46 files changed, 497 insertions, 169 deletions

diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index a52a27c1d9be..6f80665f477e 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -951,8 +951,6 @@ static int sa1111_resume(struct platform_device *dev)
         if (!save)
                 return 0;
 
-        spin_lock_irqsave(&sachip->lock, flags);
-
         /*
          * Ensure that the SA1111 is still here.
          * FIXME: shouldn't do this here.
@@ -969,6 +967,13 @@ static int sa1111_resume(struct platform_device *dev)
          * First of all, wake up the chip.
          */
         sa1111_wake(sachip);
+
+        /*
+         * Only lock for write ops. Also, sa1111_wake must be called with
+         * released spinlock!
+         */
+        spin_lock_irqsave(&sachip->lock, flags);
+
         sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN0);
         sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN1);
 
diff --git a/arch/arm/mach-nomadik/clock.c b/arch/arm/mach-nomadik/clock.c
index 2c471fc451d7..f035f4185274 100644
--- a/arch/arm/mach-nomadik/clock.c
+++ b/arch/arm/mach-nomadik/clock.c
@@ -32,7 +32,10 @@ void clk_disable(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_disable);
 
-/* We have a fixed clock alone, for now */
+static struct clk clk_24 = {
+        .rate = 2400000,
+};
+
 static struct clk clk_48 = {
         .rate = 48 * 1000 * 1000,
 };
@@ -50,6 +53,8 @@ static struct clk clk_default;
         }
 
 static struct clk_lookup lookups[] = {
+        CLK(&clk_24, "mtu0"),
+        CLK(&clk_24, "mtu1"),
         CLK(&clk_48, "uart0"),
         CLK(&clk_48, "uart1"),
         CLK(&clk_default, "gpio.0"),
@@ -59,10 +64,8 @@ static struct clk_lookup lookups[] = {
         CLK(&clk_default, "rng"),
 };
 
-static int __init clk_init(void)
+int __init clk_init(void)
 {
         clkdev_add_table(lookups, ARRAY_SIZE(lookups));
         return 0;
 }
-
-arch_initcall(clk_init);
diff --git a/arch/arm/mach-nomadik/clock.h b/arch/arm/mach-nomadik/clock.h
index 5563985a2cc7..78da2e7c3985 100644
--- a/arch/arm/mach-nomadik/clock.h
+++ b/arch/arm/mach-nomadik/clock.h
@@ -11,3 +11,5 @@
 struct clk {
         unsigned long           rate;
 };
+
+int __init clk_init(void);
diff --git a/arch/arm/mach-nomadik/cpu-8815.c b/arch/arm/mach-nomadik/cpu-8815.c
index 91c3c901b469..ac58e3b03b1a 100644
--- a/arch/arm/mach-nomadik/cpu-8815.c
+++ b/arch/arm/mach-nomadik/cpu-8815.c
@@ -31,6 +31,8 @@
 #include <asm/cacheflush.h>
 #include <asm/hardware/cache-l2x0.h>
 
+#include "clock.h"
+
 #define __MEM_4K_RESOURCE(x) \
         .res = {.start = (x), .end = (x) + SZ_4K - 1, .flags = IORESOURCE_MEM}
 
@@ -143,6 +145,12 @@ void __init cpu8815_init_irq(void)
         /* This modified VIC cell has two register blocks, at 0 and 0x20 */
         vic_init(io_p2v(NOMADIK_IC_BASE + 0x00), IRQ_VIC_START +  0, ~0, 0);
         vic_init(io_p2v(NOMADIK_IC_BASE + 0x20), IRQ_VIC_START + 32, ~0, 0);
+
+        /*
+         * Init clocks here so that they are available for system timer
+         * initialization.
+         */
+        clk_init();
 }
 
 /*
diff --git a/arch/arm/mach-pxa/palmtc.c b/arch/arm/mach-pxa/palmtc.c
index 033b567e50bb..ce1104d1bc17 100644
--- a/arch/arm/mach-pxa/palmtc.c
+++ b/arch/arm/mach-pxa/palmtc.c
@@ -263,11 +263,11 @@ const struct matrix_keymap_data palmtc_keymap_data = {
         .keymap_size            = ARRAY_SIZE(palmtc_matrix_keys),
 };
 
-const static unsigned int palmtc_keypad_row_gpios[] = {
+static const unsigned int palmtc_keypad_row_gpios[] = {
         0, 9, 10, 11
 };
 
-const static unsigned int palmtc_keypad_col_gpios[] = {
+static const unsigned int palmtc_keypad_col_gpios[] = {
         18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 79, 80
 };
 
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 4d2413ed0ffa..c1048a35f187 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -818,6 +818,9 @@ static struct i2c_board_info akita_i2c_board_info[] = {
                 .type           = "max7310",
                 .addr           = 0x18,
                 .platform_data  = &akita_ioexp,
+        }, {
+                .type           = "wm8750",
+                .addr           = 0x1b,
         },
 };
 
diff --git a/arch/arm/mach-ux500/Makefile b/arch/arm/mach-ux500/Makefile
index c7bc4199e3a8..4556aea9c3c5 100644
--- a/arch/arm/mach-ux500/Makefile
+++ b/arch/arm/mach-ux500/Makefile
@@ -7,4 +7,5 @@ obj-$(CONFIG_UX500_SOC_DB5500)	+= cpu-db5500.o devices-db5500.o
 obj-$(CONFIG_UX500_SOC_DB8500)  += cpu-db8500.o devices-db8500.o
 obj-$(CONFIG_MACH_U8500_MOP)    += board-mop500.o
 obj-$(CONFIG_MACH_U5500)        += board-u5500.o
-obj-$(CONFIG_SMP)               += platsmp.o headsmp.o localtimer.o
+obj-$(CONFIG_SMP)               += platsmp.o headsmp.o
+obj-$(CONFIG_LOCAL_TIMERS)      += localtimer.o
diff --git a/arch/arm/mach-ux500/clock.c b/arch/arm/mach-ux500/clock.c
index 6544855af2f1..fe84b9021c7a 100644
--- a/arch/arm/mach-ux500/clock.c
+++ b/arch/arm/mach-ux500/clock.c
@@ -16,6 +16,7 @@
 
 #include <asm/clkdev.h>
 
+#include <plat/mtu.h>
 #include <mach/hardware.h>
 #include "clock.h"
 
@@ -59,6 +60,9 @@
 #define PRCM_DMACLK_MGT         0x074
 #define PRCM_B2R2CLK_MGT        0x078
 #define PRCM_TVCLK_MGT          0x07C
+#define PRCM_TCR                0x1C8
+#define PRCM_TCR_STOPPED        (1 << 16)
+#define PRCM_TCR_DOZE_MODE      (1 << 17)
 #define PRCM_UNIPROCLK_MGT      0x278
 #define PRCM_SSPCLK_MGT         0x280
 #define PRCM_RNGCLK_MGT         0x284
@@ -120,10 +124,95 @@ void clk_disable(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_disable);
 
+/*
+ * The MTU has a separate, rather complex muxing setup
+ * with alternative parents (peripheral cluster or
+ * ULP or fixed 32768 Hz) depending on settings
+ */
+static unsigned long clk_mtu_get_rate(struct clk *clk)
+{
+        void __iomem *addr = __io_address(U8500_PRCMU_BASE)
+                + PRCM_TCR;
+        u32 tcr = readl(addr);
+        int mtu = (int) clk->data;
+        /*
+         * One of these is selected eventually
+         * TODO: Replace the constant with a reference
+         * to the ULP source once this is modeled.
+         */
+        unsigned long clk32k = 32768;
+        unsigned long mturate;
+        unsigned long retclk;
+
+        /* Get the rate from the parent as a default */
+        if (clk->parent_periph)
+                mturate = clk_get_rate(clk->parent_periph);
+        else if (clk->parent_cluster)
+                mturate = clk_get_rate(clk->parent_cluster);
+        else
+                /* We need to be connected SOMEWHERE */
+                BUG();
+
+        /*
+         * Are we in doze mode?
+         * In this mode the parent peripheral or the fixed 32768 Hz
+         * clock is fed into the block.
+         */
+        if (!(tcr & PRCM_TCR_DOZE_MODE)) {
+                /*
+                 * Here we're using the clock input from the APE ULP
+                 * clock domain. But first: are the timers stopped?
+                 */
+                if (tcr & PRCM_TCR_STOPPED) {
+                        clk32k = 0;
+                        mturate = 0;
+                } else {
+                        /* Else default mode: 0 and 2.4 MHz */
+                        clk32k = 0;
+                        if (cpu_is_u5500())
+                                /* DB5500 divides by 8 */
+                                mturate /= 8;
+                        else if (cpu_is_u8500ed()) {
+                                /*
+                                 * This clocking setting must not be used
+                                 * in the ED chip, it is simply not
+                                 * connected anywhere!
+                                 */
+                                mturate = 0;
+                                BUG();
+                        } else
+                                /*
+                                 * In this mode the ulp38m4 clock is divided
+                                 * by a factor 16, on the DB8500 typically
+                                 * 38400000 / 16 ~ 2.4 MHz.
+                                 * TODO: Replace the constant with a reference
+                                 * to the ULP source once this is modeled.
+                                 */
+                                mturate = 38400000 / 16;
+                }
+        }
+
+        /* Return the clock selected for this MTU */
+        if (tcr & (1 << mtu))
+                retclk = clk32k;
+        else
+                retclk = mturate;
+
+        pr_info("MTU%d clock rate: %lu Hz\n", mtu, retclk);
+        return retclk;
+}
+
 unsigned long clk_get_rate(struct clk *clk)
 {
         unsigned long rate;
 
+        /*
+         * If there is a custom getrate callback for this clock,
+         * it will take precedence.
+         */
+        if (clk->get_rate)
+                return clk->get_rate(clk);
+
         if (clk->ops && clk->ops->get_rate)
                 return clk->ops->get_rate(clk);
 
@@ -341,8 +430,9 @@ static DEFINE_PRCC_CLK(5, usb_v1, 	0,  0, NULL);
 
 /* Peripheral Cluster #6 */
 
-static DEFINE_PRCC_CLK(6, mtu1_v1,      8, -1, NULL);
-static DEFINE_PRCC_CLK(6, mtu0_v1,      7, -1, NULL);
+/* MTU ID in data */
+static DEFINE_PRCC_CLK_CUSTOM(6, mtu1_v1, 8, -1, NULL, clk_mtu_get_rate, 1);
+static DEFINE_PRCC_CLK_CUSTOM(6, mtu0_v1, 7, -1, NULL, clk_mtu_get_rate, 0);
 static DEFINE_PRCC_CLK(6, cfgreg_v1,    6,  6, NULL);
 static DEFINE_PRCC_CLK(6, dmc_ed,       6,  6, NULL);
 static DEFINE_PRCC_CLK(6, hash1,        5, -1, NULL);
@@ -357,8 +447,9 @@ static DEFINE_PRCC_CLK(6, rng_v1, 	0,  0, &clk_rngclk);
 /* Peripheral Cluster #7 */
 
 static DEFINE_PRCC_CLK(7, tzpc0_ed,     4, -1, NULL);
-static DEFINE_PRCC_CLK(7, mtu1_ed,      3, -1, NULL);
-static DEFINE_PRCC_CLK(7, mtu0_ed,      2, -1, NULL);
+/* MTU ID in data */
+static DEFINE_PRCC_CLK_CUSTOM(7, mtu1_ed, 3, -1, NULL, clk_mtu_get_rate, 1);
+static DEFINE_PRCC_CLK_CUSTOM(7, mtu0_ed, 2, -1, NULL, clk_mtu_get_rate, 0);
 static DEFINE_PRCC_CLK(7, wdg_ed,       1, -1, NULL);
 static DEFINE_PRCC_CLK(7, cfgreg_ed,    0, -1, NULL);
 
@@ -503,15 +594,17 @@ static struct clk_lookup u8500_v1_clks[] = {
         CLK(uiccclk,    "uicc",         NULL),
 };
 
-static int __init clk_init(void)
+int __init clk_init(void)
 {
         if (cpu_is_u8500ed()) {
                 clk_prcmu_ops.enable = clk_prcmu_ed_enable;
                 clk_prcmu_ops.disable = clk_prcmu_ed_disable;
+                clk_per6clk.rate = 100000000;
         } else if (cpu_is_u5500()) {
                 /* Clock tree for U5500 not implemented yet */
                 clk_prcc_ops.enable = clk_prcc_ops.disable = NULL;
                 clk_prcmu_ops.enable = clk_prcmu_ops.disable = NULL;
+                clk_per6clk.rate = 26000000;
         }
 
         clkdev_add_table(u8500_common_clks, ARRAY_SIZE(u8500_common_clks));
@@ -522,4 +615,3 @@ static int __init clk_init(void)
 
         return 0;
 }
-arch_initcall(clk_init);
diff --git a/arch/arm/mach-ux500/clock.h b/arch/arm/mach-ux500/clock.h
index e4f99b65026f..a05802501527 100644
--- a/arch/arm/mach-ux500/clock.h
+++ b/arch/arm/mach-ux500/clock.h
@@ -28,6 +28,9 @@ struct clkops {
  * @ops:                pointer to clkops struct used to control this clock
  * @name:               name, for debugging
  * @enabled:            refcount. positive if enabled, zero if disabled
+ * @get_rate:           custom callback for getting the clock rate
+ * @data:               custom per-clock data for example for the get_rate
+ *                      callback
  * @rate:               fixed rate for clocks which don't implement
  *                      ops->getrate
  * @prcmu_cg_off:       address offset of the combined enable/disable register
@@ -67,6 +70,8 @@ struct clk {
         const struct clkops     *ops;
         const char              *name;
         unsigned int            enabled;
+        unsigned long           (*get_rate)(struct clk *);
+        void                    *data;
 
         unsigned long           rate;
         struct list_head        list;
@@ -117,9 +122,26 @@ struct clk clk_##_name = {						\
                 .parent_periph  = _kernclk                              \
         }
 
+#define DEFINE_PRCC_CLK_CUSTOM(_pclust, _name, _bus_en, _kernel_en, _kernclk, _callback, _data) \
+struct clk clk_##_name = {                                              \
+                .name           = #_name,                               \
+                .ops            = &clk_prcc_ops,                        \
+                .cluster        = _pclust,                              \
+                .prcc_bus       = _bus_en,                              \
+                .prcc_kernel    = _kernel_en,                           \
+                .parent_cluster = &clk_per##_pclust##clk,               \
+                .parent_periph  = _kernclk,                             \
+                .get_rate       = _callback,                            \
+                .data           = (void *) _data                        \
+        }
+
+
 #define CLK(_clk, _devname, _conname)                   \
         {                                               \
                 .clk    = &clk_##_clk,                  \
                 .dev_id = _devname,                     \
                 .con_id = _conname,                     \
         }
+
+int __init clk_db8500_ed_fixup(void);
+int __init clk_init(void);
diff --git a/arch/arm/mach-ux500/cpu.c b/arch/arm/mach-ux500/cpu.c
index d81ad023963c..e0fd747e447a 100644
--- a/arch/arm/mach-ux500/cpu.c
+++ b/arch/arm/mach-ux500/cpu.c
@@ -62,6 +62,12 @@ void __init ux500_init_irq(void)
 {
         gic_dist_init(0, __io_address(UX500_GIC_DIST_BASE), 29);
         gic_cpu_init(0, __io_address(UX500_GIC_CPU_BASE));
+
+        /*
+         * Init clocks here so that they are available for system timer
+         * initialization.
+         */
+        clk_init();
 }
 
 #ifdef CONFIG_CACHE_L2X0
diff --git a/arch/arm/mm/copypage-feroceon.c b/arch/arm/mm/copypage-feroceon.c
index 5eb4fd93893d..ac163de7dc01 100644
--- a/arch/arm/mm/copypage-feroceon.c
+++ b/arch/arm/mm/copypage-feroceon.c
@@ -18,7 +18,7 @@ feroceon_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4-r9, lr}                \n\
-        mov     ip, %0                          \n\
+        mov     ip, %2                          \n\
 1:      mov     lr, r1                          \n\
         ldmia   r1!, {r2 - r9}                  \n\
         pld     [lr, #32]                       \n\
@@ -64,7 +64,7 @@ feroceon_copy_user_page(void *kto, const void *kfrom)
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB\n\
         ldmfd   sp!, {r4-r9, pc}"
         :
-        : "I" (PAGE_SIZE));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE));
 }
 
 void feroceon_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/copypage-v4wb.c b/arch/arm/mm/copypage-v4wb.c
index 7c2eb55cd4a9..cb589cbb2b6c 100644
--- a/arch/arm/mm/copypage-v4wb.c
+++ b/arch/arm/mm/copypage-v4wb.c
@@ -27,7 +27,7 @@ v4wb_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4, lr}                   @ 2\n\
-        mov     r2, %0                          @ 1\n\
+        mov     r2, %2                          @ 1\n\
         ldmia   r1!, {r3, r4, ip, lr}           @ 4\n\
 1:      mcr     p15, 0, r0, c7, c6, 1           @ 1   invalidate D line\n\
         stmia   r0!, {r3, r4, ip, lr}           @ 4\n\
@@ -44,7 +44,7 @@ v4wb_copy_user_page(void *kto, const void *kfrom)
         mcr     p15, 0, r1, c7, c10, 4          @ 1   drain WB\n\
         ldmfd    sp!, {r4, pc}                  @ 3"
         :
-        : "I" (PAGE_SIZE / 64));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
 }
 
 void v4wb_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/copypage-v4wt.c b/arch/arm/mm/copypage-v4wt.c
index 172e6a55458e..30c7d048a324 100644
--- a/arch/arm/mm/copypage-v4wt.c
+++ b/arch/arm/mm/copypage-v4wt.c
@@ -25,7 +25,7 @@ v4wt_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4, lr}                   @ 2\n\
-        mov     r2, %0                          @ 1\n\
+        mov     r2, %2                          @ 1\n\
         ldmia   r1!, {r3, r4, ip, lr}           @ 4\n\
 1:      stmia   r0!, {r3, r4, ip, lr}           @ 4\n\
         ldmia   r1!, {r3, r4, ip, lr}           @ 4+1\n\
@@ -40,7 +40,7 @@ v4wt_copy_user_page(void *kto, const void *kfrom)
         mcr     p15, 0, r2, c7, c7, 0           @ flush ID cache\n\
         ldmfd   sp!, {r4, pc}                   @ 3"
         :
-        : "I" (PAGE_SIZE / 64));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
 }
 
 void v4wt_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/copypage-xsc3.c b/arch/arm/mm/copypage-xsc3.c
index 747ad4140fc7..f9cde0702f1e 100644
--- a/arch/arm/mm/copypage-xsc3.c
+++ b/arch/arm/mm/copypage-xsc3.c
@@ -34,7 +34,7 @@ xsc3_mc_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4, r5, lr}               \n\
-        mov     lr, %0                          \n\
+        mov     lr, %2                          \n\
                                                 \n\
         pld     [r1, #0]                        \n\
         pld     [r1, #32]                       \n\
@@ -67,7 +67,7 @@ xsc3_mc_copy_user_page(void *kto, const void *kfrom)
                                                 \n\
         ldmfd   sp!, {r4, r5, pc}"
         :
-        : "I" (PAGE_SIZE / 64 - 1));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1));
 }
 
 void xsc3_mc_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 92f5801f99c1..cbfb2edcf7d1 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -393,6 +393,9 @@ do_translation_fault(unsigned long addr, unsigned int fsr,
         if (addr < TASK_SIZE)
                 return do_page_fault(addr, fsr, regs);
 
+        if (user_mode(regs))
+                goto bad_area;
+
         index = pgd_index(addr);
 
         /*
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index 77b030f5ec09..086816b205b8 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -48,7 +48,16 @@ void *kmap_atomic(struct page *page, enum km_type type)
 
         debug_kmap_atomic(type);
 
-        kmap = kmap_high_get(page);
+#ifdef CONFIG_DEBUG_HIGHMEM
+        /*
+         * There is no cache coherency issue when non VIVT, so force the
+         * dedicated kmap usage for better debugging purposes in that case.
+         */
+        if (!cache_is_vivt())
+                kmap = NULL;
+        else
+#endif
+                kmap = kmap_high_get(page);
         if (kmap)
                 return kmap;
 
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 1ba6cf5a2c02..f6a999465323 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -678,10 +678,10 @@ void __init mem_init(void)
 void free_initmem(void)
 {
 #ifdef CONFIG_HAVE_TCM
-        extern char *__tcm_start, *__tcm_end;
+        extern char __tcm_start, __tcm_end;
 
-        totalram_pages += free_area(__phys_to_pfn(__pa(__tcm_start)),
-                                    __phys_to_pfn(__pa(__tcm_end)),
+        totalram_pages += free_area(__phys_to_pfn(__pa(&__tcm_start)),
+                                    __phys_to_pfn(__pa(&__tcm_end)),
                                     "TCM link");
 #endif
 
diff --git a/arch/arm/plat-nomadik/timer.c b/arch/arm/plat-nomadik/timer.c
index 0ff3798769ab..08aaa4a7f65f 100644
--- a/arch/arm/plat-nomadik/timer.c
+++ b/arch/arm/plat-nomadik/timer.c
@@ -13,7 +13,9 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/clockchips.h>
+#include <linux/clk.h>
 #include <linux/jiffies.h>
+#include <linux/err.h>
 #include <asm/mach/time.h>
 
 #include <plat/mtu.h>
@@ -124,13 +126,25 @@ static struct irqaction nmdk_timer_irq = {
 void __init nmdk_timer_init(void)
 {
         unsigned long rate;
-        u32 cr = MTU_CRn_32BITS;;
+        struct clk *clk0;
+        struct clk *clk1;
+        u32 cr;
+
+        clk0 = clk_get_sys("mtu0", NULL);
+        BUG_ON(IS_ERR(clk0));
+
+        clk1 = clk_get_sys("mtu1", NULL);
+        BUG_ON(IS_ERR(clk1));
+
+        clk_enable(clk0);
+        clk_enable(clk1);
 
         /*
          * Tick rate is 2.4MHz for Nomadik and 110MHz for ux500:
          * use a divide-by-16 counter if it's more than 16MHz
          */
-        rate = CLOCK_TICK_RATE;
+        cr = MTU_CRn_32BITS;;
+        rate = clk_get_rate(clk0);
         if (rate > 16 << 20) {
                 rate /= 16;
                 cr |= MTU_CRn_PRESCALE_16;
@@ -153,6 +167,14 @@ void __init nmdk_timer_init(void)
                        nmdk_clksrc.name);
 
         /* Timer 1 is used for events, fix according to rate */
+        cr = MTU_CRn_32BITS;
+        rate = clk_get_rate(clk1);
+        if (rate > 16 << 20) {
+                rate /= 16;
+                cr |= MTU_CRn_PRESCALE_16;
+        } else {
+                cr |= MTU_CRn_PRESCALE_1;
+        }
         writel(cr | MTU_CRn_ONESHOT, mtu_base + MTU_CR(1)); /* off, currently */
         nmdk_clkevt.mult = div_sc(rate, NSEC_PER_SEC, nmdk_clkevt.shift);
         nmdk_clkevt.max_delta_ns =
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index 66dc2d03b7fc..d66cead97d28 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -277,7 +277,7 @@ ENTRY(vfp_put_double)
 #ifdef CONFIG_VFPv3
         @ d16 - d31 registers
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
-1:      mcrr    p11, 3, r1, r2, c\dr    @ fmdrr r1, r2, d\dr
+1:      mcrr    p11, 3, r0, r1, c\dr    @ fmdrr r0, r1, d\dr
         mov     pc, lr
         .org    1b + 8
         .endr
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index d5f4e9161201..21b701374f72 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -144,6 +144,7 @@ int kvm_arch_hardware_enable(void *garbage)
                                 VP_INIT_ENV : VP_INIT_ENV_INITALIZE,
                         __pa(kvm_vm_buffer), KVM_VM_BUFFER_BASE, &tmp_base);
         if (status != 0) {
+                spin_unlock(&vp_lock);
                 printk(KERN_WARNING"kvm: Failed to Enable VT Support!!!!\n");
                 return -EINVAL;
         }
diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c
index bc2b4004eb26..e8a00b0c4449 100644
--- a/arch/powerpc/kvm/e500.c
+++ b/arch/powerpc/kvm/e500.c
@@ -164,7 +164,7 @@ static int __init kvmppc_e500_init(void)
         return kvm_init(NULL, sizeof(struct kvmppc_vcpu_e500), 0, THIS_MODULE);
 }
 
-static void __init kvmppc_e500_exit(void)
+static void __exit kvmppc_e500_exit(void)
 {
         kvmppc_booke_exit();
 }
diff --git a/arch/powerpc/oprofile/op_model_cell.c b/arch/powerpc/oprofile/op_model_cell.c
index 2c9e52267292..7fd90d02d8c6 100644
--- a/arch/powerpc/oprofile/op_model_cell.c
+++ b/arch/powerpc/oprofile/op_model_cell.c
@@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n)
                 index = ENTRIES-1;
 
         /* make sure index is valid */
-        if ((index > ENTRIES) || (index < 0))
+        if ((index >= ENTRIES) || (index < 0))
                 index = ENTRIES-1;
 
         return initial_lfsr[index];
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index b49d8ca228f6..8c7ae4318629 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -110,6 +110,7 @@
 #define MSR_AMD64_PATCH_LOADER          0xc0010020
 #define MSR_AMD64_OSVW_ID_LENGTH        0xc0010140
 #define MSR_AMD64_OSVW_STATUS           0xc0010141
+#define MSR_AMD64_DC_CFG                0xc0011022
 #define MSR_AMD64_IBSFETCHCTL           0xc0011030
 #define MSR_AMD64_IBSFETCHLINAD         0xc0011031
 #define MSR_AMD64_IBSFETCHPHYSAD        0xc0011032
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 81563e76e28f..a6f695d76928 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1815,6 +1815,9 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
 
                 spte |= PT_WRITABLE_MASK;
 
+                if (!tdp_enabled && !(pte_access & ACC_WRITE_MASK))
+                        spte &= ~PT_USER_MASK;
+
                 /*
                  * Optimization: for pte sync, if spte was writable the hash
                  * lookup is unnecessary (and expensive). Write protection
@@ -1870,6 +1873,8 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
 
                         child = page_header(pte & PT64_BASE_ADDR_MASK);
                         mmu_page_remove_parent_pte(child, sptep);
+                        __set_spte(sptep, shadow_trap_nonpresent_pte);
+                        kvm_flush_remote_tlbs(vcpu->kvm);
                 } else if (pfn != spte_to_pfn(*sptep)) {
                         pgprintk("hfn old %lx new %lx\n",
                                  spte_to_pfn(*sptep), pfn);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 96dc232bfc56..ce438e0fdd26 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -28,6 +28,7 @@
 #include <linux/ftrace_event.h>
 #include <linux/slab.h>
 
+#include <asm/tlbflush.h>
 #include <asm/desc.h>
 
 #include <asm/virtext.h>
@@ -56,6 +57,8 @@ MODULE_LICENSE("GPL");
 
 #define DEBUGCTL_RESERVED_BITS (~(0x3fULL))
 
+static bool erratum_383_found __read_mostly;
+
 static const u32 host_save_user_msrs[] = {
 #ifdef CONFIG_X86_64
         MSR_STAR, MSR_LSTAR, MSR_CSTAR, MSR_SYSCALL_MASK, MSR_KERNEL_GS_BASE,
@@ -374,6 +377,31 @@ static void svm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
         svm->vmcb->control.event_inj_err = error_code;
 }
 
+static void svm_init_erratum_383(void)
+{
+        u32 low, high;
+        int err;
+        u64 val;
+
+        /* Only Fam10h is affected */
+        if (boot_cpu_data.x86 != 0x10)
+                return;
+
+        /* Use _safe variants to not break nested virtualization */
+        val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
+        if (err)
+                return;
+
+        val |= (1ULL << 47);
+
+        low  = lower_32_bits(val);
+        high = upper_32_bits(val);
+
+        native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);
+
+        erratum_383_found = true;
+}
+
 static int has_svm(void)
 {
         const char *msg;
@@ -429,6 +457,8 @@ static int svm_hardware_enable(void *garbage)
 
         wrmsrl(MSR_VM_HSAVE_PA, page_to_pfn(sd->save_area) << PAGE_SHIFT);
 
+        svm_init_erratum_383();
+
         return 0;
 }
 
@@ -1410,8 +1440,59 @@ static int nm_interception(struct vcpu_svm *svm)
         return 1;
 }
 
-static int mc_interception(struct vcpu_svm *svm)
+static bool is_erratum_383(void)
 {
+        int err, i;
+        u64 value;
+
+        if (!erratum_383_found)
+                return false;
+
+        value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
+        if (err)
+                return false;
+
+        /* Bit 62 may or may not be set for this mce */
+        value &= ~(1ULL << 62);
+
+        if (value != 0xb600000000010015ULL)
+                return false;
+
+        /* Clear MCi_STATUS registers */
+        for (i = 0; i < 6; ++i)
+                native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);
+
+        value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
+        if (!err) {
+                u32 low, high;
+
+                value &= ~(1ULL << 2);
+                low    = lower_32_bits(value);
+                high   = upper_32_bits(value);
+
+                native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
+        }
+
+        /* Flush tlb to evict multi-match entries */
+        __flush_tlb_all();
+
+        return true;
+}
+
+static void svm_handle_mce(struct vcpu_svm *svm)
+{
+        if (is_erratum_383()) {
+                /*
+                 * Erratum 383 triggered. Guest state is corrupt so kill the
+                 * guest.
+                 */
+                pr_err("KVM: Guest triggered AMD Erratum 383\n");
+
+                set_bit(KVM_REQ_TRIPLE_FAULT, &svm->vcpu.requests);
+
+                return;
+        }
+
         /*
          * On an #MC intercept the MCE handler is not called automatically in
          * the host. So do it by hand here.
@@ -1420,6 +1501,11 @@ static int mc_interception(struct vcpu_svm *svm)
                 "int $0x12\n");
         /* not sure if we ever come back to this point */
 
+        return;
+}
+
+static int mc_interception(struct vcpu_svm *svm)
+{
         return 1;
 }
 
@@ -3088,6 +3174,14 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
                 vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
                 vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
         }
+
+        /*
+         * We need to handle MC intercepts here before the vcpu has a chance to
+         * change the physical cpu
+         */
+        if (unlikely(svm->vmcb->control.exit_code ==
+                     SVM_EXIT_EXCP_BASE + MC_VECTOR))
+                svm_handle_mce(svm);
 }
 
 #undef R
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 70b58fe9e5b1..be7726d7686d 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -622,6 +622,11 @@ static int sil24_exec_polled_cmd(struct ata_port *ap, int pmp,
         irq_enabled = readl(port + PORT_IRQ_ENABLE_SET);
         writel(PORT_IRQ_COMPLETE | PORT_IRQ_ERROR, port + PORT_IRQ_ENABLE_CLR);
 
+        /*
+         * The barrier is required to ensure that writes to cmd_block reach
+         * the memory before the write to PORT_CMD_ACTIVATE.
+         */
+        wmb();
         writel((u32)paddr, port + PORT_CMD_ACTIVATE);
         writel((u64)paddr >> 32, port + PORT_CMD_ACTIVATE + 4);
 
@@ -865,7 +870,7 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
         } else {
                 prb = &cb->atapi.prb;
                 sge = cb->atapi.sge;
-                memset(cb->atapi.cdb, 0, 32);
+                memset(cb->atapi.cdb, 0, sizeof(cb->atapi.cdb));
                 memcpy(cb->atapi.cdb, qc->cdb, qc->dev->cdb_len);
 
                 if (ata_is_data(qc->tf.protocol)) {
@@ -895,6 +900,11 @@ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc)
         paddr = pp->cmd_block_dma + tag * sizeof(*pp->cmd_block);
         activate = port + PORT_CMD_ACTIVATE + tag * 8;
 
+        /*
+         * The barrier is required to ensure that writes to cmd_block reach
+         * the memory before the write to PORT_CMD_ACTIVATE.
+         */
+        wmb();
         writel((u32)paddr, activate);
         writel((u64)paddr >> 32, activate + 4);
 
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 7b6fe89f9db0..64e6a84bbbbe 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -322,6 +322,7 @@ static int smc91c92_probe(struct pcmcia_device *link)
         return -ENOMEM;
     smc = netdev_priv(dev);
     smc->p_dev = link;
+    link->priv = dev;
 
     spin_lock_init(&smc->lock);
     link->io.NumPorts1 = 16;
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 7ef7adee5e4f..9fc339845538 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -671,6 +671,7 @@ static void pcmcia_requery(struct pcmcia_socket *s)
                 if (old_funcs != new_funcs) {
                         /* we need to re-start */
                         pcmcia_card_remove(s, NULL);
+                        s->functions = 0;
                         pcmcia_card_add(s);
                 }
         }
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 424e576f3acb..f1d41374eea7 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -880,6 +880,12 @@ static struct cardbus_type cardbus_type[] = {
                 .restore_state  = ti_restore_state,
                 .sock_init      = ti_init,
         },
+        [CARDBUS_TYPE_ENE]      = {
+                .override       = ene_override,
+                .save_state     = ti_save_state,
+                .restore_state  = ti_restore_state,
+                .sock_init      = ti_init,
+        },
 #endif
 #ifdef CONFIG_YENTA_RICOH
         [CARDBUS_TYPE_RICOH]    = {
@@ -902,14 +908,6 @@ static struct cardbus_type cardbus_type[] = {
                 .restore_state  = o2micro_restore_state,
         },
 #endif
-#ifdef CONFIG_YENTA_TI
-        [CARDBUS_TYPE_ENE]      = {
-                .override       = ene_override,
-                .save_state     = ti_save_state,
-                .restore_state  = ti_restore_state,
-                .sock_init      = ti_init,
-        },
-#endif
 };
 
 
@@ -975,7 +973,7 @@ static irqreturn_t yenta_probe_handler(int irq, void *dev_id)
 /* probes the PCI interrupt, use only on override functions */
 static int yenta_probe_cb_irq(struct yenta_socket *socket)
 {
-        u8 reg;
+        u8 reg = 0;
 
         if (!socket->cb_irq)
                 return -1;
@@ -989,7 +987,8 @@ static int yenta_probe_cb_irq(struct yenta_socket *socket)
         }
 
         /* generate interrupt, wait */
-        reg = exca_readb(socket, I365_CSCINT);
+        if (!socket->dev->irq)
+                reg = exca_readb(socket, I365_CSCINT);
         exca_writeb(socket, I365_CSCINT, reg | I365_CSC_STSCHG);
         cb_writel(socket, CB_SOCKET_EVENT, -1);
         cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 7346c96308a5..99d6af811747 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -706,8 +706,13 @@ retry:
  * @bdev is about to be opened exclusively.  Check @bdev can be opened
  * exclusively and mark that an exclusive open is in progress.  Each
  * successful call to this function must be matched with a call to
- * either bd_claim() or bd_abort_claiming().  If this function
- * succeeds, the matching bd_claim() is guaranteed to succeed.
+ * either bd_finish_claiming() or bd_abort_claiming() (which do not
+ * fail).
+ *
+ * This function is used to gain exclusive access to the block device
+ * without actually causing other exclusive open attempts to fail. It
+ * should be used when the open sequence itself requires exclusive
+ * access but may subsequently fail.
  *
  * CONTEXT:
  * Might sleep.
@@ -734,6 +739,7 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
                 return ERR_PTR(-ENXIO);
 
         whole = bdget_disk(disk, 0);
+        module_put(disk->fops->owner);
         put_disk(disk);
         if (!whole)
                 return ERR_PTR(-ENOMEM);
@@ -782,15 +788,46 @@ static void bd_abort_claiming(struct block_device *whole, void *holder)
         __bd_abort_claiming(whole, holder);             /* releases bdev_lock */
 }
 
+/* increment holders when we have a legitimate claim. requires bdev_lock */
+static void __bd_claim(struct block_device *bdev, struct block_device *whole,
+                                        void *holder)
+{
+        /* note that for a whole device bd_holders
+         * will be incremented twice, and bd_holder will
+         * be set to bd_claim before being set to holder
+         */
+        whole->bd_holders++;
+        whole->bd_holder = bd_claim;
+        bdev->bd_holders++;
+        bdev->bd_holder = holder;
+}
+
+/**
+ * bd_finish_claiming - finish claiming a block device
+ * @bdev: block device of interest (passed to bd_start_claiming())
+ * @whole: whole block device returned by bd_start_claiming()
+ * @holder: holder trying to claim @bdev
+ *
+ * Finish a claiming block started by bd_start_claiming().
+ *
+ * CONTEXT:
+ * Grabs and releases bdev_lock.
+ */
+static void bd_finish_claiming(struct block_device *bdev,
+                                struct block_device *whole, void *holder)
+{
+        spin_lock(&bdev_lock);
+        BUG_ON(!bd_may_claim(bdev, whole, holder));
+        __bd_claim(bdev, whole, holder);
+        __bd_abort_claiming(whole, holder); /* not actually an abort */
+}
+
 /**
  * bd_claim - claim a block device
  * @bdev: block device to claim
  * @holder: holder trying to claim @bdev
  *
- * Try to claim @bdev which must have been opened successfully.  This
- * function may be called with or without preceding
- * blk_start_claiming().  In the former case, this function is always
- * successful and terminates the claiming block.
+ * Try to claim @bdev which must have been opened successfully.
  *
  * CONTEXT:
  * Might sleep.
@@ -806,23 +843,10 @@ int bd_claim(struct block_device *bdev, void *holder)
         might_sleep();
 
         spin_lock(&bdev_lock);
-
         res = bd_prepare_to_claim(bdev, whole, holder);
-        if (res == 0) {
-                /* note that for a whole device bd_holders
-                 * will be incremented twice, and bd_holder will
-                 * be set to bd_claim before being set to holder
-                 */
-                whole->bd_holders++;
-                whole->bd_holder = bd_claim;
-                bdev->bd_holders++;
-                bdev->bd_holder = holder;
-        }
-
-        if (whole->bd_claiming)
-                __bd_abort_claiming(whole, holder);     /* releases bdev_lock */
-        else
-                spin_unlock(&bdev_lock);
+        if (res == 0)
+                __bd_claim(bdev, whole, holder);
+        spin_unlock(&bdev_lock);
 
         return res;
 }
@@ -1476,7 +1500,7 @@ static int blkdev_open(struct inode * inode, struct file * filp)
 
         if (whole) {
                 if (res == 0)
-                        BUG_ON(bd_claim(bdev, filp) != 0);
+                        bd_finish_claiming(bdev, whole, filp);
                 else
                         bd_abort_claiming(whole, filp);
         }
@@ -1712,7 +1736,7 @@ struct block_device *open_bdev_exclusive(const char *path, fmode_t mode, void *h
         if ((mode & FMODE_WRITE) && bdev_read_only(bdev))
                 goto out_blkdev_put;
 
-        BUG_ON(bd_claim(bdev, holder) != 0);
+        bd_finish_claiming(bdev, whole, holder);
         return bdev;
 
 out_blkdev_put:
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index ae3e3a306445..619b61655ee5 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -981,6 +981,46 @@ static int send_cap_msg(struct ceph_mds_session *session,
         return 0;
 }
 
+static void __queue_cap_release(struct ceph_mds_session *session,
+                                u64 ino, u64 cap_id, u32 migrate_seq,
+                                u32 issue_seq)
+{
+        struct ceph_msg *msg;
+        struct ceph_mds_cap_release *head;
+        struct ceph_mds_cap_item *item;
+
+        spin_lock(&session->s_cap_lock);
+        BUG_ON(!session->s_num_cap_releases);
+        msg = list_first_entry(&session->s_cap_releases,
+                               struct ceph_msg, list_head);
+
+        dout(" adding %llx release to mds%d msg %p (%d left)\n",
+             ino, session->s_mds, msg, session->s_num_cap_releases);
+
+        BUG_ON(msg->front.iov_len + sizeof(*item) > PAGE_CACHE_SIZE);
+        head = msg->front.iov_base;
+        head->num = cpu_to_le32(le32_to_cpu(head->num) + 1);
+        item = msg->front.iov_base + msg->front.iov_len;
+        item->ino = cpu_to_le64(ino);
+        item->cap_id = cpu_to_le64(cap_id);
+        item->migrate_seq = cpu_to_le32(migrate_seq);
+        item->seq = cpu_to_le32(issue_seq);
+
+        session->s_num_cap_releases--;
+
+        msg->front.iov_len += sizeof(*item);
+        if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
+                dout(" release msg %p full\n", msg);
+                list_move_tail(&msg->list_head, &session->s_cap_releases_done);
+        } else {
+                dout(" release msg %p at %d/%d (%d)\n", msg,
+                     (int)le32_to_cpu(head->num),
+                     (int)CEPH_CAPS_PER_RELEASE,
+                     (int)msg->front.iov_len);
+        }
+        spin_unlock(&session->s_cap_lock);
+}
+
 /*
  * Queue cap releases when an inode is dropped from our cache.  Since
  * inode is about to be destroyed, there is no need for i_lock.
@@ -994,41 +1034,9 @@ void ceph_queue_caps_release(struct inode *inode)
         while (p) {
                 struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
                 struct ceph_mds_session *session = cap->session;
-                struct ceph_msg *msg;
-                struct ceph_mds_cap_release *head;
-                struct ceph_mds_cap_item *item;
 
-                spin_lock(&session->s_cap_lock);
-                BUG_ON(!session->s_num_cap_releases);
-                msg = list_first_entry(&session->s_cap_releases,
-                                       struct ceph_msg, list_head);
-
-                dout(" adding %p release to mds%d msg %p (%d left)\n",
-                     inode, session->s_mds, msg, session->s_num_cap_releases);
-
-                BUG_ON(msg->front.iov_len + sizeof(*item) > PAGE_CACHE_SIZE);
-                head = msg->front.iov_base;
-                head->num = cpu_to_le32(le32_to_cpu(head->num) + 1);
-                item = msg->front.iov_base + msg->front.iov_len;
-                item->ino = cpu_to_le64(ceph_ino(inode));
-                item->cap_id = cpu_to_le64(cap->cap_id);
-                item->migrate_seq = cpu_to_le32(cap->mseq);
-                item->seq = cpu_to_le32(cap->issue_seq);
-
-                session->s_num_cap_releases--;
-
-                msg->front.iov_len += sizeof(*item);
-                if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
-                        dout(" release msg %p full\n", msg);
-                        list_move_tail(&msg->list_head,
-                                       &session->s_cap_releases_done);
-                } else {
-                        dout(" release msg %p at %d/%d (%d)\n", msg,
-                             (int)le32_to_cpu(head->num),
-                             (int)CEPH_CAPS_PER_RELEASE,
-                             (int)msg->front.iov_len);
-                }
-                spin_unlock(&session->s_cap_lock);
+                __queue_cap_release(session, ceph_ino(inode), cap->cap_id,
+                                    cap->mseq, cap->issue_seq);
                 p = rb_next(p);
                 __ceph_remove_cap(cap);
         }
@@ -2655,7 +2663,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         struct ceph_mds_caps *h;
         int mds = session->s_mds;
         int op;
-        u32 seq;
+        u32 seq, mseq;
         struct ceph_vino vino;
         u64 cap_id;
         u64 size, max_size;
@@ -2675,6 +2683,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         vino.snap = CEPH_NOSNAP;
         cap_id = le64_to_cpu(h->cap_id);
         seq = le32_to_cpu(h->seq);
+        mseq = le32_to_cpu(h->migrate_seq);
         size = le64_to_cpu(h->size);
         max_size = le64_to_cpu(h->max_size);
 
@@ -2689,6 +2698,18 @@ void ceph_handle_caps(struct ceph_mds_session *session,
              vino.snap, inode);
         if (!inode) {
                 dout(" i don't have ino %llx\n", vino.ino);
+
+                if (op == CEPH_CAP_OP_IMPORT)
+                        __queue_cap_release(session, vino.ino, cap_id,
+                                            mseq, seq);
+
+                /*
+                 * send any full release message to try to move things
+                 * along for the mds (who clearly thinks we still have this
+                 * cap).
+                 */
+                ceph_add_cap_releases(mdsc, session, -1);
+                ceph_send_cap_releases(mdsc, session);
                 goto done;
         }
 
@@ -2714,7 +2735,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         spin_lock(&inode->i_lock);
         cap = __get_cap_for_mds(ceph_inode(inode), mds);
         if (!cap) {
-                dout("no cap on %p ino %llx.%llx from mds%d, releasing\n",
+                dout(" no cap on %p ino %llx.%llx from mds%d\n",
                      inode, ceph_ino(inode), ceph_snap(inode), mds);
                 spin_unlock(&inode->i_lock);
                 goto done;
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 226f5a50d362..ab47f46ca282 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -827,7 +827,7 @@ static void ceph_set_dentry_offset(struct dentry *dn)
 
         spin_lock(&dcache_lock);
         spin_lock(&dn->d_lock);
-        list_move_tail(&dir->d_subdirs, &dn->d_u.d_child);
+        list_move(&dn->d_u.d_child, &dir->d_subdirs);
         dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
              dn->d_u.d_child.prev, dn->d_u.d_child.next);
         spin_unlock(&dn->d_lock);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index b49f12822cbc..1766947fc07a 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1066,9 +1066,9 @@ static int trim_caps(struct ceph_mds_client *mdsc,
  *
  * Called under s_mutex.
  */
-static int add_cap_releases(struct ceph_mds_client *mdsc,
-                            struct ceph_mds_session *session,
-                            int extra)
+int ceph_add_cap_releases(struct ceph_mds_client *mdsc,
+                          struct ceph_mds_session *session,
+                          int extra)
 {
         struct ceph_msg *msg;
         struct ceph_mds_cap_release *head;
@@ -1176,8 +1176,8 @@ static int check_cap_flush(struct ceph_mds_client *mdsc, u64 want_flush_seq)
 /*
  * called under s_mutex
  */
-static void send_cap_releases(struct ceph_mds_client *mdsc,
-                       struct ceph_mds_session *session)
+void ceph_send_cap_releases(struct ceph_mds_client *mdsc,
+                            struct ceph_mds_session *session)
 {
         struct ceph_msg *msg;
 
@@ -1980,7 +1980,7 @@ out_err:
         }
         mutex_unlock(&mdsc->mutex);
 
-        add_cap_releases(mdsc, req->r_session, -1);
+        ceph_add_cap_releases(mdsc, req->r_session, -1);
         mutex_unlock(&session->s_mutex);
 
         /* kick calling process */
@@ -2433,6 +2433,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         struct ceph_dentry_info *di;
         int mds = session->s_mds;
         struct ceph_mds_lease *h = msg->front.iov_base;
+        u32 seq;
         struct ceph_vino vino;
         int mask;
         struct qstr dname;
@@ -2446,6 +2447,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         vino.ino = le64_to_cpu(h->ino);
         vino.snap = CEPH_NOSNAP;
         mask = le16_to_cpu(h->mask);
+        seq = le32_to_cpu(h->seq);
         dname.name = (void *)h + sizeof(*h) + sizeof(u32);
         dname.len = msg->front.iov_len - sizeof(*h) - sizeof(u32);
         if (dname.len != get_unaligned_le32(h+1))
@@ -2456,8 +2458,9 @@ static void handle_lease(struct ceph_mds_client *mdsc,
 
         /* lookup inode */
         inode = ceph_find_inode(sb, vino);
-        dout("handle_lease '%s', mask %d, ino %llx %p\n",
-             ceph_lease_op_name(h->action), mask, vino.ino, inode);
+        dout("handle_lease %s, mask %d, ino %llx %p %.*s\n",
+             ceph_lease_op_name(h->action), mask, vino.ino, inode,
+             dname.len, dname.name);
         if (inode == NULL) {
                 dout("handle_lease no inode %llx\n", vino.ino);
                 goto release;
@@ -2482,7 +2485,8 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         switch (h->action) {
         case CEPH_MDS_LEASE_REVOKE:
                 if (di && di->lease_session == session) {
-                        h->seq = cpu_to_le32(di->lease_seq);
+                        if (ceph_seq_cmp(di->lease_seq, seq) > 0)
+                                h->seq = cpu_to_le32(di->lease_seq);
                         __ceph_mdsc_drop_dentry_lease(dentry);
                 }
                 release = 1;
@@ -2496,7 +2500,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
                         unsigned long duration =
                                 le32_to_cpu(h->duration_ms) * HZ / 1000;
 
-                        di->lease_seq = le32_to_cpu(h->seq);
+                        di->lease_seq = seq;
                         dentry->d_time = di->lease_renew_from + duration;
                         di->lease_renew_after = di->lease_renew_from +
                                 (duration >> 1);
@@ -2686,10 +2690,10 @@ static void delayed_work(struct work_struct *work)
                         send_renew_caps(mdsc, s);
                 else
                         ceph_con_keepalive(&s->s_con);
-                add_cap_releases(mdsc, s, -1);
+                ceph_add_cap_releases(mdsc, s, -1);
                 if (s->s_state == CEPH_MDS_SESSION_OPEN ||
                     s->s_state == CEPH_MDS_SESSION_HUNG)
-                        send_cap_releases(mdsc, s);
+                        ceph_send_cap_releases(mdsc, s);
                 mutex_unlock(&s->s_mutex);
                 ceph_put_mds_session(s);
 
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index d9936c4f1212..b292fa42a66d 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -322,6 +322,12 @@ static inline void ceph_mdsc_put_request(struct ceph_mds_request *req)
         kref_put(&req->r_kref, ceph_mdsc_release_request);
 }
 
+extern int ceph_add_cap_releases(struct ceph_mds_client *mdsc,
+                                 struct ceph_mds_session *session,
+                                 int extra);
+extern void ceph_send_cap_releases(struct ceph_mds_client *mdsc,
+                                   struct ceph_mds_session *session);
+
 extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);
 
 extern char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
diff --git a/fs/ceph/mon_client.c b/fs/ceph/mon_client.c
index 21c62e9b7d1d..07a539906e67 100644
--- a/fs/ceph/mon_client.c
+++ b/fs/ceph/mon_client.c
@@ -400,6 +400,8 @@ static void release_generic_request(struct kref *kref)
                 ceph_msg_put(req->reply);
         if (req->request)
                 ceph_msg_put(req->request);
+
+        kfree(req);
 }
 
 static void put_generic_request(struct ceph_mon_generic_request *req)
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 4e0bee240b9d..fa87f51e38e1 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -89,7 +89,7 @@ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
 
         buf->f_files = le64_to_cpu(st.num_objects);
         buf->f_ffree = -1;
-        buf->f_namelen = PATH_MAX;
+        buf->f_namelen = NAME_MAX;
         buf->f_frsize = PAGE_CACHE_SIZE;
 
         /* leave fsid little-endian, regardless of host endianness */
@@ -926,7 +926,7 @@ static int ceph_compare_super(struct super_block *sb, void *data)
 /*
  * construct our own bdi so we can control readahead, etc.
  */
-static atomic_long_t bdi_seq = ATOMIC_INIT(0);
+static atomic_long_t bdi_seq = ATOMIC_LONG_INIT(0);
 
 static int ceph_register_bdi(struct super_block *sb, struct ceph_client *client)
 {
diff --git a/fs/pipe.c b/fs/pipe.c
index 69c4c7c13ea9..279eef96c51c 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1145,13 +1145,20 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
          * and adjust the indexes.
          */
         if (pipe->nrbufs) {
-                const unsigned int tail = pipe->nrbufs & (pipe->buffers - 1);
-                const unsigned int head = pipe->nrbufs - tail;
+                unsigned int tail;
+                unsigned int head;
 
+                tail = pipe->curbuf + pipe->nrbufs;
+                if (tail < pipe->buffers)
+                        tail = 0;
+                else
+                        tail &= (pipe->buffers - 1);
+
+                head = pipe->nrbufs - tail;
                 if (head)
                         memcpy(bufs, pipe->bufs + pipe->curbuf, head * sizeof(struct pipe_buffer));
                 if (tail)
-                        memcpy(bufs + head, pipe->bufs + pipe->curbuf, tail * sizeof(struct pipe_buffer));
+                        memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
         }
 
         pipe->curbuf = 0;
@@ -1208,12 +1215,13 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
                 size = round_pipe_size(arg);
                 nr_pages = size >> PAGE_SHIFT;
 
+                ret = -EINVAL;
+                if (!nr_pages)
+                        goto out;
+
                 if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
                         ret = -EPERM;
                         goto out;
-                } else if (nr_pages < PAGE_SIZE) {
-                        ret = -EINVAL;
-                        goto out;
                 }
                 ret = pipe_set_size(pipe, nr_pages);
                 break;
diff --git a/include/trace/events/signal.h b/include/trace/events/signal.h
index 814566c99d29..17df43464df0 100644
--- a/include/trace/events/signal.h
+++ b/include/trace/events/signal.h
@@ -10,7 +10,8 @@
 
 #define TP_STORE_SIGINFO(__entry, info)                         \
         do {                                                    \
-                if (info == SEND_SIG_NOINFO) {                  \
+                if (info == SEND_SIG_NOINFO ||                  \
+                    info == SEND_SIG_FORCED) {                  \
                         __entry->errno  = 0;                    \
                         __entry->code   = SI_USER;              \
                 } else if (info == SEND_SIG_PRIV) {             \
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 31d6afe92594..ff86c558af4c 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -1507,6 +1507,9 @@ do {					\
                 divisor = nsec * frequency;
         }
 
+        if (!divisor)
+                return dividend;
+
         return div64_u64(dividend, divisor);
 }
 
@@ -1529,7 +1532,7 @@ static int perf_event_start(struct perf_event *event)
 static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count)
 {
         struct hw_perf_event *hwc = &event->hw;
-        u64 period, sample_period;
+        s64 period, sample_period;
         s64 delta;
 
         period = perf_calculate_period(event, nsec, count);
diff --git a/sound/atmel/ac97c.c b/sound/atmel/ac97c.c
index 428121a7e705..10c3a871a12d 100644
--- a/sound/atmel/ac97c.c
+++ b/sound/atmel/ac97c.c
@@ -657,7 +657,7 @@ static irqreturn_t atmel_ac97c_interrupt(int irq, void *dev)
         if (sr & AC97C_SR_CAEVT) {
                 struct snd_pcm_runtime *runtime;
                 int offset, next_period, block_size;
-                dev_info(&chip->pdev->dev, "channel A event%s%s%s%s%s%s\n",
+                dev_dbg(&chip->pdev->dev, "channel A event%s%s%s%s%s%s\n",
                                 casr & AC97C_CSR_OVRUN   ? " OVRUN"   : "",
                                 casr & AC97C_CSR_RXRDY   ? " RXRDY"   : "",
                                 casr & AC97C_CSR_UNRUN   ? " UNRUN"   : "",
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d792cddbf4c2..fc767b6b4785 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9477,6 +9477,9 @@ static struct snd_pci_quirk alc882_ssid_cfg_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x2800, "AppleTV", ALC885_IMAC24),
         SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC885_MBP3),
         SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889A_MB31),
+        SND_PCI_QUIRK(0x106b, 0x3200, "iMac 7,1 Aluminum", ALC882_ASUS_A7M),
+        SND_PCI_QUIRK(0x106b, 0x3400, "MacBookAir 1,1", ALC885_MBP3),
+        SND_PCI_QUIRK(0x106b, 0x3500, "MacBookAir 2,1", ALC885_MBA21),
         SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889A_MB31),
         SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3),
         SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24),
diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
index 1941a357e8c4..d256f5f313b5 100644
--- a/sound/soc/pxa/spitz.c
+++ b/sound/soc/pxa/spitz.c
@@ -328,38 +328,6 @@ static struct snd_soc_device spitz_snd_devdata = {
         .codec_dev = &soc_codec_dev_wm8750,
 };
 
-/*
- * FIXME: This is a temporary bodge to avoid cross-tree merge issues.
- * New drivers should register the wm8750 I2C device in the machine
- * setup code (under arch/arm for ARM systems).
- */
-static int wm8750_i2c_register(void)
-{
-        struct i2c_board_info info;
-        struct i2c_adapter *adapter;
-        struct i2c_client *client;
-
-        memset(&info, 0, sizeof(struct i2c_board_info));
-        info.addr = 0x1b;
-        strlcpy(info.type, "wm8750", I2C_NAME_SIZE);
-
-        adapter = i2c_get_adapter(0);
-        if (!adapter) {
-                printk(KERN_ERR "can't get i2c adapter 0\n");
-                return -ENODEV;
-        }
-
-        client = i2c_new_device(adapter, &info);
-        i2c_put_adapter(adapter);
-        if (!client) {
-                printk(KERN_ERR "can't add i2c device at 0x%x\n",
-                (unsigned int)info.addr);
-                return -ENODEV;
-        }
-
-        return 0;
-}
-
 static struct platform_device *spitz_snd_device;
 
 static int __init spitz_init(void)
@@ -369,10 +337,6 @@ static int __init spitz_init(void)
         if (!(machine_is_spitz() || machine_is_borzoi() || machine_is_akita()))
                 return -ENODEV;
 
-        ret = wm8750_i2c_setup();
-        if (ret != 0)
-                return ret;
-
         spitz_snd_device = platform_device_alloc("soc-audio", -1);
         if (!spitz_snd_device)
                 return -ENOMEM;
diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c
index 4c7b051f9d17..1bc56b2b94e2 100644
--- a/sound/spi/at73c213.c
+++ b/sound/spi/at73c213.c
@@ -69,7 +69,6 @@ struct snd_at73c213 {
         int                             irq;
         int                             period;
         unsigned long                   bitrate;
-        struct clk                      *bitclk;
         struct ssc_device               *ssc;
         struct spi_device               *spi;
         u8                              spi_wbuffer[2];
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 7fd6b151feb5..b63e5713849f 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1745,7 +1745,12 @@ static int dso__load_kernel_sym(struct dso *self, struct map *map,
         if (symbol_conf.vmlinux_name != NULL) {
                 err = dso__load_vmlinux(self, map,
                                         symbol_conf.vmlinux_name, filter);
-                goto out_try_fixup;
+                if (err > 0) {
+                        dso__set_long_name(self,
+                                           strdup(symbol_conf.vmlinux_name));
+                        goto out_fixup;
+                }
+                return err;
         }
 
         if (vmlinux_path != NULL) {
@@ -1806,7 +1811,6 @@ do_kallsyms:
                 pr_debug("Using %s for symbols\n", kallsyms_filename);
         free(kallsyms_allocated_filename);
 
-out_try_fixup:
         if (err > 0) {
 out_fixup:
                 if (kallsyms_filename != NULL)
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 7c79c1d76d0c..3500dee9cf2b 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -192,12 +192,13 @@ static int ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
 
 int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
 {
-        u32 old_irr = ioapic->irr;
+        u32 old_irr;
         u32 mask = 1 << irq;
         union kvm_ioapic_redirect_entry entry;
         int ret = 1;
 
         spin_lock(&ioapic->lock);
+        old_irr = ioapic->irr;
         if (irq >= 0 && irq < IOAPIC_NUM_PINS) {
                 entry = ioapic->redirtbl[irq];
                 level ^= entry.fields.polarity;
diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
index d2f06be63354..96048ee9e39e 100644
--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
@@ -271,7 +271,7 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
                 pfn  = phys >> PAGE_SHIFT;
 
                 /* Unmap address from IO address space */
-                order       = iommu_unmap(domain, gfn_to_gpa(gfn), PAGE_SIZE);
+                order       = iommu_unmap(domain, gfn_to_gpa(gfn), 0);
                 unmap_pages = 1ULL << order;
 
                 /* Unpin all pages we just unmapped to not leak any memory */