Merge commit 'v3.5-rc3' into x86/debug

Merge it in to pick up a fix that we are going to clean up in this
branch.

Signed-off-by: Ingo Molnar <mingo@kernel.org>

103 files changed, 557 insertions, 779 deletions

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index b649c5904a4..84449dd8f03 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -7,7 +7,6 @@ config ARM
         select HAVE_IDE if PCI || ISA || PCMCIA
         select HAVE_DMA_ATTRS
         select HAVE_DMA_CONTIGUOUS if (CPU_V6 || CPU_V6K || CPU_V7)
-        select CMA if (CPU_V6 || CPU_V6K || CPU_V7)
         select HAVE_MEMBLOCK
         select RTC_LIB
         select SYS_SUPPORTS_APM_EMULATION
diff --git a/arch/arm/common/dmabounce.c b/arch/arm/common/dmabounce.c
index 9d7eb530f95..aa07f5938f0 100644
--- a/arch/arm/common/dmabounce.c
+++ b/arch/arm/common/dmabounce.c
@@ -366,8 +366,8 @@ static int __dmabounce_sync_for_cpu(struct device *dev, dma_addr_t addr,
         struct safe_buffer *buf;
         unsigned long off;
 
-        dev_dbg(dev, "%s(dma=%#x,off=%#lx,sz=%zx,dir=%x)\n",
-                __func__, addr, off, sz, dir);
+        dev_dbg(dev, "%s(dma=%#x,sz=%zx,dir=%x)\n",
+                __func__, addr, sz, dir);
 
         buf = find_safe_buffer_dev(dev, addr, __func__);
         if (!buf)
@@ -377,8 +377,8 @@ static int __dmabounce_sync_for_cpu(struct device *dev, dma_addr_t addr,
 
         BUG_ON(buf->direction != dir);
 
-        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x) mapped to %p (dma=%#x)\n",
-                __func__, buf->ptr, virt_to_dma(dev, buf->ptr),
+        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x off=%#lx) mapped to %p (dma=%#x)\n",
+                __func__, buf->ptr, virt_to_dma(dev, buf->ptr), off,
                 buf->safe, buf->safe_dma_addr);
 
         DO_STATS(dev->archdata.dmabounce->bounce_count++);
@@ -406,8 +406,8 @@ static int __dmabounce_sync_for_device(struct device *dev, dma_addr_t addr,
         struct safe_buffer *buf;
         unsigned long off;
 
-        dev_dbg(dev, "%s(dma=%#x,off=%#lx,sz=%zx,dir=%x)\n",
-                __func__, addr, off, sz, dir);
+        dev_dbg(dev, "%s(dma=%#x,sz=%zx,dir=%x)\n",
+                __func__, addr, sz, dir);
 
         buf = find_safe_buffer_dev(dev, addr, __func__);
         if (!buf)
@@ -417,8 +417,8 @@ static int __dmabounce_sync_for_device(struct device *dev, dma_addr_t addr,
 
         BUG_ON(buf->direction != dir);
 
-        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x) mapped to %p (dma=%#x)\n",
-                __func__, buf->ptr, virt_to_dma(dev, buf->ptr),
+        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x off=%#lx) mapped to %p (dma=%#x)\n",
+                __func__, buf->ptr, virt_to_dma(dev, buf->ptr), off,
                 buf->safe, buf->safe_dma_addr);
 
         DO_STATS(dev->archdata.dmabounce->bounce_count++);
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index 54d49ddb9b8..5fb47a14f4b 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -271,9 +271,9 @@ static struct platform_device *create_simple_dss_pdev(const char *pdev_name,
                 goto err;
         }
 
-        r = omap_device_register(pdev);
+        r = platform_device_add(pdev);
         if (r) {
-                pr_err("Could not register omap_device for %s\n", pdev_name);
+                pr_err("Could not register platform_device for %s\n", pdev_name);
                 goto err;
         }
 
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index ea6b4315409..d766e4256b7 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -228,7 +228,7 @@ static pte_t **consistent_pte;
 
 #define DEFAULT_CONSISTENT_DMA_SIZE SZ_2M
 
-unsigned long consistent_base = CONSISTENT_END - DEFAULT_CONSISTENT_DMA_SIZE;
+static unsigned long consistent_base = CONSISTENT_END - DEFAULT_CONSISTENT_DMA_SIZE;
 
 void __init init_consistent_dma_size(unsigned long size)
 {
@@ -268,10 +268,8 @@ static int __init consistent_init(void)
         unsigned long base = consistent_base;
         unsigned long num_ptes = (CONSISTENT_END - base) >> PMD_SHIFT;
 
-#ifndef CONFIG_ARM_DMA_USE_IOMMU
-        if (cpu_architecture() >= CPU_ARCH_ARMv6)
+        if (IS_ENABLED(CONFIG_CMA) && !IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU))
                 return 0;
-#endif
 
         consistent_pte = kmalloc(num_ptes * sizeof(pte_t), GFP_KERNEL);
         if (!consistent_pte) {
@@ -323,7 +321,7 @@ static struct arm_vmregion_head coherent_head = {
         .vm_list        = LIST_HEAD_INIT(coherent_head.vm_list),
 };
 
-size_t coherent_pool_size = DEFAULT_CONSISTENT_DMA_SIZE / 8;
+static size_t coherent_pool_size = DEFAULT_CONSISTENT_DMA_SIZE / 8;
 
 static int __init early_coherent_pool(char *p)
 {
@@ -342,7 +340,7 @@ static int __init coherent_init(void)
         struct page *page;
         void *ptr;
 
-        if (cpu_architecture() < CPU_ARCH_ARMv6)
+        if (!IS_ENABLED(CONFIG_CMA))
                 return 0;
 
         ptr = __alloc_from_contiguous(NULL, size, prot, &page);
@@ -704,7 +702,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
 
         if (arch_is_coherent() || nommu())
                 addr = __alloc_simple_buffer(dev, size, gfp, &page);
-        else if (cpu_architecture() < CPU_ARCH_ARMv6)
+        else if (!IS_ENABLED(CONFIG_CMA))
                 addr = __alloc_remap_buffer(dev, size, gfp, prot, &page, caller);
         else if (gfp & GFP_ATOMIC)
                 addr = __alloc_from_pool(dev, size, &page, caller);
@@ -773,7 +771,7 @@ void arm_dma_free(struct device *dev, size_t size, void *cpu_addr,
 
         if (arch_is_coherent() || nommu()) {
                 __dma_free_buffer(page, size);
-        } else if (cpu_architecture() < CPU_ARCH_ARMv6) {
+        } else if (!IS_ENABLED(CONFIG_CMA)) {
                 __dma_free_remap(cpu_addr, size);
                 __dma_free_buffer(page, size);
         } else {
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c21d06c7dd7..f54d5921976 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -212,7 +212,7 @@ EXPORT_SYMBOL(arm_dma_zone_size);
  * allocations.  This must be the smallest DMA mask in the system,
  * so a successful GFP_DMA allocation will always satisfy this.
  */
-u32 arm_dma_limit;
+phys_addr_t arm_dma_limit;
 
 static void __init arm_adjust_dma_zone(unsigned long *size, unsigned long *hole,
         unsigned long dma_size)
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index 93dc0c17cdc..c471436c795 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -62,7 +62,7 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
 #endif
 
 #ifdef CONFIG_ZONE_DMA
-extern u32 arm_dma_limit;
+extern phys_addr_t arm_dma_limit;
 #else
 #define arm_dma_limit ((u32)~0)
 #endif
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index cac5b6be572..14712012826 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -7,6 +7,8 @@ config M68K
         select GENERIC_IRQ_SHOW
         select ARCH_HAVE_NMI_SAFE_CMPXCHG if RMW_INSNS
         select GENERIC_CPU_DEVICES
+        select GENERIC_STRNCPY_FROM_USER if MMU
+        select GENERIC_STRNLEN_USER if MMU
         select FPU if MMU
         select ARCH_USES_GETTIMEOFFSET if MMU && !COLDFIRE
 
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 1a922fad76f..eafa2539a8e 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,2 +1,4 @@
 include include/asm-generic/Kbuild.asm
 header-y += cachectl.h
+
+generic-y += word-at-a-time.h
diff --git a/arch/m68k/include/asm/m528xsim.h b/arch/m68k/include/asm/m528xsim.h
index d63b99ff7ff..497c31c803f 100644
--- a/arch/m68k/include/asm/m528xsim.h
+++ b/arch/m68k/include/asm/m528xsim.h
@@ -86,7 +86,7 @@
 /*
  *      QSPI module.
  */
-#define MCFQSPI_IOBASE          (MCF_IPSBAR + 0x340)
+#define MCFQSPI_BASE            (MCF_IPSBAR + 0x340)
 #define MCFQSPI_SIZE            0x40
 
 #define MCFQSPI_CS0             147
diff --git a/arch/m68k/include/asm/uaccess_mm.h b/arch/m68k/include/asm/uaccess_mm.h
index 9c80cd515b2..472c891a4ae 100644
--- a/arch/m68k/include/asm/uaccess_mm.h
+++ b/arch/m68k/include/asm/uaccess_mm.h
@@ -379,12 +379,15 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
 #define copy_from_user(to, from, n)     __copy_from_user(to, from, n)
 #define copy_to_user(to, from, n)       __copy_to_user(to, from, n)
 
-long strncpy_from_user(char *dst, const char __user *src, long count);
-long strnlen_user(const char __user *src, long n);
+#define user_addr_max() \
+        (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL)
+
+extern long strncpy_from_user(char *dst, const char __user *src, long count);
+extern __must_check long strlen_user(const char __user *str);
+extern __must_check long strnlen_user(const char __user *str, long n);
+
 unsigned long __clear_user(void __user *to, unsigned long n);
 
 #define clear_user      __clear_user
 
-#define strlen_user(str) strnlen_user(str, 32767)
-
 #endif /* _M68K_UACCESS_H */
diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c
index 8b4a2222e65..1bc10e62b9a 100644
--- a/arch/m68k/kernel/ptrace.c
+++ b/arch/m68k/kernel/ptrace.c
@@ -286,7 +286,7 @@ asmlinkage void syscall_trace(void)
         }
 }
 
-#ifdef CONFIG_COLDFIRE
+#if defined(CONFIG_COLDFIRE) || !defined(CONFIG_MMU)
 asmlinkage int syscall_trace_enter(void)
 {
         int ret = 0;
diff --git a/arch/m68k/kernel/time.c b/arch/m68k/kernel/time.c
index d7deb7fc7eb..707f0573ec6 100644
--- a/arch/m68k/kernel/time.c
+++ b/arch/m68k/kernel/time.c
@@ -85,7 +85,7 @@ void __init time_init(void)
         mach_sched_init(timer_interrupt);
 }
 
-#ifdef CONFIG_M68KCLASSIC
+#ifdef CONFIG_ARCH_USES_GETTIMEOFFSET
 
 u32 arch_gettimeoffset(void)
 {
@@ -108,4 +108,4 @@ static int __init rtc_init(void)
 
 module_init(rtc_init);
 
-#endif /* CONFIG_M68KCLASSIC */
+#endif /* CONFIG_ARCH_USES_GETTIMEOFFSET */
diff --git a/arch/m68k/lib/uaccess.c b/arch/m68k/lib/uaccess.c
index 5664386338d..5e97f2ee7c1 100644
--- a/arch/m68k/lib/uaccess.c
+++ b/arch/m68k/lib/uaccess.c
@@ -104,80 +104,6 @@ unsigned long __generic_copy_to_user(void __user *to, const void *from,
 EXPORT_SYMBOL(__generic_copy_to_user);
 
 /*
- * Copy a null terminated string from userspace.
- */
-long strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res;
-        char c;
-
-        if (count <= 0)
-                return count;
-
-        asm volatile ("\n"
-                "1:     "MOVES".b       (%2)+,%4\n"
-                "       move.b  %4,(%1)+\n"
-                "       jeq     2f\n"
-                "       subq.l  #1,%3\n"
-                "       jne     1b\n"
-                "2:     sub.l   %3,%0\n"
-                "3:\n"
-                "       .section .fixup,\"ax\"\n"
-                "       .even\n"
-                "10:    move.l  %5,%0\n"
-                "       jra     3b\n"
-                "       .previous\n"
-                "\n"
-                "       .section __ex_table,\"a\"\n"
-                "       .align  4\n"
-                "       .long   1b,10b\n"
-                "       .previous"
-                : "=d" (res), "+a" (dst), "+a" (src), "+r" (count), "=&d" (c)
-                : "i" (-EFAULT), "0" (count));
-
-        return res;
-}
-EXPORT_SYMBOL(strncpy_from_user);
-
-/*
- * Return the size of a string (including the ending 0)
- *
- * Return 0 on exception, a value greater than N if too long
- */
-long strnlen_user(const char __user *src, long n)
-{
-        char c;
-        long res;
-
-        asm volatile ("\n"
-                "1:     subq.l  #1,%1\n"
-                "       jmi     3f\n"
-                "2:     "MOVES".b       (%0)+,%2\n"
-                "       tst.b   %2\n"
-                "       jne     1b\n"
-                "       jra     4f\n"
-                "\n"
-                "3:     addq.l  #1,%0\n"
-                "4:     sub.l   %4,%0\n"
-                "5:\n"
-                "       .section .fixup,\"ax\"\n"
-                "       .even\n"
-                "20:    sub.l   %0,%0\n"
-                "       jra     5b\n"
-                "       .previous\n"
-                "\n"
-                "       .section __ex_table,\"a\"\n"
-                "       .align  4\n"
-                "       .long   2b,20b\n"
-                "       .previous\n"
-                : "=&a" (res), "+d" (n), "=&d" (c)
-                : "0" (src), "r" (src));
-
-        return res;
-}
-EXPORT_SYMBOL(strnlen_user);
-
-/*
  * Zero Userspace
  */
 
diff --git a/arch/m68k/platform/68328/timers.c b/arch/m68k/platform/68328/timers.c
index c801c172b82..f4dc9b29560 100644
--- a/arch/m68k/platform/68328/timers.c
+++ b/arch/m68k/platform/68328/timers.c
@@ -53,6 +53,7 @@
 #endif
 
 static u32 m68328_tick_cnt;
+static irq_handler_t timer_interrupt;
 
 /***************************************************************************/
 
@@ -62,7 +63,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
         TSTAT &= 0;
 
         m68328_tick_cnt += TICKS_PER_JIFFY;
-        return arch_timer_interrupt(irq, dummy);
+        return timer_interrupt(irq, dummy);
 }
 
 /***************************************************************************/
@@ -99,7 +100,7 @@ static struct clocksource m68328_clk = {
 
 /***************************************************************************/
 
-void hw_timer_init(void)
+void hw_timer_init(irq_handler_t handler)
 {
         /* disable timer 1 */
         TCTL = 0;
@@ -115,6 +116,7 @@ void hw_timer_init(void)
         /* Enable timer 1 */
         TCTL |= TCTL_TEN;
         clocksource_register_hz(&m68328_clk, TICKS_PER_JIFFY*HZ);
+        timer_interrupt = handler;
 }
 
 /***************************************************************************/
diff --git a/arch/m68k/platform/68360/config.c b/arch/m68k/platform/68360/config.c
index 255fc03913e..9877cefad1e 100644
--- a/arch/m68k/platform/68360/config.c
+++ b/arch/m68k/platform/68360/config.c
@@ -35,6 +35,7 @@ extern void m360_cpm_reset(void);
 #define OSCILLATOR  (unsigned long int)33000000
 #endif
 
+static irq_handler_t timer_interrupt;
 unsigned long int system_clock;
 
 extern QUICC *pquicc;
@@ -52,7 +53,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
 
   pquicc->timer_ter1 = 0x0002; /* clear timer event */
 
-  return arch_timer_interrupt(irq, dummy);
+  return timer_interrupt(irq, dummy);
 }
 
 static struct irqaction m68360_timer_irq = {
@@ -61,7 +62,7 @@ static struct irqaction m68360_timer_irq = {
         .handler = hw_tick,
 };
 
-void hw_timer_init(void)
+void hw_timer_init(irq_handler_t handler)
 {
   unsigned char prescaler;
   unsigned short tgcr_save;
@@ -94,6 +95,8 @@ void hw_timer_init(void)
 
   pquicc->timer_ter1 = 0x0003; /* clear timer events */
 
+  timer_interrupt = handler;
+
   /* enable timer 1 interrupt in CIMR */
   setup_irq(CPMVEC_TIMER1, &m68360_timer_irq);
 
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index dbc3850b1d0..5707f1a6234 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -21,6 +21,7 @@ KBUILD_DEFCONFIG := default_defconfig
 
 NM              = sh $(srctree)/arch/parisc/nm
 CHECKFLAGS      += -D__hppa__=1
+LIBGCC          = $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
 
 MACHINE         := $(shell uname -m)
 ifeq ($(MACHINE),parisc*)
@@ -79,7 +80,7 @@ kernel-y			:= mm/ kernel/ math-emu/
 kernel-$(CONFIG_HPUX)           += hpux/
 
 core-y  += $(addprefix arch/parisc/, $(kernel-y))
-libs-y  += arch/parisc/lib/ `$(CC) -print-libgcc-file-name`
+libs-y  += arch/parisc/lib/ $(LIBGCC)
 
 drivers-$(CONFIG_OPROFILE)              += arch/parisc/oprofile/
 
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index 19a434f5505..4383707d980 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -1,3 +1,4 @@
 include include/asm-generic/Kbuild.asm
 
 header-y += pdc.h
+generic-y += word-at-a-time.h
diff --git a/arch/parisc/include/asm/bug.h b/arch/parisc/include/asm/bug.h
index 72cfdb0cfdd..62a33338549 100644
--- a/arch/parisc/include/asm/bug.h
+++ b/arch/parisc/include/asm/bug.h
@@ -1,6 +1,8 @@
 #ifndef _PARISC_BUG_H
 #define _PARISC_BUG_H
 
+#include <linux/kernel.h>       /* for BUGFLAG_TAINT */
+
 /*
  * Tell the user there is some problem.
  * The offending file and line are encoded in the __bug_table section.
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index c9aac24b02e..32b394f3b85 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -100,6 +100,9 @@ static inline void hard_irq_disable(void)
         get_paca()->irq_happened |= PACA_IRQ_HARD_DIS;
 }
 
+/* include/linux/interrupt.h needs hard_irq_disable to be a macro */
+#define hard_irq_disable        hard_irq_disable
+
 /*
  * This is called by asynchronous interrupts to conditionally
  * re-enable hard interrupts when soft-disabled after having
diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
index 0b6d79617d7..2e3200ca485 100644
--- a/arch/powerpc/kernel/module_32.c
+++ b/arch/powerpc/kernel/module_32.c
@@ -176,8 +176,8 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
 
 static inline int entry_matches(struct ppc_plt_entry *entry, Elf32_Addr val)
 {
-        if (entry->jump[0] == 0x3d600000 + ((val + 0x8000) >> 16)
-            && entry->jump[1] == 0x396b0000 + (val & 0xffff))
+        if (entry->jump[0] == 0x3d800000 + ((val + 0x8000) >> 16)
+            && entry->jump[1] == 0x398c0000 + (val & 0xffff))
                 return 1;
         return 0;
 }
@@ -204,10 +204,9 @@ static uint32_t do_plt_call(void *location,
                 entry++;
         }
 
-        /* Stolen from Paul Mackerras as well... */
-        entry->jump[0] = 0x3d600000+((val+0x8000)>>16); /* lis r11,sym@ha */
-        entry->jump[1] = 0x396b0000 + (val&0xffff);     /* addi r11,r11,sym@l*/
-        entry->jump[2] = 0x7d6903a6;                    /* mtctr r11 */
+        entry->jump[0] = 0x3d800000+((val+0x8000)>>16); /* lis r12,sym@ha */
+        entry->jump[1] = 0x398c0000 + (val&0xffff);     /* addi r12,r12,sym@l*/
+        entry->jump[2] = 0x7d8903a6;                    /* mtctr r12 */
         entry->jump[3] = 0x4e800420;                    /* bctr */
 
         DEBUGP("Initialized plt for 0x%x at %p\n", val, entry);
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 99a995c2a3f..be171ee73bf 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -475,6 +475,7 @@ void timer_interrupt(struct pt_regs * regs)
         struct pt_regs *old_regs;
         u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
         struct clock_event_device *evt = &__get_cpu_var(decrementers);
+        u64 now;
 
         /* Ensure a positive value is written to the decrementer, or else
          * some CPUs will continue to take decrementer exceptions.
@@ -509,9 +510,16 @@ void timer_interrupt(struct pt_regs * regs)
                 irq_work_run();
         }
 
-        *next_tb = ~(u64)0;
-        if (evt->event_handler)
-                evt->event_handler(evt);
+        now = get_tb_or_rtc();
+        if (now >= *next_tb) {
+                *next_tb = ~(u64)0;
+                if (evt->event_handler)
+                        evt->event_handler(evt);
+        } else {
+                now = *next_tb - now;
+                if (now <= DECREMENTER_MAX)
+                        set_dec((int)now);
+        }
 
 #ifdef CONFIG_PPC64
         /* collect purr register values often, for accurate calculations */
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 99bcd0ee838..31d9db7913e 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -32,6 +32,8 @@ config SUPERH
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_CLOCKEVENTS
         select GENERIC_CMOS_UPDATE if SH_SH03 || SH_DREAMCAST
+        select GENERIC_STRNCPY_FROM_USER
+        select GENERIC_STRNLEN_USER
         help
           The SuperH is a RISC processor targeted for use in embedded systems
           and consumer electronics; it was also used in the Sega Dreamcast
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 46edf070da1..aed701c7b11 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -9,6 +9,12 @@
 # License.  See the file "COPYING" in the main directory of this archive
 # for more details.
 #
+ifneq ($(SUBARCH),$(ARCH))
+  ifeq ($(CROSS_COMPILE),)
+    CROSS_COMPILE := $(call cc-cross-prefix, $(UTS_MACHINE)-linux-  $(UTS_MACHINE)-linux-gnu-  $(UTS_MACHINE)-unknown-linux-gnu-)
+  endif
+endif
+
 isa-y                                   := any
 isa-$(CONFIG_SH_DSP)                    := sh
 isa-$(CONFIG_CPU_SH2)                   := sh2
@@ -106,19 +112,13 @@ LDFLAGS_vmlinux		+= --defsym phys_stext=_stext-$(CONFIG_PAGE_OFFSET) \
 KBUILD_DEFCONFIG        := cayman_defconfig
 endif
 
-ifneq ($(SUBARCH),$(ARCH))
-  ifeq ($(CROSS_COMPILE),)
-    CROSS_COMPILE := $(call cc-cross-prefix, $(UTS_MACHINE)-linux-  $(UTS_MACHINE)-linux-gnu-  $(UTS_MACHINE)-unknown-linux-gnu-)
-  endif
-endif
-
 ifdef CONFIG_CPU_LITTLE_ENDIAN
 ld-bfd                  := elf32-$(UTS_MACHINE)-linux
-LDFLAGS_vmlinux         += --defsym 'jiffies=jiffies_64' --oformat $(ld-bfd)
+LDFLAGS_vmlinux         += --defsym jiffies=jiffies_64 --oformat $(ld-bfd)
 LDFLAGS                 += -EL
 else
 ld-bfd                  := elf32-$(UTS_MACHINE)big-linux
-LDFLAGS_vmlinux         += --defsym 'jiffies=jiffies_64+4' --oformat $(ld-bfd)
+LDFLAGS_vmlinux         += --defsym jiffies=jiffies_64+4 --oformat $(ld-bfd)
 LDFLAGS                 += -EB
 endif
 
diff --git a/arch/sh/include/asm/Kbuild b/arch/sh/include/asm/Kbuild
index 7beb42322f6..7b673ddcd55 100644
--- a/arch/sh/include/asm/Kbuild
+++ b/arch/sh/include/asm/Kbuild
@@ -1,5 +1,39 @@
 include include/asm-generic/Kbuild.asm
 
+generic-y += bitsperlong.h
+generic-y += cputime.h
+generic-y += current.h
+generic-y += delay.h
+generic-y += div64.h
+generic-y += emergency-restart.h
+generic-y += errno.h
+generic-y += fcntl.h
+generic-y += ioctl.h
+generic-y += ipcbuf.h
+generic-y += irq_regs.h
+generic-y += kvm_para.h
+generic-y += local.h
+generic-y += local64.h
+generic-y += param.h
+generic-y += parport.h
+generic-y += percpu.h
+generic-y += poll.h
+generic-y += mman.h
+generic-y += msgbuf.h
+generic-y += resource.h
+generic-y += scatterlist.h
+generic-y += sembuf.h
+generic-y += serial.h
+generic-y += shmbuf.h
+generic-y += siginfo.h
+generic-y += sizes.h
+generic-y += socket.h
+generic-y += statfs.h
+generic-y += termbits.h
+generic-y += termios.h
+generic-y += ucontext.h
+generic-y += xor.h
+
 header-y += cachectl.h
 header-y += cpu-features.h
 header-y += hw_breakpoint.h
diff --git a/arch/sh/include/asm/bitsperlong.h b/arch/sh/include/asm/bitsperlong.h
deleted file mode 100644
index 6dc0bb0c13b..00000000000
--- a/arch/sh/include/asm/bitsperlong.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/bitsperlong.h>
diff --git a/arch/sh/include/asm/cputime.h b/arch/sh/include/asm/cputime.h
deleted file mode 100644
index 6ca395d1393..00000000000
--- a/arch/sh/include/asm/cputime.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __SH_CPUTIME_H
-#define __SH_CPUTIME_H
-
-#include <asm-generic/cputime.h>
-
-#endif /* __SH_CPUTIME_H */
diff --git a/arch/sh/include/asm/current.h b/arch/sh/include/asm/current.h
deleted file mode 100644
index 4c51401b553..00000000000
--- a/arch/sh/include/asm/current.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/current.h>
diff --git a/arch/sh/include/asm/delay.h b/arch/sh/include/asm/delay.h
deleted file mode 100644
index 9670e127b7b..00000000000
--- a/arch/sh/include/asm/delay.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/delay.h>
diff --git a/arch/sh/include/asm/div64.h b/arch/sh/include/asm/div64.h
deleted file mode 100644
index 6cd978cefb2..00000000000
--- a/arch/sh/include/asm/div64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/div64.h>
diff --git a/arch/sh/include/asm/emergency-restart.h b/arch/sh/include/asm/emergency-restart.h
deleted file mode 100644
index 108d8c48e42..00000000000
--- a/arch/sh/include/asm/emergency-restart.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _ASM_EMERGENCY_RESTART_H
-#define _ASM_EMERGENCY_RESTART_H
-
-#include <asm-generic/emergency-restart.h>
-
-#endif /* _ASM_EMERGENCY_RESTART_H */
diff --git a/arch/sh/include/asm/errno.h b/arch/sh/include/asm/errno.h
deleted file mode 100644
index 51cf6f9cebb..00000000000
--- a/arch/sh/include/asm/errno.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_ERRNO_H
-#define __ASM_SH_ERRNO_H
-
-#include <asm-generic/errno.h>
-
-#endif /* __ASM_SH_ERRNO_H */
diff --git a/arch/sh/include/asm/fcntl.h b/arch/sh/include/asm/fcntl.h
deleted file mode 100644
index 46ab12db573..00000000000
--- a/arch/sh/include/asm/fcntl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/fcntl.h>
diff --git a/arch/sh/include/asm/ioctl.h b/arch/sh/include/asm/ioctl.h
deleted file mode 100644
index b279fe06dfe..00000000000
--- a/arch/sh/include/asm/ioctl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ioctl.h>
diff --git a/arch/sh/include/asm/ipcbuf.h b/arch/sh/include/asm/ipcbuf.h
deleted file mode 100644
index 84c7e51cb6d..00000000000
--- a/arch/sh/include/asm/ipcbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ipcbuf.h>
diff --git a/arch/sh/include/asm/irq_regs.h b/arch/sh/include/asm/irq_regs.h
deleted file mode 100644
index 3dd9c0b7027..00000000000
--- a/arch/sh/include/asm/irq_regs.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/irq_regs.h>
diff --git a/arch/sh/include/asm/kvm_para.h b/arch/sh/include/asm/kvm_para.h
deleted file mode 100644
index 14fab8f0b95..00000000000
--- a/arch/sh/include/asm/kvm_para.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/kvm_para.h>
diff --git a/arch/sh/include/asm/local.h b/arch/sh/include/asm/local.h
deleted file mode 100644
index 9ed9b9cb459..00000000000
--- a/arch/sh/include/asm/local.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef __ASM_SH_LOCAL_H
-#define __ASM_SH_LOCAL_H
-
-#include <asm-generic/local.h>
-
-#endif /* __ASM_SH_LOCAL_H */
-
diff --git a/arch/sh/include/asm/local64.h b/arch/sh/include/asm/local64.h
deleted file mode 100644
index 36c93b5cc23..00000000000
--- a/arch/sh/include/asm/local64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/local64.h>
diff --git a/arch/sh/include/asm/mman.h b/arch/sh/include/asm/mman.h
deleted file mode 100644
index 8eebf89f5ab..00000000000
--- a/arch/sh/include/asm/mman.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/mman.h>
diff --git a/arch/sh/include/asm/msgbuf.h b/arch/sh/include/asm/msgbuf.h
deleted file mode 100644
index 809134c644a..00000000000
--- a/arch/sh/include/asm/msgbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/msgbuf.h>
diff --git a/arch/sh/include/asm/param.h b/arch/sh/include/asm/param.h
deleted file mode 100644
index 965d4542797..00000000000
--- a/arch/sh/include/asm/param.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/param.h>
diff --git a/arch/sh/include/asm/parport.h b/arch/sh/include/asm/parport.h
deleted file mode 100644
index cf252af6459..00000000000
--- a/arch/sh/include/asm/parport.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/parport.h>
diff --git a/arch/sh/include/asm/percpu.h b/arch/sh/include/asm/percpu.h
deleted file mode 100644
index 4db4b39a439..00000000000
--- a/arch/sh/include/asm/percpu.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ARCH_SH_PERCPU
-#define __ARCH_SH_PERCPU
-
-#include <asm-generic/percpu.h>
-
-#endif /* __ARCH_SH_PERCPU */
diff --git a/arch/sh/include/asm/poll.h b/arch/sh/include/asm/poll.h
deleted file mode 100644
index c98509d3149..00000000000
--- a/arch/sh/include/asm/poll.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/poll.h>
diff --git a/arch/sh/include/asm/resource.h b/arch/sh/include/asm/resource.h
deleted file mode 100644
index 9c2499a86ec..00000000000
--- a/arch/sh/include/asm/resource.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_RESOURCE_H
-#define __ASM_SH_RESOURCE_H
-
-#include <asm-generic/resource.h>
-
-#endif /* __ASM_SH_RESOURCE_H */
diff --git a/arch/sh/include/asm/scatterlist.h b/arch/sh/include/asm/scatterlist.h
deleted file mode 100644
index 98dfc3510f1..00000000000
--- a/arch/sh/include/asm/scatterlist.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_SCATTERLIST_H
-#define __ASM_SH_SCATTERLIST_H
-
-#include <asm-generic/scatterlist.h>
-
-#endif /* __ASM_SH_SCATTERLIST_H */
diff --git a/arch/sh/include/asm/sembuf.h b/arch/sh/include/asm/sembuf.h
deleted file mode 100644
index 7673b83cfef..00000000000
--- a/arch/sh/include/asm/sembuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/sembuf.h>
diff --git a/arch/sh/include/asm/serial.h b/arch/sh/include/asm/serial.h
deleted file mode 100644
index a0cb0caff15..00000000000
--- a/arch/sh/include/asm/serial.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/serial.h>
diff --git a/arch/sh/include/asm/shmbuf.h b/arch/sh/include/asm/shmbuf.h
deleted file mode 100644
index 83c05fc2de3..00000000000
--- a/arch/sh/include/asm/shmbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/shmbuf.h>
diff --git a/arch/sh/include/asm/siginfo.h b/arch/sh/include/asm/siginfo.h
deleted file mode 100644
index 813040ed68a..00000000000
--- a/arch/sh/include/asm/siginfo.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_SIGINFO_H
-#define __ASM_SH_SIGINFO_H
-
-#include <asm-generic/siginfo.h>
-
-#endif /* __ASM_SH_SIGINFO_H */
diff --git a/arch/sh/include/asm/sizes.h b/arch/sh/include/asm/sizes.h
deleted file mode 100644
index dd248c2e108..00000000000
--- a/arch/sh/include/asm/sizes.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/sizes.h>
diff --git a/arch/sh/include/asm/socket.h b/arch/sh/include/asm/socket.h
deleted file mode 100644
index 6b71384b9d8..00000000000
--- a/arch/sh/include/asm/socket.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/socket.h>
diff --git a/arch/sh/include/asm/statfs.h b/arch/sh/include/asm/statfs.h
deleted file mode 100644
index 9202a023328..00000000000
--- a/arch/sh/include/asm/statfs.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_STATFS_H
-#define __ASM_SH_STATFS_H
-
-#include <asm-generic/statfs.h>
-
-#endif /* __ASM_SH_STATFS_H */
diff --git a/arch/sh/include/asm/termbits.h b/arch/sh/include/asm/termbits.h
deleted file mode 100644
index 3935b106de7..00000000000
--- a/arch/sh/include/asm/termbits.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/termbits.h>
diff --git a/arch/sh/include/asm/termios.h b/arch/sh/include/asm/termios.h
deleted file mode 100644
index 280d78a9d96..00000000000
--- a/arch/sh/include/asm/termios.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/termios.h>
diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
index 050f221fa89..8698a80ed00 100644
--- a/arch/sh/include/asm/uaccess.h
+++ b/arch/sh/include/asm/uaccess.h
@@ -25,6 +25,8 @@
         (__chk_user_ptr(addr),          \
          __access_ok((unsigned long __force)(addr), (size)))
 
+#define user_addr_max() (current_thread_info()->addr_limit.seg)
+
 /*
  * Uh, these should become the main single-value transfer routines ...
  * They automatically use the right size if we just have the right
@@ -100,6 +102,11 @@ struct __large_struct { unsigned long buf[100]; };
 # include "uaccess_64.h"
 #endif
 
+extern long strncpy_from_user(char *dest, const char __user *src, long count);
+
+extern __must_check long strlen_user(const char __user *str);
+extern __must_check long strnlen_user(const char __user *str, long n);
+
 /* Generic arbitrary sized copy.  */
 /* Return the number of bytes NOT copied */
 __kernel_size_t __copy_user(void *to, const void *from, __kernel_size_t n);
@@ -137,37 +144,6 @@ __kernel_size_t __clear_user(void *addr, __kernel_size_t size);
         __cl_size;                                                      \
 })
 
-/**
- * strncpy_from_user: - Copy a NUL terminated string from userspace.
- * @dst:   Destination address, in kernel space.  This buffer must be at
- *         least @count bytes long.
- * @src:   Source address, in user space.
- * @count: Maximum number of bytes to copy, including the trailing NUL.
- *
- * Copies a NUL-terminated string from userspace to kernel space.
- *
- * On success, returns the length of the string (not including the trailing
- * NUL).
- *
- * If access to userspace fails, returns -EFAULT (some data may have been
- * copied).
- *
- * If @count is smaller than the length of the string, copies @count bytes
- * and returns @count.
- */
-#define strncpy_from_user(dest,src,count)                               \
-({                                                                      \
-        unsigned long __sfu_src = (unsigned long)(src);                 \
-        int __sfu_count = (int)(count);                                 \
-        long __sfu_res = -EFAULT;                                       \
-                                                                        \
-        if (__access_ok(__sfu_src, __sfu_count))                        \
-                __sfu_res = __strncpy_from_user((unsigned long)(dest),  \
-                                __sfu_src, __sfu_count);                \
-                                                                        \
-        __sfu_res;                                                      \
-})
-
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
@@ -192,43 +168,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
         return __copy_size;
 }
 
-/**
- * strnlen_user: - Get the size of a string in user space.
- * @s: The string to measure.
- * @n: The maximum valid length
- *
- * Context: User context only.  This function may sleep.
- *
- * Get the size of a NUL-terminated string in user space.
- *
- * Returns the size of the string INCLUDING the terminating NUL.
- * On exception, returns 0.
- * If the string is too long, returns a value greater than @n.
- */
-static inline long strnlen_user(const char __user *s, long n)
-{
-        if (!__addr_ok(s))
-                return 0;
-        else
-                return __strnlen_user(s, n);
-}
-
-/**
- * strlen_user: - Get the size of a string in user space.
- * @str: The string to measure.
- *
- * Context: User context only.  This function may sleep.
- *
- * Get the size of a NUL-terminated string in user space.
- *
- * Returns the size of the string INCLUDING the terminating NUL.
- * On exception, returns 0.
- *
- * If there is a limit on the length of a valid string, you may wish to
- * consider using strnlen_user() instead.
- */
-#define strlen_user(str)        strnlen_user(str, ~0UL >> 1)
-
 /*
  * The exception table consists of pairs of addresses: the first is the
  * address of an instruction that is allowed to fault, and the second is
diff --git a/arch/sh/include/asm/uaccess_32.h b/arch/sh/include/asm/uaccess_32.h
index ae0d24f6653..c0de7ee35ab 100644
--- a/arch/sh/include/asm/uaccess_32.h
+++ b/arch/sh/include/asm/uaccess_32.h
@@ -170,79 +170,4 @@ __asm__ __volatile__( \
 
 extern void __put_user_unknown(void);
 
-static inline int
-__strncpy_from_user(unsigned long __dest, unsigned long __user __src, int __count)
-{
-        __kernel_size_t res;
-        unsigned long __dummy, _d, _s, _c;
-
-        __asm__ __volatile__(
-                "9:\n"
-                "mov.b  @%2+, %1\n\t"
-                "cmp/eq #0, %1\n\t"
-                "bt/s   2f\n"
-                "1:\n"
-                "mov.b  %1, @%3\n\t"
-                "dt     %4\n\t"
-                "bf/s   9b\n\t"
-                " add   #1, %3\n\t"
-                "2:\n\t"
-                "sub    %4, %0\n"
-                "3:\n"
-                ".section .fixup,\"ax\"\n"
-                "4:\n\t"
-                "mov.l  5f, %1\n\t"
-                "jmp    @%1\n\t"
-                " mov   %9, %0\n\t"
-                ".balign 4\n"
-                "5:     .long 3b\n"
-                ".previous\n"
-                ".section __ex_table,\"a\"\n"
-                "       .balign 4\n"
-                "       .long 9b,4b\n"
-                ".previous"
-                : "=r" (res), "=&z" (__dummy), "=r" (_s), "=r" (_d), "=r"(_c)
-                : "0" (__count), "2" (__src), "3" (__dest), "4" (__count),
-                  "i" (-EFAULT)
-                : "memory", "t");
-
-        return res;
-}
-
-/*
- * Return the size of a string (including the ending 0 even when we have
- * exceeded the maximum string length).
- */
-static inline long __strnlen_user(const char __user *__s, long __n)
-{
-        unsigned long res;
-        unsigned long __dummy;
-
-        __asm__ __volatile__(
-                "1:\t"
-                "mov.b  @(%0,%3), %1\n\t"
-                "cmp/eq %4, %0\n\t"
-                "bt/s   2f\n\t"
-                " add   #1, %0\n\t"
-                "tst    %1, %1\n\t"
-                "bf     1b\n\t"
-                "2:\n"
-                ".section .fixup,\"ax\"\n"
-                "3:\n\t"
-                "mov.l  4f, %1\n\t"
-                "jmp    @%1\n\t"
-                " mov   #0, %0\n"
-                ".balign 4\n"
-                "4:     .long 2b\n"
-                ".previous\n"
-                ".section __ex_table,\"a\"\n"
-                "       .balign 4\n"
-                "       .long 1b,3b\n"
-                ".previous"
-                : "=z" (res), "=&r" (__dummy)
-                : "0" (0), "r" (__s), "r" (__n)
-                : "t");
-        return res;
-}
-
 #endif /* __ASM_SH_UACCESS_32_H */
diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
index 56fd20b8cdc..2e07e0f40c6 100644
--- a/arch/sh/include/asm/uaccess_64.h
+++ b/arch/sh/include/asm/uaccess_64.h
@@ -84,8 +84,4 @@ extern long __put_user_asm_l(void *, long);
 extern long __put_user_asm_q(void *, long);
 extern void __put_user_unknown(void);
 
-extern long __strnlen_user(const char *__s, long __n);
-extern int __strncpy_from_user(unsigned long __dest,
-               unsigned long __user __src, int __count);
-
 #endif /* __ASM_SH_UACCESS_64_H */
diff --git a/arch/sh/include/asm/ucontext.h b/arch/sh/include/asm/ucontext.h
deleted file mode 100644
index 9bc07b9f30f..00000000000
--- a/arch/sh/include/asm/ucontext.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ucontext.h>
diff --git a/arch/sh/include/asm/word-at-a-time.h b/arch/sh/include/asm/word-at-a-time.h
new file mode 100644
index 00000000000..6e38953ff7f
--- /dev/null
+++ b/arch/sh/include/asm/word-at-a-time.h
@@ -0,0 +1,53 @@
+#ifndef __ASM_SH_WORD_AT_A_TIME_H
+#define __ASM_SH_WORD_AT_A_TIME_H
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+# include <asm-generic/word-at-a-time.h>
+#else
+/*
+ * Little-endian version cribbed from x86.
+ */
+struct word_at_a_time {
+        const unsigned long one_bits, high_bits;
+};
+
+#define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
+
+/* Carl Chatfield / Jan Achrenius G+ version for 32-bit */
+static inline long count_masked_bytes(long mask)
+{
+        /* (000000 0000ff 00ffff ffffff) -> ( 1 1 2 3 ) */
+        long a = (0x0ff0001+mask) >> 23;
+        /* Fix the 1 for 00 case */
+        return a & mask;
+}
+
+/* Return nonzero if it has a zero */
+static inline unsigned long has_zero(unsigned long a, unsigned long *bits, const struct word_at_a_time *c)
+{
+        unsigned long mask = ((a - c->one_bits) & ~a) & c->high_bits;
+        *bits = mask;
+        return mask;
+}
+
+static inline unsigned long prep_zero_mask(unsigned long a, unsigned long bits, const struct word_at_a_time *c)
+{
+        return bits;
+}
+
+static inline unsigned long create_zero_mask(unsigned long bits)
+{
+        bits = (bits - 1) & ~bits;
+        return bits >> 7;
+}
+
+/* The mask we created is directly usable as a bytemask */
+#define zero_bytemask(mask) (mask)
+
+static inline unsigned long find_zero(unsigned long mask)
+{
+        return count_masked_bytes(mask);
+}
+#endif
+
+#endif
diff --git a/arch/sh/include/asm/xor.h b/arch/sh/include/asm/xor.h
deleted file mode 100644
index c82eb12a5b1..00000000000
--- a/arch/sh/include/asm/xor.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/xor.h>
diff --git a/arch/sh/include/cpu-sh2a/cpu/ubc.h b/arch/sh/include/cpu-sh2a/cpu/ubc.h
deleted file mode 100644
index 1192e1c761a..00000000000
--- a/arch/sh/include/cpu-sh2a/cpu/ubc.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * SH-2A UBC definitions
- *
- * Copyright (C) 2008 Kieran Bingham
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#ifndef __ASM_CPU_SH2A_UBC_H
-#define __ASM_CPU_SH2A_UBC_H
-
-#define UBC_BARA                0xfffc0400
-#define UBC_BAMRA               0xfffc0404
-#define UBC_BBRA                0xfffc04a0      /* 16 bit access */
-#define UBC_BDRA                0xfffc0408
-#define UBC_BDMRA               0xfffc040c
-
-#define UBC_BARB                0xfffc0410
-#define UBC_BAMRB               0xfffc0414
-#define UBC_BBRB                0xfffc04b0      /* 16 bit access */
-#define UBC_BDRB                0xfffc0418
-#define UBC_BDMRB               0xfffc041c
-
-#define UBC_BRCR                0xfffc04c0
-
-#endif /* __ASM_CPU_SH2A_UBC_H */
diff --git a/arch/sh/kernel/cpu/sh5/entry.S b/arch/sh/kernel/cpu/sh5/entry.S
index ff1f0e6e9be..b7cf6a547f1 100644
--- a/arch/sh/kernel/cpu/sh5/entry.S
+++ b/arch/sh/kernel/cpu/sh5/entry.S
@@ -1569,86 +1569,6 @@ ___clear_user_exit:
 #endif /* CONFIG_MMU */
 
 /*
- * int __strncpy_from_user(unsigned long __dest, unsigned long __src,
- *                         int __count)
- *
- * Inputs:
- * (r2)  target address
- * (r3)  source address
- * (r4)  maximum size in bytes
- *
- * Ouputs:
- * (*r2) copied data
- * (r2)  -EFAULT (in case of faulting)
- *       copied data (otherwise)
- */
-        .global __strncpy_from_user
-__strncpy_from_user:
-        pta     ___strncpy_from_user1, tr0
-        pta     ___strncpy_from_user_done, tr1
-        or      r4, ZERO, r5            /* r5 = original count */
-        beq/u   r4, r63, tr1            /* early exit if r4==0 */
-        movi    -(EFAULT), r6           /* r6 = reply, no real fixup */
-        or      ZERO, ZERO, r7          /* r7 = data, clear top byte of data */
-
-___strncpy_from_user1:
-        ld.b    r3, 0, r7               /* Fault address: only in reading */
-        st.b    r2, 0, r7
-        addi    r2, 1, r2
-        addi    r3, 1, r3
-        beq/u   ZERO, r7, tr1
-        addi    r4, -1, r4              /* return real number of copied bytes */
-        bne/l   ZERO, r4, tr0
-
-___strncpy_from_user_done:
-        sub     r5, r4, r6              /* If done, return copied */
-
-___strncpy_from_user_exit:
-        or      r6, ZERO, r2
-        ptabs   LINK, tr0
-        blink   tr0, ZERO
-
-/*
- * extern long __strnlen_user(const char *__s, long __n)
- *
- * Inputs:
- * (r2)  source address
- * (r3)  source size in bytes
- *
- * Ouputs:
- * (r2)  -EFAULT (in case of faulting)
- *       string length (otherwise)
- */
-        .global __strnlen_user
-__strnlen_user:
-        pta     ___strnlen_user_set_reply, tr0
-        pta     ___strnlen_user1, tr1
-        or      ZERO, ZERO, r5          /* r5 = counter */
-        movi    -(EFAULT), r6           /* r6 = reply, no real fixup */
-        or      ZERO, ZERO, r7          /* r7 = data, clear top byte of data */
-        beq     r3, ZERO, tr0
-
-___strnlen_user1:
-        ldx.b   r2, r5, r7              /* Fault address: only in reading */
-        addi    r3, -1, r3              /* No real fixup */
-        addi    r5, 1, r5
-        beq     r3, ZERO, tr0
-        bne     r7, ZERO, tr1
-! The line below used to be active.  This meant led to a junk byte lying between each pair
-! of entries in the argv & envp structures in memory.  Whilst the program saw the right data
-! via the argv and envp arguments to main, it meant the 'flat' representation visible through
-! /proc/$pid/cmdline was corrupt, causing trouble with ps, for example.
-!       addi    r5, 1, r5               /* Include '\0' */
-
-___strnlen_user_set_reply:
-        or      r5, ZERO, r6            /* If done, return counter */
-
-___strnlen_user_exit:
-        or      r6, ZERO, r2
-        ptabs   LINK, tr0
-        blink   tr0, ZERO
-
-/*
  * extern long __get_user_asm_?(void *val, long addr)
  *
  * Inputs:
@@ -1982,8 +1902,6 @@ asm_uaccess_start:
         .long   ___copy_user2, ___copy_user_exit
         .long   ___clear_user1, ___clear_user_exit
 #endif
-        .long   ___strncpy_from_user1, ___strncpy_from_user_exit
-        .long   ___strnlen_user1, ___strnlen_user_exit
         .long   ___get_user_asm_b1, ___get_user_asm_b_exit
         .long   ___get_user_asm_w1, ___get_user_asm_w_exit
         .long   ___get_user_asm_l1, ___get_user_asm_l_exit
diff --git a/arch/sh/kernel/process.c b/arch/sh/kernel/process.c
index 9b7a459a461..055d91b7030 100644
--- a/arch/sh/kernel/process.c
+++ b/arch/sh/kernel/process.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/export.h>
 #include <linux/stackprotector.h>
+#include <asm/fpu.h>
 
 struct kmem_cache *task_xstate_cachep = NULL;
 unsigned int xstate_size;
diff --git a/arch/sh/kernel/process_64.c b/arch/sh/kernel/process_64.c
index 4264583eaba..602545b12a8 100644
--- a/arch/sh/kernel/process_64.c
+++ b/arch/sh/kernel/process_64.c
@@ -33,6 +33,7 @@
 #include <asm/switch_to.h>
 
 struct task_struct *last_task_used_math = NULL;
+struct pt_regs fake_swapper_regs = { 0, };
 
 void show_regs(struct pt_regs *regs)
 {
diff --git a/arch/sh/kernel/sh_ksyms_64.c b/arch/sh/kernel/sh_ksyms_64.c
index 45afa5c51f6..26a0774f527 100644
--- a/arch/sh/kernel/sh_ksyms_64.c
+++ b/arch/sh/kernel/sh_ksyms_64.c
@@ -32,8 +32,6 @@ EXPORT_SYMBOL(__get_user_asm_b);
 EXPORT_SYMBOL(__get_user_asm_w);
 EXPORT_SYMBOL(__get_user_asm_l);
 EXPORT_SYMBOL(__get_user_asm_q);
-EXPORT_SYMBOL(__strnlen_user);
-EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(__copy_user);
diff --git a/arch/sparc/include/asm/cmt.h b/arch/sparc/include/asm/cmt.h
deleted file mode 100644
index 870db592857..00000000000
--- a/arch/sparc/include/asm/cmt.h
+++ /dev/null
@@ -1,59 +0,0 @@
-#ifndef _SPARC64_CMT_H
-#define _SPARC64_CMT_H
-
-/* cmt.h: Chip Multi-Threading register definitions
- *
- * Copyright (C) 2004 David S. Miller (davem@redhat.com)
- */
-
-/* ASI_CORE_ID - private */
-#define LP_ID           0x0000000000000010UL
-#define  LP_ID_MAX      0x00000000003f0000UL
-#define  LP_ID_ID       0x000000000000003fUL
-
-/* ASI_INTR_ID - private */
-#define LP_INTR_ID      0x0000000000000000UL
-#define  LP_INTR_ID_ID  0x00000000000003ffUL
-
-/* ASI_CESR_ID - private */
-#define CESR_ID         0x0000000000000040UL
-#define  CESR_ID_ID     0x00000000000000ffUL
-
-/* ASI_CORE_AVAILABLE - shared */
-#define LP_AVAIL        0x0000000000000000UL
-#define  LP_AVAIL_1     0x0000000000000002UL
-#define  LP_AVAIL_0     0x0000000000000001UL
-
-/* ASI_CORE_ENABLE_STATUS - shared */
-#define LP_ENAB_STAT    0x0000000000000010UL
-#define  LP_ENAB_STAT_1 0x0000000000000002UL
-#define  LP_ENAB_STAT_0 0x0000000000000001UL
-
-/* ASI_CORE_ENABLE - shared */
-#define LP_ENAB         0x0000000000000020UL
-#define  LP_ENAB_1      0x0000000000000002UL
-#define  LP_ENAB_0      0x0000000000000001UL
-
-/* ASI_CORE_RUNNING - shared */
-#define LP_RUNNING_RW   0x0000000000000050UL
-#define LP_RUNNING_W1S  0x0000000000000060UL
-#define LP_RUNNING_W1C  0x0000000000000068UL
-#define  LP_RUNNING_1   0x0000000000000002UL
-#define  LP_RUNNING_0   0x0000000000000001UL
-
-/* ASI_CORE_RUNNING_STAT - shared */
-#define LP_RUN_STAT     0x0000000000000058UL
-#define  LP_RUN_STAT_1  0x0000000000000002UL
-#define  LP_RUN_STAT_0  0x0000000000000001UL
-
-/* ASI_XIR_STEERING - shared */
-#define LP_XIR_STEER    0x0000000000000030UL
-#define  LP_XIR_STEER_1 0x0000000000000002UL
-#define  LP_XIR_STEER_0 0x0000000000000001UL
-
-/* ASI_CMT_ERROR_STEERING - shared */
-#define CMT_ER_STEER    0x0000000000000040UL
-#define  CMT_ER_STEER_1 0x0000000000000002UL
-#define  CMT_ER_STEER_0 0x0000000000000001UL
-
-#endif /* _SPARC64_CMT_H */
diff --git a/arch/sparc/include/asm/mpmbox.h b/arch/sparc/include/asm/mpmbox.h
deleted file mode 100644
index f8423039b24..00000000000
--- a/arch/sparc/include/asm/mpmbox.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * mpmbox.h:  Interface and defines for the OpenProm mailbox
- *               facilities for MP machines under Linux.
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- */
-
-#ifndef _SPARC_MPMBOX_H
-#define _SPARC_MPMBOX_H
-
-/* The prom allocates, for each CPU on the machine an unsigned
- * byte in physical ram.  You probe the device tree prom nodes
- * for these values.  The purpose of this byte is to be able to
- * pass messages from one cpu to another.
- */
-
-/* These are the main message types we have to look for in our
- * Cpu mailboxes, based upon these values we decide what course
- * of action to take.
- */
-
-/* The CPU is executing code in the kernel. */
-#define MAILBOX_ISRUNNING     0xf0
-
-/* Another CPU called romvec->pv_exit(), you should call
- * prom_stopcpu() when you see this in your mailbox.
- */
-#define MAILBOX_EXIT          0xfb
-
-/* Another CPU called romvec->pv_enter(), you should call
- * prom_cpuidle() when this is seen.
- */
-#define MAILBOX_GOSPIN        0xfc
-
-/* Another CPU has hit a breakpoint either into kadb or the prom
- * itself.  Just like MAILBOX_GOSPIN, you should call prom_cpuidle()
- * at this point.
- */
-#define MAILBOX_BPT_SPIN      0xfd
-
-/* Oh geese, some other nitwit got a damn watchdog reset.  The party's
- * over so go call prom_stopcpu().
- */
-#define MAILBOX_WDOG_STOP     0xfe
-
-#ifndef __ASSEMBLY__
-
-/* Handy macro's to determine a cpu's state. */
-
-/* Is the cpu still in Power On Self Test? */
-#define MBOX_POST_P(letter)  ((letter) >= 0x00 && (letter) <= 0x7f)
-
-/* Is the cpu at the 'ok' prompt of the PROM? */
-#define MBOX_PROMPROMPT_P(letter) ((letter) >= 0x80 && (letter) <= 0x8f)
-
-/* Is the cpu spinning in the PROM? */
-#define MBOX_PROMSPIN_P(letter) ((letter) >= 0x90 && (letter) <= 0xef)
-
-/* Sanity check... This is junk mail, throw it out. */
-#define MBOX_BOGON_P(letter) ((letter) >= 0xf1 && (letter) <= 0xfa)
-
-/* Is the cpu actively running an application/kernel-code? */
-#define MBOX_RUNNING_P(letter) ((letter) == MAILBOX_ISRUNNING)
-
-#endif /* !(__ASSEMBLY__) */
-
-#endif /* !(_SPARC_MPMBOX_H) */
diff --git a/arch/tile/include/asm/thread_info.h b/arch/tile/include/asm/thread_info.h
index 7e1fef36bde..e9c670d7a7f 100644
--- a/arch/tile/include/asm/thread_info.h
+++ b/arch/tile/include/asm/thread_info.h
@@ -91,11 +91,6 @@ extern void smp_nap(void);
 /* Enable interrupts racelessly and nap forever: helper for cpu_idle(). */
 extern void _cpu_idle(void);
 
-/* Switch boot idle thread to a freshly-allocated stack and free old stack. */
-extern void cpu_idle_on_new_stack(struct thread_info *old_ti,
-                                  unsigned long new_sp,
-                                  unsigned long new_ss10);
-
 #else /* __ASSEMBLY__ */
 
 /*
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
index c3dd275f25e..9ab078a4605 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
@@ -146,7 +146,7 @@ extern int fixup_exception(struct pt_regs *regs);
 #ifdef __tilegx__
 #define __get_user_1(x, ptr, ret) __get_user_asm(ld1u, x, ptr, ret)
 #define __get_user_2(x, ptr, ret) __get_user_asm(ld2u, x, ptr, ret)
-#define __get_user_4(x, ptr, ret) __get_user_asm(ld4u, x, ptr, ret)
+#define __get_user_4(x, ptr, ret) __get_user_asm(ld4s, x, ptr, ret)
 #define __get_user_8(x, ptr, ret) __get_user_asm(ld, x, ptr, ret)
 #else
 #define __get_user_1(x, ptr, ret) __get_user_asm(lb_u, x, ptr, ret)
diff --git a/arch/tile/kernel/entry.S b/arch/tile/kernel/entry.S
index 133c4b56a99..c31637baff2 100644
--- a/arch/tile/kernel/entry.S
+++ b/arch/tile/kernel/entry.S
@@ -68,20 +68,6 @@ STD_ENTRY(KBacktraceIterator_init_current)
         jrp lr   /* keep backtracer happy */
         STD_ENDPROC(KBacktraceIterator_init_current)
 
-/*
- * Reset our stack to r1/r2 (sp and ksp0+cpu respectively), then
- * free the old stack (passed in r0) and re-invoke cpu_idle().
- * We update sp and ksp0 simultaneously to avoid backtracer warnings.
- */
-STD_ENTRY(cpu_idle_on_new_stack)
-        {
-         move sp, r1
-         mtspr SPR_SYSTEM_SAVE_K_0, r2
-        }
-        jal free_thread_info
-        j cpu_idle
-        STD_ENDPROC(cpu_idle_on_new_stack)
-
 /* Loop forever on a nap during SMP boot. */
 STD_ENTRY(smp_nap)
         nap
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 6098ccc59be..dd87f342039 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -29,6 +29,7 @@
 #include <linux/smp.h>
 #include <linux/timex.h>
 #include <linux/hugetlb.h>
+#include <linux/start_kernel.h>
 #include <asm/setup.h>
 #include <asm/sections.h>
 #include <asm/cacheflush.h>
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 8bbea6aa40d..efe5acfc79c 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -94,10 +94,10 @@ bs_die:
 
         .section ".bsdata", "a"
 bugger_off_msg:
-        .ascii  "Direct booting from floppy is no longer supported.\r\n"
-        .ascii  "Please use a boot loader program instead.\r\n"
+        .ascii  "Direct floppy boot is not supported. "
+        .ascii  "Use a boot loader program instead.\r\n"
         .ascii  "\n"
-        .ascii  "Remove disk and press any key to reboot . . .\r\n"
+        .ascii  "Remove disk and press any key to reboot ...\r\n"
         .byte   0
 
 #ifdef CONFIG_EFI_STUB
@@ -111,7 +111,7 @@ coff_header:
 #else
         .word   0x8664                          # x86-64
 #endif
-        .word   2                               # nr_sections
+        .word   3                               # nr_sections
         .long   0                               # TimeDateStamp
         .long   0                               # PointerToSymbolTable
         .long   1                               # NumberOfSymbols
@@ -158,8 +158,8 @@ extra_header_fields:
 #else
         .quad   0                               # ImageBase
 #endif
-        .long   0x1000                          # SectionAlignment
-        .long   0x200                           # FileAlignment
+        .long   0x20                            # SectionAlignment
+        .long   0x20                            # FileAlignment
         .word   0                               # MajorOperatingSystemVersion
         .word   0                               # MinorOperatingSystemVersion
         .word   0                               # MajorImageVersion
@@ -200,8 +200,10 @@ extra_header_fields:
 
         # Section table
 section_table:
-        .ascii  ".text"
-        .byte   0
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".setup"
         .byte   0
         .byte   0
         .long   0
@@ -217,9 +219,8 @@ section_table:
 
         #
         # The EFI application loader requires a relocation section
-        # because EFI applications must be relocatable. But since
-        # we don't need the loader to fixup any relocs for us, we
-        # just create an empty (zero-length) .reloc section header.
+        # because EFI applications must be relocatable. The .reloc
+        # offset & size fields are filled in by build.c.
         #
         .ascii  ".reloc"
         .byte   0
@@ -233,6 +234,25 @@ section_table:
         .word   0                               # NumberOfRelocations
         .word   0                               # NumberOfLineNumbers
         .long   0x42100040                      # Characteristics (section flags)
+
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".text"
+        .byte   0
+        .byte   0
+        .byte   0
+        .long   0
+        .long   0x0                             # startup_{32,64}
+        .long   0                               # Size of initialized data
+                                                # on disk
+        .long   0x0                             # startup_{32,64}
+        .long   0                               # PointerToRelocations
+        .long   0                               # PointerToLineNumbers
+        .word   0                               # NumberOfRelocations
+        .word   0                               # NumberOfLineNumbers
+        .long   0x60500020                      # Characteristics (section flags)
+
 #endif /* CONFIG_EFI_STUB */
 
         # Kernel attributes; used by setup.  This is part 1 of the
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 3f61f6e2b46..4b8e165ee57 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -50,6 +50,8 @@ typedef unsigned int   u32;
 u8 buf[SETUP_SECT_MAX*512];
 int is_big_kernel;
 
+#define PECOFF_RELOC_RESERVE 0x20
+
 /*----------------------------------------------------------------------*/
 
 static const u32 crctab32[] = {
@@ -133,11 +135,103 @@ static void usage(void)
         die("Usage: build setup system [> image]");
 }
 
-int main(int argc, char ** argv)
-{
 #ifdef CONFIG_EFI_STUB
-        unsigned int file_sz, pe_header;
+
+static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+{
+        unsigned int pe_header;
+        unsigned short num_sections;
+        u8 *section;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+        num_sections = get_unaligned_le16(&buf[pe_header + 6]);
+
+#ifdef CONFIG_X86_32
+        section = &buf[pe_header + 0xa8];
+#else
+        section = &buf[pe_header + 0xb8];
 #endif
+
+        while (num_sections > 0) {
+                if (strncmp((char*)section, section_name, 8) == 0) {
+                        /* section header size field */
+                        put_unaligned_le32(size, section + 0x8);
+
+                        /* section header vma field */
+                        put_unaligned_le32(offset, section + 0xc);
+
+                        /* section header 'size of initialised data' field */
+                        put_unaligned_le32(size, section + 0x10);
+
+                        /* section header 'file offset' field */
+                        put_unaligned_le32(offset, section + 0x14);
+
+                        break;
+                }
+                section += 0x28;
+                num_sections--;
+        }
+}
+
+static void update_pecoff_setup_and_reloc(unsigned int size)
+{
+        u32 setup_offset = 0x200;
+        u32 reloc_offset = size - PECOFF_RELOC_RESERVE;
+        u32 setup_size = reloc_offset - setup_offset;
+
+        update_pecoff_section_header(".setup", setup_offset, setup_size);
+        update_pecoff_section_header(".reloc", reloc_offset, PECOFF_RELOC_RESERVE);
+
+        /*
+         * Modify .reloc section contents with a single entry. The
+         * relocation is applied to offset 10 of the relocation section.
+         */
+        put_unaligned_le32(reloc_offset + 10, &buf[reloc_offset]);
+        put_unaligned_le32(10, &buf[reloc_offset + 4]);
+}
+
+static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
+{
+        unsigned int pe_header;
+        unsigned int text_sz = file_sz - text_start;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+
+        /* Size of image */
+        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
+
+        /*
+         * Size of code: Subtract the size of the first sector (512 bytes)
+         * which includes the header.
+         */
+        put_unaligned_le32(file_sz - 512, &buf[pe_header + 0x1c]);
+
+#ifdef CONFIG_X86_32
+        /*
+         * Address of entry point.
+         *
+         * The EFI stub entry point is +16 bytes from the start of
+         * the .text section.
+         */
+        put_unaligned_le32(text_start + 16, &buf[pe_header + 0x28]);
+#else
+        /*
+         * Address of entry point. startup_32 is at the beginning and
+         * the 64-bit entry point (startup_64) is always 512 bytes
+         * after. The EFI stub entry point is 16 bytes after that, as
+         * the first instruction allows legacy loaders to jump over
+         * the EFI stub initialisation
+         */
+        put_unaligned_le32(text_start + 528, &buf[pe_header + 0x28]);
+#endif /* CONFIG_X86_32 */
+
+        update_pecoff_section_header(".text", text_start, text_sz);
+}
+
+#endif /* CONFIG_EFI_STUB */
+
+int main(int argc, char ** argv)
+{
         unsigned int i, sz, setup_sectors;
         int c;
         u32 sys_size;
@@ -163,6 +257,12 @@ int main(int argc, char ** argv)
                 die("Boot block hasn't got boot flag (0xAA55)");
         fclose(file);
 
+#ifdef CONFIG_EFI_STUB
+        /* Reserve 0x20 bytes for .reloc section */
+        memset(buf+c, 0, PECOFF_RELOC_RESERVE);
+        c += PECOFF_RELOC_RESERVE;
+#endif
+
         /* Pad unused space with zeros */
         setup_sectors = (c + 511) / 512;
         if (setup_sectors < SETUP_SECT_MIN)
@@ -170,6 +270,10 @@ int main(int argc, char ** argv)
         i = setup_sectors*512;
         memset(buf+c, 0, i-c);
 
+#ifdef CONFIG_EFI_STUB
+        update_pecoff_setup_and_reloc(i);
+#endif
+
         /* Set the default root device */
         put_unaligned_le16(DEFAULT_ROOT_DEV, &buf[508]);
 
@@ -194,66 +298,8 @@ int main(int argc, char ** argv)
         put_unaligned_le32(sys_size, &buf[0x1f4]);
 
 #ifdef CONFIG_EFI_STUB
-        file_sz = sz + i + ((sys_size * 16) - sz);
-
-        pe_header = get_unaligned_le32(&buf[0x3c]);
-
-        /* Size of image */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
-
-        /*
-         * Subtract the size of the first section (512 bytes) which
-         * includes the header and .reloc section. The remaining size
-         * is that of the .text section.
-         */
-        file_sz -= 512;
-
-        /* Size of code */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x1c]);
-
-#ifdef CONFIG_X86_32
-        /*
-         * Address of entry point.
-         *
-         * The EFI stub entry point is +16 bytes from the start of
-         * the .text section.
-         */
-        put_unaligned_le32(i + 16, &buf[pe_header + 0x28]);
-
-        /* .text size */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xb0]);
-
-        /* .text vma */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xb4]);
-
-        /* .text size of initialised data */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xb8]);
-
-        /* .text file offset */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xbc]);
-#else
-        /*
-         * Address of entry point. startup_32 is at the beginning and
-         * the 64-bit entry point (startup_64) is always 512 bytes
-         * after. The EFI stub entry point is 16 bytes after that, as
-         * the first instruction allows legacy loaders to jump over
-         * the EFI stub initialisation
-         */
-        put_unaligned_le32(i + 528, &buf[pe_header + 0x28]);
-
-        /* .text size */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xc0]);
-
-        /* .text vma */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xc4]);
-
-        /* .text size of initialised data */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xc8]);
-
-        /* .text file offset */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xcc]);
-#endif /* CONFIG_X86_32 */
-#endif /* CONFIG_EFI_STUB */
+        update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
+#endif
 
         crc = partial_crc32(buf, i, crc);
         if (fwrite(buf, 1, i, stdout) != i)
diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index be6d9e365a8..3470624d783 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -2460,10 +2460,12 @@ ENTRY(aesni_cbc_dec)
         pxor IN3, STATE4
         movaps IN4, IV
 #else
-        pxor (INP), STATE2
-        pxor 0x10(INP), STATE3
         pxor IN1, STATE4
         movaps IN2, IV
+        movups (INP), IN1
+        pxor IN1, STATE2
+        movups 0x10(INP), IN2
+        pxor IN2, STATE3
 #endif
         movups STATE1, (OUTP)
         movups STATE2, 0x10(OUTP)
diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
index 0e3793b821e..dc580c42851 100644
--- a/arch/x86/include/asm/nmi.h
+++ b/arch/x86/include/asm/nmi.h
@@ -54,6 +54,20 @@ struct nmiaction {
         __register_nmi_handler((t), &fn##_na);  \
 })
 
+/*
+ * For special handlers that register/unregister in the
+ * init section only.  This should be considered rare.
+ */
+#define register_nmi_handler_initonly(t, fn, fg, n)             \
+({                                                      \
+        static struct nmiaction fn##_na __initdata = {          \
+                .handler = (fn),                        \
+                .name = (n),                            \
+                .flags = (fg),                          \
+        };                                              \
+        __register_nmi_handler((t), &fn##_na);  \
+})
+
 int __register_nmi_handler(unsigned int, struct nmiaction *);
 
 void unregister_nmi_handler(unsigned int, const char *);
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 04cd6882308..e1f3a17034f 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -33,9 +33,8 @@
 #define segment_eq(a, b)        ((a).seg == (b).seg)
 
 #define user_addr_max() (current_thread_info()->addr_limit.seg)
-#define __addr_ok(addr)                                 \
-        ((unsigned long __force)(addr) <                \
-         (current_thread_info()->addr_limit.seg))
+#define __addr_ok(addr)         \
+        ((unsigned long __force)(addr) < user_addr_max())
 
 /*
  * Test whether a block of memory is a valid user space address.
@@ -47,14 +46,14 @@
  * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
  */
 
-#define __range_not_ok(addr, size)                                      \
+#define __range_not_ok(addr, size, limit)                               \
 ({                                                                      \
         unsigned long flag, roksum;                                     \
         __chk_user_ptr(addr);                                           \
         asm("add %3,%1 ; sbb %0,%0 ; cmp %1,%4 ; sbb $0,%0"             \
             : "=&r" (flag), "=r" (roksum)                               \
             : "1" (addr), "g" ((long)(size)),                           \
-              "rm" (current_thread_info()->addr_limit.seg));            \
+              "rm" (limit));                                            \
         flag;                                                           \
 })
 
@@ -77,7 +76,8 @@
  * checks that the pointer is in the user space range - after calling
  * this function, memory access functions may still return -EFAULT.
  */
-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
+#define access_ok(type, addr, size) \
+        (likely(__range_not_ok(addr, size, user_addr_max()) == 0))
 
 /*
  * The exception table consists of pairs of addresses relative to the
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index becf47b8173..6149b476d9d 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -149,7 +149,6 @@
 /* 4 bits of software ack period */
 #define UV2_ACK_MASK                    0x7UL
 #define UV2_ACK_UNITS_SHFT              3
-#define UV2_LEG_SHFT UV2H_LB_BAU_MISC_CONTROL_USE_LEGACY_DESCRIPTOR_FORMATS_SHFT
 #define UV2_EXT_SHFT UV2H_LB_BAU_MISC_CONTROL_ENABLE_EXTENDED_SB_STATUS_SHFT
 
 /*
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 6e76c191a83..d5fd66f0d4c 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -20,7 +20,6 @@
 #include <linux/bitops.h>
 #include <linux/ioport.h>
 #include <linux/suspend.h>
-#include <linux/kmemleak.h>
 #include <asm/e820.h>
 #include <asm/io.h>
 #include <asm/iommu.h>
@@ -95,11 +94,6 @@ static u32 __init allocate_aperture(void)
                 return 0;
         }
         memblock_reserve(addr, aper_size);
-        /*
-         * Kmemleak should not scan this block as it may not be mapped via the
-         * kernel direct mapping.
-         */
-        kmemleak_ignore(phys_to_virt(addr));
         printk(KERN_INFO "Mapping aperture over %d KB of RAM @ %lx\n",
                         aper_size >> 10, addr);
         insert_aperture_resource((u32)addr, aper_size);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 5155d6f806f..8704918514d 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1195,7 +1195,7 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
         BUG_ON(!cfg->vector);
 
         vector = cfg->vector;
-        for_each_cpu_and(cpu, cfg->domain, cpu_online_mask)
+        for_each_cpu(cpu, cfg->domain)
                 per_cpu(vector_irq, cpu)[vector] = -1;
 
         cfg->vector = 0;
@@ -1203,7 +1203,7 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
 
         if (likely(!cfg->move_in_progress))
                 return;
-        for_each_cpu_and(cpu, cfg->old_domain, cpu_online_mask) {
+        for_each_cpu(cpu, cfg->old_domain) {
                 for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
                                                                 vector++) {
                         if (per_cpu(vector_irq, cpu)[vector] != irq)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 5623b4b5d51..5a5a5dc1ff1 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1278,7 +1278,7 @@ static void mce_timer_fn(unsigned long data)
          */
         iv = __this_cpu_read(mce_next_interval);
         if (mce_notify_irq())
-                iv = max(iv, (unsigned long) HZ/100);
+                iv = max(iv / 2, (unsigned long) HZ/100);
         else
                 iv = min(iv * 2, round_jiffies_relative(check_interval * HZ));
         __this_cpu_write(mce_next_interval, iv);
@@ -1560,7 +1560,7 @@ static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c)
 static void __mcheck_cpu_init_timer(void)
 {
         struct timer_list *t = &__get_cpu_var(mce_timer);
-        unsigned long iv = __this_cpu_read(mce_next_interval);
+        unsigned long iv = check_interval * HZ;
 
         setup_timer(t, mce_timer_fn, smp_processor_id());
 
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index e049d6da018..c4706cf9c01 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1496,6 +1496,7 @@ static struct cpu_hw_events *allocate_fake_cpuc(void)
                 if (!cpuc->shared_regs)
                         goto error;
         }
+        cpuc->is_fake = 1;
         return cpuc;
 error:
         free_fake_cpuc(cpuc);
@@ -1756,6 +1757,12 @@ perf_callchain_kernel(struct perf_callchain_entry *entry, struct pt_regs *regs)
         dump_trace(NULL, regs, NULL, 0, &backtrace_ops, entry);
 }
 
+static inline int
+valid_user_frame(const void __user *fp, unsigned long size)
+{
+        return (__range_not_ok(fp, size, TASK_SIZE) == 0);
+}
+
 #ifdef CONFIG_COMPAT
 
 #include <asm/compat.h>
@@ -1780,7 +1787,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry *entry)
                 if (bytes != sizeof(frame))
                         break;
 
-                if (fp < compat_ptr(regs->sp))
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
@@ -1826,7 +1833,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
                 if (bytes != sizeof(frame))
                         break;
 
-                if ((unsigned long)fp < regs->sp)
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 6638aaf5449..7241e2fc3c1 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -117,6 +117,7 @@ struct cpu_hw_events {
         struct perf_event       *event_list[X86_PMC_IDX_MAX]; /* in enabled order */
 
         unsigned int            group_flag;
+        int                     is_fake;
 
         /*
          * Intel DebugStore bits
@@ -364,6 +365,7 @@ struct x86_pmu {
         int             pebs_record_size;
         void            (*drain_pebs)(struct pt_regs *regs);
         struct event_constraint *pebs_constraints;
+        void            (*pebs_aliases)(struct perf_event *event);
 
         /*
          * Intel LBR
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 9e3f5d6e3d2..5073bf1c1d8 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1121,27 +1121,33 @@ intel_bts_constraints(struct perf_event *event)
         return NULL;
 }
 
-static bool intel_try_alt_er(struct perf_event *event, int orig_idx)
+static int intel_alt_er(int idx)
 {
         if (!(x86_pmu.er_flags & ERF_HAS_RSP_1))
-                return false;
+                return idx;
 
-        if (event->hw.extra_reg.idx == EXTRA_REG_RSP_0) {
-                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
-                event->hw.config |= 0x01bb;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_1;
-                event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
-        } else if (event->hw.extra_reg.idx == EXTRA_REG_RSP_1) {
+        if (idx == EXTRA_REG_RSP_0)
+                return EXTRA_REG_RSP_1;
+
+        if (idx == EXTRA_REG_RSP_1)
+                return EXTRA_REG_RSP_0;
+
+        return idx;
+}
+
+static void intel_fixup_er(struct perf_event *event, int idx)
+{
+        event->hw.extra_reg.idx = idx;
+
+        if (idx == EXTRA_REG_RSP_0) {
                 event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
                 event->hw.config |= 0x01b7;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_0;
                 event->hw.extra_reg.reg = MSR_OFFCORE_RSP_0;
+        } else if (idx == EXTRA_REG_RSP_1) {
+                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
+                event->hw.config |= 0x01bb;
+                event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
         }
-
-        if (event->hw.extra_reg.idx == orig_idx)
-                return false;
-
-        return true;
 }
 
 /*
@@ -1159,14 +1165,18 @@ __intel_shared_reg_get_constraints(struct cpu_hw_events *cpuc,
         struct event_constraint *c = &emptyconstraint;
         struct er_account *era;
         unsigned long flags;
-        int orig_idx = reg->idx;
+        int idx = reg->idx;
 
-        /* already allocated shared msr */
-        if (reg->alloc)
+        /*
+         * reg->alloc can be set due to existing state, so for fake cpuc we
+         * need to ignore this, otherwise we might fail to allocate proper fake
+         * state for this extra reg constraint. Also see the comment below.
+         */
+        if (reg->alloc && !cpuc->is_fake)
                 return NULL; /* call x86_get_event_constraint() */
 
 again:
-        era = &cpuc->shared_regs->regs[reg->idx];
+        era = &cpuc->shared_regs->regs[idx];
         /*
          * we use spin_lock_irqsave() to avoid lockdep issues when
          * passing a fake cpuc
@@ -1175,6 +1185,29 @@ again:
 
         if (!atomic_read(&era->ref) || era->config == reg->config) {
 
+                /*
+                 * If its a fake cpuc -- as per validate_{group,event}() we
+                 * shouldn't touch event state and we can avoid doing so
+                 * since both will only call get_event_constraints() once
+                 * on each event, this avoids the need for reg->alloc.
+                 *
+                 * Not doing the ER fixup will only result in era->reg being
+                 * wrong, but since we won't actually try and program hardware
+                 * this isn't a problem either.
+                 */
+                if (!cpuc->is_fake) {
+                        if (idx != reg->idx)
+                                intel_fixup_er(event, idx);
+
+                        /*
+                         * x86_schedule_events() can call get_event_constraints()
+                         * multiple times on events in the case of incremental
+                         * scheduling(). reg->alloc ensures we only do the ER
+                         * allocation once.
+                         */
+                        reg->alloc = 1;
+                }
+
                 /* lock in msr value */
                 era->config = reg->config;
                 era->reg = reg->reg;
@@ -1182,17 +1215,17 @@ again:
                 /* one more user */
                 atomic_inc(&era->ref);
 
-                /* no need to reallocate during incremental event scheduling */
-                reg->alloc = 1;
-
                 /*
                  * need to call x86_get_event_constraint()
                  * to check if associated event has constraints
                  */
                 c = NULL;
-        } else if (intel_try_alt_er(event, orig_idx)) {
-                raw_spin_unlock_irqrestore(&era->lock, flags);
-                goto again;
+        } else {
+                idx = intel_alt_er(idx);
+                if (idx != reg->idx) {
+                        raw_spin_unlock_irqrestore(&era->lock, flags);
+                        goto again;
+                }
         }
         raw_spin_unlock_irqrestore(&era->lock, flags);
 
@@ -1206,11 +1239,14 @@ __intel_shared_reg_put_constraints(struct cpu_hw_events *cpuc,
         struct er_account *era;
 
         /*
-         * only put constraint if extra reg was actually
-         * allocated. Also takes care of event which do
-         * not use an extra shared reg
+         * Only put constraint if extra reg was actually allocated. Also takes
+         * care of event which do not use an extra shared reg.
+         *
+         * Also, if this is a fake cpuc we shouldn't touch any event state
+         * (reg->alloc) and we don't care about leaving inconsistent cpuc state
+         * either since it'll be thrown out.
          */
-        if (!reg->alloc)
+        if (!reg->alloc || cpuc->is_fake)
                 return;
 
         era = &cpuc->shared_regs->regs[reg->idx];
@@ -1302,15 +1338,9 @@ static void intel_put_event_constraints(struct cpu_hw_events *cpuc,
         intel_put_shared_regs_event_constraints(cpuc, event);
 }
 
-static int intel_pmu_hw_config(struct perf_event *event)
+static void intel_pebs_aliases_core2(struct perf_event *event)
 {
-        int ret = x86_pmu_hw_config(event);
-
-        if (ret)
-                return ret;
-
-        if (event->attr.precise_ip &&
-            (event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
+        if ((event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
                 /*
                  * Use an alternative encoding for CPU_CLK_UNHALTED.THREAD_P
                  * (0x003c) so that we can use it with PEBS.
@@ -1331,10 +1361,48 @@ static int intel_pmu_hw_config(struct perf_event *event)
                  */
                 u64 alt_config = X86_CONFIG(.event=0xc0, .inv=1, .cmask=16);
 
+                alt_config |= (event->hw.config & ~X86_RAW_EVENT_MASK);
+                event->hw.config = alt_config;
+        }
+}
+
+static void intel_pebs_aliases_snb(struct perf_event *event)
+{
+        if ((event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
+                /*
+                 * Use an alternative encoding for CPU_CLK_UNHALTED.THREAD_P
+                 * (0x003c) so that we can use it with PEBS.
+                 *
+                 * The regular CPU_CLK_UNHALTED.THREAD_P event (0x003c) isn't
+                 * PEBS capable. However we can use UOPS_RETIRED.ALL
+                 * (0x01c2), which is a PEBS capable event, to get the same
+                 * count.
+                 *
+                 * UOPS_RETIRED.ALL counts the number of cycles that retires
+                 * CNTMASK micro-ops. By setting CNTMASK to a value (16)
+                 * larger than the maximum number of micro-ops that can be
+                 * retired per cycle (4) and then inverting the condition, we
+                 * count all cycles that retire 16 or less micro-ops, which
+                 * is every cycle.
+                 *
+                 * Thereby we gain a PEBS capable cycle counter.
+                 */
+                u64 alt_config = X86_CONFIG(.event=0xc2, .umask=0x01, .inv=1, .cmask=16);
 
                 alt_config |= (event->hw.config & ~X86_RAW_EVENT_MASK);
                 event->hw.config = alt_config;
         }
+}
+
+static int intel_pmu_hw_config(struct perf_event *event)
+{
+        int ret = x86_pmu_hw_config(event);
+
+        if (ret)
+                return ret;
+
+        if (event->attr.precise_ip && x86_pmu.pebs_aliases)
+                x86_pmu.pebs_aliases(event);
 
         if (intel_pmu_needs_lbr_smpl(event)) {
                 ret = intel_pmu_setup_lbr_filter(event);
@@ -1609,6 +1677,7 @@ static __initconst const struct x86_pmu intel_pmu = {
         .max_period             = (1ULL << 31) - 1,
         .get_event_constraints  = intel_get_event_constraints,
         .put_event_constraints  = intel_put_event_constraints,
+        .pebs_aliases           = intel_pebs_aliases_core2,
 
         .format_attrs           = intel_arch3_formats_attr,
 
@@ -1842,8 +1911,9 @@ __init int intel_pmu_init(void)
                 break;
 
         case 42: /* SandyBridge */
-                x86_add_quirk(intel_sandybridge_quirk);
         case 45: /* SandyBridge, "Romely-EP" */
+                x86_add_quirk(intel_sandybridge_quirk);
+        case 58: /* IvyBridge */
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
 
@@ -1851,6 +1921,7 @@ __init int intel_pmu_init(void)
 
                 x86_pmu.event_constraints = intel_snb_event_constraints;
                 x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
+                x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
                 x86_pmu.extra_regs = intel_snb_extra_regs;
                 /* all extra regs are per-cpu when HT is on */
                 x86_pmu.er_flags |= ERF_HAS_RSP_1;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 5a3edc27f6e..35e2192df9f 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -400,14 +400,7 @@ struct event_constraint intel_snb_pebs_event_constraints[] = {
         INTEL_EVENT_CONSTRAINT(0xc4, 0xf),    /* BR_INST_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xc5, 0xf),    /* BR_MISP_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xcd, 0x8),    /* MEM_TRANS_RETIRED.* */
-        INTEL_UEVENT_CONSTRAINT(0x11d0, 0xf), /* MEM_UOP_RETIRED.STLB_MISS_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x12d0, 0xf), /* MEM_UOP_RETIRED.STLB_MISS_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x21d0, 0xf), /* MEM_UOP_RETIRED.LOCK_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x22d0, 0xf), /* MEM_UOP_RETIRED.LOCK_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x41d0, 0xf), /* MEM_UOP_RETIRED.SPLIT_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x42d0, 0xf), /* MEM_UOP_RETIRED.SPLIT_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x81d0, 0xf), /* MEM_UOP_RETIRED.ANY_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x82d0, 0xf), /* MEM_UOP_RETIRED.ANY_STORES */
+        INTEL_EVENT_CONSTRAINT(0xd0, 0xf),    /* MEM_UOP_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd1, 0xf),    /* MEM_LOAD_UOPS_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd2, 0xf),    /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
         INTEL_UEVENT_CONSTRAINT(0x02d4, 0xf), /* MEM_LOAD_UOPS_MISC_RETIRED.LLC_MISS */
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 086eb58c6e8..f1b42b3a186 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -120,11 +120,6 @@ bool kvm_check_and_clear_guest_paused(void)
         bool ret = false;
         struct pvclock_vcpu_time_info *src;
 
-        /*
-         * per_cpu() is safe here because this function is only called from
-         * timer functions where preemption is already disabled.
-         */
-        WARN_ON(!in_atomic());
         src = &__get_cpu_var(hv_clock);
         if ((src->flags & PVCLOCK_GUEST_STOPPED) != 0) {
                 __this_cpu_and(hv_clock.flags, ~PVCLOCK_GUEST_STOPPED);
diff --git a/arch/x86/kernel/nmi_selftest.c b/arch/x86/kernel/nmi_selftest.c
index e31bf8d5c4d..149b8d9c6ad 100644
--- a/arch/x86/kernel/nmi_selftest.c
+++ b/arch/x86/kernel/nmi_selftest.c
@@ -42,7 +42,7 @@ static int __init nmi_unk_cb(unsigned int val, struct pt_regs *regs)
 static void __init init_nmi_testsuite(void)
 {
         /* trap all the unknown NMIs we may generate */
-        register_nmi_handler(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk");
+        register_nmi_handler_initonly(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk");
 }
 
 static void __init cleanup_nmi_testsuite(void)
@@ -64,7 +64,7 @@ static void __init test_nmi_ipi(struct cpumask *mask)
 {
         unsigned long timeout;
 
-        if (register_nmi_handler(NMI_LOCAL, test_nmi_ipi_callback,
+        if (register_nmi_handler_initonly(NMI_LOCAL, test_nmi_ipi_callback,
                                  NMI_FLAG_FIRST, "nmi_selftest")) {
                 nmi_fail = FAILURE;
                 return;
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 62c9457ccd2..c0f420f76cd 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -100,7 +100,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
                                  struct dma_attrs *attrs)
 {
         unsigned long dma_mask;
-        struct page *page = NULL;
+        struct page *page;
         unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         dma_addr_t addr;
 
@@ -108,6 +108,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
 
         flag |= __GFP_ZERO;
 again:
+        page = NULL;
         if (!(flag & GFP_ATOMIC))
                 page = dma_alloc_from_contiguous(dev, count, get_order(size));
         if (!page)
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index ab3f0626071..10ae9be07b4 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -643,9 +643,11 @@ void native_machine_shutdown(void)
         set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
 
         /*
-         * O.K Now that I'm on the appropriate processor,
-         * stop all of the others.
+         * O.K Now that I'm on the appropriate processor, stop all of the
+         * others. Also disable the local irq to not receive the per-cpu
+         * timer interrupt which may trigger scheduler's load balance.
          */
+        local_irq_disable();
         stop_other_cpus();
 #endif
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 456d64806c8..54e938de713 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -351,9 +351,12 @@ static bool __cpuinit match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 
 static bool __cpuinit match_mc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 {
-        if (c->phys_proc_id == o->phys_proc_id)
-                return topology_sane(c, o, "mc");
+        if (c->phys_proc_id == o->phys_proc_id) {
+                if (cpu_has(c, X86_FEATURE_AMD_DCM))
+                        return true;
 
+                return topology_sane(c, o, "mc");
+        }
         return false;
 }
 
@@ -384,6 +387,15 @@ void __cpuinit set_cpu_sibling_map(int cpu)
                 if ((i == cpu) || (has_mc && match_llc(c, o)))
                         link_mask(llc_shared, cpu, i);
 
+        }
+
+        /*
+         * This needs a separate iteration over the cpus because we rely on all
+         * cpu_sibling_mask links to be set-up.
+         */
+        for_each_cpu(i, cpu_sibling_setup_mask) {
+                o = &cpu_data(i);
+
                 if ((i == cpu) || (has_mc && match_mc(c, o))) {
                         link_mask(core, cpu, i);
 
diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index f61ee67ec00..4f74d94c8d9 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 
 #include <asm/word-at-a-time.h>
+#include <linux/sched.h>
 
 /*
  * best effort, GUP based copy_from_user() that is NMI-safe
@@ -21,6 +22,9 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
         void *map;
         int ret;
 
+        if (__range_not_ok(from, n, TASK_SIZE))
+                return len;
+
         do {
                 ret = __get_user_pages_fast(addr, 1, 0, &page);
                 if (!ret)
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 81913790442..5d7e51f3fd2 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -28,7 +28,7 @@
 #  - (66): the last prefix is 0x66
 #  - (F3): the last prefix is 0xF3
 #  - (F2): the last prefix is 0xF2
-#
+#  - (!F3) : the last prefix is not 0xF3 (including non-last prefix case)
 
 Table: one byte opcode
 Referrer:
@@ -515,12 +515,12 @@ b4: LFS Gv,Mp
 b5: LGS Gv,Mp
 b6: MOVZX Gv,Eb
 b7: MOVZX Gv,Ew
-b8: JMPE | POPCNT Gv,Ev (F3)
+b8: JMPE (!F3) | POPCNT Gv,Ev (F3)
 b9: Grp10 (1A)
 ba: Grp8 Ev,Ib (1A)
 bb: BTC Ev,Gv
-bc: BSF Gv,Ev | TZCNT Gv,Ev (F3)
-bd: BSR Gv,Ev | LZCNT Gv,Ev (F3)
+bc: BSF Gv,Ev (!F3) | TZCNT Gv,Ev (F3)
+bd: BSR Gv,Ev (!F3) | LZCNT Gv,Ev (F3)
 be: MOVSX Gv,Eb
 bf: MOVSX Gv,Ew
 # 0x0f 0xc0-0xcf
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 97141c26a13..bc4e9d84157 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -62,7 +62,8 @@ static void __init find_early_table_space(struct map_range *mr, unsigned long en
                 extra += PMD_SIZE;
 #endif
                 /* The first 2/4M doesn't use large pages. */
-                extra += mr->end - mr->start;
+                if (mr->start < PMD_SIZE)
+                        extra += mr->end - mr->start;
 
                 ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
         } else
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index be1ef574ce9..78fe3f1ac49 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -180,7 +180,7 @@ err_free_memtype:
 
 /**
  * ioremap_nocache     -   map bus memory into CPU space
- * @offset:    bus address of the memory
+ * @phys_addr:    bus address of the memory
  * @size:      size of the resource to map
  *
  * ioremap_nocache performs a platform specific sequence of operations to
@@ -217,7 +217,7 @@ EXPORT_SYMBOL(ioremap_nocache);
 
 /**
  * ioremap_wc   -       map memory into CPU space write combined
- * @offset:     bus address of the memory
+ * @phys_addr:  bus address of the memory
  * @size:       size of the resource to map
  *
  * This version of ioremap ensures that the memory is marked write combining.
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index e1ebde31521..a718e0d2350 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -122,7 +122,7 @@ within(unsigned long addr, unsigned long start, unsigned long end)
 
 /**
  * clflush_cache_range - flush a cache range with clflush
- * @addr:       virtual start address
+ * @vaddr:      virtual start address
  * @size:       number of bytes to flush
  *
  * clflush is an unordered instruction which needs fencing with mfence
diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
index 732af3a9618..4599c3e8bcb 100644
--- a/arch/x86/mm/srat.c
+++ b/arch/x86/mm/srat.c
@@ -176,6 +176,8 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
                 return;
         }
 
+        node_set(node, numa_nodes_parsed);
+
         printk(KERN_INFO "SRAT: Node %u PXM %u [mem %#010Lx-%#010Lx]\n",
                node, pxm,
                (unsigned long long) start, (unsigned long long) end - 1);
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index e31bcd8f2ee..fd41a9262d6 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -782,7 +782,7 @@ BLOCKING_NOTIFIER_HEAD(intel_scu_notifier);
 EXPORT_SYMBOL_GPL(intel_scu_notifier);
 
 /* Called by IPC driver */
-void intel_scu_devices_create(void)
+void __devinit intel_scu_devices_create(void)
 {
         int i;
 
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 3ae0e61abd2..59880afa851 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1295,7 +1295,6 @@ static void __init enable_timeouts(void)
                  */
                 mmr_image |= (1L << SOFTACK_MSHIFT);
                 if (is_uv2_hub()) {
-                        mmr_image &= ~(1L << UV2_LEG_SHFT);
                         mmr_image |= (1L << UV2_EXT_SHFT);
                 }
                 write_mmr_misc_control(pnode, mmr_image);
diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk
index 5f6a5b6c3a1..ddcf39b1a18 100644
--- a/arch/x86/tools/gen-insn-attr-x86.awk
+++ b/arch/x86/tools/gen-insn-attr-x86.awk
@@ -66,9 +66,10 @@ BEGIN {
         rex_expr = "^REX(\\.[XRWB]+)*"
         fpu_expr = "^ESC" # TODO
 
-        lprefix1_expr = "\\(66\\)"
+        lprefix1_expr = "\\((66|!F3)\\)"
         lprefix2_expr = "\\(F3\\)"
-        lprefix3_expr = "\\(F2\\)"
+        lprefix3_expr = "\\((F2|!F3)\\)"
+        lprefix_expr = "\\((66|F2|F3)\\)"
         max_lprefix = 4
 
         # All opcodes starting with lower-case 'v' or with (v1) superscript
@@ -333,13 +334,16 @@ function convert_operands(count,opnd,       i,j,imm,mod)
                 if (match(ext, lprefix1_expr)) {
                         lptable1[idx] = add_flags(lptable1[idx],flags)
                         variant = "INAT_VARIANT"
-                } else if (match(ext, lprefix2_expr)) {
+                }
+                if (match(ext, lprefix2_expr)) {
                         lptable2[idx] = add_flags(lptable2[idx],flags)
                         variant = "INAT_VARIANT"
-                } else if (match(ext, lprefix3_expr)) {
+                }
+                if (match(ext, lprefix3_expr)) {
                         lptable3[idx] = add_flags(lptable3[idx],flags)
                         variant = "INAT_VARIANT"
-                } else {
+                }
+                if (!match(ext, lprefix_expr)){
                         table[idx] = add_flags(table[idx],flags)
                 }
         }
diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
index 416bd40c0eb..68d1dc91b37 100644
--- a/arch/x86/um/sys_call_table_32.c
+++ b/arch/x86/um/sys_call_table_32.c
@@ -39,9 +39,9 @@
 #undef __SYSCALL_I386
 #define __SYSCALL_I386(nr, sym, compat) [ nr ] = sym,
 
-typedef void (*sys_call_ptr_t)(void);
+typedef asmlinkage void (*sys_call_ptr_t)(void);
 
-extern void sys_ni_syscall(void);
+extern asmlinkage void sys_ni_syscall(void);
 
 const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
         /*
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e74df9548a0..ff962d4b821 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -209,6 +209,9 @@ static void __init xen_banner(void)
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
 }
 
+#define CPUID_THERM_POWER_LEAF 6
+#define APERFMPERF_PRESENT 0
+
 static __read_mostly unsigned int cpuid_leaf1_edx_mask = ~0;
 static __read_mostly unsigned int cpuid_leaf1_ecx_mask = ~0;
 
@@ -242,6 +245,11 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                 *dx = cpuid_leaf5_edx_val;
                 return;
 
+        case CPUID_THERM_POWER_LEAF:
+                /* Disabling APERFMPERF for kernel usage */
+                maskecx = ~(1 << APERFMPERF_PRESENT);
+                break;
+
         case 0xb:
                 /* Suppress extended topology stuff */
                 maskebx = 0;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index ffd08c414e9..64effdc6da9 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -706,6 +706,7 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         if (!PageHighMem(page)) {
@@ -741,6 +742,24 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
         spin_unlock_irqrestore(&m2p_override_lock, flags);
 
+        /* p2m(m2p(mfn)) == mfn: the mfn is already present somewhere in
+         * this domain. Set the FOREIGN_FRAME_BIT in the p2m for the other
+         * pfn so that the following mfn_to_pfn(mfn) calls will return the
+         * pfn from the m2p_override (the backend pfn) instead.
+         * We need to do this because the pages shared by the frontend
+         * (xen-blkfront) can be already locked (lock_page, called by
+         * do_read_cache_page); when the userspace backend tries to use them
+         * with direct_IO, mfn_to_pfn returns the pfn of the frontend, so
+         * do_blockdev_direct_IO is going to try to lock the same pages
+         * again resulting in a deadlock.
+         * As a side effect get_user_pages_fast might not be safe on the
+         * frontend pages while they are being shared with the backend,
+         * because mfn_to_pfn (that ends up being called by GUPF) will
+         * return the backend pfn rather than the frontend pfn. */
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == mfn)
+                set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_add_override);
@@ -752,6 +771,7 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         mfn = get_phys_to_machine(pfn);
@@ -821,6 +841,22 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         } else
                 set_phys_to_machine(pfn, page->index);
 
+        /* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
+         * somewhere in this domain, even before being added to the
+         * m2p_override (see comment above in m2p_add_override).
+         * If there are no other entries in the m2p_override corresponding
+         * to this mfn, then remove the FOREIGN_FRAME_BIT from the p2m for
+         * the original pfn (the one shared by the frontend): the backend
+         * cannot do any IO on this page anymore because it has been
+         * unshared. Removing the FOREIGN_FRAME_BIT from the p2m entry of
+         * the original pfn causes mfn_to_pfn(mfn) to return the frontend
+         * pfn again. */
+        mfn &= ~FOREIGN_FRAME_BIT;
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
+                        m2p_find_override(mfn) == NULL)
+                set_phys_to_machine(pfn, mfn);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_remove_override);
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 3ebba0753d3..a4790bf22c5 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -371,7 +371,8 @@ char * __init xen_memory_setup(void)
         populated = xen_populate_chunk(map, memmap.nr_entries,
                         max_pfn, &last_pfn, xen_released_pages);
 
-        extra_pages += (xen_released_pages - populated);
+        xen_released_pages -= populated;
+        extra_pages += xen_released_pages;
 
         if (last_pfn > max_pfn) {
                 max_pfn = min(MAX_DOMAIN_PAGES, last_pfn);