173 files changed, 1563 insertions, 906 deletions
diff --git a/Documentation/DocBook/networking.tmpl b/Documentation/DocBook/networking.tmpl
index 59ad69a9d777..29df25016c7c 100644
--- a/Documentation/DocBook/networking.tmpl
+++ b/Documentation/DocBook/networking.tmpl
@@ -56,7 +56,7 @@
 !Enet/core/filter.c
     </sect1>
     <sect1><title>Generic Network Statistics</title>
-!Iinclude/linux/gen_stats.h
+!Iinclude/uapi/linux/gen_stats.h
 !Enet/core/gen_stats.c
 !Enet/core/gen_estimator.c
     </sect1>
@@ -80,7 +80,7 @@
 !Enet/wimax/op-rfkill.c
 !Enet/wimax/stack.c
 !Iinclude/net/wimax.h
-!Iinclude/linux/wimax.h
+!Iinclude/uapi/linux/wimax.h
     </sect1>
  </chapter>
diff --git a/Documentation/IPMI.txt b/Documentation/IPMI.txt
index b2bea15137d2..16eb4c9e9233 100644
--- a/Documentation/IPMI.txt
+++ b/Documentation/IPMI.txt
@@ -42,13 +42,7 @@ The driver interface depends on your hardware.  If your system
 properly provides the SMBIOS info for IPMI, the driver will detect it
 and just work.  If you have a board with a standard interface (These
 will generally be either "KCS", "SMIC", or "BT", consult your hardware
-manual), choose the 'IPMI SI handler' option.  A driver also exists
+manual), choose the 'IPMI SI handler' option.
-for direct I2C access to the IPMI management controller.  Some boards
-support this, but it is unknown if it will work on every board.  For
-this, choose 'IPMI SMBus handler', but be ready to try to do some
-figuring to see if it will work on your system if the SMBIOS/APCI
-information is wrong or not present.  It is fairly safe to have both
-these enabled and let the drivers auto-detect what is present.
 You should generally enable ACPI on your system, as systems with IPMI
 can have ACPI tables describing them.
@@ -58,8 +52,7 @@ their job correctly, the IPMI controller should be automatically
 detected (via ACPI or SMBIOS tables) and should just work.  Sadly,
 many boards do not have this information.  The driver attempts
 standard defaults, but they may not work.  If you fall into this
-situation, you need to read the section below named 'The SI Driver' or
+situation, you need to read the section below named 'The SI Driver'.
-"The SMBus Driver" on how to hand-configure your system.
 IPMI defines a standard watchdog timer.  You can enable this with the
 'IPMI Watchdog Timer' config option.  If you compile the driver into
@@ -104,12 +97,7 @@ driver, each open file for this device ties in to the message handler
 as an IPMI user.
 ipmi_si - A driver for various system interfaces.  This supports KCS,
-SMIC, and BT interfaces.  Unless you have an SMBus interface or your
+SMIC, and BT interfaces.
-own custom interface, you probably need to use this.
-ipmi_smb - A driver for accessing BMCs on the SMBus. It uses the
-I2C kernel driver's SMBus interfaces to send and receive IPMI messages
-over the SMBus.
 ipmi_watchdog - IPMI requires systems to have a very capable watchdog
 timer.  This driver implements the standard Linux watchdog timer
@@ -482,53 +470,6 @@ for specifying an interface.  Note that when removing an interface,
 only the first three parameters (si type, address type, and address)
 are used for the comparison.  Any options are ignored for removing.
-The SMBus Driver
----------------
-The SMBus driver allows up to 4 SMBus devices to be configured in the
-system.  By default, the driver will register any SMBus interfaces it finds
-in the I2C address range of 0x20 to 0x4f on any adapter.  You can change this
-at module load time (for a module) with:
-  modprobe ipmi_smb.o
-        addr=<adapter1>,<i2caddr1>[,<adapter2>,<i2caddr2>[,...]]
-        dbg=<flags1>,<flags2>...
-        [defaultprobe=1] [dbg_probe=1]
-The addresses are specified in pairs, the first is the adapter ID and the
-second is the I2C address on that adapter.
-The debug flags are bit flags for each BMC found, they are:
-IPMI messages: 1, driver state: 2, timing: 4, I2C probe: 8
-Setting smb_defaultprobe to zero disabled the default probing of SMBus
-interfaces at address range 0x20 to 0x4f.  This means that only the
-BMCs specified on the smb_addr line will be detected.
-Setting smb_dbg_probe to 1 will enable debugging of the probing and
-detection process for BMCs on the SMBusses.
-Discovering the IPMI compliant BMC on the SMBus can cause devices
-on the I2C bus to fail. The SMBus driver writes a "Get Device ID" IPMI
-message as a block write to the I2C bus and waits for a response.
-This action can be detrimental to some I2C devices. It is highly recommended
-that the known I2c address be given to the SMBus driver in the smb_addr
-parameter. The default address range will not be used when a smb_addr
-parameter is provided.
-When compiled into the kernel, the addresses can be specified on the
-kernel command line as:
-  ipmb_smb.addr=<adapter1>,<i2caddr1>[,<adapter2>,<i2caddr2>[,...]]
-        ipmi_smb.dbg=<flags1>,<flags2>...
-        ipmi_smb.defaultprobe=0 ipmi_smb.dbg_probe=1
-These are the same options as on the module command line.
-Note that you might need some I2C changes if CONFIG_IPMI_PANIC_EVENT
-is enabled along with this, so the I2C driver knows to run to
-completion during sending a panic event.
 Other Pieces
 ------------
diff --git a/Documentation/sysrq.txt b/Documentation/sysrq.txt
index 642f84495b29..2a4cdda4828e 100644
--- a/Documentation/sysrq.txt
+++ b/Documentation/sysrq.txt
@@ -116,6 +116,7 @@ On all -  write a character to /proc/sysrq-trigger.  e.g.:
 'w'     - Dumps tasks that are in uninterruptable (blocked) state.
 'x'     - Used by xmon interface on ppc/powerpc platforms.
+          Show global PMU Registers on sparc64.
 'y'     - Show global CPU Registers [SPARC-64 specific]
diff --git a/MAINTAINERS b/MAINTAINERS
index e73060fe0788..41c53491db60 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4372,7 +4372,7 @@ F:	Documentation/scsi/53c700.txt
 F:      drivers/scsi/53c700*
 LED SUBSYSTEM
-M:      Bryan Wu <bryan.wu@canonical.com>
+M:      Bryan Wu <cooloney@gmail.com>
 M:      Richard Purdie <rpurdie@rpsys.net>
 L:      linux-leds@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds.git
@@ -5019,6 +5019,20 @@ F:	net/ipv6/
 F:      include/net/ip*
 F:      arch/x86/net/*
+NETWORKING [IPSEC]
+M:      Steffen Klassert <steffen.klassert@secunet.com>
+M:      Herbert Xu <herbert@gondor.apana.org.au>
+M:      "David S. Miller" <davem@davemloft.net>
+L:      netdev@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+S:      Maintained
+F:      net/xfrm/
+F:      net/key/
+F:      net/ipv4/xfrm*
+F:      net/ipv6/xfrm*
+F:      include/uapi/linux/xfrm.h
+F:      include/net/xfrm.h
 NETWORKING [LABELED] (NetLabel, CIPSO, Labeled IPsec, SECMARK)
 M:      Paul Moore <paul@paul-moore.com>
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index 5be2ee8c90e4..366d0ab0c5fe 100644
--- a/Makefile
+++ b/Makefile
@@ -437,7 +437,9 @@ endif
 PHONY += asm-generic
 asm-generic:
        $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \
-                    obj=arch/$(SRCARCH)/include/generated/asm
+                    src=asm obj=arch/$(SRCARCH)/include/generated/asm
+        $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \
+                    src=uapi/asm obj=arch/$(SRCARCH)/include/generated/uapi/asm
 # To make sure we do not include .config for any of the *config targets
 # catch them early, and hand them over to scripts/kconfig/Makefile
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 417bac1846bd..34711757ba59 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -88,9 +88,9 @@ ENTRY(ret_from_fork)
        bl      schedule_tail
        cmp     r5, #0
        movne   r0, r4
-        movne   lr, pc
+        adrne   lr, BSYM(1f)
        movne   pc, r5
-        get_thread_info tsk
+1:      get_thread_info tsk
        b       ret_slow_syscall
 ENDPROC(ret_from_fork)
diff --git a/arch/arm/mach-prima2/include/mach/gpio.h b/arch/arm/mach-prima2/include/mach/gpio.h
deleted file mode 100644
index 1904bb03876e..000000000000
--- a/arch/arm/mach-prima2/include/mach/gpio.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#ifndef __MACH_GPIO_H
-#define __MACH_GPIO_H
-/* Pull up/down values */
-enum sirfsoc_gpio_pull {
-        SIRFSOC_GPIO_PULL_NONE,
-        SIRFSOC_GPIO_PULL_UP,
-        SIRFSOC_GPIO_PULL_DOWN,
-};
-void sirfsoc_gpio_set_pull(unsigned gpio, unsigned mode);
-#endif
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index 002732960315..ee0beb354e4d 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -867,8 +867,8 @@ ret_from_fork:
 ret_from_kernel_thread:
        lddi.p          @(gr28,#REG_GR(8)),gr20
        call            schedule_tail
-        or.p            gr20,gr20,gr8
+        calll.p         @(gr21,gr0)
-        calll           @(gr21,gr0)
+        or              gr20,gr20,gr8
        bra             sys_exit
        .globl          ret_from_kernel_execve
diff --git a/arch/frv/kernel/process.c b/arch/frv/kernel/process.c
index 655d90d20bb0..e1e3aa196aa4 100644
--- a/arch/frv/kernel/process.c
+++ b/arch/frv/kernel/process.c
@@ -194,7 +194,7 @@ int copy_thread(unsigned long clone_flags,
                memset(childregs, 0, sizeof(struct pt_regs));
                childregs->gr9 = usp; /* function */
                childregs->gr8 = arg;
-                chilregs->psr = PSR_S;
+                childregs->psr = PSR_S;
                p->thread.pc = (unsigned long) ret_from_kernel_thread;
                save_user_regs(p->thread.user);
                return 0;
diff --git a/arch/frv/kernel/setup.c b/arch/frv/kernel/setup.c
index 1f1e5efb3385..b8993c87d3de 100644
--- a/arch/frv/kernel/setup.c
+++ b/arch/frv/kernel/setup.c
@@ -112,9 +112,11 @@ char __initdata redboot_command_line[COMMAND_LINE_SIZE];
 #ifdef CONFIG_PM
 #define __pminit
 #define __pminitdata
+#define __pminitconst
 #else
 #define __pminit __init
 #define __pminitdata __initdata
+#define __pminitconst __initconst
 #endif
 struct clock_cmode {
diff --git a/arch/ia64/include/uapi/asm/Kbuild b/arch/ia64/include/uapi/asm/Kbuild
index 30cafac93703..1b3f5eb5fcdb 100644
--- a/arch/ia64/include/uapi/asm/Kbuild
+++ b/arch/ia64/include/uapi/asm/Kbuild
@@ -1,6 +1,8 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+generic-y += kvm_para.h
 header-y += auxvec.h
 header-y += bitsperlong.h
 header-y += break.h
diff --git a/arch/ia64/include/uapi/asm/kvm_para.h b/arch/ia64/include/uapi/asm/kvm_para.h
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/arch/ia64/include/uapi/asm/kvm_para.h
+++ /dev/null
diff --git a/arch/mips/include/asm/Kbuild b/arch/mips/include/asm/Kbuild
index e69de29bb2d1..533053d12ced 100644
--- a/arch/mips/include/asm/Kbuild
+++ b/arch/mips/include/asm/Kbuild
@@ -0,0 +1 @@
+# MIPS headers
diff --git a/arch/mn10300/include/uapi/asm/setup.h b/arch/mn10300/include/uapi/asm/setup.h
index e69de29bb2d1..ae5704fa77ad 100644
--- a/arch/mn10300/include/uapi/asm/setup.h
+++ b/arch/mn10300/include/uapi/asm/setup.h
@@ -0,0 +1,4 @@
+/*
+ * There isn't anything here anymore, but the file must not be empty or patch
+ * will delete it.
+ */
diff --git a/arch/s390/include/uapi/asm/Kbuild b/arch/s390/include/uapi/asm/Kbuild
index 7bf68fff7c5d..59b67ed423b4 100644
--- a/arch/s390/include/uapi/asm/Kbuild
+++ b/arch/s390/include/uapi/asm/Kbuild
@@ -1,6 +1,8 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+generic-y += kvm_para.h
 header-y += auxvec.h
 header-y += bitsperlong.h
 header-y += byteorder.h
diff --git a/arch/s390/include/uapi/asm/kvm_para.h b/arch/s390/include/uapi/asm/kvm_para.h
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/arch/s390/include/uapi/asm/kvm_para.h
+++ /dev/null
diff --git a/arch/sh/include/asm/Kbuild b/arch/sh/include/asm/Kbuild
index 86eadceff097..29f83beeef7a 100644
--- a/arch/sh/include/asm/Kbuild
+++ b/arch/sh/include/asm/Kbuild
@@ -1,4 +1,3 @@
-include include/asm-generic/Kbuild.asm
 generic-y += bitsperlong.h
 generic-y += cputime.h
@@ -34,13 +33,3 @@ generic-y += termbits.h
 generic-y += termios.h
 generic-y += ucontext.h
 generic-y += xor.h
-header-y += cachectl.h
-header-y += cpu-features.h
-header-y += hw_breakpoint.h
-header-y += posix_types_32.h
-header-y += posix_types_64.h
-header-y += ptrace_32.h
-header-y += ptrace_64.h
-header-y += unistd_32.h
-header-y += unistd_64.h
diff --git a/arch/sh/include/asm/hw_breakpoint.h b/arch/sh/include/asm/hw_breakpoint.h
index 89890f61a7b9..ec9ad593c3da 100644
--- a/arch/sh/include/asm/hw_breakpoint.h
+++ b/arch/sh/include/asm/hw_breakpoint.h
@@ -1,7 +1,8 @@
 #ifndef __ASM_SH_HW_BREAKPOINT_H
 #define __ASM_SH_HW_BREAKPOINT_H
-#ifdef __KERNEL__
+#include <uapi/asm/hw_breakpoint.h>
 #define __ARCH_HW_BREAKPOINT_H
 #include <linux/kdebug.h>
@@ -66,5 +67,4 @@ extern int register_sh_ubc(struct sh_ubc *);
 extern struct pmu perf_ops_bp;
-#endif /* __KERNEL__ */
 #endif /* __ASM_SH_HW_BREAKPOINT_H */
diff --git a/arch/sh/include/asm/posix_types.h b/arch/sh/include/asm/posix_types.h
index f08449bcbde7..1aa781079b1e 100644
--- a/arch/sh/include/asm/posix_types.h
+++ b/arch/sh/include/asm/posix_types.h
@@ -1,13 +1,5 @@
-#ifdef __KERNEL__
 # ifdef CONFIG_SUPERH32
 #  include <asm/posix_types_32.h>
 # else
 #  include <asm/posix_types_64.h>
 # endif
-#else
-# ifdef __SH5__
-#  include <asm/posix_types_64.h>
-# else
-#  include <asm/posix_types_32.h>
-# endif
-#endif /* __KERNEL__ */
diff --git a/arch/sh/include/asm/ptrace.h b/arch/sh/include/asm/ptrace.h
index a4a38dff997a..2506c7db76b7 100644
--- a/arch/sh/include/asm/ptrace.h
+++ b/arch/sh/include/asm/ptrace.h
@@ -1,42 +1,16 @@
-#ifndef __ASM_SH_PTRACE_H
-#define __ASM_SH_PTRACE_H
 /*
 * Copyright (C) 1999, 2000  Niibe Yutaka
 */
+#ifndef __ASM_SH_PTRACE_H
+#define __ASM_SH_PTRACE_H
-#define PTRACE_GETREGS          12      /* General registers */
-#define PTRACE_SETREGS          13
-#define PTRACE_GETFPREGS        14      /* FPU registers */
-#define PTRACE_SETFPREGS        15
-#define PTRACE_GETFDPIC         31      /* get the ELF fdpic loadmap address */
-#define PTRACE_GETFDPIC_EXEC    0       /* [addr] request the executable loadmap */
-#define PTRACE_GETFDPIC_INTERP  1       /* [addr] request the interpreter loadmap */
-#define PTRACE_GETDSPREGS       55      /* DSP registers */
-#define PTRACE_SETDSPREGS       56
-#define PT_TEXT_END_ADDR        240
-#define PT_TEXT_ADDR            244     /* &(struct user)->start_code */
-#define PT_DATA_ADDR            248     /* &(struct user)->start_data */
-#define PT_TEXT_LEN             252
-#if defined(__SH5__) || defined(CONFIG_CPU_SH5)
-#include <asm/ptrace_64.h>
-#else
-#include <asm/ptrace_32.h>
-#endif
-#ifdef __KERNEL__
 #include <linux/stringify.h>
 #include <linux/stddef.h>
 #include <linux/thread_info.h>
 #include <asm/addrspace.h>
 #include <asm/page.h>
+#include <uapi/asm/ptrace.h>
 #define user_mode(regs)                 (((regs)->sr & 0x40000000)==0)
 #define kernel_stack_pointer(_regs)     ((unsigned long)(_regs)->regs[15])
@@ -140,6 +114,4 @@ static inline unsigned long profile_pc(struct pt_regs *regs)
 #define profile_pc profile_pc
 #include <asm-generic/ptrace.h>
-#endif /* __KERNEL__ */
 #endif /* __ASM_SH_PTRACE_H */
diff --git a/arch/sh/include/asm/ptrace_32.h b/arch/sh/include/asm/ptrace_32.h
index 2d3e906aa722..1dd4480c5363 100644
--- a/arch/sh/include/asm/ptrace_32.h
+++ b/arch/sh/include/asm/ptrace_32.h
@@ -1,79 +1,8 @@
 #ifndef __ASM_SH_PTRACE_32_H
 #define __ASM_SH_PTRACE_32_H
-/*
+#include <uapi/asm/ptrace_32.h>
- * GCC defines register number like this:
- * -----------------------------
- *       0 - 15 are integer registers
- *      17 - 22 are control/special registers
- *      24 - 39 fp registers
- *      40 - 47 xd registers
- *      48 -    fpscr register
- * -----------------------------
- *
- * We follows above, except:
- *      16 --- program counter (PC)
- *      22 --- syscall #
- *      23 --- floating point communication register
- */
-#define REG_REG0         0
-#define REG_REG15       15
-#define REG_PC          16
-#define REG_PR          17
-#define REG_SR          18
-#define REG_GBR         19
-#define REG_MACH        20
-#define REG_MACL        21
-#define REG_SYSCALL     22
-#define REG_FPREG0      23
-#define REG_FPREG15     38
-#define REG_XFREG0      39
-#define REG_XFREG15     54
-#define REG_FPSCR       55
-#define REG_FPUL        56
-/*
- * This struct defines the way the registers are stored on the
- * kernel stack during a system call or other kernel entry.
- */
-struct pt_regs {
-        unsigned long regs[16];
-        unsigned long pc;
-        unsigned long pr;
-        unsigned long sr;
-        unsigned long gbr;
-        unsigned long mach;
-        unsigned long macl;
-        long tra;
-};
-/*
- * This struct defines the way the DSP registers are stored on the
- * kernel stack during a system call or other kernel entry.
- */
-struct pt_dspregs {
-        unsigned long   a1;
-        unsigned long   a0g;
-        unsigned long   a1g;
-        unsigned long   m0;
-        unsigned long   m1;
-        unsigned long   a0;
-        unsigned long   x0;
-        unsigned long   x1;
-        unsigned long   y0;
-        unsigned long   y1;
-        unsigned long   dsr;
-        unsigned long   rs;
-        unsigned long   re;
-        unsigned long   mod;
-};
-#ifdef __KERNEL__
 #define MAX_REG_OFFSET          offsetof(struct pt_regs, tra)
 static inline long regs_return_value(struct pt_regs *regs)
@@ -81,6 +10,4 @@ static inline long regs_return_value(struct pt_regs *regs)
        return regs->regs[0];
 }
-#endif /* __KERNEL__ */
 #endif /* __ASM_SH_PTRACE_32_H */
diff --git a/arch/sh/include/asm/ptrace_64.h b/arch/sh/include/asm/ptrace_64.h
index eb3fcceaf64b..97f4b5660f2c 100644
--- a/arch/sh/include/asm/ptrace_64.h
+++ b/arch/sh/include/asm/ptrace_64.h
@@ -1,16 +1,8 @@
 #ifndef __ASM_SH_PTRACE_64_H
 #define __ASM_SH_PTRACE_64_H
-struct pt_regs {
+#include <uapi/asm/ptrace_64.h>
-        unsigned long long pc;
-        unsigned long long sr;
-        long long syscall_nr;
-        unsigned long long regs[63];
-        unsigned long long tregs[8];
-        unsigned long long pad[2];
-};
-#ifdef __KERNEL__
 #define MAX_REG_OFFSET          offsetof(struct pt_regs, tregs[7])
 static inline long regs_return_value(struct pt_regs *regs)
@@ -18,6 +10,4 @@ static inline long regs_return_value(struct pt_regs *regs)
        return regs->regs[3];
 }
-#endif /* __KERNEL__ */
 #endif /* __ASM_SH_PTRACE_64_H */
diff --git a/arch/sh/include/asm/setup.h b/arch/sh/include/asm/setup.h
index 465a22df8fd0..99238108e7a5 100644
--- a/arch/sh/include/asm/setup.h
+++ b/arch/sh/include/asm/setup.h
@@ -1,9 +1,8 @@
 #ifndef _SH_SETUP_H
 #define _SH_SETUP_H
-#include <asm-generic/setup.h>
+#include <uapi/asm/setup.h>
-#ifdef __KERNEL__
 /*
 * This is set up by the setup-routine at boot-time
 */
@@ -22,6 +21,4 @@ void sh_mv_setup(void);
 void check_for_initrd(void);
 void per_cpu_trap_init(void);
-#endif /* __KERNEL__ */
 #endif /* _SH_SETUP_H */
diff --git a/arch/sh/include/asm/types.h b/arch/sh/include/asm/types.h
index f8421f7ad63a..6a31053fa5e3 100644
--- a/arch/sh/include/asm/types.h
+++ b/arch/sh/include/asm/types.h
@@ -1,12 +1,11 @@
 #ifndef __ASM_SH_TYPES_H
 #define __ASM_SH_TYPES_H
-#include <asm-generic/types.h>
+#include <uapi/asm/types.h>
 /*
 * These aren't exported outside the kernel to avoid name space clashes
 */
-#ifdef __KERNEL__
 #ifndef __ASSEMBLY__
 #ifdef CONFIG_SUPERH32
@@ -18,6 +17,4 @@ typedef u64 reg_size_t;
 #endif
 #endif /* __ASSEMBLY__ */
-#endif /* __KERNEL__ */
 #endif /* __ASM_SH_TYPES_H */
diff --git a/arch/sh/include/asm/unistd.h b/arch/sh/include/asm/unistd.h
index 307201a854f3..38956dfa76f7 100644
--- a/arch/sh/include/asm/unistd.h
+++ b/arch/sh/include/asm/unistd.h
@@ -1,4 +1,3 @@
-#ifdef __KERNEL__
 # ifdef CONFIG_SUPERH32
 #  include <asm/unistd_32.h>
 # else
@@ -38,10 +37,4 @@
 */
 # define cond_syscall(x) asm(".weak\t" #x "\n\t.set\t" #x ",sys_ni_syscall")
-#else
+#include <uapi/asm/unistd.h>
-# ifdef __SH5__
-#  include <asm/unistd_64.h>
-# else
-#  include <asm/unistd_32.h>
-# endif
-#endif
diff --git a/arch/sh/include/uapi/asm/Kbuild b/arch/sh/include/uapi/asm/Kbuild
index baebb3da1d44..60613ae78513 100644
--- a/arch/sh/include/uapi/asm/Kbuild
+++ b/arch/sh/include/uapi/asm/Kbuild
@@ -1,3 +1,25 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+header-y += auxvec.h
+header-y += byteorder.h
+header-y += cachectl.h
+header-y += cpu-features.h
+header-y += hw_breakpoint.h
+header-y += ioctls.h
+header-y += posix_types.h
+header-y += posix_types_32.h
+header-y += posix_types_64.h
+header-y += ptrace.h
+header-y += ptrace_32.h
+header-y += ptrace_64.h
+header-y += setup.h
+header-y += sigcontext.h
+header-y += signal.h
+header-y += sockios.h
+header-y += stat.h
+header-y += swab.h
+header-y += types.h
+header-y += unistd.h
+header-y += unistd_32.h
+header-y += unistd_64.h
diff --git a/arch/sh/include/asm/auxvec.h b/arch/sh/include/uapi/asm/auxvec.h
index 8bcc51af9367..8bcc51af9367 100644
--- a/arch/sh/include/asm/auxvec.h
+++ b/arch/sh/include/uapi/asm/auxvec.h
diff --git a/arch/sh/include/asm/byteorder.h b/arch/sh/include/uapi/asm/byteorder.h
index db2f5d7cb17d..db2f5d7cb17d 100644
--- a/arch/sh/include/asm/byteorder.h
+++ b/arch/sh/include/uapi/asm/byteorder.h
diff --git a/arch/sh/include/asm/cachectl.h b/arch/sh/include/uapi/asm/cachectl.h
index 6ffb4b7a212e..6ffb4b7a212e 100644
--- a/arch/sh/include/asm/cachectl.h
+++ b/arch/sh/include/uapi/asm/cachectl.h
diff --git a/arch/sh/include/asm/cpu-features.h b/arch/sh/include/uapi/asm/cpu-features.h
index 694abe490edb..694abe490edb 100644
--- a/arch/sh/include/asm/cpu-features.h
+++ b/arch/sh/include/uapi/asm/cpu-features.h
diff --git a/arch/sh/include/uapi/asm/hw_breakpoint.h b/arch/sh/include/uapi/asm/hw_breakpoint.h
new file mode 100644
index 000000000000..ae5704fa77ad
--- /dev/null
+++ b/arch/sh/include/uapi/asm/hw_breakpoint.h
@@ -0,0 +1,4 @@
+/*
+ * There isn't anything here anymore, but the file must not be empty or patch
+ * will delete it.
+ */
diff --git a/arch/sh/include/asm/ioctls.h b/arch/sh/include/uapi/asm/ioctls.h
index a6769f352bf6..a6769f352bf6 100644
--- a/arch/sh/include/asm/ioctls.h
+++ b/arch/sh/include/uapi/asm/ioctls.h
diff --git a/arch/sh/include/uapi/asm/posix_types.h b/arch/sh/include/uapi/asm/posix_types.h
new file mode 100644
index 000000000000..dc55e5adfe1e
--- /dev/null
+++ b/arch/sh/include/uapi/asm/posix_types.h
@@ -0,0 +1,7 @@
+#ifndef __KERNEL__
+# ifdef __SH5__
+#  include <asm/posix_types_64.h>
+# else
+#  include <asm/posix_types_32.h>
+# endif
+#endif /* __KERNEL__ */
diff --git a/arch/sh/include/asm/posix_types_32.h b/arch/sh/include/uapi/asm/posix_types_32.h
index ba0bdc423b07..ba0bdc423b07 100644
--- a/arch/sh/include/asm/posix_types_32.h
+++ b/arch/sh/include/uapi/asm/posix_types_32.h
diff --git a/arch/sh/include/asm/posix_types_64.h b/arch/sh/include/uapi/asm/posix_types_64.h
index 244f7e950e17..244f7e950e17 100644
--- a/arch/sh/include/asm/posix_types_64.h
+++ b/arch/sh/include/uapi/asm/posix_types_64.h
diff --git a/arch/sh/include/uapi/asm/ptrace.h b/arch/sh/include/uapi/asm/ptrace.h
new file mode 100644
index 000000000000..8b8c5aca9c28
--- /dev/null
+++ b/arch/sh/include/uapi/asm/ptrace.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 1999, 2000  Niibe Yutaka
+ */
+#ifndef _UAPI__ASM_SH_PTRACE_H
+#define _UAPI__ASM_SH_PTRACE_H
+#define PTRACE_GETREGS          12      /* General registers */
+#define PTRACE_SETREGS          13
+#define PTRACE_GETFPREGS        14      /* FPU registers */
+#define PTRACE_SETFPREGS        15
+#define PTRACE_GETFDPIC         31      /* get the ELF fdpic loadmap address */
+#define PTRACE_GETFDPIC_EXEC    0       /* [addr] request the executable loadmap */
+#define PTRACE_GETFDPIC_INTERP  1       /* [addr] request the interpreter loadmap */
+#define PTRACE_GETDSPREGS       55      /* DSP registers */
+#define PTRACE_SETDSPREGS       56
+#define PT_TEXT_END_ADDR        240
+#define PT_TEXT_ADDR            244     /* &(struct user)->start_code */
+#define PT_DATA_ADDR            248     /* &(struct user)->start_data */
+#define PT_TEXT_LEN             252
+#if defined(__SH5__) || defined(CONFIG_CPU_SH5)
+#include <asm/ptrace_64.h>
+#else
+#include <asm/ptrace_32.h>
+#endif
+#endif /* _UAPI__ASM_SH_PTRACE_H */
diff --git a/arch/sh/include/uapi/asm/ptrace_32.h b/arch/sh/include/uapi/asm/ptrace_32.h
new file mode 100644
index 000000000000..926e0cefc2bb
--- /dev/null
+++ b/arch/sh/include/uapi/asm/ptrace_32.h
@@ -0,0 +1,77 @@
+#ifndef _UAPI__ASM_SH_PTRACE_32_H
+#define _UAPI__ASM_SH_PTRACE_32_H
+/*
+ * GCC defines register number like this:
+ * -----------------------------
+ *       0 - 15 are integer registers
+ *      17 - 22 are control/special registers
+ *      24 - 39 fp registers
+ *      40 - 47 xd registers
+ *      48 -    fpscr register
+ * -----------------------------
+ *
+ * We follows above, except:
+ *      16 --- program counter (PC)
+ *      22 --- syscall #
+ *      23 --- floating point communication register
+ */
+#define REG_REG0         0
+#define REG_REG15       15
+#define REG_PC          16
+#define REG_PR          17
+#define REG_SR          18
+#define REG_GBR         19
+#define REG_MACH        20
+#define REG_MACL        21
+#define REG_SYSCALL     22
+#define REG_FPREG0      23
+#define REG_FPREG15     38
+#define REG_XFREG0      39
+#define REG_XFREG15     54
+#define REG_FPSCR       55
+#define REG_FPUL        56
+/*
+ * This struct defines the way the registers are stored on the
+ * kernel stack during a system call or other kernel entry.
+ */
+struct pt_regs {
+        unsigned long regs[16];
+        unsigned long pc;
+        unsigned long pr;
+        unsigned long sr;
+        unsigned long gbr;
+        unsigned long mach;
+        unsigned long macl;
+        long tra;
+};
+/*
+ * This struct defines the way the DSP registers are stored on the
+ * kernel stack during a system call or other kernel entry.
+ */
+struct pt_dspregs {
+        unsigned long   a1;
+        unsigned long   a0g;
+        unsigned long   a1g;
+        unsigned long   m0;
+        unsigned long   m1;
+        unsigned long   a0;
+        unsigned long   x0;
+        unsigned long   x1;
+        unsigned long   y0;
+        unsigned long   y1;
+        unsigned long   dsr;
+        unsigned long   rs;
+        unsigned long   re;
+        unsigned long   mod;
+};
+#endif /* _UAPI__ASM_SH_PTRACE_32_H */
diff --git a/arch/sh/include/uapi/asm/ptrace_64.h b/arch/sh/include/uapi/asm/ptrace_64.h
new file mode 100644
index 000000000000..0e52ee83e946
--- /dev/null
+++ b/arch/sh/include/uapi/asm/ptrace_64.h
@@ -0,0 +1,14 @@
+#ifndef _UAPI__ASM_SH_PTRACE_64_H
+#define _UAPI__ASM_SH_PTRACE_64_H
+struct pt_regs {
+        unsigned long long pc;
+        unsigned long long sr;
+        long long syscall_nr;
+        unsigned long long regs[63];
+        unsigned long long tregs[8];
+        unsigned long long pad[2];
+};
+#endif /* _UAPI__ASM_SH_PTRACE_64_H */
diff --git a/arch/sh/include/uapi/asm/setup.h b/arch/sh/include/uapi/asm/setup.h
new file mode 100644
index 000000000000..552df83f1a49
--- /dev/null
+++ b/arch/sh/include/uapi/asm/setup.h
@@ -0,0 +1 @@
+#include <asm-generic/setup.h>
diff --git a/arch/sh/include/asm/sigcontext.h b/arch/sh/include/uapi/asm/sigcontext.h
index 8ce1435bc0bf..8ce1435bc0bf 100644
--- a/arch/sh/include/asm/sigcontext.h
+++ b/arch/sh/include/uapi/asm/sigcontext.h
diff --git a/arch/sh/include/asm/signal.h b/arch/sh/include/uapi/asm/signal.h
index 9ac530a90bce..9ac530a90bce 100644
--- a/arch/sh/include/asm/signal.h
+++ b/arch/sh/include/uapi/asm/signal.h
diff --git a/arch/sh/include/asm/sockios.h b/arch/sh/include/uapi/asm/sockios.h
index cf8b96b1f9ab..cf8b96b1f9ab 100644
--- a/arch/sh/include/asm/sockios.h
+++ b/arch/sh/include/uapi/asm/sockios.h
diff --git a/arch/sh/include/asm/stat.h b/arch/sh/include/uapi/asm/stat.h
index e1810cc6e3da..e1810cc6e3da 100644
--- a/arch/sh/include/asm/stat.h
+++ b/arch/sh/include/uapi/asm/stat.h
diff --git a/arch/sh/include/asm/swab.h b/arch/sh/include/uapi/asm/swab.h
index 1cd09767a7a3..1cd09767a7a3 100644
--- a/arch/sh/include/asm/swab.h
+++ b/arch/sh/include/uapi/asm/swab.h
diff --git a/arch/sh/include/uapi/asm/types.h b/arch/sh/include/uapi/asm/types.h
new file mode 100644
index 000000000000..b9e79bc580dd
--- /dev/null
+++ b/arch/sh/include/uapi/asm/types.h
@@ -0,0 +1 @@
+#include <asm-generic/types.h>
diff --git a/arch/sh/include/uapi/asm/unistd.h b/arch/sh/include/uapi/asm/unistd.h
new file mode 100644
index 000000000000..eeef88dd53ce
--- /dev/null
+++ b/arch/sh/include/uapi/asm/unistd.h
@@ -0,0 +1,7 @@
+#ifndef __KERNEL__
+# ifdef __SH5__
+#  include <asm/unistd_64.h>
+# else
+#  include <asm/unistd_32.h>
+# endif
+#endif
diff --git a/arch/sh/include/asm/unistd_32.h b/arch/sh/include/uapi/asm/unistd_32.h
index 72fd1e061006..9e465f246dc1 100644
--- a/arch/sh/include/asm/unistd_32.h
+++ b/arch/sh/include/uapi/asm/unistd_32.h
@@ -378,7 +378,8 @@
 #define __NR_setns              364
 #define __NR_process_vm_readv   365
 #define __NR_process_vm_writev  366
+#define __NR_kcmp               367
-#define NR_syscalls 367
+#define NR_syscalls 368
 #endif /* __ASM_SH_UNISTD_32_H */
diff --git a/arch/sh/include/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h
index a28edc329692..8e3a2edd284e 100644
--- a/arch/sh/include/asm/unistd_64.h
+++ b/arch/sh/include/uapi/asm/unistd_64.h
@@ -398,7 +398,8 @@
 #define __NR_setns              375
 #define __NR_process_vm_readv   376
 #define __NR_process_vm_writev  377
+#define __NR_kcmp               378
-#define NR_syscalls 378
+#define NR_syscalls 379
 #endif /* __ASM_SH_UNISTD_64_H */
diff --git a/arch/sh/kernel/syscalls_32.S b/arch/sh/kernel/syscalls_32.S
index 4b68f0f79761..fe97ae5e56f1 100644
--- a/arch/sh/kernel/syscalls_32.S
+++ b/arch/sh/kernel/syscalls_32.S
@@ -384,3 +384,4 @@ ENTRY(sys_call_table)
        .long sys_setns
        .long sys_process_vm_readv      /* 365 */
        .long sys_process_vm_writev
+        .long sys_kcmp
diff --git a/arch/sh/kernel/syscalls_64.S b/arch/sh/kernel/syscalls_64.S
index 0956345b36ef..5c7b1c67bdc1 100644
--- a/arch/sh/kernel/syscalls_64.S
+++ b/arch/sh/kernel/syscalls_64.S
@@ -404,3 +404,4 @@ sys_call_table:
        .long sys_setns                 /* 375 */
        .long sys_process_vm_readv
        .long sys_process_vm_writev
+        .long sys_kcmp
diff --git a/arch/sparc/include/asm/ptrace.h b/arch/sparc/include/asm/ptrace.h
index 0c6f6b068289..da43bdc62294 100644
--- a/arch/sparc/include/asm/ptrace.h
+++ b/arch/sparc/include/asm/ptrace.h
@@ -42,7 +42,18 @@ struct global_reg_snapshot {
        struct thread_info      *thread;
        unsigned long           pad1;
 };
-extern struct global_reg_snapshot global_reg_snapshot[NR_CPUS];
+struct global_pmu_snapshot {
+        unsigned long           pcr[4];
+        unsigned long           pic[4];
+};
+union global_cpu_snapshot {
+        struct global_reg_snapshot      reg;
+        struct global_pmu_snapshot      pmu;
+};
+extern union global_cpu_snapshot global_cpu_snapshot[NR_CPUS];
 #define force_successful_syscall_return()           \
 do {    current_thread_info()->syscall_noerror = 1; \
diff --git a/arch/sparc/include/asm/smp_64.h b/arch/sparc/include/asm/smp_64.h
index 29862a9e9065..dd3bef4b9896 100644
--- a/arch/sparc/include/asm/smp_64.h
+++ b/arch/sparc/include/asm/smp_64.h
@@ -48,6 +48,7 @@ extern void smp_fill_in_sib_core_maps(void);
 extern void cpu_play_dead(void);
 extern void smp_fetch_global_regs(void);
+extern void smp_fetch_global_pmu(void);
 struct seq_file;
 void smp_bogo(struct seq_file *);
@@ -65,6 +66,7 @@ extern void __cpu_die(unsigned int cpu);
 #define hard_smp_processor_id()         0
 #define smp_fill_in_sib_core_maps() do { } while (0)
 #define smp_fetch_global_regs() do { } while (0)
+#define smp_fetch_global_pmu() do { } while (0)
 #endif /* !(CONFIG_SMP) */
diff --git a/arch/sparc/include/uapi/asm/sigcontext.h b/arch/sparc/include/uapi/asm/sigcontext.h
index e69de29bb2d1..ae5704fa77ad 100644
--- a/arch/sparc/include/uapi/asm/sigcontext.h
+++ b/arch/sparc/include/uapi/asm/sigcontext.h
@@ -0,0 +1,4 @@
+/*
+ * There isn't anything here anymore, but the file must not be empty or patch
+ * will delete it.
+ */
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index e48651dace1b..885a8af74064 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -817,15 +817,17 @@ static u64 nop_for_index(int idx)
 static inline void sparc_pmu_enable_event(struct cpu_hw_events *cpuc, struct hw_perf_event *hwc, int idx)
 {
-        u64 val, mask = mask_for_index(idx);
+        u64 enc, val, mask = mask_for_index(idx);
        int pcr_index = 0;
        if (sparc_pmu->num_pcrs > 1)
                pcr_index = idx;
+        enc = perf_event_get_enc(cpuc->events[idx]);
        val = cpuc->pcr[pcr_index];
        val &= ~mask;
-        val |= hwc->config;
+        val |= event_encoding(enc, idx);
        cpuc->pcr[pcr_index] = val;
        pcr_ops->write_pcr(pcr_index, cpuc->pcr[pcr_index]);
@@ -1738,8 +1740,6 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
 {
        unsigned long ufp;
-        perf_callchain_store(entry, regs->tpc);
        ufp = regs->u_regs[UREG_I6] + STACK_BIAS;
        do {
                struct sparc_stackf *usf, sf;
@@ -1760,8 +1760,6 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
 {
        unsigned long ufp;
-        perf_callchain_store(entry, regs->tpc);
        ufp = regs->u_regs[UREG_I6] & 0xffffffffUL;
        do {
                struct sparc_stackf32 *usf, sf;
@@ -1780,6 +1778,11 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
 void
 perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
 {
+        perf_callchain_store(entry, regs->tpc);
+        if (!current->mm)
+                return;
        flushw_user();
        if (test_thread_flag(TIF_32BIT))
                perf_callchain_user_32(entry, regs);
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index fcaa59421126..d778248ef3f8 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -27,6 +27,7 @@
 #include <linux/tick.h>
 #include <linux/init.h>
 #include <linux/cpu.h>
+#include <linux/perf_event.h>
 #include <linux/elfcore.h>
 #include <linux/sysrq.h>
 #include <linux/nmi.h>
@@ -47,6 +48,7 @@
 #include <asm/syscalls.h>
 #include <asm/irq_regs.h>
 #include <asm/smp.h>
+#include <asm/pcr.h>
 #include "kstack.h"
@@ -204,18 +206,22 @@ void show_regs(struct pt_regs *regs)
        show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
 }
-struct global_reg_snapshot global_reg_snapshot[NR_CPUS];
+union global_cpu_snapshot global_cpu_snapshot[NR_CPUS];
-static DEFINE_SPINLOCK(global_reg_snapshot_lock);
+static DEFINE_SPINLOCK(global_cpu_snapshot_lock);
 static void __global_reg_self(struct thread_info *tp, struct pt_regs *regs,
                              int this_cpu)
 {
+        struct global_reg_snapshot *rp;
        flushw_all();
-        global_reg_snapshot[this_cpu].tstate = regs->tstate;
+        rp = &global_cpu_snapshot[this_cpu].reg;
-        global_reg_snapshot[this_cpu].tpc = regs->tpc;
-        global_reg_snapshot[this_cpu].tnpc = regs->tnpc;
+        rp->tstate = regs->tstate;
-        global_reg_snapshot[this_cpu].o7 = regs->u_regs[UREG_I7];
+        rp->tpc = regs->tpc;
+        rp->tnpc = regs->tnpc;
+        rp->o7 = regs->u_regs[UREG_I7];
        if (regs->tstate & TSTATE_PRIV) {
                struct reg_window *rw;
@@ -223,17 +229,17 @@ static void __global_reg_self(struct thread_info *tp, struct pt_regs *regs,
                rw = (struct reg_window *)
                        (regs->u_regs[UREG_FP] + STACK_BIAS);
                if (kstack_valid(tp, (unsigned long) rw)) {
-                        global_reg_snapshot[this_cpu].i7 = rw->ins[7];
+                        rp->i7 = rw->ins[7];
                        rw = (struct reg_window *)
                                (rw->ins[6] + STACK_BIAS);
                        if (kstack_valid(tp, (unsigned long) rw))
-                                global_reg_snapshot[this_cpu].rpc = rw->ins[7];
+                                rp->rpc = rw->ins[7];
                }
        } else {
-                global_reg_snapshot[this_cpu].i7 = 0;
+                rp->i7 = 0;
-                global_reg_snapshot[this_cpu].rpc = 0;
+                rp->rpc = 0;
        }
-        global_reg_snapshot[this_cpu].thread = tp;
+        rp->thread = tp;
 }
 /* In order to avoid hangs we do not try to synchronize with the
@@ -261,9 +267,9 @@ void arch_trigger_all_cpu_backtrace(void)
        if (!regs)
                regs = tp->kregs;
-        spin_lock_irqsave(&global_reg_snapshot_lock, flags);
+        spin_lock_irqsave(&global_cpu_snapshot_lock, flags);
-        memset(global_reg_snapshot, 0, sizeof(global_reg_snapshot));
+        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
        this_cpu = raw_smp_processor_id();
@@ -272,7 +278,7 @@ void arch_trigger_all_cpu_backtrace(void)
        smp_fetch_global_regs();
        for_each_online_cpu(cpu) {
-                struct global_reg_snapshot *gp = &global_reg_snapshot[cpu];
+                struct global_reg_snapshot *gp = &global_cpu_snapshot[cpu].reg;
                __global_reg_poll(gp);
@@ -295,9 +301,9 @@ void arch_trigger_all_cpu_backtrace(void)
                }
        }
-        memset(global_reg_snapshot, 0, sizeof(global_reg_snapshot));
+        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-        spin_unlock_irqrestore(&global_reg_snapshot_lock, flags);
+        spin_unlock_irqrestore(&global_cpu_snapshot_lock, flags);
 }
 #ifdef CONFIG_MAGIC_SYSRQ
@@ -309,16 +315,90 @@ static void sysrq_handle_globreg(int key)
 static struct sysrq_key_op sparc_globalreg_op = {
        .handler        = sysrq_handle_globreg,
-        .help_msg       = "Globalregs",
+        .help_msg       = "global-regs(Y)",
        .action_msg     = "Show Global CPU Regs",
 };
-static int __init sparc_globreg_init(void)
+static void __global_pmu_self(int this_cpu)
+{
+        struct global_pmu_snapshot *pp;
+        int i, num;
+        pp = &global_cpu_snapshot[this_cpu].pmu;
+        num = 1;
+        if (tlb_type == hypervisor &&
+            sun4v_chip_type >= SUN4V_CHIP_NIAGARA4)
+                num = 4;
+        for (i = 0; i < num; i++) {
+                pp->pcr[i] = pcr_ops->read_pcr(i);
+                pp->pic[i] = pcr_ops->read_pic(i);
+        }
+}
+static void __global_pmu_poll(struct global_pmu_snapshot *pp)
+{
+        int limit = 0;
+        while (!pp->pcr[0] && ++limit < 100) {
+                barrier();
+                udelay(1);
+        }
+}
+static void pmu_snapshot_all_cpus(void)
 {
-        return register_sysrq_key('y', &sparc_globalreg_op);
+        unsigned long flags;
+        int this_cpu, cpu;
+        spin_lock_irqsave(&global_cpu_snapshot_lock, flags);
+        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
+        this_cpu = raw_smp_processor_id();
+        __global_pmu_self(this_cpu);
+        smp_fetch_global_pmu();
+        for_each_online_cpu(cpu) {
+                struct global_pmu_snapshot *pp = &global_cpu_snapshot[cpu].pmu;
+                __global_pmu_poll(pp);
+                printk("%c CPU[%3d]: PCR[%08lx:%08lx:%08lx:%08lx] PIC[%08lx:%08lx:%08lx:%08lx]\n",
+                       (cpu == this_cpu ? '*' : ' '), cpu,
+                       pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
+                       pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
+        }
+        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
+        spin_unlock_irqrestore(&global_cpu_snapshot_lock, flags);
+}
+static void sysrq_handle_globpmu(int key)
+{
+        pmu_snapshot_all_cpus();
+}
+static struct sysrq_key_op sparc_globalpmu_op = {
+        .handler        = sysrq_handle_globpmu,
+        .help_msg       = "global-pmu(X)",
+        .action_msg     = "Show Global PMU Regs",
+};
+static int __init sparc_sysrq_init(void)
+{
+        int ret = register_sysrq_key('y', &sparc_globalreg_op);
+        if (!ret)
+                ret = register_sysrq_key('x', &sparc_globalpmu_op);
+        return ret;
 }
-core_initcall(sparc_globreg_init);
+core_initcall(sparc_sysrq_init);
 #endif
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 781bcb10b8bd..d94b878577b7 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -852,6 +852,8 @@ extern unsigned long xcall_flush_tlb_mm;
 extern unsigned long xcall_flush_tlb_pending;
 extern unsigned long xcall_flush_tlb_kernel_range;
 extern unsigned long xcall_fetch_glob_regs;
+extern unsigned long xcall_fetch_glob_pmu;
+extern unsigned long xcall_fetch_glob_pmu_n4;
 extern unsigned long xcall_receive_signal;
 extern unsigned long xcall_new_mmu_context_version;
 #ifdef CONFIG_KGDB
@@ -1000,6 +1002,15 @@ void smp_fetch_global_regs(void)
        smp_cross_call(&xcall_fetch_glob_regs, 0, 0, 0);
 }
+void smp_fetch_global_pmu(void)
+{
+        if (tlb_type == hypervisor &&
+            sun4v_chip_type >= SUN4V_CHIP_NIAGARA4)
+                smp_cross_call(&xcall_fetch_glob_pmu_n4, 0, 0, 0);
+        else
+                smp_cross_call(&xcall_fetch_glob_pmu, 0, 0, 0);
+}
 /* We know that the window frames of the user have been flushed
 * to the stack before we get here because all callers of us
 * are flush_tlb_*() routines, and these run after flush_cache_*()
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index 874162a11ceb..f8e13d421fcb 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -481,8 +481,8 @@ xcall_sync_tick:
        .globl          xcall_fetch_glob_regs
 xcall_fetch_glob_regs:
-        sethi           %hi(global_reg_snapshot), %g1
+        sethi           %hi(global_cpu_snapshot), %g1
-        or              %g1, %lo(global_reg_snapshot), %g1
+        or              %g1, %lo(global_cpu_snapshot), %g1
        __GET_CPUID(%g2)
        sllx            %g2, 6, %g3
        add             %g1, %g3, %g1
@@ -509,6 +509,66 @@ xcall_fetch_glob_regs:
        stx             %g3, [%g1 + GR_SNAP_THREAD]
        retry
+        .globl          xcall_fetch_glob_pmu
+xcall_fetch_glob_pmu:
+        sethi           %hi(global_cpu_snapshot), %g1
+        or              %g1, %lo(global_cpu_snapshot), %g1
+        __GET_CPUID(%g2)
+        sllx            %g2, 6, %g3
+        add             %g1, %g3, %g1
+        rd              %pic, %g7
+        stx             %g7, [%g1 + (4 * 8)]
+        rd              %pcr, %g7
+        stx             %g7, [%g1 + (0 * 8)]
+        retry
+        .globl          xcall_fetch_glob_pmu_n4
+xcall_fetch_glob_pmu_n4:
+        sethi           %hi(global_cpu_snapshot), %g1
+        or              %g1, %lo(global_cpu_snapshot), %g1
+        __GET_CPUID(%g2)
+        sllx            %g2, 6, %g3
+        add             %g1, %g3, %g1
+        ldxa            [%g0] ASI_PIC, %g7
+        stx             %g7, [%g1 + (4 * 8)]
+        mov             0x08, %g3
+        ldxa            [%g3] ASI_PIC, %g7
+        stx             %g7, [%g1 + (5 * 8)]
+        mov             0x10, %g3
+        ldxa            [%g3] ASI_PIC, %g7
+        stx             %g7, [%g1 + (6 * 8)]
+        mov             0x18, %g3
+        ldxa            [%g3] ASI_PIC, %g7
+        stx             %g7, [%g1 + (7 * 8)]
+        mov             %o0, %g2
+        mov             %o1, %g3
+        mov             %o5, %g7
+        mov             HV_FAST_VT_GET_PERFREG, %o5
+        mov             3, %o0
+        ta              HV_FAST_TRAP
+        stx             %o1, [%g1 + (3 * 8)]
+        mov             HV_FAST_VT_GET_PERFREG, %o5
+        mov             2, %o0
+        ta              HV_FAST_TRAP
+        stx             %o1, [%g1 + (2 * 8)]
+        mov             HV_FAST_VT_GET_PERFREG, %o5
+        mov             1, %o0
+        ta              HV_FAST_TRAP
+        stx             %o1, [%g1 + (1 * 8)]
+        mov             HV_FAST_VT_GET_PERFREG, %o5
+        mov             0, %o0
+        ta              HV_FAST_TRAP
+        stx             %o1, [%g1 + (0 * 8)]
+        mov             %g2, %o0
+        mov             %g3, %o1
+        mov             %g7, %o5
+        retry
 #ifdef DCACHE_ALIASING_POSSIBLE
        .align          32
        .globl          xcall_flush_dcache_page_cheetah
diff --git a/arch/tile/include/arch/Kbuild b/arch/tile/include/arch/Kbuild
index e69de29bb2d1..3751c9fabcf2 100644
--- a/arch/tile/include/arch/Kbuild
+++ b/arch/tile/include/arch/Kbuild
@@ -0,0 +1 @@
+# Tile arch headers
diff --git a/arch/tile/include/asm/Kbuild b/arch/tile/include/asm/Kbuild
index c68808a09da7..6948015e08a2 100644
--- a/arch/tile/include/asm/Kbuild
+++ b/arch/tile/include/asm/Kbuild
@@ -1,8 +1,6 @@
 header-y += ../arch/
-header-y += ucontext.h
 generic-y += bug.h
 generic-y += bugs.h
 generic-y += clkdev.h
@@ -37,5 +35,4 @@ generic-y += statfs.h
 generic-y += termbits.h
 generic-y += termios.h
 generic-y += types.h
-generic-y += ucontext.h
 generic-y += xor.h
diff --git a/arch/tile/include/uapi/asm/Kbuild b/arch/tile/include/uapi/asm/Kbuild
index 5c6915fd30b5..c20db8e428bf 100644
--- a/arch/tile/include/uapi/asm/Kbuild
+++ b/arch/tile/include/uapi/asm/Kbuild
@@ -15,4 +15,7 @@ header-y += siginfo.h
 header-y += signal.h
 header-y += stat.h
 header-y += swab.h
+header-y += ucontext.h
 header-y += unistd.h
+generic-y += ucontext.h
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 58790bd85c1d..05afcca66de6 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -142,7 +142,7 @@ KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
 KBUILD_CFLAGS += $(mflags-y)
 KBUILD_AFLAGS += $(mflags-y)
-archscripts:
+archscripts: scripts_basic
        $(Q)$(MAKE) $(build)=arch/x86/tools relocs
 ###
diff --git a/drivers/Makefile b/drivers/Makefile
index 03da5b663aef..a16a8d001ae0 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -17,6 +17,10 @@ obj-$(CONFIG_PARISC)		+= parisc/
 obj-$(CONFIG_RAPIDIO)           += rapidio/
 obj-y                           += video/
 obj-y                           += idle/
+# IPMI must come before ACPI in order to provide IPMI opregion support
+obj-$(CONFIG_IPMI_HANDLER)      += char/ipmi/
 obj-$(CONFIG_ACPI)              += acpi/
 obj-$(CONFIG_SFI)               += sfi/
 # PnP must come after ACPI since it will eventually need to check if acpi
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 47199e2a9130..82422fe90f81 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -47,6 +47,10 @@ acpi-y				+= video_detect.o
 endif
 # These are (potentially) separate modules
+# IPMI may be used by other drivers, so it has to initialise before them
+obj-$(CONFIG_ACPI_IPMI)         += acpi_ipmi.o
 obj-$(CONFIG_ACPI_AC)           += ac.o
 obj-$(CONFIG_ACPI_BUTTON)       += button.o
 obj-$(CONFIG_ACPI_FAN)          += fan.o
@@ -70,6 +74,5 @@ processor-y			+= processor_idle.o processor_thermal.o
 processor-$(CONFIG_CPU_FREQ)    += processor_perflib.o
 obj-$(CONFIG_ACPI_PROCESSOR_AGGREGATOR) += acpi_pad.o
-obj-$(CONFIG_ACPI_IPMI)         += acpi_ipmi.o
 obj-$(CONFIG_ACPI_APEI)         += apei/
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index d0b27a39f1d4..7ff1d0d208a7 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -52,7 +52,6 @@ obj-$(CONFIG_TELCLOCK)		+= tlclk.o
 obj-$(CONFIG_MWAVE)             += mwave/
 obj-$(CONFIG_AGP)               += agp/
 obj-$(CONFIG_PCMCIA)            += pcmcia/
-obj-$(CONFIG_IPMI_HANDLER)      += ipmi/
 obj-$(CONFIG_HANGCHECK_TIMER)   += hangcheck-timer.o
 obj-$(CONFIG_TCG_TPM)           += tpm/
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index e01f5eaaec82..38390f7c6ab6 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -667,7 +667,7 @@ static int intel_gtt_init(void)
        gtt_map_size = intel_private.base.gtt_total_entries * 4;
        intel_private.gtt = NULL;
-        if (INTEL_GTT_GEN < 6)
+        if (INTEL_GTT_GEN < 6 && INTEL_GTT_GEN > 2)
                intel_private.gtt = ioremap_wc(intel_private.gtt_bus_addr,
                                               gtt_map_size);
        if (intel_private.gtt == NULL)
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 2c29942b1326..a0c84bb30856 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1880,7 +1880,7 @@ int ipmi_request_supply_msgs(ipmi_user_t          user,
                             struct ipmi_recv_msg *supplied_recv,
                             int                  priority)
 {
-        unsigned char saddr, lun;
+        unsigned char saddr = 0, lun = 0;
        int           rv;
        if (!user)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 83f85cf7fb1b..32a6c7e256bd 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2424,6 +2424,38 @@ static void ipmi_pci_cleanup(struct smi_info *info)
        pci_disable_device(pdev);
 }
+static int __devinit ipmi_pci_probe_regspacing(struct smi_info *info)
+{
+        if (info->si_type == SI_KCS) {
+                unsigned char   status;
+                int             regspacing;
+                info->io.regsize = DEFAULT_REGSIZE;
+                info->io.regshift = 0;
+                info->io_size = 2;
+                info->handlers = &kcs_smi_handlers;
+                /* detect 1, 4, 16byte spacing */
+                for (regspacing = DEFAULT_REGSPACING; regspacing <= 16;) {
+                        info->io.regspacing = regspacing;
+                        if (info->io_setup(info)) {
+                                dev_err(info->dev,
+                                        "Could not setup I/O space\n");
+                                return DEFAULT_REGSPACING;
+                        }
+                        /* write invalid cmd */
+                        info->io.outputb(&info->io, 1, 0x10);
+                        /* read status back */
+                        status = info->io.inputb(&info->io, 1);
+                        info->io_cleanup(info);
+                        if (status)
+                                return regspacing;
+                        regspacing *= 4;
+                }
+        }
+        return DEFAULT_REGSPACING;
+}
 static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
                                    const struct pci_device_id *ent)
 {
@@ -2476,8 +2508,8 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
        }
        info->io.addr_data = pci_resource_start(pdev, 0);
-        info->io.regspacing = DEFAULT_REGSPACING;
+        info->io.regspacing = ipmi_pci_probe_regspacing(info);
-        info->io.regsize = DEFAULT_REGSPACING;
+        info->io.regsize = DEFAULT_REGSIZE;
        info->io.regshift = 0;
        info->irq = pdev->irq;
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index cdf8b1e7602d..441ebc1bdbef 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -239,7 +239,7 @@ int drm_vma_info(struct seq_file *m, void *data)
        mutex_lock(&dev->struct_mutex);
        seq_printf(m, "vma use count: %d, high_memory = %pK, 0x%pK\n",
                   atomic_read(&dev->vma_count),
-                   high_memory, (void *)virt_to_phys(high_memory));
+                   high_memory, (void *)(unsigned long)virt_to_phys(high_memory));
        list_for_each_entry(pt, &dev->vmalist, head) {
                vma = pt->vma;
diff --git a/drivers/gpu/drm/i915/dvo_ch7xxx.c b/drivers/gpu/drm/i915/dvo_ch7xxx.c
index 38f3a6cb8c7d..3edd981e0770 100644
--- a/drivers/gpu/drm/i915/dvo_ch7xxx.c
+++ b/drivers/gpu/drm/i915/dvo_ch7xxx.c
@@ -303,10 +303,10 @@ static bool ch7xxx_get_hw_state(struct intel_dvo_device *dvo)
        ch7xxx_readb(dvo, CH7xxx_PM, &val);
-        if (val & CH7xxx_PM_FPD)
+        if (val & (CH7xxx_PM_DVIL | CH7xxx_PM_DVIP))
-                return false;
-        else
                return true;
+        else
+                return false;
 }
 static void ch7xxx_dump_regs(struct intel_dvo_device *dvo)
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 4f2831aa5fed..b84f7861e438 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1341,9 +1341,14 @@ int __must_check i915_gem_object_get_pages(struct drm_i915_gem_object *obj);
 static inline struct page *i915_gem_object_get_page(struct drm_i915_gem_object *obj, int n)
 {
        struct scatterlist *sg = obj->pages->sgl;
-        while (n >= SG_MAX_SINGLE_ALLOC) {
+        int nents = obj->pages->nents;
+        while (nents > SG_MAX_SINGLE_ALLOC) {
+                if (n < SG_MAX_SINGLE_ALLOC - 1)
+                        break;
                sg = sg_chain_ptr(sg + SG_MAX_SINGLE_ALLOC - 1);
                n -= SG_MAX_SINGLE_ALLOC - 1;
+                nents -= SG_MAX_SINGLE_ALLOC - 1;
        }
        return sg_page(sg+n);
 }
@@ -1427,7 +1432,7 @@ int __must_check i915_gpu_idle(struct drm_device *dev);
 int __must_check i915_gem_idle(struct drm_device *dev);
 int i915_add_request(struct intel_ring_buffer *ring,
                     struct drm_file *file,
-                     struct drm_i915_gem_request *request);
+                     u32 *seqno);
 int __must_check i915_wait_seqno(struct intel_ring_buffer *ring,
                                 uint32_t seqno);
 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 19dbdd7dd564..d33d02d13c96 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1955,11 +1955,12 @@ i915_gem_next_request_seqno(struct intel_ring_buffer *ring)
 int
 i915_add_request(struct intel_ring_buffer *ring,
                 struct drm_file *file,
-                 struct drm_i915_gem_request *request)
+                 u32 *out_seqno)
 {
        drm_i915_private_t *dev_priv = ring->dev->dev_private;
-        uint32_t seqno;
+        struct drm_i915_gem_request *request;
        u32 request_ring_position;
+        u32 seqno;
        int was_empty;
        int ret;
@@ -1974,11 +1975,9 @@ i915_add_request(struct intel_ring_buffer *ring,
        if (ret)
                return ret;
-        if (request == NULL) {
+        request = kmalloc(sizeof(*request), GFP_KERNEL);
-                request = kmalloc(sizeof(*request), GFP_KERNEL);
+        if (request == NULL)
-                if (request == NULL)
+                return -ENOMEM;
-                        return -ENOMEM;
-        }
        seqno = i915_gem_next_request_seqno(ring);
@@ -2030,6 +2029,8 @@ i915_add_request(struct intel_ring_buffer *ring,
                }
        }
+        if (out_seqno)
+                *out_seqno = seqno;
        return 0;
 }
@@ -3959,6 +3960,9 @@ i915_gem_init_hw(struct drm_device *dev)
        if (!intel_enable_gtt())
                return -EIO;
+        if (IS_HASWELL(dev) && (I915_READ(0x120010) == 1))
+                I915_WRITE(0x9008, I915_READ(0x9008) | 0xf0000);
        i915_gem_l3_remap(dev);
        i915_gem_init_swizzling(dev);
@@ -4098,7 +4102,6 @@ i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
        }
        BUG_ON(!list_empty(&dev_priv->mm.active_list));
-        BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
        mutex_unlock(&dev->struct_mutex);
        ret = drm_irq_install(dev);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 64c1be0a9cfd..a4162ddff6c5 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -521,7 +521,7 @@
 */
 # define _3D_CHICKEN2_WM_READ_PIPELINED                 (1 << 14)
 #define _3D_CHICKEN3    0x02090
-#define  _3D_CHICKEN_SF_DISABLE_FASTCLIP_CULL           (1 << 5)
+#define  _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL          (1 << 5)
 #define MI_MODE         0x0209c
 # define VS_TIMER_DISPATCH                              (1 << 6)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2b6ce9b2674a..682bd3729baf 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3253,6 +3253,16 @@ static void ironlake_crtc_enable(struct drm_crtc *crtc)
        if (HAS_PCH_CPT(dev))
                intel_cpt_verify_modeset(dev, intel_crtc->pipe);
+        /*
+         * There seems to be a race in PCH platform hw (at least on some
+         * outputs) where an enabled pipe still completes any pageflip right
+         * away (as if the pipe is off) instead of waiting for vblank. As soon
+         * as the first vblank happend, everything works as expected. Hence just
+         * wait for one vblank before returning to avoid strange things
+         * happening.
+         */
+        intel_wait_for_vblank(dev, intel_crtc->pipe);
 }
 static void ironlake_crtc_disable(struct drm_crtc *crtc)
@@ -7892,8 +7902,7 @@ static struct intel_quirk intel_quirks[] = {
        /* ThinkPad T60 needs pipe A force quirk (bug #16494) */
        { 0x2782, 0x17aa, 0x201a, quirk_pipea_force },
-        /* 855 & before need to leave pipe A & dpll A up */
+        /* 830/845 need to leave pipe A & dpll A up */
-        { 0x3582, PCI_ANY_ID, PCI_ANY_ID, quirk_pipea_force },
        { 0x2562, PCI_ANY_ID, PCI_ANY_ID, quirk_pipea_force },
        { 0x3577, PCI_ANY_ID, PCI_ANY_ID, quirk_pipea_force },
@@ -8049,29 +8058,42 @@ static void intel_enable_pipe_a(struct drm_device *dev)
 }
+static bool
+intel_check_plane_mapping(struct intel_crtc *crtc)
+{
+        struct drm_i915_private *dev_priv = crtc->base.dev->dev_private;
+        u32 reg, val;
+        if (dev_priv->num_pipe == 1)
+                return true;
+        reg = DSPCNTR(!crtc->plane);
+        val = I915_READ(reg);
+        if ((val & DISPLAY_PLANE_ENABLE) &&
+            (!!(val & DISPPLANE_SEL_PIPE_MASK) == crtc->pipe))
+                return false;
+        return true;
+}
 static void intel_sanitize_crtc(struct intel_crtc *crtc)
 {
        struct drm_device *dev = crtc->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 reg, val;
+        u32 reg;
        /* Clear any frame start delays used for debugging left by the BIOS */
        reg = PIPECONF(crtc->pipe);
        I915_WRITE(reg, I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
        /* We need to sanitize the plane -> pipe mapping first because this will
-         * disable the crtc (and hence change the state) if it is wrong. */
+         * disable the crtc (and hence change the state) if it is wrong. Note
-        if (!HAS_PCH_SPLIT(dev)) {
+         * that gen4+ has a fixed plane -> pipe mapping.  */
+        if (INTEL_INFO(dev)->gen < 4 && !intel_check_plane_mapping(crtc)) {
                struct intel_connector *connector;
                bool plane;
-                reg = DSPCNTR(crtc->plane);
-                val = I915_READ(reg);
-                if ((val & DISPLAY_PLANE_ENABLE) == 0 &&
-                    (!!(val & DISPPLANE_SEL_PIPE_MASK) == crtc->pipe))
-                        goto ok;
                DRM_DEBUG_KMS("[CRTC:%d] wrong plane connection detected!\n",
                              crtc->base.base.id);
@@ -8095,7 +8117,6 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                WARN_ON(crtc->active);
                crtc->base.enabled = false;
        }
-ok:
        if (dev_priv->quirks & QUIRK_PIPEA_FORCE &&
            crtc->pipe == PIPE_A && !crtc->active) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index d1e8ddb2d6c0..1b727a5c9ee5 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2369,8 +2369,9 @@ static void
 intel_dp_destroy(struct drm_connector *connector)
 {
        struct drm_device *dev = connector->dev;
+        struct intel_dp *intel_dp = intel_attached_dp(connector);
-        if (intel_dpd_is_edp(dev))
+        if (is_edp(intel_dp))
                intel_panel_destroy_backlight(dev);
        drm_sysfs_connector_remove(connector);
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index ebff850a9ab6..495625914e4a 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -209,7 +209,6 @@ static void intel_overlay_unmap_regs(struct intel_overlay *overlay,
 }
 static int intel_overlay_do_wait_request(struct intel_overlay *overlay,
-                                         struct drm_i915_gem_request *request,
                                         void (*tail)(struct intel_overlay *))
 {
        struct drm_device *dev = overlay->dev;
@@ -218,12 +217,10 @@ static int intel_overlay_do_wait_request(struct intel_overlay *overlay,
        int ret;
        BUG_ON(overlay->last_flip_req);
-        ret = i915_add_request(ring, NULL, request);
+        ret = i915_add_request(ring, NULL, &overlay->last_flip_req);
-        if (ret) {
+        if (ret)
-            kfree(request);
+                return ret;
-            return ret;
-        }
-        overlay->last_flip_req = request->seqno;
        overlay->flip_tail = tail;
        ret = i915_wait_seqno(ring, overlay->last_flip_req);
        if (ret)
@@ -240,7 +237,6 @@ static int intel_overlay_on(struct intel_overlay *overlay)
        struct drm_device *dev = overlay->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
-        struct drm_i915_gem_request *request;
        int ret;
        BUG_ON(overlay->active);
@@ -248,17 +244,9 @@ static int intel_overlay_on(struct intel_overlay *overlay)
        WARN_ON(IS_I830(dev) && !(dev_priv->quirks & QUIRK_PIPEA_FORCE));
-        request = kzalloc(sizeof(*request), GFP_KERNEL);
-        if (request == NULL) {
-                ret = -ENOMEM;
-                goto out;
-        }
        ret = intel_ring_begin(ring, 4);
-        if (ret) {
+        if (ret)
-                kfree(request);
+                return ret;
-                goto out;
-        }
        intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_ON);
        intel_ring_emit(ring, overlay->flip_addr | OFC_UPDATE);
@@ -266,9 +254,7 @@ static int intel_overlay_on(struct intel_overlay *overlay)
        intel_ring_emit(ring, MI_NOOP);
        intel_ring_advance(ring);
-        ret = intel_overlay_do_wait_request(overlay, request, NULL);
+        return intel_overlay_do_wait_request(overlay, NULL);
-out:
-        return ret;
 }
 /* overlay needs to be enabled in OCMD reg */
@@ -278,17 +264,12 @@ static int intel_overlay_continue(struct intel_overlay *overlay,
        struct drm_device *dev = overlay->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
-        struct drm_i915_gem_request *request;
        u32 flip_addr = overlay->flip_addr;
        u32 tmp;
        int ret;
        BUG_ON(!overlay->active);
-        request = kzalloc(sizeof(*request), GFP_KERNEL);
-        if (request == NULL)
-                return -ENOMEM;
        if (load_polyphase_filter)
                flip_addr |= OFC_UPDATE;
@@ -298,22 +279,14 @@ static int intel_overlay_continue(struct intel_overlay *overlay,
                DRM_DEBUG("overlay underrun, DOVSTA: %x\n", tmp);
        ret = intel_ring_begin(ring, 2);
-        if (ret) {
+        if (ret)
-                kfree(request);
                return ret;
-        }
        intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
        intel_ring_emit(ring, flip_addr);
        intel_ring_advance(ring);
-        ret = i915_add_request(ring, NULL, request);
+        return i915_add_request(ring, NULL, &overlay->last_flip_req);
-        if (ret) {
-                kfree(request);
-                return ret;
-        }
-        overlay->last_flip_req = request->seqno;
-        return 0;
 }
 static void intel_overlay_release_old_vid_tail(struct intel_overlay *overlay)
@@ -349,15 +322,10 @@ static int intel_overlay_off(struct intel_overlay *overlay)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
        u32 flip_addr = overlay->flip_addr;
-        struct drm_i915_gem_request *request;
        int ret;
        BUG_ON(!overlay->active);
-        request = kzalloc(sizeof(*request), GFP_KERNEL);
-        if (request == NULL)
-                return -ENOMEM;
        /* According to intel docs the overlay hw may hang (when switching
         * off) without loading the filter coeffs. It is however unclear whether
         * this applies to the disabling of the overlay or to the switching off
@@ -365,10 +333,9 @@ static int intel_overlay_off(struct intel_overlay *overlay)
        flip_addr |= OFC_UPDATE;
        ret = intel_ring_begin(ring, 6);
-        if (ret) {
+        if (ret)
-                kfree(request);
                return ret;
-        }
        /* wait for overlay to go idle */
        intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
        intel_ring_emit(ring, flip_addr);
@@ -379,8 +346,7 @@ static int intel_overlay_off(struct intel_overlay *overlay)
        intel_ring_emit(ring, MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
        intel_ring_advance(ring);
-        return intel_overlay_do_wait_request(overlay, request,
+        return intel_overlay_do_wait_request(overlay, intel_overlay_off_tail);
-                                             intel_overlay_off_tail);
 }
 /* recover from an interruption due to a signal
@@ -425,24 +391,16 @@ static int intel_overlay_release_old_vid(struct intel_overlay *overlay)
                return 0;
        if (I915_READ(ISR) & I915_OVERLAY_PLANE_FLIP_PENDING_INTERRUPT) {
-                struct drm_i915_gem_request *request;
                /* synchronous slowpath */
-                request = kzalloc(sizeof(*request), GFP_KERNEL);
-                if (request == NULL)
-                        return -ENOMEM;
                ret = intel_ring_begin(ring, 2);
-                if (ret) {
+                if (ret)
-                        kfree(request);
                        return ret;
-                }
                intel_ring_emit(ring, MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
                intel_ring_emit(ring, MI_NOOP);
                intel_ring_advance(ring);
-                ret = intel_overlay_do_wait_request(overlay, request,
+                ret = intel_overlay_do_wait_request(overlay,
                                                    intel_overlay_release_old_vid_tail);
                if (ret)
                        return ret;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index b3b4b6cea8b0..72f41aaa71ff 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3442,8 +3442,8 @@ static void gen6_init_clock_gating(struct drm_device *dev)
                   GEN6_RCCUNIT_CLOCK_GATE_DISABLE);
        /* Bspec says we need to always set all mask bits. */
-        I915_WRITE(_3D_CHICKEN, (0xFFFF << 16) |
+        I915_WRITE(_3D_CHICKEN3, (0xFFFF << 16) |
-                   _3D_CHICKEN_SF_DISABLE_FASTCLIP_CULL);
+                   _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL);
        /*
         * According to the spec the following bits should be
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
index 9ed6e728a94c..7d750382a833 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
@@ -43,7 +43,7 @@ dcb_table(struct nouveau_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
        *ver = nv_ro08(bios, dcb);
        if (*ver >= 0x41) {
-                nv_warn(bios, "DCB *ver 0x%02x unknown\n", *ver);
+                nv_warn(bios, "DCB version 0x%02x unknown\n", *ver);
                return 0x0000;
        } else
        if (*ver >= 0x30) {
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index 436e9efe7ef5..42d7539e6525 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -277,7 +277,6 @@ nv50_fb_dtor(struct nouveau_object *object)
                __free_page(priv->r100c08_page);
        }
-        nouveau_mm_fini(&priv->base.vram);
        nouveau_fb_destroy(&priv->base);
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
index b29237970fa0..523178685180 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
@@ -134,7 +134,7 @@ nouveau_therm_fan_sense(struct nouveau_therm *therm)
        end = ptimer->read(ptimer);
        if (cycles == 5) {
-                tach = (u64)60000000000;
+                tach = (u64)60000000000ULL;
                do_div(tach, (end - start));
                return tach;
        } else
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 259e5f1adf47..35ac57f0aab6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -456,6 +456,7 @@ static struct ttm_tt *
 nouveau_ttm_tt_create(struct ttm_bo_device *bdev, unsigned long size,
                      uint32_t page_flags, struct page *dummy_read)
 {
+#if __OS_HAS_AGP
        struct nouveau_drm *drm = nouveau_bdev(bdev);
        struct drm_device *dev = drm->dev;
@@ -463,6 +464,7 @@ nouveau_ttm_tt_create(struct ttm_bo_device *bdev, unsigned long size,
                return ttm_agp_tt_create(bdev, dev->agp->bridge, size,
                                         page_flags, dummy_read);
        }
+#endif
        return nouveau_sgdma_create_ttm(bdev, size, page_flags, dummy_read);
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.c b/drivers/gpu/drm/nouveau/nouveau_pm.c
index 0bf64c90aa20..5566172774df 100644
--- a/drivers/gpu/drm/nouveau/nouveau_pm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_pm.c
@@ -52,7 +52,7 @@ nouveau_pm_perflvl_aux(struct drm_device *dev, struct nouveau_pm_level *perflvl,
 {
        struct nouveau_drm *drm = nouveau_drm(dev);
        struct nouveau_pm *pm = nouveau_pm(dev);
-        struct nouveau_therm *therm = nouveau_therm(drm);
+        struct nouveau_therm *therm = nouveau_therm(drm->device);
        int ret;
        /*XXX: not on all boards, we should control based on temperature
@@ -64,7 +64,6 @@ nouveau_pm_perflvl_aux(struct drm_device *dev, struct nouveau_pm_level *perflvl,
                ret = therm->fan_set(therm, perflvl->fanspeed);
                if (ret && ret != -ENODEV) {
                        NV_ERROR(drm, "fanspeed set failed: %d\n", ret);
-                        return ret;
                }
        }
@@ -706,8 +705,7 @@ nouveau_hwmon_init(struct drm_device *dev)
        struct device *hwmon_dev;
        int ret = 0;
-        if (!therm || !therm->temp_get || !therm->attr_get ||
+        if (!therm || !therm->temp_get || !therm->attr_get || !therm->attr_set)
-                !therm->attr_set || therm->temp_get(therm) < 0)
                return -ENODEV;
        hwmon_dev = hwmon_device_register(&dev->pdev->dev);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 96184d02c8d9..2e566e123e9e 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1690,10 +1690,10 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                }
                /* all other cases */
                pll_in_use = radeon_get_pll_use_mask(crtc);
-                if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                        return ATOM_PPLL2;
                if (!(pll_in_use & (1 << ATOM_PPLL1)))
                        return ATOM_PPLL1;
+                if (!(pll_in_use & (1 << ATOM_PPLL2)))
+                        return ATOM_PPLL2;
                DRM_ERROR("unable to allocate a PPLL\n");
                return ATOM_PPLL_INVALID;
        } else {
@@ -1715,10 +1715,10 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                        }
                        /* all other cases */
                        pll_in_use = radeon_get_pll_use_mask(crtc);
-                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                                return ATOM_PPLL2;
                        if (!(pll_in_use & (1 << ATOM_PPLL1)))
                                return ATOM_PPLL1;
+                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
+                                return ATOM_PPLL2;
                        DRM_ERROR("unable to allocate a PPLL\n");
                        return ATOM_PPLL_INVALID;
                } else {
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index a1f49c5fd74b..14313ad43b76 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3431,9 +3431,14 @@ void evergreen_pcie_gen2_enable(struct radeon_device *rdev)
        if (!(mask & DRM_PCIE_SPEED_50))
                return;
+        speed_cntl = RREG32_PCIE_P(PCIE_LC_SPEED_CNTL);
+        if (speed_cntl & LC_CURRENT_DATA_RATE) {
+                DRM_INFO("PCIE gen 2 link speeds already enabled\n");
+                return;
+        }
        DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
-        speed_cntl = RREG32_PCIE_P(PCIE_LC_SPEED_CNTL);
        if ((speed_cntl & LC_OTHER_SIDE_EVER_SENT_GEN2) ||
            (speed_cntl & LC_OTHER_SIDE_SUPPORTS_GEN2)) {
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 8bcb554ea0c5..8c74c729586d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -770,9 +770,13 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev)
        WREG32(0x15DC, 0);
        /* empty context1-7 */
+        /* Assign the pt base to something valid for now; the pts used for
+         * the VMs are determined by the application and setup and assigned
+         * on the fly in the vm part of radeon_gart.c
+         */
        for (i = 1; i < 8; i++) {
                WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0);
-                WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), 0);
+                WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn);
                WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
                        rdev->gart.table_addr >> 12);
        }
@@ -1572,12 +1576,6 @@ void cayman_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
        if (vm == NULL)
                return;
-        radeon_ring_write(ring, PACKET0(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (vm->id << 2), 0));
-        radeon_ring_write(ring, 0);
-        radeon_ring_write(ring, PACKET0(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (vm->id << 2), 0));
-        radeon_ring_write(ring, vm->last_pfn);
        radeon_ring_write(ring, PACKET0(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (vm->id << 2), 0));
        radeon_ring_write(ring, vm->pd_gpu_addr >> 12);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 70c800ff6190..cda280d157da 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3703,6 +3703,12 @@ static void r600_pcie_gen2_enable(struct radeon_device *rdev)
        if (!(mask & DRM_PCIE_SPEED_50))
                return;
+        speed_cntl = RREG32_PCIE_P(PCIE_LC_SPEED_CNTL);
+        if (speed_cntl & LC_CURRENT_DATA_RATE) {
+                DRM_INFO("PCIE gen 2 link speeds already enabled\n");
+                return;
+        }
        DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
        /* 55 nm r6xx asics */
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b04c06444d8b..8c42d54c2e26 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -663,9 +663,14 @@ struct radeon_vm {
        struct list_head                list;
        struct list_head                va;
        unsigned                        id;
-        unsigned                        last_pfn;
-        u64                             pd_gpu_addr;
+        /* contains the page directory */
-        struct radeon_sa_bo             *sa_bo;
+        struct radeon_sa_bo             *page_directory;
+        uint64_t                        pd_gpu_addr;
+        /* array of page tables, one for each page directory entry */
+        struct radeon_sa_bo             **page_tables;
        struct mutex                    mutex;
        /* last fence for cs using this vm */
        struct radeon_fence             *fence;
@@ -1843,9 +1848,10 @@ extern void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size
 */
 int radeon_vm_manager_init(struct radeon_device *rdev);
 void radeon_vm_manager_fini(struct radeon_device *rdev);
-int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm);
+void radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm);
 void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm);
 int radeon_vm_alloc_pt(struct radeon_device *rdev, struct radeon_vm *vm);
+void radeon_vm_add_to_lru(struct radeon_device *rdev, struct radeon_vm *vm);
 struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
                                       struct radeon_vm *vm, int ring);
 void radeon_vm_fence(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_acpi.c b/drivers/gpu/drm/radeon/radeon_acpi.c
index b0a5688c67f8..196d28d99570 100644
--- a/drivers/gpu/drm/radeon/radeon_acpi.c
+++ b/drivers/gpu/drm/radeon/radeon_acpi.c
@@ -201,7 +201,7 @@ static int radeon_atif_verify_interface(acpi_handle handle,
        size = *(u16 *) info->buffer.pointer;
        if (size < 12) {
-                DRM_INFO("ATIF buffer is too small: %lu\n", size);
+                DRM_INFO("ATIF buffer is too small: %zu\n", size);
                err = -EINVAL;
                goto out;
        }
@@ -370,6 +370,7 @@ int radeon_atif_handler(struct radeon_device *rdev,
                        radeon_set_backlight_level(rdev, enc, req.backlight_level);
+#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
                        if (rdev->is_atom_bios) {
                                struct radeon_encoder_atom_dig *dig = enc->enc_priv;
                                backlight_force_update(dig->bl_dev,
@@ -379,6 +380,7 @@ int radeon_atif_handler(struct radeon_device *rdev,
                                backlight_force_update(dig->bl_dev,
                                                       BACKLIGHT_UPDATE_HOTKEY);
                        }
+#endif
                }
        }
        /* TODO: check other events */
@@ -485,7 +487,7 @@ static int radeon_atcs_verify_interface(acpi_handle handle,
        size = *(u16 *) info->buffer.pointer;
        if (size < 8) {
-                DRM_INFO("ATCS buffer is too small: %lu\n", size);
+                DRM_INFO("ATCS buffer is too small: %zu\n", size);
                err = -EINVAL;
                goto out;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 582e99449c12..1aa3f910b993 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -148,7 +148,7 @@ static int radeon_atpx_verify_interface(struct radeon_atpx *atpx)
        size = *(u16 *) info->buffer.pointer;
        if (size < 8) {
-                printk("ATPX buffer is too small: %lu\n", size);
+                printk("ATPX buffer is too small: %zu\n", size);
                err = -EINVAL;
                goto out;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index cb7b7c062fef..41672cc563fb 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -478,6 +478,7 @@ static int radeon_cs_ib_vm_chunk(struct radeon_device *rdev,
        }
 out:
+        radeon_vm_add_to_lru(rdev, vm);
        mutex_unlock(&vm->mutex);
        mutex_unlock(&rdev->vm_manager.lock);
        return r;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 64a42647f08a..bd13ca09eb62 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1018,6 +1018,10 @@ int radeon_device_init(struct radeon_device *rdev,
                return r;
        /* initialize vm here */
        mutex_init(&rdev->vm_manager.lock);
+        /* Adjust VM size here.
+         * Currently set to 4GB ((1 << 20) 4k pages).
+         * Max GPUVM size for cayman and SI is 40 bits.
+         */
        rdev->vm_manager.max_pfn = 1 << 20;
        INIT_LIST_HEAD(&rdev->vm_manager.lru_vm);
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index f0c06d196b75..a7677dd1ce98 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -423,6 +423,18 @@ void radeon_gart_fini(struct radeon_device *rdev)
 */
 /**
+ * radeon_vm_num_pde - return the number of page directory entries
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Calculate the number of page directory entries (cayman+).
+ */
+static unsigned radeon_vm_num_pdes(struct radeon_device *rdev)
+{
+        return rdev->vm_manager.max_pfn >> RADEON_VM_BLOCK_SIZE;
+}
+/**
 * radeon_vm_directory_size - returns the size of the page directory in bytes
 *
 * @rdev: radeon_device pointer
@@ -431,7 +443,7 @@ void radeon_gart_fini(struct radeon_device *rdev)
 */
 static unsigned radeon_vm_directory_size(struct radeon_device *rdev)
 {
-        return (rdev->vm_manager.max_pfn >> RADEON_VM_BLOCK_SIZE) * 8;
+        return RADEON_GPU_PAGE_ALIGN(radeon_vm_num_pdes(rdev) * 8);
 }
 /**
@@ -451,11 +463,11 @@ int radeon_vm_manager_init(struct radeon_device *rdev)
        if (!rdev->vm_manager.enabled) {
                /* allocate enough for 2 full VM pts */
-                size = RADEON_GPU_PAGE_ALIGN(radeon_vm_directory_size(rdev));
+                size = radeon_vm_directory_size(rdev);
-                size += RADEON_GPU_PAGE_ALIGN(rdev->vm_manager.max_pfn * 8);
+                size += rdev->vm_manager.max_pfn * 8;
                size *= 2;
                r = radeon_sa_bo_manager_init(rdev, &rdev->vm_manager.sa_manager,
-                                              size,
+                                              RADEON_GPU_PAGE_ALIGN(size),
                                              RADEON_GEM_DOMAIN_VRAM);
                if (r) {
                        dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
@@ -476,7 +488,7 @@ int radeon_vm_manager_init(struct radeon_device *rdev)
        /* restore page table */
        list_for_each_entry(vm, &rdev->vm_manager.lru_vm, list) {
-                if (vm->sa_bo == NULL)
+                if (vm->page_directory == NULL)
                        continue;
                list_for_each_entry(bo_va, &vm->va, vm_list) {
@@ -500,16 +512,25 @@ static void radeon_vm_free_pt(struct radeon_device *rdev,
                                    struct radeon_vm *vm)
 {
        struct radeon_bo_va *bo_va;
+        int i;
-        if (!vm->sa_bo)
+        if (!vm->page_directory)
                return;
        list_del_init(&vm->list);
-        radeon_sa_bo_free(rdev, &vm->sa_bo, vm->fence);
+        radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
        list_for_each_entry(bo_va, &vm->va, vm_list) {
                bo_va->valid = false;
        }
+        if (vm->page_tables == NULL)
+                return;
+        for (i = 0; i < radeon_vm_num_pdes(rdev); i++)
+                radeon_sa_bo_free(rdev, &vm->page_tables[i], vm->fence);
+        kfree(vm->page_tables);
 }
 /**
@@ -546,63 +567,106 @@ void radeon_vm_manager_fini(struct radeon_device *rdev)
 }
 /**
+ * radeon_vm_evict - evict page table to make room for new one
+ *
+ * @rdev: radeon_device pointer
+ * @vm: VM we want to allocate something for
+ *
+ * Evict a VM from the lru, making sure that it isn't @vm. (cayman+).
+ * Returns 0 for success, -ENOMEM for failure.
+ *
+ * Global and local mutex must be locked!
+ */
+int radeon_vm_evict(struct radeon_device *rdev, struct radeon_vm *vm)
+{
+        struct radeon_vm *vm_evict;
+        if (list_empty(&rdev->vm_manager.lru_vm))
+                return -ENOMEM;
+        vm_evict = list_first_entry(&rdev->vm_manager.lru_vm,
+                                    struct radeon_vm, list);
+        if (vm_evict == vm)
+                return -ENOMEM;
+        mutex_lock(&vm_evict->mutex);
+        radeon_vm_free_pt(rdev, vm_evict);
+        mutex_unlock(&vm_evict->mutex);
+        return 0;
+}
+/**
 * radeon_vm_alloc_pt - allocates a page table for a VM
 *
 * @rdev: radeon_device pointer
 * @vm: vm to bind
 *
 * Allocate a page table for the requested vm (cayman+).
- * Also starts to populate the page table.
 * Returns 0 for success, error for failure.
 *
 * Global and local mutex must be locked!
 */
 int radeon_vm_alloc_pt(struct radeon_device *rdev, struct radeon_vm *vm)
 {
-        struct radeon_vm *vm_evict;
+        unsigned pd_size, pts_size;
-        int r;
        u64 *pd_addr;
-        int tables_size;
+        int r;
        if (vm == NULL) {
                return -EINVAL;
        }
-        /* allocate enough to cover the current VM size */
+        if (vm->page_directory != NULL) {
-        tables_size = RADEON_GPU_PAGE_ALIGN(radeon_vm_directory_size(rdev));
-        tables_size += RADEON_GPU_PAGE_ALIGN(vm->last_pfn * 8);
-        if (vm->sa_bo != NULL) {
-                /* update lru */
-                list_del_init(&vm->list);
-                list_add_tail(&vm->list, &rdev->vm_manager.lru_vm);
                return 0;
        }
 retry:
-        r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager, &vm->sa_bo,
+        pd_size = RADEON_GPU_PAGE_ALIGN(radeon_vm_directory_size(rdev));
-                             tables_size, RADEON_GPU_PAGE_SIZE, false);
+        r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager,
+                             &vm->page_directory, pd_size,
+                             RADEON_GPU_PAGE_SIZE, false);
        if (r == -ENOMEM) {
-                if (list_empty(&rdev->vm_manager.lru_vm)) {
+                r = radeon_vm_evict(rdev, vm);
+                if (r)
                        return r;
-                }
-                vm_evict = list_first_entry(&rdev->vm_manager.lru_vm, struct radeon_vm, list);
-                mutex_lock(&vm_evict->mutex);
-                radeon_vm_free_pt(rdev, vm_evict);
-                mutex_unlock(&vm_evict->mutex);
                goto retry;
        } else if (r) {
                return r;
        }
-        pd_addr = radeon_sa_bo_cpu_addr(vm->sa_bo);
+        vm->pd_gpu_addr = radeon_sa_bo_gpu_addr(vm->page_directory);
-        vm->pd_gpu_addr = radeon_sa_bo_gpu_addr(vm->sa_bo);
-        memset(pd_addr, 0, tables_size);
+        /* Initially clear the page directory */
+        pd_addr = radeon_sa_bo_cpu_addr(vm->page_directory);
+        memset(pd_addr, 0, pd_size);
+        pts_size = radeon_vm_num_pdes(rdev) * sizeof(struct radeon_sa_bo *);
+        vm->page_tables = kzalloc(pts_size, GFP_KERNEL);
+        if (vm->page_tables == NULL) {
+                DRM_ERROR("Cannot allocate memory for page table array\n");
+                radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
+                return -ENOMEM;
+        }
+        return 0;
+}
+/**
+ * radeon_vm_add_to_lru - add VMs page table to LRU list
+ *
+ * @rdev: radeon_device pointer
+ * @vm: vm to add to LRU
+ *
+ * Add the allocated page table to the LRU list (cayman+).
+ *
+ * Global mutex must be locked!
+ */
+void radeon_vm_add_to_lru(struct radeon_device *rdev, struct radeon_vm *vm)
+{
+        list_del_init(&vm->list);
        list_add_tail(&vm->list, &rdev->vm_manager.lru_vm);
-        return radeon_vm_bo_update_pte(rdev, vm, rdev->ring_tmp_bo.bo,
-                                       &rdev->ring_tmp_bo.bo->tbo.mem);
 }
 /**
@@ -793,20 +857,6 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
        }
        mutex_lock(&vm->mutex);
-        if (last_pfn > vm->last_pfn) {
-                /* release mutex and lock in right order */
-                mutex_unlock(&vm->mutex);
-                mutex_lock(&rdev->vm_manager.lock);
-                mutex_lock(&vm->mutex);
-                /* and check again */
-                if (last_pfn > vm->last_pfn) {
-                        /* grow va space 32M by 32M */
-                        unsigned align = ((32 << 20) >> 12) - 1;
-                        radeon_vm_free_pt(rdev, vm);
-                        vm->last_pfn = (last_pfn + align) & ~align;
-                }
-                mutex_unlock(&rdev->vm_manager.lock);
-        }
        head = &vm->va;
        last_offset = 0;
        list_for_each_entry(tmp, &vm->va, vm_list) {
@@ -865,6 +915,155 @@ uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr)
 }
 /**
+ * radeon_vm_update_pdes - make sure that page directory is valid
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @start: start of GPU address range
+ * @end: end of GPU address range
+ *
+ * Allocates new page tables if necessary
+ * and updates the page directory (cayman+).
+ * Returns 0 for success, error for failure.
+ *
+ * Global and local mutex must be locked!
+ */
+static int radeon_vm_update_pdes(struct radeon_device *rdev,
+                                 struct radeon_vm *vm,
+                                 uint64_t start, uint64_t end)
+{
+        static const uint32_t incr = RADEON_VM_PTE_COUNT * 8;
+        uint64_t last_pde = ~0, last_pt = ~0;
+        unsigned count = 0;
+        uint64_t pt_idx;
+        int r;
+        start = (start / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
+        end = (end / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
+        /* walk over the address space and update the page directory */
+        for (pt_idx = start; pt_idx <= end; ++pt_idx) {
+                uint64_t pde, pt;
+                if (vm->page_tables[pt_idx])
+                        continue;
+retry:
+                r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager,
+                                     &vm->page_tables[pt_idx],
+                                     RADEON_VM_PTE_COUNT * 8,
+                                     RADEON_GPU_PAGE_SIZE, false);
+                if (r == -ENOMEM) {
+                        r = radeon_vm_evict(rdev, vm);
+                        if (r)
+                                return r;
+                        goto retry;
+                } else if (r) {
+                        return r;
+                }
+                pde = vm->pd_gpu_addr + pt_idx * 8;
+                pt = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
+                if (((last_pde + 8 * count) != pde) ||
+                    ((last_pt + incr * count) != pt)) {
+                        if (count) {
+                                radeon_asic_vm_set_page(rdev, last_pde,
+                                                        last_pt, count, incr,
+                                                        RADEON_VM_PAGE_VALID);
+                        }
+                        count = 1;
+                        last_pde = pde;
+                        last_pt = pt;
+                } else {
+                        ++count;
+                }
+        }
+        if (count) {
+                radeon_asic_vm_set_page(rdev, last_pde, last_pt, count,
+                                        incr, RADEON_VM_PAGE_VALID);
+        }
+        return 0;
+}
+/**
+ * radeon_vm_update_ptes - make sure that page tables are valid
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @start: start of GPU address range
+ * @end: end of GPU address range
+ * @dst: destination address to map to
+ * @flags: mapping flags
+ *
+ * Update the page tables in the range @start - @end (cayman+).
+ *
+ * Global and local mutex must be locked!
+ */
+static void radeon_vm_update_ptes(struct radeon_device *rdev,
+                                  struct radeon_vm *vm,
+                                  uint64_t start, uint64_t end,
+                                  uint64_t dst, uint32_t flags)
+{
+        static const uint64_t mask = RADEON_VM_PTE_COUNT - 1;
+        uint64_t last_pte = ~0, last_dst = ~0;
+        unsigned count = 0;
+        uint64_t addr;
+        start = start / RADEON_GPU_PAGE_SIZE;
+        end = end / RADEON_GPU_PAGE_SIZE;
+        /* walk over the address space and update the page tables */
+        for (addr = start; addr < end; ) {
+                uint64_t pt_idx = addr >> RADEON_VM_BLOCK_SIZE;
+                unsigned nptes;
+                uint64_t pte;
+                if ((addr & ~mask) == (end & ~mask))
+                        nptes = end - addr;
+                else
+                        nptes = RADEON_VM_PTE_COUNT - (addr & mask);
+                pte = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
+                pte += (addr & mask) * 8;
+                if (((last_pte + 8 * count) != pte) ||
+                    ((count + nptes) > 1 << 11)) {
+                        if (count) {
+                                radeon_asic_vm_set_page(rdev, last_pte,
+                                                        last_dst, count,
+                                                        RADEON_GPU_PAGE_SIZE,
+                                                        flags);
+                        }
+                        count = nptes;
+                        last_pte = pte;
+                        last_dst = dst;
+                } else {
+                        count += nptes;
+                }
+                addr += nptes;
+                dst += nptes * RADEON_GPU_PAGE_SIZE;
+        }
+        if (count) {
+                radeon_asic_vm_set_page(rdev, last_pte, last_dst, count,
+                                        RADEON_GPU_PAGE_SIZE, flags);
+        }
+}
+/**
 * radeon_vm_bo_update_pte - map a bo into the vm page table
 *
 * @rdev: radeon_device pointer
@@ -887,12 +1086,11 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
        struct radeon_semaphore *sem = NULL;
        struct radeon_bo_va *bo_va;
        unsigned nptes, npdes, ndw;
-        uint64_t pe, addr;
+        uint64_t addr;
-        uint64_t pfn;
        int r;
        /* nothing to do if vm isn't bound */
-        if (vm->sa_bo == NULL)
+        if (vm->page_directory == NULL)
                return 0;
        bo_va = radeon_vm_bo_find(vm, bo);
@@ -939,25 +1137,29 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                }
        }
-        /* estimate number of dw needed */
-        /* reserve space for 32-bit padding */
-        ndw = 32;
        nptes = radeon_bo_ngpu_pages(bo);
-        pfn = (bo_va->soffset / RADEON_GPU_PAGE_SIZE);
+        /* assume two extra pdes in case the mapping overlaps the borders */
+        npdes = (nptes >> RADEON_VM_BLOCK_SIZE) + 2;
-        /* handle cases where a bo spans several pdes  */
+        /* estimate number of dw needed */
-        npdes = (ALIGN(pfn + nptes, RADEON_VM_PTE_COUNT) -
+        /* semaphore, fence and padding */
-                 (pfn & ~(RADEON_VM_PTE_COUNT - 1))) >> RADEON_VM_BLOCK_SIZE;
+        ndw = 32;
+        if (RADEON_VM_BLOCK_SIZE > 11)
+                /* reserve space for one header for every 2k dwords */
+                ndw += (nptes >> 11) * 3;
+        else
+                /* reserve space for one header for
+                    every (1 << BLOCK_SIZE) entries */
+                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 3;
-        /* reserve space for one header for every 2k dwords */
-        ndw += (nptes >> 11) * 3;
        /* reserve space for pte addresses */
        ndw += nptes * 2;
        /* reserve space for one header for every 2k dwords */
        ndw += (npdes >> 11) * 3;
        /* reserve space for pde addresses */
        ndw += npdes * 2;
@@ -971,22 +1173,14 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                radeon_fence_note_sync(vm->fence, ridx);
        }
-        /* update page table entries */
+        r = radeon_vm_update_pdes(rdev, vm, bo_va->soffset, bo_va->eoffset);
-        pe = vm->pd_gpu_addr;
+        if (r) {
-        pe += radeon_vm_directory_size(rdev);
+                radeon_ring_unlock_undo(rdev, ring);
-        pe += (bo_va->soffset / RADEON_GPU_PAGE_SIZE) * 8;
+                return r;
+        }
-        radeon_asic_vm_set_page(rdev, pe, addr, nptes,
-                                RADEON_GPU_PAGE_SIZE, bo_va->flags);
-        /* update page directory entries */
-        addr = pe;
-        pe = vm->pd_gpu_addr;
-        pe += ((bo_va->soffset / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE) * 8;
-        radeon_asic_vm_set_page(rdev, pe, addr, npdes,
+        radeon_vm_update_ptes(rdev, vm, bo_va->soffset, bo_va->eoffset,
-                                RADEON_VM_PTE_COUNT * 8, RADEON_VM_PAGE_VALID);
+                              addr, bo_va->flags);
        radeon_fence_unref(&vm->fence);
        r = radeon_fence_emit(rdev, &vm->fence, ridx);
@@ -997,6 +1191,7 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
        radeon_ring_unlock_commit(rdev, ring);
        radeon_semaphore_free(rdev, &sem, vm->fence);
        radeon_fence_unref(&vm->last_flush);
        return 0;
 }
@@ -1056,31 +1251,15 @@ void radeon_vm_bo_invalidate(struct radeon_device *rdev,
 * @rdev: radeon_device pointer
 * @vm: requested vm
 *
- * Init @vm (cayman+).
+ * Init @vm fields (cayman+).
- * Map the IB pool and any other shared objects into the VM
- * by default as it's used by all VMs.
- * Returns 0 for success, error for failure.
 */
-int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
+void radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
 {
-        struct radeon_bo_va *bo_va;
-        int r;
        vm->id = 0;
        vm->fence = NULL;
-        vm->last_pfn = 0;
        mutex_init(&vm->mutex);
        INIT_LIST_HEAD(&vm->list);
        INIT_LIST_HEAD(&vm->va);
-        /* map the ib pool buffer at 0 in virtual address space, set
-         * read only
-         */
-        bo_va = radeon_vm_bo_add(rdev, vm, rdev->ring_tmp_bo.bo);
-        r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
-                                  RADEON_VM_PAGE_READABLE |
-                                  RADEON_VM_PAGE_SNOOPED);
-        return r;
 }
 /**
@@ -1102,17 +1281,6 @@ void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
        radeon_vm_free_pt(rdev, vm);
        mutex_unlock(&rdev->vm_manager.lock);
-        /* remove all bo at this point non are busy any more because unbind
-         * waited for the last vm fence to signal
-         */
-        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
-        if (!r) {
-                bo_va = radeon_vm_bo_find(vm, rdev->ring_tmp_bo.bo);
-                list_del_init(&bo_va->bo_list);
-                list_del_init(&bo_va->vm_list);
-                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
-                kfree(bo_va);
-        }
        if (!list_empty(&vm->va)) {
                dev_err(rdev->dev, "still active bo inside vm\n");
        }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 83b8d8aa71c0..dc781c49b96b 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -419,6 +419,7 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
        /* new gpu have virtual address space support */
        if (rdev->family >= CHIP_CAYMAN) {
                struct radeon_fpriv *fpriv;
+                struct radeon_bo_va *bo_va;
                int r;
                fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
@@ -426,7 +427,15 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                        return -ENOMEM;
                }
-                r = radeon_vm_init(rdev, &fpriv->vm);
+                radeon_vm_init(rdev, &fpriv->vm);
+                /* map the ib pool buffer read only into
+                 * virtual address space */
+                bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
+                                         rdev->ring_tmp_bo.bo);
+                r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
+                                          RADEON_VM_PAGE_READABLE |
+                                          RADEON_VM_PAGE_SNOOPED);
                if (r) {
                        radeon_vm_fini(rdev, &fpriv->vm);
                        kfree(fpriv);
@@ -454,6 +463,17 @@ void radeon_driver_postclose_kms(struct drm_device *dev,
        /* new gpu have virtual address space support */
        if (rdev->family >= CHIP_CAYMAN && file_priv->driver_priv) {
                struct radeon_fpriv *fpriv = file_priv->driver_priv;
+                struct radeon_bo_va *bo_va;
+                int r;
+                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                if (!r) {
+                        bo_va = radeon_vm_bo_find(&fpriv->vm,
+                                                  rdev->ring_tmp_bo.bo);
+                        if (bo_va)
+                                radeon_vm_bo_rmv(rdev, bo_va);
+                        radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                }
                radeon_vm_fini(rdev, &fpriv->vm);
                kfree(fpriv);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 92487e614778..a13ad9d707cf 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -269,27 +269,6 @@ static const struct drm_encoder_helper_funcs radeon_legacy_lvds_helper_funcs = {
        .disable = radeon_legacy_encoder_disable,
 };
-#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
-static uint8_t radeon_legacy_lvds_level(struct backlight_device *bd)
-{
-        struct radeon_backlight_privdata *pdata = bl_get_data(bd);
-        uint8_t level;
-        /* Convert brightness to hardware level */
-        if (bd->props.brightness < 0)
-                level = 0;
-        else if (bd->props.brightness > RADEON_MAX_BL_LEVEL)
-                level = RADEON_MAX_BL_LEVEL;
-        else
-                level = bd->props.brightness;
-        if (pdata->negative)
-                level = RADEON_MAX_BL_LEVEL - level;
-        return level;
-}
 u8
 radeon_legacy_get_backlight_level(struct radeon_encoder *radeon_encoder)
 {
@@ -331,6 +310,27 @@ radeon_legacy_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 leve
        radeon_legacy_lvds_update(&radeon_encoder->base, dpms_mode);
 }
+#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
+static uint8_t radeon_legacy_lvds_level(struct backlight_device *bd)
+{
+        struct radeon_backlight_privdata *pdata = bl_get_data(bd);
+        uint8_t level;
+        /* Convert brightness to hardware level */
+        if (bd->props.brightness < 0)
+                level = 0;
+        else if (bd->props.brightness > RADEON_MAX_BL_LEVEL)
+                level = RADEON_MAX_BL_LEVEL;
+        else
+                level = bd->props.brightness;
+        if (pdata->negative)
+                level = RADEON_MAX_BL_LEVEL - level;
+        return level;
+}
 static int radeon_legacy_backlight_update_status(struct backlight_device *bd)
 {
        struct radeon_backlight_privdata *pdata = bl_get_data(bd);
@@ -991,11 +991,7 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder,
 static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder)
 {
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-        struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
+        /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */
-        if (tmds) {
-                if (tmds->i2c_bus)
-                        radeon_i2c_destroy(tmds->i2c_bus);
-        }
        kfree(radeon_encoder->enc_priv);
        drm_encoder_cleanup(encoder);
        kfree(radeon_encoder);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index bba66902c83b..47634f27f2e5 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -305,7 +305,7 @@ void radeon_ring_write(struct radeon_ring *ring, uint32_t v)
 {
 #if DRM_DEBUG_CODE
        if (ring->count_dw <= 0) {
-                DRM_ERROR("radeon: writting more dword to ring than expected !\n");
+                DRM_ERROR("radeon: writing more dwords to the ring than expected!\n");
        }
 #endif
        ring->ring[ring->wptr++] = v;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index f79633a036c3..df8dd7701643 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2407,12 +2407,13 @@ static int si_pcie_gart_enable(struct radeon_device *rdev)
        WREG32(0x15DC, 0);
        /* empty context1-15 */
-        /* FIXME start with 4G, once using 2 level pt switch to full
-         * vm size space
-         */
        /* set vm size, must be a multiple of 4 */
        WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
        WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
+        /* Assign the pt base to something valid for now; the pts used for
+         * the VMs are determined by the application and setup and assigned
+         * on the fly in the vm part of radeon_gart.c
+         */
        for (i = 1; i < 16; i++) {
                if (i < 8)
                        WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b721902bb6b4..b2530b002125 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1519,7 +1519,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        /* no need to lock since we're protected by rtnl_lock */
        if (slave_dev->features & NETIF_F_VLAN_CHALLENGED) {
                pr_debug("%s: NETIF_F_VLAN_CHALLENGED\n", slave_dev->name);
-                if (bond_vlan_used(bond)) {
+                if (vlan_uses_dev(bond_dev)) {
                        pr_err("%s: Error: cannot enslave VLAN challenged slave %s on VLAN enabled bond %s\n",
                               bond_dev->name, slave_dev->name, bond_dev->name);
                        return -EPERM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 24220992413f..4833b6a9031c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2957,9 +2957,13 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        skb_shinfo(skb)->nr_frags +
                        BDS_PER_TX_PKT +
                        NEXT_CNT_PER_TX_PKT(MAX_BDS_PER_TX_PKT))) {
-                bnx2x_fp_qstats(bp, txdata->parent_fp)->driver_xoff++;
+                /* Handle special storage cases separately */
-                netif_tx_stop_queue(txq);
+                if (txdata->tx_ring_size != 0) {
-                BNX2X_ERR("BUG! Tx ring full when queue awake!\n");
+                        BNX2X_ERR("BUG! Tx ring full when queue awake!\n");
+                        bnx2x_fp_qstats(bp, txdata->parent_fp)->driver_xoff++;
+                        netif_tx_stop_queue(txq);
+                }
                return NETDEV_TX_BUSY;
        }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 71971a161bd1..614981c02264 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -126,7 +126,7 @@ static inline int bnx2x_exe_queue_add(struct bnx2x *bp,
                /* Check if this request is ok */
                rc = o->validate(bp, o->owner, elem);
                if (rc) {
-                        BNX2X_ERR("Preamble failed: %d\n", rc);
+                        DP(BNX2X_MSG_SP, "Preamble failed: %d\n", rc);
                        goto free_and_exit;
                }
        }
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 983bbf4d5ef6..961f0b293913 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -15,6 +15,11 @@ if PHYLIB
 comment "MII PHY device drivers"
+config AT803X_PHY
+        tristate "Drivers for Atheros AT803X PHYs"
+        ---help---
+          Currently supports the AT8030 and AT8035 model
 config AMD_PHY
        tristate "Drivers for the AMD PHYs"
        ---help---
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 426674debae4..9645e389a58d 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -25,6 +25,7 @@ obj-$(CONFIG_STE10XP)		+= ste10Xp.o
 obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
 obj-$(CONFIG_MICREL_KS8995MA)   += spi_ks8995.o
+obj-$(CONFIG_AT803X_PHY)        += at803x.o
 obj-$(CONFIG_AMD_PHY)           += amd.o
 obj-$(CONFIG_MDIO_BUS_MUX)      += mdio-mux.o
 obj-$(CONFIG_MDIO_BUS_MUX_GPIO) += mdio-mux-gpio.o
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
new file mode 100644
index 000000000000..45cbc10de01c
--- /dev/null
+++ b/drivers/net/phy/at803x.c
@@ -0,0 +1,176 @@
+/*
+ * drivers/net/phy/at803x.c
+ *
+ * Driver for Atheros 803x PHY
+ *
+ * Author: Matus Ujhelyi <ujhelyi.m@gmail.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/phy.h>
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#define AT803X_INTR_ENABLE                      0x12
+#define AT803X_INTR_STATUS                      0x13
+#define AT803X_WOL_ENABLE                       0x01
+#define AT803X_DEVICE_ADDR                      0x03
+#define AT803X_LOC_MAC_ADDR_0_15_OFFSET         0x804C
+#define AT803X_LOC_MAC_ADDR_16_31_OFFSET        0x804B
+#define AT803X_LOC_MAC_ADDR_32_47_OFFSET        0x804A
+#define AT803X_MMD_ACCESS_CONTROL               0x0D
+#define AT803X_MMD_ACCESS_CONTROL_DATA          0x0E
+#define AT803X_FUNC_DATA                        0x4003
+MODULE_DESCRIPTION("Atheros 803x PHY driver");
+MODULE_AUTHOR("Matus Ujhelyi");
+MODULE_LICENSE("GPL");
+static void at803x_set_wol_mac_addr(struct phy_device *phydev)
+{
+        struct net_device *ndev = phydev->attached_dev;
+        const u8 *mac;
+        unsigned int i, offsets[] = {
+                AT803X_LOC_MAC_ADDR_32_47_OFFSET,
+                AT803X_LOC_MAC_ADDR_16_31_OFFSET,
+                AT803X_LOC_MAC_ADDR_0_15_OFFSET,
+        };
+        if (!ndev)
+                return;
+        mac = (const u8 *) ndev->dev_addr;
+        if (!is_valid_ether_addr(mac))
+                return;
+        for (i = 0; i < 3; i++) {
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL,
+                                  AT803X_DEVICE_ADDR);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL_DATA,
+                                  offsets[i]);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL,
+                                  AT803X_FUNC_DATA);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL_DATA,
+                                  mac[(i * 2) + 1] | (mac[(i * 2)] << 8));
+        }
+}
+static int at803x_config_init(struct phy_device *phydev)
+{
+        int val;
+        u32 features;
+        int status;
+        features = SUPPORTED_TP | SUPPORTED_MII | SUPPORTED_AUI |
+                   SUPPORTED_FIBRE | SUPPORTED_BNC;
+        val = phy_read(phydev, MII_BMSR);
+        if (val < 0)
+                return val;
+        if (val & BMSR_ANEGCAPABLE)
+                features |= SUPPORTED_Autoneg;
+        if (val & BMSR_100FULL)
+                features |= SUPPORTED_100baseT_Full;
+        if (val & BMSR_100HALF)
+                features |= SUPPORTED_100baseT_Half;
+        if (val & BMSR_10FULL)
+                features |= SUPPORTED_10baseT_Full;
+        if (val & BMSR_10HALF)
+                features |= SUPPORTED_10baseT_Half;
+        if (val & BMSR_ESTATEN) {
+                val = phy_read(phydev, MII_ESTATUS);
+                if (val < 0)
+                        return val;
+                if (val & ESTATUS_1000_TFULL)
+                        features |= SUPPORTED_1000baseT_Full;
+                if (val & ESTATUS_1000_THALF)
+                        features |= SUPPORTED_1000baseT_Half;
+        }
+        phydev->supported = features;
+        phydev->advertising = features;
+        /* enable WOL */
+        at803x_set_wol_mac_addr(phydev);
+        status = phy_write(phydev, AT803X_INTR_ENABLE, AT803X_WOL_ENABLE);
+        status = phy_read(phydev, AT803X_INTR_STATUS);
+        return 0;
+}
+/* ATHEROS 8035 */
+static struct phy_driver at8035_driver = {
+        .phy_id         = 0x004dd072,
+        .name           = "Atheros 8035 ethernet",
+        .phy_id_mask    = 0xffffffef,
+        .config_init    = at803x_config_init,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .driver         = {
+                .owner = THIS_MODULE,
+        },
+};
+/* ATHEROS 8030 */
+static struct phy_driver at8030_driver = {
+        .phy_id         = 0x004dd076,
+        .name           = "Atheros 8030 ethernet",
+        .phy_id_mask    = 0xffffffef,
+        .config_init    = at803x_config_init,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .driver         = {
+                .owner = THIS_MODULE,
+        },
+};
+static int __init atheros_init(void)
+{
+        int ret;
+        ret = phy_driver_register(&at8035_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&at8030_driver);
+        if (ret)
+                goto err2;
+        return 0;
+err2:
+        phy_driver_unregister(&at8035_driver);
+err1:
+        return ret;
+}
+static void __exit atheros_exit(void)
+{
+        phy_driver_unregister(&at8035_driver);
+        phy_driver_unregister(&at8030_driver);
+}
+module_init(atheros_init);
+module_exit(atheros_exit);
+static struct mdio_device_id __maybe_unused atheros_tbl[] = {
+        { 0x004dd076, 0xffffffef },
+        { 0x004dd072, 0xffffffef },
+        { }
+};
+MODULE_DEVICE_TABLE(mdio, atheros_tbl);
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index a28a983d465e..534d8becbbdc 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -62,6 +62,7 @@
 #define USB_PRODUCT_IPAD 0x129a
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define USB_PRODUCT_IPHONE_4S   0x12a0
+#define USB_PRODUCT_IPHONE_5    0x12a8
 #define IPHETH_USBINTF_CLASS    255
 #define IPHETH_USBINTF_SUBCLASS 253
@@ -113,6 +114,10 @@ static struct usb_device_id ipheth_table[] = {
                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4S,
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_5,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
        { }
 };
 MODULE_DEVICE_TABLE(usb, ipheth_table);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6883c371c59f..9d23ba2fe981 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -371,16 +371,57 @@ static const struct usb_device_id products[] = {
        },
        /* 3. Combined interface devices matching on interface number */
+        {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0021, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0025, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0031, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0042, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0049, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0052, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x0055, 1)},    /* ZTE (Vodafone) K3520-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0058, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x0063, 4)},    /* ZTE (Vodafone) K3565-Z */
        {QMI_FIXED_INTF(0x19d2, 0x0104, 4)},    /* ZTE (Vodafone) K4505-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0113, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0118, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0121, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0123, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0124, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0125, 6)},
+        {QMI_FIXED_INTF(0x19d2, 0x0126, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0130, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0133, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0141, 5)},
        {QMI_FIXED_INTF(0x19d2, 0x0157, 5)},    /* ZTE MF683 */
+        {QMI_FIXED_INTF(0x19d2, 0x0158, 3)},
        {QMI_FIXED_INTF(0x19d2, 0x0167, 4)},    /* ZTE MF820D */
+        {QMI_FIXED_INTF(0x19d2, 0x0168, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0176, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0178, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0191, 4)},    /* ZTE EuFi890 */
+        {QMI_FIXED_INTF(0x19d2, 0x0199, 1)},    /* ZTE MF820S */
+        {QMI_FIXED_INTF(0x19d2, 0x0200, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0257, 3)},    /* ZTE MF821 */
        {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
        {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
        {QMI_FIXED_INTF(0x19d2, 0x1010, 4)},    /* ZTE (Vodafone) K3571-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1012, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x1018, 3)},    /* ZTE (Vodafone) K5006-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1021, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1245, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1247, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1252, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1254, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1255, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1402, 2)},    /* ZTE MF60 */
+        {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1426, 2)},    /* ZTE MF91 */
        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
        {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/pinctrl/pinctrl-bcm2835.c b/drivers/pinctrl/pinctrl-bcm2835.c
index a4adee633fa9..7e9be18ec2d2 100644
--- a/drivers/pinctrl/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/pinctrl-bcm2835.c
@@ -29,7 +29,6 @@
 #include <linux/irq.h>
 #include <linux/irqdesc.h>
 #include <linux/irqdomain.h>
-#include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/of_address.h>
 #include <linux/of.h>
@@ -960,7 +959,7 @@ static int __devinit bcm2835_pinctrl_probe(struct platform_device *pdev)
                return err;
        }
-        pc->base = devm_request_and_ioremap(&pdev->dev, &iomem);
+        pc->base = devm_request_and_ioremap(dev, &iomem);
        if (!pc->base)
                return -EADDRNOTAVAIL;
@@ -1032,7 +1031,7 @@ static int __devinit bcm2835_pinctrl_probe(struct platform_device *pdev)
        pc->pctl_dev = pinctrl_register(&bcm2835_pinctrl_desc, dev, pc);
        if (!pc->pctl_dev) {
                gpiochip_remove(&pc->gpio_chip);
-                return PTR_ERR(pc->pctl_dev);
+                return -EINVAL;
        }
        pc->gpio_range = bcm2835_pinctrl_gpio_range;
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index fec9c30133d4..01aea1c3b5fa 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -30,7 +30,20 @@
 #include <linux/pinctrl/pinconf.h>
 /* Since we request GPIOs from ourself */
 #include <linux/pinctrl/consumer.h>
+/*
+ * For the U8500 archs, use the PRCMU register interface, for the older
+ * Nomadik, provide some stubs. The functions using these will only be
+ * called on the U8500 series.
+ */
+#ifdef CONFIG_ARCH_U8500
 #include <linux/mfd/dbx500-prcmu.h>
+#else
+static inline u32 prcmu_read(unsigned int reg) {
+        return 0;
+}
+static inline void prcmu_write(unsigned int reg, u32 value) {}
+static inline void prcmu_write_masked(unsigned int reg, u32 mask, u32 value) {}
+#endif
 #include <asm/mach/irq.h>
@@ -1268,6 +1281,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
        struct clk *clk;
        int secondary_irq;
        void __iomem *base;
+        int irq_start = -1;
        int irq;
        int ret;
@@ -1371,19 +1385,11 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
        platform_set_drvdata(dev, nmk_chip);
-        if (np) {
+        if (!np)
-                /* The DT case will just grab a set of IRQ numbers */
-                nmk_chip->domain = irq_domain_add_linear(np, NMK_GPIO_PER_CHIP,
-                                &nmk_gpio_irq_simple_ops, nmk_chip);
-        } else {
-                /* Non-DT legacy mode, use hardwired IRQ numbers */
-                int irq_start;
                irq_start = NOMADIK_GPIO_TO_IRQ(pdata->first_gpio);
-                nmk_chip->domain = irq_domain_add_simple(NULL,
+        nmk_chip->domain = irq_domain_add_simple(NULL,
                                NMK_GPIO_PER_CHIP, irq_start,
                                &nmk_gpio_irq_simple_ops, nmk_chip);
-        }
        if (!nmk_chip->domain) {
                dev_err(&dev->dev, "failed to create irqdomain\n");
                ret = -ENOSYS;
diff --git a/drivers/pinctrl/pinctrl-samsung.c b/drivers/pinctrl/pinctrl-samsung.c
index dd108a94acf9..861cd5f04d5e 100644
--- a/drivers/pinctrl/pinctrl-samsung.c
+++ b/drivers/pinctrl/pinctrl-samsung.c
@@ -513,7 +513,7 @@ static int samsung_gpio_direction_output(struct gpio_chip *gc, unsigned offset,
 * Parse the pin names listed in the 'samsung,pins' property and convert it
 * into a list of gpio numbers are create a pin group from it.
 */
-static int __init samsung_pinctrl_parse_dt_pins(struct platform_device *pdev,
+static int __devinit samsung_pinctrl_parse_dt_pins(struct platform_device *pdev,
                        struct device_node *cfg_np, struct pinctrl_desc *pctl,
                        unsigned int **pin_list, unsigned int *npins)
 {
@@ -560,7 +560,7 @@ static int __init samsung_pinctrl_parse_dt_pins(struct platform_device *pdev,
 * from device node of the pin-controller. A pin group is formed with all
 * the pins listed in the "samsung,pins" property.
 */
-static int __init samsung_pinctrl_parse_dt(struct platform_device *pdev,
+static int __devinit samsung_pinctrl_parse_dt(struct platform_device *pdev,
                                struct samsung_pinctrl_drv_data *drvdata)
 {
        struct device *dev = &pdev->dev;
@@ -655,7 +655,7 @@ static int __init samsung_pinctrl_parse_dt(struct platform_device *pdev,
 }
 /* register the pinctrl interface with the pinctrl subsystem */
-static int __init samsung_pinctrl_register(struct platform_device *pdev,
+static int __devinit samsung_pinctrl_register(struct platform_device *pdev,
                                struct samsung_pinctrl_drv_data *drvdata)
 {
        struct pinctrl_desc *ctrldesc = &drvdata->pctl;
@@ -729,7 +729,7 @@ static int __init samsung_pinctrl_register(struct platform_device *pdev,
 }
 /* register the gpiolib interface with the gpiolib subsystem */
-static int __init samsung_gpiolib_register(struct platform_device *pdev,
+static int __devinit samsung_gpiolib_register(struct platform_device *pdev,
                                struct samsung_pinctrl_drv_data *drvdata)
 {
        struct gpio_chip *gc;
@@ -762,7 +762,7 @@ static int __init samsung_gpiolib_register(struct platform_device *pdev,
 }
 /* unregister the gpiolib interface with the gpiolib subsystem */
-static int __init samsung_gpiolib_unregister(struct platform_device *pdev,
+static int __devinit samsung_gpiolib_unregister(struct platform_device *pdev,
                                struct samsung_pinctrl_drv_data *drvdata)
 {
        int ret = gpiochip_remove(drvdata->gc);
diff --git a/drivers/pinctrl/pinctrl-sirf.c b/drivers/pinctrl/pinctrl-sirf.c
index 675497c15149..9ecacf3d0a75 100644
--- a/drivers/pinctrl/pinctrl-sirf.c
+++ b/drivers/pinctrl/pinctrl-sirf.c
@@ -1323,41 +1323,6 @@ static inline struct sirfsoc_gpio_bank *sirfsoc_gpio_to_bank(unsigned int gpio)
        return &sgpio_bank[gpio / SIRFSOC_GPIO_BANK_SIZE];
 }
-void sirfsoc_gpio_set_pull(unsigned gpio, unsigned mode)
-{
-        struct sirfsoc_gpio_bank *bank = sirfsoc_gpio_to_bank(gpio);
-        int idx = sirfsoc_gpio_to_offset(gpio);
-        u32 val, offset;
-        unsigned long flags;
-        offset = SIRFSOC_GPIO_CTRL(bank->id, idx);
-        spin_lock_irqsave(&sgpio_lock, flags);
-        val = readl(bank->chip.regs + offset);
-        switch (mode) {
-        case SIRFSOC_GPIO_PULL_NONE:
-                val &= ~SIRFSOC_GPIO_CTL_PULL_MASK;
-                break;
-        case SIRFSOC_GPIO_PULL_UP:
-                val |= SIRFSOC_GPIO_CTL_PULL_MASK;
-                val |= SIRFSOC_GPIO_CTL_PULL_HIGH;
-                break;
-        case SIRFSOC_GPIO_PULL_DOWN:
-                val |= SIRFSOC_GPIO_CTL_PULL_MASK;
-                val &= ~SIRFSOC_GPIO_CTL_PULL_HIGH;
-                break;
-        default:
-                break;
-        }
-        writel(val, bank->chip.regs + offset);
-        spin_unlock_irqrestore(&sgpio_lock, flags);
-}
-EXPORT_SYMBOL(sirfsoc_gpio_set_pull);
 static inline struct sirfsoc_gpio_bank *sirfsoc_irqchip_to_bank(struct gpio_chip *chip)
 {
        return container_of(to_of_mm_gpio_chip(chip), struct sirfsoc_gpio_bank, chip);
diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
index f8d917d40c92..b9bcaec66223 100644
--- a/drivers/pinctrl/pinctrl-xway.c
+++ b/drivers/pinctrl/pinctrl-xway.c
@@ -17,8 +17,6 @@
 #include <linux/ioport.h>
 #include <linux/io.h>
 #include <linux/device.h>
-#include <linux/module.h>
-#include <linux/io.h>
 #include <linux/platform_device.h>
 #include "pinctrl-lantiq.h"
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 2db409330c21..e67e0258aec5 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1141,11 +1141,12 @@ static int qeth_l2_recover(void *ptr)
                dev_info(&card->gdev->dev,
                        "Device successfully recovered!\n");
        else {
-                rtnl_lock();
+                if (rtnl_trylock()) {
-                dev_close(card->dev);
+                        dev_close(card->dev);
-                rtnl_unlock();
+                        rtnl_unlock();
-                dev_warn(&card->gdev->dev, "The qeth device driver "
+                        dev_warn(&card->gdev->dev, "The qeth device driver "
-                        "failed to recover an error on the device\n");
+                                "failed to recover an error on the device\n");
+                }
        }
        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 4cd310cb5bdf..5ba390658498 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3510,11 +3510,12 @@ static int qeth_l3_recover(void *ptr)
                dev_info(&card->gdev->dev,
                        "Device successfully recovered!\n");
        else {
-                rtnl_lock();
+                if (rtnl_trylock()) {
-                dev_close(card->dev);
+                        dev_close(card->dev);
-                rtnl_unlock();
+                        rtnl_unlock();
-                dev_warn(&card->gdev->dev, "The qeth device driver "
+                        dev_warn(&card->gdev->dev, "The qeth device driver "
-                        "failed to recover an error on the device\n");
+                                "failed to recover an error on the device\n");
+                }
        }
        qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
        qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 207b7d742443..d8f990b6b332 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -157,7 +157,7 @@ static int smsg_pm_restore_thaw(struct device *dev)
 #ifdef CONFIG_PM_DEBUG
        printk(KERN_WARNING "smsg_pm_restore_thaw\n");
 #endif
-        if (smsg_path && iucv_path_connected) {
+        if (smsg_path && !iucv_path_connected) {
                memset(smsg_path, 0, sizeof(*smsg_path));
                smsg_path->msglim = 255;
                smsg_path->flags = 0;
diff --git a/drivers/sh/intc/access.c b/drivers/sh/intc/access.c
index f892ae1d212a..114390f967d2 100644
--- a/drivers/sh/intc/access.c
+++ b/drivers/sh/intc/access.c
@@ -75,54 +75,61 @@ unsigned long intc_get_field_from_handle(unsigned int value, unsigned int handle
 static unsigned long test_8(unsigned long addr, unsigned long h,
                            unsigned long ignore)
 {
-        return intc_get_field_from_handle(__raw_readb(addr), h);
+        void __iomem *ptr = (void __iomem *)addr;
+        return intc_get_field_from_handle(__raw_readb(ptr), h);
 }
 static unsigned long test_16(unsigned long addr, unsigned long h,
                             unsigned long ignore)
 {
-        return intc_get_field_from_handle(__raw_readw(addr), h);
+        void __iomem *ptr = (void __iomem *)addr;
+        return intc_get_field_from_handle(__raw_readw(ptr), h);
 }
 static unsigned long test_32(unsigned long addr, unsigned long h,
                             unsigned long ignore)
 {
-        return intc_get_field_from_handle(__raw_readl(addr), h);
+        void __iomem *ptr = (void __iomem *)addr;
+        return intc_get_field_from_handle(__raw_readl(ptr), h);
 }
 static unsigned long write_8(unsigned long addr, unsigned long h,
                             unsigned long data)
 {
-        __raw_writeb(intc_set_field_from_handle(0, data, h), addr);
+        void __iomem *ptr = (void __iomem *)addr;
-        (void)__raw_readb(addr);        /* Defeat write posting */
+        __raw_writeb(intc_set_field_from_handle(0, data, h), ptr);
+        (void)__raw_readb(ptr); /* Defeat write posting */
        return 0;
 }
 static unsigned long write_16(unsigned long addr, unsigned long h,
                              unsigned long data)
 {
-        __raw_writew(intc_set_field_from_handle(0, data, h), addr);
+        void __iomem *ptr = (void __iomem *)addr;
-        (void)__raw_readw(addr);        /* Defeat write posting */
+        __raw_writew(intc_set_field_from_handle(0, data, h), ptr);
+        (void)__raw_readw(ptr); /* Defeat write posting */
        return 0;
 }
 static unsigned long write_32(unsigned long addr, unsigned long h,
                              unsigned long data)
 {
-        __raw_writel(intc_set_field_from_handle(0, data, h), addr);
+        void __iomem *ptr = (void __iomem *)addr;
-        (void)__raw_readl(addr);        /* Defeat write posting */
+        __raw_writel(intc_set_field_from_handle(0, data, h), ptr);
+        (void)__raw_readl(ptr); /* Defeat write posting */
        return 0;
 }
 static unsigned long modify_8(unsigned long addr, unsigned long h,
                              unsigned long data)
 {
+        void __iomem *ptr = (void __iomem *)addr;
        unsigned long flags;
        unsigned int value;
        local_irq_save(flags);
-        value = intc_set_field_from_handle(__raw_readb(addr), data, h);
+        value = intc_set_field_from_handle(__raw_readb(ptr), data, h);
-        __raw_writeb(value, addr);
+        __raw_writeb(value, ptr);
-        (void)__raw_readb(addr);        /* Defeat write posting */
+        (void)__raw_readb(ptr); /* Defeat write posting */
        local_irq_restore(flags);
        return 0;
 }
@@ -130,12 +137,13 @@ static unsigned long modify_8(unsigned long addr, unsigned long h,
 static unsigned long modify_16(unsigned long addr, unsigned long h,
                               unsigned long data)
 {
+        void __iomem *ptr = (void __iomem *)addr;
        unsigned long flags;
        unsigned int value;
        local_irq_save(flags);
-        value = intc_set_field_from_handle(__raw_readw(addr), data, h);
+        value = intc_set_field_from_handle(__raw_readw(ptr), data, h);
-        __raw_writew(value, addr);
+        __raw_writew(value, ptr);
-        (void)__raw_readw(addr);        /* Defeat write posting */
+        (void)__raw_readw(ptr); /* Defeat write posting */
        local_irq_restore(flags);
        return 0;
 }
@@ -143,12 +151,13 @@ static unsigned long modify_16(unsigned long addr, unsigned long h,
 static unsigned long modify_32(unsigned long addr, unsigned long h,
                               unsigned long data)
 {
+        void __iomem *ptr = (void __iomem *)addr;
        unsigned long flags;
        unsigned int value;
        local_irq_save(flags);
-        value = intc_set_field_from_handle(__raw_readl(addr), data, h);
+        value = intc_set_field_from_handle(__raw_readl(ptr), data, h);
-        __raw_writel(value, addr);
+        __raw_writel(value, ptr);
-        (void)__raw_readl(addr);        /* Defeat write posting */
+        (void)__raw_readl(ptr); /* Defeat write posting */
        local_irq_restore(flags);
        return 0;
 }
diff --git a/drivers/sh/intc/chip.c b/drivers/sh/intc/chip.c
index 012df2676a26..46427b48e2f1 100644
--- a/drivers/sh/intc/chip.c
+++ b/drivers/sh/intc/chip.c
@@ -83,7 +83,7 @@ static void intc_mask_ack(struct irq_data *data)
        unsigned int irq = data->irq;
        struct intc_desc_int *d = get_intc_desc(irq);
        unsigned long handle = intc_get_ack_handle(irq);
-        unsigned long addr;
+        void __iomem *addr;
        intc_disable(data);
@@ -91,7 +91,7 @@ static void intc_mask_ack(struct irq_data *data)
        if (handle) {
                unsigned int value;
-                addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
+                addr = (void __iomem *)INTC_REG(d, _INTC_ADDR_D(handle), 0);
                value = intc_set_field_from_handle(0, 1, handle);
                switch (_INTC_FN(handle)) {
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index edfd67d25013..e1cb6bd75f60 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -22,6 +22,7 @@ config THERMAL_HWMON
 config CPU_THERMAL
        bool "generic cpu cooling support"
        depends on THERMAL && CPU_FREQ
+        select CPU_FREQ_TABLE
        help
          This implements the generic cpu cooling mechanism through frequency
          reduction, cpu hotplug and any other ways of reducing temperature. An
@@ -50,6 +51,7 @@ config RCAR_THERMAL
 config EXYNOS_THERMAL
        tristate "Temperature sensor on Samsung EXYNOS"
        depends on (ARCH_EXYNOS4 || ARCH_EXYNOS5) && THERMAL
+        select CPU_FREQ_TABLE
        help
          If you say yes here you get support for TMU (Thermal Managment
          Unit) on SAMSUNG EXYNOS series of SoC.
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 9be296cf7295..6ee59001d61d 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -530,7 +530,8 @@ static inline int sci_rxd_in(struct uart_port *port)
        if (s->cfg->port_reg <= 0)
                return 1;
-        return !!__raw_readb(s->cfg->port_reg);
+        /* Cast for ARM damage */
+        return !!__raw_readb((void __iomem *)s->cfg->port_reg);
 }
 /* ********************************************************************** *
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index 05728894a88c..16ee6cee07da 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -452,6 +452,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
        NULL,                           /* v */
        &sysrq_showstate_blocked_op,    /* w */
        /* x: May be registered on ppc/powerpc for xmon */
+        /* x: May be registered on sparc64 for global PMU dump */
        NULL,                           /* x */
        /* y: May be registered on sparc64 for global register dump */
        NULL,                           /* y */
diff --git a/fs/coredump.c b/fs/coredump.c
index fd37facac8dc..ce47379bfa61 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -450,11 +450,12 @@ static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
        cp->file = files[1];
-        replace_fd(0, files[0], 0);
+        err = replace_fd(0, files[0], 0);
+        fput(files[0]);
        /* and disallow core files too */
        current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
-        return 0;
+        return err;
 }
 void do_coredump(siginfo_t *siginfo, struct pt_regs *regs)
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 6c205d0c565b..fa04d023177e 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -469,7 +469,7 @@ static int parse_options(char *options, struct super_block *sb)
                        uid = make_kuid(current_user_ns(), option);
                        if (!uid_valid(uid)) {
                                ext2_msg(sb, KERN_ERR, "Invalid uid value %d", option);
-                                return -1;
+                                return 0;
                        }
                        sbi->s_resuid = uid;
@@ -480,7 +480,7 @@ static int parse_options(char *options, struct super_block *sb)
                        gid = make_kgid(current_user_ns(), option);
                        if (!gid_valid(gid)) {
                                ext2_msg(sb, KERN_ERR, "Invalid gid value %d", option);
-                                return -1;
+                                return 0;
                        }
                        sbi->s_resgid = gid;
                        break;
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 8f4fddac01a6..890b8947c546 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -46,8 +46,7 @@ static struct buffer_head *ext3_append(handle_t *handle,
        *block = inode->i_size >> inode->i_sb->s_blocksize_bits;
-        bh = ext3_bread(handle, inode, *block, 1, err);
+        if ((bh = ext3_dir_bread(handle, inode, *block, 1, err))) {
-        if (bh) {
                inode->i_size += inode->i_sb->s_blocksize;
                EXT3_I(inode)->i_disksize = inode->i_size;
                *err = ext3_journal_get_write_access(handle, bh);
@@ -339,8 +338,10 @@ dx_probe(struct qstr *entry, struct inode *dir,
        u32 hash;
        frame->bh = NULL;
-        if (!(bh = ext3_bread (NULL,dir, 0, 0, err)))
+        if (!(bh = ext3_dir_bread(NULL, dir, 0, 0, err))) {
+                *err = ERR_BAD_DX_DIR;
                goto fail;
+        }
        root = (struct dx_root *) bh->b_data;
        if (root->info.hash_version != DX_HASH_TEA &&
            root->info.hash_version != DX_HASH_HALF_MD4 &&
@@ -436,8 +437,10 @@ dx_probe(struct qstr *entry, struct inode *dir,
                frame->entries = entries;
                frame->at = at;
                if (!indirect--) return frame;
-                if (!(bh = ext3_bread (NULL,dir, dx_get_block(at), 0, err)))
+                if (!(bh = ext3_dir_bread(NULL, dir, dx_get_block(at), 0, err))) {
+                        *err = ERR_BAD_DX_DIR;
                        goto fail2;
+                }
                at = entries = ((struct dx_node *) bh->b_data)->entries;
                if (dx_get_limit(entries) != dx_node_limit (dir)) {
                        ext3_warning(dir->i_sb, __func__,
@@ -535,8 +538,8 @@ static int ext3_htree_next_block(struct inode *dir, __u32 hash,
         * block so no check is necessary
         */
        while (num_frames--) {
-                if (!(bh = ext3_bread(NULL, dir, dx_get_block(p->at),
+                if (!(bh = ext3_dir_bread(NULL, dir, dx_get_block(p->at),
-                                      0, &err)))
+                                          0, &err)))
                        return err; /* Failure */
                p++;
                brelse (p->bh);
@@ -559,10 +562,11 @@ static int htree_dirblock_to_tree(struct file *dir_file,
 {
        struct buffer_head *bh;
        struct ext3_dir_entry_2 *de, *top;
-        int err, count = 0;
+        int err = 0, count = 0;
        dxtrace(printk("In htree dirblock_to_tree: block %d\n", block));
-        if (!(bh = ext3_bread (NULL, dir, block, 0, &err)))
+        if (!(bh = ext3_dir_bread(NULL, dir, block, 0, &err)))
                return err;
        de = (struct ext3_dir_entry_2 *) bh->b_data;
@@ -976,7 +980,7 @@ static struct buffer_head * ext3_dx_find_entry(struct inode *dir,
                return NULL;
        do {
                block = dx_get_block(frame->at);
-                if (!(bh = ext3_bread (NULL,dir, block, 0, err)))
+                if (!(bh = ext3_dir_bread (NULL, dir, block, 0, err)))
                        goto errout;
                retval = search_dirblock(bh, dir, entry,
@@ -1458,9 +1462,9 @@ static int ext3_add_entry (handle_t *handle, struct dentry *dentry,
        }
        blocks = dir->i_size >> sb->s_blocksize_bits;
        for (block = 0; block < blocks; block++) {
-                bh = ext3_bread(handle, dir, block, 0, &retval);
+                if (!(bh = ext3_dir_bread(handle, dir, block, 0, &retval)))
-                if(!bh)
                        return retval;
                retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
                if (retval != -ENOSPC)
                        return retval;
@@ -1500,7 +1504,7 @@ static int ext3_dx_add_entry(handle_t *handle, struct dentry *dentry,
        entries = frame->entries;
        at = frame->at;
-        if (!(bh = ext3_bread(handle,dir, dx_get_block(frame->at), 0, &err)))
+        if (!(bh = ext3_dir_bread(handle, dir, dx_get_block(frame->at), 0, &err)))
                goto cleanup;
        BUFFER_TRACE(bh, "get_write_access");
@@ -1790,8 +1794,7 @@ retry:
        inode->i_op = &ext3_dir_inode_operations;
        inode->i_fop = &ext3_dir_operations;
        inode->i_size = EXT3_I(inode)->i_disksize = inode->i_sb->s_blocksize;
-        dir_block = ext3_bread (handle, inode, 0, 1, &err);
+        if (!(dir_block = ext3_dir_bread(handle, inode, 0, 1, &err)))
-        if (!dir_block)
                goto out_clear_inode;
        BUFFER_TRACE(dir_block, "get_write_access");
@@ -1859,7 +1862,7 @@ static int empty_dir (struct inode * inode)
        sb = inode->i_sb;
        if (inode->i_size < EXT3_DIR_REC_LEN(1) + EXT3_DIR_REC_LEN(2) ||
-            !(bh = ext3_bread (NULL, inode, 0, 0, &err))) {
+            !(bh = ext3_dir_bread(NULL, inode, 0, 0, &err))) {
                if (err)
                        ext3_error(inode->i_sb, __func__,
                                   "error %d reading directory #%lu offset 0",
@@ -1890,9 +1893,8 @@ static int empty_dir (struct inode * inode)
                        (void *) de >= (void *) (bh->b_data+sb->s_blocksize)) {
                        err = 0;
                        brelse (bh);
-                        bh = ext3_bread (NULL, inode,
+                        if (!(bh = ext3_dir_bread (NULL, inode,
-                                offset >> EXT3_BLOCK_SIZE_BITS(sb), 0, &err);
+                                offset >> EXT3_BLOCK_SIZE_BITS(sb), 0, &err))) {
-                        if (!bh) {
                                if (err)
                                        ext3_error(sb, __func__,
                                                   "error %d reading directory"
@@ -2388,7 +2390,7 @@ static int ext3_rename (struct inode * old_dir, struct dentry *old_dentry,
                                goto end_rename;
                }
                retval = -EIO;
-                dir_bh = ext3_bread (handle, old_inode, 0, 0, &retval);
+                dir_bh = ext3_dir_bread(handle, old_inode, 0, 0, &retval);
                if (!dir_bh)
                        goto end_rename;
                if (le32_to_cpu(PARENT_INO(dir_bh->b_data)) != old_dir->i_ino)
diff --git a/fs/ext3/namei.h b/fs/ext3/namei.h
index f2ce2b0065c9..46304d8c9f0a 100644
--- a/fs/ext3/namei.h
+++ b/fs/ext3/namei.h
@@ -6,3 +6,22 @@
 */
 extern struct dentry *ext3_get_parent(struct dentry *child);
+static inline struct buffer_head *ext3_dir_bread(handle_t *handle,
+                                                 struct inode *inode,
+                                                 int block, int create,
+                                                 int *err)
+{
+        struct buffer_head *bh;
+        bh = ext3_bread(handle, inode, block, create, err);
+        if (!bh && !(*err)) {
+                *err = -EIO;
+                ext3_error(inode->i_sb, __func__,
+                           "Directory hole detected on inode %lu\n",
+                           inode->i_ino);
+                return NULL;
+        }
+        return bh;
+}
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 29e79713c7eb..5366393528df 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -1001,7 +1001,7 @@ static int parse_options (char *options, struct super_block *sb,
                        uid = make_kuid(current_user_ns(), option);
                        if (!uid_valid(uid)) {
                                ext3_msg(sb, KERN_ERR, "Invalid uid value %d", option);
-                                return -1;
+                                return 0;
                        }
                        sbi->s_resuid = uid;
@@ -1012,7 +1012,7 @@ static int parse_options (char *options, struct super_block *sb,
                        gid = make_kgid(current_user_ns(), option);
                        if (!gid_valid(gid)) {
                                ext3_msg(sb, KERN_ERR, "Invalid gid value %d", option);
-                                return -1;
+                                return 0;
                        }
                        sbi->s_resgid = gid;
                        break;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 79827ce03e3b..14df8806ff29 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1158,6 +1158,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
        struct vm_area_struct *vma = v;
        struct numa_maps *md = &numa_priv->md;
        struct file *file = vma->vm_file;
+        struct task_struct *task = proc_priv->task;
        struct mm_struct *mm = vma->vm_mm;
        struct mm_walk walk = {};
        struct mempolicy *pol;
@@ -1177,9 +1178,11 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
        walk.private = md;
        walk.mm = mm;
-        pol = get_vma_policy(proc_priv->task, vma, vma->vm_start);
+        task_lock(task);
+        pol = get_vma_policy(task, vma, vma->vm_start);
        mpol_to_str(buffer, sizeof(buffer), pol, 0);
        mpol_cond_put(pol);
+        task_unlock(task);
        seq_printf(m, "%08lx %s", vma->vm_start, buffer);
@@ -1189,7 +1192,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
        } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
                seq_printf(m, " heap");
        } else {
-                pid_t tid = vm_is_stack(proc_priv->task, vma, is_pid);
+                pid_t tid = vm_is_stack(task, vma, is_pid);
                if (tid != 0) {
                        /*
                         * Thread stack in /proc/PID/task/TID/maps or
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 557a9c20a215..05ae3c97f7a5 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1160,6 +1160,8 @@ static int need_print_warning(struct dquot_warn *warn)
                        return uid_eq(current_fsuid(), warn->w_dq_id.uid);
                case GRPQUOTA:
                        return in_group_p(warn->w_dq_id.gid);
+                case PRJQUOTA:  /* Never taken... Just make gcc happy */
+                        return 0;
        }
        return 0;
 }
diff --git a/include/Kbuild b/include/Kbuild
index 8d226bfa2696..83256b64166a 100644
--- a/include/Kbuild
+++ b/include/Kbuild
@@ -1,12 +1,8 @@
 # Top-level Makefile calls into asm-$(ARCH)
 # List only non-arch directories below
-header-y += asm-generic/
 header-y += linux/
 header-y += sound/
-header-y += mtd/
 header-y += rdma/
 header-y += video/
-header-y += drm/
-header-y += xen/
 header-y += scsi/
diff --git a/include/asm-generic/Kbuild b/include/asm-generic/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/asm-generic/Kbuild
+++ /dev/null
diff --git a/include/drm/Kbuild b/include/drm/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/drm/Kbuild
+++ /dev/null
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 5b57367e28db..7fe2dae251e5 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -1,31 +1,5 @@
-header-y += byteorder/
-header-y += can/
-header-y += caif/
 header-y += dvb/
 header-y += hdlc/
 header-y += hsi/
-header-y += isdn/
-header-y += mmc/
-header-y += nfsd/
 header-y += raid/
-header-y += spi/
-header-y += sunrpc/
-header-y += tc_act/
-header-y += tc_ematch/
-header-y += netfilter/
-header-y += netfilter_arp/
-header-y += netfilter_bridge/
-header-y += netfilter_ipv4/
-header-y += netfilter_ipv6/
 header-y += usb/
-header-y += wimax/
-ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/include/asm/a.out.h \
-                  $(srctree)/arch/$(SRCARCH)/include/uapi/asm/a.out.h),)
-endif
-ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/include/asm/kvm.h \
-                  $(srctree)/arch/$(SRCARCH)/include/uapi/asm/kvm.h),)
-endif
-ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/include/asm/kvm_para.h \
-                  $(srctree)/arch/$(SRCARCH)/include/uapi/asm/kvm_para.h),)
-endif
diff --git a/include/linux/byteorder/Kbuild b/include/linux/byteorder/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/byteorder/Kbuild
+++ /dev/null
diff --git a/include/linux/caif/Kbuild b/include/linux/caif/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/caif/Kbuild
+++ /dev/null
diff --git a/include/linux/can/Kbuild b/include/linux/can/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/can/Kbuild
+++ /dev/null
diff --git a/include/linux/elf-fdpic.h b/include/linux/elf-fdpic.h
new file mode 100644
index 000000000000..386440317b0c
--- /dev/null
+++ b/include/linux/elf-fdpic.h
@@ -0,0 +1,51 @@
+/* FDPIC ELF load map
+ *
+ * Copyright (C) 2003 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#ifndef _LINUX_ELF_FDPIC_H
+#define _LINUX_ELF_FDPIC_H
+#include <uapi/linux/elf-fdpic.h>
+/*
+ * binfmt binary parameters structure
+ */
+struct elf_fdpic_params {
+        struct elfhdr                   hdr;            /* ref copy of ELF header */
+        struct elf_phdr                 *phdrs;         /* ref copy of PT_PHDR table */
+        struct elf32_fdpic_loadmap      *loadmap;       /* loadmap to be passed to userspace */
+        unsigned long                   elfhdr_addr;    /* mapped ELF header user address */
+        unsigned long                   ph_addr;        /* mapped PT_PHDR user address */
+        unsigned long                   map_addr;       /* mapped loadmap user address */
+        unsigned long                   entry_addr;     /* mapped entry user address */
+        unsigned long                   stack_size;     /* stack size requested (PT_GNU_STACK) */
+        unsigned long                   dynamic_addr;   /* mapped PT_DYNAMIC user address */
+        unsigned long                   load_addr;      /* user address at which to map binary */
+        unsigned long                   flags;
+#define ELF_FDPIC_FLAG_ARRANGEMENT      0x0000000f      /* PT_LOAD arrangement flags */
+#define ELF_FDPIC_FLAG_INDEPENDENT      0x00000000      /* PT_LOADs can be put anywhere */
+#define ELF_FDPIC_FLAG_HONOURVADDR      0x00000001      /* PT_LOAD.vaddr must be honoured */
+#define ELF_FDPIC_FLAG_CONSTDISP        0x00000002      /* PT_LOADs require constant
+                                                         * displacement */
+#define ELF_FDPIC_FLAG_CONTIGUOUS       0x00000003      /* PT_LOADs should be contiguous */
+#define ELF_FDPIC_FLAG_EXEC_STACK       0x00000010      /* T if stack to be executable */
+#define ELF_FDPIC_FLAG_NOEXEC_STACK     0x00000020      /* T if stack not to be executable */
+#define ELF_FDPIC_FLAG_EXECUTABLE       0x00000040      /* T if this object is the executable */
+#define ELF_FDPIC_FLAG_PRESENT          0x80000000      /* T if this object is present */
+};
+#ifdef CONFIG_MMU
+extern void elf_fdpic_arch_lay_out_mm(struct elf_fdpic_params *exec_params,
+                                      struct elf_fdpic_params *interp_params,
+                                      unsigned long *start_stack,
+                                      unsigned long *start_brk);
+#endif
+#endif /* _LINUX_ELF_FDPIC_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 001c7cff2d48..b33cfc97b9ca 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -64,6 +64,73 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
                        ssize_t bytes, void *private, int ret,
                        bool is_async);
+#define MAY_EXEC                0x00000001
+#define MAY_WRITE               0x00000002
+#define MAY_READ                0x00000004
+#define MAY_APPEND              0x00000008
+#define MAY_ACCESS              0x00000010
+#define MAY_OPEN                0x00000020
+#define MAY_CHDIR               0x00000040
+/* called from RCU mode, don't block */
+#define MAY_NOT_BLOCK           0x00000080
+/*
+ * flags in file.f_mode.  Note that FMODE_READ and FMODE_WRITE must correspond
+ * to O_WRONLY and O_RDWR via the strange trick in __dentry_open()
+ */
+/* file is open for reading */
+#define FMODE_READ              ((__force fmode_t)0x1)
+/* file is open for writing */
+#define FMODE_WRITE             ((__force fmode_t)0x2)
+/* file is seekable */
+#define FMODE_LSEEK             ((__force fmode_t)0x4)
+/* file can be accessed using pread */
+#define FMODE_PREAD             ((__force fmode_t)0x8)
+/* file can be accessed using pwrite */
+#define FMODE_PWRITE            ((__force fmode_t)0x10)
+/* File is opened for execution with sys_execve / sys_uselib */
+#define FMODE_EXEC              ((__force fmode_t)0x20)
+/* File is opened with O_NDELAY (only set for block devices) */
+#define FMODE_NDELAY            ((__force fmode_t)0x40)
+/* File is opened with O_EXCL (only set for block devices) */
+#define FMODE_EXCL              ((__force fmode_t)0x80)
+/* File is opened using open(.., 3, ..) and is writeable only for ioctls
+   (specialy hack for floppy.c) */
+#define FMODE_WRITE_IOCTL       ((__force fmode_t)0x100)
+/* 32bit hashes as llseek() offset (for directories) */
+#define FMODE_32BITHASH         ((__force fmode_t)0x200)
+/* 64bit hashes as llseek() offset (for directories) */
+#define FMODE_64BITHASH         ((__force fmode_t)0x400)
+/*
+ * Don't update ctime and mtime.
+ *
+ * Currently a special hack for the XFS open_by_handle ioctl, but we'll
+ * hopefully graduate it to a proper O_CMTIME flag supported by open(2) soon.
+ */
+#define FMODE_NOCMTIME          ((__force fmode_t)0x800)
+/* Expect random access pattern */
+#define FMODE_RANDOM            ((__force fmode_t)0x1000)
+/* File is huge (eg. /dev/kmem): treat loff_t as unsigned */
+#define FMODE_UNSIGNED_OFFSET   ((__force fmode_t)0x2000)
+/* File is opened with O_PATH; almost nothing can be done with it */
+#define FMODE_PATH              ((__force fmode_t)0x4000)
+/* File was opened by fanotify and shouldn't generate fanotify events */
+#define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
+/*
+ * Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector
+ * that indicates that they should check the contents of the iovec are
+ * valid, but not check the memory that the iovec elements
+ * points too.
+ */
+#define CHECK_IOVEC_ONLY -1
 /*
 * The below are the various read and write types that we support. Some of
 * them include behavioral modifiers that send information down to the
@@ -1557,6 +1624,60 @@ struct super_operations {
 };
 /*
+ * Inode flags - they have no relation to superblock flags now
+ */
+#define S_SYNC          1       /* Writes are synced at once */
+#define S_NOATIME       2       /* Do not update access times */
+#define S_APPEND        4       /* Append-only file */
+#define S_IMMUTABLE     8       /* Immutable file */
+#define S_DEAD          16      /* removed, but still open directory */
+#define S_NOQUOTA       32      /* Inode is not counted to quota */
+#define S_DIRSYNC       64      /* Directory modifications are synchronous */
+#define S_NOCMTIME      128     /* Do not update file c/mtime */
+#define S_SWAPFILE      256     /* Do not truncate: swapon got its bmaps */
+#define S_PRIVATE       512     /* Inode is fs-internal */
+#define S_IMA           1024    /* Inode has an associated IMA struct */
+#define S_AUTOMOUNT     2048    /* Automount/referral quasi-directory */
+#define S_NOSEC         4096    /* no suid or xattr security attributes */
+/*
+ * Note that nosuid etc flags are inode-specific: setting some file-system
+ * flags just means all the inodes inherit those flags by default. It might be
+ * possible to override it selectively if you really wanted to with some
+ * ioctl() that is not currently implemented.
+ *
+ * Exception: MS_RDONLY is always applied to the entire file system.
+ *
+ * Unfortunately, it is possible to change a filesystems flags with it mounted
+ * with files in use.  This means that all of the inodes will not have their
+ * i_flags updated.  Hence, i_flags no longer inherit the superblock mount
+ * flags, so these have to be checked separately. -- rmk@arm.uk.linux.org
+ */
+#define __IS_FLG(inode, flg)    ((inode)->i_sb->s_flags & (flg))
+#define IS_RDONLY(inode)        ((inode)->i_sb->s_flags & MS_RDONLY)
+#define IS_SYNC(inode)          (__IS_FLG(inode, MS_SYNCHRONOUS) || \
+                                        ((inode)->i_flags & S_SYNC))
+#define IS_DIRSYNC(inode)       (__IS_FLG(inode, MS_SYNCHRONOUS|MS_DIRSYNC) || \
+                                        ((inode)->i_flags & (S_SYNC|S_DIRSYNC)))
+#define IS_MANDLOCK(inode)      __IS_FLG(inode, MS_MANDLOCK)
+#define IS_NOATIME(inode)       __IS_FLG(inode, MS_RDONLY|MS_NOATIME)
+#define IS_I_VERSION(inode)     __IS_FLG(inode, MS_I_VERSION)
+#define IS_NOQUOTA(inode)       ((inode)->i_flags & S_NOQUOTA)
+#define IS_APPEND(inode)        ((inode)->i_flags & S_APPEND)
+#define IS_IMMUTABLE(inode)     ((inode)->i_flags & S_IMMUTABLE)
+#define IS_POSIXACL(inode)      __IS_FLG(inode, MS_POSIXACL)
+#define IS_DEADDIR(inode)       ((inode)->i_flags & S_DEAD)
+#define IS_NOCMTIME(inode)      ((inode)->i_flags & S_NOCMTIME)
+#define IS_SWAPFILE(inode)      ((inode)->i_flags & S_SWAPFILE)
+#define IS_PRIVATE(inode)       ((inode)->i_flags & S_PRIVATE)
+#define IS_IMA(inode)           ((inode)->i_flags & S_IMA)
+#define IS_AUTOMOUNT(inode)     ((inode)->i_flags & S_AUTOMOUNT)
+#define IS_NOSEC(inode)         ((inode)->i_flags & S_NOSEC)
+/*
 * Inode state bits.  Protected by inode->i_lock
 *
 * Three bits determine the dirty state of the inode, I_DIRTY_SYNC,
@@ -1688,6 +1809,11 @@ int sync_inode_metadata(struct inode *inode, int wait);
 struct file_system_type {
        const char *name;
        int fs_flags;
+#define FS_REQUIRES_DEV         1 
+#define FS_BINARY_MOUNTDATA     2
+#define FS_HAS_SUBTYPE          4
+#define FS_REVAL_DOT            16384   /* Check the paths ".", ".." for staleness */
+#define FS_RENAME_DOES_D_MOVE   32768   /* FS will handle d_move() during rename() internally. */
        struct dentry *(*mount) (struct file_system_type *, int,
                       const char *, void *);
        void (*kill_sb) (struct super_block *);
diff --git a/include/linux/isdn/Kbuild b/include/linux/isdn/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/isdn/Kbuild
+++ /dev/null
diff --git a/include/linux/mmc/Kbuild b/include/linux/mmc/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/mmc/Kbuild
+++ /dev/null
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
deleted file mode 100644
index b3322023e9a5..000000000000
--- a/include/linux/netfilter/Kbuild
+++ /dev/null
@@ -1 +0,0 @@
-header-y += ipset/
diff --git a/include/linux/netfilter/ipset/Kbuild b/include/linux/netfilter/ipset/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/netfilter/ipset/Kbuild
+++ /dev/null
diff --git a/include/linux/netfilter_arp/Kbuild b/include/linux/netfilter_arp/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/netfilter_arp/Kbuild
+++ /dev/null
diff --git a/include/linux/netfilter_bridge/Kbuild b/include/linux/netfilter_bridge/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/netfilter_bridge/Kbuild
+++ /dev/null
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/netfilter_ipv4/Kbuild
+++ /dev/null
diff --git a/include/linux/netfilter_ipv6/Kbuild b/include/linux/netfilter_ipv6/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/netfilter_ipv6/Kbuild
+++ /dev/null
diff --git a/include/linux/nfsd/Kbuild b/include/linux/nfsd/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/nfsd/Kbuild
+++ /dev/null
diff --git a/include/linux/spi/Kbuild b/include/linux/spi/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/spi/Kbuild
+++ /dev/null
diff --git a/include/linux/sunrpc/Kbuild b/include/linux/sunrpc/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/sunrpc/Kbuild
+++ /dev/null
diff --git a/include/linux/tc_act/Kbuild b/include/linux/tc_act/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/tc_act/Kbuild
+++ /dev/null
diff --git a/include/linux/tc_ematch/Kbuild b/include/linux/tc_ematch/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/tc_ematch/Kbuild
+++ /dev/null
diff --git a/include/linux/wimax/Kbuild b/include/linux/wimax/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/linux/wimax/Kbuild
+++ /dev/null
diff --git a/include/mtd/Kbuild b/include/mtd/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/mtd/Kbuild
+++ /dev/null
diff --git a/include/uapi/asm-generic/kvm_para.h b/include/uapi/asm-generic/kvm_para.h
index e69de29bb2d1..486f0af73c39 100644
--- a/include/uapi/asm-generic/kvm_para.h
+++ b/include/uapi/asm-generic/kvm_para.h
@@ -0,0 +1,4 @@
+/*
+ * There isn't anything here, but the file must not be empty or patch
+ * will delete it.
+ */
diff --git a/include/uapi/linux/elf-fdpic.h b/include/uapi/linux/elf-fdpic.h
index 1065078938f9..3921e33aec8e 100644
--- a/include/uapi/linux/elf-fdpic.h
+++ b/include/uapi/linux/elf-fdpic.h
@@ -9,8 +9,8 @@
 * 2 of the License, or (at your option) any later version.
 */
-#ifndef _LINUX_ELF_FDPIC_H
+#ifndef _UAPI_LINUX_ELF_FDPIC_H
-#define _LINUX_ELF_FDPIC_H
+#define _UAPI_LINUX_ELF_FDPIC_H
 #include <linux/elf.h>
@@ -31,40 +31,4 @@ struct elf32_fdpic_loadmap {
 #define ELF32_FDPIC_LOADMAP_VERSION     0x0000
-#ifndef __KERNEL__
+#endif /* _UAPI_LINUX_ELF_FDPIC_H */
-/*
- * binfmt binary parameters structure
- */
-struct elf_fdpic_params {
-        struct elfhdr                   hdr;            /* ref copy of ELF header */
-        struct elf_phdr                 *phdrs;         /* ref copy of PT_PHDR table */
-        struct elf32_fdpic_loadmap      *loadmap;       /* loadmap to be passed to userspace */
-        unsigned long                   elfhdr_addr;    /* mapped ELF header user address */
-        unsigned long                   ph_addr;        /* mapped PT_PHDR user address */
-        unsigned long                   map_addr;       /* mapped loadmap user address */
-        unsigned long                   entry_addr;     /* mapped entry user address */
-        unsigned long                   stack_size;     /* stack size requested (PT_GNU_STACK) */
-        unsigned long                   dynamic_addr;   /* mapped PT_DYNAMIC user address */
-        unsigned long                   load_addr;      /* user address at which to map binary */
-        unsigned long                   flags;
-#define ELF_FDPIC_FLAG_ARRANGEMENT      0x0000000f      /* PT_LOAD arrangement flags */
-#define ELF_FDPIC_FLAG_INDEPENDENT      0x00000000      /* PT_LOADs can be put anywhere */
-#define ELF_FDPIC_FLAG_HONOURVADDR      0x00000001      /* PT_LOAD.vaddr must be honoured */
-#define ELF_FDPIC_FLAG_CONSTDISP        0x00000002      /* PT_LOADs require constant
-                                                         * displacement */
-#define ELF_FDPIC_FLAG_CONTIGUOUS       0x00000003      /* PT_LOADs should be contiguous */
-#define ELF_FDPIC_FLAG_EXEC_STACK       0x00000010      /* T if stack to be executable */
-#define ELF_FDPIC_FLAG_NOEXEC_STACK     0x00000020      /* T if stack not to be executable */
-#define ELF_FDPIC_FLAG_EXECUTABLE       0x00000040      /* T if this object is the executable */
-#define ELF_FDPIC_FLAG_PRESENT          0x80000000      /* T if this object is present */
-};
-#ifdef CONFIG_MMU
-extern void elf_fdpic_arch_lay_out_mm(struct elf_fdpic_params *exec_params,
-                                      struct elf_fdpic_params *interp_params,
-                                      unsigned long *start_stack,
-                                      unsigned long *start_brk);
-#endif
-#endif /* __KERNEL__ */
-#endif /* _LINUX_ELF_FDPIC_H */
diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
index 9fcc880d4be2..780d4c6093eb 100644
--- a/include/uapi/linux/fs.h
+++ b/include/uapi/linux/fs.h
@@ -57,85 +57,6 @@ struct inodes_stat_t {
 #define NR_FILE  8192   /* this can well be larger on a larger system */
-#define MAY_EXEC                0x00000001
-#define MAY_WRITE               0x00000002
-#define MAY_READ                0x00000004
-#define MAY_APPEND              0x00000008
-#define MAY_ACCESS              0x00000010
-#define MAY_OPEN                0x00000020
-#define MAY_CHDIR               0x00000040
-/* called from RCU mode, don't block */
-#define MAY_NOT_BLOCK           0x00000080
-/*
- * flags in file.f_mode.  Note that FMODE_READ and FMODE_WRITE must correspond
- * to O_WRONLY and O_RDWR via the strange trick in __dentry_open()
- */
-/* file is open for reading */
-#define FMODE_READ              ((__force fmode_t)0x1)
-/* file is open for writing */
-#define FMODE_WRITE             ((__force fmode_t)0x2)
-/* file is seekable */
-#define FMODE_LSEEK             ((__force fmode_t)0x4)
-/* file can be accessed using pread */
-#define FMODE_PREAD             ((__force fmode_t)0x8)
-/* file can be accessed using pwrite */
-#define FMODE_PWRITE            ((__force fmode_t)0x10)
-/* File is opened for execution with sys_execve / sys_uselib */
-#define FMODE_EXEC              ((__force fmode_t)0x20)
-/* File is opened with O_NDELAY (only set for block devices) */
-#define FMODE_NDELAY            ((__force fmode_t)0x40)
-/* File is opened with O_EXCL (only set for block devices) */
-#define FMODE_EXCL              ((__force fmode_t)0x80)
-/* File is opened using open(.., 3, ..) and is writeable only for ioctls
-   (specialy hack for floppy.c) */
-#define FMODE_WRITE_IOCTL       ((__force fmode_t)0x100)
-/* 32bit hashes as llseek() offset (for directories) */
-#define FMODE_32BITHASH         ((__force fmode_t)0x200)
-/* 64bit hashes as llseek() offset (for directories) */
-#define FMODE_64BITHASH         ((__force fmode_t)0x400)
-/*
- * Don't update ctime and mtime.
- *
- * Currently a special hack for the XFS open_by_handle ioctl, but we'll
- * hopefully graduate it to a proper O_CMTIME flag supported by open(2) soon.
- */
-#define FMODE_NOCMTIME          ((__force fmode_t)0x800)
-/* Expect random access pattern */
-#define FMODE_RANDOM            ((__force fmode_t)0x1000)
-/* File is huge (eg. /dev/kmem): treat loff_t as unsigned */
-#define FMODE_UNSIGNED_OFFSET   ((__force fmode_t)0x2000)
-/* File is opened with O_PATH; almost nothing can be done with it */
-#define FMODE_PATH              ((__force fmode_t)0x4000)
-/* File was opened by fanotify and shouldn't generate fanotify events */
-#define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
-/*
- * Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector
- * that indicates that they should check the contents of the iovec are
- * valid, but not check the memory that the iovec elements
- * points too.
- */
-#define CHECK_IOVEC_ONLY -1
-#define SEL_IN          1
-#define SEL_OUT         2
-#define SEL_EX          4
-/* public flags for file_system_type */
-#define FS_REQUIRES_DEV 1 
-#define FS_BINARY_MOUNTDATA 2
-#define FS_HAS_SUBTYPE 4
-#define FS_REVAL_DOT    16384   /* Check the paths ".", ".." for staleness */
-#define FS_RENAME_DOES_D_MOVE   32768   /* FS will handle d_move()
-                                         * during rename() internally.
-                                         */
 /*
 * These are the fs-independent mount-flags: up to 32 flags are supported
@@ -181,59 +102,6 @@ struct inodes_stat_t {
 #define MS_MGC_VAL 0xC0ED0000
 #define MS_MGC_MSK 0xffff0000
-/* Inode flags - they have nothing to superblock flags now */
-#define S_SYNC          1       /* Writes are synced at once */
-#define S_NOATIME       2       /* Do not update access times */
-#define S_APPEND        4       /* Append-only file */
-#define S_IMMUTABLE     8       /* Immutable file */
-#define S_DEAD          16      /* removed, but still open directory */
-#define S_NOQUOTA       32      /* Inode is not counted to quota */
-#define S_DIRSYNC       64      /* Directory modifications are synchronous */
-#define S_NOCMTIME      128     /* Do not update file c/mtime */
-#define S_SWAPFILE      256     /* Do not truncate: swapon got its bmaps */
-#define S_PRIVATE       512     /* Inode is fs-internal */
-#define S_IMA           1024    /* Inode has an associated IMA struct */
-#define S_AUTOMOUNT     2048    /* Automount/referral quasi-directory */
-#define S_NOSEC         4096    /* no suid or xattr security attributes */
-/*
- * Note that nosuid etc flags are inode-specific: setting some file-system
- * flags just means all the inodes inherit those flags by default. It might be
- * possible to override it selectively if you really wanted to with some
- * ioctl() that is not currently implemented.
- *
- * Exception: MS_RDONLY is always applied to the entire file system.
- *
- * Unfortunately, it is possible to change a filesystems flags with it mounted
- * with files in use.  This means that all of the inodes will not have their
- * i_flags updated.  Hence, i_flags no longer inherit the superblock mount
- * flags, so these have to be checked separately. -- rmk@arm.uk.linux.org
- */
-#define __IS_FLG(inode,flg) ((inode)->i_sb->s_flags & (flg))
-#define IS_RDONLY(inode) ((inode)->i_sb->s_flags & MS_RDONLY)
-#define IS_SYNC(inode)          (__IS_FLG(inode, MS_SYNCHRONOUS) || \
-                                        ((inode)->i_flags & S_SYNC))
-#define IS_DIRSYNC(inode)       (__IS_FLG(inode, MS_SYNCHRONOUS|MS_DIRSYNC) || \
-                                        ((inode)->i_flags & (S_SYNC|S_DIRSYNC)))
-#define IS_MANDLOCK(inode)      __IS_FLG(inode, MS_MANDLOCK)
-#define IS_NOATIME(inode)   __IS_FLG(inode, MS_RDONLY|MS_NOATIME)
-#define IS_I_VERSION(inode)   __IS_FLG(inode, MS_I_VERSION)
-#define IS_NOQUOTA(inode)       ((inode)->i_flags & S_NOQUOTA)
-#define IS_APPEND(inode)        ((inode)->i_flags & S_APPEND)
-#define IS_IMMUTABLE(inode)     ((inode)->i_flags & S_IMMUTABLE)
-#define IS_POSIXACL(inode)      __IS_FLG(inode, MS_POSIXACL)
-#define IS_DEADDIR(inode)       ((inode)->i_flags & S_DEAD)
-#define IS_NOCMTIME(inode)      ((inode)->i_flags & S_NOCMTIME)
-#define IS_SWAPFILE(inode)      ((inode)->i_flags & S_SWAPFILE)
-#define IS_PRIVATE(inode)       ((inode)->i_flags & S_PRIVATE)
-#define IS_IMA(inode)           ((inode)->i_flags & S_IMA)
-#define IS_AUTOMOUNT(inode)     ((inode)->i_flags & S_AUTOMOUNT)
-#define IS_NOSEC(inode)         ((inode)->i_flags & S_NOSEC)
 /* the read-only stuff doesn't really belong here, but any other place is
   probably as bad and I don't want to create yet another include file. */
diff --git a/include/uapi/linux/irqnr.h b/include/uapi/linux/irqnr.h
index e69de29bb2d1..ae5704fa77ad 100644
--- a/include/uapi/linux/irqnr.h
+++ b/include/uapi/linux/irqnr.h
@@ -0,0 +1,4 @@
+/*
+ * There isn't anything here anymore, but the file must not be empty or patch
+ * will delete it.
+ */
diff --git a/include/xen/Kbuild b/include/xen/Kbuild
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/include/xen/Kbuild
+++ /dev/null
diff --git a/kernel/printk.c b/kernel/printk.c
index 66a2ea37b576..2d607f4d1797 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1890,7 +1890,6 @@ static int __cpuinit console_cpu_notify(struct notifier_block *self,
        switch (action) {
        case CPU_ONLINE:
        case CPU_DEAD:
-        case CPU_DYING:
        case CPU_DOWN_FAILED:
        case CPU_UP_CANCELED:
                console_lock();
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index a863af26c79c..40f17c34b415 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -17,6 +17,7 @@
 #include <linux/khugepaged.h>
 #include <linux/freezer.h>
 #include <linux/mman.h>
+#include <linux/pagemap.h>
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
 #include "internal.h"
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 0b78fb9ea65b..d04a8a54c294 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1536,9 +1536,8 @@ asmlinkage long compat_sys_mbind(compat_ulong_t start, compat_ulong_t len,
 *
 * Returns effective policy for a VMA at specified address.
 * Falls back to @task or system default policy, as necessary.
- * Current or other task's task mempolicy and non-shared vma policies
+ * Current or other task's task mempolicy and non-shared vma policies must be
- * are protected by the task's mmap_sem, which must be held for read by
+ * protected by task_lock(task) by the caller.
- * the caller.
 * Shared policies [those marked as MPOL_F_SHARED] require an extra reference
 * count--added by the get_policy() vm_op, as appropriate--to protect against
 * freeing by another task.  It is the caller's responsibility to free the
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 9096bcb08132..ee070722a3a3 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -463,7 +463,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
        case NETDEV_PRE_TYPE_CHANGE:
                /* Forbid underlaying device to change its type. */
-                return NOTIFY_BAD;
+                if (vlan_uses_dev(dev))
+                        return NOTIFY_BAD;
+                break;
        case NETDEV_NOTIFY_PEERS:
        case NETDEV_BONDING_FAILOVER:
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index fbbf1fa00940..65e06abe023f 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -366,6 +366,13 @@ EXPORT_SYMBOL(vlan_vids_del_by_dev);
 bool vlan_uses_dev(const struct net_device *dev)
 {
-        return rtnl_dereference(dev->vlan_info) ? true : false;
+        struct vlan_info *vlan_info;
+        ASSERT_RTNL();
+        vlan_info = rtnl_dereference(dev->vlan_info);
+        if (!vlan_info)
+                return false;
+        return vlan_info->grp.nr_vlan_devs ? true : false;
 }
 EXPORT_SYMBOL(vlan_uses_dev);
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 0a9084ad19a6..fd8d5afec0dd 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1167,6 +1167,8 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
        uint16_t crc;
        unsigned long entrytime;
+        spin_lock_init(&bat_priv->bla.bcast_duplist_lock);
        batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla hash registering\n");
        /* setting claim destination address */
@@ -1210,8 +1212,8 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
 /**
 * batadv_bla_check_bcast_duplist
 * @bat_priv: the bat priv with all the soft interface information
- * @bcast_packet: originator mac address
+ * @bcast_packet: encapsulated broadcast frame plus batman header
- * @hdr_size: maximum length of the frame
+ * @bcast_packet_len: length of encapsulated broadcast frame plus batman header
 *
 * check if it is on our broadcast list. Another gateway might
 * have sent the same packet because it is connected to the same backbone,
@@ -1224,20 +1226,22 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
 */
 int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                                   struct batadv_bcast_packet *bcast_packet,
-                                   int hdr_size)
+                                   int bcast_packet_len)
 {
-        int i, length, curr;
+        int i, length, curr, ret = 0;
        uint8_t *content;
        uint16_t crc;
        struct batadv_bcast_duplist_entry *entry;
-        length = hdr_size - sizeof(*bcast_packet);
+        length = bcast_packet_len - sizeof(*bcast_packet);
        content = (uint8_t *)bcast_packet;
        content += sizeof(*bcast_packet);
        /* calculate the crc ... */
        crc = crc16(0, content, length);
+        spin_lock_bh(&bat_priv->bla.bcast_duplist_lock);
        for (i = 0; i < BATADV_DUPLIST_SIZE; i++) {
                curr = (bat_priv->bla.bcast_duplist_curr + i);
                curr %= BATADV_DUPLIST_SIZE;
@@ -1259,9 +1263,12 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                /* this entry seems to match: same crc, not too old,
                 * and from another gw. therefore return 1 to forbid it.
                 */
-                return 1;
+                ret = 1;
+                goto out;
        }
-        /* not found, add a new entry (overwrite the oldest entry) */
+        /* not found, add a new entry (overwrite the oldest entry)
+         * and allow it, its the first occurence.
+         */
        curr = (bat_priv->bla.bcast_duplist_curr + BATADV_DUPLIST_SIZE - 1);
        curr %= BATADV_DUPLIST_SIZE;
        entry = &bat_priv->bla.bcast_duplist[curr];
@@ -1270,8 +1277,10 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
        memcpy(entry->orig, bcast_packet->orig, ETH_ALEN);
        bat_priv->bla.bcast_duplist_curr = curr;
-        /* allow it, its the first occurence. */
+out:
-        return 0;
+        spin_unlock_bh(&bat_priv->bla.bcast_duplist_lock);
+        return ret;
 }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 939fc01371df..376b4cc6ca82 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1124,8 +1124,14 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
        spin_unlock_bh(&orig_node->bcast_seqno_lock);
+        /* keep skb linear for crc calculation */
+        if (skb_linearize(skb) < 0)
+                goto out;
+        bcast_packet = (struct batadv_bcast_packet *)skb->data;
        /* check whether this has been sent by another originator before */
-        if (batadv_bla_check_bcast_duplist(bat_priv, bcast_packet, hdr_size))
+        if (batadv_bla_check_bcast_duplist(bat_priv, bcast_packet, skb->len))
                goto out;
        /* rebroadcast packet */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 2ed82caacdca..ac1e07a80454 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -205,6 +205,8 @@ struct batadv_priv_bla {
        struct batadv_hashtable *backbone_hash;
        struct batadv_bcast_duplist_entry bcast_duplist[BATADV_DUPLIST_SIZE];
        int bcast_duplist_curr;
+        /* protects bcast_duplist and bcast_duplist_curr */
+        spinlock_t bcast_duplist_lock;
        struct batadv_bla_claim_dst claim_dest;
        struct delayed_work work;
 };
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 432f4bb77238..a8c651216fa6 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1163,8 +1163,12 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
        spin_lock_bh(&fnhe_lock);
        if (daddr == fnhe->fnhe_daddr) {
-                struct rtable *orig;
+                struct rtable *orig = rcu_dereference(fnhe->fnhe_rth);
+                if (orig && rt_is_expired(orig)) {
+                        fnhe->fnhe_gw = 0;
+                        fnhe->fnhe_pmtu = 0;
+                        fnhe->fnhe_expires = 0;
+                }
                if (fnhe->fnhe_pmtu) {
                        unsigned long expires = fnhe->fnhe_expires;
                        unsigned long diff = expires - jiffies;
@@ -1181,7 +1185,6 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
                } else if (!rt->rt_gateway)
                        rt->rt_gateway = daddr;
-                orig = rcu_dereference(fnhe->fnhe_rth);
                rcu_assign_pointer(fnhe->fnhe_rth, rt);
                if (orig)
                        rt_free(orig);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f32c02e2a543..b7c2f439b54f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -549,14 +549,12 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         !tp->urg_data ||
                         before(tp->urg_seq, tp->copied_seq) ||
                         !before(tp->urg_seq, tp->rcv_nxt)) {
-                        struct sk_buff *skb;
                        answ = tp->rcv_nxt - tp->copied_seq;
-                        /* Subtract 1, if FIN is in queue. */
+                        /* Subtract 1, if FIN was received */
-                        skb = skb_peek_tail(&sk->sk_receive_queue);
+                        if (answ && sock_flag(sk, SOCK_DONE))
-                        if (answ && skb)
+                                answ--;
-                                answ -= tcp_hdr(skb)->fin;
                } else
                        answ = tp->urg_seq - tp->copied_seq;
                release_sock(sk);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d7c56f8a5b4e..0424e4e27414 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3064,14 +3064,15 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
                struct hlist_node *n;
                hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
                                         addr_lst) {
+                        if (!net_eq(dev_net(ifa->idev->dev), net))
+                                continue;
                        /* sync with offset */
                        if (p < state->offset) {
                                p++;
                                continue;
                        }
                        state->offset++;
-                        if (net_eq(dev_net(ifa->idev->dev), net))
+                        return ifa;
-                                return ifa;
                }
                /* prepare for next bucket */
@@ -3089,18 +3090,20 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
        struct hlist_node *n = &ifa->addr_lst;
        hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst) {
+                if (!net_eq(dev_net(ifa->idev->dev), net))
+                        continue;
                state->offset++;
-                if (net_eq(dev_net(ifa->idev->dev), net))
+                return ifa;
-                        return ifa;
        }
        while (++state->bucket < IN6_ADDR_HSIZE) {
                state->offset = 0;
                hlist_for_each_entry_rcu_bh(ifa, n,
                                     &inet6_addr_lst[state->bucket], addr_lst) {
+                        if (!net_eq(dev_net(ifa->idev->dev), net))
+                                continue;
                        state->offset++;
-                        if (net_eq(dev_net(ifa->idev->dev), net))
+                        return ifa;
-                                return ifa;
                }
        }
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7e7198b51c06..c4ee43710aab 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2589,6 +2589,8 @@ __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
        struct ip_vs_proto_data *pd;
 #endif
+        memset(u, 0, sizeof (*u));
 #ifdef CONFIG_IP_VS_PROTO_TCP
        pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
        u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
@@ -2766,7 +2768,6 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        {
                struct ip_vs_timeout_user t;
-                memset(&t, 0, sizeof(t));
                __ip_vs_get_timeouts(net, &t);
                if (copy_to_user(user, &t, sizeof(t)) != 0)
                        ret = -EFAULT;
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 16c712563860..ae7f5daeee43 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -180,9 +180,9 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
        typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
        struct ctnl_timeout *timeout;
        struct nf_conn_timeout *timeout_ext;
-        const struct ipt_entry *e = par->entryinfo;
        struct nf_conntrack_l4proto *l4proto;
        int ret = 0;
+        u8 proto;
        rcu_read_lock();
        timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
@@ -192,9 +192,11 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
                goto out;
        }
-        if (e->ip.invflags & IPT_INV_PROTO) {
+        proto = xt_ct_find_proto(par);
+        if (!proto) {
                ret = -EINVAL;
-                pr_info("You cannot use inversion on L4 protocol\n");
+                pr_info("You must specify a L4 protocol, and not use "
+                        "inversions on it.\n");
                goto out;
        }
@@ -214,7 +216,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
        /* Make sure the timeout policy matches any existing protocol tracker,
         * otherwise default to generic.
         */
-        l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
+        l4proto = __nf_ct_l4proto_find(par->family, proto);
        if (timeout->l4proto->l4proto != l4proto->l4proto) {
                ret = -EINVAL;
                pr_info("Timeout policy `%s' can only be used by L4 protocol "
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index ee2e5bc5a8c7..bd93e51d30ac 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -70,6 +70,7 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
        fl4.daddr = info->gw.ip;
        fl4.flowi4_tos = RT_TOS(iph->tos);
        fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+        fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
        rt = ip_route_output_key(net, &fl4);
        if (IS_ERR(rt))
                return false;
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
index 81aafa8e4fef..bea7464cc43f 100644
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -111,7 +111,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .family         = NFPROTO_IPV4,
                .table          = "nat",
                .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                .me             = THIS_MODULE,
        },
        {
@@ -123,7 +123,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .family         = NFPROTO_IPV4,
                .table          = "nat",
                .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                .me             = THIS_MODULE,
        },
        {
@@ -133,7 +133,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .targetsize     = sizeof(struct nf_nat_range),
                .table          = "nat",
                .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                .me             = THIS_MODULE,
        },
        {
@@ -143,7 +143,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                .targetsize     = sizeof(struct nf_nat_range),
                .table          = "nat",
                .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                .me             = THIS_MODULE,
        },
 };
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 01e944a017a4..4da797fa5ec5 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -138,6 +138,8 @@ static int netlink_dump(struct sock *sk);
 static DEFINE_RWLOCK(nl_table_lock);
 static atomic_t nl_table_users = ATOMIC_INIT(0);
+#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));
 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
 static inline u32 netlink_group_mask(u32 group)
@@ -345,6 +347,11 @@ netlink_update_listeners(struct sock *sk)
        struct hlist_node *node;
        unsigned long mask;
        unsigned int i;
+        struct listeners *listeners;
+        listeners = nl_deref_protected(tbl->listeners);
+        if (!listeners)
+                return;
        for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
                mask = 0;
@@ -352,7 +359,7 @@ netlink_update_listeners(struct sock *sk)
                        if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
                                mask |= nlk_sk(sk)->groups[i];
                }
-                tbl->listeners->masks[i] = mask;
+                listeners->masks[i] = mask;
        }
        /* this function is only called with the netlink table "grabbed", which
         * makes sure updates are visible before bind or setsockopt return. */
@@ -536,7 +543,11 @@ static int netlink_release(struct socket *sock)
        if (netlink_is_kernel(sk)) {
                BUG_ON(nl_table[sk->sk_protocol].registered == 0);
                if (--nl_table[sk->sk_protocol].registered == 0) {
-                        kfree(nl_table[sk->sk_protocol].listeners);
+                        struct listeners *old;
+                        old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
+                        RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
+                        kfree_rcu(old, rcu);
                        nl_table[sk->sk_protocol].module = NULL;
                        nl_table[sk->sk_protocol].bind = NULL;
                        nl_table[sk->sk_protocol].flags = 0;
@@ -982,7 +993,7 @@ int netlink_has_listeners(struct sock *sk, unsigned int group)
        rcu_read_lock();
        listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);
-        if (group - 1 < nl_table[sk->sk_protocol].groups)
+        if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
                res = test_bit(group - 1, listeners->masks);
        rcu_read_unlock();
@@ -1625,7 +1636,7 @@ int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
                new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
                if (!new)
                        return -ENOMEM;
-                old = rcu_dereference_protected(tbl->listeners, 1);
+                old = nl_deref_protected(tbl->listeners);
                memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
                rcu_assign_pointer(tbl->listeners, new);
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 57f7de839b03..6773d7803627 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1642,8 +1642,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                        asoc->outqueue.outstanding_bytes;
                        sackh.num_gap_ack_blocks = 0;
                        sackh.num_dup_tsns = 0;
+                        chunk->subh.sack_hdr = &sackh;
                        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK,
-                                        SCTP_SACKH(&sackh));
+                                        SCTP_CHUNK(chunk));
                        break;
                case SCTP_CMD_DISCARD_PACKET:
diff --git a/scripts/Makefile.asm-generic b/scripts/Makefile.asm-generic
index 40caf3c26cd5..d17e0ea911ed 100644
--- a/scripts/Makefile.asm-generic
+++ b/scripts/Makefile.asm-generic
@@ -5,7 +5,7 @@
 # and for each file listed in this file with generic-y creates
 # a small wrapper file in $(obj) (arch/$(SRCARCH)/include/generated/asm)
-kbuild-file := $(srctree)/arch/$(SRCARCH)/include/asm/Kbuild
+kbuild-file := $(srctree)/arch/$(SRCARCH)/include/$(src)/Kbuild
 -include $(kbuild-file)
 include scripts/Kbuild.include
diff --git a/scripts/Makefile.fwinst b/scripts/Makefile.fwinst
index c3f69ae275d1..4d908d16c035 100644
--- a/scripts/Makefile.fwinst
+++ b/scripts/Makefile.fwinst
@@ -27,7 +27,7 @@ endif
 installed-mod-fw := $(addprefix $(INSTALL_FW_PATH)/,$(mod-fw))
 installed-fw := $(addprefix $(INSTALL_FW_PATH)/,$(fw-shipped-all))
-installed-fw-dirs := $(sort $(dir $(installed-fw))) $(INSTALL_FW_PATH)/.
+installed-fw-dirs := $(sort $(dir $(installed-fw))) $(INSTALL_FW_PATH)/./
 # Workaround for make < 3.81, where .SECONDEXPANSION doesn't work.
 PHONY += $(INSTALL_FW_PATH)/$$(%) install-all-dirs
@@ -42,7 +42,7 @@ quiet_cmd_install = INSTALL $(subst $(srctree)/,,$@)
 $(installed-fw-dirs):
        $(call cmd,mkdir)
-$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $$(dir $(INSTALL_FW_PATH)/%)
+$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $(INSTALL_FW_PATH)/$$(dir %)
        $(call cmd,install)
 PHONY +=  __fw_install __fw_modinst FORCE
diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
index 7b3021cebbea..5706b74c857f 100644
--- a/security/apparmor/Makefile
+++ b/security/apparmor/Makefile
@@ -57,7 +57,7 @@ cmd_make-rlim = echo "static const char *const rlim_names[RLIM_NLIMITS] = {" \
 $(obj)/capability.o : $(obj)/capability_names.h
 $(obj)/resource.o : $(obj)/rlim_names.h
-$(obj)/capability_names.h : $(srctree)/include/linux/capability.h \
+$(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \
                            $(src)/Makefile
        $(call cmd,make-caps)
 $(obj)/rlim_names.h : $(srctree)/include/uapi/asm-generic/resource.h \
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 24ab4148547c..61a53367d029 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2132,18 +2132,14 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                return;
        devnull = dentry_open(&selinux_null, O_RDWR, cred);
-        if (!IS_ERR(devnull)) {
+        if (IS_ERR(devnull))
-                /* replace all the matching ones with this */
+                devnull = NULL;
-                do {
+        /* replace all the matching ones with this */
-                        replace_fd(n - 1, get_file(devnull), 0);
+        do {
-                } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
+                replace_fd(n - 1, devnull, 0);
+        } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
+        if (devnull)
                fput(devnull);
-        } else {
-                /* just close all the matching ones */
-                do {
-                        replace_fd(n - 1, NULL, 0);
-                } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
-        }
 }
 /*