Merge branch 'linus' into sched/core

Resolve cherry-picking conflicts:

Conflicts:
	mm/huge_memory.c
	mm/memory.c
	mm/mprotect.c

See this upstream merge commit for more details:

  52469b4fcd4f Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Signed-off-by: Ingo Molnar <mingo@kernel.org>

54 files changed, 300 insertions, 132 deletions

diff --git a/arch/arc/kernel/ptrace.c b/arch/arc/kernel/ptrace.c
index 333238564b67..5d76706139dd 100644
--- a/arch/arc/kernel/ptrace.c
+++ b/arch/arc/kernel/ptrace.c
@@ -102,7 +102,7 @@ static int genregs_set(struct task_struct *target,
         REG_IGNORE_ONE(pad2);
         REG_IN_CHUNK(callee, efa, cregs);       /* callee_regs[r25..r13] */
         REG_IGNORE_ONE(efa);                    /* efa update invalid */
-        REG_IN_ONE(stop_pc, &ptregs->ret);      /* stop_pc: PC update */
+        REG_IGNORE_ONE(stop_pc);                        /* PC updated via @ret */
 
         return ret;
 }
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 7d7cc777ff7b..bbac42a78ce5 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -96,6 +96,11 @@
                              <1 14 0xf08>,
                              <1 11 0xf08>,
                              <1 10 0xf08>;
+                /* Unfortunately we need this since some versions of U-Boot
+                 * on Exynos don't set the CNTFRQ register, so we need the
+                 * value from DT.
+                 */
+                clock-frequency = <24000000>;
         };
 
         mct@101C0000 {
diff --git a/arch/arm/boot/dts/integratorcp.dts b/arch/arm/boot/dts/integratorcp.dts
index ff1aea0ee043..72693a69f830 100644
--- a/arch/arm/boot/dts/integratorcp.dts
+++ b/arch/arm/boot/dts/integratorcp.dts
@@ -9,11 +9,6 @@
         model = "ARM Integrator/CP";
         compatible = "arm,integrator-cp";
 
-        aliases {
-                arm,timer-primary = &timer2;
-                arm,timer-secondary = &timer1;
-        };
-
         chosen {
                 bootargs = "root=/dev/ram0 console=ttyAMA0,38400n8 earlyprintk";
         };
@@ -24,14 +19,18 @@
         };
 
         timer0: timer@13000000 {
+                /* TIMER0 runs @ 25MHz */
                 compatible = "arm,integrator-cp-timer";
+                status = "disabled";
         };
 
         timer1: timer@13000100 {
+                /* TIMER1 runs @ 1MHz */
                 compatible = "arm,integrator-cp-timer";
         };
 
         timer2: timer@13000200 {
+                /* TIMER2 runs @ 1MHz */
                 compatible = "arm,integrator-cp-timer";
         };
 
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index 0c514dc8460c..2816bf612672 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -11,7 +11,7 @@
 
 / {
         model = "TI OMAP3 BeagleBoard xM";
-        compatible = "ti,omap3-beagle-xm", "ti,omap3-beagle", "ti,omap3";
+        compatible = "ti,omap3-beagle-xm", "ti,omap36xx", "ti,omap3";
 
         cpus {
                 cpu@0 {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 7d95cda1fae4..b41bd57f4328 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -108,7 +108,7 @@
                         #address-cells = <1>;
                         #size-cells = <0>;
                         pinctrl-single,register-width = <16>;
-                        pinctrl-single,function-mask = <0x7f1f>;
+                        pinctrl-single,function-mask = <0xff1f>;
                 };
 
                 omap3_pmx_wkup: pinmux@0x48002a00 {
@@ -117,7 +117,7 @@
                         #address-cells = <1>;
                         #size-cells = <0>;
                         pinctrl-single,register-width = <16>;
-                        pinctrl-single,function-mask = <0x7f1f>;
+                        pinctrl-single,function-mask = <0xff1f>;
                 };
 
                 gpio1: gpio@48310000 {
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index 370236dd1a03..990250965f2c 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -51,7 +51,8 @@ void mcpm_cpu_power_down(void)
 {
         phys_reset_t phys_reset;
 
-        BUG_ON(!platform_ops);
+        if (WARN_ON_ONCE(!platform_ops || !platform_ops->power_down))
+                return;
         BUG_ON(!irqs_disabled());
 
         /*
@@ -93,7 +94,8 @@ void mcpm_cpu_suspend(u64 expected_residency)
 {
         phys_reset_t phys_reset;
 
-        BUG_ON(!platform_ops);
+        if (WARN_ON_ONCE(!platform_ops || !platform_ops->suspend))
+                return;
         BUG_ON(!irqs_disabled());
 
         /* Very similar to mcpm_cpu_power_down() */
diff --git a/arch/arm/common/sharpsl_param.c b/arch/arm/common/sharpsl_param.c
index d56c932580eb..025f6ce38596 100644
--- a/arch/arm/common/sharpsl_param.c
+++ b/arch/arm/common/sharpsl_param.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/string.h>
 #include <asm/mach/sharpsl_param.h>
+#include <asm/memory.h>
 
 /*
  * Certain hardware parameters determined at the time of device manufacture,
@@ -25,8 +26,10 @@
  */
 #ifdef CONFIG_ARCH_SA1100
 #define PARAM_BASE      0xe8ffc000
+#define param_start(x)  (void *)(x)
 #else
 #define PARAM_BASE      0xa0000a00
+#define param_start(x)  __va(x)
 #endif
 #define MAGIC_CHG(a,b,c,d) ( ( d << 24 ) | ( c << 16 )  | ( b << 8 ) | a )
 
@@ -41,7 +44,7 @@ EXPORT_SYMBOL(sharpsl_param);
 
 void sharpsl_save_param(void)
 {
-        memcpy(&sharpsl_param, (void *)PARAM_BASE, sizeof(struct sharpsl_param_info));
+        memcpy(&sharpsl_param, param_start(PARAM_BASE), sizeof(struct sharpsl_param_info));
 
         if (sharpsl_param.comadj_keyword != COMADJ_MAGIC)
                 sharpsl_param.comadj=-1;
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index 4e6838d4ddf6..1a7024b41351 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -31,6 +31,5 @@ generic-y += termbits.h
 generic-y += termios.h
 generic-y += timex.h
 generic-y += trace_clock.h
-generic-y += types.h
 generic-y += unaligned.h
 generic-y += preempt.h
diff --git a/arch/arm/include/asm/mcpm.h b/arch/arm/include/asm/mcpm.h
index 0f7b7620e9a5..fc82a88f5b69 100644
--- a/arch/arm/include/asm/mcpm.h
+++ b/arch/arm/include/asm/mcpm.h
@@ -76,8 +76,11 @@ int mcpm_cpu_power_up(unsigned int cpu, unsigned int cluster);
  *
  * This must be called with interrupts disabled.
  *
- * This does not return.  Re-entry in the kernel is expected via
- * mcpm_entry_point.
+ * On success this does not return.  Re-entry in the kernel is expected
+ * via mcpm_entry_point.
+ *
+ * This will return if mcpm_platform_register() has not been called
+ * previously in which case the caller should take appropriate action.
  */
 void mcpm_cpu_power_down(void);
 
@@ -98,8 +101,11 @@ void mcpm_cpu_power_down(void);
  *
  * This must be called with interrupts disabled.
  *
- * This does not return.  Re-entry in the kernel is expected via
- * mcpm_entry_point.
+ * On success this does not return.  Re-entry in the kernel is expected
+ * via mcpm_entry_point.
+ *
+ * This will return if mcpm_platform_register() has not been called
+ * previously in which case the caller should take appropriate action.
  */
 void mcpm_cpu_suspend(u64 expected_residency);
 
diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h
index f1d96d4e8092..73ddd7239b33 100644
--- a/arch/arm/include/asm/syscall.h
+++ b/arch/arm/include/asm/syscall.h
@@ -57,6 +57,9 @@ static inline void syscall_get_arguments(struct task_struct *task,
                                          unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
+        if (n == 0)
+                return;
+
         if (i + n > SYSCALL_MAX_ARGS) {
                 unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
                 unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
@@ -81,6 +84,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
                                          unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
+        if (n == 0)
+                return;
+
         if (i + n > SYSCALL_MAX_ARGS) {
                 pr_warning("%s called with max args %d, handling only %d\n",
                            __func__, i + n, SYSCALL_MAX_ARGS);
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 2c7cc1e03473..476de57dcef2 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -487,7 +487,26 @@ __fixup_smp:
         mrc     p15, 0, r0, c0, c0, 5   @ read MPIDR
         and     r0, r0, #0xc0000000     @ multiprocessing extensions and
         teq     r0, #0x80000000         @ not part of a uniprocessor system?
-        moveq   pc, lr                  @ yes, assume SMP
+        bne    __fixup_smp_on_up        @ no, assume UP
+
+        @ Core indicates it is SMP. Check for Aegis SOC where a single
+        @ Cortex-A9 CPU is present but SMP operations fault.
+        mov     r4, #0x41000000
+        orr     r4, r4, #0x0000c000
+        orr     r4, r4, #0x00000090
+        teq     r3, r4                  @ Check for ARM Cortex-A9
+        movne   pc, lr                  @ Not ARM Cortex-A9,
+
+        @ If a future SoC *does* use 0x0 as the PERIPH_BASE, then the
+        @ below address check will need to be #ifdef'd or equivalent
+        @ for the Aegis platform.
+        mrc     p15, 4, r0, c15, c0     @ get SCU base address
+        teq     r0, #0x0                @ '0' on actual UP A9 hardware
+        beq     __fixup_smp_on_up       @ So its an A9 UP
+        ldr     r0, [r0, #4]            @ read SCU Config
+        and     r0, r0, #0x3            @ number of CPUs
+        teq     r0, #0x0                @ is 1?
+        movne   pc, lr
 
 __fixup_smp_on_up:
         adr     r0, 1f
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 39c78387ddec..87162e1b94a5 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -129,6 +129,24 @@ DT_MACHINE_START(OMAP3_DT, "Generic OMAP3 (Flattened Device Tree)")
         .restart        = omap3xxx_restart,
 MACHINE_END
 
+static const char *omap36xx_boards_compat[] __initdata = {
+        "ti,omap36xx",
+        NULL,
+};
+
+DT_MACHINE_START(OMAP36XX_DT, "Generic OMAP36xx (Flattened Device Tree)")
+        .reserve        = omap_reserve,
+        .map_io         = omap3_map_io,
+        .init_early     = omap3630_init_early,
+        .init_irq       = omap_intc_of_init,
+        .handle_irq     = omap3_intc_handle_irq,
+        .init_machine   = omap_generic_init,
+        .init_late      = omap3_init_late,
+        .init_time      = omap3_sync32k_timer_init,
+        .dt_compat      = omap36xx_boards_compat,
+        .restart        = omap3xxx_restart,
+MACHINE_END
+
 static const char *omap3_gp_boards_compat[] __initdata = {
         "ti,omap3-beagle",
         "timll,omap3-devkit8000",
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index c3270c0f1fce..f6fe388af989 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -167,38 +167,47 @@ static struct lp55xx_led_config rx51_lp5523_led_config[] = {
                 .name           = "lp5523:kb1",
                 .chan_nr        = 0,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb2",
                 .chan_nr        = 1,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb3",
                 .chan_nr        = 2,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb4",
                 .chan_nr        = 3,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:b",
                 .chan_nr        = 4,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:g",
                 .chan_nr        = 5,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:r",
                 .chan_nr        = 6,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb5",
                 .chan_nr        = 7,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb6",
                 .chan_nr        = 8,
                 .led_current    = 50,
+                .max_current    = 100,
         }
 };
 
diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c
index 64b5a8346982..8b6876c98ce1 100644
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -272,9 +272,19 @@ static int omap2_onenand_setup_async(void __iomem *onenand_base)
         struct gpmc_timings t;
         int ret;
 
-        if (gpmc_onenand_data->of_node)
+        if (gpmc_onenand_data->of_node) {
                 gpmc_read_settings_dt(gpmc_onenand_data->of_node,
                                       &onenand_async);
+                if (onenand_async.sync_read || onenand_async.sync_write) {
+                        if (onenand_async.sync_write)
+                                gpmc_onenand_data->flags |=
+                                        ONENAND_SYNC_READWRITE;
+                        else
+                                gpmc_onenand_data->flags |= ONENAND_SYNC_READ;
+                        onenand_async.sync_read = false;
+                        onenand_async.sync_write = false;
+                }
+        }
 
         omap2_onenand_set_async_mode(onenand_base);
 
diff --git a/arch/arm/mach-omap2/mux.h b/arch/arm/mach-omap2/mux.h
index 5d2080ef7923..16f78a990d04 100644
--- a/arch/arm/mach-omap2/mux.h
+++ b/arch/arm/mach-omap2/mux.h
@@ -28,7 +28,7 @@
 #define OMAP_PULL_UP                    (1 << 4)
 #define OMAP_ALTELECTRICALSEL           (1 << 5)
 
-/* 34xx specific mux bit defines */
+/* omap3/4/5 specific mux bit defines */
 #define OMAP_INPUT_EN                   (1 << 8)
 #define OMAP_OFF_EN                     (1 << 9)
 #define OMAP_OFFOUT_EN                  (1 << 10)
@@ -36,8 +36,6 @@
 #define OMAP_OFF_PULL_EN                (1 << 12)
 #define OMAP_OFF_PULL_UP                (1 << 13)
 #define OMAP_WAKEUP_EN                  (1 << 14)
-
-/* 44xx specific mux bit defines */
 #define OMAP_WAKEUP_EVENT               (1 << 15)
 
 /* Active pin states */
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index fa74a0625da1..ead48fa5715e 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -628,7 +628,7 @@ void __init omap4_local_timer_init(void)
 #endif /* CONFIG_HAVE_ARM_TWD */
 #endif /* CONFIG_ARCH_OMAP4 */
 
-#ifdef CONFIG_SOC_OMAP5
+#if defined(CONFIG_SOC_OMAP5) || defined(CONFIG_SOC_DRA7XX)
 void __init omap5_realtime_timer_init(void)
 {
         omap4_sync32k_timer_init();
@@ -636,7 +636,7 @@ void __init omap5_realtime_timer_init(void)
 
         clocksource_of_init();
 }
-#endif /* CONFIG_SOC_OMAP5 */
+#endif /* CONFIG_SOC_OMAP5 || CONFIG_SOC_DRA7XX */
 
 /**
  * omap_timer_init - build and register timer device with an
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f5e1a8471714..1272ed202dde 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1232,7 +1232,8 @@ __iommu_create_mapping(struct device *dev, struct page **pages, size_t size)
                                 break;
 
                 len = (j - i) << PAGE_SHIFT;
-                ret = iommu_map(mapping->domain, iova, phys, len, 0);
+                ret = iommu_map(mapping->domain, iova, phys, len,
+                                IOMMU_READ|IOMMU_WRITE);
                 if (ret < 0)
                         goto fail;
                 iova += len;
@@ -1431,6 +1432,27 @@ static int arm_iommu_get_sgtable(struct device *dev, struct sg_table *sgt,
                                          GFP_KERNEL);
 }
 
+static int __dma_direction_to_prot(enum dma_data_direction dir)
+{
+        int prot;
+
+        switch (dir) {
+        case DMA_BIDIRECTIONAL:
+                prot = IOMMU_READ | IOMMU_WRITE;
+                break;
+        case DMA_TO_DEVICE:
+                prot = IOMMU_READ;
+                break;
+        case DMA_FROM_DEVICE:
+                prot = IOMMU_WRITE;
+                break;
+        default:
+                prot = 0;
+        }
+
+        return prot;
+}
+
 /*
  * Map a part of the scatter-gather list into contiguous io address space
  */
@@ -1444,6 +1466,7 @@ static int __map_sg_chunk(struct device *dev, struct scatterlist *sg,
         int ret = 0;
         unsigned int count;
         struct scatterlist *s;
+        int prot;
 
         size = PAGE_ALIGN(size);
         *handle = DMA_ERROR_CODE;
@@ -1460,7 +1483,9 @@ static int __map_sg_chunk(struct device *dev, struct scatterlist *sg,
                         !dma_get_attr(DMA_ATTR_SKIP_CPU_SYNC, attrs))
                         __dma_page_cpu_to_dev(sg_page(s), s->offset, s->length, dir);
 
-                ret = iommu_map(mapping->domain, iova, phys, len, 0);
+                prot = __dma_direction_to_prot(dir);
+
+                ret = iommu_map(mapping->domain, iova, phys, len, prot);
                 if (ret < 0)
                         goto fail;
                 count += len >> PAGE_SHIFT;
@@ -1665,19 +1690,7 @@ static dma_addr_t arm_coherent_iommu_map_page(struct device *dev, struct page *p
         if (dma_addr == DMA_ERROR_CODE)
                 return dma_addr;
 
-        switch (dir) {
-        case DMA_BIDIRECTIONAL:
-                prot = IOMMU_READ | IOMMU_WRITE;
-                break;
-        case DMA_TO_DEVICE:
-                prot = IOMMU_READ;
-                break;
-        case DMA_FROM_DEVICE:
-                prot = IOMMU_WRITE;
-                break;
-        default:
-                prot = 0;
-        }
+        prot = __dma_direction_to_prot(dir);
 
         ret = iommu_map(mapping->domain, dma_addr, page_to_phys(page), len, prot);
         if (ret < 0)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index febaee7ca57b..18ec4c504abf 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -17,7 +17,6 @@
 #include <linux/nodemask.h>
 #include <linux/initrd.h>
 #include <linux/of_fdt.h>
-#include <linux/of_reserved_mem.h>
 #include <linux/highmem.h>
 #include <linux/gfp.h>
 #include <linux/memblock.h>
@@ -379,8 +378,6 @@ void __init arm_memblock_init(struct meminfo *mi,
         if (mdesc->reserve)
                 mdesc->reserve();
 
-        early_init_dt_scan_reserved_mem();
-
         /*
          * reserve memory for DMA contigouos allocations,
          * must come from DMA area inside low memory
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index f50d223a0bd3..99b44e0e8d86 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -930,4 +930,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter)
                 module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/mips/kernel/octeon_switch.S b/arch/mips/kernel/octeon_switch.S
index 4204d76af854..029e002a4ea0 100644
--- a/arch/mips/kernel/octeon_switch.S
+++ b/arch/mips/kernel/octeon_switch.S
@@ -73,7 +73,7 @@
 3:
 
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
         LONG_L  t9, TASK_STACK_CANARY(a1)
         LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 38af83f84c4a..20b7b040e76f 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -67,7 +67,7 @@ LEAF(resume)
 1:
 
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
         LONG_L  t9, TASK_STACK_CANARY(a1)
         LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index 921238a6bd26..078de5eaca8f 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -69,7 +69,7 @@
 1:
 
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
         LONG_L  t9, TASK_STACK_CANARY(a1)
         LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/parisc/configs/712_defconfig b/arch/parisc/configs/712_defconfig
index 0f90569b9d85..9387cc2693f6 100644
--- a/arch/parisc/configs/712_defconfig
+++ b/arch/parisc/configs/712_defconfig
@@ -40,6 +40,8 @@ CONFIG_IP_NF_QUEUE=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/configs/a500_defconfig b/arch/parisc/configs/a500_defconfig
index b647b182dacc..90025322b75e 100644
--- a/arch/parisc/configs/a500_defconfig
+++ b/arch/parisc/configs/a500_defconfig
@@ -79,6 +79,8 @@ CONFIG_IP_DCCP=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/b180_defconfig b/arch/parisc/configs/b180_defconfig
index e289f5bf3148..f1a0c25bef8d 100644
--- a/arch/parisc/configs/b180_defconfig
+++ b/arch/parisc/configs/b180_defconfig
@@ -4,6 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODVERSIONS=y
@@ -27,6 +28,8 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_LRO is not set
 CONFIG_IPV6=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index 311ca367b622..ec1b014952b6 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -5,6 +5,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
@@ -39,6 +40,8 @@ CONFIG_NETFILTER_DEBUG=y
 CONFIG_IP_NF_QUEUE=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index f11006361297..e1c8d2015c89 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -62,6 +62,8 @@ CONFIG_TIPC=m
 CONFIG_LLC2=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/default_defconfig b/arch/parisc/configs/default_defconfig
index dfe88f6c95c4..ba61495e1fa4 100644
--- a/arch/parisc/configs/default_defconfig
+++ b/arch/parisc/configs/default_defconfig
@@ -49,6 +49,8 @@ CONFIG_INET6_ESP=y
 CONFIG_INET6_IPCOMP=y
 CONFIG_LLC2=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/include/asm/traps.h b/arch/parisc/include/asm/traps.h
index 1945f995f2df..4736020ba5ea 100644
--- a/arch/parisc/include/asm/traps.h
+++ b/arch/parisc/include/asm/traps.h
@@ -6,7 +6,7 @@ struct pt_regs;
 
 /* traps.c */
 void parisc_terminate(char *msg, struct pt_regs *regs,
-                int code, unsigned long offset);
+                int code, unsigned long offset) __noreturn __cold;
 
 /* mm/fault.c */
 void do_page_fault(struct pt_regs *regs, unsigned long code,
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 37aabd772fbb..d2d58258aea6 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -195,6 +195,8 @@ common_stext:
         ldw             MEM_PDC_HI(%r0),%r6
         depd            %r6, 31, 32, %r3        /* move to upper word */
 
+        mfctl           %cr30,%r6               /* PCX-W2 firmware bug */
+
         ldo             PDC_PSW(%r0),%arg0              /* 21 */
         ldo             PDC_PSW_SET_DEFAULTS(%r0),%arg1 /* 2 */
         ldo             PDC_PSW_WIDE_BIT(%r0),%arg2     /* 2 */
@@ -203,6 +205,8 @@ common_stext:
         copy            %r0,%arg3
 
 stext_pdc_ret:
+        mtctl           %r6,%cr30               /* restore task thread info */
+
         /* restore rfi target address*/
         ldd             TI_TASK-THREAD_SZ_ALGN(%sp), %r10
         tophys_r1       %r10
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 8a252f2d6c08..2b96602e812f 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -72,7 +72,6 @@ enum ipi_message_type {
         IPI_NOP=0,
         IPI_RESCHEDULE=1,
         IPI_CALL_FUNC,
-        IPI_CALL_FUNC_SINGLE,
         IPI_CPU_START,
         IPI_CPU_STOP,
         IPI_CPU_TEST
@@ -164,11 +163,6 @@ ipi_interrupt(int irq, void *dev_id)
                                 generic_smp_call_function_interrupt();
                                 break;
 
-                        case IPI_CALL_FUNC_SINGLE:
-                                smp_debug(100, KERN_DEBUG "CPU%d IPI_CALL_FUNC_SINGLE\n", this_cpu);
-                                generic_smp_call_function_single_interrupt();
-                                break;
-
                         case IPI_CPU_START:
                                 smp_debug(100, KERN_DEBUG "CPU%d IPI_CPU_START\n", this_cpu);
                                 break;
@@ -260,7 +254,7 @@ void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 
 void arch_send_call_function_single_ipi(int cpu)
 {
-        send_IPI_single(cpu, IPI_CALL_FUNC_SINGLE);
+        send_IPI_single(cpu, IPI_CALL_FUNC);
 }
 
 /*
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 04e47c6a4562..1cd1d0c83b6d 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -291,11 +291,6 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)
         do_exit(SIGSEGV);
 }
 
-int syscall_ipi(int (*syscall) (struct pt_regs *), struct pt_regs *regs)
-{
-        return syscall(regs);
-}
-
 /* gdb uses break 4,8 */
 #define GDB_BREAK_INSN 0x10004
 static void handle_gdb_break(struct pt_regs *regs, int wot)
@@ -805,14 +800,14 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
         else {
 
             /*
-             * The kernel should never fault on its own address space.
+             * The kernel should never fault on its own address space,
+             * unless pagefault_disable() was called before.
              */
 
-            if (fault_space == 0) 
+            if (fault_space == 0 && !in_atomic())
             {
                 pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
                 parisc_terminate("Kernel Fault", regs, code, fault_address);
-        
             }
         }
 
diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
index ac4370b1ca40..b5507ec06b84 100644
--- a/arch/parisc/lib/memcpy.c
+++ b/arch/parisc/lib/memcpy.c
@@ -56,7 +56,7 @@
 #ifdef __KERNEL__
 #include <linux/module.h>
 #include <linux/compiler.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #define s_space "%%sr1"
 #define d_space "%%sr2"
 #else
@@ -524,4 +524,17 @@ EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(copy_from_user);
 EXPORT_SYMBOL(copy_in_user);
 EXPORT_SYMBOL(memcpy);
+
+long probe_kernel_read(void *dst, const void *src, size_t size)
+{
+        unsigned long addr = (unsigned long)src;
+
+        if (size < 0 || addr < PAGE_SIZE)
+                return -EFAULT;
+
+        /* check for I/O space F_EXTEND(0xfff00000) access as well? */
+
+        return __probe_kernel_read(dst, src, size);
+}
+
 #endif
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 00c0ed333a3d..0293588d5b8c 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -171,20 +171,25 @@ void do_page_fault(struct pt_regs *regs, unsigned long code,
                               unsigned long address)
 {
         struct vm_area_struct *vma, *prev_vma;
-        struct task_struct *tsk = current;
-        struct mm_struct *mm = tsk->mm;
+        struct task_struct *tsk;
+        struct mm_struct *mm;
         unsigned long acc_type;
         int fault;
-        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+        unsigned int flags;
 
-        if (in_atomic() || !mm)
+        if (in_atomic())
                 goto no_context;
 
+        tsk = current;
+        mm = tsk->mm;
+        if (!mm)
+                goto no_context;
+
+        flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
         if (user_mode(regs))
                 flags |= FAULT_FLAG_USER;
 
         acc_type = parisc_acctyp(code, regs->iir);
-
         if (acc_type & VM_WRITE)
                 flags |= FAULT_FLAG_WRITE;
 retry:
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index bf56e33f8257..2345bdb4d917 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -691,4 +691,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter)
                 module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 9b60a36c348d..2204400d0bd5 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -748,7 +748,9 @@ static inline void pgste_set_key(pte_t *ptep, pgste_t pgste, pte_t entry)
 
 static inline void pgste_set_pte(pte_t *ptep, pte_t entry)
 {
-        if (!MACHINE_HAS_ESOP && (pte_val(entry) & _PAGE_WRITE)) {
+        if (!MACHINE_HAS_ESOP &&
+            (pte_val(entry) & _PAGE_PRESENT) &&
+            (pte_val(entry) & _PAGE_WRITE)) {
                 /*
                  * Without enhanced suppression-on-protection force
                  * the dirty bit on for all writable ptes.
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index 8ad8af915032..819b94d22720 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -71,30 +71,30 @@ static inline void local_tick_enable(unsigned long long comp)
 
 typedef unsigned long long cycles_t;
 
-static inline unsigned long long get_tod_clock(void)
-{
-        unsigned long long clk;
-
-#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
-        asm volatile(".insn s,0xb27c0000,%0" : "=Q" (clk) : : "cc");
-#else
-        asm volatile("stck %0" : "=Q" (clk) : : "cc");
-#endif
-        return clk;
-}
-
 static inline void get_tod_clock_ext(char *clk)
 {
         asm volatile("stcke %0" : "=Q" (*clk) : : "cc");
 }
 
-static inline unsigned long long get_tod_clock_xt(void)
+static inline unsigned long long get_tod_clock(void)
 {
         unsigned char clk[16];
         get_tod_clock_ext(clk);
         return *((unsigned long long *)&clk[1]);
 }
 
+static inline unsigned long long get_tod_clock_fast(void)
+{
+#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
+        unsigned long long clk;
+
+        asm volatile("stckf %0" : "=Q" (clk) : : "cc");
+        return clk;
+#else
+        return get_tod_clock();
+#endif
+}
+
 static inline cycles_t get_cycles(void)
 {
         return (cycles_t) get_tod_clock() >> 2;
@@ -125,7 +125,7 @@ extern u64 sched_clock_base_cc;
  */
 static inline unsigned long long get_tod_clock_monotonic(void)
 {
-        return get_tod_clock_xt() - sched_clock_base_cc;
+        return get_tod_clock() - sched_clock_base_cc;
 }
 
 /**
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 1389b637dae5..adaa9e9478d8 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -99,7 +99,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
                         break;
                 }
         }
-        return err;
+        return err ? -EFAULT : 0;
 }
 
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
@@ -148,7 +148,7 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
                         break;
                 }
         }
-        return err;
+        return err ? -EFAULT : 0;
 }
 
 static int save_sigregs32(struct pt_regs *regs, _sigregs32 __user *sregs)
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index f1279dc2e1bc..17d62fe5d7b7 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -867,7 +867,7 @@ static inline void
 debug_finish_entry(debug_info_t * id, debug_entry_t* active, int level,
                         int exception)
 {
-        active->id.stck = get_tod_clock();
+        active->id.stck = get_tod_clock_fast();
         active->id.fields.cpuid = smp_processor_id();
         active->caller = __builtin_return_address(0);
         active->id.fields.exception = exception;
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 7f35cb33e510..7f1f7ac5cf7f 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -385,7 +385,7 @@ static int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu)
         }
 
         if ((!rc) && (vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch)) {
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch)) {
                 if ((!psw_extint_disabled(vcpu)) &&
                         (vcpu->arch.sie_block->gcr[0] & 0x800ul))
                         rc = 1;
@@ -425,7 +425,7 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
                 goto no_timer;
         }
 
-        now = get_tod_clock() + vcpu->arch.sie_block->epoch;
+        now = get_tod_clock_fast() + vcpu->arch.sie_block->epoch;
         if (vcpu->arch.sie_block->ckc < now) {
                 __unset_cpu_idle(vcpu);
                 return 0;
@@ -515,7 +515,7 @@ void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
         }
 
         if ((vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch))
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch))
                 __try_deliver_ckc_interrupt(vcpu);
 
         if (atomic_read(&fi->active)) {
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index 57c87d7d7ede..a9f3d0042d58 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -44,7 +44,7 @@ static void __udelay_disabled(unsigned long long usecs)
         do {
                 set_clock_comparator(end);
                 vtime_stop_cpu();
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
         lockdep_on();
         __ctl_load(cr0, 0, 0);
         __ctl_load(cr6, 6, 6);
@@ -55,7 +55,7 @@ static void __udelay_enabled(unsigned long long usecs)
 {
         u64 clock_saved, end;
 
-        end = get_tod_clock() + (usecs << 12);
+        end = get_tod_clock_fast() + (usecs << 12);
         do {
                 clock_saved = 0;
                 if (end < S390_lowcore.clock_comparator) {
@@ -65,7 +65,7 @@ static void __udelay_enabled(unsigned long long usecs)
                 vtime_stop_cpu();
                 if (clock_saved)
                         local_tick_enable(clock_saved);
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
 }
 
 /*
@@ -109,8 +109,8 @@ void udelay_simple(unsigned long long usecs)
 {
         u64 end;
 
-        end = get_tod_clock() + (usecs << 12);
-        while (get_tod_clock() < end)
+        end = get_tod_clock_fast() + (usecs << 12);
+        while (get_tod_clock_fast() < end)
                 cpu_relax();
 }
 
@@ -120,10 +120,10 @@ void __ndelay(unsigned long long nsecs)
 
         nsecs <<= 9;
         do_div(nsecs, 125);
-        end = get_tod_clock() + nsecs;
+        end = get_tod_clock_fast() + nsecs;
         if (nsecs & ~0xfffUL)
                 __udelay(nsecs >> 12);
-        while (get_tod_clock() < end)
+        while (get_tod_clock_fast() < end)
                 barrier();
 }
 EXPORT_SYMBOL(__ndelay);
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 709239285869..a5df511e27a2 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -881,7 +881,9 @@ void bpf_jit_free(struct sk_filter *fp)
         struct bpf_binary_header *header = (void *)addr;
 
         if (fp->bpf_func == sk_run_filter)
-                return;
+                goto free_filter;
         set_memory_rw(addr, header->pages);
         module_free(NULL, header);
+free_filter:
+        kfree(fp);
 }
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 9c7be59e6f5a..218b6b23c378 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -808,4 +808,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter)
                 module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/um/kernel/exitcode.c b/arch/um/kernel/exitcode.c
index 829df49dee99..41ebbfebb333 100644
--- a/arch/um/kernel/exitcode.c
+++ b/arch/um/kernel/exitcode.c
@@ -40,9 +40,11 @@ static ssize_t exitcode_proc_write(struct file *file,
                 const char __user *buffer, size_t count, loff_t *pos)
 {
         char *end, buf[sizeof("nnnnn\0")];
+        size_t size;
         int tmp;
 
-        if (copy_from_user(buf, buffer, count))
+        size = min(count, sizeof(buf));
+        if (copy_from_user(buf, buffer, size))
                 return -EFAULT;
 
         tmp = simple_strtol(buf, &end, 0);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ee2fb9d37745..f67e839f06c8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -860,7 +860,7 @@ source "kernel/Kconfig.preempt"
 
 config X86_UP_APIC
         bool "Local APIC support on uniprocessors"
-        depends on X86_32 && !SMP && !X86_32_NON_STANDARD
+        depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI
         ---help---
           A local APIC (Advanced Programmable Interrupt Controller) is an
           integrated interrupt controller in the CPU. If you have a single-CPU
@@ -885,11 +885,11 @@ config X86_UP_IOAPIC
 
 config X86_LOCAL_APIC
         def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC || PCI_MSI
 
 config X86_IO_APIC
         def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC || PCI_MSI
 
 config X86_VISWS_APIC
         def_bool y
@@ -1033,6 +1033,7 @@ config X86_REBOOTFIXUPS
 
 config MICROCODE
         tristate "CPU microcode loading support"
+        depends on CPU_SUP_AMD || CPU_SUP_INTEL
         select FW_LOADER
         ---help---
 
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 0da5200ee79d..b3e18f800302 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -128,7 +128,8 @@ do {							\
 do {                                                                    \
         typedef typeof(var) pao_T__;                                    \
         const int pao_ID__ = (__builtin_constant_p(val) &&              \
-                              ((val) == 1 || (val) == -1)) ? (val) : 0; \
+                              ((val) == 1 || (val) == -1)) ?            \
+                                (int)(val) : 0;                         \
         if (0) {                                                        \
                 pao_T__ pao_tmp__;                                      \
                 pao_tmp__ = (val);                                      \
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 1191ac1c9d25..a419814cea57 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -113,7 +113,7 @@ static int __init early_get_pnodeid(void)
                 break;
         case UV3_HUB_PART_NUMBER:
         case UV3_HUB_PART_NUMBER_X:
-                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
+                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
                 break;
         }
 
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 697b93af02dd..b2046e4d0b59 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -609,7 +609,7 @@ static struct dentry *d_kvm_debug;
 
 struct dentry *kvm_init_debugfs(void)
 {
-        d_kvm_debug = debugfs_create_dir("kvm", NULL);
+        d_kvm_debug = debugfs_create_dir("kvm-guest", NULL);
         if (!d_kvm_debug)
                 printk(KERN_WARNING "Could not create 'kvm' debugfs directory\n");
 
@@ -775,11 +775,22 @@ void __init kvm_spinlock_init(void)
         if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
                 return;
 
-        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
+        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
+        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+}
+
+static __init int kvm_spinlock_init_jump(void)
+{
+        if (!kvm_para_available())
+                return 0;
+        if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
+                return 0;
 
         static_key_slow_inc(&paravirt_ticketlocks_enabled);
+        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
 
-        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
-        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+        return 0;
 }
+early_initcall(kvm_spinlock_init_jump);
+
 #endif  /* CONFIG_PARAVIRT_SPINLOCKS */
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index e643e744e4d8..7e920bff99a3 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -326,6 +326,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6320"),
                 },
         },
+        {       /* Handle problems with rebooting on the Latitude E5410. */
+                .callback = set_pci_reboot,
+                .ident = "Dell Latitude E5410",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5410"),
+                },
+        },
         {       /* Handle problems with rebooting on the Latitude E5420. */
                 .callback = set_pci_reboot,
                 .ident = "Dell Latitude E5420",
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 79c216aa0e2b..516593e1ce33 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -772,13 +772,21 @@ out:
         return;
 }
 
+static void bpf_jit_free_deferred(struct work_struct *work)
+{
+        struct sk_filter *fp = container_of(work, struct sk_filter, work);
+        unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
+        struct bpf_binary_header *header = (void *)addr;
+
+        set_memory_rw(addr, header->pages);
+        module_free(NULL, header);
+        kfree(fp);
+}
+
 void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter) {
-                unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
-                struct bpf_binary_header *header = (void *)addr;
-
-                set_memory_rw(addr, header->pages);
-                module_free(NULL, header);
+                INIT_WORK(&fp->work, bpf_jit_free_deferred);
+                schedule_work(&fp->work);
         }
 }
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index d1e4777b4e75..31d04758b76f 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -278,6 +278,15 @@ static void __init xen_smp_prepare_boot_cpu(void)
                    old memory can be recycled */
                 make_lowmem_page_readwrite(xen_initial_gdt);
 
+#ifdef CONFIG_X86_32
+                /*
+                 * Xen starts us with XEN_FLAT_RING1_DS, but linux code
+                 * expects __USER_DS
+                 */
+                loadsegment(ds, __USER_DS);
+                loadsegment(es, __USER_DS);
+#endif
+
                 xen_filter_cpu_maps();
                 xen_setup_vcpu_info_placement();
         }
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index de1dfa18d0a1..21dbe6bdb8ed 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1122,7 +1122,7 @@ ENDPROC(fast_syscall_spill_registers)
  * a3: exctable, original value in excsave1
  */
 
-fast_syscall_spill_registers_fixup:
+ENTRY(fast_syscall_spill_registers_fixup)
 
         rsr     a2, windowbase  # get current windowbase (a2 is saved)
         xsr     a0, depc        # restore depc and a0
@@ -1134,22 +1134,26 @@ fast_syscall_spill_registers_fixup:
          */
 
         xsr     a3, excsave1    # get spill-mask
-        slli    a2, a3, 1       # shift left by one
+        slli    a3, a3, 1       # shift left by one
 
-        slli    a3, a2, 32-WSBITS
-        src     a2, a2, a3      # a1 = xxwww1yyxxxwww1yy......
+        slli    a2, a3, 32-WSBITS
+        src     a2, a3, a2      # a2 = xxwww1yyxxxwww1yy......
         wsr     a2, windowstart # set corrected windowstart
 
-        rsr     a3, excsave1
-        l32i    a2, a3, EXC_TABLE_DOUBLE_SAVE   # restore a2
-        l32i    a3, a3, EXC_TABLE_PARAM # original WB (in user task)
+        srli    a3, a3, 1
+        rsr     a2, excsave1
+        l32i    a2, a2, EXC_TABLE_DOUBLE_SAVE   # restore a2
+        xsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE   # save a3
+        l32i    a3, a2, EXC_TABLE_PARAM # original WB (in user task)
+        xsr     a2, excsave1
 
         /* Return to the original (user task) WINDOWBASE.
          * We leave the following frame behind:
          * a0, a1, a2   same
-         * a3:          trashed (saved in excsave_1)
+         * a3:          trashed (saved in EXC_TABLE_DOUBLE_SAVE)
          * depc:        depc (we have to return to that address)
-         * excsave_1:   a3
+         * excsave_1:   exctable
          */
 
         wsr     a3, windowbase
@@ -1159,9 +1163,9 @@ fast_syscall_spill_registers_fixup:
          *  a0: return address
          *  a1: used, stack pointer
          *  a2: kernel stack pointer
-         *  a3: available, saved in EXCSAVE_1
+         *  a3: available
          *  depc: exception address
-         *  excsave: a3
+         *  excsave: exctable
          * Note: This frame might be the same as above.
          */
 
@@ -1181,9 +1185,12 @@ fast_syscall_spill_registers_fixup:
         rsr     a0, exccause
         addx4   a0, a0, a3                      # find entry in table
         l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
         jx      a0
 
-fast_syscall_spill_registers_fixup_return:
+ENDPROC(fast_syscall_spill_registers_fixup)
+
+ENTRY(fast_syscall_spill_registers_fixup_return)
 
         /* When we return here, all registers have been restored (a2: DEPC) */
 
@@ -1191,13 +1198,13 @@ fast_syscall_spill_registers_fixup_return:
 
         /* Restore fixup handler. */
 
-        xsr     a3, excsave1
-        movi    a2, fast_syscall_spill_registers_fixup
-        s32i    a2, a3, EXC_TABLE_FIXUP
-        s32i    a0, a3, EXC_TABLE_DOUBLE_SAVE
-        rsr     a2, windowbase
-        s32i    a2, a3, EXC_TABLE_PARAM
-        l32i    a2, a3, EXC_TABLE_KSTK
+        rsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE
+        movi    a3, fast_syscall_spill_registers_fixup
+        s32i    a3, a2, EXC_TABLE_FIXUP
+        rsr     a3, windowbase
+        s32i    a3, a2, EXC_TABLE_PARAM
+        l32i    a2, a2, EXC_TABLE_KSTK
 
         /* Load WB at the time the exception occurred. */
 
@@ -1206,8 +1213,12 @@ fast_syscall_spill_registers_fixup_return:
         wsr     a3, windowbase
         rsync
 
+        rsr     a3, excsave1
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
+
         rfde
 
+ENDPROC(fast_syscall_spill_registers_fixup_return)
 
 /*
  * spill all registers.
diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
index 718eca1850bd..98b67d5f1514 100644
--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -341,7 +341,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
 
         sp = regs->areg[1];
 
-        if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && ! on_sig_stack(sp)) {
+        if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && sas_ss_flags(sp) == 0) {
                 sp = current->sas_ss_sp + current->sas_ss_size;
         }
 
diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c
index 56f88b7afe2f..e9e1aad8c271 100644
--- a/arch/xtensa/platforms/iss/network.c
+++ b/arch/xtensa/platforms/iss/network.c
@@ -737,7 +737,8 @@ static int __init iss_net_setup(char *str)
                 return 1;
         }
 
-        if ((new = alloc_bootmem(sizeof new)) == NULL) {
+        new = alloc_bootmem(sizeof(*new));
+        if (new == NULL) {
                 printk("Alloc_bootmem failed\n");
                 return 1;
         }