146 files changed, 1146 insertions, 680 deletions
diff --git a/Documentation/kernel-doc-nano-HOWTO.txt b/Documentation/kernel-doc-nano-HOWTO.txt
index d73fbd2b2b45..026ec7d57384 100644
--- a/Documentation/kernel-doc-nano-HOWTO.txt
+++ b/Documentation/kernel-doc-nano-HOWTO.txt
@@ -43,7 +43,8 @@ Only comments so marked will be considered by the kernel-doc scripts,
 and any comment so marked must be in kernel-doc format.  Do not use
 "/**" to be begin a comment block unless the comment block contains
 kernel-doc formatted comments.  The closing comment marker for
-kernel-doc comments can be either "*/" or "**/".
+kernel-doc comments can be either "*/" or "**/", but "*/" is
+preferred in the Linux kernel tree.
 Kernel-doc comments should be placed just before the function
 or data structure being described.
@@ -63,7 +64,7 @@ Example kernel-doc function comment:
 * comment lines.
 *
 * The longer description can have multiple paragraphs.
- **/
+ */
 The first line, with the short description, must be on a single line.
@@ -85,7 +86,7 @@ Example kernel-doc data structure comment.
 *              perhaps with more lines and words.
 *
 * Longer description of this structure.
- **/
+ */
 The kernel-doc function comments describe each parameter to the
 function, in order, with the @name lines.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 6390ffb520fd..fc22e9223427 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -938,6 +938,8 @@ and is between 256 and 4096 characters. It is defined in the file
        intel_iommu=    [DMAR] Intel IOMMU driver (DMAR) option
+                on
+                        Enable intel iommu driver.
                off
                        Disable intel iommu driver.
                igfx_off [Default Off]
diff --git a/MAINTAINERS b/MAINTAINERS
index 4486ac1ccac5..b7e4afc4bc44 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1202,6 +1202,8 @@ S:	Supported
 CONTROL GROUPS (CGROUPS)
 P:      Paul Menage
 M:      menage@google.com
+P:      Li Zefan
+M:      lizf@cn.fujitsu.com
 L:      containers@lists.linux-foundation.org
 S:      Maintained
@@ -3543,6 +3545,12 @@ S:	Maintained
 PXA MMCI DRIVER
 S:      Orphan
+PXA RTC DRIVER
+P:      Robert Jarzmik
+M:      robert.jarzmik@free.fr
+L:      rtc-linux@googlegroups.com
+S:      Maintained
 QLOGIC QLA2XXX FC-SCSI DRIVER
 P:      Andrew Vasquez
 M:      linux-driver@qlogic.com
@@ -4291,8 +4299,8 @@ P:	Rajiv Andrade
 M:      srajiv@linux.vnet.ibm.com
 W:      http://tpmdd.sourceforge.net
 P:      Marcel Selhorst
-M:      tpm@selhorst.net
+M:      m.selhorst@sirrix.com
-W:      http://www.prosec.rub.de/tpm/
+W:      http://www.sirrix.com
 L:      tpmdd-devel@lists.sourceforge.net (moderated for non-subscribers)
 S:      Maintained
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 440dc62cdc3a..598ca61e7bca 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -13,8 +13,8 @@
 #include <asm/cacheflush.h>
 #include <asm/mach-types.h>
-const extern unsigned char relocate_new_kernel[];
+extern const unsigned char relocate_new_kernel[];
-const extern unsigned int relocate_new_kernel_size;
+extern const unsigned int relocate_new_kernel_size;
 extern void setup_mm_for_reboot(char mode);
diff --git a/arch/arm/mach-pxa/dma.c b/arch/arm/mach-pxa/dma.c
index b1514fb20d3a..7de17fc5d54b 100644
--- a/arch/arm/mach-pxa/dma.c
+++ b/arch/arm/mach-pxa/dma.c
@@ -121,20 +121,22 @@ int __init pxa_init_dma(int num_ch)
        if (dma_channels == NULL)
                return -ENOMEM;
-        ret = request_irq(IRQ_DMA, dma_irq_handler, IRQF_DISABLED, "DMA", NULL);
-        if (ret) {
-                printk (KERN_CRIT "Wow!  Can't register IRQ for DMA\n");
-                kfree(dma_channels);
-                return ret;
-        }
        /* dma channel priorities on pxa2xx processors:
         * ch 0 - 3,  16 - 19  <--> (0) DMA_PRIO_HIGH
         * ch 4 - 7,  20 - 23  <--> (1) DMA_PRIO_MEDIUM
         * ch 8 - 15, 24 - 31  <--> (2) DMA_PRIO_LOW
         */
-        for (i = 0; i < num_ch; i++)
+        for (i = 0; i < num_ch; i++) {
+                DCSR(i) = 0;
                dma_channels[i].prio = min((i & 0xf) >> 2, DMA_PRIO_LOW);
+        }
+        ret = request_irq(IRQ_DMA, dma_irq_handler, IRQF_DISABLED, "DMA", NULL);
+        if (ret) {
+                printk (KERN_CRIT "Wow!  Can't register IRQ for DMA\n");
+                kfree(dma_channels);
+                return ret;
+        }
        num_dma_channels = num_ch;
        return 0;
diff --git a/arch/arm/mach-pxa/include/mach/regs-ac97.h b/arch/arm/mach-pxa/include/mach/regs-ac97.h
index e41b9d202b8c..b8d14bd9ae59 100644
--- a/arch/arm/mach-pxa/include/mach/regs-ac97.h
+++ b/arch/arm/mach-pxa/include/mach/regs-ac97.h
@@ -1,6 +1,8 @@
 #ifndef __ASM_ARCH_REGS_AC97_H
 #define __ASM_ARCH_REGS_AC97_H
+#include <mach/hardware.h>
 /*
 * AC97 Controller registers
 */
diff --git a/arch/arm/mach-pxa/include/mach/regs-ssp.h b/arch/arm/mach-pxa/include/mach/regs-ssp.h
index 3c04cde2cf1f..cf31986f6f05 100644
--- a/arch/arm/mach-pxa/include/mach/regs-ssp.h
+++ b/arch/arm/mach-pxa/include/mach/regs-ssp.h
@@ -41,6 +41,9 @@
 #elif defined(CONFIG_PXA27x) || defined(CONFIG_PXA3xx)
 #define SSCR0_SCR       (0x000fff00)    /* Serial Clock Rate (mask) */
 #define SSCR0_SerClkDiv(x) (((x) - 1) << 8) /* Divisor [1..4096] */
+#endif
+#if defined(CONFIG_PXA27x) || defined(CONFIG_PXA3xx)
 #define SSCR0_EDSS      (1 << 20)       /* Extended data size select */
 #define SSCR0_NCS       (1 << 21)       /* Network clock select */
 #define SSCR0_RIM       (1 << 22)       /* Receive FIFO overrrun interrupt mask */
diff --git a/arch/arm/mach-pxa/pxa300.c b/arch/arm/mach-pxa/pxa300.c
index f735e58e6669..83fb609b6eb7 100644
--- a/arch/arm/mach-pxa/pxa300.c
+++ b/arch/arm/mach-pxa/pxa300.c
@@ -88,13 +88,13 @@ static struct pxa3xx_mfp_addr_map pxa310_mfp_addr_map[] __initdata = {
 static DEFINE_PXA3_CKEN(common_nand, NAND, 156000000, 0);
 static struct clk_lookup common_clkregs[] = {
-        INIT_CLKREG(&clk_common_nand, "pxa3xx-nand", "NANDCLK"),
+        INIT_CLKREG(&clk_common_nand, "pxa3xx-nand", NULL),
 };
 static DEFINE_PXA3_CKEN(pxa310_mmc3, MMC3, 19500000, 0);
 static struct clk_lookup pxa310_clkregs[] = {
-        INIT_CLKREG(&clk_pxa310_mmc3, "pxa2xx-mci.2", "MMCCLK"),
+        INIT_CLKREG(&clk_pxa310_mmc3, "pxa2xx-mci.2", NULL),
 };
 static int __init pxa300_init(void)
diff --git a/arch/arm/mach-pxa/pxa320.c b/arch/arm/mach-pxa/pxa320.c
index effe408c186f..36f066196fa2 100644
--- a/arch/arm/mach-pxa/pxa320.c
+++ b/arch/arm/mach-pxa/pxa320.c
@@ -83,7 +83,7 @@ static struct pxa3xx_mfp_addr_map pxa320_mfp_addr_map[] __initdata = {
 static DEFINE_PXA3_CKEN(pxa320_nand, NAND, 104000000, 0);
 static struct clk_lookup pxa320_clkregs[] = {
-        INIT_CLKREG(&clk_pxa320_nand, "pxa3xx-nand", "NANDCLK"),
+        INIT_CLKREG(&clk_pxa320_nand, "pxa3xx-nand", NULL),
 };
 static int __init pxa320_init(void)
diff --git a/arch/powerpc/boot/dts/mpc8313erdb.dts b/arch/powerpc/boot/dts/mpc8313erdb.dts
index 909a89cab9ac..3ebf7ec0484c 100644
--- a/arch/powerpc/boot/dts/mpc8313erdb.dts
+++ b/arch/powerpc/boot/dts/mpc8313erdb.dts
@@ -191,7 +191,8 @@
                        interrupts = <37 0x8 36 0x8 35 0x8>;
                        interrupt-parent = <&ipic>;
                        tbi-handle = < &tbi0 >;
-                        phy-handle = < &phy1 >;
+                        /* Vitesse 7385 isn't on the MDIO bus */
+                        fixed-link = <1 1 1000 0 0>;
                        fsl,magic-packet;
                        mdio@24520 {
@@ -199,12 +200,6 @@
                                #size-cells = <0>;
                                compatible = "fsl,gianfar-mdio";
                                reg = <0x24520 0x20>;
-                                phy1: ethernet-phy@1 {
-                                        interrupt-parent = <&ipic>;
-                                        interrupts = <19 0x8>;
-                                        reg = <0x1>;
-                                        device_type = "ethernet-phy";
-                                };
                                phy4: ethernet-phy@4 {
                                        interrupt-parent = <&ipic>;
                                        interrupts = <20 0x8>;
@@ -219,6 +214,8 @@
                };
                enet1: ethernet@25000 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
                        cell-index = <1>;
                        device_type = "network";
                        model = "eTSEC";
diff --git a/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig b/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
index 9e47ae957e2e..409d017621a8 100644
--- a/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
+++ b/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
@@ -651,7 +651,7 @@ CONFIG_CICADA_PHY=y
 # CONFIG_NATIONAL_PHY is not set
 # CONFIG_STE10XP is not set
 # CONFIG_LSI_ET1011C_PHY is not set
-# CONFIG_FIXED_PHY is not set
+CONFIG_FIXED_PHY=y
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
index 5355244c99ff..60c60ccf5e3c 100644
--- a/arch/powerpc/kernel/ftrace.c
+++ b/arch/powerpc/kernel/ftrace.c
@@ -195,8 +195,9 @@ __ftrace_make_nop(struct module *mod,
                return -EINVAL;
        }
-        offset = (unsigned)((unsigned short)jmp[0]) << 16 |
+        /* The bottom half is signed extended */
-                (unsigned)((unsigned short)jmp[1]);
+        offset = ((unsigned)((unsigned short)jmp[0]) << 16) +
+                (int)((short)jmp[1]);
        DEBUGP(" %x ", offset);
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index 19b12d2cbb4b..0f4181272311 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -561,8 +561,21 @@ int pci_mmap_legacy_page_range(struct pci_bus *bus,
                 (unsigned long long)(offset + size - 1));
        if (mmap_state == pci_mmap_mem) {
-                if ((offset + size) > hose->isa_mem_size)
+                /* Hack alert !
-                        return -ENXIO;
+                 *
+                 * Because X is lame and can fail starting if it gets an error trying
+                 * to mmap legacy_mem (instead of just moving on without legacy memory
+                 * access) we fake it here by giving it anonymous memory, effectively
+                 * behaving just like /dev/zero
+                 */
+                if ((offset + size) > hose->isa_mem_size) {
+                        printk(KERN_DEBUG
+                               "Process %s (pid:%d) mapped non-existing PCI legacy memory for 0%04x:%02x\n",
+                               current->comm, current->pid, pci_domain_nr(bus), bus->number);
+                        if (vma->vm_flags & VM_SHARED)
+                                return shmem_zero_setup(vma);
+                        return 0;
+                }
                offset += hose->isa_mem_phys;
        } else {
                unsigned long io_offset = (unsigned long)hose->io_base_virt - _IO_BASE;
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 4aae0c387645..13b7d54f185b 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -172,6 +172,8 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                        }
                        break;
                case 0x378:     /* orx */
+                        if (instr & 1)
+                                break;
                        rs = (instr >> 21) & 0x1f;
                        rb = (instr >> 11) & 0x1f;
                        if (rs == rb) {         /* mr */
diff --git a/arch/powerpc/mm/fsl_booke_mmu.c b/arch/powerpc/mm/fsl_booke_mmu.c
index 1971e4ee3d6e..ea6e41e39d9f 100644
--- a/arch/powerpc/mm/fsl_booke_mmu.c
+++ b/arch/powerpc/mm/fsl_booke_mmu.c
@@ -73,7 +73,7 @@ extern unsigned int tlbcam_index;
 /*
 * Return PA for this VA if it is mapped by a CAM, or 0
 */
-unsigned long v_mapped_by_tlbcam(unsigned long va)
+phys_addr_t v_mapped_by_tlbcam(unsigned long va)
 {
        int b;
        for (b = 0; b < tlbcam_index; ++b)
@@ -85,7 +85,7 @@ unsigned long v_mapped_by_tlbcam(unsigned long va)
 /*
 * Return VA for a given PA or 0 if not mapped
 */
-unsigned long p_mapped_by_tlbcam(unsigned long pa)
+unsigned long p_mapped_by_tlbcam(phys_addr_t pa)
 {
        int b;
        for (b = 0; b < tlbcam_index; ++b)
diff --git a/arch/powerpc/mm/hash_low_32.S b/arch/powerpc/mm/hash_low_32.S
index 67850ec9feb3..14af8cedab70 100644
--- a/arch/powerpc/mm/hash_low_32.S
+++ b/arch/powerpc/mm/hash_low_32.S
@@ -320,7 +320,7 @@ _GLOBAL(create_hpte)
        and     r8,r8,r0                /* writable if _RW & _DIRTY */
        rlwimi  r5,r5,32-1,30,30        /* _PAGE_USER -> PP msb */
        rlwimi  r5,r5,32-2,31,31        /* _PAGE_USER -> PP lsb */
-        ori     r8,r8,0xe14             /* clear out reserved bits and M */
+        ori     r8,r8,0xe04             /* clear out reserved bits */
        andc    r8,r5,r8                /* PP = user? (rw&dirty? 2: 3): 0 */
 BEGIN_FTR_SECTION
        rlwinm  r8,r8,0,~_PAGE_COHERENT /* clear M (coherence not required) */
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index 22972cd83cc9..58bcaeba728d 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -61,8 +61,8 @@ void setbat(int index, unsigned long virt, phys_addr_t phys,
 #ifdef HAVE_TLBCAM
 extern unsigned int tlbcam_index;
-extern unsigned long v_mapped_by_tlbcam(unsigned long va);
+extern phys_addr_t v_mapped_by_tlbcam(unsigned long va);
-extern unsigned long p_mapped_by_tlbcam(unsigned long pa);
+extern unsigned long p_mapped_by_tlbcam(phys_addr_t pa);
 #else /* !HAVE_TLBCAM */
 #define v_mapped_by_tlbcam(x)   (0UL)
 #define p_mapped_by_tlbcam(x)   (0UL)
diff --git a/arch/powerpc/oprofile/cell/spu_profiler.c b/arch/powerpc/oprofile/cell/spu_profiler.c
index 9305ddaac512..b129d007e7fe 100644
--- a/arch/powerpc/oprofile/cell/spu_profiler.c
+++ b/arch/powerpc/oprofile/cell/spu_profiler.c
@@ -16,6 +16,7 @@
 #include <linux/smp.h>
 #include <linux/slab.h>
 #include <asm/cell-pmu.h>
+#include <asm/time.h>
 #include "pr_util.h"
 #define SCALE_SHIFT 14
diff --git a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
index 9876d7e072f4..ddf0bdc0fc8b 100644
--- a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
+++ b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
@@ -186,7 +186,7 @@ out_unmap_regs:
        iounmap(priv->regs);
 out_free_bootmem:
        free_bootmem((unsigned long)priv,
-                     sizeof(sizeof(struct pq2ads_pci_pic)));
+                     sizeof(struct pq2ads_pci_pic));
        of_node_put(np);
 out_unmap_irq:
        irq_dispose_mapping(irq);
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index a623ad256e9e..9b21ee68ea50 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -14,6 +14,7 @@
 #include <asm/firmware.h>
 #include <asm/machdep.h>
 #include <asm/pSeries_reconfig.h>
+#include <asm/sparsemem.h>
 static int pseries_remove_lmb(unsigned long base, unsigned int lmb_size)
 {
diff --git a/arch/powerpc/sysdev/cpm2_pic.c b/arch/powerpc/sysdev/cpm2_pic.c
index b16ca3ed65d2..78f1f7cca0a0 100644
--- a/arch/powerpc/sysdev/cpm2_pic.c
+++ b/arch/powerpc/sysdev/cpm2_pic.c
@@ -165,7 +165,7 @@ static int cpm2_set_irq_type(unsigned int virq, unsigned int flow_type)
                        edibit = (14 - (src - CPM2_IRQ_EXT1));
        else
                if (src >= CPM2_IRQ_PORTC15 && src <= CPM2_IRQ_PORTC0)
-                        edibit = (31 - (src - CPM2_IRQ_PORTC15));
+                        edibit = (31 - (CPM2_IRQ_PORTC0 - src));
                else
                        return (flow_type & IRQ_TYPE_LEVEL_LOW) ? 0 : -EINVAL;
diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c
index 88a983ece5c9..9a89cd3e80a2 100644
--- a/arch/powerpc/sysdev/ipic.c
+++ b/arch/powerpc/sysdev/ipic.c
@@ -890,7 +890,7 @@ unsigned int ipic_get_irq(void)
        return irq_linear_revmap(primary_ipic->irqhost, irq);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_SUSPEND
 static struct {
        u32 sicfr;
        u32 siprr[2];
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index a0e748da9909..31e809c77790 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc6
+# Linux kernel version: 2.6.29-rc4
-# Thu Nov 27 11:00:49 2008
+# Wed Feb 11 10:07:16 2009
 #
 CONFIG_SCHED_MC=y
 CONFIG_MMU=y
@@ -14,12 +14,14 @@ CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_BUG=y
 CONFIG_NO_IOMEM=y
 CONFIG_NO_DMA=y
 CONFIG_GENERIC_LOCKBREAK=y
 CONFIG_PGSTE=y
+CONFIG_VIRT_CPU_ACCOUNTING=y
 CONFIG_S390=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
@@ -39,20 +41,29 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_TASKSTATS is not set
 CONFIG_AUDIT=y
 # CONFIG_AUDITSYSCALL is not set
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=17
+CONFIG_GROUP_SCHED=y
+CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_RT_GROUP_SCHED is not set
+CONFIG_USER_SCHED=y
+# CONFIG_CGROUP_SCHED is not set
 CONFIG_CGROUPS=y
 # CONFIG_CGROUP_DEBUG is not set
 CONFIG_CGROUP_NS=y
 # CONFIG_CGROUP_FREEZER is not set
 # CONFIG_CGROUP_DEVICE is not set
 # CONFIG_CPUSETS is not set
-CONFIG_GROUP_SCHED=y
-CONFIG_FAIR_GROUP_SCHED=y
-# CONFIG_RT_GROUP_SCHED is not set
-CONFIG_USER_SCHED=y
-# CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUP_CPUACCT is not set
 # CONFIG_RESOURCE_COUNTERS is not set
 CONFIG_SYSFS_DEPRECATED=y
@@ -63,6 +74,7 @@ CONFIG_UTS_NS=y
 CONFIG_IPC_NS=y
 # CONFIG_USER_NS is not set
 # CONFIG_PID_NS is not set
+# CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
@@ -91,17 +103,17 @@ CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_KPROBES=y
+CONFIG_HAVE_SYSCALL_WRAPPERS=y
 CONFIG_KRETPROBES=y
 CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -109,7 +121,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
+CONFIG_INIT_ALL_POSSIBLE=y
 CONFIG_STOP_MACHINE=y
 CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
@@ -130,7 +142,6 @@ CONFIG_DEFAULT_DEADLINE=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="deadline"
 CONFIG_PREEMPT_NOTIFIERS=y
-CONFIG_CLASSIC_RCU=y
 # CONFIG_FREEZER is not set
 #
@@ -161,6 +172,7 @@ CONFIG_S390_EXEC_PROTECT=y
 CONFIG_MARCH_Z900=y
 # CONFIG_MARCH_Z990 is not set
 # CONFIG_MARCH_Z9_109 is not set
+# CONFIG_MARCH_Z10 is not set
 CONFIG_PACK_STACK=y
 # CONFIG_SMALL_STACK is not set
 CONFIG_CHECK_STACK=y
@@ -174,7 +186,6 @@ CONFIG_ARCH_POPULATES_NODE_MAP=y
 # CONFIG_PREEMPT_NONE is not set
 # CONFIG_PREEMPT_VOLUNTARY is not set
 CONFIG_PREEMPT=y
-# CONFIG_PREEMPT_RCU is not set
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -195,7 +206,6 @@ CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-CONFIG_RESOURCES_64BIT=y
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
@@ -207,7 +217,6 @@ CONFIG_UNEVICTABLE_LRU=y
 #
 CONFIG_MACHCHK_WARNING=y
 CONFIG_QDIO=y
-# CONFIG_QDIO_DEBUG is not set
 CONFIG_CHSC_SCH=m
 #
@@ -227,15 +236,13 @@ CONFIG_PFAULT=y
 # CONFIG_SHARED_KERNEL is not set
 # CONFIG_CMM is not set
 # CONFIG_PAGE_STATES is not set
-CONFIG_VIRT_TIMER=y
-CONFIG_VIRT_CPU_ACCOUNTING=y
 # CONFIG_APPLDATA_BASE is not set
 CONFIG_HZ_100=y
 # CONFIG_HZ_250 is not set
 # CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=100
-# CONFIG_SCHED_HRTICK is not set
+CONFIG_SCHED_HRTICK=y
 CONFIG_S390_HYPFS_FS=y
 CONFIG_KEXEC=y
 # CONFIG_ZFCPDUMP is not set
@@ -245,6 +252,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -383,6 +391,7 @@ CONFIG_NET_SCH_TBF=m
 CONFIG_NET_SCH_GRED=m
 CONFIG_NET_SCH_DSMARK=m
 # CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_DRR is not set
 # CONFIG_NET_SCH_INGRESS is not set
 #
@@ -400,6 +409,7 @@ CONFIG_CLS_U32_MARK=y
 CONFIG_NET_CLS_RSVP=m
 CONFIG_NET_CLS_RSVP6=m
 CONFIG_NET_CLS_FLOW=m
+# CONFIG_NET_CLS_CGROUP is not set
 # CONFIG_NET_EMATCH is not set
 CONFIG_NET_CLS_ACT=y
 CONFIG_NET_ACT_POLICE=y
@@ -411,6 +421,7 @@ CONFIG_NET_ACT_NAT=m
 # CONFIG_NET_ACT_SKBEDIT is not set
 # CONFIG_NET_CLS_IND is not set
 CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
 #
 # Network testing
@@ -428,6 +439,7 @@ CONFIG_CAN_VCAN=m
 # CONFIG_CAN_DEBUG_DEVICES is not set
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 # CONFIG_PCMCIA is not set
@@ -475,11 +487,15 @@ CONFIG_DASD_DIAG=y
 CONFIG_DASD_EER=y
 CONFIG_VIRTIO_BLK=m
 CONFIG_MISC_DEVICES=y
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_C2PORT is not set
 #
+# EEPROM support
+#
+# CONFIG_EEPROM_93CX6 is not set
+#
 # SCSI device support
 #
 # CONFIG_RAID_ATTRS is not set
@@ -520,6 +536,7 @@ CONFIG_SCSI_FC_ATTRS=y
 # CONFIG_SCSI_SRP_ATTRS is not set
 CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_ISCSI_TCP is not set
+# CONFIG_LIBFC is not set
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_ZFCP=y
 CONFIG_SCSI_DH=m
@@ -566,6 +583,10 @@ CONFIG_NET_ETHERNET=y
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
 # CONFIG_TR is not set
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 #
@@ -593,9 +614,11 @@ CONFIG_VIRTIO_NET=m
 #
 CONFIG_DEVKMEM=y
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IUCV=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_HW_RANDOM=m
 CONFIG_HW_RANDOM_VIRTIO=m
@@ -645,7 +668,6 @@ CONFIG_S390_VMUR=m
 # CONFIG_NEW_LEDS is not set
 CONFIG_ACCESSIBILITY=y
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 #
 # File systems
@@ -668,6 +690,7 @@ CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -703,10 +726,7 @@ CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_HUGETLBFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_CONFIGFS_FS=m
+CONFIG_MISC_FILESYSTEMS=y
-#
-# Miscellaneous filesystems
-#
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -715,6 +735,7 @@ CONFIG_CONFIGFS_FS=m
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -808,6 +829,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
@@ -818,15 +840,19 @@ CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_HAVE_FUNCTION_TRACER=y
 #
 # Tracers
 #
+# CONFIG_FUNCTION_TRACER is not set
 # CONFIG_IRQSOFF_TRACER is not set
 # CONFIG_PREEMPT_TRACER is not set
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
 # CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
+# CONFIG_STACK_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 CONFIG_SAMPLES=y
 # CONFIG_SAMPLE_KOBJECT is not set
@@ -847,11 +873,17 @@ CONFIG_CRYPTO=y
 #
 CONFIG_CRYPTO_FIPS=y
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD=m
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
-CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_BLKCIPHER2=y
-CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_HASH=m
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=m
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 CONFIG_CRYPTO_GF128MUL=m
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
@@ -885,7 +917,7 @@ CONFIG_CRYPTO_HMAC=m
 #
 # Digest
 #
-# CONFIG_CRYPTO_CRC32C is not set
+CONFIG_CRYPTO_CRC32C=m
 # CONFIG_CRYPTO_MD4 is not set
 CONFIG_CRYPTO_MD5=m
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
@@ -942,6 +974,7 @@ CONFIG_S390_PRNG=m
 # Library routines
 #
 CONFIG_BITREVERSE=m
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 CONFIG_CRC_T10DIF=y
diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index ffdef5fe8587..f3720defdd16 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -384,8 +384,8 @@ struct _lowcore
        __u32        panic_magic;              /* 0xe00 */
        /* Per cpu primary space access list */
-        __u8         pad_0xe04[0xe3c-0xe04];   /* 0xe04 */
+        __u8         pad_0xe04[0xe38-0xe04];   /* 0xe04 */
-        __u32        vdso_per_cpu_data;        /* 0xe3c */
+        __u64        vdso_per_cpu_data;        /* 0xe38 */
        __u32        paste[16];                /* 0xe40 */
        __u8         pad13[0x11b8-0xe80];      /* 0xe80 */
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index e7c5bfb7c755..026a37a94fc9 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -95,6 +95,7 @@ asmlinkage void do_softirq(void)
        local_irq_restore(flags);
 }
+#ifdef CONFIG_PROC_FS
 void init_irq_proc(void)
 {
        struct proc_dir_entry *root_irq_dir;
@@ -102,3 +103,4 @@ void init_irq_proc(void)
        root_irq_dir = proc_mkdir("irq", NULL);
        create_prof_cpu_mask(root_irq_dir);
 }
+#endif
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 8ffee714f932..a46c3a21e26d 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -891,10 +891,35 @@ prom_tba:	.xword	0
 tlb_type:       .word   0       /* Must NOT end up in BSS */
        .section        ".fixup",#alloc,#execinstr
-        .globl  __ret_efault, __retl_efault
+        .globl  __ret_efault, __retl_efault, __ret_one, __retl_one
-__ret_efault:
+ENTRY(__ret_efault)
        ret
         restore %g0, -EFAULT, %o0
-__retl_efault:
+ENDPROC(__ret_efault)
+ENTRY(__retl_efault)
        retl
         mov    -EFAULT, %o0
+ENDPROC(__retl_efault)
+ENTRY(__retl_one)
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one)
+ENTRY(__ret_one_asi)
+        wr      %g0, ASI_AIUS, %asi
+        ret
+         restore %g0, 1, %o0
+ENDPROC(__ret_one_asi)
+ENTRY(__retl_one_asi)
+        wr      %g0, ASI_AIUS, %asi
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one_asi)
+ENTRY(__retl_o1)
+        retl
+         mov    %o1, %o0
+ENDPROC(__retl_o1)
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 09f088ed4a64..f3577223c863 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -70,6 +70,7 @@ static void die_nmi(const char *str, struct pt_regs *regs, int do_panic)
        printk(" on CPU%d, ip %08lx, registers:\n",
               smp_processor_id(), regs->tpc);
        show_regs(regs);
+        dump_stack();
        bust_spinlocks(0);
diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
index 92e0dda141a4..1ae8cdd7e703 100644
--- a/arch/sparc/kernel/pcr.c
+++ b/arch/sparc/kernel/pcr.c
@@ -133,11 +133,16 @@ int __init pcr_arch_init(void)
        case cheetah:
        case cheetah_plus:
-        case spitfire:
                pcr_ops = &direct_pcr_ops;
                pcr_enable = PCR_SUN4U_ENABLE;
                break;
+        case spitfire:
+                /* UltraSPARC-I/II and derivatives lack a profile
+                 * counter overflow interrupt so we can't make use of
+                 * their hardware currently.
+                 */
+                /* fallthrough */
        default:
                err = -ENODEV;
                goto out_unregister;
diff --git a/arch/sparc/lib/GENbzero.S b/arch/sparc/lib/GENbzero.S
index 6a4f956a2f7a..8e7a843ddd88 100644
--- a/arch/sparc/lib/GENbzero.S
+++ b/arch/sparc/lib/GENbzero.S
@@ -6,13 +6,9 @@
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
        .text;                  \
        .align 4;
diff --git a/arch/sparc/lib/GENcopy_from_user.S b/arch/sparc/lib/GENcopy_from_user.S
index 2b9df99e87f9..b7d0bd6b1406 100644
--- a/arch/sparc/lib/GENcopy_from_user.S
+++ b/arch/sparc/lib/GENcopy_from_user.S
@@ -5,13 +5,9 @@
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
        .text;                  \
        .align 4;
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop
 #endif
diff --git a/arch/sparc/lib/GENcopy_to_user.S b/arch/sparc/lib/GENcopy_to_user.S
index bb3f7084daf9..780550e1afc7 100644
--- a/arch/sparc/lib/GENcopy_to_user.S
+++ b/arch/sparc/lib/GENcopy_to_user.S
@@ -5,13 +5,9 @@
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
        .text;                  \
        .align 4;
@@ -31,7 +27,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop
 #endif
diff --git a/arch/sparc/lib/NG2copy_from_user.S b/arch/sparc/lib/NG2copy_from_user.S
index c77ef5f22102..119ccb9a54f4 100644
--- a/arch/sparc/lib/NG2copy_from_user.S
+++ b/arch/sparc/lib/NG2copy_from_user.S
@@ -5,14 +5,9 @@
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one_asi;\
        .text;                  \
        .align 4;
@@ -33,7 +28,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop
 #endif
diff --git a/arch/sparc/lib/NG2copy_to_user.S b/arch/sparc/lib/NG2copy_to_user.S
index 4bd4093acbbd..7fe1ccefd9d0 100644
--- a/arch/sparc/lib/NG2copy_to_user.S
+++ b/arch/sparc/lib/NG2copy_to_user.S
@@ -5,14 +5,9 @@
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one_asi;\
        .text;                  \
        .align 4;
@@ -42,7 +37,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop
 #endif
diff --git a/arch/sparc/lib/NGbzero.S b/arch/sparc/lib/NGbzero.S
index 814d5f7a45e1..beab29bf419b 100644
--- a/arch/sparc/lib/NGbzero.S
+++ b/arch/sparc/lib/NGbzero.S
@@ -6,13 +6,9 @@
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
        .text;                  \
        .align 4;
diff --git a/arch/sparc/lib/NGcopy_from_user.S b/arch/sparc/lib/NGcopy_from_user.S
index e7f433f71b42..5d1e4d1ac21e 100644
--- a/arch/sparc/lib/NGcopy_from_user.S
+++ b/arch/sparc/lib/NGcopy_from_user.S
@@ -5,14 +5,9 @@
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        ret;                    \
-         restore %g0, 1, %o0;   \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __ret_one_asi;\
        .text;                  \
        .align 4;
@@ -30,7 +25,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop
 #endif
diff --git a/arch/sparc/lib/NGcopy_to_user.S b/arch/sparc/lib/NGcopy_to_user.S
index 6ea01c5532a0..ff630dcb273c 100644
--- a/arch/sparc/lib/NGcopy_to_user.S
+++ b/arch/sparc/lib/NGcopy_to_user.S
@@ -5,14 +5,9 @@
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        ret;                    \
-         restore %g0, 1, %o0;   \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __ret_one_asi;\
        .text;                  \
        .align 4;
@@ -33,7 +28,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop
 #endif
diff --git a/arch/sparc/lib/U1copy_from_user.S b/arch/sparc/lib/U1copy_from_user.S
index 3192b0bf4fab..a6ae2ea04bf5 100644
--- a/arch/sparc/lib/U1copy_from_user.S
+++ b/arch/sparc/lib/U1copy_from_user.S
@@ -5,13 +5,9 @@
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
        .text;                  \
        .align 4;
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop;                                           \
 #include "U1memcpy.S"
diff --git a/arch/sparc/lib/U1copy_to_user.S b/arch/sparc/lib/U1copy_to_user.S
index d1210ffb0b82..f4b970eeb485 100644
--- a/arch/sparc/lib/U1copy_to_user.S
+++ b/arch/sparc/lib/U1copy_to_user.S
@@ -5,13 +5,9 @@
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
        .text;                  \
        .align 4;
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop;                                           \
 #include "U1memcpy.S"
diff --git a/arch/sparc/lib/U3copy_from_user.S b/arch/sparc/lib/U3copy_from_user.S
index f5bfc8d9d216..b1acd1331c33 100644
--- a/arch/sparc/lib/U3copy_from_user.S
+++ b/arch/sparc/lib/U3copy_from_user.S
@@ -5,13 +5,9 @@
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
        .text;                  \
        .align 4;
diff --git a/arch/sparc/lib/U3copy_to_user.S b/arch/sparc/lib/U3copy_to_user.S
index 2334f111bb0c..ef1e493afdfa 100644
--- a/arch/sparc/lib/U3copy_to_user.S
+++ b/arch/sparc/lib/U3copy_to_user.S
@@ -5,13 +5,9 @@
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
        .text;                  \
        .align 4;
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
        rd              %asi, %g1;                      \
        cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
         nop;                                           \
 #include "U3memcpy.S"
diff --git a/arch/sparc/lib/bzero.S b/arch/sparc/lib/bzero.S
index c7bbae8c590f..b6557297440f 100644
--- a/arch/sparc/lib/bzero.S
+++ b/arch/sparc/lib/bzero.S
@@ -88,13 +88,9 @@ __bzero_done:
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
        .text;                  \
        .align 4;
diff --git a/arch/sparc/lib/copy_in_user.S b/arch/sparc/lib/copy_in_user.S
index 650af3f21f78..302c0e60dc2c 100644
--- a/arch/sparc/lib/copy_in_user.S
+++ b/arch/sparc/lib/copy_in_user.S
@@ -3,19 +3,16 @@
 * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
 */
+#include <linux/linkage.h>
 #include <asm/asi.h>
 #define XCC xcc
 #define EX(x,y)                 \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov 1, %o0;            \
        .section __ex_table,"a";\
        .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
        .text;                  \
        .align 4;
@@ -31,18 +28,7 @@
         * to copy register windows around during thread cloning.
         */
-        .globl          ___copy_in_user
+ENTRY(___copy_in_user)  /* %o0=dst, %o1=src, %o2=len */
-        .type           ___copy_in_user,#function
-___copy_in_user:        /* %o0=dst, %o1=src, %o2=len */
-        /* Writing to %asi is _expensive_ so we hardcode it.
-         * Reading %asi to check for KERNEL_DS is comparatively
-         * cheap.
-         */
-        rd              %asi, %g1
-        cmp             %g1, ASI_AIUS
-        bne,pn          %icc, memcpy_user_stub
-         nop
        cmp             %o2, 0
        be,pn           %XCC, 85f
         or             %o0, %o1, %o3
@@ -53,22 +39,24 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
        /* 16 < len <= 64 */
        andcc           %o3, 0x7, %g0
        bne,pn          %XCC, 90f
-         sub            %o0, %o1, %o3
+         nop
        andn            %o2, 0x7, %o4
        and             %o2, 0x7, %o2
 1:      subcc           %o4, 0x8, %o4
        EX(ldxa [%o1] %asi, %o5)
-        EX(stxa %o5, [%o1 + %o3] ASI_AIUS)
+        EX(stxa %o5, [%o0] %asi)
+        add             %o1, 0x8, %o1
        bgu,pt          %XCC, 1b
-         add            %o1, 0x8, %o1
+         add            %o0, 0x8, %o0
        andcc           %o2, 0x4, %g0
        be,pt           %XCC, 1f
         nop
        sub             %o2, 0x4, %o2
        EX(lduwa [%o1] %asi, %o5)
-        EX(stwa %o5, [%o1 + %o3] ASI_AIUS)
+        EX(stwa %o5, [%o0] %asi)
        add             %o1, 0x4, %o1
+        add             %o0, 0x4, %o0
 1:      cmp             %o2, 0
        be,pt           %XCC, 85f
         nop
@@ -78,14 +66,15 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
 80:     /* 0 < len <= 16 */
        andcc           %o3, 0x3, %g0
        bne,pn          %XCC, 90f
-         sub            %o0, %o1, %o3
+         nop
 82:
        subcc           %o2, 4, %o2
        EX(lduwa [%o1] %asi, %g1)
-        EX(stwa %g1, [%o1 + %o3] ASI_AIUS)
+        EX(stwa %g1, [%o0] %asi)
+        add             %o1, 4, %o1
        bgu,pt          %XCC, 82b
-         add            %o1, 4, %o1
+         add            %o0, 4, %o0
 85:     retl
         clr            %o0
@@ -94,26 +83,10 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
 90:
        subcc           %o2, 1, %o2
        EX(lduba [%o1] %asi, %g1)
-        EX(stba %g1, [%o1 + %o3] ASI_AIUS)
+        EX(stba %g1, [%o0] %asi)
+        add             %o1, 1, %o1
        bgu,pt          %XCC, 90b
-         add            %o1, 1, %o1
+         add            %o0, 1, %o0
        retl
         clr            %o0
+ENDPROC(___copy_in_user)
-        .size           ___copy_in_user, .-___copy_in_user
-        /* Act like copy_{to,in}_user(), ie. return zero instead
-         * of original destination pointer.  This is invoked when
-         * copy_{to,in}_user() finds that %asi is kernel space.
-         */
-        .globl          memcpy_user_stub
-        .type           memcpy_user_stub,#function
-memcpy_user_stub:
-        save            %sp, -192, %sp
-        mov             %i0, %o0
-        mov             %i1, %o1
-        call            memcpy
-         mov            %i2, %o2
-        ret
-         restore        %g0, %g0, %o0
-        .size           memcpy_user_stub, .-memcpy_user_stub
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 2cf7bbcaed4e..8fc9a847cf48 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1803,6 +1803,17 @@ config DMAR
          and include PCI device scope covered by these DMA
          remapping devices.
+config DMAR_DEFAULT_ON
+        def_bool n
+        prompt "Enable DMA Remapping Devices by default"
+        depends on DMAR
+        help
+          Selecting this option will enable a DMAR device at boot time if
+          one is found. If this option is not selected, DMAR support can
+          be enabled by passing intel_iommu=on to the kernel. It is
+          recommended you say N here while the DMAR code remains
+          experimental.
 config DMAR_GFX_WA
        def_bool y
        prompt "Support for Graphics workaround"
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 8078955845ae..c98d52e82966 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -167,9 +167,9 @@ config MK7
 config MK8
        bool "Opteron/Athlon64/Hammer/K8"
        help
-          Select this for an AMD Opteron or Athlon64 Hammer-family processor.  Enables
+          Select this for an AMD Opteron or Athlon64 Hammer-family processor.
-          use of some extended instructions, and passes appropriate optimization
+          Enables use of some extended instructions, and passes appropriate
-          flags to GCC.
+          optimization flags to GCC.
 config MCRUSOE
        bool "Crusoe"
@@ -256,9 +256,11 @@ config MPSC
 config MCORE2
        bool "Core 2/newer Xeon"
        help
-          Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and 53xx)
-          CPUs. You can distinguish newer from older Xeons by the CPU family
+          Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-          in /proc/cpuinfo. Newer ones have 6 and older ones 15 (not a typo)
+          53xx) CPUs. You can distinguish newer from older Xeons by the CPU
+          family in /proc/cpuinfo. Newer ones have 6 and older ones 15
+          (not a typo)
 config GENERIC_CPU
        bool "Generic-x86-64"
@@ -320,14 +322,14 @@ config X86_PPRO_FENCE
        bool "PentiumPro memory ordering errata workaround"
        depends on M686 || M586MMX || M586TSC || M586 || M486 || M386 || MGEODEGX1
        help
-          Old PentiumPro multiprocessor systems had errata that could cause memory
+          Old PentiumPro multiprocessor systems had errata that could cause
-          operations to violate the x86 ordering standard in rare cases. Enabling this
+          memory operations to violate the x86 ordering standard in rare cases.
-          option will attempt to work around some (but not all) occurances of
+          Enabling this option will attempt to work around some (but not all)
-          this problem, at the cost of much heavier spinlock and memory barrier
+          occurances of this problem, at the cost of much heavier spinlock and
-          operations.
+          memory barrier operations.
-          If unsure, say n here. Even distro kernels should think twice before enabling
+          If unsure, say n here. Even distro kernels should think twice before
-          this: there are few systems, and an unlikely bug.
+          enabling this: there are few systems, and an unlikely bug.
 config X86_F00F_BUG
        def_bool y
diff --git a/arch/x86/include/asm/a.out-core.h b/arch/x86/include/asm/a.out-core.h
index 37822206083e..3c601f8224be 100644
--- a/arch/x86/include/asm/a.out-core.h
+++ b/arch/x86/include/asm/a.out-core.h
@@ -23,8 +23,6 @@
 */
 static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
 {
-        u16 gs;
 /* changed the size calculations - should hopefully work better. lbt */
        dump->magic = CMAGIC;
        dump->start_code = 0;
@@ -57,7 +55,7 @@ static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
        dump->regs.ds = (u16)regs->ds;
        dump->regs.es = (u16)regs->es;
        dump->regs.fs = (u16)regs->fs;
-        savesegment(gs, gs);
+        savesegment(gs, dump->regs.gs);
        dump->regs.orig_ax = regs->orig_ax;
        dump->regs.ip = regs->ip;
        dump->regs.cs = (u16)regs->cs;
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index ea408dcba513..7301e60dc4a8 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -93,6 +93,7 @@
 #define X86_FEATURE_XTOPOLOGY   (3*32+22) /* cpu topology enum extensions */
 #define X86_FEATURE_TSC_RELIABLE (3*32+23) /* TSC is known to be reliable */
 #define X86_FEATURE_NONSTOP_TSC (3*32+24) /* TSC does not stop in C states */
+#define X86_FEATURE_CLFLUSH_MONITOR (3*32+25) /* "" clflush reqd with monitor */
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
 #define X86_FEATURE_XMM3        (4*32+ 0) /* "pni" SSE-3 */
diff --git a/arch/x86/include/asm/math_emu.h b/arch/x86/include/asm/math_emu.h
index 5a65b107ad58..031f6266f425 100644
--- a/arch/x86/include/asm/math_emu.h
+++ b/arch/x86/include/asm/math_emu.h
@@ -1,31 +1,18 @@
 #ifndef _ASM_X86_MATH_EMU_H
 #define _ASM_X86_MATH_EMU_H
+#include <asm/ptrace.h>
+#include <asm/vm86.h>
 /* This structure matches the layout of the data saved to the stack
   following a device-not-present interrupt, part of it saved
   automatically by the 80386/80486.
   */
-struct info {
+struct math_emu_info {
        long ___orig_eip;
-        long ___ebx;
+        union {
-        long ___ecx;
+                struct pt_regs *regs;
-        long ___edx;
+                struct kernel_vm86_regs *vm86;
-        long ___esi;
+        };
-        long ___edi;
-        long ___ebp;
-        long ___eax;
-        long ___ds;
-        long ___es;
-        long ___fs;
-        long ___orig_eax;
-        long ___eip;
-        long ___cs;
-        long ___eflags;
-        long ___esp;
-        long ___ss;
-        long ___vm86_es; /* This and the following only in vm86 mode */
-        long ___vm86_ds;
-        long ___vm86_fs;
-        long ___vm86_gs;
 };
 #endif /* _ASM_X86_MATH_EMU_H */
diff --git a/arch/x86/include/asm/mpspec.h b/arch/x86/include/asm/mpspec.h
index 62d14ce3cd00..bd22f2a3713f 100644
--- a/arch/x86/include/asm/mpspec.h
+++ b/arch/x86/include/asm/mpspec.h
@@ -60,6 +60,7 @@ extern void mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger,
                                   u32 gsi);
 extern void mp_config_acpi_legacy_irqs(void);
 extern int mp_register_gsi(u32 gsi, int edge_level, int active_high_low);
+extern int acpi_probe_gsi(void);
 #ifdef CONFIG_X86_IO_APIC
 extern int mp_config_acpi_gsi(unsigned char number, unsigned int devfn, u8 pin,
                                u32 gsi, int triggering, int polarity);
@@ -71,6 +72,11 @@ mp_config_acpi_gsi(unsigned char number, unsigned int devfn, u8 pin,
        return 0;
 }
 #endif
+#else /* !CONFIG_ACPI: */
+static inline int acpi_probe_gsi(void)
+{
+        return 0;
+}
 #endif /* CONFIG_ACPI */
 #define PHYSID_ARRAY_SIZE       BITS_TO_LONGS(MAX_APICS)
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 06bbcbd66e9c..4f5af8447d54 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -302,16 +302,30 @@ static inline pte_t pte_mkspecial(pte_t pte)
 extern pteval_t __supported_pte_mask;
+/*
+ * Mask out unsupported bits in a present pgprot.  Non-present pgprots
+ * can use those bits for other purposes, so leave them be.
+ */
+static inline pgprotval_t massage_pgprot(pgprot_t pgprot)
+{
+        pgprotval_t protval = pgprot_val(pgprot);
+        if (protval & _PAGE_PRESENT)
+                protval &= __supported_pte_mask;
+        return protval;
+}
 static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot)
 {
-        return __pte((((phys_addr_t)page_nr << PAGE_SHIFT) |
+        return __pte(((phys_addr_t)page_nr << PAGE_SHIFT) |
-                      pgprot_val(pgprot)) & __supported_pte_mask);
+                     massage_pgprot(pgprot));
 }
 static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
 {
-        return __pmd((((phys_addr_t)page_nr << PAGE_SHIFT) |
+        return __pmd(((phys_addr_t)page_nr << PAGE_SHIFT) |
-                      pgprot_val(pgprot)) & __supported_pte_mask);
+                     massage_pgprot(pgprot));
 }
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
@@ -323,7 +337,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
         * the newprot (if present):
         */
        val &= _PAGE_CHG_MASK;
-        val |= pgprot_val(newprot) & (~_PAGE_CHG_MASK) & __supported_pte_mask;
+        val |= massage_pgprot(newprot) & ~_PAGE_CHG_MASK;
        return __pte(val);
 }
@@ -339,7 +353,7 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
 #define pte_pgprot(x) __pgprot(pte_flags(x) & PTE_FLAGS_MASK)
-#define canon_pgprot(p) __pgprot(pgprot_val(p) & __supported_pte_mask)
+#define canon_pgprot(p) __pgprot(massage_pgprot(p))
 static inline int is_new_memtype_allowed(unsigned long flags,
                                                unsigned long new_flags)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 091cd8855f2e..3bfd5235a9eb 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -353,7 +353,7 @@ struct i387_soft_struct {
        u8                      no_update;
        u8                      rm;
        u8                      alimit;
-        struct info             *info;
+        struct math_emu_info    *info;
        u32                     entry_eip;
 };
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 2ee0a3bceedf..cf3bb053da0b 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -41,7 +41,7 @@ dotraplinkage void do_int3(struct pt_regs *, long);
 dotraplinkage void do_overflow(struct pt_regs *, long);
 dotraplinkage void do_bounds(struct pt_regs *, long);
 dotraplinkage void do_invalid_op(struct pt_regs *, long);
-dotraplinkage void do_device_not_available(struct pt_regs *, long);
+dotraplinkage void do_device_not_available(struct pt_regs);
 dotraplinkage void do_coprocessor_segment_overrun(struct pt_regs *, long);
 dotraplinkage void do_invalid_TSS(struct pt_regs *, long);
 dotraplinkage void do_segment_not_present(struct pt_regs *, long);
@@ -77,7 +77,7 @@ extern int panic_on_unrecovered_nmi;
 extern int kstack_depth_to_print;
 void math_error(void __user *);
-asmlinkage void math_emulate(long);
+void math_emulate(struct math_emu_info *);
 #ifdef CONFIG_X86_32
 unsigned long patch_espfix_desc(unsigned long, unsigned long);
 #else
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 7ef617ef1df3..4bd990ee43df 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -137,7 +137,7 @@ static inline pte_t mfn_pte(unsigned long page_nr, pgprot_t pgprot)
        pte_t pte;
        pte.pte = ((phys_addr_t)page_nr << PAGE_SHIFT) |
-                (pgprot_val(pgprot) & __supported_pte_mask);
+                        massage_pgprot(pgprot);
        return pte;
 }
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index d37593c2f438..7678f10c4568 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -973,6 +973,29 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
        nr_ioapics++;
 }
+int __init acpi_probe_gsi(void)
+{
+        int idx;
+        int gsi;
+        int max_gsi = 0;
+        if (acpi_disabled)
+                return 0;
+        if (!acpi_ioapic)
+                return 0;
+        max_gsi = 0;
+        for (idx = 0; idx < nr_ioapics; idx++) {
+                gsi = mp_ioapic_routing[idx].gsi_end;
+                if (gsi > max_gsi)
+                        max_gsi = gsi;
+        }
+        return max_gsi + 1;
+}
 static void assign_to_mp_irq(struct mp_config_intsrc *m,
                                    struct mp_config_intsrc *mp_irq)
 {
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 430e5c38a544..24ff26a38ade 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -291,6 +291,9 @@ static void __cpuinit init_intel(struct cpuinfo_x86 *c)
                ds_init_intel(c);
        }
+        if (c->x86 == 6 && c->x86_model == 29 && cpu_has_clflush)
+                set_cpu_cap(c, X86_FEATURE_CLFLUSH_MONITOR);
 #ifdef CONFIG_X86_64
        if (c->x86 == 15)
                c->x86_cache_alignment = c->x86_clflush_size * 2;
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index f20f49f7d244..2f9c0c8cb4c7 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -468,8 +468,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
         * ignore such a protection.
         */
        asm volatile(
-                "1: " _ASM_MOV " (%[parent_old]), %[old]\n"
+                "1: " _ASM_MOV " (%[parent]), %[old]\n"
-                "2: " _ASM_MOV " %[return_hooker], (%[parent_replaced])\n"
+                "2: " _ASM_MOV " %[return_hooker], (%[parent])\n"
                "   movl $0, %[faulted]\n"
                "3:\n"
@@ -481,9 +481,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
                _ASM_EXTABLE(1b, 4b)
                _ASM_EXTABLE(2b, 4b)
-                : [parent_replaced] "=r" (parent), [old] "=r" (old),
+                : [old] "=r" (old), [faulted] "=r" (faulted)
-                  [faulted] "=r" (faulted)
+                : [parent] "r" (parent), [return_hooker] "r" (return_hooker)
-                : [parent_old] "0" (parent), [return_hooker] "r" (return_hooker)
                : "memory"
        );
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 64d5ad0b8add..388254f69a2a 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -897,7 +897,7 @@ static unsigned long hpet_rtc_flags;
 static int hpet_prev_update_sec;
 static struct rtc_time hpet_alarm_time;
 static unsigned long hpet_pie_count;
-static unsigned long hpet_t1_cmp;
+static u32 hpet_t1_cmp;
 static unsigned long hpet_default_delta;
 static unsigned long hpet_pie_delta;
 static unsigned long hpet_pie_limit;
@@ -905,6 +905,14 @@ static unsigned long hpet_pie_limit;
 static rtc_irq_handler irq_handler;
 /*
+ * Check that the hpet counter c1 is ahead of the c2
+ */
+static inline int hpet_cnt_ahead(u32 c1, u32 c2)
+{
+        return (s32)(c2 - c1) < 0;
+}
+/*
 * Registers a IRQ handler.
 */
 int hpet_register_irq_handler(rtc_irq_handler handler)
@@ -1075,7 +1083,7 @@ static void hpet_rtc_timer_reinit(void)
                hpet_t1_cmp += delta;
                hpet_writel(hpet_t1_cmp, HPET_T1_CMP);
                lost_ints++;
-        } while ((long)(hpet_readl(HPET_COUNTER) - hpet_t1_cmp) > 0);
+        } while (!hpet_cnt_ahead(hpet_t1_cmp, hpet_readl(HPET_COUNTER)));
        if (lost_ints) {
                if (hpet_rtc_flags & RTC_PIE)
diff --git a/arch/x86/kernel/i8237.c b/arch/x86/kernel/i8237.c
index dbd6c1d1b638..b42ca694dc68 100644
--- a/arch/x86/kernel/i8237.c
+++ b/arch/x86/kernel/i8237.c
@@ -28,10 +28,10 @@ static int i8237A_resume(struct sys_device *dev)
        flags = claim_dma_lock();
-        dma_outb(DMA1_RESET_REG, 0);
+        dma_outb(0, DMA1_RESET_REG);
-        dma_outb(DMA2_RESET_REG, 0);
+        dma_outb(0, DMA2_RESET_REG);
-        for (i = 0;i < 8;i++) {
+        for (i = 0; i < 8; i++) {
                set_dma_addr(i, 0x000000);
                /* DMA count is a bit weird so this is not 0 */
                set_dma_count(i, 1);
@@ -51,14 +51,14 @@ static int i8237A_suspend(struct sys_device *dev, pm_message_t state)
 }
 static struct sysdev_class i8237_sysdev_class = {
-        .name = "i8237",
+        .name           = "i8237",
-        .suspend = i8237A_suspend,
+        .suspend        = i8237A_suspend,
-        .resume = i8237A_resume,
+        .resume         = i8237A_resume,
 };
 static struct sys_device device_i8237A = {
-        .id     = 0,
+        .id             = 0,
-        .cls    = &i8237_sysdev_class,
+        .cls            = &i8237_sysdev_class,
 };
 static int __init i8237A_init_sysfs(void)
@@ -68,5 +68,4 @@ static int __init i8237A_init_sysfs(void)
                error = sysdev_register(&device_i8237A);
        return error;
 }
 device_initcall(i8237A_init_sysfs);
diff --git a/arch/x86/kernel/io_apic.c b/arch/x86/kernel/io_apic.c
index 9b0c480c383b..bc7ac4da90d7 100644
--- a/arch/x86/kernel/io_apic.c
+++ b/arch/x86/kernel/io_apic.c
@@ -3841,14 +3841,24 @@ int __init io_apic_get_redir_entries (int ioapic)
 void __init probe_nr_irqs_gsi(void)
 {
-        int idx;
        int nr = 0;
-        for (idx = 0; idx < nr_ioapics; idx++)
+        nr = acpi_probe_gsi();
-                nr += io_apic_get_redir_entries(idx) + 1;
+        if (nr > nr_irqs_gsi) {
-        if (nr > nr_irqs_gsi)
                nr_irqs_gsi = nr;
+        } else {
+                /* for acpi=off or acpi is not compiled in */
+                int idx;
+                nr = 0;
+                for (idx = 0; idx < nr_ioapics; idx++)
+                        nr += io_apic_get_redir_entries(idx) + 1;
+                if (nr > nr_irqs_gsi)
+                        nr_irqs_gsi = nr;
+        }
+        printk(KERN_DEBUG "nr_irqs_gsi: %d\n", nr_irqs_gsi);
 }
 /* --------------------------------------------------------------------------
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 026819ffcb0c..51126b7c0923 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -180,6 +180,9 @@ void mwait_idle_with_hints(unsigned long ax, unsigned long cx)
        trace_power_start(&it, POWER_CSTATE, (ax>>4)+1);
        if (!need_resched()) {
+                if (cpu_has(&current_cpu_data, X86_FEATURE_CLFLUSH_MONITOR))
+                        clflush((void *)&current_thread_info()->flags);
                __monitor((void *)&current_thread_info()->flags, 0, 0);
                smp_mb();
                if (!need_resched())
@@ -194,6 +197,9 @@ static void mwait_idle(void)
        struct power_trace it;
        if (!need_resched()) {
                trace_power_start(&it, POWER_CSTATE, 1);
+                if (cpu_has(&current_cpu_data, X86_FEATURE_CLFLUSH_MONITOR))
+                        clflush((void *)&current_thread_info()->flags);
                __monitor((void *)&current_thread_info()->flags, 0, 0);
                smp_mb();
                if (!need_resched())
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 416fb9282f4f..85b4cb5c1980 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -40,6 +40,7 @@
 #include <linux/uaccess.h>
 #include <linux/io.h>
 #include <linux/ftrace.h>
+#include <linux/dmi.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
@@ -151,14 +152,18 @@ void __show_regs(struct pt_regs *regs, int all)
        unsigned long d0, d1, d2, d3, d6, d7;
        unsigned int fsindex, gsindex;
        unsigned int ds, cs, es;
+        const char *board;
        printk("\n");
        print_modules();
-        printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s\n",
+        board = dmi_get_system_info(DMI_PRODUCT_NAME);
+        if (!board)
+                board = "";
+        printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
                current->pid, current->comm, print_tainted(),
                init_utsname()->release,
                (int)strcspn(init_utsname()->version, " "),
-                init_utsname()->version);
+                init_utsname()->version, board);
        printk(KERN_INFO "RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip);
        printk_address(regs->ip, 1);
        printk(KERN_INFO "RSP: %04lx:%016lx  EFLAGS: %08lx\n", regs->ss,
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index ae0d8042cf69..c461f6d69074 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -607,7 +607,7 @@ struct x86_quirks *x86_quirks __initdata = &default_x86_quirks;
 static int __init dmi_low_memory_corruption(const struct dmi_system_id *d)
 {
        printk(KERN_NOTICE
-                "%s detected: BIOS may corrupt low RAM, working it around.\n",
+                "%s detected: BIOS may corrupt low RAM, working around it.\n",
                d->ident);
        e820_update_range(0, 0x10000, E820_RAM, E820_RESERVED);
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 98c2d055284b..7932338d7cb3 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -896,7 +896,7 @@ asmlinkage void math_state_restore(void)
 EXPORT_SYMBOL_GPL(math_state_restore);
 #ifndef CONFIG_MATH_EMULATION
-asmlinkage void math_emulate(long arg)
+void math_emulate(struct math_emu_info *info)
 {
        printk(KERN_EMERG
                "math-emulation not enabled and no coprocessor found.\n");
@@ -906,16 +906,19 @@ asmlinkage void math_emulate(long arg)
 }
 #endif /* CONFIG_MATH_EMULATION */
-dotraplinkage void __kprobes
+dotraplinkage void __kprobes do_device_not_available(struct pt_regs regs)
-do_device_not_available(struct pt_regs *regs, long error)
 {
 #ifdef CONFIG_X86_32
        if (read_cr0() & X86_CR0_EM) {
-                conditional_sti(regs);
+                struct math_emu_info info = { };
-                math_emulate(0);
+                conditional_sti(&regs);
+                info.regs = &regs;
+                math_emulate(&info);
        } else {
                math_state_restore(); /* interrupts still off */
-                conditional_sti(regs);
+                conditional_sti(&regs);
        }
 #else
        math_state_restore();
diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
index 1d3302cc2ddf..bef58b4982db 100644
--- a/arch/x86/kernel/vmi_32.c
+++ b/arch/x86/kernel/vmi_32.c
@@ -321,6 +321,16 @@ static void vmi_release_pmd(unsigned long pfn)
 }
 /*
+ * We use the pgd_free hook for releasing the pgd page:
+ */
+static void vmi_pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+        unsigned long pfn = __pa(pgd) >> PAGE_SHIFT;
+        vmi_ops.release_page(pfn, VMI_PAGE_L2);
+}
+/*
 * Helper macros for MMU update flags.  We can defer updates until a flush
 * or page invalidation only if the update is to the current address space
 * (otherwise, there is no flush).  We must check against init_mm, since
@@ -762,6 +772,7 @@ static inline int __init activate_vmi(void)
        if (vmi_ops.release_page) {
                pv_mmu_ops.release_pte = vmi_release_pte;
                pv_mmu_ops.release_pmd = vmi_release_pmd;
+                pv_mmu_ops.pgd_free = vmi_pgd_free;
        }
        /* Set linear is needed in all cases */
diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
index c7b06feb139b..5d87f586f8d7 100644
--- a/arch/x86/math-emu/fpu_entry.c
+++ b/arch/x86/math-emu/fpu_entry.c
@@ -131,7 +131,7 @@ u_char emulating = 0;
 static int valid_prefix(u_char *Byte, u_char __user ** fpu_eip,
                        overrides * override);
-asmlinkage void math_emulate(long arg)
+void math_emulate(struct math_emu_info *info)
 {
        u_char FPU_modrm, byte1;
        unsigned short code;
@@ -161,7 +161,7 @@ asmlinkage void math_emulate(long arg)
        RE_ENTRANT_CHECK_ON;
 #endif /* RE_ENTRANT_CHECKING */
-        SETUP_DATA_AREA(arg);
+        FPU_info = info;
        FPU_ORIG_EIP = FPU_EIP;
@@ -659,7 +659,7 @@ static int valid_prefix(u_char *Byte, u_char __user **fpu_eip,
        }
 }
-void math_abort(struct info *info, unsigned int signal)
+void math_abort(struct math_emu_info *info, unsigned int signal)
 {
        FPU_EIP = FPU_ORIG_EIP;
        current->thread.trap_no = 16;
diff --git a/arch/x86/math-emu/fpu_proto.h b/arch/x86/math-emu/fpu_proto.h
index aa49b6a0d850..9779df436b7d 100644
--- a/arch/x86/math-emu/fpu_proto.h
+++ b/arch/x86/math-emu/fpu_proto.h
@@ -51,8 +51,8 @@ extern void ffreep(void);
 extern void fst_i_(void);
 extern void fstp_i(void);
 /* fpu_entry.c */
-asmlinkage extern void math_emulate(long arg);
+extern void math_emulate(struct math_emu_info *info);
-extern void math_abort(struct info *info, unsigned int signal);
+extern void math_abort(struct math_emu_info *info, unsigned int signal);
 /* fpu_etc.c */
 extern void FPU_etc(void);
 /* fpu_tags.c */
diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h
index 13488fa153e0..50fa0ec2c8a5 100644
--- a/arch/x86/math-emu/fpu_system.h
+++ b/arch/x86/math-emu/fpu_system.h
@@ -16,10 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
-/* This sets the pointer FPU_info to point to the argument part
-   of the stack frame of math_emulate() */
-#define SETUP_DATA_AREA(arg)    FPU_info = (struct info *) &arg
 /* s is always from a cpu register, and the cpu does bounds checking
 * during register load --> no further bounds checks needed */
 #define LDT_DESCRIPTOR(s)       (((struct desc_struct *)current->mm->context.ldt)[(s) >> 3])
@@ -38,12 +34,12 @@
 #define I387                    (current->thread.xstate)
 #define FPU_info                (I387->soft.info)
-#define FPU_CS                  (*(unsigned short *) &(FPU_info->___cs))
+#define FPU_CS                  (*(unsigned short *) &(FPU_info->regs->cs))
-#define FPU_SS                  (*(unsigned short *) &(FPU_info->___ss))
+#define FPU_SS                  (*(unsigned short *) &(FPU_info->regs->ss))
-#define FPU_DS                  (*(unsigned short *) &(FPU_info->___ds))
+#define FPU_DS                  (*(unsigned short *) &(FPU_info->regs->ds))
-#define FPU_EAX                 (FPU_info->___eax)
+#define FPU_EAX                 (FPU_info->regs->ax)
-#define FPU_EFLAGS              (FPU_info->___eflags)
+#define FPU_EFLAGS              (FPU_info->regs->flags)
-#define FPU_EIP                 (FPU_info->___eip)
+#define FPU_EIP                 (FPU_info->regs->ip)
 #define FPU_ORIG_EIP            (FPU_info->___orig_eip)
 #define FPU_lookahead           (I387->soft.lookahead)
diff --git a/arch/x86/math-emu/get_address.c b/arch/x86/math-emu/get_address.c
index d701e2b39e44..420b3b6e3915 100644
--- a/arch/x86/math-emu/get_address.c
+++ b/arch/x86/math-emu/get_address.c
@@ -29,46 +29,43 @@
 #define FPU_WRITE_BIT 0x10
 static int reg_offset[] = {
-        offsetof(struct info, ___eax),
+        offsetof(struct pt_regs, ax),
-        offsetof(struct info, ___ecx),
+        offsetof(struct pt_regs, cx),
-        offsetof(struct info, ___edx),
+        offsetof(struct pt_regs, dx),
-        offsetof(struct info, ___ebx),
+        offsetof(struct pt_regs, bx),
-        offsetof(struct info, ___esp),
+        offsetof(struct pt_regs, sp),
-        offsetof(struct info, ___ebp),
+        offsetof(struct pt_regs, bp),
-        offsetof(struct info, ___esi),
+        offsetof(struct pt_regs, si),
-        offsetof(struct info, ___edi)
+        offsetof(struct pt_regs, di)
 };
-#define REG_(x) (*(long *)(reg_offset[(x)]+(u_char *) FPU_info))
+#define REG_(x) (*(long *)(reg_offset[(x)] + (u_char *)FPU_info->regs))
 static int reg_offset_vm86[] = {
-        offsetof(struct info, ___cs),
+        offsetof(struct pt_regs, cs),
-        offsetof(struct info, ___vm86_ds),
+        offsetof(struct kernel_vm86_regs, ds),
-        offsetof(struct info, ___vm86_es),
+        offsetof(struct kernel_vm86_regs, es),
-        offsetof(struct info, ___vm86_fs),
+        offsetof(struct kernel_vm86_regs, fs),
-        offsetof(struct info, ___vm86_gs),
+        offsetof(struct kernel_vm86_regs, gs),
-        offsetof(struct info, ___ss),
+        offsetof(struct pt_regs, ss),
-        offsetof(struct info, ___vm86_ds)
+        offsetof(struct kernel_vm86_regs, ds)
 };
 #define VM86_REG_(x) (*(unsigned short *) \
-                      (reg_offset_vm86[((unsigned)x)]+(u_char *) FPU_info))
+                (reg_offset_vm86[((unsigned)x)] + (u_char *)FPU_info->regs))
-/* This dummy, gs is not saved on the stack. */
-#define ___GS ___ds
 static int reg_offset_pm[] = {
-        offsetof(struct info, ___cs),
+        offsetof(struct pt_regs, cs),
-        offsetof(struct info, ___ds),
+        offsetof(struct pt_regs, ds),
-        offsetof(struct info, ___es),
+        offsetof(struct pt_regs, es),
-        offsetof(struct info, ___fs),
+        offsetof(struct pt_regs, fs),
-        offsetof(struct info, ___GS),
+        offsetof(struct pt_regs, ds),   /* dummy, not saved on stack */
-        offsetof(struct info, ___ss),
+        offsetof(struct pt_regs, ss),
-        offsetof(struct info, ___ds)
+        offsetof(struct pt_regs, ds)
 };
 #define PM_REG_(x) (*(unsigned short *) \
-                      (reg_offset_pm[((unsigned)x)]+(u_char *) FPU_info))
+                (reg_offset_pm[((unsigned)x)] + (u_char *)FPU_info->regs))
 /* Decode the SIB byte. This function assumes mod != 0 */
 static int sib(int mod, unsigned long *fpu_eip)
@@ -349,34 +346,34 @@ void __user *FPU_get_address_16(u_char FPU_modrm, unsigned long *fpu_eip,
        }
        switch (rm) {
        case 0:
-                address += FPU_info->___ebx + FPU_info->___esi;
+                address += FPU_info->regs->bx + FPU_info->regs->si;
                break;
        case 1:
-                address += FPU_info->___ebx + FPU_info->___edi;
+                address += FPU_info->regs->bx + FPU_info->regs->di;
                break;
        case 2:
-                address += FPU_info->___ebp + FPU_info->___esi;
+                address += FPU_info->regs->bp + FPU_info->regs->si;
                if (addr_modes.override.segment == PREFIX_DEFAULT)
                        addr_modes.override.segment = PREFIX_SS_;
                break;
        case 3:
-                address += FPU_info->___ebp + FPU_info->___edi;
+                address += FPU_info->regs->bp + FPU_info->regs->di;
                if (addr_modes.override.segment == PREFIX_DEFAULT)
                        addr_modes.override.segment = PREFIX_SS_;
                break;
        case 4:
-                address += FPU_info->___esi;
+                address += FPU_info->regs->si;
                break;
        case 5:
-                address += FPU_info->___edi;
+                address += FPU_info->regs->di;
                break;
        case 6:
-                address += FPU_info->___ebp;
+                address += FPU_info->regs->bp;
                if (addr_modes.override.segment == PREFIX_DEFAULT)
                        addr_modes.override.segment = PREFIX_SS_;
                break;
        case 7:
-                address += FPU_info->___ebx;
+                address += FPU_info->regs->bx;
                break;
        }
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 72fc0f799a64..89d7a6e94c9c 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -685,6 +685,7 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
 out_release_regions:
        pci_release_regions(dev);
 out:
+        kfree(card);
        return err;
 }
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 34f80fa6fed1..8299e2d3b611 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -549,6 +549,15 @@ static void do_nbd_request(struct request_queue * q)
                BUG_ON(lo->magic != LO_MAGIC);
+                if (unlikely(!lo->sock)) {
+                        printk(KERN_ERR "%s: Attempted send on closed socket\n",
+                                lo->disk->disk_name);
+                        req->errors++;
+                        nbd_end_request(req);
+                        spin_lock_irq(q->queue_lock);
+                        continue;
+                }
                spin_lock_irq(&lo->queue_lock);
                list_add_tail(&req->queuelist, &lo->waiting_queue);
                spin_unlock_irq(&lo->queue_lock);
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 726ee8a0277f..ecba4942fc8e 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -4,7 +4,7 @@
 * SLD 9630 TT 1.1 and SLB 9635 TT 1.2 Trusted Platform Module
 * Specifications at www.trustedcomputinggroup.org
 *
- * Copyright (C) 2005, Marcel Selhorst <selhorst@crypto.rub.de>
+ * Copyright (C) 2005, Marcel Selhorst <m.selhorst@sirrix.com>
 * Sirrix AG - security technologies, http://www.sirrix.com and
 * Applied Data Security Group, Ruhr-University Bochum, Germany
 * Project-Homepage: http://www.prosec.rub.de/tpm
@@ -636,7 +636,7 @@ static void __exit cleanup_inf(void)
 module_init(init_inf);
 module_exit(cleanup_inf);
-MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
+MODULE_AUTHOR("Marcel Selhorst <m.selhorst@sirrix.com>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
 MODULE_VERSION("1.9");
 MODULE_LICENSE("GPL");
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 595ba8eb4a07..0b28141e43bf 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -4599,6 +4599,7 @@ init_e1_port(struct hfc_multi *hc, struct hm_map *m)
                        printk(KERN_ERR "%s: no memory for coeffs\n",
                            __func__);
                        ret = -ENOMEM;
+                        kfree(bch);
                        goto free_chan;
                }
                bch->nr = ch;
@@ -4767,6 +4768,7 @@ init_multi_port(struct hfc_multi *hc, int pt)
                        printk(KERN_ERR "%s: no memory for coeffs\n",
                            __func__);
                        ret = -ENOMEM;
+                        kfree(bch);
                        goto free_chan;
                }
                bch->nr = ch + 1;
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 535c234286ea..8c694213035b 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1475,6 +1475,7 @@ el3_resume(struct device *pdev)
        spin_lock_irqsave(&lp->lock, flags);
        outw(PowerUp, ioaddr + EL3_CMD);
+        EL3WINDOW(0);
        el3_up(dev);
        if (netif_running(dev))
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index acae2d8cd688..9b12a13a640f 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1629,6 +1629,12 @@ static void gfar_schedule_cleanup(struct net_device *dev)
        if (netif_rx_schedule_prep(&priv->napi)) {
                gfar_write(&priv->regs->imask, IMASK_RTX_DISABLED);
                __netif_rx_schedule(&priv->napi);
+        } else {
+                /*
+                 * Clear IEVENT, so interrupts aren't called again
+                 * because of the packets that have already arrived.
+                 */
+                gfar_write(&priv->regs->ievent, IEVENT_RTX_MASK);
        }
        spin_unlock(&priv->rxlock);
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 9c78c963b721..f4dd9acb6877 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -1203,7 +1203,7 @@ typedef struct {
 #define NETXEN_IS_MSI_FAMILY(adapter) \
        ((adapter)->flags & (NETXEN_NIC_MSI_ENABLED | NETXEN_NIC_MSIX_ENABLED))
-#define MSIX_ENTRIES_PER_ADAPTER        8
+#define MSIX_ENTRIES_PER_ADAPTER        1
 #define NETXEN_MSIX_TBL_SPACE           8192
 #define NETXEN_PCI_REG_MSIX_TBL         0x44
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 645d384fe87e..3b17a7936147 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -76,6 +76,7 @@ static void netxen_nic_poll_controller(struct net_device *netdev);
 #endif
 static irqreturn_t netxen_intr(int irq, void *data);
 static irqreturn_t netxen_msi_intr(int irq, void *data);
+static irqreturn_t netxen_msix_intr(int irq, void *data);
 /*  PCI Device ID Table  */
 #define ENTRY(device) \
@@ -1084,7 +1085,9 @@ static int netxen_nic_open(struct net_device *netdev)
                        for (ring = 0; ring < adapter->max_rds_rings; ring++)
                                netxen_post_rx_buffers(adapter, ctx, ring);
                }
-                if (NETXEN_IS_MSI_FAMILY(adapter))
+                if (adapter->flags & NETXEN_NIC_MSIX_ENABLED)
+                        handler = netxen_msix_intr;
+                else if (adapter->flags & NETXEN_NIC_MSI_ENABLED)
                        handler = netxen_msi_intr;
                else {
                        flags |= IRQF_SHARED;
@@ -1612,6 +1615,14 @@ static irqreturn_t netxen_msi_intr(int irq, void *data)
        return IRQ_HANDLED;
 }
+static irqreturn_t netxen_msix_intr(int irq, void *data)
+{
+        struct netxen_adapter *adapter = data;
+        napi_schedule(&adapter->napi);
+        return IRQ_HANDLED;
+}
 static int netxen_nic_poll(struct napi_struct *napi, int budget)
 {
        struct netxen_adapter *adapter = container_of(napi, struct netxen_adapter, napi);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 2c73ca606b35..0771eb6fc6eb 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -437,6 +437,22 @@ enum features {
        RTL_FEATURE_GMII        = (1 << 2),
 };
+struct rtl8169_counters {
+        __le64  tx_packets;
+        __le64  rx_packets;
+        __le64  tx_errors;
+        __le32  rx_errors;
+        __le16  rx_missed;
+        __le16  align_errors;
+        __le32  tx_one_collision;
+        __le32  tx_multi_collision;
+        __le64  rx_unicast;
+        __le64  rx_broadcast;
+        __le32  rx_multicast;
+        __le16  tx_aborted;
+        __le16  tx_underun;
+};
 struct rtl8169_private {
        void __iomem *mmio_addr;        /* memory map physical address */
        struct pci_dev *pci_dev;        /* Index of PCI device */
@@ -480,6 +496,7 @@ struct rtl8169_private {
        unsigned features;
        struct mii_if_info mii;
+        struct rtl8169_counters counters;
 };
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -1100,22 +1117,6 @@ static const char rtl8169_gstrings[][ETH_GSTRING_LEN] = {
        "tx_underrun",
 };
-struct rtl8169_counters {
-        __le64  tx_packets;
-        __le64  rx_packets;
-        __le64  tx_errors;
-        __le32  rx_errors;
-        __le16  rx_missed;
-        __le16  align_errors;
-        __le32  tx_one_collision;
-        __le32  tx_multi_collision;
-        __le64  rx_unicast;
-        __le64  rx_broadcast;
-        __le32  rx_multicast;
-        __le16  tx_aborted;
-        __le16  tx_underun;
-};
 static int rtl8169_get_sset_count(struct net_device *dev, int sset)
 {
        switch (sset) {
@@ -1126,16 +1127,21 @@ static int rtl8169_get_sset_count(struct net_device *dev, int sset)
        }
 }
-static void rtl8169_get_ethtool_stats(struct net_device *dev,
+static void rtl8169_update_counters(struct net_device *dev)
-                                      struct ethtool_stats *stats, u64 *data)
 {
        struct rtl8169_private *tp = netdev_priv(dev);
        void __iomem *ioaddr = tp->mmio_addr;
        struct rtl8169_counters *counters;
        dma_addr_t paddr;
        u32 cmd;
+        int wait = 1000;
-        ASSERT_RTNL();
+        /*
+         * Some chips are unable to dump tally counters when the receiver
+         * is disabled.
+         */
+        if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
+                return;
        counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
        if (!counters)
@@ -1146,31 +1152,45 @@ static void rtl8169_get_ethtool_stats(struct net_device *dev,
        RTL_W32(CounterAddrLow, cmd);
        RTL_W32(CounterAddrLow, cmd | CounterDump);
-        while (RTL_R32(CounterAddrLow) & CounterDump) {
+        while (wait--) {
-                if (msleep_interruptible(1))
+                if ((RTL_R32(CounterAddrLow) & CounterDump) == 0) {
+                        /* copy updated counters */
+                        memcpy(&tp->counters, counters, sizeof(*counters));
                        break;
+                }
+                udelay(10);
        }
        RTL_W32(CounterAddrLow, 0);
        RTL_W32(CounterAddrHigh, 0);
-        data[0] = le64_to_cpu(counters->tx_packets);
-        data[1] = le64_to_cpu(counters->rx_packets);
-        data[2] = le64_to_cpu(counters->tx_errors);
-        data[3] = le32_to_cpu(counters->rx_errors);
-        data[4] = le16_to_cpu(counters->rx_missed);
-        data[5] = le16_to_cpu(counters->align_errors);
-        data[6] = le32_to_cpu(counters->tx_one_collision);
-        data[7] = le32_to_cpu(counters->tx_multi_collision);
-        data[8] = le64_to_cpu(counters->rx_unicast);
-        data[9] = le64_to_cpu(counters->rx_broadcast);
-        data[10] = le32_to_cpu(counters->rx_multicast);
-        data[11] = le16_to_cpu(counters->tx_aborted);
-        data[12] = le16_to_cpu(counters->tx_underun);
        pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
 }
+static void rtl8169_get_ethtool_stats(struct net_device *dev,
+                                      struct ethtool_stats *stats, u64 *data)
+{
+        struct rtl8169_private *tp = netdev_priv(dev);
+        ASSERT_RTNL();
+        rtl8169_update_counters(dev);
+        data[0] = le64_to_cpu(tp->counters.tx_packets);
+        data[1] = le64_to_cpu(tp->counters.rx_packets);
+        data[2] = le64_to_cpu(tp->counters.tx_errors);
+        data[3] = le32_to_cpu(tp->counters.rx_errors);
+        data[4] = le16_to_cpu(tp->counters.rx_missed);
+        data[5] = le16_to_cpu(tp->counters.align_errors);
+        data[6] = le32_to_cpu(tp->counters.tx_one_collision);
+        data[7] = le32_to_cpu(tp->counters.tx_multi_collision);
+        data[8] = le64_to_cpu(tp->counters.rx_unicast);
+        data[9] = le64_to_cpu(tp->counters.rx_broadcast);
+        data[10] = le32_to_cpu(tp->counters.rx_multicast);
+        data[11] = le16_to_cpu(tp->counters.tx_aborted);
+        data[12] = le16_to_cpu(tp->counters.tx_underun);
+}
 static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
 {
        switch(stringset) {
@@ -3682,6 +3702,9 @@ static int rtl8169_close(struct net_device *dev)
        struct rtl8169_private *tp = netdev_priv(dev);
        struct pci_dev *pdev = tp->pci_dev;
+        /* update counters before going down */
+        rtl8169_update_counters(dev);
        rtl8169_down(dev);
        free_irq(dev->irq, dev);
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index b17efa9cc530..491876341068 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2221,6 +2221,8 @@ static int gem_do_start(struct net_device *dev)
        gp->running = 1;
+        napi_enable(&gp->napi);
        if (gp->lstate == link_up) {
                netif_carrier_on(gp->dev);
                gem_set_link_modes(gp);
@@ -2238,6 +2240,8 @@ static int gem_do_start(struct net_device *dev)
                spin_lock_irqsave(&gp->lock, flags);
                spin_lock(&gp->tx_lock);
+                napi_disable(&gp->napi);
                gp->running =  0;
                gem_reset(gp);
                gem_clean_rings(gp);
@@ -2338,8 +2342,6 @@ static int gem_open(struct net_device *dev)
        if (!gp->asleep)
                rc = gem_do_start(dev);
        gp->opened = (rc == 0);
-        if (gp->opened)
-                napi_enable(&gp->napi);
        mutex_unlock(&gp->pm_mutex);
@@ -2476,8 +2478,6 @@ static int gem_resume(struct pci_dev *pdev)
                /* Re-attach net device */
                netif_device_attach(dev);
-                napi_enable(&gp->napi);
        }
        spin_lock_irqsave(&gp->lock, flags);
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 7a72a3112f0a..cc4013be5e18 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -2629,6 +2629,14 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
        int i, qfe_slot = -1;
        int err = -ENODEV;
+        sbus_dp = to_of_device(op->dev.parent)->node;
+        if (is_qfe)
+                sbus_dp = to_of_device(op->dev.parent->parent)->node;
+        /* We can match PCI devices too, do not accept those here. */
+        if (strcmp(sbus_dp->name, "sbus"))
+                return err;
        if (is_qfe) {
                qp = quattro_sbus_find(op);
                if (qp == NULL)
@@ -2734,10 +2742,6 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
        if (qp != NULL)
                hp->happy_flags |= HFLAG_QUATTRO;
-        sbus_dp = to_of_device(op->dev.parent)->node;
-        if (is_qfe)
-                sbus_dp = to_of_device(op->dev.parent->parent)->node;
        /* Get the supported DVMA burst sizes from our Happy SBUS. */
        hp->happy_bursts = of_getintprop_default(sbus_dp,
                                                 "burst-sizes", 0x00);
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 0bf2114738be..d4c5ecc51f77 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -464,13 +464,14 @@ static void de_rx (struct de_private *de)
                        drop = 1;
 rx_next:
-                de->rx_ring[rx_tail].opts1 = cpu_to_le32(DescOwn);
                if (rx_tail == (DE_RX_RING_SIZE - 1))
                        de->rx_ring[rx_tail].opts2 =
                                cpu_to_le32(RingEnd | de->rx_buf_sz);
                else
                        de->rx_ring[rx_tail].opts2 = cpu_to_le32(de->rx_buf_sz);
                de->rx_ring[rx_tail].addr1 = cpu_to_le32(mapping);
+                wmb();
+                de->rx_ring[rx_tail].opts1 = cpu_to_le32(DescOwn);
                rx_tail = NEXT_RX(rx_tail);
        }
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index d7b81e4fdd56..09fea31d3e36 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -157,10 +157,16 @@ static int update_filter(struct tap_filter *filter, void __user *arg)
        nexact = n;
-        /* The rest is hashed */
+        /* Remaining multicast addresses are hashed,
+         * unicast will leave the filter disabled. */
        memset(filter->mask, 0, sizeof(filter->mask));
-        for (; n < uf.count; n++)
+        for (; n < uf.count; n++) {
+                if (!is_multicast_ether_addr(addr[n].u)) {
+                        err = 0; /* no filter */
+                        goto done;
+                }
                addr_hash_set(filter->mask, addr[n].u);
+        }
        /* For ALLMULTI just set the mask to all ones.
         * This overrides the mask populated above. */
diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c
index 101ed49a2d15..032db815b0f9 100644
--- a/drivers/parport/parport_serial.c
+++ b/drivers/parport/parport_serial.c
@@ -64,6 +64,11 @@ struct parport_pc_pci {
 static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *card, int autoirq, int autodma)
 {
+        /* the rule described below doesn't hold for this device */
+        if (dev->device == PCI_DEVICE_ID_NETMOS_9835 &&
+                        dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
+                        dev->subsystem_device == 0x0299)
+                return -ENODEV;
        /*
         * Netmos uses the subdevice ID to indicate the number of parallel
         * and serial ports.  The form is 0x00PS, where <P> is the number of
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 3dfecb20d5e7..f4b7c79023ff 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -268,7 +268,12 @@ static long list_size;
 static void domain_remove_dev_info(struct dmar_domain *domain);
-int dmar_disabled;
+#ifdef CONFIG_DMAR_DEFAULT_ON
+int dmar_disabled = 0;
+#else
+int dmar_disabled = 1;
+#endif /*CONFIG_DMAR_DEFAULT_ON*/
 static int __initdata dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
@@ -284,9 +289,12 @@ static int __init intel_iommu_setup(char *str)
        if (!str)
                return -EINVAL;
        while (*str) {
-                if (!strncmp(str, "off", 3)) {
+                if (!strncmp(str, "on", 2)) {
+                        dmar_disabled = 0;
+                        printk(KERN_INFO "Intel-IOMMU: enabled\n");
+                } else if (!strncmp(str, "off", 3)) {
                        dmar_disabled = 1;
-                        printk(KERN_INFO"Intel-IOMMU: disabled\n");
+                        printk(KERN_INFO "Intel-IOMMU: disabled\n");
                } else if (!strncmp(str, "igfx_off", 8)) {
                        dmar_map_gfx = 0;
                        printk(KERN_INFO
diff --git a/drivers/power/pcf50633-charger.c b/drivers/power/pcf50633-charger.c
index e988ec130fcd..41aec2acbb91 100644
--- a/drivers/power/pcf50633-charger.c
+++ b/drivers/power/pcf50633-charger.c
@@ -199,7 +199,8 @@ static int adapter_get_property(struct power_supply *psy,
                        enum power_supply_property psp,
                        union power_supply_propval *val)
 {
-        struct pcf50633_mbc *mbc = container_of(psy, struct pcf50633_mbc, usb);
+        struct pcf50633_mbc *mbc = container_of(psy,
+                                struct pcf50633_mbc, adapter);
        int ret = 0;
        switch (psp) {
diff --git a/drivers/rtc/rtc-au1xxx.c b/drivers/rtc/rtc-au1xxx.c
index 8906a688e6a6..979ed0406ce9 100644
--- a/drivers/rtc/rtc-au1xxx.c
+++ b/drivers/rtc/rtc-au1xxx.c
@@ -81,7 +81,7 @@ static int __devinit au1xtoy_rtc_probe(struct platform_device *pdev)
        if (au_readl(SYS_TOYTRIM) != 32767) {
                /* wait until hardware gives access to TRIM register */
                t = 0x00100000;
-                while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_T0S) && t--)
+                while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_T0S) && --t)
                        msleep(1);
                if (!t) {
diff --git a/drivers/rtc/rtc-pxa.c b/drivers/rtc/rtc-pxa.c
index bd56a033bfd0..bb8cc05605ac 100644
--- a/drivers/rtc/rtc-pxa.c
+++ b/drivers/rtc/rtc-pxa.c
@@ -485,7 +485,7 @@ static void __exit pxa_rtc_exit(void)
 module_init(pxa_rtc_init);
 module_exit(pxa_rtc_exit);
-MODULE_AUTHOR("Robert Jarzmik");
+MODULE_AUTHOR("Robert Jarzmik <robert.jarzmik@free.fr>");
 MODULE_DESCRIPTION("PXA27x/PXA3xx Realtime Clock Driver (RTC)");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:pxa-rtc");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index bd5914994142..08c23a921012 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -57,6 +57,8 @@ static void dasd_device_tasklet(struct dasd_device *);
 static void dasd_block_tasklet(struct dasd_block *);
 static void do_kick_device(struct work_struct *);
 static void dasd_return_cqr_cb(struct dasd_ccw_req *, void *);
+static void dasd_device_timeout(unsigned long);
+static void dasd_block_timeout(unsigned long);
 /*
 * SECTION: Operations on the device structure.
@@ -99,6 +101,8 @@ struct dasd_device *dasd_alloc_device(void)
                     (unsigned long) device);
        INIT_LIST_HEAD(&device->ccw_queue);
        init_timer(&device->timer);
+        device->timer.function = dasd_device_timeout;
+        device->timer.data = (unsigned long) device;
        INIT_WORK(&device->kick_work, do_kick_device);
        device->state = DASD_STATE_NEW;
        device->target = DASD_STATE_NEW;
@@ -138,6 +142,8 @@ struct dasd_block *dasd_alloc_block(void)
        INIT_LIST_HEAD(&block->ccw_queue);
        spin_lock_init(&block->queue_lock);
        init_timer(&block->timer);
+        block->timer.function = dasd_block_timeout;
+        block->timer.data = (unsigned long) block;
        return block;
 }
@@ -915,19 +921,10 @@ static void dasd_device_timeout(unsigned long ptr)
 */
 void dasd_device_set_timer(struct dasd_device *device, int expires)
 {
-        if (expires == 0) {
+        if (expires == 0)
-                if (timer_pending(&device->timer))
+                del_timer(&device->timer);
-                        del_timer(&device->timer);
+        else
-                return;
+                mod_timer(&device->timer, jiffies + expires);
-        }
-        if (timer_pending(&device->timer)) {
-                if (mod_timer(&device->timer, jiffies + expires))
-                        return;
-        }
-        device->timer.function = dasd_device_timeout;
-        device->timer.data = (unsigned long) device;
-        device->timer.expires = jiffies + expires;
-        add_timer(&device->timer);
 }
 /*
@@ -935,8 +932,7 @@ void dasd_device_set_timer(struct dasd_device *device, int expires)
 */
 void dasd_device_clear_timer(struct dasd_device *device)
 {
-        if (timer_pending(&device->timer))
+        del_timer(&device->timer);
-                del_timer(&device->timer);
 }
 static void dasd_handle_killed_request(struct ccw_device *cdev,
@@ -1586,19 +1582,10 @@ static void dasd_block_timeout(unsigned long ptr)
 */
 void dasd_block_set_timer(struct dasd_block *block, int expires)
 {
-        if (expires == 0) {
+        if (expires == 0)
-                if (timer_pending(&block->timer))
+                del_timer(&block->timer);
-                        del_timer(&block->timer);
+        else
-                return;
+                mod_timer(&block->timer, jiffies + expires);
-        }
-        if (timer_pending(&block->timer)) {
-                if (mod_timer(&block->timer, jiffies + expires))
-                        return;
-        }
-        block->timer.function = dasd_block_timeout;
-        block->timer.data = (unsigned long) block;
-        block->timer.expires = jiffies + expires;
-        add_timer(&block->timer);
 }
 /*
@@ -1606,8 +1593,7 @@ void dasd_block_set_timer(struct dasd_block *block, int expires)
 */
 void dasd_block_clear_timer(struct dasd_block *block)
 {
-        if (timer_pending(&block->timer))
+        del_timer(&block->timer);
-                del_timer(&block->timer);
 }
 /*
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 300e28a531f8..34339902efb9 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -677,7 +677,7 @@ static ssize_t dasd_ff_show(struct device *dev, struct device_attribute *attr,
        struct dasd_devmap *devmap;
        int ff_flag;
-        devmap = dasd_find_busid(dev->bus_id);
+        devmap = dasd_find_busid(dev_name(dev));
        if (!IS_ERR(devmap))
                ff_flag = (devmap->features & DASD_FEATURE_FAILFAST) != 0;
        else
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index 2a423d3a2a8e..90cfddabf1f7 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -447,7 +447,7 @@ static irqreturn_t bfin_t350mcqb_irq_error(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
-static int __init bfin_t350mcqb_probe(struct platform_device *pdev)
+static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
 {
        struct bfin_t350mcqbfb_info *info;
        struct fb_info *fbinfo;
diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
index 751e491ca8c8..f20eff8c4a81 100644
--- a/drivers/video/geode/gx1fb_core.c
+++ b/drivers/video/geode/gx1fb_core.c
@@ -136,13 +136,10 @@ static int gx1fb_set_par(struct fb_info *info)
 {
        struct geodefb_par *par = info->par;
-        if (info->var.bits_per_pixel == 16) {
+        if (info->var.bits_per_pixel == 16)
                info->fix.visual = FB_VISUAL_TRUECOLOR;
-                fb_dealloc_cmap(&info->cmap);
+        else
-        } else {
                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                fb_alloc_cmap(&info->cmap, 1<<info->var.bits_per_pixel, 0);
-        }
        info->fix.line_length = gx1_line_delta(info->var.xres, info->var.bits_per_pixel);
@@ -315,6 +312,10 @@ static struct fb_info * __init gx1fb_init_fbinfo(struct device *dev)
        if (!par->panel_x)
                par->enable_crt = 1; /* fall back to CRT if no panel is specified */
+        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
+                framebuffer_release(info);
+                return NULL;
+        }
        return info;
 }
@@ -374,8 +375,11 @@ static int __init gx1fb_probe(struct pci_dev *pdev, const struct pci_device_id *
                release_mem_region(gx1_gx_base() + 0x8300, 0x100);
        }
-        if (info)
+        if (info) {
+                fb_dealloc_cmap(&info->cmap);
                framebuffer_release(info);
+        }
        return ret;
 }
@@ -395,6 +399,7 @@ static void gx1fb_remove(struct pci_dev *pdev)
        iounmap(par->dc_regs);
        release_mem_region(gx1_gx_base() + 0x8300, 0x100);
+        fb_dealloc_cmap(&info->cmap);
        pci_set_drvdata(pdev, NULL);
        framebuffer_release(info);
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 484118926318..2552cac39e1c 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -171,13 +171,10 @@ static int gxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 static int gxfb_set_par(struct fb_info *info)
 {
-        if (info->var.bits_per_pixel > 8) {
+        if (info->var.bits_per_pixel > 8)
                info->fix.visual = FB_VISUAL_TRUECOLOR;
-                fb_dealloc_cmap(&info->cmap);
+        else
-        } else {
                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                fb_alloc_cmap(&info->cmap, 1<<info->var.bits_per_pixel, 0);
-        }
        info->fix.line_length = gx_line_delta(info->var.xres, info->var.bits_per_pixel);
@@ -331,6 +328,11 @@ static struct fb_info * __init gxfb_init_fbinfo(struct device *dev)
        info->var.grayscale     = 0;
+        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
+                framebuffer_release(info);
+                return NULL;
+        }
        return info;
 }
@@ -443,8 +445,10 @@ static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *i
                pci_release_region(pdev, 1);
        }
-        if (info)
+        if (info) {
+                fb_dealloc_cmap(&info->cmap);
                framebuffer_release(info);
+        }
        return ret;
 }
@@ -467,6 +471,7 @@ static void gxfb_remove(struct pci_dev *pdev)
        iounmap(par->gp_regs);
        pci_release_region(pdev, 1);
+        fb_dealloc_cmap(&info->cmap);
        pci_set_drvdata(pdev, NULL);
        framebuffer_release(info);
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index b965ecdbc604..889cbe39e580 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -278,13 +278,10 @@ static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 static int lxfb_set_par(struct fb_info *info)
 {
-        if (info->var.bits_per_pixel > 8) {
+        if (info->var.bits_per_pixel > 8)
                info->fix.visual = FB_VISUAL_TRUECOLOR;
-                fb_dealloc_cmap(&info->cmap);
+        else
-        } else {
                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                fb_alloc_cmap(&info->cmap, 1<<info->var.bits_per_pixel, 0);
-        }
        info->fix.line_length = lx_get_pitch(info->var.xres,
                info->var.bits_per_pixel);
@@ -451,6 +448,11 @@ static struct fb_info * __init lxfb_init_fbinfo(struct device *dev)
        info->pseudo_palette    = (void *)par + sizeof(struct lxfb_par);
+        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
+                framebuffer_release(info);
+                return NULL;
+        }
        info->var.grayscale     = 0;
        return info;
@@ -579,8 +581,10 @@ err:
                pci_release_region(pdev, 3);
        }
-        if (info)
+        if (info) {
+                fb_dealloc_cmap(&info->cmap);
                framebuffer_release(info);
+        }
        return ret;
 }
@@ -604,6 +608,7 @@ static void lxfb_remove(struct pci_dev *pdev)
        iounmap(par->vp_regs);
        pci_release_region(pdev, 3);
+        fb_dealloc_cmap(&info->cmap);
        pci_set_drvdata(pdev, NULL);
        framebuffer_release(info);
 }
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 2c8dff9f77da..1ed3d554e372 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -115,7 +115,7 @@ static struct w1_therm_family_converter w1_therm_families[] = {
 static inline int w1_DS18B20_convert_temp(u8 rom[9])
 {
-        s16 t = (rom[1] << 8) | rom[0];
+        int t = ((s16)rom[1] << 8) | rom[0];
        t = t*1000/16;
        return t;
 }
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index da8bdeaa2e6d..7c6e3606f0ec 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1185,9 +1185,12 @@ static int ext2_remount (struct super_block * sb, int * flags, char * data)
        es = sbi->s_es;
        if (((sbi->s_mount_opt & EXT2_MOUNT_XIP) !=
            (old_mount_opt & EXT2_MOUNT_XIP)) &&
-            invalidate_inodes(sb))
+            invalidate_inodes(sb)) {
-                ext2_warning(sb, __func__, "busy inodes while remounting "\
+                ext2_warning(sb, __func__, "refusing change of xip flag "
-                             "xip remain in cache (no functional problem)");
+                             "with busy inodes while remounting");
+                sbi->s_mount_opt &= ~EXT2_MOUNT_XIP;
+                sbi->s_mount_opt |= old_mount_opt & EXT2_MOUNT_XIP;
+        }
        if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
                return 0;
        if (*flags & MS_RDONLY) {
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index b70d90e08a3c..4a970411a458 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -2428,12 +2428,13 @@ static void ext3_write_super (struct super_block * sb)
 static int ext3_sync_fs(struct super_block *sb, int wait)
 {
-        sb->s_dirt = 0;
+        tid_t target;
-        if (wait)
-                ext3_force_commit(sb);
-        else
-                journal_start_commit(EXT3_SB(sb)->s_journal, NULL);
+        sb->s_dirt = 0;
+        if (journal_start_commit(EXT3_SB(sb)->s_journal, &target)) {
+                if (wait)
+                        log_wait_commit(EXT3_SB(sb)->s_journal, target);
+        }
        return 0;
 }
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 6903d37af037..9b800d97a687 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -108,7 +108,8 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
        if (hugetlb_reserve_pages(inode,
                                vma->vm_pgoff >> huge_page_order(h),
-                                len >> huge_page_shift(h), vma))
+                                len >> huge_page_shift(h), vma,
+                                vma->vm_flags))
                goto out;
        ret = 0;
@@ -947,7 +948,7 @@ static int can_do_hugetlb_shm(void)
                        can_do_mlock());
 }
-struct file *hugetlb_file_setup(const char *name, size_t size)
+struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag)
 {
        int error = -ENOMEM;
        struct file *file;
@@ -981,7 +982,8 @@ struct file *hugetlb_file_setup(const char *name, size_t size)
        error = -ENOMEM;
        if (hugetlb_reserve_pages(inode, 0,
-                        size >> huge_page_shift(hstate_inode(inode)), NULL))
+                        size >> huge_page_shift(hstate_inode(inode)), NULL,
+                        acctflag))
                goto out_inode;
        d_instantiate(dentry, inode);
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 9e4fa52d7dc8..e79c07812afa 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -427,7 +427,7 @@ int __log_space_left(journal_t *journal)
 }
 /*
- * Called under j_state_lock.  Returns true if a transaction was started.
+ * Called under j_state_lock.  Returns true if a transaction commit was started.
 */
 int __log_start_commit(journal_t *journal, tid_t target)
 {
@@ -495,7 +495,8 @@ int journal_force_commit_nested(journal_t *journal)
 /*
 * Start a commit of the current running transaction (if any).  Returns true
- * if a transaction was started, and fills its tid in at *ptid
+ * if a transaction is going to be committed (or is currently already
+ * committing), and fills its tid in at *ptid
 */
 int journal_start_commit(journal_t *journal, tid_t *ptid)
 {
@@ -505,15 +506,19 @@ int journal_start_commit(journal_t *journal, tid_t *ptid)
        if (journal->j_running_transaction) {
                tid_t tid = journal->j_running_transaction->t_tid;
-                ret = __log_start_commit(journal, tid);
+                __log_start_commit(journal, tid);
-                if (ret && ptid)
+                /* There's a running transaction and we've just made sure
+                 * it's commit has been scheduled. */
+                if (ptid)
                        *ptid = tid;
-        } else if (journal->j_committing_transaction && ptid) {
+                ret = 1;
+        } else if (journal->j_committing_transaction) {
                /*
                 * If ext3_write_super() recently started a commit, then we
                 * have to wait for completion of that transaction
                 */
-                *ptid = journal->j_committing_transaction->t_tid;
+                if (ptid)
+                        *ptid = journal->j_committing_transaction->t_tid;
                ret = 1;
        }
        spin_unlock(&journal->j_state_lock);
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index e4e8e117d27d..499900d0cee7 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -378,6 +378,7 @@ struct cgroup_subsys {
         * - initiating hotplug events
         */
        struct mutex hierarchy_mutex;
+        struct lock_class_key subsys_key;
        /*
         * Link to parent, and list entry in parent's children.
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 3e0f64c335c8..3e68469c1885 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -282,6 +282,18 @@ static inline void dmaengine_put(void)
 }
 #endif
+#ifdef CONFIG_NET_DMA
+#define net_dmaengine_get()     dmaengine_get()
+#define net_dmaengine_put()     dmaengine_put()
+#else
+static inline void net_dmaengine_get(void)
+{
+}
+static inline void net_dmaengine_put(void)
+{
+}
+#endif
 dma_cookie_t dma_async_memcpy_buf_to_buf(struct dma_chan *chan,
        void *dest, void *src, size_t len);
 dma_cookie_t dma_async_memcpy_buf_to_pg(struct dma_chan *chan,
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index f1d2fba19ea0..03be7f29ca01 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -33,7 +33,8 @@ unsigned long hugetlb_total_pages(void);
 int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                        unsigned long address, int write_access);
 int hugetlb_reserve_pages(struct inode *inode, long from, long to,
-                                                struct vm_area_struct *vma);
+                                                struct vm_area_struct *vma,
+                                                int acctflags);
 void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed);
 extern unsigned long hugepages_treat_as_movable;
@@ -138,7 +139,7 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
 extern const struct file_operations hugetlbfs_file_operations;
 extern struct vm_operations_struct hugetlb_vm_ops;
-struct file *hugetlb_file_setup(const char *name, size_t);
+struct file *hugetlb_file_setup(const char *name, size_t, int);
 int hugetlb_get_quota(struct address_space *mapping, long delta);
 void hugetlb_put_quota(struct address_space *mapping, long delta);
@@ -158,9 +159,9 @@ static inline void set_file_hugepages(struct file *file)
 }
 #else /* !CONFIG_HUGETLBFS */
-#define is_file_hugepages(file)         0
+#define is_file_hugepages(file)                 0
-#define set_file_hugepages(file)        BUG()
+#define set_file_hugepages(file)                BUG()
-#define hugetlb_file_setup(name,size)   ERR_PTR(-ENOSYS)
+#define hugetlb_file_setup(name,size,acctflag)  ERR_PTR(-ENOSYS)
 #endif /* !CONFIG_HUGETLBFS */
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index ea0ea1a4c36f..e752d973fa21 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -48,12 +48,11 @@ extern struct fs_struct init_fs;
        .posix_timers    = LIST_HEAD_INIT(sig.posix_timers),            \
        .cpu_timers     = INIT_CPU_TIMERS(sig.cpu_timers),              \
        .rlim           = INIT_RLIMITS,                                 \
-        .cputime        = { .totals = {                                 \
+        .cputimer       = {                                             \
-                .utime = cputime_zero,                                  \
+                .cputime = INIT_CPUTIME,                                \
-                .stime = cputime_zero,                                  \
+                .running = 0,                                           \
-                .sum_exec_runtime = 0,                                  \
+                .lock = __SPIN_LOCK_UNLOCKED(sig.cputimer.lock),        \
-                .lock = __SPIN_LOCK_UNLOCKED(sig.cputime.totals.lock),  \
+        },                                                              \
-        }, },                                                           \
 }
 extern struct nsproxy init_nsproxy;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index e8ddc98b8405..323561582c10 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1129,8 +1129,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
        unsigned long flag, unsigned long pgoff);
 extern unsigned long mmap_region(struct file *file, unsigned long addr,
        unsigned long len, unsigned long flags,
-        unsigned int vm_flags, unsigned long pgoff,
+        unsigned int vm_flags, unsigned long pgoff);
-        int accountable);
 static inline unsigned long do_mmap(struct file *file, unsigned long addr,
        unsigned long len, unsigned long prot,
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 3c103d636da3..8e6646a54acf 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -8,7 +8,7 @@ struct ring_buffer;
 struct ring_buffer_iter;
 /*
- * Don't reference this struct directly, use functions below.
+ * Don't refer to this struct directly, use functions below.
 */
 struct ring_buffer_event {
        u32             type:2, len:3, time_delta:27;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 699edb8e1853..426666dd8203 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -445,7 +445,6 @@ struct pacct_struct {
 * @utime:              time spent in user mode, in &cputime_t units
 * @stime:              time spent in kernel mode, in &cputime_t units
 * @sum_exec_runtime:   total time spent on the CPU, in nanoseconds
- * @lock:               lock for fields in this struct
 *
 * This structure groups together three kinds of CPU time that are
 * tracked for threads and thread groups.  Most things considering
@@ -456,23 +455,33 @@ struct task_cputime {
        cputime_t utime;
        cputime_t stime;
        unsigned long long sum_exec_runtime;
-        spinlock_t lock;
 };
 /* Alternate field names when used to cache expirations. */
 #define prof_exp        stime
 #define virt_exp        utime
 #define sched_exp       sum_exec_runtime
+#define INIT_CPUTIME    \
+        (struct task_cputime) {                                 \
+                .utime = cputime_zero,                          \
+                .stime = cputime_zero,                          \
+                .sum_exec_runtime = 0,                          \
+        }
 /**
- * struct thread_group_cputime - thread group interval timer counts
+ * struct thread_group_cputimer - thread group interval timer counts
- * @totals:             thread group interval timers; substructure for
+ * @cputime:            thread group interval timers.
- *                      uniprocessor kernel, per-cpu for SMP kernel.
+ * @running:            non-zero when there are timers running and
+ *                      @cputime receives updates.
+ * @lock:               lock for fields in this struct.
 *
 * This structure contains the version of task_cputime, above, that is
- * used for thread group CPU clock calculations.
+ * used for thread group CPU timer calculations.
 */
-struct thread_group_cputime {
+struct thread_group_cputimer {
-        struct task_cputime totals;
+        struct task_cputime cputime;
+        int running;
+        spinlock_t lock;
 };
 /*
@@ -521,10 +530,10 @@ struct signal_struct {
        cputime_t it_prof_incr, it_virt_incr;
        /*
-         * Thread group totals for process CPU clocks.
+         * Thread group totals for process CPU timers.
-         * See thread_group_cputime(), et al, for details.
+         * See thread_group_cputimer(), et al, for details.
         */
-        struct thread_group_cputime cputime;
+        struct thread_group_cputimer cputimer;
        /* Earliest-expiration cache. */
        struct task_cputime cputime_expires;
@@ -561,7 +570,7 @@ struct signal_struct {
         * Live threads maintain their own counters and add to these
         * in __exit_signal, except for the group leader.
         */
-        cputime_t cutime, cstime;
+        cputime_t utime, stime, cutime, cstime;
        cputime_t gtime;
        cputime_t cgtime;
        unsigned long nvcsw, nivcsw, cnvcsw, cnivcsw;
@@ -570,6 +579,14 @@ struct signal_struct {
        struct task_io_accounting ioac;
        /*
+         * Cumulative ns of schedule CPU time fo dead threads in the
+         * group, not including a zombie group leader, (This only differs
+         * from jiffies_to_ns(utime + stime) if sched_clock uses something
+         * other than jiffies.)
+         */
+        unsigned long long sum_sched_runtime;
+        /*
         * We don't bother to synchronize most readers of this at all,
         * because there is no reader checking a limit that actually needs
         * to get both rlim_cur and rlim_max atomically, and either one
@@ -2185,27 +2202,14 @@ static inline int spin_needbreak(spinlock_t *lock)
 /*
 * Thread group CPU time accounting.
 */
+void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times);
-static inline
+void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times);
-void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
-{
-        struct task_cputime *totals = &tsk->signal->cputime.totals;
-        unsigned long flags;
-        spin_lock_irqsave(&totals->lock, flags);
-        *times = *totals;
-        spin_unlock_irqrestore(&totals->lock, flags);
-}
 static inline void thread_group_cputime_init(struct signal_struct *sig)
 {
-        sig->cputime.totals = (struct task_cputime){
+        sig->cputimer.cputime = INIT_CPUTIME;
-                .utime = cputime_zero,
+        spin_lock_init(&sig->cputimer.lock);
-                .stime = cputime_zero,
+        sig->cputimer.running = 0;
-                .sum_exec_runtime = 0,
-        };
-        spin_lock_init(&sig->cputime.totals.lock);
 }
 static inline void thread_group_cputime_free(struct signal_struct *sig)
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 0eda02ff2414..f9f900cfd066 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -95,13 +95,13 @@ struct old_linux_dirent;
 #define __SC_TEST5(t5, a5, ...) __SC_TEST(t5); __SC_TEST4(__VA_ARGS__)
 #define __SC_TEST6(t6, a6, ...) __SC_TEST(t6); __SC_TEST5(__VA_ARGS__)
-#define SYSCALL_DEFINE0(name)   asmlinkage long sys_##name(void)
+#define SYSCALL_DEFINE0(name)      asmlinkage long sys_##name(void)
-#define SYSCALL_DEFINE1(...)    SYSCALL_DEFINEx(1, __VA_ARGS__)
+#define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)
-#define SYSCALL_DEFINE2(...)    SYSCALL_DEFINEx(2, __VA_ARGS__)
+#define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__)
-#define SYSCALL_DEFINE3(...)    SYSCALL_DEFINEx(3, __VA_ARGS__)
+#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
-#define SYSCALL_DEFINE4(...)    SYSCALL_DEFINEx(4, __VA_ARGS__)
+#define SYSCALL_DEFINE4(name, ...) SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
-#define SYSCALL_DEFINE5(...)    SYSCALL_DEFINEx(5, __VA_ARGS__)
+#define SYSCALL_DEFINE5(name, ...) SYSCALL_DEFINEx(5, _##name, __VA_ARGS__)
-#define SYSCALL_DEFINE6(...)    SYSCALL_DEFINEx(6, __VA_ARGS__)
+#define SYSCALL_DEFINE6(name, ...) SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)
 #ifdef CONFIG_PPC64
 #define SYSCALL_ALIAS(alias, name)                                      \
@@ -121,21 +121,21 @@ struct old_linux_dirent;
 #define SYSCALL_DEFINE(name) static inline long SYSC_##name
 #define SYSCALL_DEFINEx(x, name, ...)                                   \
-        asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__));          \
+        asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__));           \
-        static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__));      \
+        static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__));       \
-        asmlinkage long SyS_##name(__SC_LONG##x(__VA_ARGS__))           \
+        asmlinkage long SyS##name(__SC_LONG##x(__VA_ARGS__))            \
        {                                                               \
                __SC_TEST##x(__VA_ARGS__);                              \
-                return (long) SYSC_##name(__SC_CAST##x(__VA_ARGS__));   \
+                return (long) SYSC##name(__SC_CAST##x(__VA_ARGS__));    \
        }                                                               \
-        SYSCALL_ALIAS(sys_##name, SyS_##name);                          \
+        SYSCALL_ALIAS(sys##name, SyS##name);                            \
-        static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__))
+        static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__))
 #else /* CONFIG_HAVE_SYSCALL_WRAPPERS */
 #define SYSCALL_DEFINE(name) asmlinkage long sys_##name
 #define SYSCALL_DEFINEx(x, name, ...)                                   \
-        asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__))
+        asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__))
 #endif /* CONFIG_HAVE_SYSCALL_WRAPPERS */
diff --git a/ipc/shm.c b/ipc/shm.c
index f8f69fad3a27..05d51d2a792c 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -340,6 +340,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
        struct file * file;
        char name[13];
        int id;
+        int acctflag = 0;
        if (size < SHMMIN || size > ns->shm_ctlmax)
                return -EINVAL;
@@ -364,11 +365,12 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
        sprintf (name, "SYSV%08x", key);
        if (shmflg & SHM_HUGETLB) {
-                /* hugetlb_file_setup takes care of mlock user accounting */
+                /* hugetlb_file_setup applies strict accounting */
-                file = hugetlb_file_setup(name, size);
+                if (shmflg & SHM_NORESERVE)
+                        acctflag = VM_NORESERVE;
+                file = hugetlb_file_setup(name, size, acctflag);
                shp->mlock_user = current_user();
        } else {
-                int acctflag = 0;
                /*
                 * Do not allow no accounting for OVERCOMMIT_NEVER, even
                 * if it's asked for.
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 5a54ff42874e..e14db9c089b9 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2351,7 +2351,7 @@ static void cgroup_lock_hierarchy(struct cgroupfs_root *root)
        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                struct cgroup_subsys *ss = subsys[i];
                if (ss->root == root)
-                        mutex_lock_nested(&ss->hierarchy_mutex, i);
+                        mutex_lock(&ss->hierarchy_mutex);
        }
 }
@@ -2637,6 +2637,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
        BUG_ON(!list_empty(&init_task.tasks));
        mutex_init(&ss->hierarchy_mutex);
+        lockdep_set_class(&ss->hierarchy_mutex, &ss->subsys_key);
        ss->active = 1;
 }
diff --git a/kernel/exit.c b/kernel/exit.c
index f80dec3f1875..efd30ccf3858 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -118,6 +118,8 @@ static void __exit_signal(struct task_struct *tsk)
                 * We won't ever get here for the group leader, since it
                 * will have been the last reference on the signal_struct.
                 */
+                sig->utime = cputime_add(sig->utime, task_utime(tsk));
+                sig->stime = cputime_add(sig->stime, task_stime(tsk));
                sig->gtime = cputime_add(sig->gtime, task_gtime(tsk));
                sig->min_flt += tsk->min_flt;
                sig->maj_flt += tsk->maj_flt;
@@ -126,6 +128,7 @@ static void __exit_signal(struct task_struct *tsk)
                sig->inblock += task_io_get_inblock(tsk);
                sig->oublock += task_io_get_oublock(tsk);
                task_io_accounting_add(&sig->ioac, &tsk->ioac);
+                sig->sum_sched_runtime += tsk->se.sum_exec_runtime;
                sig = NULL; /* Marker for below. */
        }
diff --git a/kernel/fork.c b/kernel/fork.c
index 6d5dbb7a13e2..a66fbde20715 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -851,13 +851,14 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
        sig->tty_old_pgrp = NULL;
        sig->tty = NULL;
-        sig->cutime = sig->cstime = cputime_zero;
+        sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero;
        sig->gtime = cputime_zero;
        sig->cgtime = cputime_zero;
        sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0;
        sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0;
        sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0;
        task_io_accounting_init(&sig->ioac);
+        sig->sum_sched_runtime = 0;
        taskstats_tgid_init(sig);
        task_lock(current->group_leader);
@@ -1094,7 +1095,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #ifdef CONFIG_DEBUG_MUTEXES
        p->blocked_on = NULL; /* not blocked yet */
 #endif
-        if (unlikely(ptrace_reparented(current)))
+        if (unlikely(current->ptrace))
                ptrace_fork(p, clone_flags);
        /* Perform scheduler related setup. Assign this task to a CPU. */
diff --git a/kernel/itimer.c b/kernel/itimer.c
index 6a5fe93dd8bd..58762f7077ec 100644
--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -62,7 +62,7 @@ int do_getitimer(int which, struct itimerval *value)
                        struct task_cputime cputime;
                        cputime_t utime;
-                        thread_group_cputime(tsk, &cputime);
+                        thread_group_cputimer(tsk, &cputime);
                        utime = cputime.utime;
                        if (cputime_le(cval, utime)) { /* about to fire */
                                cval = jiffies_to_cputime(1);
@@ -82,7 +82,7 @@ int do_getitimer(int which, struct itimerval *value)
                        struct task_cputime times;
                        cputime_t ptime;
-                        thread_group_cputime(tsk, &times);
+                        thread_group_cputimer(tsk, &times);
                        ptime = cputime_add(times.utime, times.stime);
                        if (cputime_le(cval, ptime)) { /* about to fire */
                                cval = jiffies_to_cputime(1);
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index fa07da94d7be..2313a4cc14ea 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -230,6 +230,71 @@ static int cpu_clock_sample(const clockid_t which_clock, struct task_struct *p,
        return 0;
 }
+void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
+{
+        struct sighand_struct *sighand;
+        struct signal_struct *sig;
+        struct task_struct *t;
+        *times = INIT_CPUTIME;
+        rcu_read_lock();
+        sighand = rcu_dereference(tsk->sighand);
+        if (!sighand)
+                goto out;
+        sig = tsk->signal;
+        t = tsk;
+        do {
+                times->utime = cputime_add(times->utime, t->utime);
+                times->stime = cputime_add(times->stime, t->stime);
+                times->sum_exec_runtime += t->se.sum_exec_runtime;
+                t = next_thread(t);
+        } while (t != tsk);
+        times->utime = cputime_add(times->utime, sig->utime);
+        times->stime = cputime_add(times->stime, sig->stime);
+        times->sum_exec_runtime += sig->sum_sched_runtime;
+out:
+        rcu_read_unlock();
+}
+static void update_gt_cputime(struct task_cputime *a, struct task_cputime *b)
+{
+        if (cputime_gt(b->utime, a->utime))
+                a->utime = b->utime;
+        if (cputime_gt(b->stime, a->stime))
+                a->stime = b->stime;
+        if (b->sum_exec_runtime > a->sum_exec_runtime)
+                a->sum_exec_runtime = b->sum_exec_runtime;
+}
+void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
+{
+        struct thread_group_cputimer *cputimer = &tsk->signal->cputimer;
+        struct task_cputime sum;
+        unsigned long flags;
+        spin_lock_irqsave(&cputimer->lock, flags);
+        if (!cputimer->running) {
+                cputimer->running = 1;
+                /*
+                 * The POSIX timer interface allows for absolute time expiry
+                 * values through the TIMER_ABSTIME flag, therefore we have
+                 * to synchronize the timer to the clock every time we start
+                 * it.
+                 */
+                thread_group_cputime(tsk, &sum);
+                update_gt_cputime(&cputimer->cputime, &sum);
+        }
+        *times = cputimer->cputime;
+        spin_unlock_irqrestore(&cputimer->lock, flags);
+}
 /*
 * Sample a process (thread group) clock for the given group_leader task.
 * Must be called with tasklist_lock held for reading.
@@ -457,7 +522,7 @@ void posix_cpu_timers_exit_group(struct task_struct *tsk)
 {
        struct task_cputime cputime;
-        thread_group_cputime(tsk, &cputime);
+        thread_group_cputimer(tsk, &cputime);
        cleanup_timers(tsk->signal->cpu_timers,
                       cputime.utime, cputime.stime, cputime.sum_exec_runtime);
 }
@@ -964,6 +1029,19 @@ static void check_thread_timers(struct task_struct *tsk,
        }
 }
+static void stop_process_timers(struct task_struct *tsk)
+{
+        struct thread_group_cputimer *cputimer = &tsk->signal->cputimer;
+        unsigned long flags;
+        if (!cputimer->running)
+                return;
+        spin_lock_irqsave(&cputimer->lock, flags);
+        cputimer->running = 0;
+        spin_unlock_irqrestore(&cputimer->lock, flags);
+}
 /*
 * Check for any per-thread CPU timers that have fired and move them
 * off the tsk->*_timers list onto the firing list.  Per-thread timers
@@ -987,13 +1065,15 @@ static void check_process_timers(struct task_struct *tsk,
            sig->rlim[RLIMIT_CPU].rlim_cur == RLIM_INFINITY &&
            list_empty(&timers[CPUCLOCK_VIRT]) &&
            cputime_eq(sig->it_virt_expires, cputime_zero) &&
-            list_empty(&timers[CPUCLOCK_SCHED]))
+            list_empty(&timers[CPUCLOCK_SCHED])) {
+                stop_process_timers(tsk);
                return;
+        }
        /*
         * Collect the current process totals.
         */
-        thread_group_cputime(tsk, &cputime);
+        thread_group_cputimer(tsk, &cputime);
        utime = cputime.utime;
        ptime = cputime_add(utime, cputime.stime);
        sum_sched_runtime = cputime.sum_exec_runtime;
@@ -1259,7 +1339,7 @@ static inline int fastpath_timer_check(struct task_struct *tsk)
        if (!task_cputime_zero(&sig->cputime_expires)) {
                struct task_cputime group_sample;
-                thread_group_cputime(tsk, &group_sample);
+                thread_group_cputimer(tsk, &group_sample);
                if (task_cputime_expired(&group_sample, &sig->cputime_expires))
                        return 1;
        }
@@ -1329,6 +1409,33 @@ void run_posix_cpu_timers(struct task_struct *tsk)
 }
 /*
+ * Sample a process (thread group) timer for the given group_leader task.
+ * Must be called with tasklist_lock held for reading.
+ */
+static int cpu_timer_sample_group(const clockid_t which_clock,
+                                  struct task_struct *p,
+                                  union cpu_time_count *cpu)
+{
+        struct task_cputime cputime;
+        thread_group_cputimer(p, &cputime);
+        switch (CPUCLOCK_WHICH(which_clock)) {
+        default:
+                return -EINVAL;
+        case CPUCLOCK_PROF:
+                cpu->cpu = cputime_add(cputime.utime, cputime.stime);
+                break;
+        case CPUCLOCK_VIRT:
+                cpu->cpu = cputime.utime;
+                break;
+        case CPUCLOCK_SCHED:
+                cpu->sched = cputime.sum_exec_runtime + task_delta_exec(p);
+                break;
+        }
+        return 0;
+}
+/*
 * Set one of the process-wide special case CPU timers.
 * The tsk->sighand->siglock must be held by the caller.
 * The *newval argument is relative and we update it to be absolute, *oldval
@@ -1341,7 +1448,7 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx,
        struct list_head *head;
        BUG_ON(clock_idx == CPUCLOCK_SCHED);
-        cpu_clock_sample_group(clock_idx, tsk, &now);
+        cpu_timer_sample_group(clock_idx, tsk, &now);
        if (oldval) {
                if (!cputime_eq(*oldval, cputime_zero)) {
diff --git a/kernel/sched.c b/kernel/sched.c
index 1ffb89514871..5dc3b0a5d35a 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -2266,16 +2266,6 @@ static int try_to_wake_up(struct task_struct *p, unsigned int state, int sync)
        if (!sched_feat(SYNC_WAKEUPS))
                sync = 0;
-        if (!sync) {
-                if (current->se.avg_overlap < sysctl_sched_migration_cost &&
-                          p->se.avg_overlap < sysctl_sched_migration_cost)
-                        sync = 1;
-        } else {
-                if (current->se.avg_overlap >= sysctl_sched_migration_cost ||
-                          p->se.avg_overlap >= sysctl_sched_migration_cost)
-                        sync = 0;
-        }
 #ifdef CONFIG_SMP
        if (sched_feat(LB_WAKEUP_UPDATE)) {
                struct sched_domain *sd;
@@ -3890,19 +3880,24 @@ int select_nohz_load_balancer(int stop_tick)
        int cpu = smp_processor_id();
        if (stop_tick) {
-                cpumask_set_cpu(cpu, nohz.cpu_mask);
                cpu_rq(cpu)->in_nohz_recently = 1;
-                /*
+                if (!cpu_active(cpu)) {
-                 * If we are going offline and still the leader, give up!
+                        if (atomic_read(&nohz.load_balancer) != cpu)
-                 */
+                                return 0;
-                if (!cpu_active(cpu) &&
-                    atomic_read(&nohz.load_balancer) == cpu) {
+                        /*
+                         * If we are going offline and still the leader,
+                         * give up!
+                         */
                        if (atomic_cmpxchg(&nohz.load_balancer, cpu, -1) != cpu)
                                BUG();
                        return 0;
                }
+                cpumask_set_cpu(cpu, nohz.cpu_mask);
                /* time for ilb owner also to sleep */
                if (cpumask_weight(nohz.cpu_mask) == num_online_cpus()) {
                        if (atomic_read(&nohz.load_balancer) == cpu)
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index a7e50ba185ac..0566f2a03c42 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -1191,15 +1191,20 @@ wake_affine(struct sched_domain *this_sd, struct rq *this_rq,
            int idx, unsigned long load, unsigned long this_load,
            unsigned int imbalance)
 {
+        struct task_struct *curr = this_rq->curr;
+        struct task_group *tg;
        unsigned long tl = this_load;
        unsigned long tl_per_task;
-        struct task_group *tg;
        unsigned long weight;
        int balanced;
        if (!(this_sd->flags & SD_WAKE_AFFINE) || !sched_feat(AFFINE_WAKEUPS))
                return 0;
+        if (sync && (curr->se.avg_overlap > sysctl_sched_migration_cost ||
+                        p->se.avg_overlap > sysctl_sched_migration_cost))
+                sync = 0;
        /*
         * If sync wakeup then subtract the (maximum possible)
         * effect of the currently running task from the load
@@ -1426,7 +1431,9 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int sync)
        if (!sched_feat(WAKEUP_PREEMPT))
                return;
-        if (sched_feat(WAKEUP_OVERLAP) && sync) {
+        if (sched_feat(WAKEUP_OVERLAP) && (sync ||
+                        (se->avg_overlap < sysctl_sched_migration_cost &&
+                         pse->avg_overlap < sysctl_sched_migration_cost))) {
                resched_task(curr);
                return;
        }
diff --git a/kernel/sched_stats.h b/kernel/sched_stats.h
index 8ab0cef8ecab..a8f93dd374e1 100644
--- a/kernel/sched_stats.h
+++ b/kernel/sched_stats.h
@@ -296,19 +296,21 @@ sched_info_switch(struct task_struct *prev, struct task_struct *next)
 static inline void account_group_user_time(struct task_struct *tsk,
                                           cputime_t cputime)
 {
-        struct task_cputime *times;
+        struct thread_group_cputimer *cputimer;
-        struct signal_struct *sig;
        /* tsk == current, ensure it is safe to use ->signal */
        if (unlikely(tsk->exit_state))
                return;
-        sig = tsk->signal;
+        cputimer = &tsk->signal->cputimer;
-        times = &sig->cputime.totals;
-        spin_lock(&times->lock);
+        if (!cputimer->running)
-        times->utime = cputime_add(times->utime, cputime);
+                return;
-        spin_unlock(&times->lock);
+        spin_lock(&cputimer->lock);
+        cputimer->cputime.utime =
+                cputime_add(cputimer->cputime.utime, cputime);
+        spin_unlock(&cputimer->lock);
 }
 /**
@@ -324,19 +326,21 @@ static inline void account_group_user_time(struct task_struct *tsk,
 static inline void account_group_system_time(struct task_struct *tsk,
                                             cputime_t cputime)
 {
-        struct task_cputime *times;
+        struct thread_group_cputimer *cputimer;
-        struct signal_struct *sig;
        /* tsk == current, ensure it is safe to use ->signal */
        if (unlikely(tsk->exit_state))
                return;
-        sig = tsk->signal;
+        cputimer = &tsk->signal->cputimer;
-        times = &sig->cputime.totals;
+        if (!cputimer->running)
+                return;
-        spin_lock(&times->lock);
+        spin_lock(&cputimer->lock);
-        times->stime = cputime_add(times->stime, cputime);
+        cputimer->cputime.stime =
-        spin_unlock(&times->lock);
+                cputime_add(cputimer->cputime.stime, cputime);
+        spin_unlock(&cputimer->lock);
 }
 /**
@@ -352,7 +356,7 @@ static inline void account_group_system_time(struct task_struct *tsk,
 static inline void account_group_exec_runtime(struct task_struct *tsk,
                                              unsigned long long ns)
 {
-        struct task_cputime *times;
+        struct thread_group_cputimer *cputimer;
        struct signal_struct *sig;
        sig = tsk->signal;
@@ -361,9 +365,12 @@ static inline void account_group_exec_runtime(struct task_struct *tsk,
        if (unlikely(!sig))
                return;
-        times = &sig->cputime.totals;
+        cputimer = &sig->cputimer;
+        if (!cputimer->running)
+                return;
-        spin_lock(&times->lock);
+        spin_lock(&cputimer->lock);
-        times->sum_exec_runtime += ns;
+        cputimer->cputime.sum_exec_runtime += ns;
-        spin_unlock(&times->lock);
+        spin_unlock(&cputimer->lock);
 }
diff --git a/kernel/signal.c b/kernel/signal.c
index b6b36768b758..2a74fe87c0dd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1367,7 +1367,6 @@ int do_notify_parent(struct task_struct *tsk, int sig)
        struct siginfo info;
        unsigned long flags;
        struct sighand_struct *psig;
-        struct task_cputime cputime;
        int ret = sig;
        BUG_ON(sig == -1);
@@ -1397,9 +1396,10 @@ int do_notify_parent(struct task_struct *tsk, int sig)
        info.si_uid = __task_cred(tsk)->uid;
        rcu_read_unlock();
-        thread_group_cputime(tsk, &cputime);
+        info.si_utime = cputime_to_clock_t(cputime_add(tsk->utime,
-        info.si_utime = cputime_to_jiffies(cputime.utime);
+                                tsk->signal->utime));
-        info.si_stime = cputime_to_jiffies(cputime.stime);
+        info.si_stime = cputime_to_clock_t(cputime_add(tsk->stime,
+                                tsk->signal->stime));
        info.si_status = tsk->exit_code & 0x7f;
        if (tsk->exit_code & 0x80)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 790f9d785663..c5ef44ff850f 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -101,6 +101,7 @@ static int two = 2;
 static int zero;
 static int one = 1;
+static unsigned long one_ul = 1;
 static int one_hundred = 100;
 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
@@ -974,7 +975,7 @@ static struct ctl_table vm_table[] = {
                .mode           = 0644,
                .proc_handler   = &dirty_background_bytes_handler,
                .strategy       = &sysctl_intvec,
-                .extra1         = &one,
+                .extra1         = &one_ul,
        },
        {
                .ctl_name       = VM_DIRTY_RATIO,
@@ -995,7 +996,7 @@ static struct ctl_table vm_table[] = {
                .mode           = 0644,
                .proc_handler   = &dirty_bytes_handler,
                .strategy       = &sysctl_intvec,
-                .extra1         = &one,
+                .extra1         = &one_ul,
        },
        {
                .procname       = "dirty_writeback_centisecs",
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 3a331289457a..6ff928acd453 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -134,6 +134,7 @@ config SYSPROF_TRACER
        bool "Sysprof Tracer"
        depends on X86
        select TRACING
+        select CONTEXT_SWITCH_TRACER
        help
          This tracer provides the trace needed by the 'Sysprof' userspace
          tool.
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 27ef3bf13ed2..a3901b550c93 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -59,7 +59,7 @@ enum {
        RB_BUFFERS_DISABLED     = 1 << RB_BUFFERS_DISABLED_BIT,
 };
-static long ring_buffer_flags __read_mostly = RB_BUFFERS_ON;
+static unsigned long ring_buffer_flags __read_mostly = RB_BUFFERS_ON;
 /**
 * tracing_on - enable all tracing buffers
@@ -91,7 +91,7 @@ EXPORT_SYMBOL_GPL(tracing_off);
 * tracing_off_permanent - permanently disable ring buffers
 *
 * This function, once called, will disable all ring buffers
- * permanenty.
+ * permanently.
 */
 void tracing_off_permanent(void)
 {
@@ -210,7 +210,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_data);
 struct buffer_data_page {
        u64              time_stamp;    /* page time stamp */
-        local_t          commit;        /* write commited index */
+        local_t          commit;        /* write committed index */
        unsigned char    data[];        /* data of buffer page */
 };
@@ -260,7 +260,7 @@ struct ring_buffer_per_cpu {
        struct list_head                pages;
        struct buffer_page              *head_page;     /* read from head */
        struct buffer_page              *tail_page;     /* write to tail */
-        struct buffer_page              *commit_page;   /* commited pages */
+        struct buffer_page              *commit_page;   /* committed pages */
        struct buffer_page              *reader_page;
        unsigned long                   overrun;
        unsigned long                   entries;
@@ -303,7 +303,7 @@ struct ring_buffer_iter {
 * check_pages - integrity check of buffer pages
 * @cpu_buffer: CPU buffer with pages to test
 *
- * As a safty measure we check to make sure the data pages have not
+ * As a safety measure we check to make sure the data pages have not
 * been corrupted.
 */
 static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer)
@@ -2332,13 +2332,14 @@ int ring_buffer_swap_cpu(struct ring_buffer *buffer_a,
 EXPORT_SYMBOL_GPL(ring_buffer_swap_cpu);
 static void rb_remove_entries(struct ring_buffer_per_cpu *cpu_buffer,
-                              struct buffer_data_page *bpage)
+                              struct buffer_data_page *bpage,
+                              unsigned int offset)
 {
        struct ring_buffer_event *event;
        unsigned long head;
        __raw_spin_lock(&cpu_buffer->lock);
-        for (head = 0; head < local_read(&bpage->commit);
+        for (head = offset; head < local_read(&bpage->commit);
             head += rb_event_length(event)) {
                event = __rb_data_page_index(bpage, head);
@@ -2406,12 +2407,12 @@ void ring_buffer_free_read_page(struct ring_buffer *buffer, void *data)
 * to swap with a page in the ring buffer.
 *
 * for example:
- *      rpage = ring_buffer_alloc_page(buffer);
+ *      rpage = ring_buffer_alloc_read_page(buffer);
 *      if (!rpage)
 *              return error;
 *      ret = ring_buffer_read_page(buffer, &rpage, cpu, 0);
- *      if (ret)
+ *      if (ret >= 0)
- *              process_page(rpage);
+ *              process_page(rpage, ret);
 *
 * When @full is set, the function will not return true unless
 * the writer is off the reader page.
@@ -2422,8 +2423,8 @@ void ring_buffer_free_read_page(struct ring_buffer *buffer, void *data)
 *  responsible for that.
 *
 * Returns:
- *  1 if data has been transferred
+ *  >=0 if data has been transferred, returns the offset of consumed data.
- *  0 if no data has been transferred.
+ *  <0 if no data has been transferred.
 */
 int ring_buffer_read_page(struct ring_buffer *buffer,
                            void **data_page, int cpu, int full)
@@ -2432,7 +2433,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
        struct ring_buffer_event *event;
        struct buffer_data_page *bpage;
        unsigned long flags;
-        int ret = 0;
+        unsigned int read;
+        int ret = -1;
        if (!data_page)
                return 0;
@@ -2454,25 +2456,29 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
        /* check for data */
        if (!local_read(&cpu_buffer->reader_page->page->commit))
                goto out;
+        read = cpu_buffer->reader_page->read;
        /*
         * If the writer is already off of the read page, then simply
         * switch the read page with the given page. Otherwise
         * we need to copy the data from the reader to the writer.
         */
        if (cpu_buffer->reader_page == cpu_buffer->commit_page) {
-                unsigned int read = cpu_buffer->reader_page->read;
+                unsigned int commit = rb_page_commit(cpu_buffer->reader_page);
+                struct buffer_data_page *rpage = cpu_buffer->reader_page->page;
                if (full)
                        goto out;
                /* The writer is still on the reader page, we must copy */
-                bpage = cpu_buffer->reader_page->page;
+                memcpy(bpage->data + read, rpage->data + read, commit - read);
-                memcpy(bpage->data,
-                       cpu_buffer->reader_page->page->data + read,
-                       local_read(&bpage->commit) - read);
                /* consume what was read */
-                cpu_buffer->reader_page += read;
+                cpu_buffer->reader_page->read = commit;
+                /* update bpage */
+                local_set(&bpage->commit, commit);
+                if (!read)
+                        bpage->time_stamp = rpage->time_stamp;
        } else {
                /* swap the pages */
                rb_init_page(bpage);
@@ -2481,10 +2487,10 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
                cpu_buffer->reader_page->read = 0;
                *data_page = bpage;
        }
-        ret = 1;
+        ret = read;
        /* update the entry counter */
-        rb_remove_entries(cpu_buffer, bpage);
+        rb_remove_entries(cpu_buffer, bpage, read);
 out:
        spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
@@ -2495,7 +2501,7 @@ static ssize_t
 rb_simple_read(struct file *filp, char __user *ubuf,
               size_t cnt, loff_t *ppos)
 {
-        long *p = filp->private_data;
+        unsigned long *p = filp->private_data;
        char buf[64];
        int r;
@@ -2511,9 +2517,9 @@ static ssize_t
 rb_simple_write(struct file *filp, const char __user *ubuf,
                size_t cnt, loff_t *ppos)
 {
-        long *p = filp->private_data;
+        unsigned long *p = filp->private_data;
        char buf[64];
-        long val;
+        unsigned long val;
        int ret;
        if (cnt >= sizeof(buf))
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index d89821283b47..95f99a7abf2f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -80,7 +80,7 @@ static int dummy_set_flag(u32 old_flags, u32 bit, int set)
 * of the tracer is successful. But that is the only place that sets
 * this back to zero.
 */
-int tracing_disabled = 1;
+static int tracing_disabled = 1;
 static DEFINE_PER_CPU(local_t, ftrace_cpu_disabled);
@@ -459,6 +459,8 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
 * Register a new plugin tracer.
 */
 int register_tracer(struct tracer *type)
+__releases(kernel_lock)
+__acquires(kernel_lock)
 {
        struct tracer *t;
        int len;
@@ -626,7 +628,7 @@ static int cmdline_idx;
 static DEFINE_SPINLOCK(trace_cmdline_lock);
 /* temporary disable recording */
-atomic_t trace_record_cmdline_disabled __read_mostly;
+static atomic_t trace_record_cmdline_disabled __read_mostly;
 static void trace_init_cmdlines(void)
 {
@@ -983,10 +985,12 @@ static void ftrace_trace_userstack(struct trace_array *tr,
 #endif
 }
-void __trace_userstack(struct trace_array *tr, unsigned long flags)
+#ifdef UNUSED
+static void __trace_userstack(struct trace_array *tr, unsigned long flags)
 {
        ftrace_trace_userstack(tr, flags, preempt_count());
 }
+#endif /* UNUSED */
 static void
 ftrace_trace_special(void *__tr,
@@ -1720,7 +1724,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp)
        return 0;
 }
-int tracing_release(struct inode *inode, struct file *file)
+static int tracing_release(struct inode *inode, struct file *file)
 {
        struct seq_file *m = (struct seq_file *)file->private_data;
        struct trace_iterator *iter = m->private;
@@ -1963,7 +1967,7 @@ tracing_trace_options_read(struct file *filp, char __user *ubuf,
        struct tracer_opt *trace_opts = current_trace->flags->opts;
-        /* calulate max size */
+        /* calculate max size */
        for (i = 0; trace_options[i]; i++) {
                len += strlen(trace_options[i]);
                len += 3; /* "no" and space */
@@ -2145,7 +2149,7 @@ tracing_ctrl_write(struct file *filp, const char __user *ubuf,
 {
        struct trace_array *tr = filp->private_data;
        char buf[64];
-        long val;
+        unsigned long val;
        int ret;
        if (cnt >= sizeof(buf))
@@ -2293,9 +2297,9 @@ static ssize_t
 tracing_max_lat_write(struct file *filp, const char __user *ubuf,
                      size_t cnt, loff_t *ppos)
 {
-        long *ptr = filp->private_data;
+        unsigned long *ptr = filp->private_data;
        char buf[64];
-        long val;
+        unsigned long val;
        int ret;
        if (cnt >= sizeof(buf))
diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
index f8ae2c50e01d..c2e68d440c4d 100644
--- a/kernel/trace/trace_branch.c
+++ b/kernel/trace/trace_branch.c
@@ -91,8 +91,6 @@ void trace_likely_condition(struct ftrace_branch_data *f, int val, int expect)
 int enable_branch_tracing(struct trace_array *tr)
 {
-        int ret = 0;
        mutex_lock(&branch_tracing_mutex);
        branch_tracer = tr;
        /*
@@ -103,7 +101,7 @@ int enable_branch_tracing(struct trace_array *tr)
        branch_tracing_enabled++;
        mutex_unlock(&branch_tracing_mutex);
-        return ret;
+        return 0;
 }
 void disable_branch_tracing(void)
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 782ec0fdf453..519a0cab1530 100644
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -186,30 +186,30 @@ verif_pid(struct trace_seq *s, pid_t pid, int cpu, pid_t *last_pids_cpu)
        ret = trace_seq_printf(s,
                " ------------------------------------------\n");
        if (!ret)
-                TRACE_TYPE_PARTIAL_LINE;
+                return TRACE_TYPE_PARTIAL_LINE;
        ret = print_graph_cpu(s, cpu);
        if (ret == TRACE_TYPE_PARTIAL_LINE)
-                TRACE_TYPE_PARTIAL_LINE;
+                return TRACE_TYPE_PARTIAL_LINE;
        ret = print_graph_proc(s, prev_pid);
        if (ret == TRACE_TYPE_PARTIAL_LINE)
-                TRACE_TYPE_PARTIAL_LINE;
+                return TRACE_TYPE_PARTIAL_LINE;
        ret = trace_seq_printf(s, " => ");
        if (!ret)
-                TRACE_TYPE_PARTIAL_LINE;
+                return TRACE_TYPE_PARTIAL_LINE;
        ret = print_graph_proc(s, pid);
        if (ret == TRACE_TYPE_PARTIAL_LINE)
-                TRACE_TYPE_PARTIAL_LINE;
+                return TRACE_TYPE_PARTIAL_LINE;
        ret = trace_seq_printf(s,
                "\n ------------------------------------------\n\n");
        if (!ret)
-                TRACE_TYPE_PARTIAL_LINE;
+                return TRACE_TYPE_PARTIAL_LINE;
-        return ret;
+        return TRACE_TYPE_HANDLED;
 }
 static struct ftrace_graph_ret_entry *
diff --git a/kernel/trace/trace_hw_branches.c b/kernel/trace/trace_hw_branches.c
index e3e7db61c067..0794dd33f27b 100644
--- a/kernel/trace/trace_hw_branches.c
+++ b/kernel/trace/trace_hw_branches.c
@@ -75,7 +75,7 @@ static void bts_trace_start(struct trace_array *tr)
 }
 /*
- * Start tracing on the current cpu.
+ * Stop tracing on the current cpu.
 * The argument is ignored.
 *
 * pre: bts_tracer_mutex must be locked.
diff --git a/kernel/trace/trace_sysprof.c b/kernel/trace/trace_sysprof.c
index 84ca9d81e74d..7c9a2d82a7d8 100644
--- a/kernel/trace/trace_sysprof.c
+++ b/kernel/trace/trace_sysprof.c
@@ -88,7 +88,7 @@ static void backtrace_address(void *data, unsigned long addr, int reliable)
        }
 }
-const static struct stacktrace_ops backtrace_ops = {
+static const struct stacktrace_ops backtrace_ops = {
        .warning                = backtrace_warning,
        .warning_symbol         = backtrace_warning_symbol,
        .stack                  = backtrace_stack,
@@ -238,6 +238,8 @@ static int stack_trace_init(struct trace_array *tr)
 {
        sysprof_trace = tr;
+        tracing_start_cmdline_record();
        mutex_lock(&sample_timer_lock);
        start_stack_timers();
        tracer_enabled = 1;
@@ -247,6 +249,7 @@ static int stack_trace_init(struct trace_array *tr)
 static void stack_trace_reset(struct trace_array *tr)
 {
+        tracing_stop_cmdline_record();
        stop_stack_trace(tr);
 }
diff --git a/mm/fremap.c b/mm/fremap.c
index 736ba7f3306a..b6ec85abbb39 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -198,7 +198,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
                        flags &= MAP_NONBLOCK;
                        get_file(file);
                        addr = mmap_region(file, start, size,
-                                        flags, vma->vm_flags, pgoff, 1);
+                                        flags, vma->vm_flags, pgoff);
                        fput(file);
                        if (IS_ERR_VALUE(addr)) {
                                err = addr;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 618e98304080..107da3d809a8 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2269,12 +2269,18 @@ void hugetlb_change_protection(struct vm_area_struct *vma,
 int hugetlb_reserve_pages(struct inode *inode,
                                        long from, long to,
-                                        struct vm_area_struct *vma)
+                                        struct vm_area_struct *vma,
+                                        int acctflag)
 {
        long ret, chg;
        struct hstate *h = hstate_inode(inode);
-        if (vma && vma->vm_flags & VM_NORESERVE)
+        /*
+         * Only apply hugepage reservation if asked. At fault time, an
+         * attempt will be made for VM_NORESERVE to allocate a page
+         * and filesystem quota without using reserves
+         */
+        if (acctflag & VM_NORESERVE)
                return 0;
        /*
@@ -2299,13 +2305,31 @@ int hugetlb_reserve_pages(struct inode *inode,
        if (chg < 0)
                return chg;
+        /* There must be enough filesystem quota for the mapping */
        if (hugetlb_get_quota(inode->i_mapping, chg))
                return -ENOSPC;
+        /*
+         * Check enough hugepages are available for the reservation.
+         * Hand back the quota if there are not
+         */
        ret = hugetlb_acct_memory(h, chg);
        if (ret < 0) {
                hugetlb_put_quota(inode->i_mapping, chg);
                return ret;
        }
+        /*
+         * Account for the reservations made. Shared mappings record regions
+         * that have reservations as they are shared by multiple VMAs.
+         * When the last VMA disappears, the region map says how much
+         * the reservation was and the page cache tells how much of
+         * the reservation was consumed. Private mappings are per-VMA and
+         * only the consumed reservations are tracked. When the VMA
+         * disappears, the original reservation is the VMA size and the
+         * consumed reservations are stored in the map. Hence, nothing
+         * else has to be done for private mappings here
+         */
        if (!vma || vma->vm_flags & VM_SHARED)
                region_add(&inode->i_mapping->private_list, from, to);
        return 0;
diff --git a/mm/migrate.c b/mm/migrate.c
index 2bb4e1d63520..a9eff3f092f6 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1129,7 +1129,7 @@ int migrate_vmas(struct mm_struct *mm, const nodemask_t *to,
        struct vm_area_struct *vma;
        int err = 0;
-        for(vma = mm->mmap; vma->vm_next && !err; vma = vma->vm_next) {
+        for (vma = mm->mmap; vma && !err; vma = vma->vm_next) {
                if (vma->vm_ops && vma->vm_ops->migrate) {
                        err = vma->vm_ops->migrate(vma, to, from, flags);
                        if (err)
diff --git a/mm/mmap.c b/mm/mmap.c
index 214b6a258eeb..00ced3ee49a8 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -918,7 +918,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
        struct inode *inode;
        unsigned int vm_flags;
        int error;
-        int accountable = 1;
        unsigned long reqprot = prot;
        /*
@@ -1019,8 +1018,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                                        return -EPERM;
                                vm_flags &= ~VM_MAYEXEC;
                        }
-                        if (is_file_hugepages(file))
-                                accountable = 0;
                        if (!file->f_op || !file->f_op->mmap)
                                return -ENODEV;
@@ -1053,8 +1050,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
        if (error)
                return error;
-        return mmap_region(file, addr, len, flags, vm_flags, pgoff,
+        return mmap_region(file, addr, len, flags, vm_flags, pgoff);
-                           accountable);
 }
 EXPORT_SYMBOL(do_mmap_pgoff);
@@ -1092,17 +1088,23 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
 /*
 * We account for memory if it's a private writeable mapping,
- * and VM_NORESERVE wasn't set.
+ * not hugepages and VM_NORESERVE wasn't set.
 */
-static inline int accountable_mapping(unsigned int vm_flags)
+static inline int accountable_mapping(struct file *file, unsigned int vm_flags)
 {
+        /*
+         * hugetlb has its own accounting separate from the core VM
+         * VM_HUGETLB may not be set yet so we cannot check for that flag.
+         */
+        if (file && is_file_hugepages(file))
+                return 0;
        return (vm_flags & (VM_NORESERVE | VM_SHARED | VM_WRITE)) == VM_WRITE;
 }
 unsigned long mmap_region(struct file *file, unsigned long addr,
                          unsigned long len, unsigned long flags,
-                          unsigned int vm_flags, unsigned long pgoff,
+                          unsigned int vm_flags, unsigned long pgoff)
-                          int accountable)
 {
        struct mm_struct *mm = current->mm;
        struct vm_area_struct *vma, *prev;
@@ -1128,18 +1130,22 @@ munmap_back:
        /*
         * Set 'VM_NORESERVE' if we should not account for the
-         * memory use of this mapping. We only honor MAP_NORESERVE
+         * memory use of this mapping.
-         * if we're allowed to overcommit memory.
         */
-        if ((flags & MAP_NORESERVE) && sysctl_overcommit_memory != OVERCOMMIT_NEVER)
+        if ((flags & MAP_NORESERVE)) {
-                vm_flags |= VM_NORESERVE;
+                /* We honor MAP_NORESERVE if allowed to overcommit */
-        if (!accountable)
+                if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
-                vm_flags |= VM_NORESERVE;
+                        vm_flags |= VM_NORESERVE;
+                /* hugetlb applies strict overcommit unless MAP_NORESERVE */
+                if (file && is_file_hugepages(file))
+                        vm_flags |= VM_NORESERVE;
+        }
        /*
         * Private writable mapping: check memory availability
         */
-        if (accountable_mapping(vm_flags)) {
+        if (accountable_mapping(file, vm_flags)) {
                charged = len >> PAGE_SHIFT;
                if (security_vm_enough_memory(charged))
                        return -ENOMEM;
@@ -2078,12 +2084,8 @@ void exit_mmap(struct mm_struct *mm)
        unsigned long end;
        /* mm's last user has gone, and its about to be pulled down */
-        arch_exit_mmap(mm);
        mmu_notifier_release(mm);
-        if (!mm->mmap)  /* Can happen if dup_mmap() received an OOM */
-                return;
        if (mm->locked_vm) {
                vma = mm->mmap;
                while (vma) {
@@ -2092,7 +2094,13 @@ void exit_mmap(struct mm_struct *mm)
                        vma = vma->vm_next;
                }
        }
+        arch_exit_mmap(mm);
        vma = mm->mmap;
+        if (!vma)       /* Can happen if dup_mmap() received an OOM */
+                return;
        lru_add_drain();
        flush_cache_mm(mm);
        tlb = tlb_gather_mmu(mm, 1);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index abe2694e13f4..258197b76fb4 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -151,10 +151,11 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
        /*
         * If we make a private mapping writable we increase our commit;
         * but (without finer accounting) cannot reduce our commit if we
-         * make it unwritable again.
+         * make it unwritable again. hugetlb mapping were accounted for
+         * even if read-only so there is no need to account for them here
         */
        if (newflags & VM_WRITE) {
-                if (!(oldflags & (VM_ACCOUNT|VM_WRITE|
+                if (!(oldflags & (VM_ACCOUNT|VM_WRITE|VM_HUGETLB|
                                                VM_SHARED|VM_NORESERVE))) {
                        charged = nrpages;
                        if (security_vm_enough_memory(charged))
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index dc32dae01e5f..3c84128596ba 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -209,7 +209,7 @@ int dirty_bytes_handler(struct ctl_table *table, int write,
                struct file *filp, void __user *buffer, size_t *lenp,
                loff_t *ppos)
 {
-        int old_bytes = vm_dirty_bytes;
+        unsigned long old_bytes = vm_dirty_bytes;
        int ret;
        ret = proc_doulongvec_minmax(table, write, filp, buffer, lenp, ppos);
@@ -1051,20 +1051,23 @@ continue_unlock:
                                }
                        }
-                        if (nr_to_write > 0)
+                        if (nr_to_write > 0) {
                                nr_to_write--;
-                        else if (wbc->sync_mode == WB_SYNC_NONE) {
+                                if (nr_to_write == 0 &&
-                                /*
+                                    wbc->sync_mode == WB_SYNC_NONE) {
-                                 * We stop writing back only if we are not
+                                        /*
-                                 * doing integrity sync. In case of integrity
+                                         * We stop writing back only if we are
-                                 * sync we have to keep going because someone
+                                         * not doing integrity sync. In case of
-                                 * may be concurrently dirtying pages, and we
+                                         * integrity sync we have to keep going
-                                 * might have synced a lot of newly appeared
+                                         * because someone may be concurrently
-                                 * dirty pages, but have not synced all of the
+                                         * dirtying pages, and we might have
-                                 * old dirty pages.
+                                         * synced a lot of newly appeared dirty
-                                 */
+                                         * pages, but have not synced all of the
-                                done = 1;
+                                         * old dirty pages.
-                                break;
+                                         */
+                                        done = 1;
+                                        break;
+                                }
                        }
                        if (wbc->nonblocking && bdi_write_congested(bdi)) {
@@ -1076,7 +1079,7 @@ continue_unlock:
                pagevec_release(&pvec);
                cond_resched();
        }
-        if (!cycled) {
+        if (!cycled && !done) {
                /*
                 * range_cyclic:
                 * We hit the last page and there is more work to be done: wrap
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index 7006a11350c8..ceecfbb143fa 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -114,7 +114,8 @@ static int __init_refok init_section_page_cgroup(unsigned long pfn)
                nid = page_to_nid(pfn_to_page(pfn));
                table_size = sizeof(struct page_cgroup) * PAGES_PER_SECTION;
                if (slab_is_available()) {
-                        base = kmalloc_node(table_size, GFP_KERNEL, nid);
+                        base = kmalloc_node(table_size,
+                                        GFP_KERNEL | __GFP_NOWARN, nid);
                        if (!base)
                                base = vmalloc_node(table_size, nid);
                } else {
diff --git a/mm/rmap.c b/mm/rmap.c
index ac4af8cffbf9..16521664010d 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1072,7 +1072,8 @@ static int try_to_unmap_file(struct page *page, int unlock, int migration)
        spin_lock(&mapping->i_mmap_lock);
        vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
                if (MLOCK_PAGES && unlikely(unlock)) {
-                        if (!(vma->vm_flags & VM_LOCKED))
+                        if (!((vma->vm_flags & VM_LOCKED) &&
+                                                page_mapped_in_vma(page, vma)))
                                continue;       /* must visit all vmas */
                        ret = SWAP_MLOCK;
                } else {
diff --git a/mm/slab.c b/mm/slab.c
index dae716b32915..aeeb4ecb9428 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4514,3 +4514,4 @@ size_t ksize(const void *objp)
        return obj_size(virt_to_cache(objp));
 }
+EXPORT_SYMBOL(ksize);
diff --git a/mm/slob.c b/mm/slob.c
index 4d1c0fc33b6b..f9cc24688232 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -535,6 +535,7 @@ size_t ksize(const void *block)
        } else
                return sp->page.private;
 }
+EXPORT_SYMBOL(ksize);
 struct kmem_cache {
        unsigned int size, align;
diff --git a/mm/slub.c b/mm/slub.c
index 0343b3b88984..3525e7b21d19 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2787,6 +2787,7 @@ size_t ksize(const void *object)
         */
        return s->size;
 }
+EXPORT_SYMBOL(ksize);
 void kfree(const void *x)
 {
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index dcd7666824ba..fc70147c771e 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -29,6 +29,7 @@
 #include <linux/errno.h>
 #include <linux/uaccess.h>
 #include <linux/sched.h>
+#include <linux/types.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include "protocol.h"
@@ -160,29 +161,32 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                        break;
                case 'w':{
                                int16_t *val = va_arg(ap, int16_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le16 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                        errcode = -EFAULT;
                                        break;
                                }
-                                *val = cpu_to_le16(*val);
+                                *val = le16_to_cpu(le_val);
                        }
                        break;
                case 'd':{
                                int32_t *val = va_arg(ap, int32_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                        errcode = -EFAULT;
                                        break;
                                }
-                                *val = cpu_to_le32(*val);
+                                *val = le32_to_cpu(le_val);
                        }
                        break;
                case 'q':{
                                int64_t *val = va_arg(ap, int64_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le64 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                        errcode = -EFAULT;
                                        break;
                                }
-                                *val = cpu_to_le64(*val);
+                                *val = le64_to_cpu(le_val);
                        }
                        break;
                case 's':{
@@ -362,19 +366,19 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                        }
                        break;
                case 'w':{
-                                int16_t val = va_arg(ap, int);
+                                __le16 val = cpu_to_le16(va_arg(ap, int));
                                if (pdu_write(pdu, &val, sizeof(val)))
                                        errcode = -EFAULT;
                        }
                        break;
                case 'd':{
-                                int32_t val = va_arg(ap, int32_t);
+                                __le32 val = cpu_to_le32(va_arg(ap, int32_t));
                                if (pdu_write(pdu, &val, sizeof(val)))
                                        errcode = -EFAULT;
                        }
                        break;
                case 'q':{
-                                int64_t val = va_arg(ap, int64_t);
+                                __le64 val = cpu_to_le64(va_arg(ap, int64_t));
                                if (pdu_write(pdu, &val, sizeof(val)))
                                        errcode = -EFAULT;
                        }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index bdd9ccea17ce..d2c27c808d3b 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -67,6 +67,11 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
        struct net_device *indev;
+        if (skb_warn_if_lro(skb)) {
+                kfree_skb(skb);
+                return;
+        }
        indev = skb->dev;
        skb->dev = to->dev;
        skb_forward_csum(skb);
@@ -89,7 +94,7 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 /* called with rcu_read_lock */
 void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
-        if (!skb_warn_if_lro(skb) && should_deliver(to, skb)) {
+        if (should_deliver(to, skb)) {
                __br_forward(to, skb);
                return;
        }
diff --git a/net/core/dev.c b/net/core/dev.c
index 5379b0c1190a..a17e00662363 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1090,7 +1090,7 @@ int dev_open(struct net_device *dev)
                /*
                 *      Enable NET_DMA
                 */
-                dmaengine_get();
+                net_dmaengine_get();
                /*
                 *      Initialize multicasting status
@@ -1172,7 +1172,7 @@ int dev_close(struct net_device *dev)
        /*
         *      Shutdown NET_DMA
         */
-        dmaengine_put();
+        net_dmaengine_put();
        return 0;
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f66c58df8953..278a142d1047 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1994,8 +1994,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                        if (!net_eq(neigh_parms_net(p), net))
                                continue;
-                        if (nidx++ < neigh_skip)
+                        if (nidx < neigh_skip)
-                                continue;
+                                goto next;
                        if (neightbl_fill_param_info(skb, tbl, p,
                                                     NETLINK_CB(cb->skb).pid,
@@ -2003,6 +2003,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                                                     RTM_NEWNEIGHTBL,
                                                     NLM_F_MULTI) <= 0)
                                goto out;
+                next:
+                        nidx++;
                }
                neigh_skip = 0;
@@ -2082,12 +2084,10 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                if (h > s_h)
                        s_idx = 0;
                for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
-                        int lidx;
                        if (dev_net(n->dev) != net)
                                continue;
-                        lidx = idx++;
+                        if (idx < s_idx)
-                        if (lidx < s_idx)
+                                goto next;
-                                continue;
                        if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
                                            cb->nlh->nlmsg_seq,
                                            RTM_NEWNEIGH,
@@ -2096,6 +2096,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                                rc = -1;
                                goto out;
                        }
+                next:
+                        idx++;
                }
        }
        read_unlock_bh(&tbl->lock);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cc3a0a06c004..c47c989cb1fb 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1234,8 +1234,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        struct udphdr *uh;
        unsigned short ulen;
        struct rtable *rt = (struct rtable*)skb->dst;
-        __be32 saddr = ip_hdr(skb)->saddr;
+        __be32 saddr, daddr;
-        __be32 daddr = ip_hdr(skb)->daddr;
        struct net *net = dev_net(skb->dev);
        /*
@@ -1259,6 +1258,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (udp4_csum_init(skb, uh, proto))
                goto csum_error;
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
        if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                return __udp4_lib_mcast_deliver(net, skb, uh,
                                saddr, daddr, udptable);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c62dd247774f..7712578bdc66 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -323,17 +323,21 @@ static struct ip6_flowlabel *
 fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
          int optlen, int *err_p)
 {
-        struct ip6_flowlabel *fl;
+        struct ip6_flowlabel *fl = NULL;
        int olen;
        int addr_type;
        int err;
+        olen = optlen - CMSG_ALIGN(sizeof(*freq));
+        err = -EINVAL;
+        if (olen > 64 * 1024)
+                goto done;
        err = -ENOMEM;
        fl = kzalloc(sizeof(*fl), GFP_KERNEL);
        if (fl == NULL)
                goto done;
-        olen = optlen - CMSG_ALIGN(sizeof(*freq));
        if (olen > 0) {
                struct msghdr msg;
                struct flowi flowi;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 58e2b0d93758..d994c55a5b16 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -249,8 +249,8 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
        }
        t = netdev_priv(dev);
-        ip6_tnl_dev_init(dev);
        t->parms = *p;
+        ip6_tnl_dev_init(dev);
        if ((err = register_netdevice(dev)) < 0)
                goto failed_free;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c455cf4ee756..c323643ffcf9 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -49,8 +49,19 @@ static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
 static const u_int8_t invmap[] = {
        [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
        [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
-        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
+        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_REPLY + 1,
-        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
+        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_QUERY +1
+};
+static const u_int8_t noct_valid_new[] = {
+        [ICMPV6_MGM_QUERY - 130] = 1,
+        [ICMPV6_MGM_REPORT -130] = 1,
+        [ICMPV6_MGM_REDUCTION - 130] = 1,
+        [NDISC_ROUTER_SOLICITATION - 130] = 1,
+        [NDISC_ROUTER_ADVERTISEMENT - 130] = 1,
+        [NDISC_NEIGHBOUR_SOLICITATION - 130] = 1,
+        [NDISC_NEIGHBOUR_ADVERTISEMENT - 130] = 1,
+        [ICMPV6_MLD2_REPORT - 130] = 1
 };
 static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
@@ -178,6 +189,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
 {
        const struct icmp6hdr *icmp6h;
        struct icmp6hdr _ih;
+        int type;
        icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
        if (icmp6h == NULL) {
@@ -194,6 +206,15 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
                return -NF_ACCEPT;
        }
+        type = icmp6h->icmp6_type - 130;
+        if (type >= 0 && type < sizeof(noct_valid_new) &&
+            noct_valid_new[type]) {
+                skb->nfct = &nf_conntrack_untracked.ct_general;
+                skb->nfctinfo = IP_CT_NEW;
+                nf_conntrack_get(skb->nfct);
+                return NF_ACCEPT;
+        }
        /* is not error message ? */
        if (icmp6h->icmp6_type >= 128)
                return NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index c32a7e8e3a1b..cb78aa00399e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -434,7 +434,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
        } else
                return NOTIFY_DONE;
-        if (!nfnetlink_has_listeners(group))
+        if (!item->report && !nfnetlink_has_listeners(group))
                return NOTIFY_DONE;
        skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
@@ -1215,6 +1215,16 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                }
        }
+#ifdef CONFIG_NF_NAT_NEEDED
+        if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
+                err = ctnetlink_change_nat_seq_adj(ct, cda);
+                if (err < 0) {
+                        rcu_read_unlock();
+                        goto err;
+                }
+        }
+#endif
        if (cda[CTA_PROTOINFO]) {
                err = ctnetlink_change_protoinfo(ct, cda);
                if (err < 0) {
@@ -1492,7 +1502,8 @@ static int ctnetlink_expect_event(struct notifier_block *this,
        } else
                return NOTIFY_DONE;
-        if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
+        if (!item->report &&
+            !nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
                return NOTIFY_DONE;
        skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index e223cb43ae8e..a189ada9128f 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -105,7 +105,7 @@ match_packet(const struct sk_buff *skb,
        switch (chunk_match_type) {
        case SCTP_CHUNK_MATCH_ALL:
-                return SCTP_CHUNKMAP_IS_CLEAR(info->chunkmap);
+                return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
        case SCTP_CHUNK_MATCH_ANY:
                return false;
        case SCTP_CHUNK_MATCH_ONLY:
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d7d2bed7a699..eac5e7bb7365 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                if (IS_ERR(trans)) {
                        call = ERR_CAST(trans);
                        trans = NULL;
-                        goto out;
+                        goto out_notrans;
                }
        } else {
                trans = rx->trans;
                if (!trans) {
                        call = ERR_PTR(-ENOTCONN);
-                        goto out;
+                        goto out_notrans;
                }
                atomic_inc(&trans->usage);
        }
@@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
        rxrpc_put_bundle(trans, bundle);
 out:
        rxrpc_put_transport(trans);
+out_notrans:
        release_sock(&rx->sk);
        _leave(" = %p", call);
        return call;
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 8bb83a100edb..0f11870116dc 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1827,6 +1827,40 @@ sub reset_state {
    $state = 0;
 }
+sub syscall_munge() {
+        my $void = 0;
+        $prototype =~ s@[\r\n\t]+@ @gos; # strip newlines/CR's/tabs
+##      if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
+        if ($prototype =~ m/SYSCALL_DEFINE0/) {
+                $void = 1;
+##              $prototype = "long sys_$1(void)";
+        }
+        $prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
+        if ($prototype =~ m/long (sys_.*?),/) {
+                $prototype =~ s/,/\(/;
+        } elsif ($void) {
+                $prototype =~ s/\)/\(void\)/;
+        }
+        # now delete all of the odd-number commas in $prototype
+        # so that arg types & arg names don't have a comma between them
+        my $count = 0;
+        my $len = length($prototype);
+        if ($void) {
+                $len = 0;       # skip the for-loop
+        }
+        for (my $ix = 0; $ix < $len; $ix++) {
+                if (substr($prototype, $ix, 1) eq ',') {
+                        $count++;
+                        if ($count % 2 == 1) {
+                                substr($prototype, $ix, 1) = ' ';
+                        }
+                }
+        }
+}
 sub process_state3_function($$) {
    my $x = shift;
    my $file = shift;
@@ -1839,11 +1873,15 @@ sub process_state3_function($$) {
    elsif ($x =~ /([^\{]*)/) {
        $prototype .= $1;
    }
    if (($x =~ /\{/) || ($x =~ /\#\s*define/) || ($x =~ /;/)) {
        $prototype =~ s@/\*.*?\*/@@gos; # strip comments.
        $prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
        $prototype =~ s@^\s+@@gos; # strip leading spaces
-        dump_function($prototype,$file);
+        if ($prototype =~ /SYSCALL_DEFINE/) {
+                syscall_munge();
+        }
+        dump_function($prototype, $file);
        reset_state();
    }
 }
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 89096e811a4b..772901e41ecb 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -90,7 +90,7 @@ static void aaci_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
         */
        do {
                v = readl(aaci->base + AACI_SLFR);
-        } while ((v & (SLFR_1TXB|SLFR_2TXB)) && timeout--);
+        } while ((v & (SLFR_1TXB|SLFR_2TXB)) && --timeout);
        if (!timeout)
                dev_err(&aaci->dev->dev,
@@ -126,7 +126,7 @@ static unsigned short aaci_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
         */
        do {
                v = readl(aaci->base + AACI_SLFR);
-        } while ((v & SLFR_1TXB) && timeout--);
+        } while ((v & SLFR_1TXB) && --timeout);
        if (!timeout) {
                dev_err(&aaci->dev->dev, "timeout on slot 1 TX busy\n");
@@ -147,7 +147,7 @@ static unsigned short aaci_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
        do {
                cond_resched();
                v = readl(aaci->base + AACI_SLFR) & (SLFR_1RXV|SLFR_2RXV);
-        } while ((v != (SLFR_1RXV|SLFR_2RXV)) && timeout--);
+        } while ((v != (SLFR_1RXV|SLFR_2RXV)) && --timeout);
        if (!timeout) {
                dev_err(&aaci->dev->dev, "timeout on RX valid\n");