511 files changed, 8182 insertions, 3319 deletions

diff --git a/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt b/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt
new file mode 100644
index 000000000000..ae8af1694e95
--- /dev/null
+++ b/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt
@@ -0,0 +1,93 @@
+Pinctrl-based I2C Bus Mux
+
+This binding describes an I2C bus multiplexer that uses pin multiplexing to
+route the I2C signals, and represents the pin multiplexing configuration
+using the pinctrl device tree bindings.
+
+                                 +-----+  +-----+
+                                 | dev |  | dev |
+    +------------------------+   +-----+  +-----+
+    | SoC                    |      |        |
+    |                   /----|------+--------+
+    |   +---+   +------+     | child bus A, on first set of pins
+    |   |I2C|---|Pinmux|     |
+    |   +---+   +------+     | child bus B, on second set of pins
+    |                   \----|------+--------+--------+
+    |                        |      |        |        |
+    +------------------------+  +-----+  +-----+  +-----+
+                                | dev |  | dev |  | dev |
+                                +-----+  +-----+  +-----+
+
+Required properties:
+- compatible: i2c-mux-pinctrl
+- i2c-parent: The phandle of the I2C bus that this multiplexer's master-side
+  port is connected to.
+
+Also required are:
+
+* Standard pinctrl properties that specify the pin mux state for each child
+  bus. See ../pinctrl/pinctrl-bindings.txt.
+
+* Standard I2C mux properties. See mux.txt in this directory.
+
+* I2C child bus nodes. See mux.txt in this directory.
+
+For each named state defined in the pinctrl-names property, an I2C child bus
+will be created. I2C child bus numbers are assigned based on the index into
+the pinctrl-names property.
+
+The only exception is that no bus will be created for a state named "idle". If
+such a state is defined, it must be the last entry in pinctrl-names. For
+example:
+
+        pinctrl-names = "ddc", "pta", "idle"  ->  ddc = bus 0, pta = bus 1
+        pinctrl-names = "ddc", "idle", "pta"  ->  Invalid ("idle" not last)
+        pinctrl-names = "idle", "ddc", "pta"  ->  Invalid ("idle" not last)
+
+Whenever an access is made to a device on a child bus, the relevant pinctrl
+state will be programmed into hardware.
+
+If an idle state is defined, whenever an access is not being made to a device
+on a child bus, the idle pinctrl state will be programmed into hardware.
+
+If an idle state is not defined, the most recently used pinctrl state will be
+left programmed into hardware whenever no access is being made of a device on
+a child bus.
+
+Example:
+
+        i2cmux {
+                compatible = "i2c-mux-pinctrl";
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                i2c-parent = <&i2c1>;
+
+                pinctrl-names = "ddc", "pta", "idle";
+                pinctrl-0 = <&state_i2cmux_ddc>;
+                pinctrl-1 = <&state_i2cmux_pta>;
+                pinctrl-2 = <&state_i2cmux_idle>;
+
+                i2c@0 {
+                        reg = <0>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        eeprom {
+                                compatible = "eeprom";
+                                reg = <0x50>;
+                        };
+                };
+
+                i2c@1 {
+                        reg = <1>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        eeprom {
+                                compatible = "eeprom";
+                                reg = <0x50>;
+                        };
+                };
+        };
+
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index c45513d806ab..a92c5ebf373e 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2543,6 +2543,15 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         sched_debug     [KNL] Enables verbose scheduler debug messages.
 
+        skew_tick=      [KNL] Offset the periodic timer tick per cpu to mitigate
+                        xtime_lock contention on larger systems, and/or RCU lock
+                        contention on all systems with CONFIG_MAXSMP set.
+                        Format: { "0" | "1" }
+                        0 -- disable. (may be 1 via CONFIG_CMDLINE="skew_tick=1"
+                        1 -- enable.
+                        Note: increases power consumption, thus should only be
+                        enabled if running jitter sensitive (HPC/RT) workloads.
+
         security=       [SECURITY] Choose a security module to enable at boot.
                         If this boot parameter is not specified, only the first
                         security module asking for security registration will be
diff --git a/Documentation/networking/stmmac.txt b/Documentation/networking/stmmac.txt
index ab1e8d7004c5..5cb9a1972460 100644
--- a/Documentation/networking/stmmac.txt
+++ b/Documentation/networking/stmmac.txt
@@ -10,8 +10,8 @@ Currently this network device driver is for all STM embedded MAC/GMAC
 (i.e. 7xxx/5xxx SoCs), SPEAr (arm), Loongson1B (mips) and XLINX XC2V3000
 FF1152AMT0221 D1215994A VIRTEX FPGA board.
 
-DWC Ether MAC 10/100/1000 Universal version 3.60a (and older) and DWC Ether MAC 10/100
-Universal version 4.0 have been used for developing this driver.
+DWC Ether MAC 10/100/1000 Universal version 3.60a (and older) and DWC Ether
+MAC 10/100 Universal version 4.0 have been used for developing this driver.
 
 This driver supports both the platform bus and PCI.
 
@@ -54,27 +54,27 @@ net_device structure enabling the scatter/gather feature.
 When one or more packets are received, an interrupt happens. The interrupts
 are not queued so the driver has to scan all the descriptors in the ring during
 the receive process.
-This is based on NAPI so the interrupt handler signals only if there is work to be
-done, and it exits.
+This is based on NAPI so the interrupt handler signals only if there is work
+to be done, and it exits.
 Then the poll method will be scheduled at some future point.
 The incoming packets are stored, by the DMA, in a list of pre-allocated socket
 buffers in order to avoid the memcpy (Zero-copy).
 
 4.3) Timer-Driver Interrupt
-Instead of having the device that asynchronously notifies the frame receptions, the
-driver configures a timer to generate an interrupt at regular intervals.
-Based on the granularity of the timer, the frames that are received by the device
-will experience different levels of latency. Some NICs have dedicated timer
-device to perform this task. STMMAC can use either the RTC device or the TMU
-channel 2  on STLinux platforms.
+Instead of having the device that asynchronously notifies the frame receptions,
+the driver configures a timer to generate an interrupt at regular intervals.
+Based on the granularity of the timer, the frames that are received by the
+device will experience different levels of latency. Some NICs have dedicated
+timer device to perform this task. STMMAC can use either the RTC device or the
+TMU channel 2  on STLinux platforms.
 The timers frequency can be passed to the driver as parameter; when change it,
 take care of both hardware capability and network stability/performance impact.
-Several performance tests on STM platforms showed this optimisation allows to spare
-the CPU while having the maximum throughput.
+Several performance tests on STM platforms showed this optimisation allows to
+spare the CPU while having the maximum throughput.
 
 4.4) WOL
-Wake up on Lan feature through Magic and Unicast frames are supported for the GMAC
-core.
+Wake up on Lan feature through Magic and Unicast frames are supported for the
+GMAC core.
 
 4.5) DMA descriptors
 Driver handles both normal and enhanced descriptors. The latter has been only
@@ -106,7 +106,8 @@ Several driver's information can be passed through the platform
 These are included in the include/linux/stmmac.h header file
 and detailed below as well:
 
- struct plat_stmmacenet_data {
+struct plat_stmmacenet_data {
+        char *phy_bus_name;
         int bus_id;
         int phy_addr;
         int interface;
@@ -124,19 +125,24 @@ and detailed below as well:
         void (*bus_setup)(void __iomem *ioaddr);
         int (*init)(struct platform_device *pdev);
         void (*exit)(struct platform_device *pdev);
+        void *custom_cfg;
+        void *custom_data;
         void *bsp_priv;
  };
 
 Where:
+ o phy_bus_name: phy bus name to attach to the stmmac.
  o bus_id: bus identifier.
  o phy_addr: the physical address can be passed from the platform.
             If it is set to -1 the driver will automatically
             detect it at run-time by probing all the 32 addresses.
  o interface: PHY device's interface.
  o mdio_bus_data: specific platform fields for the MDIO bus.
- o pbl: the Programmable Burst Length is maximum number of beats to
+ o dma_cfg: internal DMA parameters
+   o pbl: the Programmable Burst Length is maximum number of beats to
        be transferred in one DMA transaction.
        GMAC also enables the 4xPBL by default.
+   o fixed_burst/mixed_burst/burst_len
  o clk_csr: fixed CSR Clock range selection.
  o has_gmac: uses the GMAC core.
  o enh_desc: if sets the MAC will use the enhanced descriptor structure.
@@ -160,8 +166,9 @@ Where:
              this is sometime necessary on some platforms (e.g. ST boxes)
              where the HW needs to have set some PIO lines or system cfg
              registers.
- o custom_cfg: this is a custom configuration that can be passed while
-              initialising the resources.
+ o custom_cfg/custom_data: this is a custom configuration that can be passed
+                           while initialising the resources.
+ o bsp_priv: another private poiter.
 
 For MDIO bus The we have:
 
@@ -180,7 +187,6 @@ Where:
  o irqs: list of IRQs, one per PHY.
  o probed_phy_irq: if irqs is NULL, use this for probed PHY.
 
-
 For DMA engine we have the following internal fields that should be
 tuned according to the HW capabilities.
 
diff --git a/Documentation/vm/frontswap.txt b/Documentation/vm/frontswap.txt
new file mode 100644
index 000000000000..37067cf455f4
--- /dev/null
+++ b/Documentation/vm/frontswap.txt
@@ -0,0 +1,278 @@
+Frontswap provides a "transcendent memory" interface for swap pages.
+In some environments, dramatic performance savings may be obtained because
+swapped pages are saved in RAM (or a RAM-like device) instead of a swap disk.
+
+(Note, frontswap -- and cleancache (merged at 3.0) -- are the "frontends"
+and the only necessary changes to the core kernel for transcendent memory;
+all other supporting code -- the "backends" -- is implemented as drivers.
+See the LWN.net article "Transcendent memory in a nutshell" for a detailed
+overview of frontswap and related kernel parts:
+https://lwn.net/Articles/454795/ )
+
+Frontswap is so named because it can be thought of as the opposite of
+a "backing" store for a swap device.  The storage is assumed to be
+a synchronous concurrency-safe page-oriented "pseudo-RAM device" conforming
+to the requirements of transcendent memory (such as Xen's "tmem", or
+in-kernel compressed memory, aka "zcache", or future RAM-like devices);
+this pseudo-RAM device is not directly accessible or addressable by the
+kernel and is of unknown and possibly time-varying size.  The driver
+links itself to frontswap by calling frontswap_register_ops to set the
+frontswap_ops funcs appropriately and the functions it provides must
+conform to certain policies as follows:
+
+An "init" prepares the device to receive frontswap pages associated
+with the specified swap device number (aka "type").  A "store" will
+copy the page to transcendent memory and associate it with the type and
+offset associated with the page. A "load" will copy the page, if found,
+from transcendent memory into kernel memory, but will NOT remove the page
+from from transcendent memory.  An "invalidate_page" will remove the page
+from transcendent memory and an "invalidate_area" will remove ALL pages
+associated with the swap type (e.g., like swapoff) and notify the "device"
+to refuse further stores with that swap type.
+
+Once a page is successfully stored, a matching load on the page will normally
+succeed.  So when the kernel finds itself in a situation where it needs
+to swap out a page, it first attempts to use frontswap.  If the store returns
+success, the data has been successfully saved to transcendent memory and
+a disk write and, if the data is later read back, a disk read are avoided.
+If a store returns failure, transcendent memory has rejected the data, and the
+page can be written to swap as usual.
+
+If a backend chooses, frontswap can be configured as a "writethrough
+cache" by calling frontswap_writethrough().  In this mode, the reduction
+in swap device writes is lost (and also a non-trivial performance advantage)
+in order to allow the backend to arbitrarily "reclaim" space used to
+store frontswap pages to more completely manage its memory usage.
+
+Note that if a page is stored and the page already exists in transcendent memory
+(a "duplicate" store), either the store succeeds and the data is overwritten,
+or the store fails AND the page is invalidated.  This ensures stale data may
+never be obtained from frontswap.
+
+If properly configured, monitoring of frontswap is done via debugfs in
+the /sys/kernel/debug/frontswap directory.  The effectiveness of
+frontswap can be measured (across all swap devices) with:
+
+failed_stores   - how many store attempts have failed
+loads           - how many loads were attempted (all should succeed)
+succ_stores     - how many store attempts have succeeded
+invalidates     - how many invalidates were attempted
+
+A backend implementation may provide additional metrics.
+
+FAQ
+
+1) Where's the value?
+
+When a workload starts swapping, performance falls through the floor.
+Frontswap significantly increases performance in many such workloads by
+providing a clean, dynamic interface to read and write swap pages to
+"transcendent memory" that is otherwise not directly addressable to the kernel.
+This interface is ideal when data is transformed to a different form
+and size (such as with compression) or secretly moved (as might be
+useful for write-balancing for some RAM-like devices).  Swap pages (and
+evicted page-cache pages) are a great use for this kind of slower-than-RAM-
+but-much-faster-than-disk "pseudo-RAM device" and the frontswap (and
+cleancache) interface to transcendent memory provides a nice way to read
+and write -- and indirectly "name" -- the pages.
+
+Frontswap -- and cleancache -- with a fairly small impact on the kernel,
+provides a huge amount of flexibility for more dynamic, flexible RAM
+utilization in various system configurations:
+
+In the single kernel case, aka "zcache", pages are compressed and
+stored in local memory, thus increasing the total anonymous pages
+that can be safely kept in RAM.  Zcache essentially trades off CPU
+cycles used in compression/decompression for better memory utilization.
+Benchmarks have shown little or no impact when memory pressure is
+low while providing a significant performance improvement (25%+)
+on some workloads under high memory pressure.
+
+"RAMster" builds on zcache by adding "peer-to-peer" transcendent memory
+support for clustered systems.  Frontswap pages are locally compressed
+as in zcache, but then "remotified" to another system's RAM.  This
+allows RAM to be dynamically load-balanced back-and-forth as needed,
+i.e. when system A is overcommitted, it can swap to system B, and
+vice versa.  RAMster can also be configured as a memory server so
+many servers in a cluster can swap, dynamically as needed, to a single
+server configured with a large amount of RAM... without pre-configuring
+how much of the RAM is available for each of the clients!
+
+In the virtual case, the whole point of virtualization is to statistically
+multiplex physical resources acrosst the varying demands of multiple
+virtual machines.  This is really hard to do with RAM and efforts to do
+it well with no kernel changes have essentially failed (except in some
+well-publicized special-case workloads).
+Specifically, the Xen Transcendent Memory backend allows otherwise
+"fallow" hypervisor-owned RAM to not only be "time-shared" between multiple
+virtual machines, but the pages can be compressed and deduplicated to
+optimize RAM utilization.  And when guest OS's are induced to surrender
+underutilized RAM (e.g. with "selfballooning"), sudden unexpected
+memory pressure may result in swapping; frontswap allows those pages
+to be swapped to and from hypervisor RAM (if overall host system memory
+conditions allow), thus mitigating the potentially awful performance impact
+of unplanned swapping.
+
+A KVM implementation is underway and has been RFC'ed to lkml.  And,
+using frontswap, investigation is also underway on the use of NVM as
+a memory extension technology.
+
+2) Sure there may be performance advantages in some situations, but
+   what's the space/time overhead of frontswap?
+
+If CONFIG_FRONTSWAP is disabled, every frontswap hook compiles into
+nothingness and the only overhead is a few extra bytes per swapon'ed
+swap device.  If CONFIG_FRONTSWAP is enabled but no frontswap "backend"
+registers, there is one extra global variable compared to zero for
+every swap page read or written.  If CONFIG_FRONTSWAP is enabled
+AND a frontswap backend registers AND the backend fails every "store"
+request (i.e. provides no memory despite claiming it might),
+CPU overhead is still negligible -- and since every frontswap fail
+precedes a swap page write-to-disk, the system is highly likely
+to be I/O bound and using a small fraction of a percent of a CPU
+will be irrelevant anyway.
+
+As for space, if CONFIG_FRONTSWAP is enabled AND a frontswap backend
+registers, one bit is allocated for every swap page for every swap
+device that is swapon'd.  This is added to the EIGHT bits (which
+was sixteen until about 2.6.34) that the kernel already allocates
+for every swap page for every swap device that is swapon'd.  (Hugh
+Dickins has observed that frontswap could probably steal one of
+the existing eight bits, but let's worry about that minor optimization
+later.)  For very large swap disks (which are rare) on a standard
+4K pagesize, this is 1MB per 32GB swap.
+
+When swap pages are stored in transcendent memory instead of written
+out to disk, there is a side effect that this may create more memory
+pressure that can potentially outweigh the other advantages.  A
+backend, such as zcache, must implement policies to carefully (but
+dynamically) manage memory limits to ensure this doesn't happen.
+
+3) OK, how about a quick overview of what this frontswap patch does
+   in terms that a kernel hacker can grok?
+
+Let's assume that a frontswap "backend" has registered during
+kernel initialization; this registration indicates that this
+frontswap backend has access to some "memory" that is not directly
+accessible by the kernel.  Exactly how much memory it provides is
+entirely dynamic and random.
+
+Whenever a swap-device is swapon'd frontswap_init() is called,
+passing the swap device number (aka "type") as a parameter.
+This notifies frontswap to expect attempts to "store" swap pages
+associated with that number.
+
+Whenever the swap subsystem is readying a page to write to a swap
+device (c.f swap_writepage()), frontswap_store is called.  Frontswap
+consults with the frontswap backend and if the backend says it does NOT
+have room, frontswap_store returns -1 and the kernel swaps the page
+to the swap device as normal.  Note that the response from the frontswap
+backend is unpredictable to the kernel; it may choose to never accept a
+page, it could accept every ninth page, or it might accept every
+page.  But if the backend does accept a page, the data from the page
+has already been copied and associated with the type and offset,
+and the backend guarantees the persistence of the data.  In this case,
+frontswap sets a bit in the "frontswap_map" for the swap device
+corresponding to the page offset on the swap device to which it would
+otherwise have written the data.
+
+When the swap subsystem needs to swap-in a page (swap_readpage()),
+it first calls frontswap_load() which checks the frontswap_map to
+see if the page was earlier accepted by the frontswap backend.  If
+it was, the page of data is filled from the frontswap backend and
+the swap-in is complete.  If not, the normal swap-in code is
+executed to obtain the page of data from the real swap device.
+
+So every time the frontswap backend accepts a page, a swap device read
+and (potentially) a swap device write are replaced by a "frontswap backend
+store" and (possibly) a "frontswap backend loads", which are presumably much
+faster.
+
+4) Can't frontswap be configured as a "special" swap device that is
+   just higher priority than any real swap device (e.g. like zswap,
+   or maybe swap-over-nbd/NFS)?
+
+No.  First, the existing swap subsystem doesn't allow for any kind of
+swap hierarchy.  Perhaps it could be rewritten to accomodate a hierarchy,
+but this would require fairly drastic changes.  Even if it were
+rewritten, the existing swap subsystem uses the block I/O layer which
+assumes a swap device is fixed size and any page in it is linearly
+addressable.  Frontswap barely touches the existing swap subsystem,
+and works around the constraints of the block I/O subsystem to provide
+a great deal of flexibility and dynamicity.
+
+For example, the acceptance of any swap page by the frontswap backend is
+entirely unpredictable. This is critical to the definition of frontswap
+backends because it grants completely dynamic discretion to the
+backend.  In zcache, one cannot know a priori how compressible a page is.
+"Poorly" compressible pages can be rejected, and "poorly" can itself be
+defined dynamically depending on current memory constraints.
+
+Further, frontswap is entirely synchronous whereas a real swap
+device is, by definition, asynchronous and uses block I/O.  The
+block I/O layer is not only unnecessary, but may perform "optimizations"
+that are inappropriate for a RAM-oriented device including delaying
+the write of some pages for a significant amount of time.  Synchrony is
+required to ensure the dynamicity of the backend and to avoid thorny race
+conditions that would unnecessarily and greatly complicate frontswap
+and/or the block I/O subsystem.  That said, only the initial "store"
+and "load" operations need be synchronous.  A separate asynchronous thread
+is free to manipulate the pages stored by frontswap.  For example,
+the "remotification" thread in RAMster uses standard asynchronous
+kernel sockets to move compressed frontswap pages to a remote machine.
+Similarly, a KVM guest-side implementation could do in-guest compression
+and use "batched" hypercalls.
+
+In a virtualized environment, the dynamicity allows the hypervisor
+(or host OS) to do "intelligent overcommit".  For example, it can
+choose to accept pages only until host-swapping might be imminent,
+then force guests to do their own swapping.
+
+There is a downside to the transcendent memory specifications for
+frontswap:  Since any "store" might fail, there must always be a real
+slot on a real swap device to swap the page.  Thus frontswap must be
+implemented as a "shadow" to every swapon'd device with the potential
+capability of holding every page that the swap device might have held
+and the possibility that it might hold no pages at all.  This means
+that frontswap cannot contain more pages than the total of swapon'd
+swap devices.  For example, if NO swap device is configured on some
+installation, frontswap is useless.  Swapless portable devices
+can still use frontswap but a backend for such devices must configure
+some kind of "ghost" swap device and ensure that it is never used.
+
+5) Why this weird definition about "duplicate stores"?  If a page
+   has been previously successfully stored, can't it always be
+   successfully overwritten?
+
+Nearly always it can, but no, sometimes it cannot.  Consider an example
+where data is compressed and the original 4K page has been compressed
+to 1K.  Now an attempt is made to overwrite the page with data that
+is non-compressible and so would take the entire 4K.  But the backend
+has no more space.  In this case, the store must be rejected.  Whenever
+frontswap rejects a store that would overwrite, it also must invalidate
+the old data and ensure that it is no longer accessible.  Since the
+swap subsystem then writes the new data to the read swap device,
+this is the correct course of action to ensure coherency.
+
+6) What is frontswap_shrink for?
+
+When the (non-frontswap) swap subsystem swaps out a page to a real
+swap device, that page is only taking up low-value pre-allocated disk
+space.  But if frontswap has placed a page in transcendent memory, that
+page may be taking up valuable real estate.  The frontswap_shrink
+routine allows code outside of the swap subsystem to force pages out
+of the memory managed by frontswap and back into kernel-addressable memory.
+For example, in RAMster, a "suction driver" thread will attempt
+to "repatriate" pages sent to a remote machine back to the local machine;
+this is driven using the frontswap_shrink mechanism when memory pressure
+subsides.
+
+7) Why does the frontswap patch create the new include file swapfile.h?
+
+The frontswap code depends on some swap-subsystem-internal data
+structures that have, over the years, moved back and forth between
+static and global.  This seemed a reasonable compromise:  Define
+them as global but declare them in a new include file that isn't
+included by the large number of source files that include swap.h.
+
+Dan Magenheimer, last updated April 9, 2012
diff --git a/MAINTAINERS b/MAINTAINERS
index 55f0fda602ec..3e30a3afe2a4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1077,7 +1077,7 @@ F:	drivers/media/video/s5p-fimc/
 ARM/SAMSUNG S5P SERIES Multi Format Codec (MFC) SUPPORT
 M:      Kyungmin Park <kyungmin.park@samsung.com>
 M:      Kamil Debski <k.debski@samsung.com>
-M:     Jeongtae Park <jtp.park@samsung.com>
+M:      Jeongtae Park <jtp.park@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org
 L:      linux-media@vger.kernel.org
 S:      Maintained
@@ -1646,11 +1646,11 @@ S:	Maintained
 F:      drivers/gpio/gpio-bt8xx.c
 
 BTRFS FILE SYSTEM
-M:      Chris Mason <chris.mason@oracle.com>
+M:      Chris Mason <chris.mason@fusionio.com>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs.git
 S:      Maintained
 F:      Documentation/filesystems/btrfs.txt
 F:      fs/btrfs/
@@ -1743,10 +1743,10 @@ F:	include/linux/can/platform/
 CAPABILITIES
 M:      Serge Hallyn <serge.hallyn@canonical.com>
 L:      linux-security-module@vger.kernel.org
-S:      Supported       
+S:      Supported
 F:      include/linux/capability.h
 F:      security/capability.c
-F:      security/commoncap.c 
+F:      security/commoncap.c
 F:      kernel/capability.c
 
 CELL BROADBAND ENGINE ARCHITECTURE
@@ -1800,6 +1800,9 @@ F:	include/linux/cfag12864b.h
 CFG80211 and NL80211
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      include/linux/nl80211.h
 F:      include/net/cfg80211.h
@@ -2146,11 +2149,11 @@ S:	Orphan
 F:      drivers/net/wan/pc300*
 
 CYTTSP TOUCHSCREEN DRIVER
-M:      Javier Martinez Canillas <javier@dowhile0.org>
-L:      linux-input@vger.kernel.org
-S:      Maintained
-F:      drivers/input/touchscreen/cyttsp*
-F:      include/linux/input/cyttsp.h
+M:      Javier Martinez Canillas <javier@dowhile0.org>
+L:      linux-input@vger.kernel.org
+S:      Maintained
+F:      drivers/input/touchscreen/cyttsp*
+F:      include/linux/input/cyttsp.h
 
 DAMA SLAVE for AX.25
 M:      Joerg Reuter <jreuter@yaina.de>
@@ -2270,7 +2273,7 @@ F:	include/linux/device-mapper.h
 F:      include/linux/dm-*.h
 
 DIOLAN U2C-12 I2C DRIVER
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/busses/i2c-diolan-u2c.c
@@ -2930,6 +2933,13 @@ F:	Documentation/power/freezing-of-tasks.txt
 F:      include/linux/freezer.h
 F:      kernel/freezer.c
 
+FRONTSWAP API
+M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      mm/frontswap.c
+F:      include/linux/frontswap.h
+
 FS-CACHE: LOCAL CACHING FOR NETWORK FILESYSTEMS
 M:      David Howells <dhowells@redhat.com>
 L:      linux-cachefs@redhat.com
@@ -3138,7 +3148,7 @@ F:	drivers/tty/hvc/
 
 HARDWARE MONITORING
 M:      Jean Delvare <khali@linux-fr.org>
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
 T:      quilt kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-hwmon/
@@ -4096,6 +4106,8 @@ F:	drivers/scsi/53c700*
 LED SUBSYSTEM
 M:      Bryan Wu <bryan.wu@canonical.com>
 M:      Richard Purdie <rpurdie@rpsys.net>
+L:      linux-leds@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds.git
 S:      Maintained
 F:      drivers/leds/
 F:      include/linux/leds.h
@@ -4340,7 +4352,8 @@ MAC80211
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
 W:      http://linuxwireless.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      Documentation/networking/mac80211-injection.txt
 F:      include/net/mac80211.h
@@ -4351,7 +4364,8 @@ M:	Stefano Brivio <stefano.brivio@polimi.it>
 M:      Mattias Nissler <mattias.nissler@gmx.de>
 L:      linux-wireless@vger.kernel.org
 W:      http://linuxwireless.org/en/developers/Documentation/mac80211/RateControl/PID
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      net/mac80211/rc80211_pid*
 
@@ -4411,6 +4425,13 @@ S:	Orphan
 F:      drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
 
+MAX16065 HARDWARE MONITOR DRIVER
+M:      Guenter Roeck <linux@roeck-us.net>
+L:      lm-sensors@lm-sensors.org
+S:      Maintained
+F:      Documentation/hwmon/max16065
+F:      drivers/hwmon/max16065.c
+
 MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M:      "Hans J. Koch" <hjk@hansjkoch.de>
 L:      lm-sensors@lm-sensors.org
@@ -5149,7 +5170,7 @@ F:	drivers/leds/leds-pca9532.c
 F:      include/linux/leds-pca9532.h
 
 PCA9541 I2C BUS MASTER SELECTOR DRIVER
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/muxes/i2c-mux-pca9541.c
@@ -5169,7 +5190,7 @@ S:	Maintained
 F:      drivers/firmware/pcdp.*
 
 PCI ERROR RECOVERY
-M:     Linas Vepstas <linasvepstas@gmail.com>
+M:      Linas Vepstas <linasvepstas@gmail.com>
 L:      linux-pci@vger.kernel.org
 S:      Supported
 F:      Documentation/PCI/pci-error-recovery.txt
@@ -5299,7 +5320,7 @@ F:	drivers/video/fb-puv3.c
 F:      drivers/rtc/rtc-puv3.c
 
 PMBUS HARDWARE MONITORING DRIVERS
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
 W:      http://www.roeck-us.net/linux/drivers/
@@ -5695,6 +5716,9 @@ F:	include/linux/remoteproc.h
 RFKILL
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      Documentation/rfkill.txt
 F:      net/rfkill/
@@ -7291,11 +7315,11 @@ F:	Documentation/DocBook/uio-howto.tmpl
 F:      drivers/uio/
 F:      include/linux/uio*.h
 
-UTIL-LINUX-NG PACKAGE
+UTIL-LINUX PACKAGE
 M:      Karel Zak <kzak@redhat.com>
-L:      util-linux-ng@vger.kernel.org
-W:      http://kernel.org/~kzak/util-linux-ng/
-T:      git git://git.kernel.org/pub/scm/utils/util-linux-ng/util-linux-ng.git
+L:      util-linux@vger.kernel.org
+W:      http://en.wikipedia.org/wiki/Util-linux
+T:      git git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
 S:      Maintained
 
 UVESAFB DRIVER
diff --git a/Makefile b/Makefile
index 0d718ede9ea5..b771af583389 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 5
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 567b4323c9e6..b1b27525b24d 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -7,7 +7,6 @@ config ARM
         select HAVE_IDE if PCI || ISA || PCMCIA
         select HAVE_DMA_ATTRS
         select HAVE_DMA_CONTIGUOUS if (CPU_V6 || CPU_V6K || CPU_V7)
-        select CMA if (CPU_V6 || CPU_V6K || CPU_V7)
         select HAVE_MEMBLOCK
         select RTC_LIB
         select SYS_SUPPORTS_APM_EMULATION
diff --git a/arch/arm/common/dmabounce.c b/arch/arm/common/dmabounce.c
index 9d7eb530f95f..aa07f5938f05 100644
--- a/arch/arm/common/dmabounce.c
+++ b/arch/arm/common/dmabounce.c
@@ -366,8 +366,8 @@ static int __dmabounce_sync_for_cpu(struct device *dev, dma_addr_t addr,
         struct safe_buffer *buf;
         unsigned long off;
 
-        dev_dbg(dev, "%s(dma=%#x,off=%#lx,sz=%zx,dir=%x)\n",
-                __func__, addr, off, sz, dir);
+        dev_dbg(dev, "%s(dma=%#x,sz=%zx,dir=%x)\n",
+                __func__, addr, sz, dir);
 
         buf = find_safe_buffer_dev(dev, addr, __func__);
         if (!buf)
@@ -377,8 +377,8 @@ static int __dmabounce_sync_for_cpu(struct device *dev, dma_addr_t addr,
 
         BUG_ON(buf->direction != dir);
 
-        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x) mapped to %p (dma=%#x)\n",
-                __func__, buf->ptr, virt_to_dma(dev, buf->ptr),
+        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x off=%#lx) mapped to %p (dma=%#x)\n",
+                __func__, buf->ptr, virt_to_dma(dev, buf->ptr), off,
                 buf->safe, buf->safe_dma_addr);
 
         DO_STATS(dev->archdata.dmabounce->bounce_count++);
@@ -406,8 +406,8 @@ static int __dmabounce_sync_for_device(struct device *dev, dma_addr_t addr,
         struct safe_buffer *buf;
         unsigned long off;
 
-        dev_dbg(dev, "%s(dma=%#x,off=%#lx,sz=%zx,dir=%x)\n",
-                __func__, addr, off, sz, dir);
+        dev_dbg(dev, "%s(dma=%#x,sz=%zx,dir=%x)\n",
+                __func__, addr, sz, dir);
 
         buf = find_safe_buffer_dev(dev, addr, __func__);
         if (!buf)
@@ -417,8 +417,8 @@ static int __dmabounce_sync_for_device(struct device *dev, dma_addr_t addr,
 
         BUG_ON(buf->direction != dir);
 
-        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x) mapped to %p (dma=%#x)\n",
-                __func__, buf->ptr, virt_to_dma(dev, buf->ptr),
+        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x off=%#lx) mapped to %p (dma=%#x)\n",
+                __func__, buf->ptr, virt_to_dma(dev, buf->ptr), off,
                 buf->safe, buf->safe_dma_addr);
 
         DO_STATS(dev->archdata.dmabounce->bounce_count++);
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index 54d49ddb9b81..5fb47a14f4ba 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -271,9 +271,9 @@ static struct platform_device *create_simple_dss_pdev(const char *pdev_name,
                 goto err;
         }
 
-        r = omap_device_register(pdev);
+        r = platform_device_add(pdev);
         if (r) {
-                pr_err("Could not register omap_device for %s\n", pdev_name);
+                pr_err("Could not register platform_device for %s\n", pdev_name);
                 goto err;
         }
 
diff --git a/arch/arm/mach-shmobile/Kconfig b/arch/arm/mach-shmobile/Kconfig
index f31383c32f9c..df33909205e2 100644
--- a/arch/arm/mach-shmobile/Kconfig
+++ b/arch/arm/mach-shmobile/Kconfig
@@ -186,6 +186,12 @@ config SH_TIMER_TMU
         help
           This enables build of the TMU timer driver.
 
+config EM_TIMER_STI
+        bool "STI timer driver"
+        default y
+        help
+          This enables build of the STI timer driver.
+
 endmenu
 
 config SH_CLK_CPG
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index ea6b43154090..d766e4256b74 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -228,7 +228,7 @@ static pte_t **consistent_pte;
 
 #define DEFAULT_CONSISTENT_DMA_SIZE SZ_2M
 
-unsigned long consistent_base = CONSISTENT_END - DEFAULT_CONSISTENT_DMA_SIZE;
+static unsigned long consistent_base = CONSISTENT_END - DEFAULT_CONSISTENT_DMA_SIZE;
 
 void __init init_consistent_dma_size(unsigned long size)
 {
@@ -268,10 +268,8 @@ static int __init consistent_init(void)
         unsigned long base = consistent_base;
         unsigned long num_ptes = (CONSISTENT_END - base) >> PMD_SHIFT;
 
-#ifndef CONFIG_ARM_DMA_USE_IOMMU
-        if (cpu_architecture() >= CPU_ARCH_ARMv6)
+        if (IS_ENABLED(CONFIG_CMA) && !IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU))
                 return 0;
-#endif
 
         consistent_pte = kmalloc(num_ptes * sizeof(pte_t), GFP_KERNEL);
         if (!consistent_pte) {
@@ -323,7 +321,7 @@ static struct arm_vmregion_head coherent_head = {
         .vm_list        = LIST_HEAD_INIT(coherent_head.vm_list),
 };
 
-size_t coherent_pool_size = DEFAULT_CONSISTENT_DMA_SIZE / 8;
+static size_t coherent_pool_size = DEFAULT_CONSISTENT_DMA_SIZE / 8;
 
 static int __init early_coherent_pool(char *p)
 {
@@ -342,7 +340,7 @@ static int __init coherent_init(void)
         struct page *page;
         void *ptr;
 
-        if (cpu_architecture() < CPU_ARCH_ARMv6)
+        if (!IS_ENABLED(CONFIG_CMA))
                 return 0;
 
         ptr = __alloc_from_contiguous(NULL, size, prot, &page);
@@ -704,7 +702,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
 
         if (arch_is_coherent() || nommu())
                 addr = __alloc_simple_buffer(dev, size, gfp, &page);
-        else if (cpu_architecture() < CPU_ARCH_ARMv6)
+        else if (!IS_ENABLED(CONFIG_CMA))
                 addr = __alloc_remap_buffer(dev, size, gfp, prot, &page, caller);
         else if (gfp & GFP_ATOMIC)
                 addr = __alloc_from_pool(dev, size, &page, caller);
@@ -773,7 +771,7 @@ void arm_dma_free(struct device *dev, size_t size, void *cpu_addr,
 
         if (arch_is_coherent() || nommu()) {
                 __dma_free_buffer(page, size);
-        } else if (cpu_architecture() < CPU_ARCH_ARMv6) {
+        } else if (!IS_ENABLED(CONFIG_CMA)) {
                 __dma_free_remap(cpu_addr, size);
                 __dma_free_buffer(page, size);
         } else {
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c21d06c7dd7e..f54d59219764 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -212,7 +212,7 @@ EXPORT_SYMBOL(arm_dma_zone_size);
  * allocations.  This must be the smallest DMA mask in the system,
  * so a successful GFP_DMA allocation will always satisfy this.
  */
-u32 arm_dma_limit;
+phys_addr_t arm_dma_limit;
 
 static void __init arm_adjust_dma_zone(unsigned long *size, unsigned long *hole,
         unsigned long dma_size)
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index 93dc0c17cdcb..c471436c7952 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -62,7 +62,7 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
 #endif
 
 #ifdef CONFIG_ZONE_DMA
-extern u32 arm_dma_limit;
+extern phys_addr_t arm_dma_limit;
 #else
 #define arm_dma_limit ((u32)~0)
 #endif
diff --git a/arch/avr32/kernel/signal.c b/arch/avr32/kernel/signal.c
index c140f9b41dce..d552a854dacc 100644
--- a/arch/avr32/kernel/signal.c
+++ b/arch/avr32/kernel/signal.c
@@ -300,7 +300,7 @@ asmlinkage void do_notify_resume(struct pt_regs *regs, struct thread_info *ti)
         if ((sysreg_read(SR) & MODE_MASK) == MODE_SUPERVISOR)
                 syscall = 1;
 
-        if (ti->flags & _TIF_SIGPENDING))
+        if (ti->flags & _TIF_SIGPENDING)
                 do_signal(regs, syscall);
 
         if (ti->flags & _TIF_NOTIFY_RESUME) {
diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 2e3994b20169..62bcea7dcc6d 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -173,7 +173,7 @@ asmlinkage int bfin_clone(struct pt_regs *regs)
         unsigned long newsp;
 
 #ifdef __ARCH_SYNC_CORE_DCACHE
-        if (current->rt.nr_cpus_allowed == num_possible_cpus())
+        if (current->nr_cpus_allowed == num_possible_cpus())
                 set_cpus_allowed_ptr(current, cpumask_of(smp_processor_id()));
 #endif
 
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index cac5b6be572a..147120128260 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -7,6 +7,8 @@ config M68K
         select GENERIC_IRQ_SHOW
         select ARCH_HAVE_NMI_SAFE_CMPXCHG if RMW_INSNS
         select GENERIC_CPU_DEVICES
+        select GENERIC_STRNCPY_FROM_USER if MMU
+        select GENERIC_STRNLEN_USER if MMU
         select FPU if MMU
         select ARCH_USES_GETTIMEOFFSET if MMU && !COLDFIRE
 
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 1a922fad76f7..eafa2539a8ee 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,2 +1,4 @@
 include include/asm-generic/Kbuild.asm
 header-y += cachectl.h
+
+generic-y += word-at-a-time.h
diff --git a/arch/m68k/include/asm/m528xsim.h b/arch/m68k/include/asm/m528xsim.h
index d63b99ff7ff7..497c31c803ff 100644
--- a/arch/m68k/include/asm/m528xsim.h
+++ b/arch/m68k/include/asm/m528xsim.h
@@ -86,7 +86,7 @@
 /*
  *      QSPI module.
  */
-#define MCFQSPI_IOBASE          (MCF_IPSBAR + 0x340)
+#define MCFQSPI_BASE            (MCF_IPSBAR + 0x340)
 #define MCFQSPI_SIZE            0x40
 
 #define MCFQSPI_CS0             147
diff --git a/arch/m68k/include/asm/uaccess_mm.h b/arch/m68k/include/asm/uaccess_mm.h
index 9c80cd515b20..472c891a4aee 100644
--- a/arch/m68k/include/asm/uaccess_mm.h
+++ b/arch/m68k/include/asm/uaccess_mm.h
@@ -379,12 +379,15 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
 #define copy_from_user(to, from, n)     __copy_from_user(to, from, n)
 #define copy_to_user(to, from, n)       __copy_to_user(to, from, n)
 
-long strncpy_from_user(char *dst, const char __user *src, long count);
-long strnlen_user(const char __user *src, long n);
+#define user_addr_max() \
+        (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL)
+
+extern long strncpy_from_user(char *dst, const char __user *src, long count);
+extern __must_check long strlen_user(const char __user *str);
+extern __must_check long strnlen_user(const char __user *str, long n);
+
 unsigned long __clear_user(void __user *to, unsigned long n);
 
 #define clear_user      __clear_user
 
-#define strlen_user(str) strnlen_user(str, 32767)
-
 #endif /* _M68K_UACCESS_H */
diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c
index 8b4a2222e658..1bc10e62b9af 100644
--- a/arch/m68k/kernel/ptrace.c
+++ b/arch/m68k/kernel/ptrace.c
@@ -286,7 +286,7 @@ asmlinkage void syscall_trace(void)
         }
 }
 
-#ifdef CONFIG_COLDFIRE
+#if defined(CONFIG_COLDFIRE) || !defined(CONFIG_MMU)
 asmlinkage int syscall_trace_enter(void)
 {
         int ret = 0;
diff --git a/arch/m68k/kernel/time.c b/arch/m68k/kernel/time.c
index d7deb7fc7eb5..707f0573ec6b 100644
--- a/arch/m68k/kernel/time.c
+++ b/arch/m68k/kernel/time.c
@@ -85,7 +85,7 @@ void __init time_init(void)
         mach_sched_init(timer_interrupt);
 }
 
-#ifdef CONFIG_M68KCLASSIC
+#ifdef CONFIG_ARCH_USES_GETTIMEOFFSET
 
 u32 arch_gettimeoffset(void)
 {
@@ -108,4 +108,4 @@ static int __init rtc_init(void)
 
 module_init(rtc_init);
 
-#endif /* CONFIG_M68KCLASSIC */
+#endif /* CONFIG_ARCH_USES_GETTIMEOFFSET */
diff --git a/arch/m68k/lib/uaccess.c b/arch/m68k/lib/uaccess.c
index 5664386338da..5e97f2ee7c11 100644
--- a/arch/m68k/lib/uaccess.c
+++ b/arch/m68k/lib/uaccess.c
@@ -104,80 +104,6 @@ unsigned long __generic_copy_to_user(void __user *to, const void *from,
 EXPORT_SYMBOL(__generic_copy_to_user);
 
 /*
- * Copy a null terminated string from userspace.
- */
-long strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res;
-        char c;
-
-        if (count <= 0)
-                return count;
-
-        asm volatile ("\n"
-                "1:     "MOVES".b       (%2)+,%4\n"
-                "       move.b  %4,(%1)+\n"
-                "       jeq     2f\n"
-                "       subq.l  #1,%3\n"
-                "       jne     1b\n"
-                "2:     sub.l   %3,%0\n"
-                "3:\n"
-                "       .section .fixup,\"ax\"\n"
-                "       .even\n"
-                "10:    move.l  %5,%0\n"
-                "       jra     3b\n"
-                "       .previous\n"
-                "\n"
-                "       .section __ex_table,\"a\"\n"
-                "       .align  4\n"
-                "       .long   1b,10b\n"
-                "       .previous"
-                : "=d" (res), "+a" (dst), "+a" (src), "+r" (count), "=&d" (c)
-                : "i" (-EFAULT), "0" (count));
-
-        return res;
-}
-EXPORT_SYMBOL(strncpy_from_user);
-
-/*
- * Return the size of a string (including the ending 0)
- *
- * Return 0 on exception, a value greater than N if too long
- */
-long strnlen_user(const char __user *src, long n)
-{
-        char c;
-        long res;
-
-        asm volatile ("\n"
-                "1:     subq.l  #1,%1\n"
-                "       jmi     3f\n"
-                "2:     "MOVES".b       (%0)+,%2\n"
-                "       tst.b   %2\n"
-                "       jne     1b\n"
-                "       jra     4f\n"
-                "\n"
-                "3:     addq.l  #1,%0\n"
-                "4:     sub.l   %4,%0\n"
-                "5:\n"
-                "       .section .fixup,\"ax\"\n"
-                "       .even\n"
-                "20:    sub.l   %0,%0\n"
-                "       jra     5b\n"
-                "       .previous\n"
-                "\n"
-                "       .section __ex_table,\"a\"\n"
-                "       .align  4\n"
-                "       .long   2b,20b\n"
-                "       .previous\n"
-                : "=&a" (res), "+d" (n), "=&d" (c)
-                : "0" (src), "r" (src));
-
-        return res;
-}
-EXPORT_SYMBOL(strnlen_user);
-
-/*
  * Zero Userspace
  */
 
diff --git a/arch/m68k/platform/68328/timers.c b/arch/m68k/platform/68328/timers.c
index c801c172b822..f4dc9b295609 100644
--- a/arch/m68k/platform/68328/timers.c
+++ b/arch/m68k/platform/68328/timers.c
@@ -53,6 +53,7 @@
 #endif
 
 static u32 m68328_tick_cnt;
+static irq_handler_t timer_interrupt;
 
 /***************************************************************************/
 
@@ -62,7 +63,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
         TSTAT &= 0;
 
         m68328_tick_cnt += TICKS_PER_JIFFY;
-        return arch_timer_interrupt(irq, dummy);
+        return timer_interrupt(irq, dummy);
 }
 
 /***************************************************************************/
@@ -99,7 +100,7 @@ static struct clocksource m68328_clk = {
 
 /***************************************************************************/
 
-void hw_timer_init(void)
+void hw_timer_init(irq_handler_t handler)
 {
         /* disable timer 1 */
         TCTL = 0;
@@ -115,6 +116,7 @@ void hw_timer_init(void)
         /* Enable timer 1 */
         TCTL |= TCTL_TEN;
         clocksource_register_hz(&m68328_clk, TICKS_PER_JIFFY*HZ);
+        timer_interrupt = handler;
 }
 
 /***************************************************************************/
diff --git a/arch/m68k/platform/68360/config.c b/arch/m68k/platform/68360/config.c
index 255fc03913e9..9877cefad1e7 100644
--- a/arch/m68k/platform/68360/config.c
+++ b/arch/m68k/platform/68360/config.c
@@ -35,6 +35,7 @@ extern void m360_cpm_reset(void);
 #define OSCILLATOR  (unsigned long int)33000000
 #endif
 
+static irq_handler_t timer_interrupt;
 unsigned long int system_clock;
 
 extern QUICC *pquicc;
@@ -52,7 +53,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
 
   pquicc->timer_ter1 = 0x0002; /* clear timer event */
 
-  return arch_timer_interrupt(irq, dummy);
+  return timer_interrupt(irq, dummy);
 }
 
 static struct irqaction m68360_timer_irq = {
@@ -61,7 +62,7 @@ static struct irqaction m68360_timer_irq = {
         .handler = hw_tick,
 };
 
-void hw_timer_init(void)
+void hw_timer_init(irq_handler_t handler)
 {
   unsigned char prescaler;
   unsigned short tgcr_save;
@@ -94,6 +95,8 @@ void hw_timer_init(void)
 
   pquicc->timer_ter1 = 0x0003; /* clear timer events */
 
+  timer_interrupt = handler;
+
   /* enable timer 1 interrupt in CIMR */
   setup_irq(CPMVEC_TIMER1, &m68360_timer_irq);
 
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index dbc3850b1d0d..5707f1a62341 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -21,6 +21,7 @@ KBUILD_DEFCONFIG := default_defconfig
 
 NM              = sh $(srctree)/arch/parisc/nm
 CHECKFLAGS      += -D__hppa__=1
+LIBGCC          = $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
 
 MACHINE         := $(shell uname -m)
 ifeq ($(MACHINE),parisc*)
@@ -79,7 +80,7 @@ kernel-y			:= mm/ kernel/ math-emu/
 kernel-$(CONFIG_HPUX)           += hpux/
 
 core-y  += $(addprefix arch/parisc/, $(kernel-y))
-libs-y  += arch/parisc/lib/ `$(CC) -print-libgcc-file-name`
+libs-y  += arch/parisc/lib/ $(LIBGCC)
 
 drivers-$(CONFIG_OPROFILE)              += arch/parisc/oprofile/
 
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index 19a434f55059..4383707d9801 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -1,3 +1,4 @@
 include include/asm-generic/Kbuild.asm
 
 header-y += pdc.h
+generic-y += word-at-a-time.h
diff --git a/arch/parisc/include/asm/bug.h b/arch/parisc/include/asm/bug.h
index 72cfdb0cfdd1..62a33338549c 100644
--- a/arch/parisc/include/asm/bug.h
+++ b/arch/parisc/include/asm/bug.h
@@ -1,6 +1,8 @@
 #ifndef _PARISC_BUG_H
 #define _PARISC_BUG_H
 
+#include <linux/kernel.h>       /* for BUGFLAG_TAINT */
+
 /*
  * Tell the user there is some problem.
  * The offending file and line are encoded in the __bug_table section.
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index c9aac24b02e2..32b394f3b854 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -100,6 +100,9 @@ static inline void hard_irq_disable(void)
         get_paca()->irq_happened |= PACA_IRQ_HARD_DIS;
 }
 
+/* include/linux/interrupt.h needs hard_irq_disable to be a macro */
+#define hard_irq_disable        hard_irq_disable
+
 /*
  * This is called by asynchronous interrupts to conditionally
  * re-enable hard interrupts when soft-disabled after having
diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
index 0b6d79617d7b..2e3200ca485f 100644
--- a/arch/powerpc/kernel/module_32.c
+++ b/arch/powerpc/kernel/module_32.c
@@ -176,8 +176,8 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
 
 static inline int entry_matches(struct ppc_plt_entry *entry, Elf32_Addr val)
 {
-        if (entry->jump[0] == 0x3d600000 + ((val + 0x8000) >> 16)
-            && entry->jump[1] == 0x396b0000 + (val & 0xffff))
+        if (entry->jump[0] == 0x3d800000 + ((val + 0x8000) >> 16)
+            && entry->jump[1] == 0x398c0000 + (val & 0xffff))
                 return 1;
         return 0;
 }
@@ -204,10 +204,9 @@ static uint32_t do_plt_call(void *location,
                 entry++;
         }
 
-        /* Stolen from Paul Mackerras as well... */
-        entry->jump[0] = 0x3d600000+((val+0x8000)>>16); /* lis r11,sym@ha */
-        entry->jump[1] = 0x396b0000 + (val&0xffff);     /* addi r11,r11,sym@l*/
-        entry->jump[2] = 0x7d6903a6;                    /* mtctr r11 */
+        entry->jump[0] = 0x3d800000+((val+0x8000)>>16); /* lis r12,sym@ha */
+        entry->jump[1] = 0x398c0000 + (val&0xffff);     /* addi r12,r12,sym@l*/
+        entry->jump[2] = 0x7d8903a6;                    /* mtctr r12 */
         entry->jump[3] = 0x4e800420;                    /* bctr */
 
         DEBUGP("Initialized plt for 0x%x at %p\n", val, entry);
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 99a995c2a3f2..be171ee73bf8 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -475,6 +475,7 @@ void timer_interrupt(struct pt_regs * regs)
         struct pt_regs *old_regs;
         u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
         struct clock_event_device *evt = &__get_cpu_var(decrementers);
+        u64 now;
 
         /* Ensure a positive value is written to the decrementer, or else
          * some CPUs will continue to take decrementer exceptions.
@@ -509,9 +510,16 @@ void timer_interrupt(struct pt_regs * regs)
                 irq_work_run();
         }
 
-        *next_tb = ~(u64)0;
-        if (evt->event_handler)
-                evt->event_handler(evt);
+        now = get_tb_or_rtc();
+        if (now >= *next_tb) {
+                *next_tb = ~(u64)0;
+                if (evt->event_handler)
+                        evt->event_handler(evt);
+        } else {
+                now = *next_tb - now;
+                if (now <= DECREMENTER_MAX)
+                        set_dec((int)now);
+        }
 
 #ifdef CONFIG_PPC64
         /* collect purr register values often, for accurate calculations */
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 99bcd0ee838d..31d9db7913e4 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -32,6 +32,8 @@ config SUPERH
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_CLOCKEVENTS
         select GENERIC_CMOS_UPDATE if SH_SH03 || SH_DREAMCAST
+        select GENERIC_STRNCPY_FROM_USER
+        select GENERIC_STRNLEN_USER
         help
           The SuperH is a RISC processor targeted for use in embedded systems
           and consumer electronics; it was also used in the Sega Dreamcast
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 46edf070da1c..aed701c7b11b 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -9,6 +9,12 @@
 # License.  See the file "COPYING" in the main directory of this archive
 # for more details.
 #
+ifneq ($(SUBARCH),$(ARCH))
+  ifeq ($(CROSS_COMPILE),)
+    CROSS_COMPILE := $(call cc-cross-prefix, $(UTS_MACHINE)-linux-  $(UTS_MACHINE)-linux-gnu-  $(UTS_MACHINE)-unknown-linux-gnu-)
+  endif
+endif
+
 isa-y                                   := any
 isa-$(CONFIG_SH_DSP)                    := sh
 isa-$(CONFIG_CPU_SH2)                   := sh2
@@ -106,19 +112,13 @@ LDFLAGS_vmlinux		+= --defsym phys_stext=_stext-$(CONFIG_PAGE_OFFSET) \
 KBUILD_DEFCONFIG        := cayman_defconfig
 endif
 
-ifneq ($(SUBARCH),$(ARCH))
-  ifeq ($(CROSS_COMPILE),)
-    CROSS_COMPILE := $(call cc-cross-prefix, $(UTS_MACHINE)-linux-  $(UTS_MACHINE)-linux-gnu-  $(UTS_MACHINE)-unknown-linux-gnu-)
-  endif
-endif
-
 ifdef CONFIG_CPU_LITTLE_ENDIAN
 ld-bfd                  := elf32-$(UTS_MACHINE)-linux
-LDFLAGS_vmlinux         += --defsym 'jiffies=jiffies_64' --oformat $(ld-bfd)
+LDFLAGS_vmlinux         += --defsym jiffies=jiffies_64 --oformat $(ld-bfd)
 LDFLAGS                 += -EL
 else
 ld-bfd                  := elf32-$(UTS_MACHINE)big-linux
-LDFLAGS_vmlinux         += --defsym 'jiffies=jiffies_64+4' --oformat $(ld-bfd)
+LDFLAGS_vmlinux         += --defsym jiffies=jiffies_64+4 --oformat $(ld-bfd)
 LDFLAGS                 += -EB
 endif
 
diff --git a/arch/sh/include/asm/Kbuild b/arch/sh/include/asm/Kbuild
index 7beb42322f60..7b673ddcd555 100644
--- a/arch/sh/include/asm/Kbuild
+++ b/arch/sh/include/asm/Kbuild
@@ -1,5 +1,39 @@
 include include/asm-generic/Kbuild.asm
 
+generic-y += bitsperlong.h
+generic-y += cputime.h
+generic-y += current.h
+generic-y += delay.h
+generic-y += div64.h
+generic-y += emergency-restart.h
+generic-y += errno.h
+generic-y += fcntl.h
+generic-y += ioctl.h
+generic-y += ipcbuf.h
+generic-y += irq_regs.h
+generic-y += kvm_para.h
+generic-y += local.h
+generic-y += local64.h
+generic-y += param.h
+generic-y += parport.h
+generic-y += percpu.h
+generic-y += poll.h
+generic-y += mman.h
+generic-y += msgbuf.h
+generic-y += resource.h
+generic-y += scatterlist.h
+generic-y += sembuf.h
+generic-y += serial.h
+generic-y += shmbuf.h
+generic-y += siginfo.h
+generic-y += sizes.h
+generic-y += socket.h
+generic-y += statfs.h
+generic-y += termbits.h
+generic-y += termios.h
+generic-y += ucontext.h
+generic-y += xor.h
+
 header-y += cachectl.h
 header-y += cpu-features.h
 header-y += hw_breakpoint.h
diff --git a/arch/sh/include/asm/bitsperlong.h b/arch/sh/include/asm/bitsperlong.h
deleted file mode 100644
index 6dc0bb0c13b2..000000000000
--- a/arch/sh/include/asm/bitsperlong.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/bitsperlong.h>
diff --git a/arch/sh/include/asm/cputime.h b/arch/sh/include/asm/cputime.h
deleted file mode 100644
index 6ca395d1393e..000000000000
--- a/arch/sh/include/asm/cputime.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __SH_CPUTIME_H
-#define __SH_CPUTIME_H
-
-#include <asm-generic/cputime.h>
-
-#endif /* __SH_CPUTIME_H */
diff --git a/arch/sh/include/asm/current.h b/arch/sh/include/asm/current.h
deleted file mode 100644
index 4c51401b5537..000000000000
--- a/arch/sh/include/asm/current.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/current.h>
diff --git a/arch/sh/include/asm/delay.h b/arch/sh/include/asm/delay.h
deleted file mode 100644
index 9670e127b7b2..000000000000
--- a/arch/sh/include/asm/delay.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/delay.h>
diff --git a/arch/sh/include/asm/div64.h b/arch/sh/include/asm/div64.h
deleted file mode 100644
index 6cd978cefb28..000000000000
--- a/arch/sh/include/asm/div64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/div64.h>
diff --git a/arch/sh/include/asm/emergency-restart.h b/arch/sh/include/asm/emergency-restart.h
deleted file mode 100644
index 108d8c48e42e..000000000000
--- a/arch/sh/include/asm/emergency-restart.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _ASM_EMERGENCY_RESTART_H
-#define _ASM_EMERGENCY_RESTART_H
-
-#include <asm-generic/emergency-restart.h>
-
-#endif /* _ASM_EMERGENCY_RESTART_H */
diff --git a/arch/sh/include/asm/errno.h b/arch/sh/include/asm/errno.h
deleted file mode 100644
index 51cf6f9cebb8..000000000000
--- a/arch/sh/include/asm/errno.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_ERRNO_H
-#define __ASM_SH_ERRNO_H
-
-#include <asm-generic/errno.h>
-
-#endif /* __ASM_SH_ERRNO_H */
diff --git a/arch/sh/include/asm/fcntl.h b/arch/sh/include/asm/fcntl.h
deleted file mode 100644
index 46ab12db5739..000000000000
--- a/arch/sh/include/asm/fcntl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/fcntl.h>
diff --git a/arch/sh/include/asm/ioctl.h b/arch/sh/include/asm/ioctl.h
deleted file mode 100644
index b279fe06dfe5..000000000000
--- a/arch/sh/include/asm/ioctl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ioctl.h>
diff --git a/arch/sh/include/asm/ipcbuf.h b/arch/sh/include/asm/ipcbuf.h
deleted file mode 100644
index 84c7e51cb6d0..000000000000
--- a/arch/sh/include/asm/ipcbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ipcbuf.h>
diff --git a/arch/sh/include/asm/irq_regs.h b/arch/sh/include/asm/irq_regs.h
deleted file mode 100644
index 3dd9c0b70270..000000000000
--- a/arch/sh/include/asm/irq_regs.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/irq_regs.h>
diff --git a/arch/sh/include/asm/kvm_para.h b/arch/sh/include/asm/kvm_para.h
deleted file mode 100644
index 14fab8f0b957..000000000000
--- a/arch/sh/include/asm/kvm_para.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/kvm_para.h>
diff --git a/arch/sh/include/asm/local.h b/arch/sh/include/asm/local.h
deleted file mode 100644
index 9ed9b9cb459a..000000000000
--- a/arch/sh/include/asm/local.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef __ASM_SH_LOCAL_H
-#define __ASM_SH_LOCAL_H
-
-#include <asm-generic/local.h>
-
-#endif /* __ASM_SH_LOCAL_H */
-
diff --git a/arch/sh/include/asm/local64.h b/arch/sh/include/asm/local64.h
deleted file mode 100644
index 36c93b5cc239..000000000000
--- a/arch/sh/include/asm/local64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/local64.h>
diff --git a/arch/sh/include/asm/mman.h b/arch/sh/include/asm/mman.h
deleted file mode 100644
index 8eebf89f5ab1..000000000000
--- a/arch/sh/include/asm/mman.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/mman.h>
diff --git a/arch/sh/include/asm/msgbuf.h b/arch/sh/include/asm/msgbuf.h
deleted file mode 100644
index 809134c644a6..000000000000
--- a/arch/sh/include/asm/msgbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/msgbuf.h>
diff --git a/arch/sh/include/asm/param.h b/arch/sh/include/asm/param.h
deleted file mode 100644
index 965d45427975..000000000000
--- a/arch/sh/include/asm/param.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/param.h>
diff --git a/arch/sh/include/asm/parport.h b/arch/sh/include/asm/parport.h
deleted file mode 100644
index cf252af64590..000000000000
--- a/arch/sh/include/asm/parport.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/parport.h>
diff --git a/arch/sh/include/asm/percpu.h b/arch/sh/include/asm/percpu.h
deleted file mode 100644
index 4db4b39a4399..000000000000
--- a/arch/sh/include/asm/percpu.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ARCH_SH_PERCPU
-#define __ARCH_SH_PERCPU
-
-#include <asm-generic/percpu.h>
-
-#endif /* __ARCH_SH_PERCPU */
diff --git a/arch/sh/include/asm/poll.h b/arch/sh/include/asm/poll.h
deleted file mode 100644
index c98509d3149e..000000000000
--- a/arch/sh/include/asm/poll.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/poll.h>
diff --git a/arch/sh/include/asm/resource.h b/arch/sh/include/asm/resource.h
deleted file mode 100644
index 9c2499a86ec0..000000000000
--- a/arch/sh/include/asm/resource.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_RESOURCE_H
-#define __ASM_SH_RESOURCE_H
-
-#include <asm-generic/resource.h>
-
-#endif /* __ASM_SH_RESOURCE_H */
diff --git a/arch/sh/include/asm/scatterlist.h b/arch/sh/include/asm/scatterlist.h
deleted file mode 100644
index 98dfc3510f10..000000000000
--- a/arch/sh/include/asm/scatterlist.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_SCATTERLIST_H
-#define __ASM_SH_SCATTERLIST_H
-
-#include <asm-generic/scatterlist.h>
-
-#endif /* __ASM_SH_SCATTERLIST_H */
diff --git a/arch/sh/include/asm/sembuf.h b/arch/sh/include/asm/sembuf.h
deleted file mode 100644
index 7673b83cfef7..000000000000
--- a/arch/sh/include/asm/sembuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/sembuf.h>
diff --git a/arch/sh/include/asm/serial.h b/arch/sh/include/asm/serial.h
deleted file mode 100644
index a0cb0caff152..000000000000
--- a/arch/sh/include/asm/serial.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/serial.h>
diff --git a/arch/sh/include/asm/shmbuf.h b/arch/sh/include/asm/shmbuf.h
deleted file mode 100644
index 83c05fc2de38..000000000000
--- a/arch/sh/include/asm/shmbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/shmbuf.h>
diff --git a/arch/sh/include/asm/siginfo.h b/arch/sh/include/asm/siginfo.h
deleted file mode 100644
index 813040ed68a9..000000000000
--- a/arch/sh/include/asm/siginfo.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_SIGINFO_H
-#define __ASM_SH_SIGINFO_H
-
-#include <asm-generic/siginfo.h>
-
-#endif /* __ASM_SH_SIGINFO_H */
diff --git a/arch/sh/include/asm/sizes.h b/arch/sh/include/asm/sizes.h
deleted file mode 100644
index dd248c2e1085..000000000000
--- a/arch/sh/include/asm/sizes.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/sizes.h>
diff --git a/arch/sh/include/asm/socket.h b/arch/sh/include/asm/socket.h
deleted file mode 100644
index 6b71384b9d8b..000000000000
--- a/arch/sh/include/asm/socket.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/socket.h>
diff --git a/arch/sh/include/asm/statfs.h b/arch/sh/include/asm/statfs.h
deleted file mode 100644
index 9202a023328f..000000000000
--- a/arch/sh/include/asm/statfs.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_STATFS_H
-#define __ASM_SH_STATFS_H
-
-#include <asm-generic/statfs.h>
-
-#endif /* __ASM_SH_STATFS_H */
diff --git a/arch/sh/include/asm/termbits.h b/arch/sh/include/asm/termbits.h
deleted file mode 100644
index 3935b106de79..000000000000
--- a/arch/sh/include/asm/termbits.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/termbits.h>
diff --git a/arch/sh/include/asm/termios.h b/arch/sh/include/asm/termios.h
deleted file mode 100644
index 280d78a9d966..000000000000
--- a/arch/sh/include/asm/termios.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/termios.h>
diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
index 050f221fa898..8698a80ed00c 100644
--- a/arch/sh/include/asm/uaccess.h
+++ b/arch/sh/include/asm/uaccess.h
@@ -25,6 +25,8 @@
         (__chk_user_ptr(addr),          \
          __access_ok((unsigned long __force)(addr), (size)))
 
+#define user_addr_max() (current_thread_info()->addr_limit.seg)
+
 /*
  * Uh, these should become the main single-value transfer routines ...
  * They automatically use the right size if we just have the right
@@ -100,6 +102,11 @@ struct __large_struct { unsigned long buf[100]; };
 # include "uaccess_64.h"
 #endif
 
+extern long strncpy_from_user(char *dest, const char __user *src, long count);
+
+extern __must_check long strlen_user(const char __user *str);
+extern __must_check long strnlen_user(const char __user *str, long n);
+
 /* Generic arbitrary sized copy.  */
 /* Return the number of bytes NOT copied */
 __kernel_size_t __copy_user(void *to, const void *from, __kernel_size_t n);
@@ -137,37 +144,6 @@ __kernel_size_t __clear_user(void *addr, __kernel_size_t size);
         __cl_size;                                                      \
 })
 
-/**
- * strncpy_from_user: - Copy a NUL terminated string from userspace.
- * @dst:   Destination address, in kernel space.  This buffer must be at
- *         least @count bytes long.
- * @src:   Source address, in user space.
- * @count: Maximum number of bytes to copy, including the trailing NUL.
- *
- * Copies a NUL-terminated string from userspace to kernel space.
- *
- * On success, returns the length of the string (not including the trailing
- * NUL).
- *
- * If access to userspace fails, returns -EFAULT (some data may have been
- * copied).
- *
- * If @count is smaller than the length of the string, copies @count bytes
- * and returns @count.
- */
-#define strncpy_from_user(dest,src,count)                               \
-({                                                                      \
-        unsigned long __sfu_src = (unsigned long)(src);                 \
-        int __sfu_count = (int)(count);                                 \
-        long __sfu_res = -EFAULT;                                       \
-                                                                        \
-        if (__access_ok(__sfu_src, __sfu_count))                        \
-                __sfu_res = __strncpy_from_user((unsigned long)(dest),  \
-                                __sfu_src, __sfu_count);                \
-                                                                        \
-        __sfu_res;                                                      \
-})
-
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
@@ -192,43 +168,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
         return __copy_size;
 }
 
-/**
- * strnlen_user: - Get the size of a string in user space.
- * @s: The string to measure.
- * @n: The maximum valid length
- *
- * Context: User context only.  This function may sleep.
- *
- * Get the size of a NUL-terminated string in user space.
- *
- * Returns the size of the string INCLUDING the terminating NUL.
- * On exception, returns 0.
- * If the string is too long, returns a value greater than @n.
- */
-static inline long strnlen_user(const char __user *s, long n)
-{
-        if (!__addr_ok(s))
-                return 0;
-        else
-                return __strnlen_user(s, n);
-}
-
-/**
- * strlen_user: - Get the size of a string in user space.
- * @str: The string to measure.
- *
- * Context: User context only.  This function may sleep.
- *
- * Get the size of a NUL-terminated string in user space.
- *
- * Returns the size of the string INCLUDING the terminating NUL.
- * On exception, returns 0.
- *
- * If there is a limit on the length of a valid string, you may wish to
- * consider using strnlen_user() instead.
- */
-#define strlen_user(str)        strnlen_user(str, ~0UL >> 1)
-
 /*
  * The exception table consists of pairs of addresses: the first is the
  * address of an instruction that is allowed to fault, and the second is
diff --git a/arch/sh/include/asm/uaccess_32.h b/arch/sh/include/asm/uaccess_32.h
index ae0d24f6653f..c0de7ee35ab7 100644
--- a/arch/sh/include/asm/uaccess_32.h
+++ b/arch/sh/include/asm/uaccess_32.h
@@ -170,79 +170,4 @@ __asm__ __volatile__( \
 
 extern void __put_user_unknown(void);
 
-static inline int
-__strncpy_from_user(unsigned long __dest, unsigned long __user __src, int __count)
-{
-        __kernel_size_t res;
-        unsigned long __dummy, _d, _s, _c;
-
-        __asm__ __volatile__(
-                "9:\n"
-                "mov.b  @%2+, %1\n\t"
-                "cmp/eq #0, %1\n\t"
-                "bt/s   2f\n"
-                "1:\n"
-                "mov.b  %1, @%3\n\t"
-                "dt     %4\n\t"
-                "bf/s   9b\n\t"
-                " add   #1, %3\n\t"
-                "2:\n\t"
-                "sub    %4, %0\n"
-                "3:\n"
-                ".section .fixup,\"ax\"\n"
-                "4:\n\t"
-                "mov.l  5f, %1\n\t"
-                "jmp    @%1\n\t"
-                " mov   %9, %0\n\t"
-                ".balign 4\n"
-                "5:     .long 3b\n"
-                ".previous\n"
-                ".section __ex_table,\"a\"\n"
-                "       .balign 4\n"
-                "       .long 9b,4b\n"
-                ".previous"
-                : "=r" (res), "=&z" (__dummy), "=r" (_s), "=r" (_d), "=r"(_c)
-                : "0" (__count), "2" (__src), "3" (__dest), "4" (__count),
-                  "i" (-EFAULT)
-                : "memory", "t");
-
-        return res;
-}
-
-/*
- * Return the size of a string (including the ending 0 even when we have
- * exceeded the maximum string length).
- */
-static inline long __strnlen_user(const char __user *__s, long __n)
-{
-        unsigned long res;
-        unsigned long __dummy;
-
-        __asm__ __volatile__(
-                "1:\t"
-                "mov.b  @(%0,%3), %1\n\t"
-                "cmp/eq %4, %0\n\t"
-                "bt/s   2f\n\t"
-                " add   #1, %0\n\t"
-                "tst    %1, %1\n\t"
-                "bf     1b\n\t"
-                "2:\n"
-                ".section .fixup,\"ax\"\n"
-                "3:\n\t"
-                "mov.l  4f, %1\n\t"
-                "jmp    @%1\n\t"
-                " mov   #0, %0\n"
-                ".balign 4\n"
-                "4:     .long 2b\n"
-                ".previous\n"
-                ".section __ex_table,\"a\"\n"
-                "       .balign 4\n"
-                "       .long 1b,3b\n"
-                ".previous"
-                : "=z" (res), "=&r" (__dummy)
-                : "0" (0), "r" (__s), "r" (__n)
-                : "t");
-        return res;
-}
-
 #endif /* __ASM_SH_UACCESS_32_H */
diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
index 56fd20b8cdcc..2e07e0f40c6a 100644
--- a/arch/sh/include/asm/uaccess_64.h
+++ b/arch/sh/include/asm/uaccess_64.h
@@ -84,8 +84,4 @@ extern long __put_user_asm_l(void *, long);
 extern long __put_user_asm_q(void *, long);
 extern void __put_user_unknown(void);
 
-extern long __strnlen_user(const char *__s, long __n);
-extern int __strncpy_from_user(unsigned long __dest,
-               unsigned long __user __src, int __count);
-
 #endif /* __ASM_SH_UACCESS_64_H */
diff --git a/arch/sh/include/asm/ucontext.h b/arch/sh/include/asm/ucontext.h
deleted file mode 100644
index 9bc07b9f30fb..000000000000
--- a/arch/sh/include/asm/ucontext.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ucontext.h>
diff --git a/arch/sh/include/asm/word-at-a-time.h b/arch/sh/include/asm/word-at-a-time.h
new file mode 100644
index 000000000000..6e38953ff7fd
--- /dev/null
+++ b/arch/sh/include/asm/word-at-a-time.h
@@ -0,0 +1,53 @@
+#ifndef __ASM_SH_WORD_AT_A_TIME_H
+#define __ASM_SH_WORD_AT_A_TIME_H
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+# include <asm-generic/word-at-a-time.h>
+#else
+/*
+ * Little-endian version cribbed from x86.
+ */
+struct word_at_a_time {
+        const unsigned long one_bits, high_bits;
+};
+
+#define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
+
+/* Carl Chatfield / Jan Achrenius G+ version for 32-bit */
+static inline long count_masked_bytes(long mask)
+{
+        /* (000000 0000ff 00ffff ffffff) -> ( 1 1 2 3 ) */
+        long a = (0x0ff0001+mask) >> 23;
+        /* Fix the 1 for 00 case */
+        return a & mask;
+}
+
+/* Return nonzero if it has a zero */
+static inline unsigned long has_zero(unsigned long a, unsigned long *bits, const struct word_at_a_time *c)
+{
+        unsigned long mask = ((a - c->one_bits) & ~a) & c->high_bits;
+        *bits = mask;
+        return mask;
+}
+
+static inline unsigned long prep_zero_mask(unsigned long a, unsigned long bits, const struct word_at_a_time *c)
+{
+        return bits;
+}
+
+static inline unsigned long create_zero_mask(unsigned long bits)
+{
+        bits = (bits - 1) & ~bits;
+        return bits >> 7;
+}
+
+/* The mask we created is directly usable as a bytemask */
+#define zero_bytemask(mask) (mask)
+
+static inline unsigned long find_zero(unsigned long mask)
+{
+        return count_masked_bytes(mask);
+}
+#endif
+
+#endif
diff --git a/arch/sh/include/asm/xor.h b/arch/sh/include/asm/xor.h
deleted file mode 100644
index c82eb12a5b18..000000000000
--- a/arch/sh/include/asm/xor.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/xor.h>
diff --git a/arch/sh/include/cpu-sh2a/cpu/ubc.h b/arch/sh/include/cpu-sh2a/cpu/ubc.h
deleted file mode 100644
index 1192e1c761a7..000000000000
--- a/arch/sh/include/cpu-sh2a/cpu/ubc.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * SH-2A UBC definitions
- *
- * Copyright (C) 2008 Kieran Bingham
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#ifndef __ASM_CPU_SH2A_UBC_H
-#define __ASM_CPU_SH2A_UBC_H
-
-#define UBC_BARA                0xfffc0400
-#define UBC_BAMRA               0xfffc0404
-#define UBC_BBRA                0xfffc04a0      /* 16 bit access */
-#define UBC_BDRA                0xfffc0408
-#define UBC_BDMRA               0xfffc040c
-
-#define UBC_BARB                0xfffc0410
-#define UBC_BAMRB               0xfffc0414
-#define UBC_BBRB                0xfffc04b0      /* 16 bit access */
-#define UBC_BDRB                0xfffc0418
-#define UBC_BDMRB               0xfffc041c
-
-#define UBC_BRCR                0xfffc04c0
-
-#endif /* __ASM_CPU_SH2A_UBC_H */
diff --git a/arch/sh/kernel/cpu/sh5/entry.S b/arch/sh/kernel/cpu/sh5/entry.S
index ff1f0e6e9bec..b7cf6a547f11 100644
--- a/arch/sh/kernel/cpu/sh5/entry.S
+++ b/arch/sh/kernel/cpu/sh5/entry.S
@@ -1569,86 +1569,6 @@ ___clear_user_exit:
 #endif /* CONFIG_MMU */
 
 /*
- * int __strncpy_from_user(unsigned long __dest, unsigned long __src,
- *                         int __count)
- *
- * Inputs:
- * (r2)  target address
- * (r3)  source address
- * (r4)  maximum size in bytes
- *
- * Ouputs:
- * (*r2) copied data
- * (r2)  -EFAULT (in case of faulting)
- *       copied data (otherwise)
- */
-        .global __strncpy_from_user
-__strncpy_from_user:
-        pta     ___strncpy_from_user1, tr0
-        pta     ___strncpy_from_user_done, tr1
-        or      r4, ZERO, r5            /* r5 = original count */
-        beq/u   r4, r63, tr1            /* early exit if r4==0 */
-        movi    -(EFAULT), r6           /* r6 = reply, no real fixup */
-        or      ZERO, ZERO, r7          /* r7 = data, clear top byte of data */
-
-___strncpy_from_user1:
-        ld.b    r3, 0, r7               /* Fault address: only in reading */
-        st.b    r2, 0, r7
-        addi    r2, 1, r2
-        addi    r3, 1, r3
-        beq/u   ZERO, r7, tr1
-        addi    r4, -1, r4              /* return real number of copied bytes */
-        bne/l   ZERO, r4, tr0
-
-___strncpy_from_user_done:
-        sub     r5, r4, r6              /* If done, return copied */
-
-___strncpy_from_user_exit:
-        or      r6, ZERO, r2
-        ptabs   LINK, tr0
-        blink   tr0, ZERO
-
-/*
- * extern long __strnlen_user(const char *__s, long __n)
- *
- * Inputs:
- * (r2)  source address
- * (r3)  source size in bytes
- *
- * Ouputs:
- * (r2)  -EFAULT (in case of faulting)
- *       string length (otherwise)
- */
-        .global __strnlen_user
-__strnlen_user:
-        pta     ___strnlen_user_set_reply, tr0
-        pta     ___strnlen_user1, tr1
-        or      ZERO, ZERO, r5          /* r5 = counter */
-        movi    -(EFAULT), r6           /* r6 = reply, no real fixup */
-        or      ZERO, ZERO, r7          /* r7 = data, clear top byte of data */
-        beq     r3, ZERO, tr0
-
-___strnlen_user1:
-        ldx.b   r2, r5, r7              /* Fault address: only in reading */
-        addi    r3, -1, r3              /* No real fixup */
-        addi    r5, 1, r5
-        beq     r3, ZERO, tr0
-        bne     r7, ZERO, tr1
-! The line below used to be active.  This meant led to a junk byte lying between each pair
-! of entries in the argv & envp structures in memory.  Whilst the program saw the right data
-! via the argv and envp arguments to main, it meant the 'flat' representation visible through
-! /proc/$pid/cmdline was corrupt, causing trouble with ps, for example.
-!       addi    r5, 1, r5               /* Include '\0' */
-
-___strnlen_user_set_reply:
-        or      r5, ZERO, r6            /* If done, return counter */
-
-___strnlen_user_exit:
-        or      r6, ZERO, r2
-        ptabs   LINK, tr0
-        blink   tr0, ZERO
-
-/*
  * extern long __get_user_asm_?(void *val, long addr)
  *
  * Inputs:
@@ -1982,8 +1902,6 @@ asm_uaccess_start:
         .long   ___copy_user2, ___copy_user_exit
         .long   ___clear_user1, ___clear_user_exit
 #endif
-        .long   ___strncpy_from_user1, ___strncpy_from_user_exit
-        .long   ___strnlen_user1, ___strnlen_user_exit
         .long   ___get_user_asm_b1, ___get_user_asm_b_exit
         .long   ___get_user_asm_w1, ___get_user_asm_w_exit
         .long   ___get_user_asm_l1, ___get_user_asm_l_exit
diff --git a/arch/sh/kernel/process.c b/arch/sh/kernel/process.c
index 9b7a459a4613..055d91b70305 100644
--- a/arch/sh/kernel/process.c
+++ b/arch/sh/kernel/process.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/export.h>
 #include <linux/stackprotector.h>
+#include <asm/fpu.h>
 
 struct kmem_cache *task_xstate_cachep = NULL;
 unsigned int xstate_size;
diff --git a/arch/sh/kernel/process_64.c b/arch/sh/kernel/process_64.c
index 4264583eabac..602545b12a86 100644
--- a/arch/sh/kernel/process_64.c
+++ b/arch/sh/kernel/process_64.c
@@ -33,6 +33,7 @@
 #include <asm/switch_to.h>
 
 struct task_struct *last_task_used_math = NULL;
+struct pt_regs fake_swapper_regs = { 0, };
 
 void show_regs(struct pt_regs *regs)
 {
diff --git a/arch/sh/kernel/sh_ksyms_64.c b/arch/sh/kernel/sh_ksyms_64.c
index 45afa5c51f67..26a0774f5272 100644
--- a/arch/sh/kernel/sh_ksyms_64.c
+++ b/arch/sh/kernel/sh_ksyms_64.c
@@ -32,8 +32,6 @@ EXPORT_SYMBOL(__get_user_asm_b);
 EXPORT_SYMBOL(__get_user_asm_w);
 EXPORT_SYMBOL(__get_user_asm_l);
 EXPORT_SYMBOL(__get_user_asm_q);
-EXPORT_SYMBOL(__strnlen_user);
-EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(__copy_user);
diff --git a/arch/sparc/include/asm/cmt.h b/arch/sparc/include/asm/cmt.h
deleted file mode 100644
index 870db5928577..000000000000
--- a/arch/sparc/include/asm/cmt.h
+++ /dev/null
@@ -1,59 +0,0 @@
-#ifndef _SPARC64_CMT_H
-#define _SPARC64_CMT_H
-
-/* cmt.h: Chip Multi-Threading register definitions
- *
- * Copyright (C) 2004 David S. Miller (davem@redhat.com)
- */
-
-/* ASI_CORE_ID - private */
-#define LP_ID           0x0000000000000010UL
-#define  LP_ID_MAX      0x00000000003f0000UL
-#define  LP_ID_ID       0x000000000000003fUL
-
-/* ASI_INTR_ID - private */
-#define LP_INTR_ID      0x0000000000000000UL
-#define  LP_INTR_ID_ID  0x00000000000003ffUL
-
-/* ASI_CESR_ID - private */
-#define CESR_ID         0x0000000000000040UL
-#define  CESR_ID_ID     0x00000000000000ffUL
-
-/* ASI_CORE_AVAILABLE - shared */
-#define LP_AVAIL        0x0000000000000000UL
-#define  LP_AVAIL_1     0x0000000000000002UL
-#define  LP_AVAIL_0     0x0000000000000001UL
-
-/* ASI_CORE_ENABLE_STATUS - shared */
-#define LP_ENAB_STAT    0x0000000000000010UL
-#define  LP_ENAB_STAT_1 0x0000000000000002UL
-#define  LP_ENAB_STAT_0 0x0000000000000001UL
-
-/* ASI_CORE_ENABLE - shared */
-#define LP_ENAB         0x0000000000000020UL
-#define  LP_ENAB_1      0x0000000000000002UL
-#define  LP_ENAB_0      0x0000000000000001UL
-
-/* ASI_CORE_RUNNING - shared */
-#define LP_RUNNING_RW   0x0000000000000050UL
-#define LP_RUNNING_W1S  0x0000000000000060UL
-#define LP_RUNNING_W1C  0x0000000000000068UL
-#define  LP_RUNNING_1   0x0000000000000002UL
-#define  LP_RUNNING_0   0x0000000000000001UL
-
-/* ASI_CORE_RUNNING_STAT - shared */
-#define LP_RUN_STAT     0x0000000000000058UL
-#define  LP_RUN_STAT_1  0x0000000000000002UL
-#define  LP_RUN_STAT_0  0x0000000000000001UL
-
-/* ASI_XIR_STEERING - shared */
-#define LP_XIR_STEER    0x0000000000000030UL
-#define  LP_XIR_STEER_1 0x0000000000000002UL
-#define  LP_XIR_STEER_0 0x0000000000000001UL
-
-/* ASI_CMT_ERROR_STEERING - shared */
-#define CMT_ER_STEER    0x0000000000000040UL
-#define  CMT_ER_STEER_1 0x0000000000000002UL
-#define  CMT_ER_STEER_0 0x0000000000000001UL
-
-#endif /* _SPARC64_CMT_H */
diff --git a/arch/sparc/include/asm/mpmbox.h b/arch/sparc/include/asm/mpmbox.h
deleted file mode 100644
index f8423039b242..000000000000
--- a/arch/sparc/include/asm/mpmbox.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * mpmbox.h:  Interface and defines for the OpenProm mailbox
- *               facilities for MP machines under Linux.
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- */
-
-#ifndef _SPARC_MPMBOX_H
-#define _SPARC_MPMBOX_H
-
-/* The prom allocates, for each CPU on the machine an unsigned
- * byte in physical ram.  You probe the device tree prom nodes
- * for these values.  The purpose of this byte is to be able to
- * pass messages from one cpu to another.
- */
-
-/* These are the main message types we have to look for in our
- * Cpu mailboxes, based upon these values we decide what course
- * of action to take.
- */
-
-/* The CPU is executing code in the kernel. */
-#define MAILBOX_ISRUNNING     0xf0
-
-/* Another CPU called romvec->pv_exit(), you should call
- * prom_stopcpu() when you see this in your mailbox.
- */
-#define MAILBOX_EXIT          0xfb
-
-/* Another CPU called romvec->pv_enter(), you should call
- * prom_cpuidle() when this is seen.
- */
-#define MAILBOX_GOSPIN        0xfc
-
-/* Another CPU has hit a breakpoint either into kadb or the prom
- * itself.  Just like MAILBOX_GOSPIN, you should call prom_cpuidle()
- * at this point.
- */
-#define MAILBOX_BPT_SPIN      0xfd
-
-/* Oh geese, some other nitwit got a damn watchdog reset.  The party's
- * over so go call prom_stopcpu().
- */
-#define MAILBOX_WDOG_STOP     0xfe
-
-#ifndef __ASSEMBLY__
-
-/* Handy macro's to determine a cpu's state. */
-
-/* Is the cpu still in Power On Self Test? */
-#define MBOX_POST_P(letter)  ((letter) >= 0x00 && (letter) <= 0x7f)
-
-/* Is the cpu at the 'ok' prompt of the PROM? */
-#define MBOX_PROMPROMPT_P(letter) ((letter) >= 0x80 && (letter) <= 0x8f)
-
-/* Is the cpu spinning in the PROM? */
-#define MBOX_PROMSPIN_P(letter) ((letter) >= 0x90 && (letter) <= 0xef)
-
-/* Sanity check... This is junk mail, throw it out. */
-#define MBOX_BOGON_P(letter) ((letter) >= 0xf1 && (letter) <= 0xfa)
-
-/* Is the cpu actively running an application/kernel-code? */
-#define MBOX_RUNNING_P(letter) ((letter) == MAILBOX_ISRUNNING)
-
-#endif /* !(__ASSEMBLY__) */
-
-#endif /* !(_SPARC_MPMBOX_H) */
diff --git a/arch/tile/include/asm/thread_info.h b/arch/tile/include/asm/thread_info.h
index 7e1fef36bde6..e9c670d7a7fe 100644
--- a/arch/tile/include/asm/thread_info.h
+++ b/arch/tile/include/asm/thread_info.h
@@ -91,11 +91,6 @@ extern void smp_nap(void);
 /* Enable interrupts racelessly and nap forever: helper for cpu_idle(). */
 extern void _cpu_idle(void);
 
-/* Switch boot idle thread to a freshly-allocated stack and free old stack. */
-extern void cpu_idle_on_new_stack(struct thread_info *old_ti,
-                                  unsigned long new_sp,
-                                  unsigned long new_ss10);
-
 #else /* __ASSEMBLY__ */
 
 /*
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
index c3dd275f25e2..9ab078a4605d 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
@@ -146,7 +146,7 @@ extern int fixup_exception(struct pt_regs *regs);
 #ifdef __tilegx__
 #define __get_user_1(x, ptr, ret) __get_user_asm(ld1u, x, ptr, ret)
 #define __get_user_2(x, ptr, ret) __get_user_asm(ld2u, x, ptr, ret)
-#define __get_user_4(x, ptr, ret) __get_user_asm(ld4u, x, ptr, ret)
+#define __get_user_4(x, ptr, ret) __get_user_asm(ld4s, x, ptr, ret)
 #define __get_user_8(x, ptr, ret) __get_user_asm(ld, x, ptr, ret)
 #else
 #define __get_user_1(x, ptr, ret) __get_user_asm(lb_u, x, ptr, ret)
diff --git a/arch/tile/kernel/entry.S b/arch/tile/kernel/entry.S
index 133c4b56a99e..c31637baff28 100644
--- a/arch/tile/kernel/entry.S
+++ b/arch/tile/kernel/entry.S
@@ -68,20 +68,6 @@ STD_ENTRY(KBacktraceIterator_init_current)
         jrp lr   /* keep backtracer happy */
         STD_ENDPROC(KBacktraceIterator_init_current)
 
-/*
- * Reset our stack to r1/r2 (sp and ksp0+cpu respectively), then
- * free the old stack (passed in r0) and re-invoke cpu_idle().
- * We update sp and ksp0 simultaneously to avoid backtracer warnings.
- */
-STD_ENTRY(cpu_idle_on_new_stack)
-        {
-         move sp, r1
-         mtspr SPR_SYSTEM_SAVE_K_0, r2
-        }
-        jal free_thread_info
-        j cpu_idle
-        STD_ENDPROC(cpu_idle_on_new_stack)
-
 /* Loop forever on a nap during SMP boot. */
 STD_ENTRY(smp_nap)
         nap
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 6098ccc59be2..dd87f3420390 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -29,6 +29,7 @@
 #include <linux/smp.h>
 #include <linux/timex.h>
 #include <linux/hugetlb.h>
+#include <linux/start_kernel.h>
 #include <asm/setup.h>
 #include <asm/sections.h>
 #include <asm/cacheflush.h>
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 8bbea6aa40d9..efe5acfc79c3 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -94,10 +94,10 @@ bs_die:
 
         .section ".bsdata", "a"
 bugger_off_msg:
-        .ascii  "Direct booting from floppy is no longer supported.\r\n"
-        .ascii  "Please use a boot loader program instead.\r\n"
+        .ascii  "Direct floppy boot is not supported. "
+        .ascii  "Use a boot loader program instead.\r\n"
         .ascii  "\n"
-        .ascii  "Remove disk and press any key to reboot . . .\r\n"
+        .ascii  "Remove disk and press any key to reboot ...\r\n"
         .byte   0
 
 #ifdef CONFIG_EFI_STUB
@@ -111,7 +111,7 @@ coff_header:
 #else
         .word   0x8664                          # x86-64
 #endif
-        .word   2                               # nr_sections
+        .word   3                               # nr_sections
         .long   0                               # TimeDateStamp
         .long   0                               # PointerToSymbolTable
         .long   1                               # NumberOfSymbols
@@ -158,8 +158,8 @@ extra_header_fields:
 #else
         .quad   0                               # ImageBase
 #endif
-        .long   0x1000                          # SectionAlignment
-        .long   0x200                           # FileAlignment
+        .long   0x20                            # SectionAlignment
+        .long   0x20                            # FileAlignment
         .word   0                               # MajorOperatingSystemVersion
         .word   0                               # MinorOperatingSystemVersion
         .word   0                               # MajorImageVersion
@@ -200,8 +200,10 @@ extra_header_fields:
 
         # Section table
 section_table:
-        .ascii  ".text"
-        .byte   0
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".setup"
         .byte   0
         .byte   0
         .long   0
@@ -217,9 +219,8 @@ section_table:
 
         #
         # The EFI application loader requires a relocation section
-        # because EFI applications must be relocatable. But since
-        # we don't need the loader to fixup any relocs for us, we
-        # just create an empty (zero-length) .reloc section header.
+        # because EFI applications must be relocatable. The .reloc
+        # offset & size fields are filled in by build.c.
         #
         .ascii  ".reloc"
         .byte   0
@@ -233,6 +234,25 @@ section_table:
         .word   0                               # NumberOfRelocations
         .word   0                               # NumberOfLineNumbers
         .long   0x42100040                      # Characteristics (section flags)
+
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".text"
+        .byte   0
+        .byte   0
+        .byte   0
+        .long   0
+        .long   0x0                             # startup_{32,64}
+        .long   0                               # Size of initialized data
+                                                # on disk
+        .long   0x0                             # startup_{32,64}
+        .long   0                               # PointerToRelocations
+        .long   0                               # PointerToLineNumbers
+        .word   0                               # NumberOfRelocations
+        .word   0                               # NumberOfLineNumbers
+        .long   0x60500020                      # Characteristics (section flags)
+
 #endif /* CONFIG_EFI_STUB */
 
         # Kernel attributes; used by setup.  This is part 1 of the
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 3f61f6e2b46f..4b8e165ee572 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -50,6 +50,8 @@ typedef unsigned int   u32;
 u8 buf[SETUP_SECT_MAX*512];
 int is_big_kernel;
 
+#define PECOFF_RELOC_RESERVE 0x20
+
 /*----------------------------------------------------------------------*/
 
 static const u32 crctab32[] = {
@@ -133,11 +135,103 @@ static void usage(void)
         die("Usage: build setup system [> image]");
 }
 
-int main(int argc, char ** argv)
-{
 #ifdef CONFIG_EFI_STUB
-        unsigned int file_sz, pe_header;
+
+static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+{
+        unsigned int pe_header;
+        unsigned short num_sections;
+        u8 *section;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+        num_sections = get_unaligned_le16(&buf[pe_header + 6]);
+
+#ifdef CONFIG_X86_32
+        section = &buf[pe_header + 0xa8];
+#else
+        section = &buf[pe_header + 0xb8];
 #endif
+
+        while (num_sections > 0) {
+                if (strncmp((char*)section, section_name, 8) == 0) {
+                        /* section header size field */
+                        put_unaligned_le32(size, section + 0x8);
+
+                        /* section header vma field */
+                        put_unaligned_le32(offset, section + 0xc);
+
+                        /* section header 'size of initialised data' field */
+                        put_unaligned_le32(size, section + 0x10);
+
+                        /* section header 'file offset' field */
+                        put_unaligned_le32(offset, section + 0x14);
+
+                        break;
+                }
+                section += 0x28;
+                num_sections--;
+        }
+}
+
+static void update_pecoff_setup_and_reloc(unsigned int size)
+{
+        u32 setup_offset = 0x200;
+        u32 reloc_offset = size - PECOFF_RELOC_RESERVE;
+        u32 setup_size = reloc_offset - setup_offset;
+
+        update_pecoff_section_header(".setup", setup_offset, setup_size);
+        update_pecoff_section_header(".reloc", reloc_offset, PECOFF_RELOC_RESERVE);
+
+        /*
+         * Modify .reloc section contents with a single entry. The
+         * relocation is applied to offset 10 of the relocation section.
+         */
+        put_unaligned_le32(reloc_offset + 10, &buf[reloc_offset]);
+        put_unaligned_le32(10, &buf[reloc_offset + 4]);
+}
+
+static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
+{
+        unsigned int pe_header;
+        unsigned int text_sz = file_sz - text_start;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+
+        /* Size of image */
+        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
+
+        /*
+         * Size of code: Subtract the size of the first sector (512 bytes)
+         * which includes the header.
+         */
+        put_unaligned_le32(file_sz - 512, &buf[pe_header + 0x1c]);
+
+#ifdef CONFIG_X86_32
+        /*
+         * Address of entry point.
+         *
+         * The EFI stub entry point is +16 bytes from the start of
+         * the .text section.
+         */
+        put_unaligned_le32(text_start + 16, &buf[pe_header + 0x28]);
+#else
+        /*
+         * Address of entry point. startup_32 is at the beginning and
+         * the 64-bit entry point (startup_64) is always 512 bytes
+         * after. The EFI stub entry point is 16 bytes after that, as
+         * the first instruction allows legacy loaders to jump over
+         * the EFI stub initialisation
+         */
+        put_unaligned_le32(text_start + 528, &buf[pe_header + 0x28]);
+#endif /* CONFIG_X86_32 */
+
+        update_pecoff_section_header(".text", text_start, text_sz);
+}
+
+#endif /* CONFIG_EFI_STUB */
+
+int main(int argc, char ** argv)
+{
         unsigned int i, sz, setup_sectors;
         int c;
         u32 sys_size;
@@ -163,6 +257,12 @@ int main(int argc, char ** argv)
                 die("Boot block hasn't got boot flag (0xAA55)");
         fclose(file);
 
+#ifdef CONFIG_EFI_STUB
+        /* Reserve 0x20 bytes for .reloc section */
+        memset(buf+c, 0, PECOFF_RELOC_RESERVE);
+        c += PECOFF_RELOC_RESERVE;
+#endif
+
         /* Pad unused space with zeros */
         setup_sectors = (c + 511) / 512;
         if (setup_sectors < SETUP_SECT_MIN)
@@ -170,6 +270,10 @@ int main(int argc, char ** argv)
         i = setup_sectors*512;
         memset(buf+c, 0, i-c);
 
+#ifdef CONFIG_EFI_STUB
+        update_pecoff_setup_and_reloc(i);
+#endif
+
         /* Set the default root device */
         put_unaligned_le16(DEFAULT_ROOT_DEV, &buf[508]);
 
@@ -194,66 +298,8 @@ int main(int argc, char ** argv)
         put_unaligned_le32(sys_size, &buf[0x1f4]);
 
 #ifdef CONFIG_EFI_STUB
-        file_sz = sz + i + ((sys_size * 16) - sz);
-
-        pe_header = get_unaligned_le32(&buf[0x3c]);
-
-        /* Size of image */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
-
-        /*
-         * Subtract the size of the first section (512 bytes) which
-         * includes the header and .reloc section. The remaining size
-         * is that of the .text section.
-         */
-        file_sz -= 512;
-
-        /* Size of code */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x1c]);
-
-#ifdef CONFIG_X86_32
-        /*
-         * Address of entry point.
-         *
-         * The EFI stub entry point is +16 bytes from the start of
-         * the .text section.
-         */
-        put_unaligned_le32(i + 16, &buf[pe_header + 0x28]);
-
-        /* .text size */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xb0]);
-
-        /* .text vma */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xb4]);
-
-        /* .text size of initialised data */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xb8]);
-
-        /* .text file offset */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xbc]);
-#else
-        /*
-         * Address of entry point. startup_32 is at the beginning and
-         * the 64-bit entry point (startup_64) is always 512 bytes
-         * after. The EFI stub entry point is 16 bytes after that, as
-         * the first instruction allows legacy loaders to jump over
-         * the EFI stub initialisation
-         */
-        put_unaligned_le32(i + 528, &buf[pe_header + 0x28]);
-
-        /* .text size */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xc0]);
-
-        /* .text vma */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xc4]);
-
-        /* .text size of initialised data */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xc8]);
-
-        /* .text file offset */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xcc]);
-#endif /* CONFIG_X86_32 */
-#endif /* CONFIG_EFI_STUB */
+        update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
+#endif
 
         crc = partial_crc32(buf, i, crc);
         if (fwrite(buf, 1, i, stdout) != i)
diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index be6d9e365a80..3470624d7835 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -2460,10 +2460,12 @@ ENTRY(aesni_cbc_dec)
         pxor IN3, STATE4
         movaps IN4, IV
 #else
-        pxor (INP), STATE2
-        pxor 0x10(INP), STATE3
         pxor IN1, STATE4
         movaps IN2, IV
+        movups (INP), IN1
+        pxor IN1, STATE2
+        movups 0x10(INP), IN2
+        pxor IN2, STATE3
 #endif
         movups STATE1, (OUTP)
         movups STATE2, 0x10(OUTP)
diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
index 0e3793b821ef..dc580c42851c 100644
--- a/arch/x86/include/asm/nmi.h
+++ b/arch/x86/include/asm/nmi.h
@@ -54,6 +54,20 @@ struct nmiaction {
         __register_nmi_handler((t), &fn##_na);  \
 })
 
+/*
+ * For special handlers that register/unregister in the
+ * init section only.  This should be considered rare.
+ */
+#define register_nmi_handler_initonly(t, fn, fg, n)             \
+({                                                      \
+        static struct nmiaction fn##_na __initdata = {          \
+                .handler = (fn),                        \
+                .name = (n),                            \
+                .flags = (fg),                          \
+        };                                              \
+        __register_nmi_handler((t), &fn##_na);  \
+})
+
 int __register_nmi_handler(unsigned int, struct nmiaction *);
 
 void unregister_nmi_handler(unsigned int, const char *);
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 04cd6882308e..e1f3a17034fc 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -33,9 +33,8 @@
 #define segment_eq(a, b)        ((a).seg == (b).seg)
 
 #define user_addr_max() (current_thread_info()->addr_limit.seg)
-#define __addr_ok(addr)                                 \
-        ((unsigned long __force)(addr) <                \
-         (current_thread_info()->addr_limit.seg))
+#define __addr_ok(addr)         \
+        ((unsigned long __force)(addr) < user_addr_max())
 
 /*
  * Test whether a block of memory is a valid user space address.
@@ -47,14 +46,14 @@
  * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
  */
 
-#define __range_not_ok(addr, size)                                      \
+#define __range_not_ok(addr, size, limit)                               \
 ({                                                                      \
         unsigned long flag, roksum;                                     \
         __chk_user_ptr(addr);                                           \
         asm("add %3,%1 ; sbb %0,%0 ; cmp %1,%4 ; sbb $0,%0"             \
             : "=&r" (flag), "=r" (roksum)                               \
             : "1" (addr), "g" ((long)(size)),                           \
-              "rm" (current_thread_info()->addr_limit.seg));            \
+              "rm" (limit));                                            \
         flag;                                                           \
 })
 
@@ -77,7 +76,8 @@
  * checks that the pointer is in the user space range - after calling
  * this function, memory access functions may still return -EFAULT.
  */
-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
+#define access_ok(type, addr, size) \
+        (likely(__range_not_ok(addr, size, user_addr_max()) == 0))
 
 /*
  * The exception table consists of pairs of addresses relative to the
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index becf47b81735..6149b476d9df 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -149,7 +149,6 @@
 /* 4 bits of software ack period */
 #define UV2_ACK_MASK                    0x7UL
 #define UV2_ACK_UNITS_SHFT              3
-#define UV2_LEG_SHFT UV2H_LB_BAU_MISC_CONTROL_USE_LEGACY_DESCRIPTOR_FORMATS_SHFT
 #define UV2_EXT_SHFT UV2H_LB_BAU_MISC_CONTROL_ENABLE_EXTENDED_SB_STATUS_SHFT
 
 /*
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 6e76c191a835..d5fd66f0d4cd 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -20,7 +20,6 @@
 #include <linux/bitops.h>
 #include <linux/ioport.h>
 #include <linux/suspend.h>
-#include <linux/kmemleak.h>
 #include <asm/e820.h>
 #include <asm/io.h>
 #include <asm/iommu.h>
@@ -95,11 +94,6 @@ static u32 __init allocate_aperture(void)
                 return 0;
         }
         memblock_reserve(addr, aper_size);
-        /*
-         * Kmemleak should not scan this block as it may not be mapped via the
-         * kernel direct mapping.
-         */
-        kmemleak_ignore(phys_to_virt(addr));
         printk(KERN_INFO "Mapping aperture over %d KB of RAM @ %lx\n",
                         aper_size >> 10, addr);
         insert_aperture_resource((u32)addr, aper_size);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index ac96561d1a99..5f0ff597437c 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1195,7 +1195,7 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
         BUG_ON(!cfg->vector);
 
         vector = cfg->vector;
-        for_each_cpu_and(cpu, cfg->domain, cpu_online_mask)
+        for_each_cpu(cpu, cfg->domain)
                 per_cpu(vector_irq, cpu)[vector] = -1;
 
         cfg->vector = 0;
@@ -1203,7 +1203,7 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
 
         if (likely(!cfg->move_in_progress))
                 return;
-        for_each_cpu_and(cpu, cfg->old_domain, cpu_online_mask) {
+        for_each_cpu(cpu, cfg->old_domain) {
                 for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
                                                                 vector++) {
                         if (per_cpu(vector_irq, cpu)[vector] != irq)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 0a687fd185e6..da27c5d2168a 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1274,7 +1274,7 @@ static void mce_timer_fn(unsigned long data)
          */
         iv = __this_cpu_read(mce_next_interval);
         if (mce_notify_irq())
-                iv = max(iv, (unsigned long) HZ/100);
+                iv = max(iv / 2, (unsigned long) HZ/100);
         else
                 iv = min(iv * 2, round_jiffies_relative(check_interval * HZ));
         __this_cpu_write(mce_next_interval, iv);
@@ -1557,7 +1557,7 @@ static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c)
 static void __mcheck_cpu_init_timer(void)
 {
         struct timer_list *t = &__get_cpu_var(mce_timer);
-        unsigned long iv = __this_cpu_read(mce_next_interval);
+        unsigned long iv = check_interval * HZ;
 
         setup_timer(t, mce_timer_fn, smp_processor_id());
 
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index e049d6da0183..c4706cf9c011 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1496,6 +1496,7 @@ static struct cpu_hw_events *allocate_fake_cpuc(void)
                 if (!cpuc->shared_regs)
                         goto error;
         }
+        cpuc->is_fake = 1;
         return cpuc;
 error:
         free_fake_cpuc(cpuc);
@@ -1756,6 +1757,12 @@ perf_callchain_kernel(struct perf_callchain_entry *entry, struct pt_regs *regs)
         dump_trace(NULL, regs, NULL, 0, &backtrace_ops, entry);
 }
 
+static inline int
+valid_user_frame(const void __user *fp, unsigned long size)
+{
+        return (__range_not_ok(fp, size, TASK_SIZE) == 0);
+}
+
 #ifdef CONFIG_COMPAT
 
 #include <asm/compat.h>
@@ -1780,7 +1787,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry *entry)
                 if (bytes != sizeof(frame))
                         break;
 
-                if (fp < compat_ptr(regs->sp))
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
@@ -1826,7 +1833,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
                 if (bytes != sizeof(frame))
                         break;
 
-                if ((unsigned long)fp < regs->sp)
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 6638aaf54493..7241e2fc3c17 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -117,6 +117,7 @@ struct cpu_hw_events {
         struct perf_event       *event_list[X86_PMC_IDX_MAX]; /* in enabled order */
 
         unsigned int            group_flag;
+        int                     is_fake;
 
         /*
          * Intel DebugStore bits
@@ -364,6 +365,7 @@ struct x86_pmu {
         int             pebs_record_size;
         void            (*drain_pebs)(struct pt_regs *regs);
         struct event_constraint *pebs_constraints;
+        void            (*pebs_aliases)(struct perf_event *event);
 
         /*
          * Intel LBR
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 166546ec6aef..187c294bc658 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1119,27 +1119,33 @@ intel_bts_constraints(struct perf_event *event)
         return NULL;
 }
 
-static bool intel_try_alt_er(struct perf_event *event, int orig_idx)
+static int intel_alt_er(int idx)
 {
         if (!(x86_pmu.er_flags & ERF_HAS_RSP_1))
-                return false;
+                return idx;
 
-        if (event->hw.extra_reg.idx == EXTRA_REG_RSP_0) {
-                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
-                event->hw.config |= 0x01bb;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_1;
-                event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
-        } else if (event->hw.extra_reg.idx == EXTRA_REG_RSP_1) {
+        if (idx == EXTRA_REG_RSP_0)
+                return EXTRA_REG_RSP_1;
+
+        if (idx == EXTRA_REG_RSP_1)
+                return EXTRA_REG_RSP_0;
+
+        return idx;
+}
+
+static void intel_fixup_er(struct perf_event *event, int idx)
+{
+        event->hw.extra_reg.idx = idx;
+
+        if (idx == EXTRA_REG_RSP_0) {
                 event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
                 event->hw.config |= 0x01b7;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_0;
                 event->hw.extra_reg.reg = MSR_OFFCORE_RSP_0;
+        } else if (idx == EXTRA_REG_RSP_1) {
+                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
+                event->hw.config |= 0x01bb;
+                event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
         }
-
-        if (event->hw.extra_reg.idx == orig_idx)
-                return false;
-
-        return true;
 }
 
 /*
@@ -1157,14 +1163,18 @@ __intel_shared_reg_get_constraints(struct cpu_hw_events *cpuc,
         struct event_constraint *c = &emptyconstraint;
         struct er_account *era;
         unsigned long flags;
-        int orig_idx = reg->idx;
+        int idx = reg->idx;
 
-        /* already allocated shared msr */
-        if (reg->alloc)
+        /*
+         * reg->alloc can be set due to existing state, so for fake cpuc we
+         * need to ignore this, otherwise we might fail to allocate proper fake
+         * state for this extra reg constraint. Also see the comment below.
+         */
+        if (reg->alloc && !cpuc->is_fake)
                 return NULL; /* call x86_get_event_constraint() */
 
 again:
-        era = &cpuc->shared_regs->regs[reg->idx];
+        era = &cpuc->shared_regs->regs[idx];
         /*
          * we use spin_lock_irqsave() to avoid lockdep issues when
          * passing a fake cpuc
@@ -1173,6 +1183,29 @@ again:
 
         if (!atomic_read(&era->ref) || era->config == reg->config) {
 
+                /*
+                 * If its a fake cpuc -- as per validate_{group,event}() we
+                 * shouldn't touch event state and we can avoid doing so
+                 * since both will only call get_event_constraints() once
+                 * on each event, this avoids the need for reg->alloc.
+                 *
+                 * Not doing the ER fixup will only result in era->reg being
+                 * wrong, but since we won't actually try and program hardware
+                 * this isn't a problem either.
+                 */
+                if (!cpuc->is_fake) {
+                        if (idx != reg->idx)
+                                intel_fixup_er(event, idx);
+
+                        /*
+                         * x86_schedule_events() can call get_event_constraints()
+                         * multiple times on events in the case of incremental
+                         * scheduling(). reg->alloc ensures we only do the ER
+                         * allocation once.
+                         */
+                        reg->alloc = 1;
+                }
+
                 /* lock in msr value */
                 era->config = reg->config;
                 era->reg = reg->reg;
@@ -1180,17 +1213,17 @@ again:
                 /* one more user */
                 atomic_inc(&era->ref);
 
-                /* no need to reallocate during incremental event scheduling */
-                reg->alloc = 1;
-
                 /*
                  * need to call x86_get_event_constraint()
                  * to check if associated event has constraints
                  */
                 c = NULL;
-        } else if (intel_try_alt_er(event, orig_idx)) {
-                raw_spin_unlock_irqrestore(&era->lock, flags);
-                goto again;
+        } else {
+                idx = intel_alt_er(idx);
+                if (idx != reg->idx) {
+                        raw_spin_unlock_irqrestore(&era->lock, flags);
+                        goto again;
+                }
         }
         raw_spin_unlock_irqrestore(&era->lock, flags);
 
@@ -1204,11 +1237,14 @@ __intel_shared_reg_put_constraints(struct cpu_hw_events *cpuc,
         struct er_account *era;
 
         /*
-         * only put constraint if extra reg was actually
-         * allocated. Also takes care of event which do
-         * not use an extra shared reg
+         * Only put constraint if extra reg was actually allocated. Also takes
+         * care of event which do not use an extra shared reg.
+         *
+         * Also, if this is a fake cpuc we shouldn't touch any event state
+         * (reg->alloc) and we don't care about leaving inconsistent cpuc state
+         * either since it'll be thrown out.
          */
-        if (!reg->alloc)
+        if (!reg->alloc || cpuc->is_fake)
                 return;
 
         era = &cpuc->shared_regs->regs[reg->idx];
@@ -1300,15 +1336,9 @@ static void intel_put_event_constraints(struct cpu_hw_events *cpuc,
         intel_put_shared_regs_event_constraints(cpuc, event);
 }
 
-static int intel_pmu_hw_config(struct perf_event *event)
+static void intel_pebs_aliases_core2(struct perf_event *event)
 {
-        int ret = x86_pmu_hw_config(event);
-
-        if (ret)
-                return ret;
-
-        if (event->attr.precise_ip &&
-            (event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
+        if ((event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
                 /*
                  * Use an alternative encoding for CPU_CLK_UNHALTED.THREAD_P
                  * (0x003c) so that we can use it with PEBS.
@@ -1329,10 +1359,48 @@ static int intel_pmu_hw_config(struct perf_event *event)
                  */
                 u64 alt_config = X86_CONFIG(.event=0xc0, .inv=1, .cmask=16);
 
+                alt_config |= (event->hw.config & ~X86_RAW_EVENT_MASK);
+                event->hw.config = alt_config;
+        }
+}
+
+static void intel_pebs_aliases_snb(struct perf_event *event)
+{
+        if ((event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
+                /*
+                 * Use an alternative encoding for CPU_CLK_UNHALTED.THREAD_P
+                 * (0x003c) so that we can use it with PEBS.
+                 *
+                 * The regular CPU_CLK_UNHALTED.THREAD_P event (0x003c) isn't
+                 * PEBS capable. However we can use UOPS_RETIRED.ALL
+                 * (0x01c2), which is a PEBS capable event, to get the same
+                 * count.
+                 *
+                 * UOPS_RETIRED.ALL counts the number of cycles that retires
+                 * CNTMASK micro-ops. By setting CNTMASK to a value (16)
+                 * larger than the maximum number of micro-ops that can be
+                 * retired per cycle (4) and then inverting the condition, we
+                 * count all cycles that retire 16 or less micro-ops, which
+                 * is every cycle.
+                 *
+                 * Thereby we gain a PEBS capable cycle counter.
+                 */
+                u64 alt_config = X86_CONFIG(.event=0xc2, .umask=0x01, .inv=1, .cmask=16);
 
                 alt_config |= (event->hw.config & ~X86_RAW_EVENT_MASK);
                 event->hw.config = alt_config;
         }
+}
+
+static int intel_pmu_hw_config(struct perf_event *event)
+{
+        int ret = x86_pmu_hw_config(event);
+
+        if (ret)
+                return ret;
+
+        if (event->attr.precise_ip && x86_pmu.pebs_aliases)
+                x86_pmu.pebs_aliases(event);
 
         if (intel_pmu_needs_lbr_smpl(event)) {
                 ret = intel_pmu_setup_lbr_filter(event);
@@ -1607,6 +1675,7 @@ static __initconst const struct x86_pmu intel_pmu = {
         .max_period             = (1ULL << 31) - 1,
         .get_event_constraints  = intel_get_event_constraints,
         .put_event_constraints  = intel_put_event_constraints,
+        .pebs_aliases           = intel_pebs_aliases_core2,
 
         .format_attrs           = intel_arch3_formats_attr,
 
@@ -1840,8 +1909,9 @@ __init int intel_pmu_init(void)
                 break;
 
         case 42: /* SandyBridge */
-                x86_add_quirk(intel_sandybridge_quirk);
         case 45: /* SandyBridge, "Romely-EP" */
+                x86_add_quirk(intel_sandybridge_quirk);
+        case 58: /* IvyBridge */
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
 
@@ -1849,6 +1919,7 @@ __init int intel_pmu_init(void)
 
                 x86_pmu.event_constraints = intel_snb_event_constraints;
                 x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
+                x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
                 x86_pmu.extra_regs = intel_snb_extra_regs;
                 /* all extra regs are per-cpu when HT is on */
                 x86_pmu.er_flags |= ERF_HAS_RSP_1;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 5a3edc27f6e5..35e2192df9f4 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -400,14 +400,7 @@ struct event_constraint intel_snb_pebs_event_constraints[] = {
         INTEL_EVENT_CONSTRAINT(0xc4, 0xf),    /* BR_INST_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xc5, 0xf),    /* BR_MISP_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xcd, 0x8),    /* MEM_TRANS_RETIRED.* */
-        INTEL_UEVENT_CONSTRAINT(0x11d0, 0xf), /* MEM_UOP_RETIRED.STLB_MISS_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x12d0, 0xf), /* MEM_UOP_RETIRED.STLB_MISS_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x21d0, 0xf), /* MEM_UOP_RETIRED.LOCK_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x22d0, 0xf), /* MEM_UOP_RETIRED.LOCK_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x41d0, 0xf), /* MEM_UOP_RETIRED.SPLIT_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x42d0, 0xf), /* MEM_UOP_RETIRED.SPLIT_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x81d0, 0xf), /* MEM_UOP_RETIRED.ANY_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x82d0, 0xf), /* MEM_UOP_RETIRED.ANY_STORES */
+        INTEL_EVENT_CONSTRAINT(0xd0, 0xf),    /* MEM_UOP_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd1, 0xf),    /* MEM_LOAD_UOPS_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd2, 0xf),    /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
         INTEL_UEVENT_CONSTRAINT(0x02d4, 0xf), /* MEM_LOAD_UOPS_MISC_RETIRED.LLC_MISS */
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 086eb58c6e80..f1b42b3a186c 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -120,11 +120,6 @@ bool kvm_check_and_clear_guest_paused(void)
         bool ret = false;
         struct pvclock_vcpu_time_info *src;
 
-        /*
-         * per_cpu() is safe here because this function is only called from
-         * timer functions where preemption is already disabled.
-         */
-        WARN_ON(!in_atomic());
         src = &__get_cpu_var(hv_clock);
         if ((src->flags & PVCLOCK_GUEST_STOPPED) != 0) {
                 __this_cpu_and(hv_clock.flags, ~PVCLOCK_GUEST_STOPPED);
diff --git a/arch/x86/kernel/nmi_selftest.c b/arch/x86/kernel/nmi_selftest.c
index e31bf8d5c4d2..149b8d9c6ad4 100644
--- a/arch/x86/kernel/nmi_selftest.c
+++ b/arch/x86/kernel/nmi_selftest.c
@@ -42,7 +42,7 @@ static int __init nmi_unk_cb(unsigned int val, struct pt_regs *regs)
 static void __init init_nmi_testsuite(void)
 {
         /* trap all the unknown NMIs we may generate */
-        register_nmi_handler(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk");
+        register_nmi_handler_initonly(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk");
 }
 
 static void __init cleanup_nmi_testsuite(void)
@@ -64,7 +64,7 @@ static void __init test_nmi_ipi(struct cpumask *mask)
 {
         unsigned long timeout;
 
-        if (register_nmi_handler(NMI_LOCAL, test_nmi_ipi_callback,
+        if (register_nmi_handler_initonly(NMI_LOCAL, test_nmi_ipi_callback,
                                  NMI_FLAG_FIRST, "nmi_selftest")) {
                 nmi_fail = FAILURE;
                 return;
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 62c9457ccd2f..c0f420f76cd3 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -100,7 +100,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
                                  struct dma_attrs *attrs)
 {
         unsigned long dma_mask;
-        struct page *page = NULL;
+        struct page *page;
         unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         dma_addr_t addr;
 
@@ -108,6 +108,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
 
         flag |= __GFP_ZERO;
 again:
+        page = NULL;
         if (!(flag & GFP_ATOMIC))
                 page = dma_alloc_from_contiguous(dev, count, get_order(size));
         if (!page)
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 79c45af81604..25b48edb847c 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -639,9 +639,11 @@ void native_machine_shutdown(void)
         set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
 
         /*
-         * O.K Now that I'm on the appropriate processor,
-         * stop all of the others.
+         * O.K Now that I'm on the appropriate processor, stop all of the
+         * others. Also disable the local irq to not receive the per-cpu
+         * timer interrupt which may trigger scheduler's load balance.
          */
+        local_irq_disable();
         stop_other_cpus();
 #endif
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index f56f96da77f5..7bd8a0823654 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -349,9 +349,12 @@ static bool __cpuinit match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 
 static bool __cpuinit match_mc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 {
-        if (c->phys_proc_id == o->phys_proc_id)
-                return topology_sane(c, o, "mc");
+        if (c->phys_proc_id == o->phys_proc_id) {
+                if (cpu_has(c, X86_FEATURE_AMD_DCM))
+                        return true;
 
+                return topology_sane(c, o, "mc");
+        }
         return false;
 }
 
@@ -382,6 +385,15 @@ void __cpuinit set_cpu_sibling_map(int cpu)
                 if ((i == cpu) || (has_mc && match_llc(c, o)))
                         link_mask(llc_shared, cpu, i);
 
+        }
+
+        /*
+         * This needs a separate iteration over the cpus because we rely on all
+         * cpu_sibling_mask links to be set-up.
+         */
+        for_each_cpu(i, cpu_sibling_setup_mask) {
+                o = &cpu_data(i);
+
                 if ((i == cpu) || (has_mc && match_mc(c, o))) {
                         link_mask(core, cpu, i);
 
@@ -410,15 +422,7 @@ void __cpuinit set_cpu_sibling_map(int cpu)
 /* maps the cpu to the sched domain representing multi-core */
 const struct cpumask *cpu_coregroup_mask(int cpu)
 {
-        struct cpuinfo_x86 *c = &cpu_data(cpu);
-        /*
-         * For perf, we return last level cache shared map.
-         * And for power savings, we return cpu_core_map
-         */
-        if (!(cpu_has(c, X86_FEATURE_AMD_DCM)))
-                return cpu_core_mask(cpu);
-        else
-                return cpu_llc_shared_mask(cpu);
+        return cpu_llc_shared_mask(cpu);
 }
 
 static void impress_friends(void)
diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index f61ee67ec00f..4f74d94c8d97 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 
 #include <asm/word-at-a-time.h>
+#include <linux/sched.h>
 
 /*
  * best effort, GUP based copy_from_user() that is NMI-safe
@@ -21,6 +22,9 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
         void *map;
         int ret;
 
+        if (__range_not_ok(from, n, TASK_SIZE))
+                return len;
+
         do {
                 ret = __get_user_pages_fast(addr, 1, 0, &page);
                 if (!ret)
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 819137904428..5d7e51f3fd28 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -28,7 +28,7 @@
 #  - (66): the last prefix is 0x66
 #  - (F3): the last prefix is 0xF3
 #  - (F2): the last prefix is 0xF2
-#
+#  - (!F3) : the last prefix is not 0xF3 (including non-last prefix case)
 
 Table: one byte opcode
 Referrer:
@@ -515,12 +515,12 @@ b4: LFS Gv,Mp
 b5: LGS Gv,Mp
 b6: MOVZX Gv,Eb
 b7: MOVZX Gv,Ew
-b8: JMPE | POPCNT Gv,Ev (F3)
+b8: JMPE (!F3) | POPCNT Gv,Ev (F3)
 b9: Grp10 (1A)
 ba: Grp8 Ev,Ib (1A)
 bb: BTC Ev,Gv
-bc: BSF Gv,Ev | TZCNT Gv,Ev (F3)
-bd: BSR Gv,Ev | LZCNT Gv,Ev (F3)
+bc: BSF Gv,Ev (!F3) | TZCNT Gv,Ev (F3)
+bd: BSR Gv,Ev (!F3) | LZCNT Gv,Ev (F3)
 be: MOVSX Gv,Eb
 bf: MOVSX Gv,Ew
 # 0x0f 0xc0-0xcf
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 97141c26a13a..bc4e9d84157f 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -62,7 +62,8 @@ static void __init find_early_table_space(struct map_range *mr, unsigned long en
                 extra += PMD_SIZE;
 #endif
                 /* The first 2/4M doesn't use large pages. */
-                extra += mr->end - mr->start;
+                if (mr->start < PMD_SIZE)
+                        extra += mr->end - mr->start;
 
                 ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
         } else
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index be1ef574ce9a..78fe3f1ac49f 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -180,7 +180,7 @@ err_free_memtype:
 
 /**
  * ioremap_nocache     -   map bus memory into CPU space
- * @offset:    bus address of the memory
+ * @phys_addr:    bus address of the memory
  * @size:      size of the resource to map
  *
  * ioremap_nocache performs a platform specific sequence of operations to
@@ -217,7 +217,7 @@ EXPORT_SYMBOL(ioremap_nocache);
 
 /**
  * ioremap_wc   -       map memory into CPU space write combined
- * @offset:     bus address of the memory
+ * @phys_addr:  bus address of the memory
  * @size:       size of the resource to map
  *
  * This version of ioremap ensures that the memory is marked write combining.
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index e1ebde315210..a718e0d23503 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -122,7 +122,7 @@ within(unsigned long addr, unsigned long start, unsigned long end)
 
 /**
  * clflush_cache_range - flush a cache range with clflush
- * @addr:       virtual start address
+ * @vaddr:      virtual start address
  * @size:       number of bytes to flush
  *
  * clflush is an unordered instruction which needs fencing with mfence
diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
index 732af3a96183..4599c3e8bcb6 100644
--- a/arch/x86/mm/srat.c
+++ b/arch/x86/mm/srat.c
@@ -176,6 +176,8 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
                 return;
         }
 
+        node_set(node, numa_nodes_parsed);
+
         printk(KERN_INFO "SRAT: Node %u PXM %u [mem %#010Lx-%#010Lx]\n",
                node, pxm,
                (unsigned long long) start, (unsigned long long) end - 1);
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index e31bcd8f2eee..fd41a9262d65 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -782,7 +782,7 @@ BLOCKING_NOTIFIER_HEAD(intel_scu_notifier);
 EXPORT_SYMBOL_GPL(intel_scu_notifier);
 
 /* Called by IPC driver */
-void intel_scu_devices_create(void)
+void __devinit intel_scu_devices_create(void)
 {
         int i;
 
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 3ae0e61abd23..59880afa851f 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1295,7 +1295,6 @@ static void __init enable_timeouts(void)
                  */
                 mmr_image |= (1L << SOFTACK_MSHIFT);
                 if (is_uv2_hub()) {
-                        mmr_image &= ~(1L << UV2_LEG_SHFT);
                         mmr_image |= (1L << UV2_EXT_SHFT);
                 }
                 write_mmr_misc_control(pnode, mmr_image);
diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk
index 5f6a5b6c3a15..ddcf39b1a18d 100644
--- a/arch/x86/tools/gen-insn-attr-x86.awk
+++ b/arch/x86/tools/gen-insn-attr-x86.awk
@@ -66,9 +66,10 @@ BEGIN {
         rex_expr = "^REX(\\.[XRWB]+)*"
         fpu_expr = "^ESC" # TODO
 
-        lprefix1_expr = "\\(66\\)"
+        lprefix1_expr = "\\((66|!F3)\\)"
         lprefix2_expr = "\\(F3\\)"
-        lprefix3_expr = "\\(F2\\)"
+        lprefix3_expr = "\\((F2|!F3)\\)"
+        lprefix_expr = "\\((66|F2|F3)\\)"
         max_lprefix = 4
 
         # All opcodes starting with lower-case 'v' or with (v1) superscript
@@ -333,13 +334,16 @@ function convert_operands(count,opnd,       i,j,imm,mod)
                 if (match(ext, lprefix1_expr)) {
                         lptable1[idx] = add_flags(lptable1[idx],flags)
                         variant = "INAT_VARIANT"
-                } else if (match(ext, lprefix2_expr)) {
+                }
+                if (match(ext, lprefix2_expr)) {
                         lptable2[idx] = add_flags(lptable2[idx],flags)
                         variant = "INAT_VARIANT"
-                } else if (match(ext, lprefix3_expr)) {
+                }
+                if (match(ext, lprefix3_expr)) {
                         lptable3[idx] = add_flags(lptable3[idx],flags)
                         variant = "INAT_VARIANT"
-                } else {
+                }
+                if (!match(ext, lprefix_expr)){
                         table[idx] = add_flags(table[idx],flags)
                 }
         }
diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
index 416bd40c0eba..68d1dc91b37b 100644
--- a/arch/x86/um/sys_call_table_32.c
+++ b/arch/x86/um/sys_call_table_32.c
@@ -39,9 +39,9 @@
 #undef __SYSCALL_I386
 #define __SYSCALL_I386(nr, sym, compat) [ nr ] = sym,
 
-typedef void (*sys_call_ptr_t)(void);
+typedef asmlinkage void (*sys_call_ptr_t)(void);
 
-extern void sys_ni_syscall(void);
+extern asmlinkage void sys_ni_syscall(void);
 
 const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
         /*
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e74df9548a02..ff962d4b821e 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -209,6 +209,9 @@ static void __init xen_banner(void)
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
 }
 
+#define CPUID_THERM_POWER_LEAF 6
+#define APERFMPERF_PRESENT 0
+
 static __read_mostly unsigned int cpuid_leaf1_edx_mask = ~0;
 static __read_mostly unsigned int cpuid_leaf1_ecx_mask = ~0;
 
@@ -242,6 +245,11 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                 *dx = cpuid_leaf5_edx_val;
                 return;
 
+        case CPUID_THERM_POWER_LEAF:
+                /* Disabling APERFMPERF for kernel usage */
+                maskecx = ~(1 << APERFMPERF_PRESENT);
+                break;
+
         case 0xb:
                 /* Suppress extended topology stuff */
                 maskebx = 0;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index ffd08c414e91..64effdc6da94 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -706,6 +706,7 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         if (!PageHighMem(page)) {
@@ -741,6 +742,24 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
         spin_unlock_irqrestore(&m2p_override_lock, flags);
 
+        /* p2m(m2p(mfn)) == mfn: the mfn is already present somewhere in
+         * this domain. Set the FOREIGN_FRAME_BIT in the p2m for the other
+         * pfn so that the following mfn_to_pfn(mfn) calls will return the
+         * pfn from the m2p_override (the backend pfn) instead.
+         * We need to do this because the pages shared by the frontend
+         * (xen-blkfront) can be already locked (lock_page, called by
+         * do_read_cache_page); when the userspace backend tries to use them
+         * with direct_IO, mfn_to_pfn returns the pfn of the frontend, so
+         * do_blockdev_direct_IO is going to try to lock the same pages
+         * again resulting in a deadlock.
+         * As a side effect get_user_pages_fast might not be safe on the
+         * frontend pages while they are being shared with the backend,
+         * because mfn_to_pfn (that ends up being called by GUPF) will
+         * return the backend pfn rather than the frontend pfn. */
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == mfn)
+                set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_add_override);
@@ -752,6 +771,7 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         mfn = get_phys_to_machine(pfn);
@@ -821,6 +841,22 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         } else
                 set_phys_to_machine(pfn, page->index);
 
+        /* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
+         * somewhere in this domain, even before being added to the
+         * m2p_override (see comment above in m2p_add_override).
+         * If there are no other entries in the m2p_override corresponding
+         * to this mfn, then remove the FOREIGN_FRAME_BIT from the p2m for
+         * the original pfn (the one shared by the frontend): the backend
+         * cannot do any IO on this page anymore because it has been
+         * unshared. Removing the FOREIGN_FRAME_BIT from the p2m entry of
+         * the original pfn causes mfn_to_pfn(mfn) to return the frontend
+         * pfn again. */
+        mfn &= ~FOREIGN_FRAME_BIT;
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
+                        m2p_find_override(mfn) == NULL)
+                set_phys_to_machine(pfn, mfn);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_remove_override);
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 3ebba0753d38..a4790bf22c59 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -371,7 +371,8 @@ char * __init xen_memory_setup(void)
         populated = xen_populate_chunk(map, memmap.nr_entries,
                         max_pfn, &last_pfn, xen_released_pages);
 
-        extra_pages += (xen_released_pages - populated);
+        xen_released_pages -= populated;
+        extra_pages += xen_released_pages;
 
         if (last_pfn > max_pfn) {
                 max_pfn = min(MAX_DOMAIN_PAGES, last_pfn);
diff --git a/arch/xtensa/include/asm/syscall.h b/arch/xtensa/include/asm/syscall.h
index 0b9f2e13c781..c1dacca312f3 100644
--- a/arch/xtensa/include/asm/syscall.h
+++ b/arch/xtensa/include/asm/syscall.h
@@ -31,5 +31,5 @@ asmlinkage long sys_pselect6(int n, fd_set __user *inp, fd_set __user *outp,
 asmlinkage long sys_ppoll(struct pollfd __user *ufds, unsigned int nfds,
         struct timespec __user *tsp, const sigset_t __user *sigmask,
         size_t sigsetsize);
-
-
+asmlinkage long sys_rt_sigsuspend(sigset_t __user *unewset,
+                size_t sigsetsize);
diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
index b9f8e5850d3a..efe4e854b3cd 100644
--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -493,7 +493,7 @@ static void do_signal(struct pt_regs *regs)
                 if (ret)
                         return;
 
-                signal_delivered(signr, info, ka, regs, 0);
+                signal_delivered(signr, &info, &ka, regs, 0);
                 if (current->ptrace & PT_SINGLESTEP)
                         task_pt_regs(current)->icountlevel = 1;
 
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 47768ff87343..80998958cf45 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -208,7 +208,7 @@ config ACPI_IPMI
 
 config ACPI_HOTPLUG_CPU
         bool
-        depends on ACPI_PROCESSOR && HOTPLUG_CPU
+        depends on EXPERIMENTAL && ACPI_PROCESSOR && HOTPLUG_CPU
         select ACPI_CONTAINER
         default y
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 86933ca8b472..7dd3f9fb9f3f 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -643,11 +643,19 @@ static int acpi_battery_update(struct acpi_battery *battery)
 
 static void acpi_battery_refresh(struct acpi_battery *battery)
 {
+        int power_unit;
+
         if (!battery->bat.dev)
                 return;
 
+        power_unit = battery->power_unit;
+
         acpi_battery_get_info(battery);
-        /* The battery may have changed its reporting units. */
+
+        if (power_unit == battery->power_unit)
+                return;
+
+        /* The battery has changed its reporting units. */
         sysfs_remove_battery(battery);
         sysfs_add_battery(battery);
 }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 3188da3df8da..adceafda9c17 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -182,41 +182,66 @@ EXPORT_SYMBOL(acpi_bus_get_private_data);
                                  Power Management
    -------------------------------------------------------------------------- */
 
+static const char *state_string(int state)
+{
+        switch (state) {
+        case ACPI_STATE_D0:
+                return "D0";
+        case ACPI_STATE_D1:
+                return "D1";
+        case ACPI_STATE_D2:
+                return "D2";
+        case ACPI_STATE_D3_HOT:
+                return "D3hot";
+        case ACPI_STATE_D3_COLD:
+                return "D3";
+        default:
+                return "(unknown)";
+        }
+}
+
 static int __acpi_bus_get_power(struct acpi_device *device, int *state)
 {
-        int result = 0;
-        acpi_status status = 0;
-        unsigned long long psc = 0;
+        int result = ACPI_STATE_UNKNOWN;
 
         if (!device || !state)
                 return -EINVAL;
 
-        *state = ACPI_STATE_UNKNOWN;
-
-        if (device->flags.power_manageable) {
-                /*
-                 * Get the device's power state either directly (via _PSC) or
-                 * indirectly (via power resources).
-                 */
-                if (device->power.flags.power_resources) {
-                        result = acpi_power_get_inferred_state(device, state);
-                        if (result)
-                                return result;
-                } else if (device->power.flags.explicit_get) {
-                        status = acpi_evaluate_integer(device->handle, "_PSC",
-                                                       NULL, &psc);
-                        if (ACPI_FAILURE(status))
-                                return -ENODEV;
-                        *state = (int)psc;
-                }
-        } else {
+        if (!device->flags.power_manageable) {
                 /* TBD: Non-recursive algorithm for walking up hierarchy. */
                 *state = device->parent ?
                         device->parent->power.state : ACPI_STATE_D0;
+                goto out;
+        }
+
+        /*
+         * Get the device's power state either directly (via _PSC) or
+         * indirectly (via power resources).
+         */
+        if (device->power.flags.explicit_get) {
+                unsigned long long psc;
+                acpi_status status = acpi_evaluate_integer(device->handle,
+                                                           "_PSC", NULL, &psc);
+                if (ACPI_FAILURE(status))
+                        return -ENODEV;
+
+                result = psc;
+        }
+        /* The test below covers ACPI_STATE_UNKNOWN too. */
+        if (result <= ACPI_STATE_D2) {
+          ; /* Do nothing. */
+        } else if (device->power.flags.power_resources) {
+                int error = acpi_power_get_inferred_state(device, &result);
+                if (error)
+                        return error;
+        } else if (result == ACPI_STATE_D3_HOT) {
+                result = ACPI_STATE_D3;
         }
+        *state = result;
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device [%s] power state is D%d\n",
-                          device->pnp.bus_id, *state));
+ out:
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device [%s] power state is %s\n",
+                          device->pnp.bus_id, state_string(*state)));
 
         return 0;
 }
@@ -234,13 +259,14 @@ static int __acpi_bus_set_power(struct acpi_device *device, int state)
         /* Make sure this is a valid target state */
 
         if (state == device->power.state) {
-                ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device is already at D%d\n",
-                                  state));
+                ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device is already at %s\n",
+                                  state_string(state)));
                 return 0;
         }
 
         if (!device->power.states[state].flags.valid) {
-                printk(KERN_WARNING PREFIX "Device does not support D%d\n", state);
+                printk(KERN_WARNING PREFIX "Device does not support %s\n",
+                       state_string(state));
                 return -ENODEV;
         }
         if (device->parent && (state < device->parent->power.state)) {
@@ -294,13 +320,13 @@ static int __acpi_bus_set_power(struct acpi_device *device, int state)
       end:
         if (result)
                 printk(KERN_WARNING PREFIX
-                              "Device [%s] failed to transition to D%d\n",
-                              device->pnp.bus_id, state);
+                              "Device [%s] failed to transition to %s\n",
+                              device->pnp.bus_id, state_string(state));
         else {
                 device->power.state = state;
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                  "Device [%s] transitioned to D%d\n",
-                                  device->pnp.bus_id, state));
+                                  "Device [%s] transitioned to %s\n",
+                                  device->pnp.bus_id, state_string(state)));
         }
 
         return result;
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 0500f719f63e..dd6d6a3c6780 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -631,7 +631,7 @@ int acpi_power_get_inferred_state(struct acpi_device *device, int *state)
          * We know a device's inferred power state when all the resources
          * required for a given D-state are 'on'.
          */
-        for (i = ACPI_STATE_D0; i < ACPI_STATE_D3_HOT; i++) {
+        for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
                 list = &device->power.states[i].resources;
                 if (list->count < 1)
                         continue;
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 0af48a8554cd..a093dc163a42 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -333,6 +333,7 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
         struct acpi_buffer state = { 0, NULL };
         union acpi_object *pss = NULL;
         int i;
+        int last_invalid = -1;
 
 
         status = acpi_evaluate_object(pr->handle, "_PSS", NULL, &buffer);
@@ -394,14 +395,33 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
                     ((u32)(px->core_frequency * 1000) !=
                      (px->core_frequency * 1000))) {
                         printk(KERN_ERR FW_BUG PREFIX
-                               "Invalid BIOS _PSS frequency: 0x%llx MHz\n",
-                               px->core_frequency);
-                        result = -EFAULT;
-                        kfree(pr->performance->states);
-                        goto end;
+                               "Invalid BIOS _PSS frequency found for processor %d: 0x%llx MHz\n",
+                               pr->id, px->core_frequency);
+                        if (last_invalid == -1)
+                                last_invalid = i;
+                } else {
+                        if (last_invalid != -1) {
+                                /*
+                                 * Copy this valid entry over last_invalid entry
+                                 */
+                                memcpy(&(pr->performance->states[last_invalid]),
+                                       px, sizeof(struct acpi_processor_px));
+                                ++last_invalid;
+                        }
                 }
         }
 
+        if (last_invalid == 0) {
+                printk(KERN_ERR FW_BUG PREFIX
+                       "No valid BIOS _PSS frequency found for processor %d\n", pr->id);
+                result = -EFAULT;
+                kfree(pr->performance->states);
+                pr->performance->states = NULL;
+        }
+
+        if (last_invalid > 0)
+                pr->performance->state_count = last_invalid;
+
       end:
         kfree(buffer.pointer);
 
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 85cbfdccc97c..c8a1f3b68110 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1567,6 +1567,7 @@ static int acpi_bus_scan_fixed(void)
                                                 ACPI_BUS_TYPE_POWER_BUTTON,
                                                 ACPI_STA_DEFAULT,
                                                 &ops);
+                device_init_wakeup(&device->dev, true);
         }
 
         if ((acpi_gbl_FADT.flags & ACPI_FADT_SLEEP_BUTTON) == 0) {
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 74ee4ab577b6..88561029cca8 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -57,6 +57,7 @@ MODULE_PARM_DESC(gts, "Enable evaluation of _GTS on suspend.");
 MODULE_PARM_DESC(bfs, "Enable evaluation of _BFS on resume".);
 
 static u8 sleep_states[ACPI_S_STATE_COUNT];
+static bool pwr_btn_event_pending;
 
 static void acpi_sleep_tts_switch(u32 acpi_state)
 {
@@ -184,6 +185,14 @@ static int acpi_pm_prepare(void)
         return error;
 }
 
+static int find_powerf_dev(struct device *dev, void *data)
+{
+        struct acpi_device *device = to_acpi_device(dev);
+        const char *hid = acpi_device_hid(device);
+
+        return !strcmp(hid, ACPI_BUTTON_HID_POWERF);
+}
+
 /**
  *      acpi_pm_finish - Instruct the platform to leave a sleep state.
  *
@@ -192,6 +201,7 @@ static int acpi_pm_prepare(void)
  */
 static void acpi_pm_finish(void)
 {
+        struct device *pwr_btn_dev;
         u32 acpi_state = acpi_target_sleep_state;
 
         acpi_ec_unblock_transactions();
@@ -209,6 +219,23 @@ static void acpi_pm_finish(void)
         acpi_set_firmware_waking_vector((acpi_physical_address) 0);
 
         acpi_target_sleep_state = ACPI_STATE_S0;
+
+        /* If we were woken with the fixed power button, provide a small
+         * hint to userspace in the form of a wakeup event on the fixed power
+         * button device (if it can be found).
+         *
+         * We delay the event generation til now, as the PM layer requires
+         * timekeeping to be running before we generate events. */
+        if (!pwr_btn_event_pending)
+                return;
+
+        pwr_btn_event_pending = false;
+        pwr_btn_dev = bus_find_device(&acpi_bus_type, NULL, NULL,
+                                      find_powerf_dev);
+        if (pwr_btn_dev) {
+                pm_wakeup_event(pwr_btn_dev, 0);
+                put_device(pwr_btn_dev);
+        }
 }
 
 /**
@@ -298,9 +325,23 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
         /* ACPI 3.0 specs (P62) says that it's the responsibility
          * of the OSPM to clear the status bit [ implying that the
          * POWER_BUTTON event should not reach userspace ]
+         *
+         * However, we do generate a small hint for userspace in the form of
+         * a wakeup event. We flag this condition for now and generate the
+         * event later, as we're currently too early in resume to be able to
+         * generate wakeup events.
          */
-        if (ACPI_SUCCESS(status) && (acpi_state == ACPI_STATE_S3))
-                acpi_clear_event(ACPI_EVENT_POWER_BUTTON);
+        if (ACPI_SUCCESS(status) && (acpi_state == ACPI_STATE_S3)) {
+                acpi_event_status pwr_btn_status;
+
+                acpi_get_event_status(ACPI_EVENT_POWER_BUTTON, &pwr_btn_status);
+
+                if (pwr_btn_status & ACPI_EVENT_FLAG_SET) {
+                        acpi_clear_event(ACPI_EVENT_POWER_BUTTON);
+                        /* Flag for later */
+                        pwr_btn_event_pending = true;
+                }
+        }
 
         /*
          * Disable and clear GPE status before interrupt is enabled. Some GPEs
@@ -730,8 +771,8 @@ int acpi_pm_device_sleep_state(struct device *dev, int *d_min_p)
          * can wake the system.  _S0W may be valid, too.
          */
         if (acpi_target_sleep_state == ACPI_STATE_S0 ||
-            (device_may_wakeup(dev) &&
-             adev->wakeup.sleep_state <= acpi_target_sleep_state)) {
+            (device_may_wakeup(dev) && adev->wakeup.flags.valid &&
+             adev->wakeup.sleep_state >= acpi_target_sleep_state)) {
                 acpi_status status;
 
                 acpi_method[3] = 'W';
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 9577b6fa2650..a576575617d7 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1687,10 +1687,6 @@ static int acpi_video_bus_add(struct acpi_device *device)
         set_bit(KEY_BRIGHTNESS_ZERO, input->keybit);
         set_bit(KEY_DISPLAY_OFF, input->keybit);
 
-        error = input_register_device(input);
-        if (error)
-                goto err_stop_video;
-
         printk(KERN_INFO PREFIX "%s [%s] (multi-head: %s  rom: %s  post: %s)\n",
                ACPI_VIDEO_DEVICE_NAME, acpi_device_bid(device),
                video->flags.multihead ? "yes" : "no",
@@ -1701,12 +1697,16 @@ static int acpi_video_bus_add(struct acpi_device *device)
         video->pm_nb.priority = 0;
         error = register_pm_notifier(&video->pm_nb);
         if (error)
-                goto err_unregister_input_dev;
+                goto err_stop_video;
+
+        error = input_register_device(input);
+        if (error)
+                goto err_unregister_pm_notifier;
 
         return 0;
 
- err_unregister_input_dev:
-        input_unregister_device(input);
+ err_unregister_pm_notifier:
+        unregister_pm_notifier(&video->pm_nb);
  err_stop_video:
         acpi_video_bus_stop_devices(video);
  err_free_input_dev:
@@ -1743,9 +1743,18 @@ static int acpi_video_bus_remove(struct acpi_device *device, int type)
         return 0;
 }
 
+static int __init is_i740(struct pci_dev *dev)
+{
+        if (dev->device == 0x00D1)
+                return 1;
+        if (dev->device == 0x7000)
+                return 1;
+        return 0;
+}
+
 static int __init intel_opregion_present(void)
 {
-#if defined(CONFIG_DRM_I915) || defined(CONFIG_DRM_I915_MODULE)
+        int opregion = 0;
         struct pci_dev *dev = NULL;
         u32 address;
 
@@ -1754,13 +1763,15 @@ static int __init intel_opregion_present(void)
                         continue;
                 if (dev->vendor != PCI_VENDOR_ID_INTEL)
                         continue;
+                /* We don't want to poke around undefined i740 registers */
+                if (is_i740(dev))
+                        continue;
                 pci_read_config_dword(dev, 0xfc, &address);
                 if (!address)
                         continue;
-                return 1;
+                opregion = 1;
         }
-#endif
-        return 0;
+        return opregion;
 }
 
 int acpi_video_register(void)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 0bcda488f11c..c89aa01fb1de 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -246,11 +246,11 @@ struct regmap *regmap_init(struct device *dev,
                 map->lock = regmap_lock_mutex;
                 map->unlock = regmap_unlock_mutex;
         }
-        map->format.buf_size = (config->reg_bits + config->val_bits) / 8;
         map->format.reg_bytes = DIV_ROUND_UP(config->reg_bits, 8);
         map->format.pad_bytes = config->pad_bits / 8;
         map->format.val_bytes = DIV_ROUND_UP(config->val_bits, 8);
-        map->format.buf_size += map->format.pad_bytes;
+        map->format.buf_size = DIV_ROUND_UP(config->reg_bits +
+                        config->val_bits + config->pad_bits, 8);
         map->reg_shift = config->pad_bits % 8;
         if (config->reg_stride)
                 map->reg_stride = config->reg_stride;
@@ -368,7 +368,7 @@ struct regmap *regmap_init(struct device *dev,
 
         ret = regcache_init(map, config);
         if (ret < 0)
-                goto err_free_workbuf;
+                goto err_debugfs;
 
         /* Add a devres resource for dev_get_regmap() */
         m = devres_alloc(dev_get_regmap_release, sizeof(*m), GFP_KERNEL);
@@ -383,7 +383,8 @@ struct regmap *regmap_init(struct device *dev,
 
 err_cache:
         regcache_exit(map);
-err_free_workbuf:
+err_debugfs:
+        regmap_debugfs_exit(map);
         kfree(map->work_buf);
 err_map:
         kfree(map);
@@ -471,6 +472,7 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(regmap_reinit_cache);
 
 /**
  * regmap_exit(): Free a previously allocated register map
diff --git a/drivers/bcma/driver_chipcommon_pmu.c b/drivers/bcma/driver_chipcommon_pmu.c
index a058842f14fd..61ce4054b3c3 100644
--- a/drivers/bcma/driver_chipcommon_pmu.c
+++ b/drivers/bcma/driver_chipcommon_pmu.c
@@ -139,7 +139,9 @@ void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
                 bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x7);
                 break;
         case 0x4331:
-                /* BCM4331 workaround is SPROM-related, we put it in sprom.c */
+        case 43431:
+                /* Ext PA lines must be enabled for tx on BCM4331 */
+                bcma_chipco_bcm4331_ext_pa_lines_ctl(cc, true);
                 break;
         case 43224:
                 if (bus->chipinfo.rev == 0) {
diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index 9a96f14c8f47..c32ebd537abe 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -232,17 +232,19 @@ void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
                           bool enable)
 {
-        struct pci_dev *pdev = pc->core->bus->host_pci;
+        struct pci_dev *pdev;
         u32 coremask, tmp;
         int err = 0;
 
-        if (core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
+        if (!pc || core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
                 /* This bcma device is not on a PCI host-bus. So the IRQs are
                  * not routed through the PCI core.
                  * So we must not enable routing through the PCI core. */
                 goto out;
         }
 
+        pdev = pc->core->bus->host_pci;
+
         err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
         if (err)
                 goto out;
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index c7f93359acb0..f16f42d36071 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -579,13 +579,13 @@ int bcma_sprom_get(struct bcma_bus *bus)
         if (!sprom)
                 return -ENOMEM;
 
-        if (bus->chipinfo.id == 0x4331)
+        if (bus->chipinfo.id == 0x4331 || bus->chipinfo.id == 43431)
                 bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 
         pr_debug("SPROM offset 0x%x\n", offset);
         bcma_sprom_read(bus, offset, sprom);
 
-        if (bus->chipinfo.id == 0x4331)
+        if (bus->chipinfo.id == 0x4331 || bus->chipinfo.id == 43431)
                 bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, true);
 
         err = bcma_sprom_valid(sprom);
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 764f70c5e690..0a4185279417 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -898,6 +898,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_B43_HB),
         ID(PCI_DEVICE_ID_INTEL_B43_1_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
+        ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D2_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB),
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index c0091753a0d1..8e2d9140f300 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -212,6 +212,7 @@
 #define PCI_DEVICE_ID_INTEL_G41_HB          0x2E30
 #define PCI_DEVICE_ID_INTEL_G41_IG          0x2E32
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB           0x0040
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_D2_HB          0x0069
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG           0x0042
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB           0x0044
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB          0x0062
diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c
index f518b99f53f5..6289f0eee24c 100644
--- a/drivers/char/hw_random/atmel-rng.c
+++ b/drivers/char/hw_random/atmel-rng.c
@@ -36,6 +36,13 @@ static int atmel_trng_read(struct hwrng *rng, void *buf, size_t max,
         /* data ready? */
         if (readl(trng->base + TRNG_ODATA) & 1) {
                 *data = readl(trng->base + TRNG_ODATA);
+                /*
+                  ensure data ready is only set again AFTER the next data
+                  word is ready in case it got set between checking ISR
+                  and reading ODATA, so we don't risk re-reading the
+                  same word
+                */
+                readl(trng->base + TRNG_ISR);
                 return 4;
         } else
                 return 0;
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index 8d81a1d32653..dd3e661a124d 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -6,6 +6,7 @@ obj-$(CONFIG_CS5535_CLOCK_EVENT_SRC)	+= cs5535-clockevt.o
 obj-$(CONFIG_SH_TIMER_CMT)      += sh_cmt.o
 obj-$(CONFIG_SH_TIMER_MTU2)     += sh_mtu2.o
 obj-$(CONFIG_SH_TIMER_TMU)      += sh_tmu.o
+obj-$(CONFIG_EM_TIMER_STI)      += em_sti.o
 obj-$(CONFIG_CLKBLD_I8253)      += i8253.o
 obj-$(CONFIG_CLKSRC_MMIO)       += mmio.o
 obj-$(CONFIG_DW_APB_TIMER)      += dw_apb_timer.o
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
new file mode 100644
index 000000000000..372051d1bba8
--- /dev/null
+++ b/drivers/clocksource/em_sti.c
@@ -0,0 +1,406 @@
+/*
+ * Emma Mobile Timer Support - STI
+ *
+ *  Copyright (C) 2012 Magnus Damm
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/io.h>
+#include <linux/clk.h>
+#include <linux/irq.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/clocksource.h>
+#include <linux/clockchips.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+
+enum { USER_CLOCKSOURCE, USER_CLOCKEVENT, USER_NR };
+
+struct em_sti_priv {
+        void __iomem *base;
+        struct clk *clk;
+        struct platform_device *pdev;
+        unsigned int active[USER_NR];
+        unsigned long rate;
+        raw_spinlock_t lock;
+        struct clock_event_device ced;
+        struct clocksource cs;
+};
+
+#define STI_CONTROL 0x00
+#define STI_COMPA_H 0x10
+#define STI_COMPA_L 0x14
+#define STI_COMPB_H 0x18
+#define STI_COMPB_L 0x1c
+#define STI_COUNT_H 0x20
+#define STI_COUNT_L 0x24
+#define STI_COUNT_RAW_H 0x28
+#define STI_COUNT_RAW_L 0x2c
+#define STI_SET_H 0x30
+#define STI_SET_L 0x34
+#define STI_INTSTATUS 0x40
+#define STI_INTRAWSTATUS 0x44
+#define STI_INTENSET 0x48
+#define STI_INTENCLR 0x4c
+#define STI_INTFFCLR 0x50
+
+static inline unsigned long em_sti_read(struct em_sti_priv *p, int offs)
+{
+        return ioread32(p->base + offs);
+}
+
+static inline void em_sti_write(struct em_sti_priv *p, int offs,
+                                unsigned long value)
+{
+        iowrite32(value, p->base + offs);
+}
+
+static int em_sti_enable(struct em_sti_priv *p)
+{
+        int ret;
+
+        /* enable clock */
+        ret = clk_enable(p->clk);
+        if (ret) {
+                dev_err(&p->pdev->dev, "cannot enable clock\n");
+                return ret;
+        }
+
+        /* configure channel, periodic mode and maximum timeout */
+        p->rate = clk_get_rate(p->clk);
+
+        /* reset the counter */
+        em_sti_write(p, STI_SET_H, 0x40000000);
+        em_sti_write(p, STI_SET_L, 0x00000000);
+
+        /* mask and clear pending interrupts */
+        em_sti_write(p, STI_INTENCLR, 3);
+        em_sti_write(p, STI_INTFFCLR, 3);
+
+        /* enable updates of counter registers */
+        em_sti_write(p, STI_CONTROL, 1);
+
+        return 0;
+}
+
+static void em_sti_disable(struct em_sti_priv *p)
+{
+        /* mask interrupts */
+        em_sti_write(p, STI_INTENCLR, 3);
+
+        /* stop clock */
+        clk_disable(p->clk);
+}
+
+static cycle_t em_sti_count(struct em_sti_priv *p)
+{
+        cycle_t ticks;
+        unsigned long flags;
+
+        /* the STI hardware buffers the 48-bit count, but to
+         * break it out into two 32-bit access the registers
+         * must be accessed in a certain order.
+         * Always read STI_COUNT_H before STI_COUNT_L.
+         */
+        raw_spin_lock_irqsave(&p->lock, flags);
+        ticks = (cycle_t)(em_sti_read(p, STI_COUNT_H) & 0xffff) << 32;
+        ticks |= em_sti_read(p, STI_COUNT_L);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
+
+        return ticks;
+}
+
+static cycle_t em_sti_set_next(struct em_sti_priv *p, cycle_t next)
+{
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&p->lock, flags);
+
+        /* mask compare A interrupt */
+        em_sti_write(p, STI_INTENCLR, 1);
+
+        /* update compare A value */
+        em_sti_write(p, STI_COMPA_H, next >> 32);
+        em_sti_write(p, STI_COMPA_L, next & 0xffffffff);
+
+        /* clear compare A interrupt source */
+        em_sti_write(p, STI_INTFFCLR, 1);
+
+        /* unmask compare A interrupt */
+        em_sti_write(p, STI_INTENSET, 1);
+
+        raw_spin_unlock_irqrestore(&p->lock, flags);
+
+        return next;
+}
+
+static irqreturn_t em_sti_interrupt(int irq, void *dev_id)
+{
+        struct em_sti_priv *p = dev_id;
+
+        p->ced.event_handler(&p->ced);
+        return IRQ_HANDLED;
+}
+
+static int em_sti_start(struct em_sti_priv *p, unsigned int user)
+{
+        unsigned long flags;
+        int used_before;
+        int ret = 0;
+
+        raw_spin_lock_irqsave(&p->lock, flags);
+        used_before = p->active[USER_CLOCKSOURCE] | p->active[USER_CLOCKEVENT];
+        if (!used_before)
+                ret = em_sti_enable(p);
+
+        if (!ret)
+                p->active[user] = 1;
+        raw_spin_unlock_irqrestore(&p->lock, flags);
+
+        return ret;
+}
+
+static void em_sti_stop(struct em_sti_priv *p, unsigned int user)
+{
+        unsigned long flags;
+        int used_before, used_after;
+
+        raw_spin_lock_irqsave(&p->lock, flags);
+        used_before = p->active[USER_CLOCKSOURCE] | p->active[USER_CLOCKEVENT];
+        p->active[user] = 0;
+        used_after = p->active[USER_CLOCKSOURCE] | p->active[USER_CLOCKEVENT];
+
+        if (used_before && !used_after)
+                em_sti_disable(p);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
+}
+
+static struct em_sti_priv *cs_to_em_sti(struct clocksource *cs)
+{
+        return container_of(cs, struct em_sti_priv, cs);
+}
+
+static cycle_t em_sti_clocksource_read(struct clocksource *cs)
+{
+        return em_sti_count(cs_to_em_sti(cs));
+}
+
+static int em_sti_clocksource_enable(struct clocksource *cs)
+{
+        int ret;
+        struct em_sti_priv *p = cs_to_em_sti(cs);
+
+        ret = em_sti_start(p, USER_CLOCKSOURCE);
+        if (!ret)
+                __clocksource_updatefreq_hz(cs, p->rate);
+        return ret;
+}
+
+static void em_sti_clocksource_disable(struct clocksource *cs)
+{
+        em_sti_stop(cs_to_em_sti(cs), USER_CLOCKSOURCE);
+}
+
+static void em_sti_clocksource_resume(struct clocksource *cs)
+{
+        em_sti_clocksource_enable(cs);
+}
+
+static int em_sti_register_clocksource(struct em_sti_priv *p)
+{
+        struct clocksource *cs = &p->cs;
+
+        memset(cs, 0, sizeof(*cs));
+        cs->name = dev_name(&p->pdev->dev);
+        cs->rating = 200;
+        cs->read = em_sti_clocksource_read;
+        cs->enable = em_sti_clocksource_enable;
+        cs->disable = em_sti_clocksource_disable;
+        cs->suspend = em_sti_clocksource_disable;
+        cs->resume = em_sti_clocksource_resume;
+        cs->mask = CLOCKSOURCE_MASK(48);
+        cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
+
+        dev_info(&p->pdev->dev, "used as clock source\n");
+
+        /* Register with dummy 1 Hz value, gets updated in ->enable() */
+        clocksource_register_hz(cs, 1);
+        return 0;
+}
+
+static struct em_sti_priv *ced_to_em_sti(struct clock_event_device *ced)
+{
+        return container_of(ced, struct em_sti_priv, ced);
+}
+
+static void em_sti_clock_event_mode(enum clock_event_mode mode,
+                                    struct clock_event_device *ced)
+{
+        struct em_sti_priv *p = ced_to_em_sti(ced);
+
+        /* deal with old setting first */
+        switch (ced->mode) {
+        case CLOCK_EVT_MODE_ONESHOT:
+                em_sti_stop(p, USER_CLOCKEVENT);
+                break;
+        default:
+                break;
+        }
+
+        switch (mode) {
+        case CLOCK_EVT_MODE_ONESHOT:
+                dev_info(&p->pdev->dev, "used for oneshot clock events\n");
+                em_sti_start(p, USER_CLOCKEVENT);
+                clockevents_config(&p->ced, p->rate);
+                break;
+        case CLOCK_EVT_MODE_SHUTDOWN:
+        case CLOCK_EVT_MODE_UNUSED:
+                em_sti_stop(p, USER_CLOCKEVENT);
+                break;
+        default:
+                break;
+        }
+}
+
+static int em_sti_clock_event_next(unsigned long delta,
+                                   struct clock_event_device *ced)
+{
+        struct em_sti_priv *p = ced_to_em_sti(ced);
+        cycle_t next;
+        int safe;
+
+        next = em_sti_set_next(p, em_sti_count(p) + delta);
+        safe = em_sti_count(p) < (next - 1);
+
+        return !safe;
+}
+
+static void em_sti_register_clockevent(struct em_sti_priv *p)
+{
+        struct clock_event_device *ced = &p->ced;
+
+        memset(ced, 0, sizeof(*ced));
+        ced->name = dev_name(&p->pdev->dev);
+        ced->features = CLOCK_EVT_FEAT_ONESHOT;
+        ced->rating = 200;
+        ced->cpumask = cpumask_of(0);
+        ced->set_next_event = em_sti_clock_event_next;
+        ced->set_mode = em_sti_clock_event_mode;
+
+        dev_info(&p->pdev->dev, "used for clock events\n");
+
+        /* Register with dummy 1 Hz value, gets updated in ->set_mode() */
+        clockevents_config_and_register(ced, 1, 2, 0xffffffff);
+}
+
+static int __devinit em_sti_probe(struct platform_device *pdev)
+{
+        struct em_sti_priv *p;
+        struct resource *res;
+        int irq, ret;
+
+        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        if (p == NULL) {
+                dev_err(&pdev->dev, "failed to allocate driver data\n");
+                ret = -ENOMEM;
+                goto err0;
+        }
+
+        p->pdev = pdev;
+        platform_set_drvdata(pdev, p);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to get I/O memory\n");
+                ret = -EINVAL;
+                goto err0;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "failed to get irq\n");
+                ret = -EINVAL;
+                goto err0;
+        }
+
+        /* map memory, let base point to the STI instance */
+        p->base = ioremap_nocache(res->start, resource_size(res));
+        if (p->base == NULL) {
+                dev_err(&pdev->dev, "failed to remap I/O memory\n");
+                ret = -ENXIO;
+                goto err0;
+        }
+
+        /* get hold of clock */
+        p->clk = clk_get(&pdev->dev, "sclk");
+        if (IS_ERR(p->clk)) {
+                dev_err(&pdev->dev, "cannot get clock\n");
+                ret = PTR_ERR(p->clk);
+                goto err1;
+        }
+
+        if (request_irq(irq, em_sti_interrupt,
+                        IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
+                        dev_name(&pdev->dev), p)) {
+                dev_err(&pdev->dev, "failed to request low IRQ\n");
+                ret = -ENOENT;
+                goto err2;
+        }
+
+        raw_spin_lock_init(&p->lock);
+        em_sti_register_clockevent(p);
+        em_sti_register_clocksource(p);
+        return 0;
+
+err2:
+        clk_put(p->clk);
+err1:
+        iounmap(p->base);
+err0:
+        kfree(p);
+        return ret;
+}
+
+static int __devexit em_sti_remove(struct platform_device *pdev)
+{
+        return -EBUSY; /* cannot unregister clockevent and clocksource */
+}
+
+static const struct of_device_id em_sti_dt_ids[] __devinitconst = {
+        { .compatible = "renesas,em-sti", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, em_sti_dt_ids);
+
+static struct platform_driver em_sti_device_driver = {
+        .probe          = em_sti_probe,
+        .remove         = __devexit_p(em_sti_remove),
+        .driver         = {
+                .name   = "em_sti",
+                .of_match_table = em_sti_dt_ids,
+        }
+};
+
+module_platform_driver(em_sti_device_driver);
+
+MODULE_AUTHOR("Magnus Damm");
+MODULE_DESCRIPTION("Renesas Emma Mobile STI Timer Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 32fe9ef5cc5c..98b06baafcc6 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -48,13 +48,13 @@ struct sh_cmt_priv {
         unsigned long next_match_value;
         unsigned long max_match_value;
         unsigned long rate;
-        spinlock_t lock;
+        raw_spinlock_t lock;
         struct clock_event_device ced;
         struct clocksource cs;
         unsigned long total_cycles;
 };
 
-static DEFINE_SPINLOCK(sh_cmt_lock);
+static DEFINE_RAW_SPINLOCK(sh_cmt_lock);
 
 #define CMSTR -1 /* shared register */
 #define CMCSR 0 /* channel register */
@@ -139,7 +139,7 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
         unsigned long flags, value;
 
         /* start stop register shared by multiple timer channels */
-        spin_lock_irqsave(&sh_cmt_lock, flags);
+        raw_spin_lock_irqsave(&sh_cmt_lock, flags);
         value = sh_cmt_read(p, CMSTR);
 
         if (start)
@@ -148,7 +148,7 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
                 value &= ~(1 << cfg->timer_bit);
 
         sh_cmt_write(p, CMSTR, value);
-        spin_unlock_irqrestore(&sh_cmt_lock, flags);
+        raw_spin_unlock_irqrestore(&sh_cmt_lock, flags);
 }
 
 static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
@@ -328,9 +328,9 @@ static void sh_cmt_set_next(struct sh_cmt_priv *p, unsigned long delta)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
         __sh_cmt_set_next(p, delta);
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static irqreturn_t sh_cmt_interrupt(int irq, void *dev_id)
@@ -385,7 +385,7 @@ static int sh_cmt_start(struct sh_cmt_priv *p, unsigned long flag)
         int ret = 0;
         unsigned long flags;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
 
         if (!(p->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE)))
                 ret = sh_cmt_enable(p, &p->rate);
@@ -398,7 +398,7 @@ static int sh_cmt_start(struct sh_cmt_priv *p, unsigned long flag)
         if ((flag == FLAG_CLOCKSOURCE) && (!(p->flags & FLAG_CLOCKEVENT)))
                 __sh_cmt_set_next(p, p->max_match_value);
  out:
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 
         return ret;
 }
@@ -408,7 +408,7 @@ static void sh_cmt_stop(struct sh_cmt_priv *p, unsigned long flag)
         unsigned long flags;
         unsigned long f;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
 
         f = p->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE);
         p->flags &= ~flag;
@@ -420,7 +420,7 @@ static void sh_cmt_stop(struct sh_cmt_priv *p, unsigned long flag)
         if ((flag == FLAG_CLOCKEVENT) && (p->flags & FLAG_CLOCKSOURCE))
                 __sh_cmt_set_next(p, p->max_match_value);
 
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static struct sh_cmt_priv *cs_to_sh_cmt(struct clocksource *cs)
@@ -435,13 +435,13 @@ static cycle_t sh_cmt_clocksource_read(struct clocksource *cs)
         unsigned long value;
         int has_wrapped;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
         value = p->total_cycles;
         raw = sh_cmt_get_counter(p, &has_wrapped);
 
         if (unlikely(has_wrapped))
                 raw += p->match_value + 1;
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 
         return value + raw;
 }
@@ -591,7 +591,7 @@ static int sh_cmt_register(struct sh_cmt_priv *p, char *name,
                 p->max_match_value = (1 << p->width) - 1;
 
         p->match_value = p->max_match_value;
-        spin_lock_init(&p->lock);
+        raw_spin_lock_init(&p->lock);
 
         if (clockevent_rating)
                 sh_cmt_register_clockevent(p, name, clockevent_rating);
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index a2172f690418..d9b76ca64a61 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -43,7 +43,7 @@ struct sh_mtu2_priv {
         struct clock_event_device ced;
 };
 
-static DEFINE_SPINLOCK(sh_mtu2_lock);
+static DEFINE_RAW_SPINLOCK(sh_mtu2_lock);
 
 #define TSTR -1 /* shared register */
 #define TCR  0 /* channel register */
@@ -107,7 +107,7 @@ static void sh_mtu2_start_stop_ch(struct sh_mtu2_priv *p, int start)
         unsigned long flags, value;
 
         /* start stop register shared by multiple timer channels */
-        spin_lock_irqsave(&sh_mtu2_lock, flags);
+        raw_spin_lock_irqsave(&sh_mtu2_lock, flags);
         value = sh_mtu2_read(p, TSTR);
 
         if (start)
@@ -116,7 +116,7 @@ static void sh_mtu2_start_stop_ch(struct sh_mtu2_priv *p, int start)
                 value &= ~(1 << cfg->timer_bit);
 
         sh_mtu2_write(p, TSTR, value);
-        spin_unlock_irqrestore(&sh_mtu2_lock, flags);
+        raw_spin_unlock_irqrestore(&sh_mtu2_lock, flags);
 }
 
 static int sh_mtu2_enable(struct sh_mtu2_priv *p)
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 97f54b634be4..c1b51d49d106 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -45,7 +45,7 @@ struct sh_tmu_priv {
         struct clocksource cs;
 };
 
-static DEFINE_SPINLOCK(sh_tmu_lock);
+static DEFINE_RAW_SPINLOCK(sh_tmu_lock);
 
 #define TSTR -1 /* shared register */
 #define TCOR  0 /* channel register */
@@ -95,7 +95,7 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_priv *p, int start)
         unsigned long flags, value;
 
         /* start stop register shared by multiple timer channels */
-        spin_lock_irqsave(&sh_tmu_lock, flags);
+        raw_spin_lock_irqsave(&sh_tmu_lock, flags);
         value = sh_tmu_read(p, TSTR);
 
         if (start)
@@ -104,7 +104,7 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_priv *p, int start)
                 value &= ~(1 << cfg->timer_bit);
 
         sh_tmu_write(p, TSTR, value);
-        spin_unlock_irqrestore(&sh_tmu_lock, flags);
+        raw_spin_unlock_irqrestore(&sh_tmu_lock, flags);
 }
 
 static int sh_tmu_enable(struct sh_tmu_priv *p)
@@ -245,12 +245,7 @@ static void sh_tmu_clock_event_start(struct sh_tmu_priv *p, int periodic)
 
         sh_tmu_enable(p);
 
-        /* TODO: calculate good shift from rate and counter bit width */
-
-        ced->shift = 32;
-        ced->mult = div_sc(p->rate, NSEC_PER_SEC, ced->shift);
-        ced->max_delta_ns = clockevent_delta2ns(0xffffffff, ced);
-        ced->min_delta_ns = 5000;
+        clockevents_config(ced, p->rate);
 
         if (periodic) {
                 p->periodic = (p->rate + HZ/2) / HZ;
@@ -323,7 +318,8 @@ static void sh_tmu_register_clockevent(struct sh_tmu_priv *p,
         ced->set_mode = sh_tmu_clock_event_mode;
 
         dev_info(&p->pdev->dev, "used for clock events\n");
-        clockevents_register_device(ced);
+
+        clockevents_config_and_register(ced, 1, 0x300, 0xffffffff);
 
         ret = setup_irq(p->irqaction.irq, &p->irqaction);
         if (ret) {
diff --git a/drivers/gpio/gpio-samsung.c b/drivers/gpio/gpio-samsung.c
index 7bb00448e13d..b6453d0e44ad 100644
--- a/drivers/gpio/gpio-samsung.c
+++ b/drivers/gpio/gpio-samsung.c
@@ -2833,7 +2833,7 @@ static __init void exynos5_gpiolib_init(void)
         }
 
         /* need to set base address for gpc4 */
-        exonys5_gpios_1[11].base = gpio_base1 + 0x2E0;
+        exynos5_gpios_1[11].base = gpio_base1 + 0x2E0;
 
         /* need to set base address for gpx */
         chip = &exynos5_gpios_1[21];
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 420953197d0a..d6de2e07fa03 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -244,8 +244,8 @@ static const struct file_operations exynos_drm_driver_fops = {
 };
 
 static struct drm_driver exynos_drm_driver = {
-        .driver_features        = DRIVER_HAVE_IRQ | DRIVER_BUS_PLATFORM |
-                                  DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME,
+        .driver_features        = DRIVER_HAVE_IRQ | DRIVER_MODESET |
+                                        DRIVER_GEM | DRIVER_PRIME,
         .load                   = exynos_drm_load,
         .unload                 = exynos_drm_unload,
         .open                   = exynos_drm_open,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.c b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
index 6e9ac7bd1dcf..23d5ad379f86 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
@@ -172,19 +172,12 @@ static void exynos_drm_encoder_commit(struct drm_encoder *encoder)
                 manager_ops->commit(manager->dev);
 }
 
-static struct drm_crtc *
-exynos_drm_encoder_get_crtc(struct drm_encoder *encoder)
-{
-        return encoder->crtc;
-}
-
 static struct drm_encoder_helper_funcs exynos_encoder_helper_funcs = {
         .dpms           = exynos_drm_encoder_dpms,
         .mode_fixup     = exynos_drm_encoder_mode_fixup,
         .mode_set       = exynos_drm_encoder_mode_set,
         .prepare        = exynos_drm_encoder_prepare,
         .commit         = exynos_drm_encoder_commit,
-        .get_crtc       = exynos_drm_encoder_get_crtc,
 };
 
 static void exynos_drm_encoder_destroy(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index f82a299553fb..4ccfe4328fab 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -51,11 +51,22 @@ struct exynos_drm_fb {
 static void exynos_drm_fb_destroy(struct drm_framebuffer *fb)
 {
         struct exynos_drm_fb *exynos_fb = to_exynos_fb(fb);
+        unsigned int i;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         drm_framebuffer_cleanup(fb);
 
+        for (i = 0; i < ARRAY_SIZE(exynos_fb->exynos_gem_obj); i++) {
+                struct drm_gem_object *obj;
+
+                if (exynos_fb->exynos_gem_obj[i] == NULL)
+                        continue;
+
+                obj = &exynos_fb->exynos_gem_obj[i]->base;
+                drm_gem_object_unreference_unlocked(obj);
+        }
+
         kfree(exynos_fb);
         exynos_fb = NULL;
 }
@@ -134,11 +145,11 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                 return ERR_PTR(-ENOENT);
         }
 
-        drm_gem_object_unreference_unlocked(obj);
-
         fb = exynos_drm_framebuffer_init(dev, mode_cmd, obj);
-        if (IS_ERR(fb))
+        if (IS_ERR(fb)) {
+                drm_gem_object_unreference_unlocked(obj);
                 return fb;
+        }
 
         exynos_fb = to_exynos_fb(fb);
         nr = exynos_drm_format_num_buffers(fb->pixel_format);
@@ -152,8 +163,6 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                         return ERR_PTR(-ENOENT);
                 }
 
-                drm_gem_object_unreference_unlocked(obj);
-
                 exynos_fb->exynos_gem_obj[i] = to_exynos_gem_obj(obj);
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.h b/drivers/gpu/drm/exynos/exynos_drm_fb.h
index 3ecb30d93552..50823756cdea 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.h
@@ -31,10 +31,10 @@
 static inline int exynos_drm_format_num_buffers(uint32_t format)
 {
         switch (format) {
-        case DRM_FORMAT_NV12M:
+        case DRM_FORMAT_NV12:
         case DRM_FORMAT_NV12MT:
                 return 2;
-        case DRM_FORMAT_YUV420M:
+        case DRM_FORMAT_YUV420:
                 return 3;
         default:
                 return 1;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index fc91293c4560..5c8b683029ea 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -689,7 +689,6 @@ int exynos_drm_gem_dumb_map_offset(struct drm_file *file_priv,
                                    struct drm_device *dev, uint32_t handle,
                                    uint64_t *offset)
 {
-        struct exynos_drm_gem_obj *exynos_gem_obj;
         struct drm_gem_object *obj;
         int ret = 0;
 
@@ -710,15 +709,13 @@ int exynos_drm_gem_dumb_map_offset(struct drm_file *file_priv,
                 goto unlock;
         }
 
-        exynos_gem_obj = to_exynos_gem_obj(obj);
-
-        if (!exynos_gem_obj->base.map_list.map) {
-                ret = drm_gem_create_mmap_offset(&exynos_gem_obj->base);
+        if (!obj->map_list.map) {
+                ret = drm_gem_create_mmap_offset(obj);
                 if (ret)
                         goto out;
         }
 
-        *offset = (u64)exynos_gem_obj->base.map_list.hash.key << PAGE_SHIFT;
+        *offset = (u64)obj->map_list.hash.key << PAGE_SHIFT;
         DRM_DEBUG_KMS("offset = 0x%lx\n", (unsigned long)*offset);
 
 out:
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 68ef01028375..e2147a2ddcec 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -365,7 +365,7 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
         switch (win_data->pixel_format) {
         case DRM_FORMAT_NV12MT:
                 tiled_mode = true;
-        case DRM_FORMAT_NV12M:
+        case DRM_FORMAT_NV12:
                 crcb_mode = false;
                 buf_num = 2;
                 break;
@@ -601,18 +601,20 @@ static void mixer_win_reset(struct mixer_context *ctx)
         mixer_reg_write(res, MXR_BG_COLOR2, 0x008080);
 
         /* setting graphical layers */
-
         val  = MXR_GRP_CFG_COLOR_KEY_DISABLE; /* no blank key */
         val |= MXR_GRP_CFG_WIN_BLEND_EN;
+        val |= MXR_GRP_CFG_BLEND_PRE_MUL;
+        val |= MXR_GRP_CFG_PIXEL_BLEND_EN;
         val |= MXR_GRP_CFG_ALPHA_VAL(0xff); /* non-transparent alpha */
 
         /* the same configuration for both layers */
         mixer_reg_write(res, MXR_GRAPHIC_CFG(0), val);
-
-        val |= MXR_GRP_CFG_BLEND_PRE_MUL;
-        val |= MXR_GRP_CFG_PIXEL_BLEND_EN;
         mixer_reg_write(res, MXR_GRAPHIC_CFG(1), val);
 
+        /* setting video layers */
+        val = MXR_GRP_CFG_ALPHA_VAL(0);
+        mixer_reg_write(res, MXR_VIDEO_CFG, val);
+
         /* configuration of Video Processor Registers */
         vp_win_reset(ctx);
         vp_default_filter(res);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 238a52165833..9fe9ebe52a7a 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -233,6 +233,7 @@ static const struct intel_device_info intel_sandybridge_d_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_sandybridge_m_info = {
@@ -243,6 +244,7 @@ static const struct intel_device_info intel_sandybridge_m_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_ivybridge_d_info = {
@@ -252,6 +254,7 @@ static const struct intel_device_info intel_ivybridge_d_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_ivybridge_m_info = {
@@ -262,6 +265,7 @@ static const struct intel_device_info intel_ivybridge_m_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_valleyview_m_info = {
@@ -289,6 +293,7 @@ static const struct intel_device_info intel_haswell_d_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_haswell_m_info = {
@@ -298,6 +303,7 @@ static const struct intel_device_info intel_haswell_m_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct pci_device_id pciidlist[] = {               /* aka */
@@ -1139,10 +1145,9 @@ MODULE_LICENSE("GPL and additional rights");
 
 /* We give fast paths for the really cool registers */
 #define NEEDS_FORCE_WAKE(dev_priv, reg) \
-       (((dev_priv)->info->gen >= 6) && \
-        ((reg) < 0x40000) &&            \
-        ((reg) != FORCEWAKE)) && \
-       (!IS_VALLEYVIEW((dev_priv)->dev))
+        ((HAS_FORCE_WAKE((dev_priv)->dev)) && \
+         ((reg) < 0x40000) &&            \
+         ((reg) != FORCEWAKE))
 
 #define __i915_read(x, y) \
 u##x i915_read##x(struct drm_i915_private *dev_priv, u32 reg) { \
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c9cfc67c2cf5..b0b676abde0d 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -285,6 +285,7 @@ struct intel_device_info {
         u8 is_ivybridge:1;
         u8 is_valleyview:1;
         u8 has_pch_split:1;
+        u8 has_force_wake:1;
         u8 is_haswell:1;
         u8 has_fbc:1;
         u8 has_pipe_cxsr:1;
@@ -1101,6 +1102,8 @@ struct drm_i915_file_private {
 #define HAS_PCH_CPT(dev) (INTEL_PCH_TYPE(dev) == PCH_CPT)
 #define HAS_PCH_IBX(dev) (INTEL_PCH_TYPE(dev) == PCH_IBX)
 
+#define HAS_FORCE_WAKE(dev) (INTEL_INFO(dev)->has_force_wake)
+
 #include "i915_trace.h"
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 1417660a93ec..b1fe0edda955 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -510,7 +510,7 @@ out:
         return ret;
 }
 
-static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
+static void ibx_irq_handler(struct drm_device *dev, u32 pch_iir)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         int pipe;
@@ -550,6 +550,35 @@ static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
                 DRM_DEBUG_DRIVER("PCH transcoder A underrun interrupt\n");
 }
 
+static void cpt_irq_handler(struct drm_device *dev, u32 pch_iir)
+{
+        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        int pipe;
+
+        if (pch_iir & SDE_AUDIO_POWER_MASK_CPT)
+                DRM_DEBUG_DRIVER("PCH audio power change on port %d\n",
+                                 (pch_iir & SDE_AUDIO_POWER_MASK_CPT) >>
+                                 SDE_AUDIO_POWER_SHIFT_CPT);
+
+        if (pch_iir & SDE_AUX_MASK_CPT)
+                DRM_DEBUG_DRIVER("AUX channel interrupt\n");
+
+        if (pch_iir & SDE_GMBUS_CPT)
+                DRM_DEBUG_DRIVER("PCH GMBUS interrupt\n");
+
+        if (pch_iir & SDE_AUDIO_CP_REQ_CPT)
+                DRM_DEBUG_DRIVER("Audio CP request interrupt\n");
+
+        if (pch_iir & SDE_AUDIO_CP_CHG_CPT)
+                DRM_DEBUG_DRIVER("Audio CP change interrupt\n");
+
+        if (pch_iir & SDE_FDI_MASK_CPT)
+                for_each_pipe(pipe)
+                        DRM_DEBUG_DRIVER("  pipe %c FDI IIR: 0x%08x\n",
+                                         pipe_name(pipe),
+                                         I915_READ(FDI_RX_IIR(pipe)));
+}
+
 static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
 {
         struct drm_device *dev = (struct drm_device *) arg;
@@ -591,7 +620,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
 
                         if (pch_iir & SDE_HOTPLUG_MASK_CPT)
                                 queue_work(dev_priv->wq, &dev_priv->hotplug_work);
-                        pch_irq_handler(dev, pch_iir);
+                        cpt_irq_handler(dev, pch_iir);
 
                         /* clear PCH hotplug event before clear CPU irq */
                         I915_WRITE(SDEIIR, pch_iir);
@@ -684,7 +713,10 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
         if (de_iir & DE_PCH_EVENT) {
                 if (pch_iir & hotplug_mask)
                         queue_work(dev_priv->wq, &dev_priv->hotplug_work);
-                pch_irq_handler(dev, pch_iir);
+                if (HAS_PCH_CPT(dev))
+                        cpt_irq_handler(dev, pch_iir);
+                else
+                        ibx_irq_handler(dev, pch_iir);
         }
 
         if (de_iir & DE_PCU_EVENT) {
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 2d49b9507ed0..48d5e8e051cf 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -210,6 +210,14 @@
 #define MI_DISPLAY_FLIP         MI_INSTR(0x14, 2)
 #define MI_DISPLAY_FLIP_I915    MI_INSTR(0x14, 1)
 #define   MI_DISPLAY_FLIP_PLANE(n) ((n) << 20)
+/* IVB has funny definitions for which plane to flip. */
+#define   MI_DISPLAY_FLIP_IVB_PLANE_A  (0 << 19)
+#define   MI_DISPLAY_FLIP_IVB_PLANE_B  (1 << 19)
+#define   MI_DISPLAY_FLIP_IVB_SPRITE_A (2 << 19)
+#define   MI_DISPLAY_FLIP_IVB_SPRITE_B (3 << 19)
+#define   MI_DISPLAY_FLIP_IVB_PLANE_C  (4 << 19)
+#define   MI_DISPLAY_FLIP_IVB_SPRITE_C (5 << 19)
+
 #define MI_SET_CONTEXT          MI_INSTR(0x18, 0)
 #define   MI_MM_SPACE_GTT               (1<<8)
 #define   MI_MM_SPACE_PHYSICAL          (0<<8)
@@ -3313,7 +3321,7 @@
 
 /* PCH */
 
-/* south display engine interrupt */
+/* south display engine interrupt: IBX */
 #define SDE_AUDIO_POWER_D       (1 << 27)
 #define SDE_AUDIO_POWER_C       (1 << 26)
 #define SDE_AUDIO_POWER_B       (1 << 25)
@@ -3349,15 +3357,44 @@
 #define SDE_TRANSA_CRC_ERR      (1 << 1)
 #define SDE_TRANSA_FIFO_UNDER   (1 << 0)
 #define SDE_TRANS_MASK          (0x3f)
-/* CPT */
-#define SDE_CRT_HOTPLUG_CPT     (1 << 19)
+
+/* south display engine interrupt: CPT/PPT */
+#define SDE_AUDIO_POWER_D_CPT   (1 << 31)
+#define SDE_AUDIO_POWER_C_CPT   (1 << 30)
+#define SDE_AUDIO_POWER_B_CPT   (1 << 29)
+#define SDE_AUDIO_POWER_SHIFT_CPT   29
+#define SDE_AUDIO_POWER_MASK_CPT    (7 << 29)
+#define SDE_AUXD_CPT            (1 << 27)
+#define SDE_AUXC_CPT            (1 << 26)
+#define SDE_AUXB_CPT            (1 << 25)
+#define SDE_AUX_MASK_CPT        (7 << 25)
 #define SDE_PORTD_HOTPLUG_CPT   (1 << 23)
 #define SDE_PORTC_HOTPLUG_CPT   (1 << 22)
 #define SDE_PORTB_HOTPLUG_CPT   (1 << 21)
+#define SDE_CRT_HOTPLUG_CPT     (1 << 19)
 #define SDE_HOTPLUG_MASK_CPT    (SDE_CRT_HOTPLUG_CPT |          \
                                  SDE_PORTD_HOTPLUG_CPT |        \
                                  SDE_PORTC_HOTPLUG_CPT |        \
                                  SDE_PORTB_HOTPLUG_CPT)
+#define SDE_GMBUS_CPT           (1 << 17)
+#define SDE_AUDIO_CP_REQ_C_CPT  (1 << 10)
+#define SDE_AUDIO_CP_CHG_C_CPT  (1 << 9)
+#define SDE_FDI_RXC_CPT         (1 << 8)
+#define SDE_AUDIO_CP_REQ_B_CPT  (1 << 6)
+#define SDE_AUDIO_CP_CHG_B_CPT  (1 << 5)
+#define SDE_FDI_RXB_CPT         (1 << 4)
+#define SDE_AUDIO_CP_REQ_A_CPT  (1 << 2)
+#define SDE_AUDIO_CP_CHG_A_CPT  (1 << 1)
+#define SDE_FDI_RXA_CPT         (1 << 0)
+#define SDE_AUDIO_CP_REQ_CPT    (SDE_AUDIO_CP_REQ_C_CPT | \
+                                 SDE_AUDIO_CP_REQ_B_CPT | \
+                                 SDE_AUDIO_CP_REQ_A_CPT)
+#define SDE_AUDIO_CP_CHG_CPT    (SDE_AUDIO_CP_CHG_C_CPT | \
+                                 SDE_AUDIO_CP_CHG_B_CPT | \
+                                 SDE_AUDIO_CP_CHG_A_CPT)
+#define SDE_FDI_MASK_CPT        (SDE_FDI_RXC_CPT | \
+                                 SDE_FDI_RXB_CPT | \
+                                 SDE_FDI_RXA_CPT)
 
 #define SDEISR  0xc4000
 #define SDEIMR  0xc4004
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 914789420906..e0aa064def31 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6158,17 +6158,34 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct intel_ring_buffer *ring = &dev_priv->ring[BCS];
+        uint32_t plane_bit = 0;
         int ret;
 
         ret = intel_pin_and_fence_fb_obj(dev, obj, ring);
         if (ret)
                 goto err;
 
+        switch(intel_crtc->plane) {
+        case PLANE_A:
+                plane_bit = MI_DISPLAY_FLIP_IVB_PLANE_A;
+                break;
+        case PLANE_B:
+                plane_bit = MI_DISPLAY_FLIP_IVB_PLANE_B;
+                break;
+        case PLANE_C:
+                plane_bit = MI_DISPLAY_FLIP_IVB_PLANE_C;
+                break;
+        default:
+                WARN_ONCE(1, "unknown plane in flip command\n");
+                ret = -ENODEV;
+                goto err;
+        }
+
         ret = intel_ring_begin(ring, 4);
         if (ret)
                 goto err_unpin;
 
-        intel_ring_emit(ring, MI_DISPLAY_FLIP_I915 | (intel_crtc->plane << 19));
+        intel_ring_emit(ring, MI_DISPLAY_FLIP_I915 | plane_bit);
         intel_ring_emit(ring, (fb->pitches[0] | obj->tiling_mode));
         intel_ring_emit(ring, (obj->gtt_offset));
         intel_ring_emit(ring, (MI_NOOP));
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b59b6d5b7583..e5b84ff89ca5 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -266,10 +266,15 @@ u32 intel_ring_get_active_head(struct intel_ring_buffer *ring)
 
 static int init_ring_common(struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_device *dev = ring->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj = ring->obj;
+        int ret = 0;
         u32 head;
 
+        if (HAS_FORCE_WAKE(dev))
+                gen6_gt_force_wake_get(dev_priv);
+
         /* Stop the ring if it's running. */
         I915_WRITE_CTL(ring, 0);
         I915_WRITE_HEAD(ring, 0);
@@ -317,7 +322,8 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                                 I915_READ_HEAD(ring),
                                 I915_READ_TAIL(ring),
                                 I915_READ_START(ring));
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
 
         if (!drm_core_check_feature(ring->dev, DRIVER_MODESET))
@@ -326,9 +332,14 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                 ring->head = I915_READ_HEAD(ring);
                 ring->tail = I915_READ_TAIL(ring) & TAIL_ADDR;
                 ring->space = ring_space(ring);
+                ring->last_retired_head = -1;
         }
 
-        return 0;
+out:
+        if (HAS_FORCE_WAKE(dev))
+                gen6_gt_force_wake_put(dev_priv);
+
+        return ret;
 }
 
 static int
@@ -987,6 +998,10 @@ static int intel_init_ring_buffer(struct drm_device *dev,
         if (ret)
                 goto err_unref;
 
+        ret = i915_gem_object_set_to_gtt_domain(obj, true);
+        if (ret)
+                goto err_unpin;
+
         ring->virtual_start = ioremap_wc(dev->agp->base + obj->gtt_offset,
                                          ring->size);
         if (ring->virtual_start == NULL) {
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 4e7dd2b4843d..c16554122ccd 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -52,6 +52,7 @@ struct evergreen_cs_track {
         u32                     cb_color_view[12];
         u32                     cb_color_pitch[12];
         u32                     cb_color_slice[12];
+        u32                     cb_color_slice_idx[12];
         u32                     cb_color_attrib[12];
         u32                     cb_color_cmask_slice[8];/* unused */
         u32                     cb_color_fmask_slice[8];/* unused */
@@ -127,12 +128,14 @@ static void evergreen_cs_track_init(struct evergreen_cs_track *track)
                 track->cb_color_info[i] = 0;
                 track->cb_color_view[i] = 0xFFFFFFFF;
                 track->cb_color_pitch[i] = 0;
-                track->cb_color_slice[i] = 0;
+                track->cb_color_slice[i] = 0xfffffff;
+                track->cb_color_slice_idx[i] = 0;
         }
         track->cb_target_mask = 0xFFFFFFFF;
         track->cb_shader_mask = 0xFFFFFFFF;
         track->cb_dirty = true;
 
+        track->db_depth_slice = 0xffffffff;
         track->db_depth_view = 0xFFFFC000;
         track->db_depth_size = 0xFFFFFFFF;
         track->db_depth_control = 0xFFFFFFFF;
@@ -250,10 +253,9 @@ static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
 {
         struct evergreen_cs_track *track = p->track;
         unsigned palign, halign, tileb, slice_pt;
+        unsigned mtile_pr, mtile_ps, mtileb;
 
         tileb = 64 * surf->bpe * surf->nsamples;
-        palign = track->group_size / (8 * surf->bpe * surf->nsamples);
-        palign = MAX(8, palign);
         slice_pt = 1;
         if (tileb > surf->tsplit) {
                 slice_pt = tileb / surf->tsplit;
@@ -262,7 +264,10 @@ static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
         /* macro tile width & height */
         palign = (8 * surf->bankw * track->npipes) * surf->mtilea;
         halign = (8 * surf->bankh * surf->nbanks) / surf->mtilea;
-        surf->layer_size = surf->nbx * surf->nby * surf->bpe * slice_pt;
+        mtileb = (palign / 8) * (halign / 8) * tileb;;
+        mtile_pr = surf->nbx / palign;
+        mtile_ps = (mtile_pr * surf->nby) / halign;
+        surf->layer_size = mtile_ps * mtileb * slice_pt;
         surf->base_align = (palign / 8) * (halign / 8) * tileb;
         surf->palign = palign;
         surf->halign = halign;
@@ -434,6 +439,39 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 
         offset += surf.layer_size * mslice;
         if (offset > radeon_bo_size(track->cb_color_bo[id])) {
+                /* old ddx are broken they allocate bo with w*h*bpp but
+                 * program slice with ALIGN(h, 8), catch this and patch
+                 * command stream.
+                 */
+                if (!surf.mode) {
+                        volatile u32 *ib = p->ib.ptr;
+                        unsigned long tmp, nby, bsize, size, min = 0;
+
+                        /* find the height the ddx wants */
+                        if (surf.nby > 8) {
+                                min = surf.nby - 8;
+                        }
+                        bsize = radeon_bo_size(track->cb_color_bo[id]);
+                        tmp = track->cb_color_bo_offset[id] << 8;
+                        for (nby = surf.nby; nby > min; nby--) {
+                                size = nby * surf.nbx * surf.bpe * surf.nsamples;
+                                if ((tmp + size * mslice) <= bsize) {
+                                        break;
+                                }
+                        }
+                        if (nby > min) {
+                                surf.nby = nby;
+                                slice = ((nby * surf.nbx) / 64) - 1;
+                                if (!evergreen_surface_check(p, &surf, "cb")) {
+                                        /* check if this one works */
+                                        tmp += surf.layer_size * mslice;
+                                        if (tmp <= bsize) {
+                                                ib[track->cb_color_slice_idx[id]] = slice;
+                                                goto old_ddx_ok;
+                                        }
+                                }
+                        }
+                }
                 dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
                          "offset %d, max layer %d, bo size %ld, slice %d)\n",
                          __func__, __LINE__, id, surf.layer_size,
@@ -446,6 +484,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
                         surf.tsplit, surf.mtilea);
                 return -EINVAL;
         }
+old_ddx_ok:
 
         return 0;
 }
@@ -1532,6 +1571,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
         case CB_COLOR7_SLICE:
                 tmp = (reg - CB_COLOR0_SLICE) / 0x3c;
                 track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
+                track->cb_color_slice_idx[tmp] = idx;
                 track->cb_dirty = true;
                 break;
         case CB_COLOR8_SLICE:
@@ -1540,6 +1580,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
         case CB_COLOR11_SLICE:
                 tmp = ((reg - CB_COLOR8_SLICE) / 0x1c) + 8;
                 track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
+                track->cb_color_slice_idx[tmp] = idx;
                 track->cb_dirty = true;
                 break;
         case CB_COLOR0_ATTRIB:
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 3df4efa11942..3186522a4458 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -460,15 +460,28 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                 rdev->config.cayman.max_pipes_per_simd = 4;
                 rdev->config.cayman.max_tile_pipes = 2;
                 if ((rdev->pdev->device == 0x9900) ||
-                    (rdev->pdev->device == 0x9901)) {
+                    (rdev->pdev->device == 0x9901) ||
+                    (rdev->pdev->device == 0x9905) ||
+                    (rdev->pdev->device == 0x9906) ||
+                    (rdev->pdev->device == 0x9907) ||
+                    (rdev->pdev->device == 0x9908) ||
+                    (rdev->pdev->device == 0x9909) ||
+                    (rdev->pdev->device == 0x9910) ||
+                    (rdev->pdev->device == 0x9917)) {
                         rdev->config.cayman.max_simds_per_se = 6;
                         rdev->config.cayman.max_backends_per_se = 2;
                 } else if ((rdev->pdev->device == 0x9903) ||
-                           (rdev->pdev->device == 0x9904)) {
+                           (rdev->pdev->device == 0x9904) ||
+                           (rdev->pdev->device == 0x990A) ||
+                           (rdev->pdev->device == 0x9913) ||
+                           (rdev->pdev->device == 0x9918)) {
                         rdev->config.cayman.max_simds_per_se = 4;
                         rdev->config.cayman.max_backends_per_se = 2;
-                } else if ((rdev->pdev->device == 0x9990) ||
-                           (rdev->pdev->device == 0x9991)) {
+                } else if ((rdev->pdev->device == 0x9919) ||
+                           (rdev->pdev->device == 0x9990) ||
+                           (rdev->pdev->device == 0x9991) ||
+                           (rdev->pdev->device == 0x9994) ||
+                           (rdev->pdev->device == 0x99A0)) {
                         rdev->config.cayman.max_simds_per_se = 3;
                         rdev->config.cayman.max_backends_per_se = 1;
                 } else {
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 45cfcea63507..f30dc95f83b1 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2426,6 +2426,12 @@ int r600_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                DRM_ERROR("radeon: audio init failed\n");
+                return r;
+        }
+
         return 0;
 }
 
@@ -2462,12 +2468,6 @@ int r600_resume(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                DRM_ERROR("radeon: audio resume failed\n");
-                return r;
-        }
-
         return r;
 }
 
@@ -2577,9 +2577,6 @@ int r600_init(struct radeon_device *rdev)
                 rdev->accel_working = false;
         }
 
-        r = r600_audio_init(rdev);
-        if (r)
-                return r; /* TODO error handling */
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index 7c4fa77f018f..7479a5c503e4 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -192,6 +192,7 @@ void r600_audio_set_clock(struct drm_encoder *encoder, int clock)
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
         int base_rate = 48000;
 
         switch (radeon_encoder->encoder_id) {
@@ -217,8 +218,8 @@ void r600_audio_set_clock(struct drm_encoder *encoder, int clock)
                 WREG32(EVERGREEN_AUDIO_PLL1_DIV, clock * 10);
                 WREG32(EVERGREEN_AUDIO_PLL1_UNK, 0x00000071);
 
-                /* Some magic trigger or src sel? */
-                WREG32_P(0x5ac, 0x01, ~0x77);
+                /* Select DTO source */
+                WREG32(0x5ac, radeon_crtc->crtc_id);
         } else {
                 switch (dig->dig_encoder) {
                 case 0:
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 226379e00ac1..969c27529dfe 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -348,7 +348,6 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
                 WREG32(HDMI0_AUDIO_PACKET_CONTROL + offset,
                        HDMI0_AUDIO_SAMPLE_SEND | /* send audio packets */
                        HDMI0_AUDIO_DELAY_EN(1) | /* default audio delay */
-                       HDMI0_AUDIO_SEND_MAX_PACKETS | /* send NULL packets if no audio is available */
                        HDMI0_AUDIO_PACKETS_PER_LINE(3) | /* should be suffient for all audio modes and small enough for all hblanks */
                        HDMI0_60958_CS_UPDATE); /* allow 60958 channel status fields to be updated */
         }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 85dac33e3cce..fefcca55c1eb 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1374,9 +1374,9 @@ struct cayman_asic {
 
 struct si_asic {
         unsigned max_shader_engines;
-        unsigned max_pipes_per_simd;
         unsigned max_tile_pipes;
-        unsigned max_simds_per_se;
+        unsigned max_cu_per_sh;
+        unsigned max_sh_per_se;
         unsigned max_backends_per_se;
         unsigned max_texture_channel_caches;
         unsigned max_gprs;
@@ -1387,7 +1387,6 @@ struct si_asic {
         unsigned sc_hiz_tile_fifo_size;
         unsigned sc_earlyz_tile_fifo_size;
 
-        unsigned num_shader_engines;
         unsigned num_tile_pipes;
         unsigned num_backends_per_se;
         unsigned backend_disable_mask_per_asic;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index f0bb2b543b13..03e5f5df40f1 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -57,9 +57,10 @@
  *   2.13.0 - virtual memory support, streamout
  *   2.14.0 - add evergreen tiling informations
  *   2.15.0 - add max_pipes query
+ *   2.16.0 - fix evergreen 2D tiled surface calculation
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        15
+#define KMS_DRIVER_MINOR        16
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 79db56e6c2ac..59d44937dd9f 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -476,12 +476,18 @@ int radeon_vm_bo_add(struct radeon_device *rdev,
 
         mutex_lock(&vm->mutex);
         if (last_pfn > vm->last_pfn) {
-                /* grow va space 32M by 32M */
-                unsigned align = ((32 << 20) >> 12) - 1;
+                /* release mutex and lock in right order */
+                mutex_unlock(&vm->mutex);
                 radeon_mutex_lock(&rdev->cs_mutex);
-                radeon_vm_unbind_locked(rdev, vm);
+                mutex_lock(&vm->mutex);
+                /* and check again */
+                if (last_pfn > vm->last_pfn) {
+                        /* grow va space 32M by 32M */
+                        unsigned align = ((32 << 20) >> 12) - 1;
+                        radeon_vm_unbind_locked(rdev, vm);
+                        vm->last_pfn = (last_pfn + align) & ~align;
+                }
                 radeon_mutex_unlock(&rdev->cs_mutex);
-                vm->last_pfn = (last_pfn + align) & ~align;
         }
         head = &vm->va;
         last_offset = 0;
@@ -595,8 +601,8 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         if (bo_va == NULL)
                 return 0;
 
-        mutex_lock(&vm->mutex);
         radeon_mutex_lock(&rdev->cs_mutex);
+        mutex_lock(&vm->mutex);
         radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
         radeon_mutex_unlock(&rdev->cs_mutex);
         list_del(&bo_va->vm_list);
@@ -641,9 +647,8 @@ void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
         struct radeon_bo_va *bo_va, *tmp;
         int r;
 
-        mutex_lock(&vm->mutex);
-
         radeon_mutex_lock(&rdev->cs_mutex);
+        mutex_lock(&vm->mutex);
         radeon_vm_unbind_locked(rdev, vm);
         radeon_mutex_unlock(&rdev->cs_mutex);
 
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index f1016a5820d1..5c58d7d90cb2 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -273,7 +273,7 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 break;
         case RADEON_INFO_MAX_PIPES:
                 if (rdev->family >= CHIP_TAHITI)
-                        value = rdev->config.si.max_pipes_per_simd;
+                        value = rdev->config.si.max_cu_per_sh;
                 else if (rdev->family >= CHIP_CAYMAN)
                         value = rdev->config.cayman.max_pipes_per_simd;
                 else if (rdev->family >= CHIP_CEDAR)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 25f9eef12c42..e95c5e61d4e2 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -908,12 +908,6 @@ static int rs600_startup(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "failed initializing audio\n");
-                return r;
-        }
-
         r = radeon_ib_pool_start(rdev);
         if (r)
                 return r;
@@ -922,6 +916,12 @@ static int rs600_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                dev_err(rdev->dev, "failed initializing audio\n");
+                return r;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3277ddecfe9f..159b6a43fda0 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -637,12 +637,6 @@ static int rs690_startup(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "failed initializing audio\n");
-                return r;
-        }
-
         r = radeon_ib_pool_start(rdev);
         if (r)
                 return r;
@@ -651,6 +645,12 @@ static int rs690_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                dev_err(rdev->dev, "failed initializing audio\n");
+                return r;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 04ddc365a908..4ad0281fdc37 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -956,6 +956,12 @@ static int rv770_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                DRM_ERROR("radeon: audio init failed\n");
+                return r;
+        }
+
         return 0;
 }
 
@@ -978,12 +984,6 @@ int rv770_resume(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "radeon: audio init failed\n");
-                return r;
-        }
-
         return r;
 
 }
@@ -1092,12 +1092,6 @@ int rv770_init(struct radeon_device *rdev)
                 rdev->accel_working = false;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "radeon: audio init failed\n");
-                return r;
-        }
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 549732e56ca9..c7b61f16ecfd 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -867,200 +867,6 @@ void dce6_bandwidth_update(struct radeon_device *rdev)
 /*
  * Core functions
  */
-static u32 si_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
-                                           u32 num_tile_pipes,
-                                           u32 num_backends_per_asic,
-                                           u32 *backend_disable_mask_per_asic,
-                                           u32 num_shader_engines)
-{
-        u32 backend_map = 0;
-        u32 enabled_backends_mask = 0;
-        u32 enabled_backends_count = 0;
-        u32 num_backends_per_se;
-        u32 cur_pipe;
-        u32 swizzle_pipe[SI_MAX_PIPES];
-        u32 cur_backend = 0;
-        u32 i;
-        bool force_no_swizzle;
-
-        /* force legal values */
-        if (num_tile_pipes < 1)
-                num_tile_pipes = 1;
-        if (num_tile_pipes > rdev->config.si.max_tile_pipes)
-                num_tile_pipes = rdev->config.si.max_tile_pipes;
-        if (num_shader_engines < 1)
-                num_shader_engines = 1;
-        if (num_shader_engines > rdev->config.si.max_shader_engines)
-                num_shader_engines = rdev->config.si.max_shader_engines;
-        if (num_backends_per_asic < num_shader_engines)
-                num_backends_per_asic = num_shader_engines;
-        if (num_backends_per_asic > (rdev->config.si.max_backends_per_se * num_shader_engines))
-                num_backends_per_asic = rdev->config.si.max_backends_per_se * num_shader_engines;
-
-        /* make sure we have the same number of backends per se */
-        num_backends_per_asic = ALIGN(num_backends_per_asic, num_shader_engines);
-        /* set up the number of backends per se */
-        num_backends_per_se = num_backends_per_asic / num_shader_engines;
-        if (num_backends_per_se > rdev->config.si.max_backends_per_se) {
-                num_backends_per_se = rdev->config.si.max_backends_per_se;
-                num_backends_per_asic = num_backends_per_se * num_shader_engines;
-        }
-
-        /* create enable mask and count for enabled backends */
-        for (i = 0; i < SI_MAX_BACKENDS; ++i) {
-                if (((*backend_disable_mask_per_asic >> i) & 1) == 0) {
-                        enabled_backends_mask |= (1 << i);
-                        ++enabled_backends_count;
-                }
-                if (enabled_backends_count == num_backends_per_asic)
-                        break;
-        }
-
-        /* force the backends mask to match the current number of backends */
-        if (enabled_backends_count != num_backends_per_asic) {
-                u32 this_backend_enabled;
-                u32 shader_engine;
-                u32 backend_per_se;
-
-                enabled_backends_mask = 0;
-                enabled_backends_count = 0;
-                *backend_disable_mask_per_asic = SI_MAX_BACKENDS_MASK;
-                for (i = 0; i < SI_MAX_BACKENDS; ++i) {
-                        /* calc the current se */
-                        shader_engine = i / rdev->config.si.max_backends_per_se;
-                        /* calc the backend per se */
-                        backend_per_se = i % rdev->config.si.max_backends_per_se;
-                        /* default to not enabled */
-                        this_backend_enabled = 0;
-                        if ((shader_engine < num_shader_engines) &&
-                            (backend_per_se < num_backends_per_se))
-                                this_backend_enabled = 1;
-                        if (this_backend_enabled) {
-                                enabled_backends_mask |= (1 << i);
-                                *backend_disable_mask_per_asic &= ~(1 << i);
-                                ++enabled_backends_count;
-                        }
-                }
-        }
-
-
-        memset((uint8_t *)&swizzle_pipe[0], 0, sizeof(u32) * SI_MAX_PIPES);
-        switch (rdev->family) {
-        case CHIP_TAHITI:
-        case CHIP_PITCAIRN:
-        case CHIP_VERDE:
-                force_no_swizzle = true;
-                break;
-        default:
-                force_no_swizzle = false;
-                break;
-        }
-        if (force_no_swizzle) {
-                bool last_backend_enabled = false;
-
-                force_no_swizzle = false;
-                for (i = 0; i < SI_MAX_BACKENDS; ++i) {
-                        if (((enabled_backends_mask >> i) & 1) == 1) {
-                                if (last_backend_enabled)
-                                        force_no_swizzle = true;
-                                last_backend_enabled = true;
-                        } else
-                                last_backend_enabled = false;
-                }
-        }
-
-        switch (num_tile_pipes) {
-        case 1:
-        case 3:
-        case 5:
-        case 7:
-                DRM_ERROR("odd number of pipes!\n");
-                break;
-        case 2:
-                swizzle_pipe[0] = 0;
-                swizzle_pipe[1] = 1;
-                break;
-        case 4:
-                if (force_no_swizzle) {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 1;
-                        swizzle_pipe[2] = 2;
-                        swizzle_pipe[3] = 3;
-                } else {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 2;
-                        swizzle_pipe[2] = 1;
-                        swizzle_pipe[3] = 3;
-                }
-                break;
-        case 6:
-                if (force_no_swizzle) {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 1;
-                        swizzle_pipe[2] = 2;
-                        swizzle_pipe[3] = 3;
-                        swizzle_pipe[4] = 4;
-                        swizzle_pipe[5] = 5;
-                } else {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 2;
-                        swizzle_pipe[2] = 4;
-                        swizzle_pipe[3] = 1;
-                        swizzle_pipe[4] = 3;
-                        swizzle_pipe[5] = 5;
-                }
-                break;
-        case 8:
-                if (force_no_swizzle) {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 1;
-                        swizzle_pipe[2] = 2;
-                        swizzle_pipe[3] = 3;
-                        swizzle_pipe[4] = 4;
-                        swizzle_pipe[5] = 5;
-                        swizzle_pipe[6] = 6;
-                        swizzle_pipe[7] = 7;
-                } else {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 2;
-                        swizzle_pipe[2] = 4;
-                        swizzle_pipe[3] = 6;
-                        swizzle_pipe[4] = 1;
-                        swizzle_pipe[5] = 3;
-                        swizzle_pipe[6] = 5;
-                        swizzle_pipe[7] = 7;
-                }
-                break;
-        }
-
-        for (cur_pipe = 0; cur_pipe < num_tile_pipes; ++cur_pipe) {
-                while (((1 << cur_backend) & enabled_backends_mask) == 0)
-                        cur_backend = (cur_backend + 1) % SI_MAX_BACKENDS;
-
-                backend_map |= (((cur_backend & 0xf) << (swizzle_pipe[cur_pipe] * 4)));
-
-                cur_backend = (cur_backend + 1) % SI_MAX_BACKENDS;
-        }
-
-        return backend_map;
-}
-
-static u32 si_get_disable_mask_per_asic(struct radeon_device *rdev,
-                                        u32 disable_mask_per_se,
-                                        u32 max_disable_mask_per_se,
-                                        u32 num_shader_engines)
-{
-        u32 disable_field_width_per_se = r600_count_pipe_bits(disable_mask_per_se);
-        u32 disable_mask_per_asic = disable_mask_per_se & max_disable_mask_per_se;
-
-        if (num_shader_engines == 1)
-                return disable_mask_per_asic;
-        else if (num_shader_engines == 2)
-                return disable_mask_per_asic | (disable_mask_per_asic << disable_field_width_per_se);
-        else
-                return 0xffffffff;
-}
-
 static void si_tiling_mode_table_init(struct radeon_device *rdev)
 {
         const u32 num_tile_mode_states = 32;
@@ -1562,18 +1368,151 @@ static void si_tiling_mode_table_init(struct radeon_device *rdev)
                 DRM_ERROR("unknown asic: 0x%x\n", rdev->family);
 }
 
+static void si_select_se_sh(struct radeon_device *rdev,
+                            u32 se_num, u32 sh_num)
+{
+        u32 data = INSTANCE_BROADCAST_WRITES;
+
+        if ((se_num == 0xffffffff) && (sh_num == 0xffffffff))
+                data = SH_BROADCAST_WRITES | SE_BROADCAST_WRITES;
+        else if (se_num == 0xffffffff)
+                data |= SE_BROADCAST_WRITES | SH_INDEX(sh_num);
+        else if (sh_num == 0xffffffff)
+                data |= SH_BROADCAST_WRITES | SE_INDEX(se_num);
+        else
+                data |= SH_INDEX(sh_num) | SE_INDEX(se_num);
+        WREG32(GRBM_GFX_INDEX, data);
+}
+
+static u32 si_create_bitmask(u32 bit_width)
+{
+        u32 i, mask = 0;
+
+        for (i = 0; i < bit_width; i++) {
+                mask <<= 1;
+                mask |= 1;
+        }
+        return mask;
+}
+
+static u32 si_get_cu_enabled(struct radeon_device *rdev, u32 cu_per_sh)
+{
+        u32 data, mask;
+
+        data = RREG32(CC_GC_SHADER_ARRAY_CONFIG);
+        if (data & 1)
+                data &= INACTIVE_CUS_MASK;
+        else
+                data = 0;
+        data |= RREG32(GC_USER_SHADER_ARRAY_CONFIG);
+
+        data >>= INACTIVE_CUS_SHIFT;
+
+        mask = si_create_bitmask(cu_per_sh);
+
+        return ~data & mask;
+}
+
+static void si_setup_spi(struct radeon_device *rdev,
+                         u32 se_num, u32 sh_per_se,
+                         u32 cu_per_sh)
+{
+        int i, j, k;
+        u32 data, mask, active_cu;
+
+        for (i = 0; i < se_num; i++) {
+                for (j = 0; j < sh_per_se; j++) {
+                        si_select_se_sh(rdev, i, j);
+                        data = RREG32(SPI_STATIC_THREAD_MGMT_3);
+                        active_cu = si_get_cu_enabled(rdev, cu_per_sh);
+
+                        mask = 1;
+                        for (k = 0; k < 16; k++) {
+                                mask <<= k;
+                                if (active_cu & mask) {
+                                        data &= ~mask;
+                                        WREG32(SPI_STATIC_THREAD_MGMT_3, data);
+                                        break;
+                                }
+                        }
+                }
+        }
+        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
+}
+
+static u32 si_get_rb_disabled(struct radeon_device *rdev,
+                              u32 max_rb_num, u32 se_num,
+                              u32 sh_per_se)
+{
+        u32 data, mask;
+
+        data = RREG32(CC_RB_BACKEND_DISABLE);
+        if (data & 1)
+                data &= BACKEND_DISABLE_MASK;
+        else
+                data = 0;
+        data |= RREG32(GC_USER_RB_BACKEND_DISABLE);
+
+        data >>= BACKEND_DISABLE_SHIFT;
+
+        mask = si_create_bitmask(max_rb_num / se_num / sh_per_se);
+
+        return data & mask;
+}
+
+static void si_setup_rb(struct radeon_device *rdev,
+                        u32 se_num, u32 sh_per_se,
+                        u32 max_rb_num)
+{
+        int i, j;
+        u32 data, mask;
+        u32 disabled_rbs = 0;
+        u32 enabled_rbs = 0;
+
+        for (i = 0; i < se_num; i++) {
+                for (j = 0; j < sh_per_se; j++) {
+                        si_select_se_sh(rdev, i, j);
+                        data = si_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        disabled_rbs |= data << ((i * sh_per_se + j) * TAHITI_RB_BITMAP_WIDTH_PER_SH);
+                }
+        }
+        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
+
+        mask = 1;
+        for (i = 0; i < max_rb_num; i++) {
+                if (!(disabled_rbs & mask))
+                        enabled_rbs |= mask;
+                mask <<= 1;
+        }
+
+        for (i = 0; i < se_num; i++) {
+                si_select_se_sh(rdev, i, 0xffffffff);
+                data = 0;
+                for (j = 0; j < sh_per_se; j++) {
+                        switch (enabled_rbs & 3) {
+                        case 1:
+                                data |= (RASTER_CONFIG_RB_MAP_0 << (i * sh_per_se + j) * 2);
+                                break;
+                        case 2:
+                                data |= (RASTER_CONFIG_RB_MAP_3 << (i * sh_per_se + j) * 2);
+                                break;
+                        case 3:
+                        default:
+                                data |= (RASTER_CONFIG_RB_MAP_2 << (i * sh_per_se + j) * 2);
+                                break;
+                        }
+                        enabled_rbs >>= 2;
+                }
+                WREG32(PA_SC_RASTER_CONFIG, data);
+        }
+        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
+}
+
 static void si_gpu_init(struct radeon_device *rdev)
 {
-        u32 cc_rb_backend_disable = 0;
-        u32 cc_gc_shader_array_config;
         u32 gb_addr_config = 0;
         u32 mc_shared_chmap, mc_arb_ramcfg;
-        u32 gb_backend_map;
-        u32 cgts_tcc_disable;
         u32 sx_debug_1;
-        u32 gc_user_shader_array_config;
-        u32 gc_user_rb_backend_disable;
-        u32 cgts_user_tcc_disable;
         u32 hdp_host_path_cntl;
         u32 tmp;
         int i, j;
@@ -1581,9 +1520,9 @@ static void si_gpu_init(struct radeon_device *rdev)
         switch (rdev->family) {
         case CHIP_TAHITI:
                 rdev->config.si.max_shader_engines = 2;
-                rdev->config.si.max_pipes_per_simd = 4;
                 rdev->config.si.max_tile_pipes = 12;
-                rdev->config.si.max_simds_per_se = 8;
+                rdev->config.si.max_cu_per_sh = 8;
+                rdev->config.si.max_sh_per_se = 2;
                 rdev->config.si.max_backends_per_se = 4;
                 rdev->config.si.max_texture_channel_caches = 12;
                 rdev->config.si.max_gprs = 256;
@@ -1594,12 +1533,13 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.sc_prim_fifo_size_backend = 0x100;
                 rdev->config.si.sc_hiz_tile_fifo_size = 0x30;
                 rdev->config.si.sc_earlyz_tile_fifo_size = 0x130;
+                gb_addr_config = TAHITI_GB_ADDR_CONFIG_GOLDEN;
                 break;
         case CHIP_PITCAIRN:
                 rdev->config.si.max_shader_engines = 2;
-                rdev->config.si.max_pipes_per_simd = 4;
                 rdev->config.si.max_tile_pipes = 8;
-                rdev->config.si.max_simds_per_se = 5;
+                rdev->config.si.max_cu_per_sh = 5;
+                rdev->config.si.max_sh_per_se = 2;
                 rdev->config.si.max_backends_per_se = 4;
                 rdev->config.si.max_texture_channel_caches = 8;
                 rdev->config.si.max_gprs = 256;
@@ -1610,13 +1550,14 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.sc_prim_fifo_size_backend = 0x100;
                 rdev->config.si.sc_hiz_tile_fifo_size = 0x30;
                 rdev->config.si.sc_earlyz_tile_fifo_size = 0x130;
+                gb_addr_config = TAHITI_GB_ADDR_CONFIG_GOLDEN;
                 break;
         case CHIP_VERDE:
         default:
                 rdev->config.si.max_shader_engines = 1;
-                rdev->config.si.max_pipes_per_simd = 4;
                 rdev->config.si.max_tile_pipes = 4;
-                rdev->config.si.max_simds_per_se = 2;
+                rdev->config.si.max_cu_per_sh = 2;
+                rdev->config.si.max_sh_per_se = 2;
                 rdev->config.si.max_backends_per_se = 4;
                 rdev->config.si.max_texture_channel_caches = 4;
                 rdev->config.si.max_gprs = 256;
@@ -1627,6 +1568,7 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.sc_prim_fifo_size_backend = 0x40;
                 rdev->config.si.sc_hiz_tile_fifo_size = 0x30;
                 rdev->config.si.sc_earlyz_tile_fifo_size = 0x130;
+                gb_addr_config = VERDE_GB_ADDR_CONFIG_GOLDEN;
                 break;
         }
 
@@ -1648,31 +1590,7 @@ static void si_gpu_init(struct radeon_device *rdev)
         mc_shared_chmap = RREG32(MC_SHARED_CHMAP);
         mc_arb_ramcfg = RREG32(MC_ARB_RAMCFG);
 
-        cc_rb_backend_disable = RREG32(CC_RB_BACKEND_DISABLE);
-        cc_gc_shader_array_config = RREG32(CC_GC_SHADER_ARRAY_CONFIG);
-        cgts_tcc_disable = 0xffff0000;
-        for (i = 0; i < rdev->config.si.max_texture_channel_caches; i++)
-                cgts_tcc_disable &= ~(1 << (16 + i));
-        gc_user_rb_backend_disable = RREG32(GC_USER_RB_BACKEND_DISABLE);
-        gc_user_shader_array_config = RREG32(GC_USER_SHADER_ARRAY_CONFIG);
-        cgts_user_tcc_disable = RREG32(CGTS_USER_TCC_DISABLE);
-
-        rdev->config.si.num_shader_engines = rdev->config.si.max_shader_engines;
         rdev->config.si.num_tile_pipes = rdev->config.si.max_tile_pipes;
-        tmp = ((~gc_user_rb_backend_disable) & BACKEND_DISABLE_MASK) >> BACKEND_DISABLE_SHIFT;
-        rdev->config.si.num_backends_per_se = r600_count_pipe_bits(tmp);
-        tmp = (gc_user_rb_backend_disable & BACKEND_DISABLE_MASK) >> BACKEND_DISABLE_SHIFT;
-        rdev->config.si.backend_disable_mask_per_asic =
-                si_get_disable_mask_per_asic(rdev, tmp, SI_MAX_BACKENDS_PER_SE_MASK,
-                                             rdev->config.si.num_shader_engines);
-        rdev->config.si.backend_map =
-                si_get_tile_pipe_to_backend_map(rdev, rdev->config.si.num_tile_pipes,
-                                                rdev->config.si.num_backends_per_se *
-                                                rdev->config.si.num_shader_engines,
-                                                &rdev->config.si.backend_disable_mask_per_asic,
-                                                rdev->config.si.num_shader_engines);
-        tmp = ((~cgts_user_tcc_disable) & TCC_DISABLE_MASK) >> TCC_DISABLE_SHIFT;
-        rdev->config.si.num_texture_channel_caches = r600_count_pipe_bits(tmp);
         rdev->config.si.mem_max_burst_length_bytes = 256;
         tmp = (mc_arb_ramcfg & NOOFCOLS_MASK) >> NOOFCOLS_SHIFT;
         rdev->config.si.mem_row_size_in_kb = (4 * (1 << (8 + tmp))) / 1024;
@@ -1683,55 +1601,8 @@ static void si_gpu_init(struct radeon_device *rdev)
         rdev->config.si.num_gpus = 1;
         rdev->config.si.multi_gpu_tile_size = 64;
 
-        gb_addr_config = 0;
-        switch (rdev->config.si.num_tile_pipes) {
-        case 1:
-                gb_addr_config |= NUM_PIPES(0);
-                break;
-        case 2:
-                gb_addr_config |= NUM_PIPES(1);
-                break;
-        case 4:
-                gb_addr_config |= NUM_PIPES(2);
-                break;
-        case 8:
-        default:
-                gb_addr_config |= NUM_PIPES(3);
-                break;
-        }
-
-        tmp = (rdev->config.si.mem_max_burst_length_bytes / 256) - 1;
-        gb_addr_config |= PIPE_INTERLEAVE_SIZE(tmp);
-        gb_addr_config |= NUM_SHADER_ENGINES(rdev->config.si.num_shader_engines - 1);
-        tmp = (rdev->config.si.shader_engine_tile_size / 16) - 1;
-        gb_addr_config |= SHADER_ENGINE_TILE_SIZE(tmp);
-        switch (rdev->config.si.num_gpus) {
-        case 1:
-        default:
-                gb_addr_config |= NUM_GPUS(0);
-                break;
-        case 2:
-                gb_addr_config |= NUM_GPUS(1);
-                break;
-        case 4:
-                gb_addr_config |= NUM_GPUS(2);
-                break;
-        }
-        switch (rdev->config.si.multi_gpu_tile_size) {
-        case 16:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(0);
-                break;
-        case 32:
-        default:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(1);
-                break;
-        case 64:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(2);
-                break;
-        case 128:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(3);
-                break;
-        }
+        /* fix up row size */
+        gb_addr_config &= ~ROW_SIZE_MASK;
         switch (rdev->config.si.mem_row_size_in_kb) {
         case 1:
         default:
@@ -1745,26 +1616,6 @@ static void si_gpu_init(struct radeon_device *rdev)
                 break;
         }
 
-        tmp = (gb_addr_config & NUM_PIPES_MASK) >> NUM_PIPES_SHIFT;
-        rdev->config.si.num_tile_pipes = (1 << tmp);
-        tmp = (gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT;
-        rdev->config.si.mem_max_burst_length_bytes = (tmp + 1) * 256;
-        tmp = (gb_addr_config & NUM_SHADER_ENGINES_MASK) >> NUM_SHADER_ENGINES_SHIFT;
-        rdev->config.si.num_shader_engines = tmp + 1;
-        tmp = (gb_addr_config & NUM_GPUS_MASK) >> NUM_GPUS_SHIFT;
-        rdev->config.si.num_gpus = tmp + 1;
-        tmp = (gb_addr_config & MULTI_GPU_TILE_SIZE_MASK) >> MULTI_GPU_TILE_SIZE_SHIFT;
-        rdev->config.si.multi_gpu_tile_size = 1 << tmp;
-        tmp = (gb_addr_config & ROW_SIZE_MASK) >> ROW_SIZE_SHIFT;
-        rdev->config.si.mem_row_size_in_kb = 1 << tmp;
-
-        gb_backend_map =
-                si_get_tile_pipe_to_backend_map(rdev, rdev->config.si.num_tile_pipes,
-                                                rdev->config.si.num_backends_per_se *
-                                                rdev->config.si.num_shader_engines,
-                                                &rdev->config.si.backend_disable_mask_per_asic,
-                                                rdev->config.si.num_shader_engines);
-
         /* setup tiling info dword.  gb_addr_config is not adequate since it does
          * not have bank info, so create a custom tiling dword.
          * bits 3:0   num_pipes
@@ -1789,33 +1640,29 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.tile_config |= (3 << 0);
                 break;
         }
-        rdev->config.si.tile_config |=
-                ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
+        if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
+                rdev->config.si.tile_config |= 1 << 4;
+        else
+                rdev->config.si.tile_config |= 0 << 4;
         rdev->config.si.tile_config |=
                 ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
         rdev->config.si.tile_config |=
                 ((gb_addr_config & ROW_SIZE_MASK) >> ROW_SIZE_SHIFT) << 12;
 
-        rdev->config.si.backend_map = gb_backend_map;
         WREG32(GB_ADDR_CONFIG, gb_addr_config);
         WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
         WREG32(HDP_ADDR_CONFIG, gb_addr_config);
 
-        /* primary versions */
-        WREG32(CC_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(CC_SYS_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(CC_GC_SHADER_ARRAY_CONFIG, cc_gc_shader_array_config);
-
-        WREG32(CGTS_TCC_DISABLE, cgts_tcc_disable);
+        si_tiling_mode_table_init(rdev);
 
-        /* user versions */
-        WREG32(GC_USER_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(GC_USER_SYS_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(GC_USER_SHADER_ARRAY_CONFIG, cc_gc_shader_array_config);
+        si_setup_rb(rdev, rdev->config.si.max_shader_engines,
+                    rdev->config.si.max_sh_per_se,
+                    rdev->config.si.max_backends_per_se);
 
-        WREG32(CGTS_USER_TCC_DISABLE, cgts_tcc_disable);
+        si_setup_spi(rdev, rdev->config.si.max_shader_engines,
+                     rdev->config.si.max_sh_per_se,
+                     rdev->config.si.max_cu_per_sh);
 
-        si_tiling_mode_table_init(rdev);
 
         /* set HW defaults for 3D engine */
         WREG32(CP_QUEUE_THRESHOLDS, (ROQ_IB1_START(0x16) |
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 53ea2c42dbd6..db4067962868 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -24,6 +24,11 @@
 #ifndef SI_H
 #define SI_H
 
+#define TAHITI_RB_BITMAP_WIDTH_PER_SH  2
+
+#define TAHITI_GB_ADDR_CONFIG_GOLDEN        0x12011003
+#define VERDE_GB_ADDR_CONFIG_GOLDEN         0x12010002
+
 #define CG_MULT_THERMAL_STATUS                                  0x714
 #define         ASIC_MAX_TEMP(x)                                ((x) << 0)
 #define         ASIC_MAX_TEMP_MASK                              0x000001ff
@@ -408,6 +413,12 @@
 #define         SOFT_RESET_IA                                   (1 << 15)
 
 #define GRBM_GFX_INDEX                                  0x802C
+#define         INSTANCE_INDEX(x)                       ((x) << 0)
+#define         SH_INDEX(x)                             ((x) << 8)
+#define         SE_INDEX(x)                             ((x) << 16)
+#define         SH_BROADCAST_WRITES                     (1 << 29)
+#define         INSTANCE_BROADCAST_WRITES               (1 << 30)
+#define         SE_BROADCAST_WRITES                     (1 << 31)
 
 #define GRBM_INT_CNTL                                   0x8060
 #       define RDERR_INT_ENABLE                         (1 << 0)
@@ -480,6 +491,8 @@
 #define VGT_TF_MEMORY_BASE                              0x89B8
 
 #define CC_GC_SHADER_ARRAY_CONFIG                       0x89bc
+#define         INACTIVE_CUS_MASK                       0xFFFF0000
+#define         INACTIVE_CUS_SHIFT                      16
 #define GC_USER_SHADER_ARRAY_CONFIG                     0x89c0
 
 #define PA_CL_ENHANCE                                   0x8A14
@@ -688,6 +701,12 @@
 #define RLC_MC_CNTL                                       0xC344
 #define RLC_UCODE_CNTL                                    0xC348
 
+#define PA_SC_RASTER_CONFIG                             0x28350
+#       define RASTER_CONFIG_RB_MAP_0                   0
+#       define RASTER_CONFIG_RB_MAP_1                   1
+#       define RASTER_CONFIG_RB_MAP_2                   2
+#       define RASTER_CONFIG_RB_MAP_3                   3
+
 #define VGT_EVENT_INITIATOR                             0x28a90
 #       define SAMPLE_STREAMOUTSTATS1                   (1 << 0)
 #       define SAMPLE_STREAMOUTSTATS2                   (2 << 0)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index b67cfcaa661f..36f4b28c1b90 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1204,6 +1204,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
                         (*destroy)(bo);
                 else
                         kfree(bo);
+                ttm_mem_global_free(mem_glob, acc_size);
                 return -EINVAL;
         }
         bo->destroy = destroy;
@@ -1307,22 +1308,14 @@ int ttm_bo_create(struct ttm_bo_device *bdev,
                         struct ttm_buffer_object **p_bo)
 {
         struct ttm_buffer_object *bo;
-        struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
         size_t acc_size;
         int ret;
 
-        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
-        ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
-        if (unlikely(ret != 0))
-                return ret;
-
         bo = kzalloc(sizeof(*bo), GFP_KERNEL);
-
-        if (unlikely(bo == NULL)) {
-                ttm_mem_global_free(mem_glob, acc_size);
+        if (unlikely(bo == NULL))
                 return -ENOMEM;
-        }
 
+        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
         ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
                                 buffer_start, interruptible,
                           persistent_swap_storage, acc_size, NULL, NULL);
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index 38f9534ac513..5b3c7d135dc9 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -190,6 +190,19 @@ find_active_client(struct list_head *head)
         return NULL;
 }
 
+int vga_switcheroo_get_client_state(struct pci_dev *pdev)
+{
+        struct vga_switcheroo_client *client;
+
+        client = find_client_from_pci(&vgasr_priv.clients, pdev);
+        if (!client)
+                return VGA_SWITCHEROO_NOT_FOUND;
+        if (!vgasr_priv.active)
+                return VGA_SWITCHEROO_INIT;
+        return client->pwr_state;
+}
+EXPORT_SYMBOL(vga_switcheroo_get_client_state);
+
 void vga_switcheroo_unregister_client(struct pci_dev *pdev)
 {
         struct vga_switcheroo_client *client;
@@ -291,8 +304,6 @@ static int vga_switchto_stage1(struct vga_switcheroo_client *new_client)
                 vga_switchon(new_client);
 
         vga_set_default_device(new_client->pdev);
-        set_audio_state(new_client->id, VGA_SWITCHEROO_ON);
-
         return 0;
 }
 
@@ -308,6 +319,8 @@ static int vga_switchto_stage2(struct vga_switcheroo_client *new_client)
 
         active->active = false;
 
+        set_audio_state(active->id, VGA_SWITCHEROO_OFF);
+
         if (new_client->fb_info) {
                 struct fb_event event;
                 event.info = new_client->fb_info;
@@ -321,11 +334,11 @@ static int vga_switchto_stage2(struct vga_switcheroo_client *new_client)
         if (new_client->ops->reprobe)
                 new_client->ops->reprobe(new_client->pdev);
 
-        set_audio_state(active->id, VGA_SWITCHEROO_OFF);
-
         if (active->pwr_state == VGA_SWITCHEROO_ON)
                 vga_switchoff(active);
 
+        set_audio_state(new_client->id, VGA_SWITCHEROO_ON);
+
         new_client->active = true;
         return 0;
 }
@@ -371,8 +384,9 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
         /* pwr off the device not in use */
         if (strncmp(usercmd, "OFF", 3) == 0) {
                 list_for_each_entry(client, &vgasr_priv.clients, list) {
-                        if (client->active)
+                        if (client->active || client_is_audio(client))
                                 continue;
+                        set_audio_state(client->id, VGA_SWITCHEROO_OFF);
                         if (client->pwr_state == VGA_SWITCHEROO_ON)
                                 vga_switchoff(client);
                 }
@@ -381,10 +395,11 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
         /* pwr on the device not in use */
         if (strncmp(usercmd, "ON", 2) == 0) {
                 list_for_each_entry(client, &vgasr_priv.clients, list) {
-                        if (client->active)
+                        if (client->active || client_is_audio(client))
                                 continue;
                         if (client->pwr_state == VGA_SWITCHEROO_OFF)
                                 vga_switchon(client);
+                        set_audio_state(client->id, VGA_SWITCHEROO_ON);
                 }
                 goto out;
         }
diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig
index beb2491db274..a0edd9854218 100644
--- a/drivers/i2c/muxes/Kconfig
+++ b/drivers/i2c/muxes/Kconfig
@@ -37,4 +37,16 @@ config I2C_MUX_PCA954x
           This driver can also be built as a module.  If so, the module
           will be called i2c-mux-pca954x.
 
+config I2C_MUX_PINCTRL
+        tristate "pinctrl-based I2C multiplexer"
+        depends on PINCTRL
+        help
+          If you say yes to this option, support will be included for an I2C
+          multiplexer that uses the pinctrl subsystem, i.e. pin multiplexing.
+          This is useful for SoCs whose I2C module's signals can be routed to
+          different sets of pins at run-time.
+
+          This driver can also be built as a module. If so, the module will be
+          called pinctrl-i2cmux.
+
 endmenu
diff --git a/drivers/i2c/muxes/Makefile b/drivers/i2c/muxes/Makefile
index 5826249b29ca..76da8692afff 100644
--- a/drivers/i2c/muxes/Makefile
+++ b/drivers/i2c/muxes/Makefile
@@ -4,5 +4,6 @@
 obj-$(CONFIG_I2C_MUX_GPIO)      += i2c-mux-gpio.o
 obj-$(CONFIG_I2C_MUX_PCA9541)   += i2c-mux-pca9541.o
 obj-$(CONFIG_I2C_MUX_PCA954x)   += i2c-mux-pca954x.o
+obj-$(CONFIG_I2C_MUX_PINCTRL)   += i2c-mux-pinctrl.o
 
 ccflags-$(CONFIG_I2C_DEBUG_BUS) := -DDEBUG
diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
new file mode 100644
index 000000000000..46a669763476
--- /dev/null
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -0,0 +1,279 @@
+/*
+ * I2C multiplexer using pinctrl API
+ *
+ * Copyright (c) 2012, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/i2c.h>
+#include <linux/i2c-mux.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/of_i2c.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/i2c-mux-pinctrl.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+
+struct i2c_mux_pinctrl {
+        struct device *dev;
+        struct i2c_mux_pinctrl_platform_data *pdata;
+        struct pinctrl *pinctrl;
+        struct pinctrl_state **states;
+        struct pinctrl_state *state_idle;
+        struct i2c_adapter *parent;
+        struct i2c_adapter **busses;
+};
+
+static int i2c_mux_pinctrl_select(struct i2c_adapter *adap, void *data,
+                                  u32 chan)
+{
+        struct i2c_mux_pinctrl *mux = data;
+
+        return pinctrl_select_state(mux->pinctrl, mux->states[chan]);
+}
+
+static int i2c_mux_pinctrl_deselect(struct i2c_adapter *adap, void *data,
+                                    u32 chan)
+{
+        struct i2c_mux_pinctrl *mux = data;
+
+        return pinctrl_select_state(mux->pinctrl, mux->state_idle);
+}
+
+#ifdef CONFIG_OF
+static int i2c_mux_pinctrl_parse_dt(struct i2c_mux_pinctrl *mux,
+                                struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        int num_names, i, ret;
+        struct device_node *adapter_np;
+        struct i2c_adapter *adapter;
+
+        if (!np)
+                return 0;
+
+        mux->pdata = devm_kzalloc(&pdev->dev, sizeof(*mux->pdata), GFP_KERNEL);
+        if (!mux->pdata) {
+                dev_err(mux->dev,
+                        "Cannot allocate i2c_mux_pinctrl_platform_data\n");
+                return -ENOMEM;
+        }
+
+        num_names = of_property_count_strings(np, "pinctrl-names");
+        if (num_names < 0) {
+                dev_err(mux->dev, "Cannot parse pinctrl-names: %d\n",
+                        num_names);
+                return num_names;
+        }
+
+        mux->pdata->pinctrl_states = devm_kzalloc(&pdev->dev,
+                sizeof(*mux->pdata->pinctrl_states) * num_names,
+                GFP_KERNEL);
+        if (!mux->pdata->pinctrl_states) {
+                dev_err(mux->dev, "Cannot allocate pinctrl_states\n");
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < num_names; i++) {
+                ret = of_property_read_string_index(np, "pinctrl-names", i,
+                        &mux->pdata->pinctrl_states[mux->pdata->bus_count]);
+                if (ret < 0) {
+                        dev_err(mux->dev, "Cannot parse pinctrl-names: %d\n",
+                                ret);
+                        return ret;
+                }
+                if (!strcmp(mux->pdata->pinctrl_states[mux->pdata->bus_count],
+                            "idle")) {
+                        if (i != num_names - 1) {
+                                dev_err(mux->dev, "idle state must be last\n");
+                                return -EINVAL;
+                        }
+                        mux->pdata->pinctrl_state_idle = "idle";
+                } else {
+                        mux->pdata->bus_count++;
+                }
+        }
+
+        adapter_np = of_parse_phandle(np, "i2c-parent", 0);
+        if (!adapter_np) {
+                dev_err(mux->dev, "Cannot parse i2c-parent\n");
+                return -ENODEV;
+        }
+        adapter = of_find_i2c_adapter_by_node(adapter_np);
+        if (!adapter) {
+                dev_err(mux->dev, "Cannot find parent bus\n");
+                return -ENODEV;
+        }
+        mux->pdata->parent_bus_num = i2c_adapter_id(adapter);
+        put_device(&adapter->dev);
+
+        return 0;
+}
+#else
+static inline int i2c_mux_pinctrl_parse_dt(struct i2c_mux_pinctrl *mux,
+                                           struct platform_device *pdev)
+{
+        return 0;
+}
+#endif
+
+static int __devinit i2c_mux_pinctrl_probe(struct platform_device *pdev)
+{
+        struct i2c_mux_pinctrl *mux;
+        int (*deselect)(struct i2c_adapter *, void *, u32);
+        int i, ret;
+
+        mux = devm_kzalloc(&pdev->dev, sizeof(*mux), GFP_KERNEL);
+        if (!mux) {
+                dev_err(&pdev->dev, "Cannot allocate i2c_mux_pinctrl\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+        platform_set_drvdata(pdev, mux);
+
+        mux->dev = &pdev->dev;
+
+        mux->pdata = pdev->dev.platform_data;
+        if (!mux->pdata) {
+                ret = i2c_mux_pinctrl_parse_dt(mux, pdev);
+                if (ret < 0)
+                        goto err;
+        }
+        if (!mux->pdata) {
+                dev_err(&pdev->dev, "Missing platform data\n");
+                ret = -ENODEV;
+                goto err;
+        }
+
+        mux->states = devm_kzalloc(&pdev->dev,
+                                   sizeof(*mux->states) * mux->pdata->bus_count,
+                                   GFP_KERNEL);
+        if (!mux->states) {
+                dev_err(&pdev->dev, "Cannot allocate states\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        mux->busses = devm_kzalloc(&pdev->dev,
+                                   sizeof(mux->busses) * mux->pdata->bus_count,
+                                   GFP_KERNEL);
+        if (!mux->states) {
+                dev_err(&pdev->dev, "Cannot allocate busses\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        mux->pinctrl = devm_pinctrl_get(&pdev->dev);
+        if (IS_ERR(mux->pinctrl)) {
+                ret = PTR_ERR(mux->pinctrl);
+                dev_err(&pdev->dev, "Cannot get pinctrl: %d\n", ret);
+                goto err;
+        }
+        for (i = 0; i < mux->pdata->bus_count; i++) {
+                mux->states[i] = pinctrl_lookup_state(mux->pinctrl,
+                                                mux->pdata->pinctrl_states[i]);
+                        if (IS_ERR(mux->states[i])) {
+                                ret = PTR_ERR(mux->states[i]);
+                                dev_err(&pdev->dev,
+                                        "Cannot look up pinctrl state %s: %d\n",
+                                        mux->pdata->pinctrl_states[i], ret);
+                                goto err;
+                        }
+        }
+        if (mux->pdata->pinctrl_state_idle) {
+                mux->state_idle = pinctrl_lookup_state(mux->pinctrl,
+                                                mux->pdata->pinctrl_state_idle);
+                if (IS_ERR(mux->state_idle)) {
+                        ret = PTR_ERR(mux->state_idle);
+                        dev_err(&pdev->dev,
+                                "Cannot look up pinctrl state %s: %d\n",
+                                mux->pdata->pinctrl_state_idle, ret);
+                        goto err;
+                }
+
+                deselect = i2c_mux_pinctrl_deselect;
+        } else {
+                deselect = NULL;
+        }
+
+        mux->parent = i2c_get_adapter(mux->pdata->parent_bus_num);
+        if (!mux->parent) {
+                dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
+                        mux->pdata->parent_bus_num);
+                ret = -ENODEV;
+                goto err;
+        }
+
+        for (i = 0; i < mux->pdata->bus_count; i++) {
+                u32 bus = mux->pdata->base_bus_num ?
+                                (mux->pdata->base_bus_num + i) : 0;
+
+                mux->busses[i] = i2c_add_mux_adapter(mux->parent, &pdev->dev,
+                                                     mux, bus, i,
+                                                     i2c_mux_pinctrl_select,
+                                                     deselect);
+                if (!mux->busses[i]) {
+                        ret = -ENODEV;
+                        dev_err(&pdev->dev, "Failed to add adapter %d\n", i);
+                        goto err_del_adapter;
+                }
+        }
+
+        return 0;
+
+err_del_adapter:
+        for (; i > 0; i--)
+                i2c_del_mux_adapter(mux->busses[i - 1]);
+        i2c_put_adapter(mux->parent);
+err:
+        return ret;
+}
+
+static int __devexit i2c_mux_pinctrl_remove(struct platform_device *pdev)
+{
+        struct i2c_mux_pinctrl *mux = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < mux->pdata->bus_count; i++)
+                i2c_del_mux_adapter(mux->busses[i]);
+
+        i2c_put_adapter(mux->parent);
+
+        return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id i2c_mux_pinctrl_of_match[] __devinitconst = {
+        { .compatible = "i2c-mux-pinctrl", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, i2c_mux_pinctrl_of_match);
+#endif
+
+static struct platform_driver i2c_mux_pinctrl_driver = {
+        .driver = {
+                .name   = "i2c-mux-pinctrl",
+                .owner  = THIS_MODULE,
+                .of_match_table = of_match_ptr(i2c_mux_pinctrl_of_match),
+        },
+        .probe  = i2c_mux_pinctrl_probe,
+        .remove = __devexit_p(i2c_mux_pinctrl_remove),
+};
+module_platform_driver(i2c_mux_pinctrl_driver);
+
+MODULE_DESCRIPTION("pinctrl-based I2C multiplexer driver");
+MODULE_AUTHOR("Stephen Warren <swarren@nvidia.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:i2c-mux-pinctrl");
diff --git a/drivers/ide/icside.c b/drivers/ide/icside.c
index 8716066a2f2b..bcb507b0cfd4 100644
--- a/drivers/ide/icside.c
+++ b/drivers/ide/icside.c
@@ -236,7 +236,7 @@ static const struct ide_port_ops icside_v6_no_dma_port_ops = {
  */
 static void icside_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
 {
-        unsigned long cycle_time;
+        unsigned long cycle_time = 0;
         int use_dma_info = 0;
         const u8 xfer_mode = drive->dma_mode;
 
@@ -271,9 +271,9 @@ static void icside_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
 
         ide_set_drivedata(drive, (void *)cycle_time);
 
-        printk("%s: %s selected (peak %dMB/s)\n", drive->name,
-                ide_xfer_verbose(xfer_mode),
-                2000 / (unsigned long)ide_get_drivedata(drive));
+        printk(KERN_INFO "%s: %s selected (peak %luMB/s)\n",
+               drive->name, ide_xfer_verbose(xfer_mode),
+               2000 / (cycle_time ? cycle_time : (unsigned long) -1));
 }
 
 static const struct ide_port_ops icside_v6_port_ops = {
@@ -375,8 +375,6 @@ static const struct ide_dma_ops icside_v6_dma_ops = {
         .dma_test_irq           = icside_dma_test_irq,
         .dma_lost_irq           = ide_dma_lost_irq,
 };
-#else
-#define icside_v6_dma_ops NULL
 #endif
 
 static int icside_dma_off_init(ide_hwif_t *hwif, const struct ide_port_info *d)
@@ -456,7 +454,6 @@ err_free:
 static const struct ide_port_info icside_v6_port_info __initdata = {
         .init_dma               = icside_dma_off_init,
         .port_ops               = &icside_v6_no_dma_port_ops,
-        .dma_ops                = &icside_v6_dma_ops,
         .host_flags             = IDE_HFLAG_SERIALIZE | IDE_HFLAG_MMIO,
         .mwdma_mask             = ATA_MWDMA2,
         .swdma_mask             = ATA_SWDMA2,
@@ -518,11 +515,13 @@ icside_register_v6(struct icside_state *state, struct expansion_card *ec)
 
         ecard_set_drvdata(ec, state);
 
+#ifdef CONFIG_BLK_DEV_IDEDMA_ICS
         if (ec->dma != NO_DMA && !request_dma(ec->dma, DRV_NAME)) {
                 d.init_dma = icside_dma_init;
                 d.port_ops = &icside_v6_port_ops;
-        } else
-                d.dma_ops = NULL;
+                d.dma_ops  = &icside_v6_dma_ops;
+        }
+#endif
 
         ret = ide_host_register(host, &d, hws);
         if (ret)
diff --git a/drivers/ide/ide-cs.c b/drivers/ide/ide-cs.c
index 28e344ea514c..f1e922e2479a 100644
--- a/drivers/ide/ide-cs.c
+++ b/drivers/ide/ide-cs.c
@@ -167,7 +167,8 @@ static int pcmcia_check_one_config(struct pcmcia_device *pdev, void *priv_data)
 {
         int *is_kme = priv_data;
 
-        if (!(pdev->resource[0]->flags & IO_DATA_PATH_WIDTH_8)) {
+        if ((pdev->resource[0]->flags & IO_DATA_PATH_WIDTH)
+            != IO_DATA_PATH_WIDTH_8) {
                 pdev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH;
                 pdev->resource[0]->flags |= IO_DATA_PATH_WIDTH_AUTO;
         }
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 55ab284e22f2..b18870c455ad 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1593,6 +1593,10 @@ static int import_ep(struct c4iw_ep *ep, __be32 peer_ip, struct dst_entry *dst,
                 struct net_device *pdev;
 
                 pdev = ip_dev_find(&init_net, peer_ip);
+                if (!pdev) {
+                        err = -ENODEV;
+                        goto out;
+                }
                 ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
                                         n, pdev, 0);
                 if (!ep->l2t)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ee1c577238f7..3530c41fcd1f 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -140,7 +140,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->max_mr_size         = ~0ull;
         props->page_size_cap       = dev->dev->caps.page_size_cap;
         props->max_qp              = dev->dev->caps.num_qps - dev->dev->caps.reserved_qps;
-        props->max_qp_wr           = dev->dev->caps.max_wqes;
+        props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
         props->max_sge             = min(dev->dev->caps.max_sq_sg,
                                          dev->dev->caps.max_rq_sg);
         props->max_cq              = dev->dev->caps.num_cqs - dev->dev->caps.reserved_cqs;
@@ -1084,12 +1084,9 @@ static void mlx4_ib_alloc_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
         int total_eqs = 0;
         int i, j, eq;
 
-        /* Init eq table */
-        ibdev->eq_table = NULL;
-        ibdev->eq_added = 0;
-
-        /* Legacy mode? */
-        if (dev->caps.comp_pool == 0)
+        /* Legacy mode or comp_pool is not large enough */
+        if (dev->caps.comp_pool == 0 ||
+            dev->caps.num_ports > dev->caps.comp_pool)
                 return;
 
         eq_per_port = rounddown_pow_of_two(dev->caps.comp_pool/
@@ -1135,7 +1132,10 @@ static void mlx4_ib_alloc_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
 static void mlx4_ib_free_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
 {
         int i;
-        int total_eqs;
+
+        /* no additional eqs were added */
+        if (!ibdev->eq_table)
+                return;
 
         /* Reset the advertised EQ number */
         ibdev->ib_dev.num_comp_vectors = dev->caps.num_comp_vectors;
@@ -1148,12 +1148,7 @@ static void mlx4_ib_free_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
                 mlx4_release_eq(dev, ibdev->eq_table[i]);
         }
 
-        total_eqs = dev->caps.num_comp_vectors + ibdev->eq_added;
-        memset(ibdev->eq_table, 0, total_eqs * sizeof(int));
         kfree(ibdev->eq_table);
-
-        ibdev->eq_table = NULL;
-        ibdev->eq_added = 0;
 }
 
 static void *mlx4_ib_add(struct mlx4_dev *dev)
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index e62297cc77cc..ff36655d23d3 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -44,6 +44,14 @@
 #include <linux/mlx4/device.h>
 #include <linux/mlx4/doorbell.h>
 
+enum {
+        MLX4_IB_SQ_MIN_WQE_SHIFT = 6,
+        MLX4_IB_MAX_HEADROOM     = 2048
+};
+
+#define MLX4_IB_SQ_HEADROOM(shift)      ((MLX4_IB_MAX_HEADROOM >> (shift)) + 1)
+#define MLX4_IB_SQ_MAX_SPARE            (MLX4_IB_SQ_HEADROOM(MLX4_IB_SQ_MIN_WQE_SHIFT))
+
 struct mlx4_ib_ucontext {
         struct ib_ucontext      ibucontext;
         struct mlx4_uar         uar;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index ceb33327091a..8d4ed24aef93 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -310,8 +310,8 @@ static int set_rq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                        int is_user, int has_rq, struct mlx4_ib_qp *qp)
 {
         /* Sanity check RQ size before proceeding */
-        if (cap->max_recv_wr  > dev->dev->caps.max_wqes  ||
-            cap->max_recv_sge > dev->dev->caps.max_rq_sg)
+        if (cap->max_recv_wr > dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE ||
+            cap->max_recv_sge > min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg))
                 return -EINVAL;
 
         if (!has_rq) {
@@ -329,8 +329,17 @@ static int set_rq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                 qp->rq.wqe_shift = ilog2(qp->rq.max_gs * sizeof (struct mlx4_wqe_data_seg));
         }
 
-        cap->max_recv_wr  = qp->rq.max_post = qp->rq.wqe_cnt;
-        cap->max_recv_sge = qp->rq.max_gs;
+        /* leave userspace return values as they were, so as not to break ABI */
+        if (is_user) {
+                cap->max_recv_wr  = qp->rq.max_post = qp->rq.wqe_cnt;
+                cap->max_recv_sge = qp->rq.max_gs;
+        } else {
+                cap->max_recv_wr  = qp->rq.max_post =
+                        min(dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE, qp->rq.wqe_cnt);
+                cap->max_recv_sge = min(qp->rq.max_gs,
+                                        min(dev->dev->caps.max_sq_sg,
+                                            dev->dev->caps.max_rq_sg));
+        }
 
         return 0;
 }
@@ -341,8 +350,8 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
         int s;
 
         /* Sanity check SQ size before proceeding */
-        if (cap->max_send_wr     > dev->dev->caps.max_wqes  ||
-            cap->max_send_sge    > dev->dev->caps.max_sq_sg ||
+        if (cap->max_send_wr  > (dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE) ||
+            cap->max_send_sge > min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg) ||
             cap->max_inline_data + send_wqe_overhead(type, qp->flags) +
             sizeof (struct mlx4_wqe_inline_seg) > dev->dev->caps.max_sq_desc_sz)
                 return -EINVAL;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma.h b/drivers/infiniband/hw/ocrdma/ocrdma.h
index 85a69c958559..037f5cea85bd 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma.h
@@ -231,7 +231,6 @@ struct ocrdma_qp_hwq_info {
         u32 entry_size;
         u32 max_cnt;
         u32 max_wqe_idx;
-        u32 free_delta;
         u16 dbid;               /* qid, where to ring the doorbell. */
         u32 len;
         dma_addr_t pa;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
index a411a4e3193d..517ab20b727c 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
@@ -101,8 +101,6 @@ struct ocrdma_create_qp_uresp {
         u32 rsvd1;
         u32 num_wqe_allocated;
         u32 num_rqe_allocated;
-        u32 free_wqe_delta;
-        u32 free_rqe_delta;
         u32 db_sq_offset;
         u32 db_rq_offset;
         u32 db_shift;
@@ -126,8 +124,7 @@ struct ocrdma_create_srq_uresp {
         u32 db_rq_offset;
         u32 db_shift;
 
-        u32 free_rqe_delta;
-        u32 rsvd2;
+        u64 rsvd2;
         u64 rsvd3;
 } __packed;
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 9b204b1ba336..9343a1522977 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -732,7 +732,7 @@ static void ocrdma_dispatch_ibevent(struct ocrdma_dev *dev,
                 break;
         case OCRDMA_SRQ_LIMIT_EVENT:
                 ib_evt.element.srq = &qp->srq->ibsrq;
-                ib_evt.event = IB_EVENT_QP_LAST_WQE_REACHED;
+                ib_evt.event = IB_EVENT_SRQ_LIMIT_REACHED;
                 srq_event = 1;
                 qp_event = 0;
                 break;
@@ -1990,19 +1990,12 @@ static void ocrdma_get_create_qp_rsp(struct ocrdma_create_qp_rsp *rsp,
         max_wqe_allocated = 1 << max_wqe_allocated;
         max_rqe_allocated = 1 << ((u16)rsp->max_wqe_rqe);
 
-        if (qp->dev->nic_info.dev_family == OCRDMA_GEN2_FAMILY) {
-                qp->sq.free_delta = 0;
-                qp->rq.free_delta = 1;
-        } else
-                qp->sq.free_delta = 1;
-
         qp->sq.max_cnt = max_wqe_allocated;
         qp->sq.max_wqe_idx = max_wqe_allocated - 1;
 
         if (!attrs->srq) {
                 qp->rq.max_cnt = max_rqe_allocated;
                 qp->rq.max_wqe_idx = max_rqe_allocated - 1;
-                qp->rq.free_delta = 1;
         }
 }
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index a20d16eaae71..04fef3de6d75 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -26,7 +26,6 @@
  *******************************************************************/
 
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/idr.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_user_verbs.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index e9f74d1b48f6..d16d172b6b6b 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -940,8 +940,6 @@ static int ocrdma_copy_qp_uresp(struct ocrdma_qp *qp,
                 uresp.db_rq_offset = OCRDMA_DB_RQ_OFFSET;
                 uresp.db_shift = 16;
         }
-        uresp.free_wqe_delta = qp->sq.free_delta;
-        uresp.free_rqe_delta = qp->rq.free_delta;
 
         if (qp->dpp_enabled) {
                 uresp.dpp_credit = dpp_credit_lmt;
@@ -1307,8 +1305,6 @@ static int ocrdma_hwq_free_cnt(struct ocrdma_qp_hwq_info *q)
                 free_cnt = (q->max_cnt - q->head) + q->tail;
         else
                 free_cnt = q->tail - q->head;
-        if (q->free_delta)
-                free_cnt -= q->free_delta;
         return free_cnt;
 }
 
@@ -1501,7 +1497,6 @@ static int ocrdma_copy_srq_uresp(struct ocrdma_srq *srq, struct ib_udata *udata)
             (srq->pd->id * srq->dev->nic_info.db_page_size);
         uresp.db_page_size = srq->dev->nic_info.db_page_size;
         uresp.num_rqe_allocated = srq->rq.max_cnt;
-        uresp.free_rqe_delta = 1;
         if (srq->dev->nic_info.dev_family == OCRDMA_GEN2_FAMILY) {
                 uresp.db_rq_offset = OCRDMA_DB_GEN2_RQ1_OFFSET;
                 uresp.db_shift = 24;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
index e6483439f25f..633f03d80274 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
@@ -28,7 +28,6 @@
 #ifndef __OCRDMA_VERBS_H__
 #define __OCRDMA_VERBS_H__
 
-#include <linux/version.h>
 int ocrdma_post_send(struct ib_qp *, struct ib_send_wr *,
                      struct ib_send_wr **bad_wr);
 int ocrdma_post_recv(struct ib_qp *, struct ib_recv_wr *,
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index d90a421e9cac..a2e418cba0ff 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -547,26 +547,12 @@ static void iommu_poll_events(struct amd_iommu *iommu)
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
-static void iommu_handle_ppr_entry(struct amd_iommu *iommu, u32 head)
+static void iommu_handle_ppr_entry(struct amd_iommu *iommu, u64 *raw)
 {
         struct amd_iommu_fault fault;
-        volatile u64 *raw;
-        int i;
 
         INC_STATS_COUNTER(pri_requests);
 
-        raw = (u64 *)(iommu->ppr_log + head);
-
-        /*
-         * Hardware bug: Interrupt may arrive before the entry is written to
-         * memory. If this happens we need to wait for the entry to arrive.
-         */
-        for (i = 0; i < LOOP_TIMEOUT; ++i) {
-                if (PPR_REQ_TYPE(raw[0]) != 0)
-                        break;
-                udelay(1);
-        }
-
         if (PPR_REQ_TYPE(raw[0]) != PPR_REQ_FAULT) {
                 pr_err_ratelimited("AMD-Vi: Unknown PPR request received\n");
                 return;
@@ -578,12 +564,6 @@ static void iommu_handle_ppr_entry(struct amd_iommu *iommu, u32 head)
         fault.tag       = PPR_TAG(raw[0]);
         fault.flags     = PPR_FLAGS(raw[0]);
 
-        /*
-         * To detect the hardware bug we need to clear the entry
-         * to back to zero.
-         */
-        raw[0] = raw[1] = 0;
-
         atomic_notifier_call_chain(&ppr_notifier, 0, &fault);
 }
 
@@ -595,25 +575,62 @@ static void iommu_poll_ppr_log(struct amd_iommu *iommu)
         if (iommu->ppr_log == NULL)
                 return;
 
+        /* enable ppr interrupts again */
+        writel(MMIO_STATUS_PPR_INT_MASK, iommu->mmio_base + MMIO_STATUS_OFFSET);
+
         spin_lock_irqsave(&iommu->lock, flags);
 
         head = readl(iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
         tail = readl(iommu->mmio_base + MMIO_PPR_TAIL_OFFSET);
 
         while (head != tail) {
+                volatile u64 *raw;
+                u64 entry[2];
+                int i;
 
-                /* Handle PPR entry */
-                iommu_handle_ppr_entry(iommu, head);
+                raw = (u64 *)(iommu->ppr_log + head);
+
+                /*
+                 * Hardware bug: Interrupt may arrive before the entry is
+                 * written to memory. If this happens we need to wait for the
+                 * entry to arrive.
+                 */
+                for (i = 0; i < LOOP_TIMEOUT; ++i) {
+                        if (PPR_REQ_TYPE(raw[0]) != 0)
+                                break;
+                        udelay(1);
+                }
+
+                /* Avoid memcpy function-call overhead */
+                entry[0] = raw[0];
+                entry[1] = raw[1];
 
-                /* Update and refresh ring-buffer state*/
+                /*
+                 * To detect the hardware bug we need to clear the entry
+                 * back to zero.
+                 */
+                raw[0] = raw[1] = 0UL;
+
+                /* Update head pointer of hardware ring-buffer */
                 head = (head + PPR_ENTRY_SIZE) % PPR_LOG_SIZE;
                 writel(head, iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
+
+                /*
+                 * Release iommu->lock because ppr-handling might need to
+                 * re-aquire it
+                 */
+                spin_unlock_irqrestore(&iommu->lock, flags);
+
+                /* Handle PPR entry */
+                iommu_handle_ppr_entry(iommu, entry);
+
+                spin_lock_irqsave(&iommu->lock, flags);
+
+                /* Refresh ring-buffer information */
+                head = readl(iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
                 tail = readl(iommu->mmio_base + MMIO_PPR_TAIL_OFFSET);
         }
 
-        /* enable ppr interrupts again */
-        writel(MMIO_STATUS_PPR_INT_MASK, iommu->mmio_base + MMIO_STATUS_OFFSET);
-
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index c56790375e0f..542024ba6dba 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1029,6 +1029,9 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
         if (!iommu->dev)
                 return 1;
 
+        iommu->root_pdev = pci_get_bus_and_slot(iommu->dev->bus->number,
+                                                PCI_DEVFN(0, 0));
+
         iommu->cap_ptr = h->cap_ptr;
         iommu->pci_seg = h->pci_seg;
         iommu->mmio_phys = h->mmio_phys;
@@ -1323,20 +1326,16 @@ static void iommu_apply_resume_quirks(struct amd_iommu *iommu)
 {
         int i, j;
         u32 ioc_feature_control;
-        struct pci_dev *pdev = NULL;
+        struct pci_dev *pdev = iommu->root_pdev;
 
         /* RD890 BIOSes may not have completely reconfigured the iommu */
-        if (!is_rd890_iommu(iommu->dev))
+        if (!is_rd890_iommu(iommu->dev) || !pdev)
                 return;
 
         /*
          * First, we need to ensure that the iommu is enabled. This is
          * controlled by a register in the northbridge
          */
-        pdev = pci_get_bus_and_slot(iommu->dev->bus->number, PCI_DEVFN(0, 0));
-
-        if (!pdev)
-                return;
 
         /* Select Northbridge indirect register 0x75 and enable writing */
         pci_write_config_dword(pdev, 0x60, 0x75 | (1 << 7));
@@ -1346,8 +1345,6 @@ static void iommu_apply_resume_quirks(struct amd_iommu *iommu)
         if (!(ioc_feature_control & 0x1))
                 pci_write_config_dword(pdev, 0x64, ioc_feature_control | 1);
 
-        pci_dev_put(pdev);
-
         /* Restore the iommu BAR */
         pci_write_config_dword(iommu->dev, iommu->cap_ptr + 4,
                                iommu->stored_addr_lo);
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 2452f3b71736..24355559a2ad 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -481,6 +481,9 @@ struct amd_iommu {
         /* Pointer to PCI device of this IOMMU */
         struct pci_dev *dev;
 
+        /* Cache pdev to root device for resume quirks */
+        struct pci_dev *root_pdev;
+
         /* physical address of MMIO space */
         u64 mmio_phys;
         /* virtual address of MMIO space */
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 04cb8c88d74b..12b2b55c519e 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -379,7 +379,7 @@ config LEDS_NETXBIG
 
 config LEDS_ASIC3
         bool "LED support for the HTC ASIC3"
-        depends on LEDS_CLASS
+        depends on LEDS_CLASS=y
         depends on MFD_ASIC3
         default y
         help
@@ -390,7 +390,7 @@ config LEDS_ASIC3
 
 config LEDS_RENESAS_TPU
         bool "LED support for Renesas TPU"
-        depends on LEDS_CLASS && HAVE_CLK && GENERIC_GPIO
+        depends on LEDS_CLASS=y && HAVE_CLK && GENERIC_GPIO
         help
           This option enables build of the LED TPU platform driver,
           suitable to drive any TPU channel on newer Renesas SoCs.
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index 8ee92c81aec2..e663e6f413e9 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -29,7 +29,7 @@ static void led_update_brightness(struct led_classdev *led_cdev)
                 led_cdev->brightness = led_cdev->brightness_get(led_cdev);
 }
 
-static ssize_t led_brightness_show(struct device *dev, 
+static ssize_t led_brightness_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
         struct led_classdev *led_cdev = dev_get_drvdata(dev);
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index d6860043f6f9..d65353d8d3fc 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -44,13 +44,6 @@ static void led_set_software_blink(struct led_classdev *led_cdev,
         if (!led_cdev->blink_brightness)
                 led_cdev->blink_brightness = led_cdev->max_brightness;
 
-        if (led_get_trigger_data(led_cdev) &&
-            delay_on == led_cdev->blink_delay_on &&
-            delay_off == led_cdev->blink_delay_off)
-                return;
-
-        led_stop_software_blink(led_cdev);
-
         led_cdev->blink_delay_on = delay_on;
         led_cdev->blink_delay_off = delay_off;
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 835de7168cd3..a9c7981ddd24 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2550,6 +2550,7 @@ static struct r1conf *setup_conf(struct mddev *mddev)
         err = -EINVAL;
         spin_lock_init(&conf->device_lock);
         rdev_for_each(rdev, mddev) {
+                struct request_queue *q;
                 int disk_idx = rdev->raid_disk;
                 if (disk_idx >= mddev->raid_disks
                     || disk_idx < 0)
@@ -2562,6 +2563,9 @@ static struct r1conf *setup_conf(struct mddev *mddev)
                 if (disk->rdev)
                         goto abort;
                 disk->rdev = rdev;
+                q = bdev_get_queue(rdev->bdev);
+                if (q->merge_bvec_fn)
+                        mddev->merge_check_needed = 1;
 
                 disk->head_position = 0;
         }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 987db37cb875..99ae6068e456 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3475,6 +3475,7 @@ static int run(struct mddev *mddev)
 
         rdev_for_each(rdev, mddev) {
                 long long diff;
+                struct request_queue *q;
 
                 disk_idx = rdev->raid_disk;
                 if (disk_idx < 0)
@@ -3493,6 +3494,9 @@ static int run(struct mddev *mddev)
                                 goto out_free_conf;
                         disk->rdev = rdev;
                 }
+                q = bdev_get_queue(rdev->bdev);
+                if (q->merge_bvec_fn)
+                        mddev->merge_check_needed = 1;
                 diff = (rdev->new_data_offset - rdev->data_offset);
                 if (!mddev->reshape_backwards)
                         diff = -diff;
diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
index 9f957c2d48e9..09d4f8d9d592 100644
--- a/drivers/mtd/ubi/debug.c
+++ b/drivers/mtd/ubi/debug.c
@@ -264,6 +264,9 @@ static struct dentry *dfs_rootdir;
  */
 int ubi_debugfs_init(void)
 {
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         dfs_rootdir = debugfs_create_dir("ubi", NULL);
         if (IS_ERR_OR_NULL(dfs_rootdir)) {
                 int err = dfs_rootdir ? -ENODEV : PTR_ERR(dfs_rootdir);
@@ -281,7 +284,8 @@ int ubi_debugfs_init(void)
  */
 void ubi_debugfs_exit(void)
 {
-        debugfs_remove(dfs_rootdir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove(dfs_rootdir);
 }
 
 /* Read an UBI debugfs file */
@@ -403,6 +407,9 @@ int ubi_debugfs_init_dev(struct ubi_device *ubi)
         struct dentry *dent;
         struct ubi_debug_info *d = ubi->dbg;
 
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         n = snprintf(d->dfs_dir_name, UBI_DFS_DIR_LEN + 1, UBI_DFS_DIR_NAME,
                      ubi->ubi_num);
         if (n == UBI_DFS_DIR_LEN) {
@@ -470,5 +477,6 @@ out:
  */
 void ubi_debugfs_exit_dev(struct ubi_device *ubi)
 {
-        debugfs_remove_recursive(ubi->dbg->dfs_dir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove_recursive(ubi->dbg->dfs_dir);
 }
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 9df100a4ec38..b6be644e7b85 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1262,11 +1262,11 @@ int ubi_wl_flush(struct ubi_device *ubi, int vol_id, int lnum)
         dbg_wl("flush pending work for LEB %d:%d (%d pending works)",
                vol_id, lnum, ubi->works_count);
 
-        down_write(&ubi->work_sem);
         while (found) {
                 struct ubi_work *wrk;
                 found = 0;
 
+                down_read(&ubi->work_sem);
                 spin_lock(&ubi->wl_lock);
                 list_for_each_entry(wrk, &ubi->works, list) {
                         if ((vol_id == UBI_ALL || wrk->vol_id == vol_id) &&
@@ -1277,18 +1277,27 @@ int ubi_wl_flush(struct ubi_device *ubi, int vol_id, int lnum)
                                 spin_unlock(&ubi->wl_lock);
 
                                 err = wrk->func(ubi, wrk, 0);
-                                if (err)
-                                        goto out;
+                                if (err) {
+                                        up_read(&ubi->work_sem);
+                                        return err;
+                                }
+
                                 spin_lock(&ubi->wl_lock);
                                 found = 1;
                                 break;
                         }
                 }
                 spin_unlock(&ubi->wl_lock);
+                up_read(&ubi->work_sem);
         }
 
-out:
+        /*
+         * Make sure all the works which have been done in parallel are
+         * finished.
+         */
+        down_write(&ubi->work_sem);
         up_write(&ubi->work_sem);
+
         return err;
 }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2ee8cf9e8a3b..b9c2ae62166d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -76,6 +76,7 @@
 #include <net/route.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
+#include <net/pkt_sched.h>
 #include "bonding.h"
 #include "bond_3ad.h"
 #include "bond_alb.h"
@@ -381,8 +382,6 @@ struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr)
         return next;
 }
 
-#define bond_queue_mapping(skb) (*(u16 *)((skb)->cb))
-
 /**
  * bond_dev_queue_xmit - Prepare skb for xmit.
  *
@@ -395,7 +394,9 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb,
 {
         skb->dev = slave_dev;
 
-        skb->queue_mapping = bond_queue_mapping(skb);
+        BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
+                     sizeof(qdisc_skb_cb(skb)->bond_queue_mapping));
+        skb->queue_mapping = qdisc_skb_cb(skb)->bond_queue_mapping;
 
         if (unlikely(netpoll_tx_running(slave_dev)))
                 bond_netpoll_send_skb(bond_get_slave_by_dev(bond, slave_dev), skb);
@@ -4171,7 +4172,7 @@ static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
         /*
          * Save the original txq to restore before passing to the driver
          */
-        bond_queue_mapping(skb) = skb->queue_mapping;
+        qdisc_skb_cb(skb)->bond_queue_mapping = skb->queue_mapping;
 
         if (unlikely(txq >= dev->real_num_tx_queues)) {
                 do {
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index aef42f045320..485bedb8278c 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1082,8 +1082,12 @@ static ssize_t bonding_store_primary(struct device *d,
                 }
         }
 
-        pr_info("%s: Unable to set %.*s as primary slave.\n",
-                bond->dev->name, (int)strlen(buf) - 1, buf);
+        strncpy(bond->params.primary, ifname, IFNAMSIZ);
+        bond->params.primary[IFNAMSIZ - 1] = 0;
+
+        pr_info("%s: Recording %s as primary, "
+                "but it has not been enslaved to %s yet.\n",
+                bond->dev->name, ifname, bond->dev->name);
 out:
         write_unlock_bh(&bond->curr_slave_lock);
         read_unlock(&bond->lock);
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 536bda072a16..8dc84d66eea1 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -686,7 +686,7 @@ static int c_can_get_berr_counter(const struct net_device *dev,
  *
  * We iterate from priv->tx_echo to priv->tx_next and check if the
  * packet has been transmitted, echo it back to the CAN framework.
- * If we discover a not yet transmitted package, stop looking for more.
+ * If we discover a not yet transmitted packet, stop looking for more.
  */
 static void c_can_do_tx(struct net_device *dev)
 {
@@ -698,7 +698,7 @@ static void c_can_do_tx(struct net_device *dev)
         for (/* nix */; (priv->tx_next - priv->tx_echo) > 0; priv->tx_echo++) {
                 msg_obj_no = get_tx_echo_msg_obj(priv);
                 val = c_can_read_reg32(priv, &priv->regs->txrqst1);
-                if (!(val & (1 << msg_obj_no))) {
+                if (!(val & (1 << (msg_obj_no - 1)))) {
                         can_get_echo_skb(dev,
                                         msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
                         stats->tx_bytes += priv->read_reg(priv,
@@ -706,6 +706,8 @@ static void c_can_do_tx(struct net_device *dev)
                                         & IF_MCONT_DLC_MASK;
                         stats->tx_packets++;
                         c_can_inval_msg_object(dev, 0, msg_obj_no);
+                } else {
+                        break;
                 }
         }
 
@@ -950,7 +952,7 @@ static int c_can_poll(struct napi_struct *napi, int quota)
         struct net_device *dev = napi->dev;
         struct c_can_priv *priv = netdev_priv(dev);
 
-        irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
+        irqstatus = priv->irqstatus;
         if (!irqstatus)
                 goto end;
 
@@ -1028,12 +1030,11 @@ end:
 
 static irqreturn_t c_can_isr(int irq, void *dev_id)
 {
-        u16 irqstatus;
         struct net_device *dev = (struct net_device *)dev_id;
         struct c_can_priv *priv = netdev_priv(dev);
 
-        irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
-        if (!irqstatus)
+        priv->irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
+        if (!priv->irqstatus)
                 return IRQ_NONE;
 
         /* disable all interrupts and schedule the NAPI */
@@ -1063,10 +1064,11 @@ static int c_can_open(struct net_device *dev)
                 goto exit_irq_fail;
         }
 
+        napi_enable(&priv->napi);
+
         /* start the c_can controller */
         c_can_start(dev);
 
-        napi_enable(&priv->napi);
         netif_start_queue(dev);
 
         return 0;
diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h
index 9b7fbef3d09a..5f32d34af507 100644
--- a/drivers/net/can/c_can/c_can.h
+++ b/drivers/net/can/c_can/c_can.h
@@ -76,6 +76,7 @@ struct c_can_priv {
         unsigned int tx_next;
         unsigned int tx_echo;
         void *priv;             /* for board-specific data */
+        u16 irqstatus;
 };
 
 struct net_device *alloc_c_can_dev(void);
diff --git a/drivers/net/can/cc770/cc770_platform.c b/drivers/net/can/cc770/cc770_platform.c
index 53115eee8075..688371cda37a 100644
--- a/drivers/net/can/cc770/cc770_platform.c
+++ b/drivers/net/can/cc770/cc770_platform.c
@@ -154,7 +154,7 @@ static int __devinit cc770_get_platform_data(struct platform_device *pdev,
         struct cc770_platform_data *pdata = pdev->dev.platform_data;
 
         priv->can.clock.freq = pdata->osc_freq;
-        if (priv->cpu_interface | CPUIF_DSC)
+        if (priv->cpu_interface & CPUIF_DSC)
                 priv->can.clock.freq /= 2;
         priv->clkout = pdata->cor;
         priv->bus_config = pdata->bcr;
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 442d91a2747b..bab0158f1cc3 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -187,8 +187,10 @@ static int __init dummy_init_module(void)
         rtnl_lock();
         err = __rtnl_link_register(&dummy_link_ops);
 
-        for (i = 0; i < numdummies && !err; i++)
+        for (i = 0; i < numdummies && !err; i++) {
                 err = dummy_init_one();
+                cond_resched();
+        }
         if (err < 0)
                 __rtnl_link_unregister(&dummy_link_ops);
         rtnl_unlock();
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index e30e2a2f354c..7de824184979 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -747,21 +747,6 @@ struct bnx2x_fastpath {
 
 #define ETH_RX_ERROR_FALGS              ETH_FAST_PATH_RX_CQE_PHY_DECODE_ERR_FLG
 
-#define BNX2X_IP_CSUM_ERR(cqe) \
-                        (!((cqe)->fast_path_cqe.status_flags & \
-                           ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG) && \
-                         ((cqe)->fast_path_cqe.type_error_flags & \
-                          ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG))
-
-#define BNX2X_L4_CSUM_ERR(cqe) \
-                        (!((cqe)->fast_path_cqe.status_flags & \
-                           ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG) && \
-                         ((cqe)->fast_path_cqe.type_error_flags & \
-                          ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG))
-
-#define BNX2X_RX_CSUM_OK(cqe) \
-                        (!(BNX2X_L4_CSUM_ERR(cqe) || BNX2X_IP_CSUM_ERR(cqe)))
-
 #define BNX2X_PRS_FLAG_OVERETH_IPV4(flags) \
                                 (((le16_to_cpu(flags) & \
                                    PARSING_FLAGS_OVER_ETHERNET_PROTOCOL) >> \
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ad0743bf4bde..cbc56f274e0c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -617,6 +617,25 @@ static int bnx2x_alloc_rx_data(struct bnx2x *bp,
         return 0;
 }
 
+static void bnx2x_csum_validate(struct sk_buff *skb, union eth_rx_cqe *cqe,
+                                struct bnx2x_fastpath *fp)
+{
+        /* Do nothing if no IP/L4 csum validation was done */
+
+        if (cqe->fast_path_cqe.status_flags &
+            (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG |
+             ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG))
+                return;
+
+        /* If both IP/L4 validation were done, check if an error was found. */
+
+        if (cqe->fast_path_cqe.type_error_flags &
+            (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
+             ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG))
+                fp->eth_q_stats.hw_csum_err++;
+        else
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
 
 int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
 {
@@ -806,13 +825,9 @@ reuse_rx:
 
                 skb_checksum_none_assert(skb);
 
-                if (bp->dev->features & NETIF_F_RXCSUM) {
+                if (bp->dev->features & NETIF_F_RXCSUM)
+                        bnx2x_csum_validate(skb, cqe, fp);
 
-                        if (likely(BNX2X_RX_CSUM_OK(cqe)))
-                                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        else
-                                fp->eth_q_stats.hw_csum_err++;
-                }
 
                 skb_record_rx_queue(skb, fp->rx_queue);
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index edeeb516807a..e47ff8be1d7b 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14275,7 +14275,8 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 }
         }
 
-        if (tg3_flag(tp, 5755_PLUS))
+        if (tg3_flag(tp, 5755_PLUS) ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
                 tg3_flag_set(tp, SHORT_DMA_BUG);
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 08efd308d78a..fdb50cec6b51 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -736,6 +736,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
 
         copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
         if (copied) {
+                int gso_segs = skb_shinfo(skb)->gso_segs;
+
                 /* record the sent skb in the sent_skb table */
                 BUG_ON(txo->sent_skb_list[start]);
                 txo->sent_skb_list[start] = skb;
@@ -753,8 +755,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
 
                 be_txq_notify(adapter, txq->id, wrb_cnt);
 
-                be_tx_stats_update(txo, wrb_cnt, copied,
-                                skb_shinfo(skb)->gso_segs, stopped);
+                be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
         } else {
                 txq->head = start;
                 dev_kfree_skb_any(skb);
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index d863075df7a4..905e2147d918 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -258,7 +258,8 @@ static int e1000_set_settings(struct net_device *netdev,
          * When SoL/IDER sessions are active, autoneg/speed/duplex
          * cannot be changed
          */
-        if (hw->phy.ops.check_reset_block(hw)) {
+        if (hw->phy.ops.check_reset_block &&
+            hw->phy.ops.check_reset_block(hw)) {
                 e_err("Cannot change link characteristics when SoL/IDER is active.\n");
                 return -EINVAL;
         }
@@ -1615,7 +1616,8 @@ static int e1000_loopback_test(struct e1000_adapter *adapter, u64 *data)
          * PHY loopback cannot be performed if SoL/IDER
          * sessions are active
          */
-        if (hw->phy.ops.check_reset_block(hw)) {
+        if (hw->phy.ops.check_reset_block &&
+            hw->phy.ops.check_reset_block(hw)) {
                 e_err("Cannot do PHY loopback test when SoL/IDER is active.\n");
                 *data = 0;
                 goto out;
diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
index 026e8b3ab52e..a13439928488 100644
--- a/drivers/net/ethernet/intel/e1000e/mac.c
+++ b/drivers/net/ethernet/intel/e1000e/mac.c
@@ -709,7 +709,7 @@ s32 e1000e_setup_link_generic(struct e1000_hw *hw)
          * In the case of the phy reset being blocked, we already have a link.
          * We do not need to set it up again.
          */
-        if (hw->phy.ops.check_reset_block(hw))
+        if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block(hw))
                 return 0;
 
         /*
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index a4b0435b00dc..31d37a2b5ba8 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6237,7 +6237,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                 adapter->hw.phy.ms_type = e1000_ms_hw_default;
         }
 
-        if (hw->phy.ops.check_reset_block(hw))
+        if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block(hw))
                 e_info("PHY reset is blocked due to SOL/IDER session.\n");
 
         /* Set initial default active device features */
@@ -6404,7 +6404,7 @@ err_register:
         if (!(adapter->flags & FLAG_HAS_AMT))
                 e1000e_release_hw_control(adapter);
 err_eeprom:
-        if (!hw->phy.ops.check_reset_block(hw))
+        if (hw->phy.ops.check_reset_block && !hw->phy.ops.check_reset_block(hw))
                 e1000_phy_hw_reset(&adapter->hw);
 err_hw_init:
         kfree(adapter->tx_ring);
diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
index 0334d013bc3c..b860d4f7ea2a 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -2155,9 +2155,11 @@ s32 e1000e_phy_hw_reset_generic(struct e1000_hw *hw)
         s32 ret_val;
         u32 ctrl;
 
-        ret_val = phy->ops.check_reset_block(hw);
-        if (ret_val)
-                return 0;
+        if (phy->ops.check_reset_block) {
+                ret_val = phy->ops.check_reset_block(hw);
+                if (ret_val)
+                        return 0;
+        }
 
         ret_val = phy->ops.acquire(hw);
         if (ret_val)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index bf20457ea23a..17ad6a3c1be1 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1390,6 +1390,8 @@ static void ixgbe_process_skb_fields(struct ixgbe_ring *rx_ring,
                                      union ixgbe_adv_rx_desc *rx_desc,
                                      struct sk_buff *skb)
 {
+        struct net_device *dev = rx_ring->netdev;
+
         ixgbe_update_rsc_stats(rx_ring, skb);
 
         ixgbe_rx_hash(rx_ring, rx_desc, skb);
@@ -1401,14 +1403,15 @@ static void ixgbe_process_skb_fields(struct ixgbe_ring *rx_ring,
                 ixgbe_ptp_rx_hwtstamp(rx_ring->q_vector, skb);
 #endif
 
-        if (ixgbe_test_staterr(rx_desc, IXGBE_RXD_STAT_VP)) {
+        if ((dev->features & NETIF_F_HW_VLAN_RX) &&
+            ixgbe_test_staterr(rx_desc, IXGBE_RXD_STAT_VP)) {
                 u16 vid = le16_to_cpu(rx_desc->wb.upper.vlan);
                 __vlan_hwaccel_put_tag(skb, vid);
         }
 
         skb_record_rx_queue(skb, rx_ring->queue_index);
 
-        skb->protocol = eth_type_trans(skb, rx_ring->netdev);
+        skb->protocol = eth_type_trans(skb, dev);
 }
 
 static void ixgbe_rx_skb(struct ixgbe_q_vector *q_vector,
@@ -3607,10 +3610,6 @@ static void ixgbe_configure_dcb(struct ixgbe_adapter *adapter)
         if (hw->mac.type == ixgbe_mac_82598EB)
                 netif_set_gso_max_size(adapter->netdev, 32768);
 
-
-        /* Enable VLAN tag insert/strip */
-        adapter->netdev->features |= NETIF_F_HW_VLAN_RX;
-
         hw->mac.ops.set_vfta(&adapter->hw, 0, 0, true);
 
 #ifdef IXGBE_FCOE
@@ -6701,11 +6700,6 @@ static netdev_features_t ixgbe_fix_features(struct net_device *netdev,
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
-#ifdef CONFIG_DCB
-        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED)
-                features &= ~NETIF_F_HW_VLAN_RX;
-#endif
-
         /* return error if RXHASH is being enabled when RSS is not supported */
         if (!(adapter->flags & IXGBE_FLAG_RSS_ENABLED))
                 features &= ~NETIF_F_RXHASH;
@@ -6718,7 +6712,6 @@ static netdev_features_t ixgbe_fix_features(struct net_device *netdev,
         if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
                 features &= ~NETIF_F_LRO;
 
-
         return features;
 }
 
@@ -6766,6 +6759,11 @@ static int ixgbe_set_features(struct net_device *netdev,
                 need_reset = true;
         }
 
+        if (features & NETIF_F_HW_VLAN_RX)
+                ixgbe_vlan_strip_enable(adapter);
+        else
+                ixgbe_vlan_strip_disable(adapter);
+
         if (changed & NETIF_F_RXALL)
                 need_reset = true;
 
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 04d901d0ff63..f0f06b2bc28b 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -436,7 +436,9 @@ struct mv643xx_eth_private {
         /*
          * Hardware-specific parameters.
          */
+#if defined(CONFIG_HAVE_CLK)
         struct clk *clk;
+#endif
         unsigned int t_clk;
 };
 
@@ -2895,17 +2897,17 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         mp->dev = dev;
 
         /*
-         * Get the clk rate, if there is one, otherwise use the default.
+         * Start with a default rate, and if there is a clock, allow
+         * it to override the default.
          */
+        mp->t_clk = 133000000;
+#if defined(CONFIG_HAVE_CLK)
         mp->clk = clk_get(&pdev->dev, (pdev->id ? "1" : "0"));
         if (!IS_ERR(mp->clk)) {
                 clk_prepare_enable(mp->clk);
                 mp->t_clk = clk_get_rate(mp->clk);
-        } else {
-                mp->t_clk = 133000000;
-                printk(KERN_WARNING "Unable to get clock");
         }
-
+#endif
         set_params(mp, pd);
         netif_set_real_num_tx_queues(dev, mp->txq_count);
         netif_set_real_num_rx_queues(dev, mp->rxq_count);
@@ -2995,10 +2997,13 @@ static int mv643xx_eth_remove(struct platform_device *pdev)
                 phy_detach(mp->phy);
         cancel_work_sync(&mp->tx_timeout_task);
 
+#if defined(CONFIG_HAVE_CLK)
         if (!IS_ERR(mp->clk)) {
                 clk_disable_unprepare(mp->clk);
                 clk_put(mp->clk);
         }
+#endif
+
         free_netdev(mp->dev);
 
         platform_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index cace36f2ab92..28a54451a3e5 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -4381,10 +4381,12 @@ static int sky2_set_features(struct net_device *dev, netdev_features_t features)
         struct sky2_port *sky2 = netdev_priv(dev);
         netdev_features_t changed = dev->features ^ features;
 
-        if (changed & NETIF_F_RXCSUM) {
-                bool on = features & NETIF_F_RXCSUM;
-                sky2_write32(sky2->hw, Q_ADDR(rxqaddr[sky2->port], Q_CSR),
-                             on ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
+        if ((changed & NETIF_F_RXCSUM) &&
+            !(sky2->hw->flags & SKY2_HW_NEW_LE)) {
+                sky2_write32(sky2->hw,
+                             Q_ADDR(rxqaddr[sky2->port], Q_CSR),
+                             (features & NETIF_F_RXCSUM)
+                             ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
         }
 
         if (changed & NETIF_F_RXHASH)
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 1fe2c7a8b40c..a8fb52992c64 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -697,10 +697,10 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
         if (slave != dev->caps.function)
                 memset(inbox->buf, 0, 256);
         if (dev->flags & MLX4_FLAG_OLD_PORT_CMDS) {
-                *(u8 *) inbox->buf         = !!reset_qkey_viols << 6;
+                *(u8 *) inbox->buf         |= !!reset_qkey_viols << 6;
                 ((__be32 *) inbox->buf)[2] = agg_cap_mask;
         } else {
-                ((u8 *) inbox->buf)[3]     = !!reset_qkey_viols;
+                ((u8 *) inbox->buf)[3]     |= !!reset_qkey_viols;
                 ((__be32 *) inbox->buf)[1] = agg_cap_mask;
         }
 
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 8d2666fcffd7..083d6715335c 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -946,16 +946,16 @@ static void __lpc_handle_xmit(struct net_device *ndev)
                         /* Update stats */
                         ndev->stats.tx_packets++;
                         ndev->stats.tx_bytes += skb->len;
-
-                        /* Free buffer */
-                        dev_kfree_skb_irq(skb);
                 }
+                dev_kfree_skb_irq(skb);
 
                 txcidx = readl(LPC_ENET_TXCONSUMEINDEX(pldat->net_base));
         }
 
-        if (netif_queue_stopped(ndev))
-                netif_wake_queue(ndev);
+        if (pldat->num_used_tx_buffs <= ENET_TX_DESC/2) {
+                if (netif_queue_stopped(ndev))
+                        netif_wake_queue(ndev);
+        }
 }
 
 static int __lpc_handle_recv(struct net_device *ndev, int budget)
@@ -1320,6 +1320,7 @@ static const struct net_device_ops lpc_netdev_ops = {
         .ndo_set_rx_mode        = lpc_eth_set_multicast_list,
         .ndo_do_ioctl           = lpc_eth_ioctl,
         .ndo_set_mac_address    = lpc_set_mac_address,
+        .ndo_change_mtu         = eth_change_mtu,
 };
 
 static int lpc_eth_drv_probe(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 9757ce3543a0..7260aa79466a 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5889,11 +5889,7 @@ static void rtl_slow_event_work(struct rtl8169_private *tp)
         if (status & LinkChg)
                 __rtl8169_check_link_status(dev, tp, tp->mmio_addr, true);
 
-        napi_disable(&tp->napi);
-        rtl_irq_disable(tp);
-
-        napi_enable(&tp->napi);
-        napi_schedule(&tp->napi);
+        rtl_irq_enable_all(tp);
 }
 
 static void rtl_task(struct work_struct *work)
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index 036428348faa..9f448279e12a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -13,7 +13,7 @@ config STMMAC_ETH
 if STMMAC_ETH
 
 config STMMAC_PLATFORM
-        tristate "STMMAC platform bus support"
+        bool "STMMAC Platform bus support"
         depends on STMMAC_ETH
         default y
         ---help---
@@ -26,7 +26,7 @@ config STMMAC_PLATFORM
           If unsure, say N.
 
 config STMMAC_PCI
-        tristate "STMMAC support on PCI bus (EXPERIMENTAL)"
+        bool "STMMAC PCI bus support (EXPERIMENTAL)"
         depends on STMMAC_ETH && PCI && EXPERIMENTAL
         ---help---
           This is to select the Synopsys DWMAC available on PCI devices,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 6b5d060ee9de..dc20c56efc9d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -26,6 +26,7 @@
 #include <linux/clk.h>
 #include <linux/stmmac.h>
 #include <linux/phy.h>
+#include <linux/pci.h>
 #include "common.h"
 #ifdef CONFIG_STMMAC_TIMER
 #include "stmmac_timer.h"
@@ -95,7 +96,6 @@ extern int stmmac_mdio_register(struct net_device *ndev);
 extern void stmmac_set_ethtool_ops(struct net_device *netdev);
 extern const struct stmmac_desc_ops enh_desc_ops;
 extern const struct stmmac_desc_ops ndesc_ops;
-
 int stmmac_freeze(struct net_device *ndev);
 int stmmac_restore(struct net_device *ndev);
 int stmmac_resume(struct net_device *ndev);
@@ -109,7 +109,7 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
 static inline int stmmac_clk_enable(struct stmmac_priv *priv)
 {
         if (!IS_ERR(priv->stmmac_clk))
-                return clk_enable(priv->stmmac_clk);
+                return clk_prepare_enable(priv->stmmac_clk);
 
         return 0;
 }
@@ -119,7 +119,7 @@ static inline void stmmac_clk_disable(struct stmmac_priv *priv)
         if (IS_ERR(priv->stmmac_clk))
                 return;
 
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
 }
 static inline int stmmac_clk_get(struct stmmac_priv *priv)
 {
@@ -143,3 +143,60 @@ static inline int stmmac_clk_get(struct stmmac_priv *priv)
         return 0;
 }
 #endif /* CONFIG_HAVE_CLK */
+
+
+#ifdef CONFIG_STMMAC_PLATFORM
+extern struct platform_driver stmmac_pltfr_driver;
+static inline int stmmac_register_platform(void)
+{
+        int err;
+
+        err = platform_driver_register(&stmmac_pltfr_driver);
+        if (err)
+                pr_err("stmmac: failed to register the platform driver\n");
+
+        return err;
+}
+static inline void stmmac_unregister_platform(void)
+{
+        platform_driver_register(&stmmac_pltfr_driver);
+}
+#else
+static inline int stmmac_register_platform(void)
+{
+        pr_debug("stmmac: do not register the platf driver\n");
+
+        return -EINVAL;
+}
+static inline void stmmac_unregister_platform(void)
+{
+}
+#endif /* CONFIG_STMMAC_PLATFORM */
+
+#ifdef CONFIG_STMMAC_PCI
+extern struct pci_driver stmmac_pci_driver;
+static inline int stmmac_register_pci(void)
+{
+        int err;
+
+        err = pci_register_driver(&stmmac_pci_driver);
+        if (err)
+                pr_err("stmmac: failed to register the PCI driver\n");
+
+        return err;
+}
+static inline void stmmac_unregister_pci(void)
+{
+        pci_unregister_driver(&stmmac_pci_driver);
+}
+#else
+static inline int stmmac_register_pci(void)
+{
+        pr_debug("stmmac: do not register the PCI driver\n");
+
+        return -EINVAL;
+}
+static inline void stmmac_unregister_pci(void)
+{
+}
+#endif /* CONFIG_STMMAC_PCI */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 70966330f44e..51b3b68528ee 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -833,8 +833,9 @@ static u32 stmmac_get_synopsys_id(struct stmmac_priv *priv)
 
 /**
  * stmmac_selec_desc_mode
- * @dev : device pointer
- * Description: select the Enhanced/Alternate or Normal descriptors */
+ * @priv : private structure
+ * Description: select the Enhanced/Alternate or Normal descriptors
+ */
 static void stmmac_selec_desc_mode(struct stmmac_priv *priv)
 {
         if (priv->plat->enh_desc) {
@@ -1861,6 +1862,8 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
 /**
  * stmmac_dvr_probe
  * @device: device pointer
+ * @plat_dat: platform data pointer
+ * @addr: iobase memory address
  * Description: this is the main probe function used to
  * call the alloc_etherdev, allocate the priv structure.
  */
@@ -2090,6 +2093,34 @@ int stmmac_restore(struct net_device *ndev)
 }
 #endif /* CONFIG_PM */
 
+/* Driver can be configured w/ and w/ both PCI and Platf drivers
+ * depending on the configuration selected.
+ */
+static int __init stmmac_init(void)
+{
+        int err_plt = 0;
+        int err_pci = 0;
+
+        err_plt = stmmac_register_platform();
+        err_pci = stmmac_register_pci();
+
+        if ((err_pci) && (err_plt)) {
+                pr_err("stmmac: driver registration failed\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static void __exit stmmac_exit(void)
+{
+        stmmac_unregister_platform();
+        stmmac_unregister_pci();
+}
+
+module_init(stmmac_init);
+module_exit(stmmac_exit);
+
 #ifndef MODULE
 static int __init stmmac_cmdline_opt(char *str)
 {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 58fab5303e9c..cf826e6b6aa1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -179,7 +179,7 @@ static DEFINE_PCI_DEVICE_TABLE(stmmac_id_table) = {
 
 MODULE_DEVICE_TABLE(pci, stmmac_id_table);
 
-static struct pci_driver stmmac_driver = {
+struct pci_driver stmmac_pci_driver = {
         .name = STMMAC_RESOURCE_NAME,
         .id_table = stmmac_id_table,
         .probe = stmmac_pci_probe,
@@ -190,33 +190,6 @@ static struct pci_driver stmmac_driver = {
 #endif
 };
 
-/**
- * stmmac_init_module - Entry point for the driver
- * Description: This function is the entry point for the driver.
- */
-static int __init stmmac_init_module(void)
-{
-        int ret;
-
-        ret = pci_register_driver(&stmmac_driver);
-        if (ret < 0)
-                pr_err("%s: ERROR: driver registration failed\n", __func__);
-
-        return ret;
-}
-
-/**
- * stmmac_cleanup_module - Cleanup routine for the driver
- * Description: This function is the cleanup routine for the driver.
- */
-static void __exit stmmac_cleanup_module(void)
-{
-        pci_unregister_driver(&stmmac_driver);
-}
-
-module_init(stmmac_init_module);
-module_exit(stmmac_cleanup_module);
-
 MODULE_DESCRIPTION("STMMAC 10/100/1000 Ethernet PCI driver");
 MODULE_AUTHOR("Rayagond Kokatanur <rayagond.kokatanur@vayavyalabs.com>");
 MODULE_AUTHOR("Giuseppe Cavallaro <peppe.cavallaro@st.com>");
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3dd8f0803808..680d2b8dfe27 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -255,7 +255,7 @@ static const struct of_device_id stmmac_dt_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, stmmac_dt_ids);
 
-static struct platform_driver stmmac_driver = {
+struct platform_driver stmmac_pltfr_driver = {
         .probe = stmmac_pltfr_probe,
         .remove = stmmac_pltfr_remove,
         .driver = {
@@ -266,8 +266,6 @@ static struct platform_driver stmmac_driver = {
                    },
 };
 
-module_platform_driver(stmmac_driver);
-
 MODULE_DESCRIPTION("STMMAC 10/100/1000 Ethernet PLATFORM driver");
 MODULE_AUTHOR("Giuseppe Cavallaro <peppe.cavallaro@st.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 703c8cce2a2c..8c726b7004d3 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -3598,7 +3598,6 @@ static int release_tx_packet(struct niu *np, struct tx_ring_info *rp, int idx)
 static void niu_tx_work(struct niu *np, struct tx_ring_info *rp)
 {
         struct netdev_queue *txq;
-        unsigned int tx_bytes;
         u16 pkt_cnt, tmp;
         int cons, index;
         u64 cs;
@@ -3621,18 +3620,12 @@ static void niu_tx_work(struct niu *np, struct tx_ring_info *rp)
         netif_printk(np, tx_done, KERN_DEBUG, np->dev,
                      "%s() pkt_cnt[%u] cons[%d]\n", __func__, pkt_cnt, cons);
 
-        tx_bytes = 0;
-        tmp = pkt_cnt;
-        while (tmp--) {
-                tx_bytes += rp->tx_buffs[cons].skb->len;
+        while (pkt_cnt--)
                 cons = release_tx_packet(np, rp, cons);
-        }
 
         rp->cons = cons;
         smp_mb();
 
-        netdev_tx_completed_queue(txq, pkt_cnt, tx_bytes);
-
 out:
         if (unlikely(netif_tx_queue_stopped(txq) &&
                      (niu_tx_avail(rp) > NIU_TX_WAKEUP_THRESH(rp)))) {
@@ -4333,7 +4326,6 @@ static void niu_free_channels(struct niu *np)
                         struct tx_ring_info *rp = &np->tx_rings[i];
 
                         niu_free_tx_ring_info(np, rp);
-                        netdev_tx_reset_queue(netdev_get_tx_queue(np->dev, i));
                 }
                 kfree(np->tx_rings);
                 np->tx_rings = NULL;
@@ -6739,8 +6731,6 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb,
                 prod = NEXT_TX(rp, prod);
         }
 
-        netdev_tx_sent_queue(txq, skb->len);
-
         if (prod < rp->prod)
                 rp->wrap_bit ^= TX_RING_KICK_WRAP;
         rp->prod = prod;
diff --git a/drivers/net/ethernet/tile/Kconfig b/drivers/net/ethernet/tile/Kconfig
index 2d9218f86bca..098b1c42b393 100644
--- a/drivers/net/ethernet/tile/Kconfig
+++ b/drivers/net/ethernet/tile/Kconfig
@@ -7,6 +7,8 @@ config TILE_NET
         depends on TILE
         default y
         select CRC32
+        select TILE_GXIO_MPIPE if TILEGX
+        select HIGH_RES_TIMERS if TILEGX
         ---help---
           This is a standard Linux network device driver for the
           on-chip Tilera Gigabit Ethernet and XAUI interfaces.
diff --git a/drivers/net/ethernet/tile/Makefile b/drivers/net/ethernet/tile/Makefile
index f634f142cab4..0ef9eefd3211 100644
--- a/drivers/net/ethernet/tile/Makefile
+++ b/drivers/net/ethernet/tile/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_TILE_NET) += tile_net.o
 ifdef CONFIG_TILEGX
-tile_net-objs := tilegx.o mpipe.o iorpc_mpipe.o dma_queue.o
+tile_net-y := tilegx.o
 else
-tile_net-objs := tilepro.o
+tile_net-y := tilepro.o
 endif
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
new file mode 100644
index 000000000000..83b4b388ad49
--- /dev/null
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -0,0 +1,1898 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/moduleparam.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>      /* printk() */
+#include <linux/slab.h>        /* kmalloc() */
+#include <linux/errno.h>       /* error codes */
+#include <linux/types.h>       /* size_t */
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/irq.h>
+#include <linux/netdevice.h>   /* struct device, and other headers */
+#include <linux/etherdevice.h> /* eth_type_trans */
+#include <linux/skbuff.h>
+#include <linux/ioctl.h>
+#include <linux/cdev.h>
+#include <linux/hugetlb.h>
+#include <linux/in6.h>
+#include <linux/timer.h>
+#include <linux/hrtimer.h>
+#include <linux/ktime.h>
+#include <linux/io.h>
+#include <linux/ctype.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+
+#include <asm/checksum.h>
+#include <asm/homecache.h>
+#include <gxio/mpipe.h>
+#include <arch/sim.h>
+
+/* Default transmit lockup timeout period, in jiffies. */
+#define TILE_NET_TIMEOUT (5 * HZ)
+
+/* The maximum number of distinct channels (idesc.channel is 5 bits). */
+#define TILE_NET_CHANNELS 32
+
+/* Maximum number of idescs to handle per "poll". */
+#define TILE_NET_BATCH 128
+
+/* Maximum number of packets to handle per "poll". */
+#define TILE_NET_WEIGHT 64
+
+/* Number of entries in each iqueue. */
+#define IQUEUE_ENTRIES 512
+
+/* Number of entries in each equeue. */
+#define EQUEUE_ENTRIES 2048
+
+/* Total header bytes per equeue slot.  Must be big enough for 2 bytes
+ * of NET_IP_ALIGN alignment, plus 14 bytes (?) of L2 header, plus up to
+ * 60 bytes of actual TCP header.  We round up to align to cache lines.
+ */
+#define HEADER_BYTES 128
+
+/* Maximum completions per cpu per device (must be a power of two).
+ * ISSUE: What is the right number here?  If this is too small, then
+ * egress might block waiting for free space in a completions array.
+ * ISSUE: At the least, allocate these only for initialized echannels.
+ */
+#define TILE_NET_MAX_COMPS 64
+
+#define MAX_FRAGS (MAX_SKB_FRAGS + 1)
+
+/* Size of completions data to allocate.
+ * ISSUE: Probably more than needed since we don't use all the channels.
+ */
+#define COMPS_SIZE (TILE_NET_CHANNELS * sizeof(struct tile_net_comps))
+
+/* Size of NotifRing data to allocate. */
+#define NOTIF_RING_SIZE (IQUEUE_ENTRIES * sizeof(gxio_mpipe_idesc_t))
+
+/* Timeout to wake the per-device TX timer after we stop the queue.
+ * We don't want the timeout too short (adds overhead, and might end
+ * up causing stop/wake/stop/wake cycles) or too long (affects performance).
+ * For the 10 Gb NIC, 30 usec means roughly 30+ 1500-byte packets.
+ */
+#define TX_TIMER_DELAY_USEC 30
+
+/* Timeout to wake the per-cpu egress timer to free completions. */
+#define EGRESS_TIMER_DELAY_USEC 1000
+
+MODULE_AUTHOR("Tilera Corporation");
+MODULE_LICENSE("GPL");
+
+/* A "packet fragment" (a chunk of memory). */
+struct frag {
+        void *buf;
+        size_t length;
+};
+
+/* A single completion. */
+struct tile_net_comp {
+        /* The "complete_count" when the completion will be complete. */
+        s64 when;
+        /* The buffer to be freed when the completion is complete. */
+        struct sk_buff *skb;
+};
+
+/* The completions for a given cpu and echannel. */
+struct tile_net_comps {
+        /* The completions. */
+        struct tile_net_comp comp_queue[TILE_NET_MAX_COMPS];
+        /* The number of completions used. */
+        unsigned long comp_next;
+        /* The number of completions freed. */
+        unsigned long comp_last;
+};
+
+/* The transmit wake timer for a given cpu and echannel. */
+struct tile_net_tx_wake {
+        struct hrtimer timer;
+        struct net_device *dev;
+};
+
+/* Info for a specific cpu. */
+struct tile_net_info {
+        /* The NAPI struct. */
+        struct napi_struct napi;
+        /* Packet queue. */
+        gxio_mpipe_iqueue_t iqueue;
+        /* Our cpu. */
+        int my_cpu;
+        /* True if iqueue is valid. */
+        bool has_iqueue;
+        /* NAPI flags. */
+        bool napi_added;
+        bool napi_enabled;
+        /* Number of small sk_buffs which must still be provided. */
+        unsigned int num_needed_small_buffers;
+        /* Number of large sk_buffs which must still be provided. */
+        unsigned int num_needed_large_buffers;
+        /* A timer for handling egress completions. */
+        struct hrtimer egress_timer;
+        /* True if "egress_timer" is scheduled. */
+        bool egress_timer_scheduled;
+        /* Comps for each egress channel. */
+        struct tile_net_comps *comps_for_echannel[TILE_NET_CHANNELS];
+        /* Transmit wake timer for each egress channel. */
+        struct tile_net_tx_wake tx_wake[TILE_NET_CHANNELS];
+};
+
+/* Info for egress on a particular egress channel. */
+struct tile_net_egress {
+        /* The "equeue". */
+        gxio_mpipe_equeue_t *equeue;
+        /* The headers for TSO. */
+        unsigned char *headers;
+};
+
+/* Info for a specific device. */
+struct tile_net_priv {
+        /* Our network device. */
+        struct net_device *dev;
+        /* The primary link. */
+        gxio_mpipe_link_t link;
+        /* The primary channel, if open, else -1. */
+        int channel;
+        /* The "loopify" egress link, if needed. */
+        gxio_mpipe_link_t loopify_link;
+        /* The "loopify" egress channel, if open, else -1. */
+        int loopify_channel;
+        /* The egress channel (channel or loopify_channel). */
+        int echannel;
+        /* Total stats. */
+        struct net_device_stats stats;
+};
+
+/* Egress info, indexed by "priv->echannel" (lazily created as needed). */
+static struct tile_net_egress egress_for_echannel[TILE_NET_CHANNELS];
+
+/* Devices currently associated with each channel.
+ * NOTE: The array entry can become NULL after ifconfig down, but
+ * we do not free the underlying net_device structures, so it is
+ * safe to use a pointer after reading it from this array.
+ */
+static struct net_device *tile_net_devs_for_channel[TILE_NET_CHANNELS];
+
+/* A mutex for "tile_net_devs_for_channel". */
+static DEFINE_MUTEX(tile_net_devs_for_channel_mutex);
+
+/* The per-cpu info. */
+static DEFINE_PER_CPU(struct tile_net_info, per_cpu_info);
+
+/* The "context" for all devices. */
+static gxio_mpipe_context_t context;
+
+/* Buffer sizes and mpipe enum codes for buffer stacks.
+ * See arch/tile/include/gxio/mpipe.h for the set of possible values.
+ */
+#define BUFFER_SIZE_SMALL_ENUM GXIO_MPIPE_BUFFER_SIZE_128
+#define BUFFER_SIZE_SMALL 128
+#define BUFFER_SIZE_LARGE_ENUM GXIO_MPIPE_BUFFER_SIZE_1664
+#define BUFFER_SIZE_LARGE 1664
+
+/* The small/large "buffer stacks". */
+static int small_buffer_stack = -1;
+static int large_buffer_stack = -1;
+
+/* Amount of memory allocated for each buffer stack. */
+static size_t buffer_stack_size;
+
+/* The actual memory allocated for the buffer stacks. */
+static void *small_buffer_stack_va;
+static void *large_buffer_stack_va;
+
+/* The buckets. */
+static int first_bucket = -1;
+static int num_buckets = 1;
+
+/* The ingress irq. */
+static int ingress_irq = -1;
+
+/* Text value of tile_net.cpus if passed as a module parameter. */
+static char *network_cpus_string;
+
+/* The actual cpus in "network_cpus". */
+static struct cpumask network_cpus_map;
+
+/* If "loopify=LINK" was specified, this is "LINK". */
+static char *loopify_link_name;
+
+/* If "tile_net.custom" was specified, this is non-NULL. */
+static char *custom_str;
+
+/* The "tile_net.cpus" argument specifies the cpus that are dedicated
+ * to handle ingress packets.
+ *
+ * The parameter should be in the form "tile_net.cpus=m-n[,x-y]", where
+ * m, n, x, y are integer numbers that represent the cpus that can be
+ * neither a dedicated cpu nor a dataplane cpu.
+ */
+static bool network_cpus_init(void)
+{
+        char buf[1024];
+        int rc;
+
+        if (network_cpus_string == NULL)
+                return false;
+
+        rc = cpulist_parse_crop(network_cpus_string, &network_cpus_map);
+        if (rc != 0) {
+                pr_warn("tile_net.cpus=%s: malformed cpu list\n",
+                        network_cpus_string);
+                return false;
+        }
+
+        /* Remove dedicated cpus. */
+        cpumask_and(&network_cpus_map, &network_cpus_map, cpu_possible_mask);
+
+        if (cpumask_empty(&network_cpus_map)) {
+                pr_warn("Ignoring empty tile_net.cpus='%s'.\n",
+                        network_cpus_string);
+                return false;
+        }
+
+        cpulist_scnprintf(buf, sizeof(buf), &network_cpus_map);
+        pr_info("Linux network CPUs: %s\n", buf);
+        return true;
+}
+
+module_param_named(cpus, network_cpus_string, charp, 0444);
+MODULE_PARM_DESC(cpus, "cpulist of cores that handle network interrupts");
+
+/* The "tile_net.loopify=LINK" argument causes the named device to
+ * actually use "loop0" for ingress, and "loop1" for egress.  This
+ * allows an app to sit between the actual link and linux, passing
+ * (some) packets along to linux, and forwarding (some) packets sent
+ * out by linux.
+ */
+module_param_named(loopify, loopify_link_name, charp, 0444);
+MODULE_PARM_DESC(loopify, "name the device to use loop0/1 for ingress/egress");
+
+/* The "tile_net.custom" argument causes us to ignore the "conventional"
+ * classifier metadata, in particular, the "l2_offset".
+ */
+module_param_named(custom, custom_str, charp, 0444);
+MODULE_PARM_DESC(custom, "indicates a (heavily) customized classifier");
+
+/* Atomically update a statistics field.
+ * Note that on TILE-Gx, this operation is fire-and-forget on the
+ * issuing core (single-cycle dispatch) and takes only a few cycles
+ * longer than a regular store when the request reaches the home cache.
+ * No expensive bus management overhead is required.
+ */
+static void tile_net_stats_add(unsigned long value, unsigned long *field)
+{
+        BUILD_BUG_ON(sizeof(atomic_long_t) != sizeof(unsigned long));
+        atomic_long_add(value, (atomic_long_t *)field);
+}
+
+/* Allocate and push a buffer. */
+static bool tile_net_provide_buffer(bool small)
+{
+        int stack = small ? small_buffer_stack : large_buffer_stack;
+        const unsigned long buffer_alignment = 128;
+        struct sk_buff *skb;
+        int len;
+
+        len = sizeof(struct sk_buff **) + buffer_alignment;
+        len += (small ? BUFFER_SIZE_SMALL : BUFFER_SIZE_LARGE);
+        skb = dev_alloc_skb(len);
+        if (skb == NULL)
+                return false;
+
+        /* Make room for a back-pointer to 'skb' and guarantee alignment. */
+        skb_reserve(skb, sizeof(struct sk_buff **));
+        skb_reserve(skb, -(long)skb->data & (buffer_alignment - 1));
+
+        /* Save a back-pointer to 'skb'. */
+        *(struct sk_buff **)(skb->data - sizeof(struct sk_buff **)) = skb;
+
+        /* Make sure "skb" and the back-pointer have been flushed. */
+        wmb();
+
+        gxio_mpipe_push_buffer(&context, stack,
+                               (void *)va_to_tile_io_addr(skb->data));
+
+        return true;
+}
+
+/* Convert a raw mpipe buffer to its matching skb pointer. */
+static struct sk_buff *mpipe_buf_to_skb(void *va)
+{
+        /* Acquire the associated "skb". */
+        struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+        struct sk_buff *skb = *skb_ptr;
+
+        /* Paranoia. */
+        if (skb->data != va) {
+                /* Panic here since there's a reasonable chance
+                 * that corrupt buffers means generic memory
+                 * corruption, with unpredictable system effects.
+                 */
+                panic("Corrupt linux buffer! va=%p, skb=%p, skb->data=%p",
+                      va, skb, skb->data);
+        }
+
+        return skb;
+}
+
+static void tile_net_pop_all_buffers(int stack)
+{
+        for (;;) {
+                tile_io_addr_t addr =
+                        (tile_io_addr_t)gxio_mpipe_pop_buffer(&context, stack);
+                if (addr == 0)
+                        break;
+                dev_kfree_skb_irq(mpipe_buf_to_skb(tile_io_addr_to_va(addr)));
+        }
+}
+
+/* Provide linux buffers to mPIPE. */
+static void tile_net_provide_needed_buffers(void)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+
+        while (info->num_needed_small_buffers != 0) {
+                if (!tile_net_provide_buffer(true))
+                        goto oops;
+                info->num_needed_small_buffers--;
+        }
+
+        while (info->num_needed_large_buffers != 0) {
+                if (!tile_net_provide_buffer(false))
+                        goto oops;
+                info->num_needed_large_buffers--;
+        }
+
+        return;
+
+oops:
+        /* Add a description to the page allocation failure dump. */
+        pr_notice("Tile %d still needs some buffers\n", info->my_cpu);
+}
+
+static inline bool filter_packet(struct net_device *dev, void *buf)
+{
+        /* Filter packets received before we're up. */
+        if (dev == NULL || !(dev->flags & IFF_UP))
+                return true;
+
+        /* Filter out packets that aren't for us. */
+        if (!(dev->flags & IFF_PROMISC) &&
+            !is_multicast_ether_addr(buf) &&
+            compare_ether_addr(dev->dev_addr, buf) != 0)
+                return true;
+
+        return false;
+}
+
+static void tile_net_receive_skb(struct net_device *dev, struct sk_buff *skb,
+                                 gxio_mpipe_idesc_t *idesc, unsigned long len)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+
+        /* Encode the actual packet length. */
+        skb_put(skb, len);
+
+        skb->protocol = eth_type_trans(skb, dev);
+
+        /* Acknowledge "good" hardware checksums. */
+        if (idesc->cs && idesc->csum_seed_val == 0xFFFF)
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+        netif_receive_skb(skb);
+
+        /* Update stats. */
+        tile_net_stats_add(1, &priv->stats.rx_packets);
+        tile_net_stats_add(len, &priv->stats.rx_bytes);
+
+        /* Need a new buffer. */
+        if (idesc->size == BUFFER_SIZE_SMALL_ENUM)
+                info->num_needed_small_buffers++;
+        else
+                info->num_needed_large_buffers++;
+}
+
+/* Handle a packet.  Return true if "processed", false if "filtered". */
+static bool tile_net_handle_packet(gxio_mpipe_idesc_t *idesc)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct net_device *dev = tile_net_devs_for_channel[idesc->channel];
+        uint8_t l2_offset;
+        void *va;
+        void *buf;
+        unsigned long len;
+        bool filter;
+
+        /* Drop packets for which no buffer was available.
+         * NOTE: This happens under heavy load.
+         */
+        if (idesc->be) {
+                struct tile_net_priv *priv = netdev_priv(dev);
+                tile_net_stats_add(1, &priv->stats.rx_dropped);
+                gxio_mpipe_iqueue_consume(&info->iqueue, idesc);
+                if (net_ratelimit())
+                        pr_info("Dropping packet (insufficient buffers).\n");
+                return false;
+        }
+
+        /* Get the "l2_offset", if allowed. */
+        l2_offset = custom_str ? 0 : gxio_mpipe_idesc_get_l2_offset(idesc);
+
+        /* Get the raw buffer VA (includes "headroom"). */
+        va = tile_io_addr_to_va((unsigned long)(long)idesc->va);
+
+        /* Get the actual packet start/length. */
+        buf = va + l2_offset;
+        len = idesc->l2_size - l2_offset;
+
+        /* Point "va" at the raw buffer. */
+        va -= NET_IP_ALIGN;
+
+        filter = filter_packet(dev, buf);
+        if (filter) {
+                gxio_mpipe_iqueue_drop(&info->iqueue, idesc);
+        } else {
+                struct sk_buff *skb = mpipe_buf_to_skb(va);
+
+                /* Skip headroom, and any custom header. */
+                skb_reserve(skb, NET_IP_ALIGN + l2_offset);
+
+                tile_net_receive_skb(dev, skb, idesc, len);
+        }
+
+        gxio_mpipe_iqueue_consume(&info->iqueue, idesc);
+        return !filter;
+}
+
+/* Handle some packets for the current CPU.
+ *
+ * This function handles up to TILE_NET_BATCH idescs per call.
+ *
+ * ISSUE: Since we do not provide new buffers until this function is
+ * complete, we must initially provide enough buffers for each network
+ * cpu to fill its iqueue and also its batched idescs.
+ *
+ * ISSUE: The "rotting packet" race condition occurs if a packet
+ * arrives after the queue appears to be empty, and before the
+ * hypervisor interrupt is re-enabled.
+ */
+static int tile_net_poll(struct napi_struct *napi, int budget)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        unsigned int work = 0;
+        gxio_mpipe_idesc_t *idesc;
+        int i, n;
+
+        /* Process packets. */
+        while ((n = gxio_mpipe_iqueue_try_peek(&info->iqueue, &idesc)) > 0) {
+                for (i = 0; i < n; i++) {
+                        if (i == TILE_NET_BATCH)
+                                goto done;
+                        if (tile_net_handle_packet(idesc + i)) {
+                                if (++work >= budget)
+                                        goto done;
+                        }
+                }
+        }
+
+        /* There are no packets left. */
+        napi_complete(&info->napi);
+
+        /* Re-enable hypervisor interrupts. */
+        gxio_mpipe_enable_notif_ring_interrupt(&context, info->iqueue.ring);
+
+        /* HACK: Avoid the "rotting packet" problem. */
+        if (gxio_mpipe_iqueue_try_peek(&info->iqueue, &idesc) > 0)
+                napi_schedule(&info->napi);
+
+        /* ISSUE: Handle completions? */
+
+done:
+        tile_net_provide_needed_buffers();
+
+        return work;
+}
+
+/* Handle an ingress interrupt on the current cpu. */
+static irqreturn_t tile_net_handle_ingress_irq(int irq, void *unused)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        napi_schedule(&info->napi);
+        return IRQ_HANDLED;
+}
+
+/* Free some completions.  This must be called with interrupts blocked. */
+static int tile_net_free_comps(gxio_mpipe_equeue_t *equeue,
+                                struct tile_net_comps *comps,
+                                int limit, bool force_update)
+{
+        int n = 0;
+        while (comps->comp_last < comps->comp_next) {
+                unsigned int cid = comps->comp_last % TILE_NET_MAX_COMPS;
+                struct tile_net_comp *comp = &comps->comp_queue[cid];
+                if (!gxio_mpipe_equeue_is_complete(equeue, comp->when,
+                                                   force_update || n == 0))
+                        break;
+                dev_kfree_skb_irq(comp->skb);
+                comps->comp_last++;
+                if (++n == limit)
+                        break;
+        }
+        return n;
+}
+
+/* Add a completion.  This must be called with interrupts blocked.
+ * tile_net_equeue_try_reserve() will have ensured a free completion entry.
+ */
+static void add_comp(gxio_mpipe_equeue_t *equeue,
+                     struct tile_net_comps *comps,
+                     uint64_t when, struct sk_buff *skb)
+{
+        int cid = comps->comp_next % TILE_NET_MAX_COMPS;
+        comps->comp_queue[cid].when = when;
+        comps->comp_queue[cid].skb = skb;
+        comps->comp_next++;
+}
+
+static void tile_net_schedule_tx_wake_timer(struct net_device *dev)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+
+        hrtimer_start(&info->tx_wake[priv->echannel].timer,
+                      ktime_set(0, TX_TIMER_DELAY_USEC * 1000UL),
+                      HRTIMER_MODE_REL_PINNED);
+}
+
+static enum hrtimer_restart tile_net_handle_tx_wake_timer(struct hrtimer *t)
+{
+        struct tile_net_tx_wake *tx_wake =
+                container_of(t, struct tile_net_tx_wake, timer);
+        netif_wake_subqueue(tx_wake->dev, smp_processor_id());
+        return HRTIMER_NORESTART;
+}
+
+/* Make sure the egress timer is scheduled. */
+static void tile_net_schedule_egress_timer(void)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+
+        if (!info->egress_timer_scheduled) {
+                hrtimer_start(&info->egress_timer,
+                              ktime_set(0, EGRESS_TIMER_DELAY_USEC * 1000UL),
+                              HRTIMER_MODE_REL_PINNED);
+                info->egress_timer_scheduled = true;
+        }
+}
+
+/* The "function" for "info->egress_timer".
+ *
+ * This timer will reschedule itself as long as there are any pending
+ * completions expected for this tile.
+ */
+static enum hrtimer_restart tile_net_handle_egress_timer(struct hrtimer *t)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        unsigned long irqflags;
+        bool pending = false;
+        int i;
+
+        local_irq_save(irqflags);
+
+        /* The timer is no longer scheduled. */
+        info->egress_timer_scheduled = false;
+
+        /* Free all possible comps for this tile. */
+        for (i = 0; i < TILE_NET_CHANNELS; i++) {
+                struct tile_net_egress *egress = &egress_for_echannel[i];
+                struct tile_net_comps *comps = info->comps_for_echannel[i];
+                if (comps->comp_last >= comps->comp_next)
+                        continue;
+                tile_net_free_comps(egress->equeue, comps, -1, true);
+                pending = pending || (comps->comp_last < comps->comp_next);
+        }
+
+        /* Reschedule timer if needed. */
+        if (pending)
+                tile_net_schedule_egress_timer();
+
+        local_irq_restore(irqflags);
+
+        return HRTIMER_NORESTART;
+}
+
+/* Helper function for "tile_net_update()".
+ * "dev" (i.e. arg) is the device being brought up or down,
+ * or NULL if all devices are now down.
+ */
+static void tile_net_update_cpu(void *arg)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct net_device *dev = arg;
+
+        if (!info->has_iqueue)
+                return;
+
+        if (dev != NULL) {
+                if (!info->napi_added) {
+                        netif_napi_add(dev, &info->napi,
+                                       tile_net_poll, TILE_NET_WEIGHT);
+                        info->napi_added = true;
+                }
+                if (!info->napi_enabled) {
+                        napi_enable(&info->napi);
+                        info->napi_enabled = true;
+                }
+                enable_percpu_irq(ingress_irq, 0);
+        } else {
+                disable_percpu_irq(ingress_irq);
+                if (info->napi_enabled) {
+                        napi_disable(&info->napi);
+                        info->napi_enabled = false;
+                }
+                /* FIXME: Drain the iqueue. */
+        }
+}
+
+/* Helper function for tile_net_open() and tile_net_stop().
+ * Always called under tile_net_devs_for_channel_mutex.
+ */
+static int tile_net_update(struct net_device *dev)
+{
+        static gxio_mpipe_rules_t rules;  /* too big to fit on the stack */
+        bool saw_channel = false;
+        int channel;
+        int rc;
+        int cpu;
+
+        gxio_mpipe_rules_init(&rules, &context);
+
+        for (channel = 0; channel < TILE_NET_CHANNELS; channel++) {
+                if (tile_net_devs_for_channel[channel] == NULL)
+                        continue;
+                if (!saw_channel) {
+                        saw_channel = true;
+                        gxio_mpipe_rules_begin(&rules, first_bucket,
+                                               num_buckets, NULL);
+                        gxio_mpipe_rules_set_headroom(&rules, NET_IP_ALIGN);
+                }
+                gxio_mpipe_rules_add_channel(&rules, channel);
+        }
+
+        /* NOTE: This can fail if there is no classifier.
+         * ISSUE: Can anything else cause it to fail?
+         */
+        rc = gxio_mpipe_rules_commit(&rules);
+        if (rc != 0) {
+                netdev_warn(dev, "gxio_mpipe_rules_commit failed: %d\n", rc);
+                return -EIO;
+        }
+
+        /* Update all cpus, sequentially (to protect "netif_napi_add()"). */
+        for_each_online_cpu(cpu)
+                smp_call_function_single(cpu, tile_net_update_cpu,
+                                         (saw_channel ? dev : NULL), 1);
+
+        /* HACK: Allow packets to flow in the simulator. */
+        if (saw_channel)
+                sim_enable_mpipe_links(0, -1);
+
+        return 0;
+}
+
+/* Allocate and initialize mpipe buffer stacks, and register them in
+ * the mPIPE TLBs, for both small and large packet sizes.
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int init_buffer_stacks(struct net_device *dev, int num_buffers)
+{
+        pte_t hash_pte = pte_set_home((pte_t) { 0 }, PAGE_HOME_HASH);
+        int rc;
+
+        /* Compute stack bytes; we round up to 64KB and then use
+         * alloc_pages() so we get the required 64KB alignment as well.
+         */
+        buffer_stack_size =
+                ALIGN(gxio_mpipe_calc_buffer_stack_bytes(num_buffers),
+                      64 * 1024);
+
+        /* Allocate two buffer stack indices. */
+        rc = gxio_mpipe_alloc_buffer_stacks(&context, 2, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_buffer_stacks failed: %d\n",
+                           rc);
+                return rc;
+        }
+        small_buffer_stack = rc;
+        large_buffer_stack = rc + 1;
+
+        /* Allocate the small memory stack. */
+        small_buffer_stack_va =
+                alloc_pages_exact(buffer_stack_size, GFP_KERNEL);
+        if (small_buffer_stack_va == NULL) {
+                netdev_err(dev,
+                           "Could not alloc %zd bytes for buffer stacks\n",
+                           buffer_stack_size);
+                return -ENOMEM;
+        }
+        rc = gxio_mpipe_init_buffer_stack(&context, small_buffer_stack,
+                                          BUFFER_SIZE_SMALL_ENUM,
+                                          small_buffer_stack_va,
+                                          buffer_stack_size, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_init_buffer_stack: %d\n", rc);
+                return rc;
+        }
+        rc = gxio_mpipe_register_client_memory(&context, small_buffer_stack,
+                                               hash_pte, 0);
+        if (rc != 0) {
+                netdev_err(dev,
+                           "gxio_mpipe_register_buffer_memory failed: %d\n",
+                           rc);
+                return rc;
+        }
+
+        /* Allocate the large buffer stack. */
+        large_buffer_stack_va =
+                alloc_pages_exact(buffer_stack_size, GFP_KERNEL);
+        if (large_buffer_stack_va == NULL) {
+                netdev_err(dev,
+                           "Could not alloc %zd bytes for buffer stacks\n",
+                           buffer_stack_size);
+                return -ENOMEM;
+        }
+        rc = gxio_mpipe_init_buffer_stack(&context, large_buffer_stack,
+                                          BUFFER_SIZE_LARGE_ENUM,
+                                          large_buffer_stack_va,
+                                          buffer_stack_size, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_init_buffer_stack failed: %d\n",
+                           rc);
+                return rc;
+        }
+        rc = gxio_mpipe_register_client_memory(&context, large_buffer_stack,
+                                               hash_pte, 0);
+        if (rc != 0) {
+                netdev_err(dev,
+                           "gxio_mpipe_register_buffer_memory failed: %d\n",
+                           rc);
+                return rc;
+        }
+
+        return 0;
+}
+
+/* Allocate per-cpu resources (memory for completions and idescs).
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int alloc_percpu_mpipe_resources(struct net_device *dev,
+                                        int cpu, int ring)
+{
+        struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+        int order, i, rc;
+        struct page *page;
+        void *addr;
+
+        /* Allocate the "comps". */
+        order = get_order(COMPS_SIZE);
+        page = homecache_alloc_pages(GFP_KERNEL, order, cpu);
+        if (page == NULL) {
+                netdev_err(dev, "Failed to alloc %zd bytes comps memory\n",
+                           COMPS_SIZE);
+                return -ENOMEM;
+        }
+        addr = pfn_to_kaddr(page_to_pfn(page));
+        memset(addr, 0, COMPS_SIZE);
+        for (i = 0; i < TILE_NET_CHANNELS; i++)
+                info->comps_for_echannel[i] =
+                        addr + i * sizeof(struct tile_net_comps);
+
+        /* If this is a network cpu, create an iqueue. */
+        if (cpu_isset(cpu, network_cpus_map)) {
+                order = get_order(NOTIF_RING_SIZE);
+                page = homecache_alloc_pages(GFP_KERNEL, order, cpu);
+                if (page == NULL) {
+                        netdev_err(dev,
+                                   "Failed to alloc %zd bytes iqueue memory\n",
+                                   NOTIF_RING_SIZE);
+                        return -ENOMEM;
+                }
+                addr = pfn_to_kaddr(page_to_pfn(page));
+                rc = gxio_mpipe_iqueue_init(&info->iqueue, &context, ring++,
+                                            addr, NOTIF_RING_SIZE, 0);
+                if (rc < 0) {
+                        netdev_err(dev,
+                                   "gxio_mpipe_iqueue_init failed: %d\n", rc);
+                        return rc;
+                }
+                info->has_iqueue = true;
+        }
+
+        return ring;
+}
+
+/* Initialize NotifGroup and buckets.
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int init_notif_group_and_buckets(struct net_device *dev,
+                                        int ring, int network_cpus_count)
+{
+        int group, rc;
+
+        /* Allocate one NotifGroup. */
+        rc = gxio_mpipe_alloc_notif_groups(&context, 1, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_notif_groups failed: %d\n",
+                           rc);
+                return rc;
+        }
+        group = rc;
+
+        /* Initialize global num_buckets value. */
+        if (network_cpus_count > 4)
+                num_buckets = 256;
+        else if (network_cpus_count > 1)
+                num_buckets = 16;
+
+        /* Allocate some buckets, and set global first_bucket value. */
+        rc = gxio_mpipe_alloc_buckets(&context, num_buckets, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_buckets failed: %d\n", rc);
+                return rc;
+        }
+        first_bucket = rc;
+
+        /* Init group and buckets. */
+        rc = gxio_mpipe_init_notif_group_and_buckets(
+                &context, group, ring, network_cpus_count,
+                first_bucket, num_buckets,
+                GXIO_MPIPE_BUCKET_STICKY_FLOW_LOCALITY);
+        if (rc != 0) {
+                netdev_err(
+                        dev,
+                        "gxio_mpipe_init_notif_group_and_buckets failed: %d\n",
+                        rc);
+                return rc;
+        }
+
+        return 0;
+}
+
+/* Create an irq and register it, then activate the irq and request
+ * interrupts on all cores.  Note that "ingress_irq" being initialized
+ * is how we know not to call tile_net_init_mpipe() again.
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int tile_net_setup_interrupts(struct net_device *dev)
+{
+        int cpu, rc;
+
+        rc = create_irq();
+        if (rc < 0) {
+                netdev_err(dev, "create_irq failed: %d\n", rc);
+                return rc;
+        }
+        ingress_irq = rc;
+        tile_irq_activate(ingress_irq, TILE_IRQ_PERCPU);
+        rc = request_irq(ingress_irq, tile_net_handle_ingress_irq,
+                         0, NULL, NULL);
+        if (rc != 0) {
+                netdev_err(dev, "request_irq failed: %d\n", rc);
+                destroy_irq(ingress_irq);
+                ingress_irq = -1;
+                return rc;
+        }
+
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                if (info->has_iqueue) {
+                        gxio_mpipe_request_notif_ring_interrupt(
+                                &context, cpu_x(cpu), cpu_y(cpu),
+                                1, ingress_irq, info->iqueue.ring);
+                }
+        }
+
+        return 0;
+}
+
+/* Undo any state set up partially by a failed call to tile_net_init_mpipe. */
+static void tile_net_init_mpipe_fail(void)
+{
+        int cpu;
+
+        /* Do cleanups that require the mpipe context first. */
+        if (small_buffer_stack >= 0)
+                tile_net_pop_all_buffers(small_buffer_stack);
+        if (large_buffer_stack >= 0)
+                tile_net_pop_all_buffers(large_buffer_stack);
+
+        /* Destroy mpipe context so the hardware no longer owns any memory. */
+        gxio_mpipe_destroy(&context);
+
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                free_pages((unsigned long)(info->comps_for_echannel[0]),
+                           get_order(COMPS_SIZE));
+                info->comps_for_echannel[0] = NULL;
+                free_pages((unsigned long)(info->iqueue.idescs),
+                           get_order(NOTIF_RING_SIZE));
+                info->iqueue.idescs = NULL;
+        }
+
+        if (small_buffer_stack_va)
+                free_pages_exact(small_buffer_stack_va, buffer_stack_size);
+        if (large_buffer_stack_va)
+                free_pages_exact(large_buffer_stack_va, buffer_stack_size);
+
+        small_buffer_stack_va = NULL;
+        large_buffer_stack_va = NULL;
+        large_buffer_stack = -1;
+        small_buffer_stack = -1;
+        first_bucket = -1;
+}
+
+/* The first time any tilegx network device is opened, we initialize
+ * the global mpipe state.  If this step fails, we fail to open the
+ * device, but if it succeeds, we never need to do it again, and since
+ * tile_net can't be unloaded, we never undo it.
+ *
+ * Note that some resources in this path (buffer stack indices,
+ * bindings from init_buffer_stack, etc.) are hypervisor resources
+ * that are freed implicitly by gxio_mpipe_destroy().
+ */
+static int tile_net_init_mpipe(struct net_device *dev)
+{
+        int i, num_buffers, rc;
+        int cpu;
+        int first_ring, ring;
+        int network_cpus_count = cpus_weight(network_cpus_map);
+
+        if (!hash_default) {
+                netdev_err(dev, "Networking requires hash_default!\n");
+                return -EIO;
+        }
+
+        rc = gxio_mpipe_init(&context, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_init failed: %d\n", rc);
+                return -EIO;
+        }
+
+        /* Set up the buffer stacks. */
+        num_buffers =
+                network_cpus_count * (IQUEUE_ENTRIES + TILE_NET_BATCH);
+        rc = init_buffer_stacks(dev, num_buffers);
+        if (rc != 0)
+                goto fail;
+
+        /* Provide initial buffers. */
+        rc = -ENOMEM;
+        for (i = 0; i < num_buffers; i++) {
+                if (!tile_net_provide_buffer(true)) {
+                        netdev_err(dev, "Cannot allocate initial sk_bufs!\n");
+                        goto fail;
+                }
+        }
+        for (i = 0; i < num_buffers; i++) {
+                if (!tile_net_provide_buffer(false)) {
+                        netdev_err(dev, "Cannot allocate initial sk_bufs!\n");
+                        goto fail;
+                }
+        }
+
+        /* Allocate one NotifRing for each network cpu. */
+        rc = gxio_mpipe_alloc_notif_rings(&context, network_cpus_count, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_notif_rings failed %d\n",
+                           rc);
+                goto fail;
+        }
+
+        /* Init NotifRings per-cpu. */
+        first_ring = rc;
+        ring = first_ring;
+        for_each_online_cpu(cpu) {
+                rc = alloc_percpu_mpipe_resources(dev, cpu, ring);
+                if (rc < 0)
+                        goto fail;
+                ring = rc;
+        }
+
+        /* Initialize NotifGroup and buckets. */
+        rc = init_notif_group_and_buckets(dev, first_ring, network_cpus_count);
+        if (rc != 0)
+                goto fail;
+
+        /* Create and enable interrupts. */
+        rc = tile_net_setup_interrupts(dev);
+        if (rc != 0)
+                goto fail;
+
+        return 0;
+
+fail:
+        tile_net_init_mpipe_fail();
+        return rc;
+}
+
+/* Create persistent egress info for a given egress channel.
+ * Note that this may be shared between, say, "gbe0" and "xgbe0".
+ * ISSUE: Defer header allocation until TSO is actually needed?
+ */
+static int tile_net_init_egress(struct net_device *dev, int echannel)
+{
+        struct page *headers_page, *edescs_page, *equeue_page;
+        gxio_mpipe_edesc_t *edescs;
+        gxio_mpipe_equeue_t *equeue;
+        unsigned char *headers;
+        int headers_order, edescs_order, equeue_order;
+        size_t edescs_size;
+        int edma;
+        int rc = -ENOMEM;
+
+        /* Only initialize once. */
+        if (egress_for_echannel[echannel].equeue != NULL)
+                return 0;
+
+        /* Allocate memory for the "headers". */
+        headers_order = get_order(EQUEUE_ENTRIES * HEADER_BYTES);
+        headers_page = alloc_pages(GFP_KERNEL, headers_order);
+        if (headers_page == NULL) {
+                netdev_warn(dev,
+                            "Could not alloc %zd bytes for TSO headers.\n",
+                            PAGE_SIZE << headers_order);
+                goto fail;
+        }
+        headers = pfn_to_kaddr(page_to_pfn(headers_page));
+
+        /* Allocate memory for the "edescs". */
+        edescs_size = EQUEUE_ENTRIES * sizeof(*edescs);
+        edescs_order = get_order(edescs_size);
+        edescs_page = alloc_pages(GFP_KERNEL, edescs_order);
+        if (edescs_page == NULL) {
+                netdev_warn(dev,
+                            "Could not alloc %zd bytes for eDMA ring.\n",
+                            edescs_size);
+                goto fail_headers;
+        }
+        edescs = pfn_to_kaddr(page_to_pfn(edescs_page));
+
+        /* Allocate memory for the "equeue". */
+        equeue_order = get_order(sizeof(*equeue));
+        equeue_page = alloc_pages(GFP_KERNEL, equeue_order);
+        if (equeue_page == NULL) {
+                netdev_warn(dev,
+                            "Could not alloc %zd bytes for equeue info.\n",
+                            PAGE_SIZE << equeue_order);
+                goto fail_edescs;
+        }
+        equeue = pfn_to_kaddr(page_to_pfn(equeue_page));
+
+        /* Allocate an edma ring.  Note that in practice this can't
+         * fail, which is good, because we will leak an edma ring if so.
+         */
+        rc = gxio_mpipe_alloc_edma_rings(&context, 1, 0, 0);
+        if (rc < 0) {
+                netdev_warn(dev, "gxio_mpipe_alloc_edma_rings failed: %d\n",
+                            rc);
+                goto fail_equeue;
+        }
+        edma = rc;
+
+        /* Initialize the equeue. */
+        rc = gxio_mpipe_equeue_init(equeue, &context, edma, echannel,
+                                    edescs, edescs_size, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_equeue_init failed: %d\n", rc);
+                goto fail_equeue;
+        }
+
+        /* Done. */
+        egress_for_echannel[echannel].equeue = equeue;
+        egress_for_echannel[echannel].headers = headers;
+        return 0;
+
+fail_equeue:
+        __free_pages(equeue_page, equeue_order);
+
+fail_edescs:
+        __free_pages(edescs_page, edescs_order);
+
+fail_headers:
+        __free_pages(headers_page, headers_order);
+
+fail:
+        return rc;
+}
+
+/* Return channel number for a newly-opened link. */
+static int tile_net_link_open(struct net_device *dev, gxio_mpipe_link_t *link,
+                              const char *link_name)
+{
+        int rc = gxio_mpipe_link_open(link, &context, link_name, 0);
+        if (rc < 0) {
+                netdev_err(dev, "Failed to open '%s'\n", link_name);
+                return rc;
+        }
+        rc = gxio_mpipe_link_channel(link);
+        if (rc < 0 || rc >= TILE_NET_CHANNELS) {
+                netdev_err(dev, "gxio_mpipe_link_channel bad value: %d\n", rc);
+                gxio_mpipe_link_close(link);
+                return -EINVAL;
+        }
+        return rc;
+}
+
+/* Help the kernel activate the given network interface. */
+static int tile_net_open(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int cpu, rc;
+
+        mutex_lock(&tile_net_devs_for_channel_mutex);
+
+        /* Do one-time initialization the first time any device is opened. */
+        if (ingress_irq < 0) {
+                rc = tile_net_init_mpipe(dev);
+                if (rc != 0)
+                        goto fail;
+        }
+
+        /* Determine if this is the "loopify" device. */
+        if (unlikely((loopify_link_name != NULL) &&
+                     !strcmp(dev->name, loopify_link_name))) {
+                rc = tile_net_link_open(dev, &priv->link, "loop0");
+                if (rc < 0)
+                        goto fail;
+                priv->channel = rc;
+                rc = tile_net_link_open(dev, &priv->loopify_link, "loop1");
+                if (rc < 0)
+                        goto fail;
+                priv->loopify_channel = rc;
+                priv->echannel = rc;
+        } else {
+                rc = tile_net_link_open(dev, &priv->link, dev->name);
+                if (rc < 0)
+                        goto fail;
+                priv->channel = rc;
+                priv->echannel = rc;
+        }
+
+        /* Initialize egress info (if needed).  Once ever, per echannel. */
+        rc = tile_net_init_egress(dev, priv->echannel);
+        if (rc != 0)
+                goto fail;
+
+        tile_net_devs_for_channel[priv->channel] = dev;
+
+        rc = tile_net_update(dev);
+        if (rc != 0)
+                goto fail;
+
+        mutex_unlock(&tile_net_devs_for_channel_mutex);
+
+        /* Initialize the transmit wake timer for this device for each cpu. */
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                struct tile_net_tx_wake *tx_wake =
+                        &info->tx_wake[priv->echannel];
+
+                hrtimer_init(&tx_wake->timer, CLOCK_MONOTONIC,
+                             HRTIMER_MODE_REL);
+                tx_wake->timer.function = tile_net_handle_tx_wake_timer;
+                tx_wake->dev = dev;
+        }
+
+        for_each_online_cpu(cpu)
+                netif_start_subqueue(dev, cpu);
+        netif_carrier_on(dev);
+        return 0;
+
+fail:
+        if (priv->loopify_channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->loopify_link) != 0)
+                        netdev_warn(dev, "Failed to close loopify link!\n");
+                priv->loopify_channel = -1;
+        }
+        if (priv->channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->link) != 0)
+                        netdev_warn(dev, "Failed to close link!\n");
+                priv->channel = -1;
+        }
+        priv->echannel = -1;
+        tile_net_devs_for_channel[priv->channel] = NULL;
+        mutex_unlock(&tile_net_devs_for_channel_mutex);
+
+        /* Don't return raw gxio error codes to generic Linux. */
+        return (rc > -512) ? rc : -EIO;
+}
+
+/* Help the kernel deactivate the given network interface. */
+static int tile_net_stop(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int cpu;
+
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                struct tile_net_tx_wake *tx_wake =
+                        &info->tx_wake[priv->echannel];
+
+                hrtimer_cancel(&tx_wake->timer);
+                netif_stop_subqueue(dev, cpu);
+        }
+
+        mutex_lock(&tile_net_devs_for_channel_mutex);
+        tile_net_devs_for_channel[priv->channel] = NULL;
+        (void)tile_net_update(dev);
+        if (priv->loopify_channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->loopify_link) != 0)
+                        netdev_warn(dev, "Failed to close loopify link!\n");
+                priv->loopify_channel = -1;
+        }
+        if (priv->channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->link) != 0)
+                        netdev_warn(dev, "Failed to close link!\n");
+                priv->channel = -1;
+        }
+        priv->echannel = -1;
+        mutex_unlock(&tile_net_devs_for_channel_mutex);
+
+        return 0;
+}
+
+/* Determine the VA for a fragment. */
+static inline void *tile_net_frag_buf(skb_frag_t *f)
+{
+        unsigned long pfn = page_to_pfn(skb_frag_page(f));
+        return pfn_to_kaddr(pfn) + f->page_offset;
+}
+
+/* Acquire a completion entry and an egress slot, or if we can't,
+ * stop the queue and schedule the tx_wake timer.
+ */
+static s64 tile_net_equeue_try_reserve(struct net_device *dev,
+                                       struct tile_net_comps *comps,
+                                       gxio_mpipe_equeue_t *equeue,
+                                       int num_edescs)
+{
+        /* Try to acquire a completion entry. */
+        if (comps->comp_next - comps->comp_last < TILE_NET_MAX_COMPS - 1 ||
+            tile_net_free_comps(equeue, comps, 32, false) != 0) {
+
+                /* Try to acquire an egress slot. */
+                s64 slot = gxio_mpipe_equeue_try_reserve(equeue, num_edescs);
+                if (slot >= 0)
+                        return slot;
+
+                /* Freeing some completions gives the equeue time to drain. */
+                tile_net_free_comps(equeue, comps, TILE_NET_MAX_COMPS, false);
+
+                slot = gxio_mpipe_equeue_try_reserve(equeue, num_edescs);
+                if (slot >= 0)
+                        return slot;
+        }
+
+        /* Still nothing; give up and stop the queue for a short while. */
+        netif_stop_subqueue(dev, smp_processor_id());
+        tile_net_schedule_tx_wake_timer(dev);
+        return -1;
+}
+
+/* Determine how many edesc's are needed for TSO.
+ *
+ * Sometimes, if "sendfile()" requires copying, we will be called with
+ * "data" containing the header and payload, with "frags" being empty.
+ * Sometimes, for example when using NFS over TCP, a single segment can
+ * span 3 fragments.  This requires special care.
+ */
+static int tso_count_edescs(struct sk_buff *skb)
+{
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned int data_len = skb->data_len;
+        unsigned int p_len = sh->gso_size;
+        long f_id = -1;    /* id of the current fragment */
+        long f_size = -1;  /* size of the current fragment */
+        long f_used = -1;  /* bytes used from the current fragment */
+        long n;            /* size of the current piece of payload */
+        int num_edescs = 0;
+        int segment;
+
+        for (segment = 0; segment < sh->gso_segs; segment++) {
+
+                unsigned int p_used = 0;
+
+                /* One edesc for header and for each piece of the payload. */
+                for (num_edescs++; p_used < p_len; num_edescs++) {
+
+                        /* Advance as needed. */
+                        while (f_used >= f_size) {
+                                f_id++;
+                                f_size = sh->frags[f_id].size;
+                                f_used = 0;
+                        }
+
+                        /* Use bytes from the current fragment. */
+                        n = p_len - p_used;
+                        if (n > f_size - f_used)
+                                n = f_size - f_used;
+                        f_used += n;
+                        p_used += n;
+                }
+
+                /* The last segment may be less than gso_size. */
+                data_len -= p_len;
+                if (data_len < p_len)
+                        p_len = data_len;
+        }
+
+        return num_edescs;
+}
+
+/* Prepare modified copies of the skbuff headers.
+ * FIXME: add support for IPv6.
+ */
+static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
+                                s64 slot)
+{
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        struct iphdr *ih;
+        struct tcphdr *th;
+        unsigned int data_len = skb->data_len;
+        unsigned char *data = skb->data;
+        unsigned int ih_off, th_off, sh_len, p_len;
+        unsigned int isum_seed, tsum_seed, id, seq;
+        long f_id = -1;    /* id of the current fragment */
+        long f_size = -1;  /* size of the current fragment */
+        long f_used = -1;  /* bytes used from the current fragment */
+        long n;            /* size of the current piece of payload */
+        int segment;
+
+        /* Locate original headers and compute various lengths. */
+        ih = ip_hdr(skb);
+        th = tcp_hdr(skb);
+        ih_off = skb_network_offset(skb);
+        th_off = skb_transport_offset(skb);
+        sh_len = th_off + tcp_hdrlen(skb);
+        p_len = sh->gso_size;
+
+        /* Set up seed values for IP and TCP csum and initialize id and seq. */
+        isum_seed = ((0xFFFF - ih->check) +
+                     (0xFFFF - ih->tot_len) +
+                     (0xFFFF - ih->id));
+        tsum_seed = th->check + (0xFFFF ^ htons(skb->len));
+        id = ntohs(ih->id);
+        seq = ntohl(th->seq);
+
+        /* Prepare all the headers. */
+        for (segment = 0; segment < sh->gso_segs; segment++) {
+                unsigned char *buf;
+                unsigned int p_used = 0;
+
+                /* Copy to the header memory for this segment. */
+                buf = headers + (slot % EQUEUE_ENTRIES) * HEADER_BYTES +
+                        NET_IP_ALIGN;
+                memcpy(buf, data, sh_len);
+
+                /* Update copied ip header. */
+                ih = (struct iphdr *)(buf + ih_off);
+                ih->tot_len = htons(sh_len + p_len - ih_off);
+                ih->id = htons(id);
+                ih->check = csum_long(isum_seed + ih->tot_len +
+                                      ih->id) ^ 0xffff;
+
+                /* Update copied tcp header. */
+                th = (struct tcphdr *)(buf + th_off);
+                th->seq = htonl(seq);
+                th->check = csum_long(tsum_seed + htons(sh_len + p_len));
+                if (segment != sh->gso_segs - 1) {
+                        th->fin = 0;
+                        th->psh = 0;
+                }
+
+                /* Skip past the header. */
+                slot++;
+
+                /* Skip past the payload. */
+                while (p_used < p_len) {
+
+                        /* Advance as needed. */
+                        while (f_used >= f_size) {
+                                f_id++;
+                                f_size = sh->frags[f_id].size;
+                                f_used = 0;
+                        }
+
+                        /* Use bytes from the current fragment. */
+                        n = p_len - p_used;
+                        if (n > f_size - f_used)
+                                n = f_size - f_used;
+                        f_used += n;
+                        p_used += n;
+
+                        slot++;
+                }
+
+                id++;
+                seq += p_len;
+
+                /* The last segment may be less than gso_size. */
+                data_len -= p_len;
+                if (data_len < p_len)
+                        p_len = data_len;
+        }
+
+        /* Flush the headers so they are ready for hardware DMA. */
+        wmb();
+}
+
+/* Pass all the data to mpipe for egress. */
+static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
+                       struct sk_buff *skb, unsigned char *headers, s64 slot)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned int data_len = skb->data_len;
+        unsigned int p_len = sh->gso_size;
+        gxio_mpipe_edesc_t edesc_head = { { 0 } };
+        gxio_mpipe_edesc_t edesc_body = { { 0 } };
+        long f_id = -1;    /* id of the current fragment */
+        long f_size = -1;  /* size of the current fragment */
+        long f_used = -1;  /* bytes used from the current fragment */
+        long n;            /* size of the current piece of payload */
+        unsigned long tx_packets = 0, tx_bytes = 0;
+        unsigned int csum_start, sh_len;
+        int segment;
+
+        /* Prepare to egress the headers: set up header edesc. */
+        csum_start = skb_checksum_start_offset(skb);
+        sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+        edesc_head.csum = 1;
+        edesc_head.csum_start = csum_start;
+        edesc_head.csum_dest = csum_start + skb->csum_offset;
+        edesc_head.xfer_size = sh_len;
+
+        /* This is only used to specify the TLB. */
+        edesc_head.stack_idx = large_buffer_stack;
+        edesc_body.stack_idx = large_buffer_stack;
+
+        /* Egress all the edescs. */
+        for (segment = 0; segment < sh->gso_segs; segment++) {
+                void *va;
+                unsigned char *buf;
+                unsigned int p_used = 0;
+
+                /* Egress the header. */
+                buf = headers + (slot % EQUEUE_ENTRIES) * HEADER_BYTES +
+                        NET_IP_ALIGN;
+                edesc_head.va = va_to_tile_io_addr(buf);
+                gxio_mpipe_equeue_put_at(equeue, edesc_head, slot);
+                slot++;
+
+                /* Egress the payload. */
+                while (p_used < p_len) {
+
+                        /* Advance as needed. */
+                        while (f_used >= f_size) {
+                                f_id++;
+                                f_size = sh->frags[f_id].size;
+                                f_used = 0;
+                        }
+
+                        va = tile_net_frag_buf(&sh->frags[f_id]) + f_used;
+
+                        /* Use bytes from the current fragment. */
+                        n = p_len - p_used;
+                        if (n > f_size - f_used)
+                                n = f_size - f_used;
+                        f_used += n;
+                        p_used += n;
+
+                        /* Egress a piece of the payload. */
+                        edesc_body.va = va_to_tile_io_addr(va);
+                        edesc_body.xfer_size = n;
+                        edesc_body.bound = !(p_used < p_len);
+                        gxio_mpipe_equeue_put_at(equeue, edesc_body, slot);
+                        slot++;
+                }
+
+                tx_packets++;
+                tx_bytes += sh_len + p_len;
+
+                /* The last segment may be less than gso_size. */
+                data_len -= p_len;
+                if (data_len < p_len)
+                        p_len = data_len;
+        }
+
+        /* Update stats. */
+        tile_net_stats_add(tx_packets, &priv->stats.tx_packets);
+        tile_net_stats_add(tx_bytes, &priv->stats.tx_bytes);
+}
+
+/* Do "TSO" handling for egress.
+ *
+ * Normally drivers set NETIF_F_TSO only to support hardware TSO;
+ * otherwise the stack uses scatter-gather to implement GSO in software.
+ * On our testing, enabling GSO support (via NETIF_F_SG) drops network
+ * performance down to around 7.5 Gbps on the 10G interfaces, although
+ * also dropping cpu utilization way down, to under 8%.  But
+ * implementing "TSO" in the driver brings performance back up to line
+ * rate, while dropping cpu usage even further, to less than 4%.  In
+ * practice, profiling of GSO shows that skb_segment() is what causes
+ * the performance overheads; we benefit in the driver from using
+ * preallocated memory to duplicate the TCP/IP headers.
+ */
+static int tile_net_tx_tso(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int channel = priv->echannel;
+        struct tile_net_egress *egress = &egress_for_echannel[channel];
+        struct tile_net_comps *comps = info->comps_for_echannel[channel];
+        gxio_mpipe_equeue_t *equeue = egress->equeue;
+        unsigned long irqflags;
+        int num_edescs;
+        s64 slot;
+
+        /* Determine how many mpipe edesc's are needed. */
+        num_edescs = tso_count_edescs(skb);
+
+        local_irq_save(irqflags);
+
+        /* Try to acquire a completion entry and an egress slot. */
+        slot = tile_net_equeue_try_reserve(dev, comps, equeue, num_edescs);
+        if (slot < 0) {
+                local_irq_restore(irqflags);
+                return NETDEV_TX_BUSY;
+        }
+
+        /* Set up copies of header data properly. */
+        tso_headers_prepare(skb, egress->headers, slot);
+
+        /* Actually pass the data to the network hardware. */
+        tso_egress(dev, equeue, skb, egress->headers, slot);
+
+        /* Add a completion record. */
+        add_comp(equeue, comps, slot + num_edescs - 1, skb);
+
+        local_irq_restore(irqflags);
+
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer();
+
+        return NETDEV_TX_OK;
+}
+
+/* Analyze the body and frags for a transmit request. */
+static unsigned int tile_net_tx_frags(struct frag *frags,
+                                       struct sk_buff *skb,
+                                       void *b_data, unsigned int b_len)
+{
+        unsigned int i, n = 0;
+
+        struct skb_shared_info *sh = skb_shinfo(skb);
+
+        if (b_len != 0) {
+                frags[n].buf = b_data;
+                frags[n++].length = b_len;
+        }
+
+        for (i = 0; i < sh->nr_frags; i++) {
+                skb_frag_t *f = &sh->frags[i];
+                frags[n].buf = tile_net_frag_buf(f);
+                frags[n++].length = skb_frag_size(f);
+        }
+
+        return n;
+}
+
+/* Help the kernel transmit a packet. */
+static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+        struct tile_net_egress *egress = &egress_for_echannel[priv->echannel];
+        gxio_mpipe_equeue_t *equeue = egress->equeue;
+        struct tile_net_comps *comps =
+                info->comps_for_echannel[priv->echannel];
+        unsigned int len = skb->len;
+        unsigned char *data = skb->data;
+        unsigned int num_edescs;
+        struct frag frags[MAX_FRAGS];
+        gxio_mpipe_edesc_t edescs[MAX_FRAGS];
+        unsigned long irqflags;
+        gxio_mpipe_edesc_t edesc = { { 0 } };
+        unsigned int i;
+        s64 slot;
+
+        if (skb_is_gso(skb))
+                return tile_net_tx_tso(skb, dev);
+
+        num_edescs = tile_net_tx_frags(frags, skb, data, skb_headlen(skb));
+
+        /* This is only used to specify the TLB. */
+        edesc.stack_idx = large_buffer_stack;
+
+        /* Prepare the edescs. */
+        for (i = 0; i < num_edescs; i++) {
+                edesc.xfer_size = frags[i].length;
+                edesc.va = va_to_tile_io_addr(frags[i].buf);
+                edescs[i] = edesc;
+        }
+
+        /* Mark the final edesc. */
+        edescs[num_edescs - 1].bound = 1;
+
+        /* Add checksum info to the initial edesc, if needed. */
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                unsigned int csum_start = skb_checksum_start_offset(skb);
+                edescs[0].csum = 1;
+                edescs[0].csum_start = csum_start;
+                edescs[0].csum_dest = csum_start + skb->csum_offset;
+        }
+
+        local_irq_save(irqflags);
+
+        /* Try to acquire a completion entry and an egress slot. */
+        slot = tile_net_equeue_try_reserve(dev, comps, equeue, num_edescs);
+        if (slot < 0) {
+                local_irq_restore(irqflags);
+                return NETDEV_TX_BUSY;
+        }
+
+        for (i = 0; i < num_edescs; i++)
+                gxio_mpipe_equeue_put_at(equeue, edescs[i], slot++);
+
+        /* Add a completion record. */
+        add_comp(equeue, comps, slot - 1, skb);
+
+        /* NOTE: Use ETH_ZLEN for short packets (e.g. 42 < 60). */
+        tile_net_stats_add(1, &priv->stats.tx_packets);
+        tile_net_stats_add(max_t(unsigned int, len, ETH_ZLEN),
+                           &priv->stats.tx_bytes);
+
+        local_irq_restore(irqflags);
+
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer();
+
+        return NETDEV_TX_OK;
+}
+
+/* Return subqueue id on this core (one per core). */
+static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb)
+{
+        return smp_processor_id();
+}
+
+/* Deal with a transmit timeout. */
+static void tile_net_tx_timeout(struct net_device *dev)
+{
+        int cpu;
+
+        for_each_online_cpu(cpu)
+                netif_wake_subqueue(dev, cpu);
+}
+
+/* Ioctl commands. */
+static int tile_net_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+        return -EOPNOTSUPP;
+}
+
+/* Get system network statistics for device. */
+static struct net_device_stats *tile_net_get_stats(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        return &priv->stats;
+}
+
+/* Change the MTU. */
+static int tile_net_change_mtu(struct net_device *dev, int new_mtu)
+{
+        if ((new_mtu < 68) || (new_mtu > 1500))
+                return -EINVAL;
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+/* Change the Ethernet address of the NIC.
+ *
+ * The hypervisor driver does not support changing MAC address.  However,
+ * the hardware does not do anything with the MAC address, so the address
+ * which gets used on outgoing packets, and which is accepted on incoming
+ * packets, is completely up to us.
+ *
+ * Returns 0 on success, negative on failure.
+ */
+static int tile_net_set_mac_address(struct net_device *dev, void *p)
+{
+        struct sockaddr *addr = p;
+
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EINVAL;
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        return 0;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/* Polling 'interrupt' - used by things like netconsole to send skbs
+ * without having to re-enable interrupts. It's not called while
+ * the interrupt routine is executing.
+ */
+static void tile_net_netpoll(struct net_device *dev)
+{
+        disable_percpu_irq(ingress_irq);
+        tile_net_handle_ingress_irq(ingress_irq, NULL);
+        enable_percpu_irq(ingress_irq, 0);
+}
+#endif
+
+static const struct net_device_ops tile_net_ops = {
+        .ndo_open = tile_net_open,
+        .ndo_stop = tile_net_stop,
+        .ndo_start_xmit = tile_net_tx,
+        .ndo_select_queue = tile_net_select_queue,
+        .ndo_do_ioctl = tile_net_ioctl,
+        .ndo_get_stats = tile_net_get_stats,
+        .ndo_change_mtu = tile_net_change_mtu,
+        .ndo_tx_timeout = tile_net_tx_timeout,
+        .ndo_set_mac_address = tile_net_set_mac_address,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller = tile_net_netpoll,
+#endif
+};
+
+/* The setup function.
+ *
+ * This uses ether_setup() to assign various fields in dev, including
+ * setting IFF_BROADCAST and IFF_MULTICAST, then sets some extra fields.
+ */
+static void tile_net_setup(struct net_device *dev)
+{
+        ether_setup(dev);
+        dev->netdev_ops = &tile_net_ops;
+        dev->watchdog_timeo = TILE_NET_TIMEOUT;
+        dev->features |= NETIF_F_LLTX;
+        dev->features |= NETIF_F_HW_CSUM;
+        dev->features |= NETIF_F_SG;
+        dev->features |= NETIF_F_TSO;
+        dev->mtu = 1500;
+}
+
+/* Allocate the device structure, register the device, and obtain the
+ * MAC address from the hypervisor.
+ */
+static void tile_net_dev_init(const char *name, const uint8_t *mac)
+{
+        int ret;
+        int i;
+        int nz_addr = 0;
+        struct net_device *dev;
+        struct tile_net_priv *priv;
+
+        /* HACK: Ignore "loop" links. */
+        if (strncmp(name, "loop", 4) == 0)
+                return;
+
+        /* Allocate the device structure.  Normally, "name" is a
+         * template, instantiated by register_netdev(), but not for us.
+         */
+        dev = alloc_netdev_mqs(sizeof(*priv), name, tile_net_setup,
+                               NR_CPUS, 1);
+        if (!dev) {
+                pr_err("alloc_netdev_mqs(%s) failed\n", name);
+                return;
+        }
+
+        /* Initialize "priv". */
+        priv = netdev_priv(dev);
+        memset(priv, 0, sizeof(*priv));
+        priv->dev = dev;
+        priv->channel = -1;
+        priv->loopify_channel = -1;
+        priv->echannel = -1;
+
+        /* Get the MAC address and set it in the device struct; this must
+         * be done before the device is opened.  If the MAC is all zeroes,
+         * we use a random address, since we're probably on the simulator.
+         */
+        for (i = 0; i < 6; i++)
+                nz_addr |= mac[i];
+
+        if (nz_addr) {
+                memcpy(dev->dev_addr, mac, 6);
+                dev->addr_len = 6;
+        } else {
+                random_ether_addr(dev->dev_addr);
+        }
+
+        /* Register the network device. */
+        ret = register_netdev(dev);
+        if (ret) {
+                netdev_err(dev, "register_netdev failed %d\n", ret);
+                free_netdev(dev);
+                return;
+        }
+}
+
+/* Per-cpu module initialization. */
+static void tile_net_init_module_percpu(void *unused)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        int my_cpu = smp_processor_id();
+
+        info->has_iqueue = false;
+
+        info->my_cpu = my_cpu;
+
+        /* Initialize the egress timer. */
+        hrtimer_init(&info->egress_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        info->egress_timer.function = tile_net_handle_egress_timer;
+}
+
+/* Module initialization. */
+static int __init tile_net_init_module(void)
+{
+        int i;
+        char name[GXIO_MPIPE_LINK_NAME_LEN];
+        uint8_t mac[6];
+
+        pr_info("Tilera Network Driver\n");
+
+        mutex_init(&tile_net_devs_for_channel_mutex);
+
+        /* Initialize each CPU. */
+        on_each_cpu(tile_net_init_module_percpu, NULL, 1);
+
+        /* Find out what devices we have, and initialize them. */
+        for (i = 0; gxio_mpipe_link_enumerate_mac(i, name, mac) >= 0; i++)
+                tile_net_dev_init(name, mac);
+
+        if (!network_cpus_init())
+                network_cpus_map = *cpu_online_mask;
+
+        return 0;
+}
+
+module_init(tile_net_init_module);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 4ffcd57b011b..2857ab078aac 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -478,6 +478,7 @@ struct netvsc_device {
         u32 nvsp_version;
 
         atomic_t num_outstanding_sends;
+        wait_queue_head_t wait_drain;
         bool start_remove;
         bool destroy;
         /*
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 8b919471472f..0c569831db5a 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -42,6 +42,7 @@ static struct netvsc_device *alloc_net_device(struct hv_device *device)
         if (!net_device)
                 return NULL;
 
+        init_waitqueue_head(&net_device->wait_drain);
         net_device->start_remove = false;
         net_device->destroy = false;
         net_device->dev = device;
@@ -387,12 +388,8 @@ int netvsc_device_remove(struct hv_device *device)
         spin_unlock_irqrestore(&device->channel->inbound_lock, flags);
 
         /* Wait for all send completions */
-        while (atomic_read(&net_device->num_outstanding_sends)) {
-                dev_info(&device->device,
-                        "waiting for %d requests to complete...\n",
-                        atomic_read(&net_device->num_outstanding_sends));
-                udelay(100);
-        }
+        wait_event(net_device->wait_drain,
+                   atomic_read(&net_device->num_outstanding_sends) == 0);
 
         netvsc_disconnect_vsp(net_device);
 
@@ -486,6 +483,9 @@ static void netvsc_send_completion(struct hv_device *device,
                 num_outstanding_sends =
                         atomic_dec_return(&net_device->num_outstanding_sends);
 
+                if (net_device->destroy && num_outstanding_sends == 0)
+                        wake_up(&net_device->wait_drain);
+
                 if (netif_queue_stopped(ndev) && !net_device->start_remove &&
                         (hv_ringbuf_avail_percent(&device->channel->outbound)
                         > RING_AVAIL_PERCENT_HIWATER ||
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index 5ac46f5226f3..47f8e8939266 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -41,6 +41,8 @@ MODULE_LICENSE("GPL");
 #define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
 #define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 #define IP101A_G_IRQ_CONF_STATUS        0x11    /* Conf Info IRQ & Status Reg */
+#define IP101A_G_IRQ_PIN_USED           (1<<15) /* INTR pin used */
+#define IP101A_G_IRQ_DEFAULT            IP101A_G_IRQ_PIN_USED
 
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -136,6 +138,11 @@ static int ip1001_config_init(struct phy_device *phydev)
         if (c < 0)
                 return c;
 
+        /* INTR pin used: speed/link/duplex will cause an interrupt */
+        c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
+        if (c < 0)
+                return c;
+
         if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
                 /* Additional delay (2ns) used to adjust RX clock phase
                  * at RGMII interface */
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 683ef1ce5519..5061608f408c 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -96,7 +96,7 @@ static int of_mdio_bus_match(struct device *dev, void *mdio_bus_np)
 }
 /**
  * of_mdio_find_bus - Given an mii_bus node, find the mii_bus.
- * @mdio_np: Pointer to the mii_bus.
+ * @mdio_bus_np: Pointer to the mii_bus.
  *
  * Returns a pointer to the mii_bus, or NULL if none found.
  *
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index 3faef5670d1f..d75d1f56becf 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -946,7 +946,7 @@ struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 }
 
 static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
-static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+static const struct sierra_net_info_data sierra_net_info_data_direct_ip = {
         .rx_urb_size = 8 * 1024,
         .whitelist = {
                 .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
@@ -954,7 +954,7 @@ static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
         }
 };
 
-static const struct driver_info sierra_net_info_68A3 = {
+static const struct driver_info sierra_net_info_direct_ip = {
         .description = "Sierra Wireless USB-to-WWAN Modem",
         .flags = FLAG_WWAN | FLAG_SEND_ZLP,
         .bind = sierra_net_bind,
@@ -962,12 +962,18 @@ static const struct driver_info sierra_net_info_68A3 = {
         .status = sierra_net_status,
         .rx_fixup = sierra_net_rx_fixup,
         .tx_fixup = sierra_net_tx_fixup,
-        .data = (unsigned long)&sierra_net_info_data_68A3,
+        .data = (unsigned long)&sierra_net_info_data_direct_ip,
 };
 
 static const struct usb_device_id products[] = {
         {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
-        .driver_info = (unsigned long) &sierra_net_info_68A3},
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        {USB_DEVICE(0x0F3D, 0x68A3), /* AT&T Direct IP modem */
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        {USB_DEVICE(0x1199, 0x68AA), /* Sierra Wireless Direct IP LTE modem */
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        {USB_DEVICE(0x0F3D, 0x68AA), /* AT&T Direct IP LTE modem */
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
 
         {}, /* last item */
 };
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 5214b1eceb95..f18149ae2588 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -42,7 +42,8 @@ module_param(gso, bool, 0444);
 #define VIRTNET_DRIVER_VERSION "1.0.0"
 
 struct virtnet_stats {
-        struct u64_stats_sync syncp;
+        struct u64_stats_sync tx_syncp;
+        struct u64_stats_sync rx_syncp;
         u64 tx_bytes;
         u64 tx_packets;
 
@@ -300,10 +301,10 @@ static void receive_buf(struct net_device *dev, void *buf, unsigned int len)
 
         hdr = skb_vnet_hdr(skb);
 
-        u64_stats_update_begin(&stats->syncp);
+        u64_stats_update_begin(&stats->rx_syncp);
         stats->rx_bytes += skb->len;
         stats->rx_packets++;
-        u64_stats_update_end(&stats->syncp);
+        u64_stats_update_end(&stats->rx_syncp);
 
         if (hdr->hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
                 pr_debug("Needs csum!\n");
@@ -565,10 +566,10 @@ static unsigned int free_old_xmit_skbs(struct virtnet_info *vi)
         while ((skb = virtqueue_get_buf(vi->svq, &len)) != NULL) {
                 pr_debug("Sent skb %p\n", skb);
 
-                u64_stats_update_begin(&stats->syncp);
+                u64_stats_update_begin(&stats->tx_syncp);
                 stats->tx_bytes += skb->len;
                 stats->tx_packets++;
-                u64_stats_update_end(&stats->syncp);
+                u64_stats_update_end(&stats->tx_syncp);
 
                 tot_sgs += skb_vnet_hdr(skb)->num_sg;
                 dev_kfree_skb_any(skb);
@@ -703,12 +704,16 @@ static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
                 u64 tpackets, tbytes, rpackets, rbytes;
 
                 do {
-                        start = u64_stats_fetch_begin(&stats->syncp);
+                        start = u64_stats_fetch_begin(&stats->tx_syncp);
                         tpackets = stats->tx_packets;
                         tbytes   = stats->tx_bytes;
+                } while (u64_stats_fetch_retry(&stats->tx_syncp, start));
+
+                do {
+                        start = u64_stats_fetch_begin(&stats->rx_syncp);
                         rpackets = stats->rx_packets;
                         rbytes   = stats->rx_bytes;
-                } while (u64_stats_fetch_retry(&stats->syncp, start));
+                } while (u64_stats_fetch_retry(&stats->rx_syncp, start));
 
                 tot->rx_packets += rpackets;
                 tot->tx_packets += tpackets;
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 67c13af6f206..c06b6cb5c91e 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -877,6 +877,10 @@ struct b43_wl {
          * from the mac80211 subsystem. */
         u16 mac80211_initially_registered_queues;
 
+        /* Set this if we call ieee80211_register_hw() and check if we call
+         * ieee80211_unregister_hw(). */
+        bool hw_registred;
+
         /* We can only have one operating interface (802.11 core)
          * at a time. General information about this interface follows.
          */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 5a39b226b2e3..acd03a4f9730 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2437,6 +2437,7 @@ start_ieee80211:
         err = ieee80211_register_hw(wl->hw);
         if (err)
                 goto err_one_core_detach;
+        wl->hw_registred = true;
         b43_leds_register(wl->current_dev);
         goto out;
 
@@ -5299,6 +5300,7 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
 
         hw->queues = modparam_qos ? B43_QOS_QUEUE_NUM : 1;
         wl->mac80211_initially_registered_queues = hw->queues;
+        wl->hw_registred = false;
         hw->max_rates = 2;
         SET_IEEE80211_DEV(hw, dev->dev);
         if (is_valid_ether_addr(sprom->et1mac))
@@ -5370,12 +5372,15 @@ static void b43_bcma_remove(struct bcma_device *core)
          * as the ieee80211 unreg will destroy the workqueue. */
         cancel_work_sync(&wldev->restart_work);
 
-        /* Restore the queues count before unregistering, because firmware detect
-         * might have modified it. Restoring is important, so the networking
-         * stack can properly free resources. */
-        wl->hw->queues = wl->mac80211_initially_registered_queues;
-        b43_leds_stop(wldev);
-        ieee80211_unregister_hw(wl->hw);
+        B43_WARN_ON(!wl);
+        if (wl->current_dev == wldev && wl->hw_registred) {
+                /* Restore the queues count before unregistering, because firmware detect
+                 * might have modified it. Restoring is important, so the networking
+                 * stack can properly free resources. */
+                wl->hw->queues = wl->mac80211_initially_registered_queues;
+                b43_leds_stop(wldev);
+                ieee80211_unregister_hw(wl->hw);
+        }
 
         b43_one_core_detach(wldev->dev);
 
@@ -5446,7 +5451,7 @@ static void b43_ssb_remove(struct ssb_device *sdev)
         cancel_work_sync(&wldev->restart_work);
 
         B43_WARN_ON(!wl);
-        if (wl->current_dev == wldev) {
+        if (wl->current_dev == wldev && wl->hw_registred) {
                 /* Restore the queues count before unregistering, because firmware detect
                  * might have modified it. Restoring is important, so the networking
                  * stack can properly free resources. */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index e2480d196276..8e7e6928c936 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -89,9 +89,9 @@ int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
         data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
         brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
 
-        /* redirect, configure ane enable io for interrupt signal */
+        /* redirect, configure and enable io for interrupt signal */
         data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
-        if (sdiodev->irq_flags | IRQF_TRIGGER_HIGH)
+        if (sdiodev->irq_flags & IRQF_TRIGGER_HIGH)
                 data |= SDIO_SEPINT_ACT_HI;
         brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 9cfae0c08707..95aa8e1683ec 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,14 +1903,6 @@ static void ipw2100_down(struct ipw2100_priv *priv)
         netif_stop_queue(priv->net_dev);
 }
 
-/* Called by register_netdev() */
-static int ipw2100_net_init(struct net_device *dev)
-{
-        struct ipw2100_priv *priv = libipw_priv(dev);
-
-        return ipw2100_up(priv, 1);
-}
-
 static int ipw2100_wdev_init(struct net_device *dev)
 {
         struct ipw2100_priv *priv = libipw_priv(dev);
@@ -6087,7 +6079,6 @@ static const struct net_device_ops ipw2100_netdev_ops = {
         .ndo_stop               = ipw2100_close,
         .ndo_start_xmit         = libipw_xmit,
         .ndo_change_mtu         = libipw_change_mtu,
-        .ndo_init               = ipw2100_net_init,
         .ndo_tx_timeout         = ipw2100_tx_timeout,
         .ndo_set_mac_address    = ipw2100_set_address,
         .ndo_validate_addr      = eth_validate_addr,
@@ -6329,6 +6320,10 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
         printk(KERN_INFO DRV_NAME
                ": Detected Intel PRO/Wireless 2100 Network Connection\n");
 
+        err = ipw2100_up(priv, 1);
+        if (err)
+                goto fail;
+
         err = ipw2100_wdev_init(dev);
         if (err)
                 goto fail;
@@ -6338,12 +6333,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
          * network device we would call ipw2100_up.  This introduced a race
          * condition with newer hotplug configurations (network was coming
          * up and making calls before the device was initialized).
-         *
-         * If we called ipw2100_up before we registered the device, then the
-         * device name wasn't registered.  So, we instead use the net_dev->init
-         * member to call a function that then just turns and calls ipw2100_up.
-         * net_dev->init is called after name allocation but before the
-         * notifier chain is called */
+         */
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_WARNING DRV_NAME
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 19f7ee84ae89..e5e8ada4aaf6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -35,17 +35,20 @@
 #define IWL6000_UCODE_API_MAX 6
 #define IWL6050_UCODE_API_MAX 5
 #define IWL6000G2_UCODE_API_MAX 6
+#define IWL6035_UCODE_API_MAX 6
 
 /* Oldest version we won't warn about */
 #define IWL6000_UCODE_API_OK 4
 #define IWL6000G2_UCODE_API_OK 5
 #define IWL6050_UCODE_API_OK 5
 #define IWL6000G2B_UCODE_API_OK 6
+#define IWL6035_UCODE_API_OK 6
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
 #define IWL6050_UCODE_API_MIN 4
-#define IWL6000G2_UCODE_API_MIN 4
+#define IWL6000G2_UCODE_API_MIN 5
+#define IWL6035_UCODE_API_MIN 6
 
 /* EEPROM versions */
 #define EEPROM_6000_TX_POWER_VERSION    (4)
@@ -227,9 +230,25 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         IWL_DEVICE_6030,
 };
 
+#define IWL_DEVICE_6035                                         \
+        .fw_name_pre = IWL6030_FW_PRE,                          \
+        .ucode_api_max = IWL6035_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL6035_UCODE_API_OK,                   \
+        .ucode_api_min = IWL6035_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_6030,                \
+        .max_inst_size = IWL60_RTC_INST_SIZE,                   \
+        .max_data_size = IWL60_RTC_DATA_SIZE,                   \
+        .eeprom_ver = EEPROM_6030_EEPROM_VERSION,               \
+        .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,       \
+        .base_params = &iwl6000_g2_base_params,                 \
+        .bt_params = &iwl6000_bt_params,                        \
+        .need_temp_offset_calib = true,                         \
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .adv_pm = true
+
 const struct iwl_cfg iwl6035_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
-        IWL_DEVICE_6030,
+        IWL_DEVICE_6035,
         .ht_params = &iwl6000_ht_params,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index aea07aab3c9e..eb6a8eaf42fc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1267,7 +1267,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 key_flags |= STA_KEY_MULTICAST_MSK;
 
         sta_cmd.key.key_flags = key_flags;
-        sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
+        sta_cmd.key.key_offset = keyconf->hw_key_idx;
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index d742900969ea..fac67a526a30 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -861,13 +861,18 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
 
         /* We have our copies now, allow OS release its copies */
         release_firmware(ucode_raw);
-        complete(&drv->request_firmware_complete);
 
         drv->op_mode = iwl_dvm_ops.start(drv->trans, drv->cfg, &drv->fw);
 
         if (!drv->op_mode)
-                goto out_free_fw;
+                goto out_unbind;
 
+        /*
+         * Complete the firmware request last so that
+         * a driver unbind (stop) doesn't run while we
+         * are doing the start() above.
+         */
+        complete(&drv->request_firmware_complete);
         return;
 
  try_again:
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 50c58911e718..b8e2b223ac36 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -568,28 +568,28 @@ static int iwl_find_otp_image(struct iwl_trans *trans,
  * iwl_get_max_txpower_avg - get the highest tx power from all chains.
  *     find the highest tx power from all chains for the channel
  */
-static s8 iwl_get_max_txpower_avg(const struct iwl_cfg *cfg,
+static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
                 struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
                 int element, s8 *max_txpower_in_half_dbm)
 {
         s8 max_txpower_avg = 0; /* (dBm) */
 
         /* Take the highest tx power from any valid chains */
-        if ((cfg->valid_tx_ant & ANT_A) &&
+        if ((priv->hw_params.valid_tx_ant & ANT_A) &&
             (enhanced_txpower[element].chain_a_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].chain_a_max;
-        if ((cfg->valid_tx_ant & ANT_B) &&
+        if ((priv->hw_params.valid_tx_ant & ANT_B) &&
             (enhanced_txpower[element].chain_b_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].chain_b_max;
-        if ((cfg->valid_tx_ant & ANT_C) &&
+        if ((priv->hw_params.valid_tx_ant & ANT_C) &&
             (enhanced_txpower[element].chain_c_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].chain_c_max;
-        if (((cfg->valid_tx_ant == ANT_AB) |
-            (cfg->valid_tx_ant == ANT_BC) |
-            (cfg->valid_tx_ant == ANT_AC)) &&
+        if (((priv->hw_params.valid_tx_ant == ANT_AB) |
+            (priv->hw_params.valid_tx_ant == ANT_BC) |
+            (priv->hw_params.valid_tx_ant == ANT_AC)) &&
             (enhanced_txpower[element].mimo2_max > max_txpower_avg))
                 max_txpower_avg =  enhanced_txpower[element].mimo2_max;
-        if ((cfg->valid_tx_ant == ANT_ABC) &&
+        if ((priv->hw_params.valid_tx_ant == ANT_ABC) &&
             (enhanced_txpower[element].mimo3_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].mimo3_max;
 
@@ -691,7 +691,7 @@ static void iwl_eeprom_enhanced_txpower(struct iwl_priv *priv)
                                  ((txp->delta_20_in_40 & 0xf0) >> 4),
                                  (txp->delta_20_in_40 & 0x0f));
 
-                max_txp_avg = iwl_get_max_txpower_avg(priv->cfg, txp_array, idx,
+                max_txp_avg = iwl_get_max_txpower_avg(priv, txp_array, idx,
                                                       &max_txp_avg_halfdbm);
 
                 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index ab2f4d7500a4..3ee23134c02b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -199,6 +199,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                             WIPHY_FLAG_DISABLE_BEACON_HINTS |
                             WIPHY_FLAG_IBSS_RSN;
 
+#ifdef CONFIG_PM_SLEEP
         if (priv->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
             priv->trans->ops->wowlan_suspend &&
             device_can_wakeup(priv->trans->dev)) {
@@ -217,6 +218,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                 hw->wiphy->wowlan.pattern_max_len =
                                         IWLAGN_WOWLAN_MAX_PATTERN_LEN;
         }
+#endif
 
         if (iwlwifi_mod_params.power_save)
                 hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
@@ -249,6 +251,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
         ret = ieee80211_register_hw(priv->hw);
         if (ret) {
                 IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
+                iwl_leds_exit(priv);
                 return ret;
         }
         priv->mac80211_registered = 1;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 3b1069290fa9..dfd54662e3e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -224,6 +224,7 @@
 #define SCD_TXFACT              (SCD_BASE + 0x10)
 #define SCD_ACTIVE              (SCD_BASE + 0x14)
 #define SCD_QUEUECHAIN_SEL      (SCD_BASE + 0xe8)
+#define SCD_CHAINEXT_EN         (SCD_BASE + 0x244)
 #define SCD_AGGR_SEL            (SCD_BASE + 0x248)
 #define SCD_INTERRUPT_MASK      (SCD_BASE + 0x108)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index ec6fb395b84d..79c6b91417f9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -1058,6 +1058,11 @@ static void iwl_tx_start(struct iwl_trans *trans)
         iwl_write_prph(trans, SCD_DRAM_BASE_ADDR,
                        trans_pcie->scd_bc_tbls.dma >> 10);
 
+        /* The chain extension of the SCD doesn't work well. This feature is
+         * enabled by default by the HW, so we need to disable it manually.
+         */
+        iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
+
         /* Enable DMA channel */
         for (chan = 0; chan < FH_TCSR_CHNL_NUM ; chan++)
                 iwl_write_direct32(trans, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index fb787df01666..a0b7cfd34685 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1555,6 +1555,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
                         hdr = (struct ieee80211_hdr *) skb->data;
                         mac80211_hwsim_monitor_ack(data2->hw, hdr->addr2);
                 }
+                txi->flags |= IEEE80211_TX_STAT_ACK;
         }
         ieee80211_tx_status_irqsafe(data2->hw, skb);
         return 0;
@@ -1721,6 +1722,24 @@ static void hwsim_exit_netlink(void)
                        "unregister family %i\n", ret);
 }
 
+static const struct ieee80211_iface_limit hwsim_if_limits[] = {
+        { .max = 1, .types = BIT(NL80211_IFTYPE_ADHOC) },
+        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) |
+                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
+#ifdef CONFIG_MAC80211_MESH
+                                 BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_P2P_GO) },
+};
+
+static const struct ieee80211_iface_combination hwsim_if_comb = {
+        .limits = hwsim_if_limits,
+        .n_limits = ARRAY_SIZE(hwsim_if_limits),
+        .max_interfaces = 2048,
+        .num_different_channels = 1,
+};
+
 static int __init init_mac80211_hwsim(void)
 {
         int i, err = 0;
@@ -1782,6 +1801,9 @@ static int __init init_mac80211_hwsim(void)
                 hw->wiphy->n_addresses = 2;
                 hw->wiphy->addresses = data->addresses;
 
+                hw->wiphy->iface_combinations = &hwsim_if_comb;
+                hw->wiphy->n_iface_combinations = 1;
+
                 if (fake_hw_scan) {
                         hw->wiphy->max_scan_ssids = 255;
                         hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 87671446e24b..015fec3371a0 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -948,6 +948,19 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
                 bss_cfg->ssid.ssid_len = params->ssid_len;
         }
 
+        switch (params->hidden_ssid) {
+        case NL80211_HIDDEN_SSID_NOT_IN_USE:
+                bss_cfg->bcast_ssid_ctl = 1;
+                break;
+        case NL80211_HIDDEN_SSID_ZERO_LEN:
+                bss_cfg->bcast_ssid_ctl = 0;
+                break;
+        case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
+                /* firmware doesn't support this type of hidden SSID */
+        default:
+                return -EINVAL;
+        }
+
         if (mwifiex_set_secure_params(priv, bss_cfg, params)) {
                 kfree(bss_cfg);
                 wiphy_err(wiphy, "Failed to parse secuirty parameters!\n");
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 9f674bbebe65..561452a5c818 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -122,6 +122,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_CHANNELBANDLIST    (PROPRIETARY_TLV_BASE_ID + 42)
 #define TLV_TYPE_UAP_BEACON_PERIOD  (PROPRIETARY_TLV_BASE_ID + 44)
 #define TLV_TYPE_UAP_DTIM_PERIOD    (PROPRIETARY_TLV_BASE_ID + 45)
+#define TLV_TYPE_UAP_BCAST_SSID     (PROPRIETARY_TLV_BASE_ID + 48)
 #define TLV_TYPE_UAP_RTS_THRESHOLD  (PROPRIETARY_TLV_BASE_ID + 51)
 #define TLV_TYPE_UAP_WPA_PASSPHRASE (PROPRIETARY_TLV_BASE_ID + 60)
 #define TLV_TYPE_UAP_ENCRY_PROTOCOL (PROPRIETARY_TLV_BASE_ID + 64)
@@ -1209,6 +1210,11 @@ struct host_cmd_tlv_ssid {
         u8 ssid[0];
 } __packed;
 
+struct host_cmd_tlv_bcast_ssid {
+        struct host_cmd_tlv tlv;
+        u8 bcast_ctl;
+} __packed;
+
 struct host_cmd_tlv_beacon_period {
         struct host_cmd_tlv tlv;
         __le16 period;
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 76dfbc42a732..8173ab66066d 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -132,6 +132,7 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
         struct host_cmd_tlv_dtim_period *dtim_period;
         struct host_cmd_tlv_beacon_period *beacon_period;
         struct host_cmd_tlv_ssid *ssid;
+        struct host_cmd_tlv_bcast_ssid *bcast_ssid;
         struct host_cmd_tlv_channel_band *chan_band;
         struct host_cmd_tlv_frag_threshold *frag_threshold;
         struct host_cmd_tlv_rts_threshold *rts_threshold;
@@ -153,6 +154,14 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
                 cmd_size += sizeof(struct host_cmd_tlv) +
                             bss_cfg->ssid.ssid_len;
                 tlv += sizeof(struct host_cmd_tlv) + bss_cfg->ssid.ssid_len;
+
+                bcast_ssid = (struct host_cmd_tlv_bcast_ssid *)tlv;
+                bcast_ssid->tlv.type = cpu_to_le16(TLV_TYPE_UAP_BCAST_SSID);
+                bcast_ssid->tlv.len =
+                                cpu_to_le16(sizeof(bcast_ssid->bcast_ctl));
+                bcast_ssid->bcast_ctl = bss_cfg->bcast_ssid_ctl;
+                cmd_size += sizeof(struct host_cmd_tlv_bcast_ssid);
+                tlv += sizeof(struct host_cmd_tlv_bcast_ssid);
         }
         if (bss_cfg->channel && bss_cfg->channel <= MAX_CHANNEL_BAND_BG) {
                 chan_band = (struct host_cmd_tlv_channel_band *)tlv;
@@ -416,6 +425,7 @@ int mwifiex_uap_set_channel(struct mwifiex_private *priv, int channel)
         if (!bss_cfg)
                 return -ENOMEM;
 
+        mwifiex_set_sys_config_invalid_data(bss_cfg);
         bss_cfg->band_cfg = BAND_CONFIG_MANUAL;
         bss_cfg->channel = channel;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index ca36cccaba31..8f754025b06e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -396,8 +396,7 @@ struct rt2x00_intf {
          * for hardware which doesn't support hardware
          * sequence counting.
          */
-        spinlock_t seqlock;
-        u16 seqno;
+        atomic_t seqno;
 };
 
 static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index b49773ef72f2..dd24b2663b5e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -277,7 +277,6 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
         else
                 rt2x00dev->intf_sta_count++;
 
-        spin_lock_init(&intf->seqlock);
         mutex_init(&intf->beacon_skb_mutex);
         intf->beacon = entry;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 4c662eccf53c..2fd830103415 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -207,6 +207,7 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct rt2x00_intf *intf = vif_to_intf(tx_info->control.vif);
+        u16 seqno;
 
         if (!(tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
                 return;
@@ -238,15 +239,13 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
          * sequence counting per-frame, since those will override the
          * sequence counter given by mac80211.
          */
-        spin_lock(&intf->seqlock);
-
         if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
-                intf->seqno += 0x10;
-        hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
-        hdr->seq_ctrl |= cpu_to_le16(intf->seqno);
-
-        spin_unlock(&intf->seqlock);
+                seqno = atomic_add_return(0x10, &intf->seqno);
+        else
+                seqno = atomic_read(&intf->seqno);
 
+        hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+        hdr->seq_ctrl |= cpu_to_le16(seqno);
 }
 
 static void rt2x00queue_create_tx_descriptor_plcp(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rtl818x/rtl8187/leds.c b/drivers/net/wireless/rtl818x/rtl8187/leds.c
index 2e0de2f5f0f9..c2d5b495c179 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/leds.c
@@ -117,7 +117,7 @@ static void rtl8187_led_brightness_set(struct led_classdev *led_dev,
                         radio_on = true;
                 } else if (radio_on) {
                         radio_on = false;
-                        cancel_delayed_work_sync(&priv->led_on);
+                        cancel_delayed_work(&priv->led_on);
                         ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
                 }
         } else if (radio_on) {
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 447e83472c01..77cb54a65cde 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1744,6 +1744,11 @@ int pci_prepare_to_sleep(struct pci_dev *dev)
         if (target_state == PCI_POWER_ERROR)
                 return -EIO;
 
+        /* Some devices mustn't be in D3 during system sleep */
+        if (target_state == PCI_D3hot &&
+                        (dev->dev_flags & PCI_DEV_FLAGS_NO_D3_DURING_SLEEP))
+                return 0;
+
         pci_enable_wake(dev, target_state, device_may_wakeup(&dev->dev));
 
         error = pci_set_power_state(dev, target_state);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 2a7521677541..194b243a2817 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2929,6 +2929,32 @@ static void __devinit disable_igfx_irq(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
 
+/*
+ * The Intel 6 Series/C200 Series chipset's EHCI controllers on many
+ * ASUS motherboards will cause memory corruption or a system crash
+ * if they are in D3 while the system is put into S3 sleep.
+ */
+static void __devinit asus_ehci_no_d3(struct pci_dev *dev)
+{
+        const char *sys_info;
+        static const char good_Asus_board[] = "P8Z68-V";
+
+        if (dev->dev_flags & PCI_DEV_FLAGS_NO_D3_DURING_SLEEP)
+                return;
+        if (dev->subsystem_vendor != PCI_VENDOR_ID_ASUSTEK)
+                return;
+        sys_info = dmi_get_system_info(DMI_BOARD_NAME);
+        if (sys_info && memcmp(sys_info, good_Asus_board,
+                        sizeof(good_Asus_board) - 1) == 0)
+                return;
+
+        dev_info(&dev->dev, "broken D3 during system sleep on ASUS\n");
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_D3_DURING_SLEEP;
+        device_set_wakeup_capable(&dev->dev, false);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1c26, asus_ehci_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1c2d, asus_ehci_no_d3);
+
 static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
                           struct pci_fixup *end)
 {
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index c3b331b74fa0..0cc053af70bd 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -61,7 +61,7 @@ static LIST_HEAD(pinctrl_maps);
         list_for_each_entry(_maps_node_, &pinctrl_maps, node) \
                 for (_i_ = 0, _map_ = &_maps_node_->maps[_i_]; \
                         _i_ < _maps_node_->num_maps; \
-                        i++, _map_ = &_maps_node_->maps[_i_])
+                        _i_++, _map_ = &_maps_node_->maps[_i_])
 
 /**
  * pinctrl_provide_dummies() - indicate if pinctrl provides dummy state support
diff --git a/drivers/pinctrl/pinctrl-imx.c b/drivers/pinctrl/pinctrl-imx.c
index f6e7c670906c..dd6d93aa5334 100644
--- a/drivers/pinctrl/pinctrl-imx.c
+++ b/drivers/pinctrl/pinctrl-imx.c
@@ -27,16 +27,16 @@
 #include "core.h"
 #include "pinctrl-imx.h"
 
-#define IMX_PMX_DUMP(info, p, m, c, n)          \
-{                                               \
-        int i, j;                               \
-        printk("Format: Pin Mux Config\n");     \
-        for (i = 0; i < n; i++) {               \
-                j = p[i];                       \
-                printk("%s %d 0x%lx\n",         \
-                        info->pins[j].name,     \
-                        m[i], c[i]);            \
-        }                                       \
+#define IMX_PMX_DUMP(info, p, m, c, n)                  \
+{                                                       \
+        int i, j;                                       \
+        printk(KERN_DEBUG "Format: Pin Mux Config\n");  \
+        for (i = 0; i < n; i++) {                       \
+                j = p[i];                               \
+                printk(KERN_DEBUG "%s %d 0x%lx\n",      \
+                        info->pins[j].name,             \
+                        m[i], c[i]);                    \
+        }                                               \
 }
 
 /* The bits in CONFIG cell defined in binding doc*/
@@ -173,8 +173,10 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
 
         /* create mux map */
         parent = of_get_parent(np);
-        if (!parent)
+        if (!parent) {
+                kfree(new_map);
                 return -EINVAL;
+        }
         new_map[0].type = PIN_MAP_TYPE_MUX_GROUP;
         new_map[0].data.mux.function = parent->name;
         new_map[0].data.mux.group = np->name;
@@ -193,7 +195,7 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
         }
 
         dev_dbg(pctldev->dev, "maps: function %s group %s num %d\n",
-                new_map->data.mux.function, new_map->data.mux.group, map_num);
+                (*map)->data.mux.function, (*map)->data.mux.group, map_num);
 
         return 0;
 }
@@ -201,10 +203,7 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
 static void imx_dt_free_map(struct pinctrl_dev *pctldev,
                                 struct pinctrl_map *map, unsigned num_maps)
 {
-        int i;
-
-        for (i = 0; i < num_maps; i++)
-                kfree(map);
+        kfree(map);
 }
 
 static struct pinctrl_ops imx_pctrl_ops = {
@@ -475,9 +474,8 @@ static int __devinit imx_pinctrl_parse_groups(struct device_node *np,
                 grp->configs[j] = config & ~IMX_PAD_SION;
         }
 
-#ifdef DEBUG
         IMX_PMX_DUMP(info, grp->pins, grp->mux_mode, grp->configs, grp->npins);
-#endif
+
         return 0;
 }
 
diff --git a/drivers/pinctrl/pinctrl-mxs.c b/drivers/pinctrl/pinctrl-mxs.c
index 556e45a213eb..afb50ee64598 100644
--- a/drivers/pinctrl/pinctrl-mxs.c
+++ b/drivers/pinctrl/pinctrl-mxs.c
@@ -107,8 +107,10 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
 
                 /* Compose group name */
                 group = kzalloc(length, GFP_KERNEL);
-                if (!group)
-                        return -ENOMEM;
+                if (!group) {
+                        ret = -ENOMEM;
+                        goto free;
+                }
                 snprintf(group, length, "%s.%d", np->name, reg);
                 new_map[i].data.mux.group = group;
                 i++;
@@ -118,7 +120,7 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
                 pconfig = kmemdup(&config, sizeof(config), GFP_KERNEL);
                 if (!pconfig) {
                         ret = -ENOMEM;
-                        goto free;
+                        goto free_group;
                 }
 
                 new_map[i].type = PIN_MAP_TYPE_CONFIGS_GROUP;
@@ -133,6 +135,9 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
 
         return 0;
 
+free_group:
+        if (!purecfg)
+                free(group);
 free:
         kfree(new_map);
         return ret;
@@ -511,6 +516,7 @@ int __devinit mxs_pinctrl_probe(struct platform_device *pdev,
         return 0;
 
 err:
+        platform_set_drvdata(pdev, NULL);
         iounmap(d->base);
         return ret;
 }
@@ -520,6 +526,7 @@ int __devexit mxs_pinctrl_remove(struct platform_device *pdev)
 {
         struct mxs_pinctrl_data *d = platform_get_drvdata(pdev);
 
+        platform_set_drvdata(pdev, NULL);
         pinctrl_unregister(d->pctl);
         iounmap(d->base);
 
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index b26395d16347..e8937e7e4999 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -673,7 +673,7 @@ static void __nmk_gpio_set_wake(struct nmk_gpio_chip *nmk_chip,
          * wakeup is anyhow controlled by the RIMSC and FIMSC registers.
          */
         if (nmk_chip->sleepmode && on) {
-                __nmk_gpio_set_slpm(nmk_chip, gpio % nmk_chip->chip.base,
+                __nmk_gpio_set_slpm(nmk_chip, gpio % NMK_GPIO_PER_CHIP,
                                     NMK_GPIO_SLPM_WAKEUP_ENABLE);
         }
 
@@ -1246,6 +1246,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
                 ret = PTR_ERR(clk);
                 goto out_unmap;
         }
+        clk_prepare(clk);
 
         nmk_chip = kzalloc(sizeof(*nmk_chip), GFP_KERNEL);
         if (!nmk_chip) {
diff --git a/drivers/pinctrl/pinctrl-sirf.c b/drivers/pinctrl/pinctrl-sirf.c
index ba15b1a29e52..e9f8e7d11001 100644
--- a/drivers/pinctrl/pinctrl-sirf.c
+++ b/drivers/pinctrl/pinctrl-sirf.c
@@ -1184,7 +1184,7 @@ out_no_gpio_remap:
         return ret;
 }
 
-static const struct of_device_id pinmux_ids[]  = {
+static const struct of_device_id pinmux_ids[] __devinitconst = {
         { .compatible = "sirf,prima2-gpio-pinmux" },
         {}
 };
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
index 639db4d0aa76..2fd9d36acd15 100644
--- a/drivers/platform/x86/acerhdf.c
+++ b/drivers/platform/x86/acerhdf.c
@@ -5,7 +5,7 @@
  *
  * (C) 2009 - Peter Feuerer     peter (a) piie.net
  *                              http://piie.net
- *     2009 Borislav Petkov <petkovbb@gmail.com>
+ *     2009 Borislav Petkov     bp (a) alien8.de
  *
  * Inspired by and many thanks to:
  *  o acerfand   - Rachel Greenham
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 3660bace123c..e82e7eaac0f1 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -224,7 +224,7 @@ static struct platform_driver anatop_regulator_driver = {
                 .of_match_table = of_anatop_regulator_match_tbl,
         },
         .probe  = anatop_regulator_probe,
-        .remove = anatop_regulator_remove,
+        .remove = __devexit_p(anatop_regulator_remove),
 };
 
 static int __init anatop_regulator_init(void)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 7584a74eec8a..09a737c868b5 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2050,6 +2050,9 @@ int regulator_map_voltage_linear(struct regulator_dev *rdev,
                 return -EINVAL;
         }
 
+        if (min_uV < rdev->desc->min_uV)
+                min_uV = rdev->desc->min_uV;
+
         ret = DIV_ROUND_UP(min_uV - rdev->desc->min_uV, rdev->desc->uV_step);
         if (ret < 0)
                 return ret;
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index 9997d7aaca84..242851a4c1a6 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -101,16 +101,20 @@ static int gpio_regulator_get_value(struct regulator_dev *dev)
 }
 
 static int gpio_regulator_set_value(struct regulator_dev *dev,
-                                        int min, int max)
+                                        int min, int max, unsigned *selector)
 {
         struct gpio_regulator_data *data = rdev_get_drvdata(dev);
-        int ptr, target, state, best_val = INT_MAX;
+        int ptr, target = 0, state, best_val = INT_MAX;
 
         for (ptr = 0; ptr < data->nr_states; ptr++)
                 if (data->states[ptr].value < best_val &&
                     data->states[ptr].value >= min &&
-                    data->states[ptr].value <= max)
+                    data->states[ptr].value <= max) {
                         target = data->states[ptr].gpios;
+                        best_val = data->states[ptr].value;
+                        if (selector)
+                                *selector = ptr;
+                }
 
         if (best_val == INT_MAX)
                 return -EINVAL;
@@ -128,7 +132,7 @@ static int gpio_regulator_set_voltage(struct regulator_dev *dev,
                                         int min_uV, int max_uV,
                                         unsigned *selector)
 {
-        return gpio_regulator_set_value(dev, min_uV, max_uV);
+        return gpio_regulator_set_value(dev, min_uV, max_uV, selector);
 }
 
 static int gpio_regulator_list_voltage(struct regulator_dev *dev,
@@ -145,7 +149,7 @@ static int gpio_regulator_list_voltage(struct regulator_dev *dev,
 static int gpio_regulator_set_current_limit(struct regulator_dev *dev,
                                         int min_uA, int max_uA)
 {
-        return gpio_regulator_set_value(dev, min_uA, max_uA);
+        return gpio_regulator_set_value(dev, min_uA, max_uA, NULL);
 }
 
 static struct regulator_ops gpio_regulator_voltage_ops = {
@@ -286,7 +290,7 @@ static int __devinit gpio_regulator_probe(struct platform_device *pdev)
 
         cfg.dev = &pdev->dev;
         cfg.init_data = config->init_data;
-        cfg.driver_data = &drvdata;
+        cfg.driver_data = drvdata;
 
         drvdata->dev = regulator_register(&drvdata->desc, &cfg);
         if (IS_ERR(drvdata->dev)) {
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 1f4bb80457b3..9d540cd02dab 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -259,6 +259,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
         config.dev = &client->dev;
         config.init_data = pdata->regulator;
         config.driver_data = info;
+        config.regmap = info->regmap;
 
         info->regulator = regulator_register(&dcdc_desc, &config);
         if (IS_ERR(info->regulator)) {
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index c4435f608df7..9b7ca90057d5 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -775,9 +775,6 @@ static __devinit int palmas_probe(struct platform_device *pdev)
 err_unregister_regulator:
         while (--id >= 0)
                 regulator_unregister(pmic->rdev[id]);
-        kfree(pmic->rdev);
-        kfree(pmic->desc);
-        kfree(pmic);
         return ret;
 }
 
@@ -788,10 +785,6 @@ static int __devexit palmas_remove(struct platform_device *pdev)
 
         for (id = 0; id < PALMAS_NUM_REGS; id++)
                 regulator_unregister(pmic->rdev[id]);
-
-        kfree(pmic->rdev);
-        kfree(pmic->desc);
-        kfree(pmic);
         return 0;
 }
 
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index 7d5f56edb8ef..4267789ca995 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -910,14 +910,17 @@ static inline int cmos_poweroff(struct device *dev)
 
 static u32 rtc_handler(void *context)
 {
+        struct device *dev = context;
+
+        pm_wakeup_event(dev, 0);
         acpi_clear_event(ACPI_EVENT_RTC);
         acpi_disable_event(ACPI_EVENT_RTC, 0);
         return ACPI_INTERRUPT_HANDLED;
 }
 
-static inline void rtc_wake_setup(void)
+static inline void rtc_wake_setup(struct device *dev)
 {
-        acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, NULL);
+        acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, dev);
         /*
          * After the RTC handler is installed, the Fixed_RTC event should
          * be disabled. Only when the RTC alarm is set will it be enabled.
@@ -950,7 +953,7 @@ cmos_wake_setup(struct device *dev)
         if (acpi_disabled)
                 return;
 
-        rtc_wake_setup();
+        rtc_wake_setup(dev);
         acpi_rtc_info.wake_on = rtc_wake_on;
         acpi_rtc_info.wake_off = rtc_wake_off;
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 6102ef2cb2d8..9d46fcbe7755 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -1792,7 +1792,7 @@ static inline void _base_writeq(__u64 b, volatile void __iomem *addr,
 static inline u8
 _base_get_msix_index(struct MPT2SAS_ADAPTER *ioc)
 {
-        return ioc->cpu_msix_table[smp_processor_id()];
+        return ioc->cpu_msix_table[raw_smp_processor_id()];
 }
 
 /**
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 04f80ebf09eb..6986552b47e6 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -26,7 +26,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <linux/blkdev.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
@@ -2477,11 +2476,9 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
         }
 
         cmd = qlt_ctio_to_cmd(vha, handle, ctio);
-        if (cmd == NULL) {
-                if (status != CTIO_SUCCESS)
-                        qlt_term_ctio_exchange(vha, ctio, NULL, status);
+        if (cmd == NULL)
                 return;
-        }
+
         se_cmd = &cmd->se_cmd;
         tfo = se_cmd->se_tfo;
 
@@ -2727,10 +2724,12 @@ static void qlt_do_work(struct work_struct *work)
 out_term:
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf020, "Terminating work cmd %p", cmd);
         /*
-         * cmd has not sent to target yet, so pass NULL as the second argument
+         * cmd has not sent to target yet, so pass NULL as the second
+         * argument to qlt_send_term_exchange() and free the memory here.
          */
         spin_lock_irqsave(&ha->hardware_lock, flags);
         qlt_send_term_exchange(vha, NULL, &cmd->atio, 1);
+        kmem_cache_free(qla_tgt_cmd_cachep, cmd);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         if (sess)
                 ha->tgt.tgt_ops->put_sess(sess);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 9ec19bc2f0fe..9f9ef1644fd9 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -919,7 +919,6 @@ struct qla_tgt_srr_ctio {
 #define QLA_TGT_XMIT_STATUS             2
 #define QLA_TGT_XMIT_ALL                (QLA_TGT_XMIT_STATUS|QLA_TGT_XMIT_DATA)
 
-#include <linux/version.h>
 
 extern struct qla_tgt_data qla_target;
 /*
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 436598f57404..6e64314dbbb3 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -137,13 +137,15 @@ static char *tcm_qla2xxx_get_fabric_name(void)
  */
 static int tcm_qla2xxx_npiv_extract_wwn(const char *ns, u64 *nm)
 {
-        unsigned int i, j, value;
+        unsigned int i, j;
         u8 wwn[8];
 
         memset(wwn, 0, sizeof(wwn));
 
         /* Validate and store the new name */
         for (i = 0, j = 0; i < 16; i++) {
+                int value;
+
                 value = hex_to_bin(*ns++);
                 if (value >= 0)
                         j = (j << 4) | value;
@@ -652,8 +654,8 @@ static int tcm_qla2xxx_handle_data(struct qla_tgt_cmd *cmd)
 /*
  * Called from qla_target.c:qlt_issue_task_mgmt()
  */
-int tcm_qla2xxx_handle_tmr(struct qla_tgt_mgmt_cmd *mcmd, uint32_t lun,
-                        uint8_t tmr_func, uint32_t tag)
+static int tcm_qla2xxx_handle_tmr(struct qla_tgt_mgmt_cmd *mcmd, uint32_t lun,
+        uint8_t tmr_func, uint32_t tag)
 {
         struct qla_tgt_sess *sess = mcmd->sess;
         struct se_cmd *se_cmd = &mcmd->se_cmd;
@@ -762,65 +764,8 @@ static u16 tcm_qla2xxx_set_fabric_sense_len(struct se_cmd *se_cmd,
 struct target_fabric_configfs *tcm_qla2xxx_fabric_configfs;
 struct target_fabric_configfs *tcm_qla2xxx_npiv_fabric_configfs;
 
-static int tcm_qla2xxx_setup_nacl_from_rport(
-        struct se_portal_group *se_tpg,
-        struct se_node_acl *se_nacl,
-        struct tcm_qla2xxx_lport *lport,
-        struct tcm_qla2xxx_nacl *nacl,
-        u64 rport_wwnn)
-{
-        struct scsi_qla_host *vha = lport->qla_vha;
-        struct Scsi_Host *sh = vha->host;
-        struct fc_host_attrs *fc_host = shost_to_fc_host(sh);
-        struct fc_rport *rport;
-        unsigned long flags;
-        void *node;
-        int rc;
-
-        /*
-         * Scan the existing rports, and create a session for the
-         * explict NodeACL is an matching rport->node_name already
-         * exists.
-         */
-        spin_lock_irqsave(sh->host_lock, flags);
-        list_for_each_entry(rport, &fc_host->rports, peers) {
-                if (rport_wwnn != rport->node_name)
-                        continue;
-
-                pr_debug("Located existing rport_wwpn and rport->node_name: 0x%016LX, port_id: 0x%04x\n",
-                    rport->node_name, rport->port_id);
-                nacl->nport_id = rport->port_id;
-
-                spin_unlock_irqrestore(sh->host_lock, flags);
-
-                spin_lock_irqsave(&vha->hw->hardware_lock, flags);
-                node = btree_lookup32(&lport->lport_fcport_map, rport->port_id);
-                if (node) {
-                        rc = btree_update32(&lport->lport_fcport_map,
-                                            rport->port_id, se_nacl);
-                } else {
-                        rc = btree_insert32(&lport->lport_fcport_map,
-                                            rport->port_id, se_nacl,
-                                            GFP_ATOMIC);
-                }
-                spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
-
-                if (rc) {
-                        pr_err("Unable to insert se_nacl into fcport_map");
-                        WARN_ON(rc > 0);
-                        return rc;
-                }
-
-                pr_debug("Inserted into fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%08x\n",
-                    se_nacl, rport_wwnn, nacl->nport_id);
-
-                return 1;
-        }
-        spin_unlock_irqrestore(sh->host_lock, flags);
-
-        return 0;
-}
-
+static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
+                        struct tcm_qla2xxx_nacl *, struct qla_tgt_sess *);
 /*
  * Expected to be called with struct qla_hw_data->hardware_lock held
  */
@@ -842,11 +787,40 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess)
 
         pr_debug("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n",
             se_nacl, nacl->nport_wwnn, nacl->nport_id);
+        /*
+         * Now clear the se_nacl and session pointers from our HW lport lookup
+         * table mapping for this initiator's fabric S_ID and LOOP_ID entries.
+         *
+         * This is done ahead of callbacks into tcm_qla2xxx_free_session() ->
+         * target_wait_for_sess_cmds() before the session waits for outstanding
+         * I/O to complete, to avoid a race between session shutdown execution
+         * and incoming ATIOs or TMRs picking up a stale se_node_act reference.
+         */
+        tcm_qla2xxx_clear_sess_lookup(lport, nacl, sess);
+}
+
+static void tcm_qla2xxx_release_session(struct kref *kref)
+{
+        struct se_session *se_sess = container_of(kref,
+                        struct se_session, sess_kref);
+
+        qlt_unreg_sess(se_sess->fabric_sess_ptr);
+}
+
+static void tcm_qla2xxx_put_session(struct se_session *se_sess)
+{
+        struct qla_tgt_sess *sess = se_sess->fabric_sess_ptr;
+        struct qla_hw_data *ha = sess->vha->hw;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        kref_put(&se_sess->sess_kref, tcm_qla2xxx_release_session);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 
 static void tcm_qla2xxx_put_sess(struct qla_tgt_sess *sess)
 {
-        target_put_session(sess->se_sess);
+        tcm_qla2xxx_put_session(sess->se_sess);
 }
 
 static void tcm_qla2xxx_shutdown_sess(struct qla_tgt_sess *sess)
@@ -859,14 +833,10 @@ static struct se_node_acl *tcm_qla2xxx_make_nodeacl(
         struct config_group *group,
         const char *name)
 {
-        struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
-        struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
-                                struct tcm_qla2xxx_lport, lport_wwn);
         struct se_node_acl *se_nacl, *se_nacl_new;
         struct tcm_qla2xxx_nacl *nacl;
         u64 wwnn;
         u32 qla2xxx_nexus_depth;
-        int rc;
 
         if (tcm_qla2xxx_parse_wwn(name, &wwnn, 1) < 0)
                 return ERR_PTR(-EINVAL);
@@ -893,16 +863,6 @@ static struct se_node_acl *tcm_qla2xxx_make_nodeacl(
         nacl = container_of(se_nacl, struct tcm_qla2xxx_nacl, se_node_acl);
         nacl->nport_wwnn = wwnn;
         tcm_qla2xxx_format_wwn(&nacl->nport_name[0], TCM_QLA2XXX_NAMELEN, wwnn);
-        /*
-         * Setup a se_nacl handle based on an a matching struct fc_rport setup
-         * via drivers/scsi/qla2xxx/qla_init.c:qla2x00_reg_remote_port()
-         */
-        rc = tcm_qla2xxx_setup_nacl_from_rport(se_tpg, se_nacl, lport,
-                                        nacl, wwnn);
-        if (rc < 0) {
-                tcm_qla2xxx_release_fabric_acl(se_tpg, se_nacl_new);
-                return ERR_PTR(rc);
-        }
 
         return se_nacl;
 }
@@ -1390,6 +1350,25 @@ static void tcm_qla2xxx_set_sess_by_loop_id(
             nacl->qla_tgt_sess, new_se_nacl, new_se_nacl->initiatorname);
 }
 
+/*
+ * Should always be called with qla_hw_data->hardware_lock held.
+ */
+static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *lport,
+                struct tcm_qla2xxx_nacl *nacl, struct qla_tgt_sess *sess)
+{
+        struct se_session *se_sess = sess->se_sess;
+        unsigned char be_sid[3];
+
+        be_sid[0] = sess->s_id.b.domain;
+        be_sid[1] = sess->s_id.b.area;
+        be_sid[2] = sess->s_id.b.al_pa;
+
+        tcm_qla2xxx_set_sess_by_s_id(lport, NULL, nacl, se_sess,
+                                sess, be_sid);
+        tcm_qla2xxx_set_sess_by_loop_id(lport, NULL, nacl, se_sess,
+                                sess, sess->loop_id);
+}
+
 static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
 {
         struct qla_tgt *tgt = sess->tgt;
@@ -1398,8 +1377,6 @@ static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
         struct se_node_acl *se_nacl;
         struct tcm_qla2xxx_lport *lport;
         struct tcm_qla2xxx_nacl *nacl;
-        unsigned char be_sid[3];
-        unsigned long flags;
 
         BUG_ON(in_interrupt());
 
@@ -1419,21 +1396,6 @@ static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
                 return;
         }
         target_wait_for_sess_cmds(se_sess, 0);
-        /*
-         * And now clear the se_nacl and session pointers from our HW lport
-         * mappings for fabric S_ID and LOOP_ID.
-         */
-        memset(&be_sid, 0, 3);
-        be_sid[0] = sess->s_id.b.domain;
-        be_sid[1] = sess->s_id.b.area;
-        be_sid[2] = sess->s_id.b.al_pa;
-
-        spin_lock_irqsave(&ha->hardware_lock, flags);
-        tcm_qla2xxx_set_sess_by_s_id(lport, NULL, nacl, se_sess,
-                        sess, be_sid);
-        tcm_qla2xxx_set_sess_by_loop_id(lport, NULL, nacl, se_sess,
-                        sess, sess->loop_id);
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         transport_deregister_session_configfs(sess->se_sess);
         transport_deregister_session(sess->se_sess);
@@ -1731,6 +1693,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_ops = {
         .new_cmd_map                    = NULL,
         .check_stop_free                = tcm_qla2xxx_check_stop_free,
         .release_cmd                    = tcm_qla2xxx_release_cmd,
+        .put_session                    = tcm_qla2xxx_put_session,
         .shutdown_session               = tcm_qla2xxx_shutdown_session,
         .close_session                  = tcm_qla2xxx_close_session,
         .sess_get_index                 = tcm_qla2xxx_sess_get_index,
@@ -1779,6 +1742,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_npiv_ops = {
         .tpg_release_fabric_acl         = tcm_qla2xxx_release_fabric_acl,
         .tpg_get_inst_index             = tcm_qla2xxx_tpg_get_inst_index,
         .release_cmd                    = tcm_qla2xxx_release_cmd,
+        .put_session                    = tcm_qla2xxx_put_session,
         .shutdown_session               = tcm_qla2xxx_shutdown_session,
         .close_session                  = tcm_qla2xxx_close_session,
         .sess_get_index                 = tcm_qla2xxx_sess_get_index,
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 61c82a345f82..bbbc9c918d4c 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -90,11 +90,9 @@ unsigned int scsi_logging_level;
 EXPORT_SYMBOL(scsi_logging_level);
 #endif
 
-#if IS_ENABLED(CONFIG_PM) || IS_ENABLED(CONFIG_BLK_DEV_SD)
-/* sd and scsi_pm need to coordinate flushing async actions */
+/* sd, scsi core and power management need to coordinate flushing async actions */
 LIST_HEAD(scsi_sd_probe_domain);
 EXPORT_SYMBOL(scsi_sd_probe_domain);
-#endif
 
 /* NB: These are exposed through /proc/scsi/scsi and form part of the ABI.
  * You may not alter any existing entry (although adding new ones is
diff --git a/drivers/staging/ramster/zcache-main.c b/drivers/staging/ramster/zcache-main.c
index 4e7ef0e6b79c..d46764b5aaba 100644
--- a/drivers/staging/ramster/zcache-main.c
+++ b/drivers/staging/ramster/zcache-main.c
@@ -3002,7 +3002,7 @@ static inline struct tmem_oid oswiz(unsigned type, u32 ind)
         return oid;
 }
 
-static int zcache_frontswap_put_page(unsigned type, pgoff_t offset,
+static int zcache_frontswap_store(unsigned type, pgoff_t offset,
                                    struct page *page)
 {
         u64 ind64 = (u64)offset;
@@ -3025,7 +3025,7 @@ static int zcache_frontswap_put_page(unsigned type, pgoff_t offset,
 
 /* returns 0 if the page was successfully gotten from frontswap, -1 if
  * was not present (should never happen!) */
-static int zcache_frontswap_get_page(unsigned type, pgoff_t offset,
+static int zcache_frontswap_load(unsigned type, pgoff_t offset,
                                    struct page *page)
 {
         u64 ind64 = (u64)offset;
@@ -3080,8 +3080,8 @@ static void zcache_frontswap_init(unsigned ignored)
 }
 
 static struct frontswap_ops zcache_frontswap_ops = {
-        .put_page = zcache_frontswap_put_page,
-        .get_page = zcache_frontswap_get_page,
+        .store = zcache_frontswap_store,
+        .load = zcache_frontswap_load,
         .invalidate_page = zcache_frontswap_flush_page,
         .invalidate_area = zcache_frontswap_flush_area,
         .init = zcache_frontswap_init
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index 2734dacacbaf..784c796b9848 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1835,7 +1835,7 @@ static int zcache_frontswap_poolid = -1;
  * Swizzling increases objects per swaptype, increasing tmem concurrency
  * for heavy swaploads.  Later, larger nr_cpus -> larger SWIZ_BITS
  * Setting SWIZ_BITS to 27 basically reconstructs the swap entry from
- * frontswap_get_page(), but has side-effects. Hence using 8.
+ * frontswap_load(), but has side-effects. Hence using 8.
  */
 #define SWIZ_BITS               8
 #define SWIZ_MASK               ((1 << SWIZ_BITS) - 1)
@@ -1849,7 +1849,7 @@ static inline struct tmem_oid oswiz(unsigned type, u32 ind)
         return oid;
 }
 
-static int zcache_frontswap_put_page(unsigned type, pgoff_t offset,
+static int zcache_frontswap_store(unsigned type, pgoff_t offset,
                                    struct page *page)
 {
         u64 ind64 = (u64)offset;
@@ -1870,7 +1870,7 @@ static int zcache_frontswap_put_page(unsigned type, pgoff_t offset,
 
 /* returns 0 if the page was successfully gotten from frontswap, -1 if
  * was not present (should never happen!) */
-static int zcache_frontswap_get_page(unsigned type, pgoff_t offset,
+static int zcache_frontswap_load(unsigned type, pgoff_t offset,
                                    struct page *page)
 {
         u64 ind64 = (u64)offset;
@@ -1919,8 +1919,8 @@ static void zcache_frontswap_init(unsigned ignored)
 }
 
 static struct frontswap_ops zcache_frontswap_ops = {
-        .put_page = zcache_frontswap_put_page,
-        .get_page = zcache_frontswap_get_page,
+        .store = zcache_frontswap_store,
+        .load = zcache_frontswap_load,
         .invalidate_page = zcache_frontswap_flush_page,
         .invalidate_area = zcache_frontswap_flush_area,
         .init = zcache_frontswap_init
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
index 37c609898f84..7e6136e2ce81 100644
--- a/drivers/target/sbp/sbp_target.c
+++ b/drivers/target/sbp/sbp_target.c
@@ -587,14 +587,14 @@ static void sbp_management_request_logout(
 {
         struct sbp_tport *tport = agent->tport;
         struct sbp_tpg *tpg = tport->tpg;
-        int login_id;
+        int id;
         struct sbp_login_descriptor *login;
 
-        login_id = LOGOUT_ORB_LOGIN_ID(be32_to_cpu(req->orb.misc));
+        id = LOGOUT_ORB_LOGIN_ID(be32_to_cpu(req->orb.misc));
 
-        login = sbp_login_find_by_id(tpg, login_id);
+        login = sbp_login_find_by_id(tpg, id);
         if (!login) {
-                pr_warn("cannot find login: %d\n", login_id);
+                pr_warn("cannot find login: %d\n", id);
 
                 req->status.status = cpu_to_be32(
                         STATUS_BLOCK_RESP(STATUS_RESP_REQUEST_COMPLETE) |
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index e624b836469c..91799973081a 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -374,8 +374,9 @@ int target_emulate_set_target_port_groups(struct se_cmd *cmd)
 
 out:
         transport_kunmap_data_sg(cmd);
-        target_complete_cmd(cmd, GOOD);
-        return 0;
+        if (!rc)
+                target_complete_cmd(cmd, GOOD);
+        return rc;
 }
 
 static inline int core_alua_state_nonoptimized(
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 686dba189f8e..9f99d0404908 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -133,16 +133,11 @@ static struct se_device *fd_create_virtdevice(
                 ret = PTR_ERR(dev_p);
                 goto fail;
         }
-
-        /* O_DIRECT too? */
-        flags = O_RDWR | O_CREAT | O_LARGEFILE;
-
         /*
-         * If fd_buffered_io=1 has not been set explicitly (the default),
-         * use O_SYNC to force FILEIO writes to disk.
+         * Use O_DSYNC by default instead of O_SYNC to forgo syncing
+         * of pure timestamp updates.
          */
-        if (!(fd_dev->fbd_flags & FDBD_USE_BUFFERED_IO))
-                flags |= O_SYNC;
+        flags = O_RDWR | O_CREAT | O_LARGEFILE | O_DSYNC;
 
         file = filp_open(dev_p, flags, 0600);
         if (IS_ERR(file)) {
@@ -380,23 +375,6 @@ static void fd_emulate_sync_cache(struct se_cmd *cmd)
         }
 }
 
-static void fd_emulate_write_fua(struct se_cmd *cmd)
-{
-        struct se_device *dev = cmd->se_dev;
-        struct fd_dev *fd_dev = dev->dev_ptr;
-        loff_t start = cmd->t_task_lba *
-                dev->se_sub_dev->se_dev_attrib.block_size;
-        loff_t end = start + cmd->data_length;
-        int ret;
-
-        pr_debug("FILEIO: FUA WRITE LBA: %llu, bytes: %u\n",
-                cmd->t_task_lba, cmd->data_length);
-
-        ret = vfs_fsync_range(fd_dev->fd_file, start, end, 1);
-        if (ret != 0)
-                pr_err("FILEIO: vfs_fsync_range() failed: %d\n", ret);
-}
-
 static int fd_execute_cmd(struct se_cmd *cmd, struct scatterlist *sgl,
                 u32 sgl_nents, enum dma_data_direction data_direction)
 {
@@ -411,19 +389,21 @@ static int fd_execute_cmd(struct se_cmd *cmd, struct scatterlist *sgl,
                 ret = fd_do_readv(cmd, sgl, sgl_nents);
         } else {
                 ret = fd_do_writev(cmd, sgl, sgl_nents);
-
+                /*
+                 * Perform implict vfs_fsync_range() for fd_do_writev() ops
+                 * for SCSI WRITEs with Forced Unit Access (FUA) set.
+                 * Allow this to happen independent of WCE=0 setting.
+                 */
                 if (ret > 0 &&
-                    dev->se_sub_dev->se_dev_attrib.emulate_write_cache > 0 &&
                     dev->se_sub_dev->se_dev_attrib.emulate_fua_write > 0 &&
                     (cmd->se_cmd_flags & SCF_FUA)) {
-                        /*
-                         * We might need to be a bit smarter here
-                         * and return some sense data to let the initiator
-                         * know the FUA WRITE cache sync failed..?
-                         */
-                        fd_emulate_write_fua(cmd);
-                }
+                        struct fd_dev *fd_dev = dev->dev_ptr;
+                        loff_t start = cmd->t_task_lba *
+                                dev->se_sub_dev->se_dev_attrib.block_size;
+                        loff_t end = start + cmd->data_length;
 
+                        vfs_fsync_range(fd_dev->fd_file, start, end, 1);
+                }
         }
 
         if (ret < 0) {
@@ -442,7 +422,6 @@ enum {
 static match_table_t tokens = {
         {Opt_fd_dev_name, "fd_dev_name=%s"},
         {Opt_fd_dev_size, "fd_dev_size=%s"},
-        {Opt_fd_buffered_io, "fd_buffered_io=%d"},
         {Opt_err, NULL}
 };
 
@@ -454,7 +433,7 @@ static ssize_t fd_set_configfs_dev_params(
         struct fd_dev *fd_dev = se_dev->se_dev_su_ptr;
         char *orig, *ptr, *arg_p, *opts;
         substring_t args[MAX_OPT_ARGS];
-        int ret = 0, arg, token;
+        int ret = 0, token;
 
         opts = kstrdup(page, GFP_KERNEL);
         if (!opts)
@@ -498,19 +477,6 @@ static ssize_t fd_set_configfs_dev_params(
                                         " bytes\n", fd_dev->fd_dev_size);
                         fd_dev->fbd_flags |= FBDF_HAS_SIZE;
                         break;
-                case Opt_fd_buffered_io:
-                        match_int(args, &arg);
-                        if (arg != 1) {
-                                pr_err("bogus fd_buffered_io=%d value\n", arg);
-                                ret = -EINVAL;
-                                goto out;
-                        }
-
-                        pr_debug("FILEIO: Using buffered I/O"
-                                " operations for struct fd_dev\n");
-
-                        fd_dev->fbd_flags |= FDBD_USE_BUFFERED_IO;
-                        break;
                 default:
                         break;
                 }
@@ -542,10 +508,8 @@ static ssize_t fd_show_configfs_dev_params(
         ssize_t bl = 0;
 
         bl = sprintf(b + bl, "TCM FILEIO ID: %u", fd_dev->fd_dev_id);
-        bl += sprintf(b + bl, "        File: %s  Size: %llu  Mode: %s\n",
-                fd_dev->fd_dev_name, fd_dev->fd_dev_size,
-                (fd_dev->fbd_flags & FDBD_USE_BUFFERED_IO) ?
-                "Buffered" : "Synchronous");
+        bl += sprintf(b + bl, "        File: %s  Size: %llu  Mode: O_DSYNC\n",
+                fd_dev->fd_dev_name, fd_dev->fd_dev_size);
         return bl;
 }
 
diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
index fbd59ef7d8be..70ce7fd7111d 100644
--- a/drivers/target/target_core_file.h
+++ b/drivers/target/target_core_file.h
@@ -14,7 +14,6 @@
 
 #define FBDF_HAS_PATH           0x01
 #define FBDF_HAS_SIZE           0x02
-#define FDBD_USE_BUFFERED_IO    0x04
 
 struct fd_dev {
         u32             fbd_flags;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index b05fdc0c05d3..634d0f31a28c 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -315,7 +315,7 @@ void transport_register_session(
 }
 EXPORT_SYMBOL(transport_register_session);
 
-static void target_release_session(struct kref *kref)
+void target_release_session(struct kref *kref)
 {
         struct se_session *se_sess = container_of(kref,
                         struct se_session, sess_kref);
@@ -332,6 +332,12 @@ EXPORT_SYMBOL(target_get_session);
 
 void target_put_session(struct se_session *se_sess)
 {
+        struct se_portal_group *tpg = se_sess->se_tpg;
+
+        if (tpg->se_tpg_tfo->put_session != NULL) {
+                tpg->se_tpg_tfo->put_session(se_sess);
+                return;
+        }
         kref_put(&se_sess->sess_kref, target_release_session);
 }
 EXPORT_SYMBOL(target_put_session);
diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index d3d91dae065c..944eaeb8e0cf 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -214,24 +214,24 @@ static int xen_hvm_console_init(void)
         /* already configured */
         if (info->intf != NULL)
                 return 0;
-
+        /*
+         * If the toolstack (or the hypervisor) hasn't set these values, the
+         * default value is 0. Even though mfn = 0 and evtchn = 0 are
+         * theoretically correct values, in practice they never are and they
+         * mean that a legacy toolstack hasn't initialized the pv console correctly.
+         */
         r = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v);
-        if (r < 0) {
-                kfree(info);
-                return -ENODEV;
-        }
+        if (r < 0 || v == 0)
+                goto err;
         info->evtchn = v;
-        hvm_get_parameter(HVM_PARAM_CONSOLE_PFN, &v);
-        if (r < 0) {
-                kfree(info);
-                return -ENODEV;
-        }
+        v = 0;
+        r = hvm_get_parameter(HVM_PARAM_CONSOLE_PFN, &v);
+        if (r < 0 || v == 0)
+                goto err;
         mfn = v;
         info->intf = ioremap(mfn << PAGE_SHIFT, PAGE_SIZE);
-        if (info->intf == NULL) {
-                kfree(info);
-                return -ENODEV;
-        }
+        if (info->intf == NULL)
+                goto err;
         info->vtermno = HVC_COOKIE;
 
         spin_lock(&xencons_lock);
@@ -239,6 +239,9 @@ static int xen_hvm_console_init(void)
         spin_unlock(&xencons_lock);
 
         return 0;
+err:
+        kfree(info);
+        return -ENODEV;
 }
 
 static int xen_pv_console_init(void)
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 4604153b7954..1bd9163bc118 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -2179,6 +2179,16 @@ static int __devinit sci_init_single(struct platform_device *dev,
         return 0;
 }
 
+static void sci_cleanup_single(struct sci_port *port)
+{
+        sci_free_gpios(port);
+
+        clk_put(port->iclk);
+        clk_put(port->fclk);
+
+        pm_runtime_disable(port->port.dev);
+}
+
 #ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
 static void serial_console_putchar(struct uart_port *port, int ch)
 {
@@ -2360,14 +2370,10 @@ static int sci_remove(struct platform_device *dev)
         cpufreq_unregister_notifier(&port->freq_transition,
                                     CPUFREQ_TRANSITION_NOTIFIER);
 
-        sci_free_gpios(port);
-
         uart_remove_one_port(&sci_uart_driver, &port->port);
 
-        clk_put(port->iclk);
-        clk_put(port->fclk);
+        sci_cleanup_single(port);
 
-        pm_runtime_disable(&dev->dev);
         return 0;
 }
 
@@ -2385,14 +2391,20 @@ static int __devinit sci_probe_single(struct platform_device *dev,
                            index+1, SCI_NPORTS);
                 dev_notice(&dev->dev, "Consider bumping "
                            "CONFIG_SERIAL_SH_SCI_NR_UARTS!\n");
-                return 0;
+                return -EINVAL;
         }
 
         ret = sci_init_single(dev, sciport, index, p);
         if (ret)
                 return ret;
 
-        return uart_add_one_port(&sci_uart_driver, &sciport->port);
+        ret = uart_add_one_port(&sci_uart_driver, &sciport->port);
+        if (ret) {
+                sci_cleanup_single(sciport);
+                return ret;
+        }
+
+        return 0;
 }
 
 static int __devinit sci_probe(struct platform_device *dev)
@@ -2413,24 +2425,22 @@ static int __devinit sci_probe(struct platform_device *dev)
 
         ret = sci_probe_single(dev, dev->id, p, sp);
         if (ret)
-                goto err_unreg;
+                return ret;
 
         sp->freq_transition.notifier_call = sci_notifier;
 
         ret = cpufreq_register_notifier(&sp->freq_transition,
                                         CPUFREQ_TRANSITION_NOTIFIER);
-        if (unlikely(ret < 0))
-                goto err_unreg;
+        if (unlikely(ret < 0)) {
+                sci_cleanup_single(sp);
+                return ret;
+        }
 
 #ifdef CONFIG_SH_STANDARD_BIOS
         sh_bios_gdb_detach();
 #endif
 
         return 0;
-
-err_unreg:
-        sci_remove(dev);
-        return ret;
 }
 
 static int sci_suspend(struct device *dev)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index f2a120eea9d4..36a2a0b7b82c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -567,6 +567,14 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
 
         usb_autopm_put_interface(acm->control);
 
+        /*
+         * Unthrottle device in case the TTY was closed while throttled.
+         */
+        spin_lock_irq(&acm->read_lock);
+        acm->throttled = 0;
+        acm->throttle_req = 0;
+        spin_unlock_irq(&acm->read_lock);
+
         if (acm_submit_read_urbs(acm, GFP_KERNEL))
                 goto error_submit_read_urbs;
 
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index ea8b304f0e85..8fd398dffced 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -55,6 +55,15 @@ static const struct usb_device_id wdm_ids[] = {
                 .bInterfaceSubClass = 1,
                 .bInterfaceProtocol = 9, /* NOTE: CDC ECM control interface! */
         },
+        {
+                 /* Vodafone/Huawei K5005 (12d1:14c8) and similar modems */
+                .match_flags        = USB_DEVICE_ID_MATCH_VENDOR |
+                                      USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = HUAWEI_VENDOR_ID,
+                .bInterfaceClass    = USB_CLASS_VENDOR_SPEC,
+                .bInterfaceSubClass = 1,
+                .bInterfaceProtocol = 57, /* NOTE: CDC ECM control interface! */
+        },
         { }
 };
 
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 57ed9e400c06..622b4a48e732 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -493,15 +493,6 @@ static int hcd_pci_suspend_noirq(struct device *dev)
 
         pci_save_state(pci_dev);
 
-        /*
-         * Some systems crash if an EHCI controller is in D3 during
-         * a sleep transition.  We have to leave such controllers in D0.
-         */
-        if (hcd->broken_pci_sleep) {
-                dev_dbg(dev, "Staying in PCI D0\n");
-                return retval;
-        }
-
         /* If the root hub is dead rather than suspended, disallow remote
          * wakeup.  usb_hc_died() should ensure that both hosts are marked as
          * dying, so we only need to check the primary roothub.
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 04fb834c3fa1..25a7422ee657 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3379,7 +3379,7 @@ int usb_disable_lpm(struct usb_device *udev)
                 return 0;
 
         udev->lpm_disable_count++;
-        if ((udev->u1_params.timeout == 0 && udev->u1_params.timeout == 0))
+        if ((udev->u1_params.timeout == 0 && udev->u2_params.timeout == 0))
                 return 0;
 
         /* If LPM is enabled, attempt to disable it. */
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index b548cf1dbc62..bdd1c6749d88 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1838,7 +1838,6 @@ free_interfaces:
                 intfc = cp->intf_cache[i];
                 intf->altsetting = intfc->altsetting;
                 intf->num_altsetting = intfc->num_altsetting;
-                intf->intf_assoc = find_iad(dev, cp, i);
                 kref_get(&intfc->ref);
 
                 alt = usb_altnum_to_altsetting(intf, 0);
@@ -1851,6 +1850,8 @@ free_interfaces:
                 if (!alt)
                         alt = &intf->altsetting[0];
 
+                intf->intf_assoc =
+                        find_iad(dev, cp, alt->desc.bInterfaceNumber);
                 intf->cur_altsetting = alt;
                 usb_enable_interface(dev, intf, true);
                 intf->dev.parent = &dev->dev;
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index e23bf7984aaf..9a9bced813ed 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -599,12 +599,6 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 
         spin_lock_irqsave(&ep->udc->lock, flags);
 
-        if (ep->ep.desc) {
-                spin_unlock_irqrestore(&ep->udc->lock, flags);
-                DBG(DBG_ERR, "ep%d already enabled\n", ep->index);
-                return -EBUSY;
-        }
-
         ep->ep.desc = desc;
         ep->ep.maxpacket = maxpacket;
 
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index 51881f3bd07a..b09452d6f33a 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -1596,7 +1596,7 @@ static int qe_ep_enable(struct usb_ep *_ep,
         ep = container_of(_ep, struct qe_ep, ep);
 
         /* catch various bogus parameters */
-        if (!_ep || !desc || ep->ep.desc || _ep->name == ep_name[0] ||
+        if (!_ep || !desc || _ep->name == ep_name[0] ||
                         (desc->bDescriptorType != USB_DT_ENDPOINT))
                 return -EINVAL;
 
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index 28316858208b..bc6f9bb9994a 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -567,7 +567,7 @@ static int fsl_ep_enable(struct usb_ep *_ep,
         ep = container_of(_ep, struct fsl_ep, ep);
 
         /* catch various bogus parameters */
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || (desc->bDescriptorType != USB_DT_ENDPOINT))
                 return -EINVAL;
 
@@ -2575,7 +2575,7 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
         /* for ep0: the desc defined here;
          * for other eps, gadget layer called ep_enable with defined desc
          */
-        udc_controller->eps[0].desc = &fsl_ep0_desc;
+        udc_controller->eps[0].ep.desc = &fsl_ep0_desc;
         udc_controller->eps[0].ep.maxpacket = USB_MAX_CTRL_PAYLOAD;
 
         /* setup the udc->eps[] for non-control endpoints and link
diff --git a/drivers/usb/gadget/fsl_usb2_udc.h b/drivers/usb/gadget/fsl_usb2_udc.h
index 5cd7b7e7ddb4..f61a967f7082 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.h
+++ b/drivers/usb/gadget/fsl_usb2_udc.h
@@ -568,10 +568,10 @@ static void dump_msg(const char *label, const u8 * buf, unsigned int length)
 /*
  * ### internal used help routines.
  */
-#define ep_index(EP)            ((EP)->desc->bEndpointAddress&0xF)
+#define ep_index(EP)            ((EP)->ep.desc->bEndpointAddress&0xF)
 #define ep_maxpacket(EP)        ((EP)->ep.maxpacket)
 #define ep_is_in(EP)    ( (ep_index(EP) == 0) ? (EP->udc->ep0_dir == \
-                        USB_DIR_IN ):((EP)->desc->bEndpointAddress \
+                        USB_DIR_IN) : ((EP)->ep.desc->bEndpointAddress \
                         & USB_DIR_IN)==USB_DIR_IN)
 #define get_ep_by_pipe(udc, pipe)       ((pipe == 1)? &udc->eps[0]: \
                                         &udc->eps[pipe])
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index b241e6c6a7f2..3d28fb976c78 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -102,7 +102,7 @@ goku_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
         unsigned long   flags;
 
         ep = container_of(_ep, struct goku_ep, ep);
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || desc->bDescriptorType != USB_DT_ENDPOINT)
                 return -EINVAL;
         dev = ep->dev;
diff --git a/drivers/usb/gadget/mv_udc_core.c b/drivers/usb/gadget/mv_udc_core.c
index dbcd1329495e..117a4bba1b8c 100644
--- a/drivers/usb/gadget/mv_udc_core.c
+++ b/drivers/usb/gadget/mv_udc_core.c
@@ -464,7 +464,7 @@ static int mv_ep_enable(struct usb_ep *_ep,
         ep = container_of(_ep, struct mv_ep, ep);
         udc = ep->udc;
 
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || desc->bDescriptorType != USB_DT_ENDPOINT)
                 return -EINVAL;
 
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 7ba32469c5bd..a460e8c204f4 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -153,7 +153,7 @@ static int omap_ep_enable(struct usb_ep *_ep,
         u16             maxp;
 
         /* catch various bogus parameters */
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || desc->bDescriptorType != USB_DT_ENDPOINT
                         || ep->bEndpointAddress != desc->bEndpointAddress
                         || ep->maxpacket < usb_endpoint_maxp(desc)) {
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index d7c8cb3bf759..f7ff9e8e746a 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -218,7 +218,7 @@ static int pxa25x_ep_enable (struct usb_ep *_ep,
         struct pxa25x_udc       *dev;
 
         ep = container_of (_ep, struct pxa25x_ep, ep);
-        if (!_ep || !desc || ep->ep.desc || _ep->name == ep0name
+        if (!_ep || !desc || _ep->name == ep0name
                         || desc->bDescriptorType != USB_DT_ENDPOINT
                         || ep->bEndpointAddress != desc->bEndpointAddress
                         || ep->fifo_size < usb_endpoint_maxp (desc)) {
diff --git a/drivers/usb/gadget/s3c-hsudc.c b/drivers/usb/gadget/s3c-hsudc.c
index 36c6836eeb0f..236b271871a0 100644
--- a/drivers/usb/gadget/s3c-hsudc.c
+++ b/drivers/usb/gadget/s3c-hsudc.c
@@ -760,7 +760,7 @@ static int s3c_hsudc_ep_enable(struct usb_ep *_ep,
         u32 ecr = 0;
 
         hsep = our_ep(_ep);
-        if (!_ep || !desc || hsep->ep.desc || _ep->name == ep0name
+        if (!_ep || !desc || _ep->name == ep0name
                 || desc->bDescriptorType != USB_DT_ENDPOINT
                 || hsep->bEndpointAddress != desc->bEndpointAddress
                 || ep_maxpacket(hsep) < usb_endpoint_maxp(desc))
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index 3de71d37d75e..f2e51f50e528 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1062,7 +1062,7 @@ static int s3c2410_udc_ep_enable(struct usb_ep *_ep,
 
         ep = to_s3c2410_ep(_ep);
 
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || _ep->name == ep0name
                         || desc->bDescriptorType != USB_DT_ENDPOINT)
                 return -EINVAL;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index b100f5f9f4b6..800be38c78b4 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -671,7 +671,9 @@ static int ehci_init(struct usb_hcd *hcd)
         hw = ehci->async->hw;
         hw->hw_next = QH_NEXT(ehci, ehci->async->qh_dma);
         hw->hw_info1 = cpu_to_hc32(ehci, QH_HEAD);
+#if defined(CONFIG_PPC_PS3)
         hw->hw_info1 |= cpu_to_hc32(ehci, (1 << 7));    /* I = 1 */
+#endif
         hw->hw_token = cpu_to_hc32(ehci, QTD_STS_HALT);
         hw->hw_qtd_next = EHCI_LIST_END(ehci);
         ehci->async->qh_state = QH_STATE_LINKED;
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index a44294d13494..17cfb8a1131c 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -43,6 +43,7 @@
 #include <linux/regulator/consumer.h>
 #include <linux/pm_runtime.h>
 #include <linux/gpio.h>
+#include <linux/clk.h>
 
 /* EHCI Register Set */
 #define EHCI_INSNREG04                                  (0xA0)
@@ -55,6 +56,15 @@
 #define EHCI_INSNREG05_ULPI_EXTREGADD_SHIFT             8
 #define EHCI_INSNREG05_ULPI_WRDATA_SHIFT                0
 
+/* Errata i693 */
+static struct clk       *utmi_p1_fck;
+static struct clk       *utmi_p2_fck;
+static struct clk       *xclk60mhsp1_ck;
+static struct clk       *xclk60mhsp2_ck;
+static struct clk       *usbhost_p1_fck;
+static struct clk       *usbhost_p2_fck;
+static struct clk       *init_60m_fclk;
+
 /*-------------------------------------------------------------------------*/
 
 static const struct hc_driver ehci_omap_hc_driver;
@@ -70,6 +80,41 @@ static inline u32 ehci_read(void __iomem *base, u32 reg)
         return __raw_readl(base + reg);
 }
 
+/* Erratum i693 workaround sequence */
+static void omap_ehci_erratum_i693(struct ehci_hcd *ehci)
+{
+        int ret = 0;
+
+        /* Switch to the internal 60 MHz clock */
+        ret = clk_set_parent(utmi_p1_fck, init_60m_fclk);
+        if (ret != 0)
+                ehci_err(ehci, "init_60m_fclk set parent"
+                        "failed error:%d\n", ret);
+
+        ret = clk_set_parent(utmi_p2_fck, init_60m_fclk);
+        if (ret != 0)
+                ehci_err(ehci, "init_60m_fclk set parent"
+                        "failed error:%d\n", ret);
+
+        clk_enable(usbhost_p1_fck);
+        clk_enable(usbhost_p2_fck);
+
+        /* Wait 1ms and switch back to the external clock */
+        mdelay(1);
+        ret = clk_set_parent(utmi_p1_fck, xclk60mhsp1_ck);
+        if (ret != 0)
+                ehci_err(ehci, "xclk60mhsp1_ck set parent"
+                        "failed error:%d\n", ret);
+
+        ret = clk_set_parent(utmi_p2_fck, xclk60mhsp2_ck);
+        if (ret != 0)
+                ehci_err(ehci, "xclk60mhsp2_ck set parent"
+                        "failed error:%d\n", ret);
+
+        clk_disable(usbhost_p1_fck);
+        clk_disable(usbhost_p2_fck);
+}
+
 static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
 {
         struct usb_hcd  *hcd = dev_get_drvdata(&pdev->dev);
@@ -100,6 +145,50 @@ static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
         }
 }
 
+static int omap_ehci_hub_control(
+        struct usb_hcd  *hcd,
+        u16             typeReq,
+        u16             wValue,
+        u16             wIndex,
+        char            *buf,
+        u16             wLength
+)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        u32 __iomem *status_reg = &ehci->regs->port_status[
+                                (wIndex & 0xff) - 1];
+        u32             temp;
+        unsigned long   flags;
+        int             retval = 0;
+
+        spin_lock_irqsave(&ehci->lock, flags);
+
+        if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
+                temp = ehci_readl(ehci, status_reg);
+                if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
+                        retval = -EPIPE;
+                        goto done;
+                }
+
+                temp &= ~PORT_WKCONN_E;
+                temp |= PORT_WKDISC_E | PORT_WKOC_E;
+                ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
+
+                omap_ehci_erratum_i693(ehci);
+
+                set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
+                goto done;
+        }
+
+        spin_unlock_irqrestore(&ehci->lock, flags);
+
+        /* Handle the hub control events here */
+        return ehci_hub_control(hcd, typeReq, wValue, wIndex, buf, wLength);
+done:
+        spin_unlock_irqrestore(&ehci->lock, flags);
+        return retval;
+}
+
 static void disable_put_regulator(
                 struct ehci_hcd_omap_platform_data *pdata)
 {
@@ -264,8 +353,76 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
         /* root ports should always stay powered */
         ehci_port_power(omap_ehci, 1);
 
+        /* get clocks */
+        utmi_p1_fck = clk_get(dev, "utmi_p1_gfclk");
+        if (IS_ERR(utmi_p1_fck)) {
+                ret = PTR_ERR(utmi_p1_fck);
+                dev_err(dev, "utmi_p1_gfclk failed error:%d\n", ret);
+                goto err_add_hcd;
+        }
+
+        xclk60mhsp1_ck = clk_get(dev, "xclk60mhsp1_ck");
+        if (IS_ERR(xclk60mhsp1_ck)) {
+                ret = PTR_ERR(xclk60mhsp1_ck);
+                dev_err(dev, "xclk60mhsp1_ck failed error:%d\n", ret);
+                goto err_utmi_p1_fck;
+        }
+
+        utmi_p2_fck = clk_get(dev, "utmi_p2_gfclk");
+        if (IS_ERR(utmi_p2_fck)) {
+                ret = PTR_ERR(utmi_p2_fck);
+                dev_err(dev, "utmi_p2_gfclk failed error:%d\n", ret);
+                goto err_xclk60mhsp1_ck;
+        }
+
+        xclk60mhsp2_ck = clk_get(dev, "xclk60mhsp2_ck");
+        if (IS_ERR(xclk60mhsp2_ck)) {
+                ret = PTR_ERR(xclk60mhsp2_ck);
+                dev_err(dev, "xclk60mhsp2_ck failed error:%d\n", ret);
+                goto err_utmi_p2_fck;
+        }
+
+        usbhost_p1_fck = clk_get(dev, "usb_host_hs_utmi_p1_clk");
+        if (IS_ERR(usbhost_p1_fck)) {
+                ret = PTR_ERR(usbhost_p1_fck);
+                dev_err(dev, "usbhost_p1_fck failed error:%d\n", ret);
+                goto err_xclk60mhsp2_ck;
+        }
+
+        usbhost_p2_fck = clk_get(dev, "usb_host_hs_utmi_p2_clk");
+        if (IS_ERR(usbhost_p2_fck)) {
+                ret = PTR_ERR(usbhost_p2_fck);
+                dev_err(dev, "usbhost_p2_fck failed error:%d\n", ret);
+                goto err_usbhost_p1_fck;
+        }
+
+        init_60m_fclk = clk_get(dev, "init_60m_fclk");
+        if (IS_ERR(init_60m_fclk)) {
+                ret = PTR_ERR(init_60m_fclk);
+                dev_err(dev, "init_60m_fclk failed error:%d\n", ret);
+                goto err_usbhost_p2_fck;
+        }
+
         return 0;
 
+err_usbhost_p2_fck:
+        clk_put(usbhost_p2_fck);
+
+err_usbhost_p1_fck:
+        clk_put(usbhost_p1_fck);
+
+err_xclk60mhsp2_ck:
+        clk_put(xclk60mhsp2_ck);
+
+err_utmi_p2_fck:
+        clk_put(utmi_p2_fck);
+
+err_xclk60mhsp1_ck:
+        clk_put(xclk60mhsp1_ck);
+
+err_utmi_p1_fck:
+        clk_put(utmi_p1_fck);
+
 err_add_hcd:
         disable_put_regulator(pdata);
         pm_runtime_put_sync(dev);
@@ -294,6 +451,15 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
         disable_put_regulator(dev->platform_data);
         iounmap(hcd->regs);
         usb_put_hcd(hcd);
+
+        clk_put(utmi_p1_fck);
+        clk_put(utmi_p2_fck);
+        clk_put(xclk60mhsp1_ck);
+        clk_put(xclk60mhsp2_ck);
+        clk_put(usbhost_p1_fck);
+        clk_put(usbhost_p2_fck);
+        clk_put(init_60m_fclk);
+
         pm_runtime_put_sync(dev);
         pm_runtime_disable(dev);
 
@@ -364,7 +530,7 @@ static const struct hc_driver ehci_omap_hc_driver = {
          * root hub support
          */
         .hub_status_data        = ehci_hub_status_data,
-        .hub_control            = ehci_hub_control,
+        .hub_control            = omap_ehci_hub_control,
         .bus_suspend            = ehci_bus_suspend,
         .bus_resume             = ehci_bus_resume,
 
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index bc94d7bf072d..123481793a47 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -144,14 +144,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         hcd->has_tt = 1;
                         tdi_reset(ehci);
                 }
-                if (pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK) {
-                        /* EHCI #1 or #2 on 6 Series/C200 Series chipset */
-                        if (pdev->device == 0x1c26 || pdev->device == 0x1c2d) {
-                                ehci_info(ehci, "broken D3 during system sleep on ASUS\n");
-                                hcd->broken_pci_sleep = 1;
-                                device_set_wakeup_capable(&pdev->dev, false);
-                        }
-                }
                 break;
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
diff --git a/drivers/usb/host/ehci-sh.c b/drivers/usb/host/ehci-sh.c
index ca819cdd0c5e..e7cb3925abf8 100644
--- a/drivers/usb/host/ehci-sh.c
+++ b/drivers/usb/host/ehci-sh.c
@@ -126,8 +126,7 @@ static int ehci_hcd_sh_probe(struct platform_device *pdev)
                 goto fail_create_hcd;
         }
 
-        if (pdev->dev.platform_data != NULL)
-                pdata = pdev->dev.platform_data;
+        pdata = pdev->dev.platform_data;
 
         /* initialize hcd */
         hcd = usb_create_hcd(&ehci_sh_hc_driver, &pdev->dev,
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
index 9c2cc4633894..e9713d589e30 100644
--- a/drivers/usb/host/ehci-xilinx-of.c
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -270,14 +270,12 @@ static int ehci_hcd_xilinx_of_remove(struct platform_device *op)
  *
  * Properly shutdown the hcd, call driver's shutdown routine.
  */
-static int ehci_hcd_xilinx_of_shutdown(struct platform_device *op)
+static void ehci_hcd_xilinx_of_shutdown(struct platform_device *op)
 {
         struct usb_hcd *hcd = dev_get_drvdata(&op->dev);
 
         if (hcd->driver->shutdown)
                 hcd->driver->shutdown(hcd);
-
-        return 0;
 }
 
 
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 836772dfabd3..2f3619eefefa 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -317,7 +317,7 @@ static int ohci_bus_resume (struct usb_hcd *hcd)
 }
 
 /* Carry out the final steps of resuming the controller device */
-static void ohci_finish_controller_resume(struct usb_hcd *hcd)
+static void __maybe_unused ohci_finish_controller_resume(struct usb_hcd *hcd)
 {
         struct ohci_hcd         *ohci = hcd_to_ohci(hcd);
         int                     port;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index ec4338eec826..77689bd64cac 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -793,10 +793,9 @@ static void xhci_free_tt_info(struct xhci_hcd *xhci,
                 struct xhci_virt_device *virt_dev,
                 int slot_id)
 {
-        struct list_head *tt;
         struct list_head *tt_list_head;
-        struct list_head *tt_next;
-        struct xhci_tt_bw_info *tt_info;
+        struct xhci_tt_bw_info *tt_info, *next;
+        bool slot_found = false;
 
         /* If the device never made it past the Set Address stage,
          * it may not have the real_port set correctly.
@@ -808,34 +807,16 @@ static void xhci_free_tt_info(struct xhci_hcd *xhci,
         }
 
         tt_list_head = &(xhci->rh_bw[virt_dev->real_port - 1].tts);
-        if (list_empty(tt_list_head))
-                return;
-
-        list_for_each(tt, tt_list_head) {
-                tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
-                if (tt_info->slot_id == slot_id)
+        list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
+                /* Multi-TT hubs will have more than one entry */
+                if (tt_info->slot_id == slot_id) {
+                        slot_found = true;
+                        list_del(&tt_info->tt_list);
+                        kfree(tt_info);
+                } else if (slot_found) {
                         break;
+                }
         }
-        /* Cautionary measure in case the hub was disconnected before we
-         * stored the TT information.
-         */
-        if (tt_info->slot_id != slot_id)
-                return;
-
-        tt_next = tt->next;
-        tt_info = list_entry(tt, struct xhci_tt_bw_info,
-                        tt_list);
-        /* Multi-TT hubs will have more than one entry */
-        do {
-                list_del(tt);
-                kfree(tt_info);
-                tt = tt_next;
-                if (list_empty(tt_list_head))
-                        break;
-                tt_next = tt->next;
-                tt_info = list_entry(tt, struct xhci_tt_bw_info,
-                                tt_list);
-        } while (tt_info->slot_id == slot_id);
 }
 
 int xhci_alloc_tt_info(struct xhci_hcd *xhci,
@@ -1791,17 +1772,9 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
 {
         struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
         struct dev_info *dev_info, *next;
-        struct list_head *tt_list_head;
-        struct list_head *tt;
-        struct list_head *endpoints;
-        struct list_head *ep, *q;
-        struct xhci_tt_bw_info *tt_info;
-        struct xhci_interval_bw_table *bwt;
-        struct xhci_virt_ep *virt_ep;
-
         unsigned long   flags;
         int size;
-        int i;
+        int i, j, num_ports;
 
         /* Free the Event Ring Segment Table and the actual Event Ring */
         size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
@@ -1860,21 +1833,22 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         }
         spin_unlock_irqrestore(&xhci->lock, flags);
 
-        bwt = &xhci->rh_bw->bw_table;
-        for (i = 0; i < XHCI_MAX_INTERVAL; i++) {
-                endpoints = &bwt->interval_bw[i].endpoints;
-                list_for_each_safe(ep, q, endpoints) {
-                        virt_ep = list_entry(ep, struct xhci_virt_ep, bw_endpoint_list);
-                        list_del(&virt_ep->bw_endpoint_list);
-                        kfree(virt_ep);
+        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+        for (i = 0; i < num_ports; i++) {
+                struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+                for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+                        struct list_head *ep = &bwt->interval_bw[j].endpoints;
+                        while (!list_empty(ep))
+                                list_del_init(ep->next);
                 }
         }
 
-        tt_list_head = &xhci->rh_bw->tts;
-        list_for_each_safe(tt, q, tt_list_head) {
-                tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
-                list_del(tt);
-                kfree(tt_info);
+        for (i = 0; i < num_ports; i++) {
+                struct xhci_tt_bw_info *tt, *n;
+                list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) {
+                        list_del(&tt->tt_list);
+                        kfree(tt);
+                }
         }
 
         xhci->num_usb2_ports = 0;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index afdc73ee84a6..a979cd0dbe0f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -795,8 +795,8 @@ int xhci_suspend(struct xhci_hcd *xhci)
         command = xhci_readl(xhci, &xhci->op_regs->command);
         command |= CMD_CSS;
         xhci_writel(xhci, command, &xhci->op_regs->command);
-        if (handshake(xhci, &xhci->op_regs->status, STS_SAVE, 0, 10*100)) {
-                xhci_warn(xhci, "WARN: xHC CMD_CSS timeout\n");
+        if (handshake(xhci, &xhci->op_regs->status, STS_SAVE, 0, 10 * 1000)) {
+                xhci_warn(xhci, "WARN: xHC save state timeout\n");
                 spin_unlock_irq(&xhci->lock);
                 return -ETIMEDOUT;
         }
@@ -848,8 +848,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 command |= CMD_CRS;
                 xhci_writel(xhci, command, &xhci->op_regs->command);
                 if (handshake(xhci, &xhci->op_regs->status,
-                              STS_RESTORE, 0, 10*100)) {
-                        xhci_dbg(xhci, "WARN: xHC CMD_CSS timeout\n");
+                              STS_RESTORE, 0, 10 * 1000)) {
+                        xhci_warn(xhci, "WARN: xHC restore state timeout\n");
                         spin_unlock_irq(&xhci->lock);
                         return -ETIMEDOUT;
                 }
@@ -3906,7 +3906,7 @@ static u16 xhci_get_timeout_no_hub_lpm(struct usb_device *udev,
         default:
                 dev_warn(&udev->dev, "%s: Can't get timeout for non-U1 or U2 state.\n",
                                 __func__);
-                return -EINVAL;
+                return USB3_LPM_DISABLED;
         }
 
         if (sel <= max_sel_pel && pel <= max_sel_pel)
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 768b4b55c816..9d63ba4d10d6 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -34,6 +34,7 @@
 #include <linux/dma-mapping.h>
 
 #include <mach/cputype.h>
+#include <mach/hardware.h>
 
 #include <asm/mach-types.h>
 
diff --git a/drivers/usb/musb/davinci.h b/drivers/usb/musb/davinci.h
index 046c84433cad..371baa0ee509 100644
--- a/drivers/usb/musb/davinci.h
+++ b/drivers/usb/musb/davinci.h
@@ -15,7 +15,7 @@
  */
 
 /* Integrated highspeed/otg PHY */
-#define USBPHY_CTL_PADDR        (DAVINCI_SYSTEM_MODULE_BASE + 0x34)
+#define USBPHY_CTL_PADDR        0x01c40034
 #define USBPHY_DATAPOL          BIT(11) /* (dm355) switch D+/D- */
 #define USBPHY_PHYCLKGD         BIT(8)
 #define USBPHY_SESNDEN          BIT(7)  /* v(sess_end) comparator */
@@ -27,7 +27,7 @@
 #define USBPHY_OTGPDWN          BIT(1)
 #define USBPHY_PHYPDWN          BIT(0)
 
-#define DM355_DEEPSLEEP_PADDR   (DAVINCI_SYSTEM_MODULE_BASE + 0x48)
+#define DM355_DEEPSLEEP_PADDR   0x01c40048
 #define DRVVBUS_FORCE           BIT(2)
 #define DRVVBUS_OVERRIDE        BIT(1)
 
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index f42c29b11f71..95918dacc99a 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1232,6 +1232,7 @@ static int musb_gadget_disable(struct usb_ep *ep)
         }
 
         musb_ep->desc = NULL;
+        musb_ep->end_point.desc = NULL;
 
         /* abort all pending DMA and requests */
         nuke(musb_ep, -ESHUTDOWN);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 1b1926200ba7..73d25cd8cba5 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -82,6 +82,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
         { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
         { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
+        { USB_DEVICE(0x10C4, 0x80C4) }, /* Cygnal Integrated Products, Inc., Optris infrared thermometer */
         { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */
         { USB_DEVICE(0x10C4, 0x80DD) }, /* Tracient RFID */
         { USB_DEVICE(0x10C4, 0x80F6) }, /* Suunto sports instrument */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8c084ea34e26..bc912e5a3beb 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -737,6 +737,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
         { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
         { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
         { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index f3c7c78ede33..5661c7e2d415 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -784,6 +784,7 @@
 #define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
 #define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
 #define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
+#define RTSYSTEMS_RTS01_PID             0x9e57  /* USB-RTS01 Radio Cable */
 
 
 /*
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 105a6d898ca4..9b026bf7afef 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -39,13 +39,6 @@ MODULE_PARM_DESC(product, "User specified USB idProduct");
 
 static struct usb_device_id generic_device_ids[2]; /* Initially all zeroes. */
 
-/* we want to look at all devices, as the vendor/product id can change
- * depending on the command line argument */
-static const struct usb_device_id generic_serial_ids[] = {
-        {.driver_info = 42},
-        {}
-};
-
 /* All of the device info needed for the Generic Serial Converter */
 struct usb_serial_driver usb_serial_generic_device = {
         .driver = {
@@ -79,7 +72,8 @@ int usb_serial_generic_register(int _debug)
                 USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_PRODUCT;
 
         /* register our generic driver with ourselves */
-        retval = usb_serial_register_drivers(serial_drivers, "usbserial_generic", generic_serial_ids);
+        retval = usb_serial_register_drivers(serial_drivers,
+                        "usbserial_generic", generic_device_ids);
 #endif
         return retval;
 }
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index d0ec1aa52719..a71fa0aa0406 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -309,13 +309,16 @@ static int mct_u232_set_modem_ctrl(struct usb_serial *serial,
                         MCT_U232_SET_REQUEST_TYPE,
                         0, 0, buf, MCT_U232_SET_MODEM_CTRL_SIZE,
                         WDR_TIMEOUT);
-        if (rc < 0)
-                dev_err(&serial->dev->dev,
-                        "Set MODEM CTRL 0x%x failed (error = %d)\n", mcr, rc);
+        kfree(buf);
+
         dbg("set_modem_ctrl: state=0x%x ==> mcr=0x%x", control_state, mcr);
 
-        kfree(buf);
-        return rc;
+        if (rc < 0) {
+                dev_err(&serial->dev->dev,
+                        "Set MODEM CTRL 0x%x failed (error = %d)\n", mcr, rc);
+                return rc;
+        }
+        return 0;
 } /* mct_u232_set_modem_ctrl */
 
 static int mct_u232_get_modem_stat(struct usb_serial *serial,
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 29160f8b5101..57eca2448424 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -190,7 +190,7 @@
 
 static int device_type;
 
-static const struct usb_device_id id_table[] __devinitconst = {
+static const struct usb_device_id id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7810)},
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 1aae9028cd0b..e668a2460bd4 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -47,6 +47,7 @@
 /* Function prototypes */
 static int  option_probe(struct usb_serial *serial,
                         const struct usb_device_id *id);
+static void option_release(struct usb_serial *serial);
 static int option_send_setup(struct usb_serial_port *port);
 static void option_instat_callback(struct urb *urb);
 
@@ -150,6 +151,7 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_E14AC                    0x14AC
 #define HUAWEI_PRODUCT_K3806                    0x14AE
 #define HUAWEI_PRODUCT_K4605                    0x14C6
+#define HUAWEI_PRODUCT_K5005                    0x14C8
 #define HUAWEI_PRODUCT_K3770                    0x14C9
 #define HUAWEI_PRODUCT_K3771                    0x14CA
 #define HUAWEI_PRODUCT_K4510                    0x14CB
@@ -425,7 +427,7 @@ static void option_instat_callback(struct urb *urb);
 #define SAMSUNG_VENDOR_ID                       0x04e8
 #define SAMSUNG_PRODUCT_GT_B3730                0x6889
 
-/* YUGA products  www.yuga-info.com*/
+/* YUGA products  www.yuga-info.com gavin.kx@qq.com */
 #define YUGA_VENDOR_ID                          0x257A
 #define YUGA_PRODUCT_CEM600                     0x1601
 #define YUGA_PRODUCT_CEM610                     0x1602
@@ -442,6 +444,8 @@ static void option_instat_callback(struct urb *urb);
 #define YUGA_PRODUCT_CEU516                     0x160C
 #define YUGA_PRODUCT_CEU528                     0x160D
 #define YUGA_PRODUCT_CEU526                     0x160F
+#define YUGA_PRODUCT_CEU881                     0x161F
+#define YUGA_PRODUCT_CEU882                     0x162F
 
 #define YUGA_PRODUCT_CWM600                     0x2601
 #define YUGA_PRODUCT_CWM610                     0x2602
@@ -457,23 +461,26 @@ static void option_instat_callback(struct urb *urb);
 #define YUGA_PRODUCT_CWU518                     0x260B
 #define YUGA_PRODUCT_CWU516                     0x260C
 #define YUGA_PRODUCT_CWU528                     0x260D
+#define YUGA_PRODUCT_CWU581                     0x260E
 #define YUGA_PRODUCT_CWU526                     0x260F
-
-#define YUGA_PRODUCT_CLM600                     0x2601
-#define YUGA_PRODUCT_CLM610                     0x2602
-#define YUGA_PRODUCT_CLM500                     0x2603
-#define YUGA_PRODUCT_CLM510                     0x2604
-#define YUGA_PRODUCT_CLM800                     0x2605
-#define YUGA_PRODUCT_CLM900                     0x2606
-
-#define YUGA_PRODUCT_CLU718                     0x2607
-#define YUGA_PRODUCT_CLU716                     0x2608
-#define YUGA_PRODUCT_CLU728                     0x2609
-#define YUGA_PRODUCT_CLU726                     0x260A
-#define YUGA_PRODUCT_CLU518                     0x260B
-#define YUGA_PRODUCT_CLU516                     0x260C
-#define YUGA_PRODUCT_CLU528                     0x260D
-#define YUGA_PRODUCT_CLU526                     0x260F
+#define YUGA_PRODUCT_CWU582                     0x261F
+#define YUGA_PRODUCT_CWU583                     0x262F
+
+#define YUGA_PRODUCT_CLM600                     0x3601
+#define YUGA_PRODUCT_CLM610                     0x3602
+#define YUGA_PRODUCT_CLM500                     0x3603
+#define YUGA_PRODUCT_CLM510                     0x3604
+#define YUGA_PRODUCT_CLM800                     0x3605
+#define YUGA_PRODUCT_CLM900                     0x3606
+
+#define YUGA_PRODUCT_CLU718                     0x3607
+#define YUGA_PRODUCT_CLU716                     0x3608
+#define YUGA_PRODUCT_CLU728                     0x3609
+#define YUGA_PRODUCT_CLU726                     0x360A
+#define YUGA_PRODUCT_CLU518                     0x360B
+#define YUGA_PRODUCT_CLU516                     0x360C
+#define YUGA_PRODUCT_CLU528                     0x360D
+#define YUGA_PRODUCT_CLU526                     0x360F
 
 /* Viettel products */
 #define VIETTEL_VENDOR_ID                       0x2262
@@ -666,6 +673,11 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x33) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
@@ -1209,6 +1221,11 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU516) },
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU881) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU882) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU581) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU582) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU583) },
         { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
         { USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */
@@ -1245,7 +1262,7 @@ static struct usb_serial_driver option_1port_device = {
         .ioctl             = usb_wwan_ioctl,
         .attach            = usb_wwan_startup,
         .disconnect        = usb_wwan_disconnect,
-        .release           = usb_wwan_release,
+        .release           = option_release,
         .read_int_callback = option_instat_callback,
 #ifdef CONFIG_PM
         .suspend           = usb_wwan_suspend,
@@ -1259,35 +1276,6 @@ static struct usb_serial_driver * const serial_drivers[] = {
 
 static bool debug;
 
-/* per port private data */
-
-#define N_IN_URB 4
-#define N_OUT_URB 4
-#define IN_BUFLEN 4096
-#define OUT_BUFLEN 4096
-
-struct option_port_private {
-        /* Input endpoints and buffer for this port */
-        struct urb *in_urbs[N_IN_URB];
-        u8 *in_buffer[N_IN_URB];
-        /* Output endpoints and buffer for this port */
-        struct urb *out_urbs[N_OUT_URB];
-        u8 *out_buffer[N_OUT_URB];
-        unsigned long out_busy;         /* Bit vector of URBs in use */
-        int opened;
-        struct usb_anchor delayed;
-
-        /* Settings for the port */
-        int rts_state;  /* Handshaking pins (outputs) */
-        int dtr_state;
-        int cts_state;  /* Handshaking pins (inputs) */
-        int dsr_state;
-        int dcd_state;
-        int ri_state;
-
-        unsigned long tx_start_time[N_OUT_URB];
-};
-
 module_usb_serial_driver(serial_drivers, option_ids);
 
 static bool is_blacklisted(const u8 ifnum, enum option_blacklist_reason reason,
@@ -1356,12 +1344,22 @@ static int option_probe(struct usb_serial *serial,
         return 0;
 }
 
+static void option_release(struct usb_serial *serial)
+{
+        struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
+
+        usb_wwan_release(serial);
+
+        kfree(priv);
+}
+
 static void option_instat_callback(struct urb *urb)
 {
         int err;
         int status = urb->status;
         struct usb_serial_port *port =  urb->context;
-        struct option_port_private *portdata = usb_get_serial_port_data(port);
+        struct usb_wwan_port_private *portdata =
+                                        usb_get_serial_port_data(port);
 
         dbg("%s: urb %p port %p has data %p", __func__, urb, port, portdata);
 
@@ -1421,7 +1419,7 @@ static int option_send_setup(struct usb_serial_port *port)
         struct usb_serial *serial = port->serial;
         struct usb_wwan_intf_private *intfdata =
                 (struct usb_wwan_intf_private *) serial->private;
-        struct option_port_private *portdata;
+        struct usb_wwan_port_private *portdata;
         int ifNum = serial->interface->cur_altsetting->desc.bInterfaceNumber;
         int val = 0;
 
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 0d5fe59ebb9e..996015c5f1ac 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -105,7 +105,13 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x1410, 0xa021)},   /* Novatel Gobi 3000 Composite */
         {USB_DEVICE(0x413c, 0x8193)},   /* Dell Gobi 3000 QDL */
         {USB_DEVICE(0x413c, 0x8194)},   /* Dell Gobi 3000 Composite */
+        {USB_DEVICE(0x1199, 0x9010)},   /* Sierra Wireless Gobi 3000 QDL */
+        {USB_DEVICE(0x1199, 0x9012)},   /* Sierra Wireless Gobi 3000 QDL */
         {USB_DEVICE(0x1199, 0x9013)},   /* Sierra Wireless Gobi 3000 Modem device (MC8355) */
+        {USB_DEVICE(0x1199, 0x9014)},   /* Sierra Wireless Gobi 3000 QDL */
+        {USB_DEVICE(0x1199, 0x9015)},   /* Sierra Wireless Gobi 3000 Modem device */
+        {USB_DEVICE(0x1199, 0x9018)},   /* Sierra Wireless Gobi 3000 QDL */
+        {USB_DEVICE(0x1199, 0x9019)},   /* Sierra Wireless Gobi 3000 Modem device */
         {USB_DEVICE(0x12D1, 0x14F0)},   /* Sony Gobi 3000 QDL */
         {USB_DEVICE(0x12D1, 0x14F1)},   /* Sony Gobi 3000 Composite */
         { }                             /* Terminating entry */
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index ba54a0a8235c..d423d36acc04 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -294,6 +294,10 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x1199, 0x68A3),   /* Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
+        /* AT&T Direct IP LTE modems */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
+          .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+        },
         { USB_DEVICE(0x0f3d, 0x68A3),   /* Airprime/Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 6a1b609a0d94..27483f91a4a3 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -659,12 +659,14 @@ exit:
 static struct usb_serial_driver *search_serial_device(
                                         struct usb_interface *iface)
 {
-        const struct usb_device_id *id;
+        const struct usb_device_id *id = NULL;
         struct usb_serial_driver *drv;
+        struct usb_driver *driver = to_usb_driver(iface->dev.driver);
 
         /* Check if the usb id matches a known device */
         list_for_each_entry(drv, &usb_serial_driver_list, driver_list) {
-                id = get_iface_id(drv, iface);
+                if (drv->usb_driver == driver)
+                        id = get_iface_id(drv, iface);
                 if (id)
                         return drv;
         }
@@ -755,7 +757,7 @@ static int usb_serial_probe(struct usb_interface *interface,
 
                 if (retval) {
                         dbg("sub driver rejected device");
-                        kfree(serial);
+                        usb_serial_put(serial);
                         module_put(type->driver.owner);
                         return retval;
                 }
@@ -827,7 +829,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                  */
                 if (num_bulk_in == 0 || num_bulk_out == 0) {
                         dev_info(&interface->dev, "PL-2303 hack: descriptors matched but endpoints did not\n");
-                        kfree(serial);
+                        usb_serial_put(serial);
                         module_put(type->driver.owner);
                         return -ENODEV;
                 }
@@ -841,7 +843,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                 if (num_ports == 0) {
                         dev_err(&interface->dev,
                             "Generic device with no bulk out, not allowed.\n");
-                        kfree(serial);
+                        usb_serial_put(serial);
                         module_put(type->driver.owner);
                         return -EIO;
                 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 1719886bb9be..caf22bf5f822 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1107,6 +1107,13 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9999,
                 USB_SC_RBC, USB_PR_BULK, NULL,
                 0 ),
 
+/* Feiya QDI U2 DISK, reported by Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV( 0x090c, 0x1000, 0x0000, 0xffff,
+                "Feiya",
+                "QDI U2 DISK",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_READ_CAPACITY_16 ),
+
 /* aeb */
 UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
                 "Feiya",
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index fa2b03750316..2979292650d6 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -88,7 +88,7 @@ config LCD_PLATFORM
 
 config LCD_TOSA
         tristate "Sharp SL-6000 LCD Driver"
-        depends on SPI && MACH_TOSA
+        depends on I2C && SPI && MACH_TOSA
         help
           If you have an Sharp SL-6000 Zaurus say Y to enable a driver
           for its LCD.
diff --git a/drivers/video/backlight/ili9320.c b/drivers/video/backlight/ili9320.c
index 6c9399341bcf..9327cd1b3143 100644
--- a/drivers/video/backlight/ili9320.c
+++ b/drivers/video/backlight/ili9320.c
@@ -263,7 +263,7 @@ int __devinit ili9320_probe_spi(struct spi_device *spi,
 
 EXPORT_SYMBOL_GPL(ili9320_probe_spi);
 
-int __devexit ili9320_remove(struct ili9320 *ili)
+int ili9320_remove(struct ili9320 *ili)
 {
         ili9320_power(ili, FB_BLANK_POWERDOWN);
 
diff --git a/drivers/video/bfin_adv7393fb.c b/drivers/video/bfin_adv7393fb.c
index 33ea874c87d2..9bdd4b0c18c8 100644
--- a/drivers/video/bfin_adv7393fb.c
+++ b/drivers/video/bfin_adv7393fb.c
@@ -353,18 +353,16 @@ adv7393_read_proc(char *page, char **start, off_t off,
 
 static int
 adv7393_write_proc(struct file *file, const char __user * buffer,
-                   unsigned long count, void *data)
+                   size_t count, void *data)
 {
         struct adv7393fb_device *fbdev = data;
-        char line[8];
         unsigned int val;
         int ret;
 
-        ret = copy_from_user(line, buffer, count);
+        ret = kstrtouint_from_user(buffer, count, 0, &val);
         if (ret)
                 return -EFAULT;
 
-        val = simple_strtoul(line, NULL, 0);
         adv7393_write(fbdev->client, val >> 8, val & 0xff);
 
         return count;
diff --git a/drivers/video/broadsheetfb.c b/drivers/video/broadsheetfb.c
index 377dde3d5bfc..c95b417d0d41 100644
--- a/drivers/video/broadsheetfb.c
+++ b/drivers/video/broadsheetfb.c
@@ -1211,7 +1211,7 @@ static int __devexit broadsheetfb_remove(struct platform_device *dev)
 
 static struct platform_driver broadsheetfb_driver = {
         .probe  = broadsheetfb_probe,
-        .remove = broadsheetfb_remove,
+        .remove = __devexit_p(broadsheetfb_remove),
         .driver = {
                 .owner  = THIS_MODULE,
                 .name   = "broadsheetfb",
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index c2d11fef114b..e2c96d01d8f5 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -224,5 +224,19 @@ config FONT_10x18
           big letters. It fits between the sun 12x22 and the normal 8x16 font.
           If other fonts are too big or too small for you, say Y, otherwise say N.
 
+config FONT_AUTOSELECT
+        def_bool y
+        depends on FRAMEBUFFER_CONSOLE || SGI_NEWPORT_CONSOLE || STI_CONSOLE || USB_SISUSBVGA_CON
+        depends on !FONT_8x8
+        depends on !FONT_6x11
+        depends on !FONT_7x14
+        depends on !FONT_PEARL_8x8
+        depends on !FONT_ACORN_8x8
+        depends on !FONT_MINI_4x6
+        depends on !FONT_SUN8x16
+        depends on !FONT_SUN12x22
+        depends on !FONT_10x18
+        select FONT_8x16
+
 endmenu
 
diff --git a/drivers/video/mbx/mbxfb.c b/drivers/video/mbx/mbxfb.c
index ab0a8e527333..85e4f44bfa61 100644
--- a/drivers/video/mbx/mbxfb.c
+++ b/drivers/video/mbx/mbxfb.c
@@ -1045,7 +1045,7 @@ static int __devexit mbxfb_remove(struct platform_device *dev)
 
 static struct platform_driver mbxfb_driver = {
         .probe = mbxfb_probe,
-        .remove = mbxfb_remove,
+        .remove = __devexit_p(mbxfb_remove),
         .suspend = mbxfb_suspend,
         .resume = mbxfb_resume,
         .driver = {
diff --git a/drivers/video/omap2/displays/panel-taal.c b/drivers/video/omap2/displays/panel-taal.c
index 2ce9992f403b..901576eb5a84 100644
--- a/drivers/video/omap2/displays/panel-taal.c
+++ b/drivers/video/omap2/displays/panel-taal.c
@@ -526,7 +526,7 @@ static ssize_t taal_num_errors_show(struct device *dev,
 {
         struct omap_dss_device *dssdev = to_dss_device(dev);
         struct taal_data *td = dev_get_drvdata(&dssdev->dev);
-        u8 errors;
+        u8 errors = 0;
         int r;
 
         mutex_lock(&td->lock);
diff --git a/drivers/video/omap2/dss/core.c b/drivers/video/omap2/dss/core.c
index 72ded9cd2cb0..5066eee10ccf 100644
--- a/drivers/video/omap2/dss/core.c
+++ b/drivers/video/omap2/dss/core.c
@@ -194,8 +194,7 @@ static inline int dss_initialize_debugfs(void)
 static inline void dss_uninitialize_debugfs(void)
 {
 }
-static inline int dss_debugfs_create_file(const char *name,
-                void (*write)(struct seq_file *))
+int dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *))
 {
         return 0;
 }
diff --git a/drivers/video/omap2/dss/dsi.c b/drivers/video/omap2/dss/dsi.c
index ec363d8390ed..ca8382d346e9 100644
--- a/drivers/video/omap2/dss/dsi.c
+++ b/drivers/video/omap2/dss/dsi.c
@@ -3724,7 +3724,7 @@ static int dsi_compute_interleave_lp(int blank, int enter_hs, int exit_hs,
         /* CLKIN4DDR = 16 * TXBYTECLKHS */
         tlp_avail = thsbyte_clk * (blank - trans_lp);
 
-        ttxclkesc = tdsi_fclk / lp_clk_div;
+        ttxclkesc = tdsi_fclk * lp_clk_div;
 
         lp_inter = ((tlp_avail - 8 * thsbyte_clk - 5 * tdsi_fclk) / ttxclkesc -
                         26) / 16;
diff --git a/drivers/video/omap2/dss/dss.c b/drivers/video/omap2/dss/dss.c
index 6ea1ff149f6f..770632359a17 100644
--- a/drivers/video/omap2/dss/dss.c
+++ b/drivers/video/omap2/dss/dss.c
@@ -731,7 +731,7 @@ static void dss_runtime_put(void)
         DSSDBG("dss_runtime_put\n");
 
         r = pm_runtime_put_sync(&dss.pdev->dev);
-        WARN_ON(r < 0);
+        WARN_ON(r < 0 && r != -EBUSY);
 }
 
 /* DEBUGFS */
diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index 5f9d8e69029e..ea7b661e7229 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -361,7 +361,7 @@ static int s3c_fb_calc_pixclk(struct s3c_fb *sfb, unsigned int pixclk)
         result = (unsigned int)tmp / 1000;
 
         dev_dbg(sfb->dev, "pixclk=%u, clk=%lu, div=%d (%lu)\n",
-                pixclk, clk, result, clk / result);
+                pixclk, clk, result, result ? clk / result : clk);
 
         return result;
 }
@@ -1348,8 +1348,14 @@ static void s3c_fb_clear_win(struct s3c_fb *sfb, int win)
         writel(0, regs + VIDOSD_A(win, sfb->variant));
         writel(0, regs + VIDOSD_B(win, sfb->variant));
         writel(0, regs + VIDOSD_C(win, sfb->variant));
-        reg = readl(regs + SHADOWCON);
-        writel(reg & ~SHADOWCON_WINx_PROTECT(win), regs + SHADOWCON);
+
+        if (sfb->variant.has_shadowcon) {
+                reg = readl(sfb->regs + SHADOWCON);
+                reg &= ~(SHADOWCON_WINx_PROTECT(win) |
+                        SHADOWCON_CHx_ENABLE(win) |
+                        SHADOWCON_CHx_LOCAL_ENABLE(win));
+                writel(reg, sfb->regs + SHADOWCON);
+        }
 }
 
 static int __devinit s3c_fb_probe(struct platform_device *pdev)
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index cee7803a0a1c..f3d3b9ce4751 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -1351,7 +1351,7 @@ static void savagefb_set_par_int(struct savagefb_par  *par, struct savage_reg *r
         /* following part not present in X11 driver */
         cr67 = vga_in8(0x3d5, par) & 0xf;
         vga_out8(0x3d5, 0x50 | cr67, par);
-        udelay(10000);
+        mdelay(10);
         vga_out8(0x3d4, 0x67, par);
         /* end of part */
         vga_out8(0x3d5, reg->CR67 & ~0x0c, par);
@@ -1904,11 +1904,11 @@ static int savage_init_hw(struct savagefb_par *par)
         vga_out8(0x3d4, 0x66, par);
         cr66 = vga_in8(0x3d5, par);
         vga_out8(0x3d5, cr66 | 0x02, par);
-        udelay(10000);
+        mdelay(10);
 
         vga_out8(0x3d4, 0x66, par);
         vga_out8(0x3d5, cr66 & ~0x02, par);     /* clear reset flag */
-        udelay(10000);
+        mdelay(10);
 
 
         /*
@@ -1918,11 +1918,11 @@ static int savage_init_hw(struct savagefb_par *par)
         vga_out8(0x3d4, 0x3f, par);
         cr3f = vga_in8(0x3d5, par);
         vga_out8(0x3d5, cr3f | 0x08, par);
-        udelay(10000);
+        mdelay(10);
 
         vga_out8(0x3d4, 0x3f, par);
         vga_out8(0x3d5, cr3f & ~0x08, par);     /* clear reset flags */
-        udelay(10000);
+        mdelay(10);
 
         /* Savage ramdac speeds */
         par->numClocks = 4;
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 6908e4ce2a0d..7595581d032c 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -827,6 +827,9 @@ int bind_evtchn_to_irq(unsigned int evtchn)
                                               handle_edge_irq, "event");
 
                 xen_irq_info_evtchn_init(irq, evtchn);
+        } else {
+                struct irq_info *info = info_for_irq(irq);
+                WARN_ON(info == NULL || info->type != IRQT_EVTCHN);
         }
 
 out:
@@ -862,6 +865,9 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
                 xen_irq_info_ipi_init(cpu, irq, evtchn, ipi);
 
                 bind_evtchn_to_cpu(evtchn, cpu);
+        } else {
+                struct irq_info *info = info_for_irq(irq);
+                WARN_ON(info == NULL || info->type != IRQT_IPI);
         }
 
  out:
@@ -939,6 +945,9 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
                 xen_irq_info_virq_init(cpu, irq, evtchn, virq);
 
                 bind_evtchn_to_cpu(evtchn, cpu);
+        } else {
+                struct irq_info *info = info_for_irq(irq);
+                WARN_ON(info == NULL || info->type != IRQT_VIRQ);
         }
 
 out:
diff --git a/drivers/xen/pci.c b/drivers/xen/pci.c
index b84bf0b6cc34..18fff88254eb 100644
--- a/drivers/xen/pci.c
+++ b/drivers/xen/pci.c
@@ -59,7 +59,7 @@ static int xen_add_device(struct device *dev)
 
 #ifdef CONFIG_ACPI
                 handle = DEVICE_ACPI_HANDLE(&pci_dev->dev);
-                if (!handle)
+                if (!handle && pci_dev->bus->bridge)
                         handle = DEVICE_ACPI_HANDLE(pci_dev->bus->bridge);
 #ifdef CONFIG_PCI_IOV
                 if (!handle && pci_dev->is_virtfn)
diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c
index dcb79521e6c8..89f264c67420 100644
--- a/drivers/xen/tmem.c
+++ b/drivers/xen/tmem.c
@@ -269,7 +269,7 @@ static inline struct tmem_oid oswiz(unsigned type, u32 ind)
 }
 
 /* returns 0 if the page was successfully put into frontswap, -1 if not */
-static int tmem_frontswap_put_page(unsigned type, pgoff_t offset,
+static int tmem_frontswap_store(unsigned type, pgoff_t offset,
                                    struct page *page)
 {
         u64 ind64 = (u64)offset;
@@ -295,7 +295,7 @@ static int tmem_frontswap_put_page(unsigned type, pgoff_t offset,
  * returns 0 if the page was successfully gotten from frontswap, -1 if
  * was not present (should never happen!)
  */
-static int tmem_frontswap_get_page(unsigned type, pgoff_t offset,
+static int tmem_frontswap_load(unsigned type, pgoff_t offset,
                                    struct page *page)
 {
         u64 ind64 = (u64)offset;
@@ -362,8 +362,8 @@ static int __init no_frontswap(char *s)
 __setup("nofrontswap", no_frontswap);
 
 static struct frontswap_ops __initdata tmem_frontswap_ops = {
-        .put_page = tmem_frontswap_put_page,
-        .get_page = tmem_frontswap_get_page,
+        .store = tmem_frontswap_store,
+        .load = tmem_frontswap_load,
         .invalidate_page = tmem_frontswap_flush_page,
         .invalidate_area = tmem_frontswap_flush_area,
         .init = tmem_frontswap_init
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 3f75895c919b..8f7d1237b7a0 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -179,7 +179,8 @@ static int __add_prelim_ref(struct list_head *head, u64 root_id,
 
 static int add_all_parents(struct btrfs_root *root, struct btrfs_path *path,
                                 struct ulist *parents, int level,
-                                struct btrfs_key *key, u64 wanted_disk_byte,
+                                struct btrfs_key *key, u64 time_seq,
+                                u64 wanted_disk_byte,
                                 const u64 *extent_item_pos)
 {
         int ret;
@@ -212,7 +213,7 @@ add_parent:
          */
         while (1) {
                 eie = NULL;
-                ret = btrfs_next_leaf(root, path);
+                ret = btrfs_next_old_leaf(root, path, time_seq);
                 if (ret < 0)
                         return ret;
                 if (ret)
@@ -294,18 +295,10 @@ static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
                 goto out;
         }
 
-        if (level == 0) {
-                if (ret == 1 && path->slots[0] >= btrfs_header_nritems(eb)) {
-                        ret = btrfs_next_leaf(root, path);
-                        if (ret)
-                                goto out;
-                        eb = path->nodes[0];
-                }
-
+        if (level == 0)
                 btrfs_item_key_to_cpu(eb, &key, path->slots[0]);
-        }
 
-        ret = add_all_parents(root, path, parents, level, &key,
+        ret = add_all_parents(root, path, parents, level, &key, time_seq,
                                 ref->wanted_disk_byte, extent_item_pos);
 out:
         btrfs_free_path(path);
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index e616f8872e69..12394a90d60f 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -37,6 +37,7 @@
 #define BTRFS_INODE_IN_DEFRAG                   3
 #define BTRFS_INODE_DELALLOC_META_RESERVED      4
 #define BTRFS_INODE_HAS_ORPHAN_ITEM             5
+#define BTRFS_INODE_HAS_ASYNC_EXTENT            6
 
 /* in memory btrfs inode */
 struct btrfs_inode {
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index 9cebb1fd6a3c..da6e9364a5e3 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -93,6 +93,7 @@
 #include "print-tree.h"
 #include "locking.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 #define BTRFSIC_BLOCK_HASHTABLE_SIZE 0x10000
 #define BTRFSIC_BLOCK_LINK_HASHTABLE_SIZE 0x10000
@@ -843,13 +844,14 @@ static int btrfsic_process_superblock_dev_mirror(
                 superblock_tmp->never_written = 0;
                 superblock_tmp->mirror_num = 1 + superblock_mirror_num;
                 if (state->print_mask & BTRFSIC_PRINT_MASK_SUPERBLOCK_WRITE)
-                        printk(KERN_INFO "New initial S-block (bdev %p, %s)"
-                               " @%llu (%s/%llu/%d)\n",
-                               superblock_bdev, device->name,
-                               (unsigned long long)dev_bytenr,
-                               dev_state->name,
-                               (unsigned long long)dev_bytenr,
-                               superblock_mirror_num);
+                        printk_in_rcu(KERN_INFO "New initial S-block (bdev %p, %s)"
+                                     " @%llu (%s/%llu/%d)\n",
+                                     superblock_bdev,
+                                     rcu_str_deref(device->name),
+                                     (unsigned long long)dev_bytenr,
+                                     dev_state->name,
+                                     (unsigned long long)dev_bytenr,
+                                     superblock_mirror_num);
                 list_add(&superblock_tmp->all_blocks_node,
                          &state->all_blocks_list);
                 btrfsic_block_hashtable_add(superblock_tmp,
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index d7a96cfdc50a..15cbc2bf4ff0 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -467,6 +467,15 @@ static inline int tree_mod_dont_log(struct btrfs_fs_info *fs_info,
         return 0;
 }
 
+/*
+ * This allocates memory and gets a tree modification sequence number when
+ * needed.
+ *
+ * Returns 0 when no sequence number is needed, < 0 on error.
+ * Returns 1 when a sequence number was added. In this case,
+ * fs_info->tree_mod_seq_lock was acquired and must be released by the caller
+ * after inserting into the rb tree.
+ */
 static inline int tree_mod_alloc(struct btrfs_fs_info *fs_info, gfp_t flags,
                                  struct tree_mod_elem **tm_ret)
 {
@@ -491,11 +500,11 @@ static inline int tree_mod_alloc(struct btrfs_fs_info *fs_info, gfp_t flags,
                  */
                 kfree(tm);
                 seq = 0;
+                spin_unlock(&fs_info->tree_mod_seq_lock);
         } else {
                 __get_tree_mod_seq(fs_info, &tm->elem);
                 seq = tm->elem.seq;
         }
-        spin_unlock(&fs_info->tree_mod_seq_lock);
 
         return seq;
 }
@@ -521,7 +530,9 @@ tree_mod_log_insert_key_mask(struct btrfs_fs_info *fs_info,
         tm->slot = slot;
         tm->generation = btrfs_node_ptr_generation(eb, slot);
 
-        return __tree_mod_log_insert(fs_info, tm);
+        ret = __tree_mod_log_insert(fs_info, tm);
+        spin_unlock(&fs_info->tree_mod_seq_lock);
+        return ret;
 }
 
 static noinline int
@@ -559,7 +570,9 @@ tree_mod_log_insert_move(struct btrfs_fs_info *fs_info,
         tm->move.nr_items = nr_items;
         tm->op = MOD_LOG_MOVE_KEYS;
 
-        return __tree_mod_log_insert(fs_info, tm);
+        ret = __tree_mod_log_insert(fs_info, tm);
+        spin_unlock(&fs_info->tree_mod_seq_lock);
+        return ret;
 }
 
 static noinline int
@@ -580,7 +593,9 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
         tm->generation = btrfs_header_generation(old_root);
         tm->op = MOD_LOG_ROOT_REPLACE;
 
-        return __tree_mod_log_insert(fs_info, tm);
+        ret = __tree_mod_log_insert(fs_info, tm);
+        spin_unlock(&fs_info->tree_mod_seq_lock);
+        return ret;
 }
 
 static struct tree_mod_elem *
@@ -1023,6 +1038,10 @@ __tree_mod_log_oldest_root(struct btrfs_fs_info *fs_info,
                 looped = 1;
         }
 
+        /* if there's no old root to return, return what we found instead */
+        if (!found)
+                found = tm;
+
         return found;
 }
 
@@ -1143,22 +1162,36 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
         return eb_rewin;
 }
 
+/*
+ * get_old_root() rewinds the state of @root's root node to the given @time_seq
+ * value. If there are no changes, the current root->root_node is returned. If
+ * anything changed in between, there's a fresh buffer allocated on which the
+ * rewind operations are done. In any case, the returned buffer is read locked.
+ * Returns NULL on error (with no locks held).
+ */
 static inline struct extent_buffer *
 get_old_root(struct btrfs_root *root, u64 time_seq)
 {
         struct tree_mod_elem *tm;
         struct extent_buffer *eb;
-        struct tree_mod_root *old_root;
-        u64 old_generation;
+        struct tree_mod_root *old_root = NULL;
+        u64 old_generation = 0;
+        u64 logical;
 
+        eb = btrfs_read_lock_root_node(root);
         tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
         if (!tm)
                 return root->node;
 
-        old_root = &tm->old_root;
-        old_generation = tm->generation;
+        if (tm->op == MOD_LOG_ROOT_REPLACE) {
+                old_root = &tm->old_root;
+                old_generation = tm->generation;
+                logical = old_root->logical;
+        } else {
+                logical = root->node->start;
+        }
 
-        tm = tree_mod_log_search(root->fs_info, old_root->logical, time_seq);
+        tm = tree_mod_log_search(root->fs_info, logical, time_seq);
         /*
          * there was an item in the log when __tree_mod_log_oldest_root
          * returned. this one must not go away, because the time_seq passed to
@@ -1166,22 +1199,25 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
          */
         BUG_ON(!tm);
 
-        if (old_root->logical == root->node->start) {
-                /* there are logged operations for the current root */
-                eb = btrfs_clone_extent_buffer(root->node);
-        } else {
-                /* there's a root replace operation for the current root */
+        if (old_root)
                 eb = alloc_dummy_extent_buffer(tm->index << PAGE_CACHE_SHIFT,
                                                root->nodesize);
+        else
+                eb = btrfs_clone_extent_buffer(root->node);
+        btrfs_tree_read_unlock(root->node);
+        free_extent_buffer(root->node);
+        if (!eb)
+                return NULL;
+        btrfs_tree_read_lock(eb);
+        if (old_root) {
                 btrfs_set_header_bytenr(eb, eb->start);
                 btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV);
                 btrfs_set_header_owner(eb, root->root_key.objectid);
+                btrfs_set_header_level(eb, old_root->level);
+                btrfs_set_header_generation(eb, old_generation);
         }
-        if (!eb)
-                return NULL;
-        btrfs_set_header_level(eb, old_root->level);
-        btrfs_set_header_generation(eb, old_generation);
         __tree_mod_log_rewind(eb, time_seq, tm);
+        extent_buffer_get(eb);
 
         return eb;
 }
@@ -1650,8 +1686,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
             BTRFS_NODEPTRS_PER_BLOCK(root) / 4)
                 return 0;
 
-        btrfs_header_nritems(mid);
-
         left = read_node_slot(root, parent, pslot - 1);
         if (left) {
                 btrfs_tree_lock(left);
@@ -1681,7 +1715,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 wret = push_node_left(trans, root, left, mid, 1);
                 if (wret < 0)
                         ret = wret;
-                btrfs_header_nritems(mid);
         }
 
         /*
@@ -2615,9 +2648,7 @@ int btrfs_search_old_slot(struct btrfs_root *root, struct btrfs_key *key,
 
 again:
         b = get_old_root(root, time_seq);
-        extent_buffer_get(b);
         level = btrfs_header_level(b);
-        btrfs_tree_read_lock(b);
         p->locks[level] = BTRFS_READ_LOCK;
 
         while (b) {
@@ -5001,6 +5032,12 @@ next:
  */
 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
 {
+        return btrfs_next_old_leaf(root, path, 0);
+}
+
+int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
+                        u64 time_seq)
+{
         int slot;
         int level;
         struct extent_buffer *c;
@@ -5025,7 +5062,10 @@ again:
         path->keep_locks = 1;
         path->leave_spinning = 1;
 
-        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        if (time_seq)
+                ret = btrfs_search_old_slot(root, &key, path, time_seq);
+        else
+                ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
         path->keep_locks = 0;
 
         if (ret < 0)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0236d03c6732..8b73b2d4deb7 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2753,6 +2753,8 @@ static inline int btrfs_insert_empty_item(struct btrfs_trans_handle *trans,
 }
 
 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path);
+int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
+                        u64 time_seq);
 static inline int btrfs_next_item(struct btrfs_root *root, struct btrfs_path *p)
 {
         ++p->slots[0];
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index c18d0442ae6d..2399f4086915 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1879,3 +1879,21 @@ void btrfs_kill_all_delayed_nodes(struct btrfs_root *root)
                 }
         }
 }
+
+void btrfs_destroy_delayed_inodes(struct btrfs_root *root)
+{
+        struct btrfs_delayed_root *delayed_root;
+        struct btrfs_delayed_node *curr_node, *prev_node;
+
+        delayed_root = btrfs_get_delayed_root(root);
+
+        curr_node = btrfs_first_delayed_node(delayed_root);
+        while (curr_node) {
+                __btrfs_kill_delayed_node(curr_node);
+
+                prev_node = curr_node;
+                curr_node = btrfs_next_delayed_node(curr_node);
+                btrfs_release_delayed_node(prev_node);
+        }
+}
+
diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
index 7083d08b2a21..f5aa4023d3e1 100644
--- a/fs/btrfs/delayed-inode.h
+++ b/fs/btrfs/delayed-inode.h
@@ -124,6 +124,9 @@ int btrfs_fill_inode(struct inode *inode, u32 *rdev);
 /* Used for drop dead root */
 void btrfs_kill_all_delayed_nodes(struct btrfs_root *root);
 
+/* Used for clean the transaction */
+void btrfs_destroy_delayed_inodes(struct btrfs_root *root);
+
 /* Used for readdir() */
 void btrfs_get_delayed_items(struct inode *inode, struct list_head *ins_list,
                              struct list_head *del_list);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 7ae51decf6d3..e1890b1d3075 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -44,6 +44,7 @@
 #include "free-space-cache.h"
 #include "inode-map.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 static struct extent_io_ops btree_extent_io_ops;
 static void end_workqueue_fn(struct btrfs_work *work);
@@ -2118,7 +2119,7 @@ int open_ctree(struct super_block *sb,
 
         features = btrfs_super_incompat_flags(disk_super);
         features |= BTRFS_FEATURE_INCOMPAT_MIXED_BACKREF;
-        if (tree_root->fs_info->compress_type & BTRFS_COMPRESS_LZO)
+        if (tree_root->fs_info->compress_type == BTRFS_COMPRESS_LZO)
                 features |= BTRFS_FEATURE_INCOMPAT_COMPRESS_LZO;
 
         /*
@@ -2575,8 +2576,9 @@ static void btrfs_end_buffer_write_sync(struct buffer_head *bh, int uptodate)
                 struct btrfs_device *device = (struct btrfs_device *)
                         bh->b_private;
 
-                printk_ratelimited(KERN_WARNING "lost page write due to "
-                                   "I/O error on %s\n", device->name);
+                printk_ratelimited_in_rcu(KERN_WARNING "lost page write due to "
+                                          "I/O error on %s\n",
+                                          rcu_str_deref(device->name));
                 /* note, we dont' set_buffer_write_io_error because we have
                  * our own ways of dealing with the IO errors
                  */
@@ -2749,8 +2751,8 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
                 wait_for_completion(&device->flush_wait);
 
                 if (bio_flagged(bio, BIO_EOPNOTSUPP)) {
-                        printk("btrfs: disabling barriers on dev %s\n",
-                               device->name);
+                        printk_in_rcu("btrfs: disabling barriers on dev %s\n",
+                                      rcu_str_deref(device->name));
                         device->nobarriers = 1;
                 }
                 if (!bio_flagged(bio, BIO_UPTODATE)) {
@@ -3400,7 +3402,6 @@ int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
 
         delayed_refs = &trans->delayed_refs;
 
-again:
         spin_lock(&delayed_refs->lock);
         if (delayed_refs->num_entries == 0) {
                 spin_unlock(&delayed_refs->lock);
@@ -3408,31 +3409,36 @@ again:
                 return ret;
         }
 
-        node = rb_first(&delayed_refs->root);
-        while (node) {
+        while ((node = rb_first(&delayed_refs->root)) != NULL) {
                 ref = rb_entry(node, struct btrfs_delayed_ref_node, rb_node);
-                node = rb_next(node);
-
-                ref->in_tree = 0;
-                rb_erase(&ref->rb_node, &delayed_refs->root);
-                delayed_refs->num_entries--;
 
                 atomic_set(&ref->refs, 1);
                 if (btrfs_delayed_ref_is_head(ref)) {
                         struct btrfs_delayed_ref_head *head;
 
                         head = btrfs_delayed_node_to_head(ref);
-                        spin_unlock(&delayed_refs->lock);
-                        mutex_lock(&head->mutex);
+                        if (!mutex_trylock(&head->mutex)) {
+                                atomic_inc(&ref->refs);
+                                spin_unlock(&delayed_refs->lock);
+
+                                /* Need to wait for the delayed ref to run */
+                                mutex_lock(&head->mutex);
+                                mutex_unlock(&head->mutex);
+                                btrfs_put_delayed_ref(ref);
+
+                                continue;
+                        }
+
                         kfree(head->extent_op);
                         delayed_refs->num_heads--;
                         if (list_empty(&head->cluster))
                                 delayed_refs->num_heads_ready--;
                         list_del_init(&head->cluster);
-                        mutex_unlock(&head->mutex);
-                        btrfs_put_delayed_ref(ref);
-                        goto again;
                 }
+                ref->in_tree = 0;
+                rb_erase(&ref->rb_node, &delayed_refs->root);
+                delayed_refs->num_entries--;
+
                 spin_unlock(&delayed_refs->lock);
                 btrfs_put_delayed_ref(ref);
 
@@ -3520,11 +3526,9 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root,
                              &(&BTRFS_I(page->mapping->host)->io_tree)->buffer,
                                                offset >> PAGE_CACHE_SHIFT);
                         spin_unlock(&dirty_pages->buffer_lock);
-                        if (eb) {
+                        if (eb)
                                 ret = test_and_clear_bit(EXTENT_BUFFER_DIRTY,
                                                          &eb->bflags);
-                                atomic_set(&eb->refs, 1);
-                        }
                         if (PageWriteback(page))
                                 end_page_writeback(page);
 
@@ -3538,8 +3542,8 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root,
                                 spin_unlock_irq(&page->mapping->tree_lock);
                         }
 
-                        page->mapping->a_ops->invalidatepage(page, 0);
                         unlock_page(page);
+                        page_cache_release(page);
                 }
         }
 
@@ -3553,8 +3557,10 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
         u64 start;
         u64 end;
         int ret;
+        bool loop = true;
 
         unpin = pinned_extents;
+again:
         while (1) {
                 ret = find_first_extent_bit(unpin, 0, &start, &end,
                                             EXTENT_DIRTY);
@@ -3572,6 +3578,15 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
                 cond_resched();
         }
 
+        if (loop) {
+                if (unpin == &root->fs_info->freed_extents[0])
+                        unpin = &root->fs_info->freed_extents[1];
+                else
+                        unpin = &root->fs_info->freed_extents[0];
+                loop = false;
+                goto again;
+        }
+
         return 0;
 }
 
@@ -3585,21 +3600,23 @@ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
         /* FIXME: cleanup wait for commit */
         cur_trans->in_commit = 1;
         cur_trans->blocked = 1;
-        if (waitqueue_active(&root->fs_info->transaction_blocked_wait))
-                wake_up(&root->fs_info->transaction_blocked_wait);
+        wake_up(&root->fs_info->transaction_blocked_wait);
 
         cur_trans->blocked = 0;
-        if (waitqueue_active(&root->fs_info->transaction_wait))
-                wake_up(&root->fs_info->transaction_wait);
+        wake_up(&root->fs_info->transaction_wait);
 
         cur_trans->commit_done = 1;
-        if (waitqueue_active(&cur_trans->commit_wait))
-                wake_up(&cur_trans->commit_wait);
+        wake_up(&cur_trans->commit_wait);
+
+        btrfs_destroy_delayed_inodes(root);
+        btrfs_assert_delayed_root_empty(root);
 
         btrfs_destroy_pending_snapshots(cur_trans);
 
         btrfs_destroy_marked_extents(root, &cur_trans->dirty_pages,
                                      EXTENT_DIRTY);
+        btrfs_destroy_pinned_extent(root,
+                                    root->fs_info->pinned_extents);
 
         /*
         memset(cur_trans, 0, sizeof(*cur_trans));
@@ -3648,6 +3665,9 @@ int btrfs_cleanup_transaction(struct btrfs_root *root)
                 if (waitqueue_active(&t->commit_wait))
                         wake_up(&t->commit_wait);
 
+                btrfs_destroy_delayed_inodes(root);
+                btrfs_assert_delayed_root_empty(root);
+
                 btrfs_destroy_pending_snapshots(t);
 
                 btrfs_destroy_delalloc_inodes(root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2c8f7b204617..aaa12c1eb348 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -20,6 +20,7 @@
 #include "volumes.h"
 #include "check-integrity.h"
 #include "locking.h"
+#include "rcu-string.h"
 
 static struct kmem_cache *extent_state_cache;
 static struct kmem_cache *extent_buffer_cache;
@@ -1917,9 +1918,9 @@ int repair_io_failure(struct btrfs_mapping_tree *map_tree, u64 start,
                 return -EIO;
         }
 
-        printk(KERN_INFO "btrfs read error corrected: ino %lu off %llu (dev %s "
-                        "sector %llu)\n", page->mapping->host->i_ino, start,
-                        dev->name, sector);
+        printk_in_rcu(KERN_INFO "btrfs read error corrected: ino %lu off %llu "
+                      "(dev %s sector %llu)\n", page->mapping->host->i_ino,
+                      start, rcu_str_deref(dev->name), sector);
 
         bio_put(bio);
         return 0;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index f6ab6f5e635a..a4f02501da40 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -830,7 +830,7 @@ static noinline int cow_file_range(struct inode *inode,
         if (IS_ERR(trans)) {
                 extent_clear_unlock_delalloc(inode,
                              &BTRFS_I(inode)->io_tree,
-                             start, end, NULL,
+                             start, end, locked_page,
                              EXTENT_CLEAR_UNLOCK_PAGE |
                              EXTENT_CLEAR_UNLOCK |
                              EXTENT_CLEAR_DELALLOC |
@@ -963,7 +963,7 @@ out:
 out_unlock:
         extent_clear_unlock_delalloc(inode,
                      &BTRFS_I(inode)->io_tree,
-                     start, end, NULL,
+                     start, end, locked_page,
                      EXTENT_CLEAR_UNLOCK_PAGE |
                      EXTENT_CLEAR_UNLOCK |
                      EXTENT_CLEAR_DELALLOC |
@@ -986,8 +986,10 @@ static noinline void async_cow_start(struct btrfs_work *work)
         compress_file_range(async_cow->inode, async_cow->locked_page,
                             async_cow->start, async_cow->end, async_cow,
                             &num_added);
-        if (num_added == 0)
+        if (num_added == 0) {
+                iput(async_cow->inode);
                 async_cow->inode = NULL;
+        }
 }
 
 /*
@@ -1020,6 +1022,8 @@ static noinline void async_cow_free(struct btrfs_work *work)
 {
         struct async_cow *async_cow;
         async_cow = container_of(work, struct async_cow, work);
+        if (async_cow->inode)
+                iput(async_cow->inode);
         kfree(async_cow);
 }
 
@@ -1038,7 +1042,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
         while (start < end) {
                 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
                 BUG_ON(!async_cow); /* -ENOMEM */
-                async_cow->inode = inode;
+                async_cow->inode = igrab(inode);
                 async_cow->root = root;
                 async_cow->locked_page = locked_page;
                 async_cow->start = start;
@@ -1136,8 +1140,18 @@ static noinline int run_delalloc_nocow(struct inode *inode,
         u64 ino = btrfs_ino(inode);
 
         path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
+                extent_clear_unlock_delalloc(inode,
+                             &BTRFS_I(inode)->io_tree,
+                             start, end, locked_page,
+                             EXTENT_CLEAR_UNLOCK_PAGE |
+                             EXTENT_CLEAR_UNLOCK |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_DIRTY |
+                             EXTENT_SET_WRITEBACK |
+                             EXTENT_END_WRITEBACK);
                 return -ENOMEM;
+        }
 
         nolock = btrfs_is_free_space_inode(root, inode);
 
@@ -1147,6 +1161,15 @@ static noinline int run_delalloc_nocow(struct inode *inode,
                 trans = btrfs_join_transaction(root);
 
         if (IS_ERR(trans)) {
+                extent_clear_unlock_delalloc(inode,
+                             &BTRFS_I(inode)->io_tree,
+                             start, end, locked_page,
+                             EXTENT_CLEAR_UNLOCK_PAGE |
+                             EXTENT_CLEAR_UNLOCK |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_DIRTY |
+                             EXTENT_SET_WRITEBACK |
+                             EXTENT_END_WRITEBACK);
                 btrfs_free_path(path);
                 return PTR_ERR(trans);
         }
@@ -1327,8 +1350,11 @@ out_check:
         }
         btrfs_release_path(path);
 
-        if (cur_offset <= end && cow_start == (u64)-1)
+        if (cur_offset <= end && cow_start == (u64)-1) {
                 cow_start = cur_offset;
+                cur_offset = end;
+        }
+
         if (cow_start != (u64)-1) {
                 ret = cow_file_range(inode, locked_page, cow_start, end,
                                      page_started, nr_written, 1);
@@ -1347,6 +1373,17 @@ error:
         if (!ret)
                 ret = err;
 
+        if (ret && cur_offset < end)
+                extent_clear_unlock_delalloc(inode,
+                             &BTRFS_I(inode)->io_tree,
+                             cur_offset, end, locked_page,
+                             EXTENT_CLEAR_UNLOCK_PAGE |
+                             EXTENT_CLEAR_UNLOCK |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_DIRTY |
+                             EXTENT_SET_WRITEBACK |
+                             EXTENT_END_WRITEBACK);
+
         btrfs_free_path(path);
         return ret;
 }
@@ -1361,20 +1398,23 @@ static int run_delalloc_range(struct inode *inode, struct page *locked_page,
         int ret;
         struct btrfs_root *root = BTRFS_I(inode)->root;
 
-        if (BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW)
+        if (BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW) {
                 ret = run_delalloc_nocow(inode, locked_page, start, end,
                                          page_started, 1, nr_written);
-        else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC)
+        } else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC) {
                 ret = run_delalloc_nocow(inode, locked_page, start, end,
                                          page_started, 0, nr_written);
-        else if (!btrfs_test_opt(root, COMPRESS) &&
-                 !(BTRFS_I(inode)->force_compress) &&
-                 !(BTRFS_I(inode)->flags & BTRFS_INODE_COMPRESS))
+        } else if (!btrfs_test_opt(root, COMPRESS) &&
+                   !(BTRFS_I(inode)->force_compress) &&
+                   !(BTRFS_I(inode)->flags & BTRFS_INODE_COMPRESS)) {
                 ret = cow_file_range(inode, locked_page, start, end,
                                       page_started, nr_written, 1);
-        else
+        } else {
+                set_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
+                        &BTRFS_I(inode)->runtime_flags);
                 ret = cow_file_range_async(inode, locked_page, start, end,
                                            page_started, nr_written);
+        }
         return ret;
 }
 
@@ -7054,10 +7094,13 @@ static void fixup_inode_flags(struct inode *dir, struct inode *inode)
         else
                 b_inode->flags &= ~BTRFS_INODE_NODATACOW;
 
-        if (b_dir->flags & BTRFS_INODE_COMPRESS)
+        if (b_dir->flags & BTRFS_INODE_COMPRESS) {
                 b_inode->flags |= BTRFS_INODE_COMPRESS;
-        else
-                b_inode->flags &= ~BTRFS_INODE_COMPRESS;
+                b_inode->flags &= ~BTRFS_INODE_NOCOMPRESS;
+        } else {
+                b_inode->flags &= ~(BTRFS_INODE_COMPRESS |
+                                    BTRFS_INODE_NOCOMPRESS);
+        }
 }
 
 static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 24b776c08d99..0e92e5763005 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -52,6 +52,7 @@
 #include "locking.h"
 #include "inode-map.h"
 #include "backref.h"
+#include "rcu-string.h"
 
 /* Mask out flags that are inappropriate for the given type of inode. */
 static inline __u32 btrfs_mask_flags(umode_t mode, __u32 flags)
@@ -785,39 +786,57 @@ none:
         return -ENOENT;
 }
 
-/*
- * Validaty check of prev em and next em:
- * 1) no prev/next em
- * 2) prev/next em is an hole/inline extent
- */
-static int check_adjacent_extents(struct inode *inode, struct extent_map *em)
+static struct extent_map *defrag_lookup_extent(struct inode *inode, u64 start)
 {
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
-        struct extent_map *prev = NULL, *next = NULL;
-        int ret = 0;
+        struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
+        struct extent_map *em;
+        u64 len = PAGE_CACHE_SIZE;
 
+        /*
+         * hopefully we have this extent in the tree already, try without
+         * the full extent lock
+         */
         read_lock(&em_tree->lock);
-        prev = lookup_extent_mapping(em_tree, em->start - 1, (u64)-1);
-        next = lookup_extent_mapping(em_tree, em->start + em->len, (u64)-1);
+        em = lookup_extent_mapping(em_tree, start, len);
         read_unlock(&em_tree->lock);
 
-        if ((!prev || prev->block_start >= EXTENT_MAP_LAST_BYTE) &&
-            (!next || next->block_start >= EXTENT_MAP_LAST_BYTE))
-                ret = 1;
-        free_extent_map(prev);
-        free_extent_map(next);
+        if (!em) {
+                /* get the big lock and read metadata off disk */
+                lock_extent(io_tree, start, start + len - 1);
+                em = btrfs_get_extent(inode, NULL, 0, start, len, 0);
+                unlock_extent(io_tree, start, start + len - 1);
+
+                if (IS_ERR(em))
+                        return NULL;
+        }
+
+        return em;
+}
+
+static bool defrag_check_next_extent(struct inode *inode, struct extent_map *em)
+{
+        struct extent_map *next;
+        bool ret = true;
 
+        /* this is the last extent */
+        if (em->start + em->len >= i_size_read(inode))
+                return false;
+
+        next = defrag_lookup_extent(inode, em->start + em->len);
+        if (!next || next->block_start >= EXTENT_MAP_LAST_BYTE)
+                ret = false;
+
+        free_extent_map(next);
         return ret;
 }
 
-static int should_defrag_range(struct inode *inode, u64 start, u64 len,
-                               int thresh, u64 *last_len, u64 *skip,
-                               u64 *defrag_end)
+static int should_defrag_range(struct inode *inode, u64 start, int thresh,
+                               u64 *last_len, u64 *skip, u64 *defrag_end)
 {
-        struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
-        struct extent_map *em = NULL;
-        struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
+        struct extent_map *em;
         int ret = 1;
+        bool next_mergeable = true;
 
         /*
          * make sure that once we start defragging an extent, we keep on
@@ -828,23 +847,9 @@ static int should_defrag_range(struct inode *inode, u64 start, u64 len,
 
         *skip = 0;
 
-        /*
-         * hopefully we have this extent in the tree already, try without
-         * the full extent lock
-         */
-        read_lock(&em_tree->lock);
-        em = lookup_extent_mapping(em_tree, start, len);
-        read_unlock(&em_tree->lock);
-
-        if (!em) {
-                /* get the big lock and read metadata off disk */
-                lock_extent(io_tree, start, start + len - 1);
-                em = btrfs_get_extent(inode, NULL, 0, start, len, 0);
-                unlock_extent(io_tree, start, start + len - 1);
-
-                if (IS_ERR(em))
-                        return 0;
-        }
+        em = defrag_lookup_extent(inode, start);
+        if (!em)
+                return 0;
 
         /* this will cover holes, and inline extents */
         if (em->block_start >= EXTENT_MAP_LAST_BYTE) {
@@ -852,18 +857,15 @@ static int should_defrag_range(struct inode *inode, u64 start, u64 len,
                 goto out;
         }
 
-        /* If we have nothing to merge with us, just skip. */
-        if (check_adjacent_extents(inode, em)) {
-                ret = 0;
-                goto out;
-        }
+        next_mergeable = defrag_check_next_extent(inode, em);
 
         /*
-         * we hit a real extent, if it is big don't bother defragging it again
+         * we hit a real extent, if it is big or the next extent is not a
+         * real extent, don't bother defragging it
          */
-        if ((*last_len == 0 || *last_len >= thresh) && em->len >= thresh)
+        if ((*last_len == 0 || *last_len >= thresh) &&
+            (em->len >= thresh || !next_mergeable))
                 ret = 0;
-
 out:
         /*
          * last_len ends up being a counter of how many bytes we've defragged.
@@ -1142,8 +1144,8 @@ int btrfs_defrag_file(struct inode *inode, struct file *file,
                         break;
 
                 if (!should_defrag_range(inode, (u64)i << PAGE_CACHE_SHIFT,
-                                         PAGE_CACHE_SIZE, extent_thresh,
-                                         &last_len, &skip, &defrag_end)) {
+                                         extent_thresh, &last_len, &skip,
+                                         &defrag_end)) {
                         unsigned long next;
                         /*
                          * the should_defrag function tells us how much to skip
@@ -1304,6 +1306,14 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                 ret = -EINVAL;
                 goto out_free;
         }
+        if (device->fs_devices && device->fs_devices->seeding) {
+                printk(KERN_INFO "btrfs: resizer unable to apply on "
+                       "seeding device %llu\n",
+                       (unsigned long long)devid);
+                ret = -EINVAL;
+                goto out_free;
+        }
+
         if (!strcmp(sizestr, "max"))
                 new_size = device->bdev->bd_inode->i_size;
         else {
@@ -1345,8 +1355,9 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
         do_div(new_size, root->sectorsize);
         new_size *= root->sectorsize;
 
-        printk(KERN_INFO "btrfs: new size for %s is %llu\n",
-                device->name, (unsigned long long)new_size);
+        printk_in_rcu(KERN_INFO "btrfs: new size for %s is %llu\n",
+                      rcu_str_deref(device->name),
+                      (unsigned long long)new_size);
 
         if (new_size > old_size) {
                 trans = btrfs_start_transaction(root, 0);
@@ -2264,7 +2275,12 @@ static long btrfs_ioctl_dev_info(struct btrfs_root *root, void __user *arg)
         di_args->total_bytes = dev->total_bytes;
         memcpy(di_args->uuid, dev->uuid, sizeof(di_args->uuid));
         if (dev->name) {
-                strncpy(di_args->path, dev->name, sizeof(di_args->path));
+                struct rcu_string *name;
+
+                rcu_read_lock();
+                name = rcu_dereference(dev->name);
+                strncpy(di_args->path, name->str, sizeof(di_args->path));
+                rcu_read_unlock();
                 di_args->path[sizeof(di_args->path) - 1] = 0;
         } else {
                 di_args->path[0] = '\0';
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 9e138cdc36c5..643335a4fe3c 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -627,7 +627,27 @@ void btrfs_wait_ordered_range(struct inode *inode, u64 start, u64 len)
         /* start IO across the range first to instantiate any delalloc
          * extents
          */
-        filemap_write_and_wait_range(inode->i_mapping, start, orig_end);
+        filemap_fdatawrite_range(inode->i_mapping, start, orig_end);
+
+        /*
+         * So with compression we will find and lock a dirty page and clear the
+         * first one as dirty, setup an async extent, and immediately return
+         * with the entire range locked but with nobody actually marked with
+         * writeback.  So we can't just filemap_write_and_wait_range() and
+         * expect it to work since it will just kick off a thread to do the
+         * actual work.  So we need to call filemap_fdatawrite_range _again_
+         * since it will wait on the page lock, which won't be unlocked until
+         * after the pages have been marked as writeback and so we're good to go
+         * from there.  We have to do this otherwise we'll miss the ordered
+         * extents and that results in badness.  Please Josef, do not think you
+         * know better and pull this out at some point in the future, it is
+         * right and you are wrong.
+         */
+        if (test_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
+                     &BTRFS_I(inode)->runtime_flags))
+                filemap_fdatawrite_range(inode->i_mapping, start, orig_end);
+
+        filemap_fdatawait_range(inode->i_mapping, start, orig_end);
 
         end = orig_end;
         found = 0;
diff --git a/fs/btrfs/rcu-string.h b/fs/btrfs/rcu-string.h
new file mode 100644
index 000000000000..9e111e4576d4
--- /dev/null
+++ b/fs/btrfs/rcu-string.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Red Hat.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License v2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public
+ * License along with this program; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 021110-1307, USA.
+ */
+
+struct rcu_string {
+        struct rcu_head rcu;
+        char str[0];
+};
+
+static inline struct rcu_string *rcu_string_strdup(const char *src, gfp_t mask)
+{
+        size_t len = strlen(src) + 1;
+        struct rcu_string *ret = kzalloc(sizeof(struct rcu_string) +
+                                         (len * sizeof(char)), mask);
+        if (!ret)
+                return ret;
+        strncpy(ret->str, src, len);
+        return ret;
+}
+
+static inline void rcu_string_free(struct rcu_string *str)
+{
+        if (str)
+                kfree_rcu(str, rcu);
+}
+
+#define printk_in_rcu(fmt, ...) do {    \
+        rcu_read_lock();                \
+        printk(fmt, __VA_ARGS__);       \
+        rcu_read_unlock();              \
+} while (0)
+
+#define printk_ratelimited_in_rcu(fmt, ...) do {        \
+        rcu_read_lock();                                \
+        printk_ratelimited(fmt, __VA_ARGS__);           \
+        rcu_read_unlock();                              \
+} while (0)
+
+#define rcu_str_deref(rcu_str) ({                               \
+        struct rcu_string *__str = rcu_dereference(rcu_str);    \
+        __str->str;                                             \
+})
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index a38cfa4f251e..b223620cd5a6 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -26,6 +26,7 @@
 #include "backref.h"
 #include "extent_io.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 /*
  * This is only the first step towards a full-features scrub. It reads all
@@ -320,10 +321,10 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, void *ctx)
          * hold all of the paths here
          */
         for (i = 0; i < ipath->fspath->elem_cnt; ++i)
-                printk(KERN_WARNING "btrfs: %s at logical %llu on dev "
+                printk_in_rcu(KERN_WARNING "btrfs: %s at logical %llu on dev "
                         "%s, sector %llu, root %llu, inode %llu, offset %llu, "
                         "length %llu, links %u (path: %s)\n", swarn->errstr,
-                        swarn->logical, swarn->dev->name,
+                        swarn->logical, rcu_str_deref(swarn->dev->name),
                         (unsigned long long)swarn->sector, root, inum, offset,
                         min(isize - offset, (u64)PAGE_SIZE), nlink,
                         (char *)(unsigned long)ipath->fspath->val[i]);
@@ -332,10 +333,10 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, void *ctx)
         return 0;
 
 err:
-        printk(KERN_WARNING "btrfs: %s at logical %llu on dev "
+        printk_in_rcu(KERN_WARNING "btrfs: %s at logical %llu on dev "
                 "%s, sector %llu, root %llu, inode %llu, offset %llu: path "
                 "resolving failed with ret=%d\n", swarn->errstr,
-                swarn->logical, swarn->dev->name,
+                swarn->logical, rcu_str_deref(swarn->dev->name),
                 (unsigned long long)swarn->sector, root, inum, offset, ret);
 
         free_ipath(ipath);
@@ -390,10 +391,11 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
                 do {
                         ret = tree_backref_for_extent(&ptr, eb, ei, item_size,
                                                         &ref_root, &ref_level);
-                        printk(KERN_WARNING
+                        printk_in_rcu(KERN_WARNING
                                 "btrfs: %s at logical %llu on dev %s, "
                                 "sector %llu: metadata %s (level %d) in tree "
-                                "%llu\n", errstr, swarn.logical, dev->name,
+                                "%llu\n", errstr, swarn.logical,
+                                rcu_str_deref(dev->name),
                                 (unsigned long long)swarn.sector,
                                 ref_level ? "node" : "leaf",
                                 ret < 0 ? -1 : ref_level,
@@ -580,9 +582,11 @@ out:
                 spin_lock(&sdev->stat_lock);
                 ++sdev->stat.uncorrectable_errors;
                 spin_unlock(&sdev->stat_lock);
-                printk_ratelimited(KERN_ERR
+
+                printk_ratelimited_in_rcu(KERN_ERR
                         "btrfs: unable to fixup (nodatasum) error at logical %llu on dev %s\n",
-                        (unsigned long long)fixup->logical, sdev->dev->name);
+                        (unsigned long long)fixup->logical,
+                        rcu_str_deref(sdev->dev->name));
         }
 
         btrfs_free_path(path);
@@ -936,18 +940,20 @@ corrected_error:
                         spin_lock(&sdev->stat_lock);
                         sdev->stat.corrected_errors++;
                         spin_unlock(&sdev->stat_lock);
-                        printk_ratelimited(KERN_ERR
+                        printk_ratelimited_in_rcu(KERN_ERR
                                 "btrfs: fixed up error at logical %llu on dev %s\n",
-                                (unsigned long long)logical, sdev->dev->name);
+                                (unsigned long long)logical,
+                                rcu_str_deref(sdev->dev->name));
                 }
         } else {
 did_not_correct_error:
                 spin_lock(&sdev->stat_lock);
                 sdev->stat.uncorrectable_errors++;
                 spin_unlock(&sdev->stat_lock);
-                printk_ratelimited(KERN_ERR
+                printk_ratelimited_in_rcu(KERN_ERR
                         "btrfs: unable to fixup (regular) error at logical %llu on dev %s\n",
-                        (unsigned long long)logical, sdev->dev->name);
+                        (unsigned long long)logical,
+                        rcu_str_deref(sdev->dev->name));
         }
 
 out:
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 96eb9fef7bd2..0eb9a4da069e 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -54,6 +54,7 @@
 #include "version.h"
 #include "export.h"
 #include "compression.h"
+#include "rcu-string.h"
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/btrfs.h>
@@ -1482,12 +1483,44 @@ static void btrfs_fs_dirty_inode(struct inode *inode, int flags)
                                    "error %d\n", btrfs_ino(inode), ret);
 }
 
+static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
+{
+        struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb);
+        struct btrfs_fs_devices *cur_devices;
+        struct btrfs_device *dev, *first_dev = NULL;
+        struct list_head *head;
+        struct rcu_string *name;
+
+        mutex_lock(&fs_info->fs_devices->device_list_mutex);
+        cur_devices = fs_info->fs_devices;
+        while (cur_devices) {
+                head = &cur_devices->devices;
+                list_for_each_entry(dev, head, dev_list) {
+                        if (!first_dev || dev->devid < first_dev->devid)
+                                first_dev = dev;
+                }
+                cur_devices = cur_devices->seed;
+        }
+
+        if (first_dev) {
+                rcu_read_lock();
+                name = rcu_dereference(first_dev->name);
+                seq_escape(m, name->str, " \t\n\\");
+                rcu_read_unlock();
+        } else {
+                WARN_ON(1);
+        }
+        mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+        return 0;
+}
+
 static const struct super_operations btrfs_super_ops = {
         .drop_inode     = btrfs_drop_inode,
         .evict_inode    = btrfs_evict_inode,
         .put_super      = btrfs_put_super,
         .sync_fs        = btrfs_sync_fs,
         .show_options   = btrfs_show_options,
+        .show_devname   = btrfs_show_devname,
         .write_inode    = btrfs_write_inode,
         .dirty_inode    = btrfs_fs_dirty_inode,
         .alloc_inode    = btrfs_alloc_inode,
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 1791c6e3d834..b72b068183ec 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -100,6 +100,10 @@ loop:
                 kmem_cache_free(btrfs_transaction_cachep, cur_trans);
                 cur_trans = fs_info->running_transaction;
                 goto loop;
+        } else if (root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
+                spin_unlock(&root->fs_info->trans_lock);
+                kmem_cache_free(btrfs_transaction_cachep, cur_trans);
+                return -EROFS;
         }
 
         atomic_set(&cur_trans->num_writers, 1);
@@ -1213,14 +1217,20 @@ int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans,
 
 
 static void cleanup_transaction(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root)
+                                struct btrfs_root *root, int err)
 {
         struct btrfs_transaction *cur_trans = trans->transaction;
 
         WARN_ON(trans->use_count > 1);
 
+        btrfs_abort_transaction(trans, root, err);
+
         spin_lock(&root->fs_info->trans_lock);
         list_del_init(&cur_trans->list);
+        if (cur_trans == root->fs_info->running_transaction) {
+                root->fs_info->running_transaction = NULL;
+                root->fs_info->trans_no_join = 0;
+        }
         spin_unlock(&root->fs_info->trans_lock);
 
         btrfs_cleanup_one_transaction(trans->transaction, root);
@@ -1526,7 +1536,7 @@ cleanup_transaction:
 //      WARN_ON(1);
         if (current->journal_info == trans)
                 current->journal_info = NULL;
-        cleanup_transaction(trans, root);
+        cleanup_transaction(trans, root, ret);
 
         return ret;
 }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 7782020996fe..8a3d2594b807 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -35,6 +35,7 @@
 #include "volumes.h"
 #include "async-thread.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 static int init_first_rw_device(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
@@ -64,7 +65,7 @@ static void free_fs_devices(struct btrfs_fs_devices *fs_devices)
                 device = list_entry(fs_devices->devices.next,
                                     struct btrfs_device, dev_list);
                 list_del(&device->dev_list);
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
         }
         kfree(fs_devices);
@@ -334,8 +335,8 @@ static noinline int device_list_add(const char *path,
 {
         struct btrfs_device *device;
         struct btrfs_fs_devices *fs_devices;
+        struct rcu_string *name;
         u64 found_transid = btrfs_super_generation(disk_super);
-        char *name;
 
         fs_devices = find_fsid(disk_super->fsid);
         if (!fs_devices) {
@@ -369,11 +370,13 @@ static noinline int device_list_add(const char *path,
                 memcpy(device->uuid, disk_super->dev_item.uuid,
                        BTRFS_UUID_SIZE);
                 spin_lock_init(&device->io_lock);
-                device->name = kstrdup(path, GFP_NOFS);
-                if (!device->name) {
+
+                name = rcu_string_strdup(path, GFP_NOFS);
+                if (!name) {
                         kfree(device);
                         return -ENOMEM;
                 }
+                rcu_assign_pointer(device->name, name);
                 INIT_LIST_HEAD(&device->dev_alloc_list);
 
                 /* init readahead state */
@@ -390,12 +393,12 @@ static noinline int device_list_add(const char *path,
 
                 device->fs_devices = fs_devices;
                 fs_devices->num_devices++;
-        } else if (!device->name || strcmp(device->name, path)) {
-                name = kstrdup(path, GFP_NOFS);
+        } else if (!device->name || strcmp(device->name->str, path)) {
+                name = rcu_string_strdup(path, GFP_NOFS);
                 if (!name)
                         return -ENOMEM;
-                kfree(device->name);
-                device->name = name;
+                rcu_string_free(device->name);
+                rcu_assign_pointer(device->name, name);
                 if (device->missing) {
                         fs_devices->missing_devices--;
                         device->missing = 0;
@@ -430,15 +433,22 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
 
         /* We have held the volume lock, it is safe to get the devices. */
         list_for_each_entry(orig_dev, &orig->devices, dev_list) {
+                struct rcu_string *name;
+
                 device = kzalloc(sizeof(*device), GFP_NOFS);
                 if (!device)
                         goto error;
 
-                device->name = kstrdup(orig_dev->name, GFP_NOFS);
-                if (!device->name) {
+                /*
+                 * This is ok to do without rcu read locked because we hold the
+                 * uuid mutex so nothing we touch in here is going to disappear.
+                 */
+                name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
+                if (!name) {
                         kfree(device);
                         goto error;
                 }
+                rcu_assign_pointer(device->name, name);
 
                 device->devid = orig_dev->devid;
                 device->work.func = pending_bios_fn;
@@ -491,7 +501,7 @@ again:
                 }
                 list_del_init(&device->dev_list);
                 fs_devices->num_devices--;
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
         }
 
@@ -516,7 +526,7 @@ static void __free_device(struct work_struct *work)
         if (device->bdev)
                 blkdev_put(device->bdev, device->mode);
 
-        kfree(device->name);
+        rcu_string_free(device->name);
         kfree(device);
 }
 
@@ -540,6 +550,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
         mutex_lock(&fs_devices->device_list_mutex);
         list_for_each_entry(device, &fs_devices->devices, dev_list) {
                 struct btrfs_device *new_device;
+                struct rcu_string *name;
 
                 if (device->bdev)
                         fs_devices->open_devices--;
@@ -555,8 +566,11 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                 new_device = kmalloc(sizeof(*new_device), GFP_NOFS);
                 BUG_ON(!new_device); /* -ENOMEM */
                 memcpy(new_device, device, sizeof(*new_device));
-                new_device->name = kstrdup(device->name, GFP_NOFS);
-                BUG_ON(device->name && !new_device->name); /* -ENOMEM */
+
+                /* Safe because we are under uuid_mutex */
+                name = rcu_string_strdup(device->name->str, GFP_NOFS);
+                BUG_ON(device->name && !name); /* -ENOMEM */
+                rcu_assign_pointer(new_device->name, name);
                 new_device->bdev = NULL;
                 new_device->writeable = 0;
                 new_device->in_fs_metadata = 0;
@@ -621,9 +635,9 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                 if (!device->name)
                         continue;
 
-                bdev = blkdev_get_by_path(device->name, flags, holder);
+                bdev = blkdev_get_by_path(device->name->str, flags, holder);
                 if (IS_ERR(bdev)) {
-                        printk(KERN_INFO "open %s failed\n", device->name);
+                        printk(KERN_INFO "open %s failed\n", device->name->str);
                         goto error;
                 }
                 filemap_write_and_wait(bdev->bd_inode->i_mapping);
@@ -1632,6 +1646,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         struct block_device *bdev;
         struct list_head *devices;
         struct super_block *sb = root->fs_info->sb;
+        struct rcu_string *name;
         u64 total_bytes;
         int seeding_dev = 0;
         int ret = 0;
@@ -1671,23 +1686,24 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                 goto error;
         }
 
-        device->name = kstrdup(device_path, GFP_NOFS);
-        if (!device->name) {
+        name = rcu_string_strdup(device_path, GFP_NOFS);
+        if (!name) {
                 kfree(device);
                 ret = -ENOMEM;
                 goto error;
         }
+        rcu_assign_pointer(device->name, name);
 
         ret = find_next_devid(root, &device->devid);
         if (ret) {
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
                 goto error;
         }
 
         trans = btrfs_start_transaction(root, 0);
         if (IS_ERR(trans)) {
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
                 ret = PTR_ERR(trans);
                 goto error;
@@ -1796,7 +1812,7 @@ error_trans:
         unlock_chunks(root);
         btrfs_abort_transaction(trans, root, ret);
         btrfs_end_transaction(trans, root);
-        kfree(device->name);
+        rcu_string_free(device->name);
         kfree(device);
 error:
         blkdev_put(bdev, FMODE_EXCL);
@@ -4204,10 +4220,17 @@ int btrfs_map_bio(struct btrfs_root *root, int rw, struct bio *bio,
                 bio->bi_sector = bbio->stripes[dev_nr].physical >> 9;
                 dev = bbio->stripes[dev_nr].dev;
                 if (dev && dev->bdev && (rw != WRITE || dev->writeable)) {
+#ifdef DEBUG
+                        struct rcu_string *name;
+
+                        rcu_read_lock();
+                        name = rcu_dereference(dev->name);
                         pr_debug("btrfs_map_bio: rw %d, secor=%llu, dev=%lu "
                                  "(%s id %llu), size=%u\n", rw,
                                  (u64)bio->bi_sector, (u_long)dev->bdev->bd_dev,
-                                 dev->name, dev->devid, bio->bi_size);
+                                 name->str, dev->devid, bio->bi_size);
+                        rcu_read_unlock();
+#endif
                         bio->bi_bdev = dev->bdev;
                         if (async_submit)
                                 schedule_bio(root, dev, rw, bio);
@@ -4694,8 +4717,9 @@ int btrfs_init_dev_stats(struct btrfs_fs_info *fs_info)
                 key.offset = device->devid;
                 ret = btrfs_search_slot(NULL, dev_root, &key, path, 0, 0);
                 if (ret) {
-                        printk(KERN_WARNING "btrfs: no dev_stats entry found for device %s (devid %llu) (OK on first mount after mkfs)\n",
-                               device->name, (unsigned long long)device->devid);
+                        printk_in_rcu(KERN_WARNING "btrfs: no dev_stats entry found for device %s (devid %llu) (OK on first mount after mkfs)\n",
+                                      rcu_str_deref(device->name),
+                                      (unsigned long long)device->devid);
                         __btrfs_reset_dev_stats(device);
                         device->dev_stats_valid = 1;
                         btrfs_release_path(path);
@@ -4747,8 +4771,8 @@ static int update_dev_stat_item(struct btrfs_trans_handle *trans,
         BUG_ON(!path);
         ret = btrfs_search_slot(trans, dev_root, &key, path, -1, 1);
         if (ret < 0) {
-                printk(KERN_WARNING "btrfs: error %d while searching for dev_stats item for device %s!\n",
-                       ret, device->name);
+                printk_in_rcu(KERN_WARNING "btrfs: error %d while searching for dev_stats item for device %s!\n",
+                              ret, rcu_str_deref(device->name));
                 goto out;
         }
 
@@ -4757,8 +4781,8 @@ static int update_dev_stat_item(struct btrfs_trans_handle *trans,
                 /* need to delete old one and insert a new one */
                 ret = btrfs_del_item(trans, dev_root, path);
                 if (ret != 0) {
-                        printk(KERN_WARNING "btrfs: delete too small dev_stats item for device %s failed %d!\n",
-                               device->name, ret);
+                        printk_in_rcu(KERN_WARNING "btrfs: delete too small dev_stats item for device %s failed %d!\n",
+                                      rcu_str_deref(device->name), ret);
                         goto out;
                 }
                 ret = 1;
@@ -4770,8 +4794,8 @@ static int update_dev_stat_item(struct btrfs_trans_handle *trans,
                 ret = btrfs_insert_empty_item(trans, dev_root, path,
                                               &key, sizeof(*ptr));
                 if (ret < 0) {
-                        printk(KERN_WARNING "btrfs: insert dev_stats item for device %s failed %d!\n",
-                               device->name, ret);
+                        printk_in_rcu(KERN_WARNING "btrfs: insert dev_stats item for device %s failed %d!\n",
+                                      rcu_str_deref(device->name), ret);
                         goto out;
                 }
         }
@@ -4823,9 +4847,9 @@ void btrfs_dev_stat_print_on_error(struct btrfs_device *dev)
 {
         if (!dev->dev_stats_valid)
                 return;
-        printk_ratelimited(KERN_ERR
+        printk_ratelimited_in_rcu(KERN_ERR
                            "btrfs: bdev %s errs: wr %u, rd %u, flush %u, corrupt %u, gen %u\n",
-                           dev->name,
+                           rcu_str_deref(dev->name),
                            btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_WRITE_ERRS),
                            btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_READ_ERRS),
                            btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_FLUSH_ERRS),
@@ -4837,8 +4861,8 @@ void btrfs_dev_stat_print_on_error(struct btrfs_device *dev)
 
 static void btrfs_dev_stat_print_on_load(struct btrfs_device *dev)
 {
-        printk(KERN_INFO "btrfs: bdev %s errs: wr %u, rd %u, flush %u, corrupt %u, gen %u\n",
-               dev->name,
+        printk_in_rcu(KERN_INFO "btrfs: bdev %s errs: wr %u, rd %u, flush %u, corrupt %u, gen %u\n",
+               rcu_str_deref(dev->name),
                btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_WRITE_ERRS),
                btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_READ_ERRS),
                btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_FLUSH_ERRS),
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 3406a88ca83e..74366f27a76b 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -58,7 +58,7 @@ struct btrfs_device {
         /* the mode sent to blkdev_get */
         fmode_t mode;
 
-        char *name;
+        struct rcu_string *name;
 
         /* the internal btrfs device id */
         u64 devid;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 20350a93ed99..6df0cbe1cbc9 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -174,6 +174,7 @@ struct smb_version_operations {
         void (*add_credits)(struct TCP_Server_Info *, const unsigned int);
         void (*set_credits)(struct TCP_Server_Info *, const int);
         int * (*get_credits_field)(struct TCP_Server_Info *);
+        __u64 (*get_next_mid)(struct TCP_Server_Info *);
         /* data offset from read response message */
         unsigned int (*read_data_offset)(char *);
         /* data length from read response message */
@@ -399,6 +400,12 @@ set_credits(struct TCP_Server_Info *server, const int val)
         server->ops->set_credits(server, val);
 }
 
+static inline __u64
+get_next_mid(struct TCP_Server_Info *server)
+{
+        return server->ops->get_next_mid(server);
+}
+
 /*
  * Macros to allow the TCP_Server_Info->net field and related code to drop out
  * when CONFIG_NET_NS isn't set.
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 5ec21ecf7980..0a6cbfe2761e 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -114,7 +114,6 @@ extern int small_smb_init_no_tc(const int smb_cmd, const int wct,
                                 void **request_buf);
 extern int CIFS_SessSetup(unsigned int xid, struct cifs_ses *ses,
                              const struct nls_table *nls_cp);
-extern __u64 GetNextMid(struct TCP_Server_Info *server);
 extern struct timespec cifs_NTtimeToUnix(__le64 utc_nanoseconds_since_1601);
 extern u64 cifs_UnixTimeToNT(struct timespec);
 extern struct timespec cnvrtDosUnixTm(__le16 le_date, __le16 le_time,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index b5ad716b2642..5b400730c213 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -268,7 +268,7 @@ small_smb_init_no_tc(const int smb_command, const int wct,
                 return rc;
 
         buffer = (struct smb_hdr *)*request_buf;
-        buffer->Mid = GetNextMid(ses->server);
+        buffer->Mid = get_next_mid(ses->server);
         if (ses->capabilities & CAP_UNICODE)
                 buffer->Flags2 |= SMBFLG2_UNICODE;
         if (ses->capabilities & CAP_STATUS32)
@@ -402,7 +402,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifs_ses *ses)
 
         cFYI(1, "secFlags 0x%x", secFlags);
 
-        pSMB->hdr.Mid = GetNextMid(server);
+        pSMB->hdr.Mid = get_next_mid(server);
         pSMB->hdr.Flags2 |= (SMBFLG2_UNICODE | SMBFLG2_ERR_STATUS);
 
         if ((secFlags & CIFSSEC_MUST_KRB5) == CIFSSEC_MUST_KRB5)
@@ -782,7 +782,7 @@ CIFSSMBLogoff(const int xid, struct cifs_ses *ses)
                 return rc;
         }
 
-        pSMB->hdr.Mid = GetNextMid(ses->server);
+        pSMB->hdr.Mid = get_next_mid(ses->server);
 
         if (ses->server->sec_mode &
                    (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
@@ -4762,7 +4762,7 @@ getDFSRetry:
 
         /* server pointer checked in called function,
         but should never be null here anyway */
-        pSMB->hdr.Mid = GetNextMid(ses->server);
+        pSMB->hdr.Mid = get_next_mid(ses->server);
         pSMB->hdr.Tid = ses->ipc_tid;
         pSMB->hdr.Uid = ses->Suid;
         if (ses->capabilities & CAP_STATUS32)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index ccafdedd0dbc..78db68a5cf44 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1058,13 +1058,15 @@ cifs_demultiplex_thread(void *p)
                 if (mid_entry != NULL) {
                         if (!mid_entry->multiRsp || mid_entry->multiEnd)
                                 mid_entry->callback(mid_entry);
-                } else if (!server->ops->is_oplock_break(buf, server)) {
+                } else if (!server->ops->is_oplock_break ||
+                           !server->ops->is_oplock_break(buf, server)) {
                         cERROR(1, "No task to wake, unknown frame received! "
                                    "NumMids %d", atomic_read(&midCount));
                         cifs_dump_mem("Received Data is: ", buf,
                                       HEADER_SIZE(server));
 #ifdef CONFIG_CIFS_DEBUG2
-                        server->ops->dump_detail(buf);
+                        if (server->ops->dump_detail)
+                                server->ops->dump_detail(buf);
                         cifs_dump_mids(server);
 #endif /* CIFS_DEBUG2 */
 
@@ -3938,7 +3940,7 @@ CIFSTCon(unsigned int xid, struct cifs_ses *ses,
         header_assemble(smb_buffer, SMB_COM_TREE_CONNECT_ANDX,
                         NULL /*no tid */ , 4 /*wct */ );
 
-        smb_buffer->Mid = GetNextMid(ses->server);
+        smb_buffer->Mid = get_next_mid(ses->server);
         smb_buffer->Uid = ses->Suid;
         pSMB = (TCONX_REQ *) smb_buffer;
         pSMBr = (TCONX_RSP *) smb_buffer_response;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 253170dfa716..513adbc211d7 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -876,7 +876,7 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
         struct cifsLockInfo *li, *tmp;
         struct cifs_tcon *tcon;
         struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode);
-        unsigned int num, max_num;
+        unsigned int num, max_num, max_buf;
         LOCKING_ANDX_RANGE *buf, *cur;
         int types[] = {LOCKING_ANDX_LARGE_FILES,
                        LOCKING_ANDX_SHARED_LOCK | LOCKING_ANDX_LARGE_FILES};
@@ -892,8 +892,19 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
                 return rc;
         }
 
-        max_num = (tcon->ses->server->maxBuf - sizeof(struct smb_hdr)) /
-                  sizeof(LOCKING_ANDX_RANGE);
+        /*
+         * Accessing maxBuf is racy with cifs_reconnect - need to store value
+         * and check it for zero before using.
+         */
+        max_buf = tcon->ses->server->maxBuf;
+        if (!max_buf) {
+                mutex_unlock(&cinode->lock_mutex);
+                FreeXid(xid);
+                return -EINVAL;
+        }
+
+        max_num = (max_buf - sizeof(struct smb_hdr)) /
+                                                sizeof(LOCKING_ANDX_RANGE);
         buf = kzalloc(max_num * sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
         if (!buf) {
                 mutex_unlock(&cinode->lock_mutex);
@@ -1218,7 +1229,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, int xid)
         int types[] = {LOCKING_ANDX_LARGE_FILES,
                        LOCKING_ANDX_SHARED_LOCK | LOCKING_ANDX_LARGE_FILES};
         unsigned int i;
-        unsigned int max_num, num;
+        unsigned int max_num, num, max_buf;
         LOCKING_ANDX_RANGE *buf, *cur;
         struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
         struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode);
@@ -1228,8 +1239,16 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, int xid)
 
         INIT_LIST_HEAD(&tmp_llist);
 
-        max_num = (tcon->ses->server->maxBuf - sizeof(struct smb_hdr)) /
-                  sizeof(LOCKING_ANDX_RANGE);
+        /*
+         * Accessing maxBuf is racy with cifs_reconnect - need to store value
+         * and check it for zero before using.
+         */
+        max_buf = tcon->ses->server->maxBuf;
+        if (!max_buf)
+                return -EINVAL;
+
+        max_num = (max_buf - sizeof(struct smb_hdr)) /
+                                                sizeof(LOCKING_ANDX_RANGE);
         buf = kzalloc(max_num * sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
@@ -1247,46 +1266,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, int xid)
                                 continue;
                         if (types[i] != li->type)
                                 continue;
-                        if (!cinode->can_cache_brlcks) {
-                                cur->Pid = cpu_to_le16(li->pid);
-                                cur->LengthLow = cpu_to_le32((u32)li->length);
-                                cur->LengthHigh =
-                                        cpu_to_le32((u32)(li->length>>32));
-                                cur->OffsetLow = cpu_to_le32((u32)li->offset);
-                                cur->OffsetHigh =
-                                        cpu_to_le32((u32)(li->offset>>32));
-                                /*
-                                 * We need to save a lock here to let us add
-                                 * it again to the file's list if the unlock
-                                 * range request fails on the server.
-                                 */
-                                list_move(&li->llist, &tmp_llist);
-                                if (++num == max_num) {
-                                        stored_rc = cifs_lockv(xid, tcon,
-                                                               cfile->netfid,
-                                                               li->type, num,
-                                                               0, buf);
-                                        if (stored_rc) {
-                                                /*
-                                                 * We failed on the unlock range
-                                                 * request - add all locks from
-                                                 * the tmp list to the head of
-                                                 * the file's list.
-                                                 */
-                                                cifs_move_llist(&tmp_llist,
-                                                                &cfile->llist);
-                                                rc = stored_rc;
-                                        } else
-                                                /*
-                                                 * The unlock range request
-                                                 * succeed - free the tmp list.
-                                                 */
-                                                cifs_free_llist(&tmp_llist);
-                                        cur = buf;
-                                        num = 0;
-                                } else
-                                        cur++;
-                        } else {
+                        if (cinode->can_cache_brlcks) {
                                 /*
                                  * We can cache brlock requests - simply remove
                                  * a lock from the file's list.
@@ -1294,7 +1274,41 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, int xid)
                                 list_del(&li->llist);
                                 cifs_del_lock_waiters(li);
                                 kfree(li);
+                                continue;
                         }
+                        cur->Pid = cpu_to_le16(li->pid);
+                        cur->LengthLow = cpu_to_le32((u32)li->length);
+                        cur->LengthHigh = cpu_to_le32((u32)(li->length>>32));
+                        cur->OffsetLow = cpu_to_le32((u32)li->offset);
+                        cur->OffsetHigh = cpu_to_le32((u32)(li->offset>>32));
+                        /*
+                         * We need to save a lock here to let us add it again to
+                         * the file's list if the unlock range request fails on
+                         * the server.
+                         */
+                        list_move(&li->llist, &tmp_llist);
+                        if (++num == max_num) {
+                                stored_rc = cifs_lockv(xid, tcon, cfile->netfid,
+                                                       li->type, num, 0, buf);
+                                if (stored_rc) {
+                                        /*
+                                         * We failed on the unlock range
+                                         * request - add all locks from the tmp
+                                         * list to the head of the file's list.
+                                         */
+                                        cifs_move_llist(&tmp_llist,
+                                                        &cfile->llist);
+                                        rc = stored_rc;
+                                } else
+                                        /*
+                                         * The unlock range request succeed -
+                                         * free the tmp list.
+                                         */
+                                        cifs_free_llist(&tmp_llist);
+                                cur = buf;
+                                num = 0;
+                        } else
+                                cur++;
                 }
                 if (num) {
                         stored_rc = cifs_lockv(xid, tcon, cfile->netfid,
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index e2552d2b2e42..557506ae1e2a 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -212,93 +212,6 @@ cifs_small_buf_release(void *buf_to_free)
         return;
 }
 
-/*
- * Find a free multiplex id (SMB mid). Otherwise there could be
- * mid collisions which might cause problems, demultiplexing the
- * wrong response to this request. Multiplex ids could collide if
- * one of a series requests takes much longer than the others, or
- * if a very large number of long lived requests (byte range
- * locks or FindNotify requests) are pending. No more than
- * 64K-1 requests can be outstanding at one time. If no
- * mids are available, return zero. A future optimization
- * could make the combination of mids and uid the key we use
- * to demultiplex on (rather than mid alone).
- * In addition to the above check, the cifs demultiplex
- * code already used the command code as a secondary
- * check of the frame and if signing is negotiated the
- * response would be discarded if the mid were the same
- * but the signature was wrong. Since the mid is not put in the
- * pending queue until later (when it is about to be dispatched)
- * we do have to limit the number of outstanding requests
- * to somewhat less than 64K-1 although it is hard to imagine
- * so many threads being in the vfs at one time.
- */
-__u64 GetNextMid(struct TCP_Server_Info *server)
-{
-        __u64 mid = 0;
-        __u16 last_mid, cur_mid;
-        bool collision;
-
-        spin_lock(&GlobalMid_Lock);
-
-        /* mid is 16 bit only for CIFS/SMB */
-        cur_mid = (__u16)((server->CurrentMid) & 0xffff);
-        /* we do not want to loop forever */
-        last_mid = cur_mid;
-        cur_mid++;
-
-        /*
-         * This nested loop looks more expensive than it is.
-         * In practice the list of pending requests is short,
-         * fewer than 50, and the mids are likely to be unique
-         * on the first pass through the loop unless some request
-         * takes longer than the 64 thousand requests before it
-         * (and it would also have to have been a request that
-         * did not time out).
-         */
-        while (cur_mid != last_mid) {
-                struct mid_q_entry *mid_entry;
-                unsigned int num_mids;
-
-                collision = false;
-                if (cur_mid == 0)
-                        cur_mid++;
-
-                num_mids = 0;
-                list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
-                        ++num_mids;
-                        if (mid_entry->mid == cur_mid &&
-                            mid_entry->mid_state == MID_REQUEST_SUBMITTED) {
-                                /* This mid is in use, try a different one */
-                                collision = true;
-                                break;
-                        }
-                }
-
-                /*
-                 * if we have more than 32k mids in the list, then something
-                 * is very wrong. Possibly a local user is trying to DoS the
-                 * box by issuing long-running calls and SIGKILL'ing them. If
-                 * we get to 2^16 mids then we're in big trouble as this
-                 * function could loop forever.
-                 *
-                 * Go ahead and assign out the mid in this situation, but force
-                 * an eventual reconnect to clean out the pending_mid_q.
-                 */
-                if (num_mids > 32768)
-                        server->tcpStatus = CifsNeedReconnect;
-
-                if (!collision) {
-                        mid = (__u64)cur_mid;
-                        server->CurrentMid = mid;
-                        break;
-                }
-                cur_mid++;
-        }
-        spin_unlock(&GlobalMid_Lock);
-        return mid;
-}
-
 /* NB: MID can not be set if treeCon not passed in, in that
    case it is responsbility of caller to set the mid */
 void
@@ -334,7 +247,7 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
 
                         /* Uid is not converted */
                         buffer->Uid = treeCon->ses->Suid;
-                        buffer->Mid = GetNextMid(treeCon->ses->server);
+                        buffer->Mid = get_next_mid(treeCon->ses->server);
                 }
                 if (treeCon->Flags & SMB_SHARE_IS_IN_DFS)
                         buffer->Flags2 |= SMBFLG2_DFS;
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index d9d615fbed3f..6dec38f5522d 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -125,6 +125,94 @@ cifs_get_credits_field(struct TCP_Server_Info *server)
         return &server->credits;
 }
 
+/*
+ * Find a free multiplex id (SMB mid). Otherwise there could be
+ * mid collisions which might cause problems, demultiplexing the
+ * wrong response to this request. Multiplex ids could collide if
+ * one of a series requests takes much longer than the others, or
+ * if a very large number of long lived requests (byte range
+ * locks or FindNotify requests) are pending. No more than
+ * 64K-1 requests can be outstanding at one time. If no
+ * mids are available, return zero. A future optimization
+ * could make the combination of mids and uid the key we use
+ * to demultiplex on (rather than mid alone).
+ * In addition to the above check, the cifs demultiplex
+ * code already used the command code as a secondary
+ * check of the frame and if signing is negotiated the
+ * response would be discarded if the mid were the same
+ * but the signature was wrong. Since the mid is not put in the
+ * pending queue until later (when it is about to be dispatched)
+ * we do have to limit the number of outstanding requests
+ * to somewhat less than 64K-1 although it is hard to imagine
+ * so many threads being in the vfs at one time.
+ */
+static __u64
+cifs_get_next_mid(struct TCP_Server_Info *server)
+{
+        __u64 mid = 0;
+        __u16 last_mid, cur_mid;
+        bool collision;
+
+        spin_lock(&GlobalMid_Lock);
+
+        /* mid is 16 bit only for CIFS/SMB */
+        cur_mid = (__u16)((server->CurrentMid) & 0xffff);
+        /* we do not want to loop forever */
+        last_mid = cur_mid;
+        cur_mid++;
+
+        /*
+         * This nested loop looks more expensive than it is.
+         * In practice the list of pending requests is short,
+         * fewer than 50, and the mids are likely to be unique
+         * on the first pass through the loop unless some request
+         * takes longer than the 64 thousand requests before it
+         * (and it would also have to have been a request that
+         * did not time out).
+         */
+        while (cur_mid != last_mid) {
+                struct mid_q_entry *mid_entry;
+                unsigned int num_mids;
+
+                collision = false;
+                if (cur_mid == 0)
+                        cur_mid++;
+
+                num_mids = 0;
+                list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
+                        ++num_mids;
+                        if (mid_entry->mid == cur_mid &&
+                            mid_entry->mid_state == MID_REQUEST_SUBMITTED) {
+                                /* This mid is in use, try a different one */
+                                collision = true;
+                                break;
+                        }
+                }
+
+                /*
+                 * if we have more than 32k mids in the list, then something
+                 * is very wrong. Possibly a local user is trying to DoS the
+                 * box by issuing long-running calls and SIGKILL'ing them. If
+                 * we get to 2^16 mids then we're in big trouble as this
+                 * function could loop forever.
+                 *
+                 * Go ahead and assign out the mid in this situation, but force
+                 * an eventual reconnect to clean out the pending_mid_q.
+                 */
+                if (num_mids > 32768)
+                        server->tcpStatus = CifsNeedReconnect;
+
+                if (!collision) {
+                        mid = (__u64)cur_mid;
+                        server->CurrentMid = mid;
+                        break;
+                }
+                cur_mid++;
+        }
+        spin_unlock(&GlobalMid_Lock);
+        return mid;
+}
+
 struct smb_version_operations smb1_operations = {
         .send_cancel = send_nt_cancel,
         .compare_fids = cifs_compare_fids,
@@ -133,6 +221,7 @@ struct smb_version_operations smb1_operations = {
         .add_credits = cifs_add_credits,
         .set_credits = cifs_set_credits,
         .get_credits_field = cifs_get_credits_field,
+        .get_next_mid = cifs_get_next_mid,
         .read_data_offset = cifs_read_data_offset,
         .read_data_length = cifs_read_data_length,
         .map_error = map_smb_to_linux_error,
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 1b36ffe6a47b..3097ee58fd7d 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -779,7 +779,7 @@ send_lock_cancel(const unsigned int xid, struct cifs_tcon *tcon,
 
         pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
         pSMB->Timeout = 0;
-        pSMB->hdr.Mid = GetNextMid(ses->server);
+        pSMB->hdr.Mid = get_next_mid(ses->server);
 
         return SendReceive(xid, ses, in_buf, out_buf,
                         &bytes_returned, 0);
diff --git a/fs/dcache.c b/fs/dcache.c
index 85c9e2bff8e6..40469044088d 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -683,6 +683,8 @@ EXPORT_SYMBOL(dget_parent);
 /**
  * d_find_alias - grab a hashed alias of inode
  * @inode: inode in question
+ * @want_discon:  flag, used by d_splice_alias, to request
+ *          that only a DISCONNECTED alias be returned.
  *
  * If inode has a hashed alias, or is a directory and has any alias,
  * acquire the reference to alias and return it. Otherwise return NULL.
@@ -691,9 +693,10 @@ EXPORT_SYMBOL(dget_parent);
  * of a filesystem.
  *
  * If the inode has an IS_ROOT, DCACHE_DISCONNECTED alias, then prefer
- * any other hashed alias over that.
+ * any other hashed alias over that one unless @want_discon is set,
+ * in which case only return an IS_ROOT, DCACHE_DISCONNECTED alias.
  */
-static struct dentry *__d_find_alias(struct inode *inode)
+static struct dentry *__d_find_alias(struct inode *inode, int want_discon)
 {
         struct dentry *alias, *discon_alias;
 
@@ -705,7 +708,7 @@ again:
                         if (IS_ROOT(alias) &&
                             (alias->d_flags & DCACHE_DISCONNECTED)) {
                                 discon_alias = alias;
-                        } else {
+                        } else if (!want_discon) {
                                 __dget_dlock(alias);
                                 spin_unlock(&alias->d_lock);
                                 return alias;
@@ -736,7 +739,7 @@ struct dentry *d_find_alias(struct inode *inode)
 
         if (!list_empty(&inode->i_dentry)) {
                 spin_lock(&inode->i_lock);
-                de = __d_find_alias(inode);
+                de = __d_find_alias(inode, 0);
                 spin_unlock(&inode->i_lock);
         }
         return de;
@@ -1647,8 +1650,9 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
 
         if (inode && S_ISDIR(inode->i_mode)) {
                 spin_lock(&inode->i_lock);
-                new = __d_find_any_alias(inode);
+                new = __d_find_alias(inode, 1);
                 if (new) {
+                        BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED));
                         spin_unlock(&inode->i_lock);
                         security_d_instantiate(new, inode);
                         d_move(new, dentry);
@@ -2478,7 +2482,7 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                 struct dentry *alias;
 
                 /* Does an aliased dentry already exist? */
-                alias = __d_find_alias(inode);
+                alias = __d_find_alias(inode, 0);
                 if (alias) {
                         actual = alias;
                         write_seqlock(&rename_lock);
diff --git a/fs/exofs/sys.c b/fs/exofs/sys.c
index e32bc919e4e3..5a7b691e748b 100644
--- a/fs/exofs/sys.c
+++ b/fs/exofs/sys.c
@@ -109,7 +109,7 @@ static struct kobj_type odev_ktype = {
 static struct kobj_type uuid_ktype = {
 };
 
-void exofs_sysfs_dbg_print()
+void exofs_sysfs_dbg_print(void)
 {
 #ifdef CONFIG_EXOFS_DEBUG
         struct kobject *k_name, *k_tmp;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 99b6324290db..cee7812cc3cf 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -90,8 +90,8 @@ unsigned ext4_num_overhead_clusters(struct super_block *sb,
          * unusual file system layouts.
          */
         if (ext4_block_in_group(sb, ext4_block_bitmap(sb, gdp), block_group)) {
-                block_cluster = EXT4_B2C(sbi, (start -
-                                               ext4_block_bitmap(sb, gdp)));
+                block_cluster = EXT4_B2C(sbi,
+                                         ext4_block_bitmap(sb, gdp) - start);
                 if (block_cluster < num_clusters)
                         block_cluster = -1;
                 else if (block_cluster == num_clusters) {
@@ -102,7 +102,7 @@ unsigned ext4_num_overhead_clusters(struct super_block *sb,
 
         if (ext4_block_in_group(sb, ext4_inode_bitmap(sb, gdp), block_group)) {
                 inode_cluster = EXT4_B2C(sbi,
-                                         start - ext4_inode_bitmap(sb, gdp));
+                                         ext4_inode_bitmap(sb, gdp) - start);
                 if (inode_cluster < num_clusters)
                         inode_cluster = -1;
                 else if (inode_cluster == num_clusters) {
@@ -114,7 +114,7 @@ unsigned ext4_num_overhead_clusters(struct super_block *sb,
         itbl_blk = ext4_inode_table(sb, gdp);
         for (i = 0; i < sbi->s_itb_per_group; i++) {
                 if (ext4_block_in_group(sb, itbl_blk + i, block_group)) {
-                        c = EXT4_B2C(sbi, start - itbl_blk + i);
+                        c = EXT4_B2C(sbi, itbl_blk + i - start);
                         if ((c < num_clusters) || (c == inode_cluster) ||
                             (c == block_cluster) || (c == itbl_cluster))
                                 continue;
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 8ad112ae0ade..e34deac3f366 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -123,7 +123,6 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                         else
                                 ext4_clear_inode_flag(inode, i);
                 }
-                ei->i_flags = flags;
 
                 ext4_set_inode_flags(inode);
                 inode->i_ctime = ext4_current_time(inode);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 8d2fb8c88cf3..41a3ccff18d8 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -664,6 +664,7 @@ static long writeback_sb_inodes(struct super_block *sb,
                         /* Wait for I_SYNC. This function drops i_lock... */
                         inode_sleep_on_writeback(inode);
                         /* Inode may be gone, start again */
+                        spin_lock(&wb->list_lock);
                         continue;
                 }
                 inode->i_state |= I_SYNC;
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index 42593c587d48..03ff5b1eba93 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -75,19 +75,13 @@ static ssize_t fuse_conn_limit_write(struct file *file, const char __user *buf,
                                      unsigned global_limit)
 {
         unsigned long t;
-        char tmp[32];
         unsigned limit = (1 << 16) - 1;
         int err;
 
-        if (*ppos || count >= sizeof(tmp) - 1)
-                return -EINVAL;
-
-        if (copy_from_user(tmp, buf, count))
+        if (*ppos)
                 return -EINVAL;
 
-        tmp[count] = '\0';
-
-        err = strict_strtoul(tmp, 0, &t);
+        err = kstrtoul_from_user(buf, count, 0, &t);
         if (err)
                 return err;
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index df5ac048dc74..334e0b18a014 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -775,6 +775,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir,
 static void fuse_fillattr(struct inode *inode, struct fuse_attr *attr,
                           struct kstat *stat)
 {
+        unsigned int blkbits;
+
         stat->dev = inode->i_sb->s_dev;
         stat->ino = attr->ino;
         stat->mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
@@ -790,7 +792,13 @@ static void fuse_fillattr(struct inode *inode, struct fuse_attr *attr,
         stat->ctime.tv_nsec = attr->ctimensec;
         stat->size = attr->size;
         stat->blocks = attr->blocks;
-        stat->blksize = (1 << inode->i_blkbits);
+
+        if (attr->blksize != 0)
+                blkbits = ilog2(attr->blksize);
+        else
+                blkbits = inode->i_sb->s_blocksize_bits;
+
+        stat->blksize = 1 << blkbits;
 }
 
 static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
@@ -863,6 +871,7 @@ int fuse_update_attributes(struct inode *inode, struct kstat *stat,
                 if (stat) {
                         generic_fillattr(inode, stat);
                         stat->mode = fi->orig_i_mode;
+                        stat->ino = fi->orig_ino;
                 }
         }
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 9562109d3a87..b321a688cde7 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2173,6 +2173,44 @@ fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
         return ret;
 }
 
+long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
+                            loff_t length)
+{
+        struct fuse_file *ff = file->private_data;
+        struct fuse_conn *fc = ff->fc;
+        struct fuse_req *req;
+        struct fuse_fallocate_in inarg = {
+                .fh = ff->fh,
+                .offset = offset,
+                .length = length,
+                .mode = mode
+        };
+        int err;
+
+        if (fc->no_fallocate)
+                return -EOPNOTSUPP;
+
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+
+        req->in.h.opcode = FUSE_FALLOCATE;
+        req->in.h.nodeid = ff->nodeid;
+        req->in.numargs = 1;
+        req->in.args[0].size = sizeof(inarg);
+        req->in.args[0].value = &inarg;
+        fuse_request_send(fc, req);
+        err = req->out.h.error;
+        if (err == -ENOSYS) {
+                fc->no_fallocate = 1;
+                err = -EOPNOTSUPP;
+        }
+        fuse_put_request(fc, req);
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(fuse_file_fallocate);
+
 static const struct file_operations fuse_file_operations = {
         .llseek         = fuse_file_llseek,
         .read           = do_sync_read,
@@ -2190,6 +2228,7 @@ static const struct file_operations fuse_file_operations = {
         .unlocked_ioctl = fuse_file_ioctl,
         .compat_ioctl   = fuse_file_compat_ioctl,
         .poll           = fuse_file_poll,
+        .fallocate      = fuse_file_fallocate,
 };
 
 static const struct file_operations fuse_direct_io_file_operations = {
@@ -2206,6 +2245,7 @@ static const struct file_operations fuse_direct_io_file_operations = {
         .unlocked_ioctl = fuse_file_ioctl,
         .compat_ioctl   = fuse_file_compat_ioctl,
         .poll           = fuse_file_poll,
+        .fallocate      = fuse_file_fallocate,
         /* no splice_read */
 };
 
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 572cefc78012..771fb6322c07 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -82,6 +82,9 @@ struct fuse_inode {
             preserve the original mode */
         umode_t orig_i_mode;
 
+        /** 64 bit inode number */
+        u64 orig_ino;
+
         /** Version of last attribute change */
         u64 attr_version;
 
@@ -478,6 +481,9 @@ struct fuse_conn {
         /** Are BSD file locking primitives not implemented by fs? */
         unsigned no_flock:1;
 
+        /** Is fallocate not implemented by fs? */
+        unsigned no_fallocate:1;
+
         /** The number of requests waiting for completion */
         atomic_t num_waiting;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 42678a33b7bb..1cd61652018c 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -91,6 +91,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
         fi->nlookup = 0;
         fi->attr_version = 0;
         fi->writectr = 0;
+        fi->orig_ino = 0;
         INIT_LIST_HEAD(&fi->write_files);
         INIT_LIST_HEAD(&fi->queued_writes);
         INIT_LIST_HEAD(&fi->writepages);
@@ -139,6 +140,18 @@ static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
         return 0;
 }
 
+/*
+ * ino_t is 32-bits on 32-bit arch. We have to squash the 64-bit value down
+ * so that it will fit.
+ */
+static ino_t fuse_squash_ino(u64 ino64)
+{
+        ino_t ino = (ino_t) ino64;
+        if (sizeof(ino_t) < sizeof(u64))
+                ino ^= ino64 >> (sizeof(u64) - sizeof(ino_t)) * 8;
+        return ino;
+}
+
 void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
                                    u64 attr_valid)
 {
@@ -148,7 +161,7 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
         fi->attr_version = ++fc->attr_version;
         fi->i_time = attr_valid;
 
-        inode->i_ino     = attr->ino;
+        inode->i_ino     = fuse_squash_ino(attr->ino);
         inode->i_mode    = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
         set_nlink(inode, attr->nlink);
         inode->i_uid     = attr->uid;
@@ -174,6 +187,8 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
         fi->orig_i_mode = inode->i_mode;
         if (!(fc->flags & FUSE_DEFAULT_PERMISSIONS))
                 inode->i_mode &= ~S_ISVTX;
+
+        fi->orig_ino = attr->ino;
 }
 
 void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 970659daa323..23ff18fe080a 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -17,7 +17,6 @@
 #include <linux/kthread.h>
 #include <linux/sunrpc/svcauth_gss.h>
 #include <linux/sunrpc/bc_xprt.h>
-#include <linux/nsproxy.h>
 
 #include <net/inet_sock.h>
 
@@ -107,7 +106,7 @@ nfs4_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt)
 {
         int ret;
 
-        ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET,
+        ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET,
                                 nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
         if (ret <= 0)
                 goto out_err;
@@ -115,7 +114,7 @@ nfs4_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt)
         dprintk("NFS: Callback listener port = %u (af %u)\n",
                         nfs_callback_tcpport, PF_INET);
 
-        ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET6,
+        ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET6,
                                 nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
         if (ret > 0) {
                 nfs_callback_tcpport6 = ret;
@@ -184,7 +183,7 @@ nfs41_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt)
          * fore channel connection.
          * Returns the input port (0) and sets the svc_serv bc_xprt on success
          */
-        ret = svc_create_xprt(serv, "tcp-bc", xprt->xprt_net, PF_INET, 0,
+        ret = svc_create_xprt(serv, "tcp-bc", &init_net, PF_INET, 0,
                               SVC_SOCK_ANONYMOUS);
         if (ret < 0) {
                 rqstp = ERR_PTR(ret);
@@ -254,7 +253,7 @@ int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt)
         char svc_name[12];
         int ret = 0;
         int minorversion_setup;
-        struct net *net = current->nsproxy->net_ns;
+        struct net *net = &init_net;
 
         mutex_lock(&nfs_callback_mutex);
         if (cb_info->users++ || cb_info->task != NULL) {
@@ -330,7 +329,7 @@ void nfs_callback_down(int minorversion)
         cb_info->users--;
         if (cb_info->users == 0 && cb_info->task != NULL) {
                 kthread_stop(cb_info->task);
-                svc_shutdown_net(cb_info->serv, current->nsproxy->net_ns);
+                svc_shutdown_net(cb_info->serv, &init_net);
                 svc_exit_thread(cb_info->rqst);
                 cb_info->serv = NULL;
                 cb_info->rqst = NULL;
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 95bfc243992c..e64b01d2a338 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
         args->csa_nrclists = ntohl(*p++);
         args->csa_rclists = NULL;
         if (args->csa_nrclists) {
-                args->csa_rclists = kmalloc(args->csa_nrclists *
-                                            sizeof(*args->csa_rclists),
-                                            GFP_KERNEL);
+                args->csa_rclists = kmalloc_array(args->csa_nrclists,
+                                                  sizeof(*args->csa_rclists),
+                                                  GFP_KERNEL);
                 if (unlikely(args->csa_rclists == NULL))
                         goto out;
 
@@ -696,7 +696,7 @@ static __be32 encode_cb_sequence_res(struct svc_rqst *rqstp,
                                        const struct cb_sequenceres *res)
 {
         __be32 *p;
-        unsigned status = res->csr_status;
+        __be32 status = res->csr_status;
 
         if (unlikely(status != 0))
                 goto out;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 7d108753af81..17ba6b995659 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -544,8 +544,6 @@ nfs_found_client(const struct nfs_client_initdata *cl_init,
 
         smp_rmb();
 
-        BUG_ON(clp->cl_cons_state != NFS_CS_READY);
-
         dprintk("<-- %s found nfs_client %p for %s\n",
                 __func__, clp, cl_init->hostname ?: "");
         return clp;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index ad2775d3e219..3168f6e3d4d4 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -523,9 +523,9 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)
                 nfs_list_remove_request(req);
                 if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES) {
                         /* Note the rewrite will go through mds */
-                        kref_get(&req->wb_kref);
                         nfs_mark_request_commit(req, NULL, &cinfo);
-                }
+                } else
+                        nfs_release_request(req);
                 nfs_unlock_and_release_request(req);
         }
 
@@ -716,12 +716,12 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
                         if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
                                 bit = NFS_IOHDR_NEED_RESCHED;
                         else if (dreq->flags == 0) {
-                                memcpy(&dreq->verf, &req->wb_verf,
+                                memcpy(&dreq->verf, hdr->verf,
                                        sizeof(dreq->verf));
                                 bit = NFS_IOHDR_NEED_COMMIT;
                                 dreq->flags = NFS_ODIRECT_DO_COMMIT;
                         } else if (dreq->flags == NFS_ODIRECT_DO_COMMIT) {
-                                if (memcmp(&dreq->verf, &req->wb_verf, sizeof(dreq->verf))) {
+                                if (memcmp(&dreq->verf, hdr->verf, sizeof(dreq->verf))) {
                                         dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
                                         bit = NFS_IOHDR_NEED_RESCHED;
                                 } else
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index c6827f93ab57..cc5900ac61b5 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -295,7 +295,7 @@ is_ds_client(struct nfs_client *clp)
 
 extern const struct nfs4_minor_version_ops *nfs_v4_minor_ops[];
 
-extern const u32 nfs4_fattr_bitmap[2];
+extern const u32 nfs4_fattr_bitmap[3];
 extern const u32 nfs4_statfs_bitmap[2];
 extern const u32 nfs4_pathconf_bitmap[2];
 extern const u32 nfs4_fsinfo_bitmap[3];
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index d48dbefa0e71..15fc7e4664ed 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -105,6 +105,8 @@ static int nfs4_map_errors(int err)
                 return -EINVAL;
         case -NFS4ERR_SHARE_DENIED:
                 return -EACCES;
+        case -NFS4ERR_MINOR_VERS_MISMATCH:
+                return -EPROTONOSUPPORT;
         default:
                 dprintk("%s could not handle NFSv4 error %d\n",
                                 __func__, -err);
@@ -116,7 +118,7 @@ static int nfs4_map_errors(int err)
 /*
  * This is our standard bitmap for GETATTR requests.
  */
-const u32 nfs4_fattr_bitmap[2] = {
+const u32 nfs4_fattr_bitmap[3] = {
         FATTR4_WORD0_TYPE
         | FATTR4_WORD0_CHANGE
         | FATTR4_WORD0_SIZE
@@ -133,6 +135,24 @@ const u32 nfs4_fattr_bitmap[2] = {
         | FATTR4_WORD1_TIME_MODIFY
 };
 
+static const u32 nfs4_pnfs_open_bitmap[3] = {
+        FATTR4_WORD0_TYPE
+        | FATTR4_WORD0_CHANGE
+        | FATTR4_WORD0_SIZE
+        | FATTR4_WORD0_FSID
+        | FATTR4_WORD0_FILEID,
+        FATTR4_WORD1_MODE
+        | FATTR4_WORD1_NUMLINKS
+        | FATTR4_WORD1_OWNER
+        | FATTR4_WORD1_OWNER_GROUP
+        | FATTR4_WORD1_RAWDEV
+        | FATTR4_WORD1_SPACE_USED
+        | FATTR4_WORD1_TIME_ACCESS
+        | FATTR4_WORD1_TIME_METADATA
+        | FATTR4_WORD1_TIME_MODIFY,
+        FATTR4_WORD2_MDSTHRESHOLD
+};
+
 const u32 nfs4_statfs_bitmap[2] = {
         FATTR4_WORD0_FILES_AVAIL
         | FATTR4_WORD0_FILES_FREE
@@ -844,6 +864,7 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
         p->o_arg.name = &dentry->d_name;
         p->o_arg.server = server;
         p->o_arg.bitmask = server->attr_bitmask;
+        p->o_arg.open_bitmap = &nfs4_fattr_bitmap[0];
         p->o_arg.claim = NFS4_OPEN_CLAIM_NULL;
         if (attrs != NULL && attrs->ia_valid != 0) {
                 __be32 verf[2];
@@ -1820,6 +1841,7 @@ static int _nfs4_do_open(struct inode *dir,
                 opendata->f_attr.mdsthreshold = pnfs_mdsthreshold_alloc();
                 if (!opendata->f_attr.mdsthreshold)
                         goto err_opendata_put;
+                opendata->o_arg.open_bitmap = &nfs4_pnfs_open_bitmap[0];
         }
         if (dentry->d_inode != NULL)
                 opendata->state = nfs4_get_open_state(dentry->d_inode, sp);
@@ -1880,6 +1902,7 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
         struct nfs4_state *res;
         int status;
 
+        fmode &= FMODE_READ|FMODE_WRITE;
         do {
                 status = _nfs4_do_open(dir, dentry, fmode, flags, sattr, cred,
                                        &res, ctx_th);
@@ -2526,6 +2549,14 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
 
         nfs_fattr_init(fattr);
         
+        /* Deal with open(O_TRUNC) */
+        if (sattr->ia_valid & ATTR_OPEN)
+                sattr->ia_valid &= ~(ATTR_MTIME|ATTR_CTIME|ATTR_OPEN);
+
+        /* Optimization: if the end result is no change, don't RPC */
+        if ((sattr->ia_valid & ~(ATTR_FILE)) == 0)
+                return 0;
+
         /* Search for an existing open(O_WRITE) file */
         if (sattr->ia_valid & ATTR_FILE) {
                 struct nfs_open_context *ctx;
@@ -2537,10 +2568,6 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
                 }
         }
 
-        /* Deal with open(O_TRUNC) */
-        if (sattr->ia_valid & ATTR_OPEN)
-                sattr->ia_valid &= ~(ATTR_MTIME|ATTR_CTIME|ATTR_OPEN);
-
         status = nfs4_do_setattr(inode, cred, fattr, sattr, state);
         if (status == 0)
                 nfs_setattr_update_inode(inode, sattr);
@@ -5275,7 +5302,7 @@ static int _nfs4_proc_destroy_clientid(struct nfs_client *clp,
 
         status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (status)
-                pr_warn("NFS: Got error %d from the server %s on "
+                dprintk("NFS: Got error %d from the server %s on "
                         "DESTROY_CLIENTID.", status, clp->cl_hostname);
         return status;
 }
@@ -5746,8 +5773,7 @@ int nfs4_proc_destroy_session(struct nfs4_session *session,
         status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
 
         if (status)
-                printk(KERN_WARNING
-                        "NFS: Got error %d from the server on DESTROY_SESSION. "
+                dprintk("NFS: Got error %d from the server on DESTROY_SESSION. "
                         "Session has been destroyed regardless...\n", status);
 
         dprintk("<-- nfs4_proc_destroy_session\n");
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index c679b9ecef63..f38300e9f171 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -244,6 +244,16 @@ static int nfs4_begin_drain_session(struct nfs_client *clp)
         return nfs4_wait_on_slot_tbl(&ses->fc_slot_table);
 }
 
+static void nfs41_finish_session_reset(struct nfs_client *clp)
+{
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+        clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+        /* create_session negotiated new slot table */
+        clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+        clear_bit(NFS4CLNT_BIND_CONN_TO_SESSION, &clp->cl_state);
+        nfs41_setup_state_renewal(clp);
+}
+
 int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
         int status;
@@ -259,8 +269,7 @@ do_confirm:
         status = nfs4_proc_create_session(clp, cred);
         if (status != 0)
                 goto out;
-        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
-        nfs41_setup_state_renewal(clp);
+        nfs41_finish_session_reset(clp);
         nfs_mark_client_ready(clp, NFS_CS_READY);
 out:
         return status;
@@ -1772,16 +1781,9 @@ static int nfs4_reset_session(struct nfs_client *clp)
                 status = nfs4_handle_reclaim_lease_error(clp, status);
                 goto out;
         }
-        clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
-        /* create_session negotiated new slot table */
-        clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
-        clear_bit(NFS4CLNT_BIND_CONN_TO_SESSION, &clp->cl_state);
+        nfs41_finish_session_reset(clp);
         dprintk("%s: session reset was successful for server %s!\n",
                         __func__, clp->cl_hostname);
-
-         /* Let the state manager reestablish state */
-        if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
-                nfs41_setup_state_renewal(clp);
 out:
         if (cred)
                 put_rpccred(cred);
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index ee4a74db95d0..18fae29b0301 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1198,12 +1198,13 @@ static void encode_getfattr(struct xdr_stream *xdr, const u32* bitmask, struct c
 }
 
 static void encode_getfattr_open(struct xdr_stream *xdr, const u32 *bitmask,
+                                 const u32 *open_bitmap,
                                  struct compound_hdr *hdr)
 {
         encode_getattr_three(xdr,
-                             bitmask[0] & nfs4_fattr_bitmap[0],
-                             bitmask[1] & nfs4_fattr_bitmap[1],
-                             bitmask[2] & FATTR4_WORD2_MDSTHRESHOLD,
+                             bitmask[0] & open_bitmap[0],
+                             bitmask[1] & open_bitmap[1],
+                             bitmask[2] & open_bitmap[2],
                              hdr);
 }
 
@@ -2221,7 +2222,7 @@ static void nfs4_xdr_enc_open(struct rpc_rqst *req, struct xdr_stream *xdr,
         encode_putfh(xdr, args->fh, &hdr);
         encode_open(xdr, args, &hdr);
         encode_getfh(xdr, &hdr);
-        encode_getfattr_open(xdr, args->bitmask, &hdr);
+        encode_getfattr_open(xdr, args->bitmask, args->open_bitmap, &hdr);
         encode_nops(&hdr);
 }
 
@@ -4359,7 +4360,10 @@ static int decode_attr_mdsthreshold(struct xdr_stream *xdr,
 
         if (unlikely(bitmap[2] & (FATTR4_WORD2_MDSTHRESHOLD - 1U)))
                 return -EIO;
-        if (likely(bitmap[2] & FATTR4_WORD2_MDSTHRESHOLD)) {
+        if (bitmap[2] & FATTR4_WORD2_MDSTHRESHOLD) {
+                /* Did the server return an unrequested attribute? */
+                if (unlikely(res == NULL))
+                        return -EREMOTEIO;
                 p = xdr_inline_decode(xdr, 4);
                 if (unlikely(!p))
                         goto out_overflow;
@@ -4372,6 +4376,7 @@ static int decode_attr_mdsthreshold(struct xdr_stream *xdr,
                                 __func__);
 
                 status = decode_first_threshold_item4(xdr, res);
+                bitmap[2] &= ~FATTR4_WORD2_MDSTHRESHOLD;
         }
         return status;
 out_overflow:
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 29fd23c0efdc..64f90d845f6a 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -365,7 +365,7 @@ static inline bool
 pnfs_use_threshold(struct nfs4_threshold **dst, struct nfs4_threshold *src,
                    struct nfs_server *nfss)
 {
-        return (dst && src && src->bm != 0 &&
+        return (dst && src && src->bm != 0 && nfss->pnfs_curr_ld &&
                                         nfss->pnfs_curr_ld->id == src->l_type);
 }
 
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index a706b6bcc286..617c7419a08e 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -651,7 +651,7 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
                 /* Emulate the eof flag, which isn't normally needed in NFSv2
                  * as it is guaranteed to always return the file attributes
                  */
-                if (data->args.offset + data->args.count >= data->res.fattr->size)
+                if (data->args.offset + data->res.count >= data->res.fattr->size)
                         data->res.eof = 1;
         }
         return 0;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ff656c022684..906f09c7d842 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1867,6 +1867,7 @@ static int nfs23_validate_mount_data(void *options,
         if (data == NULL)
                 goto out_no_data;
 
+        args->version = NFS_DEFAULT_VERSION;
         switch (data->version) {
         case 1:
                 data->namlen = 0;
@@ -2637,6 +2638,8 @@ static int nfs4_validate_mount_data(void *options,
         if (data == NULL)
                 goto out_no_data;
 
+        args->version = 4;
+
         switch (data->version) {
         case 1:
                 if (data->host_addrlen > sizeof(args->nfs_server.address))
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e6fe3d69d14c..4d6861c0dc14 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -80,6 +80,7 @@ struct nfs_write_header *nfs_writehdr_alloc(void)
                 INIT_LIST_HEAD(&hdr->rpc_list);
                 spin_lock_init(&hdr->lock);
                 atomic_set(&hdr->refcnt, 0);
+                hdr->verf = &p->verf;
         }
         return p;
 }
@@ -619,6 +620,7 @@ static void nfs_write_completion(struct nfs_pgio_header *hdr)
                         goto next;
                 }
                 if (test_bit(NFS_IOHDR_NEED_COMMIT, &hdr->flags)) {
+                        memcpy(&req->wb_verf, hdr->verf, sizeof(req->wb_verf));
                         nfs_mark_request_commit(req, hdr->lseg, &cinfo);
                         goto next;
                 }
@@ -1255,15 +1257,14 @@ static void nfs_writeback_release_common(void *calldata)
         struct nfs_write_data   *data = calldata;
         struct nfs_pgio_header *hdr = data->header;
         int status = data->task.tk_status;
-        struct nfs_page *req = hdr->req;
 
         if ((status >= 0) && nfs_write_need_commit(data)) {
                 spin_lock(&hdr->lock);
                 if (test_bit(NFS_IOHDR_NEED_RESCHED, &hdr->flags))
                         ; /* Do nothing */
                 else if (!test_and_set_bit(NFS_IOHDR_NEED_COMMIT, &hdr->flags))
-                        memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
-                else if (memcmp(&req->wb_verf, &data->verf, sizeof(req->wb_verf)))
+                        memcpy(hdr->verf, &data->verf, sizeof(*hdr->verf));
+                else if (memcmp(hdr->verf, &data->verf, sizeof(*hdr->verf)))
                         set_bit(NFS_IOHDR_NEED_RESCHED, &hdr->flags);
                 spin_unlock(&hdr->lock);
         }
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 8fdc9ec5c5d3..94effd5bc4a1 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -900,7 +900,7 @@ static void free_session(struct kref *kref)
         struct nfsd4_session *ses;
         int mem;
 
-        BUG_ON(!spin_is_locked(&client_lock));
+        lockdep_assert_held(&client_lock);
         ses = container_of(kref, struct nfsd4_session, se_ref);
         nfsd4_del_conns(ses);
         spin_lock(&nfsd_drc_lock);
@@ -1080,7 +1080,7 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
 static inline void
 free_client(struct nfs4_client *clp)
 {
-        BUG_ON(!spin_is_locked(&client_lock));
+        lockdep_assert_held(&client_lock);
         while (!list_empty(&clp->cl_sessions)) {
                 struct nfsd4_session *ses;
                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 616f41a7cde6..437195f204e1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1803,7 +1803,7 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
                         rcu_read_lock();
                         file = fcheck_files(files, fd);
                         if (file) {
-                                unsigned i_mode, f_mode = file->f_mode;
+                                unsigned f_mode = file->f_mode;
 
                                 rcu_read_unlock();
                                 put_files_struct(files);
@@ -1819,12 +1819,14 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
                                         inode->i_gid = GLOBAL_ROOT_GID;
                                 }
 
-                                i_mode = S_IFLNK;
-                                if (f_mode & FMODE_READ)
-                                        i_mode |= S_IRUSR | S_IXUSR;
-                                if (f_mode & FMODE_WRITE)
-                                        i_mode |= S_IWUSR | S_IXUSR;
-                                inode->i_mode = i_mode;
+                                if (S_ISLNK(inode->i_mode)) {
+                                        unsigned i_mode = S_IFLNK;
+                                        if (f_mode & FMODE_READ)
+                                                i_mode |= S_IRUSR | S_IXUSR;
+                                        if (f_mode & FMODE_WRITE)
+                                                i_mode |= S_IWUSR | S_IXUSR;
+                                        inode->i_mode = i_mode;
+                                }
 
                                 security_task_to_inode(task, inode);
                                 put_task_struct(task);
@@ -1859,6 +1861,7 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
         ei = PROC_I(inode);
         ei->fd = fd;
 
+        inode->i_mode = S_IFLNK;
         inode->i_op = &proc_pid_link_inode_operations;
         inode->i_size = 64;
         ei->op.proc_get_link = proc_fd_link;
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 685a83756b2b..84a7e6f3c046 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -2918,6 +2918,9 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
         struct dentry *dent;
         struct ubifs_debug_info *d = c->dbg;
 
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         n = snprintf(d->dfs_dir_name, UBIFS_DFS_DIR_LEN + 1, UBIFS_DFS_DIR_NAME,
                      c->vi.ubi_num, c->vi.vol_id);
         if (n == UBIFS_DFS_DIR_LEN) {
@@ -3010,7 +3013,8 @@ out:
  */
 void dbg_debugfs_exit_fs(struct ubifs_info *c)
 {
-        debugfs_remove_recursive(c->dbg->dfs_dir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove_recursive(c->dbg->dfs_dir);
 }
 
 struct ubifs_global_debug_info ubifs_dbg;
@@ -3095,6 +3099,9 @@ int dbg_debugfs_init(void)
         const char *fname;
         struct dentry *dent;
 
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         fname = "ubifs";
         dent = debugfs_create_dir(fname, NULL);
         if (IS_ERR_OR_NULL(dent))
@@ -3159,7 +3166,8 @@ out:
  */
 void dbg_debugfs_exit(void)
 {
-        debugfs_remove_recursive(dfs_rootdir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove_recursive(dfs_rootdir);
 }
 
 /**
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index b0d62820ada1..9e6e1c6eb60a 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -440,8 +440,8 @@ static inline int acpi_pm_device_sleep_wake(struct device *dev, bool enable)
 
 #else   /* CONFIG_ACPI */
 
-static int register_acpi_bus_type(struct acpi_bus_type *bus) { return 0; }
-static int unregister_acpi_bus_type(struct acpi_bus_type *bus) { return 0; }
+static inline int register_acpi_bus_type(void *bus) { return 0; }
+static inline int unregister_acpi_bus_type(void *bus) { return 0; }
 
 #endif                          /* CONFIG_ACPI */
 
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 2520a6e241dc..9f02005f217a 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -2,6 +2,7 @@
 #define _ASM_GENERIC_BUG_H
 
 #include <linux/compiler.h>
+#include <linux/kernel.h>
 
 #ifdef CONFIG_BUG
 
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 73e45600f95d..bac55c215113 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -54,7 +54,7 @@ struct drm_mode_object {
         struct drm_object_properties *properties;
 };
 
-#define DRM_OBJECT_MAX_PROPERTY 16
+#define DRM_OBJECT_MAX_PROPERTY 24
 struct drm_object_properties {
         int count;
         uint32_t ids[DRM_OBJECT_MAX_PROPERTY];
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 58d0bdab68dd..81368ab6c611 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -181,6 +181,7 @@
         {0x1002, 0x6747, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6748, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x674A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6750, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6751, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6758, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
@@ -198,6 +199,7 @@
         {0x1002, 0x6767, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6768, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6771, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6772, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
@@ -229,10 +231,11 @@
         {0x1002, 0x6827, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6829, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x682B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x6830, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x6831, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6830, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6831, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6837, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6838, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6839, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
@@ -531,6 +534,7 @@
         {0x1002, 0x9645, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9647, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
         {0x1002, 0x9648, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
+        {0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
         {0x1002, 0x964a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x964b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x964c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
@@ -550,6 +554,7 @@
         {0x1002, 0x9807, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x980A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9900, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9901, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9903, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
@@ -561,11 +566,19 @@
         {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9918, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9919, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9990, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9991, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0, 0, 0}
 
 #define r128_PCI_IDS \
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index b6d7ce92eadd..68733587e700 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -64,6 +64,7 @@ struct drm_exynos_gem_map_off {
  * A structure for mapping buffer.
  *
  * @handle: a handle to gem object created.
+ * @pad: just padding to be 64-bit aligned.
  * @size: memory size to be mapped.
  * @mapped: having user virtual address mmaped.
  *      - this variable would be filled by exynos gem module
@@ -72,7 +73,8 @@ struct drm_exynos_gem_map_off {
  */
 struct drm_exynos_gem_mmap {
         unsigned int handle;
-        unsigned int size;
+        unsigned int pad;
+        uint64_t size;
         uint64_t mapped;
 };
 
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 81e803e90aa4..acba894374a1 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -132,6 +132,7 @@ extern u64 clockevent_delta2ns(unsigned long latch,
                                struct clock_event_device *evt);
 extern void clockevents_register_device(struct clock_event_device *dev);
 
+extern void clockevents_config(struct clock_event_device *dev, u32 freq);
 extern void clockevents_config_and_register(struct clock_event_device *dev,
                                             u32 freq, unsigned long min_delta,
                                             unsigned long max_delta);
diff --git a/include/linux/compaction.h b/include/linux/compaction.h
index e988037abd2a..51a90b7f2d60 100644
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
@@ -1,8 +1,6 @@
 #ifndef _LINUX_COMPACTION_H
 #define _LINUX_COMPACTION_H
 
-#include <linux/node.h>
-
 /* Return values for compact_zone() and try_to_compact_pages() */
 /* compaction didn't start as it was not possible or direct reclaim was more suitable */
 #define COMPACT_SKIPPED         0
@@ -13,23 +11,6 @@
 /* The full zone was compacted */
 #define COMPACT_COMPLETE        3
 
-/*
- * compaction supports three modes
- *
- * COMPACT_ASYNC_MOVABLE uses asynchronous migration and only scans
- *    MIGRATE_MOVABLE pageblocks as migration sources and targets.
- * COMPACT_ASYNC_UNMOVABLE uses asynchronous migration and only scans
- *    MIGRATE_MOVABLE pageblocks as migration sources.
- *    MIGRATE_UNMOVABLE pageblocks are scanned as potential migration
- *    targets and convers them to MIGRATE_MOVABLE if possible
- * COMPACT_SYNC uses synchronous migration and scans all pageblocks
- */
-enum compact_mode {
-        COMPACT_ASYNC_MOVABLE,
-        COMPACT_ASYNC_UNMOVABLE,
-        COMPACT_SYNC,
-};
-
 #ifdef CONFIG_COMPACTION
 extern int sysctl_compact_memory;
 extern int sysctl_compaction_handler(struct ctl_table *table, int write,
diff --git a/include/linux/frontswap.h b/include/linux/frontswap.h
new file mode 100644
index 000000000000..0e4e2eec5c1d
--- /dev/null
+++ b/include/linux/frontswap.h
@@ -0,0 +1,127 @@
+#ifndef _LINUX_FRONTSWAP_H
+#define _LINUX_FRONTSWAP_H
+
+#include <linux/swap.h>
+#include <linux/mm.h>
+#include <linux/bitops.h>
+
+struct frontswap_ops {
+        void (*init)(unsigned);
+        int (*store)(unsigned, pgoff_t, struct page *);
+        int (*load)(unsigned, pgoff_t, struct page *);
+        void (*invalidate_page)(unsigned, pgoff_t);
+        void (*invalidate_area)(unsigned);
+};
+
+extern bool frontswap_enabled;
+extern struct frontswap_ops
+        frontswap_register_ops(struct frontswap_ops *ops);
+extern void frontswap_shrink(unsigned long);
+extern unsigned long frontswap_curr_pages(void);
+extern void frontswap_writethrough(bool);
+
+extern void __frontswap_init(unsigned type);
+extern int __frontswap_store(struct page *page);
+extern int __frontswap_load(struct page *page);
+extern void __frontswap_invalidate_page(unsigned, pgoff_t);
+extern void __frontswap_invalidate_area(unsigned);
+
+#ifdef CONFIG_FRONTSWAP
+
+static inline bool frontswap_test(struct swap_info_struct *sis, pgoff_t offset)
+{
+        bool ret = false;
+
+        if (frontswap_enabled && sis->frontswap_map)
+                ret = test_bit(offset, sis->frontswap_map);
+        return ret;
+}
+
+static inline void frontswap_set(struct swap_info_struct *sis, pgoff_t offset)
+{
+        if (frontswap_enabled && sis->frontswap_map)
+                set_bit(offset, sis->frontswap_map);
+}
+
+static inline void frontswap_clear(struct swap_info_struct *sis, pgoff_t offset)
+{
+        if (frontswap_enabled && sis->frontswap_map)
+                clear_bit(offset, sis->frontswap_map);
+}
+
+static inline void frontswap_map_set(struct swap_info_struct *p,
+                                     unsigned long *map)
+{
+        p->frontswap_map = map;
+}
+
+static inline unsigned long *frontswap_map_get(struct swap_info_struct *p)
+{
+        return p->frontswap_map;
+}
+#else
+/* all inline routines become no-ops and all externs are ignored */
+
+#define frontswap_enabled (0)
+
+static inline bool frontswap_test(struct swap_info_struct *sis, pgoff_t offset)
+{
+        return false;
+}
+
+static inline void frontswap_set(struct swap_info_struct *sis, pgoff_t offset)
+{
+}
+
+static inline void frontswap_clear(struct swap_info_struct *sis, pgoff_t offset)
+{
+}
+
+static inline void frontswap_map_set(struct swap_info_struct *p,
+                                     unsigned long *map)
+{
+}
+
+static inline unsigned long *frontswap_map_get(struct swap_info_struct *p)
+{
+        return NULL;
+}
+#endif
+
+static inline int frontswap_store(struct page *page)
+{
+        int ret = -1;
+
+        if (frontswap_enabled)
+                ret = __frontswap_store(page);
+        return ret;
+}
+
+static inline int frontswap_load(struct page *page)
+{
+        int ret = -1;
+
+        if (frontswap_enabled)
+                ret = __frontswap_load(page);
+        return ret;
+}
+
+static inline void frontswap_invalidate_page(unsigned type, pgoff_t offset)
+{
+        if (frontswap_enabled)
+                __frontswap_invalidate_page(type, offset);
+}
+
+static inline void frontswap_invalidate_area(unsigned type)
+{
+        if (frontswap_enabled)
+                __frontswap_invalidate_area(type);
+}
+
+static inline void frontswap_init(unsigned type)
+{
+        if (frontswap_enabled)
+                __frontswap_init(type);
+}
+
+#endif /* _LINUX_FRONTSWAP_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 51978ed43e97..17fd887c798f 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -802,13 +802,14 @@ struct inode {
                 unsigned int __i_nlink;
         };
         dev_t                   i_rdev;
+        loff_t                  i_size;
         struct timespec         i_atime;
         struct timespec         i_mtime;
         struct timespec         i_ctime;
         spinlock_t              i_lock; /* i_blocks, i_bytes, maybe i_size */
         unsigned short          i_bytes;
+        unsigned int            i_blkbits;
         blkcnt_t                i_blocks;
-        loff_t                  i_size;
 
 #ifdef __NEED_I_SIZE_ORDERED
         seqcount_t              i_size_seqcount;
@@ -828,9 +829,8 @@ struct inode {
                 struct list_head        i_dentry;
                 struct rcu_head         i_rcu;
         };
-        atomic_t                i_count;
-        unsigned int            i_blkbits;
         u64                     i_version;
+        atomic_t                i_count;
         atomic_t                i_dio_count;
         atomic_t                i_writecount;
         const struct file_operations    *i_fop; /* former ->i_op->default_file_ops */
diff --git a/include/linux/fuse.h b/include/linux/fuse.h
index 8f2ab8fef929..9303348965fb 100644
--- a/include/linux/fuse.h
+++ b/include/linux/fuse.h
@@ -54,6 +54,9 @@
  * 7.18
  *  - add FUSE_IOCTL_DIR flag
  *  - add FUSE_NOTIFY_DELETE
+ *
+ * 7.19
+ *  - add FUSE_FALLOCATE
  */
 
 #ifndef _LINUX_FUSE_H
@@ -85,7 +88,7 @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 18
+#define FUSE_KERNEL_MINOR_VERSION 19
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -278,6 +281,7 @@ enum fuse_opcode {
         FUSE_POLL          = 40,
         FUSE_NOTIFY_REPLY  = 41,
         FUSE_BATCH_FORGET  = 42,
+        FUSE_FALLOCATE     = 43,
 
         /* CUSE specific operations */
         CUSE_INIT          = 4096,
@@ -571,6 +575,14 @@ struct fuse_notify_poll_wakeup_out {
         __u64   kh;
 };
 
+struct fuse_fallocate_in {
+        __u64   fh;
+        __u64   offset;
+        __u64   length;
+        __u32   mode;
+        __u32   padding;
+};
+
 struct fuse_in_header {
         __u32   len;
         __u32   opcode;
diff --git a/include/linux/i2c-mux-pinctrl.h b/include/linux/i2c-mux-pinctrl.h
new file mode 100644
index 000000000000..a65c86429e84
--- /dev/null
+++ b/include/linux/i2c-mux-pinctrl.h
@@ -0,0 +1,41 @@
+/*
+ * i2c-mux-pinctrl platform data
+ *
+ * Copyright (c) 2012, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _LINUX_I2C_MUX_PINCTRL_H
+#define _LINUX_I2C_MUX_PINCTRL_H
+
+/**
+ * struct i2c_mux_pinctrl_platform_data - Platform data for i2c-mux-pinctrl
+ * @parent_bus_num: Parent I2C bus number
+ * @base_bus_num: Base I2C bus number for the child busses. 0 for dynamic.
+ * @bus_count: Number of child busses. Also the number of elements in
+ *      @pinctrl_states
+ * @pinctrl_states: The names of the pinctrl state to select for each child bus
+ * @pinctrl_state_idle: The pinctrl state to select when no child bus is being
+ *      accessed. If NULL, the most recently used pinctrl state will be left
+ *      selected.
+ */
+struct i2c_mux_pinctrl_platform_data {
+        int parent_bus_num;
+        int base_bus_num;
+        int bus_count;
+        const char **pinctrl_states;
+        const char *pinctrl_state_idle;
+};
+
+#endif
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index e4baff5f7ff4..9e65eff6af3b 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -149,6 +149,7 @@ extern struct cred init_cred;
         .normal_prio    = MAX_PRIO-20,                                  \
         .policy         = SCHED_NORMAL,                                 \
         .cpus_allowed   = CPU_MASK_ALL,                                 \
+        .nr_cpus_allowed= NR_CPUS,                                      \
         .mm             = NULL,                                         \
         .active_mm      = &init_mm,                                     \
         .se             = {                                             \
@@ -157,7 +158,6 @@ extern struct cred init_cred;
         .rt             = {                                             \
                 .run_list       = LIST_HEAD_INIT(tsk.rt.run_list),      \
                 .time_slice     = RR_TIMESLICE,                         \
-                .nr_cpus_allowed = NR_CPUS,                             \
         },                                                              \
         .tasks          = LIST_HEAD_INIT(tsk.tasks),                    \
         INIT_PUSHABLE_TASKS(tsk)                                        \
diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
index 1b14d25162cb..d6a58065c09c 100644
--- a/include/linux/moduleparam.h
+++ b/include/linux/moduleparam.h
@@ -128,7 +128,7 @@ struct kparam_array
  * The ops can have NULL set or get functions.
  */
 #define module_param_cb(name, ops, arg, perm)                                 \
-        __module_param_call(MODULE_PARAM_PREFIX, name, ops, arg, perm, 0)
+        __module_param_call(MODULE_PARAM_PREFIX, name, ops, arg, perm, -1)
 
 /**
  * <level>_param_cb - general callback for a module/cmdline parameter
@@ -192,7 +192,7 @@ struct kparam_array
                  { (void *)set, (void *)get };                          \
         __module_param_call(MODULE_PARAM_PREFIX,                        \
                             name, &__param_ops_##name, arg,             \
-                            (perm) + sizeof(__check_old_set_param(set))*0, 0)
+                            (perm) + sizeof(__check_old_set_param(set))*0, -1)
 
 /* We don't get oldget: it's often a new-style param_get_uint, etc. */
 static inline int
@@ -272,7 +272,7 @@ static inline void __kernel_param_unlock(void)
  */
 #define core_param(name, var, type, perm)                               \
         param_check_##type(name, &(var));                               \
-        __module_param_call("", name, &param_ops_##type, &var, perm, 0)
+        __module_param_call("", name, &param_ops_##type, &var, perm, -1)
 #endif /* !MODULE */
 
 /**
@@ -290,7 +290,7 @@ static inline void __kernel_param_unlock(void)
                 = { len, string };                                      \
         __module_param_call(MODULE_PARAM_PREFIX, name,                  \
                             &param_ops_string,                          \
-                            .str = &__param_string_##name, perm, 0);    \
+                            .str = &__param_string_##name, perm, -1);   \
         __MODULE_PARM_TYPE(name, "string")
 
 /**
@@ -432,7 +432,7 @@ extern int param_set_bint(const char *val, const struct kernel_param *kp);
         __module_param_call(MODULE_PARAM_PREFIX, name,                  \
                             &param_array_ops,                           \
                             .arr = &__param_arr_##name,                 \
-                            perm, 0);                                   \
+                            perm, -1);                                  \
         __MODULE_PARM_TYPE(name, "array of " #type)
 
 extern struct kernel_param_ops param_array_ops;
diff --git a/include/linux/netfilter/xt_HMARK.h b/include/linux/netfilter/xt_HMARK.h
index abb1650940d2..826fc5807577 100644
--- a/include/linux/netfilter/xt_HMARK.h
+++ b/include/linux/netfilter/xt_HMARK.h
@@ -27,7 +27,12 @@ union hmark_ports {
                 __u16   src;
                 __u16   dst;
         } p16;
+        struct {
+                __be16  src;
+                __be16  dst;
+        } b16;
         __u32   v32;
+        __be32  b32;
 };
 
 struct xt_hmark_info {
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index d1a7bf51c326..8aadd90b808a 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -348,6 +348,7 @@ struct nfs_openargs {
         const struct qstr *     name;
         const struct nfs_server *server;         /* Needed for ID mapping */
         const u32 *             bitmask;
+        const u32 *             open_bitmap;
         __u32                   claim;
         struct nfs4_sequence_args       seq_args;
 };
@@ -1236,6 +1237,7 @@ struct nfs_pgio_header {
         struct list_head        rpc_list;
         atomic_t                refcnt;
         struct nfs_page         *req;
+        struct nfs_writeverf    *verf;
         struct pnfs_layout_segment *lseg;
         loff_t                  io_start;
         const struct rpc_call_ops *mds_ops;
@@ -1273,6 +1275,7 @@ struct nfs_write_data {
 struct nfs_write_header {
         struct nfs_pgio_header  header;
         struct nfs_write_data   rpc_data;
+        struct nfs_writeverf    verf;
 };
 
 struct nfs_mds_commit_info {
diff --git a/include/linux/pci.h b/include/linux/pci.h
index d8c379dba6ad..fefb4e19bf6a 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -176,6 +176,8 @@ enum pci_dev_flags {
         PCI_DEV_FLAGS_NO_D3 = (__force pci_dev_flags_t) 2,
         /* Provide indication device is assigned by a Virtual Machine Manager */
         PCI_DEV_FLAGS_ASSIGNED = (__force pci_dev_flags_t) 4,
+        /* Device causes system crash if in D3 during S3 sleep */
+        PCI_DEV_FLAGS_NO_D3_DURING_SLEEP = (__force pci_dev_flags_t) 8,
 };
 
 enum pci_irq_reroute_variant {
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index f32578634d9d..45db49f64bb4 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -555,6 +555,8 @@ enum perf_event_type {
         PERF_RECORD_MAX,                        /* non-ABI */
 };
 
+#define PERF_MAX_STACK_DEPTH            127
+
 enum perf_callchain_context {
         PERF_CONTEXT_HV                 = (__u64)-32,
         PERF_CONTEXT_KERNEL             = (__u64)-128,
@@ -609,8 +611,6 @@ struct perf_guest_info_callbacks {
 #include <linux/sysfs.h>
 #include <asm/local.h>
 
-#define PERF_MAX_STACK_DEPTH            255
-
 struct perf_callchain_entry {
         __u64                           nr;
         __u64                           ip[PERF_MAX_STACK_DEPTH];
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 711e0a30aacc..3988012255dc 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -127,8 +127,8 @@
 #define PR_SET_PTRACER 0x59616d61
 # define PR_SET_PTRACER_ANY ((unsigned long)-1)
 
-#define PR_SET_CHILD_SUBREAPER 36
-#define PR_GET_CHILD_SUBREAPER 37
+#define PR_SET_CHILD_SUBREAPER  36
+#define PR_GET_CHILD_SUBREAPER  37
 
 /*
  * If no_new_privs is set, then operations that grant new privileges (i.e.
@@ -142,7 +142,9 @@
  * asking selinux for a specific new context (e.g. with runcon) will result
  * in execve returning -EPERM.
  */
-#define PR_SET_NO_NEW_PRIVS 38
-#define PR_GET_NO_NEW_PRIVS 39
+#define PR_SET_NO_NEW_PRIVS     38
+#define PR_GET_NO_NEW_PRIVS     39
+
+#define PR_GET_TID_ADDRESS      40
 
 #endif /* _LINUX_PRCTL_H */
diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index 0d04cd69ab9b..ffc444c38b0a 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -368,8 +368,11 @@ radix_tree_next_slot(void **slot, struct radix_tree_iter *iter, unsigned flags)
                         iter->index++;
                         if (likely(*slot))
                                 return slot;
-                        if (flags & RADIX_TREE_ITER_CONTIG)
+                        if (flags & RADIX_TREE_ITER_CONTIG) {
+                                /* forbid switching to the next chunk */
+                                iter->next_index = 0;
                                 break;
+                        }
                 }
         }
         return NULL;
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
index adb5e5a38cae..854dc4c5c271 100644
--- a/include/linux/rcutiny.h
+++ b/include/linux/rcutiny.h
@@ -87,8 +87,9 @@ static inline void kfree_call_rcu(struct rcu_head *head,
 
 #ifdef CONFIG_TINY_RCU
 
-static inline int rcu_needs_cpu(int cpu)
+static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 {
+        *delta_jiffies = ULONG_MAX;
         return 0;
 }
 
@@ -96,8 +97,9 @@ static inline int rcu_needs_cpu(int cpu)
 
 int rcu_preempt_needs_cpu(void);
 
-static inline int rcu_needs_cpu(int cpu)
+static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 {
+        *delta_jiffies = ULONG_MAX;
         return rcu_preempt_needs_cpu();
 }
 
diff --git a/include/linux/rcutree.h b/include/linux/rcutree.h
index 3c6083cde4fc..952b79339304 100644
--- a/include/linux/rcutree.h
+++ b/include/linux/rcutree.h
@@ -32,7 +32,7 @@
 
 extern void rcu_init(void);
 extern void rcu_note_context_switch(int cpu);
-extern int rcu_needs_cpu(int cpu);
+extern int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies);
 extern void rcu_cpu_stall_reset(void);
 
 /*
diff --git a/include/linux/sched.h b/include/linux/sched.h
index f34437e835a7..4059c0f33f07 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -145,6 +145,7 @@ extern unsigned long this_cpu_load(void);
 
 
 extern void calc_global_load(unsigned long ticks);
+extern void update_cpu_load_nohz(void);
 
 extern unsigned long get_parent_ip(unsigned long addr);
 
@@ -438,6 +439,7 @@ extern int get_dumpable(struct mm_struct *mm);
                                         /* leave room for more dump flags */
 #define MMF_VM_MERGEABLE        16      /* KSM may merge identical pages */
 #define MMF_VM_HUGEPAGE         17      /* set when VM_HUGEPAGE is set on vma */
+#define MMF_EXE_FILE_CHANGED    18      /* see prctl_set_mm_exe_file() */
 
 #define MMF_INIT_MASK           (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK)
 
@@ -875,6 +877,8 @@ struct sched_group_power {
          * Number of busy cpus in this group.
          */
         atomic_t nr_busy_cpus;
+
+        unsigned long cpumask[0]; /* iteration mask */
 };
 
 struct sched_group {
@@ -899,6 +903,15 @@ static inline struct cpumask *sched_group_cpus(struct sched_group *sg)
         return to_cpumask(sg->cpumask);
 }
 
+/*
+ * cpumask masking which cpus in the group are allowed to iterate up the domain
+ * tree.
+ */
+static inline struct cpumask *sched_group_mask(struct sched_group *sg)
+{
+        return to_cpumask(sg->sgp->cpumask);
+}
+
 /**
  * group_first_cpu - Returns the first cpu in the cpumask of a sched_group.
  * @group: The group whose first cpu is to be returned.
@@ -1187,7 +1200,6 @@ struct sched_rt_entity {
         struct list_head run_list;
         unsigned long timeout;
         unsigned int time_slice;
-        int nr_cpus_allowed;
 
         struct sched_rt_entity *back;
 #ifdef CONFIG_RT_GROUP_SCHED
@@ -1252,6 +1264,7 @@ struct task_struct {
 #endif
 
         unsigned int policy;
+        int nr_cpus_allowed;
         cpumask_t cpus_allowed;
 
 #ifdef CONFIG_PREEMPT_RCU
diff --git a/include/linux/swap.h b/include/linux/swap.h
index b6661933e252..c84ec68eaec9 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -197,6 +197,10 @@ struct swap_info_struct {
         struct block_device *bdev;      /* swap device or bdev of swap file */
         struct file *swap_file;         /* seldom referenced */
         unsigned int old_block_size;    /* seldom referenced */
+#ifdef CONFIG_FRONTSWAP
+        unsigned long *frontswap_map;   /* frontswap in-use, one bit per page */
+        atomic_t frontswap_pages;       /* frontswap pages in-use counter */
+#endif
 };
 
 struct swap_list_t {
diff --git a/include/linux/swapfile.h b/include/linux/swapfile.h
new file mode 100644
index 000000000000..e282624e8c10
--- /dev/null
+++ b/include/linux/swapfile.h
@@ -0,0 +1,13 @@
+#ifndef _LINUX_SWAPFILE_H
+#define _LINUX_SWAPFILE_H
+
+/*
+ * these were static in swapfile.c but frontswap.c needs them and we don't
+ * want to expose them to the dozens of source files that include swap.h
+ */
+extern spinlock_t swap_lock;
+extern struct swap_list_t swap_list;
+extern struct swap_info_struct *swap_info[];
+extern int try_to_unuse(unsigned int, bool, unsigned long);
+
+#endif /* _LINUX_SWAPFILE_H */
diff --git a/include/linux/swapops.h b/include/linux/swapops.h
index 792d16d9cbc7..47ead515c811 100644
--- a/include/linux/swapops.h
+++ b/include/linux/swapops.h
@@ -9,13 +9,15 @@
  * get good packing density in that tree, so the index should be dense in
  * the low-order bits.
  *
- * We arrange the `type' and `offset' fields so that `type' is at the five
+ * We arrange the `type' and `offset' fields so that `type' is at the seven
  * high-order bits of the swp_entry_t and `offset' is right-aligned in the
- * remaining bits.
+ * remaining bits.  Although `type' itself needs only five bits, we allow for
+ * shmem/tmpfs to shift it all up a further two bits: see swp_to_radix_entry().
  *
  * swp_entry_t's are *never* stored anywhere in their arch-dependent format.
  */
-#define SWP_TYPE_SHIFT(e)       (sizeof(e.val) * 8 - MAX_SWAPFILES_SHIFT)
+#define SWP_TYPE_SHIFT(e)       ((sizeof(e.val) * 8) - \
+                        (MAX_SWAPFILES_SHIFT + RADIX_TREE_EXCEPTIONAL_SHIFT))
 #define SWP_OFFSET_MASK(e)      ((1UL << SWP_TYPE_SHIFT(e)) - 1)
 
 /*
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 4c5b63283377..5f359dbfcdce 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -69,16 +69,16 @@ union tcp_word_hdr {
 #define tcp_flag_word(tp) ( ((union tcp_word_hdr *)(tp))->words [3]) 
 
 enum { 
-        TCP_FLAG_CWR = __cpu_to_be32(0x00800000),
-        TCP_FLAG_ECE = __cpu_to_be32(0x00400000),
-        TCP_FLAG_URG = __cpu_to_be32(0x00200000),
-        TCP_FLAG_ACK = __cpu_to_be32(0x00100000),
-        TCP_FLAG_PSH = __cpu_to_be32(0x00080000),
-        TCP_FLAG_RST = __cpu_to_be32(0x00040000),
-        TCP_FLAG_SYN = __cpu_to_be32(0x00020000),
-        TCP_FLAG_FIN = __cpu_to_be32(0x00010000),
-        TCP_RESERVED_BITS = __cpu_to_be32(0x0F000000),
-        TCP_DATA_OFFSET = __cpu_to_be32(0xF0000000)
+        TCP_FLAG_CWR = __constant_cpu_to_be32(0x00800000),
+        TCP_FLAG_ECE = __constant_cpu_to_be32(0x00400000),
+        TCP_FLAG_URG = __constant_cpu_to_be32(0x00200000),
+        TCP_FLAG_ACK = __constant_cpu_to_be32(0x00100000),
+        TCP_FLAG_PSH = __constant_cpu_to_be32(0x00080000),
+        TCP_FLAG_RST = __constant_cpu_to_be32(0x00040000),
+        TCP_FLAG_SYN = __constant_cpu_to_be32(0x00020000),
+        TCP_FLAG_FIN = __constant_cpu_to_be32(0x00010000),
+        TCP_RESERVED_BITS = __constant_cpu_to_be32(0x0F000000),
+        TCP_DATA_OFFSET = __constant_cpu_to_be32(0xF0000000)
 }; 
 
 /*
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 7f855d50cdf5..49b3ac29726a 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -126,8 +126,6 @@ struct usb_hcd {
         unsigned                wireless:1;     /* Wireless USB HCD */
         unsigned                authorized_default:1;
         unsigned                has_tt:1;       /* Integrated TT in root hub */
-        unsigned                broken_pci_sleep:1;     /* Don't put the
-                        controller in PCI-D3 for system sleep */
 
         unsigned int            irq;            /* irq allocated */
         void __iomem            *regs;          /* device memory/io */
diff --git a/include/linux/vga_switcheroo.h b/include/linux/vga_switcheroo.h
index b455c7c212eb..60da41fe9dc2 100644
--- a/include/linux/vga_switcheroo.h
+++ b/include/linux/vga_switcheroo.h
@@ -12,6 +12,9 @@
 enum vga_switcheroo_state {
         VGA_SWITCHEROO_OFF,
         VGA_SWITCHEROO_ON,
+        /* below are referred only from vga_switcheroo_get_client_state() */
+        VGA_SWITCHEROO_INIT,
+        VGA_SWITCHEROO_NOT_FOUND,
 };
 
 enum vga_switcheroo_client_id {
@@ -50,6 +53,8 @@ void vga_switcheroo_unregister_handler(void);
 
 int vga_switcheroo_process_delayed_switch(void);
 
+int vga_switcheroo_get_client_state(struct pci_dev *dev);
+
 #else
 
 static inline void vga_switcheroo_unregister_client(struct pci_dev *dev) {}
@@ -62,5 +67,7 @@ static inline int vga_switcheroo_register_audio_client(struct pci_dev *pdev,
         int id, bool active) { return 0; }
 static inline void vga_switcheroo_unregister_handler(void) {}
 static inline int vga_switcheroo_process_delayed_switch(void) { return 0; }
+static inline int vga_switcheroo_get_client_state(struct pci_dev *dev) { return VGA_SWITCHEROO_ON; }
+
 
 #endif
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index b94765e38e80..2040bff945d4 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -40,7 +40,10 @@ struct inet_peer {
         u32                     pmtu_orig;
         u32                     pmtu_learned;
         struct inetpeer_addr_base redirect_learned;
-        struct list_head        gc_list;
+        union {
+                struct list_head        gc_list;
+                struct rcu_head     gc_rcu;
+        };
         /*
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
          * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
diff --git a/include/net/route.h b/include/net/route.h
index ed2b78e2375d..98705468ac03 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -130,9 +130,9 @@ static inline struct rtable *ip_route_output(struct net *net, __be32 daddr,
 {
         struct flowi4 fl4 = {
                 .flowi4_oif = oif,
+                .flowi4_tos = tos,
                 .daddr = daddr,
                 .saddr = saddr,
-                .flowi4_tos = tos,
         };
         return ip_route_output_key(net, &fl4);
 }
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 55ce96b53b09..9d7d54a00e63 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -220,13 +220,16 @@ struct tcf_proto {
 
 struct qdisc_skb_cb {
         unsigned int            pkt_len;
-        unsigned char           data[24];
+        u16                     bond_queue_mapping;
+        u16                     _pad;
+        unsigned char           data[20];
 };
 
 static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
 {
         struct qdisc_skb_cb *qcb;
-        BUILD_BUG_ON(sizeof(skb->cb) < sizeof(unsigned int) + sz);
+
+        BUILD_BUG_ON(sizeof(skb->cb) < offsetof(struct qdisc_skb_cb, data) + sz);
         BUILD_BUG_ON(sizeof(qcb->data) < sz);
 }
 
diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
index 116959933f46..c78a23333c4f 100644
--- a/include/target/target_core_fabric.h
+++ b/include/target/target_core_fabric.h
@@ -47,6 +47,7 @@ struct target_core_fabric_ops {
          */
         int (*check_stop_free)(struct se_cmd *);
         void (*release_cmd)(struct se_cmd *);
+        void (*put_session)(struct se_session *);
         /*
          * Called with spin_lock_bh(struct se_portal_group->session_lock held.
          */
diff --git a/include/trace/events/rcu.h b/include/trace/events/rcu.h
index 1480900c511c..d274734b2aa4 100644
--- a/include/trace/events/rcu.h
+++ b/include/trace/events/rcu.h
@@ -289,6 +289,7 @@ TRACE_EVENT(rcu_dyntick,
  *      "In holdoff": Nothing to do, holding off after unsuccessful attempt.
  *      "Begin holdoff": Attempt failed, don't retry until next jiffy.
  *      "Dyntick with callbacks": Entering dyntick-idle despite callbacks.
+ *      "Dyntick with lazy callbacks": Entering dyntick-idle w/lazy callbacks.
  *      "More callbacks": Still more callbacks, try again to clear them out.
  *      "Callbacks drained": All callbacks processed, off to dyntick idle!
  *      "Timer": Timer fired to cause CPU to continue processing callbacks.
diff --git a/init/main.c b/init/main.c
index 1ca6b32c4828..b5cc0a7c4708 100644
--- a/init/main.c
+++ b/init/main.c
@@ -508,7 +508,7 @@ asmlinkage void __init start_kernel(void)
         parse_early_param();
         parse_args("Booting kernel", static_command_line, __start___param,
                    __stop___param - __start___param,
-                   0, 0, &unknown_bootoption);
+                   -1, -1, &unknown_bootoption);
 
         jump_label_init();
 
@@ -755,13 +755,8 @@ static void __init do_initcalls(void)
 {
         int level;
 
-        for (level = 0; level < ARRAY_SIZE(initcall_levels) - 1; level++) {
-                pr_info("initlevel:%d=%s, %d registered initcalls\n",
-                        level, initcall_level_names[level],
-                        (int) (initcall_levels[level+1]
-                                - initcall_levels[level]));
+        for (level = 0; level < ARRAY_SIZE(initcall_levels) - 1; level++)
                 do_initcall_level(level);
-        }
 }
 
 /*
diff --git a/ipc/shm.c b/ipc/shm.c
index 5e2cbfdab6fc..41c1285d697a 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -393,6 +393,16 @@ static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
         return sfd->file->f_op->fsync(sfd->file, start, end, datasync);
 }
 
+static long shm_fallocate(struct file *file, int mode, loff_t offset,
+                          loff_t len)
+{
+        struct shm_file_data *sfd = shm_file_data(file);
+
+        if (!sfd->file->f_op->fallocate)
+                return -EOPNOTSUPP;
+        return sfd->file->f_op->fallocate(file, mode, offset, len);
+}
+
 static unsigned long shm_get_unmapped_area(struct file *file,
         unsigned long addr, unsigned long len, unsigned long pgoff,
         unsigned long flags)
@@ -410,6 +420,7 @@ static const struct file_operations shm_file_operations = {
         .get_unmapped_area      = shm_get_unmapped_area,
 #endif
         .llseek         = noop_llseek,
+        .fallocate      = shm_fallocate,
 };
 
 static const struct file_operations shm_file_operations_huge = {
@@ -418,6 +429,7 @@ static const struct file_operations shm_file_operations_huge = {
         .release        = shm_release,
         .get_unmapped_area      = shm_get_unmapped_area,
         .llseek         = noop_llseek,
+        .fallocate      = shm_fallocate,
 };
 
 int is_file_shm_hugepages(struct file *file)
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 0f3527d6184a..72fcd3069a90 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -896,10 +896,13 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                 mutex_unlock(&cgroup_mutex);
 
                 /*
-                 * Drop the active superblock reference that we took when we
-                 * created the cgroup
+                 * We want to drop the active superblock reference from the
+                 * cgroup creation after all the dentry refs are gone -
+                 * kill_sb gets mighty unhappy otherwise.  Mark
+                 * dentry->d_fsdata with cgroup_diput() to tell
+                 * cgroup_d_release() to call deactivate_super().
                  */
-                deactivate_super(cgrp->root->sb);
+                dentry->d_fsdata = cgroup_diput;
 
                 /*
                  * if we're getting rid of the cgroup, refcount should ensure
@@ -925,6 +928,13 @@ static int cgroup_delete(const struct dentry *d)
         return 1;
 }
 
+static void cgroup_d_release(struct dentry *dentry)
+{
+        /* did cgroup_diput() tell me to deactivate super? */
+        if (dentry->d_fsdata == cgroup_diput)
+                deactivate_super(dentry->d_sb);
+}
+
 static void remove_dir(struct dentry *d)
 {
         struct dentry *parent = dget(d->d_parent);
@@ -1532,6 +1542,7 @@ static int cgroup_get_rootdir(struct super_block *sb)
         static const struct dentry_operations cgroup_dops = {
                 .d_iput = cgroup_diput,
                 .d_delete = cgroup_delete,
+                .d_release = cgroup_d_release,
         };
 
         struct inode *inode =
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5b06cbbf6931..f85c0154b333 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3181,7 +3181,6 @@ static void perf_event_for_each(struct perf_event *event,
         event = event->group_leader;
 
         perf_event_for_each_child(event, func);
-        func(event);
         list_for_each_entry(sibling, &event->sibling_list, group_entry)
                 perf_event_for_each_child(sibling, func);
         mutex_unlock(&ctx->mutex);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index fc275e4f629b..eebd6d5cfb44 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -275,8 +275,10 @@ void handle_nested_irq(unsigned int irq)
         kstat_incr_irqs_this_cpu(irq, desc);
 
         action = desc->action;
-        if (unlikely(!action || irqd_irq_disabled(&desc->irq_data)))
+        if (unlikely(!action || irqd_irq_disabled(&desc->irq_data))) {
+                desc->istate |= IRQS_PENDING;
                 goto out_unlock;
+        }
 
         irqd_set(&desc->irq_data, IRQD_IRQ_INPROGRESS);
         raw_spin_unlock_irq(&desc->lock);
@@ -324,8 +326,10 @@ handle_simple_irq(unsigned int irq, struct irq_desc *desc)
         desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
         kstat_incr_irqs_this_cpu(irq, desc);
 
-        if (unlikely(!desc->action || irqd_irq_disabled(&desc->irq_data)))
+        if (unlikely(!desc->action || irqd_irq_disabled(&desc->irq_data))) {
+                desc->istate |= IRQS_PENDING;
                 goto out_unlock;
+        }
 
         handle_irq_event(desc);
 
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 8e5c56b3b7d9..001fa5bab490 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -101,6 +101,9 @@ extern int irq_select_affinity_usr(unsigned int irq, struct cpumask *mask);
 
 extern void irq_set_thread_affinity(struct irq_desc *desc);
 
+extern int irq_do_set_affinity(struct irq_data *data,
+                               const struct cpumask *dest, bool force);
+
 /* Inline functions for support of irq chips on slow busses */
 static inline void chip_bus_lock(struct irq_desc *desc)
 {
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index ea0c6c2ae6f7..8c548232ba39 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -142,6 +142,25 @@ static inline void
 irq_get_pending(struct cpumask *mask, struct irq_desc *desc) { }
 #endif
 
+int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
+                        bool force)
+{
+        struct irq_desc *desc = irq_data_to_desc(data);
+        struct irq_chip *chip = irq_data_get_irq_chip(data);
+        int ret;
+
+        ret = chip->irq_set_affinity(data, mask, false);
+        switch (ret) {
+        case IRQ_SET_MASK_OK:
+                cpumask_copy(data->affinity, mask);
+        case IRQ_SET_MASK_OK_NOCOPY:
+                irq_set_thread_affinity(desc);
+                ret = 0;
+        }
+
+        return ret;
+}
+
 int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
 {
         struct irq_chip *chip = irq_data_get_irq_chip(data);
@@ -152,14 +171,7 @@ int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
                 return -EINVAL;
 
         if (irq_can_move_pcntxt(data)) {
-                ret = chip->irq_set_affinity(data, mask, false);
-                switch (ret) {
-                case IRQ_SET_MASK_OK:
-                        cpumask_copy(data->affinity, mask);
-                case IRQ_SET_MASK_OK_NOCOPY:
-                        irq_set_thread_affinity(desc);
-                        ret = 0;
-                }
+                ret = irq_do_set_affinity(data, mask, false);
         } else {
                 irqd_set_move_pending(data);
                 irq_copy_pending(desc, mask);
@@ -283,9 +295,8 @@ EXPORT_SYMBOL_GPL(irq_set_affinity_notifier);
 static int
 setup_affinity(unsigned int irq, struct irq_desc *desc, struct cpumask *mask)
 {
-        struct irq_chip *chip = irq_desc_get_chip(desc);
         struct cpumask *set = irq_default_affinity;
-        int ret, node = desc->irq_data.node;
+        int node = desc->irq_data.node;
 
         /* Excludes PER_CPU and NO_BALANCE interrupts */
         if (!irq_can_set_affinity(irq))
@@ -311,13 +322,7 @@ setup_affinity(unsigned int irq, struct irq_desc *desc, struct cpumask *mask)
                 if (cpumask_intersects(mask, nodemask))
                         cpumask_and(mask, mask, nodemask);
         }
-        ret = chip->irq_set_affinity(&desc->irq_data, mask, false);
-        switch (ret) {
-        case IRQ_SET_MASK_OK:
-                cpumask_copy(desc->irq_data.affinity, mask);
-        case IRQ_SET_MASK_OK_NOCOPY:
-                irq_set_thread_affinity(desc);
-        }
+        irq_do_set_affinity(&desc->irq_data, mask, false);
         return 0;
 }
 #else
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index c3c89751b327..ca3f4aaff707 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -42,17 +42,8 @@ void irq_move_masked_irq(struct irq_data *idata)
          * For correct operation this depends on the caller
          * masking the irqs.
          */
-        if (likely(cpumask_any_and(desc->pending_mask, cpu_online_mask)
-                   < nr_cpu_ids)) {
-                int ret = chip->irq_set_affinity(&desc->irq_data,
-                                                 desc->pending_mask, false);
-                switch (ret) {
-                case IRQ_SET_MASK_OK:
-                        cpumask_copy(desc->irq_data.affinity, desc->pending_mask);
-                case IRQ_SET_MASK_OK_NOCOPY:
-                        irq_set_thread_affinity(desc);
-                }
-        }
+        if (cpumask_any_and(desc->pending_mask, cpu_online_mask) < nr_cpu_ids)
+                irq_do_set_affinity(&desc->irq_data, desc->pending_mask, false);
 
         cpumask_clear(desc->pending_mask);
 }
diff --git a/kernel/panic.c b/kernel/panic.c
index 8ed89a175d79..d2a5f4ecc6dd 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -27,7 +27,7 @@
 #define PANIC_TIMER_STEP 100
 #define PANIC_BLINK_SPD 18
 
-int panic_on_oops;
+int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE;
 static unsigned long tainted_mask;
 static int pause_on_oops;
 static int pause_on_oops_flag;
@@ -108,8 +108,6 @@ void panic(const char *fmt, ...)
          */
         crash_kexec(NULL);
 
-        kmsg_dump(KMSG_DUMP_PANIC);
-
         /*
          * Note smp_send_stop is the usual smp shutdown function, which
          * unfortunately means it may not be hardened to work in a panic
@@ -117,6 +115,8 @@ void panic(const char *fmt, ...)
          */
         smp_send_stop();
 
+        kmsg_dump(KMSG_DUMP_PANIC);
+
         atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
 
         bust_spinlocks(0);
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 0da7b88d92d0..3b0f1337f75b 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -1397,6 +1397,8 @@ static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
         rdp->qlen_lazy += rsp->qlen_lazy;
         rdp->qlen += rsp->qlen;
         rdp->n_cbs_adopted += rsp->qlen;
+        if (rsp->qlen_lazy != rsp->qlen)
+                rcu_idle_count_callbacks_posted();
         rsp->qlen_lazy = 0;
         rsp->qlen = 0;
 
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 7f5d138dedf5..ea056495783e 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -84,6 +84,20 @@ struct rcu_dynticks {
                                     /* Process level is worth LLONG_MAX/2. */
         int dynticks_nmi_nesting;   /* Track NMI nesting level. */
         atomic_t dynticks;          /* Even value for idle, else odd. */
+#ifdef CONFIG_RCU_FAST_NO_HZ
+        int dyntick_drain;          /* Prepare-for-idle state variable. */
+        unsigned long dyntick_holdoff;
+                                    /* No retries for the jiffy of failure. */
+        struct timer_list idle_gp_timer;
+                                    /* Wake up CPU sleeping with callbacks. */
+        unsigned long idle_gp_timer_expires;
+                                    /* When to wake up CPU (for repost). */
+        bool idle_first_pass;       /* First pass of attempt to go idle? */
+        unsigned long nonlazy_posted;
+                                    /* # times non-lazy CBs posted to CPU. */
+        unsigned long nonlazy_posted_snap;
+                                    /* idle-period nonlazy_posted snapshot. */
+#endif /* #ifdef CONFIG_RCU_FAST_NO_HZ */
 };
 
 /* RCU's kthread states for tracing. */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 2411000d9869..5271a020887e 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -1886,8 +1886,9 @@ static void __cpuinit rcu_prepare_kthreads(int cpu)
  * Because we not have RCU_FAST_NO_HZ, just check whether this CPU needs
  * any flavor of RCU.
  */
-int rcu_needs_cpu(int cpu)
+int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 {
+        *delta_jiffies = ULONG_MAX;
         return rcu_cpu_has_callbacks(cpu);
 }
 
@@ -1962,41 +1963,6 @@ static void rcu_idle_count_callbacks_posted(void)
 #define RCU_IDLE_GP_DELAY 6             /* Roughly one grace period. */
 #define RCU_IDLE_LAZY_GP_DELAY (6 * HZ) /* Roughly six seconds. */
 
-/* Loop counter for rcu_prepare_for_idle(). */
-static DEFINE_PER_CPU(int, rcu_dyntick_drain);
-/* If rcu_dyntick_holdoff==jiffies, don't try to enter dyntick-idle mode. */
-static DEFINE_PER_CPU(unsigned long, rcu_dyntick_holdoff);
-/* Timer to awaken the CPU if it enters dyntick-idle mode with callbacks. */
-static DEFINE_PER_CPU(struct timer_list, rcu_idle_gp_timer);
-/* Scheduled expiry time for rcu_idle_gp_timer to allow reposting. */
-static DEFINE_PER_CPU(unsigned long, rcu_idle_gp_timer_expires);
-/* Enable special processing on first attempt to enter dyntick-idle mode. */
-static DEFINE_PER_CPU(bool, rcu_idle_first_pass);
-/* Running count of non-lazy callbacks posted, never decremented. */
-static DEFINE_PER_CPU(unsigned long, rcu_nonlazy_posted);
-/* Snapshot of rcu_nonlazy_posted to detect meaningful exits from idle. */
-static DEFINE_PER_CPU(unsigned long, rcu_nonlazy_posted_snap);
-
-/*
- * Allow the CPU to enter dyntick-idle mode if either: (1) There are no
- * callbacks on this CPU, (2) this CPU has not yet attempted to enter
- * dyntick-idle mode, or (3) this CPU is in the process of attempting to
- * enter dyntick-idle mode.  Otherwise, if we have recently tried and failed
- * to enter dyntick-idle mode, we refuse to try to enter it.  After all,
- * it is better to incur scheduling-clock interrupts than to spin
- * continuously for the same time duration!
- */
-int rcu_needs_cpu(int cpu)
-{
-        /* Flag a new idle sojourn to the idle-entry state machine. */
-        per_cpu(rcu_idle_first_pass, cpu) = 1;
-        /* If no callbacks, RCU doesn't need the CPU. */
-        if (!rcu_cpu_has_callbacks(cpu))
-                return 0;
-        /* Otherwise, RCU needs the CPU only if it recently tried and failed. */
-        return per_cpu(rcu_dyntick_holdoff, cpu) == jiffies;
-}
-
 /*
  * Does the specified flavor of RCU have non-lazy callbacks pending on
  * the specified CPU?  Both RCU flavor and CPU are specified by the
@@ -2040,6 +2006,47 @@ static bool rcu_cpu_has_nonlazy_callbacks(int cpu)
 }
 
 /*
+ * Allow the CPU to enter dyntick-idle mode if either: (1) There are no
+ * callbacks on this CPU, (2) this CPU has not yet attempted to enter
+ * dyntick-idle mode, or (3) this CPU is in the process of attempting to
+ * enter dyntick-idle mode.  Otherwise, if we have recently tried and failed
+ * to enter dyntick-idle mode, we refuse to try to enter it.  After all,
+ * it is better to incur scheduling-clock interrupts than to spin
+ * continuously for the same time duration!
+ *
+ * The delta_jiffies argument is used to store the time when RCU is
+ * going to need the CPU again if it still has callbacks.  The reason
+ * for this is that rcu_prepare_for_idle() might need to post a timer,
+ * but if so, it will do so after tick_nohz_stop_sched_tick() has set
+ * the wakeup time for this CPU.  This means that RCU's timer can be
+ * delayed until the wakeup time, which defeats the purpose of posting
+ * a timer.
+ */
+int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
+{
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+
+        /* Flag a new idle sojourn to the idle-entry state machine. */
+        rdtp->idle_first_pass = 1;
+        /* If no callbacks, RCU doesn't need the CPU. */
+        if (!rcu_cpu_has_callbacks(cpu)) {
+                *delta_jiffies = ULONG_MAX;
+                return 0;
+        }
+        if (rdtp->dyntick_holdoff == jiffies) {
+                /* RCU recently tried and failed, so don't try again. */
+                *delta_jiffies = 1;
+                return 1;
+        }
+        /* Set up for the possibility that RCU will post a timer. */
+        if (rcu_cpu_has_nonlazy_callbacks(cpu))
+                *delta_jiffies = RCU_IDLE_GP_DELAY;
+        else
+                *delta_jiffies = RCU_IDLE_LAZY_GP_DELAY;
+        return 0;
+}
+
+/*
  * Handler for smp_call_function_single().  The only point of this
  * handler is to wake the CPU up, so the handler does only tracing.
  */
@@ -2075,21 +2082,24 @@ static void rcu_idle_gp_timer_func(unsigned long cpu_in)
  */
 static void rcu_prepare_for_idle_init(int cpu)
 {
-        per_cpu(rcu_dyntick_holdoff, cpu) = jiffies - 1;
-        setup_timer(&per_cpu(rcu_idle_gp_timer, cpu),
-                    rcu_idle_gp_timer_func, cpu);
-        per_cpu(rcu_idle_gp_timer_expires, cpu) = jiffies - 1;
-        per_cpu(rcu_idle_first_pass, cpu) = 1;
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+
+        rdtp->dyntick_holdoff = jiffies - 1;
+        setup_timer(&rdtp->idle_gp_timer, rcu_idle_gp_timer_func, cpu);
+        rdtp->idle_gp_timer_expires = jiffies - 1;
+        rdtp->idle_first_pass = 1;
 }
 
 /*
  * Clean up for exit from idle.  Because we are exiting from idle, there
- * is no longer any point to rcu_idle_gp_timer, so cancel it.  This will
+ * is no longer any point to ->idle_gp_timer, so cancel it.  This will
  * do nothing if this timer is not active, so just cancel it unconditionally.
  */
 static void rcu_cleanup_after_idle(int cpu)
 {
-        del_timer(&per_cpu(rcu_idle_gp_timer, cpu));
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+
+        del_timer(&rdtp->idle_gp_timer);
         trace_rcu_prep_idle("Cleanup after idle");
 }
 
@@ -2108,42 +2118,41 @@ static void rcu_cleanup_after_idle(int cpu)
  * Because it is not legal to invoke rcu_process_callbacks() with irqs
  * disabled, we do one pass of force_quiescent_state(), then do a
  * invoke_rcu_core() to cause rcu_process_callbacks() to be invoked
- * later.  The per-cpu rcu_dyntick_drain variable controls the sequencing.
+ * later.  The ->dyntick_drain field controls the sequencing.
  *
  * The caller must have disabled interrupts.
  */
 static void rcu_prepare_for_idle(int cpu)
 {
         struct timer_list *tp;
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
 
         /*
          * If this is an idle re-entry, for example, due to use of
          * RCU_NONIDLE() or the new idle-loop tracing API within the idle
          * loop, then don't take any state-machine actions, unless the
          * momentary exit from idle queued additional non-lazy callbacks.
-         * Instead, repost the rcu_idle_gp_timer if this CPU has callbacks
+         * Instead, repost the ->idle_gp_timer if this CPU has callbacks
          * pending.
          */
-        if (!per_cpu(rcu_idle_first_pass, cpu) &&
-            (per_cpu(rcu_nonlazy_posted, cpu) ==
-             per_cpu(rcu_nonlazy_posted_snap, cpu))) {
+        if (!rdtp->idle_first_pass &&
+            (rdtp->nonlazy_posted == rdtp->nonlazy_posted_snap)) {
                 if (rcu_cpu_has_callbacks(cpu)) {
-                        tp = &per_cpu(rcu_idle_gp_timer, cpu);
-                        mod_timer_pinned(tp, per_cpu(rcu_idle_gp_timer_expires, cpu));
+                        tp = &rdtp->idle_gp_timer;
+                        mod_timer_pinned(tp, rdtp->idle_gp_timer_expires);
                 }
                 return;
         }
-        per_cpu(rcu_idle_first_pass, cpu) = 0;
-        per_cpu(rcu_nonlazy_posted_snap, cpu) =
-                per_cpu(rcu_nonlazy_posted, cpu) - 1;
+        rdtp->idle_first_pass = 0;
+        rdtp->nonlazy_posted_snap = rdtp->nonlazy_posted - 1;
 
         /*
          * If there are no callbacks on this CPU, enter dyntick-idle mode.
          * Also reset state to avoid prejudicing later attempts.
          */
         if (!rcu_cpu_has_callbacks(cpu)) {
-                per_cpu(rcu_dyntick_holdoff, cpu) = jiffies - 1;
-                per_cpu(rcu_dyntick_drain, cpu) = 0;
+                rdtp->dyntick_holdoff = jiffies - 1;
+                rdtp->dyntick_drain = 0;
                 trace_rcu_prep_idle("No callbacks");
                 return;
         }
@@ -2152,36 +2161,37 @@ static void rcu_prepare_for_idle(int cpu)
          * If in holdoff mode, just return.  We will presumably have
          * refrained from disabling the scheduling-clock tick.
          */
-        if (per_cpu(rcu_dyntick_holdoff, cpu) == jiffies) {
+        if (rdtp->dyntick_holdoff == jiffies) {
                 trace_rcu_prep_idle("In holdoff");
                 return;
         }
 
-        /* Check and update the rcu_dyntick_drain sequencing. */
-        if (per_cpu(rcu_dyntick_drain, cpu) <= 0) {
+        /* Check and update the ->dyntick_drain sequencing. */
+        if (rdtp->dyntick_drain <= 0) {
                 /* First time through, initialize the counter. */
-                per_cpu(rcu_dyntick_drain, cpu) = RCU_IDLE_FLUSHES;
-        } else if (per_cpu(rcu_dyntick_drain, cpu) <= RCU_IDLE_OPT_FLUSHES &&
+                rdtp->dyntick_drain = RCU_IDLE_FLUSHES;
+        } else if (rdtp->dyntick_drain <= RCU_IDLE_OPT_FLUSHES &&
                    !rcu_pending(cpu) &&
                    !local_softirq_pending()) {
                 /* Can we go dyntick-idle despite still having callbacks? */
-                trace_rcu_prep_idle("Dyntick with callbacks");
-                per_cpu(rcu_dyntick_drain, cpu) = 0;
-                per_cpu(rcu_dyntick_holdoff, cpu) = jiffies;
-                if (rcu_cpu_has_nonlazy_callbacks(cpu))
-                        per_cpu(rcu_idle_gp_timer_expires, cpu) =
+                rdtp->dyntick_drain = 0;
+                rdtp->dyntick_holdoff = jiffies;
+                if (rcu_cpu_has_nonlazy_callbacks(cpu)) {
+                        trace_rcu_prep_idle("Dyntick with callbacks");
+                        rdtp->idle_gp_timer_expires =
                                            jiffies + RCU_IDLE_GP_DELAY;
-                else
-                        per_cpu(rcu_idle_gp_timer_expires, cpu) =
+                } else {
+                        rdtp->idle_gp_timer_expires =
                                            jiffies + RCU_IDLE_LAZY_GP_DELAY;
-                tp = &per_cpu(rcu_idle_gp_timer, cpu);
-                mod_timer_pinned(tp, per_cpu(rcu_idle_gp_timer_expires, cpu));
-                per_cpu(rcu_nonlazy_posted_snap, cpu) =
-                        per_cpu(rcu_nonlazy_posted, cpu);
+                        trace_rcu_prep_idle("Dyntick with lazy callbacks");
+                }
+                tp = &rdtp->idle_gp_timer;
+                mod_timer_pinned(tp, rdtp->idle_gp_timer_expires);
+                rdtp->nonlazy_posted_snap = rdtp->nonlazy_posted;
                 return; /* Nothing more to do immediately. */
-        } else if (--per_cpu(rcu_dyntick_drain, cpu) <= 0) {
+        } else if (--(rdtp->dyntick_drain) <= 0) {
                 /* We have hit the limit, so time to give up. */
-                per_cpu(rcu_dyntick_holdoff, cpu) = jiffies;
+                rdtp->dyntick_holdoff = jiffies;
                 trace_rcu_prep_idle("Begin holdoff");
                 invoke_rcu_core();  /* Force the CPU out of dyntick-idle. */
                 return;
@@ -2227,7 +2237,7 @@ static void rcu_prepare_for_idle(int cpu)
  */
 static void rcu_idle_count_callbacks_posted(void)
 {
-        __this_cpu_add(rcu_nonlazy_posted, 1);
+        __this_cpu_add(rcu_dynticks.nonlazy_posted, 1);
 }
 
 #endif /* #else #if !defined(CONFIG_RCU_FAST_NO_HZ) */
@@ -2238,11 +2248,12 @@ static void rcu_idle_count_callbacks_posted(void)
 
 static void print_cpu_stall_fast_no_hz(char *cp, int cpu)
 {
-        struct timer_list *tltp = &per_cpu(rcu_idle_gp_timer, cpu);
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+        struct timer_list *tltp = &rdtp->idle_gp_timer;
 
         sprintf(cp, "drain=%d %c timer=%lu",
-                per_cpu(rcu_dyntick_drain, cpu),
-                per_cpu(rcu_dyntick_holdoff, cpu) == jiffies ? 'H' : '.',
+                rdtp->dyntick_drain,
+                rdtp->dyntick_holdoff == jiffies ? 'H' : '.',
                 timer_pending(tltp) ? tltp->expires - jiffies : -1);
 }
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 39eb6011bc38..d5594a4268d4 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -142,9 +142,8 @@ const_debug unsigned int sysctl_sched_features =
 #define SCHED_FEAT(name, enabled)       \
         #name ,
 
-static __read_mostly char *sched_feat_names[] = {
+static const char * const sched_feat_names[] = {
 #include "features.h"
-        NULL
 };
 
 #undef SCHED_FEAT
@@ -2517,25 +2516,32 @@ static void __update_cpu_load(struct rq *this_rq, unsigned long this_load,
         sched_avg_update(this_rq);
 }
 
+#ifdef CONFIG_NO_HZ
+/*
+ * There is no sane way to deal with nohz on smp when using jiffies because the
+ * cpu doing the jiffies update might drift wrt the cpu doing the jiffy reading
+ * causing off-by-one errors in observed deltas; {0,2} instead of {1,1}.
+ *
+ * Therefore we cannot use the delta approach from the regular tick since that
+ * would seriously skew the load calculation. However we'll make do for those
+ * updates happening while idle (nohz_idle_balance) or coming out of idle
+ * (tick_nohz_idle_exit).
+ *
+ * This means we might still be one tick off for nohz periods.
+ */
+
 /*
  * Called from nohz_idle_balance() to update the load ratings before doing the
  * idle balance.
  */
 void update_idle_cpu_load(struct rq *this_rq)
 {
-        unsigned long curr_jiffies = jiffies;
+        unsigned long curr_jiffies = ACCESS_ONCE(jiffies);
         unsigned long load = this_rq->load.weight;
         unsigned long pending_updates;
 
         /*
-         * Bloody broken means of dealing with nohz, but better than nothing..
-         * jiffies is updated by one cpu, another cpu can drift wrt the jiffy
-         * update and see 0 difference the one time and 2 the next, even though
-         * we ticked at roughtly the same rate.
-         *
-         * Hence we only use this from nohz_idle_balance() and skip this
-         * nonsense when called from the scheduler_tick() since that's
-         * guaranteed a stable rate.
+         * bail if there's load or we're actually up-to-date.
          */
         if (load || curr_jiffies == this_rq->last_load_update_tick)
                 return;
@@ -2547,12 +2553,38 @@ void update_idle_cpu_load(struct rq *this_rq)
 }
 
 /*
+ * Called from tick_nohz_idle_exit() -- try and fix up the ticks we missed.
+ */
+void update_cpu_load_nohz(void)
+{
+        struct rq *this_rq = this_rq();
+        unsigned long curr_jiffies = ACCESS_ONCE(jiffies);
+        unsigned long pending_updates;
+
+        if (curr_jiffies == this_rq->last_load_update_tick)
+                return;
+
+        raw_spin_lock(&this_rq->lock);
+        pending_updates = curr_jiffies - this_rq->last_load_update_tick;
+        if (pending_updates) {
+                this_rq->last_load_update_tick = curr_jiffies;
+                /*
+                 * We were idle, this means load 0, the current load might be
+                 * !0 due to remote wakeups and the sort.
+                 */
+                __update_cpu_load(this_rq, 0, pending_updates);
+        }
+        raw_spin_unlock(&this_rq->lock);
+}
+#endif /* CONFIG_NO_HZ */
+
+/*
  * Called from scheduler_tick()
  */
 static void update_cpu_load_active(struct rq *this_rq)
 {
         /*
-         * See the mess in update_idle_cpu_load().
+         * See the mess around update_idle_cpu_load() / update_cpu_load_nohz().
          */
         this_rq->last_load_update_tick = jiffies;
         __update_cpu_load(this_rq, this_rq->load.weight, 1);
@@ -4982,7 +5014,7 @@ void do_set_cpus_allowed(struct task_struct *p, const struct cpumask *new_mask)
                 p->sched_class->set_cpus_allowed(p, new_mask);
 
         cpumask_copy(&p->cpus_allowed, new_mask);
-        p->rt.nr_cpus_allowed = cpumask_weight(new_mask);
+        p->nr_cpus_allowed = cpumask_weight(new_mask);
 }
 
 /*
@@ -5524,15 +5556,20 @@ static cpumask_var_t sched_domains_tmpmask; /* sched_domains_mutex */
 
 #ifdef CONFIG_SCHED_DEBUG
 
-static __read_mostly int sched_domain_debug_enabled;
+static __read_mostly int sched_debug_enabled;
 
-static int __init sched_domain_debug_setup(char *str)
+static int __init sched_debug_setup(char *str)
 {
-        sched_domain_debug_enabled = 1;
+        sched_debug_enabled = 1;
 
         return 0;
 }
-early_param("sched_debug", sched_domain_debug_setup);
+early_param("sched_debug", sched_debug_setup);
+
+static inline bool sched_debug(void)
+{
+        return sched_debug_enabled;
+}
 
 static int sched_domain_debug_one(struct sched_domain *sd, int cpu, int level,
                                   struct cpumask *groupmask)
@@ -5572,7 +5609,12 @@ static int sched_domain_debug_one(struct sched_domain *sd, int cpu, int level,
                         break;
                 }
 
-                if (!group->sgp->power) {
+                /*
+                 * Even though we initialize ->power to something semi-sane,
+                 * we leave power_orig unset. This allows us to detect if
+                 * domain iteration is still funny without causing /0 traps.
+                 */
+                if (!group->sgp->power_orig) {
                         printk(KERN_CONT "\n");
                         printk(KERN_ERR "ERROR: domain->cpu_power not "
                                         "set\n");
@@ -5620,7 +5662,7 @@ static void sched_domain_debug(struct sched_domain *sd, int cpu)
 {
         int level = 0;
 
-        if (!sched_domain_debug_enabled)
+        if (!sched_debug_enabled)
                 return;
 
         if (!sd) {
@@ -5641,6 +5683,10 @@ static void sched_domain_debug(struct sched_domain *sd, int cpu)
 }
 #else /* !CONFIG_SCHED_DEBUG */
 # define sched_domain_debug(sd, cpu) do { } while (0)
+static inline bool sched_debug(void)
+{
+        return false;
+}
 #endif /* CONFIG_SCHED_DEBUG */
 
 static int sd_degenerate(struct sched_domain *sd)
@@ -5962,6 +6008,44 @@ struct sched_domain_topology_level {
         struct sd_data      data;
 };
 
+/*
+ * Build an iteration mask that can exclude certain CPUs from the upwards
+ * domain traversal.
+ *
+ * Asymmetric node setups can result in situations where the domain tree is of
+ * unequal depth, make sure to skip domains that already cover the entire
+ * range.
+ *
+ * In that case build_sched_domains() will have terminated the iteration early
+ * and our sibling sd spans will be empty. Domains should always include the
+ * cpu they're built on, so check that.
+ *
+ */
+static void build_group_mask(struct sched_domain *sd, struct sched_group *sg)
+{
+        const struct cpumask *span = sched_domain_span(sd);
+        struct sd_data *sdd = sd->private;
+        struct sched_domain *sibling;
+        int i;
+
+        for_each_cpu(i, span) {
+                sibling = *per_cpu_ptr(sdd->sd, i);
+                if (!cpumask_test_cpu(i, sched_domain_span(sibling)))
+                        continue;
+
+                cpumask_set_cpu(i, sched_group_mask(sg));
+        }
+}
+
+/*
+ * Return the canonical balance cpu for this group, this is the first cpu
+ * of this group that's also in the iteration mask.
+ */
+int group_balance_cpu(struct sched_group *sg)
+{
+        return cpumask_first_and(sched_group_cpus(sg), sched_group_mask(sg));
+}
+
 static int
 build_overlap_sched_groups(struct sched_domain *sd, int cpu)
 {
@@ -5980,6 +6064,12 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
                 if (cpumask_test_cpu(i, covered))
                         continue;
 
+                child = *per_cpu_ptr(sdd->sd, i);
+
+                /* See the comment near build_group_mask(). */
+                if (!cpumask_test_cpu(i, sched_domain_span(child)))
+                        continue;
+
                 sg = kzalloc_node(sizeof(struct sched_group) + cpumask_size(),
                                 GFP_KERNEL, cpu_to_node(cpu));
 
@@ -5987,8 +6077,6 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
                         goto fail;
 
                 sg_span = sched_group_cpus(sg);
-
-                child = *per_cpu_ptr(sdd->sd, i);
                 if (child->child) {
                         child = child->child;
                         cpumask_copy(sg_span, sched_domain_span(child));
@@ -5997,10 +6085,24 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
 
                 cpumask_or(covered, covered, sg_span);
 
-                sg->sgp = *per_cpu_ptr(sdd->sgp, cpumask_first(sg_span));
-                atomic_inc(&sg->sgp->ref);
+                sg->sgp = *per_cpu_ptr(sdd->sgp, i);
+                if (atomic_inc_return(&sg->sgp->ref) == 1)
+                        build_group_mask(sd, sg);
 
-                if (cpumask_test_cpu(cpu, sg_span))
+                /*
+                 * Initialize sgp->power such that even if we mess up the
+                 * domains and no possible iteration will get us here, we won't
+                 * die on a /0 trap.
+                 */
+                sg->sgp->power = SCHED_POWER_SCALE * cpumask_weight(sg_span);
+
+                /*
+                 * Make sure the first group of this domain contains the
+                 * canonical balance cpu. Otherwise the sched_domain iteration
+                 * breaks. See update_sg_lb_stats().
+                 */
+                if ((!groups && cpumask_test_cpu(cpu, sg_span)) ||
+                    group_balance_cpu(sg) == cpu)
                         groups = sg;
 
                 if (!first)
@@ -6074,6 +6176,7 @@ build_sched_groups(struct sched_domain *sd, int cpu)
 
                 cpumask_clear(sched_group_cpus(sg));
                 sg->sgp->power = 0;
+                cpumask_setall(sched_group_mask(sg));
 
                 for_each_cpu(j, span) {
                         if (get_group(j, sdd, NULL) != group)
@@ -6115,7 +6218,7 @@ static void init_sched_groups_power(int cpu, struct sched_domain *sd)
                 sg = sg->next;
         } while (sg != sd->groups);
 
-        if (cpu != group_first_cpu(sg))
+        if (cpu != group_balance_cpu(sg))
                 return;
 
         update_group_power(sd, cpu);
@@ -6165,11 +6268,8 @@ int sched_domain_level_max;
 
 static int __init setup_relax_domain_level(char *str)
 {
-        unsigned long val;
-
-        val = simple_strtoul(str, NULL, 0);
-        if (val < sched_domain_level_max)
-                default_relax_domain_level = val;
+        if (kstrtoint(str, 0, &default_relax_domain_level))
+                pr_warn("Unable to set relax_domain_level\n");
 
         return 1;
 }
@@ -6279,14 +6379,13 @@ static struct sched_domain_topology_level *sched_domain_topology = default_topol
 #ifdef CONFIG_NUMA
 
 static int sched_domains_numa_levels;
-static int sched_domains_numa_scale;
 static int *sched_domains_numa_distance;
 static struct cpumask ***sched_domains_numa_masks;
 static int sched_domains_curr_level;
 
 static inline int sd_local_flags(int level)
 {
-        if (sched_domains_numa_distance[level] > REMOTE_DISTANCE)
+        if (sched_domains_numa_distance[level] > RECLAIM_DISTANCE)
                 return 0;
 
         return SD_BALANCE_EXEC | SD_BALANCE_FORK | SD_WAKE_AFFINE;
@@ -6344,6 +6443,42 @@ static const struct cpumask *sd_numa_mask(int cpu)
         return sched_domains_numa_masks[sched_domains_curr_level][cpu_to_node(cpu)];
 }
 
+static void sched_numa_warn(const char *str)
+{
+        static int done = false;
+        int i,j;
+
+        if (done)
+                return;
+
+        done = true;
+
+        printk(KERN_WARNING "ERROR: %s\n\n", str);
+
+        for (i = 0; i < nr_node_ids; i++) {
+                printk(KERN_WARNING "  ");
+                for (j = 0; j < nr_node_ids; j++)
+                        printk(KERN_CONT "%02d ", node_distance(i,j));
+                printk(KERN_CONT "\n");
+        }
+        printk(KERN_WARNING "\n");
+}
+
+static bool find_numa_distance(int distance)
+{
+        int i;
+
+        if (distance == node_distance(0, 0))
+                return true;
+
+        for (i = 0; i < sched_domains_numa_levels; i++) {
+                if (sched_domains_numa_distance[i] == distance)
+                        return true;
+        }
+
+        return false;
+}
+
 static void sched_init_numa(void)
 {
         int next_distance, curr_distance = node_distance(0, 0);
@@ -6351,7 +6486,6 @@ static void sched_init_numa(void)
         int level = 0;
         int i, j, k;
 
-        sched_domains_numa_scale = curr_distance;
         sched_domains_numa_distance = kzalloc(sizeof(int) * nr_node_ids, GFP_KERNEL);
         if (!sched_domains_numa_distance)
                 return;
@@ -6362,23 +6496,41 @@ static void sched_init_numa(void)
          *
          * Assumes node_distance(0,j) includes all distances in
          * node_distance(i,j) in order to avoid cubic time.
-         *
-         * XXX: could be optimized to O(n log n) by using sort()
          */
         next_distance = curr_distance;
         for (i = 0; i < nr_node_ids; i++) {
                 for (j = 0; j < nr_node_ids; j++) {
-                        int distance = node_distance(0, j);
-                        if (distance > curr_distance &&
-                                        (distance < next_distance ||
-                                         next_distance == curr_distance))
-                                next_distance = distance;
+                        for (k = 0; k < nr_node_ids; k++) {
+                                int distance = node_distance(i, k);
+
+                                if (distance > curr_distance &&
+                                    (distance < next_distance ||
+                                     next_distance == curr_distance))
+                                        next_distance = distance;
+
+                                /*
+                                 * While not a strong assumption it would be nice to know
+                                 * about cases where if node A is connected to B, B is not
+                                 * equally connected to A.
+                                 */
+                                if (sched_debug() && node_distance(k, i) != distance)
+                                        sched_numa_warn("Node-distance not symmetric");
+
+                                if (sched_debug() && i && !find_numa_distance(distance))
+                                        sched_numa_warn("Node-0 not representative");
+                        }
+                        if (next_distance != curr_distance) {
+                                sched_domains_numa_distance[level++] = next_distance;
+                                sched_domains_numa_levels = level;
+                                curr_distance = next_distance;
+                        } else break;
                 }
-                if (next_distance != curr_distance) {
-                        sched_domains_numa_distance[level++] = next_distance;
-                        sched_domains_numa_levels = level;
-                        curr_distance = next_distance;
-                } else break;
+
+                /*
+                 * In case of sched_debug() we verify the above assumption.
+                 */
+                if (!sched_debug())
+                        break;
         }
         /*
          * 'level' contains the number of unique distances, excluding the
@@ -6403,7 +6555,7 @@ static void sched_init_numa(void)
                         return;
 
                 for (j = 0; j < nr_node_ids; j++) {
-                        struct cpumask *mask = kzalloc_node(cpumask_size(), GFP_KERNEL, j);
+                        struct cpumask *mask = kzalloc(cpumask_size(), GFP_KERNEL);
                         if (!mask)
                                 return;
 
@@ -6490,7 +6642,7 @@ static int __sdt_alloc(const struct cpumask *cpu_map)
 
                         *per_cpu_ptr(sdd->sg, j) = sg;
 
-                        sgp = kzalloc_node(sizeof(struct sched_group_power),
+                        sgp = kzalloc_node(sizeof(struct sched_group_power) + cpumask_size(),
                                         GFP_KERNEL, cpu_to_node(j));
                         if (!sgp)
                                 return -ENOMEM;
@@ -6543,7 +6695,6 @@ struct sched_domain *build_sched_domain(struct sched_domain_topology_level *tl,
         if (!sd)
                 return child;
 
-        set_domain_attribute(sd, attr);
         cpumask_and(sched_domain_span(sd), cpu_map, tl->mask(cpu));
         if (child) {
                 sd->level = child->level + 1;
@@ -6551,6 +6702,7 @@ struct sched_domain *build_sched_domain(struct sched_domain_topology_level *tl,
                 child->parent = sd;
         }
         sd->child = child;
+        set_domain_attribute(sd, attr);
 
         return sd;
 }
@@ -6691,7 +6843,6 @@ static int init_sched_domains(const struct cpumask *cpu_map)
         if (!doms_cur)
                 doms_cur = &fallback_doms;
         cpumask_andnot(doms_cur[0], cpu_map, cpu_isolated_map);
-        dattr_cur = NULL;
         err = build_sched_domains(doms_cur[0], NULL);
         register_sched_domain_sysctl();
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 940e6d17cf96..c099cc6eebe3 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2703,7 +2703,7 @@ select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flags)
         int want_sd = 1;
         int sync = wake_flags & WF_SYNC;
 
-        if (p->rt.nr_cpus_allowed == 1)
+        if (p->nr_cpus_allowed == 1)
                 return prev_cpu;
 
         if (sd_flag & SD_BALANCE_WAKE) {
@@ -3503,15 +3503,22 @@ unsigned long __weak arch_scale_smt_power(struct sched_domain *sd, int cpu)
 unsigned long scale_rt_power(int cpu)
 {
         struct rq *rq = cpu_rq(cpu);
-        u64 total, available;
+        u64 total, available, age_stamp, avg;
 
-        total = sched_avg_period() + (rq->clock - rq->age_stamp);
+        /*
+         * Since we're reading these variables without serialization make sure
+         * we read them once before doing sanity checks on them.
+         */
+        age_stamp = ACCESS_ONCE(rq->age_stamp);
+        avg = ACCESS_ONCE(rq->rt_avg);
+
+        total = sched_avg_period() + (rq->clock - age_stamp);
 
-        if (unlikely(total < rq->rt_avg)) {
+        if (unlikely(total < avg)) {
                 /* Ensures that power won't end up being negative */
                 available = 0;
         } else {
-                available = total - rq->rt_avg;
+                available = total - avg;
         }
 
         if (unlikely((s64)total < SCHED_POWER_SCALE))
@@ -3574,13 +3581,28 @@ void update_group_power(struct sched_domain *sd, int cpu)
 
         power = 0;
 
-        group = child->groups;
-        do {
-                power += group->sgp->power;
-                group = group->next;
-        } while (group != child->groups);
+        if (child->flags & SD_OVERLAP) {
+                /*
+                 * SD_OVERLAP domains cannot assume that child groups
+                 * span the current group.
+                 */
 
-        sdg->sgp->power = power;
+                for_each_cpu(cpu, sched_group_cpus(sdg))
+                        power += power_of(cpu);
+        } else  {
+                /*
+                 * !SD_OVERLAP domains can assume that child groups
+                 * span the current group.
+                 */ 
+
+                group = child->groups;
+                do {
+                        power += group->sgp->power;
+                        group = group->next;
+                } while (group != child->groups);
+        }
+
+        sdg->sgp->power_orig = sdg->sgp->power = power;
 }
 
 /*
@@ -3610,7 +3632,7 @@ fix_small_capacity(struct sched_domain *sd, struct sched_group *group)
 
 /**
  * update_sg_lb_stats - Update sched_group's statistics for load balancing.
- * @sd: The sched_domain whose statistics are to be updated.
+ * @env: The load balancing environment.
  * @group: sched_group whose statistics are to be updated.
  * @load_idx: Load index of sched_domain of this_cpu for load calc.
  * @local_group: Does group contain this_cpu.
@@ -3630,7 +3652,7 @@ static inline void update_sg_lb_stats(struct lb_env *env,
         int i;
 
         if (local_group)
-                balance_cpu = group_first_cpu(group);
+                balance_cpu = group_balance_cpu(group);
 
         /* Tally up the load of all CPUs in the group */
         max_cpu_load = 0;
@@ -3645,7 +3667,8 @@ static inline void update_sg_lb_stats(struct lb_env *env,
 
                 /* Bias balancing toward cpus of our domain */
                 if (local_group) {
-                        if (idle_cpu(i) && !first_idle_cpu) {
+                        if (idle_cpu(i) && !first_idle_cpu &&
+                                        cpumask_test_cpu(i, sched_group_mask(group))) {
                                 first_idle_cpu = 1;
                                 balance_cpu = i;
                         }
@@ -3719,11 +3742,10 @@ static inline void update_sg_lb_stats(struct lb_env *env,
 
 /**
  * update_sd_pick_busiest - return 1 on busiest group
- * @sd: sched_domain whose statistics are to be checked
+ * @env: The load balancing environment.
  * @sds: sched_domain statistics
  * @sg: sched_group candidate to be checked for being the busiest
  * @sgs: sched_group statistics
- * @this_cpu: the current cpu
  *
  * Determine if @sg is a busier group than the previously selected
  * busiest group.
@@ -3761,9 +3783,7 @@ static bool update_sd_pick_busiest(struct lb_env *env,
 
 /**
  * update_sd_lb_stats - Update sched_domain's statistics for load balancing.
- * @sd: sched_domain whose statistics are to be updated.
- * @this_cpu: Cpu for which load balance is currently performed.
- * @idle: Idle status of this_cpu
+ * @env: The load balancing environment.
  * @cpus: Set of cpus considered for load balancing.
  * @balance: Should we balance.
  * @sds: variable to hold the statistics for this sched_domain.
@@ -3852,10 +3872,8 @@ static inline void update_sd_lb_stats(struct lb_env *env,
  * Returns 1 when packing is required and a task should be moved to
  * this CPU.  The amount of the imbalance is returned in *imbalance.
  *
- * @sd: The sched_domain whose packing is to be checked.
+ * @env: The load balancing environment.
  * @sds: Statistics of the sched_domain which is to be packed
- * @this_cpu: The cpu at whose sched_domain we're performing load-balance.
- * @imbalance: returns amount of imbalanced due to packing.
  */
 static int check_asym_packing(struct lb_env *env, struct sd_lb_stats *sds)
 {
@@ -3881,9 +3899,8 @@ static int check_asym_packing(struct lb_env *env, struct sd_lb_stats *sds)
  * fix_small_imbalance - Calculate the minor imbalance that exists
  *                      amongst the groups of a sched_domain, during
  *                      load balancing.
+ * @env: The load balancing environment.
  * @sds: Statistics of the sched_domain whose imbalance is to be calculated.
- * @this_cpu: The cpu at whose sched_domain we're performing load-balance.
- * @imbalance: Variable to store the imbalance.
  */
 static inline
 void fix_small_imbalance(struct lb_env *env, struct sd_lb_stats *sds)
@@ -4026,11 +4043,7 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
  * Also calculates the amount of weighted load which should be moved
  * to restore balance.
  *
- * @sd: The sched_domain whose busiest group is to be returned.
- * @this_cpu: The cpu for which load balancing is currently being performed.
- * @imbalance: Variable which stores amount of weighted load which should
- *              be moved to restore balance/put a group to idle.
- * @idle: The idle status of this_cpu.
+ * @env: The load balancing environment.
  * @cpus: The set of CPUs under consideration for load-balancing.
  * @balance: Pointer to a variable indicating if this_cpu
  *      is the appropriate cpu to perform load balancing at this_level.
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index c5565c3c515f..573e1ca01102 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -274,13 +274,16 @@ static void update_rt_migration(struct rt_rq *rt_rq)
 
 static void inc_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
 {
+        struct task_struct *p;
+
         if (!rt_entity_is_task(rt_se))
                 return;
 
+        p = rt_task_of(rt_se);
         rt_rq = &rq_of_rt_rq(rt_rq)->rt;
 
         rt_rq->rt_nr_total++;
-        if (rt_se->nr_cpus_allowed > 1)
+        if (p->nr_cpus_allowed > 1)
                 rt_rq->rt_nr_migratory++;
 
         update_rt_migration(rt_rq);
@@ -288,13 +291,16 @@ static void inc_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
 
 static void dec_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
 {
+        struct task_struct *p;
+
         if (!rt_entity_is_task(rt_se))
                 return;
 
+        p = rt_task_of(rt_se);
         rt_rq = &rq_of_rt_rq(rt_rq)->rt;
 
         rt_rq->rt_nr_total--;
-        if (rt_se->nr_cpus_allowed > 1)
+        if (p->nr_cpus_allowed > 1)
                 rt_rq->rt_nr_migratory--;
 
         update_rt_migration(rt_rq);
@@ -1161,7 +1167,7 @@ enqueue_task_rt(struct rq *rq, struct task_struct *p, int flags)
 
         enqueue_rt_entity(rt_se, flags & ENQUEUE_HEAD);
 
-        if (!task_current(rq, p) && p->rt.nr_cpus_allowed > 1)
+        if (!task_current(rq, p) && p->nr_cpus_allowed > 1)
                 enqueue_pushable_task(rq, p);
 
         inc_nr_running(rq);
@@ -1225,7 +1231,7 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
 
         cpu = task_cpu(p);
 
-        if (p->rt.nr_cpus_allowed == 1)
+        if (p->nr_cpus_allowed == 1)
                 goto out;
 
         /* For anything but wake ups, just return the task_cpu */
@@ -1260,9 +1266,9 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
          * will have to sort it out.
          */
         if (curr && unlikely(rt_task(curr)) &&
-            (curr->rt.nr_cpus_allowed < 2 ||
+            (curr->nr_cpus_allowed < 2 ||
              curr->prio <= p->prio) &&
-            (p->rt.nr_cpus_allowed > 1)) {
+            (p->nr_cpus_allowed > 1)) {
                 int target = find_lowest_rq(p);
 
                 if (target != -1)
@@ -1276,10 +1282,10 @@ out:
 
 static void check_preempt_equal_prio(struct rq *rq, struct task_struct *p)
 {
-        if (rq->curr->rt.nr_cpus_allowed == 1)
+        if (rq->curr->nr_cpus_allowed == 1)
                 return;
 
-        if (p->rt.nr_cpus_allowed != 1
+        if (p->nr_cpus_allowed != 1
             && cpupri_find(&rq->rd->cpupri, p, NULL))
                 return;
 
@@ -1395,7 +1401,7 @@ static void put_prev_task_rt(struct rq *rq, struct task_struct *p)
          * The previous task needs to be made eligible for pushing
          * if it is still active
          */
-        if (on_rt_rq(&p->rt) && p->rt.nr_cpus_allowed > 1)
+        if (on_rt_rq(&p->rt) && p->nr_cpus_allowed > 1)
                 enqueue_pushable_task(rq, p);
 }
 
@@ -1408,7 +1414,7 @@ static int pick_rt_task(struct rq *rq, struct task_struct *p, int cpu)
 {
         if (!task_running(rq, p) &&
             (cpu < 0 || cpumask_test_cpu(cpu, tsk_cpus_allowed(p))) &&
-            (p->rt.nr_cpus_allowed > 1))
+            (p->nr_cpus_allowed > 1))
                 return 1;
         return 0;
 }
@@ -1464,7 +1470,7 @@ static int find_lowest_rq(struct task_struct *task)
         if (unlikely(!lowest_mask))
                 return -1;
 
-        if (task->rt.nr_cpus_allowed == 1)
+        if (task->nr_cpus_allowed == 1)
                 return -1; /* No other targets possible */
 
         if (!cpupri_find(&task_rq(task)->rd->cpupri, task, lowest_mask))
@@ -1556,7 +1562,7 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq)
                                      task_running(rq, task) ||
                                      !task->on_rq)) {
 
-                                raw_spin_unlock(&lowest_rq->lock);
+                                double_unlock_balance(rq, lowest_rq);
                                 lowest_rq = NULL;
                                 break;
                         }
@@ -1586,7 +1592,7 @@ static struct task_struct *pick_next_pushable_task(struct rq *rq)
 
         BUG_ON(rq->cpu != task_cpu(p));
         BUG_ON(task_current(rq, p));
-        BUG_ON(p->rt.nr_cpus_allowed <= 1);
+        BUG_ON(p->nr_cpus_allowed <= 1);
 
         BUG_ON(!p->on_rq);
         BUG_ON(!rt_task(p));
@@ -1793,9 +1799,9 @@ static void task_woken_rt(struct rq *rq, struct task_struct *p)
         if (!task_running(rq, p) &&
             !test_tsk_need_resched(rq->curr) &&
             has_pushable_tasks(rq) &&
-            p->rt.nr_cpus_allowed > 1 &&
+            p->nr_cpus_allowed > 1 &&
             rt_task(rq->curr) &&
-            (rq->curr->rt.nr_cpus_allowed < 2 ||
+            (rq->curr->nr_cpus_allowed < 2 ||
              rq->curr->prio <= p->prio))
                 push_rt_tasks(rq);
 }
@@ -1817,7 +1823,7 @@ static void set_cpus_allowed_rt(struct task_struct *p,
          * Only update if the process changes its state from whether it
          * can migrate or not.
          */
-        if ((p->rt.nr_cpus_allowed > 1) == (weight > 1))
+        if ((p->nr_cpus_allowed > 1) == (weight > 1))
                 return;
 
         rq = task_rq(p);
@@ -1979,6 +1985,8 @@ static void watchdog(struct rq *rq, struct task_struct *p)
 
 static void task_tick_rt(struct rq *rq, struct task_struct *p, int queued)
 {
+        struct sched_rt_entity *rt_se = &p->rt;
+
         update_curr_rt(rq);
 
         watchdog(rq, p);
@@ -1996,12 +2004,15 @@ static void task_tick_rt(struct rq *rq, struct task_struct *p, int queued)
         p->rt.time_slice = RR_TIMESLICE;
 
         /*
-         * Requeue to the end of queue if we are not the only element
-         * on the queue:
+         * Requeue to the end of queue if we (and all of our ancestors) are the
+         * only element on the queue
          */
-        if (p->rt.run_list.prev != p->rt.run_list.next) {
-                requeue_task_rt(rq, p, 0);
-                set_tsk_need_resched(p);
+        for_each_sched_rt_entity(rt_se) {
+                if (rt_se->run_list.prev != rt_se->run_list.next) {
+                        requeue_task_rt(rq, p, 0);
+                        set_tsk_need_resched(p);
+                        return;
+                }
         }
 }
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index ba9dccfd24ce..6d52cea7f33d 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -526,6 +526,8 @@ static inline struct sched_domain *highest_flag_domain(int cpu, int flag)
 DECLARE_PER_CPU(struct sched_domain *, sd_llc);
 DECLARE_PER_CPU(int, sd_llc_id);
 
+extern int group_balance_cpu(struct sched_group *sg);
+
 #endif /* CONFIG_SMP */
 
 #include "stats.h"
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index e1a797e028a3..98f60c5caa1b 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -31,6 +31,12 @@ void __init idle_thread_set_boot_cpu(void)
         per_cpu(idle_threads, smp_processor_id()) = current;
 }
 
+/**
+ * idle_init - Initialize the idle thread for a cpu
+ * @cpu:        The cpu for which the idle thread should be initialized
+ *
+ * Creates the thread if it does not exist.
+ */
 static inline void idle_init(unsigned int cpu)
 {
         struct task_struct *tsk = per_cpu(idle_threads, cpu);
@@ -45,17 +51,16 @@ static inline void idle_init(unsigned int cpu)
 }
 
 /**
- * idle_thread_init - Initialize the idle thread for a cpu
- * @cpu:        The cpu for which the idle thread should be initialized
- *
- * Creates the thread if it does not exist.
+ * idle_threads_init - Initialize idle threads for all cpus
  */
 void __init idle_threads_init(void)
 {
-        unsigned int cpu;
+        unsigned int cpu, boot_cpu;
+
+        boot_cpu = smp_processor_id();
 
         for_each_possible_cpu(cpu) {
-                if (cpu != smp_processor_id())
+                if (cpu != boot_cpu)
                         idle_init(cpu);
         }
 }
diff --git a/kernel/sys.c b/kernel/sys.c
index 9ff89cb9657a..f0ec44dcd415 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1786,27 +1786,13 @@ SYSCALL_DEFINE1(umask, int, mask)
 }
 
 #ifdef CONFIG_CHECKPOINT_RESTORE
-static bool vma_flags_mismatch(struct vm_area_struct *vma,
-                               unsigned long required,
-                               unsigned long banned)
-{
-        return (vma->vm_flags & required) != required ||
-                (vma->vm_flags & banned);
-}
-
 static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
 {
+        struct vm_area_struct *vma;
         struct file *exe_file;
         struct dentry *dentry;
         int err;
 
-        /*
-         * Setting new mm::exe_file is only allowed when no VM_EXECUTABLE vma's
-         * remain. So perform a quick test first.
-         */
-        if (mm->num_exe_file_vmas)
-                return -EBUSY;
-
         exe_file = fget(fd);
         if (!exe_file)
                 return -EBADF;
@@ -1827,17 +1813,30 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
         if (err)
                 goto exit;
 
+        down_write(&mm->mmap_sem);
+
+        /*
+         * Forbid mm->exe_file change if there are mapped other files.
+         */
+        err = -EBUSY;
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                if (vma->vm_file && !path_equal(&vma->vm_file->f_path,
+                                                &exe_file->f_path))
+                        goto exit_unlock;
+        }
+
         /*
          * The symlink can be changed only once, just to disallow arbitrary
          * transitions malicious software might bring in. This means one
          * could make a snapshot over all processes running and monitor
          * /proc/pid/exe changes to notice unusual activity if needed.
          */
-        down_write(&mm->mmap_sem);
-        if (likely(!mm->exe_file))
-                set_mm_exe_file(mm, exe_file);
-        else
-                err = -EBUSY;
+        err = -EPERM;
+        if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
+                goto exit_unlock;
+
+        set_mm_exe_file(mm, exe_file);
+exit_unlock:
         up_write(&mm->mmap_sem);
 
 exit:
@@ -1862,7 +1861,7 @@ static int prctl_set_mm(int opt, unsigned long addr,
         if (opt == PR_SET_MM_EXE_FILE)
                 return prctl_set_mm_exe_file(mm, (unsigned int)addr);
 
-        if (addr >= TASK_SIZE)
+        if (addr >= TASK_SIZE || addr < mmap_min_addr)
                 return -EINVAL;
 
         error = -EINVAL;
@@ -1924,12 +1923,6 @@ static int prctl_set_mm(int opt, unsigned long addr,
                         error = -EFAULT;
                         goto out;
                 }
-#ifdef CONFIG_STACK_GROWSUP
-                if (vma_flags_mismatch(vma, VM_READ | VM_WRITE | VM_GROWSUP, 0))
-#else
-                if (vma_flags_mismatch(vma, VM_READ | VM_WRITE | VM_GROWSDOWN, 0))
-#endif
-                        goto out;
                 if (opt == PR_SET_MM_START_STACK)
                         mm->start_stack = addr;
                 else if (opt == PR_SET_MM_ARG_START)
@@ -1981,12 +1974,22 @@ out:
         up_read(&mm->mmap_sem);
         return error;
 }
+
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return put_user(me->clear_child_tid, tid_addr);
+}
+
 #else /* CONFIG_CHECKPOINT_RESTORE */
 static int prctl_set_mm(int opt, unsigned long addr,
                         unsigned long arg4, unsigned long arg5)
 {
         return -EINVAL;
 }
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return -EINVAL;
+}
 #endif
 
 SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
@@ -2124,6 +2127,9 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                 else
                                         return -EINVAL;
                                 break;
+                case PR_GET_TID_ADDRESS:
+                        error = prctl_get_tid_address(me, (int __user **)arg2);
+                        break;
                         default:
                                 return -EINVAL;
                         }
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 9cd928f7a7c6..7e1ce012a851 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -297,8 +297,7 @@ void clockevents_register_device(struct clock_event_device *dev)
 }
 EXPORT_SYMBOL_GPL(clockevents_register_device);
 
-static void clockevents_config(struct clock_event_device *dev,
-                               u32 freq)
+void clockevents_config(struct clock_event_device *dev, u32 freq)
 {
         u64 sec;
 
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 6a3a5b9ff561..869997833928 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -274,6 +274,7 @@ EXPORT_SYMBOL_GPL(get_cpu_iowait_time_us);
 static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
 {
         unsigned long seq, last_jiffies, next_jiffies, delta_jiffies;
+        unsigned long rcu_delta_jiffies;
         ktime_t last_update, expires, now;
         struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
         u64 time_delta;
@@ -322,7 +323,7 @@ static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
                 time_delta = timekeeping_max_deferment();
         } while (read_seqretry(&xtime_lock, seq));
 
-        if (rcu_needs_cpu(cpu) || printk_needs_cpu(cpu) ||
+        if (rcu_needs_cpu(cpu, &rcu_delta_jiffies) || printk_needs_cpu(cpu) ||
             arch_needs_cpu(cpu)) {
                 next_jiffies = last_jiffies + 1;
                 delta_jiffies = 1;
@@ -330,6 +331,10 @@ static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
                 /* Get the next timer wheel timer */
                 next_jiffies = get_next_timer_interrupt(last_jiffies);
                 delta_jiffies = next_jiffies - last_jiffies;
+                if (rcu_delta_jiffies < delta_jiffies) {
+                        next_jiffies = last_jiffies + rcu_delta_jiffies;
+                        delta_jiffies = rcu_delta_jiffies;
+                }
         }
         /*
          * Do not stop the tick, if we are only one off
@@ -576,6 +581,7 @@ void tick_nohz_idle_exit(void)
         /* Update jiffies first */
         select_nohz_load_balancer(0);
         tick_do_update_jiffies64(now);
+        update_cpu_load_nohz();
 
 #ifndef CONFIG_VIRT_CPU_ACCOUNTING
         /*
@@ -814,6 +820,16 @@ static enum hrtimer_restart tick_sched_timer(struct hrtimer *timer)
         return HRTIMER_RESTART;
 }
 
+static int sched_skew_tick;
+
+static int __init skew_tick(char *str)
+{
+        get_option(&str, &sched_skew_tick);
+
+        return 0;
+}
+early_param("skew_tick", skew_tick);
+
 /**
  * tick_setup_sched_timer - setup the tick emulation timer
  */
@@ -831,6 +847,14 @@ void tick_setup_sched_timer(void)
         /* Get the next period (per cpu) */
         hrtimer_set_expires(&ts->sched_timer, tick_init_jiffy_update());
 
+        /* Offset the tick to avert xtime_lock contention. */
+        if (sched_skew_tick) {
+                u64 offset = ktime_to_ns(tick_period) >> 1;
+                do_div(offset, num_possible_cpus());
+                offset *= smp_processor_id();
+                hrtimer_add_expires_ns(&ts->sched_timer, offset);
+        }
+
         for (;;) {
                 hrtimer_forward(&ts->sched_timer, now, tick_period);
                 hrtimer_start_expires(&ts->sched_timer,
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 6e46cacf5969..6f46a00a1e8a 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -962,6 +962,7 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
                 timekeeper.xtime.tv_sec++;
                 leap = second_overflow(timekeeper.xtime.tv_sec);
                 timekeeper.xtime.tv_sec += leap;
+                timekeeper.wall_to_monotonic.tv_sec -= leap;
         }
 
         /* Accumulate raw time */
@@ -1077,6 +1078,7 @@ static void update_wall_time(void)
                 timekeeper.xtime.tv_sec++;
                 leap = second_overflow(timekeeper.xtime.tv_sec);
                 timekeeper.xtime.tv_sec += leap;
+                timekeeper.wall_to_monotonic.tv_sec -= leap;
         }
 
         timekeeping_update(false);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 68032c6177db..49249c28690d 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -371,7 +371,7 @@ EXPORT_SYMBOL_GPL(tracing_on);
 void tracing_off(void)
 {
         if (global_trace.buffer)
-                ring_buffer_record_on(global_trace.buffer);
+                ring_buffer_record_off(global_trace.buffer);
         /*
          * This flag is only looked at when buffers haven't been
          * allocated yet. We don't really care about the race
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index e5e1d85b8c7c..4b1dfba70f7c 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -372,6 +372,13 @@ static int watchdog(void *unused)
 
 
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
+/*
+ * People like the simple clean cpu node info on boot.
+ * Reduce the watchdog noise by only printing messages
+ * that are different from what cpu0 displayed.
+ */
+static unsigned long cpu0_err;
+
 static int watchdog_nmi_enable(int cpu)
 {
         struct perf_event_attr *wd_attr;
@@ -390,11 +397,21 @@ static int watchdog_nmi_enable(int cpu)
 
         /* Try to register using hardware perf events */
         event = perf_event_create_kernel_counter(wd_attr, cpu, NULL, watchdog_overflow_callback, NULL);
+
+        /* save cpu0 error for future comparision */
+        if (cpu == 0 && IS_ERR(event))
+                cpu0_err = PTR_ERR(event);
+
         if (!IS_ERR(event)) {
-                pr_info("enabled, takes one hw-pmu counter.\n");
+                /* only print for cpu0 or different than cpu0 */
+                if (cpu == 0 || cpu0_err)
+                        pr_info("enabled on all CPUs, permanently consumes one hw-PMU counter.\n");
                 goto out_save;
         }
 
+        /* skip displaying the same error again */
+        if (cpu > 0 && (PTR_ERR(event) == cpu0_err))
+                return PTR_ERR(event);
 
         /* vary the KERN level based on the returned errno */
         if (PTR_ERR(event) == -EOPNOTSUPP)
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index a42d3ae39648..ff5bdee4716d 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -241,6 +241,26 @@ config BOOTPARAM_SOFTLOCKUP_PANIC_VALUE
         default 0 if !BOOTPARAM_SOFTLOCKUP_PANIC
         default 1 if BOOTPARAM_SOFTLOCKUP_PANIC
 
+config PANIC_ON_OOPS
+        bool "Panic on Oops" if EXPERT
+        default n
+        help
+          Say Y here to enable the kernel to panic when it oopses. This
+          has the same effect as setting oops=panic on the kernel command
+          line.
+
+          This feature is useful to ensure that the kernel does not do
+          anything erroneous after an oops which could result in data
+          corruption or other issues.
+
+          Say N if unsure.
+
+config PANIC_ON_OOPS_VALUE
+        int
+        range 0 1
+        default 0 if !PANIC_ON_OOPS
+        default 1 if PANIC_ON_OOPS
+
 config DETECT_HUNG_TASK
         bool "Detect Hung Tasks"
         depends on DEBUG_KERNEL
diff --git a/lib/btree.c b/lib/btree.c
index e5ec1e9c1aa5..f9a484676cb6 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -319,8 +319,8 @@ void *btree_get_prev(struct btree_head *head, struct btree_geo *geo,
 
         if (head->height == 0)
                 return NULL;
-retry:
         longcpy(key, __key, geo->keylen);
+retry:
         dec_key(geo, key);
 
         node = head->node;
@@ -351,7 +351,7 @@ retry:
         }
 miss:
         if (retry_key) {
-                __key = retry_key;
+                longcpy(key, retry_key, geo->keylen);
                 retry_key = NULL;
                 goto retry;
         }
@@ -509,6 +509,7 @@ retry:
 int btree_insert(struct btree_head *head, struct btree_geo *geo,
                 unsigned long *key, void *val, gfp_t gfp)
 {
+        BUG_ON(!val);
         return btree_insert_level(head, geo, key, val, 1, gfp);
 }
 EXPORT_SYMBOL_GPL(btree_insert);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index d7c878cc006c..e7964296fd50 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -686,6 +686,9 @@ void **radix_tree_next_chunk(struct radix_tree_root *root,
          * during iterating; it can be zero only at the beginning.
          * And we cannot overflow iter->next_index in a single step,
          * because RADIX_TREE_MAP_SHIFT < BITS_PER_LONG.
+         *
+         * This condition also used by radix_tree_next_slot() to stop
+         * contiguous iterating, and forbid swithing to the next chunk.
          */
         index = iter->next_index;
         if (!index && iter->index)
diff --git a/lib/raid6/recov.c b/lib/raid6/recov.c
index 1805a5cc5daa..a95bccb8497d 100644
--- a/lib/raid6/recov.c
+++ b/lib/raid6/recov.c
@@ -22,8 +22,8 @@
 #include <linux/raid/pq.h>
 
 /* Recover two failed data blocks. */
-void raid6_2data_recov_intx1(int disks, size_t bytes, int faila, int failb,
-                       void **ptrs)
+static void raid6_2data_recov_intx1(int disks, size_t bytes, int faila,
+                int failb, void **ptrs)
 {
         u8 *p, *q, *dp, *dq;
         u8 px, qx, db;
@@ -66,7 +66,8 @@ void raid6_2data_recov_intx1(int disks, size_t bytes, int faila, int failb,
 }
 
 /* Recover failure of one data block plus the P block */
-void raid6_datap_recov_intx1(int disks, size_t bytes, int faila, void **ptrs)
+static void raid6_datap_recov_intx1(int disks, size_t bytes, int faila,
+                void **ptrs)
 {
         u8 *p, *q, *dq;
         const u8 *qmul;         /* Q multiplier table */
diff --git a/lib/raid6/recov_ssse3.c b/lib/raid6/recov_ssse3.c
index 37ae61930559..ecb710c0b4d9 100644
--- a/lib/raid6/recov_ssse3.c
+++ b/lib/raid6/recov_ssse3.c
@@ -19,8 +19,8 @@ static int raid6_has_ssse3(void)
                 boot_cpu_has(X86_FEATURE_SSSE3);
 }
 
-void raid6_2data_recov_ssse3(int disks, size_t bytes, int faila, int failb,
-                       void **ptrs)
+static void raid6_2data_recov_ssse3(int disks, size_t bytes, int faila,
+                int failb, void **ptrs)
 {
         u8 *p, *q, *dp, *dq;
         const u8 *pbmul;        /* P multiplier table for B data */
@@ -194,7 +194,8 @@ void raid6_2data_recov_ssse3(int disks, size_t bytes, int faila, int failb,
 }
 
 
-void raid6_datap_recov_ssse3(int disks, size_t bytes, int faila, void **ptrs)
+static void raid6_datap_recov_ssse3(int disks, size_t bytes, int faila,
+                void **ptrs)
 {
         u8 *p, *q, *dq;
         const u8 *qmul;         /* Q multiplier table */
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index d0ec4f3d1593..e91fbc23fff1 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -118,7 +118,7 @@ static void __spin_lock_debug(raw_spinlock_t *lock)
                 /* lockup suspected: */
                 if (print_once) {
                         print_once = 0;
-                        spin_dump(lock, "lockup");
+                        spin_dump(lock, "lockup suspected");
 #ifdef CONFIG_SMP
                         trigger_all_cpu_backtrace();
 #endif
diff --git a/mm/Kconfig b/mm/Kconfig
index b2176374b98e..82fed4eb2b6f 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -389,3 +389,20 @@ config CLEANCACHE
           in a negligible performance hit.
 
           If unsure, say Y to enable cleancache
+
+config FRONTSWAP
+        bool "Enable frontswap to cache swap pages if tmem is present"
+        depends on SWAP
+        default n
+        help
+          Frontswap is so named because it can be thought of as the opposite
+          of a "backing" store for a swap device.  The data is stored into
+          "transcendent memory", memory that is not directly accessible or
+          addressable by the kernel and is of unknown and possibly
+          time-varying size.  When space in transcendent memory is available,
+          a significant swap I/O reduction may be achieved.  When none is
+          available, all frontswap calls are reduced to a single pointer-
+          compare-against-NULL resulting in a negligible performance hit
+          and swap data is stored as normal on the matching swap device.
+
+          If unsure, say Y to enable frontswap.
diff --git a/mm/Makefile b/mm/Makefile
index a156285ce88d..2e2fbbefb99f 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -29,6 +29,7 @@ obj-$(CONFIG_HAVE_MEMBLOCK) += memblock.o
 
 obj-$(CONFIG_BOUNCE)    += bounce.o
 obj-$(CONFIG_SWAP)      += page_io.o swap_state.o swapfile.o
+obj-$(CONFIG_FRONTSWAP) += frontswap.o
 obj-$(CONFIG_HAS_DMA)   += dmapool.o
 obj-$(CONFIG_HUGETLBFS) += hugetlb.o
 obj-$(CONFIG_NUMA)      += mempolicy.o
diff --git a/mm/compaction.c b/mm/compaction.c
index 4ac338af5120..7ea259d82a99 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -236,7 +236,7 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
          */
         while (unlikely(too_many_isolated(zone))) {
                 /* async migration should just abort */
-                if (cc->mode != COMPACT_SYNC)
+                if (!cc->sync)
                         return 0;
 
                 congestion_wait(BLK_RW_ASYNC, HZ/10);
@@ -304,8 +304,7 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                  * satisfies the allocation
                  */
                 pageblock_nr = low_pfn >> pageblock_order;
-                if (cc->mode != COMPACT_SYNC &&
-                    last_pageblock_nr != pageblock_nr &&
+                if (!cc->sync && last_pageblock_nr != pageblock_nr &&
                     !migrate_async_suitable(get_pageblock_migratetype(page))) {
                         low_pfn += pageblock_nr_pages;
                         low_pfn = ALIGN(low_pfn, pageblock_nr_pages) - 1;
@@ -326,7 +325,7 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
                         continue;
                 }
 
-                if (cc->mode != COMPACT_SYNC)
+                if (!cc->sync)
                         mode |= ISOLATE_ASYNC_MIGRATE;
 
                 lruvec = mem_cgroup_page_lruvec(page, zone);
@@ -361,90 +360,27 @@ isolate_migratepages_range(struct zone *zone, struct compact_control *cc,
 
 #endif /* CONFIG_COMPACTION || CONFIG_CMA */
 #ifdef CONFIG_COMPACTION
-/*
- * Returns true if MIGRATE_UNMOVABLE pageblock was successfully
- * converted to MIGRATE_MOVABLE type, false otherwise.
- */
-static bool rescue_unmovable_pageblock(struct page *page)
-{
-        unsigned long pfn, start_pfn, end_pfn;
-        struct page *start_page, *end_page;
-
-        pfn = page_to_pfn(page);
-        start_pfn = pfn & ~(pageblock_nr_pages - 1);
-        end_pfn = start_pfn + pageblock_nr_pages;
-
-        start_page = pfn_to_page(start_pfn);
-        end_page = pfn_to_page(end_pfn);
-
-        /* Do not deal with pageblocks that overlap zones */
-        if (page_zone(start_page) != page_zone(end_page))
-                return false;
-
-        for (page = start_page, pfn = start_pfn; page < end_page; pfn++,
-                                                                  page++) {
-                if (!pfn_valid_within(pfn))
-                        continue;
-
-                if (PageBuddy(page)) {
-                        int order = page_order(page);
-
-                        pfn += (1 << order) - 1;
-                        page += (1 << order) - 1;
-
-                        continue;
-                } else if (page_count(page) == 0 || PageLRU(page))
-                        continue;
-
-                return false;
-        }
-
-        set_pageblock_migratetype(page, MIGRATE_MOVABLE);
-        move_freepages_block(page_zone(page), page, MIGRATE_MOVABLE);
-        return true;
-}
 
-enum smt_result {
-        GOOD_AS_MIGRATION_TARGET,
-        FAIL_UNMOVABLE_TARGET,
-        FAIL_BAD_TARGET,
-};
-
-/*
- * Returns GOOD_AS_MIGRATION_TARGET if the page is within a block
- * suitable for migration to, FAIL_UNMOVABLE_TARGET if the page
- * is within a MIGRATE_UNMOVABLE block, FAIL_BAD_TARGET otherwise.
- */
-static enum smt_result suitable_migration_target(struct page *page,
-                                      struct compact_control *cc)
+/* Returns true if the page is within a block suitable for migration to */
+static bool suitable_migration_target(struct page *page)
 {
 
         int migratetype = get_pageblock_migratetype(page);
 
         /* Don't interfere with memory hot-remove or the min_free_kbytes blocks */
         if (migratetype == MIGRATE_ISOLATE || migratetype == MIGRATE_RESERVE)
-                return FAIL_BAD_TARGET;
+                return false;
 
         /* If the page is a large free page, then allow migration */
         if (PageBuddy(page) && page_order(page) >= pageblock_order)
-                return GOOD_AS_MIGRATION_TARGET;
+                return true;
 
         /* If the block is MIGRATE_MOVABLE or MIGRATE_CMA, allow migration */
-        if (cc->mode != COMPACT_ASYNC_UNMOVABLE &&
-            migrate_async_suitable(migratetype))
-                return GOOD_AS_MIGRATION_TARGET;
-
-        if (cc->mode == COMPACT_ASYNC_MOVABLE &&
-            migratetype == MIGRATE_UNMOVABLE)
-                return FAIL_UNMOVABLE_TARGET;
-
-        if (cc->mode != COMPACT_ASYNC_MOVABLE &&
-            migratetype == MIGRATE_UNMOVABLE &&
-            rescue_unmovable_pageblock(page))
-                return GOOD_AS_MIGRATION_TARGET;
+        if (migrate_async_suitable(migratetype))
+                return true;
 
         /* Otherwise skip the block */
-        return FAIL_BAD_TARGET;
+        return false;
 }
 
 /*
@@ -478,13 +414,6 @@ static void isolate_freepages(struct zone *zone,
         zone_end_pfn = zone->zone_start_pfn + zone->spanned_pages;
 
         /*
-         * isolate_freepages() may be called more than once during
-         * compact_zone_order() run and we want only the most recent
-         * count.
-         */
-        cc->nr_pageblocks_skipped = 0;
-
-        /*
          * Isolate free pages until enough are available to migrate the
          * pages on cc->migratepages. We stop searching if the migrate
          * and free page scanners meet or enough free pages are isolated.
@@ -492,7 +421,6 @@ static void isolate_freepages(struct zone *zone,
         for (; pfn > low_pfn && cc->nr_migratepages > nr_freepages;
                                         pfn -= pageblock_nr_pages) {
                 unsigned long isolated;
-                enum smt_result ret;
 
                 if (!pfn_valid(pfn))
                         continue;
@@ -509,12 +437,9 @@ static void isolate_freepages(struct zone *zone,
                         continue;
 
                 /* Check the block is suitable for migration */
-                ret = suitable_migration_target(page, cc);
-                if (ret != GOOD_AS_MIGRATION_TARGET) {
-                        if (ret == FAIL_UNMOVABLE_TARGET)
-                                cc->nr_pageblocks_skipped++;
+                if (!suitable_migration_target(page))
                         continue;
-                }
+
                 /*
                  * Found a block suitable for isolating free pages from. Now
                  * we disabled interrupts, double check things are ok and
@@ -523,14 +448,12 @@ static void isolate_freepages(struct zone *zone,
                  */
                 isolated = 0;
                 spin_lock_irqsave(&zone->lock, flags);
-                ret = suitable_migration_target(page, cc);
-                if (ret == GOOD_AS_MIGRATION_TARGET) {
+                if (suitable_migration_target(page)) {
                         end_pfn = min(pfn + pageblock_nr_pages, zone_end_pfn);
                         isolated = isolate_freepages_block(pfn, end_pfn,
                                                            freelist, false);
                         nr_freepages += isolated;
-                } else if (ret == FAIL_UNMOVABLE_TARGET)
-                        cc->nr_pageblocks_skipped++;
+                }
                 spin_unlock_irqrestore(&zone->lock, flags);
 
                 /*
@@ -762,9 +685,8 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
 
                 nr_migrate = cc->nr_migratepages;
                 err = migrate_pages(&cc->migratepages, compaction_alloc,
-                        (unsigned long)&cc->freepages, false,
-                        (cc->mode == COMPACT_SYNC) ? MIGRATE_SYNC_LIGHT
-                                                      : MIGRATE_ASYNC);
+                                (unsigned long)cc, false,
+                                cc->sync ? MIGRATE_SYNC_LIGHT : MIGRATE_ASYNC);
                 update_nr_listpages(cc);
                 nr_remaining = cc->nr_migratepages;
 
@@ -793,8 +715,7 @@ out:
 
 static unsigned long compact_zone_order(struct zone *zone,
                                  int order, gfp_t gfp_mask,
-                                 enum compact_mode mode,
-                                 unsigned long *nr_pageblocks_skipped)
+                                 bool sync)
 {
         struct compact_control cc = {
                 .nr_freepages = 0,
@@ -802,17 +723,12 @@ static unsigned long compact_zone_order(struct zone *zone,
                 .order = order,
                 .migratetype = allocflags_to_migratetype(gfp_mask),
                 .zone = zone,
-                .mode = mode,
+                .sync = sync,
         };
-        unsigned long rc;
-
         INIT_LIST_HEAD(&cc.freepages);
         INIT_LIST_HEAD(&cc.migratepages);
 
-        rc = compact_zone(zone, &cc);
-        *nr_pageblocks_skipped = cc.nr_pageblocks_skipped;
-
-        return rc;
+        return compact_zone(zone, &cc);
 }
 
 int sysctl_extfrag_threshold = 500;
@@ -837,8 +753,6 @@ unsigned long try_to_compact_pages(struct zonelist *zonelist,
         struct zoneref *z;
         struct zone *zone;
         int rc = COMPACT_SKIPPED;
-        unsigned long nr_pageblocks_skipped;
-        enum compact_mode mode;
 
         /*
          * Check whether it is worth even starting compaction. The order check is
@@ -855,22 +769,12 @@ unsigned long try_to_compact_pages(struct zonelist *zonelist,
                                                                 nodemask) {
                 int status;
 
-                mode = sync ? COMPACT_SYNC : COMPACT_ASYNC_MOVABLE;
-retry:
-                status = compact_zone_order(zone, order, gfp_mask, mode,
-                                                &nr_pageblocks_skipped);
+                status = compact_zone_order(zone, order, gfp_mask, sync);
                 rc = max(status, rc);
 
                 /* If a normal allocation would succeed, stop compacting */
                 if (zone_watermark_ok(zone, order, low_wmark_pages(zone), 0, 0))
                         break;
-
-                if (rc == COMPACT_COMPLETE && mode == COMPACT_ASYNC_MOVABLE) {
-                        if (nr_pageblocks_skipped) {
-                                mode = COMPACT_ASYNC_UNMOVABLE;
-                                goto retry;
-                        }
-                }
         }
 
         return rc;
@@ -904,7 +808,7 @@ static int __compact_pgdat(pg_data_t *pgdat, struct compact_control *cc)
                         if (ok && cc->order > zone->compact_order_failed)
                                 zone->compact_order_failed = cc->order + 1;
                         /* Currently async compaction is never deferred. */
-                        else if (!ok && cc->mode == COMPACT_SYNC)
+                        else if (!ok && cc->sync)
                                 defer_compaction(zone, cc->order);
                 }
 
@@ -919,7 +823,7 @@ int compact_pgdat(pg_data_t *pgdat, int order)
 {
         struct compact_control cc = {
                 .order = order,
-                .mode = COMPACT_ASYNC_MOVABLE,
+                .sync = false,
         };
 
         return __compact_pgdat(pgdat, &cc);
@@ -929,7 +833,7 @@ static int compact_node(int nid)
 {
         struct compact_control cc = {
                 .order = -1,
-                .mode = COMPACT_SYNC,
+                .sync = true,
         };
 
         return __compact_pgdat(NODE_DATA(nid), &cc);
diff --git a/mm/frontswap.c b/mm/frontswap.c
new file mode 100644
index 000000000000..e25025574a02
--- /dev/null
+++ b/mm/frontswap.c
@@ -0,0 +1,314 @@
+/*
+ * Frontswap frontend
+ *
+ * This code provides the generic "frontend" layer to call a matching
+ * "backend" driver implementation of frontswap.  See
+ * Documentation/vm/frontswap.txt for more information.
+ *
+ * Copyright (C) 2009-2012 Oracle Corp.  All rights reserved.
+ * Author: Dan Magenheimer
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+
+#include <linux/mm.h>
+#include <linux/mman.h>
+#include <linux/swap.h>
+#include <linux/swapops.h>
+#include <linux/proc_fs.h>
+#include <linux/security.h>
+#include <linux/capability.h>
+#include <linux/module.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+#include <linux/frontswap.h>
+#include <linux/swapfile.h>
+
+/*
+ * frontswap_ops is set by frontswap_register_ops to contain the pointers
+ * to the frontswap "backend" implementation functions.
+ */
+static struct frontswap_ops frontswap_ops __read_mostly;
+
+/*
+ * This global enablement flag reduces overhead on systems where frontswap_ops
+ * has not been registered, so is preferred to the slower alternative: a
+ * function call that checks a non-global.
+ */
+bool frontswap_enabled __read_mostly;
+EXPORT_SYMBOL(frontswap_enabled);
+
+/*
+ * If enabled, frontswap_store will return failure even on success.  As
+ * a result, the swap subsystem will always write the page to swap, in
+ * effect converting frontswap into a writethrough cache.  In this mode,
+ * there is no direct reduction in swap writes, but a frontswap backend
+ * can unilaterally "reclaim" any pages in use with no data loss, thus
+ * providing increases control over maximum memory usage due to frontswap.
+ */
+static bool frontswap_writethrough_enabled __read_mostly;
+
+#ifdef CONFIG_DEBUG_FS
+/*
+ * Counters available via /sys/kernel/debug/frontswap (if debugfs is
+ * properly configured).  These are for information only so are not protected
+ * against increment races.
+ */
+static u64 frontswap_loads;
+static u64 frontswap_succ_stores;
+static u64 frontswap_failed_stores;
+static u64 frontswap_invalidates;
+
+static inline void inc_frontswap_loads(void) {
+        frontswap_loads++;
+}
+static inline void inc_frontswap_succ_stores(void) {
+        frontswap_succ_stores++;
+}
+static inline void inc_frontswap_failed_stores(void) {
+        frontswap_failed_stores++;
+}
+static inline void inc_frontswap_invalidates(void) {
+        frontswap_invalidates++;
+}
+#else
+static inline void inc_frontswap_loads(void) { }
+static inline void inc_frontswap_succ_stores(void) { }
+static inline void inc_frontswap_failed_stores(void) { }
+static inline void inc_frontswap_invalidates(void) { }
+#endif
+/*
+ * Register operations for frontswap, returning previous thus allowing
+ * detection of multiple backends and possible nesting.
+ */
+struct frontswap_ops frontswap_register_ops(struct frontswap_ops *ops)
+{
+        struct frontswap_ops old = frontswap_ops;
+
+        frontswap_ops = *ops;
+        frontswap_enabled = true;
+        return old;
+}
+EXPORT_SYMBOL(frontswap_register_ops);
+
+/*
+ * Enable/disable frontswap writethrough (see above).
+ */
+void frontswap_writethrough(bool enable)
+{
+        frontswap_writethrough_enabled = enable;
+}
+EXPORT_SYMBOL(frontswap_writethrough);
+
+/*
+ * Called when a swap device is swapon'd.
+ */
+void __frontswap_init(unsigned type)
+{
+        struct swap_info_struct *sis = swap_info[type];
+
+        BUG_ON(sis == NULL);
+        if (sis->frontswap_map == NULL)
+                return;
+        if (frontswap_enabled)
+                (*frontswap_ops.init)(type);
+}
+EXPORT_SYMBOL(__frontswap_init);
+
+/*
+ * "Store" data from a page to frontswap and associate it with the page's
+ * swaptype and offset.  Page must be locked and in the swap cache.
+ * If frontswap already contains a page with matching swaptype and
+ * offset, the frontswap implmentation may either overwrite the data and
+ * return success or invalidate the page from frontswap and return failure.
+ */
+int __frontswap_store(struct page *page)
+{
+        int ret = -1, dup = 0;
+        swp_entry_t entry = { .val = page_private(page), };
+        int type = swp_type(entry);
+        struct swap_info_struct *sis = swap_info[type];
+        pgoff_t offset = swp_offset(entry);
+
+        BUG_ON(!PageLocked(page));
+        BUG_ON(sis == NULL);
+        if (frontswap_test(sis, offset))
+                dup = 1;
+        ret = (*frontswap_ops.store)(type, offset, page);
+        if (ret == 0) {
+                frontswap_set(sis, offset);
+                inc_frontswap_succ_stores();
+                if (!dup)
+                        atomic_inc(&sis->frontswap_pages);
+        } else if (dup) {
+                /*
+                  failed dup always results in automatic invalidate of
+                  the (older) page from frontswap
+                 */
+                frontswap_clear(sis, offset);
+                atomic_dec(&sis->frontswap_pages);
+                inc_frontswap_failed_stores();
+        } else
+                inc_frontswap_failed_stores();
+        if (frontswap_writethrough_enabled)
+                /* report failure so swap also writes to swap device */
+                ret = -1;
+        return ret;
+}
+EXPORT_SYMBOL(__frontswap_store);
+
+/*
+ * "Get" data from frontswap associated with swaptype and offset that were
+ * specified when the data was put to frontswap and use it to fill the
+ * specified page with data. Page must be locked and in the swap cache.
+ */
+int __frontswap_load(struct page *page)
+{
+        int ret = -1;
+        swp_entry_t entry = { .val = page_private(page), };
+        int type = swp_type(entry);
+        struct swap_info_struct *sis = swap_info[type];
+        pgoff_t offset = swp_offset(entry);
+
+        BUG_ON(!PageLocked(page));
+        BUG_ON(sis == NULL);
+        if (frontswap_test(sis, offset))
+                ret = (*frontswap_ops.load)(type, offset, page);
+        if (ret == 0)
+                inc_frontswap_loads();
+        return ret;
+}
+EXPORT_SYMBOL(__frontswap_load);
+
+/*
+ * Invalidate any data from frontswap associated with the specified swaptype
+ * and offset so that a subsequent "get" will fail.
+ */
+void __frontswap_invalidate_page(unsigned type, pgoff_t offset)
+{
+        struct swap_info_struct *sis = swap_info[type];
+
+        BUG_ON(sis == NULL);
+        if (frontswap_test(sis, offset)) {
+                (*frontswap_ops.invalidate_page)(type, offset);
+                atomic_dec(&sis->frontswap_pages);
+                frontswap_clear(sis, offset);
+                inc_frontswap_invalidates();
+        }
+}
+EXPORT_SYMBOL(__frontswap_invalidate_page);
+
+/*
+ * Invalidate all data from frontswap associated with all offsets for the
+ * specified swaptype.
+ */
+void __frontswap_invalidate_area(unsigned type)
+{
+        struct swap_info_struct *sis = swap_info[type];
+
+        BUG_ON(sis == NULL);
+        if (sis->frontswap_map == NULL)
+                return;
+        (*frontswap_ops.invalidate_area)(type);
+        atomic_set(&sis->frontswap_pages, 0);
+        memset(sis->frontswap_map, 0, sis->max / sizeof(long));
+}
+EXPORT_SYMBOL(__frontswap_invalidate_area);
+
+/*
+ * Frontswap, like a true swap device, may unnecessarily retain pages
+ * under certain circumstances; "shrink" frontswap is essentially a
+ * "partial swapoff" and works by calling try_to_unuse to attempt to
+ * unuse enough frontswap pages to attempt to -- subject to memory
+ * constraints -- reduce the number of pages in frontswap to the
+ * number given in the parameter target_pages.
+ */
+void frontswap_shrink(unsigned long target_pages)
+{
+        struct swap_info_struct *si = NULL;
+        int si_frontswap_pages;
+        unsigned long total_pages = 0, total_pages_to_unuse;
+        unsigned long pages = 0, pages_to_unuse = 0;
+        int type;
+        bool locked = false;
+
+        /*
+         * we don't want to hold swap_lock while doing a very
+         * lengthy try_to_unuse, but swap_list may change
+         * so restart scan from swap_list.head each time
+         */
+        spin_lock(&swap_lock);
+        locked = true;
+        total_pages = 0;
+        for (type = swap_list.head; type >= 0; type = si->next) {
+                si = swap_info[type];
+                total_pages += atomic_read(&si->frontswap_pages);
+        }
+        if (total_pages <= target_pages)
+                goto out;
+        total_pages_to_unuse = total_pages - target_pages;
+        for (type = swap_list.head; type >= 0; type = si->next) {
+                si = swap_info[type];
+                si_frontswap_pages = atomic_read(&si->frontswap_pages);
+                if (total_pages_to_unuse < si_frontswap_pages)
+                        pages = pages_to_unuse = total_pages_to_unuse;
+                else {
+                        pages = si_frontswap_pages;
+                        pages_to_unuse = 0; /* unuse all */
+                }
+                /* ensure there is enough RAM to fetch pages from frontswap */
+                if (security_vm_enough_memory_mm(current->mm, pages))
+                        continue;
+                vm_unacct_memory(pages);
+                break;
+        }
+        if (type < 0)
+                goto out;
+        locked = false;
+        spin_unlock(&swap_lock);
+        try_to_unuse(type, true, pages_to_unuse);
+out:
+        if (locked)
+                spin_unlock(&swap_lock);
+        return;
+}
+EXPORT_SYMBOL(frontswap_shrink);
+
+/*
+ * Count and return the number of frontswap pages across all
+ * swap devices.  This is exported so that backend drivers can
+ * determine current usage without reading debugfs.
+ */
+unsigned long frontswap_curr_pages(void)
+{
+        int type;
+        unsigned long totalpages = 0;
+        struct swap_info_struct *si = NULL;
+
+        spin_lock(&swap_lock);
+        for (type = swap_list.head; type >= 0; type = si->next) {
+                si = swap_info[type];
+                totalpages += atomic_read(&si->frontswap_pages);
+        }
+        spin_unlock(&swap_lock);
+        return totalpages;
+}
+EXPORT_SYMBOL(frontswap_curr_pages);
+
+static int __init init_frontswap(void)
+{
+#ifdef CONFIG_DEBUG_FS
+        struct dentry *root = debugfs_create_dir("frontswap", NULL);
+        if (root == NULL)
+                return -ENXIO;
+        debugfs_create_u64("loads", S_IRUGO, root, &frontswap_loads);
+        debugfs_create_u64("succ_stores", S_IRUGO, root, &frontswap_succ_stores);
+        debugfs_create_u64("failed_stores", S_IRUGO, root,
+                                &frontswap_failed_stores);
+        debugfs_create_u64("invalidates", S_IRUGO,
+                                root, &frontswap_invalidates);
+#endif
+        return 0;
+}
+
+module_init(init_frontswap);
diff --git a/mm/internal.h b/mm/internal.h
index 5cbb78190041..2ba87fbfb75b 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -94,9 +94,6 @@ extern void putback_lru_page(struct page *page);
 /*
  * in mm/page_alloc.c
  */
-extern void set_pageblock_migratetype(struct page *page, int migratetype);
-extern int move_freepages_block(struct zone *zone, struct page *page,
-                                int migratetype);
 extern void __free_pages_bootmem(struct page *page, unsigned int order);
 extern void prep_compound_page(struct page *page, unsigned long order);
 #ifdef CONFIG_MEMORY_FAILURE
@@ -104,7 +101,6 @@ extern bool is_free_buddy_page(struct page *page);
 #endif
 
 #if defined CONFIG_COMPACTION || defined CONFIG_CMA
-#include <linux/compaction.h>
 
 /*
  * in mm/compaction.c
@@ -123,14 +119,11 @@ struct compact_control {
         unsigned long nr_migratepages;  /* Number of pages to migrate */
         unsigned long free_pfn;         /* isolate_freepages search base */
         unsigned long migrate_pfn;      /* isolate_migratepages search base */
-        enum compact_mode mode;         /* Compaction mode */
+        bool sync;                      /* Synchronous migration */
 
         int order;                      /* order a direct compactor needs */
         int migratetype;                /* MOVABLE, RECLAIMABLE etc */
         struct zone *zone;
-
-        /* Number of UNMOVABLE destination pageblocks skipped during scan */
-        unsigned long nr_pageblocks_skipped;
 };
 
 unsigned long
diff --git a/mm/memblock.c b/mm/memblock.c
index 952123eba433..32a0a5e4d79d 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -867,6 +867,16 @@ int __init_memblock memblock_is_memory(phys_addr_t addr)
         return memblock_search(&memblock.memory, addr) != -1;
 }
 
+/**
+ * memblock_is_region_memory - check if a region is a subset of memory
+ * @base: base of region to check
+ * @size: size of region to check
+ *
+ * Check if the region [@base, @base+@size) is a subset of a memory block.
+ *
+ * RETURNS:
+ * 0 if false, non-zero if true
+ */
 int __init_memblock memblock_is_region_memory(phys_addr_t base, phys_addr_t size)
 {
         int idx = memblock_search(&memblock.memory, base);
@@ -879,6 +889,16 @@ int __init_memblock memblock_is_region_memory(phys_addr_t base, phys_addr_t size
                  memblock.memory.regions[idx].size) >= end;
 }
 
+/**
+ * memblock_is_region_reserved - check if a region intersects reserved memory
+ * @base: base of region to check
+ * @size: size of region to check
+ *
+ * Check if the region [@base, @base+@size) intersects a reserved memory block.
+ *
+ * RETURNS:
+ * 0 if false, non-zero if true
+ */
 int __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_addr_t size)
 {
         memblock_cap_size(base, &size);
diff --git a/mm/migrate.c b/mm/migrate.c
index ab81d482ae6f..be26d5cbe56b 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -436,7 +436,10 @@ void migrate_page_copy(struct page *newpage, struct page *page)
                  * is actually a signal that all of the page has become dirty.
                  * Whereas only part of our page may be dirty.
                  */
-                __set_page_dirty_nobuffers(newpage);
+                if (PageSwapBacked(page))
+                        SetPageDirty(newpage);
+                else
+                        __set_page_dirty_nobuffers(newpage);
         }
 
         mlock_migrate_page(newpage, page);
diff --git a/mm/nommu.c b/mm/nommu.c
index c4acfbc09972..d4b0c10872de 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1486,7 +1486,7 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
 
         flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
 
-        ret = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff);
+        retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff);
 
         if (file)
                 fput(file);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index ed0e19677360..416637f0e924 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -183,7 +183,7 @@ static bool oom_unkillable_task(struct task_struct *p,
 unsigned long oom_badness(struct task_struct *p, struct mem_cgroup *memcg,
                           const nodemask_t *nodemask, unsigned long totalpages)
 {
-        unsigned long points;
+        long points;
 
         if (oom_unkillable_task(p, memcg, nodemask))
                 return 0;
@@ -223,7 +223,7 @@ unsigned long oom_badness(struct task_struct *p, struct mem_cgroup *memcg,
          * Never return 0 for an eligible task regardless of the root bonus and
          * oom_score_adj (oom_score_adj can't be OOM_SCORE_ADJ_MIN here).
          */
-        return points ? points : 1;
+        return points > 0 ? points : 1;
 }
 
 /*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 6092f331b32e..44030096da63 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -219,7 +219,7 @@ EXPORT_SYMBOL(nr_online_nodes);
 
 int page_group_by_mobility_disabled __read_mostly;
 
-void set_pageblock_migratetype(struct page *page, int migratetype)
+static void set_pageblock_migratetype(struct page *page, int migratetype)
 {
 
         if (unlikely(page_group_by_mobility_disabled))
@@ -954,8 +954,8 @@ static int move_freepages(struct zone *zone,
         return pages_moved;
 }
 
-int move_freepages_block(struct zone *zone, struct page *page,
-                         int migratetype)
+static int move_freepages_block(struct zone *zone, struct page *page,
+                                int migratetype)
 {
         unsigned long start_pfn, end_pfn;
         struct page *start_page, *end_page;
@@ -5651,7 +5651,7 @@ static int __alloc_contig_migrate_range(unsigned long start, unsigned long end)
                 .nr_migratepages = 0,
                 .order = -1,
                 .zone = page_zone(pfn_to_page(start)),
-                .mode = COMPACT_SYNC,
+                .sync = true,
         };
         INIT_LIST_HEAD(&cc.migratepages);
 
diff --git a/mm/page_io.c b/mm/page_io.c
index dc76b4d0611e..34f02923744c 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -18,6 +18,7 @@
 #include <linux/bio.h>
 #include <linux/swapops.h>
 #include <linux/writeback.h>
+#include <linux/frontswap.h>
 #include <asm/pgtable.h>
 
 static struct bio *get_swap_bio(gfp_t gfp_flags,
@@ -98,6 +99,12 @@ int swap_writepage(struct page *page, struct writeback_control *wbc)
                 unlock_page(page);
                 goto out;
         }
+        if (frontswap_store(page) == 0) {
+                set_page_writeback(page);
+                unlock_page(page);
+                end_page_writeback(page);
+                goto out;
+        }
         bio = get_swap_bio(GFP_NOIO, page, end_swap_bio_write);
         if (bio == NULL) {
                 set_page_dirty(page);
@@ -122,6 +129,11 @@ int swap_readpage(struct page *page)
 
         VM_BUG_ON(!PageLocked(page));
         VM_BUG_ON(PageUptodate(page));
+        if (frontswap_load(page) == 0) {
+                SetPageUptodate(page);
+                unlock_page(page);
+                goto out;
+        }
         bio = get_swap_bio(GFP_KERNEL, page, end_swap_bio_read);
         if (bio == NULL) {
                 unlock_page(page);
diff --git a/mm/shmem.c b/mm/shmem.c
index 585bd220a21e..a15a466d0d1d 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -683,10 +683,21 @@ static int shmem_unuse_inode(struct shmem_inode_info *info,
                 mutex_lock(&shmem_swaplist_mutex);
                 /*
                  * We needed to drop mutex to make that restrictive page
-                 * allocation; but the inode might already be freed by now,
-                 * and we cannot refer to inode or mapping or info to check.
-                 * However, we do hold page lock on the PageSwapCache page,
-                 * so can check if that still has our reference remaining.
+                 * allocation, but the inode might have been freed while we
+                 * dropped it: although a racing shmem_evict_inode() cannot
+                 * complete without emptying the radix_tree, our page lock
+                 * on this swapcache page is not enough to prevent that -
+                 * free_swap_and_cache() of our swap entry will only
+                 * trylock_page(), removing swap from radix_tree whatever.
+                 *
+                 * We must not proceed to shmem_add_to_page_cache() if the
+                 * inode has been freed, but of course we cannot rely on
+                 * inode or mapping or info to check that.  However, we can
+                 * safely check if our swap entry is still in use (and here
+                 * it can't have got reused for another page): if it's still
+                 * in use, then the inode cannot have been freed yet, and we
+                 * can safely proceed (if it's no longer in use, that tells
+                 * nothing about the inode, but we don't need to unuse swap).
                  */
                 if (!page_swapcount(*pagep))
                         error = -ENOENT;
@@ -730,9 +741,9 @@ int shmem_unuse(swp_entry_t swap, struct page *page)
 
         /*
          * There's a faint possibility that swap page was replaced before
-         * caller locked it: it will come back later with the right page.
+         * caller locked it: caller will come back later with the right page.
          */
-        if (unlikely(!PageSwapCache(page)))
+        if (unlikely(!PageSwapCache(page) || page_private(page) != swap.val))
                 goto out;
 
         /*
@@ -995,21 +1006,15 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         newpage = shmem_alloc_page(gfp, info, index);
         if (!newpage)
                 return -ENOMEM;
-        VM_BUG_ON(shmem_should_replace_page(newpage, gfp));
 
-        *pagep = newpage;
         page_cache_get(newpage);
         copy_highpage(newpage, oldpage);
+        flush_dcache_page(newpage);
 
-        VM_BUG_ON(!PageLocked(oldpage));
         __set_page_locked(newpage);
-        VM_BUG_ON(!PageUptodate(oldpage));
         SetPageUptodate(newpage);
-        VM_BUG_ON(!PageSwapBacked(oldpage));
         SetPageSwapBacked(newpage);
-        VM_BUG_ON(!swap_index);
         set_page_private(newpage, swap_index);
-        VM_BUG_ON(!PageSwapCache(oldpage));
         SetPageSwapCache(newpage);
 
         /*
@@ -1019,13 +1024,24 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         spin_lock_irq(&swap_mapping->tree_lock);
         error = shmem_radix_tree_replace(swap_mapping, swap_index, oldpage,
                                                                    newpage);
-        __inc_zone_page_state(newpage, NR_FILE_PAGES);
-        __dec_zone_page_state(oldpage, NR_FILE_PAGES);
+        if (!error) {
+                __inc_zone_page_state(newpage, NR_FILE_PAGES);
+                __dec_zone_page_state(oldpage, NR_FILE_PAGES);
+        }
         spin_unlock_irq(&swap_mapping->tree_lock);
-        BUG_ON(error);
 
-        mem_cgroup_replace_page_cache(oldpage, newpage);
-        lru_cache_add_anon(newpage);
+        if (unlikely(error)) {
+                /*
+                 * Is this possible?  I think not, now that our callers check
+                 * both PageSwapCache and page_private after getting page lock;
+                 * but be defensive.  Reverse old to newpage for clear and free.
+                 */
+                oldpage = newpage;
+        } else {
+                mem_cgroup_replace_page_cache(oldpage, newpage);
+                lru_cache_add_anon(newpage);
+                *pagep = newpage;
+        }
 
         ClearPageSwapCache(oldpage);
         set_page_private(oldpage, 0);
@@ -1033,7 +1049,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         unlock_page(oldpage);
         page_cache_release(oldpage);
         page_cache_release(oldpage);
-        return 0;
+        return error;
 }
 
 /*
@@ -1107,7 +1123,8 @@ repeat:
 
                 /* We have to do this with page locked to prevent races */
                 lock_page(page);
-                if (!PageSwapCache(page) || page->mapping) {
+                if (!PageSwapCache(page) || page_private(page) != swap.val ||
+                    page->mapping) {
                         error = -EEXIST;        /* try again */
                         goto failed;
                 }
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 457b10baef59..71373d03fcee 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -31,6 +31,8 @@
 #include <linux/memcontrol.h>
 #include <linux/poll.h>
 #include <linux/oom.h>
+#include <linux/frontswap.h>
+#include <linux/swapfile.h>
 
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
@@ -42,7 +44,7 @@ static bool swap_count_continued(struct swap_info_struct *, pgoff_t,
 static void free_swap_count_continuations(struct swap_info_struct *);
 static sector_t map_swap_entry(swp_entry_t, struct block_device**);
 
-static DEFINE_SPINLOCK(swap_lock);
+DEFINE_SPINLOCK(swap_lock);
 static unsigned int nr_swapfiles;
 long nr_swap_pages;
 long total_swap_pages;
@@ -53,9 +55,9 @@ static const char Unused_file[] = "Unused swap file entry ";
 static const char Bad_offset[] = "Bad swap offset entry ";
 static const char Unused_offset[] = "Unused swap offset entry ";
 
-static struct swap_list_t swap_list = {-1, -1};
+struct swap_list_t swap_list = {-1, -1};
 
-static struct swap_info_struct *swap_info[MAX_SWAPFILES];
+struct swap_info_struct *swap_info[MAX_SWAPFILES];
 
 static DEFINE_MUTEX(swapon_mutex);
 
@@ -556,6 +558,7 @@ static unsigned char swap_entry_free(struct swap_info_struct *p,
                         swap_list.next = p->type;
                 nr_swap_pages++;
                 p->inuse_pages--;
+                frontswap_invalidate_page(p->type, offset);
                 if ((p->flags & SWP_BLKDEV) &&
                                 disk->fops->swap_slot_free_notify)
                         disk->fops->swap_slot_free_notify(p->bdev, offset);
@@ -985,11 +988,12 @@ static int unuse_mm(struct mm_struct *mm,
 }
 
 /*
- * Scan swap_map from current position to next entry still in use.
+ * Scan swap_map (or frontswap_map if frontswap parameter is true)
+ * from current position to next entry still in use.
  * Recycle to start on reaching the end, returning 0 when empty.
  */
 static unsigned int find_next_to_unuse(struct swap_info_struct *si,
-                                        unsigned int prev)
+                                        unsigned int prev, bool frontswap)
 {
         unsigned int max = si->max;
         unsigned int i = prev;
@@ -1015,6 +1019,12 @@ static unsigned int find_next_to_unuse(struct swap_info_struct *si,
                         prev = 0;
                         i = 1;
                 }
+                if (frontswap) {
+                        if (frontswap_test(si, i))
+                                break;
+                        else
+                                continue;
+                }
                 count = si->swap_map[i];
                 if (count && swap_count(count) != SWAP_MAP_BAD)
                         break;
@@ -1026,8 +1036,12 @@ static unsigned int find_next_to_unuse(struct swap_info_struct *si,
  * We completely avoid races by reading each swap page in advance,
  * and then search for the process using it.  All the necessary
  * page table adjustments can then be made atomically.
+ *
+ * if the boolean frontswap is true, only unuse pages_to_unuse pages;
+ * pages_to_unuse==0 means all pages; ignored if frontswap is false
  */
-static int try_to_unuse(unsigned int type)
+int try_to_unuse(unsigned int type, bool frontswap,
+                 unsigned long pages_to_unuse)
 {
         struct swap_info_struct *si = swap_info[type];
         struct mm_struct *start_mm;
@@ -1060,7 +1074,7 @@ static int try_to_unuse(unsigned int type)
          * one pass through swap_map is enough, but not necessarily:
          * there are races when an instance of an entry might be missed.
          */
-        while ((i = find_next_to_unuse(si, i)) != 0) {
+        while ((i = find_next_to_unuse(si, i, frontswap)) != 0) {
                 if (signal_pending(current)) {
                         retval = -EINTR;
                         break;
@@ -1227,6 +1241,10 @@ static int try_to_unuse(unsigned int type)
                  * interactive performance.
                  */
                 cond_resched();
+                if (frontswap && pages_to_unuse > 0) {
+                        if (!--pages_to_unuse)
+                                break;
+                }
         }
 
         mmput(start_mm);
@@ -1486,7 +1504,8 @@ bad_bmap:
 }
 
 static void enable_swap_info(struct swap_info_struct *p, int prio,
-                                unsigned char *swap_map)
+                                unsigned char *swap_map,
+                                unsigned long *frontswap_map)
 {
         int i, prev;
 
@@ -1496,6 +1515,7 @@ static void enable_swap_info(struct swap_info_struct *p, int prio,
         else
                 p->prio = --least_priority;
         p->swap_map = swap_map;
+        frontswap_map_set(p, frontswap_map);
         p->flags |= SWP_WRITEOK;
         nr_swap_pages += p->pages;
         total_swap_pages += p->pages;
@@ -1512,6 +1532,7 @@ static void enable_swap_info(struct swap_info_struct *p, int prio,
                 swap_list.head = swap_list.next = p->type;
         else
                 swap_info[prev]->next = p->type;
+        frontswap_init(p->type);
         spin_unlock(&swap_lock);
 }
 
@@ -1585,7 +1606,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         spin_unlock(&swap_lock);
 
         oom_score_adj = test_set_oom_score_adj(OOM_SCORE_ADJ_MAX);
-        err = try_to_unuse(type);
+        err = try_to_unuse(type, false, 0); /* force all pages to be unused */
         compare_swap_oom_score_adj(OOM_SCORE_ADJ_MAX, oom_score_adj);
 
         if (err) {
@@ -1596,7 +1617,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
                  * sys_swapoff for this swap_info_struct at this point.
                  */
                 /* re-insert swap space back into swap_list */
-                enable_swap_info(p, p->prio, p->swap_map);
+                enable_swap_info(p, p->prio, p->swap_map, frontswap_map_get(p));
                 goto out_dput;
         }
 
@@ -1622,9 +1643,11 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         swap_map = p->swap_map;
         p->swap_map = NULL;
         p->flags = 0;
+        frontswap_invalidate_area(type);
         spin_unlock(&swap_lock);
         mutex_unlock(&swapon_mutex);
         vfree(swap_map);
+        vfree(frontswap_map_get(p));
         /* Destroy swap account informatin */
         swap_cgroup_swapoff(type);
 
@@ -1893,24 +1916,20 @@ static unsigned long read_swap_header(struct swap_info_struct *p,
 
         /*
          * Find out how many pages are allowed for a single swap
-         * device. There are three limiting factors: 1) the number
+         * device. There are two limiting factors: 1) the number
          * of bits for the swap offset in the swp_entry_t type, and
          * 2) the number of bits in the swap pte as defined by the
-         * the different architectures, and 3) the number of free bits
-         * in an exceptional radix_tree entry. In order to find the
+         * different architectures. In order to find the
          * largest possible bit mask, a swap entry with swap type 0
          * and swap offset ~0UL is created, encoded to a swap pte,
          * decoded to a swp_entry_t again, and finally the swap
          * offset is extracted. This will mask all the bits from
          * the initial ~0UL mask that can't be encoded in either
          * the swp_entry_t or the architecture definition of a
-         * swap pte.  Then the same is done for a radix_tree entry.
+         * swap pte.
          */
         maxpages = swp_offset(pte_to_swp_entry(
-                        swp_entry_to_pte(swp_entry(0, ~0UL))));
-        maxpages = swp_offset(radix_to_swp_entry(
-                        swp_to_radix_entry(swp_entry(0, maxpages)))) + 1;
-
+                        swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1;
         if (maxpages > swap_header->info.last_page) {
                 maxpages = swap_header->info.last_page + 1;
                 /* p->max is an unsigned int: don't overflow it */
@@ -1988,6 +2007,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
         sector_t span;
         unsigned long maxpages;
         unsigned char *swap_map = NULL;
+        unsigned long *frontswap_map = NULL;
         struct page *page = NULL;
         struct inode *inode = NULL;
 
@@ -2071,6 +2091,9 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
                 error = nr_extents;
                 goto bad_swap;
         }
+        /* frontswap enabled? set up bit-per-page map for frontswap */
+        if (frontswap_enabled)
+                frontswap_map = vzalloc(maxpages / sizeof(long));
 
         if (p->bdev) {
                 if (blk_queue_nonrot(bdev_get_queue(p->bdev))) {
@@ -2086,14 +2109,15 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
         if (swap_flags & SWAP_FLAG_PREFER)
                 prio =
                   (swap_flags & SWAP_FLAG_PRIO_MASK) >> SWAP_FLAG_PRIO_SHIFT;
-        enable_swap_info(p, prio, swap_map);
+        enable_swap_info(p, prio, swap_map, frontswap_map);
 
         printk(KERN_INFO "Adding %uk swap on %s.  "
-                        "Priority:%d extents:%d across:%lluk %s%s\n",
+                        "Priority:%d extents:%d across:%lluk %s%s%s\n",
                 p->pages<<(PAGE_SHIFT-10), name, p->prio,
                 nr_extents, (unsigned long long)span<<(PAGE_SHIFT-10),
                 (p->flags & SWP_SOLIDSTATE) ? "SS" : "",
-                (p->flags & SWP_DISCARDABLE) ? "D" : "");
+                (p->flags & SWP_DISCARDABLE) ? "D" : "",
+                (frontswap_map) ? "FS" : "");
 
         mutex_unlock(&swapon_mutex);
         atomic_inc(&proc_poll_event);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 0301b328cf0f..86852963b7f7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1208,9 +1208,7 @@ static int atalk_connect(struct socket *sock, struct sockaddr *uaddr,
         if (addr->sat_addr.s_node == ATADDR_BCAST &&
             !sock_flag(sk, SOCK_BROADCAST)) {
 #if 1
-                printk(KERN_WARNING "%s is broken and did not set "
-                                    "SO_BROADCAST. It will break when 2.2 is "
-                                    "released.\n",
+                pr_warn("atalk_connect: %s is broken and did not set SO_BROADCAST.\n",
                         current->comm);
 #else
                 return -EACCES;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 46e7f86acfc9..3e18af4dadc4 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -210,7 +210,7 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
                 }
 
                 if (sk->sk_state == BT_CONNECTED || !newsock ||
-                    test_bit(BT_DEFER_SETUP, &bt_sk(parent)->flags)) {
+                    test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) {
                         bt_accept_unlink(sk);
                         if (newsock)
                                 sock_graft(sk, newsock);
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index ea5fb9fcc3f5..d23b6682f4e9 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -36,9 +36,6 @@
 #define TRACE_ON 1
 #define TRACE_OFF 0
 
-static void send_dm_alert(struct work_struct *unused);
-
-
 /*
  * Globals, our netlink socket pointer
  * and the work handle that will send up
@@ -48,11 +45,10 @@ static int trace_state = TRACE_OFF;
 static DEFINE_MUTEX(trace_state_mutex);
 
 struct per_cpu_dm_data {
-        struct work_struct dm_alert_work;
-        struct sk_buff __rcu *skb;
-        atomic_t dm_hit_count;
-        struct timer_list send_timer;
-        int cpu;
+        spinlock_t              lock;
+        struct sk_buff          *skb;
+        struct work_struct      dm_alert_work;
+        struct timer_list       send_timer;
 };
 
 struct dm_hw_stat_delta {
@@ -78,13 +74,13 @@ static int dm_delay = 1;
 static unsigned long dm_hw_check_delta = 2*HZ;
 static LIST_HEAD(hw_stats_list);
 
-static void reset_per_cpu_data(struct per_cpu_dm_data *data)
+static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
 {
         size_t al;
         struct net_dm_alert_msg *msg;
         struct nlattr *nla;
         struct sk_buff *skb;
-        struct sk_buff *oskb = rcu_dereference_protected(data->skb, 1);
+        unsigned long flags;
 
         al = sizeof(struct net_dm_alert_msg);
         al += dm_hit_limit * sizeof(struct net_dm_drop_point);
@@ -99,65 +95,40 @@ static void reset_per_cpu_data(struct per_cpu_dm_data *data)
                                   sizeof(struct net_dm_alert_msg));
                 msg = nla_data(nla);
                 memset(msg, 0, al);
-        } else
-                schedule_work_on(data->cpu, &data->dm_alert_work);
-
-        /*
-         * Don't need to lock this, since we are guaranteed to only
-         * run this on a single cpu at a time.
-         * Note also that we only update data->skb if the old and new skb
-         * pointers don't match.  This ensures that we don't continually call
-         * synchornize_rcu if we repeatedly fail to alloc a new netlink message.
-         */
-        if (skb != oskb) {
-                rcu_assign_pointer(data->skb, skb);
-
-                synchronize_rcu();
-
-                atomic_set(&data->dm_hit_count, dm_hit_limit);
+        } else {
+                mod_timer(&data->send_timer, jiffies + HZ / 10);
         }
 
+        spin_lock_irqsave(&data->lock, flags);
+        swap(data->skb, skb);
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        return skb;
 }
 
-static void send_dm_alert(struct work_struct *unused)
+static void send_dm_alert(struct work_struct *work)
 {
         struct sk_buff *skb;
-        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data;
 
-        WARN_ON_ONCE(data->cpu != smp_processor_id());
+        data = container_of(work, struct per_cpu_dm_data, dm_alert_work);
 
-        /*
-         * Grab the skb we're about to send
-         */
-        skb = rcu_dereference_protected(data->skb, 1);
-
-        /*
-         * Replace it with a new one
-         */
-        reset_per_cpu_data(data);
+        skb = reset_per_cpu_data(data);
 
-        /*
-         * Ship it!
-         */
         if (skb)
                 genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
-
-        put_cpu_var(dm_cpu_data);
 }
 
 /*
  * This is the timer function to delay the sending of an alert
  * in the event that more drops will arrive during the
- * hysteresis period.  Note that it operates under the timer interrupt
- * so we don't need to disable preemption here
+ * hysteresis period.
  */
-static void sched_send_work(unsigned long unused)
+static void sched_send_work(unsigned long _data)
 {
-        struct per_cpu_dm_data *data =  &get_cpu_var(dm_cpu_data);
-
-        schedule_work_on(smp_processor_id(), &data->dm_alert_work);
+        struct per_cpu_dm_data *data = (struct per_cpu_dm_data *)_data;
 
-        put_cpu_var(dm_cpu_data);
+        schedule_work(&data->dm_alert_work);
 }
 
 static void trace_drop_common(struct sk_buff *skb, void *location)
@@ -167,33 +138,28 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         struct nlattr *nla;
         int i;
         struct sk_buff *dskb;
-        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
-
+        struct per_cpu_dm_data *data;
+        unsigned long flags;
 
-        rcu_read_lock();
-        dskb = rcu_dereference(data->skb);
+        local_irq_save(flags);
+        data = &__get_cpu_var(dm_cpu_data);
+        spin_lock(&data->lock);
+        dskb = data->skb;
 
         if (!dskb)
                 goto out;
 
-        if (!atomic_add_unless(&data->dm_hit_count, -1, 0)) {
-                /*
-                 * we're already at zero, discard this hit
-                 */
-                goto out;
-        }
-
         nlh = (struct nlmsghdr *)dskb->data;
         nla = genlmsg_data(nlmsg_data(nlh));
         msg = nla_data(nla);
         for (i = 0; i < msg->entries; i++) {
                 if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
                         msg->points[i].count++;
-                        atomic_inc(&data->dm_hit_count);
                         goto out;
                 }
         }
-
+        if (msg->entries == dm_hit_limit)
+                goto out;
         /*
          * We need to create a new entry
          */
@@ -205,13 +171,11 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
 
         if (!timer_pending(&data->send_timer)) {
                 data->send_timer.expires = jiffies + dm_delay * HZ;
-                add_timer_on(&data->send_timer, smp_processor_id());
+                add_timer(&data->send_timer);
         }
 
 out:
-        rcu_read_unlock();
-        put_cpu_var(dm_cpu_data);
-        return;
+        spin_unlock_irqrestore(&data->lock, flags);
 }
 
 static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, void *location)
@@ -418,11 +382,11 @@ static int __init init_net_drop_monitor(void)
 
         for_each_possible_cpu(cpu) {
                 data = &per_cpu(dm_cpu_data, cpu);
-                data->cpu = cpu;
                 INIT_WORK(&data->dm_alert_work, send_dm_alert);
                 init_timer(&data->send_timer);
-                data->send_timer.data = cpu;
+                data->send_timer.data = (unsigned long)data;
                 data->send_timer.function = sched_send_work;
+                spin_lock_init(&data->lock);
                 reset_per_cpu_data(data);
         }
 
diff --git a/net/core/filter.c b/net/core/filter.c
index a3eddb515d1b..d4ce2dc712e3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -616,9 +616,9 @@ static int __sk_prepare_filter(struct sk_filter *fp)
 /**
  *      sk_unattached_filter_create - create an unattached filter
  *      @fprog: the filter program
- *      @sk: the socket to use
+ *      @pfp: the unattached filter that is created
  *
- * Create a filter independent ofr any socket. We first run some
+ * Create a filter independent of any socket. We first run some
  * sanity checks on it to make sure it does not explode on us later.
  * If an error occurs or there is insufficient memory for the filter
  * a negative errno code is returned. On success the return is zero.
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index eb09f8bbbf07..d81d026138f0 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2219,9 +2219,7 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
         rcu_read_lock_bh();
         nht = rcu_dereference_bh(tbl->nht);
 
-        for (h = 0; h < (1 << nht->hash_shift); h++) {
-                if (h < s_h)
-                        continue;
+        for (h = s_h; h < (1 << nht->hash_shift); h++) {
                 if (h > s_h)
                         s_idx = 0;
                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
@@ -2260,9 +2258,7 @@ static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
 
         read_lock_bh(&tbl->lock);
 
-        for (h = 0; h <= PNEIGH_HASHMASK; h++) {
-                if (h < s_h)
-                        continue;
+        for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
                 if (h > s_h)
                         s_idx = 0;
                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
@@ -2297,7 +2293,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
         struct neigh_table *tbl;
         int t, family, s_t;
         int proxy = 0;
-        int err = 0;
+        int err;
 
         read_lock(&neigh_tbl_lock);
         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
@@ -2311,7 +2307,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
 
         s_t = cb->args[0];
 
-        for (tbl = neigh_tables, t = 0; tbl && (err >= 0);
+        for (tbl = neigh_tables, t = 0; tbl;
              tbl = tbl->next, t++) {
                 if (t < s_t || (family && tbl->family != family))
                         continue;
@@ -2322,6 +2318,8 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                         err = pneigh_dump_table(tbl, skb, cb);
                 else
                         err = neigh_dump_table(tbl, skb, cb);
+                if (err < 0)
+                        break;
         }
         read_unlock(&neigh_tbl_lock);
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 3d84fb9d8873..f9f40b932e4b 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -362,22 +362,23 @@ EXPORT_SYMBOL(netpoll_send_skb_on_dev);
 
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
 {
-        int total_len, eth_len, ip_len, udp_len;
+        int total_len, ip_len, udp_len;
         struct sk_buff *skb;
         struct udphdr *udph;
         struct iphdr *iph;
         struct ethhdr *eth;
 
         udp_len = len + sizeof(*udph);
-        ip_len = eth_len = udp_len + sizeof(*iph);
-        total_len = eth_len + ETH_HLEN + NET_IP_ALIGN;
+        ip_len = udp_len + sizeof(*iph);
+        total_len = ip_len + LL_RESERVED_SPACE(np->dev);
 
-        skb = find_skb(np, total_len, total_len - len);
+        skb = find_skb(np, total_len + np->dev->needed_tailroom,
+                       total_len - len);
         if (!skb)
                 return;
 
         skb_copy_to_linear_data(skb, msg, len);
-        skb->len += len;
+        skb_put(skb, len);
 
         skb_push(skb, sizeof(*udph));
         skb_reset_transport_header(skb);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 016694d62484..d78671e9d545 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3361,7 +3361,7 @@ EXPORT_SYMBOL(kfree_skb_partial);
  * @to: prior buffer
  * @from: buffer to add
  * @fragstolen: pointer to boolean
- *
+ * @delta_truesize: how much more was allocated than was requested
  */
 bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
                       bool *fragstolen, int *delta_truesize)
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d4d61b694fab..dfba343b2509 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -560,6 +560,17 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
 }
 EXPORT_SYMBOL(inet_peer_xrlim_allow);
 
+static void inetpeer_inval_rcu(struct rcu_head *head)
+{
+        struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu);
+
+        spin_lock_bh(&gc_lock);
+        list_add_tail(&p->gc_list, &gc_list);
+        spin_unlock_bh(&gc_lock);
+
+        schedule_delayed_work(&gc_work, gc_delay);
+}
+
 void inetpeer_invalidate_tree(int family)
 {
         struct inet_peer *old, *new, *prev;
@@ -576,10 +587,7 @@ void inetpeer_invalidate_tree(int family)
         prev = cmpxchg(&base->root, old, new);
         if (prev == old) {
                 base->total = 0;
-                spin_lock(&gc_lock);
-                list_add_tail(&prev->gc_list, &gc_list);
-                spin_unlock(&gc_lock);
-                schedule_delayed_work(&gc_work, gc_delay);
+                call_rcu(&prev->gc_rcu, inetpeer_inval_rcu);
         }
 
 out:
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index e5c44fc586ab..ab09b126423c 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -44,6 +44,7 @@ static int ip_forward_finish(struct sk_buff *skb)
         struct ip_options *opt  = &(IPCB(skb)->opt);
 
         IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
 
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index a9e519ad6db5..c94bbc6f2ba3 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1574,6 +1574,7 @@ static inline int ipmr_forward_finish(struct sk_buff *skb)
         struct ip_options *opt = &(IPCB(skb)->opt);
 
         IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
 
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 0c220a416626..74c21b924a79 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1561,7 +1561,7 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                                 neigh_flags = neigh->flags;
                                 neigh_release(neigh);
                         }
-                        if (neigh_flags & NTF_ROUTER) {
+                        if (!(neigh_flags & NTF_ROUTER)) {
                                 RT6_TRACE("purging route %p via non-router but gateway\n",
                                           rt);
                                 return -1;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 17b8c67998bb..decc21d19c53 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -526,6 +526,7 @@ int ip6_forward(struct sk_buff *skb)
         hdr->hop_limit--;
 
         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
                        ip6_forward_finish);
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index b15dc08643a4..461e47c8e956 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1886,6 +1886,8 @@ static inline int ip6mr_forward2_finish(struct sk_buff *skb)
 {
         IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
                          IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP6_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
+                         IPSTATS_MIB_OUTOCTETS, skb->len);
         return dst_output(skb);
 }
 
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 443591d629ca..185f12f4a5fa 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -162,6 +162,7 @@ static void l2tp_eth_delete(struct l2tp_session *session)
                 if (dev) {
                         unregister_netdev(dev);
                         spriv->dev = NULL;
+                        module_put(THIS_MODULE);
                 }
         }
 }
@@ -249,6 +250,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
         if (rc < 0)
                 goto out_del_dev;
 
+        __module_get(THIS_MODULE);
         /* Must be done after register_netdev() */
         strlcpy(session->ifname, dev->name, IFNAMSIZ);
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 70614e7affab..61d8b75d2686 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -464,10 +464,12 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                                            sk->sk_bound_dev_if);
                 if (IS_ERR(rt))
                         goto no_route;
-                if (connected)
+                if (connected) {
                         sk_setup_caps(sk, &rt->dst);
-                else
-                        dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
+                } else {
+                        skb_dst_set(skb, &rt->dst);
+                        goto xmit;
+                }
         }
 
         /* We dont need to clone dst here, it is guaranteed to not disappear.
@@ -475,6 +477,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
          */
         skb_dst_set_noref(skb, &rt->dst);
 
+xmit:
         /* Queue the packet to IP for output */
         rc = ip_queue_xmit(skb, &inet->cork.fl);
         rcu_read_unlock();
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 26ddb699d693..c649188314cc 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -145,15 +145,20 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         struct tid_ampdu_rx *tid_rx;
         unsigned long timeout;
 
+        rcu_read_lock();
         tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[*ptid]);
-        if (!tid_rx)
+        if (!tid_rx) {
+                rcu_read_unlock();
                 return;
+        }
 
         timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
         if (time_is_after_jiffies(timeout)) {
                 mod_timer(&tid_rx->session_timer, timeout);
+                rcu_read_unlock();
                 return;
         }
+        rcu_read_unlock();
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 495831ee48f1..e9cecca5c44d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -533,16 +533,16 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                 sinfo.filled = 0;
                 sta_set_sinfo(sta, &sinfo);
 
-                if (sinfo.filled | STATION_INFO_TX_BITRATE)
+                if (sinfo.filled & STATION_INFO_TX_BITRATE)
                         data[i] = 100000 *
                                 cfg80211_calculate_bitrate(&sinfo.txrate);
                 i++;
-                if (sinfo.filled | STATION_INFO_RX_BITRATE)
+                if (sinfo.filled & STATION_INFO_RX_BITRATE)
                         data[i] = 100000 *
                                 cfg80211_calculate_bitrate(&sinfo.rxrate);
                 i++;
 
-                if (sinfo.filled | STATION_INFO_SIGNAL_AVG)
+                if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
                         data[i] = (u8)sinfo.signal_avg;
                 i++;
         } else {
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d4c19a7773db..8664111d0566 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -637,6 +637,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 ieee80211_configure_filter(local);
                 break;
         default:
+                mutex_lock(&local->mtx);
+                if (local->hw_roc_dev == sdata->dev &&
+                    local->hw_roc_channel) {
+                        /* ignore return value since this is racy */
+                        drv_cancel_remain_on_channel(local);
+                        ieee80211_queue_work(&local->hw, &local->hw_roc_done);
+                }
+                mutex_unlock(&local->mtx);
+
+                flush_work(&local->hw_roc_start);
+                flush_work(&local->hw_roc_done);
+
                 flush_work(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 04c306308987..91d84cc77bbf 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1220,6 +1220,22 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         sdata->vif.bss_conf.qos = true;
 }
 
+static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
+{
+        lockdep_assert_held(&sdata->local->mtx);
+
+        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                IEEE80211_STA_BEACON_POLL);
+        ieee80211_run_deferred_scan(sdata->local);
+}
+
+static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
+{
+        mutex_lock(&sdata->local->mtx);
+        __ieee80211_stop_poll(sdata);
+        mutex_unlock(&sdata->local->mtx);
+}
+
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
@@ -1285,8 +1301,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
 
         /* just to be sure */
-        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                                IEEE80211_STA_BEACON_POLL);
+        ieee80211_stop_poll(sdata);
 
         ieee80211_led_assoc(local, 1);
 
@@ -1456,8 +1471,7 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
-        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                          IEEE80211_STA_BEACON_POLL);
+        __ieee80211_stop_poll(sdata);
 
         mutex_lock(&local->iflist_mtx);
         ieee80211_recalc_ps(local, -1);
@@ -1477,7 +1491,6 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
                   round_jiffies_up(jiffies +
                                    IEEE80211_CONNECTION_IDLE_TIME));
 out:
-        ieee80211_run_deferred_scan(local);
         mutex_unlock(&local->mtx);
 }
 
@@ -2408,7 +2421,11 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 net_dbg_ratelimited("%s: cancelling probereq poll due to a received beacon\n",
                                     sdata->name);
 #endif
+                mutex_lock(&local->mtx);
                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
+                ieee80211_run_deferred_scan(local);
+                mutex_unlock(&local->mtx);
+
                 mutex_lock(&local->iflist_mtx);
                 ieee80211_recalc_ps(local, -1);
                 mutex_unlock(&local->iflist_mtx);
@@ -2595,8 +2612,7 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
-        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                          IEEE80211_STA_BEACON_POLL);
+        ieee80211_stop_poll(sdata);
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
                                false, frame_buf);
@@ -2874,8 +2890,7 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
         u32 flags;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL |
-                                        IEEE80211_STA_CONNECTION_POLL);
+                __ieee80211_stop_poll(sdata);
 
                 /* let's probe the connection once */
                 flags = sdata->local->hw.flags;
@@ -2944,7 +2959,10 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
                 add_timer(&ifmgd->chswitch_timer);
         ieee80211_sta_reset_beacon_monitor(sdata);
+
+        mutex_lock(&sdata->local->mtx);
         ieee80211_restart_sta_timer(sdata);
+        mutex_unlock(&sdata->local->mtx);
 }
 #endif
 
@@ -3106,7 +3124,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         }
 
         local->oper_channel = cbss->channel;
-        ieee80211_hw_config(local, 0);
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         if (!have_sta) {
                 u32 rates = 0, basic_rates = 0;
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index f054e94901a2..935aa4b6deee 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -234,6 +234,22 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
                 return;
         }
 
+        /* was never transmitted */
+        if (local->hw_roc_skb) {
+                u64 cookie;
+
+                cookie = local->hw_roc_cookie ^ 2;
+
+                cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,
+                                        local->hw_roc_skb->data,
+                                        local->hw_roc_skb->len, false,
+                                        GFP_KERNEL);
+
+                kfree_skb(local->hw_roc_skb);
+                local->hw_roc_skb = NULL;
+                local->hw_roc_skb_for_status = NULL;
+        }
+
         if (!local->hw_roc_for_tx)
                 cfg80211_remain_on_channel_expired(local->hw_roc_dev,
                                                    local->hw_roc_cookie,
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f5b1638fbf80..de455f8bbb91 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -378,7 +378,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
         /* make the station visible */
         sta_info_hash_add(local, sta);
 
-        list_add(&sta->list, &local->sta_list);
+        list_add_rcu(&sta->list, &local->sta_list);
 
         set_sta_flag(sta, WLAN_STA_INSERTED);
 
@@ -688,7 +688,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         if (ret)
                 return ret;
 
-        list_del(&sta->list);
+        list_del_rcu(&sta->list);
 
         mutex_lock(&local->key_mtx);
         for (i = 0; i < NUM_DEFAULT_KEYS; i++)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 847215bb2a6f..e453212fa17f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1737,7 +1737,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         __le16 fc;
         struct ieee80211_hdr hdr;
         struct ieee80211s_hdr mesh_hdr __maybe_unused;
-        struct mesh_path __maybe_unused *mppath = NULL;
+        struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
         const u8 *encaps_data;
         int encaps_len, skip_header_bytes;
         int nh_pos, h_pos;
@@ -1803,8 +1803,11 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         goto fail;
                 }
                 rcu_read_lock();
-                if (!is_multicast_ether_addr(skb->data))
-                        mppath = mpp_path_lookup(skb->data, sdata);
+                if (!is_multicast_ether_addr(skb->data)) {
+                        mpath = mesh_path_lookup(skb->data, sdata);
+                        if (!mpath)
+                                mppath = mpp_path_lookup(skb->data, sdata);
+                }
 
                 /*
                  * Use address extension if it is a packet from
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index a44c6807df01..8dd4712620ff 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1271,7 +1271,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         enum ieee80211_sta_state state;
 
                         for (state = IEEE80211_STA_NOTEXIST;
-                             state < sta->sta_state - 1; state++)
+                             state < sta->sta_state; state++)
                                 WARN_ON(drv_sta_state(local, sta->sdata, sta,
                                                       state, state + 1));
                 }
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 46d69d7f1bb4..31f50bc3a312 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                 return 0;
 
         /* RTP port is even */
-        port &= htons(~1);
-        rtp_port = port;
-        rtcp_port = htons(ntohs(port) + 1);
+        rtp_port = port & ~htons(1);
+        rtcp_port = port | htons(1);
 
         /* Create expect for RTP */
         if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)
diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
index 0a96a43108ed..1686ca1b53a1 100644
--- a/net/netfilter/xt_HMARK.c
+++ b/net/netfilter/xt_HMARK.c
@@ -32,13 +32,13 @@ MODULE_ALIAS("ipt_HMARK");
 MODULE_ALIAS("ip6t_HMARK");
 
 struct hmark_tuple {
-        u32                     src;
-        u32                     dst;
+        __be32                  src;
+        __be32                  dst;
         union hmark_ports       uports;
-        uint8_t                 proto;
+        u8                      proto;
 };
 
-static inline u32 hmark_addr6_mask(const __u32 *addr32, const __u32 *mask)
+static inline __be32 hmark_addr6_mask(const __be32 *addr32, const __be32 *mask)
 {
         return (addr32[0] & mask[0]) ^
                (addr32[1] & mask[1]) ^
@@ -46,8 +46,8 @@ static inline u32 hmark_addr6_mask(const __u32 *addr32, const __u32 *mask)
                (addr32[3] & mask[3]);
 }
 
-static inline u32
-hmark_addr_mask(int l3num, const __u32 *addr32, const __u32 *mask)
+static inline __be32
+hmark_addr_mask(int l3num, const __be32 *addr32, const __be32 *mask)
 {
         switch (l3num) {
         case AF_INET:
@@ -58,6 +58,22 @@ hmark_addr_mask(int l3num, const __u32 *addr32, const __u32 *mask)
         return 0;
 }
 
+static inline void hmark_swap_ports(union hmark_ports *uports,
+                                    const struct xt_hmark_info *info)
+{
+        union hmark_ports hp;
+        u16 src, dst;
+
+        hp.b32 = (uports->b32 & info->port_mask.b32) | info->port_set.b32;
+        src = ntohs(hp.b16.src);
+        dst = ntohs(hp.b16.dst);
+
+        if (dst > src)
+                uports->v32 = (dst << 16) | src;
+        else
+                uports->v32 = (src << 16) | dst;
+}
+
 static int
 hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
                     const struct xt_hmark_info *info)
@@ -74,22 +90,19 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
         otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
         rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 
-        t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.all,
-                                 info->src_mask.all);
-        t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.all,
-                                 info->dst_mask.all);
+        t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.ip6,
+                                 info->src_mask.ip6);
+        t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.ip6,
+                                 info->dst_mask.ip6);
 
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
                 return 0;
 
         t->proto = nf_ct_protonum(ct);
         if (t->proto != IPPROTO_ICMP) {
-                t->uports.p16.src = otuple->src.u.all;
-                t->uports.p16.dst = rtuple->src.u.all;
-                t->uports.v32 = (t->uports.v32 & info->port_mask.v32) |
-                                info->port_set.v32;
-                if (t->uports.p16.dst < t->uports.p16.src)
-                        swap(t->uports.p16.dst, t->uports.p16.src);
+                t->uports.b16.src = otuple->src.u.all;
+                t->uports.b16.dst = rtuple->src.u.all;
+                hmark_swap_ports(&t->uports, info);
         }
 
         return 0;
@@ -98,15 +111,19 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
 #endif
 }
 
+/* This hash function is endian independent, to ensure consistent hashing if
+ * the cluster is composed of big and little endian systems. */
 static inline u32
 hmark_hash(struct hmark_tuple *t, const struct xt_hmark_info *info)
 {
         u32 hash;
+        u32 src = ntohl(t->src);
+        u32 dst = ntohl(t->dst);
 
-        if (t->dst < t->src)
-                swap(t->src, t->dst);
+        if (dst < src)
+                swap(src, dst);
 
-        hash = jhash_3words(t->src, t->dst, t->uports.v32, info->hashrnd);
+        hash = jhash_3words(src, dst, t->uports.v32, info->hashrnd);
         hash = hash ^ (t->proto & info->proto_mask);
 
         return (((u64)hash * info->hmodulus) >> 32) + info->hoffset;
@@ -126,11 +143,7 @@ hmark_set_tuple_ports(const struct sk_buff *skb, unsigned int nhoff,
         if (skb_copy_bits(skb, nhoff, &t->uports, sizeof(t->uports)) < 0)
                 return;
 
-        t->uports.v32 = (t->uports.v32 & info->port_mask.v32) |
-                        info->port_set.v32;
-
-        if (t->uports.p16.dst < t->uports.p16.src)
-                swap(t->uports.p16.dst, t->uports.p16.src);
+        hmark_swap_ports(&t->uports, info);
 }
 
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
@@ -178,8 +191,8 @@ hmark_pkt_set_htuple_ipv6(const struct sk_buff *skb, struct hmark_tuple *t,
                         return -1;
         }
 noicmp:
-        t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.all);
-        t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.all);
+        t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.ip6);
+        t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.ip6);
 
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
                 return 0;
@@ -255,11 +268,8 @@ hmark_pkt_set_htuple_ipv4(const struct sk_buff *skb, struct hmark_tuple *t,
                 }
         }
 
-        t->src = (__force u32) ip->saddr;
-        t->dst = (__force u32) ip->daddr;
-
-        t->src &= info->src_mask.ip;
-        t->dst &= info->dst_mask.ip;
+        t->src = ip->saddr & info->src_mask.ip;
+        t->dst = ip->daddr & info->dst_mask.ip;
 
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
                 return 0;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 3f339b19d140..17a707db40eb 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -292,6 +292,9 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
 
         pr_debug("%p\n", sk);
 
+        if (llcp_sock == NULL)
+                return -EBADFD;
+
         addr->sa_family = AF_NFC;
         *len = sizeof(struct sockaddr_nfc_llcp);
 
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 04040476082e..21fde99e5c56 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -71,7 +71,9 @@ static void rpc_purge_list(wait_queue_head_t *waitq, struct list_head *head,
                 msg->errno = err;
                 destroy_msg(msg);
         } while (!list_empty(head));
-        wake_up(waitq);
+
+        if (waitq)
+                wake_up(waitq);
 }
 
 static void
@@ -91,11 +93,9 @@ rpc_timeout_upcall_queue(struct work_struct *work)
         }
         dentry = dget(pipe->dentry);
         spin_unlock(&pipe->lock);
-        if (dentry) {
-                rpc_purge_list(&RPC_I(dentry->d_inode)->waitq,
-                               &free_list, destroy_msg, -ETIMEDOUT);
-                dput(dentry);
-        }
+        rpc_purge_list(dentry ? &RPC_I(dentry->d_inode)->waitq : NULL,
+                        &free_list, destroy_msg, -ETIMEDOUT);
+        dput(dentry);
 }
 
 ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg,
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 7e9baaa1e543..3ee7461926d8 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1374,7 +1374,8 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
                                                 sizeof(req->rq_snd_buf));
                 return bc_send(req);
         } else {
-                /* Nothing to do to drop request */
+                /* drop request */
+                xprt_free_bc_request(req);
                 return 0;
         }
 }
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index d2a19b0ff71f..89baa3328411 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -42,6 +42,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
         cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
+        wdev->sme_state = CFG80211_SME_CONNECTED;
         cfg80211_upload_connect_keys(wdev);
 
         nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
@@ -60,7 +61,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
         struct cfg80211_event *ev;
         unsigned long flags;
 
-        CFG80211_DEV_WARN_ON(!wdev->ssid_len);
+        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTING);
 
         ev = kzalloc(sizeof(*ev), gfp);
         if (!ev)
@@ -115,9 +116,11 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
 #ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.channel = params->channel;
 #endif
+        wdev->sme_state = CFG80211_SME_CONNECTING;
         err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
         if (err) {
                 wdev->connect_keys = NULL;
+                wdev->sme_state = CFG80211_SME_IDLE;
                 return err;
         }
 
@@ -169,6 +172,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
         }
 
         wdev->current_bss = NULL;
+        wdev->sme_state = CFG80211_SME_IDLE;
         wdev->ssid_len = 0;
 #ifdef CONFIG_CFG80211_WEXT
         if (!nowext)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 55d99466babb..8f2d68fc3a44 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -935,6 +935,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                                   enum nl80211_iftype iftype)
 {
         struct wireless_dev *wdev_iter;
+        u32 used_iftypes = BIT(iftype);
         int num[NUM_NL80211_IFTYPES];
         int total = 1;
         int i, j;
@@ -961,6 +962,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
 
                 num[wdev_iter->iftype]++;
                 total++;
+                used_iftypes |= BIT(wdev_iter->iftype);
         }
         mutex_unlock(&rdev->devlist_mtx);
 
@@ -970,6 +972,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
         for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
                 const struct ieee80211_iface_combination *c;
                 struct ieee80211_iface_limit *limits;
+                u32 all_iftypes = 0;
 
                 c = &rdev->wiphy.iface_combinations[i];
 
@@ -984,6 +987,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                         if (rdev->wiphy.software_iftypes & BIT(iftype))
                                 continue;
                         for (j = 0; j < c->n_limits; j++) {
+                                all_iftypes |= limits[j].types;
                                 if (!(limits[j].types & BIT(iftype)))
                                         continue;
                                 if (limits[j].max < num[iftype])
@@ -991,7 +995,20 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                                 limits[j].max -= num[iftype];
                         }
                 }
-                /* yay, it fits */
+
+                /*
+                 * Finally check that all iftypes that we're currently
+                 * using are actually part of this combination. If they
+                 * aren't then we can't use this combination and have
+                 * to continue to the next.
+                 */
+                if ((all_iftypes & used_iftypes) != used_iftypes)
+                        goto cont;
+
+                /*
+                 * This combination covered all interface types and
+                 * supported the requested numbers, so we're good.
+                 */
                 kfree(limits);
                 return 0;
  cont:
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index a68aed7fce02..ec2118d0e27a 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -502,10 +502,8 @@ static int snd_compr_pause(struct snd_compr_stream *stream)
         if (stream->runtime->state != SNDRV_PCM_STATE_RUNNING)
                 return -EPERM;
         retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_PAUSE_PUSH);
-        if (!retval) {
+        if (!retval)
                 stream->runtime->state = SNDRV_PCM_STATE_PAUSED;
-                wake_up(&stream->runtime->sleep);
-        }
         return retval;
 }
 
@@ -544,6 +542,10 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
         if (!retval) {
                 stream->runtime->state = SNDRV_PCM_STATE_SETUP;
                 wake_up(&stream->runtime->sleep);
+                stream->runtime->hw_pointer = 0;
+                stream->runtime->app_pointer = 0;
+                stream->runtime->total_bytes_available = 0;
+                stream->runtime->total_bytes_transferred = 0;
         }
         return retval;
 }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 2b6392be451c..02763827dde0 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2484,9 +2484,9 @@ static void azx_notifier_unregister(struct azx *chip)
 static int DELAYED_INIT_MARK azx_first_init(struct azx *chip);
 static int DELAYED_INIT_MARK azx_probe_continue(struct azx *chip);
 
+#ifdef SUPPORT_VGA_SWITCHEROO
 static struct pci_dev __devinit *get_bound_vga(struct pci_dev *pci);
 
-#ifdef SUPPORT_VGA_SWITCHEROO
 static void azx_vs_set_state(struct pci_dev *pci,
                              enum vga_switcheroo_state state)
 {
@@ -2578,6 +2578,7 @@ static int __devinit register_vga_switcheroo(struct azx *chip)
 #else
 #define init_vga_switcheroo(chip)               /* NOP */
 #define register_vga_switcheroo(chip)           0
+#define check_hdmi_disabled(pci)        false
 #endif /* SUPPORT_VGA_SWITCHER */
 
 /*
@@ -2638,6 +2639,7 @@ static int azx_dev_free(struct snd_device *device)
         return azx_free(device->device_data);
 }
 
+#ifdef SUPPORT_VGA_SWITCHEROO
 /*
  * Check of disabled HDMI controller by vga-switcheroo
  */
@@ -2670,12 +2672,13 @@ static bool __devinit check_hdmi_disabled(struct pci_dev *pci)
         struct pci_dev *p = get_bound_vga(pci);
 
         if (p) {
-                if (vga_default_device() && p != vga_default_device())
+                if (vga_switcheroo_get_client_state(p) == VGA_SWITCHEROO_OFF)
                         vga_inactive = true;
                 pci_dev_put(p);
         }
         return vga_inactive;
 }
+#endif /* SUPPORT_VGA_SWITCHEROO */
 
 /*
  * white/black-listing for position_fix
@@ -3351,6 +3354,11 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
         { PCI_DEVICE(0x6549, 0x1200),
           .driver_data = AZX_DRIVER_TERA | AZX_DCAPS_NO_64BIT },
         /* Creative X-Fi (CA0110-IBG) */
+        /* CTHDA chips */
+        { PCI_DEVICE(0x1102, 0x0010),
+          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
+        { PCI_DEVICE(0x1102, 0x0012),
+          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
 #if !defined(CONFIG_SND_CTXFI) && !defined(CONFIG_SND_CTXFI_MODULE)
         /* the following entry conflicts with snd-ctxfi driver,
          * as ctxfi driver mutates from HD-audio to native mode with
@@ -3367,11 +3375,6 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
           .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
           AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
 #endif
-        /* CTHDA chips */
-        { PCI_DEVICE(0x1102, 0x0010),
-          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
-        { PCI_DEVICE(0x1102, 0x0012),
-          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
         /* Vortex86MX */
         { PCI_DEVICE(0x17f3, 0x3010), .driver_data = AZX_DRIVER_GENERIC },
         /* VMware HDAudio */
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 3acb5824ad39..172370b3793b 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4061,7 +4061,7 @@ static void cx_auto_init_digital(struct hda_codec *codec)
 static int cx_auto_init(struct hda_codec *codec)
 {
         struct conexant_spec *spec = codec->spec;
-        /*snd_hda_sequence_write(codec, cx_auto_init_verbs);*/
+        snd_hda_gen_apply_verbs(codec);
         cx_auto_init_output(codec);
         cx_auto_init_input(codec);
         cx_auto_init_digital(codec);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 224410e8e9e7..f8f4906e498d 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1896,6 +1896,7 @@ static int alc_init(struct hda_codec *codec)
         alc_fix_pll(codec);
         alc_auto_init_amp(codec, spec->init_amp);
 
+        snd_hda_gen_apply_verbs(codec);
         alc_init_special_input_src(codec);
         alc_auto_init_std(codec);
 
@@ -6439,6 +6440,7 @@ enum {
         ALC662_FIXUP_ASUS_MODE7,
         ALC662_FIXUP_ASUS_MODE8,
         ALC662_FIXUP_NO_JACK_DETECT,
+        ALC662_FIXUP_ZOTAC_Z68,
 };
 
 static const struct alc_fixup alc662_fixups[] = {
@@ -6588,6 +6590,13 @@ static const struct alc_fixup alc662_fixups[] = {
                 .type = ALC_FIXUP_FUNC,
                 .v.func = alc_fixup_no_jack_detect,
         },
+        [ALC662_FIXUP_ZOTAC_Z68] = {
+                .type = ALC_FIXUP_PINS,
+                .v.pins = (const struct alc_pincfg[]) {
+                        { 0x1b, 0x02214020 }, /* Front HP */
+                        { }
+                }
+        },
 };
 
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -6601,6 +6610,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+        SND_PCI_QUIRK(0x19da, 0xa130, "Zotac Z68", ALC662_FIXUP_ZOTAC_Z68),
         SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
 
 #if 0
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index a75c3766aede..0418fa11e6bd 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -99,8 +99,9 @@ static void wm2000_reset(struct wm2000_priv *wm2000)
 }
 
 static int wm2000_poll_bit(struct i2c_client *i2c,
-                           unsigned int reg, u8 mask, int timeout)
+                           unsigned int reg, u8 mask)
 {
+        int timeout = 4000;
         int val;
 
         val = wm2000_read(i2c, reg);
@@ -119,7 +120,7 @@ static int wm2000_poll_bit(struct i2c_client *i2c,
 static int wm2000_power_up(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int ret, timeout;
+        int ret;
 
         BUG_ON(wm2000->anc_mode != ANC_OFF);
 
@@ -140,13 +141,13 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
 
         /* Wait for ANC engine to become ready */
         if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT,
-                             WM2000_ANC_ENG_IDLE, 1)) {
+                             WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev, "ANC engine failed to reset\n");
                 return -ETIMEDOUT;
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_BOOT_COMPLETE, 1)) {
+                             WM2000_STATUS_BOOT_COMPLETE)) {
                 dev_err(&i2c->dev, "ANC engine failed to initialise\n");
                 return -ETIMEDOUT;
         }
@@ -173,16 +174,13 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
         dev_dbg(&i2c->dev, "Download complete\n");
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, 248 / 4);
 
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_MOUSE_ENABLE |
                              WM2000_MODE_THERMAL_ENABLE);
         } else {
-                timeout = 10;
-
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_MOUSE_ENABLE |
                              WM2000_MODE_THERMAL_ENABLE);
@@ -201,9 +199,8 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
         wm2000_write(i2c, WM2000_REG_SYS_CTL2, WM2000_ANC_INT_N_CLR);
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_MOUSE_ACTIVE, timeout)) {
-                dev_err(&i2c->dev, "Timed out waiting for device after %dms\n",
-                        timeout * 10);
+                             WM2000_STATUS_MOUSE_ACTIVE)) {
+                dev_err(&i2c->dev, "Timed out waiting for device\n");
                 return -ETIMEDOUT;
         }
 
@@ -218,28 +215,25 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
 static int wm2000_power_down(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int timeout;
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, 248 / 4);
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_POWER_DOWN);
         } else {
-                timeout = 10;
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_POWER_DOWN);
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_POWER_DOWN_COMPLETE, timeout)) {
+                             WM2000_STATUS_POWER_DOWN_COMPLETE)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC power down\n");
                 return -ETIMEDOUT;
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT,
-                             WM2000_ANC_ENG_IDLE, 1)) {
+                             WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC engine idle\n");
                 return -ETIMEDOUT;
         }
@@ -268,13 +262,13 @@ static int wm2000_enter_bypass(struct i2c_client *i2c, int analogue)
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_ANC_DISABLED, 10)) {
+                             WM2000_STATUS_ANC_DISABLED)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC disable\n");
                 return -ETIMEDOUT;
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT,
-                             WM2000_ANC_ENG_IDLE, 1)) {
+                             WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC engine idle\n");
                 return -ETIMEDOUT;
         }
@@ -311,7 +305,7 @@ static int wm2000_exit_bypass(struct i2c_client *i2c, int analogue)
         wm2000_write(i2c, WM2000_REG_SYS_CTL2, WM2000_ANC_INT_N_CLR);
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_MOUSE_ACTIVE, 10)) {
+                             WM2000_STATUS_MOUSE_ACTIVE)) {
                 dev_err(&i2c->dev, "Timed out waiting for MOUSE\n");
                 return -ETIMEDOUT;
         }
@@ -325,38 +319,32 @@ static int wm2000_exit_bypass(struct i2c_client *i2c, int analogue)
 static int wm2000_enter_standby(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int timeout;
 
         BUG_ON(wm2000->anc_mode != ANC_ACTIVE);
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, 248 / 4);
 
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_STANDBY_ENTRY);
         } else {
-                timeout = 10;
-
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_STANDBY_ENTRY);
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_ANC_DISABLED, timeout)) {
+                             WM2000_STATUS_ANC_DISABLED)) {
                 dev_err(&i2c->dev,
                         "Timed out waiting for ANC disable after 1ms\n");
                 return -ETIMEDOUT;
         }
 
-        if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT, WM2000_ANC_ENG_IDLE,
-                             1)) {
+        if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT, WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev,
-                        "Timed out waiting for standby after %dms\n",
-                        timeout * 10);
+                        "Timed out waiting for standby\n");
                 return -ETIMEDOUT;
         }
 
@@ -374,23 +362,19 @@ static int wm2000_enter_standby(struct i2c_client *i2c, int analogue)
 static int wm2000_exit_standby(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int timeout;
 
         BUG_ON(wm2000->anc_mode != ANC_STANDBY);
 
         wm2000_write(i2c, WM2000_REG_SYS_CTL1, 0);
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, 248 / 4);
 
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_MOUSE_ENABLE);
         } else {
-                timeout = 10;
-
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_MOUSE_ENABLE);
@@ -400,9 +384,8 @@ static int wm2000_exit_standby(struct i2c_client *i2c, int analogue)
         wm2000_write(i2c, WM2000_REG_SYS_CTL2, WM2000_ANC_INT_N_CLR);
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_MOUSE_ACTIVE, timeout)) {
-                dev_err(&i2c->dev, "Timed out waiting for MOUSE after %dms\n",
-                        timeout * 10);
+                             WM2000_STATUS_MOUSE_ACTIVE)) {
+                dev_err(&i2c->dev, "Timed out waiting for MOUSE\n");
                 return -ETIMEDOUT;
         }
 
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 993639d694ce..aa8c98b628da 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -46,6 +46,39 @@
 #define WM8994_NUM_DRC 3
 #define WM8994_NUM_EQ  3
 
+static struct {
+        unsigned int reg;
+        unsigned int mask;
+} wm8994_vu_bits[] = {
+        { WM8994_LEFT_LINE_INPUT_1_2_VOLUME, WM8994_IN1_VU },
+        { WM8994_RIGHT_LINE_INPUT_1_2_VOLUME, WM8994_IN1_VU },
+        { WM8994_LEFT_LINE_INPUT_3_4_VOLUME, WM8994_IN2_VU },
+        { WM8994_RIGHT_LINE_INPUT_3_4_VOLUME, WM8994_IN2_VU },
+        { WM8994_SPEAKER_VOLUME_LEFT, WM8994_SPKOUT_VU },
+        { WM8994_SPEAKER_VOLUME_RIGHT, WM8994_SPKOUT_VU },
+        { WM8994_LEFT_OUTPUT_VOLUME, WM8994_HPOUT1_VU },
+        { WM8994_RIGHT_OUTPUT_VOLUME, WM8994_HPOUT1_VU },
+        { WM8994_LEFT_OPGA_VOLUME, WM8994_MIXOUT_VU },
+        { WM8994_RIGHT_OPGA_VOLUME, WM8994_MIXOUT_VU },
+
+        { WM8994_AIF1_DAC1_LEFT_VOLUME, WM8994_AIF1DAC1_VU },
+        { WM8994_AIF1_DAC1_RIGHT_VOLUME, WM8994_AIF1DAC1_VU },
+        { WM8994_AIF1_DAC2_LEFT_VOLUME, WM8994_AIF1DAC2_VU },
+        { WM8994_AIF1_DAC2_RIGHT_VOLUME, WM8994_AIF1DAC2_VU },
+        { WM8994_AIF2_DAC_LEFT_VOLUME, WM8994_AIF2DAC_VU },
+        { WM8994_AIF2_DAC_RIGHT_VOLUME, WM8994_AIF2DAC_VU },
+        { WM8994_AIF1_ADC1_LEFT_VOLUME, WM8994_AIF1ADC1_VU },
+        { WM8994_AIF1_ADC1_RIGHT_VOLUME, WM8994_AIF1ADC1_VU },
+        { WM8994_AIF1_ADC2_LEFT_VOLUME, WM8994_AIF1ADC2_VU },
+        { WM8994_AIF1_ADC2_RIGHT_VOLUME, WM8994_AIF1ADC2_VU },
+        { WM8994_AIF2_ADC_LEFT_VOLUME, WM8994_AIF2ADC_VU },
+        { WM8994_AIF2_ADC_RIGHT_VOLUME, WM8994_AIF1ADC2_VU },
+        { WM8994_DAC1_LEFT_VOLUME, WM8994_DAC1_VU },
+        { WM8994_DAC1_RIGHT_VOLUME, WM8994_DAC1_VU },
+        { WM8994_DAC2_LEFT_VOLUME, WM8994_DAC2_VU },
+        { WM8994_DAC2_RIGHT_VOLUME, WM8994_DAC2_VU },
+};
+
 static int wm8994_drc_base[] = {
         WM8994_AIF1_DRC1_1,
         WM8994_AIF1_DRC2_1,
@@ -989,6 +1022,7 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
         struct snd_soc_codec *codec = w->codec;
         struct wm8994 *control = codec->control_data;
         int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
+        int i;
         int dac;
         int adc;
         int val;
@@ -1047,6 +1081,13 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
                                     WM8994_AIF1DAC2L_ENA);
                 break;
 
+        case SND_SOC_DAPM_POST_PMU:
+                for (i = 0; i < ARRAY_SIZE(wm8994_vu_bits); i++)
+                        snd_soc_write(codec, wm8994_vu_bits[i].reg,
+                                      snd_soc_read(codec,
+                                                   wm8994_vu_bits[i].reg));
+                break;
+
         case SND_SOC_DAPM_PRE_PMD:
         case SND_SOC_DAPM_POST_PMD:
                 snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
@@ -1072,6 +1113,7 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
                       struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
+        int i;
         int dac;
         int adc;
         int val;
@@ -1122,6 +1164,13 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
                                     WM8994_AIF2DACR_ENA);
                 break;
 
+        case SND_SOC_DAPM_POST_PMU:
+                for (i = 0; i < ARRAY_SIZE(wm8994_vu_bits); i++)
+                        snd_soc_write(codec, wm8994_vu_bits[i].reg,
+                                      snd_soc_read(codec,
+                                                   wm8994_vu_bits[i].reg));
+                break;
+
         case SND_SOC_DAPM_PRE_PMD:
         case SND_SOC_DAPM_POST_PMD:
                 snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
@@ -1190,17 +1239,19 @@ static int late_enable_ev(struct snd_soc_dapm_widget *w,
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
                 if (wm8994->aif1clk_enable) {
-                        aif1clk_ev(w, kcontrol, event);
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMU);
                         snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
                                             WM8994_AIF1CLK_ENA_MASK,
                                             WM8994_AIF1CLK_ENA);
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMU);
                         wm8994->aif1clk_enable = 0;
                 }
                 if (wm8994->aif2clk_enable) {
-                        aif2clk_ev(w, kcontrol, event);
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMU);
                         snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
                                             WM8994_AIF2CLK_ENA_MASK,
                                             WM8994_AIF2CLK_ENA);
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMU);
                         wm8994->aif2clk_enable = 0;
                 }
                 break;
@@ -1221,15 +1272,17 @@ static int late_disable_ev(struct snd_soc_dapm_widget *w,
         switch (event) {
         case SND_SOC_DAPM_POST_PMD:
                 if (wm8994->aif1clk_disable) {
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMD);
                         snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
                                             WM8994_AIF1CLK_ENA_MASK, 0);
-                        aif1clk_ev(w, kcontrol, event);
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMD);
                         wm8994->aif1clk_disable = 0;
                 }
                 if (wm8994->aif2clk_disable) {
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMD);
                         snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
                                             WM8994_AIF2CLK_ENA_MASK, 0);
-                        aif2clk_ev(w, kcontrol, event);
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMD);
                         wm8994->aif2clk_disable = 0;
                 }
                 break;
@@ -1527,9 +1580,11 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev)
 
 static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = {
 SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev,
-                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+                    SND_SOC_DAPM_PRE_PMD),
 SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev,
-                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+                    SND_SOC_DAPM_PRE_PMD),
 SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0),
 SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0,
                    left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)),
@@ -3879,39 +3934,11 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
 
         pm_runtime_put(codec->dev);
 
-        /* Latch volume updates (right only; we always do left then right). */
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC1_LEFT_VOLUME,
-                            WM8994_AIF1DAC1_VU, WM8994_AIF1DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC1_RIGHT_VOLUME,
-                            WM8994_AIF1DAC1_VU, WM8994_AIF1DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC2_LEFT_VOLUME,
-                            WM8994_AIF1DAC2_VU, WM8994_AIF1DAC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC2_RIGHT_VOLUME,
-                            WM8994_AIF1DAC2_VU, WM8994_AIF1DAC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_DAC_LEFT_VOLUME,
-                            WM8994_AIF2DAC_VU, WM8994_AIF2DAC_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_DAC_RIGHT_VOLUME,
-                            WM8994_AIF2DAC_VU, WM8994_AIF2DAC_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC1_LEFT_VOLUME,
-                            WM8994_AIF1ADC1_VU, WM8994_AIF1ADC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC1_RIGHT_VOLUME,
-                            WM8994_AIF1ADC1_VU, WM8994_AIF1ADC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC2_LEFT_VOLUME,
-                            WM8994_AIF1ADC2_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC2_RIGHT_VOLUME,
-                            WM8994_AIF1ADC2_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_ADC_LEFT_VOLUME,
-                            WM8994_AIF2ADC_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_ADC_RIGHT_VOLUME,
-                            WM8994_AIF2ADC_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_DAC1_LEFT_VOLUME,
-                            WM8994_DAC1_VU, WM8994_DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_DAC1_RIGHT_VOLUME,
-                            WM8994_DAC1_VU, WM8994_DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_DAC2_LEFT_VOLUME,
-                            WM8994_DAC2_VU, WM8994_DAC2_VU);
-        snd_soc_update_bits(codec, WM8994_DAC2_RIGHT_VOLUME,
-                            WM8994_DAC2_VU, WM8994_DAC2_VU);
+        /* Latch volume update bits */
+        for (i = 0; i < ARRAY_SIZE(wm8994_vu_bits); i++)
+                snd_soc_update_bits(codec, wm8994_vu_bits[i].reg,
+                                    wm8994_vu_bits[i].mask,
+                                    wm8994_vu_bits[i].mask);
 
         /* Set the low bit of the 3D stereo depth so TLV matches */
         snd_soc_update_bits(codec, WM8994_AIF1_DAC1_FILTERS_2,
diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
index f23700359c67..080327414c6b 100644
--- a/sound/soc/fsl/imx-audmux.c
+++ b/sound/soc/fsl/imx-audmux.c
@@ -26,6 +26,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
+#include <linux/pinctrl/consumer.h>
 
 #include "imx-audmux.h"
 
@@ -249,6 +250,7 @@ EXPORT_SYMBOL_GPL(imx_audmux_v2_configure_port);
 static int __devinit imx_audmux_probe(struct platform_device *pdev)
 {
         struct resource *res;
+        struct pinctrl *pinctrl;
         const struct of_device_id *of_id =
                         of_match_device(imx_audmux_dt_ids, &pdev->dev);
 
@@ -257,6 +259,12 @@ static int __devinit imx_audmux_probe(struct platform_device *pdev)
         if (!audmux_base)
                 return -EADDRNOTAVAIL;
 
+        pinctrl = devm_pinctrl_get_select_default(&pdev->dev);
+        if (IS_ERR(pinctrl)) {
+                dev_err(&pdev->dev, "setup pinctrl failed!");
+                return PTR_ERR(pinctrl);
+        }
+
         audmux_clk = clk_get(&pdev->dev, "audmux");
         if (IS_ERR(audmux_clk)) {
                 dev_dbg(&pdev->dev, "cannot get clock: %ld\n",
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 90ee77d2409d..89eae93445cf 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -913,7 +913,7 @@ static int is_connected_input_ep(struct snd_soc_dapm_widget *widget,
                         /* do we need to add this widget to the list ? */
                         if (list) {
                                 int err;
-                                err = dapm_list_add_widget(list, path->sink);
+                                err = dapm_list_add_widget(list, path->source);
                                 if (err < 0) {
                                         dev_err(widget->dapm->dev, "could not add widget %s\n",
                                                 widget->name);
@@ -954,7 +954,7 @@ int snd_soc_dapm_dai_get_connected_widgets(struct snd_soc_dai *dai, int stream,
         if (stream == SNDRV_PCM_STREAM_PLAYBACK)
                 paths = is_connected_output_ep(dai->playback_widget, list);
         else
-                paths = is_connected_input_ep(dai->playback_widget, list);
+                paths = is_connected_input_ep(dai->capture_widget, list);
 
         trace_snd_soc_dapm_connected(paths, stream);
         dapm_clear_walk(&card->dapm);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index bedd1717a373..48fd15b312c1 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -794,6 +794,9 @@ static struct snd_soc_pcm_runtime *dpcm_get_be(struct snd_soc_card *card,
                 for (i = 0; i < card->num_links; i++) {
                         be = &card->rtd[i];
 
+                        if (!be->dai_link->no_pcm)
+                                continue;
+
                         if (be->cpu_dai->playback_widget == widget ||
                                 be->codec_dai->playback_widget == widget)
                                 return be;
@@ -803,6 +806,9 @@ static struct snd_soc_pcm_runtime *dpcm_get_be(struct snd_soc_card *card,
                 for (i = 0; i < card->num_links; i++) {
                         be = &card->rtd[i];
 
+                        if (!be->dai_link->no_pcm)
+                                continue;
+
                         if (be->cpu_dai->capture_widget == widget ||
                                 be->codec_dai->capture_widget == widget)
                                 return be;
diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index 57cd419f743e..f43edb364a18 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -629,3 +629,4 @@ MODULE_AUTHOR("Stephen Warren <swarren@nvidia.com>");
 MODULE_DESCRIPTION("Tegra30 AHUB driver");
 MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("platform:" DRV_NAME);
+MODULE_DEVICE_TABLE(of, tegra30_ahub_of_match);
diff --git a/sound/usb/card.h b/sound/usb/card.h
index 0d37238b8457..2b9fffff23b6 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -119,6 +119,7 @@ struct snd_usb_substream {
         unsigned long unlink_mask;      /* bitmask of unlinked urbs */
 
         /* data and sync endpoints for this stream */
+        unsigned int ep_num;            /* the endpoint number */
         struct snd_usb_endpoint *data_endpoint;
         struct snd_usb_endpoint *sync_endpoint;
         unsigned long flags;
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 6b7d7a2b7baa..083ed81160e5 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -97,6 +97,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as,
         subs->formats |= fp->formats;
         subs->num_formats++;
         subs->fmt_type = fp->fmt_type;
+        subs->ep_num = fp->endpoint;
 }
 
 /*
@@ -119,9 +120,7 @@ int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
                 if (as->fmt_type != fp->fmt_type)
                         continue;
                 subs = &as->substream[stream];
-                if (!subs->data_endpoint)
-                        continue;
-                if (subs->data_endpoint->ep_num == fp->endpoint) {
+                if (subs->ep_num == fp->endpoint) {
                         list_add_tail(&fp->list, &subs->fmt_list);
                         subs->num_formats++;
                         subs->formats |= fp->formats;
@@ -134,7 +133,7 @@ int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
                 if (as->fmt_type != fp->fmt_type)
                         continue;
                 subs = &as->substream[stream];
-                if (subs->data_endpoint)
+                if (subs->ep_num)
                         continue;
                 err = snd_pcm_new_stream(as->pcm, stream, 1);
                 if (err < 0)
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 5476bc0a1eac..b4b572e8c100 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -1,4 +1,6 @@
 tools/perf
+tools/scripts
+tools/lib/traceevent
 include/linux/const.h
 include/linux/perf_event.h
 include/linux/rbtree.h
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 8c767c6bca91..25249f76329d 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -152,7 +152,7 @@ static int perf_evsel__add_hist_entry(struct perf_evsel *evsel,
 
         if (symbol_conf.use_callchain) {
                 err = callchain_append(he->callchain,
-                                       &evsel->hists.callchain_cursor,
+                                       &callchain_cursor,
                                        sample->period);
                 if (err)
                         return err;
@@ -162,7 +162,7 @@ static int perf_evsel__add_hist_entry(struct perf_evsel *evsel,
          * so we don't allocated the extra space needed because the stdio
          * code will not use it.
          */
-        if (al->sym != NULL && use_browser > 0) {
+        if (he->ms.sym != NULL && use_browser > 0) {
                 struct annotation *notes = symbol__annotation(he->ms.sym);
 
                 assert(evsel != NULL);
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 62ae30d34fa6..262589991ea4 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1129,7 +1129,7 @@ static int add_default_attributes(void)
                 return 0;
 
         if (!evsel_list->nr_entries) {
-                if (perf_evlist__add_attrs_array(evsel_list, default_attrs) < 0)
+                if (perf_evlist__add_default_attrs(evsel_list, default_attrs) < 0)
                         return -1;
         }
 
@@ -1139,21 +1139,21 @@ static int add_default_attributes(void)
                 return 0;
 
         /* Append detailed run extra attributes: */
-        if (perf_evlist__add_attrs_array(evsel_list, detailed_attrs) < 0)
+        if (perf_evlist__add_default_attrs(evsel_list, detailed_attrs) < 0)
                 return -1;
 
         if (detailed_run < 2)
                 return 0;
 
         /* Append very detailed run extra attributes: */
-        if (perf_evlist__add_attrs_array(evsel_list, very_detailed_attrs) < 0)
+        if (perf_evlist__add_default_attrs(evsel_list, very_detailed_attrs) < 0)
                 return -1;
 
         if (detailed_run < 3)
                 return 0;
 
         /* Append very, very detailed run extra attributes: */
-        return perf_evlist__add_attrs_array(evsel_list, very_very_detailed_attrs);
+        return perf_evlist__add_default_attrs(evsel_list, very_very_detailed_attrs);
 }
 
 int cmd_stat(int argc, const char **argv, const char *prefix __used)
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 871b540293e1..6bb0277b7dfe 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -787,7 +787,7 @@ static void perf_event__process_sample(struct perf_tool *tool,
                 }
 
                 if (symbol_conf.use_callchain) {
-                        err = callchain_append(he->callchain, &evsel->hists.callchain_cursor,
+                        err = callchain_append(he->callchain, &callchain_cursor,
                                                sample->period);
                         if (err)
                                 return;
diff --git a/tools/perf/design.txt b/tools/perf/design.txt
index bd0bb1b1279b..67e5d0cace85 100644
--- a/tools/perf/design.txt
+++ b/tools/perf/design.txt
@@ -409,14 +409,15 @@ Counters can be enabled and disabled in two ways: via ioctl and via
 prctl.  When a counter is disabled, it doesn't count or generate
 events but does continue to exist and maintain its count value.
 
-An individual counter or counter group can be enabled with
+An individual counter can be enabled with
 
-        ioctl(fd, PERF_EVENT_IOC_ENABLE);
+        ioctl(fd, PERF_EVENT_IOC_ENABLE, 0);
 
 or disabled with
 
-        ioctl(fd, PERF_EVENT_IOC_DISABLE);
+        ioctl(fd, PERF_EVENT_IOC_DISABLE, 0);
 
+For a counter group, pass PERF_IOC_FLAG_GROUP as the third argument.
 Enabling or disabling the leader of a group enables or disables the
 whole group; that is, while the group leader is disabled, none of the
 counters in the group will count.  Enabling or disabling a member of a
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 4deea6aaf927..34b1c46eaf42 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -668,7 +668,7 @@ static int annotate_browser__run(struct annotate_browser *browser, int evidx,
                 "q/ESC/CTRL+C  Exit\n\n"
                 "->            Go to target\n"
                 "<-            Exit\n"
-                "h             Cycle thru hottest instructions\n"
+                "H             Cycle thru hottest instructions\n"
                 "j             Toggle showing jump to target arrows\n"
                 "J             Toggle showing number of jump sources on targets\n"
                 "n             Search next string\n"
diff --git a/tools/perf/util/PERF-VERSION-GEN b/tools/perf/util/PERF-VERSION-GEN
index ad73300f7bac..95264f304179 100755
--- a/tools/perf/util/PERF-VERSION-GEN
+++ b/tools/perf/util/PERF-VERSION-GEN
@@ -12,7 +12,7 @@ LF='
 # First check if there is a .git to get the version from git describe
 # otherwise try to get the version from the kernel makefile
 if test -d ../../.git -o -f ../../.git &&
-        VN=$(git describe --abbrev=4 HEAD 2>/dev/null) &&
+        VN=$(git describe --match 'v[0-9].[0-9]*' --abbrev=4 HEAD 2>/dev/null) &&
         case "$VN" in
         *$LF*) (exit 1) ;;
         v[0-9]*)
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 9f7106a8d9a4..3a6bff47614f 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -18,6 +18,8 @@
 #include "util.h"
 #include "callchain.h"
 
+__thread struct callchain_cursor callchain_cursor;
+
 bool ip_callchain__valid(struct ip_callchain *chain,
                          const union perf_event *event)
 {
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 7f9c0f1ae3a9..3bdb407f9cd9 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -76,6 +76,8 @@ struct callchain_cursor {
         struct callchain_cursor_node    *curr;
 };
 
+extern __thread struct callchain_cursor callchain_cursor;
+
 static inline void callchain_init(struct callchain_root *root)
 {
         INIT_LIST_HEAD(&root->node.siblings);
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index 4ac5f5ae4ce9..7400fb3fc50c 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -159,6 +159,17 @@ out_delete_partial_list:
         return -1;
 }
 
+int __perf_evlist__add_default_attrs(struct perf_evlist *evlist,
+                                     struct perf_event_attr *attrs, size_t nr_attrs)
+{
+        size_t i;
+
+        for (i = 0; i < nr_attrs; i++)
+                event_attr_init(attrs + i);
+
+        return perf_evlist__add_attrs(evlist, attrs, nr_attrs);
+}
+
 static int trace_event__id(const char *evname)
 {
         char *filename, *colon;
@@ -263,7 +274,8 @@ void perf_evlist__disable(struct perf_evlist *evlist)
         for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
                 list_for_each_entry(pos, &evlist->entries, node) {
                         for (thread = 0; thread < evlist->threads->nr; thread++)
-                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_DISABLE);
+                                ioctl(FD(pos, cpu, thread),
+                                      PERF_EVENT_IOC_DISABLE, 0);
                 }
         }
 }
@@ -276,7 +288,8 @@ void perf_evlist__enable(struct perf_evlist *evlist)
         for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
                 list_for_each_entry(pos, &evlist->entries, node) {
                         for (thread = 0; thread < evlist->threads->nr; thread++)
-                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_ENABLE);
+                                ioctl(FD(pos, cpu, thread),
+                                      PERF_EVENT_IOC_ENABLE, 0);
                 }
         }
 }
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 58abb63ac13a..989bee9624c2 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -54,6 +54,8 @@ void perf_evlist__add(struct perf_evlist *evlist, struct perf_evsel *entry);
 int perf_evlist__add_default(struct perf_evlist *evlist);
 int perf_evlist__add_attrs(struct perf_evlist *evlist,
                            struct perf_event_attr *attrs, size_t nr_attrs);
+int __perf_evlist__add_default_attrs(struct perf_evlist *evlist,
+                                     struct perf_event_attr *attrs, size_t nr_attrs);
 int perf_evlist__add_tracepoints(struct perf_evlist *evlist,
                                  const char *tracepoints[], size_t nr_tracepoints);
 int perf_evlist__set_tracepoints_handlers(struct perf_evlist *evlist,
@@ -62,6 +64,8 @@ int perf_evlist__set_tracepoints_handlers(struct perf_evlist *evlist,
 
 #define perf_evlist__add_attrs_array(evlist, array) \
         perf_evlist__add_attrs(evlist, array, ARRAY_SIZE(array))
+#define perf_evlist__add_default_attrs(evlist, array) \
+        __perf_evlist__add_default_attrs(evlist, array, ARRAY_SIZE(array))
 
 #define perf_evlist__add_tracepoints_array(evlist, array) \
         perf_evlist__add_tracepoints(evlist, array, ARRAY_SIZE(array))
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 91d19138f3ec..9f6cebd798ee 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -494,16 +494,24 @@ int perf_evsel__open_per_thread(struct perf_evsel *evsel,
 }
 
 static int perf_event__parse_id_sample(const union perf_event *event, u64 type,
-                                       struct perf_sample *sample)
+                                       struct perf_sample *sample,
+                                       bool swapped)
 {
         const u64 *array = event->sample.array;
+        union u64_swap u;
 
         array += ((event->header.size -
                    sizeof(event->header)) / sizeof(u64)) - 1;
 
         if (type & PERF_SAMPLE_CPU) {
-                u32 *p = (u32 *)array;
-                sample->cpu = *p;
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                }
+
+                sample->cpu = u.val32[0];
                 array--;
         }
 
@@ -523,9 +531,16 @@ static int perf_event__parse_id_sample(const union perf_event *event, u64 type,
         }
 
         if (type & PERF_SAMPLE_TID) {
-                u32 *p = (u32 *)array;
-                sample->pid = p[0];
-                sample->tid = p[1];
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
+
+                sample->pid = u.val32[0];
+                sample->tid = u.val32[1];
         }
 
         return 0;
@@ -562,7 +577,7 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
         if (event->header.type != PERF_RECORD_SAMPLE) {
                 if (!sample_id_all)
                         return 0;
-                return perf_event__parse_id_sample(event, type, data);
+                return perf_event__parse_id_sample(event, type, data, swapped);
         }
 
         array = event->sample.array;
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 1293b5ebea4d..514e2a4b367d 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -378,7 +378,7 @@ void hist_entry__free(struct hist_entry *he)
  * collapse the histogram
  */
 
-static bool hists__collapse_insert_entry(struct hists *hists,
+static bool hists__collapse_insert_entry(struct hists *hists __used,
                                          struct rb_root *root,
                                          struct hist_entry *he)
 {
@@ -397,8 +397,9 @@ static bool hists__collapse_insert_entry(struct hists *hists,
                         iter->period += he->period;
                         iter->nr_events += he->nr_events;
                         if (symbol_conf.use_callchain) {
-                                callchain_cursor_reset(&hists->callchain_cursor);
-                                callchain_merge(&hists->callchain_cursor, iter->callchain,
+                                callchain_cursor_reset(&callchain_cursor);
+                                callchain_merge(&callchain_cursor,
+                                                iter->callchain,
                                                 he->callchain);
                         }
                         hist_entry__free(he);
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index cfc64e293f90..34bb556d6219 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -67,8 +67,6 @@ struct hists {
         struct events_stats     stats;
         u64                     event_stream;
         u16                     col_len[HISTC_NR_COLS];
-        /* Best would be to reuse the session callchain cursor */
-        struct callchain_cursor callchain_cursor;
 };
 
 struct hist_entry *__hists__add_entry(struct hists *self,
diff --git a/tools/perf/util/pager.c b/tools/perf/util/pager.c
index 1915de20dcac..3322b8446e89 100644
--- a/tools/perf/util/pager.c
+++ b/tools/perf/util/pager.c
@@ -57,6 +57,10 @@ void setup_pager(void)
         }
         if (!pager)
                 pager = getenv("PAGER");
+        if (!pager) {
+                if (!access("/usr/bin/pager", X_OK))
+                        pager = "/usr/bin/pager";
+        }
         if (!pager)
                 pager = "less";
         else if (!*pager || !strcmp(pager, "cat"))
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 59dccc98b554..0dda25d82d06 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -2164,16 +2164,12 @@ int del_perf_probe_events(struct strlist *dellist)
 
 error:
         if (kfd >= 0) {
-                if (namelist)
-                        strlist__delete(namelist);
-
+                strlist__delete(namelist);
                 close(kfd);
         }
 
         if (ufd >= 0) {
-                if (unamelist)
-                        strlist__delete(unamelist);
-
+                strlist__delete(unamelist);
                 close(ufd);
         }
 
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 93d355d27109..2600916efa83 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -288,7 +288,8 @@ struct branch_info *machine__resolve_bstack(struct machine *self,
         return bi;
 }
 
-int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
+int machine__resolve_callchain(struct machine *self,
+                               struct perf_evsel *evsel __used,
                                struct thread *thread,
                                struct ip_callchain *chain,
                                struct symbol **parent)
@@ -297,7 +298,12 @@ int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
         unsigned int i;
         int err;
 
-        callchain_cursor_reset(&evsel->hists.callchain_cursor);
+        callchain_cursor_reset(&callchain_cursor);
+
+        if (chain->nr > PERF_MAX_STACK_DEPTH) {
+                pr_warning("corrupted callchain. skipping...\n");
+                return 0;
+        }
 
         for (i = 0; i < chain->nr; i++) {
                 u64 ip;
@@ -317,7 +323,14 @@ int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
                         case PERF_CONTEXT_USER:
                                 cpumode = PERF_RECORD_MISC_USER;        break;
                         default:
-                                break;
+                                pr_debug("invalid callchain context: "
+                                         "%"PRId64"\n", (s64) ip);
+                                /*
+                                 * It seems the callchain is corrupted.
+                                 * Discard all.
+                                 */
+                                callchain_cursor_reset(&callchain_cursor);
+                                return 0;
                         }
                         continue;
                 }
@@ -333,7 +346,7 @@ int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
                                 break;
                 }
 
-                err = callchain_cursor_append(&evsel->hists.callchain_cursor,
+                err = callchain_cursor_append(&callchain_cursor,
                                               ip, al.map, al.sym);
                 if (err)
                         return err;
@@ -441,37 +454,65 @@ void mem_bswap_64(void *src, int byte_size)
         }
 }
 
-static void perf_event__all64_swap(union perf_event *event)
+static void swap_sample_id_all(union perf_event *event, void *data)
+{
+        void *end = (void *) event + event->header.size;
+        int size = end - data;
+
+        BUG_ON(size % sizeof(u64));
+        mem_bswap_64(data, size);
+}
+
+static void perf_event__all64_swap(union perf_event *event,
+                                   bool sample_id_all __used)
 {
         struct perf_event_header *hdr = &event->header;
         mem_bswap_64(hdr + 1, event->header.size - sizeof(*hdr));
 }
 
-static void perf_event__comm_swap(union perf_event *event)
+static void perf_event__comm_swap(union perf_event *event, bool sample_id_all)
 {
         event->comm.pid = bswap_32(event->comm.pid);
         event->comm.tid = bswap_32(event->comm.tid);
+
+        if (sample_id_all) {
+                void *data = &event->comm.comm;
+
+                data += ALIGN(strlen(data) + 1, sizeof(u64));
+                swap_sample_id_all(event, data);
+        }
 }
 
-static void perf_event__mmap_swap(union perf_event *event)
+static void perf_event__mmap_swap(union perf_event *event,
+                                  bool sample_id_all)
 {
         event->mmap.pid   = bswap_32(event->mmap.pid);
         event->mmap.tid   = bswap_32(event->mmap.tid);
         event->mmap.start = bswap_64(event->mmap.start);
         event->mmap.len   = bswap_64(event->mmap.len);
         event->mmap.pgoff = bswap_64(event->mmap.pgoff);
+
+        if (sample_id_all) {
+                void *data = &event->mmap.filename;
+
+                data += ALIGN(strlen(data) + 1, sizeof(u64));
+                swap_sample_id_all(event, data);
+        }
 }
 
-static void perf_event__task_swap(union perf_event *event)
+static void perf_event__task_swap(union perf_event *event, bool sample_id_all)
 {
         event->fork.pid  = bswap_32(event->fork.pid);
         event->fork.tid  = bswap_32(event->fork.tid);
         event->fork.ppid = bswap_32(event->fork.ppid);
         event->fork.ptid = bswap_32(event->fork.ptid);
         event->fork.time = bswap_64(event->fork.time);
+
+        if (sample_id_all)
+                swap_sample_id_all(event, &event->fork + 1);
 }
 
-static void perf_event__read_swap(union perf_event *event)
+static void perf_event__read_swap(union perf_event *event, bool sample_id_all)
 {
         event->read.pid          = bswap_32(event->read.pid);
         event->read.tid          = bswap_32(event->read.tid);
@@ -479,6 +520,9 @@ static void perf_event__read_swap(union perf_event *event)
         event->read.time_enabled = bswap_64(event->read.time_enabled);
         event->read.time_running = bswap_64(event->read.time_running);
         event->read.id           = bswap_64(event->read.id);
+
+        if (sample_id_all)
+                swap_sample_id_all(event, &event->read + 1);
 }
 
 static u8 revbyte(u8 b)
@@ -530,7 +574,8 @@ void perf_event__attr_swap(struct perf_event_attr *attr)
         swap_bitfield((u8 *) (&attr->read_format + 1), sizeof(u64));
 }
 
-static void perf_event__hdr_attr_swap(union perf_event *event)
+static void perf_event__hdr_attr_swap(union perf_event *event,
+                                      bool sample_id_all __used)
 {
         size_t size;
 
@@ -541,18 +586,21 @@ static void perf_event__hdr_attr_swap(union perf_event *event)
         mem_bswap_64(event->attr.id, size);
 }
 
-static void perf_event__event_type_swap(union perf_event *event)
+static void perf_event__event_type_swap(union perf_event *event,
+                                        bool sample_id_all __used)
 {
         event->event_type.event_type.event_id =
                 bswap_64(event->event_type.event_type.event_id);
 }
 
-static void perf_event__tracing_data_swap(union perf_event *event)
+static void perf_event__tracing_data_swap(union perf_event *event,
+                                          bool sample_id_all __used)
 {
         event->tracing_data.size = bswap_32(event->tracing_data.size);
 }
 
-typedef void (*perf_event__swap_op)(union perf_event *event);
+typedef void (*perf_event__swap_op)(union perf_event *event,
+                                    bool sample_id_all);
 
 static perf_event__swap_op perf_event__swap_ops[] = {
         [PERF_RECORD_MMAP]                = perf_event__mmap_swap,
@@ -986,6 +1034,15 @@ static int perf_session__process_user_event(struct perf_session *session, union
         }
 }
 
+static void event_swap(union perf_event *event, bool sample_id_all)
+{
+        perf_event__swap_op swap;
+
+        swap = perf_event__swap_ops[event->header.type];
+        if (swap)
+                swap(event, sample_id_all);
+}
+
 static int perf_session__process_event(struct perf_session *session,
                                        union perf_event *event,
                                        struct perf_tool *tool,
@@ -994,9 +1051,8 @@ static int perf_session__process_event(struct perf_session *session,
         struct perf_sample sample;
         int ret;
 
-        if (session->header.needs_swap &&
-            perf_event__swap_ops[event->header.type])
-                perf_event__swap_ops[event->header.type](event);
+        if (session->header.needs_swap)
+                event_swap(event, session->sample_id_all);
 
         if (event->header.type >= PERF_RECORD_HEADER_MAX)
                 return -EINVAL;
@@ -1428,7 +1484,6 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                           int print_sym, int print_dso, int print_symoffset)
 {
         struct addr_location al;
-        struct callchain_cursor *cursor = &evsel->hists.callchain_cursor;
         struct callchain_cursor_node *node;
 
         if (perf_event__preprocess_sample(event, machine, &al, sample,
@@ -1446,10 +1501,10 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                                 error("Failed to resolve callchain. Skipping\n");
                         return;
                 }
-                callchain_cursor_commit(cursor);
+                callchain_cursor_commit(&callchain_cursor);
 
                 while (1) {
-                        node = callchain_cursor_current(cursor);
+                        node = callchain_cursor_current(&callchain_cursor);
                         if (!node)
                                 break;
 
@@ -1460,12 +1515,12 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                         }
                         if (print_dso) {
                                 printf(" (");
-                                map__fprintf_dsoname(al.map, stdout);
+                                map__fprintf_dsoname(node->map, stdout);
                                 printf(")");
                         }
                         printf("\n");
 
-                        callchain_cursor_advance(cursor);
+                        callchain_cursor_advance(&callchain_cursor);
                 }
 
         } else {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index e2ba8858f3e1..3e2e5ea0f03f 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -323,6 +323,7 @@ struct dso *dso__new(const char *name)
                 dso->sorted_by_name = 0;
                 dso->has_build_id = 0;
                 dso->kernel = DSO_TYPE_USER;
+                dso->needs_swap = DSO_SWAP__UNSET;
                 INIT_LIST_HEAD(&dso->node);
         }
 
@@ -1156,6 +1157,33 @@ static size_t elf_addr_to_index(Elf *elf, GElf_Addr addr)
         return -1;
 }
 
+static int dso__swap_init(struct dso *dso, unsigned char eidata)
+{
+        static unsigned int const endian = 1;
+
+        dso->needs_swap = DSO_SWAP__NO;
+
+        switch (eidata) {
+        case ELFDATA2LSB:
+                /* We are big endian, DSO is little endian. */
+                if (*(unsigned char const *)&endian != 1)
+                        dso->needs_swap = DSO_SWAP__YES;
+                break;
+
+        case ELFDATA2MSB:
+                /* We are little endian, DSO is big endian. */
+                if (*(unsigned char const *)&endian != 0)
+                        dso->needs_swap = DSO_SWAP__YES;
+                break;
+
+        default:
+                pr_err("unrecognized DSO data encoding %d\n", eidata);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
                          int fd, symbol_filter_t filter, int kmodule,
                          int want_symtab)
@@ -1187,6 +1215,9 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
                 goto out_elf_end;
         }
 
+        if (dso__swap_init(dso, ehdr.e_ident[EI_DATA]))
+                goto out_elf_end;
+
         /* Always reject images with a mismatched build-id: */
         if (dso->has_build_id) {
                 u8 build_id[BUILD_ID_SIZE];
@@ -1272,7 +1303,7 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
                 if (opdsec && sym.st_shndx == opdidx) {
                         u32 offset = sym.st_value - opdshdr.sh_addr;
                         u64 *opd = opddata->d_buf + offset;
-                        sym.st_value = *opd;
+                        sym.st_value = DSO__SWAP(dso, u64, *opd);
                         sym.st_shndx = elf_addr_to_index(elf, sym.st_value);
                 }
 
@@ -2786,8 +2817,11 @@ int machine__load_vmlinux_path(struct machine *machine, enum map_type type,
 
 struct map *dso__new_map(const char *name)
 {
+        struct map *map = NULL;
         struct dso *dso = dso__new(name);
-        struct map *map = map__new2(0, dso, MAP__FUNCTION);
+
+        if (dso)
+                map = map__new2(0, dso, MAP__FUNCTION);
 
         return map;
 }
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 5649d63798cb..af0752b1aca1 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -9,6 +9,7 @@
 #include <linux/list.h>
 #include <linux/rbtree.h>
 #include <stdio.h>
+#include <byteswap.h>
 
 #ifdef HAVE_CPLUS_DEMANGLE
 extern char *cplus_demangle(const char *, int);
@@ -160,11 +161,18 @@ enum dso_kernel_type {
         DSO_TYPE_GUEST_KERNEL
 };
 
+enum dso_swap_type {
+        DSO_SWAP__UNSET,
+        DSO_SWAP__NO,
+        DSO_SWAP__YES,
+};
+
 struct dso {
         struct list_head node;
         struct rb_root   symbols[MAP__NR_TYPES];
         struct rb_root   symbol_names[MAP__NR_TYPES];
         enum dso_kernel_type    kernel;
+        enum dso_swap_type      needs_swap;
         u8               adjust_symbols:1;
         u8               has_build_id:1;
         u8               hit:1;
@@ -182,6 +190,28 @@ struct dso {
         char             name[0];
 };
 
+#define DSO__SWAP(dso, type, val)                       \
+({                                                      \
+        type ____r = val;                               \
+        BUG_ON(dso->needs_swap == DSO_SWAP__UNSET);     \
+        if (dso->needs_swap == DSO_SWAP__YES) {         \
+                switch (sizeof(____r)) {                \
+                case 2:                                 \
+                        ____r = bswap_16(val);          \
+                        break;                          \
+                case 4:                                 \
+                        ____r = bswap_32(val);          \
+                        break;                          \
+                case 8:                                 \
+                        ____r = bswap_64(val);          \
+                        break;                          \
+                default:                                \
+                        BUG_ON(1);                      \
+                }                                       \
+        }                                               \
+        ____r;                                          \
+})
+
 struct dso *dso__new(const char *name);
 void dso__delete(struct dso *dso);
 
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index ab2f682fd44c..16de7ad4850f 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -73,8 +73,8 @@ int backwards_count;
 char *progname;
 
 int num_cpus;
-cpu_set_t *cpu_mask;
-size_t cpu_mask_size;
+cpu_set_t *cpu_present_set, *cpu_mask;
+size_t cpu_present_setsize, cpu_mask_size;
 
 struct counters {
         unsigned long long tsc;         /* per thread */
@@ -103,6 +103,12 @@ struct timeval tv_even;
 struct timeval tv_odd;
 struct timeval tv_delta;
 
+int mark_cpu_present(int pkg, int core, int cpu)
+{
+        CPU_SET_S(cpu, cpu_present_setsize, cpu_present_set);
+        return 0;
+}
+
 /*
  * cpu_mask_init(ncpus)
  *
@@ -118,6 +124,18 @@ void cpu_mask_init(int ncpus)
         }
         cpu_mask_size = CPU_ALLOC_SIZE(ncpus);
         CPU_ZERO_S(cpu_mask_size, cpu_mask);
+
+        /*
+         * Allocate and initialize cpu_present_set
+         */
+        cpu_present_set = CPU_ALLOC(ncpus);
+        if (cpu_present_set == NULL) {
+                perror("CPU_ALLOC");
+                exit(3);
+        }
+        cpu_present_setsize = CPU_ALLOC_SIZE(ncpus);
+        CPU_ZERO_S(cpu_present_setsize, cpu_present_set);
+        for_all_cpus(mark_cpu_present);
 }
 
 void cpu_mask_uninit()
@@ -125,6 +143,9 @@ void cpu_mask_uninit()
         CPU_FREE(cpu_mask);
         cpu_mask = NULL;
         cpu_mask_size = 0;
+        CPU_FREE(cpu_present_set);
+        cpu_present_set = NULL;
+        cpu_present_setsize = 0;
 }
 
 int cpu_migrate(int cpu)
@@ -912,6 +933,8 @@ int is_snb(unsigned int family, unsigned int model)
         switch (model) {
         case 0x2A:
         case 0x2D:
+        case 0x3A:      /* IVB */
+        case 0x3D:      /* IVB Xeon */
                 return 1;
         }
         return 0;
@@ -1047,6 +1070,9 @@ int fork_it(char **argv)
         int retval;
         pid_t child_pid;
         get_counters(cnt_even);
+
+        /* clear affinity side-effect of get_counters() */
+        sched_setaffinity(0, cpu_present_setsize, cpu_present_set);
         gettimeofday(&tv_even, (struct timezone *)NULL);
 
         child_pid = fork();
diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
index a6a0365475ed..5afb43114020 100644
--- a/virt/kvm/irq_comm.c
+++ b/virt/kvm/irq_comm.c
@@ -332,6 +332,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
          */
         hlist_for_each_entry(ei, n, &rt->map[ue->gsi], link)
                 if (ei->type == KVM_IRQ_ROUTING_MSI ||
+                    ue->type == KVM_IRQ_ROUTING_MSI ||
                     ue->u.irqchip.irqchip == ei->irqchip.irqchip)
                         return r;