234 files changed, 2817 insertions, 1950 deletions
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index f54273e2ac97..ceb1ff735469 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -210,6 +210,8 @@ local_ops.txt
        - semantics and behavior of local atomic operations.
 lockdep-design.txt
        - documentation on the runtime locking correctness validator.
+lockup-watchdogs.txt
+        - info on soft and hard lockup detectors (aka nmi_watchdog).
 logo.gif
        - full colour GIF image of Linux logo (penguin - Tux).
 logo.txt
@@ -240,8 +242,6 @@ netlabel/
        - directory with information on the NetLabel subsystem.
 networking/
        - directory with info on various aspects of networking with Linux.
-nmi_watchdog.txt
-        - info on NMI watchdog for SMP systems.
 nommu-mmap.txt
        - documentation about no-mmu memory mapping support.
 numastat.txt
diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
index c8e578263ce2..683fde93c4fb 100644
--- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
+++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
@@ -93,7 +93,7 @@ Valid values for pin and group names are:
    With some exceptions, these support nvidia,high-speed-mode,
    nvidia,schmitt, nvidia,low-power-mode, nvidia,pull-down-strength,
-    nvidia,pull-up-strength, nvidia,slew_rate-rising, nvidia,slew_rate-falling.
+    nvidia,pull-up-strength, nvidia,slew-rate-rising, nvidia,slew-rate-falling.
    drive_ao1, drive_ao2, drive_at1, drive_at2, drive_cdev1, drive_cdev2,
    drive_csus, drive_dap1, drive_dap2, drive_dap3, drive_dap4, drive_dbg,
diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
index c275b70349c1..6f426ed7009e 100644
--- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
+++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
@@ -83,7 +83,7 @@ Valid values for pin and group names are:
  drive groups:
    These all support nvidia,pull-down-strength, nvidia,pull-up-strength,
-    nvidia,slew_rate-rising, nvidia,slew_rate-falling. Most but not all
+    nvidia,slew-rate-rising, nvidia,slew-rate-falling. Most but not all
    support nvidia,high-speed-mode, nvidia,schmitt, nvidia,low-power-mode.
    ao1, ao2, at1, at2, at3, at4, at5, cdev1, cdev2, cec, crt, csus, dap1,
diff --git a/MAINTAINERS b/MAINTAINERS
index 027ec2bfa135..f39a82dc0260 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2802,6 +2802,7 @@ F:	sound/usb/misc/ua101.c
 EXTENSIBLE FIRMWARE INTERFACE (EFI)
 M:      Matt Fleming <matt.fleming@intel.com>
 L:      linux-efi@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi.git
 S:      Maintained
 F:      Documentation/x86/efi-stub.txt
 F:      arch/ia64/kernel/efi.c
diff --git a/arch/alpha/include/asm/thread_info.h b/arch/alpha/include/asm/thread_info.h
index 4554ecbff7c6..1f8c72959fb6 100644
--- a/arch/alpha/include/asm/thread_info.h
+++ b/arch/alpha/include/asm/thread_info.h
@@ -7,6 +7,7 @@
 #include <asm/processor.h>
 #include <asm/types.h>
 #include <asm/hwrpb.h>
+#include <asm/sysinfo.h>
 #endif
 #ifndef __ASSEMBLY__
@@ -21,6 +22,7 @@ struct thread_info {
        mm_segment_t            addr_limit;     /* thread address space */
        unsigned                cpu;            /* current CPU */
        int                     preempt_count; /* 0 => preemptable, <0 => BUG */
+        unsigned int            status;         /* thread-synchronous flags */
        int bpt_nsaved;
        unsigned long bpt_addr[2];              /* breakpoint handling  */
@@ -63,8 +65,6 @@ register struct thread_info *__current_thread_info __asm__("$8");
 * - these are process state flags and used from assembly
 * - pending work-to-be-done flags come first and must be assigned to be
 *   within bits 0 to 7 to fit in and immediate operand.
- * - ALPHA_UAC_SHIFT below must be kept consistent with the unaligned
- *   control flags.
 *
 * TIF_SYSCALL_TRACE is known to be 0 via blbs.
 */
@@ -72,18 +72,12 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define TIF_NOTIFY_RESUME       1       /* callback before returning to user */
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
-#define TIF_POLLING_NRFLAG      8       /* poll_idle is polling NEED_RESCHED */
 #define TIF_DIE_IF_KERNEL       9       /* dik recursion lock */
-#define TIF_UAC_NOPRINT         10      /* ! Preserve sequence of following */
-#define TIF_UAC_NOFIX           11      /* ! flags as they match            */
-#define TIF_UAC_SIGBUS          12      /* ! userspace part of 'osf_sysinfo' */
 #define TIF_MEMDIE              13      /* is terminating due to OOM killer */
-#define TIF_RESTORE_SIGMASK     14      /* restore signal mask in do_signal */
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING         (1<<TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
-#define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_NOTIFY_RESUME      (1<<TIF_NOTIFY_RESUME)
 /* Work to do on interrupt/exception return.  */
@@ -94,29 +88,63 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define _TIF_ALLWORK_MASK       (_TIF_WORK_MASK         \
                                 | _TIF_SYSCALL_TRACE)
-#define ALPHA_UAC_SHIFT         TIF_UAC_NOPRINT
+#define TS_UAC_NOPRINT          0x0001  /* ! Preserve the following three */
-#define ALPHA_UAC_MASK          (1 << TIF_UAC_NOPRINT | 1 << TIF_UAC_NOFIX | \
+#define TS_UAC_NOFIX            0x0002  /* ! flags as they match          */
-                                 1 << TIF_UAC_SIGBUS)
+#define TS_UAC_SIGBUS           0x0004  /* ! userspace part of 'osf_sysinfo' */
+#define TS_RESTORE_SIGMASK      0x0008  /* restore signal mask in do_signal() */
+#define TS_POLLING              0x0010  /* idle task polling need_resched,
+                                           skip sending interrupt */
-#define SET_UNALIGN_CTL(task,value)     ({                                   \
+#define tsk_is_polling(t) (task_thread_info(t)->status & TS_POLLING)
-        task_thread_info(task)->flags = ((task_thread_info(task)->flags &    \
-                ~ALPHA_UAC_MASK)                                             \
+#ifndef __ASSEMBLY__
-                | (((value) << ALPHA_UAC_SHIFT)       & (1<<TIF_UAC_NOPRINT))\
+#define HAVE_SET_RESTORE_SIGMASK        1
-                | (((value) << (ALPHA_UAC_SHIFT + 1)) & (1<<TIF_UAC_SIGBUS)) \
+static inline void set_restore_sigmask(void)
-                | (((value) << (ALPHA_UAC_SHIFT - 1)) & (1<<TIF_UAC_NOFIX)));\
+{
+        struct thread_info *ti = current_thread_info();
+        ti->status |= TS_RESTORE_SIGMASK;
+        WARN_ON(!test_bit(TIF_SIGPENDING, (unsigned long *)&ti->flags));
+}
+static inline void clear_restore_sigmask(void)
+{
+        current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
+}
+static inline bool test_restore_sigmask(void)
+{
+        return current_thread_info()->status & TS_RESTORE_SIGMASK;
+}
+static inline bool test_and_clear_restore_sigmask(void)
+{
+        struct thread_info *ti = current_thread_info();
+        if (!(ti->status & TS_RESTORE_SIGMASK))
+                return false;
+        ti->status &= ~TS_RESTORE_SIGMASK;
+        return true;
+}
+#endif
+#define SET_UNALIGN_CTL(task,value)     ({                              \
+        __u32 status = task_thread_info(task)->status & ~UAC_BITMASK;   \
+        if (value & PR_UNALIGN_NOPRINT)                                 \
+                status |= TS_UAC_NOPRINT;                               \
+        if (value & PR_UNALIGN_SIGBUS)                                  \
+                status |= TS_UAC_SIGBUS;                                \
+        if (value & 4)  /* alpha-specific */                            \
+                status |= TS_UAC_NOFIX;                                 \
+        task_thread_info(task)->status = status;                        \
        0; })
 #define GET_UNALIGN_CTL(task,value)     ({                              \
-        put_user((task_thread_info(task)->flags & (1 << TIF_UAC_NOPRINT))\
+        __u32 status = task_thread_info(task)->status & ~UAC_BITMASK;   \
-                  >> ALPHA_UAC_SHIFT                                    \
+        __u32 res = 0;                                                  \
-                 | (task_thread_info(task)->flags & (1 << TIF_UAC_SIGBUS))\
+        if (status & TS_UAC_NOPRINT)                                    \
-                 >> (ALPHA_UAC_SHIFT + 1)                               \
+                res |= PR_UNALIGN_NOPRINT;                              \
-                 | (task_thread_info(task)->flags & (1 << TIF_UAC_NOFIX))\
+        if (status & TS_UAC_SIGBUS)                                     \
-                 >> (ALPHA_UAC_SHIFT - 1),                              \
+                res |= PR_UNALIGN_SIGBUS;                               \
-                 (int __user *)(value));                                \
+        if (status & TS_UAC_NOFIX)                                      \
+                res |= 4;                                               \
+        put_user(res, (int __user *)(value));                           \
        })
-#define tsk_is_polling(t) test_tsk_thread_flag(t, TIF_POLLING_NRFLAG)
 #endif /* __KERNEL__ */
 #endif /* _ALPHA_THREAD_INFO_H */
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 9eb090582cf1..1e6956a90608 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -793,8 +793,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
        case GSI_UACPROC:
                if (nbytes < sizeof(unsigned int))
                        return -EINVAL;
-                w = (current_thread_info()->flags >> ALPHA_UAC_SHIFT) &
+                w = current_thread_info()->status & UAC_BITMASK;
-                        UAC_BITMASK;
                if (put_user(w, (unsigned int __user *)buffer))
                        return -EFAULT;
                return 1;
@@ -904,24 +903,20 @@ SYSCALL_DEFINE5(osf_setsysinfo, unsigned long, op, void __user *, buffer,
                break;
        case SSI_NVPAIRS: {
-                unsigned long v, w, i;
+                unsigned __user *p = buffer;
-                unsigned int old, new;
+                unsigned i;
                
-                for (i = 0; i < nbytes; ++i) {
+                for (i = 0, p = buffer; i < nbytes; ++i, p += 2) {
+                        unsigned v, w, status;
-                        if (get_user(v, 2*i + (unsigned int __user *)buffer))
+                        if (get_user(v, p) || get_user(w, p + 1))
-                                return -EFAULT;
-                        if (get_user(w, 2*i + 1 + (unsigned int __user *)buffer))
                                return -EFAULT;
                        switch (v) {
                        case SSIN_UACPROC:
-                        again:
+                                w &= UAC_BITMASK;
-                                old = current_thread_info()->flags;
+                                status = current_thread_info()->status;
-                                new = old & ~(UAC_BITMASK << ALPHA_UAC_SHIFT);
+                                status = (status & ~UAC_BITMASK) | w;
-                                new = new | (w & UAC_BITMASK) << ALPHA_UAC_SHIFT;
+                                current_thread_info()->status = status;
-                                if (cmpxchg(&current_thread_info()->flags,
-                                            old, new) != old)
-                                        goto again;
                                break;
 
                        default:
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 4054e0ffe2b2..51987dcf79b8 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -49,7 +49,7 @@ EXPORT_SYMBOL(pm_power_off);
 void
 cpu_idle(void)
 {
-        set_thread_flag(TIF_POLLING_NRFLAG);
+        current_thread_info()->status |= TS_POLLING;
        while (1) {
                /* FIXME -- EV6 and LCA45 know how to power down
diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
index 80d987c0e9aa..272666d006df 100644
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -780,17 +780,17 @@ do_entUnaUser(void __user * va, unsigned long opcode,
        /* Check the UAC bits to decide what the user wants us to do
           with the unaliged access.  */
-        if (!test_thread_flag (TIF_UAC_NOPRINT)) {
+        if (!(current_thread_info()->status & TS_UAC_NOPRINT)) {
                if (__ratelimit(&ratelimit)) {
                        printk("%s(%d): unaligned trap at %016lx: %p %lx %ld\n",
                               current->comm, task_pid_nr(current),
                               regs->pc - 4, va, opcode, reg);
                }
        }
-        if (test_thread_flag (TIF_UAC_SIGBUS))
+        if ((current_thread_info()->status & TS_UAC_SIGBUS))
                goto give_sigbus;
        /* Not sure why you'd want to use this, but... */
-        if (test_thread_flag (TIF_UAC_NOFIX))
+        if ((current_thread_info()->status & TS_UAC_NOFIX))
                return;
        /* Don't bother reading ds in the access check since we already
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 73067efd4845..ade7e924bef5 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1603,8 +1603,8 @@ config NR_CPUS
        default "4"
 config HOTPLUG_CPU
-        bool "Support for hot-pluggable CPUs (EXPERIMENTAL)"
+        bool "Support for hot-pluggable CPUs"
-        depends on SMP && HOTPLUG && EXPERIMENTAL
+        depends on SMP && HOTPLUG
        help
          Say Y here to experiment with turning CPUs off and on.  CPUs
          can be controlled through /sys/devices/system/cpu.
@@ -1645,8 +1645,8 @@ config HZ
        default 100
 config THUMB2_KERNEL
-        bool "Compile the kernel in Thumb-2 mode (EXPERIMENTAL)"
+        bool "Compile the kernel in Thumb-2 mode"
-        depends on CPU_V7 && !CPU_V6 && !CPU_V6K && EXPERIMENTAL
+        depends on CPU_V7 && !CPU_V6 && !CPU_V6K
        select AEABI
        select ARM_ASM_UNIFIED
        select ARM_UNWIND
@@ -1850,6 +1850,7 @@ config XEN_DOM0
 config XEN
        bool "Xen guest support on ARM (EXPERIMENTAL)"
        depends on EXPERIMENTAL && ARM && OF
+        depends on CPU_V7 && !CPU_V6
        help
          Say Y if you want to run Linux in a Virtual Machine on Xen on ARM.
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index f023e3acdfbd..5f914fca911b 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -21,8 +21,6 @@ endif
 OBJCOPYFLAGS    :=-O binary -R .comment -S
 GZFLAGS         :=-9
 #KBUILD_CFLAGS  +=-pipe
-# Explicitly specifiy 32-bit ARM ISA since toolchain default can be -mthumb:
-KBUILD_CFLAGS   +=$(call cc-option,-marm,)
 # Never generate .eh_frame
 KBUILD_CFLAGS   += $(call cc-option,-fno-dwarf2-cfi-asm)
@@ -105,17 +103,20 @@ endif
 ifeq ($(CONFIG_THUMB2_KERNEL),y)
 AFLAGS_AUTOIT   :=$(call as-option,-Wa$(comma)-mimplicit-it=always,-Wa$(comma)-mauto-it)
 AFLAGS_NOWARN   :=$(call as-option,-Wa$(comma)-mno-warn-deprecated,-Wa$(comma)-W)
-CFLAGS_THUMB2   :=-mthumb $(AFLAGS_AUTOIT) $(AFLAGS_NOWARN)
+CFLAGS_ISA      :=-mthumb $(AFLAGS_AUTOIT) $(AFLAGS_NOWARN)
-AFLAGS_THUMB2   :=$(CFLAGS_THUMB2) -Wa$(comma)-mthumb
+AFLAGS_ISA      :=$(CFLAGS_ISA) -Wa$(comma)-mthumb
 # Work around buggy relocation from gas if requested:
 ifeq ($(CONFIG_THUMB2_AVOID_R_ARM_THM_JUMP11),y)
 CFLAGS_MODULE   +=-fno-optimize-sibling-calls
 endif
+else
+CFLAGS_ISA      :=$(call cc-option,-marm,)
+AFLAGS_ISA      :=$(CFLAGS_ISA)
 endif
 # Need -Uarm for gcc < 3.x
-KBUILD_CFLAGS   +=$(CFLAGS_ABI) $(CFLAGS_THUMB2) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
+KBUILD_CFLAGS   +=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
-KBUILD_AFLAGS   +=$(CFLAGS_ABI) $(AFLAGS_THUMB2) $(arch-y) $(tune-y) -include asm/unified.h -msoft-float
+KBUILD_AFLAGS   +=$(CFLAGS_ABI) $(AFLAGS_ISA) $(arch-y) $(tune-y) -include asm/unified.h -msoft-float
 CHECKFLAGS      += -D__arm__
diff --git a/arch/arm/boot/Makefile b/arch/arm/boot/Makefile
index 3fdab016aa5c..f2aa09eb658e 100644
--- a/arch/arm/boot/Makefile
+++ b/arch/arm/boot/Makefile
@@ -33,7 +33,7 @@ ifeq ($(CONFIG_XIP_KERNEL),y)
 $(obj)/xipImage: vmlinux FORCE
        $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready (physical address: $(CONFIG_XIP_PHYS_ADDR))'
+        $(kecho) '  Kernel: $@ is ready (physical address: $(CONFIG_XIP_PHYS_ADDR))'
 $(obj)/Image $(obj)/zImage: FORCE
        @echo 'Kernel configured for XIP (CONFIG_XIP_KERNEL=y)'
@@ -48,14 +48,14 @@ $(obj)/xipImage: FORCE
 $(obj)/Image: vmlinux FORCE
        $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready'
+        $(kecho) '  Kernel: $@ is ready'
 $(obj)/compressed/vmlinux: $(obj)/Image FORCE
        $(Q)$(MAKE) $(build)=$(obj)/compressed $@
 $(obj)/zImage:  $(obj)/compressed/vmlinux FORCE
        $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready'
+        $(kecho) '  Kernel: $@ is ready'
 endif
@@ -90,7 +90,7 @@ fi
 $(obj)/uImage:  $(obj)/zImage FORCE
        @$(check_for_multiple_loadaddr)
        $(call if_changed,uimage)
-        @echo '  Image $@ is ready'
+        $(kecho) '  Image $@ is ready'
 $(obj)/bootp/bootp: $(obj)/zImage initrd FORCE
        $(Q)$(MAKE) $(build)=$(obj)/bootp $@
@@ -98,7 +98,7 @@ $(obj)/bootp/bootp: $(obj)/zImage initrd FORCE
 $(obj)/bootpImage: $(obj)/bootp/bootp FORCE
        $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready'
+        $(kecho) '  Kernel: $@ is ready'
 PHONY += initrd FORCE
 initrd:
diff --git a/arch/arm/include/asm/flat.h b/arch/arm/include/asm/flat.h
index 59426a4595c9..e847d23351ed 100644
--- a/arch/arm/include/asm/flat.h
+++ b/arch/arm/include/asm/flat.h
@@ -8,7 +8,7 @@
 #define flat_argvp_envp_on_stack()              1
 #define flat_old_ram_flag(flags)                (flags)
 #define flat_reloc_valid(reloc, size)           ((reloc) <= (size))
-#define flat_get_addr_from_rp(rp, relval, flags, persistent) get_unaligned(rp)
+#define flat_get_addr_from_rp(rp, relval, flags, persistent) ((void)persistent,get_unaligned(rp))
 #define flat_put_addr_at_rp(rp, val, relval)    put_unaligned(val,rp)
 #define flat_get_relocate_addr(rel)             (rel)
 #define flat_set_persistent(relval, p)          0
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 77bd79f2ffdb..7e1f76027f66 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -200,8 +200,8 @@ extern int __put_user_8(void *, unsigned long long);
 #define USER_DS                 KERNEL_DS
 #define segment_eq(a,b)         (1)
-#define __addr_ok(addr)         (1)
+#define __addr_ok(addr)         ((void)(addr),1)
-#define __range_ok(addr,size)   (0)
+#define __range_ok(addr,size)   ((void)(addr),0)
 #define get_fs()                (KERNEL_DS)
 static inline void set_fs(mm_segment_t fs)
diff --git a/arch/arm/include/asm/xen/interface.h b/arch/arm/include/asm/xen/interface.h
index ae05e56dd17d..5000397134b4 100644
--- a/arch/arm/include/asm/xen/interface.h
+++ b/arch/arm/include/asm/xen/interface.h
@@ -29,16 +29,22 @@
 #ifndef __ASSEMBLY__
 /* Explicitly size integers that represent pfns in the interface with
- * Xen so that we can have one ABI that works for 32 and 64 bit guests. */
+ * Xen so that we can have one ABI that works for 32 and 64 bit guests.
+ * Note that this means that the xen_pfn_t type may be capable of
+ * representing pfn's which the guest cannot represent in its own pfn
+ * type. However since pfn space is controlled by the guest this is
+ * fine since it simply wouldn't be able to create any sure pfns in
+ * the first place.
+ */
 typedef uint64_t xen_pfn_t;
+#define PRI_xen_pfn "llx"
 typedef uint64_t xen_ulong_t;
+#define PRI_xen_ulong "llx"
 /* Guest handles for primitive C types. */
 __DEFINE_GUEST_HANDLE(uchar, unsigned char);
 __DEFINE_GUEST_HANDLE(uint,  unsigned int);
-__DEFINE_GUEST_HANDLE(ulong, unsigned long);
 DEFINE_GUEST_HANDLE(char);
 DEFINE_GUEST_HANDLE(int);
-DEFINE_GUEST_HANDLE(long);
 DEFINE_GUEST_HANDLE(void);
 DEFINE_GUEST_HANDLE(uint64_t);
 DEFINE_GUEST_HANDLE(uint32_t);
diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
index 174202318dff..c6b9096cef95 100644
--- a/arch/arm/include/asm/xen/page.h
+++ b/arch/arm/include/asm/xen/page.h
@@ -10,7 +10,7 @@
 #include <xen/interface/grant_table.h>
 #define pfn_to_mfn(pfn)                 (pfn)
-#define phys_to_machine_mapping_valid   (1)
+#define phys_to_machine_mapping_valid(pfn) (1)
 #define mfn_to_pfn(mfn)                 (mfn)
 #define mfn_to_virt(m)                  (__va(mfn_to_pfn(m) << PAGE_SHIFT))
@@ -30,6 +30,8 @@ typedef struct xpaddr {
 #define XMADDR(x)       ((xmaddr_t) { .maddr = (x) })
 #define XPADDR(x)       ((xpaddr_t) { .paddr = (x) })
+#define INVALID_P2M_ENTRY      (~0UL)
 static inline xmaddr_t phys_to_machine(xpaddr_t phys)
 {
        unsigned offset = phys.paddr & ~PAGE_MASK;
@@ -74,9 +76,14 @@ static inline int m2p_remove_override(struct page *page, bool clear_pte)
        return 0;
 }
+static inline bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn)
+{
+        BUG_ON(pfn != mfn && mfn != INVALID_P2M_ENTRY);
+        return true;
+}
 static inline bool set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 {
-        BUG();
+        return __set_phys_to_machine(pfn, mfn);
-        return false;
 }
 #endif /* _ASM_ARM_XEN_PAGE_H */
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 16cedb42c0c3..896165096d6a 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -34,6 +34,7 @@
 #include <linux/list.h>
 #include <linux/kallsyms.h>
 #include <linux/proc_fs.h>
+#include <linux/export.h>
 #include <asm/exception.h>
 #include <asm/mach/arch.h>
@@ -109,6 +110,7 @@ void set_irq_flags(unsigned int irq, unsigned int iflags)
        /* Order is clear bits in "clr" then set bits in "set" */
        irq_modify_status(irq, clr, set & ~clr);
 }
+EXPORT_SYMBOL_GPL(set_irq_flags);
 void __init init_IRQ(void)
 {
diff --git a/arch/arm/kernel/kprobes-test-arm.c b/arch/arm/kernel/kprobes-test-arm.c
index 38c1a3b103a0..839312905067 100644
--- a/arch/arm/kernel/kprobes-test-arm.c
+++ b/arch/arm/kernel/kprobes-test-arm.c
@@ -366,7 +366,9 @@ void kprobe_arm_test_cases(void)
        TEST_UNSUPPORTED(".word 0xe04f0392 @ umaal r0, pc, r2, r3")
        TEST_UNSUPPORTED(".word 0xe0500090 @ undef")
        TEST_UNSUPPORTED(".word 0xe05fff9f @ undef")
+#endif
+#if __LINUX_ARM_ARCH__ >= 7
        TEST_RRR(  "mls         r0, r",1, VAL1,", r",2, VAL2,", r",3,  VAL3,"")
        TEST_RRR(  "mlshi       r7, r",8, VAL3,", r",9, VAL1,", r",10, VAL2,"")
        TEST_RR(   "mls         lr, r",1, VAL2,", r",2, VAL3,", r13")
@@ -456,6 +458,8 @@ void kprobe_arm_test_cases(void)
        TEST_UNSUPPORTED(".word 0xe1700090") /* Unallocated space */
 #if __LINUX_ARM_ARCH__ >= 6
        TEST_UNSUPPORTED("ldrex r2, [sp]")
+#endif
+#if (__LINUX_ARM_ARCH__ >= 7) || defined(CONFIG_CPU_32v6K)
        TEST_UNSUPPORTED("strexd        r0, r2, r3, [sp]")
        TEST_UNSUPPORTED("ldrexd        r2, r3, [sp]")
        TEST_UNSUPPORTED("strexb        r0, r2, [sp]")
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index e29c3337ca81..8ef8c9337809 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -45,10 +45,9 @@ int machine_kexec_prepare(struct kimage *image)
        for (i = 0; i < image->nr_segments; i++) {
                current_segment = &image->segment[i];
-                err = memblock_is_region_memory(current_segment->mem,
+                if (!memblock_is_region_memory(current_segment->mem,
-                                                current_segment->memsz);
+                                               current_segment->memsz))
-                if (err)
+                        return -EINVAL;
-                        return - EINVAL;
                err = get_user(header, (__be32*)current_segment->buf);
                if (err)
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 93971b1a4f0b..53c0304b734a 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -96,6 +96,10 @@ armpmu_event_set_period(struct perf_event *event,
        s64 period = hwc->sample_period;
        int ret = 0;
+        /* The period may have been changed by PERF_EVENT_IOC_PERIOD */
+        if (unlikely(period != hwc->last_period))
+                left = period - (hwc->last_period - left);
        if (unlikely(left <= -period)) {
                left = period;
                local64_set(&hwc->period_left, left);
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 8e20754dd31d..fbc8b2623d82 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -294,18 +294,24 @@ static void percpu_timer_setup(void);
 asmlinkage void __cpuinit secondary_start_kernel(void)
 {
        struct mm_struct *mm = &init_mm;
-        unsigned int cpu = smp_processor_id();
+        unsigned int cpu;
+        /*
+         * The identity mapping is uncached (strongly ordered), so
+         * switch away from it before attempting any exclusive accesses.
+         */
+        cpu_switch_mm(mm->pgd, mm);
+        enter_lazy_tlb(mm, current);
+        local_flush_tlb_all();
        /*
         * All kernel threads share the same mm context; grab a
         * reference and switch to it.
         */
+        cpu = smp_processor_id();
        atomic_inc(&mm->mm_count);
        current->active_mm = mm;
        cpumask_set_cpu(cpu, mm_cpumask(mm));
-        cpu_switch_mm(mm->pgd, mm);
-        enter_lazy_tlb(mm, current);
-        local_flush_tlb_all();
        printk("CPU%u: Booted secondary processor\n", cpu);
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index e1f906989bb8..b22d700fea27 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -42,10 +42,10 @@ static void twd_set_mode(enum clock_event_mode mode,
        switch (mode) {
        case CLOCK_EVT_MODE_PERIODIC:
-                /* timer load already set up */
                ctrl = TWD_TIMER_CONTROL_ENABLE | TWD_TIMER_CONTROL_IT_ENABLE
                        | TWD_TIMER_CONTROL_PERIODIC;
-                __raw_writel(twd_timer_rate / HZ, twd_base + TWD_TIMER_LOAD);
+                __raw_writel(DIV_ROUND_CLOSEST(twd_timer_rate, HZ),
+                        twd_base + TWD_TIMER_LOAD);
                break;
        case CLOCK_EVT_MODE_ONESHOT:
                /* period set, and timer enabled in 'next_event' hook */
diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
index 9d0a30032d7f..0dc53854a5d8 100644
--- a/arch/arm/lib/delay.c
+++ b/arch/arm/lib/delay.c
@@ -45,6 +45,7 @@ int read_current_timer(unsigned long *timer_val)
        *timer_val = delay_timer->read_current_timer();
        return 0;
 }
+EXPORT_SYMBOL_GPL(read_current_timer);
 static void __timer_delay(unsigned long cycles)
 {
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index b9f60ebe3bc4..023f443784ec 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -856,8 +856,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
                if (thumb2_32b) {
                        offset.un = 0;
                        handler = do_alignment_t32_to_handler(&instr, regs, &offset);
-                } else
+                } else {
+                        offset.un = 0;
                        handler = do_alignment_ldmstm;
+                }
                break;
        default:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 477a2d23ddf1..58bc3e4d3bd0 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -610,7 +610,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
                         gfp_t gfp, pgprot_t prot, bool is_coherent, const void *caller)
 {
        u64 mask = get_coherent_dma_mask(dev);
-        struct page *page;
+        struct page *page = NULL;
        void *addr;
 #ifdef CONFIG_DMA_API_DEBUG
diff --git a/arch/arm/mm/vmregion.h b/arch/arm/mm/vmregion.h
index bf312c354a21..0f5a5f2a2c7b 100644
--- a/arch/arm/mm/vmregion.h
+++ b/arch/arm/mm/vmregion.h
@@ -17,7 +17,6 @@ struct arm_vmregion {
        struct list_head        vm_list;
        unsigned long           vm_start;
        unsigned long           vm_end;
-        void                    *priv;
        int                     vm_active;
        const void              *caller;
 };
diff --git a/arch/arm/tools/Makefile b/arch/arm/tools/Makefile
index 635cb1865e4d..cd60a81163e9 100644
--- a/arch/arm/tools/Makefile
+++ b/arch/arm/tools/Makefile
@@ -5,6 +5,6 @@
 #
 include/generated/mach-types.h: $(src)/gen-mach-types $(src)/mach-types
-        @echo '  Generating $@'
+        $(kecho) '  Generating $@'
        @mkdir -p $(dir $@)
        $(Q)$(AWK) -f $^ > $@ || { rm -f $@; /bin/false; }
diff --git a/arch/arm/xen/grant-table.c b/arch/arm/xen/grant-table.c
index dbd1330c0196..859a9bb002d5 100644
--- a/arch/arm/xen/grant-table.c
+++ b/arch/arm/xen/grant-table.c
@@ -33,7 +33,7 @@
 #include <xen/page.h>
 #include <xen/grant_table.h>
-int arch_gnttab_map_shared(unsigned long *frames, unsigned long nr_gframes,
+int arch_gnttab_map_shared(xen_pfn_t *frames, unsigned long nr_gframes,
                           unsigned long max_nr_gframes,
                           void **__shared)
 {
diff --git a/arch/ia64/include/asm/Kbuild b/arch/ia64/include/asm/Kbuild
index 4a159da23633..dd02f09b6eda 100644
--- a/arch/ia64/include/asm/Kbuild
+++ b/arch/ia64/include/asm/Kbuild
@@ -1,3 +1,4 @@
 generic-y += clkdev.h
 generic-y += exec.h
+generic-y += kvm_para.h
diff --git a/arch/ia64/include/asm/kvm_para.h b/arch/ia64/include/asm/kvm_para.h
deleted file mode 100644
index 47c00f910434..000000000000
--- a/arch/ia64/include/asm/kvm_para.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) 2007 Xiantao Zhang <xiantao.zhang@intel.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place - Suite 330, Boston, MA 02111-1307 USA.
- *
- */
-#ifndef __IA64_KVM_PARA_H
-#define __IA64_KVM_PARA_H
-#include <uapi/asm/kvm_para.h>
-static inline unsigned int kvm_arch_para_features(void)
-{
-        return 0;
-}
-static inline bool kvm_check_and_clear_guest_paused(void)
-{
-        return false;
-}
-#endif
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index ecb540810ab3..88fa3ac86fae 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,5 +1,3 @@
-include include/asm-generic/Kbuild.asm
-header-y += cachectl.h
 generic-y += bitsperlong.h
 generic-y += clkdev.h
diff --git a/arch/m68k/include/asm/ptrace.h b/arch/m68k/include/asm/ptrace.h
index 5e08b597f012..0f717045bdde 100644
--- a/arch/m68k/include/asm/ptrace.h
+++ b/arch/m68k/include/asm/ptrace.h
@@ -1,82 +1,10 @@
 #ifndef _M68K_PTRACE_H
 #define _M68K_PTRACE_H
-#define PT_D1      0
+#include <uapi/asm/ptrace.h>
-#define PT_D2      1
-#define PT_D3      2
-#define PT_D4      3
-#define PT_D5      4
-#define PT_D6      5
-#define PT_D7      6
-#define PT_A0      7
-#define PT_A1      8
-#define PT_A2      9
-#define PT_A3      10
-#define PT_A4      11
-#define PT_A5      12
-#define PT_A6      13
-#define PT_D0      14
-#define PT_USP     15
-#define PT_ORIG_D0 16
-#define PT_SR      17
-#define PT_PC      18
 #ifndef __ASSEMBLY__
-/* this struct defines the way the registers are stored on the
-   stack during a system call. */
-struct pt_regs {
-  long     d1;
-  long     d2;
-  long     d3;
-  long     d4;
-  long     d5;
-  long     a0;
-  long     a1;
-  long     a2;
-  long     d0;
-  long     orig_d0;
-  long     stkadj;
-#ifdef CONFIG_COLDFIRE
-  unsigned format :  4; /* frame format specifier */
-  unsigned vector : 12; /* vector offset */
-  unsigned short sr;
-  unsigned long  pc;
-#else
-  unsigned short sr;
-  unsigned long  pc;
-  unsigned format :  4; /* frame format specifier */
-  unsigned vector : 12; /* vector offset */
-#endif
-};
-/*
- * This is the extended stack used by signal handlers and the context
- * switcher: it's pushed after the normal "struct pt_regs".
- */
-struct switch_stack {
-        unsigned long  d6;
-        unsigned long  d7;
-        unsigned long  a3;
-        unsigned long  a4;
-        unsigned long  a5;
-        unsigned long  a6;
-        unsigned long  retpc;
-};
-/* Arbitrarily choose the same ptrace numbers as used by the Sparc code. */
-#define PTRACE_GETREGS            12
-#define PTRACE_SETREGS            13
-#define PTRACE_GETFPREGS          14
-#define PTRACE_SETFPREGS          15
-#define PTRACE_GET_THREAD_AREA    25
-#define PTRACE_SINGLEBLOCK      33      /* resume execution until next branch */
-#ifdef __KERNEL__
 #ifndef PS_S
 #define PS_S  (0x2000)
 #define PS_M  (0x1000)
@@ -94,6 +22,5 @@ struct switch_stack {
 #define arch_has_block_step()   (1)
 #endif
-#endif /* __KERNEL__ */
 #endif /* __ASSEMBLY__ */
 #endif /* _M68K_PTRACE_H */
diff --git a/arch/m68k/include/asm/setup.h b/arch/m68k/include/asm/setup.h
index 00c2c5397d37..65e78a2dad64 100644
--- a/arch/m68k/include/asm/setup.h
+++ b/arch/m68k/include/asm/setup.h
@@ -19,33 +19,12 @@
 **   Redesign of the boot information structure; moved boot information
 **   structure to bootinfo.h
 */
 #ifndef _M68K_SETUP_H
 #define _M68K_SETUP_H
+#include <uapi/asm/setup.h>
-    /*
-     *  Linux/m68k Architectures
-     */
-#define MACH_AMIGA    1
-#define MACH_ATARI    2
-#define MACH_MAC      3
-#define MACH_APOLLO   4
-#define MACH_SUN3     5
-#define MACH_MVME147  6
-#define MACH_MVME16x  7
-#define MACH_BVME6000 8
-#define MACH_HP300    9
-#define MACH_Q40     10
-#define MACH_SUN3X   11
-#define MACH_M54XX   12
-#define COMMAND_LINE_SIZE 256
-#ifdef __KERNEL__
 #define CL_SIZE COMMAND_LINE_SIZE
 #ifndef __ASSEMBLY__
@@ -194,63 +173,6 @@ extern unsigned long m68k_machtype;
 #  define MACH_TYPE (m68k_machtype)
 #endif
-#endif /* __KERNEL__ */
-    /*
-     *  CPU, FPU and MMU types
-     *
-     *  Note: we may rely on the following equalities:
-     *
-     *      CPU_68020 == MMU_68851
-     *      CPU_68030 == MMU_68030
-     *      CPU_68040 == FPU_68040 == MMU_68040
-     *      CPU_68060 == FPU_68060 == MMU_68060
-     */
-#define CPUB_68020     0
-#define CPUB_68030     1
-#define CPUB_68040     2
-#define CPUB_68060     3
-#define CPUB_COLDFIRE  4
-#define CPU_68020      (1<<CPUB_68020)
-#define CPU_68030      (1<<CPUB_68030)
-#define CPU_68040      (1<<CPUB_68040)
-#define CPU_68060      (1<<CPUB_68060)
-#define CPU_COLDFIRE   (1<<CPUB_COLDFIRE)
-#define FPUB_68881     0
-#define FPUB_68882     1
-#define FPUB_68040     2                       /* Internal FPU */
-#define FPUB_68060     3                       /* Internal FPU */
-#define FPUB_SUNFPA    4                       /* Sun-3 FPA */
-#define FPUB_COLDFIRE  5                       /* ColdFire FPU */
-#define FPU_68881      (1<<FPUB_68881)
-#define FPU_68882      (1<<FPUB_68882)
-#define FPU_68040      (1<<FPUB_68040)
-#define FPU_68060      (1<<FPUB_68060)
-#define FPU_SUNFPA     (1<<FPUB_SUNFPA)
-#define FPU_COLDFIRE   (1<<FPUB_COLDFIRE)
-#define MMUB_68851     0
-#define MMUB_68030     1                       /* Internal MMU */
-#define MMUB_68040     2                       /* Internal MMU */
-#define MMUB_68060     3                       /* Internal MMU */
-#define MMUB_APOLLO    4                       /* Custom Apollo */
-#define MMUB_SUN3      5                       /* Custom Sun-3 */
-#define MMUB_COLDFIRE  6                       /* Internal MMU */
-#define MMU_68851      (1<<MMUB_68851)
-#define MMU_68030      (1<<MMUB_68030)
-#define MMU_68040      (1<<MMUB_68040)
-#define MMU_68060      (1<<MMUB_68060)
-#define MMU_SUN3       (1<<MMUB_SUN3)
-#define MMU_APOLLO     (1<<MMUB_APOLLO)
-#define MMU_COLDFIRE   (1<<MMUB_COLDFIRE)
-#ifdef __KERNEL__
 #ifndef __ASSEMBLY__
 extern unsigned long m68k_cputype;
@@ -385,6 +307,4 @@ extern int m68k_realnum_memory;		/* real # of memory blocks found */
 extern struct mem_info m68k_memory[NUM_MEMINFO];/* memory description */
 #endif
-#endif /* __KERNEL__ */
 #endif /* _M68K_SETUP_H */
diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h
index 60e88660169c..67e489d8d1bd 100644
--- a/arch/m68k/include/asm/signal.h
+++ b/arch/m68k/include/asm/signal.h
@@ -1,12 +1,8 @@
 #ifndef _M68K_SIGNAL_H
 #define _M68K_SIGNAL_H
-#include <linux/types.h>
+#include <uapi/asm/signal.h>
-/* Avoid too many header ordering problems.  */
-struct siginfo;
-#ifdef __KERNEL__
 /* Most things should be clean enough to redefine this at will, if care
   is taken to make libc match.  */
@@ -20,92 +16,6 @@ typedef struct {
        unsigned long sig[_NSIG_WORDS];
 } sigset_t;
-#else
-/* Here we must cater to libcs that poke about in kernel headers.  */
-#define NSIG            32
-typedef unsigned long sigset_t;
-#endif /* __KERNEL__ */
-#define SIGHUP           1
-#define SIGINT           2
-#define SIGQUIT          3
-#define SIGILL           4
-#define SIGTRAP          5
-#define SIGABRT          6
-#define SIGIOT           6
-#define SIGBUS           7
-#define SIGFPE           8
-#define SIGKILL          9
-#define SIGUSR1         10
-#define SIGSEGV         11
-#define SIGUSR2         12
-#define SIGPIPE         13
-#define SIGALRM         14
-#define SIGTERM         15
-#define SIGSTKFLT       16
-#define SIGCHLD         17
-#define SIGCONT         18
-#define SIGSTOP         19
-#define SIGTSTP         20
-#define SIGTTIN         21
-#define SIGTTOU         22
-#define SIGURG          23
-#define SIGXCPU         24
-#define SIGXFSZ         25
-#define SIGVTALRM       26
-#define SIGPROF         27
-#define SIGWINCH        28
-#define SIGIO           29
-#define SIGPOLL         SIGIO
-/*
-#define SIGLOST         29
-*/
-#define SIGPWR          30
-#define SIGSYS          31
-#define SIGUNUSED       31
-/* These should not be considered constants from userland.  */
-#define SIGRTMIN        32
-#define SIGRTMAX        _NSIG
-/*
- * SA_FLAGS values:
- *
- * SA_ONSTACK indicates that a registered stack_t will be used.
- * SA_RESTART flag to get restarting signals (which were the default long ago)
- * SA_NOCLDSTOP flag to turn off SIGCHLD when children stop.
- * SA_RESETHAND clears the handler when the signal is delivered.
- * SA_NOCLDWAIT flag on SIGCHLD to inhibit zombies.
- * SA_NODEFER prevents the current signal from being masked in the handler.
- *
- * SA_ONESHOT and SA_NOMASK are the historical Linux names for the Single
- * Unix names RESETHAND and NODEFER respectively.
- */
-#define SA_NOCLDSTOP    0x00000001
-#define SA_NOCLDWAIT    0x00000002
-#define SA_SIGINFO      0x00000004
-#define SA_ONSTACK      0x08000000
-#define SA_RESTART      0x10000000
-#define SA_NODEFER      0x40000000
-#define SA_RESETHAND    0x80000000
-#define SA_NOMASK       SA_NODEFER
-#define SA_ONESHOT      SA_RESETHAND
-/*
- * sigaltstack controls
- */
-#define SS_ONSTACK      1
-#define SS_DISABLE      2
-#define MINSIGSTKSZ     2048
-#define SIGSTKSZ        8192
-#include <asm-generic/signal-defs.h>
-#ifdef __KERNEL__
 struct old_sigaction {
        __sighandler_t sa_handler;
        old_sigset_t sa_mask;
@@ -123,31 +33,6 @@ struct sigaction {
 struct k_sigaction {
        struct sigaction sa;
 };
-#else
-/* Here we must cater to libcs that poke about in kernel headers.  */
-struct sigaction {
-        union {
-          __sighandler_t _sa_handler;
-          void (*_sa_sigaction)(int, struct siginfo *, void *);
-        } _u;
-        sigset_t sa_mask;
-        unsigned long sa_flags;
-        void (*sa_restorer)(void);
-};
-#define sa_handler      _u._sa_handler
-#define sa_sigaction    _u._sa_sigaction
-#endif /* __KERNEL__ */
-typedef struct sigaltstack {
-        void __user *ss_sp;
-        int ss_flags;
-        size_t ss_size;
-} stack_t;
-#ifdef __KERNEL__
 #include <asm/sigcontext.h>
 #ifndef CONFIG_CPU_HAS_NO_BITFIELDS
@@ -208,5 +93,4 @@ struct pt_regs;
 extern void ptrace_signal_deliver(struct pt_regs *regs, void *cookie);
 #endif /* __uClinux__ */
-#endif /* __KERNEL__ */
 #endif /* _M68K_SIGNAL_H */
diff --git a/arch/m68k/include/asm/termios.h b/arch/m68k/include/asm/termios.h
index 0823032e4045..ad8efb098663 100644
--- a/arch/m68k/include/asm/termios.h
+++ b/arch/m68k/include/asm/termios.h
@@ -1,27 +1,8 @@
 #ifndef _M68K_TERMIOS_H
 #define _M68K_TERMIOS_H
-#include <asm/termbits.h>
+#include <uapi/asm/termios.h>
-#include <asm/ioctls.h>
-struct winsize {
-        unsigned short ws_row;
-        unsigned short ws_col;
-        unsigned short ws_xpixel;
-        unsigned short ws_ypixel;
-};
-#define NCC 8
-struct termio {
-        unsigned short c_iflag;         /* input mode flags */
-        unsigned short c_oflag;         /* output mode flags */
-        unsigned short c_cflag;         /* control mode flags */
-        unsigned short c_lflag;         /* local mode flags */
-        unsigned char c_line;           /* line discipline */
-        unsigned char c_cc[NCC];        /* control characters */
-};
-#ifdef __KERNEL__
 /*      intr=^C         quit=^|         erase=del       kill=^U
        eof=^D          vtime=\0        vmin=\1         sxtc=\0
        start=^Q        stop=^S         susp=^Z         eol=\0
@@ -29,27 +10,6 @@ struct termio {
        eol2=\0
 */
 #define INIT_C_CC "\003\034\177\025\004\0\1\0\021\023\032\0\022\017\027\026\0"
-#endif
-/* modem lines */
-#define TIOCM_LE        0x001
-#define TIOCM_DTR       0x002
-#define TIOCM_RTS       0x004
-#define TIOCM_ST        0x008
-#define TIOCM_SR        0x010
-#define TIOCM_CTS       0x020
-#define TIOCM_CAR       0x040
-#define TIOCM_RNG       0x080
-#define TIOCM_DSR       0x100
-#define TIOCM_CD        TIOCM_CAR
-#define TIOCM_RI        TIOCM_RNG
-#define TIOCM_OUT1      0x2000
-#define TIOCM_OUT2      0x4000
-#define TIOCM_LOOP      0x8000
-/* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
-#ifdef __KERNEL__
 /*
 * Translate a "termio" structure into a "termios". Ugh.
@@ -87,6 +47,4 @@ struct termio {
 #define user_termios_to_kernel_termios_1(k, u) copy_from_user(k, u, sizeof(struct termios))
 #define kernel_termios_to_user_termios_1(u, k) copy_to_user(u, k, sizeof(struct termios))
-#endif  /* __KERNEL__ */
 #endif /* _M68K_TERMIOS_H */
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index c702ad716791..5fc7f7bec1c8 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -1,361 +1,10 @@
 #ifndef _ASM_M68K_UNISTD_H_
 #define _ASM_M68K_UNISTD_H_
-/*
+#include <uapi/asm/unistd.h>
- * This file contains the system call numbers.
- */
-#define __NR_restart_syscall      0
-#define __NR_exit                 1
-#define __NR_fork                 2
-#define __NR_read                 3
-#define __NR_write                4
-#define __NR_open                 5
-#define __NR_close                6
-#define __NR_waitpid              7
-#define __NR_creat                8
-#define __NR_link                 9
-#define __NR_unlink              10
-#define __NR_execve              11
-#define __NR_chdir               12
-#define __NR_time                13
-#define __NR_mknod               14
-#define __NR_chmod               15
-#define __NR_chown               16
-/*#define __NR_break             17*/
-#define __NR_oldstat             18
-#define __NR_lseek               19
-#define __NR_getpid              20
-#define __NR_mount               21
-#define __NR_umount              22
-#define __NR_setuid              23
-#define __NR_getuid              24
-#define __NR_stime               25
-#define __NR_ptrace              26
-#define __NR_alarm               27
-#define __NR_oldfstat            28
-#define __NR_pause               29
-#define __NR_utime               30
-/*#define __NR_stty              31*/
-/*#define __NR_gtty              32*/
-#define __NR_access              33
-#define __NR_nice                34
-/*#define __NR_ftime             35*/
-#define __NR_sync                36
-#define __NR_kill                37
-#define __NR_rename              38
-#define __NR_mkdir               39
-#define __NR_rmdir               40
-#define __NR_dup                 41
-#define __NR_pipe                42
-#define __NR_times               43
-/*#define __NR_prof              44*/
-#define __NR_brk                 45
-#define __NR_setgid              46
-#define __NR_getgid              47
-#define __NR_signal              48
-#define __NR_geteuid             49
-#define __NR_getegid             50
-#define __NR_acct                51
-#define __NR_umount2             52
-/*#define __NR_lock              53*/
-#define __NR_ioctl               54
-#define __NR_fcntl               55
-/*#define __NR_mpx               56*/
-#define __NR_setpgid             57
-/*#define __NR_ulimit            58*/
-/*#define __NR_oldolduname       59*/
-#define __NR_umask               60
-#define __NR_chroot              61
-#define __NR_ustat               62
-#define __NR_dup2                63
-#define __NR_getppid             64
-#define __NR_getpgrp             65
-#define __NR_setsid              66
-#define __NR_sigaction           67
-#define __NR_sgetmask            68
-#define __NR_ssetmask            69
-#define __NR_setreuid            70
-#define __NR_setregid            71
-#define __NR_sigsuspend          72
-#define __NR_sigpending          73
-#define __NR_sethostname         74
-#define __NR_setrlimit           75
-#define __NR_getrlimit           76
-#define __NR_getrusage           77
-#define __NR_gettimeofday        78
-#define __NR_settimeofday        79
-#define __NR_getgroups           80
-#define __NR_setgroups           81
-#define __NR_select              82
-#define __NR_symlink             83
-#define __NR_oldlstat            84
-#define __NR_readlink            85
-#define __NR_uselib              86
-#define __NR_swapon              87
-#define __NR_reboot              88
-#define __NR_readdir             89
-#define __NR_mmap                90
-#define __NR_munmap              91
-#define __NR_truncate            92
-#define __NR_ftruncate           93
-#define __NR_fchmod              94
-#define __NR_fchown              95
-#define __NR_getpriority         96
-#define __NR_setpriority         97
-/*#define __NR_profil            98*/
-#define __NR_statfs              99
-#define __NR_fstatfs            100
-/*#define __NR_ioperm           101*/
-#define __NR_socketcall         102
-#define __NR_syslog             103
-#define __NR_setitimer          104
-#define __NR_getitimer          105
-#define __NR_stat               106
-#define __NR_lstat              107
-#define __NR_fstat              108
-/*#define __NR_olduname         109*/
-/*#define __NR_iopl             110*/ /* not supported */
-#define __NR_vhangup            111
-/*#define __NR_idle             112*/ /* Obsolete */
-/*#define __NR_vm86             113*/ /* not supported */
-#define __NR_wait4              114
-#define __NR_swapoff            115
-#define __NR_sysinfo            116
-#define __NR_ipc                117
-#define __NR_fsync              118
-#define __NR_sigreturn          119
-#define __NR_clone              120
-#define __NR_setdomainname      121
-#define __NR_uname              122
-#define __NR_cacheflush         123
-#define __NR_adjtimex           124
-#define __NR_mprotect           125
-#define __NR_sigprocmask        126
-#define __NR_create_module      127
-#define __NR_init_module        128
-#define __NR_delete_module      129
-#define __NR_get_kernel_syms    130
-#define __NR_quotactl           131
-#define __NR_getpgid            132
-#define __NR_fchdir             133
-#define __NR_bdflush            134
-#define __NR_sysfs              135
-#define __NR_personality        136
-/*#define __NR_afs_syscall      137*/ /* Syscall for Andrew File System */
-#define __NR_setfsuid           138
-#define __NR_setfsgid           139
-#define __NR__llseek            140
-#define __NR_getdents           141
-#define __NR__newselect         142
-#define __NR_flock              143
-#define __NR_msync              144
-#define __NR_readv              145
-#define __NR_writev             146
-#define __NR_getsid             147
-#define __NR_fdatasync          148
-#define __NR__sysctl            149
-#define __NR_mlock              150
-#define __NR_munlock            151
-#define __NR_mlockall           152
-#define __NR_munlockall         153
-#define __NR_sched_setparam             154
-#define __NR_sched_getparam             155
-#define __NR_sched_setscheduler         156
-#define __NR_sched_getscheduler         157
-#define __NR_sched_yield                158
-#define __NR_sched_get_priority_max     159
-#define __NR_sched_get_priority_min     160
-#define __NR_sched_rr_get_interval      161
-#define __NR_nanosleep          162
-#define __NR_mremap             163
-#define __NR_setresuid          164
-#define __NR_getresuid          165
-#define __NR_getpagesize        166
-#define __NR_query_module       167
-#define __NR_poll               168
-#define __NR_nfsservctl         169
-#define __NR_setresgid          170
-#define __NR_getresgid          171
-#define __NR_prctl              172
-#define __NR_rt_sigreturn       173
-#define __NR_rt_sigaction       174
-#define __NR_rt_sigprocmask     175
-#define __NR_rt_sigpending      176
-#define __NR_rt_sigtimedwait    177
-#define __NR_rt_sigqueueinfo    178
-#define __NR_rt_sigsuspend      179
-#define __NR_pread64            180
-#define __NR_pwrite64           181
-#define __NR_lchown             182
-#define __NR_getcwd             183
-#define __NR_capget             184
-#define __NR_capset             185
-#define __NR_sigaltstack        186
-#define __NR_sendfile           187
-#define __NR_getpmsg            188     /* some people actually want streams */
-#define __NR_putpmsg            189     /* some people actually want streams */
-#define __NR_vfork              190
-#define __NR_ugetrlimit         191
-#define __NR_mmap2              192
-#define __NR_truncate64         193
-#define __NR_ftruncate64        194
-#define __NR_stat64             195
-#define __NR_lstat64            196
-#define __NR_fstat64            197
-#define __NR_chown32            198
-#define __NR_getuid32           199
-#define __NR_getgid32           200
-#define __NR_geteuid32          201
-#define __NR_getegid32          202
-#define __NR_setreuid32         203
-#define __NR_setregid32         204
-#define __NR_getgroups32        205
-#define __NR_setgroups32        206
-#define __NR_fchown32           207
-#define __NR_setresuid32        208
-#define __NR_getresuid32        209
-#define __NR_setresgid32        210
-#define __NR_getresgid32        211
-#define __NR_lchown32           212
-#define __NR_setuid32           213
-#define __NR_setgid32           214
-#define __NR_setfsuid32         215
-#define __NR_setfsgid32         216
-#define __NR_pivot_root         217
-/* 218*/
-/* 219*/
-#define __NR_getdents64         220
-#define __NR_gettid             221
-#define __NR_tkill              222
-#define __NR_setxattr           223
-#define __NR_lsetxattr          224
-#define __NR_fsetxattr          225
-#define __NR_getxattr           226
-#define __NR_lgetxattr          227
-#define __NR_fgetxattr          228
-#define __NR_listxattr          229
-#define __NR_llistxattr         230
-#define __NR_flistxattr         231
-#define __NR_removexattr        232
-#define __NR_lremovexattr       233
-#define __NR_fremovexattr       234
-#define __NR_futex              235
-#define __NR_sendfile64         236
-#define __NR_mincore            237
-#define __NR_madvise            238
-#define __NR_fcntl64            239
-#define __NR_readahead          240
-#define __NR_io_setup           241
-#define __NR_io_destroy         242
-#define __NR_io_getevents       243
-#define __NR_io_submit          244
-#define __NR_io_cancel          245
-#define __NR_fadvise64          246
-#define __NR_exit_group         247
-#define __NR_lookup_dcookie     248
-#define __NR_epoll_create       249
-#define __NR_epoll_ctl          250
-#define __NR_epoll_wait         251
-#define __NR_remap_file_pages   252
-#define __NR_set_tid_address    253
-#define __NR_timer_create       254
-#define __NR_timer_settime      255
-#define __NR_timer_gettime      256
-#define __NR_timer_getoverrun   257
-#define __NR_timer_delete       258
-#define __NR_clock_settime      259
-#define __NR_clock_gettime      260
-#define __NR_clock_getres       261
-#define __NR_clock_nanosleep    262
-#define __NR_statfs64           263
-#define __NR_fstatfs64          264
-#define __NR_tgkill             265
-#define __NR_utimes             266
-#define __NR_fadvise64_64       267
-#define __NR_mbind              268
-#define __NR_get_mempolicy      269
-#define __NR_set_mempolicy      270
-#define __NR_mq_open            271
-#define __NR_mq_unlink          272
-#define __NR_mq_timedsend       273
-#define __NR_mq_timedreceive    274
-#define __NR_mq_notify          275
-#define __NR_mq_getsetattr      276
-#define __NR_waitid             277
-/*#define __NR_vserver          278*/
-#define __NR_add_key            279
-#define __NR_request_key        280
-#define __NR_keyctl             281
-#define __NR_ioprio_set         282
-#define __NR_ioprio_get         283
-#define __NR_inotify_init       284
-#define __NR_inotify_add_watch  285
-#define __NR_inotify_rm_watch   286
-#define __NR_migrate_pages      287
-#define __NR_openat             288
-#define __NR_mkdirat            289
-#define __NR_mknodat            290
-#define __NR_fchownat           291
-#define __NR_futimesat          292
-#define __NR_fstatat64          293
-#define __NR_unlinkat           294
-#define __NR_renameat           295
-#define __NR_linkat             296
-#define __NR_symlinkat          297
-#define __NR_readlinkat         298
-#define __NR_fchmodat           299
-#define __NR_faccessat          300
-#define __NR_pselect6           301
-#define __NR_ppoll              302
-#define __NR_unshare            303
-#define __NR_set_robust_list    304
-#define __NR_get_robust_list    305
-#define __NR_splice             306
-#define __NR_sync_file_range    307
-#define __NR_tee                308
-#define __NR_vmsplice           309
-#define __NR_move_pages         310
-#define __NR_sched_setaffinity  311
-#define __NR_sched_getaffinity  312
-#define __NR_kexec_load         313
-#define __NR_getcpu             314
-#define __NR_epoll_pwait        315
-#define __NR_utimensat          316
-#define __NR_signalfd           317
-#define __NR_timerfd_create     318
-#define __NR_eventfd            319
-#define __NR_fallocate          320
-#define __NR_timerfd_settime    321
-#define __NR_timerfd_gettime    322
-#define __NR_signalfd4          323
-#define __NR_eventfd2           324
-#define __NR_epoll_create1      325
-#define __NR_dup3               326
-#define __NR_pipe2              327
-#define __NR_inotify_init1      328
-#define __NR_preadv             329
-#define __NR_pwritev            330
-#define __NR_rt_tgsigqueueinfo  331
-#define __NR_perf_event_open    332
-#define __NR_get_thread_area    333
-#define __NR_set_thread_area    334
-#define __NR_atomic_cmpxchg_32  335
-#define __NR_atomic_barrier     336
-#define __NR_fanotify_init      337
-#define __NR_fanotify_mark      338
-#define __NR_prlimit64          339
-#define __NR_name_to_handle_at  340
-#define __NR_open_by_handle_at  341
-#define __NR_clock_adjtime      342
-#define __NR_syncfs             343
-#define __NR_setns              344
-#define __NR_process_vm_readv   345
-#define __NR_process_vm_writev  346
-#ifdef __KERNEL__
-#define NR_syscalls             347
+#define NR_syscalls             348
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
@@ -393,5 +42,4 @@
 */
 #define cond_syscall(x) asm(".weak\t" #x "\n\t.set\t" #x ",sys_ni_syscall")
-#endif /* __KERNEL__ */
 #endif /* _ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index baebb3da1d44..972bce120e1e 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -1,3 +1,26 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+header-y += a.out.h
+header-y += auxvec.h
+header-y += byteorder.h
+header-y += cachectl.h
+header-y += fcntl.h
+header-y += ioctls.h
+header-y += msgbuf.h
+header-y += param.h
+header-y += poll.h
+header-y += posix_types.h
+header-y += ptrace.h
+header-y += sembuf.h
+header-y += setup.h
+header-y += shmbuf.h
+header-y += sigcontext.h
+header-y += signal.h
+header-y += socket.h
+header-y += sockios.h
+header-y += stat.h
+header-y += swab.h
+header-y += termbits.h
+header-y += termios.h
+header-y += unistd.h
diff --git a/arch/m68k/include/asm/a.out.h b/arch/m68k/include/uapi/asm/a.out.h
index 3885fe43432a..3885fe43432a 100644
--- a/arch/m68k/include/asm/a.out.h
+++ b/arch/m68k/include/uapi/asm/a.out.h
diff --git a/arch/m68k/include/asm/auxvec.h b/arch/m68k/include/uapi/asm/auxvec.h
index 844d6d52204b..844d6d52204b 100644
--- a/arch/m68k/include/asm/auxvec.h
+++ b/arch/m68k/include/uapi/asm/auxvec.h
diff --git a/arch/m68k/include/asm/byteorder.h b/arch/m68k/include/uapi/asm/byteorder.h
index 31b260a88803..31b260a88803 100644
--- a/arch/m68k/include/asm/byteorder.h
+++ b/arch/m68k/include/uapi/asm/byteorder.h
diff --git a/arch/m68k/include/asm/cachectl.h b/arch/m68k/include/uapi/asm/cachectl.h
index 525978e959e3..525978e959e3 100644
--- a/arch/m68k/include/asm/cachectl.h
+++ b/arch/m68k/include/uapi/asm/cachectl.h
diff --git a/arch/m68k/include/asm/fcntl.h b/arch/m68k/include/uapi/asm/fcntl.h
index 1c369b20dc45..1c369b20dc45 100644
--- a/arch/m68k/include/asm/fcntl.h
+++ b/arch/m68k/include/uapi/asm/fcntl.h
diff --git a/arch/m68k/include/asm/ioctls.h b/arch/m68k/include/uapi/asm/ioctls.h
index 1332bb4ca5b0..1332bb4ca5b0 100644
--- a/arch/m68k/include/asm/ioctls.h
+++ b/arch/m68k/include/uapi/asm/ioctls.h
diff --git a/arch/m68k/include/asm/msgbuf.h b/arch/m68k/include/uapi/asm/msgbuf.h
index 243cb798de8f..243cb798de8f 100644
--- a/arch/m68k/include/asm/msgbuf.h
+++ b/arch/m68k/include/uapi/asm/msgbuf.h
diff --git a/arch/m68k/include/asm/param.h b/arch/m68k/include/uapi/asm/param.h
index 36265ccf5c7b..36265ccf5c7b 100644
--- a/arch/m68k/include/asm/param.h
+++ b/arch/m68k/include/uapi/asm/param.h
diff --git a/arch/m68k/include/asm/poll.h b/arch/m68k/include/uapi/asm/poll.h
index f080fcdb61bf..f080fcdb61bf 100644
--- a/arch/m68k/include/asm/poll.h
+++ b/arch/m68k/include/uapi/asm/poll.h
diff --git a/arch/m68k/include/asm/posix_types.h b/arch/m68k/include/uapi/asm/posix_types.h
index cf4dbf70fdc7..cf4dbf70fdc7 100644
--- a/arch/m68k/include/asm/posix_types.h
+++ b/arch/m68k/include/uapi/asm/posix_types.h
diff --git a/arch/m68k/include/uapi/asm/ptrace.h b/arch/m68k/include/uapi/asm/ptrace.h
new file mode 100644
index 000000000000..caf92fd34939
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/ptrace.h
@@ -0,0 +1,79 @@
+#ifndef _UAPI_M68K_PTRACE_H
+#define _UAPI_M68K_PTRACE_H
+#define PT_D1      0
+#define PT_D2      1
+#define PT_D3      2
+#define PT_D4      3
+#define PT_D5      4
+#define PT_D6      5
+#define PT_D7      6
+#define PT_A0      7
+#define PT_A1      8
+#define PT_A2      9
+#define PT_A3      10
+#define PT_A4      11
+#define PT_A5      12
+#define PT_A6      13
+#define PT_D0      14
+#define PT_USP     15
+#define PT_ORIG_D0 16
+#define PT_SR      17
+#define PT_PC      18
+#ifndef __ASSEMBLY__
+/* this struct defines the way the registers are stored on the
+   stack during a system call. */
+struct pt_regs {
+  long     d1;
+  long     d2;
+  long     d3;
+  long     d4;
+  long     d5;
+  long     a0;
+  long     a1;
+  long     a2;
+  long     d0;
+  long     orig_d0;
+  long     stkadj;
+#ifdef CONFIG_COLDFIRE
+  unsigned format :  4; /* frame format specifier */
+  unsigned vector : 12; /* vector offset */
+  unsigned short sr;
+  unsigned long  pc;
+#else
+  unsigned short sr;
+  unsigned long  pc;
+  unsigned format :  4; /* frame format specifier */
+  unsigned vector : 12; /* vector offset */
+#endif
+};
+/*
+ * This is the extended stack used by signal handlers and the context
+ * switcher: it's pushed after the normal "struct pt_regs".
+ */
+struct switch_stack {
+        unsigned long  d6;
+        unsigned long  d7;
+        unsigned long  a3;
+        unsigned long  a4;
+        unsigned long  a5;
+        unsigned long  a6;
+        unsigned long  retpc;
+};
+/* Arbitrarily choose the same ptrace numbers as used by the Sparc code. */
+#define PTRACE_GETREGS            12
+#define PTRACE_SETREGS            13
+#define PTRACE_GETFPREGS          14
+#define PTRACE_SETFPREGS          15
+#define PTRACE_GET_THREAD_AREA    25
+#define PTRACE_SINGLEBLOCK      33      /* resume execution until next branch */
+#endif /* __ASSEMBLY__ */
+#endif /* _UAPI_M68K_PTRACE_H */
diff --git a/arch/m68k/include/asm/sembuf.h b/arch/m68k/include/uapi/asm/sembuf.h
index 2308052a8c24..2308052a8c24 100644
--- a/arch/m68k/include/asm/sembuf.h
+++ b/arch/m68k/include/uapi/asm/sembuf.h
diff --git a/arch/m68k/include/uapi/asm/setup.h b/arch/m68k/include/uapi/asm/setup.h
new file mode 100644
index 000000000000..85579bff455c
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/setup.h
@@ -0,0 +1,103 @@
+/*
+** asm/setup.h -- Definition of the Linux/m68k setup information
+**
+** Copyright 1992 by Greg Harp
+**
+** This file is subject to the terms and conditions of the GNU General Public
+** License.  See the file COPYING in the main directory of this archive
+** for more details.
+**
+** Created 09/29/92 by Greg Harp
+**
+** 5/2/94 Roman Hodek:
+**   Added bi_atari part of the machine dependent union bi_un; for now it
+**   contains just a model field to distinguish between TT and Falcon.
+** 26/7/96 Roman Zippel:
+**   Renamed to setup.h; added some useful macros to allow gcc some
+**   optimizations if possible.
+** 5/10/96 Geert Uytterhoeven:
+**   Redesign of the boot information structure; moved boot information
+**   structure to bootinfo.h
+*/
+#ifndef _UAPI_M68K_SETUP_H
+#define _UAPI_M68K_SETUP_H
+    /*
+     *  Linux/m68k Architectures
+     */
+#define MACH_AMIGA    1
+#define MACH_ATARI    2
+#define MACH_MAC      3
+#define MACH_APOLLO   4
+#define MACH_SUN3     5
+#define MACH_MVME147  6
+#define MACH_MVME16x  7
+#define MACH_BVME6000 8
+#define MACH_HP300    9
+#define MACH_Q40     10
+#define MACH_SUN3X   11
+#define MACH_M54XX   12
+#define COMMAND_LINE_SIZE 256
+    /*
+     *  CPU, FPU and MMU types
+     *
+     *  Note: we may rely on the following equalities:
+     *
+     *      CPU_68020 == MMU_68851
+     *      CPU_68030 == MMU_68030
+     *      CPU_68040 == FPU_68040 == MMU_68040
+     *      CPU_68060 == FPU_68060 == MMU_68060
+     */
+#define CPUB_68020     0
+#define CPUB_68030     1
+#define CPUB_68040     2
+#define CPUB_68060     3
+#define CPUB_COLDFIRE  4
+#define CPU_68020      (1<<CPUB_68020)
+#define CPU_68030      (1<<CPUB_68030)
+#define CPU_68040      (1<<CPUB_68040)
+#define CPU_68060      (1<<CPUB_68060)
+#define CPU_COLDFIRE   (1<<CPUB_COLDFIRE)
+#define FPUB_68881     0
+#define FPUB_68882     1
+#define FPUB_68040     2                       /* Internal FPU */
+#define FPUB_68060     3                       /* Internal FPU */
+#define FPUB_SUNFPA    4                       /* Sun-3 FPA */
+#define FPUB_COLDFIRE  5                       /* ColdFire FPU */
+#define FPU_68881      (1<<FPUB_68881)
+#define FPU_68882      (1<<FPUB_68882)
+#define FPU_68040      (1<<FPUB_68040)
+#define FPU_68060      (1<<FPUB_68060)
+#define FPU_SUNFPA     (1<<FPUB_SUNFPA)
+#define FPU_COLDFIRE   (1<<FPUB_COLDFIRE)
+#define MMUB_68851     0
+#define MMUB_68030     1                       /* Internal MMU */
+#define MMUB_68040     2                       /* Internal MMU */
+#define MMUB_68060     3                       /* Internal MMU */
+#define MMUB_APOLLO    4                       /* Custom Apollo */
+#define MMUB_SUN3      5                       /* Custom Sun-3 */
+#define MMUB_COLDFIRE  6                       /* Internal MMU */
+#define MMU_68851      (1<<MMUB_68851)
+#define MMU_68030      (1<<MMUB_68030)
+#define MMU_68040      (1<<MMUB_68040)
+#define MMU_68060      (1<<MMUB_68060)
+#define MMU_SUN3       (1<<MMUB_SUN3)
+#define MMU_APOLLO     (1<<MMUB_APOLLO)
+#define MMU_COLDFIRE   (1<<MMUB_COLDFIRE)
+#endif /* _UAPI_M68K_SETUP_H */
diff --git a/arch/m68k/include/asm/shmbuf.h b/arch/m68k/include/uapi/asm/shmbuf.h
index f8928d62f1b7..f8928d62f1b7 100644
--- a/arch/m68k/include/asm/shmbuf.h
+++ b/arch/m68k/include/uapi/asm/shmbuf.h
diff --git a/arch/m68k/include/asm/sigcontext.h b/arch/m68k/include/uapi/asm/sigcontext.h
index 523db2a51cf3..523db2a51cf3 100644
--- a/arch/m68k/include/asm/sigcontext.h
+++ b/arch/m68k/include/uapi/asm/sigcontext.h
diff --git a/arch/m68k/include/uapi/asm/signal.h b/arch/m68k/include/uapi/asm/signal.h
new file mode 100644
index 000000000000..2b450f311bd9
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/signal.h
@@ -0,0 +1,118 @@
+#ifndef _UAPI_M68K_SIGNAL_H
+#define _UAPI_M68K_SIGNAL_H
+#include <linux/types.h>
+/* Avoid too many header ordering problems.  */
+struct siginfo;
+#ifndef __KERNEL__
+/* Here we must cater to libcs that poke about in kernel headers.  */
+#define NSIG            32
+typedef unsigned long sigset_t;
+#endif /* __KERNEL__ */
+#define SIGHUP           1
+#define SIGINT           2
+#define SIGQUIT          3
+#define SIGILL           4
+#define SIGTRAP          5
+#define SIGABRT          6
+#define SIGIOT           6
+#define SIGBUS           7
+#define SIGFPE           8
+#define SIGKILL          9
+#define SIGUSR1         10
+#define SIGSEGV         11
+#define SIGUSR2         12
+#define SIGPIPE         13
+#define SIGALRM         14
+#define SIGTERM         15
+#define SIGSTKFLT       16
+#define SIGCHLD         17
+#define SIGCONT         18
+#define SIGSTOP         19
+#define SIGTSTP         20
+#define SIGTTIN         21
+#define SIGTTOU         22
+#define SIGURG          23
+#define SIGXCPU         24
+#define SIGXFSZ         25
+#define SIGVTALRM       26
+#define SIGPROF         27
+#define SIGWINCH        28
+#define SIGIO           29
+#define SIGPOLL         SIGIO
+/*
+#define SIGLOST         29
+*/
+#define SIGPWR          30
+#define SIGSYS          31
+#define SIGUNUSED       31
+/* These should not be considered constants from userland.  */
+#define SIGRTMIN        32
+#define SIGRTMAX        _NSIG
+/*
+ * SA_FLAGS values:
+ *
+ * SA_ONSTACK indicates that a registered stack_t will be used.
+ * SA_RESTART flag to get restarting signals (which were the default long ago)
+ * SA_NOCLDSTOP flag to turn off SIGCHLD when children stop.
+ * SA_RESETHAND clears the handler when the signal is delivered.
+ * SA_NOCLDWAIT flag on SIGCHLD to inhibit zombies.
+ * SA_NODEFER prevents the current signal from being masked in the handler.
+ *
+ * SA_ONESHOT and SA_NOMASK are the historical Linux names for the Single
+ * Unix names RESETHAND and NODEFER respectively.
+ */
+#define SA_NOCLDSTOP    0x00000001
+#define SA_NOCLDWAIT    0x00000002
+#define SA_SIGINFO      0x00000004
+#define SA_ONSTACK      0x08000000
+#define SA_RESTART      0x10000000
+#define SA_NODEFER      0x40000000
+#define SA_RESETHAND    0x80000000
+#define SA_NOMASK       SA_NODEFER
+#define SA_ONESHOT      SA_RESETHAND
+/*
+ * sigaltstack controls
+ */
+#define SS_ONSTACK      1
+#define SS_DISABLE      2
+#define MINSIGSTKSZ     2048
+#define SIGSTKSZ        8192
+#include <asm-generic/signal-defs.h>
+#ifndef __KERNEL__
+/* Here we must cater to libcs that poke about in kernel headers.  */
+struct sigaction {
+        union {
+          __sighandler_t _sa_handler;
+          void (*_sa_sigaction)(int, struct siginfo *, void *);
+        } _u;
+        sigset_t sa_mask;
+        unsigned long sa_flags;
+        void (*sa_restorer)(void);
+};
+#define sa_handler      _u._sa_handler
+#define sa_sigaction    _u._sa_sigaction
+#endif /* __KERNEL__ */
+typedef struct sigaltstack {
+        void __user *ss_sp;
+        int ss_flags;
+        size_t ss_size;
+} stack_t;
+#endif /* _UAPI_M68K_SIGNAL_H */
diff --git a/arch/m68k/include/asm/socket.h b/arch/m68k/include/uapi/asm/socket.h
index d1be684edf97..d1be684edf97 100644
--- a/arch/m68k/include/asm/socket.h
+++ b/arch/m68k/include/uapi/asm/socket.h
diff --git a/arch/m68k/include/asm/sockios.h b/arch/m68k/include/uapi/asm/sockios.h
index c04a23943cb7..c04a23943cb7 100644
--- a/arch/m68k/include/asm/sockios.h
+++ b/arch/m68k/include/uapi/asm/sockios.h
diff --git a/arch/m68k/include/asm/stat.h b/arch/m68k/include/uapi/asm/stat.h
index dd38bc2e9f98..dd38bc2e9f98 100644
--- a/arch/m68k/include/asm/stat.h
+++ b/arch/m68k/include/uapi/asm/stat.h
diff --git a/arch/m68k/include/asm/swab.h b/arch/m68k/include/uapi/asm/swab.h
index b7b37a40defc..b7b37a40defc 100644
--- a/arch/m68k/include/asm/swab.h
+++ b/arch/m68k/include/uapi/asm/swab.h
diff --git a/arch/m68k/include/asm/termbits.h b/arch/m68k/include/uapi/asm/termbits.h
index aea1e37b765a..aea1e37b765a 100644
--- a/arch/m68k/include/asm/termbits.h
+++ b/arch/m68k/include/uapi/asm/termbits.h
diff --git a/arch/m68k/include/uapi/asm/termios.h b/arch/m68k/include/uapi/asm/termios.h
new file mode 100644
index 000000000000..ce2142c9ac1d
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/termios.h
@@ -0,0 +1,44 @@
+#ifndef _UAPI_M68K_TERMIOS_H
+#define _UAPI_M68K_TERMIOS_H
+#include <asm/termbits.h>
+#include <asm/ioctls.h>
+struct winsize {
+        unsigned short ws_row;
+        unsigned short ws_col;
+        unsigned short ws_xpixel;
+        unsigned short ws_ypixel;
+};
+#define NCC 8
+struct termio {
+        unsigned short c_iflag;         /* input mode flags */
+        unsigned short c_oflag;         /* output mode flags */
+        unsigned short c_cflag;         /* control mode flags */
+        unsigned short c_lflag;         /* local mode flags */
+        unsigned char c_line;           /* line discipline */
+        unsigned char c_cc[NCC];        /* control characters */
+};
+/* modem lines */
+#define TIOCM_LE        0x001
+#define TIOCM_DTR       0x002
+#define TIOCM_RTS       0x004
+#define TIOCM_ST        0x008
+#define TIOCM_SR        0x010
+#define TIOCM_CTS       0x020
+#define TIOCM_CAR       0x040
+#define TIOCM_RNG       0x080
+#define TIOCM_DSR       0x100
+#define TIOCM_CD        TIOCM_CAR
+#define TIOCM_RI        TIOCM_RNG
+#define TIOCM_OUT1      0x2000
+#define TIOCM_OUT2      0x4000
+#define TIOCM_LOOP      0x8000
+/* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
+#endif /* _UAPI_M68K_TERMIOS_H */
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
new file mode 100644
index 000000000000..b94bfbf90705
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -0,0 +1,357 @@
+#ifndef _UAPI_ASM_M68K_UNISTD_H_
+#define _UAPI_ASM_M68K_UNISTD_H_
+/*
+ * This file contains the system call numbers.
+ */
+#define __NR_restart_syscall      0
+#define __NR_exit                 1
+#define __NR_fork                 2
+#define __NR_read                 3
+#define __NR_write                4
+#define __NR_open                 5
+#define __NR_close                6
+#define __NR_waitpid              7
+#define __NR_creat                8
+#define __NR_link                 9
+#define __NR_unlink              10
+#define __NR_execve              11
+#define __NR_chdir               12
+#define __NR_time                13
+#define __NR_mknod               14
+#define __NR_chmod               15
+#define __NR_chown               16
+/*#define __NR_break             17*/
+#define __NR_oldstat             18
+#define __NR_lseek               19
+#define __NR_getpid              20
+#define __NR_mount               21
+#define __NR_umount              22
+#define __NR_setuid              23
+#define __NR_getuid              24
+#define __NR_stime               25
+#define __NR_ptrace              26
+#define __NR_alarm               27
+#define __NR_oldfstat            28
+#define __NR_pause               29
+#define __NR_utime               30
+/*#define __NR_stty              31*/
+/*#define __NR_gtty              32*/
+#define __NR_access              33
+#define __NR_nice                34
+/*#define __NR_ftime             35*/
+#define __NR_sync                36
+#define __NR_kill                37
+#define __NR_rename              38
+#define __NR_mkdir               39
+#define __NR_rmdir               40
+#define __NR_dup                 41
+#define __NR_pipe                42
+#define __NR_times               43
+/*#define __NR_prof              44*/
+#define __NR_brk                 45
+#define __NR_setgid              46
+#define __NR_getgid              47
+#define __NR_signal              48
+#define __NR_geteuid             49
+#define __NR_getegid             50
+#define __NR_acct                51
+#define __NR_umount2             52
+/*#define __NR_lock              53*/
+#define __NR_ioctl               54
+#define __NR_fcntl               55
+/*#define __NR_mpx               56*/
+#define __NR_setpgid             57
+/*#define __NR_ulimit            58*/
+/*#define __NR_oldolduname       59*/
+#define __NR_umask               60
+#define __NR_chroot              61
+#define __NR_ustat               62
+#define __NR_dup2                63
+#define __NR_getppid             64
+#define __NR_getpgrp             65
+#define __NR_setsid              66
+#define __NR_sigaction           67
+#define __NR_sgetmask            68
+#define __NR_ssetmask            69
+#define __NR_setreuid            70
+#define __NR_setregid            71
+#define __NR_sigsuspend          72
+#define __NR_sigpending          73
+#define __NR_sethostname         74
+#define __NR_setrlimit           75
+#define __NR_getrlimit           76
+#define __NR_getrusage           77
+#define __NR_gettimeofday        78
+#define __NR_settimeofday        79
+#define __NR_getgroups           80
+#define __NR_setgroups           81
+#define __NR_select              82
+#define __NR_symlink             83
+#define __NR_oldlstat            84
+#define __NR_readlink            85
+#define __NR_uselib              86
+#define __NR_swapon              87
+#define __NR_reboot              88
+#define __NR_readdir             89
+#define __NR_mmap                90
+#define __NR_munmap              91
+#define __NR_truncate            92
+#define __NR_ftruncate           93
+#define __NR_fchmod              94
+#define __NR_fchown              95
+#define __NR_getpriority         96
+#define __NR_setpriority         97
+/*#define __NR_profil            98*/
+#define __NR_statfs              99
+#define __NR_fstatfs            100
+/*#define __NR_ioperm           101*/
+#define __NR_socketcall         102
+#define __NR_syslog             103
+#define __NR_setitimer          104
+#define __NR_getitimer          105
+#define __NR_stat               106
+#define __NR_lstat              107
+#define __NR_fstat              108
+/*#define __NR_olduname         109*/
+/*#define __NR_iopl             110*/ /* not supported */
+#define __NR_vhangup            111
+/*#define __NR_idle             112*/ /* Obsolete */
+/*#define __NR_vm86             113*/ /* not supported */
+#define __NR_wait4              114
+#define __NR_swapoff            115
+#define __NR_sysinfo            116
+#define __NR_ipc                117
+#define __NR_fsync              118
+#define __NR_sigreturn          119
+#define __NR_clone              120
+#define __NR_setdomainname      121
+#define __NR_uname              122
+#define __NR_cacheflush         123
+#define __NR_adjtimex           124
+#define __NR_mprotect           125
+#define __NR_sigprocmask        126
+#define __NR_create_module      127
+#define __NR_init_module        128
+#define __NR_delete_module      129
+#define __NR_get_kernel_syms    130
+#define __NR_quotactl           131
+#define __NR_getpgid            132
+#define __NR_fchdir             133
+#define __NR_bdflush            134
+#define __NR_sysfs              135
+#define __NR_personality        136
+/*#define __NR_afs_syscall      137*/ /* Syscall for Andrew File System */
+#define __NR_setfsuid           138
+#define __NR_setfsgid           139
+#define __NR__llseek            140
+#define __NR_getdents           141
+#define __NR__newselect         142
+#define __NR_flock              143
+#define __NR_msync              144
+#define __NR_readv              145
+#define __NR_writev             146
+#define __NR_getsid             147
+#define __NR_fdatasync          148
+#define __NR__sysctl            149
+#define __NR_mlock              150
+#define __NR_munlock            151
+#define __NR_mlockall           152
+#define __NR_munlockall         153
+#define __NR_sched_setparam             154
+#define __NR_sched_getparam             155
+#define __NR_sched_setscheduler         156
+#define __NR_sched_getscheduler         157
+#define __NR_sched_yield                158
+#define __NR_sched_get_priority_max     159
+#define __NR_sched_get_priority_min     160
+#define __NR_sched_rr_get_interval      161
+#define __NR_nanosleep          162
+#define __NR_mremap             163
+#define __NR_setresuid          164
+#define __NR_getresuid          165
+#define __NR_getpagesize        166
+#define __NR_query_module       167
+#define __NR_poll               168
+#define __NR_nfsservctl         169
+#define __NR_setresgid          170
+#define __NR_getresgid          171
+#define __NR_prctl              172
+#define __NR_rt_sigreturn       173
+#define __NR_rt_sigaction       174
+#define __NR_rt_sigprocmask     175
+#define __NR_rt_sigpending      176
+#define __NR_rt_sigtimedwait    177
+#define __NR_rt_sigqueueinfo    178
+#define __NR_rt_sigsuspend      179
+#define __NR_pread64            180
+#define __NR_pwrite64           181
+#define __NR_lchown             182
+#define __NR_getcwd             183
+#define __NR_capget             184
+#define __NR_capset             185
+#define __NR_sigaltstack        186
+#define __NR_sendfile           187
+#define __NR_getpmsg            188     /* some people actually want streams */
+#define __NR_putpmsg            189     /* some people actually want streams */
+#define __NR_vfork              190
+#define __NR_ugetrlimit         191
+#define __NR_mmap2              192
+#define __NR_truncate64         193
+#define __NR_ftruncate64        194
+#define __NR_stat64             195
+#define __NR_lstat64            196
+#define __NR_fstat64            197
+#define __NR_chown32            198
+#define __NR_getuid32           199
+#define __NR_getgid32           200
+#define __NR_geteuid32          201
+#define __NR_getegid32          202
+#define __NR_setreuid32         203
+#define __NR_setregid32         204
+#define __NR_getgroups32        205
+#define __NR_setgroups32        206
+#define __NR_fchown32           207
+#define __NR_setresuid32        208
+#define __NR_getresuid32        209
+#define __NR_setresgid32        210
+#define __NR_getresgid32        211
+#define __NR_lchown32           212
+#define __NR_setuid32           213
+#define __NR_setgid32           214
+#define __NR_setfsuid32         215
+#define __NR_setfsgid32         216
+#define __NR_pivot_root         217
+/* 218*/
+/* 219*/
+#define __NR_getdents64         220
+#define __NR_gettid             221
+#define __NR_tkill              222
+#define __NR_setxattr           223
+#define __NR_lsetxattr          224
+#define __NR_fsetxattr          225
+#define __NR_getxattr           226
+#define __NR_lgetxattr          227
+#define __NR_fgetxattr          228
+#define __NR_listxattr          229
+#define __NR_llistxattr         230
+#define __NR_flistxattr         231
+#define __NR_removexattr        232
+#define __NR_lremovexattr       233
+#define __NR_fremovexattr       234
+#define __NR_futex              235
+#define __NR_sendfile64         236
+#define __NR_mincore            237
+#define __NR_madvise            238
+#define __NR_fcntl64            239
+#define __NR_readahead          240
+#define __NR_io_setup           241
+#define __NR_io_destroy         242
+#define __NR_io_getevents       243
+#define __NR_io_submit          244
+#define __NR_io_cancel          245
+#define __NR_fadvise64          246
+#define __NR_exit_group         247
+#define __NR_lookup_dcookie     248
+#define __NR_epoll_create       249
+#define __NR_epoll_ctl          250
+#define __NR_epoll_wait         251
+#define __NR_remap_file_pages   252
+#define __NR_set_tid_address    253
+#define __NR_timer_create       254
+#define __NR_timer_settime      255
+#define __NR_timer_gettime      256
+#define __NR_timer_getoverrun   257
+#define __NR_timer_delete       258
+#define __NR_clock_settime      259
+#define __NR_clock_gettime      260
+#define __NR_clock_getres       261
+#define __NR_clock_nanosleep    262
+#define __NR_statfs64           263
+#define __NR_fstatfs64          264
+#define __NR_tgkill             265
+#define __NR_utimes             266
+#define __NR_fadvise64_64       267
+#define __NR_mbind              268
+#define __NR_get_mempolicy      269
+#define __NR_set_mempolicy      270
+#define __NR_mq_open            271
+#define __NR_mq_unlink          272
+#define __NR_mq_timedsend       273
+#define __NR_mq_timedreceive    274
+#define __NR_mq_notify          275
+#define __NR_mq_getsetattr      276
+#define __NR_waitid             277
+/*#define __NR_vserver          278*/
+#define __NR_add_key            279
+#define __NR_request_key        280
+#define __NR_keyctl             281
+#define __NR_ioprio_set         282
+#define __NR_ioprio_get         283
+#define __NR_inotify_init       284
+#define __NR_inotify_add_watch  285
+#define __NR_inotify_rm_watch   286
+#define __NR_migrate_pages      287
+#define __NR_openat             288
+#define __NR_mkdirat            289
+#define __NR_mknodat            290
+#define __NR_fchownat           291
+#define __NR_futimesat          292
+#define __NR_fstatat64          293
+#define __NR_unlinkat           294
+#define __NR_renameat           295
+#define __NR_linkat             296
+#define __NR_symlinkat          297
+#define __NR_readlinkat         298
+#define __NR_fchmodat           299
+#define __NR_faccessat          300
+#define __NR_pselect6           301
+#define __NR_ppoll              302
+#define __NR_unshare            303
+#define __NR_set_robust_list    304
+#define __NR_get_robust_list    305
+#define __NR_splice             306
+#define __NR_sync_file_range    307
+#define __NR_tee                308
+#define __NR_vmsplice           309
+#define __NR_move_pages         310
+#define __NR_sched_setaffinity  311
+#define __NR_sched_getaffinity  312
+#define __NR_kexec_load         313
+#define __NR_getcpu             314
+#define __NR_epoll_pwait        315
+#define __NR_utimensat          316
+#define __NR_signalfd           317
+#define __NR_timerfd_create     318
+#define __NR_eventfd            319
+#define __NR_fallocate          320
+#define __NR_timerfd_settime    321
+#define __NR_timerfd_gettime    322
+#define __NR_signalfd4          323
+#define __NR_eventfd2           324
+#define __NR_epoll_create1      325
+#define __NR_dup3               326
+#define __NR_pipe2              327
+#define __NR_inotify_init1      328
+#define __NR_preadv             329
+#define __NR_pwritev            330
+#define __NR_rt_tgsigqueueinfo  331
+#define __NR_perf_event_open    332
+#define __NR_get_thread_area    333
+#define __NR_set_thread_area    334
+#define __NR_atomic_cmpxchg_32  335
+#define __NR_atomic_barrier     336
+#define __NR_fanotify_init      337
+#define __NR_fanotify_mark      338
+#define __NR_prlimit64          339
+#define __NR_name_to_handle_at  340
+#define __NR_open_by_handle_at  341
+#define __NR_clock_adjtime      342
+#define __NR_syncfs             343
+#define __NR_setns              344
+#define __NR_process_vm_readv   345
+#define __NR_process_vm_writev  346
+#define __NR_kcmp               347
+#endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index ce827b376110..4fc2e29b771b 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -367,4 +367,5 @@ ENTRY(sys_call_table)
        .long sys_setns
        .long sys_process_vm_readv      /* 345 */
        .long sys_process_vm_writev
+        .long sys_kcmp
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 3f3d9ca7a5b6..5dba755a43e6 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -130,6 +130,7 @@ config S390
        select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
        select HAVE_UID16 if 32BIT
        select ARCH_WANT_IPC_PARSE_VERSION
+        select HAVE_ARCH_TRANSPARENT_HUGEPAGE if 64BIT
        select GENERIC_SMP_IDLE_THREAD
        select GENERIC_TIME_VSYSCALL_OLD
        select GENERIC_CLOCKEVENTS
diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S
index d80f79d8dd9c..8e1fb8239287 100644
--- a/arch/s390/boot/compressed/vmlinux.lds.S
+++ b/arch/s390/boot/compressed/vmlinux.lds.S
@@ -5,7 +5,7 @@ OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390")
 OUTPUT_ARCH(s390:64-bit)
 #else
 OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
-OUTPUT_ARCH(s390)
+OUTPUT_ARCH(s390:31-bit)
 #endif
 ENTRY(startup)
diff --git a/arch/s390/include/asm/perf_event.h b/arch/s390/include/asm/perf_event.h
index 7941968e12b4..5f0173a31693 100644
--- a/arch/s390/include/asm/perf_event.h
+++ b/arch/s390/include/asm/perf_event.h
@@ -9,7 +9,7 @@
 #include <asm/cpu_mf.h>
 /* CPU-measurement counter facility */
-#define PERF_CPUM_CF_MAX_CTR            160
+#define PERF_CPUM_CF_MAX_CTR            256
 /* Per-CPU flags for PMU states */
 #define PMU_F_RESERVED                  0x1000
diff --git a/arch/s390/include/uapi/asm/Kbuild b/arch/s390/include/uapi/asm/Kbuild
index 59b67ed423b4..7bf68fff7c5d 100644
--- a/arch/s390/include/uapi/asm/Kbuild
+++ b/arch/s390/include/uapi/asm/Kbuild
@@ -1,8 +1,6 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
-generic-y += kvm_para.h
 header-y += auxvec.h
 header-y += bitsperlong.h
 header-y += byteorder.h
diff --git a/arch/s390/include/uapi/asm/chpid.h b/arch/s390/include/uapi/asm/chpid.h
index 581992dfae27..6b4fb29cc197 100644
--- a/arch/s390/include/uapi/asm/chpid.h
+++ b/arch/s390/include/uapi/asm/chpid.h
@@ -1,5 +1,5 @@
 /*
- *    Copyright IBM Corp. 2007
+ *    Copyright IBM Corp. 2007, 2012
 *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
 */
@@ -12,10 +12,10 @@
 #define __MAX_CHPID 255
 struct chp_id {
-        u8 reserved1;
+        __u8 reserved1;
-        u8 cssid;
+        __u8 cssid;
-        u8 reserved2;
+        __u8 reserved2;
-        u8 id;
+        __u8 id;
 } __attribute__((packed));
diff --git a/arch/s390/include/uapi/asm/kvm_para.h b/arch/s390/include/uapi/asm/kvm_para.h
new file mode 100644
index 000000000000..ff1f4e7b3015
--- /dev/null
+++ b/arch/s390/include/uapi/asm/kvm_para.h
@@ -0,0 +1,11 @@
+/*
+ * User API definitions for paravirtual devices on s390
+ *
+ * Copyright IBM Corp. 2008
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ *    Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
+ */
diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
index 8df8d8a19c98..64b24650e4f8 100644
--- a/arch/s390/kernel/cache.c
+++ b/arch/s390/kernel/cache.c
@@ -59,8 +59,8 @@ enum {
 enum {
        CACHE_TI_UNIFIED = 0,
-        CACHE_TI_INSTRUCTION = 0,
+        CACHE_TI_DATA = 0,
-        CACHE_TI_DATA,
+        CACHE_TI_INSTRUCTION,
 };
 struct cache_info {
@@ -121,7 +121,10 @@ static int __init cache_add(int level, int private, int type)
        cache = kzalloc(sizeof(*cache), GFP_KERNEL);
        if (!cache)
                return -ENOMEM;
-        ti = type == CACHE_TYPE_DATA ? CACHE_TI_DATA : CACHE_TI_UNIFIED;
+        if (type == CACHE_TYPE_INSTRUCTION)
+                ti = CACHE_TI_INSTRUCTION;
+        else
+                ti = CACHE_TI_UNIFIED;
        cache->size = ecag(EXTRACT_SIZE, level, ti);
        cache->line_size = ecag(EXTRACT_LINE_SIZE, level, ti);
        cache->associativity = ecag(EXTRACT_ASSOCIATIVITY, level, ti);
diff --git a/arch/s390/kernel/head_kdump.S b/arch/s390/kernel/head_kdump.S
index acaaaf4b7055..085a95eb315f 100644
--- a/arch/s390/kernel/head_kdump.S
+++ b/arch/s390/kernel/head_kdump.S
@@ -85,16 +85,10 @@
 .align 2
 startup_kdump_relocated:
        basr    %r13,0
-0:
+0:      lpswe   .Lrestart_psw-0b(%r13)          # Start new kernel...
-        mvc     0(8,%r0),.Lrestart_psw-0b(%r13) # Setup restart PSW
-        sam31                                   # Switch to 31 bit addr mode
-        sr      %r1,%r1                         # Erase register r1
-        sr      %r2,%r2                         # Erase register r2
-        sigp    %r1,%r2,SIGP_SET_ARCHITECTURE   # Switch to 31 bit arch mode
-        lpsw    0                               # Start new kernel...
 .align  8
 .Lrestart_psw:
-        .long   0x00080000,0x80000000 + startup
+        .quad   0x0000000080000000,0x0000000000000000 + startup
 #else
 .align 2
 .Lep_startup_kdump:
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 9871b1971ed7..c4e7269d4a09 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -94,7 +94,7 @@ static int get_counter_set(u64 event)
                set = CPUMF_CTR_SET_USER;
        else if (event < 128)
                set = CPUMF_CTR_SET_CRYPTO;
-        else if (event < 160)
+        else if (event < 256)
                set = CPUMF_CTR_SET_EXT;
        return set;
@@ -138,6 +138,10 @@ static int validate_ctr_version(const struct hw_perf_event *hwc)
        case CPUMF_CTR_SET_EXT:
                if (cpuhw->info.csvn < 1)
                        err = -EOPNOTSUPP;
+                if ((cpuhw->info.csvn == 1 && hwc->config > 159) ||
+                    (cpuhw->info.csvn == 2 && hwc->config > 175) ||
+                    (cpuhw->info.csvn  > 2 && hwc->config > 255))
+                        err = -EOPNOTSUPP;
                break;
        }
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index de8fa9bbd35e..79cb51adc741 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -8,7 +8,7 @@
 #ifndef CONFIG_64BIT
 OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
-OUTPUT_ARCH(s390)
+OUTPUT_ARCH(s390:31-bit)
 ENTRY(startup)
 jiffies = jiffies_64 + 4;
 #else
diff --git a/arch/tile/Makefile b/arch/tile/Makefile
index 55640cf92597..3d15364c6071 100644
--- a/arch/tile/Makefile
+++ b/arch/tile/Makefile
@@ -26,6 +26,10 @@ $(error Set TILERA_ROOT or CROSS_COMPILE when building $(ARCH) on $(HOST_ARCH))
  endif
 endif
+# The tile compiler may emit .eh_frame information for backtracing.
+# In kernel modules, this causes load failures due to unsupported relocations.
+KBUILD_CFLAGS   += -fno-asynchronous-unwind-tables
 ifneq ($(CONFIG_DEBUG_EXTRA_FLAGS),"")
 KBUILD_CFLAGS   += $(CONFIG_DEBUG_EXTRA_FLAGS)
 endif
diff --git a/arch/tile/kernel/module.c b/arch/tile/kernel/module.c
index 001cbfa10ac6..243ffebe38d6 100644
--- a/arch/tile/kernel/module.c
+++ b/arch/tile/kernel/module.c
@@ -24,16 +24,6 @@
 #include <asm/homecache.h>
 #include <arch/opcode.h>
-#ifdef __tilegx__
-# define Elf_Rela Elf64_Rela
-# define ELF_R_SYM ELF64_R_SYM
-# define ELF_R_TYPE ELF64_R_TYPE
-#else
-# define Elf_Rela Elf32_Rela
-# define ELF_R_SYM ELF32_R_SYM
-# define ELF_R_TYPE ELF32_R_TYPE
-#endif
 #ifdef MODULE_DEBUG
 #define DEBUGP printk
 #else
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index c9dcc181d4d1..6e8fdf5ad113 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -35,7 +35,7 @@ extern unsigned long asmlinkage efi_call_phys(void *, ...);
 #define efi_call_virt6(f, a1, a2, a3, a4, a5, a6)       \
        efi_call_virt(f, a1, a2, a3, a4, a5, a6)
-#define efi_ioremap(addr, size, type)           ioremap_cache(addr, size)
+#define efi_ioremap(addr, size, type, attr)     ioremap_cache(addr, size)
 #else /* !CONFIG_X86_32 */
@@ -89,7 +89,7 @@ extern u64 efi_call6(void *fp, u64 arg1, u64 arg2, u64 arg3,
                  (u64)(a3), (u64)(a4), (u64)(a5), (u64)(a6))
 extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
-                                 u32 type);
+                                 u32 type, u64 attribute);
 #endif /* CONFIG_X86_32 */
@@ -98,6 +98,8 @@ extern void efi_set_executable(efi_memory_desc_t *md, bool executable);
 extern int efi_memblock_x86_reserve_range(void);
 extern void efi_call_phys_prelog(void);
 extern void efi_call_phys_epilog(void);
+extern void efi_unmap_memmap(void);
+extern void efi_memory_uc(u64 addr, unsigned long size);
 #ifndef CONFIG_EFI
 /*
diff --git a/arch/x86/include/asm/xen/interface.h b/arch/x86/include/asm/xen/interface.h
index 6d2f75a82a14..54d52ff1304a 100644
--- a/arch/x86/include/asm/xen/interface.h
+++ b/arch/x86/include/asm/xen/interface.h
@@ -51,14 +51,14 @@
 * with Xen so that on ARM we can have one ABI that works for 32 and 64
 * bit guests. */
 typedef unsigned long xen_pfn_t;
+#define PRI_xen_pfn "lx"
 typedef unsigned long xen_ulong_t;
+#define PRI_xen_ulong "lx"
 /* Guest handles for primitive C types. */
 __DEFINE_GUEST_HANDLE(uchar, unsigned char);
 __DEFINE_GUEST_HANDLE(uint,  unsigned int);
-__DEFINE_GUEST_HANDLE(ulong, unsigned long);
 DEFINE_GUEST_HANDLE(char);
 DEFINE_GUEST_HANDLE(int);
-DEFINE_GUEST_HANDLE(long);
 DEFINE_GUEST_HANDLE(void);
 DEFINE_GUEST_HANDLE(uint64_t);
 DEFINE_GUEST_HANDLE(uint32_t);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index c265593ec2cd..1817fa911024 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2257,6 +2257,9 @@ asmlinkage void smp_irq_move_cleanup_interrupt(void)
                        continue;
                cfg = irq_cfg(irq);
+                if (!cfg)
+                        continue;
                raw_spin_lock(&desc->lock);
                /*
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 3373f84d1397..4a3374e61a93 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -208,12 +208,14 @@ static bool check_hw_exists(void)
        }
        /*
-         * Now write a value and read it back to see if it matches,
+         * Read the current value, change it and read it back to see if it
-         * this is needed to detect certain hardware emulators (qemu/kvm)
+         * matches, this is needed to detect certain hardware emulators
-         * that don't trap on the MSR access and always return 0s.
+         * (qemu/kvm) that don't trap on the MSR access and always return 0s.
         */
-        val = 0xabcdUL;
        reg = x86_pmu_event_addr(0);
+        if (rdmsrl_safe(reg, &val))
+                goto msr_fail;
+        val ^= 0xffffUL;
        ret = wrmsrl_safe(reg, val);
        ret |= rdmsrl_safe(reg, &val_new);
        if (ret || val != val_new)
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 99d96a4978b5..3cf3d97cce3a 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -118,22 +118,24 @@ static void snbep_uncore_pci_disable_box(struct intel_uncore_box *box)
 {
        struct pci_dev *pdev = box->pci_dev;
        int box_ctl = uncore_pci_box_ctl(box);
-        u32 config;
+        u32 config = 0;
-        pci_read_config_dword(pdev, box_ctl, &config);
+        if (!pci_read_config_dword(pdev, box_ctl, &config)) {
-        config |= SNBEP_PMON_BOX_CTL_FRZ;
+                config |= SNBEP_PMON_BOX_CTL_FRZ;
-        pci_write_config_dword(pdev, box_ctl, config);
+                pci_write_config_dword(pdev, box_ctl, config);
+        }
 }
 static void snbep_uncore_pci_enable_box(struct intel_uncore_box *box)
 {
        struct pci_dev *pdev = box->pci_dev;
        int box_ctl = uncore_pci_box_ctl(box);
-        u32 config;
+        u32 config = 0;
-        pci_read_config_dword(pdev, box_ctl, &config);
+        if (!pci_read_config_dword(pdev, box_ctl, &config)) {
-        config &= ~SNBEP_PMON_BOX_CTL_FRZ;
+                config &= ~SNBEP_PMON_BOX_CTL_FRZ;
-        pci_write_config_dword(pdev, box_ctl, config);
+                pci_write_config_dword(pdev, box_ctl, config);
+        }
 }
 static void snbep_uncore_pci_enable_event(struct intel_uncore_box *box, struct perf_event *event)
@@ -156,7 +158,7 @@ static u64 snbep_uncore_pci_read_counter(struct intel_uncore_box *box, struct pe
 {
        struct pci_dev *pdev = box->pci_dev;
        struct hw_perf_event *hwc = &event->hw;
-        u64 count;
+        u64 count = 0;
        pci_read_config_dword(pdev, hwc->event_base, (u32 *)&count);
        pci_read_config_dword(pdev, hwc->event_base + 4, (u32 *)&count + 1);
@@ -603,11 +605,12 @@ static struct pci_driver snbep_uncore_pci_driver = {
 /*
 * build pci bus to socket mapping
 */
-static void snbep_pci2phy_map_init(void)
+static int snbep_pci2phy_map_init(void)
 {
        struct pci_dev *ubox_dev = NULL;
        int i, bus, nodeid;
-        u32 config;
+        int err = 0;
+        u32 config = 0;
        while (1) {
                /* find the UBOX device */
@@ -618,10 +621,14 @@ static void snbep_pci2phy_map_init(void)
                        break;
                bus = ubox_dev->bus->number;
                /* get the Node ID of the local register */
-                pci_read_config_dword(ubox_dev, 0x40, &config);
+                err = pci_read_config_dword(ubox_dev, 0x40, &config);
+                if (err)
+                        break;
                nodeid = config;
                /* get the Node ID mapping */
-                pci_read_config_dword(ubox_dev, 0x54, &config);
+                err = pci_read_config_dword(ubox_dev, 0x54, &config);
+                if (err)
+                        break;
                /*
                 * every three bits in the Node ID mapping register maps
                 * to a particular node.
@@ -633,7 +640,11 @@ static void snbep_pci2phy_map_init(void)
                        }
                }
        };
-        return;
+        if (ubox_dev)
+                pci_dev_put(ubox_dev);
+        return err ? pcibios_err_to_errno(err) : 0;
 }
 /* end of Sandy Bridge-EP uncore support */
@@ -1547,7 +1558,6 @@ void nhmex_rbox_alter_er(struct intel_uncore_box *box, struct perf_event *event)
 {
        struct hw_perf_event *hwc = &event->hw;
        struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
-        int port;
        /* adjust the main event selector and extra register index */
        if (reg1->idx % 2) {
@@ -1559,7 +1569,6 @@ void nhmex_rbox_alter_er(struct intel_uncore_box *box, struct perf_event *event)
        }
        /* adjust extra register config */
-        port = reg1->idx / 6 + box->pmu->pmu_idx * 4;
        switch (reg1->idx % 6) {
        case 2:
                /* shift the 8~15 bits to the 0~7 bits */
@@ -2578,9 +2587,11 @@ static int __init uncore_pci_init(void)
        switch (boot_cpu_data.x86_model) {
        case 45: /* Sandy Bridge-EP */
+                ret = snbep_pci2phy_map_init();
+                if (ret)
+                        return ret;
                pci_uncores = snbep_pci_uncores;
                uncore_pci_driver = &snbep_uncore_pci_driver;
-                snbep_pci2phy_map_init();
                break;
        default:
                return 0;
@@ -2926,6 +2937,9 @@ static int __init intel_uncore_init(void)
        if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
                return -ENODEV;
+        if (cpu_has_hypervisor)
+                return -ENODEV;
        ret = uncore_pci_init();
        if (ret)
                goto fail;
diff --git a/arch/x86/kernel/cpu/perf_event_knc.c b/arch/x86/kernel/cpu/perf_event_knc.c
index 7c46bfdbc373..4b7731bf23a8 100644
--- a/arch/x86/kernel/cpu/perf_event_knc.c
+++ b/arch/x86/kernel/cpu/perf_event_knc.c
@@ -3,6 +3,8 @@
 #include <linux/perf_event.h>
 #include <linux/types.h>
+#include <asm/hardirq.h>
 #include "perf_event.h"
 static const u64 knc_perfmon_event_map[] =
@@ -173,30 +175,100 @@ static void knc_pmu_enable_all(int added)
 static inline void
 knc_pmu_disable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
        struct hw_perf_event *hwc = &event->hw;
        u64 val;
        val = hwc->config;
-        if (cpuc->enabled)
+        val &= ~ARCH_PERFMON_EVENTSEL_ENABLE;
-                val &= ~ARCH_PERFMON_EVENTSEL_ENABLE;
        (void)wrmsrl_safe(hwc->config_base + hwc->idx, val);
 }
 static void knc_pmu_enable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
        struct hw_perf_event *hwc = &event->hw;
        u64 val;
        val = hwc->config;
-        if (cpuc->enabled)
+        val |= ARCH_PERFMON_EVENTSEL_ENABLE;
-                val |= ARCH_PERFMON_EVENTSEL_ENABLE;
        (void)wrmsrl_safe(hwc->config_base + hwc->idx, val);
 }
+static inline u64 knc_pmu_get_status(void)
+{
+        u64 status;
+        rdmsrl(MSR_KNC_IA32_PERF_GLOBAL_STATUS, status);
+        return status;
+}
+static inline void knc_pmu_ack_status(u64 ack)
+{
+        wrmsrl(MSR_KNC_IA32_PERF_GLOBAL_OVF_CONTROL, ack);
+}
+static int knc_pmu_handle_irq(struct pt_regs *regs)
+{
+        struct perf_sample_data data;
+        struct cpu_hw_events *cpuc;
+        int handled = 0;
+        int bit, loops;
+        u64 status;
+        cpuc = &__get_cpu_var(cpu_hw_events);
+        knc_pmu_disable_all();
+        status = knc_pmu_get_status();
+        if (!status) {
+                knc_pmu_enable_all(0);
+                return handled;
+        }
+        loops = 0;
+again:
+        knc_pmu_ack_status(status);
+        if (++loops > 100) {
+                WARN_ONCE(1, "perf: irq loop stuck!\n");
+                perf_event_print_debug();
+                goto done;
+        }
+        inc_irq_stat(apic_perf_irqs);
+        for_each_set_bit(bit, (unsigned long *)&status, X86_PMC_IDX_MAX) {
+                struct perf_event *event = cpuc->events[bit];
+                handled++;
+                if (!test_bit(bit, cpuc->active_mask))
+                        continue;
+                if (!intel_pmu_save_and_restart(event))
+                        continue;
+                perf_sample_data_init(&data, 0, event->hw.last_period);
+                if (perf_event_overflow(event, &data, regs))
+                        x86_pmu_stop(event, 0);
+        }
+        /*
+         * Repeat if there is more work to be done:
+         */
+        status = knc_pmu_get_status();
+        if (status)
+                goto again;
+done:
+        knc_pmu_enable_all(0);
+        return handled;
+}
 PMU_FORMAT_ATTR(event,  "config:0-7"    );
 PMU_FORMAT_ATTR(umask,  "config:8-15"   );
 PMU_FORMAT_ATTR(edge,   "config:18"     );
@@ -214,7 +286,7 @@ static struct attribute *intel_knc_formats_attr[] = {
 static __initconst struct x86_pmu knc_pmu = {
        .name                   = "knc",
-        .handle_irq             = x86_pmu_handle_irq,
+        .handle_irq             = knc_pmu_handle_irq,
        .disable_all            = knc_pmu_disable_all,
        .enable_all             = knc_pmu_enable_all,
        .enable                 = knc_pmu_enable_event,
@@ -226,12 +298,11 @@ static __initconst struct x86_pmu knc_pmu = {
        .event_map              = knc_pmu_event_map,
        .max_events             = ARRAY_SIZE(knc_perfmon_event_map),
        .apic                   = 1,
-        .max_period             = (1ULL << 31) - 1,
+        .max_period             = (1ULL << 39) - 1,
        .version                = 0,
        .num_counters           = 2,
-        /* in theory 40 bits, early silicon is buggy though */
+        .cntval_bits            = 40,
-        .cntval_bits            = 32,
+        .cntval_mask            = (1ULL << 40) - 1,
-        .cntval_mask            = (1ULL << 32) - 1,
        .get_event_constraints  = x86_get_event_constraints,
        .event_constraints      = knc_event_constraints,
        .format_attrs           = intel_knc_formats_attr,
diff --git a/arch/x86/kernel/cpu/perf_event_p6.c b/arch/x86/kernel/cpu/perf_event_p6.c
index e4dd0f7a0453..7d0270bd793e 100644
--- a/arch/x86/kernel/cpu/perf_event_p6.c
+++ b/arch/x86/kernel/cpu/perf_event_p6.c
@@ -8,13 +8,106 @@
 */
 static const u64 p6_perfmon_event_map[] =
 {
-  [PERF_COUNT_HW_CPU_CYCLES]            = 0x0079,
+  [PERF_COUNT_HW_CPU_CYCLES]            = 0x0079,       /* CPU_CLK_UNHALTED */
-  [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
+  [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,       /* INST_RETIRED     */
-  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0f2e,
+  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0f2e,       /* L2_RQSTS:M:E:S:I */
-  [PERF_COUNT_HW_CACHE_MISSES]          = 0x012e,
+  [PERF_COUNT_HW_CACHE_MISSES]          = 0x012e,       /* L2_RQSTS:I       */
-  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,
+  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,       /* BR_INST_RETIRED  */
-  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,
+  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,       /* BR_MISS_PRED_RETIRED */
-  [PERF_COUNT_HW_BUS_CYCLES]            = 0x0062,
+  [PERF_COUNT_HW_BUS_CYCLES]            = 0x0062,       /* BUS_DRDY_CLOCKS  */
+  [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00a2,     /* RESOURCE_STALLS  */
+};
+static __initconst u64 p6_hw_cache_event_ids
+                                [PERF_COUNT_HW_CACHE_MAX]
+                                [PERF_COUNT_HW_CACHE_OP_MAX]
+                                [PERF_COUNT_HW_CACHE_RESULT_MAX] =
+{
+ [ C(L1D) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0043,  /* DATA_MEM_REFS       */
+                [ C(RESULT_MISS)   ] = 0x0045,  /* DCU_LINES_IN        */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0x0f29,  /* L2_LD:M:E:S:I       */
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(L1I ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0080,  /* IFU_IFETCH         */
+                [ C(RESULT_MISS)   ] = 0x0f28,  /* L2_IFETCH:M:E:S:I  */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(LL  ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0x0025,  /* L2_M_LINES_INM     */
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(DTLB) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0043,  /* DATA_MEM_REFS      */
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(ITLB) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0080,  /* IFU_IFETCH         */
+                [ C(RESULT_MISS)   ] = 0x0085,  /* ITLB_MISS          */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+ },
+ [ C(BPU ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x00c4,  /* BR_INST_RETIRED      */
+                [ C(RESULT_MISS)   ] = 0x00c5,  /* BR_MISS_PRED_RETIRED */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+ },
 };
 static u64 p6_pmu_event_map(int hw_event)
@@ -34,7 +127,7 @@ static struct event_constraint p6_event_constraints[] =
 {
        INTEL_EVENT_CONSTRAINT(0xc1, 0x1),      /* FLOPS */
        INTEL_EVENT_CONSTRAINT(0x10, 0x1),      /* FP_COMP_OPS_EXE */
-        INTEL_EVENT_CONSTRAINT(0x11, 0x1),      /* FP_ASSIST */
+        INTEL_EVENT_CONSTRAINT(0x11, 0x2),      /* FP_ASSIST */
        INTEL_EVENT_CONSTRAINT(0x12, 0x2),      /* MUL */
        INTEL_EVENT_CONSTRAINT(0x13, 0x2),      /* DIV */
        INTEL_EVENT_CONSTRAINT(0x14, 0x1),      /* CYCLES_DIV_BUSY */
@@ -64,25 +157,25 @@ static void p6_pmu_enable_all(int added)
 static inline void
 p6_pmu_disable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
        struct hw_perf_event *hwc = &event->hw;
        u64 val = P6_NOP_EVENT;
-        if (cpuc->enabled)
-                val |= ARCH_PERFMON_EVENTSEL_ENABLE;
        (void)wrmsrl_safe(hwc->config_base, val);
 }
 static void p6_pmu_enable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
        struct hw_perf_event *hwc = &event->hw;
        u64 val;
        val = hwc->config;
-        if (cpuc->enabled)
-                val |= ARCH_PERFMON_EVENTSEL_ENABLE;
+        /*
+         * p6 only has a global event enable, set on PerfEvtSel0
+         * We "disable" events by programming P6_NOP_EVENT
+         * and we rely on p6_pmu_enable_all() being called
+         * to actually enable the events.
+         */
        (void)wrmsrl_safe(hwc->config_base, val);
 }
@@ -158,5 +251,9 @@ __init int p6_pmu_init(void)
        x86_pmu = p6_pmu;
+        memcpy(hw_cache_event_ids, p6_hw_cache_event_ids,
+                sizeof(hw_cache_event_ids));
        return 0;
 }
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index ed858e9e9a74..df06ade26bef 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -1077,6 +1077,9 @@ void __init memblock_x86_fill(void)
                memblock_add(ei->addr, ei->size);
        }
+        /* throw away partial pages */
+        memblock_trim_memory(PAGE_SIZE);
        memblock_dump_all();
 }
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index a1193aef6d7d..88b725aa1d52 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -1035,7 +1035,7 @@ ENTRY(xen_sysenter_target)
 ENTRY(xen_hypervisor_callback)
        CFI_STARTPROC
-        pushl_cfi $0
+        pushl_cfi $-1 /* orig_ax = -1 => not a system call */
        SAVE_ALL
        TRACE_IRQS_OFF
@@ -1077,14 +1077,16 @@ ENTRY(xen_failsafe_callback)
 2:      mov 8(%esp),%es
 3:      mov 12(%esp),%fs
 4:      mov 16(%esp),%gs
+        /* EAX == 0 => Category 1 (Bad segment)
+           EAX != 0 => Category 2 (Bad IRET) */
        testl %eax,%eax
        popl_cfi %eax
        lea 16(%esp),%esp
        CFI_ADJUST_CFA_OFFSET -16
        jz 5f
        addl $16,%esp
-        jmp iret_exc            # EAX != 0 => Category 2 (Bad IRET)
+        jmp iret_exc
-5:      pushl_cfi $0            # EAX == 0 => Category 1 (Bad segment)
+5:      pushl_cfi $-1 /* orig_ax = -1 => not a system call */
        SAVE_ALL
        jmp ret_from_exception
        CFI_ENDPROC
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 0c58952d64e8..b51b2c7ee51f 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1435,7 +1435,7 @@ ENTRY(xen_failsafe_callback)
        CFI_RESTORE r11
        addq $0x30,%rsp
        CFI_ADJUST_CFA_OFFSET -0x30
-        pushq_cfi $0
+        pushq_cfi $-1 /* orig_ax = -1 => not a system call */
        SAVE_ALL
        jmp error_exit
        CFI_ENDPROC
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index b3e5e51bc907..4180a874c764 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -247,7 +247,10 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code)
                break;
        case KVM_PV_REASON_PAGE_NOT_PRESENT:
                /* page is swapped out by the host. */
+                rcu_irq_enter();
+                exit_idle();
                kvm_async_pf_task_wait((u32)read_cr2());
+                rcu_irq_exit();
                break;
        case KVM_PV_REASON_PAGE_READY:
                rcu_irq_enter();
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 468e98dfd44e..ca45696f30fb 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -921,18 +921,19 @@ void __init setup_arch(char **cmdline_p)
 #ifdef CONFIG_X86_64
        if (max_pfn > max_low_pfn) {
                int i;
-                for (i = 0; i < e820.nr_map; i++) {
+                unsigned long start, end;
-                        struct e820entry *ei = &e820.map[i];
+                unsigned long start_pfn, end_pfn;
-                        if (ei->addr + ei->size <= 1UL << 32)
+                for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn,
-                                continue;
+                                                         NULL) {
-                        if (ei->type == E820_RESERVED)
+                        end = PFN_PHYS(end_pfn);
+                        if (end <= (1UL<<32))
                                continue;
+                        start = PFN_PHYS(start_pfn);
                        max_pfn_mapped = init_memory_mapping(
-                                ei->addr < 1UL << 32 ? 1UL << 32 : ei->addr,
+                                                max((1UL<<32), start), end);
-                                ei->addr + ei->size);
                }
                /* can we preseve max_low_pfn ?*/
@@ -1048,6 +1049,18 @@ void __init setup_arch(char **cmdline_p)
        arch_init_ideal_nops();
        register_refined_jiffies(CLOCK_TICK_RATE);
+#ifdef CONFIG_EFI
+        /* Once setup is done above, disable efi_enabled on mismatched
+         * firmware/kernel archtectures since there is no support for
+         * runtime services.
+         */
+        if (efi_enabled && IS_ENABLED(CONFIG_X86_64) != efi_64bit) {
+                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
+                efi_unmap_memmap();
+                efi_enabled = 0;
+        }
+#endif
 }
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 29ad351804e9..70b27ee6118e 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -824,10 +824,8 @@ do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
                mce_notify_process();
 #endif /* CONFIG_X86_64 && CONFIG_X86_MCE */
-        if (thread_info_flags & _TIF_UPROBE) {
+        if (thread_info_flags & _TIF_UPROBE)
-                clear_thread_flag(TIF_UPROBE);
                uprobe_notify_resume(regs);
-        }
        /* deal with pending signal delivery */
        if (thread_info_flags & _TIF_SIGPENDING)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 9538f00827a9..aafa5557b396 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -651,31 +651,19 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
 /*
 * Skip these instructions as per the currently known x86 ISA.
- * 0x66* { 0x90 | 0x0f 0x1f | 0x0f 0x19 | 0x87 0xc0 }
+ * rep=0x66*; nop=0x90
 */
 static bool __skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
 {
        int i;
        for (i = 0; i < MAX_UINSN_BYTES; i++) {
-                if ((auprobe->insn[i] == 0x66))
+                if (auprobe->insn[i] == 0x66)
                        continue;
                if (auprobe->insn[i] == 0x90)
                        return true;
-                if (i == (MAX_UINSN_BYTES - 1))
-                        break;
-                if ((auprobe->insn[i] == 0x0f) && (auprobe->insn[i+1] == 0x1f))
-                        return true;
-                if ((auprobe->insn[i] == 0x0f) && (auprobe->insn[i+1] == 0x19))
-                        return true;
-                if ((auprobe->insn[i] == 0x87) && (auprobe->insn[i+1] == 0xc0))
-                        return true;
                break;
        }
        return false;
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index c6e6b721b6ee..43e9fadca5d0 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1311,7 +1311,7 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
        vcpu->arch.apic_base = value;
        if (apic_x2apic_mode(apic)) {
                u32 id = kvm_apic_id(apic);
-                u32 ldr = ((id & ~0xf) << 16) | (1 << (id & 0xf));
+                u32 ldr = ((id >> 4) << 16) | (1 << (id & 0xf));
                kvm_apic_set_ldr(apic, ldr);
        }
        apic->base_address = apic->vcpu->arch.apic_base &
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index d289fee1ffb8..6f85fe0bf958 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2497,8 +2497,7 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                }
        }
-        if (!is_error_pfn(pfn))
+        kvm_release_pfn_clean(pfn);
-                kvm_release_pfn_clean(pfn);
 }
 static void nonpaging_new_cr3(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index ab1f6a93b527..d7aea41563b3 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -35,40 +35,44 @@ struct map_range {
        unsigned page_size_mask;
 };
-static void __init find_early_table_space(struct map_range *mr, unsigned long end,
+/*
-                                          int use_pse, int use_gbpages)
+ * First calculate space needed for kernel direct mapping page tables to cover
+ * mr[0].start to mr[nr_range - 1].end, while accounting for possible 2M and 1GB
+ * pages. Then find enough contiguous space for those page tables.
+ */
+static void __init find_early_table_space(struct map_range *mr, int nr_range)
 {
-        unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
+        int i;
+        unsigned long puds = 0, pmds = 0, ptes = 0, tables;
+        unsigned long start = 0, good_end;
        phys_addr_t base;
-        puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
+        for (i = 0; i < nr_range; i++) {
-        tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
+                unsigned long range, extra;
-        if (use_gbpages) {
-                unsigned long extra;
-                extra = end - ((end>>PUD_SHIFT) << PUD_SHIFT);
-                pmds = (extra + PMD_SIZE - 1) >> PMD_SHIFT;
-        } else
-                pmds = (end + PMD_SIZE - 1) >> PMD_SHIFT;
-        tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
+                range = mr[i].end - mr[i].start;
+                puds += (range + PUD_SIZE - 1) >> PUD_SHIFT;
-        if (use_pse) {
+                if (mr[i].page_size_mask & (1 << PG_LEVEL_1G)) {
-                unsigned long extra;
+                        extra = range - ((range >> PUD_SHIFT) << PUD_SHIFT);
+                        pmds += (extra + PMD_SIZE - 1) >> PMD_SHIFT;
+                } else {
+                        pmds += (range + PMD_SIZE - 1) >> PMD_SHIFT;
+                }
-                extra = end - ((end>>PMD_SHIFT) << PMD_SHIFT);
+                if (mr[i].page_size_mask & (1 << PG_LEVEL_2M)) {
+                        extra = range - ((range >> PMD_SHIFT) << PMD_SHIFT);
 #ifdef CONFIG_X86_32
-                extra += PMD_SIZE;
+                        extra += PMD_SIZE;
 #endif
-                /* The first 2/4M doesn't use large pages. */
+                        ptes += (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
-                if (mr->start < PMD_SIZE)
+                } else {
-                        extra += mr->end - mr->start;
+                        ptes += (range + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                }
-                ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
+        }
-        } else
-                ptes = (end + PAGE_SIZE - 1) >> PAGE_SHIFT;
+        tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
+        tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
        tables += roundup(ptes * sizeof(pte_t), PAGE_SIZE);
 #ifdef CONFIG_X86_32
@@ -86,7 +90,7 @@ static void __init find_early_table_space(struct map_range *mr, unsigned long en
        pgt_buf_top = pgt_buf_start + (tables >> PAGE_SHIFT);
        printk(KERN_DEBUG "kernel direct mapping tables up to %#lx @ [mem %#010lx-%#010lx]\n",
-                end - 1, pgt_buf_start << PAGE_SHIFT,
+                mr[nr_range - 1].end - 1, pgt_buf_start << PAGE_SHIFT,
                (pgt_buf_top << PAGE_SHIFT) - 1);
 }
@@ -267,7 +271,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
         * nodes are discovered.
         */
        if (!after_bootmem)
-                find_early_table_space(&mr[0], end, use_pse, use_gbpages);
+                find_early_table_space(mr, nr_range);
        for (i = 0; i < nr_range; i++)
                ret = kernel_physical_mapping_init(mr[i].start, mr[i].end,
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 2b6b4a3c8beb..3baff255adac 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -386,7 +386,8 @@ phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end,
                 * these mappings are more intelligent.
                 */
                if (pte_val(*pte)) {
-                        pages++;
+                        if (!after_bootmem)
+                                pages++;
                        continue;
                }
@@ -451,6 +452,8 @@ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
                         * attributes.
                         */
                        if (page_size_mask & (1 << PG_LEVEL_2M)) {
+                                if (!after_bootmem)
+                                        pages++;
                                last_map_addr = next;
                                continue;
                        }
@@ -526,6 +529,8 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
                         * attributes.
                         */
                        if (page_size_mask & (1 << PG_LEVEL_1G)) {
+                                if (!after_bootmem)
+                                        pages++;
                                last_map_addr = next;
                                continue;
                        }
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 26b8a8514ee5..48768df2471a 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -55,7 +55,7 @@ u64 op_x86_get_ctrl(struct op_x86_model_spec const *model,
        val |= counter_config->extra;
        event &= model->event_mask ? model->event_mask : 0xFF;
        val |= event & 0xFF;
-        val |= (event & 0x0F00) << 24;
+        val |= (u64)(event & 0x0F00) << 24;
        return val;
 }
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index aded2a91162a..ad4439145f85 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -70,11 +70,15 @@ EXPORT_SYMBOL(efi);
 struct efi_memory_map memmap;
 bool efi_64bit;
-static bool efi_native;
 static struct efi efi_phys __initdata;
 static efi_system_table_t efi_systab __initdata;
+static inline bool efi_is_native(void)
+{
+        return IS_ENABLED(CONFIG_X86_64) == efi_64bit;
+}
 static int __init setup_noefi(char *arg)
 {
        efi_enabled = 0;
@@ -420,7 +424,7 @@ void __init efi_reserve_boot_services(void)
        }
 }
-static void __init efi_unmap_memmap(void)
+void __init efi_unmap_memmap(void)
 {
        if (memmap.map) {
                early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size);
@@ -432,7 +436,7 @@ void __init efi_free_boot_services(void)
 {
        void *p;
-        if (!efi_native)
+        if (!efi_is_native())
                return;
        for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
@@ -684,12 +688,10 @@ void __init efi_init(void)
                return;
        }
        efi_phys.systab = (efi_system_table_t *)boot_params.efi_info.efi_systab;
-        efi_native = !efi_64bit;
 #else
        efi_phys.systab = (efi_system_table_t *)
                          (boot_params.efi_info.efi_systab |
                          ((__u64)boot_params.efi_info.efi_systab_hi<<32));
-        efi_native = efi_64bit;
 #endif
        if (efi_systab_init(efi_phys.systab)) {
@@ -723,7 +725,7 @@ void __init efi_init(void)
         * that doesn't match the kernel 32/64-bit mode.
         */
-        if (!efi_native)
+        if (!efi_is_native())
                pr_info("No EFI runtime due to 32/64-bit mismatch with kernel\n");
        else if (efi_runtime_init()) {
                efi_enabled = 0;
@@ -735,7 +737,7 @@ void __init efi_init(void)
                return;
        }
 #ifdef CONFIG_X86_32
-        if (efi_native) {
+        if (efi_is_native()) {
                x86_platform.get_wallclock = efi_get_time;
                x86_platform.set_wallclock = efi_set_rtc_mmss;
        }
@@ -810,6 +812,16 @@ void __iomem *efi_lookup_mapped_addr(u64 phys_addr)
        return NULL;
 }
+void efi_memory_uc(u64 addr, unsigned long size)
+{
+        unsigned long page_shift = 1UL << EFI_PAGE_SHIFT;
+        u64 npages;
+        npages = round_up(size, page_shift) / page_shift;
+        memrange_efi_to_native(&addr, &npages);
+        set_memory_uc(addr, npages);
+}
 /*
 * This function will switch the EFI runtime services to virtual mode.
 * Essentially, look through the EFI memmap and map every region that
@@ -823,7 +835,7 @@ void __init efi_enter_virtual_mode(void)
        efi_memory_desc_t *md, *prev_md = NULL;
        efi_status_t status;
        unsigned long size;
-        u64 end, systab, addr, npages, end_pfn;
+        u64 end, systab, end_pfn;
        void *p, *va, *new_memmap = NULL;
        int count = 0;
@@ -834,7 +846,7 @@ void __init efi_enter_virtual_mode(void)
         * non-native EFI
         */
-        if (!efi_native) {
+        if (!efi_is_native()) {
                efi_unmap_memmap();
                return;
        }
@@ -879,10 +891,14 @@ void __init efi_enter_virtual_mode(void)
                end_pfn = PFN_UP(end);
                if (end_pfn <= max_low_pfn_mapped
                    || (end_pfn > (1UL << (32 - PAGE_SHIFT))
-                        && end_pfn <= max_pfn_mapped))
+                        && end_pfn <= max_pfn_mapped)) {
                        va = __va(md->phys_addr);
-                else
-                        va = efi_ioremap(md->phys_addr, size, md->type);
+                        if (!(md->attribute & EFI_MEMORY_WB))
+                                efi_memory_uc((u64)(unsigned long)va, size);
+                } else
+                        va = efi_ioremap(md->phys_addr, size,
+                                         md->type, md->attribute);
                md->virt_addr = (u64) (unsigned long) va;
@@ -892,13 +908,6 @@ void __init efi_enter_virtual_mode(void)
                        continue;
                }
-                if (!(md->attribute & EFI_MEMORY_WB)) {
-                        addr = md->virt_addr;
-                        npages = md->num_pages;
-                        memrange_efi_to_native(&addr, &npages);
-                        set_memory_uc(addr, npages);
-                }
                systab = (u64) (unsigned long) efi_phys.systab;
                if (md->phys_addr <= systab && systab < end) {
                        systab += md->virt_addr - md->phys_addr;
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index ac3aa54e2654..95fd505dfeb6 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -82,7 +82,7 @@ void __init efi_call_phys_epilog(void)
 }
 void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
-                                 u32 type)
+                                 u32 type, u64 attribute)
 {
        unsigned long last_map_pfn;
@@ -92,8 +92,11 @@ void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
        last_map_pfn = init_memory_mapping(phys_addr, phys_addr + size);
        if ((last_map_pfn << PAGE_SHIFT) < phys_addr + size) {
                unsigned long top = last_map_pfn << PAGE_SHIFT;
-                efi_ioremap(top, size - (top - phys_addr), type);
+                efi_ioremap(top, size - (top - phys_addr), type, attribute);
        }
+        if (!(attribute & EFI_MEMORY_WB))
+                efi_memory_uc((u64)(unsigned long)__va(phys_addr), size);
        return (void __iomem *)__va(phys_addr);
 }
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e3497f240eab..586d83812b67 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -81,8 +81,6 @@
 #include "smp.h"
 #include "multicalls.h"
-#include <xen/events.h>
 EXPORT_SYMBOL_GPL(hypercall_page);
 DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 08b4c5209384..b34b5cda5ae1 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -236,7 +236,7 @@ config CMA_SIZE_PERCENTAGE
 choice
        prompt "Selected region size"
-        default CMA_SIZE_SEL_ABSOLUTE
+        default CMA_SIZE_SEL_MBYTES
 config CMA_SIZE_SEL_MBYTES
        bool "Use mega bytes value only"
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index 560a7173f810..bc256b641027 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -191,9 +191,8 @@ EXPORT_SYMBOL(dma_release_from_coherent);
 * This checks whether the memory was allocated from the per-device
 * coherent memory pool and if so, maps that memory to the provided vma.
 *
- * Returns 1 if we correctly mapped the memory, or 0 if
+ * Returns 1 if we correctly mapped the memory, or 0 if the caller should
- * dma_release_coherent() should proceed with mapping memory from
+ * proceed with mapping memory from generic pools.
- * generic pools.
 */
 int dma_mmap_from_coherent(struct device *dev, struct vm_area_struct *vma,
                           void *vaddr, size_t size, int *ret)
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 9a1469474f55..612afcc5a938 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -27,15 +27,12 @@
 #include <linux/mm.h>
 #include <linux/mutex.h>
 #include <linux/page-isolation.h>
+#include <linux/sizes.h>
 #include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/mm_types.h>
 #include <linux/dma-contiguous.h>
-#ifndef SZ_1M
-#define SZ_1M (1 << 20)
-#endif
 struct cma {
        unsigned long   base_pfn;
        unsigned long   count;
diff --git a/drivers/base/regmap/Kconfig b/drivers/base/regmap/Kconfig
index 6be390bd8bd1..f0d30543fcce 100644
--- a/drivers/base/regmap/Kconfig
+++ b/drivers/base/regmap/Kconfig
@@ -3,7 +3,7 @@
 # subsystems should select the appropriate symbols.
 config REGMAP
-        default y if (REGMAP_I2C || REGMAP_SPI)
+        default y if (REGMAP_I2C || REGMAP_SPI || REGMAP_MMIO || REGMAP_IRQ)
        select LZO_COMPRESS
        select LZO_DECOMPRESS
        select IRQ_DOMAIN if REGMAP_IRQ
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 677cd6e4e1a1..d4c12180c654 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -90,6 +90,17 @@ config DW_DMAC
          Support the Synopsys DesignWare AHB DMA controller.  This
          can be integrated in chips such as the Atmel AT32ap7000.
+config DW_DMAC_BIG_ENDIAN_IO
+        bool "Use big endian I/O register access"
+        default y if AVR32
+        depends on DW_DMAC
+        help
+          Say yes here to use big endian I/O access when reading and writing
+          to the DMA controller registers. This is needed on some platforms,
+          like the Atmel AVR32 architecture.
+          If unsure, use the default setting.
 config AT_HDMAC
        tristate "Atmel AHB DMA support"
        depends on ARCH_AT91
diff --git a/drivers/dma/dw_dmac_regs.h b/drivers/dma/dw_dmac_regs.h
index ff39fa6cd2bc..88965597b7d0 100644
--- a/drivers/dma/dw_dmac_regs.h
+++ b/drivers/dma/dw_dmac_regs.h
@@ -98,9 +98,17 @@ struct dw_dma_regs {
        u32     DW_PARAMS;
 };
+#ifdef CONFIG_DW_DMAC_BIG_ENDIAN_IO
+#define dma_readl_native ioread32be
+#define dma_writel_native iowrite32be
+#else
+#define dma_readl_native readl
+#define dma_writel_native writel
+#endif
 /* To access the registers in early stage of probe */
 #define dma_read_byaddr(addr, name) \
-        readl((addr) + offsetof(struct dw_dma_regs, name))
+        dma_readl_native((addr) + offsetof(struct dw_dma_regs, name))
 /* Bitfields in DW_PARAMS */
 #define DW_PARAMS_NR_CHAN       8               /* number of channels */
@@ -216,9 +224,9 @@ __dwc_regs(struct dw_dma_chan *dwc)
 }
 #define channel_readl(dwc, name) \
-        readl(&(__dwc_regs(dwc)->name))
+        dma_readl_native(&(__dwc_regs(dwc)->name))
 #define channel_writel(dwc, name, val) \
-        writel((val), &(__dwc_regs(dwc)->name))
+        dma_writel_native((val), &(__dwc_regs(dwc)->name))
 static inline struct dw_dma_chan *to_dw_dma_chan(struct dma_chan *chan)
 {
@@ -246,9 +254,9 @@ static inline struct dw_dma_regs __iomem *__dw_regs(struct dw_dma *dw)
 }
 #define dma_readl(dw, name) \
-        readl(&(__dw_regs(dw)->name))
+        dma_readl_native(&(__dw_regs(dw)->name))
 #define dma_writel(dw, name, val) \
-        writel((val), &(__dw_regs(dw)->name))
+        dma_writel_native((val), &(__dw_regs(dw)->name))
 #define channel_set_bit(dw, reg, mask) \
        dma_writel(dw, reg, ((mask) << 8) | (mask))
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 5a297a26211d..cc8e7c78a23c 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -170,8 +170,11 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
         * memory controller and apply to register. Search for the first
         * bandwidth entry that is greater or equal than the setting requested
         * and program that. If at last entry, turn off DRAM scrubbing.
+         *
+         * If no suitable bandwidth is found, turn off DRAM scrubbing entirely
+         * by falling back to the last element in scrubrates[].
         */
-        for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
+        for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) {
                /*
                 * skip scrub rates which aren't recommended
                 * (see F10 BKDG, F3x58)
@@ -181,12 +184,6 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
                if (scrubrates[i].bandwidth <= new_bw)
                        break;
-                /*
-                 * if no suitable bandwidth found, turn off DRAM scrubbing
-                 * entirely by falling back to the last element in the
-                 * scrubrates array.
-                 */
        }
        scrubval = scrubrates[i].scrubval;
diff --git a/drivers/gpu/drm/drm_fb_cma_helper.c b/drivers/gpu/drm/drm_fb_cma_helper.c
index 09e11a5d921a..fd9d0af4d536 100644
--- a/drivers/gpu/drm/drm_fb_cma_helper.c
+++ b/drivers/gpu/drm/drm_fb_cma_helper.c
@@ -206,7 +206,7 @@ static int drm_fbdev_cma_create(struct drm_fb_helper *helper,
        size_t size;
        int ret;
-        DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d\n",
+        DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d)\n",
                        sizes->surface_width, sizes->surface_height,
                        sizes->surface_bpp);
@@ -220,7 +220,7 @@ static int drm_fbdev_cma_create(struct drm_fb_helper *helper,
        size = mode_cmd.pitches[0] * mode_cmd.height;
        obj = drm_gem_cma_create(dev, size);
-        if (!obj)
+        if (IS_ERR(obj))
                return -ENOMEM;
        fbi = framebuffer_alloc(0, dev->dev);
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 441ebc1bdbef..d4b20ceda3fb 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -205,8 +205,6 @@ static int drm_gem_one_name_info(int id, void *ptr, void *data)
        struct drm_gem_object *obj = ptr;
        struct seq_file *m = data;
-        seq_printf(m, "name %d size %zd\n", obj->name, obj->size);
        seq_printf(m, "%6d %8zd %7d %8d\n",
                   obj->name, obj->size,
                   atomic_read(&obj->handle_count),
diff --git a/drivers/gpu/drm/drm_platform.c b/drivers/gpu/drm/drm_platform.c
index aaeb6f8d69ce..b8a282ea8751 100644
--- a/drivers/gpu/drm/drm_platform.c
+++ b/drivers/gpu/drm/drm_platform.c
@@ -64,7 +64,6 @@ int drm_get_platform_dev(struct platform_device *platdev,
        }
        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                dev_set_drvdata(&platdev->dev, dev);
                ret = drm_get_minor(dev, &dev->control, DRM_MINOR_CONTROL);
                if (ret)
                        goto err_g1;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index aac4e5e1a5b9..6770ee6084b4 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -118,6 +118,13 @@ module_param_named(i915_enable_ppgtt, i915_enable_ppgtt, int, 0600);
 MODULE_PARM_DESC(i915_enable_ppgtt,
                "Enable PPGTT (default: true)");
+unsigned int i915_preliminary_hw_support __read_mostly = 0;
+module_param_named(preliminary_hw_support, i915_preliminary_hw_support, int, 0600);
+MODULE_PARM_DESC(preliminary_hw_support,
+                "Enable preliminary hardware support. "
+                "Enable Haswell and ValleyView Support. "
+                "(default: false)");
 static struct drm_driver driver;
 extern int intel_agp_enabled;
@@ -826,6 +833,12 @@ i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        struct intel_device_info *intel_info =
                (struct intel_device_info *) ent->driver_data;
+        if (intel_info->is_haswell || intel_info->is_valleyview)
+                if(!i915_preliminary_hw_support) {
+                        DRM_ERROR("Preliminary hardware support disabled\n");
+                        return -ENODEV;
+                }
        /* Only bind to function 0 of the device. Early generations
         * used function 1 as a placeholder for multi-head. This causes
         * us confusion instead, especially on the systems where both
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index b84f7861e438..f511fa2f4168 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1217,6 +1217,7 @@ extern int i915_enable_rc6 __read_mostly;
 extern int i915_enable_fbc __read_mostly;
 extern bool i915_enable_hangcheck __read_mostly;
 extern int i915_enable_ppgtt __read_mostly;
+extern unsigned int i915_preliminary_hw_support __read_mostly;
 extern int i915_suspend(struct drm_device *dev, pm_message_t state);
 extern int i915_resume(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index d33d02d13c96..107f09befe92 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1407,8 +1407,10 @@ out:
                return VM_FAULT_NOPAGE;
        case -ENOMEM:
                return VM_FAULT_OOM;
+        case -ENOSPC:
+                return VM_FAULT_SIGBUS;
        default:
-                WARN_ON_ONCE(ret);
+                WARN_ONCE(ret, "unhandled error in i915_gem_fault: %i\n", ret);
                return VM_FAULT_SIGBUS;
        }
 }
@@ -1822,10 +1824,11 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                sg_set_page(sg, page, PAGE_SIZE, 0);
        }
+        obj->pages = st;
        if (i915_gem_object_needs_bit17_swizzle(obj))
                i915_gem_object_do_bit_17_swizzle(obj);
-        obj->pages = st;
        return 0;
 err_pages:
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 893f30164b7e..f78061af7045 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -219,20 +219,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
                intel_encoder_to_crt(to_intel_encoder(encoder));
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct drm_i915_private *dev_priv = dev->dev_private;
-        int dpll_md_reg;
+        u32 adpa;
-        u32 adpa, dpll_md;
-        dpll_md_reg = DPLL_MD(intel_crtc->pipe);
-        /*
-         * Disable separate mode multiplier used when cloning SDVO to CRT
-         * XXX this needs to be adjusted when we really are cloning
-         */
-        if (INTEL_INFO(dev)->gen >= 4 && !HAS_PCH_SPLIT(dev)) {
-                dpll_md = I915_READ(dpll_md_reg);
-                I915_WRITE(dpll_md_reg,
-                           dpll_md & ~DPLL_MD_UDI_MULTIPLIER_MASK);
-        }
        adpa = ADPA_HOTPLUG_BITS;
        if (adjusted_mode->flags & DRM_MODE_FLAG_PHSYNC)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 682bd3729baf..461a637f1ef7 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7892,6 +7892,34 @@ struct intel_quirk {
        void (*hook)(struct drm_device *dev);
 };
+/* For systems that don't have a meaningful PCI subdevice/subvendor ID */
+struct intel_dmi_quirk {
+        void (*hook)(struct drm_device *dev);
+        const struct dmi_system_id (*dmi_id_list)[];
+};
+static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
+{
+        DRM_INFO("Backlight polarity reversed on %s\n", id->ident);
+        return 1;
+}
+static const struct intel_dmi_quirk intel_dmi_quirks[] = {
+        {
+                .dmi_id_list = &(const struct dmi_system_id[]) {
+                        {
+                                .callback = intel_dmi_reverse_brightness,
+                                .ident = "NCR Corporation",
+                                .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
+                                            DMI_MATCH(DMI_PRODUCT_NAME, ""),
+                                },
+                        },
+                        { }  /* terminating entry */
+                },
+                .hook = quirk_invert_brightness,
+        },
+};
 static struct intel_quirk intel_quirks[] = {
        /* HP Mini needs pipe A force quirk (LP: #322104) */
        { 0x27ae, 0x103c, 0x361a, quirk_pipea_force },
@@ -7931,6 +7959,10 @@ static void intel_init_quirks(struct drm_device *dev)
                     q->subsystem_device == PCI_ANY_ID))
                        q->hook(dev);
        }
+        for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
+                if (dmi_check_system(*intel_dmi_quirks[i].dmi_id_list) != 0)
+                        intel_dmi_quirks[i].hook(dev);
+        }
 }
 /* Disable the VGA plane that we never use */
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1b727a5c9ee5..368ed8ef1600 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1797,7 +1797,8 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                        if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
                                break;
                if (i == intel_dp->lane_count && voltage_tries == 5) {
-                        if (++loop_tries == 5) {
+                        ++loop_tries;
+                        if (loop_tries == 5) {
                                DRM_DEBUG_KMS("too many full retries, give up\n");
                                break;
                        }
@@ -1807,11 +1808,15 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                }
                /* Check to see if we've tried the same voltage 5 times */
-                if ((intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK) != voltage) {
+                if ((intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK) == voltage) {
-                        voltage = intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
-                        voltage_tries = 0;
-                } else
                        ++voltage_tries;
+                        if (voltage_tries == 5) {
+                                DRM_DEBUG_KMS("too many voltage retries, give up\n");
+                                break;
+                        }
+                } else
+                        voltage_tries = 0;
+                voltage = intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
                /* Compute new intel_dp->train_set as requested by target */
                intel_get_adjust_train(intel_dp, link_status);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index e3166df55daa..edba93b3474b 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -777,6 +777,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
                        DMI_MATCH(DMI_BOARD_NAME, "D525TUD"),
                },
        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Supermicro X7SPA-H",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Supermicro"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X7SPA-H"),
+                },
+        },
        { }     /* terminating entry */
 };
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 0007a4d9bf6e..c01d97db0061 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -139,6 +139,11 @@ struct intel_sdvo {
        /* DDC bus used by this SDVO encoder */
        uint8_t ddc_bus;
+        /*
+         * the sdvo flag gets lost in round trip: dtd->adjusted_mode->dtd
+         */
+        uint8_t dtd_sdvo_flags;
 };
 struct intel_sdvo_connector {
@@ -984,6 +989,7 @@ intel_sdvo_get_preferred_input_mode(struct intel_sdvo *intel_sdvo,
                return false;
        intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
+        intel_sdvo->dtd_sdvo_flags = input_dtd.part2.sdvo_flags;
        return true;
 }
@@ -1092,6 +1098,8 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
         * adjusted_mode.
         */
        intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
+        if (intel_sdvo->is_tv || intel_sdvo->is_lvds)
+                input_dtd.part2.sdvo_flags = intel_sdvo->dtd_sdvo_flags;
        if (!intel_sdvo_set_input_timing(intel_sdvo, &input_dtd))
                DRM_INFO("Setting input timings on %s failed\n",
                         SDVO_NAME(intel_sdvo));
@@ -2277,10 +2285,8 @@ intel_sdvo_lvds_init(struct intel_sdvo *intel_sdvo, int device)
                intel_sdvo_connector->output_flag = SDVO_OUTPUT_LVDS1;
        }
-        /* SDVO LVDS is cloneable because the SDVO encoder does the upscaling,
+        /* SDVO LVDS is not cloneable because the input mode gets adjusted by the encoder */
-         * as opposed to native LVDS, where we upscale with the panel-fitter
+        intel_sdvo->base.cloneable = false;
-         * (and hence only the native LVDS resolution could be cloned). */
-        intel_sdvo->base.cloneable = true;
        intel_sdvo_connector_init(intel_sdvo_connector, intel_sdvo);
        if (!intel_sdvo_create_enhance_property(intel_sdvo, intel_sdvo_connector))
diff --git a/drivers/gpu/drm/nouveau/core/core/gpuobj.c b/drivers/gpu/drm/nouveau/core/core/gpuobj.c
index 1f34549aff18..70586fde69cf 100644
--- a/drivers/gpu/drm/nouveau/core/core/gpuobj.c
+++ b/drivers/gpu/drm/nouveau/core/core/gpuobj.c
@@ -39,6 +39,11 @@ nouveau_gpuobj_destroy(struct nouveau_gpuobj *gpuobj)
                        nv_wo32(gpuobj, i, 0x00000000);
        }
+        if (gpuobj->node) {
+                nouveau_mm_free(&nv_gpuobj(gpuobj->parent)->heap,
+                                &gpuobj->node);
+        }
        if (gpuobj->heap.block_size)
                nouveau_mm_fini(&gpuobj->heap);
diff --git a/drivers/gpu/drm/nouveau/core/core/mm.c b/drivers/gpu/drm/nouveau/core/core/mm.c
index bfddf87926dd..4d6206448670 100644
--- a/drivers/gpu/drm/nouveau/core/core/mm.c
+++ b/drivers/gpu/drm/nouveau/core/core/mm.c
@@ -236,7 +236,7 @@ nouveau_mm_fini(struct nouveau_mm *mm)
        int nodes = 0;
        list_for_each_entry(node, &mm->nodes, nl_entry) {
-                if (nodes++ == mm->heap_nodes)
+                if (WARN_ON(nodes++ == mm->heap_nodes))
                        return -EBUSY;
        }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
index dcb5c2befc92..70ca7d5a1aa1 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
@@ -72,7 +72,7 @@ nouveau_bios_shadow_of(struct nouveau_bios *bios)
        }
        data = of_get_property(dn, "NVDA,BMP", &size);
-        if (data) {
+        if (data && size) {
                bios->size = size;
                bios->data = kmalloc(bios->size, GFP_KERNEL);
                if (bios->data)
@@ -104,6 +104,9 @@ nouveau_bios_shadow_pramin(struct nouveau_bios *bios)
                goto out;
        bios->size = nv_rd08(bios, 0x700002) * 512;
+        if (!bios->size)
+                goto out;
        bios->data = kmalloc(bios->size, GFP_KERNEL);
        if (bios->data) {
                for (i = 0; i < bios->size; i++)
@@ -155,6 +158,9 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
        /* read entire bios image to system memory */
        bios->size = nv_rd08(bios, 0x300002) * 512;
+        if (!bios->size)
+                goto out;
        bios->data = kmalloc(bios->size, GFP_KERNEL);
        if (bios->data) {
                for (i = 0; i < bios->size; i++)
@@ -186,14 +192,22 @@ nouveau_bios_shadow_acpi(struct nouveau_bios *bios)
 {
        struct pci_dev *pdev = nv_device(bios)->pdev;
        int ret, cnt, i;
-        u8  data[3];
-        if (!nouveau_acpi_rom_supported(pdev))
+        if (!nouveau_acpi_rom_supported(pdev)) {
+                bios->data = NULL;
                return;
+        }
        bios->size = 0;
-        if (nouveau_acpi_get_bios_chunk(data, 0, 3) == 3)
+        bios->data = kmalloc(4096, GFP_KERNEL);
-                bios->size = data[2] * 512;
+        if (bios->data) {
+                if (nouveau_acpi_get_bios_chunk(bios->data, 0, 4096) == 4096)
+                        bios->size = bios->data[2] * 512;
+                kfree(bios->data);
+        }
+        if (!bios->size)
+                return;
        bios->data = kmalloc(bios->size, GFP_KERNEL);
        for (i = 0; bios->data && i < bios->size; i += cnt) {
@@ -229,12 +243,14 @@ nouveau_bios_shadow_pci(struct nouveau_bios *bios)
 static int
 nouveau_bios_score(struct nouveau_bios *bios, const bool writeable)
 {
-        if (!bios->data || bios->data[0] != 0x55 || bios->data[1] != 0xAA) {
+        if (bios->size < 3 || !bios->data || bios->data[0] != 0x55 ||
+                        bios->data[1] != 0xAA) {
                nv_info(bios, "... signature not found\n");
                return 0;
        }
-        if (nvbios_checksum(bios->data, bios->data[2] * 512)) {
+        if (nvbios_checksum(bios->data,
+                        min_t(u32, bios->data[2] * 512, bios->size))) {
                nv_info(bios, "... checksum invalid\n");
                /* if a ro image is somewhat bad, it's probably all rubbish */
                return writeable ? 2 : 1;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c b/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c
index 5e5f4cddae3c..f835501203e5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c
@@ -157,11 +157,10 @@ pll_map_reg(struct nouveau_bios *bios, u32 reg, u32 *type, u8 *ver, u8 *len)
        while (map->reg) {
                if (map->reg == reg && *ver >= 0x20) {
                        u16 addr = (data += hdr);
+                        *type = map->type;
                        while (cnt--) {
-                                if (nv_ro32(bios, data) == map->reg) {
+                                if (nv_ro32(bios, data) == map->reg)
-                                        *type = map->type;
                                        return data;
-                                }
                                data += *len;
                        }
                        return addr;
@@ -200,11 +199,10 @@ pll_map_type(struct nouveau_bios *bios, u8 type, u32 *reg, u8 *ver, u8 *len)
        while (map->reg) {
                if (map->type == type && *ver >= 0x20) {
                        u16 addr = (data += hdr);
+                        *reg = map->reg;
                        while (cnt--) {
-                                if (nv_ro32(bios, data) == map->reg) {
+                                if (nv_ro32(bios, data) == map->reg)
-                                        *reg = map->reg;
                                        return data;
-                                }
                                data += *len;
                        }
                        return addr;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index 42d7539e6525..27fb1af7a779 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -237,6 +237,7 @@ nv50_fb_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                        return ret;
                priv->base.ram.stolen = (u64)nv_rd32(priv, 0x100e10) << 12;
+                priv->base.ram.type = NV_MEM_TYPE_STOLEN;
                break;
        default:
                ret = nouveau_mm_init(&priv->base.vram, rsvd_head, size,
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
index 0203e1e12caa..49050d991e75 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
@@ -92,7 +92,8 @@ nv41_vmmgr_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv04_vmmgr_priv *priv;
        int ret;
-        if (!nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
+        if (pci_find_capability(device->pdev, PCI_CAP_ID_AGP) ||
+            !nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
                return nouveau_object_ctor(parent, engine, &nv04_vmmgr_oclass,
                                           data, size, pobject);
        }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c
index 0ac18d05a146..aa8131436e3d 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c
@@ -163,7 +163,8 @@ nv44_vmmgr_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv04_vmmgr_priv *priv;
        int ret;
-        if (!nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
+        if (pci_find_capability(device->pdev, PCI_CAP_ID_AGP) ||
+            !nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
                return nouveau_object_ctor(parent, engine, &nv04_vmmgr_oclass,
                                           data, size, pobject);
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 8f98e5a8c488..d2f8ffeed742 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -530,9 +530,11 @@ nouveau_page_flip_reserve(struct nouveau_bo *old_bo,
        if (ret)
                goto fail;
-        ret = ttm_bo_reserve(&old_bo->bo, false, false, false, 0);
+        if (likely(old_bo != new_bo)) {
-        if (ret)
+                ret = ttm_bo_reserve(&old_bo->bo, false, false, false, 0);
-                goto fail_unreserve;
+                if (ret)
+                        goto fail_unreserve;
+        }
        return 0;
@@ -551,8 +553,10 @@ nouveau_page_flip_unreserve(struct nouveau_bo *old_bo,
        nouveau_bo_fence(new_bo, fence);
        ttm_bo_unreserve(&new_bo->bo);
-        nouveau_bo_fence(old_bo, fence);
+        if (likely(old_bo != new_bo)) {
-        ttm_bo_unreserve(&old_bo->bo);
+                nouveau_bo_fence(old_bo, fence);
+                ttm_bo_unreserve(&old_bo->bo);
+        }
        nouveau_bo_unpin(old_bo);
 }
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 49cbb3795a10..ba498f8e47a2 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -184,6 +184,7 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
        struct radeon_backlight_privdata *pdata;
        struct radeon_encoder_atom_dig *dig;
        u8 backlight_level;
+        char bl_name[16];
        if (!radeon_encoder->enc_priv)
                return;
@@ -203,7 +204,9 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
        memset(&props, 0, sizeof(props));
        props.max_brightness = RADEON_MAX_BL_LEVEL;
        props.type = BACKLIGHT_RAW;
-        bd = backlight_device_register("radeon_bl", &drm_connector->kdev,
+        snprintf(bl_name, sizeof(bl_name),
+                 "radeon_bl%d", dev->primary->index);
+        bd = backlight_device_register(bl_name, &drm_connector->kdev,
                                       pdata, &radeon_atom_backlight_ops, &props);
        if (IS_ERR(bd)) {
                DRM_ERROR("Backlight registration failed\n");
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 573ed1bc6cf7..30271b641913 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -2829,6 +2829,7 @@ static bool evergreen_vm_reg_valid(u32 reg)
        case CAYMAN_SQ_EX_ALLOC_TABLE_SLOTS:
                return true;
        default:
+                DRM_ERROR("Invalid register 0x%x in CS\n", reg);
                return false;
        }
 }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 8c74c729586d..81e6a568c29d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1538,26 +1538,31 @@ void cayman_vm_set_page(struct radeon_device *rdev, uint64_t pe,
 {
        struct radeon_ring *ring = &rdev->ring[rdev->asic->vm.pt_ring_index];
        uint32_t r600_flags = cayman_vm_page_flags(rdev, flags);
-        int i;
-        radeon_ring_write(ring, PACKET3(PACKET3_ME_WRITE, 1 + count * 2));
+        while (count) {
-        radeon_ring_write(ring, pe);
+                unsigned ndw = 1 + count * 2;
-        radeon_ring_write(ring, upper_32_bits(pe) & 0xff);
+                if (ndw > 0x3FFF)
-        for (i = 0; i < count; ++i) {
+                        ndw = 0x3FFF;
-                uint64_t value = 0;
-                if (flags & RADEON_VM_PAGE_SYSTEM) {
+                radeon_ring_write(ring, PACKET3(PACKET3_ME_WRITE, ndw));
-                        value = radeon_vm_map_gart(rdev, addr);
+                radeon_ring_write(ring, pe);
-                        value &= 0xFFFFFFFFFFFFF000ULL;
+                radeon_ring_write(ring, upper_32_bits(pe) & 0xff);
-                        addr += incr;
+                for (; ndw > 1; ndw -= 2, --count, pe += 8) {
+                        uint64_t value = 0;
-                } else if (flags & RADEON_VM_PAGE_VALID) {
+                        if (flags & RADEON_VM_PAGE_SYSTEM) {
-                        value = addr;
+                                value = radeon_vm_map_gart(rdev, addr);
-                        addr += incr;
+                                value &= 0xFFFFFFFFFFFFF000ULL;
-                }
+                                addr += incr;
+                        } else if (flags & RADEON_VM_PAGE_VALID) {
+                                value = addr;
+                                addr += incr;
+                        }
-                value |= r600_flags;
+                        value |= r600_flags;
-                radeon_ring_write(ring, value);
+                        radeon_ring_write(ring, value);
-                radeon_ring_write(ring, upper_32_bits(value));
+                        radeon_ring_write(ring, upper_32_bits(value));
+                }
        }
 }
@@ -1586,4 +1591,8 @@ void cayman_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
        /* bits 0-7 are the VM contexts0-7 */
        radeon_ring_write(ring, PACKET0(VM_INVALIDATE_REQUEST, 0));
        radeon_ring_write(ring, 1 << vm->id);
+        /* sync PFP to ME, otherwise we might get invalid PFP reads */
+        radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
+        radeon_ring_write(ring, 0x0);
 }
diff --git a/drivers/gpu/drm/radeon/nid.h b/drivers/gpu/drm/radeon/nid.h
index 2423d1b5d385..cbef6815907a 100644
--- a/drivers/gpu/drm/radeon/nid.h
+++ b/drivers/gpu/drm/radeon/nid.h
@@ -502,6 +502,7 @@
 #define PACKET3_MPEG_INDEX                              0x3A
 #define PACKET3_WAIT_REG_MEM                            0x3C
 #define PACKET3_MEM_WRITE                               0x3D
+#define PACKET3_PFP_SYNC_ME                             0x42
 #define PACKET3_SURFACE_SYNC                            0x43
 #              define PACKET3_CB0_DEST_BASE_ENA    (1 << 6)
 #              define PACKET3_CB1_DEST_BASE_ENA    (1 << 7)
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 1aa3f910b993..37f6a907aea4 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -87,7 +87,7 @@ static union acpi_object *radeon_atpx_call(acpi_handle handle, int function,
                atpx_arg_elements[1].integer.value = 0;
        }
-        status = acpi_evaluate_object(handle, "ATPX", &atpx_arg, &buffer);
+        status = acpi_evaluate_object(handle, NULL, &atpx_arg, &buffer);
        /* Fail only if calling the method fails and ATPX is supported */
        if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
@@ -373,11 +373,11 @@ static int radeon_atpx_power_state(enum vga_switcheroo_client_id id,
 }
 /**
- * radeon_atpx_pci_probe_handle - look up the ATRM and ATPX handles
+ * radeon_atpx_pci_probe_handle - look up the ATPX handle
 *
 * @pdev: pci device
 *
- * Look up the ATPX and ATRM handles (all asics).
+ * Look up the ATPX handles (all asics).
 * Returns true if the handles are found, false if not.
 */
 static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index bd13ca09eb62..e2f5f888c374 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -355,6 +355,8 @@ int radeon_wb_init(struct radeon_device *rdev)
 */
 void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *mc, u64 base)
 {
+        uint64_t limit = (uint64_t)radeon_vram_limit << 20;
        mc->vram_start = base;
        if (mc->mc_vram_size > (0xFFFFFFFF - base + 1)) {
                dev_warn(rdev->dev, "limiting VRAM to PCI aperture size\n");
@@ -368,8 +370,8 @@ void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *mc, u64
                mc->mc_vram_size = mc->aper_size;
        }
        mc->vram_end = mc->vram_start + mc->mc_vram_size - 1;
-        if (radeon_vram_limit && radeon_vram_limit < mc->real_vram_size)
+        if (limit && limit < mc->real_vram_size)
-                mc->real_vram_size = radeon_vram_limit;
+                mc->real_vram_size = limit;
        dev_info(rdev->dev, "VRAM: %lluM 0x%016llX - 0x%016llX (%lluM used)\n",
                        mc->mc_vram_size >> 20, mc->vram_start,
                        mc->vram_end, mc->real_vram_size >> 20);
@@ -835,6 +837,19 @@ static unsigned int radeon_vga_set_decode(void *cookie, bool state)
 }
 /**
+ * radeon_check_pot_argument - check that argument is a power of two
+ *
+ * @arg: value to check
+ *
+ * Validates that a certain argument is a power of two (all asics).
+ * Returns true if argument is valid.
+ */
+static bool radeon_check_pot_argument(int arg)
+{
+        return (arg & (arg - 1)) == 0;
+}
+/**
 * radeon_check_arguments - validate module params
 *
 * @rdev: radeon_device pointer
@@ -845,52 +860,25 @@ static unsigned int radeon_vga_set_decode(void *cookie, bool state)
 static void radeon_check_arguments(struct radeon_device *rdev)
 {
        /* vramlimit must be a power of two */
-        switch (radeon_vram_limit) {
+        if (!radeon_check_pot_argument(radeon_vram_limit)) {
-        case 0:
-        case 4:
-        case 8:
-        case 16:
-        case 32:
-        case 64:
-        case 128:
-        case 256:
-        case 512:
-        case 1024:
-        case 2048:
-        case 4096:
-                break;
-        default:
                dev_warn(rdev->dev, "vram limit (%d) must be a power of 2\n",
                                radeon_vram_limit);
                radeon_vram_limit = 0;
-                break;
        }
-        radeon_vram_limit = radeon_vram_limit << 20;
        /* gtt size must be power of two and greater or equal to 32M */
-        switch (radeon_gart_size) {
+        if (radeon_gart_size < 32) {
-        case 4:
-        case 8:
-        case 16:
                dev_warn(rdev->dev, "gart size (%d) too small forcing to 512M\n",
                                radeon_gart_size);
                radeon_gart_size = 512;
-                break;
-        case 32:
+        } else if (!radeon_check_pot_argument(radeon_gart_size)) {
-        case 64:
-        case 128:
-        case 256:
-        case 512:
-        case 1024:
-        case 2048:
-        case 4096:
-                break;
-        default:
                dev_warn(rdev->dev, "gart size (%d) must be a power of 2\n",
                                radeon_gart_size);
                radeon_gart_size = 512;
-                break;
        }
-        rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
+        rdev->mc.gtt_size = (uint64_t)radeon_gart_size << 20;
        /* AGP mode can only be -1, 1, 2, 4, 8 */
        switch (radeon_agpmode) {
        case -1:
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index a7677dd1ce98..4debd60e5aa6 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -355,14 +355,13 @@ int radeon_gart_init(struct radeon_device *rdev)
        DRM_INFO("GART: num cpu pages %u, num gpu pages %u\n",
                 rdev->gart.num_cpu_pages, rdev->gart.num_gpu_pages);
        /* Allocate pages table */
-        rdev->gart.pages = kzalloc(sizeof(void *) * rdev->gart.num_cpu_pages,
+        rdev->gart.pages = vzalloc(sizeof(void *) * rdev->gart.num_cpu_pages);
-                                   GFP_KERNEL);
        if (rdev->gart.pages == NULL) {
                radeon_gart_fini(rdev);
                return -ENOMEM;
        }
-        rdev->gart.pages_addr = kzalloc(sizeof(dma_addr_t) *
+        rdev->gart.pages_addr = vzalloc(sizeof(dma_addr_t) *
-                                        rdev->gart.num_cpu_pages, GFP_KERNEL);
+                                        rdev->gart.num_cpu_pages);
        if (rdev->gart.pages_addr == NULL) {
                radeon_gart_fini(rdev);
                return -ENOMEM;
@@ -388,8 +387,8 @@ void radeon_gart_fini(struct radeon_device *rdev)
                radeon_gart_unbind(rdev, 0, rdev->gart.num_cpu_pages);
        }
        rdev->gart.ready = false;
-        kfree(rdev->gart.pages);
+        vfree(rdev->gart.pages);
-        kfree(rdev->gart.pages_addr);
+        vfree(rdev->gart.pages_addr);
        rdev->gart.pages = NULL;
        rdev->gart.pages_addr = NULL;
@@ -577,7 +576,7 @@ void radeon_vm_manager_fini(struct radeon_device *rdev)
 *
 * Global and local mutex must be locked!
 */
-int radeon_vm_evict(struct radeon_device *rdev, struct radeon_vm *vm)
+static int radeon_vm_evict(struct radeon_device *rdev, struct radeon_vm *vm)
 {
        struct radeon_vm *vm_evict;
@@ -1036,8 +1035,7 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
                pte = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
                pte += (addr & mask) * 8;
-                if (((last_pte + 8 * count) != pte) ||
+                if ((last_pte + 8 * count) != pte) {
-                    ((count + nptes) > 1 << 11)) {
                        if (count) {
                                radeon_asic_vm_set_page(rdev, last_pte,
@@ -1148,17 +1146,17 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
        if (RADEON_VM_BLOCK_SIZE > 11)
                /* reserve space for one header for every 2k dwords */
-                ndw += (nptes >> 11) * 3;
+                ndw += (nptes >> 11) * 4;
        else
                /* reserve space for one header for
                    every (1 << BLOCK_SIZE) entries */
-                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 3;
+                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 4;
        /* reserve space for pte addresses */
        ndw += nptes * 2;
        /* reserve space for one header for every 2k dwords */
-        ndw += (npdes >> 11) * 3;
+        ndw += (npdes >> 11) * 4;
        /* reserve space for pde addresses */
        ndw += npdes * 2;
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index f38fbcc46935..fe5c1f6b7957 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -53,6 +53,7 @@ int radeon_gem_object_create(struct radeon_device *rdev, int size,
                                struct drm_gem_object **obj)
 {
        struct radeon_bo *robj;
+        unsigned long max_size;
        int r;
        *obj = NULL;
@@ -60,11 +61,26 @@ int radeon_gem_object_create(struct radeon_device *rdev, int size,
        if (alignment < PAGE_SIZE) {
                alignment = PAGE_SIZE;
        }
+        /* maximun bo size is the minimun btw visible vram and gtt size */
+        max_size = min(rdev->mc.visible_vram_size, rdev->mc.gtt_size);
+        if (size > max_size) {
+                printk(KERN_WARNING "%s:%d alloc size %dMb bigger than %ldMb limit\n",
+                       __func__, __LINE__, size >> 20, max_size >> 20);
+                return -ENOMEM;
+        }
+retry:
        r = radeon_bo_create(rdev, size, alignment, kernel, initial_domain, NULL, &robj);
        if (r) {
-                if (r != -ERESTARTSYS)
+                if (r != -ERESTARTSYS) {
+                        if (initial_domain == RADEON_GEM_DOMAIN_VRAM) {
+                                initial_domain |= RADEON_GEM_DOMAIN_GTT;
+                                goto retry;
+                        }
                        DRM_ERROR("Failed to allocate GEM object (%d, %d, %u, %d)\n",
                                  size, initial_domain, alignment, r);
+                }
                return r;
        }
        *obj = &robj->gem_base;
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index a13ad9d707cf..0063df9d166d 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -370,6 +370,7 @@ void radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder,
        struct backlight_properties props;
        struct radeon_backlight_privdata *pdata;
        uint8_t backlight_level;
+        char bl_name[16];
        if (!radeon_encoder->enc_priv)
                return;
@@ -389,7 +390,9 @@ void radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder,
        memset(&props, 0, sizeof(props));
        props.max_brightness = RADEON_MAX_BL_LEVEL;
        props.type = BACKLIGHT_RAW;
-        bd = backlight_device_register("radeon_bl", &drm_connector->kdev,
+        snprintf(bl_name, sizeof(bl_name),
+                 "radeon_bl%d", dev->primary->index);
+        bd = backlight_device_register(bl_name, &drm_connector->kdev,
                                       pdata, &radeon_backlight_ops, &props);
        if (IS_ERR(bd)) {
                DRM_ERROR("Backlight registration failed\n");
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 8b27dd6e3144..b91118ccef86 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -105,7 +105,6 @@ int radeon_bo_create(struct radeon_device *rdev,
        struct radeon_bo *bo;
        enum ttm_bo_type type;
        unsigned long page_align = roundup(byte_align, PAGE_SIZE) >> PAGE_SHIFT;
-        unsigned long max_size = 0;
        size_t acc_size;
        int r;
@@ -121,18 +120,9 @@ int radeon_bo_create(struct radeon_device *rdev,
        }
        *bo_ptr = NULL;
-        /* maximun bo size is the minimun btw visible vram and gtt size */
-        max_size = min(rdev->mc.visible_vram_size, rdev->mc.gtt_size);
-        if ((page_align << PAGE_SHIFT) >= max_size) {
-                printk(KERN_WARNING "%s:%d alloc size %ldM bigger than %ldMb limit\n",
-                        __func__, __LINE__, page_align  >> (20 - PAGE_SHIFT), max_size >> 20);
-                return -ENOMEM;
-        }
        acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
                                       sizeof(struct radeon_bo));
-retry:
        bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
        if (bo == NULL)
                return -ENOMEM;
@@ -154,15 +144,6 @@ retry:
                        acc_size, sg, &radeon_ttm_bo_destroy);
        up_read(&rdev->pm.mclk_lock);
        if (unlikely(r != 0)) {
-                if (r != -ERESTARTSYS) {
-                        if (domain == RADEON_GEM_DOMAIN_VRAM) {
-                                domain |= RADEON_GEM_DOMAIN_GTT;
-                                goto retry;
-                        }
-                        dev_err(rdev->dev,
-                                "object_init failed for (%lu, 0x%08X)\n",
-                                size, domain);
-                }
                return r;
        }
        *bo_ptr = bo;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index df8dd7701643..b0db712060fb 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2808,26 +2808,31 @@ void si_vm_set_page(struct radeon_device *rdev, uint64_t pe,
 {
        struct radeon_ring *ring = &rdev->ring[rdev->asic->vm.pt_ring_index];
        uint32_t r600_flags = cayman_vm_page_flags(rdev, flags);
-        int i;
-        uint64_t value;
-        radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 2 + count * 2));
+        while (count) {
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+                unsigned ndw = 2 + count * 2;
-                                 WRITE_DATA_DST_SEL(1)));
+                if (ndw > 0x3FFE)
-        radeon_ring_write(ring, pe);
+                        ndw = 0x3FFE;
-        radeon_ring_write(ring, upper_32_bits(pe));
-        for (i = 0; i < count; ++i) {
+                radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, ndw));
-                if (flags & RADEON_VM_PAGE_SYSTEM) {
+                radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
-                        value = radeon_vm_map_gart(rdev, addr);
+                                         WRITE_DATA_DST_SEL(1)));
-                        value &= 0xFFFFFFFFFFFFF000ULL;
+                radeon_ring_write(ring, pe);
-                } else if (flags & RADEON_VM_PAGE_VALID)
+                radeon_ring_write(ring, upper_32_bits(pe));
-                        value = addr;
+                for (; ndw > 2; ndw -= 2, --count, pe += 8) {
-                else
+                        uint64_t value;
-                        value = 0;
+                        if (flags & RADEON_VM_PAGE_SYSTEM) {
-                addr += incr;
+                                value = radeon_vm_map_gart(rdev, addr);
-                value |= r600_flags;
+                                value &= 0xFFFFFFFFFFFFF000ULL;
-                radeon_ring_write(ring, value);
+                        } else if (flags & RADEON_VM_PAGE_VALID)
-                radeon_ring_write(ring, upper_32_bits(value));
+                                value = addr;
+                        else
+                                value = 0;
+                        addr += incr;
+                        value |= r600_flags;
+                        radeon_ring_write(ring, value);
+                        radeon_ring_write(ring, upper_32_bits(value));
+                }
        }
 }
@@ -2868,6 +2873,10 @@ void si_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
        radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
        radeon_ring_write(ring, 0);
        radeon_ring_write(ring, 1 << vm->id);
+        /* sync PFP to ME, otherwise we might get invalid PFP reads */
+        radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
+        radeon_ring_write(ring, 0x0);
 }
 /*
diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
index c71d493fd0c5..1c350fc4e449 100644
--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
@@ -201,6 +201,8 @@ static int shmob_drm_load(struct drm_device *dev, unsigned long flags)
                goto done;
        }
+        platform_set_drvdata(pdev, sdev);
 done:
        if (ret)
                shmob_drm_unload(dev);
@@ -299,11 +301,9 @@ static struct drm_driver shmob_drm_driver = {
 #if CONFIG_PM_SLEEP
 static int shmob_drm_pm_suspend(struct device *dev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
+        struct shmob_drm_device *sdev = dev_get_drvdata(dev);
-        struct drm_device *ddev = platform_get_drvdata(pdev);
-        struct shmob_drm_device *sdev = ddev->dev_private;
-        drm_kms_helper_poll_disable(ddev);
+        drm_kms_helper_poll_disable(sdev->ddev);
        shmob_drm_crtc_suspend(&sdev->crtc);
        return 0;
@@ -311,9 +311,7 @@ static int shmob_drm_pm_suspend(struct device *dev)
 static int shmob_drm_pm_resume(struct device *dev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
+        struct shmob_drm_device *sdev = dev_get_drvdata(dev);
-        struct drm_device *ddev = platform_get_drvdata(pdev);
-        struct shmob_drm_device *sdev = ddev->dev_private;
        mutex_lock(&sdev->ddev->mode_config.mutex);
        shmob_drm_crtc_resume(&sdev->crtc);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 402ab69f9f99..bf6e4b5a73b5 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -580,6 +580,7 @@ retry:
        if (unlikely(ret != 0))
                return ret;
+retry_reserve:
        spin_lock(&glob->lru_lock);
        if (unlikely(list_empty(&bo->ddestroy))) {
@@ -587,14 +588,20 @@ retry:
                return 0;
        }
-        ret = ttm_bo_reserve_locked(bo, interruptible,
+        ret = ttm_bo_reserve_locked(bo, false, true, false, 0);
-                                    no_wait_reserve, false, 0);
-        if (unlikely(ret != 0)) {
+        if (unlikely(ret == -EBUSY)) {
                spin_unlock(&glob->lru_lock);
-                return ret;
+                if (likely(!no_wait_reserve))
+                        ret = ttm_bo_wait_unreserved(bo, interruptible);
+                if (unlikely(ret != 0))
+                        return ret;
+                goto retry_reserve;
        }
+        BUG_ON(ret != 0);
        /**
         * We can re-check for sync object without taking
         * the bo::lock since setting the sync object requires
@@ -811,17 +818,14 @@ retry:
                                          no_wait_reserve, no_wait_gpu);
                kref_put(&bo->list_kref, ttm_bo_release_list);
-                if (likely(ret == 0 || ret == -ERESTARTSYS))
+                return ret;
-                        return ret;
-                goto retry;
        }
-        ret = ttm_bo_reserve_locked(bo, false, no_wait_reserve, false, 0);
+        ret = ttm_bo_reserve_locked(bo, false, true, false, 0);
        if (unlikely(ret == -EBUSY)) {
                spin_unlock(&glob->lru_lock);
-                if (likely(!no_wait_gpu))
+                if (likely(!no_wait_reserve))
                        ret = ttm_bo_wait_unreserved(bo, interruptible);
                kref_put(&bo->list_kref, ttm_bo_release_list);
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 6ae2ac47c9c8..f0f8928b3c8a 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -292,7 +292,6 @@ static int evdev_release(struct inode *inode, struct file *file)
        kfree(client);
        evdev_close_device(evdev);
-        put_device(&evdev->dev);
        return 0;
 }
@@ -331,7 +330,6 @@ static int evdev_open(struct inode *inode, struct file *file)
        file->private_data = client;
        nonseekable_open(inode, file);
-        get_device(&evdev->dev);
        return 0;
 err_free_client:
@@ -1001,6 +999,7 @@ static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
                goto err_free_evdev;
        cdev_init(&evdev->cdev, &evdev_fops);
+        evdev->cdev.kobj.parent = &evdev->dev.kobj;
        error = cdev_add(&evdev->cdev, evdev->dev.devt, 1);
        if (error)
                goto err_unregister_handle;
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index b62b5891f399..f362883c94e3 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -243,7 +243,6 @@ static int joydev_release(struct inode *inode, struct file *file)
        kfree(client);
        joydev_close_device(joydev);
-        put_device(&joydev->dev);
        return 0;
 }
@@ -270,7 +269,6 @@ static int joydev_open(struct inode *inode, struct file *file)
        file->private_data = client;
        nonseekable_open(inode, file);
-        get_device(&joydev->dev);
        return 0;
 err_free_client:
@@ -858,6 +856,7 @@ static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
                goto err_free_joydev;
        cdev_init(&joydev->cdev, &joydev_fops);
+        joydev->cdev.kobj.parent = &joydev->dev.kobj;
        error = cdev_add(&joydev->cdev, joydev->dev.devt, 1);
        if (error)
                goto err_unregister_handle;
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index a1b4c37956b2..8f02e3d0e712 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -523,7 +523,6 @@ static int mousedev_release(struct inode *inode, struct file *file)
        kfree(client);
        mousedev_close_device(mousedev);
-        put_device(&mousedev->dev);
        return 0;
 }
@@ -558,7 +557,6 @@ static int mousedev_open(struct inode *inode, struct file *file)
        file->private_data = client;
        nonseekable_open(inode, file);
-        get_device(&mousedev->dev);
        return 0;
 err_free_client:
@@ -892,6 +890,7 @@ static struct mousedev *mousedev_create(struct input_dev *dev,
        }
        cdev_init(&mousedev->cdev, &mousedev_fops);
+        mousedev->cdev.kobj.parent = &mousedev->dev.kobj;
        error = cdev_add(&mousedev->cdev, mousedev->dev.devt, 1);
        if (error)
                goto err_unregister_handle;
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 9edf9806cff9..2c1e12bf2ab4 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -391,7 +391,7 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                                        features->pktlen = WACOM_PKGLEN_TPC2FG;
                                                }
-                                                if (features->type == MTSCREEN)
+                                                if (features->type == MTSCREEN || WACOM_24HDT)
                                                        features->pktlen = WACOM_PKGLEN_MTOUCH;
                                                if (features->type == BAMBOO_PT) {
@@ -402,6 +402,14 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                                        features->x_max =
                                                                get_unaligned_le16(&report[i + 8]);
                                                        i += 15;
+                                                } else if (features->type == WACOM_24HDT) {
+                                                        features->x_max =
+                                                                get_unaligned_le16(&report[i + 3]);
+                                                        features->x_phy =
+                                                                get_unaligned_le16(&report[i + 8]);
+                                                        features->unit = report[i - 1];
+                                                        features->unitExpo = report[i - 3];
+                                                        i += 12;
                                                } else {
                                                        features->x_max =
                                                                get_unaligned_le16(&report[i + 3]);
@@ -434,6 +442,12 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                                        features->y_phy =
                                                                get_unaligned_le16(&report[i + 6]);
                                                        i += 7;
+                                                } else if (type == WACOM_24HDT) {
+                                                        features->y_max =
+                                                                get_unaligned_le16(&report[i + 3]);
+                                                        features->y_phy =
+                                                                get_unaligned_le16(&report[i - 2]);
+                                                        i += 7;
                                                } else if (type == BAMBOO_PT) {
                                                        features->y_phy =
                                                                get_unaligned_le16(&report[i + 3]);
@@ -541,6 +555,9 @@ static int wacom_query_tablet_data(struct usb_interface *intf, struct wacom_feat
                        /* MT Tablet PC touch */
                        return wacom_set_device_mode(intf, 3, 4, 4);
                }
+                else if (features->type == WACOM_24HDT) {
+                        return wacom_set_device_mode(intf, 18, 3, 2);
+                }
        } else if (features->device_type == BTN_TOOL_PEN) {
                if (features->type <= BAMBOO_PT && features->type != WIRELESS) {
                        return wacom_set_device_mode(intf, 2, 2, 2);
@@ -613,6 +630,30 @@ struct wacom_usbdev_data {
 static LIST_HEAD(wacom_udev_list);
 static DEFINE_MUTEX(wacom_udev_list_lock);
+static struct usb_device *wacom_get_sibling(struct usb_device *dev, int vendor, int product)
+{
+        int port1;
+        struct usb_device *sibling;
+        if (vendor == 0 && product == 0)
+                return dev;
+        if (dev->parent == NULL)
+                return NULL;
+        usb_hub_for_each_child(dev->parent, port1, sibling) {
+                struct usb_device_descriptor *d;
+                if (sibling == NULL)
+                        continue;
+                d = &sibling->descriptor;
+                if (d->idVendor == vendor && d->idProduct == product)
+                        return sibling;
+        }
+        return NULL;
+}
 static struct wacom_usbdev_data *wacom_get_usbdev_data(struct usb_device *dev)
 {
        struct wacom_usbdev_data *data;
@@ -1257,13 +1298,19 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
        strlcpy(wacom_wac->name, features->name, sizeof(wacom_wac->name));
        if (features->quirks & WACOM_QUIRK_MULTI_INPUT) {
+                struct usb_device *other_dev;
                /* Append the device type to the name */
                strlcat(wacom_wac->name,
                        features->device_type == BTN_TOOL_PEN ?
                                " Pen" : " Finger",
                        sizeof(wacom_wac->name));
-                error = wacom_add_shared_data(wacom_wac, dev);
+                other_dev = wacom_get_sibling(dev, features->oVid, features->oPid);
+                if (other_dev == NULL || wacom_get_usbdev_data(other_dev) == NULL)
+                        other_dev = dev;
+                error = wacom_add_shared_data(wacom_wac, other_dev);
                if (error)
                        goto fail3;
        }
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index c3468c8dbd89..aa6010131179 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -806,6 +806,70 @@ static int find_slot_from_contactid(struct wacom_wac *wacom, int contactid)
        return -1;
 }
+static int int_dist(int x1, int y1, int x2, int y2)
+{
+        int x = x2 - x1;
+        int y = y2 - y1;
+        return int_sqrt(x*x + y*y);
+}
+static int wacom_24hdt_irq(struct wacom_wac *wacom)
+{
+        struct input_dev *input = wacom->input;
+        char *data = wacom->data;
+        int i;
+        int current_num_contacts = data[61];
+        int contacts_to_send = 0;
+        /*
+         * First packet resets the counter since only the first
+         * packet in series will have non-zero current_num_contacts.
+         */
+        if (current_num_contacts)
+                wacom->num_contacts_left = current_num_contacts;
+        /* There are at most 4 contacts per packet */
+        contacts_to_send = min(4, wacom->num_contacts_left);
+        for (i = 0; i < contacts_to_send; i++) {
+                int offset = (WACOM_BYTES_PER_24HDT_PACKET * i) + 1;
+                bool touch = data[offset] & 0x1 && !wacom->shared->stylus_in_proximity;
+                int id = data[offset + 1];
+                int slot = find_slot_from_contactid(wacom, id);
+                if (slot < 0)
+                        continue;
+                input_mt_slot(input, slot);
+                input_mt_report_slot_state(input, MT_TOOL_FINGER, touch);
+                if (touch) {
+                        int t_x = le16_to_cpup((__le16 *)&data[offset + 2]);
+                        int c_x = le16_to_cpup((__le16 *)&data[offset + 4]);
+                        int t_y = le16_to_cpup((__le16 *)&data[offset + 6]);
+                        int c_y = le16_to_cpup((__le16 *)&data[offset + 8]);
+                        int w = le16_to_cpup((__le16 *)&data[offset + 10]);
+                        int h = le16_to_cpup((__le16 *)&data[offset + 12]);
+                        input_report_abs(input, ABS_MT_POSITION_X, t_x);
+                        input_report_abs(input, ABS_MT_POSITION_Y, t_y);
+                        input_report_abs(input, ABS_MT_TOUCH_MAJOR, min(w,h));
+                        input_report_abs(input, ABS_MT_WIDTH_MAJOR, min(w, h) + int_dist(t_x, t_y, c_x, c_y));
+                        input_report_abs(input, ABS_MT_WIDTH_MINOR, min(w, h));
+                        input_report_abs(input, ABS_MT_ORIENTATION, w > h);
+                }
+                wacom->slots[slot] = touch ? id : -1;
+        }
+        input_mt_report_pointer_emulation(input, true);
+        wacom->num_contacts_left -= contacts_to_send;
+        if (wacom->num_contacts_left <= 0)
+                wacom->num_contacts_left = 0;
+        return 1;
+}
 static int wacom_mt_touch(struct wacom_wac *wacom)
 {
        struct input_dev *input = wacom->input;
@@ -1255,6 +1319,10 @@ void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len)
                sync = wacom_intuos_irq(wacom_wac);
                break;
+        case WACOM_24HDT:
+                sync = wacom_24hdt_irq(wacom_wac);
+                break;
        case INTUOS5S:
        case INTUOS5:
        case INTUOS5L:
@@ -1340,7 +1408,8 @@ void wacom_setup_device_quirks(struct wacom_features *features)
        /* these device have multiple inputs */
        if (features->type >= WIRELESS ||
-            (features->type >= INTUOS5S && features->type <= INTUOS5L))
+            (features->type >= INTUOS5S && features->type <= INTUOS5L) ||
+            (features->oVid && features->oPid))
                features->quirks |= WACOM_QUIRK_MULTI_INPUT;
        /* quirk for bamboo touch with 2 low res touches */
@@ -1575,6 +1644,15 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                break;
+        case WACOM_24HDT:
+                if (features->device_type == BTN_TOOL_FINGER) {
+                        input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR, 0, features->x_max, 0, 0);
+                        input_set_abs_params(input_dev, ABS_MT_WIDTH_MAJOR, 0, features->x_max, 0, 0);
+                        input_set_abs_params(input_dev, ABS_MT_WIDTH_MINOR, 0, features->y_max, 0, 0);
+                        input_set_abs_params(input_dev, ABS_MT_ORIENTATION, 0, 1, 0, 0);
+                }
+                /* fall through */
        case MTSCREEN:
                if (features->device_type == BTN_TOOL_FINGER) {
                        wacom_wac->slots = kmalloc(features->touch_max *
@@ -1869,8 +1947,11 @@ static const struct wacom_features wacom_features_0xF4 =
        { "Wacom Cintiq 24HD",       WACOM_PKGLEN_INTUOS,   104480, 65600, 2047,
          63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0xF8 =
-        { "Wacom Cintiq 24HD touch", WACOM_PKGLEN_INTUOS,   104480, 65600, 2047,
+        { "Wacom Cintiq 24HD touch", WACOM_PKGLEN_INTUOS,   104480, 65600, 2047, /* Pen */
-          63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
+          63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, .oVid = USB_VENDOR_ID_WACOM, .oPid = 0xf6 };
+static const struct wacom_features wacom_features_0xF6 =
+        { "Wacom Cintiq 24HD touch", .type = WACOM_24HDT, /* Touch */
+          .oVid = USB_VENDOR_ID_WACOM, .oPid = 0xf8, .touch_max = 10 };
 static const struct wacom_features wacom_features_0x3F =
        { "Wacom Cintiq 21UX",    WACOM_PKGLEN_INTUOS,    87200, 65600, 1023,
          63, CINTIQ, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
@@ -2113,6 +2194,7 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0x47) },
        { USB_DEVICE_WACOM(0xF4) },
        { USB_DEVICE_WACOM(0xF8) },
+        { USB_DEVICE_WACOM(0xF6) },
        { USB_DEVICE_WACOM(0xFA) },
        { USB_DEVICE_LENOVO(0x6004) },
        { }
diff --git a/drivers/input/tablet/wacom_wac.h b/drivers/input/tablet/wacom_wac.h
index 96c185cc301e..345f1e76975e 100644
--- a/drivers/input/tablet/wacom_wac.h
+++ b/drivers/input/tablet/wacom_wac.h
@@ -29,6 +29,7 @@
 /* wacom data size per MT contact */
 #define WACOM_BYTES_PER_MT_PACKET       11
+#define WACOM_BYTES_PER_24HDT_PACKET    14
 /* device IDs */
 #define STYLUS_DEVICE_ID        0x02
@@ -49,6 +50,7 @@
 #define WACOM_REPORT_TPCHID             15
 #define WACOM_REPORT_TPCST              16
 #define WACOM_REPORT_TPC1FGE            18
+#define WACOM_REPORT_24HDT              1
 /* device quirks */
 #define WACOM_QUIRK_MULTI_INPUT         0x0001
@@ -81,6 +83,7 @@ enum {
        WACOM_MO,
        WIRELESS,
        BAMBOO_PT,
+        WACOM_24HDT,
        TABLETPC,   /* add new TPC below */
        TABLETPCE,
        TABLETPC2FG,
@@ -109,6 +112,8 @@ struct wacom_features {
        int distance_fuzz;
        unsigned quirks;
        unsigned touch_max;
+        int oVid;
+        int oPid;
 };
 struct wacom_shared {
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 18b0d99bd4d6..81837b0710a9 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1599,21 +1599,46 @@ static void __init free_on_init_error(void)
 #endif
 }
+/* SB IOAPIC is always on this device in AMD systems */
+#define IOAPIC_SB_DEVID         ((0x00 << 8) | PCI_DEVFN(0x14, 0))
 static bool __init check_ioapic_information(void)
 {
+        bool ret, has_sb_ioapic;
        int idx;
-        for (idx = 0; idx < nr_ioapics; idx++) {
+        has_sb_ioapic = false;
-                int id = mpc_ioapic_id(idx);
+        ret           = false;
-                if (get_ioapic_devid(id) < 0) {
+        for (idx = 0; idx < nr_ioapics; idx++) {
-                        pr_err(FW_BUG "AMD-Vi: IO-APIC[%d] not in IVRS table\n", id);
+                int devid, id = mpc_ioapic_id(idx);
-                        pr_err("AMD-Vi: Disabling interrupt remapping due to BIOS Bug\n");
-                        return false;
+                devid = get_ioapic_devid(id);
+                if (devid < 0) {
+                        pr_err(FW_BUG "AMD-Vi: IOAPIC[%d] not in IVRS table\n", id);
+                        ret = false;
+                } else if (devid == IOAPIC_SB_DEVID) {
+                        has_sb_ioapic = true;
+                        ret           = true;
                }
        }
-        return true;
+        if (!has_sb_ioapic) {
+                /*
+                 * We expect the SB IOAPIC to be listed in the IVRS
+                 * table. The system timer is connected to the SB IOAPIC
+                 * and if we don't have it in the list the system will
+                 * panic at boot time.  This situation usually happens
+                 * when the BIOS is buggy and provides us the wrong
+                 * device id for the IOAPIC in the system.
+                 */
+                pr_err(FW_BUG "AMD-Vi: No southbridge IOAPIC found in IVRS table\n");
+        }
+        if (!ret)
+                pr_err("AMD-Vi: Disabling interrupt remapping due to BIOS Bug(s)\n");
+        return ret;
 }
 static void __init free_dma_resources(void)
diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
index 0b4d62e0c645..a649f146d17b 100644
--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -200,7 +200,7 @@ enum {
 #define SMMU_ADDR_TO_PFN(addr)  ((addr) >> 12)
 #define SMMU_ADDR_TO_PDN(addr)  ((addr) >> 22)
-#define SMMU_PDN_TO_ADDR(addr)  ((pdn) << 22)
+#define SMMU_PDN_TO_ADDR(pdn)   ((pdn) << 22)
 #define _READABLE       (1 << SMMU_PTB_DATA_ASID_READABLE_SHIFT)
 #define _WRITABLE       (1 << SMMU_PTB_DATA_ASID_WRITABLE_SHIFT)
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 0f1ec9e8ff14..2e39c04fc16b 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1061,8 +1061,10 @@ static int pinctrl_groups_show(struct seq_file *s, void *what)
                        seq_printf(s, "group: %s\n", gname);
                        for (i = 0; i < num_pins; i++) {
                                pname = pin_get_name(pctldev, pins[i]);
-                                if (WARN_ON(!pname))
+                                if (WARN_ON(!pname)) {
+                                        mutex_unlock(&pinctrl_mutex);
                                        return -EINVAL;
+                                }
                                seq_printf(s, "pin %d (%s)\n", pins[i], pname);
                        }
                        seq_puts(s, "\n");
diff --git a/drivers/pinctrl/pinconf.c b/drivers/pinctrl/pinconf.c
index 43f474cdc110..baee2cc46a17 100644
--- a/drivers/pinctrl/pinconf.c
+++ b/drivers/pinctrl/pinconf.c
@@ -537,8 +537,6 @@ static int pinconf_groups_show(struct seq_file *s, void *what)
        seq_puts(s, "Pin config settings per pin group\n");
        seq_puts(s, "Format: group (name): configs\n");
-        mutex_lock(&pinctrl_mutex);
        while (selector < ngroups) {
                const char *gname = pctlops->get_group_name(pctldev, selector);
@@ -549,8 +547,6 @@ static int pinconf_groups_show(struct seq_file *s, void *what)
                selector++;
        }
-        mutex_unlock(&pinctrl_mutex);
        return 0;
 }
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index 01aea1c3b5fa..cf82d9ce4dee 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -1056,7 +1056,7 @@ static int nmk_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
        struct nmk_gpio_chip *nmk_chip =
                container_of(chip, struct nmk_gpio_chip, chip);
-        return irq_find_mapping(nmk_chip->domain, offset);
+        return irq_create_mapping(nmk_chip->domain, offset);
 }
 #ifdef CONFIG_DEBUG_FS
@@ -1281,7 +1281,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
        struct clk *clk;
        int secondary_irq;
        void __iomem *base;
-        int irq_start = -1;
+        int irq_start = 0;
        int irq;
        int ret;
@@ -1387,7 +1387,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
        if (!np)
                irq_start = NOMADIK_GPIO_TO_IRQ(pdata->first_gpio);
-        nmk_chip->domain = irq_domain_add_simple(NULL,
+        nmk_chip->domain = irq_domain_add_simple(np,
                                NMK_GPIO_PER_CHIP, irq_start,
                                &nmk_gpio_irq_simple_ops, nmk_chip);
        if (!nmk_chip->domain) {
diff --git a/drivers/pinctrl/pinctrl-tegra.c b/drivers/pinctrl/pinctrl-tegra.c
index 729b686c3ad2..7da0b371fd65 100644
--- a/drivers/pinctrl/pinctrl-tegra.c
+++ b/drivers/pinctrl/pinctrl-tegra.c
@@ -464,7 +464,7 @@ static int tegra_pinconf_reg(struct tegra_pmx *pmx,
                *bank = g->drv_bank;
                *reg = g->drv_reg;
                *bit = g->lpmd_bit;
-                *width = 1;
+                *width = 2;
                break;
        case TEGRA_PINCONF_PARAM_DRIVE_DOWN_STRENGTH:
                *bank = g->drv_bank;
diff --git a/drivers/pinctrl/pinctrl-tegra30.c b/drivers/pinctrl/pinctrl-tegra30.c
index 0386fdf0da16..7894f14c7059 100644
--- a/drivers/pinctrl/pinctrl-tegra30.c
+++ b/drivers/pinctrl/pinctrl-tegra30.c
@@ -3345,10 +3345,10 @@ static const struct tegra_function tegra30_functions[] = {
        FUNCTION(vi_alt3),
 };
-#define MUXCTL_REG_A    0x3000
+#define DRV_PINGROUP_REG_A      0x868   /* bank 0 */
-#define PINGROUP_REG_A  0x868
+#define PINGROUP_REG_A          0x3000  /* bank 1 */
-#define PINGROUP_REG_Y(r) ((r) - MUXCTL_REG_A)
+#define PINGROUP_REG_Y(r) ((r) - PINGROUP_REG_A)
 #define PINGROUP_REG_N(r) -1
 #define PINGROUP(pg_name, f0, f1, f2, f3, f_safe, r, od, ior)   \
@@ -3364,25 +3364,25 @@ static const struct tegra_function tegra30_functions[] = {
                },                                              \
                .func_safe = TEGRA_MUX_ ## f_safe,              \
                .mux_reg = PINGROUP_REG_Y(r),                   \
-                .mux_bank = 0,                                  \
+                .mux_bank = 1,                                  \
                .mux_bit = 0,                                   \
                .pupd_reg = PINGROUP_REG_Y(r),                  \
-                .pupd_bank = 0,                                 \
+                .pupd_bank = 1,                                 \
                .pupd_bit = 2,                                  \
                .tri_reg = PINGROUP_REG_Y(r),                   \
-                .tri_bank = 0,                                  \
+                .tri_bank = 1,                                  \
                .tri_bit = 4,                                   \
                .einput_reg = PINGROUP_REG_Y(r),                \
-                .einput_bank = 0,                               \
+                .einput_bank = 1,                               \
                .einput_bit = 5,                                \
                .odrain_reg = PINGROUP_REG_##od(r),             \
-                .odrain_bank = 0,                               \
+                .odrain_bank = 1,                               \
                .odrain_bit = 6,                                \
                .lock_reg = PINGROUP_REG_Y(r),                  \
-                .lock_bank = 0,                                 \
+                .lock_bank = 1,                                 \
                .lock_bit = 7,                                  \
                .ioreset_reg = PINGROUP_REG_##ior(r),           \
-                .ioreset_bank = 0,                              \
+                .ioreset_bank = 1,                              \
                .ioreset_bit = 8,                               \
                .drv_reg = -1,                                  \
        }
@@ -3401,8 +3401,8 @@ static const struct tegra_function tegra30_functions[] = {
                .odrain_reg = -1,                               \
                .lock_reg = -1,                                 \
                .ioreset_reg = -1,                              \
-                .drv_reg = ((r) - PINGROUP_REG_A),              \
+                .drv_reg = ((r) - DRV_PINGROUP_REG_A),          \
-                .drv_bank = 1,                                  \
+                .drv_bank = 0,                                  \
                .hsm_bit = hsm_b,                               \
                .schmitt_bit = schmitt_b,                       \
                .lpmd_bit = lpmd_b,                             \
diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c
index 891cd6c61d0a..4eed51044c5d 100644
--- a/drivers/rtc/rtc-imxdi.c
+++ b/drivers/rtc/rtc-imxdi.c
@@ -392,6 +392,8 @@ static int dryice_rtc_probe(struct platform_device *pdev)
        if (imxdi->ioaddr == NULL)
                return -ENOMEM;
+        spin_lock_init(&imxdi->irq_lock);
        imxdi->irq = platform_get_irq(pdev, 0);
        if (imxdi->irq < 0)
                return imxdi->irq;
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index b4d572f65f07..fd00afd8b850 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -377,7 +377,11 @@ static int css_evaluate_new_subchannel(struct subchannel_id schid, int slow)
                /* Will be done on the slow path. */
                return -EAGAIN;
        }
-        if (stsch_err(schid, &schib) || !css_sch_is_valid(&schib)) {
+        if (stsch_err(schid, &schib)) {
+                /* Subchannel is not provided. */
+                return -ENXIO;
+        }
+        if (!css_sch_is_valid(&schib)) {
                /* Unusable - ignore. */
                return 0;
        }
@@ -536,6 +540,7 @@ static int slow_eval_unknown_fn(struct subchannel_id schid, void *data)
                case -ENOMEM:
                case -EIO:
                        /* These should abort looping */
+                        idset_sch_del_subseq(slow_subchannel_set, schid);
                        break;
                default:
                        rc = 0;
diff --git a/drivers/s390/cio/idset.c b/drivers/s390/cio/idset.c
index e6d5f8c49524..199bc6791177 100644
--- a/drivers/s390/cio/idset.c
+++ b/drivers/s390/cio/idset.c
@@ -1,9 +1,10 @@
 /*
- *    Copyright IBM Corp. 2007
+ *    Copyright IBM Corp. 2007, 2012
 *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
 */
 #include <linux/vmalloc.h>
+#include <linux/bitmap.h>
 #include <linux/bitops.h>
 #include "idset.h"
 #include "css.h"
@@ -89,6 +90,14 @@ void idset_sch_del(struct idset *set, struct subchannel_id schid)
        idset_del(set, schid.ssid, schid.sch_no);
 }
+/* Clear ids starting from @schid up to end of subchannel set. */
+void idset_sch_del_subseq(struct idset *set, struct subchannel_id schid)
+{
+        int pos = schid.ssid * set->num_id + schid.sch_no;
+        bitmap_clear(set->bitmap, pos, set->num_id - schid.sch_no);
+}
 int idset_sch_contains(struct idset *set, struct subchannel_id schid)
 {
        return idset_contains(set, schid.ssid, schid.sch_no);
@@ -111,20 +120,13 @@ int idset_sch_get_first(struct idset *set, struct subchannel_id *schid)
 int idset_is_empty(struct idset *set)
 {
-        int bitnum;
+        return bitmap_empty(set->bitmap, set->num_ssid * set->num_id);
-        bitnum = find_first_bit(set->bitmap, set->num_ssid * set->num_id);
-        if (bitnum >= set->num_ssid * set->num_id)
-                return 1;
-        return 0;
 }
 void idset_add_set(struct idset *to, struct idset *from)
 {
-        unsigned long i, len;
+        int len = min(__BITOPS_WORDS(to->num_ssid * to->num_id),
+                      __BITOPS_WORDS(from->num_ssid * from->num_id));
-        len = min(__BITOPS_WORDS(to->num_ssid * to->num_id),
+        bitmap_or(to->bitmap, to->bitmap, from->bitmap, len);
-                  __BITOPS_WORDS(from->num_ssid * from->num_id));
-        for (i = 0; i < len ; i++)
-                to->bitmap[i] |= from->bitmap[i];
 }
diff --git a/drivers/s390/cio/idset.h b/drivers/s390/cio/idset.h
index 3d943f03591e..06d3bc01bb09 100644
--- a/drivers/s390/cio/idset.h
+++ b/drivers/s390/cio/idset.h
@@ -1,5 +1,5 @@
 /*
- *    Copyright IBM Corp. 2007
+ *    Copyright IBM Corp. 2007, 2012
 *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
 */
@@ -17,6 +17,7 @@ void idset_fill(struct idset *set);
 struct idset *idset_sch_new(void);
 void idset_sch_add(struct idset *set, struct subchannel_id id);
 void idset_sch_del(struct idset *set, struct subchannel_id id);
+void idset_sch_del_subseq(struct idset *set, struct subchannel_id schid);
 int idset_sch_contains(struct idset *set, struct subchannel_id id);
 int idset_sch_get_first(struct idset *set, struct subchannel_id *id);
 int idset_is_empty(struct idset *set);
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 919464102d33..a1db91a99b89 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -2186,8 +2186,6 @@ pl022_probe(struct amba_device *adev, const struct amba_id *id)
        printk(KERN_INFO "pl022: mapped registers from 0x%08x to %p\n",
               adev->res.start, pl022->virtbase);
-        pm_runtime_resume(dev);
        pl022->clk = devm_clk_get(&adev->dev, NULL);
        if (IS_ERR(pl022->clk)) {
                status = PTR_ERR(pl022->clk);
@@ -2292,7 +2290,6 @@ pl022_remove(struct amba_device *adev)
        clk_disable(pl022->clk);
        clk_unprepare(pl022->clk);
-        pm_runtime_disable(&adev->dev);
        amba_release_regions(adev);
        tasklet_disable(&pl022->pump_transfers);
        spi_unregister_master(pl022->master);
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 4894bde4bbff..30faf6d4ab91 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -147,8 +147,6 @@ struct rspi_data {
        unsigned char spsr;
        /* for dmaengine */
-        struct sh_dmae_slave dma_tx;
-        struct sh_dmae_slave dma_rx;
        struct dma_chan *chan_tx;
        struct dma_chan *chan_rx;
        int irq;
@@ -663,20 +661,16 @@ static irqreturn_t rspi_irq(int irq, void *_sr)
        return ret;
 }
-static bool rspi_filter(struct dma_chan *chan, void *filter_param)
+static int __devinit rspi_request_dma(struct rspi_data *rspi,
-{
+                                      struct platform_device *pdev)
-        chan->private = filter_param;
-        return true;
-}
-static void __devinit rspi_request_dma(struct rspi_data *rspi,
-                                       struct platform_device *pdev)
 {
        struct rspi_plat_data *rspi_pd = pdev->dev.platform_data;
        dma_cap_mask_t mask;
+        struct dma_slave_config cfg;
+        int ret;
        if (!rspi_pd)
-                return;
+                return 0;       /* The driver assumes no error. */
        rspi->dma_width_16bit = rspi_pd->dma_width_16bit;
@@ -684,21 +678,35 @@ static void __devinit rspi_request_dma(struct rspi_data *rspi,
        if (rspi_pd->dma_rx_id && rspi_pd->dma_tx_id) {
                dma_cap_zero(mask);
                dma_cap_set(DMA_SLAVE, mask);
-                rspi->dma_rx.slave_id = rspi_pd->dma_rx_id;
+                rspi->chan_rx = dma_request_channel(mask, shdma_chan_filter,
-                rspi->chan_rx = dma_request_channel(mask, rspi_filter,
+                                                    (void *)rspi_pd->dma_rx_id);
-                                                    &rspi->dma_rx);
+                if (rspi->chan_rx) {
-                if (rspi->chan_rx)
+                        cfg.slave_id = rspi_pd->dma_rx_id;
-                        dev_info(&pdev->dev, "Use DMA when rx.\n");
+                        cfg.direction = DMA_DEV_TO_MEM;
+                        ret = dmaengine_slave_config(rspi->chan_rx, &cfg);
+                        if (!ret)
+                                dev_info(&pdev->dev, "Use DMA when rx.\n");
+                        else
+                                return ret;
+                }
        }
        if (rspi_pd->dma_tx_id) {
                dma_cap_zero(mask);
                dma_cap_set(DMA_SLAVE, mask);
-                rspi->dma_tx.slave_id = rspi_pd->dma_tx_id;
+                rspi->chan_tx = dma_request_channel(mask, shdma_chan_filter,
-                rspi->chan_tx = dma_request_channel(mask, rspi_filter,
+                                                    (void *)rspi_pd->dma_tx_id);
-                                                    &rspi->dma_tx);
+                if (rspi->chan_tx) {
-                if (rspi->chan_tx)
+                        cfg.slave_id = rspi_pd->dma_tx_id;
-                        dev_info(&pdev->dev, "Use DMA when tx\n");
+                        cfg.direction = DMA_MEM_TO_DEV;
+                        ret = dmaengine_slave_config(rspi->chan_tx, &cfg);
+                        if (!ret)
+                                dev_info(&pdev->dev, "Use DMA when tx\n");
+                        else
+                                return ret;
+                }
        }
+        return 0;
 }
 static void __devexit rspi_release_dma(struct rspi_data *rspi)
@@ -788,7 +796,11 @@ static int __devinit rspi_probe(struct platform_device *pdev)
        }
        rspi->irq = irq;
-        rspi_request_dma(rspi, pdev);
+        ret = rspi_request_dma(rspi, pdev);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "rspi_request_dma failed.\n");
+                goto error4;
+        }
        ret = spi_register_master(master);
        if (ret < 0) {
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index c101697a4ba7..765a945f8ea1 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -60,7 +60,8 @@ config LCD_LTV350QV
          The LTV350QV panel is present on all ATSTK1000 boards.
 config LCD_ILI9320
-        tristate
+        tristate "ILI Technology ILI9320 controller support"
+        depends on SPI
        help
          If you have a panel based on the ILI9320 controller chip
          then say y to include a power driver for it.
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index d4dffcd52873..126d8ce591ce 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -3,6 +3,7 @@ menu "Xen driver support"
 config XEN_BALLOON
        bool "Xen memory balloon driver"
+        depends on !ARM
        default y
        help
          The balloon driver allows the Xen domain to request more memory from
@@ -145,6 +146,7 @@ config SWIOTLB_XEN
 config XEN_TMEM
        bool
+        depends on !ARM
        default y if (CLEANCACHE || FRONTSWAP)
        help
          Shim to interface in-kernel Transcendent Memory hooks
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 31ab82fda38a..d6886d90ccfd 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -55,7 +55,6 @@
 #include <asm/pgalloc.h>
 #include <asm/pgtable.h>
 #include <asm/tlb.h>
-#include <asm/e820.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
@@ -88,7 +87,7 @@ struct balloon_stats balloon_stats;
 EXPORT_SYMBOL_GPL(balloon_stats);
 /* We increase/decrease in batches which fit in a page */
-static unsigned long frame_list[PAGE_SIZE / sizeof(unsigned long)];
+static xen_pfn_t frame_list[PAGE_SIZE / sizeof(unsigned long)];
 #ifdef CONFIG_HIGHMEM
 #define inc_totalhigh_pages() (totalhigh_pages++)
diff --git a/drivers/xen/dbgp.c b/drivers/xen/dbgp.c
index 42569c77ccc8..f3ccc80a455f 100644
--- a/drivers/xen/dbgp.c
+++ b/drivers/xen/dbgp.c
@@ -8,7 +8,9 @@
 static int xen_dbgp_op(struct usb_hcd *hcd, int op)
 {
+#ifdef CONFIG_PCI
        const struct device *ctrlr = hcd_to_bus(hcd)->controller;
+#endif
        struct physdev_dbgp_op dbgp;
        if (!xen_initial_domain())
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 59e10a1286d5..912ac81b6dbf 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -115,7 +115,9 @@ struct irq_info {
 #define PIRQ_SHAREABLE  (1 << 1)
 static int *evtchn_to_irq;
+#ifdef CONFIG_X86
 static unsigned long *pirq_eoi_map;
+#endif
 static bool (*pirq_needs_eoi)(unsigned irq);
 static DEFINE_PER_CPU(unsigned long [NR_EVENT_CHANNELS/BITS_PER_LONG],
@@ -277,10 +279,12 @@ static unsigned int cpu_from_evtchn(unsigned int evtchn)
        return ret;
 }
+#ifdef CONFIG_X86
 static bool pirq_check_eoi_map(unsigned irq)
 {
        return test_bit(pirq_from_irq(irq), pirq_eoi_map);
 }
+#endif
 static bool pirq_needs_eoi_flag(unsigned irq)
 {
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index b2b0a375b348..b91f14e83164 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -84,7 +84,7 @@ struct gnttab_ops {
         * nr_gframes is the number of frames to map grant table. Returning
         * GNTST_okay means success and negative value means failure.
         */
-        int (*map_frames)(unsigned long *frames, unsigned int nr_gframes);
+        int (*map_frames)(xen_pfn_t *frames, unsigned int nr_gframes);
        /*
         * Release a list of frames which are mapped in map_frames for grant
         * entry status.
@@ -960,7 +960,7 @@ static unsigned nr_status_frames(unsigned nr_grant_frames)
        return (nr_grant_frames * GREFS_PER_GRANT_FRAME + SPP - 1) / SPP;
 }
-static int gnttab_map_frames_v1(unsigned long *frames, unsigned int nr_gframes)
+static int gnttab_map_frames_v1(xen_pfn_t *frames, unsigned int nr_gframes)
 {
        int rc;
@@ -977,7 +977,7 @@ static void gnttab_unmap_frames_v1(void)
        arch_gnttab_unmap(gnttab_shared.addr, nr_grant_frames);
 }
-static int gnttab_map_frames_v2(unsigned long *frames, unsigned int nr_gframes)
+static int gnttab_map_frames_v2(xen_pfn_t *frames, unsigned int nr_gframes)
 {
        uint64_t *sframes;
        unsigned int nr_sframes;
@@ -1029,7 +1029,7 @@ static void gnttab_unmap_frames_v2(void)
 static int gnttab_map(unsigned int start_idx, unsigned int end_idx)
 {
        struct gnttab_setup_table setup;
-        unsigned long *frames;
+        xen_pfn_t *frames;
        unsigned int nr_gframes = end_idx + 1;
        int rc;
diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c
index 5e5ad7e28858..96453f8a85c5 100644
--- a/drivers/xen/sys-hypervisor.c
+++ b/drivers/xen/sys-hypervisor.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/kobject.h>
+#include <linux/err.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
@@ -284,7 +285,8 @@ static ssize_t virtual_start_show(struct hyp_sysfs_attr *attr, char *buffer)
                ret = HYPERVISOR_xen_version(XENVER_platform_parameters,
                                             parms);
                if (!ret)
-                        ret = sprintf(buffer, "%lx\n", parms->virt_start);
+                        ret = sprintf(buffer, "%"PRI_xen_ulong"\n",
+                                      parms->virt_start);
                kfree(parms);
        }
diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c
index 46d140baebd8..0f478ac483cd 100644
--- a/drivers/xen/xen-pciback/vpci.c
+++ b/drivers/xen/xen-pciback/vpci.c
@@ -89,9 +89,15 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
        mutex_lock(&vpci_dev->lock);
-        /* Keep multi-function devices together on the virtual PCI bus */
+        /*
-        for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
+         * Keep multi-function devices together on the virtual PCI bus, except
-                if (!list_empty(&vpci_dev->dev_list[slot])) {
+         * virtual functions.
+         */
+        if (!dev->is_virtfn) {
+                for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
+                        if (list_empty(&vpci_dev->dev_list[slot]))
+                                continue;
                        t = list_entry(list_first(&vpci_dev->dev_list[slot]),
                                       struct pci_dev_entry, list);
@@ -116,7 +122,7 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
                               pci_name(dev), slot);
                        list_add_tail(&dev_entry->list,
                                      &vpci_dev->dev_list[slot]);
-                        func = PCI_FUNC(dev->devfn);
+                        func = dev->is_virtfn ? 0 : PCI_FUNC(dev->devfn);
                        goto unlock;
                }
        }
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index f5dda83ad7a5..acedeabe589c 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -627,6 +627,7 @@ static struct xenbus_watch *find_watch(const char *token)
 */
 static bool xen_strict_xenbus_quirk(void)
 {
+#ifdef CONFIG_X86
        uint32_t eax, ebx, ecx, edx, base;
        base = xen_cpuid_base();
@@ -634,6 +635,7 @@ static bool xen_strict_xenbus_quirk(void)
        if ((eax >> 16) < 4)
                return true;
+#endif
        return false;
 }
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index f3187938e081..208d8aa5b07e 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -283,9 +283,7 @@ static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
                goto out;
        }
-        rcu_read_lock();
+        root_level = btrfs_old_root_level(root, time_seq);
-        root_level = btrfs_header_level(root->node);
-        rcu_read_unlock();
        if (root_level + 1 == level)
                goto out;
@@ -1177,16 +1175,15 @@ int btrfs_find_one_extref(struct btrfs_root *root, u64 inode_objectid,
        return ret;
 }
-static char *ref_to_path(struct btrfs_root *fs_root,
+char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
-                         struct btrfs_path *path,
+                        u32 name_len, unsigned long name_off,
-                         u32 name_len, unsigned long name_off,
+                        struct extent_buffer *eb_in, u64 parent,
-                         struct extent_buffer *eb_in, u64 parent,
+                        char *dest, u32 size)
-                         char *dest, u32 size)
 {
        int slot;
        u64 next_inum;
        int ret;
-        s64 bytes_left = size - 1;
+        s64 bytes_left = ((s64)size) - 1;
        struct extent_buffer *eb = eb_in;
        struct btrfs_key found_key;
        int leave_spinning = path->leave_spinning;
@@ -1266,10 +1263,10 @@ char *btrfs_iref_to_path(struct btrfs_root *fs_root,
                         struct extent_buffer *eb_in, u64 parent,
                         char *dest, u32 size)
 {
-        return ref_to_path(fs_root, path,
+        return btrfs_ref_to_path(fs_root, path,
-                           btrfs_inode_ref_name_len(eb_in, iref),
+                                 btrfs_inode_ref_name_len(eb_in, iref),
-                           (unsigned long)(iref + 1),
+                                 (unsigned long)(iref + 1),
-                           eb_in, parent, dest, size);
+                                 eb_in, parent, dest, size);
 }
 /*
@@ -1715,9 +1712,8 @@ static int inode_to_path(u64 inum, u32 name_len, unsigned long name_off,
                                        ipath->fspath->bytes_left - s_ptr : 0;
        fspath_min = (char *)ipath->fspath->val + (i + 1) * s_ptr;
-        fspath = ref_to_path(ipath->fs_root, ipath->btrfs_path, name_len,
+        fspath = btrfs_ref_to_path(ipath->fs_root, ipath->btrfs_path, name_len,
-                             name_off, eb, inum, fspath_min,
+                                   name_off, eb, inum, fspath_min, bytes_left);
-                             bytes_left);
        if (IS_ERR(fspath))
                return PTR_ERR(fspath);
diff --git a/fs/btrfs/backref.h b/fs/btrfs/backref.h
index e75533043a5f..d61feca79455 100644
--- a/fs/btrfs/backref.h
+++ b/fs/btrfs/backref.h
@@ -62,6 +62,10 @@ int btrfs_find_all_roots(struct btrfs_trans_handle *trans,
 char *btrfs_iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                         struct btrfs_inode_ref *iref, struct extent_buffer *eb,
                         u64 parent, char *dest, u32 size);
+char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
+                        u32 name_len, unsigned long name_off,
+                        struct extent_buffer *eb_in, u64 parent,
+                        char *dest, u32 size);
 struct btrfs_data_container *init_data_container(u32 total_bytes);
 struct inode_fs_paths *init_ipath(s32 total_bytes, struct btrfs_root *fs_root,
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index b33436211000..cdfb4c49a806 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -596,6 +596,11 @@ tree_mod_log_insert_move(struct btrfs_fs_info *fs_info,
        if (tree_mod_dont_log(fs_info, eb))
                return 0;
+        /*
+         * When we override something during the move, we log these removals.
+         * This can only happen when we move towards the beginning of the
+         * buffer, i.e. dst_slot < src_slot.
+         */
        for (i = 0; i + dst_slot < src_slot && i < nr_items; i++) {
                ret = tree_mod_log_insert_key_locked(fs_info, eb, i + dst_slot,
                                              MOD_LOG_KEY_REMOVE_WHILE_MOVING);
@@ -647,8 +652,6 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
        if (tree_mod_dont_log(fs_info, NULL))
                return 0;
-        __tree_mod_log_free_eb(fs_info, old_root);
        ret = tree_mod_alloc(fs_info, flags, &tm);
        if (ret < 0)
                goto out;
@@ -926,12 +929,7 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                        ret = btrfs_dec_ref(trans, root, buf, 1, 1);
                        BUG_ON(ret); /* -ENOMEM */
                }
-                /*
+                tree_mod_log_free_eb(root->fs_info, buf);
-                 * don't log freeing in case we're freeing the root node, this
-                 * is done by tree_mod_log_set_root_pointer later
-                 */
-                if (buf != root->node && btrfs_header_level(buf) != 0)
-                        tree_mod_log_free_eb(root->fs_info, buf);
                clean_tree_block(trans, root, buf);
                *last_ref = 1;
        }
@@ -1225,6 +1223,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
        free_extent_buffer(eb);
        __tree_mod_log_rewind(eb_rewin, time_seq, tm);
+        WARN_ON(btrfs_header_nritems(eb_rewin) >
+                BTRFS_NODEPTRS_PER_BLOCK(fs_info->fs_root));
        return eb_rewin;
 }
@@ -1241,9 +1241,11 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
 {
        struct tree_mod_elem *tm;
        struct extent_buffer *eb;
+        struct extent_buffer *old;
        struct tree_mod_root *old_root = NULL;
        u64 old_generation = 0;
        u64 logical;
+        u32 blocksize;
        eb = btrfs_read_lock_root_node(root);
        tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
@@ -1259,14 +1261,32 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
        }
        tm = tree_mod_log_search(root->fs_info, logical, time_seq);
-        if (old_root)
+        if (old_root && tm && tm->op != MOD_LOG_KEY_REMOVE_WHILE_FREEING) {
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
+                blocksize = btrfs_level_size(root, old_root->level);
+                old = read_tree_block(root, logical, blocksize, 0);
+                if (!old) {
+                        pr_warn("btrfs: failed to read tree block %llu from get_old_root\n",
+                                logical);
+                        WARN_ON(1);
+                } else {
+                        eb = btrfs_clone_extent_buffer(old);
+                        free_extent_buffer(old);
+                }
+        } else if (old_root) {
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
                eb = alloc_dummy_extent_buffer(logical, root->nodesize);
-        else
+        } else {
                eb = btrfs_clone_extent_buffer(root->node);
-        btrfs_tree_read_unlock(root->node);
+                btrfs_tree_read_unlock(root->node);
-        free_extent_buffer(root->node);
+                free_extent_buffer(root->node);
+        }
        if (!eb)
                return NULL;
+        extent_buffer_get(eb);
        btrfs_tree_read_lock(eb);
        if (old_root) {
                btrfs_set_header_bytenr(eb, eb->start);
@@ -1279,11 +1299,28 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
                __tree_mod_log_rewind(eb, time_seq, tm);
        else
                WARN_ON(btrfs_header_level(eb) != 0);
-        extent_buffer_get(eb);
+        WARN_ON(btrfs_header_nritems(eb) > BTRFS_NODEPTRS_PER_BLOCK(root));
        return eb;
 }
+int btrfs_old_root_level(struct btrfs_root *root, u64 time_seq)
+{
+        struct tree_mod_elem *tm;
+        int level;
+        tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
+        if (tm && tm->op == MOD_LOG_ROOT_REPLACE) {
+                level = tm->old_root.level;
+        } else {
+                rcu_read_lock();
+                level = btrfs_header_level(root->node);
+                rcu_read_unlock();
+        }
+        return level;
+}
 static inline int should_cow_block(struct btrfs_trans_handle *trans,
                                   struct btrfs_root *root,
                                   struct extent_buffer *buf)
@@ -1725,6 +1762,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                        goto enospc;
                }
+                tree_mod_log_free_eb(root->fs_info, root->node);
                tree_mod_log_set_root_pointer(root, child);
                rcu_assign_pointer(root->node, child);
@@ -2970,8 +3008,10 @@ static int push_node_left(struct btrfs_trans_handle *trans,
                           push_items * sizeof(struct btrfs_key_ptr));
        if (push_items < src_nritems) {
-                tree_mod_log_eb_move(root->fs_info, src, 0, push_items,
+                /*
-                                     src_nritems - push_items);
+                 * don't call tree_mod_log_eb_move here, key removal was already
+                 * fully logged by tree_mod_log_eb_copy above.
+                 */
                memmove_extent_buffer(src, btrfs_node_key_ptr_offset(0),
                                      btrfs_node_key_ptr_offset(push_items),
                                      (src_nritems - push_items) *
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 926c9ffc66d9..c72ead869507 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3120,6 +3120,7 @@ static inline u64 btrfs_inc_tree_mod_seq(struct btrfs_fs_info *fs_info)
 {
        return atomic_inc_return(&fs_info->tree_mod_seq);
 }
+int btrfs_old_root_level(struct btrfs_root *root, u64 time_seq);
 /* root-item.c */
 int btrfs_find_root_ref(struct btrfs_root *tree_root,
@@ -3338,6 +3339,8 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
 int btrfs_update_inode(struct btrfs_trans_handle *trans,
                              struct btrfs_root *root,
                              struct inode *inode);
+int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
+                                struct btrfs_root *root, struct inode *inode);
 int btrfs_orphan_add(struct btrfs_trans_handle *trans, struct inode *inode);
 int btrfs_orphan_del(struct btrfs_trans_handle *trans, struct inode *inode);
 int btrfs_orphan_cleanup(struct btrfs_root *root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 8036d3a84853..472873a94d96 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4110,8 +4110,8 @@ struct extent_buffer *alloc_dummy_extent_buffer(u64 start, unsigned long len)
        return eb;
 err:
-        for (i--; i >= 0; i--)
+        for (; i > 0; i--)
-                __free_page(eb->pages[i]);
+                __free_page(eb->pages[i - 1]);
        __free_extent_buffer(eb);
        return NULL;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 85a1e5053fe6..95542a1b3dfc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -94,8 +94,6 @@ static noinline int cow_file_range(struct inode *inode,
                                   struct page *locked_page,
                                   u64 start, u64 end, int *page_started,
                                   unsigned long *nr_written, int unlock);
-static noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root, struct inode *inode);
 static int btrfs_init_inode_security(struct btrfs_trans_handle *trans,
                                     struct inode *inode,  struct inode *dir,
@@ -2746,8 +2744,9 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
        return btrfs_update_inode_item(trans, root, inode);
 }
-static noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
+noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root, struct inode *inode)
+                                         struct btrfs_root *root,
+                                         struct inode *inode)
 {
        int ret;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 61168805f175..8fcf9a59c28d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -343,7 +343,8 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
                return -EOPNOTSUPP;
        if (copy_from_user(&range, arg, sizeof(range)))
                return -EFAULT;
-        if (range.start > total_bytes)
+        if (range.start > total_bytes ||
+            range.len < fs_info->sb->s_blocksize)
                return -EINVAL;
        range.len = min(range.len, total_bytes - range.start);
@@ -570,7 +571,8 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
                ret = btrfs_commit_transaction(trans,
                                               root->fs_info->extent_root);
        }
-        BUG_ON(ret);
+        if (ret)
+                goto fail;
        ret = pending_snapshot->error;
        if (ret)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 5039686df6ae..fe9d02c45f8e 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -790,8 +790,10 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
        }
        path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out_free_root;
+        }
        key.objectid = 0;
        key.type = BTRFS_QGROUP_STATUS_KEY;
@@ -800,7 +802,7 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
        ret = btrfs_insert_empty_item(trans, quota_root, path, &key,
                                      sizeof(*ptr));
        if (ret)
-                goto out;
+                goto out_free_path;
        leaf = path->nodes[0];
        ptr = btrfs_item_ptr(leaf, path->slots[0],
@@ -818,8 +820,15 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
        fs_info->quota_root = quota_root;
        fs_info->pending_quota_state = 1;
        spin_unlock(&fs_info->qgroup_lock);
-out:
+out_free_path:
        btrfs_free_path(path);
+out_free_root:
+        if (ret) {
+                free_extent_buffer(quota_root->node);
+                free_extent_buffer(quota_root->commit_root);
+                kfree(quota_root);
+        }
+out:
        return ret;
 }
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index c7beb543a4a8..e78b297b0b00 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -745,31 +745,36 @@ typedef int (*iterate_inode_ref_t)(int num, u64 dir, int index,
                                   void *ctx);
 /*
- * Helper function to iterate the entries in ONE btrfs_inode_ref.
+ * Helper function to iterate the entries in ONE btrfs_inode_ref or
+ * btrfs_inode_extref.
 * The iterate callback may return a non zero value to stop iteration. This can
 * be a negative value for error codes or 1 to simply stop it.
 *
- * path must point to the INODE_REF when called.
+ * path must point to the INODE_REF or INODE_EXTREF when called.
 */
 static int iterate_inode_ref(struct send_ctx *sctx,
                             struct btrfs_root *root, struct btrfs_path *path,
                             struct btrfs_key *found_key, int resolve,
                             iterate_inode_ref_t iterate, void *ctx)
 {
-        struct extent_buffer *eb;
+        struct extent_buffer *eb = path->nodes[0];
        struct btrfs_item *item;
        struct btrfs_inode_ref *iref;
+        struct btrfs_inode_extref *extref;
        struct btrfs_path *tmp_path;
        struct fs_path *p;
-        u32 cur;
+        u32 cur = 0;
-        u32 len;
        u32 total;
-        int slot;
+        int slot = path->slots[0];
        u32 name_len;
        char *start;
        int ret = 0;
-        int num;
+        int num = 0;
        int index;
+        u64 dir;
+        unsigned long name_off;
+        unsigned long elem_size;
+        unsigned long ptr;
        p = fs_path_alloc_reversed(sctx);
        if (!p)
@@ -781,24 +786,40 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                return -ENOMEM;
        }
-        eb = path->nodes[0];
-        slot = path->slots[0];
-        item = btrfs_item_nr(eb, slot);
-        iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
-        cur = 0;
-        len = 0;
-        total = btrfs_item_size(eb, item);
-        num = 0;
+        if (found_key->type == BTRFS_INODE_REF_KEY) {
+                ptr = (unsigned long)btrfs_item_ptr(eb, slot,
+                                                    struct btrfs_inode_ref);
+                item = btrfs_item_nr(eb, slot);
+                total = btrfs_item_size(eb, item);
+                elem_size = sizeof(*iref);
+        } else {
+                ptr = btrfs_item_ptr_offset(eb, slot);
+                total = btrfs_item_size_nr(eb, slot);
+                elem_size = sizeof(*extref);
+        }
        while (cur < total) {
                fs_path_reset(p);
-                name_len = btrfs_inode_ref_name_len(eb, iref);
+                if (found_key->type == BTRFS_INODE_REF_KEY) {
-                index = btrfs_inode_ref_index(eb, iref);
+                        iref = (struct btrfs_inode_ref *)(ptr + cur);
+                        name_len = btrfs_inode_ref_name_len(eb, iref);
+                        name_off = (unsigned long)(iref + 1);
+                        index = btrfs_inode_ref_index(eb, iref);
+                        dir = found_key->offset;
+                } else {
+                        extref = (struct btrfs_inode_extref *)(ptr + cur);
+                        name_len = btrfs_inode_extref_name_len(eb, extref);
+                        name_off = (unsigned long)&extref->name;
+                        index = btrfs_inode_extref_index(eb, extref);
+                        dir = btrfs_inode_extref_parent(eb, extref);
+                }
                if (resolve) {
-                        start = btrfs_iref_to_path(root, tmp_path, iref, eb,
+                        start = btrfs_ref_to_path(root, tmp_path, name_len,
-                                                found_key->offset, p->buf,
+                                                  name_off, eb, dir,
-                                                p->buf_len);
+                                                  p->buf, p->buf_len);
                        if (IS_ERR(start)) {
                                ret = PTR_ERR(start);
                                goto out;
@@ -809,9 +830,10 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                                                p->buf_len + p->buf - start);
                                if (ret < 0)
                                        goto out;
-                                start = btrfs_iref_to_path(root, tmp_path, iref,
+                                start = btrfs_ref_to_path(root, tmp_path,
-                                                eb, found_key->offset, p->buf,
+                                                          name_len, name_off,
-                                                p->buf_len);
+                                                          eb, dir,
+                                                          p->buf, p->buf_len);
                                if (IS_ERR(start)) {
                                        ret = PTR_ERR(start);
                                        goto out;
@@ -820,21 +842,16 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                        }
                        p->start = start;
                } else {
-                        ret = fs_path_add_from_extent_buffer(p, eb,
+                        ret = fs_path_add_from_extent_buffer(p, eb, name_off,
-                                        (unsigned long)(iref + 1), name_len);
+                                                             name_len);
                        if (ret < 0)
                                goto out;
                }
+                cur += elem_size + name_len;
-                len = sizeof(*iref) + name_len;
+                ret = iterate(num, dir, index, p, ctx);
-                iref = (struct btrfs_inode_ref *)((char *)iref + len);
-                cur += len;
-                ret = iterate(num, found_key->offset, index, p, ctx);
                if (ret)
                        goto out;
                num++;
        }
@@ -998,7 +1015,8 @@ static int get_inode_path(struct send_ctx *sctx, struct btrfs_root *root,
        }
        btrfs_item_key_to_cpu(p->nodes[0], &found_key, p->slots[0]);
        if (found_key.objectid != ino ||
-                found_key.type != BTRFS_INODE_REF_KEY) {
+            (found_key.type != BTRFS_INODE_REF_KEY &&
+             found_key.type != BTRFS_INODE_EXTREF_KEY)) {
                ret = -ENOENT;
                goto out;
        }
@@ -1551,8 +1569,8 @@ static int get_first_ref(struct send_ctx *sctx,
        struct btrfs_key key;
        struct btrfs_key found_key;
        struct btrfs_path *path;
-        struct btrfs_inode_ref *iref;
        int len;
+        u64 parent_dir;
        path = alloc_path_for_send();
        if (!path)
@@ -1568,27 +1586,41 @@ static int get_first_ref(struct send_ctx *sctx,
        if (!ret)
                btrfs_item_key_to_cpu(path->nodes[0], &found_key,
                                path->slots[0]);
-        if (ret || found_key.objectid != key.objectid ||
+        if (ret || found_key.objectid != ino ||
-            found_key.type != key.type) {
+            (found_key.type != BTRFS_INODE_REF_KEY &&
+             found_key.type != BTRFS_INODE_EXTREF_KEY)) {
                ret = -ENOENT;
                goto out;
        }
-        iref = btrfs_item_ptr(path->nodes[0], path->slots[0],
+        if (key.type == BTRFS_INODE_REF_KEY) {
-                        struct btrfs_inode_ref);
+                struct btrfs_inode_ref *iref;
-        len = btrfs_inode_ref_name_len(path->nodes[0], iref);
+                iref = btrfs_item_ptr(path->nodes[0], path->slots[0],
-        ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
+                                      struct btrfs_inode_ref);
-                        (unsigned long)(iref + 1), len);
+                len = btrfs_inode_ref_name_len(path->nodes[0], iref);
+                ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
+                                                     (unsigned long)(iref + 1),
+                                                     len);
+                parent_dir = found_key.offset;
+        } else {
+                struct btrfs_inode_extref *extref;
+                extref = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                        struct btrfs_inode_extref);
+                len = btrfs_inode_extref_name_len(path->nodes[0], extref);
+                ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
+                                        (unsigned long)&extref->name, len);
+                parent_dir = btrfs_inode_extref_parent(path->nodes[0], extref);
+        }
        if (ret < 0)
                goto out;
        btrfs_release_path(path);
-        ret = get_inode_info(root, found_key.offset, NULL, dir_gen, NULL, NULL,
+        ret = get_inode_info(root, parent_dir, NULL, dir_gen, NULL, NULL,
                        NULL, NULL);
        if (ret < 0)
                goto out;
-        *dir = found_key.offset;
+        *dir = parent_dir;
 out:
        btrfs_free_path(path);
@@ -2430,7 +2462,8 @@ verbose_printk("btrfs: send_create_inode %llu\n", ino);
                TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH_LINK, p);
        } else if (S_ISCHR(mode) || S_ISBLK(mode) ||
                   S_ISFIFO(mode) || S_ISSOCK(mode)) {
-                TLV_PUT_U64(sctx, BTRFS_SEND_A_RDEV, rdev);
+                TLV_PUT_U64(sctx, BTRFS_SEND_A_RDEV, new_encode_dev(rdev));
+                TLV_PUT_U64(sctx, BTRFS_SEND_A_MODE, mode);
        }
        ret = send_cmd(sctx);
@@ -3226,7 +3259,8 @@ static int process_all_refs(struct send_ctx *sctx,
                btrfs_item_key_to_cpu(eb, &found_key, slot);
                if (found_key.objectid != key.objectid ||
-                    found_key.type != key.type)
+                    (found_key.type != BTRFS_INODE_REF_KEY &&
+                     found_key.type != BTRFS_INODE_EXTREF_KEY))
                        break;
                ret = iterate_inode_ref(sctx, root, path, &found_key, 0, cb,
@@ -3987,7 +4021,7 @@ static int process_recorded_refs_if_needed(struct send_ctx *sctx, int at_end)
        if (sctx->cur_ino == 0)
                goto out;
        if (!at_end && sctx->cur_ino == sctx->cmp_key->objectid &&
-            sctx->cmp_key->type <= BTRFS_INODE_REF_KEY)
+            sctx->cmp_key->type <= BTRFS_INODE_EXTREF_KEY)
                goto out;
        if (list_empty(&sctx->new_refs) && list_empty(&sctx->deleted_refs))
                goto out;
@@ -4033,22 +4067,21 @@ static int finish_inode_if_needed(struct send_ctx *sctx, int at_end)
        if (ret < 0)
                goto out;
-        if (!S_ISLNK(sctx->cur_inode_mode)) {
+        if (!sctx->parent_root || sctx->cur_inode_new) {
-                if (!sctx->parent_root || sctx->cur_inode_new) {
+                need_chown = 1;
+                if (!S_ISLNK(sctx->cur_inode_mode))
                        need_chmod = 1;
-                        need_chown = 1;
+        } else {
-                } else {
+                ret = get_inode_info(sctx->parent_root, sctx->cur_ino,
-                        ret = get_inode_info(sctx->parent_root, sctx->cur_ino,
+                                NULL, NULL, &right_mode, &right_uid,
-                                        NULL, NULL, &right_mode, &right_uid,
+                                &right_gid, NULL);
-                                        &right_gid, NULL);
+                if (ret < 0)
-                        if (ret < 0)
+                        goto out;
-                                goto out;
-                        if (left_uid != right_uid || left_gid != right_gid)
+                if (left_uid != right_uid || left_gid != right_gid)
-                                need_chown = 1;
+                        need_chown = 1;
-                        if (left_mode != right_mode)
+                if (!S_ISLNK(sctx->cur_inode_mode) && left_mode != right_mode)
-                                need_chmod = 1;
+                        need_chmod = 1;
-                }
        }
        if (S_ISREG(sctx->cur_inode_mode)) {
@@ -4335,7 +4368,8 @@ static int changed_cb(struct btrfs_root *left_root,
        if (key->type == BTRFS_INODE_ITEM_KEY)
                ret = changed_inode(sctx, result);
-        else if (key->type == BTRFS_INODE_REF_KEY)
+        else if (key->type == BTRFS_INODE_REF_KEY ||
+                 key->type == BTRFS_INODE_EXTREF_KEY)
                ret = changed_ref(sctx, result);
        else if (key->type == BTRFS_XATTR_ITEM_KEY)
                ret = changed_xattr(sctx, result);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 77db875b5116..04bbfb1052eb 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1200,7 +1200,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                         dentry->d_name.len * 2);
        parent_inode->i_mtime = parent_inode->i_ctime = CURRENT_TIME;
-        ret = btrfs_update_inode(trans, parent_root, parent_inode);
+        ret = btrfs_update_inode_fallback(trans, parent_root, parent_inode);
        if (ret)
                btrfs_abort_transaction(trans, root, ret);
 fail:
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 029b903a4ae3..0f5ebb72a5ea 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1819,6 +1819,13 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                                    "Failed to relocate sys chunks after "
                                    "device initialization. This can be fixed "
                                    "using the \"btrfs balance\" command.");
+                trans = btrfs_attach_transaction(root);
+                if (IS_ERR(trans)) {
+                        if (PTR_ERR(trans) == -ENOENT)
+                                return 0;
+                        return PTR_ERR(trans);
+                }
+                ret = btrfs_commit_transaction(trans, root);
        }
        return ret;
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 3f152b92a94a..afc2bb691780 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -471,9 +471,19 @@ static int exact_lock(dev_t dev, void *data)
 */
 int cdev_add(struct cdev *p, dev_t dev, unsigned count)
 {
+        int error;
        p->dev = dev;
        p->count = count;
-        return kobj_map(cdev_map, dev, count, NULL, exact_match, exact_lock, p);
+        error = kobj_map(cdev_map, dev, count, NULL,
+                         exact_match, exact_lock, p);
+        if (error)
+                return error;
+        kobject_get(p->kobj.parent);
+        return 0;
 }
 static void cdev_unmap(dev_t dev, unsigned count)
@@ -498,14 +508,20 @@ void cdev_del(struct cdev *p)
 static void cdev_default_release(struct kobject *kobj)
 {
        struct cdev *p = container_of(kobj, struct cdev, kobj);
+        struct kobject *parent = kobj->parent;
        cdev_purge(p);
+        kobject_put(parent);
 }
 static void cdev_dynamic_release(struct kobject *kobj)
 {
        struct cdev *p = container_of(kobj, struct cdev, kobj);
+        struct kobject *parent = kobj->parent;
        cdev_purge(p);
        kfree(p);
+        kobject_put(parent);
 }
 static struct kobj_type ktype_cdev_default = {
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f5054025f9da..4c6285fff598 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
        err  = get_user(palp, &up->palette);
        err |= get_user(length, &up->length);
+        if (err)
+                return -EFAULT;
        up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
        err  = put_user(compat_ptr(palp), &up_native->palette);
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 1b5089067d01..cf1821784a16 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -174,8 +174,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                ext4_free_inodes_set(sb, gdp, 0);
                ext4_itable_unused_set(sb, gdp, 0);
                memset(bh->b_data, 0xff, sb->s_blocksize);
-                ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
+                ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
-                                           EXT4_BLOCKS_PER_GROUP(sb) / 8);
                return;
        }
        memset(bh->b_data, 0, sb->s_blocksize);
@@ -212,8 +211,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
         */
        ext4_mark_bitmap_end(num_clusters_in_group(sb, block_group),
                             sb->s_blocksize * 8, bh->b_data);
-        ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
+        ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
        ext4_group_desc_csum_set(sb, block_group, gdp);
 }
@@ -350,7 +348,7 @@ void ext4_validate_block_bitmap(struct super_block *sb,
                return;
        }
        if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
-                        desc, bh, EXT4_BLOCKS_PER_GROUP(sb) / 8))) {
+                        desc, bh))) {
                ext4_unlock_group(sb, block_group);
                ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
                return;
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
index 5c2d1813ebe9..3285aa5a706a 100644
--- a/fs/ext4/bitmap.c
+++ b/fs/ext4/bitmap.c
@@ -58,11 +58,12 @@ void ext4_inode_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
 int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                  struct ext4_group_desc *gdp,
-                                  struct buffer_head *bh, int sz)
+                                  struct buffer_head *bh)
 {
        __u32 hi;
        __u32 provided, calculated;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
        if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                        EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))
@@ -84,8 +85,9 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
 void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
                                struct ext4_group_desc *gdp,
-                                struct buffer_head *bh, int sz)
+                                struct buffer_head *bh)
 {
+        int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
        __u32 csum;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 3ab2539b7b2e..3c20de1d59d0 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1882,10 +1882,10 @@ int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                  struct buffer_head *bh, int sz);
 void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
                                struct ext4_group_desc *gdp,
-                                struct buffer_head *bh, int sz);
+                                struct buffer_head *bh);
 int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                  struct ext4_group_desc *gdp,
-                                  struct buffer_head *bh, int sz);
+                                  struct buffer_head *bh);
 /* balloc.c */
 extern void ext4_validate_block_bitmap(struct super_block *sb,
@@ -2063,8 +2063,7 @@ extern int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count);
 extern int ext4_calculate_overhead(struct super_block *sb);
 extern int ext4_superblock_csum_verify(struct super_block *sb,
                                       struct ext4_super_block *es);
-extern void ext4_superblock_csum_set(struct super_block *sb,
+extern void ext4_superblock_csum_set(struct super_block *sb);
-                                     struct ext4_super_block *es);
 extern void *ext4_kvmalloc(size_t size, gfp_t flags);
 extern void *ext4_kvzalloc(size_t size, gfp_t flags);
 extern void ext4_kvfree(void *ptr);
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index bfa65b49d424..b4323ba846b5 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -143,17 +143,13 @@ int __ext4_handle_dirty_super(const char *where, unsigned int line,
        struct buffer_head *bh = EXT4_SB(sb)->s_sbh;
        int err = 0;
+        ext4_superblock_csum_set(sb);
        if (ext4_handle_valid(handle)) {
-                ext4_superblock_csum_set(sb,
-                                (struct ext4_super_block *)bh->b_data);
                err = jbd2_journal_dirty_metadata(handle, bh);
                if (err)
                        ext4_journal_abort_handle(where, line, __func__,
                                                  bh, handle, err);
-        } else {
+        } else
-                ext4_superblock_csum_set(sb,
-                                (struct ext4_super_block *)bh->b_data);
                mark_buffer_dirty(bh);
-        }
        return err;
 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 1c94cca35ed1..7011ac967208 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -52,6 +52,9 @@
 #define EXT4_EXT_MARK_UNINIT1   0x2  /* mark first half uninitialized */
 #define EXT4_EXT_MARK_UNINIT2   0x4  /* mark second half uninitialized */
+#define EXT4_EXT_DATA_VALID1    0x8  /* first half contains valid data */
+#define EXT4_EXT_DATA_VALID2    0x10 /* second half contains valid data */
 static __le32 ext4_extent_block_csum(struct inode *inode,
                                     struct ext4_extent_header *eh)
 {
@@ -2914,6 +2917,9 @@ static int ext4_split_extent_at(handle_t *handle,
        unsigned int ee_len, depth;
        int err = 0;
+        BUG_ON((split_flag & (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)) ==
+               (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2));
        ext_debug("ext4_split_extents_at: inode %lu, logical"
                "block %llu\n", inode->i_ino, (unsigned long long)split);
@@ -2972,7 +2978,14 @@ static int ext4_split_extent_at(handle_t *handle,
        err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
        if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
-                err = ext4_ext_zeroout(inode, &orig_ex);
+                if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
+                        if (split_flag & EXT4_EXT_DATA_VALID1)
+                                err = ext4_ext_zeroout(inode, ex2);
+                        else
+                                err = ext4_ext_zeroout(inode, ex);
+                } else
+                        err = ext4_ext_zeroout(inode, &orig_ex);
                if (err)
                        goto fix_extent_len;
                /* update the extent length and mark as initialized */
@@ -3025,12 +3038,13 @@ static int ext4_split_extent(handle_t *handle,
        uninitialized = ext4_ext_is_uninitialized(ex);
        if (map->m_lblk + map->m_len < ee_block + ee_len) {
-                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
+                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT;
-                              EXT4_EXT_MAY_ZEROOUT : 0;
                flags1 = flags | EXT4_GET_BLOCKS_PRE_IO;
                if (uninitialized)
                        split_flag1 |= EXT4_EXT_MARK_UNINIT1 |
                                       EXT4_EXT_MARK_UNINIT2;
+                if (split_flag & EXT4_EXT_DATA_VALID2)
+                        split_flag1 |= EXT4_EXT_DATA_VALID1;
                err = ext4_split_extent_at(handle, inode, path,
                                map->m_lblk + map->m_len, split_flag1, flags1);
                if (err)
@@ -3043,8 +3057,8 @@ static int ext4_split_extent(handle_t *handle,
                return PTR_ERR(path);
        if (map->m_lblk >= ee_block) {
-                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
+                split_flag1 = split_flag & (EXT4_EXT_MAY_ZEROOUT |
-                              EXT4_EXT_MAY_ZEROOUT : 0;
+                                            EXT4_EXT_DATA_VALID2);
                if (uninitialized)
                        split_flag1 |= EXT4_EXT_MARK_UNINIT1;
                if (split_flag & EXT4_EXT_MARK_UNINIT2)
@@ -3323,26 +3337,47 @@ static int ext4_split_unwritten_extents(handle_t *handle,
        split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0;
        split_flag |= EXT4_EXT_MARK_UNINIT2;
+        if (flags & EXT4_GET_BLOCKS_CONVERT)
+                split_flag |= EXT4_EXT_DATA_VALID2;
        flags |= EXT4_GET_BLOCKS_PRE_IO;
        return ext4_split_extent(handle, inode, path, map, split_flag, flags);
 }
 static int ext4_convert_unwritten_extents_endio(handle_t *handle,
-                                              struct inode *inode,
+                                                struct inode *inode,
-                                              struct ext4_ext_path *path)
+                                                struct ext4_map_blocks *map,
+                                                struct ext4_ext_path *path)
 {
        struct ext4_extent *ex;
+        ext4_lblk_t ee_block;
+        unsigned int ee_len;
        int depth;
        int err = 0;
        depth = ext_depth(inode);
        ex = path[depth].p_ext;
+        ee_block = le32_to_cpu(ex->ee_block);
+        ee_len = ext4_ext_get_actual_len(ex);
        ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
                "block %llu, max_blocks %u\n", inode->i_ino,
-                (unsigned long long)le32_to_cpu(ex->ee_block),
+                  (unsigned long long)ee_block, ee_len);
-                ext4_ext_get_actual_len(ex));
+        /* If extent is larger than requested then split is required */
+        if (ee_block != map->m_lblk || ee_len > map->m_len) {
+                err = ext4_split_unwritten_extents(handle, inode, map, path,
+                                                   EXT4_GET_BLOCKS_CONVERT);
+                if (err < 0)
+                        goto out;
+                ext4_ext_drop_refs(path);
+                path = ext4_ext_find_extent(inode, map->m_lblk, path);
+                if (IS_ERR(path)) {
+                        err = PTR_ERR(path);
+                        goto out;
+                }
+                depth = ext_depth(inode);
+                ex = path[depth].p_ext;
+        }
        err = ext4_ext_get_access(handle, inode, path + depth);
        if (err)
@@ -3652,7 +3687,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
        }
        /* IO end_io complete, convert the filled extent to written */
        if ((flags & EXT4_GET_BLOCKS_CONVERT)) {
-                ret = ext4_convert_unwritten_extents_endio(handle, inode,
+                ret = ext4_convert_unwritten_extents_endio(handle, inode, map,
                                                        path);
                if (ret >= 0) {
                        ext4_update_inode_fsync_trans(handle, inode, 1);
@@ -4428,6 +4463,9 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
         */
        if (len <= EXT_UNINIT_MAX_LEN << blkbits)
                flags |= EXT4_GET_BLOCKS_NO_NORMALIZE;
+        /* Prevent race condition between unwritten */
+        ext4_flush_unwritten_io(inode);
 retry:
        while (ret >= 0 && ret < max_blocks) {
                map.m_lblk = map.m_lblk + ret;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index fa36372f3fdf..4facdd29a350 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -762,9 +762,7 @@ got:
                        ext4_free_group_clusters_set(sb, gdp,
                                ext4_free_clusters_after_init(sb, group, gdp));
                        ext4_block_bitmap_csum_set(sb, group, gdp,
-                                                   block_bitmap_bh,
+                                                   block_bitmap_bh);
-                                                   EXT4_BLOCKS_PER_GROUP(sb) /
-                                                   8);
                        ext4_group_desc_csum_set(sb, group, gdp);
                }
                ext4_unlock_group(sb, group);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index f8b27bf80aca..526e55358606 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2805,8 +2805,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
        }
        len = ext4_free_group_clusters(sb, gdp) - ac->ac_b_ex.fe_len;
        ext4_free_group_clusters_set(sb, gdp, len);
-        ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh,
+        ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh);
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
        ext4_group_desc_csum_set(sb, ac->ac_b_ex.fe_group, gdp);
        ext4_unlock_group(sb, ac->ac_b_ex.fe_group);
@@ -4666,8 +4665,7 @@ do_more:
        ret = ext4_free_group_clusters(sb, gdp) + count_clusters;
        ext4_free_group_clusters_set(sb, gdp, ret);
-        ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh,
+        ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh);
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
        ext4_group_desc_csum_set(sb, block_group, gdp);
        ext4_unlock_group(sb, block_group);
        percpu_counter_add(&sbi->s_freeclusters_counter, count_clusters);
@@ -4811,8 +4809,7 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
        mb_free_blocks(NULL, &e4b, bit, count);
        blk_free_count = blocks_freed + ext4_free_group_clusters(sb, desc);
        ext4_free_group_clusters_set(sb, desc, blk_free_count);
-        ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh,
+        ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh);
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
        ext4_group_desc_csum_set(sb, block_group, desc);
        ext4_unlock_group(sb, block_group);
        percpu_counter_add(&sbi->s_freeclusters_counter,
@@ -4993,8 +4990,9 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
        minlen = EXT4_NUM_B2C(EXT4_SB(sb),
                              range->minlen >> sb->s_blocksize_bits);
-        if (unlikely(minlen > EXT4_CLUSTERS_PER_GROUP(sb)) ||
+        if (minlen > EXT4_CLUSTERS_PER_GROUP(sb) ||
-            unlikely(start >= max_blks))
+            start >= max_blks ||
+            range->len < sb->s_blocksize)
                return -EINVAL;
        if (end >= max_blks)
                end = max_blks - 1;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 7a75e1086961..47bf06a2765d 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1212,8 +1212,7 @@ static int ext4_set_bitmap_checksums(struct super_block *sb,
        bh = ext4_get_bitmap(sb, group_data->block_bitmap);
        if (!bh)
                return -EIO;
-        ext4_block_bitmap_csum_set(sb, group, gdp, bh,
+        ext4_block_bitmap_csum_set(sb, group, gdp, bh);
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
        brelse(bh);
        return 0;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 7265a0367476..80928f716850 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -143,9 +143,10 @@ int ext4_superblock_csum_verify(struct super_block *sb,
        return es->s_checksum == ext4_superblock_csum(sb, es);
 }
-void ext4_superblock_csum_set(struct super_block *sb,
+void ext4_superblock_csum_set(struct super_block *sb)
-                              struct ext4_super_block *es)
 {
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
        if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
                EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))
                return;
@@ -1963,7 +1964,7 @@ static int ext4_fill_flex_info(struct super_block *sb)
                sbi->s_log_groups_per_flex = 0;
                return 1;
        }
-        groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+        groups_per_flex = 1U << sbi->s_log_groups_per_flex;
        err = ext4_alloc_flex_bg_array(sb, sbi->s_groups_count);
        if (err)
@@ -4381,7 +4382,7 @@ static int ext4_commit_super(struct super_block *sb, int sync)
                cpu_to_le32(percpu_counter_sum_positive(
                                &EXT4_SB(sb)->s_freeinodes_counter));
        BUFFER_TRACE(sbh, "marking dirty");
-        ext4_superblock_csum_set(sb, es);
+        ext4_superblock_csum_set(sb);
        mark_buffer_dirty(sbh);
        if (sync) {
                error = sync_dirty_buffer(sbh);
diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c
index 9947563e4175..dfcd50304559 100644
--- a/fs/jfs/jfs_discard.c
+++ b/fs/jfs/jfs_discard.c
@@ -83,7 +83,7 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
        struct bmap *bmp = JFS_SBI(ip->i_sb)->bmap;
        struct super_block *sb = ipbmap->i_sb;
        int agno, agno_end;
-        s64 start, end, minlen;
+        u64 start, end, minlen;
        u64 trimmed = 0;
        /**
@@ -93,15 +93,19 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
         * minlen:      minimum extent length in Bytes
         */
        start = range->start >> sb->s_blocksize_bits;
-        if (start < 0)
-                start = 0;
        end = start + (range->len >> sb->s_blocksize_bits) - 1;
-        if (end >= bmp->db_mapsize)
-                end = bmp->db_mapsize - 1;
        minlen = range->minlen >> sb->s_blocksize_bits;
-        if (minlen <= 0)
+        if (minlen == 0)
                minlen = 1;
+        if (minlen > bmp->db_agsize ||
+            start >= bmp->db_mapsize ||
+            range->len < sb->s_blocksize)
+                return -EINVAL;
+        if (end >= bmp->db_mapsize)
+                end = bmp->db_mapsize - 1;
        /**
         * we trim all ag's within the range
         */
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index e4fb3ba5a58a..3d7e09bcc0e9 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -85,29 +85,38 @@ static struct rpc_clnt *nsm_create(struct net *net)
        return rpc_create(&args);
 }
+static struct rpc_clnt *nsm_client_set(struct lockd_net *ln,
+                struct rpc_clnt *clnt)
+{
+        spin_lock(&ln->nsm_clnt_lock);
+        if (ln->nsm_users == 0) {
+                if (clnt == NULL)
+                        goto out;
+                ln->nsm_clnt = clnt;
+        }
+        clnt = ln->nsm_clnt;
+        ln->nsm_users++;
+out:
+        spin_unlock(&ln->nsm_clnt_lock);
+        return clnt;
+}
 static struct rpc_clnt *nsm_client_get(struct net *net)
 {
-        static DEFINE_MUTEX(nsm_create_mutex);
+        struct rpc_clnt *clnt, *new;
-        struct rpc_clnt *clnt;
        struct lockd_net *ln = net_generic(net, lockd_net_id);
-        spin_lock(&ln->nsm_clnt_lock);
+        clnt = nsm_client_set(ln, NULL);
-        if (ln->nsm_users) {
+        if (clnt != NULL)
-                ln->nsm_users++;
-                clnt = ln->nsm_clnt;
-                spin_unlock(&ln->nsm_clnt_lock);
                goto out;
-        }
-        spin_unlock(&ln->nsm_clnt_lock);
-        mutex_lock(&nsm_create_mutex);
+        clnt = new = nsm_create(net);
-        clnt = nsm_create(net);
+        if (IS_ERR(clnt))
-        if (!IS_ERR(clnt)) {
+                goto out;
-                ln->nsm_clnt = clnt;
-                smp_wmb();
+        clnt = nsm_client_set(ln, new);
-                ln->nsm_users = 1;
+        if (clnt != new)
-        }
+                rpc_shutdown_client(new);
-        mutex_unlock(&nsm_create_mutex);
 out:
        return clnt;
 }
@@ -115,18 +124,16 @@ out:
 static void nsm_client_put(struct net *net)
 {
        struct lockd_net *ln = net_generic(net, lockd_net_id);
-        struct rpc_clnt *clnt = ln->nsm_clnt;
+        struct rpc_clnt *clnt = NULL;
-        int shutdown = 0;
        spin_lock(&ln->nsm_clnt_lock);
-        if (ln->nsm_users) {
+        ln->nsm_users--;
-                if (--ln->nsm_users)
+        if (ln->nsm_users == 0) {
-                        ln->nsm_clnt = NULL;
+                clnt = ln->nsm_clnt;
-                shutdown = !ln->nsm_users;
+                ln->nsm_clnt = NULL;
        }
        spin_unlock(&ln->nsm_clnt_lock);
+        if (clnt != NULL)
-        if (shutdown)
                rpc_shutdown_client(clnt);
 }
diff --git a/fs/namei.c b/fs/namei.c
index d1895f308156..937f9d50c84b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -705,8 +705,8 @@ static inline void put_link(struct nameidata *nd, struct path *link, void *cooki
        path_put(link);
 }
-int sysctl_protected_symlinks __read_mostly = 1;
+int sysctl_protected_symlinks __read_mostly = 0;
-int sysctl_protected_hardlinks __read_mostly = 1;
+int sysctl_protected_hardlinks __read_mostly = 0;
 /**
 * may_follow_link - Check symlink following for unsafe situations
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 9a521fb39869..5088b57b078a 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -241,7 +241,7 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
                svc_exit_thread(cb_info->rqst);
                cb_info->rqst = NULL;
                cb_info->task = NULL;
-                return PTR_ERR(cb_info->task);
+                return ret;
        }
        dprintk("nfs_callback_up: service started\n");
        return 0;
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 52d847212066..2e45fd9c02a3 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -122,12 +122,21 @@ static void filelayout_reset_read(struct nfs_read_data *data)
        }
 }
+static void filelayout_fenceme(struct inode *inode, struct pnfs_layout_hdr *lo)
+{
+        if (!test_and_clear_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                return;
+        clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
+        pnfs_return_layout(inode);
+}
 static int filelayout_async_handle_error(struct rpc_task *task,
                                         struct nfs4_state *state,
                                         struct nfs_client *clp,
                                         struct pnfs_layout_segment *lseg)
 {
-        struct inode *inode = lseg->pls_layout->plh_inode;
+        struct pnfs_layout_hdr *lo = lseg->pls_layout;
+        struct inode *inode = lo->plh_inode;
        struct nfs_server *mds_server = NFS_SERVER(inode);
        struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
        struct nfs_client *mds_client = mds_server->nfs_client;
@@ -204,10 +213,8 @@ static int filelayout_async_handle_error(struct rpc_task *task,
                dprintk("%s DS connection error %d\n", __func__,
                        task->tk_status);
                nfs4_mark_deviceid_unavailable(devid);
-                clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
+                set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
-                _pnfs_return_layout(inode);
                rpc_wake_up(&tbl->slot_tbl_waitq);
-                nfs4_ds_disconnect(clp);
                /* fall through */
        default:
 reset:
@@ -331,7 +338,9 @@ static void filelayout_read_count_stats(struct rpc_task *task, void *data)
 static void filelayout_read_release(void *data)
 {
        struct nfs_read_data *rdata = data;
+        struct pnfs_layout_hdr *lo = rdata->header->lseg->pls_layout;
+        filelayout_fenceme(lo->plh_inode, lo);
        nfs_put_client(rdata->ds_clp);
        rdata->header->mds_ops->rpc_release(data);
 }
@@ -429,7 +438,9 @@ static void filelayout_write_count_stats(struct rpc_task *task, void *data)
 static void filelayout_write_release(void *data)
 {
        struct nfs_write_data *wdata = data;
+        struct pnfs_layout_hdr *lo = wdata->header->lseg->pls_layout;
+        filelayout_fenceme(lo->plh_inode, lo);
        nfs_put_client(wdata->ds_clp);
        wdata->header->mds_ops->rpc_release(data);
 }
@@ -739,7 +750,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                goto out_err;
        if (fl->num_fh > 0) {
-                fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+                fl->fh_array = kcalloc(fl->num_fh, sizeof(fl->fh_array[0]),
                                       gfp_flags);
                if (!fl->fh_array)
                        goto out_err;
diff --git a/fs/nfs/nfs4filelayout.h b/fs/nfs/nfs4filelayout.h
index dca47d786710..8c07241fe52b 100644
--- a/fs/nfs/nfs4filelayout.h
+++ b/fs/nfs/nfs4filelayout.h
@@ -149,6 +149,5 @@ extern void nfs4_fl_put_deviceid(struct nfs4_file_layout_dsaddr *dsaddr);
 extern void nfs4_fl_free_deviceid(struct nfs4_file_layout_dsaddr *dsaddr);
 struct nfs4_file_layout_dsaddr *
 filelayout_get_device_info(struct inode *inode, struct nfs4_deviceid *dev_id, gfp_t gfp_flags);
-void nfs4_ds_disconnect(struct nfs_client *clp);
 #endif /* FS_NFS_NFS4FILELAYOUT_H */
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 3336d5eaf879..a8eaa9b7bb0f 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -149,28 +149,6 @@ _data_server_lookup_locked(const struct list_head *dsaddrs)
 }
 /*
- * Lookup DS by nfs_client pointer. Zero data server client pointer
- */
-void nfs4_ds_disconnect(struct nfs_client *clp)
-{
-        struct nfs4_pnfs_ds *ds;
-        struct nfs_client *found = NULL;
-        dprintk("%s clp %p\n", __func__, clp);
-        spin_lock(&nfs4_ds_cache_lock);
-        list_for_each_entry(ds, &nfs4_data_server_cache, ds_node)
-                if (ds->ds_clp && ds->ds_clp == clp) {
-                        found = ds->ds_clp;
-                        ds->ds_clp = NULL;
-                }
-        spin_unlock(&nfs4_ds_cache_lock);
-        if (found) {
-                set_bit(NFS_CS_STOP_RENEW, &clp->cl_res_state);
-                nfs_put_client(clp);
-        }
-}
-/*
 * Create an rpc connection to the nfs4_pnfs_ds data server
 * Currently only supports IPv4 and IPv6 addresses
 */
diff --git a/fs/nfs/nfs4getroot.c b/fs/nfs/nfs4getroot.c
index 6a83780e0ce6..549462e5b9b0 100644
--- a/fs/nfs/nfs4getroot.c
+++ b/fs/nfs/nfs4getroot.c
@@ -5,6 +5,7 @@
 #include <linux/nfs_fs.h>
 #include "nfs4_fs.h"
+#include "internal.h"
 #define NFSDBG_FACILITY         NFSDBG_CLIENT
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index be731e6b7b9c..c6f990656f89 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -369,7 +369,7 @@ void objio_free_result(struct objlayout_io_res *oir)
        kfree(objios);
 }
-enum pnfs_osd_errno osd_pri_2_pnfs_err(enum osd_err_priority oep)
+static enum pnfs_osd_errno osd_pri_2_pnfs_err(enum osd_err_priority oep)
 {
        switch (oep) {
        case OSD_ERR_PRI_NO_ERROR:
@@ -574,7 +574,7 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
                        (unsigned long)pgio->pg_layout_private;
 }
-void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+static void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
        pnfs_generic_pg_init_read(pgio, req);
        if (unlikely(pgio->pg_lseg == NULL))
@@ -604,7 +604,7 @@ static bool aligned_on_raid_stripe(u64 offset, struct ore_layout *layout,
        return false;
 }
-void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+static void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
        unsigned long stripe_end = 0;
        u64 wb_size;
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 2d722dba1111..dbf7bba52da0 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -62,6 +62,7 @@ enum {
        NFS_LAYOUT_RW_FAILED,           /* get rw layout failed stop trying */
        NFS_LAYOUT_BULK_RECALL,         /* bulk recall affecting layout */
        NFS_LAYOUT_ROC,                 /* some lseg had roc bit set */
+        NFS_LAYOUT_RETURN,              /* Return this layout ASAP */
 };
 enum layoutdriver_policy_flags {
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 64c3b3172367..e296572c73ed 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -45,10 +45,13 @@ static cputime64_t get_iowait_time(int cpu)
 static u64 get_idle_time(int cpu)
 {
-        u64 idle, idle_time = get_cpu_idle_time_us(cpu, NULL);
+        u64 idle, idle_time = -1ULL;
+        if (cpu_online(cpu))
+                idle_time = get_cpu_idle_time_us(cpu, NULL);
        if (idle_time == -1ULL)
-                /* !NO_HZ so we can rely on cpustat.idle */
+                /* !NO_HZ or cpu offline so we can rely on cpustat.idle */
                idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
        else
                idle = usecs_to_cputime64(idle_time);
@@ -58,10 +61,13 @@ static u64 get_idle_time(int cpu)
 static u64 get_iowait_time(int cpu)
 {
-        u64 iowait, iowait_time = get_cpu_iowait_time_us(cpu, NULL);
+        u64 iowait, iowait_time = -1ULL;
+        if (cpu_online(cpu))
+                iowait_time = get_cpu_iowait_time_us(cpu, NULL);
        if (iowait_time == -1ULL)
-                /* !NO_HZ so we can rely on cpustat.iowait */
+                /* !NO_HZ or cpu offline so we can rely on cpustat.iowait */
                iowait = kcpustat_cpu(cpu).cpustat[CPUTIME_IOWAIT];
        else
                iowait = usecs_to_cputime64(iowait_time);
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index c78bb997e2c6..af1cbaf535ed 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -205,6 +205,8 @@
        {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x678A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6790, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6791, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6792, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6798, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6799, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x679A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
@@ -217,6 +219,7 @@
        {0x1002, 0x6808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6810, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6811, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6816, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6817, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6818, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 569d67d4243e..d452ee191066 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -57,6 +57,7 @@ int memblock_add(phys_addr_t base, phys_addr_t size);
 int memblock_remove(phys_addr_t base, phys_addr_t size);
 int memblock_free(phys_addr_t base, phys_addr_t size);
 int memblock_reserve(phys_addr_t base, phys_addr_t size);
+void memblock_trim_memory(phys_addr_t align);
 #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
 void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 2e902359aee5..6bfb2faa0b19 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -803,12 +803,16 @@ static inline void perf_event_task_tick(void)				{ }
 do {                                                                    \
        static struct notifier_block fn##_nb __cpuinitdata =            \
                { .notifier_call = fn, .priority = CPU_PRI_PERF };      \
+        unsigned long cpu = smp_processor_id();                         \
+        unsigned long flags;                                            \
        fn(&fn##_nb, (unsigned long)CPU_UP_PREPARE,                     \
-                (void *)(unsigned long)smp_processor_id());             \
+                (void *)(unsigned long)cpu);                            \
+        local_irq_save(flags);                                          \
        fn(&fn##_nb, (unsigned long)CPU_STARTING,                       \
-                (void *)(unsigned long)smp_processor_id());             \
+                (void *)(unsigned long)cpu);                            \
+        local_irq_restore(flags);                                       \
        fn(&fn##_nb, (unsigned long)CPU_ONLINE,                         \
-                (void *)(unsigned long)smp_processor_id());             \
+                (void *)(unsigned long)cpu);                            \
        register_cpu_notifier(&fn##_nb);                                \
 } while (0)
diff --git a/include/linux/rbtree_augmented.h b/include/linux/rbtree_augmented.h
index 214caa33433b..2ac60c9cf644 100644
--- a/include/linux/rbtree_augmented.h
+++ b/include/linux/rbtree_augmented.h
@@ -24,6 +24,7 @@
 #ifndef _LINUX_RBTREE_AUGMENTED_H
 #define _LINUX_RBTREE_AUGMENTED_H
+#include <linux/compiler.h>
 #include <linux/rbtree.h>
 /*
diff --git a/include/linux/spi/tsc2005.h b/include/linux/spi/tsc2005.h
index d9b0c84220c7..8f721e465e05 100644
--- a/include/linux/spi/tsc2005.h
+++ b/include/linux/spi/tsc2005.h
@@ -3,8 +3,6 @@
 *
 * Copyright (C) 2009-2010 Nokia Corporation
 *
- * Contact: Aaro Koskinen <aaro.koskinen@nokia.com>
- *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index e6f0331e3d45..24594571c5a3 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -35,16 +35,6 @@ struct inode;
 # include <asm/uprobes.h>
 #endif
-/* flags that denote/change uprobes behaviour */
-/* Have a copy of original instruction */
-#define UPROBE_COPY_INSN        0x1
-/* Dont run handlers when first register/ last unregister in progress*/
-#define UPROBE_RUN_HANDLER      0x2
-/* Can skip singlestep */
-#define UPROBE_SKIP_SSTEP       0x4
 struct uprobe_consumer {
        int (*handler)(struct uprobe_consumer *self, struct pt_regs *regs);
        /*
@@ -59,7 +49,6 @@ struct uprobe_consumer {
 #ifdef CONFIG_UPROBES
 enum uprobe_task_state {
        UTASK_RUNNING,
-        UTASK_BP_HIT,
        UTASK_SSTEP,
        UTASK_SSTEP_ACK,
        UTASK_SSTEP_TRAPPED,
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index aecee9d112cb..694dcaf266e6 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -170,7 +170,7 @@ gnttab_set_unmap_op(struct gnttab_unmap_grant_ref *unmap, phys_addr_t addr,
        unmap->dev_bus_addr = 0;
 }
-int arch_gnttab_map_shared(unsigned long *frames, unsigned long nr_gframes,
+int arch_gnttab_map_shared(xen_pfn_t *frames, unsigned long nr_gframes,
                           unsigned long max_nr_gframes,
                           void **__shared);
 int arch_gnttab_map_status(uint64_t *frames, unsigned long nr_gframes,
diff --git a/include/xen/interface/grant_table.h b/include/xen/interface/grant_table.h
index f9f8b975ae74..e40fae9bf11a 100644
--- a/include/xen/interface/grant_table.h
+++ b/include/xen/interface/grant_table.h
@@ -310,7 +310,7 @@ struct gnttab_setup_table {
    uint32_t nr_frames;
    /* OUT parameters. */
    int16_t  status;              /* GNTST_* */
-    GUEST_HANDLE(ulong) frame_list;
+    GUEST_HANDLE(xen_pfn_t) frame_list;
 };
 DEFINE_GUEST_HANDLE_STRUCT(gnttab_setup_table);
diff --git a/include/xen/interface/memory.h b/include/xen/interface/memory.h
index b66d04ce6957..90712e2072d5 100644
--- a/include/xen/interface/memory.h
+++ b/include/xen/interface/memory.h
@@ -179,28 +179,8 @@ struct xen_add_to_physmap {
 };
 DEFINE_GUEST_HANDLE_STRUCT(xen_add_to_physmap);
-/*
+/*** REMOVED ***/
- * Translates a list of domain-specific GPFNs into MFNs. Returns a -ve error
+/*#define XENMEM_translate_gpfn_list  8*/
- * code on failure. This call only works for auto-translated guests.
- */
-#define XENMEM_translate_gpfn_list  8
-struct xen_translate_gpfn_list {
-    /* Which domain to translate for? */
-    domid_t domid;
-    /* Length of list. */
-    xen_ulong_t nr_gpfns;
-    /* List of GPFNs to translate. */
-    GUEST_HANDLE(ulong) gpfn_list;
-    /*
-     * Output list to contain MFN translations. May be the same as the input
-     * list (in which case each input GPFN is overwritten with the output MFN).
-     */
-    GUEST_HANDLE(ulong) mfn_list;
-};
-DEFINE_GUEST_HANDLE_STRUCT(xen_translate_gpfn_list);
 /*
 * Returns the pseudo-physical memory map as it was when the domain
diff --git a/kernel/Makefile b/kernel/Makefile
index 0dfeca4324ee..86e3285ae7e5 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -174,10 +174,8 @@ signing_key.priv signing_key.x509: x509.genkey
        @echo "###"
        @echo "### If this takes a long time, you might wish to run rngd in the"
        @echo "### background to keep the supply of entropy topped up.  It"
-        @echo "### needs to be run as root, and should use a hardware random"
+        @echo "### needs to be run as root, and uses a hardware random"
-        @echo "### number generator if one is available, eg:"
+        @echo "### number generator if one is available."
-        @echo "###"
-        @echo "###     rngd -r /dev/hwrandom"
        @echo "###"
        openssl req -new -nodes -utf8 $(sign_key_with_hash) -days 36500 -batch \
                -x509 -config x509.genkey \
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 13774b3b39aa..f24f724620dd 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1962,9 +1962,8 @@ static void cgroup_task_migrate(struct cgroup *cgrp, struct cgroup *oldcgrp,
         * trading it for newcg is protected by cgroup_mutex, we're safe to drop
         * it here; it will be freed under RCU.
         */
-        put_css_set(oldcg);
        set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
+        put_css_set(oldcg);
 }
 /**
@@ -4815,31 +4814,20 @@ static const struct file_operations proc_cgroupstats_operations = {
 *
 * A pointer to the shared css_set was automatically copied in
 * fork.c by dup_task_struct().  However, we ignore that copy, since
- * it was not made under the protection of RCU, cgroup_mutex or
+ * it was not made under the protection of RCU or cgroup_mutex, so
- * threadgroup_change_begin(), so it might no longer be a valid
+ * might no longer be a valid cgroup pointer.  cgroup_attach_task() might
- * cgroup pointer.  cgroup_attach_task() might have already changed
+ * have already changed current->cgroups, allowing the previously
- * current->cgroups, allowing the previously referenced cgroup
+ * referenced cgroup group to be removed and freed.
- * group to be removed and freed.
- *
- * Outside the pointer validity we also need to process the css_set
- * inheritance between threadgoup_change_begin() and
- * threadgoup_change_end(), this way there is no leak in any process
- * wide migration performed by cgroup_attach_proc() that could otherwise
- * miss a thread because it is too early or too late in the fork stage.
 *
 * At the point that cgroup_fork() is called, 'current' is the parent
 * task, and the passed argument 'child' points to the child task.
 */
 void cgroup_fork(struct task_struct *child)
 {
-        /*
+        task_lock(current);
-         * We don't need to task_lock() current because current->cgroups
-         * can't be changed concurrently here. The parent obviously hasn't
-         * exited and called cgroup_exit(), and we are synchronized against
-         * cgroup migration through threadgroup_change_begin().
-         */
        child->cgroups = current->cgroups;
        get_css_set(child->cgroups);
+        task_unlock(current);
        INIT_LIST_HEAD(&child->cg_list);
 }
@@ -4895,19 +4883,10 @@ void cgroup_post_fork(struct task_struct *child)
         */
        if (use_task_css_set_links) {
                write_lock(&css_set_lock);
-                if (list_empty(&child->cg_list)) {
+                task_lock(child);
-                        /*
+                if (list_empty(&child->cg_list))
-                         * It's safe to use child->cgroups without task_lock()
-                         * here because we are protected through
-                         * threadgroup_change_begin() against concurrent
-                         * css_set change in cgroup_task_migrate(). Also
-                         * the task can't exit at that point until
-                         * wake_up_new_task() is called, so we are protected
-                         * against cgroup_exit() setting child->cgroup to
-                         * init_css_set.
-                         */
                        list_add(&child->cg_list, &child->cgroups->tasks);
-                }
+                task_unlock(child);
                write_unlock(&css_set_lock);
        }
 }
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 98256bc71ee1..5cc4e7e42e68 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -78,15 +78,23 @@ static struct mutex uprobes_mmap_mutex[UPROBES_HASH_SZ];
 */
 static atomic_t uprobe_events = ATOMIC_INIT(0);
+/* Have a copy of original instruction */
+#define UPROBE_COPY_INSN        0
+/* Dont run handlers when first register/ last unregister in progress*/
+#define UPROBE_RUN_HANDLER      1
+/* Can skip singlestep */
+#define UPROBE_SKIP_SSTEP       2
 struct uprobe {
        struct rb_node          rb_node;        /* node in the rb tree */
        atomic_t                ref;
        struct rw_semaphore     consumer_rwsem;
+        struct mutex            copy_mutex;     /* TODO: kill me and UPROBE_COPY_INSN */
        struct list_head        pending_list;
        struct uprobe_consumer  *consumers;
        struct inode            *inode;         /* Also hold a ref to inode */
        loff_t                  offset;
-        int                     flags;
+        unsigned long           flags;
        struct arch_uprobe      arch;
 };
@@ -100,17 +108,12 @@ struct uprobe {
 */
 static bool valid_vma(struct vm_area_struct *vma, bool is_register)
 {
-        if (!vma->vm_file)
+        vm_flags_t flags = VM_HUGETLB | VM_MAYEXEC | VM_SHARED;
-                return false;
-        if (!is_register)
-                return true;
-        if ((vma->vm_flags & (VM_HUGETLB|VM_READ|VM_WRITE|VM_EXEC|VM_SHARED))
+        if (is_register)
-                                == (VM_READ|VM_EXEC))
+                flags |= VM_WRITE;
-                return true;
-        return false;
+        return vma->vm_file && (vma->vm_flags & flags) == VM_MAYEXEC;
 }
 static unsigned long offset_to_vaddr(struct vm_area_struct *vma, loff_t offset)
@@ -193,19 +196,44 @@ bool __weak is_swbp_insn(uprobe_opcode_t *insn)
        return *insn == UPROBE_SWBP_INSN;
 }
+static void copy_opcode(struct page *page, unsigned long vaddr, uprobe_opcode_t *opcode)
+{
+        void *kaddr = kmap_atomic(page);
+        memcpy(opcode, kaddr + (vaddr & ~PAGE_MASK), UPROBE_SWBP_INSN_SIZE);
+        kunmap_atomic(kaddr);
+}
+static int verify_opcode(struct page *page, unsigned long vaddr, uprobe_opcode_t *new_opcode)
+{
+        uprobe_opcode_t old_opcode;
+        bool is_swbp;
+        copy_opcode(page, vaddr, &old_opcode);
+        is_swbp = is_swbp_insn(&old_opcode);
+        if (is_swbp_insn(new_opcode)) {
+                if (is_swbp)            /* register: already installed? */
+                        return 0;
+        } else {
+                if (!is_swbp)           /* unregister: was it changed by us? */
+                        return 0;
+        }
+        return 1;
+}
 /*
 * NOTE:
 * Expect the breakpoint instruction to be the smallest size instruction for
 * the architecture. If an arch has variable length instruction and the
 * breakpoint instruction is not of the smallest length instruction
- * supported by that architecture then we need to modify read_opcode /
+ * supported by that architecture then we need to modify is_swbp_at_addr and
 * write_opcode accordingly. This would never be a problem for archs that
 * have fixed length instructions.
 */
 /*
 * write_opcode - write the opcode at a given virtual address.
- * @auprobe: arch breakpointing information.
 * @mm: the probed process address space.
 * @vaddr: the virtual address to store the opcode.
 * @opcode: opcode to be written at @vaddr.
@@ -216,8 +244,8 @@ bool __weak is_swbp_insn(uprobe_opcode_t *insn)
 * For mm @mm, write the opcode at @vaddr.
 * Return 0 (success) or a negative errno.
 */
-static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
+static int write_opcode(struct mm_struct *mm, unsigned long vaddr,
-                        unsigned long vaddr, uprobe_opcode_t opcode)
+                        uprobe_opcode_t opcode)
 {
        struct page *old_page, *new_page;
        void *vaddr_old, *vaddr_new;
@@ -226,10 +254,14 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
 retry:
        /* Read the page with vaddr into memory */
-        ret = get_user_pages(NULL, mm, vaddr, 1, 0, 0, &old_page, &vma);
+        ret = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &old_page, &vma);
        if (ret <= 0)
                return ret;
+        ret = verify_opcode(old_page, vaddr, &opcode);
+        if (ret <= 0)
+                goto put_old;
        ret = -ENOMEM;
        new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, vaddr);
        if (!new_page)
@@ -264,63 +296,6 @@ put_old:
 }
 /**
- * read_opcode - read the opcode at a given virtual address.
- * @mm: the probed process address space.
- * @vaddr: the virtual address to read the opcode.
- * @opcode: location to store the read opcode.
- *
- * Called with mm->mmap_sem held (for read and with a reference to
- * mm.
- *
- * For mm @mm, read the opcode at @vaddr and store it in @opcode.
- * Return 0 (success) or a negative errno.
- */
-static int read_opcode(struct mm_struct *mm, unsigned long vaddr, uprobe_opcode_t *opcode)
-{
-        struct page *page;
-        void *vaddr_new;
-        int ret;
-        ret = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &page, NULL);
-        if (ret <= 0)
-                return ret;
-        vaddr_new = kmap_atomic(page);
-        vaddr &= ~PAGE_MASK;
-        memcpy(opcode, vaddr_new + vaddr, UPROBE_SWBP_INSN_SIZE);
-        kunmap_atomic(vaddr_new);
-        put_page(page);
-        return 0;
-}
-static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
-{
-        uprobe_opcode_t opcode;
-        int result;
-        if (current->mm == mm) {
-                pagefault_disable();
-                result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
-                                                                sizeof(opcode));
-                pagefault_enable();
-                if (likely(result == 0))
-                        goto out;
-        }
-        result = read_opcode(mm, vaddr, &opcode);
-        if (result)
-                return result;
-out:
-        if (is_swbp_insn(&opcode))
-                return 1;
-        return 0;
-}
-/**
 * set_swbp - store breakpoint at a given address.
 * @auprobe: arch specific probepoint information.
 * @mm: the probed process address space.
@@ -331,18 +306,7 @@ out:
 */
 int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long vaddr)
 {
-        int result;
+        return write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
-        /*
-         * See the comment near uprobes_hash().
-         */
-        result = is_swbp_at_addr(mm, vaddr);
-        if (result == 1)
-                return 0;
-        if (result)
-                return result;
-        return write_opcode(auprobe, mm, vaddr, UPROBE_SWBP_INSN);
 }
 /**
@@ -357,16 +321,7 @@ int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned
 int __weak
 set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long vaddr)
 {
-        int result;
+        return write_opcode(mm, vaddr, *(uprobe_opcode_t *)auprobe->insn);
-        result = is_swbp_at_addr(mm, vaddr);
-        if (!result)
-                return -EINVAL;
-        if (result != 1)
-                return result;
-        return write_opcode(auprobe, mm, vaddr, *(uprobe_opcode_t *)auprobe->insn);
 }
 static int match_uprobe(struct uprobe *l, struct uprobe *r)
@@ -473,7 +428,7 @@ static struct uprobe *insert_uprobe(struct uprobe *uprobe)
        spin_unlock(&uprobes_treelock);
        /* For now assume that the instruction need not be single-stepped */
-        uprobe->flags |= UPROBE_SKIP_SSTEP;
+        __set_bit(UPROBE_SKIP_SSTEP, &uprobe->flags);
        return u;
 }
@@ -495,6 +450,7 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
        uprobe->inode = igrab(inode);
        uprobe->offset = offset;
        init_rwsem(&uprobe->consumer_rwsem);
+        mutex_init(&uprobe->copy_mutex);
        /* add to uprobes_tree, sorted on inode:offset */
        cur_uprobe = insert_uprobe(uprobe);
@@ -515,7 +471,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs)
 {
        struct uprobe_consumer *uc;
-        if (!(uprobe->flags & UPROBE_RUN_HANDLER))
+        if (!test_bit(UPROBE_RUN_HANDLER, &uprobe->flags))
                return;
        down_read(&uprobe->consumer_rwsem);
@@ -621,29 +577,43 @@ static int copy_insn(struct uprobe *uprobe, struct file *filp)
        return __copy_insn(mapping, filp, uprobe->arch.insn, bytes, uprobe->offset);
 }
-/*
+static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
- * How mm->uprobes_state.count gets updated
+                                struct mm_struct *mm, unsigned long vaddr)
- * uprobe_mmap() increments the count if
+{
- *      - it successfully adds a breakpoint.
+        int ret = 0;
- *      - it cannot add a breakpoint, but sees that there is a underlying
- *        breakpoint (via a is_swbp_at_addr()).
+        if (test_bit(UPROBE_COPY_INSN, &uprobe->flags))
- *
+                return ret;
- * uprobe_munmap() decrements the count if
- *      - it sees a underlying breakpoint, (via is_swbp_at_addr)
+        mutex_lock(&uprobe->copy_mutex);
- *        (Subsequent uprobe_unregister wouldnt find the breakpoint
+        if (test_bit(UPROBE_COPY_INSN, &uprobe->flags))
- *        unless a uprobe_mmap kicks in, since the old vma would be
+                goto out;
- *        dropped just after uprobe_munmap.)
- *
+        ret = copy_insn(uprobe, file);
- * uprobe_register increments the count if:
+        if (ret)
- *      - it successfully adds a breakpoint.
+                goto out;
- *
- * uprobe_unregister decrements the count if:
+        ret = -ENOTSUPP;
- *      - it sees a underlying breakpoint and removes successfully.
+        if (is_swbp_insn((uprobe_opcode_t *)uprobe->arch.insn))
- *        (via is_swbp_at_addr)
+                goto out;
- *        (Subsequent uprobe_munmap wouldnt find the breakpoint
- *        since there is no underlying breakpoint after the
+        ret = arch_uprobe_analyze_insn(&uprobe->arch, mm, vaddr);
- *        breakpoint removal.)
+        if (ret)
- */
+                goto out;
+        /* write_opcode() assumes we don't cross page boundary */
+        BUG_ON((uprobe->offset & ~PAGE_MASK) +
+                        UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+        smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
+        set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+ out:
+        mutex_unlock(&uprobe->copy_mutex);
+        return ret;
+}
 static int
 install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
                        struct vm_area_struct *vma, unsigned long vaddr)
@@ -661,24 +631,9 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
        if (!uprobe->consumers)
                return 0;
-        if (!(uprobe->flags & UPROBE_COPY_INSN)) {
+        ret = prepare_uprobe(uprobe, vma->vm_file, mm, vaddr);
-                ret = copy_insn(uprobe, vma->vm_file);
+        if (ret)
-                if (ret)
+                return ret;
-                        return ret;
-                if (is_swbp_insn((uprobe_opcode_t *)uprobe->arch.insn))
-                        return -ENOTSUPP;
-                ret = arch_uprobe_analyze_insn(&uprobe->arch, mm, vaddr);
-                if (ret)
-                        return ret;
-                /* write_opcode() assumes we don't cross page boundary */
-                BUG_ON((uprobe->offset & ~PAGE_MASK) +
-                                UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
-                uprobe->flags |= UPROBE_COPY_INSN;
-        }
        /*
         * set MMF_HAS_UPROBES in advance for uprobe_pre_sstep_notifier(),
@@ -697,15 +652,15 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
        return ret;
 }
-static void
+static int
 remove_breakpoint(struct uprobe *uprobe, struct mm_struct *mm, unsigned long vaddr)
 {
        /* can happen if uprobe_register() fails */
        if (!test_bit(MMF_HAS_UPROBES, &mm->flags))
-                return;
+                return 0;
        set_bit(MMF_RECALC_UPROBES, &mm->flags);
-        set_orig_insn(&uprobe->arch, mm, vaddr);
+        return set_orig_insn(&uprobe->arch, mm, vaddr);
 }
 /*
@@ -820,7 +775,7 @@ static int register_for_each_vma(struct uprobe *uprobe, bool is_register)
                struct mm_struct *mm = info->mm;
                struct vm_area_struct *vma;
-                if (err)
+                if (err && is_register)
                        goto free;
                down_write(&mm->mmap_sem);
@@ -836,7 +791,7 @@ static int register_for_each_vma(struct uprobe *uprobe, bool is_register)
                if (is_register)
                        err = install_breakpoint(uprobe, mm, vma, info->vaddr);
                else
-                        remove_breakpoint(uprobe, mm, info->vaddr);
+                        err |= remove_breakpoint(uprobe, mm, info->vaddr);
 unlock:
                up_write(&mm->mmap_sem);
@@ -893,13 +848,15 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *
        mutex_lock(uprobes_hash(inode));
        uprobe = alloc_uprobe(inode, offset);
-        if (uprobe && !consumer_add(uprobe, uc)) {
+        if (!uprobe) {
+                ret = -ENOMEM;
+        } else if (!consumer_add(uprobe, uc)) {
                ret = __uprobe_register(uprobe);
                if (ret) {
                        uprobe->consumers = NULL;
                        __uprobe_unregister(uprobe);
                } else {
-                        uprobe->flags |= UPROBE_RUN_HANDLER;
+                        set_bit(UPROBE_RUN_HANDLER, &uprobe->flags);
                }
        }
@@ -932,7 +889,7 @@ void uprobe_unregister(struct inode *inode, loff_t offset, struct uprobe_consume
        if (consumer_del(uprobe, uc)) {
                if (!uprobe->consumers) {
                        __uprobe_unregister(uprobe);
-                        uprobe->flags &= ~UPROBE_RUN_HANDLER;
+                        clear_bit(UPROBE_RUN_HANDLER, &uprobe->flags);
                }
        }
@@ -1393,10 +1350,11 @@ bool uprobe_deny_signal(void)
 */
 static bool can_skip_sstep(struct uprobe *uprobe, struct pt_regs *regs)
 {
-        if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+        if (test_bit(UPROBE_SKIP_SSTEP, &uprobe->flags)) {
-                return true;
+                if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+                        return true;
-        uprobe->flags &= ~UPROBE_SKIP_SSTEP;
+                clear_bit(UPROBE_SKIP_SSTEP, &uprobe->flags);
+        }
        return false;
 }
@@ -1419,6 +1377,30 @@ static void mmf_recalc_uprobes(struct mm_struct *mm)
        clear_bit(MMF_HAS_UPROBES, &mm->flags);
 }
+static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
+{
+        struct page *page;
+        uprobe_opcode_t opcode;
+        int result;
+        pagefault_disable();
+        result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
+                                                        sizeof(opcode));
+        pagefault_enable();
+        if (likely(result == 0))
+                goto out;
+        result = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &page, NULL);
+        if (result < 0)
+                return result;
+        copy_opcode(page, vaddr, &opcode);
+        put_page(page);
+ out:
+        return is_swbp_insn(&opcode);
+}
 static struct uprobe *find_active_uprobe(unsigned long bp_vaddr, int *is_swbp)
 {
        struct mm_struct *mm = current->mm;
@@ -1489,38 +1471,41 @@ static void handle_swbp(struct pt_regs *regs)
                }
                return;
        }
+        /*
+         * TODO: move copy_insn/etc into _register and remove this hack.
+         * After we hit the bp, _unregister + _register can install the
+         * new and not-yet-analyzed uprobe at the same address, restart.
+         */
+        smp_rmb(); /* pairs with wmb() in install_breakpoint() */
+        if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
+                goto restart;
        utask = current->utask;
        if (!utask) {
                utask = add_utask();
                /* Cannot allocate; re-execute the instruction. */
                if (!utask)
-                        goto cleanup_ret;
+                        goto restart;
        }
-        utask->active_uprobe = uprobe;
        handler_chain(uprobe, regs);
-        if (uprobe->flags & UPROBE_SKIP_SSTEP && can_skip_sstep(uprobe, regs))
+        if (can_skip_sstep(uprobe, regs))
-                goto cleanup_ret;
+                goto out;
-        utask->state = UTASK_SSTEP;
        if (!pre_ssout(uprobe, regs, bp_vaddr)) {
                arch_uprobe_enable_step(&uprobe->arch);
+                utask->active_uprobe = uprobe;
+                utask->state = UTASK_SSTEP;
                return;
        }
-cleanup_ret:
+restart:
-        if (utask) {
+        /*
-                utask->active_uprobe = NULL;
+         * cannot singlestep; cannot skip instruction;
-                utask->state = UTASK_RUNNING;
+         * re-execute the instruction.
-        }
+         */
-        if (!(uprobe->flags & UPROBE_SKIP_SSTEP))
+        instruction_pointer_set(regs, bp_vaddr);
+out:
-                /*
-                 * cannot singlestep; cannot skip instruction;
-                 * re-execute the instruction.
-                 */
-                instruction_pointer_set(regs, bp_vaddr);
        put_uprobe(uprobe);
 }
@@ -1552,13 +1537,12 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs)
 }
 /*
- * On breakpoint hit, breakpoint notifier sets the TIF_UPROBE flag.  (and on
+ * On breakpoint hit, breakpoint notifier sets the TIF_UPROBE flag and
- * subsequent probe hits on the thread sets the state to UTASK_BP_HIT) and
+ * allows the thread to return from interrupt. After that handle_swbp()
- * allows the thread to return from interrupt.
+ * sets utask->active_uprobe.
 *
- * On singlestep exception, singlestep notifier sets the TIF_UPROBE flag and
+ * On singlestep exception, singlestep notifier sets the TIF_UPROBE flag
- * also sets the state to UTASK_SSTEP_ACK and allows the thread to return from
+ * and allows the thread to return from interrupt.
- * interrupt.
 *
 * While returning to userspace, thread notices the TIF_UPROBE flag and calls
 * uprobe_notify_resume().
@@ -1567,11 +1551,13 @@ void uprobe_notify_resume(struct pt_regs *regs)
 {
        struct uprobe_task *utask;
+        clear_thread_flag(TIF_UPROBE);
        utask = current->utask;
-        if (!utask || utask->state == UTASK_BP_HIT)
+        if (utask && utask->active_uprobe)
-                handle_swbp(regs);
-        else
                handle_singlestep(utask, regs);
+        else
+                handle_swbp(regs);
 }
 /*
@@ -1580,17 +1566,10 @@ void uprobe_notify_resume(struct pt_regs *regs)
 */
 int uprobe_pre_sstep_notifier(struct pt_regs *regs)
 {
-        struct uprobe_task *utask;
        if (!current->mm || !test_bit(MMF_HAS_UPROBES, &current->mm->flags))
                return 0;
-        utask = current->utask;
-        if (utask)
-                utask->state = UTASK_BP_HIT;
        set_thread_flag(TIF_UPROBE);
        return 1;
 }
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
index d492a23df99c..ea1b1df5dbb0 100644
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -192,7 +192,7 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
        size_t modlen = *_modlen, sig_len;
        int ret;
-        pr_devel("==>%s(,%lu)\n", __func__, modlen);
+        pr_devel("==>%s(,%zu)\n", __func__, modlen);
        if (modlen <= sizeof(ms))
                return -EBADMSG;
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index eb00be205811..7b07cc0dfb75 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -71,12 +71,22 @@ err_alloc:
        return NULL;
 }
+/* MAX_PID_NS_LEVEL is needed for limiting size of 'struct pid' */
+#define MAX_PID_NS_LEVEL 32
 static struct pid_namespace *create_pid_namespace(struct pid_namespace *parent_pid_ns)
 {
        struct pid_namespace *ns;
        unsigned int level = parent_pid_ns->level + 1;
-        int i, err = -ENOMEM;
+        int i;
+        int err;
+        if (level > MAX_PID_NS_LEVEL) {
+                err = -EINVAL;
+                goto out;
+        }
+        err = -ENOMEM;
        ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL);
        if (ns == NULL)
                goto out;
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index b32ed0e385a5..b979426d16c6 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1567,6 +1567,10 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
                put_online_cpus();
        } else {
+                /* Make sure this CPU has been intitialized */
+                if (!cpumask_test_cpu(cpu_id, buffer->cpumask))
+                        goto out;
                cpu_buffer = buffer->buffers[cpu_id];
                if (nr_pages == cpu_buffer->nr_pages)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index d951daa0ca9a..042d221d33cc 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2982,7 +2982,7 @@ bool cancel_delayed_work(struct delayed_work *dwork)
        set_work_cpu_and_clear_pending(&dwork->work, work_cpu(&dwork->work));
        local_irq_restore(flags);
-        return true;
+        return ret;
 }
 EXPORT_SYMBOL(cancel_delayed_work);
diff --git a/lib/genalloc.c b/lib/genalloc.c
index ca208a92628c..54920433705a 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -178,7 +178,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
        struct gen_pool_chunk *chunk;
        int nbits = size >> pool->min_alloc_order;
        int nbytes = sizeof(struct gen_pool_chunk) +
-                                (nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE;
+                                BITS_TO_LONGS(nbits) * sizeof(long);
        chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid);
        if (unlikely(chunk == NULL))
diff --git a/mm/memblock.c b/mm/memblock.c
index 931eef145af5..625905523c2a 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -930,6 +930,30 @@ int __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_addr_t si
        return memblock_overlaps_region(&memblock.reserved, base, size) >= 0;
 }
+void __init_memblock memblock_trim_memory(phys_addr_t align)
+{
+        int i;
+        phys_addr_t start, end, orig_start, orig_end;
+        struct memblock_type *mem = &memblock.memory;
+        for (i = 0; i < mem->cnt; i++) {
+                orig_start = mem->regions[i].base;
+                orig_end = mem->regions[i].base + mem->regions[i].size;
+                start = round_up(orig_start, align);
+                end = round_down(orig_end, align);
+                if (start == orig_start && end == orig_end)
+                        continue;
+                if (start < end) {
+                        mem->regions[i].base = start;
+                        mem->regions[i].size = end - start;
+                } else {
+                        memblock_remove_region(mem, i);
+                        i--;
+                }
+        }
+}
 void __init_memblock memblock_set_current_limit(phys_addr_t limit)
 {
diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
index 479a1e751a73..8a5ac8c686b0 100644
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -196,28 +196,28 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn,
        BUG_ON(atomic_read(&mm->mm_users) <= 0);
        /*
-        * Verify that mmu_notifier_init() already run and the global srcu is
+         * Verify that mmu_notifier_init() already run and the global srcu is
-        * initialized.
+         * initialized.
-        */
+         */
        BUG_ON(!srcu.per_cpu_ref);
+        ret = -ENOMEM;
+        mmu_notifier_mm = kmalloc(sizeof(struct mmu_notifier_mm), GFP_KERNEL);
+        if (unlikely(!mmu_notifier_mm))
+                goto out;
        if (take_mmap_sem)
                down_write(&mm->mmap_sem);
        ret = mm_take_all_locks(mm);
        if (unlikely(ret))
-                goto out;
+                goto out_clean;
        if (!mm_has_notifiers(mm)) {
-                mmu_notifier_mm = kmalloc(sizeof(struct mmu_notifier_mm),
-                                        GFP_KERNEL);
-                if (unlikely(!mmu_notifier_mm)) {
-                        ret = -ENOMEM;
-                        goto out_of_mem;
-                }
                INIT_HLIST_HEAD(&mmu_notifier_mm->list);
                spin_lock_init(&mmu_notifier_mm->lock);
                mm->mmu_notifier_mm = mmu_notifier_mm;
+                mmu_notifier_mm = NULL;
        }
        atomic_inc(&mm->mm_count);
@@ -233,12 +233,12 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn,
        hlist_add_head(&mn->hlist, &mm->mmu_notifier_mm->list);
        spin_unlock(&mm->mmu_notifier_mm->lock);
-out_of_mem:
        mm_drop_all_locks(mm);
-out:
+out_clean:
        if (take_mmap_sem)
                up_write(&mm->mmap_sem);
+        kfree(mmu_notifier_mm);
+out:
        BUG_ON(atomic_read(&mm->mm_users) <= 0);
        return ret;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index bb90971182bd..5b74de6702e0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1809,10 +1809,10 @@ static void __paginginit init_zone_allows_reclaim(int nid)
        int i;
        for_each_online_node(i)
-                if (node_distance(nid, i) <= RECLAIM_DISTANCE) {
+                if (node_distance(nid, i) <= RECLAIM_DISTANCE)
                        node_set(i, NODE_DATA(nid)->reclaim_nodes);
+                else
                        zone_reclaim_mode = 1;
-                }
 }
 #else   /* CONFIG_NUMA */
@@ -5825,7 +5825,7 @@ int alloc_contig_range(unsigned long start, unsigned long end,
        ret = start_isolate_page_range(pfn_max_align_down(start),
                                       pfn_max_align_up(end), migratetype);
        if (ret)
-                goto done;
+                return ret;
        ret = __alloc_contig_migrate_range(&cc, start, end);
        if (ret)
diff --git a/mm/rmap.c b/mm/rmap.c
index 7df7984d476c..2ee1ef0f317b 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -56,6 +56,7 @@
 #include <linux/mmu_notifier.h>
 #include <linux/migrate.h>
 #include <linux/hugetlb.h>
+#include <linux/backing-dev.h>
 #include <asm/tlbflush.h>
@@ -926,11 +927,8 @@ int page_mkclean(struct page *page)
        if (page_mapped(page)) {
                struct address_space *mapping = page_mapping(page);
-                if (mapping) {
+                if (mapping)
                        ret = page_mkclean_file(mapping, page);
-                        if (page_test_and_clear_dirty(page_to_pfn(page), 1))
-                                ret = 1;
-                }
        }
        return ret;
@@ -1116,6 +1114,7 @@ void page_add_file_rmap(struct page *page)
 */
 void page_remove_rmap(struct page *page)
 {
+        struct address_space *mapping = page_mapping(page);
        bool anon = PageAnon(page);
        bool locked;
        unsigned long flags;
@@ -1138,8 +1137,19 @@ void page_remove_rmap(struct page *page)
         * this if the page is anon, so about to be freed; but perhaps
         * not if it's in swapcache - there might be another pte slot
         * containing the swap entry, but page not yet written to swap.
+         *
+         * And we can skip it on file pages, so long as the filesystem
+         * participates in dirty tracking; but need to catch shm and tmpfs
+         * and ramfs pages which have been modified since creation by read
+         * fault.
+         *
+         * Note that mapping must be decided above, before decrementing
+         * mapcount (which luckily provides a barrier): once page is unmapped,
+         * it could be truncated and page->mapping reset to NULL at any moment.
+         * Note also that we are relying on page_mapping(page) to set mapping
+         * to &swapper_space when PageSwapCache(page).
         */
-        if ((!anon || PageSwapCache(page)) &&
+        if (mapping && !mapping_cap_account_dirty(mapping) &&
            page_test_and_clear_dirty(page_to_pfn(page), 1))
                set_page_dirty(page);
        /*
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index aaaadfbe36e9..75853cabf4c9 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -254,7 +254,6 @@ struct sock_xprt {
        void                    (*old_data_ready)(struct sock *, int);
        void                    (*old_state_change)(struct sock *);
        void                    (*old_write_space)(struct sock *);
-        void                    (*old_error_report)(struct sock *);
 };
 /*
@@ -737,10 +736,10 @@ static int xs_tcp_send_request(struct rpc_task *task)
                dprintk("RPC:       sendmsg returned unrecognized error %d\n",
                        -status);
        case -ECONNRESET:
-        case -EPIPE:
                xs_tcp_shutdown(xprt);
        case -ECONNREFUSED:
        case -ENOTCONN:
+        case -EPIPE:
                clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
        }
@@ -781,7 +780,6 @@ static void xs_save_old_callbacks(struct sock_xprt *transport, struct sock *sk)
        transport->old_data_ready = sk->sk_data_ready;
        transport->old_state_change = sk->sk_state_change;
        transport->old_write_space = sk->sk_write_space;
-        transport->old_error_report = sk->sk_error_report;
 }
 static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *sk)
@@ -789,7 +787,6 @@ static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *s
        sk->sk_data_ready = transport->old_data_ready;
        sk->sk_state_change = transport->old_state_change;
        sk->sk_write_space = transport->old_write_space;
-        sk->sk_error_report = transport->old_error_report;
 }
 static void xs_reset_transport(struct sock_xprt *transport)
@@ -1453,7 +1450,7 @@ static void xs_tcp_cancel_linger_timeout(struct rpc_xprt *xprt)
        xprt_clear_connecting(xprt);
 }
-static void xs_sock_mark_closed(struct rpc_xprt *xprt)
+static void xs_sock_reset_connection_flags(struct rpc_xprt *xprt)
 {
        smp_mb__before_clear_bit();
        clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
@@ -1461,6 +1458,11 @@ static void xs_sock_mark_closed(struct rpc_xprt *xprt)
        clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
        clear_bit(XPRT_CLOSING, &xprt->state);
        smp_mb__after_clear_bit();
+}
+static void xs_sock_mark_closed(struct rpc_xprt *xprt)
+{
+        xs_sock_reset_connection_flags(xprt);
        /* Mark transport as closed and wake up all pending tasks */
        xprt_disconnect_done(xprt);
 }
@@ -1516,6 +1518,7 @@ static void xs_tcp_state_change(struct sock *sk)
        case TCP_CLOSE_WAIT:
                /* The server initiated a shutdown of the socket */
                xprt->connect_cookie++;
+                clear_bit(XPRT_CONNECTED, &xprt->state);
                xs_tcp_force_close(xprt);
        case TCP_CLOSING:
                /*
@@ -1540,25 +1543,6 @@ static void xs_tcp_state_change(struct sock *sk)
        read_unlock_bh(&sk->sk_callback_lock);
 }
-/**
- * xs_error_report - callback mainly for catching socket errors
- * @sk: socket
- */
-static void xs_error_report(struct sock *sk)
-{
-        struct rpc_xprt *xprt;
-        read_lock_bh(&sk->sk_callback_lock);
-        if (!(xprt = xprt_from_sock(sk)))
-                goto out;
-        dprintk("RPC:       %s client %p...\n"
-                        "RPC:       error %d\n",
-                        __func__, xprt, sk->sk_err);
-        xprt_wake_pending_tasks(xprt, -EAGAIN);
-out:
-        read_unlock_bh(&sk->sk_callback_lock);
-}
 static void xs_write_space(struct sock *sk)
 {
        struct socket *sock;
@@ -1858,7 +1842,6 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt,
                sk->sk_user_data = xprt;
                sk->sk_data_ready = xs_local_data_ready;
                sk->sk_write_space = xs_udp_write_space;
-                sk->sk_error_report = xs_error_report;
                sk->sk_allocation = GFP_ATOMIC;
                xprt_clear_connected(xprt);
@@ -1983,7 +1966,6 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                sk->sk_user_data = xprt;
                sk->sk_data_ready = xs_udp_data_ready;
                sk->sk_write_space = xs_udp_write_space;
-                sk->sk_error_report = xs_error_report;
                sk->sk_no_check = UDP_CSUM_NORCV;
                sk->sk_allocation = GFP_ATOMIC;
@@ -2050,10 +2032,8 @@ static void xs_abort_connection(struct sock_xprt *transport)
        any.sa_family = AF_UNSPEC;
        result = kernel_connect(transport->sock, &any, sizeof(any), 0);
        if (!result)
-                xs_sock_mark_closed(&transport->xprt);
+                xs_sock_reset_connection_flags(&transport->xprt);
-        else
+        dprintk("RPC:       AF_UNSPEC connect return code %d\n", result);
-                dprintk("RPC:       AF_UNSPEC connect return code %d\n",
-                                result);
 }
 static void xs_tcp_reuse_connection(struct sock_xprt *transport)
@@ -2098,7 +2078,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                sk->sk_data_ready = xs_tcp_data_ready;
                sk->sk_state_change = xs_tcp_state_change;
                sk->sk_write_space = xs_tcp_write_space;
-                sk->sk_error_report = xs_error_report;
                sk->sk_allocation = GFP_ATOMIC;
                /* socket options */
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index cf5fd220309b..813200384d97 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -724,6 +724,8 @@ fail:
 */
 static void free_profile(struct aa_profile *profile)
 {
+        struct aa_profile *p;
        AA_DEBUG("%s(%p)\n", __func__, profile);
        if (!profile)
@@ -751,7 +753,27 @@ static void free_profile(struct aa_profile *profile)
        aa_put_dfa(profile->xmatch);
        aa_put_dfa(profile->policy.dfa);
-        aa_put_profile(profile->replacedby);
+        /* put the profile reference for replacedby, but not via
+         * put_profile(kref_put).
+         * replacedby can form a long chain that can result in cascading
+         * frees that blows the stack because kref_put makes a nested fn
+         * call (it looks like recursion, with free_profile calling
+         * free_profile) for each profile in the chain lp#1056078.
+         */
+        for (p = profile->replacedby; p; ) {
+                if (atomic_dec_and_test(&p->base.count.refcount)) {
+                        /* no more refs on p, grab its replacedby */
+                        struct aa_profile *next = p->replacedby;
+                        /* break the chain */
+                        p->replacedby = NULL;
+                        /* now free p, chain is broken */
+                        free_profile(p);
+                        /* follow up with next profile in the chain */
+                        p = next;
+                } else
+                        break;
+        }
        kzfree(profile);
 }
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 44dfc415a379..842c254396db 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -42,7 +42,10 @@ struct dev_exception_item {
 struct dev_cgroup {
        struct cgroup_subsys_state css;
        struct list_head exceptions;
-        bool deny_all;
+        enum {
+                DEVCG_DEFAULT_ALLOW,
+                DEVCG_DEFAULT_DENY,
+        } behavior;
 };
 static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
@@ -182,13 +185,13 @@ static struct cgroup_subsys_state *devcgroup_create(struct cgroup *cgroup)
        parent_cgroup = cgroup->parent;
        if (parent_cgroup == NULL)
-                dev_cgroup->deny_all = false;
+                dev_cgroup->behavior = DEVCG_DEFAULT_ALLOW;
        else {
                parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
                mutex_lock(&devcgroup_mutex);
                ret = dev_exceptions_copy(&dev_cgroup->exceptions,
                                          &parent_dev_cgroup->exceptions);
-                dev_cgroup->deny_all = parent_dev_cgroup->deny_all;
+                dev_cgroup->behavior = parent_dev_cgroup->behavior;
                mutex_unlock(&devcgroup_mutex);
                if (ret) {
                        kfree(dev_cgroup);
@@ -260,7 +263,7 @@ static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft,
         * - List the exceptions in case the default policy is to deny
         * This way, the file remains as a "whitelist of devices"
         */
-        if (devcgroup->deny_all == false) {
+        if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
                set_access(acc, ACC_MASK);
                set_majmin(maj, ~0);
                set_majmin(min, ~0);
@@ -314,12 +317,12 @@ static int may_access(struct dev_cgroup *dev_cgroup,
         * In two cases we'll consider this new exception valid:
         * - the dev cgroup has its default policy to allow + exception list:
         *   the new exception should *not* match any of the exceptions
-         *   (!deny_all, !match)
+         *   (behavior == DEVCG_DEFAULT_ALLOW, !match)
         * - the dev cgroup has its default policy to deny + exception list:
         *   the new exception *should* match the exceptions
-         *   (deny_all, match)
+         *   (behavior == DEVCG_DEFAULT_DENY, match)
         */
-        if (dev_cgroup->deny_all == match)
+        if ((dev_cgroup->behavior == DEVCG_DEFAULT_DENY) == match)
                return 1;
        return 0;
 }
@@ -341,6 +344,17 @@ static int parent_has_perm(struct dev_cgroup *childcg,
        return may_access(parent, ex);
 }
+/**
+ * may_allow_all - checks if it's possible to change the behavior to
+ *                 allow based on parent's rules.
+ * @parent: device cgroup's parent
+ * returns: != 0 in case it's allowed, 0 otherwise
+ */
+static inline int may_allow_all(struct dev_cgroup *parent)
+{
+        return parent->behavior == DEVCG_DEFAULT_ALLOW;
+}
 /*
 * Modify the exception list using allow/deny rules.
 * CAP_SYS_ADMIN is needed for this.  It's at least separate from CAP_MKNOD
@@ -358,9 +372,11 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                                   int filetype, const char *buffer)
 {
        const char *b;
-        char *endp;
+        char temp[12];          /* 11 + 1 characters needed for a u32 */
-        int count;
+        int count, rc;
        struct dev_exception_item ex;
+        struct cgroup *p = devcgroup->css.cgroup;
+        struct dev_cgroup *parent = cgroup_to_devcgroup(p->parent);
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
@@ -372,14 +388,18 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
        case 'a':
                switch (filetype) {
                case DEVCG_ALLOW:
-                        if (!parent_has_perm(devcgroup, &ex))
+                        if (!may_allow_all(parent))
                                return -EPERM;
                        dev_exception_clean(devcgroup);
-                        devcgroup->deny_all = false;
+                        rc = dev_exceptions_copy(&devcgroup->exceptions,
+                                                 &parent->exceptions);
+                        if (rc)
+                                return rc;
+                        devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
                        break;
                case DEVCG_DENY:
                        dev_exception_clean(devcgroup);
-                        devcgroup->deny_all = true;
+                        devcgroup->behavior = DEVCG_DEFAULT_DENY;
                        break;
                default:
                        return -EINVAL;
@@ -402,8 +422,16 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                ex.major = ~0;
                b++;
        } else if (isdigit(*b)) {
-                ex.major = simple_strtoul(b, &endp, 10);
+                memset(temp, 0, sizeof(temp));
-                b = endp;
+                for (count = 0; count < sizeof(temp) - 1; count++) {
+                        temp[count] = *b;
+                        b++;
+                        if (!isdigit(*b))
+                                break;
+                }
+                rc = kstrtou32(temp, 10, &ex.major);
+                if (rc)
+                        return -EINVAL;
        } else {
                return -EINVAL;
        }
@@ -416,8 +444,16 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                ex.minor = ~0;
                b++;
        } else if (isdigit(*b)) {
-                ex.minor = simple_strtoul(b, &endp, 10);
+                memset(temp, 0, sizeof(temp));
-                b = endp;
+                for (count = 0; count < sizeof(temp) - 1; count++) {
+                        temp[count] = *b;
+                        b++;
+                        if (!isdigit(*b))
+                                break;
+                }
+                rc = kstrtou32(temp, 10, &ex.minor);
+                if (rc)
+                        return -EINVAL;
        } else {
                return -EINVAL;
        }
@@ -452,7 +488,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                 * an matching exception instead. And be silent about it: we
                 * don't want to break compatibility
                 */
-                if (devcgroup->deny_all == false) {
+                if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
                        dev_exception_rm(devcgroup, &ex);
                        return 0;
                }
@@ -463,7 +499,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                 * an matching exception instead. And be silent about it: we
                 * don't want to break compatibility
                 */
-                if (devcgroup->deny_all == true) {
+                if (devcgroup->behavior == DEVCG_DEFAULT_DENY) {
                        dev_exception_rm(devcgroup, &ex);
                        return 0;
                }
@@ -533,10 +569,10 @@ struct cgroup_subsys devices_subsys = {
 *
 * returns 0 on success, -EPERM case the operation is not permitted
 */
-static int __devcgroup_check_permission(struct dev_cgroup *dev_cgroup,
+static int __devcgroup_check_permission(short type, u32 major, u32 minor,
-                                        short type, u32 major, u32 minor,
                                        short access)
 {
+        struct dev_cgroup *dev_cgroup;
        struct dev_exception_item ex;
        int rc;
@@ -547,6 +583,7 @@ static int __devcgroup_check_permission(struct dev_cgroup *dev_cgroup,
        ex.access = access;
        rcu_read_lock();
+        dev_cgroup = task_devcgroup(current);
        rc = may_access(dev_cgroup, &ex);
        rcu_read_unlock();
@@ -558,7 +595,6 @@ static int __devcgroup_check_permission(struct dev_cgroup *dev_cgroup,
 int __devcgroup_inode_permission(struct inode *inode, int mask)
 {
-        struct dev_cgroup *dev_cgroup = task_devcgroup(current);
        short type, access = 0;
        if (S_ISBLK(inode->i_mode))
@@ -570,13 +606,12 @@ int __devcgroup_inode_permission(struct inode *inode, int mask)
        if (mask & MAY_READ)
                access |= ACC_READ;
-        return __devcgroup_check_permission(dev_cgroup, type, imajor(inode),
+        return __devcgroup_check_permission(type, imajor(inode), iminor(inode),
-                                            iminor(inode), access);
+                        access);
 }
 int devcgroup_inode_mknod(int mode, dev_t dev)
 {
-        struct dev_cgroup *dev_cgroup = task_devcgroup(current);
        short type;
        if (!S_ISBLK(mode) && !S_ISCHR(mode))
@@ -587,7 +622,7 @@ int devcgroup_inode_mknod(int mode, dev_t dev)
        else
                type = DEV_CHAR;
-        return __devcgroup_check_permission(dev_cgroup, type, MAJOR(dev),
+        return __devcgroup_check_permission(type, MAJOR(dev), MINOR(dev),
-                                            MINOR(dev), ACC_MKNOD);
+                        ACC_MKNOD);
 }
diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
index 3d1afb612b35..4a7ff4e8985b 100644
--- a/sound/isa/opti9xx/miro.c
+++ b/sound/isa/opti9xx/miro.c
@@ -1286,7 +1286,6 @@ static int __devinit snd_miro_probe(struct snd_card *card)
        error = snd_card_miro_aci_detect(card, miro);
        if (error < 0) {
-                snd_card_free(card);
                snd_printk(KERN_ERR "unable to detect aci chip\n");
                return -ENODEV;
        }
diff --git a/sound/pci/als300.c b/sound/pci/als300.c
index 00f157a2cf64..5af3cb6b0c18 100644
--- a/sound/pci/als300.c
+++ b/sound/pci/als300.c
@@ -394,6 +394,8 @@ static int snd_als300_playback_open(struct snd_pcm_substream *substream)
        struct snd_als300_substream_data *data = kzalloc(sizeof(*data),
                                                                GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
        snd_als300_dbgcallenter();
        chip->playback_substream = substream;
        runtime->hw = snd_als300_playback_hw;
@@ -425,6 +427,8 @@ static int snd_als300_capture_open(struct snd_pcm_substream *substream)
        struct snd_als300_substream_data *data = kzalloc(sizeof(*data),
                                                                GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
        snd_als300_dbgcallenter();
        chip->capture_substream = substream;
        runtime->hw = snd_als300_capture_hw;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 48d9d609f89b..f7397ad02a0d 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5677,6 +5677,7 @@ static const struct hda_verb alc268_beep_init_verbs[] = {
 enum {
        ALC268_FIXUP_INV_DMIC,
+        ALC268_FIXUP_HP_EAPD,
 };
 static const struct alc_fixup alc268_fixups[] = {
@@ -5684,10 +5685,26 @@ static const struct alc_fixup alc268_fixups[] = {
                .type = ALC_FIXUP_FUNC,
                .v.func = alc_fixup_inv_dmic_0x12,
        },
+        [ALC268_FIXUP_HP_EAPD] = {
+                .type = ALC_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        {0x15, AC_VERB_SET_EAPD_BTLENABLE, 0},
+                        {}
+                }
+        },
 };
 static const struct alc_model_fixup alc268_fixup_models[] = {
        {.id = ALC268_FIXUP_INV_DMIC, .name = "inv-dmic"},
+        {.id = ALC268_FIXUP_HP_EAPD, .name = "hp-eapd"},
+        {}
+};
+static const struct snd_pci_quirk alc268_fixup_tbl[] = {
+        /* below is codec SSID since multiple Toshiba laptops have the
+         * same PCI SSID 1179:ff00
+         */
+        SND_PCI_QUIRK(0x1179, 0xff06, "Toshiba P200", ALC268_FIXUP_HP_EAPD),
        {}
 };
@@ -5722,7 +5739,7 @@ static int patch_alc268(struct hda_codec *codec)
        spec = codec->spec;
-        alc_pick_fixup(codec, alc268_fixup_models, NULL, alc268_fixups);
+        alc_pick_fixup(codec, alc268_fixup_models, alc268_fixup_tbl, alc268_fixups);
        alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE);
        /* automatic parse from the BIOS config */
@@ -6188,6 +6205,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
        SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index b12308b5ba2a..f1cd1e387801 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -971,6 +971,7 @@ static inline void snd_hdspm_initialize_midi_flush(struct hdspm *hdspm);
 static int hdspm_update_simple_mixer_controls(struct hdspm *hdspm);
 static int hdspm_autosync_ref(struct hdspm *hdspm);
 static int snd_hdspm_set_defaults(struct hdspm *hdspm);
+static int hdspm_system_clock_mode(struct hdspm *hdspm);
 static void hdspm_set_sgbuf(struct hdspm *hdspm,
                            struct snd_pcm_substream *substream,
                             unsigned int reg, int channels);
@@ -1989,10 +1990,14 @@ static int hdspm_get_system_sample_rate(struct hdspm *hdspm)
        rate = hdspm_calc_dds_value(hdspm, period);
        if (rate > 207000) {
-                /* Unreasonable high sample rate as seen on PCI MADI cards.
+                /* Unreasonable high sample rate as seen on PCI MADI cards. */
-                 * Use the cached value instead.
+                if (0 == hdspm_system_clock_mode(hdspm)) {
-                 */
+                        /* master mode, return internal sample rate */
-                rate = hdspm->system_sample_rate;
+                        rate = hdspm->system_sample_rate;
+                } else {
+                        /* slave mode, return external sample rate */
+                        rate = hdspm_external_sample_rate(hdspm);
+                }
        }
        return rate;
@@ -2000,12 +2005,14 @@ static int hdspm_get_system_sample_rate(struct hdspm *hdspm)
 #define HDSPM_SYSTEM_SAMPLE_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READ, \
+        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE |\
-  .info = snd_hdspm_info_system_sample_rate, \
+                SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
-  .get = snd_hdspm_get_system_sample_rate \
+        .info = snd_hdspm_info_system_sample_rate, \
+        .put = snd_hdspm_put_system_sample_rate, \
+        .get = snd_hdspm_get_system_sample_rate \
 }
 static int snd_hdspm_info_system_sample_rate(struct snd_kcontrol *kcontrol,
@@ -2030,6 +2037,16 @@ static int snd_hdspm_get_system_sample_rate(struct snd_kcontrol *kcontrol,
        return 0;
 }
+static int snd_hdspm_put_system_sample_rate(struct snd_kcontrol *kcontrol,
+                                            struct snd_ctl_elem_value *
+                                            ucontrol)
+{
+        struct hdspm *hdspm = snd_kcontrol_chip(kcontrol);
+        hdspm_set_dds_value(hdspm, ucontrol->value.enumerated.item[0]);
+        return 0;
+}
 /**
 * Returns the WordClock sample rate class for the given card.
@@ -2163,6 +2180,7 @@ static int snd_hdspm_get_autosync_sample_rate(struct snd_kcontrol *kcontrol,
                                hdspm_get_s1_sample_rate(hdspm,
                                                kcontrol->private_value-1);
                }
+                break;
        case AIO:
                switch (kcontrol->private_value) {
@@ -2183,6 +2201,7 @@ static int snd_hdspm_get_autosync_sample_rate(struct snd_kcontrol *kcontrol,
                                hdspm_get_s1_sample_rate(hdspm,
                                                ucontrol->id.index-1);
                }
+                break;
        case AES32:
@@ -2204,8 +2223,23 @@ static int snd_hdspm_get_autosync_sample_rate(struct snd_kcontrol *kcontrol,
                                hdspm_get_s1_sample_rate(hdspm,
                                                kcontrol->private_value-1);
                        break;
+                }
+                break;
+        case MADI:
+        case MADIface:
+                {
+                        int rate = hdspm_external_sample_rate(hdspm);
+                        int i, selected_rate = 0;
+                        for (i = 1; i < 10; i++)
+                                if (HDSPM_bit2freq(i) == rate) {
+                                        selected_rate = i;
+                                        break;
+                                }
+                        ucontrol->value.enumerated.item[0] = selected_rate;
                }
+                break;
        default:
                break;
        }
@@ -2430,7 +2464,7 @@ static int snd_hdspm_put_clock_source(struct snd_kcontrol *kcontrol,
 #define HDSPM_PREF_SYNC_REF(xname, xindex) \
-{.iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
        .name = xname, \
        .index = xindex, \
        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE |\
@@ -2766,12 +2800,12 @@ static int snd_hdspm_put_pref_sync_ref(struct snd_kcontrol *kcontrol,
 #define HDSPM_AUTOSYNC_REF(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READ, \
+        .access = SNDRV_CTL_ELEM_ACCESS_READ, \
-  .info = snd_hdspm_info_autosync_ref, \
+        .info = snd_hdspm_info_autosync_ref, \
-  .get = snd_hdspm_get_autosync_ref, \
+        .get = snd_hdspm_get_autosync_ref, \
 }
 static int hdspm_autosync_ref(struct hdspm *hdspm)
@@ -2855,12 +2889,12 @@ static int snd_hdspm_get_autosync_ref(struct snd_kcontrol *kcontrol,
 #define HDSPM_LINE_OUT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_line_out, \
+        .info = snd_hdspm_info_line_out, \
-  .get = snd_hdspm_get_line_out, \
+        .get = snd_hdspm_get_line_out, \
-  .put = snd_hdspm_put_line_out \
+        .put = snd_hdspm_put_line_out \
 }
 static int hdspm_line_out(struct hdspm * hdspm)
@@ -2912,12 +2946,12 @@ static int snd_hdspm_put_line_out(struct snd_kcontrol *kcontrol,
 #define HDSPM_TX_64(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_tx_64, \
+        .info = snd_hdspm_info_tx_64, \
-  .get = snd_hdspm_get_tx_64, \
+        .get = snd_hdspm_get_tx_64, \
-  .put = snd_hdspm_put_tx_64 \
+        .put = snd_hdspm_put_tx_64 \
 }
 static int hdspm_tx_64(struct hdspm * hdspm)
@@ -2968,12 +3002,12 @@ static int snd_hdspm_put_tx_64(struct snd_kcontrol *kcontrol,
 #define HDSPM_C_TMS(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_c_tms, \
+        .info = snd_hdspm_info_c_tms, \
-  .get = snd_hdspm_get_c_tms, \
+        .get = snd_hdspm_get_c_tms, \
-  .put = snd_hdspm_put_c_tms \
+        .put = snd_hdspm_put_c_tms \
 }
 static int hdspm_c_tms(struct hdspm * hdspm)
@@ -3024,12 +3058,12 @@ static int snd_hdspm_put_c_tms(struct snd_kcontrol *kcontrol,
 #define HDSPM_SAFE_MODE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_safe_mode, \
+        .info = snd_hdspm_info_safe_mode, \
-  .get = snd_hdspm_get_safe_mode, \
+        .get = snd_hdspm_get_safe_mode, \
-  .put = snd_hdspm_put_safe_mode \
+        .put = snd_hdspm_put_safe_mode \
 }
 static int hdspm_safe_mode(struct hdspm * hdspm)
@@ -3080,12 +3114,12 @@ static int snd_hdspm_put_safe_mode(struct snd_kcontrol *kcontrol,
 #define HDSPM_EMPHASIS(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_emphasis, \
+        .info = snd_hdspm_info_emphasis, \
-  .get = snd_hdspm_get_emphasis, \
+        .get = snd_hdspm_get_emphasis, \
-  .put = snd_hdspm_put_emphasis \
+        .put = snd_hdspm_put_emphasis \
 }
 static int hdspm_emphasis(struct hdspm * hdspm)
@@ -3136,12 +3170,12 @@ static int snd_hdspm_put_emphasis(struct snd_kcontrol *kcontrol,
 #define HDSPM_DOLBY(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_dolby, \
+        .info = snd_hdspm_info_dolby, \
-  .get = snd_hdspm_get_dolby, \
+        .get = snd_hdspm_get_dolby, \
-  .put = snd_hdspm_put_dolby \
+        .put = snd_hdspm_put_dolby \
 }
 static int hdspm_dolby(struct hdspm * hdspm)
@@ -3192,12 +3226,12 @@ static int snd_hdspm_put_dolby(struct snd_kcontrol *kcontrol,
 #define HDSPM_PROFESSIONAL(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_professional, \
+        .info = snd_hdspm_info_professional, \
-  .get = snd_hdspm_get_professional, \
+        .get = snd_hdspm_get_professional, \
-  .put = snd_hdspm_put_professional \
+        .put = snd_hdspm_put_professional \
 }
 static int hdspm_professional(struct hdspm * hdspm)
@@ -3247,12 +3281,12 @@ static int snd_hdspm_put_professional(struct snd_kcontrol *kcontrol,
 }
 #define HDSPM_INPUT_SELECT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_input_select, \
+        .info = snd_hdspm_info_input_select, \
-  .get = snd_hdspm_get_input_select, \
+        .get = snd_hdspm_get_input_select, \
-  .put = snd_hdspm_put_input_select \
+        .put = snd_hdspm_put_input_select \
 }
 static int hdspm_input_select(struct hdspm * hdspm)
@@ -3319,12 +3353,12 @@ static int snd_hdspm_put_input_select(struct snd_kcontrol *kcontrol,
 #define HDSPM_DS_WIRE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_ds_wire, \
+        .info = snd_hdspm_info_ds_wire, \
-  .get = snd_hdspm_get_ds_wire, \
+        .get = snd_hdspm_get_ds_wire, \
-  .put = snd_hdspm_put_ds_wire \
+        .put = snd_hdspm_put_ds_wire \
 }
 static int hdspm_ds_wire(struct hdspm * hdspm)
@@ -3391,12 +3425,12 @@ static int snd_hdspm_put_ds_wire(struct snd_kcontrol *kcontrol,
 #define HDSPM_QS_WIRE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .info = snd_hdspm_info_qs_wire, \
+        .info = snd_hdspm_info_qs_wire, \
-  .get = snd_hdspm_get_qs_wire, \
+        .get = snd_hdspm_get_qs_wire, \
-  .put = snd_hdspm_put_qs_wire \
+        .put = snd_hdspm_put_qs_wire \
 }
 static int hdspm_qs_wire(struct hdspm * hdspm)
@@ -3563,15 +3597,15 @@ static int snd_hdspm_put_madi_speedmode(struct snd_kcontrol *kcontrol,
 }
 #define HDSPM_MIXER(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
-  .name = xname, \
+        .name = xname, \
-  .index = xindex, \
+        .index = xindex, \
-  .device = 0, \
+        .device = 0, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READWRITE | \
+        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE | \
-                 SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
+                SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
-  .info = snd_hdspm_info_mixer, \
+        .info = snd_hdspm_info_mixer, \
-  .get = snd_hdspm_get_mixer, \
+        .get = snd_hdspm_get_mixer, \
-  .put = snd_hdspm_put_mixer \
+        .put = snd_hdspm_put_mixer \
 }
 static int snd_hdspm_info_mixer(struct snd_kcontrol *kcontrol,
@@ -3670,12 +3704,12 @@ static int snd_hdspm_put_mixer(struct snd_kcontrol *kcontrol,
 */
 #define HDSPM_PLAYBACK_MIXER \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_WRITE | \
+        .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_WRITE | \
-                 SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
+                SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
-  .info = snd_hdspm_info_playback_mixer, \
+        .info = snd_hdspm_info_playback_mixer, \
-  .get = snd_hdspm_get_playback_mixer, \
+        .get = snd_hdspm_get_playback_mixer, \
-  .put = snd_hdspm_put_playback_mixer \
+        .put = snd_hdspm_put_playback_mixer \
 }
 static int snd_hdspm_info_playback_mixer(struct snd_kcontrol *kcontrol,
@@ -3851,12 +3885,17 @@ static int hdspm_sync_in_sync_check(struct hdspm *hdspm)
                break;
        case MADI:
-        case AES32:
+                status = hdspm_read(hdspm, HDSPM_statusRegister);
-                status = hdspm_read(hdspm, HDSPM_statusRegister2);
                lock = (status & HDSPM_syncInLock) ? 1 : 0;
                sync = (status & HDSPM_syncInSync) ? 1 : 0;
                break;
+        case AES32:
+                status = hdspm_read(hdspm, HDSPM_statusRegister2);
+                lock = (status & 0x100000) ? 1 : 0;
+                sync = (status & 0x200000) ? 1 : 0;
+                break;
        case MADIface:
                break;
        }
@@ -3942,6 +3981,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                default:
                        val = hdspm_s1_sync_check(hdspm, ucontrol->id.index-1);
                }
+                break;
        case AIO:
                switch (kcontrol->private_value) {
@@ -3954,6 +3994,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                default:
                        val = hdspm_s1_sync_check(hdspm, ucontrol->id.index-1);
                }
+                break;
        case MADI:
                switch (kcontrol->private_value) {
@@ -3966,6 +4007,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                case 3: /* SYNC_IN */
                        val = hdspm_sync_in_sync_check(hdspm); break;
                }
+                break;
        case MADIface:
                val = hdspm_madi_sync_check(hdspm); /* MADI */
@@ -3983,6 +4025,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                         val = hdspm_aes_sync_check(hdspm,
                                         kcontrol->private_value-1);
                }
+                break;
        }
@@ -4427,9 +4470,10 @@ static struct snd_kcontrol_new snd_hdspm_controls_madi[] = {
        HDSPM_PREF_SYNC_REF("Preferred Sync Reference", 0),
        HDSPM_AUTOSYNC_REF("AutoSync Reference", 0),
        HDSPM_SYSTEM_SAMPLE_RATE("System Sample Rate", 0),
+        HDSPM_AUTOSYNC_SAMPLE_RATE("External Rate", 0),
        HDSPM_SYNC_CHECK("WC SyncCheck", 0),
        HDSPM_SYNC_CHECK("MADI SyncCheck", 1),
-        HDSPM_SYNC_CHECK("TCO SyncCHeck", 2),
+        HDSPM_SYNC_CHECK("TCO SyncCheck", 2),
        HDSPM_SYNC_CHECK("SYNC IN SyncCheck", 3),
        HDSPM_LINE_OUT("Line Out", 0),
        HDSPM_TX_64("TX 64 channels mode", 0),
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 2b2dadc54dac..3fddc7ad1127 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -1045,6 +1045,7 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
                      struct snd_kcontrol *kcontrol, int event)
 {
        struct snd_soc_codec *codec = w->codec;
+        struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
        struct wm8994 *control = codec->control_data;
        int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
        int i;
@@ -1063,6 +1064,10 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
        switch (event) {
        case SND_SOC_DAPM_PRE_PMU:
+                /* Don't enable timeslot 2 if not in use */
+                if (wm8994->channels[0] <= 2)
+                        mask &= ~(WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA);
                val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1);
                if ((val & WM8994_AIF1ADCL_SRC) &&
                    (val & WM8994_AIF1ADCR_SRC))
@@ -2687,7 +2692,7 @@ static int wm8994_hw_params(struct snd_pcm_substream *substream,
                return -EINVAL;
        }
-        bclk_rate = params_rate(params) * 4;
+        bclk_rate = params_rate(params);
        switch (params_format(params)) {
        case SNDRV_PCM_FORMAT_S16_LE:
                bclk_rate *= 16;
@@ -2708,6 +2713,17 @@ static int wm8994_hw_params(struct snd_pcm_substream *substream,
                return -EINVAL;
        }
+        wm8994->channels[id] = params_channels(params);
+        switch (params_channels(params)) {
+        case 1:
+        case 2:
+                bclk_rate *= 2;
+                break;
+        default:
+                bclk_rate *= 4;
+                break;
+        }
        /* Try to find an appropriate sample rate; look for an exact match. */
        for (i = 0; i < ARRAY_SIZE(srs); i++)
                if (srs[i].rate == params_rate(params))
diff --git a/sound/soc/codecs/wm8994.h b/sound/soc/codecs/wm8994.h
index f142ec198db3..ccbce5791e95 100644
--- a/sound/soc/codecs/wm8994.h
+++ b/sound/soc/codecs/wm8994.h
@@ -77,6 +77,7 @@ struct wm8994_priv {
        int sysclk_rate[2];
        int mclk[2];
        int aifclk[2];
+        int channels[2];
        struct wm8994_fll_config fll[2], fll_suspend[2];
        struct completion fll_locked[2];
        bool fll_locked_irq;
diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c
index 356611d9654d..54f7e25b6f7d 100644
--- a/sound/soc/ux500/mop500.c
+++ b/sound/soc/ux500/mop500.c
@@ -57,6 +57,20 @@ static struct snd_soc_card mop500_card = {
        .num_links = ARRAY_SIZE(mop500_dai_links),
 };
+static void mop500_of_node_put(void)
+{
+        int i;
+        for (i = 0; i < 2; i++) {
+                if (mop500_dai_links[i].cpu_of_node)
+                        of_node_put((struct device_node *)
+                                mop500_dai_links[i].cpu_of_node);
+                if (mop500_dai_links[i].codec_of_node)
+                        of_node_put((struct device_node *)
+                                mop500_dai_links[i].codec_of_node);
+        }
+}
 static int __devinit mop500_of_probe(struct platform_device *pdev,
                                struct device_node *np)
 {
@@ -69,6 +83,7 @@ static int __devinit mop500_of_probe(struct platform_device *pdev,
        if (!(msp_np[0] && msp_np[1] && codec_np)) {
                dev_err(&pdev->dev, "Phandle missing or invalid\n");
+                mop500_of_node_put();
                return -EINVAL;
        }
@@ -83,6 +98,7 @@ static int __devinit mop500_of_probe(struct platform_device *pdev,
        return 0;
 }
 static int __devinit mop500_probe(struct platform_device *pdev)
 {
        struct device_node *np = pdev->dev.of_node;
@@ -128,6 +144,7 @@ static int __devexit mop500_remove(struct platform_device *pdev)
        snd_soc_unregister_card(mop500_card);
        mop500_ab8500_remove(mop500_card);
+        mop500_of_node_put();
        return 0;
 }
diff --git a/sound/soc/ux500/ux500_msp_i2s.c b/sound/soc/ux500/ux500_msp_i2s.c
index b7c996e77570..a26c6bf0a29b 100644
--- a/sound/soc/ux500/ux500_msp_i2s.c
+++ b/sound/soc/ux500/ux500_msp_i2s.c
@@ -18,6 +18,7 @@
 #include <linux/pinctrl/consumer.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 #include <linux/of.h>
 #include <mach/hardware.h>
@@ -697,14 +698,11 @@ int ux500_msp_i2s_init_msp(struct platform_device *pdev,
                        platform_data = devm_kzalloc(&pdev->dev,
                                sizeof(struct msp_i2s_platform_data), GFP_KERNEL);
                        if (!platform_data)
-                                ret = -ENOMEM;
+                                return -ENOMEM;
                }
        } else
                if (!platform_data)
-                        ret = -EINVAL;
+                        return -EINVAL;
-        if (ret)
-                goto err_res;
        dev_dbg(&pdev->dev, "%s: Enter (name: %s, id: %d).\n", __func__,
                pdev->name, platform_data->id);
diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c
index 411ee5664e98..178b88ae3d2f 100644
--- a/tools/perf/builtin-help.c
+++ b/tools/perf/builtin-help.c
@@ -414,7 +414,7 @@ static int show_html_page(const char *perf_cmd)
 int cmd_help(int argc, const char **argv, const char *prefix __maybe_unused)
 {
        bool show_all = false;
-        enum help_format help_format = HELP_FORMAT_NONE;
+        enum help_format help_format = HELP_FORMAT_MAN;
        struct option builtin_help_options[] = {
        OPT_BOOLEAN('a', "all", &show_all, "print all available commands"),
        OPT_SET_UINT('m', "man", &help_format, "show man page", HELP_FORMAT_MAN),
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index dec8ced61fb0..7aaee39f6774 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -56,6 +56,10 @@ static int trace__read_syscall_info(struct trace *trace, int id)
 {
        char tp_name[128];
        struct syscall *sc;
+        const char *name = audit_syscall_to_name(id, trace->audit_machine);
+        if (name == NULL)
+                return -1;
        if (id > trace->syscalls.max) {
                struct syscall *nsyscalls = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
@@ -75,11 +79,8 @@ static int trace__read_syscall_info(struct trace *trace, int id)
        }
        sc = trace->syscalls.table + id;
-        sc->name = audit_syscall_to_name(id, trace->audit_machine);
+        sc->name = name;
-        if (sc->name == NULL)
+        sc->fmt  = syscall_fmt__find(sc->name);
-                return -1;
-        sc->fmt = syscall_fmt__find(sc->name);
        snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
        sc->tp_format = event_format__new("syscalls", tp_name);
@@ -267,6 +268,13 @@ again:
                        if (evlist->threads->map[0] == -1 || evlist->threads->nr > 1)
                                printf("%d ", sample.tid);
+                        if (sample.raw_data == NULL) {
+                                printf("%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n",
+                                       perf_evsel__name(evsel), sample.tid,
+                                       sample.cpu, sample.raw_size);
+                                continue;
+                        }
                        handler = evsel->handler.func;
                        handler(trace, evsel, &sample);
                }
diff --git a/tools/perf/util/parse-events-test.c b/tools/perf/util/parse-events-test.c
index 28c18d1d52c3..516ecd9ddd6e 100644
--- a/tools/perf/util/parse-events-test.c
+++ b/tools/perf/util/parse-events-test.c
@@ -513,7 +513,8 @@ static int test__group1(struct perf_evlist *evlist)
        TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
        TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
        TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
        TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 2);
        TEST_ASSERT_VAL("wrong leader", evsel->leader == leader);
@@ -599,7 +600,8 @@ static int test__group3(struct perf_evlist *evlist __maybe_unused)
        TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
        TEST_ASSERT_VAL("wrong exclude_kernel", !evsel->attr.exclude_kernel);
        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
        TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
        TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 3);
        TEST_ASSERT_VAL("wrong leader", evsel->leader == leader);
@@ -662,7 +664,8 @@ static int test__group4(struct perf_evlist *evlist __maybe_unused)
        TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
        TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
        TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
        TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 1);
        TEST_ASSERT_VAL("wrong group name", !evsel->group_name);
@@ -676,7 +679,8 @@ static int test__group4(struct perf_evlist *evlist __maybe_unused)
        TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
        TEST_ASSERT_VAL("wrong exclude_kernel", !evsel->attr.exclude_kernel);
        TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
        TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
        TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 2);
        TEST_ASSERT_VAL("wrong leader", evsel->leader == leader);
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index fb4b7ea6752f..8b3e5939afb6 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -39,7 +39,6 @@ int thread__set_comm(struct thread *self, const char *comm)
        err = self->comm == NULL ? -ENOMEM : 0;
        if (!err) {
                self->comm_set = true;
-                map_groups__flush(&self->mg);
        }
        return err;
 }
diff --git a/tools/testing/selftests/epoll/test_epoll.c b/tools/testing/selftests/epoll/test_epoll.c
index e0fcff1e8331..f7525392ce84 100644
--- a/tools/testing/selftests/epoll/test_epoll.c
+++ b/tools/testing/selftests/epoll/test_epoll.c
@@ -162,14 +162,14 @@ void *write_thread_function(void *function_data)
        int index;
        struct write_thread_data *thread_data =
                (struct write_thread_data *)function_data;
-        while (!write_thread_data->stop)
+        while (!thread_data->stop)
                for (index = 0;
                     !thread_data->stop && (index < thread_data->n_fds);
                     ++index)
                        if ((write(thread_data->fds[index], &data, 1) < 1) &&
                                (errno != EAGAIN) &&
                                (errno != EWOULDBLOCK)) {
-                                write_thread_data->status = errno;
+                                thread_data->status = errno;
                                return;
                        }
 }
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index cd1b03e80899..b76edf2f8333 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -35,7 +35,7 @@
 #include <sys/mount.h>
 #include <sys/statfs.h>
 #include "../../include/uapi/linux/magic.h"
-#include "../../include/linux/kernel-page-flags.h"
+#include "../../include/uapi/linux/kernel-page-flags.h"
 #ifndef MAX_PATH
diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
index af0f22fb1ef7..aca6edcbbc6f 100644
--- a/usr/gen_init_cpio.c
+++ b/usr/gen_init_cpio.c
@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location,
        int retval;
        int rc = -1;
        int namesize;
-        int i;
+        unsigned int i;
        mode |= S_IFREG;
@@ -381,25 +381,28 @@ error:
 static char *cpio_replace_env(char *new_location)
 {
-       char expanded[PATH_MAX + 1];
+        char expanded[PATH_MAX + 1];
-       char env_var[PATH_MAX + 1];
+        char env_var[PATH_MAX + 1];
-       char *start;
+        char *start;
-       char *end;
+        char *end;
-       for (start = NULL; (start = strstr(new_location, "${")); ) {
+        for (start = NULL; (start = strstr(new_location, "${")); ) {
-               end = strchr(start, '}');
+                end = strchr(start, '}');
-               if (start < end) {
+                if (start < end) {
-                       *env_var = *expanded = '\0';
+                        *env_var = *expanded = '\0';
-                       strncat(env_var, start + 2, end - start - 2);
+                        strncat(env_var, start + 2, end - start - 2);
-                       strncat(expanded, new_location, start - new_location);
+                        strncat(expanded, new_location, start - new_location);
-                       strncat(expanded, getenv(env_var), PATH_MAX);
+                        strncat(expanded, getenv(env_var),
-                       strncat(expanded, end + 1, PATH_MAX);
+                                PATH_MAX - strlen(expanded));
-                       strncpy(new_location, expanded, PATH_MAX);
+                        strncat(expanded, end + 1,
-               } else
+                                PATH_MAX - strlen(expanded));
-                       break;
+                        strncpy(new_location, expanded, PATH_MAX);
-       }
+                        new_location[PATH_MAX] = 0;
+                } else
-       return new_location;
+                        break;
+        }
+        return new_location;
 }
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index e59bb63cb089..be70035fd42a 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1322,9 +1322,7 @@ EXPORT_SYMBOL_GPL(kvm_release_page_clean);
 void kvm_release_pfn_clean(pfn_t pfn)
 {
-        WARN_ON(is_error_pfn(pfn));
+        if (!is_error_pfn(pfn) && !kvm_is_mmio_pfn(pfn))
-        if (!kvm_is_mmio_pfn(pfn))
                put_page(pfn_to_page(pfn));
 }
 EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);