diff --git a/[refs] b/[refs]
index b01b22add5d6..c4de6a2e8dc1 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: cba8df4be3bdf10c86a26c458c5fc2ca978eeb2c
+refs/heads/master: 7d0c399fe94d4fe572eadc7405654a282e5df63d
diff --git a/trunk/arch/m68k/include/asm/m528xsim.h b/trunk/arch/m68k/include/asm/m528xsim.h
index 497c31c803ff..d63b99ff7ff7 100644
--- a/trunk/arch/m68k/include/asm/m528xsim.h
+++ b/trunk/arch/m68k/include/asm/m528xsim.h
@@ -86,7 +86,7 @@
 /*
  *	QSPI module.
  */
-#define	MCFQSPI_BASE		(MCF_IPSBAR + 0x340)
+#define	MCFQSPI_IOBASE		(MCF_IPSBAR + 0x340)
 #define	MCFQSPI_SIZE		0x40
 
 #define	MCFQSPI_CS0		147
diff --git a/trunk/arch/m68k/kernel/ptrace.c b/trunk/arch/m68k/kernel/ptrace.c
index 1bc10e62b9af..8b4a2222e658 100644
--- a/trunk/arch/m68k/kernel/ptrace.c
+++ b/trunk/arch/m68k/kernel/ptrace.c
@@ -286,7 +286,7 @@ asmlinkage void syscall_trace(void)
 	}
 }
 
-#if defined(CONFIG_COLDFIRE) || !defined(CONFIG_MMU)
+#ifdef CONFIG_COLDFIRE
 asmlinkage int syscall_trace_enter(void)
 {
 	int ret = 0;
diff --git a/trunk/arch/m68k/kernel/time.c b/trunk/arch/m68k/kernel/time.c
index 707f0573ec6b..d7deb7fc7eb5 100644
--- a/trunk/arch/m68k/kernel/time.c
+++ b/trunk/arch/m68k/kernel/time.c
@@ -85,7 +85,7 @@ void __init time_init(void)
 	mach_sched_init(timer_interrupt);
 }
 
-#ifdef CONFIG_ARCH_USES_GETTIMEOFFSET
+#ifdef CONFIG_M68KCLASSIC
 
 u32 arch_gettimeoffset(void)
 {
@@ -108,4 +108,4 @@ static int __init rtc_init(void)
 
 module_init(rtc_init);
 
-#endif /* CONFIG_ARCH_USES_GETTIMEOFFSET */
+#endif /* CONFIG_M68KCLASSIC */
diff --git a/trunk/arch/m68k/platform/68328/timers.c b/trunk/arch/m68k/platform/68328/timers.c
index f4dc9b295609..c801c172b822 100644
--- a/trunk/arch/m68k/platform/68328/timers.c
+++ b/trunk/arch/m68k/platform/68328/timers.c
@@ -53,7 +53,6 @@
 #endif
 
 static u32 m68328_tick_cnt;
-static irq_handler_t timer_interrupt;
 
 /***************************************************************************/
 
@@ -63,7 +62,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
 	TSTAT &= 0;
 
 	m68328_tick_cnt += TICKS_PER_JIFFY;
-	return timer_interrupt(irq, dummy);
+	return arch_timer_interrupt(irq, dummy);
 }
 
 /***************************************************************************/
@@ -100,7 +99,7 @@ static struct clocksource m68328_clk = {
 
 /***************************************************************************/
 
-void hw_timer_init(irq_handler_t handler)
+void hw_timer_init(void)
 {
 	/* disable timer 1 */
 	TCTL = 0;
@@ -116,7 +115,6 @@ void hw_timer_init(irq_handler_t handler)
 	/* Enable timer 1 */
 	TCTL |= TCTL_TEN;
 	clocksource_register_hz(&m68328_clk, TICKS_PER_JIFFY*HZ);
-	timer_interrupt = handler;
 }
 
 /***************************************************************************/
diff --git a/trunk/arch/m68k/platform/68360/config.c b/trunk/arch/m68k/platform/68360/config.c
index 9877cefad1e7..255fc03913e9 100644
--- a/trunk/arch/m68k/platform/68360/config.c
+++ b/trunk/arch/m68k/platform/68360/config.c
@@ -35,7 +35,6 @@ extern void m360_cpm_reset(void);
 #define OSCILLATOR  (unsigned long int)33000000
 #endif
 
-static irq_handler_t timer_interrupt;
 unsigned long int system_clock;
 
 extern QUICC *pquicc;
@@ -53,7 +52,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
 
   pquicc->timer_ter1 = 0x0002; /* clear timer event */
 
-  return timer_interrupt(irq, dummy);
+  return arch_timer_interrupt(irq, dummy);
 }
 
 static struct irqaction m68360_timer_irq = {
@@ -62,7 +61,7 @@ static struct irqaction m68360_timer_irq = {
 	.handler = hw_tick,
 };
 
-void hw_timer_init(irq_handler_t handler)
+void hw_timer_init(void)
 {
   unsigned char prescaler;
   unsigned short tgcr_save;
@@ -95,8 +94,6 @@ void hw_timer_init(irq_handler_t handler)
 
   pquicc->timer_ter1 = 0x0003; /* clear timer events */
 
-  timer_interrupt = handler;
-
   /* enable timer 1 interrupt in CIMR */
   setup_irq(CPMVEC_TIMER1, &m68360_timer_irq);
 
diff --git a/trunk/arch/sh/Kconfig b/trunk/arch/sh/Kconfig
index 31d9db7913e4..99bcd0ee838d 100644
--- a/trunk/arch/sh/Kconfig
+++ b/trunk/arch/sh/Kconfig
@@ -32,8 +32,6 @@ config SUPERH
 	select GENERIC_SMP_IDLE_THREAD
 	select GENERIC_CLOCKEVENTS
 	select GENERIC_CMOS_UPDATE if SH_SH03 || SH_DREAMCAST
-	select GENERIC_STRNCPY_FROM_USER
-	select GENERIC_STRNLEN_USER
 	help
 	  The SuperH is a RISC processor targeted for use in embedded systems
 	  and consumer electronics; it was also used in the Sega Dreamcast
diff --git a/trunk/arch/sh/include/asm/uaccess.h b/trunk/arch/sh/include/asm/uaccess.h
index 8698a80ed00c..050f221fa898 100644
--- a/trunk/arch/sh/include/asm/uaccess.h
+++ b/trunk/arch/sh/include/asm/uaccess.h
@@ -25,8 +25,6 @@
 	(__chk_user_ptr(addr),		\
 	 __access_ok((unsigned long __force)(addr), (size)))
 
-#define user_addr_max()	(current_thread_info()->addr_limit.seg)
-
 /*
  * Uh, these should become the main single-value transfer routines ...
  * They automatically use the right size if we just have the right
@@ -102,11 +100,6 @@ struct __large_struct { unsigned long buf[100]; };
 # include "uaccess_64.h"
 #endif
 
-extern long strncpy_from_user(char *dest, const char __user *src, long count);
-
-extern __must_check long strlen_user(const char __user *str);
-extern __must_check long strnlen_user(const char __user *str, long n);
-
 /* Generic arbitrary sized copy.  */
 /* Return the number of bytes NOT copied */
 __kernel_size_t __copy_user(void *to, const void *from, __kernel_size_t n);
@@ -144,6 +137,37 @@ __kernel_size_t __clear_user(void *addr, __kernel_size_t size);
 	__cl_size;							\
 })
 
+/**
+ * strncpy_from_user: - Copy a NUL terminated string from userspace.
+ * @dst:   Destination address, in kernel space.  This buffer must be at
+ *         least @count bytes long.
+ * @src:   Source address, in user space.
+ * @count: Maximum number of bytes to copy, including the trailing NUL.
+ *
+ * Copies a NUL-terminated string from userspace to kernel space.
+ *
+ * On success, returns the length of the string (not including the trailing
+ * NUL).
+ *
+ * If access to userspace fails, returns -EFAULT (some data may have been
+ * copied).
+ *
+ * If @count is smaller than the length of the string, copies @count bytes
+ * and returns @count.
+ */
+#define strncpy_from_user(dest,src,count)				\
+({									\
+	unsigned long __sfu_src = (unsigned long)(src);			\
+	int __sfu_count = (int)(count);					\
+	long __sfu_res = -EFAULT;					\
+									\
+	if (__access_ok(__sfu_src, __sfu_count))			\
+		__sfu_res = __strncpy_from_user((unsigned long)(dest),	\
+				__sfu_src, __sfu_count);		\
+									\
+	__sfu_res;							\
+})
+
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
@@ -168,6 +192,43 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
 	return __copy_size;
 }
 
+/**
+ * strnlen_user: - Get the size of a string in user space.
+ * @s: The string to measure.
+ * @n: The maximum valid length
+ *
+ * Context: User context only.  This function may sleep.
+ *
+ * Get the size of a NUL-terminated string in user space.
+ *
+ * Returns the size of the string INCLUDING the terminating NUL.
+ * On exception, returns 0.
+ * If the string is too long, returns a value greater than @n.
+ */
+static inline long strnlen_user(const char __user *s, long n)
+{
+	if (!__addr_ok(s))
+		return 0;
+	else
+		return __strnlen_user(s, n);
+}
+
+/**
+ * strlen_user: - Get the size of a string in user space.
+ * @str: The string to measure.
+ *
+ * Context: User context only.  This function may sleep.
+ *
+ * Get the size of a NUL-terminated string in user space.
+ *
+ * Returns the size of the string INCLUDING the terminating NUL.
+ * On exception, returns 0.
+ *
+ * If there is a limit on the length of a valid string, you may wish to
+ * consider using strnlen_user() instead.
+ */
+#define strlen_user(str)	strnlen_user(str, ~0UL >> 1)
+
 /*
  * The exception table consists of pairs of addresses: the first is the
  * address of an instruction that is allowed to fault, and the second is
diff --git a/trunk/arch/sh/include/asm/uaccess_32.h b/trunk/arch/sh/include/asm/uaccess_32.h
index c0de7ee35ab7..ae0d24f6653f 100644
--- a/trunk/arch/sh/include/asm/uaccess_32.h
+++ b/trunk/arch/sh/include/asm/uaccess_32.h
@@ -170,4 +170,79 @@ __asm__ __volatile__( \
 
 extern void __put_user_unknown(void);
 
+static inline int
+__strncpy_from_user(unsigned long __dest, unsigned long __user __src, int __count)
+{
+	__kernel_size_t res;
+	unsigned long __dummy, _d, _s, _c;
+
+	__asm__ __volatile__(
+		"9:\n"
+		"mov.b	@%2+, %1\n\t"
+		"cmp/eq	#0, %1\n\t"
+		"bt/s	2f\n"
+		"1:\n"
+		"mov.b	%1, @%3\n\t"
+		"dt	%4\n\t"
+		"bf/s	9b\n\t"
+		" add	#1, %3\n\t"
+		"2:\n\t"
+		"sub	%4, %0\n"
+		"3:\n"
+		".section .fixup,\"ax\"\n"
+		"4:\n\t"
+		"mov.l	5f, %1\n\t"
+		"jmp	@%1\n\t"
+		" mov	%9, %0\n\t"
+		".balign 4\n"
+		"5:	.long 3b\n"
+		".previous\n"
+		".section __ex_table,\"a\"\n"
+		"	.balign 4\n"
+		"	.long 9b,4b\n"
+		".previous"
+		: "=r" (res), "=&z" (__dummy), "=r" (_s), "=r" (_d), "=r"(_c)
+		: "0" (__count), "2" (__src), "3" (__dest), "4" (__count),
+		  "i" (-EFAULT)
+		: "memory", "t");
+
+	return res;
+}
+
+/*
+ * Return the size of a string (including the ending 0 even when we have
+ * exceeded the maximum string length).
+ */
+static inline long __strnlen_user(const char __user *__s, long __n)
+{
+	unsigned long res;
+	unsigned long __dummy;
+
+	__asm__ __volatile__(
+		"1:\t"
+		"mov.b	@(%0,%3), %1\n\t"
+		"cmp/eq	%4, %0\n\t"
+		"bt/s	2f\n\t"
+		" add	#1, %0\n\t"
+		"tst	%1, %1\n\t"
+		"bf	1b\n\t"
+		"2:\n"
+		".section .fixup,\"ax\"\n"
+		"3:\n\t"
+		"mov.l	4f, %1\n\t"
+		"jmp	@%1\n\t"
+		" mov	#0, %0\n"
+		".balign 4\n"
+		"4:	.long 2b\n"
+		".previous\n"
+		".section __ex_table,\"a\"\n"
+		"	.balign 4\n"
+		"	.long 1b,3b\n"
+		".previous"
+		: "=z" (res), "=&r" (__dummy)
+		: "0" (0), "r" (__s), "r" (__n)
+		: "t");
+	return res;
+}
+
 #endif /* __ASM_SH_UACCESS_32_H */
diff --git a/trunk/arch/sh/include/asm/uaccess_64.h b/trunk/arch/sh/include/asm/uaccess_64.h
index 2e07e0f40c6a..56fd20b8cdcc 100644
--- a/trunk/arch/sh/include/asm/uaccess_64.h
+++ b/trunk/arch/sh/include/asm/uaccess_64.h
@@ -84,4 +84,8 @@ extern long __put_user_asm_l(void *, long);
 extern long __put_user_asm_q(void *, long);
 extern void __put_user_unknown(void);
 
+extern long __strnlen_user(const char *__s, long __n);
+extern int __strncpy_from_user(unsigned long __dest,
+	       unsigned long __user __src, int __count);
+
 #endif /* __ASM_SH_UACCESS_64_H */
diff --git a/trunk/arch/sh/include/asm/word-at-a-time.h b/trunk/arch/sh/include/asm/word-at-a-time.h
deleted file mode 100644
index 6e38953ff7fd..000000000000
--- a/trunk/arch/sh/include/asm/word-at-a-time.h
+++ /dev/null
@@ -1,53 +0,0 @@
-#ifndef __ASM_SH_WORD_AT_A_TIME_H
-#define __ASM_SH_WORD_AT_A_TIME_H
-
-#ifdef CONFIG_CPU_BIG_ENDIAN
-# include <asm-generic/word-at-a-time.h>
-#else
-/*
- * Little-endian version cribbed from x86.
- */
-struct word_at_a_time {
-	const unsigned long one_bits, high_bits;
-};
-
-#define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
-
-/* Carl Chatfield / Jan Achrenius G+ version for 32-bit */
-static inline long count_masked_bytes(long mask)
-{
-	/* (000000 0000ff 00ffff ffffff) -> ( 1 1 2 3 ) */
-	long a = (0x0ff0001+mask) >> 23;
-	/* Fix the 1 for 00 case */
-	return a & mask;
-}
-
-/* Return nonzero if it has a zero */
-static inline unsigned long has_zero(unsigned long a, unsigned long *bits, const struct word_at_a_time *c)
-{
-	unsigned long mask = ((a - c->one_bits) & ~a) & c->high_bits;
-	*bits = mask;
-	return mask;
-}
-
-static inline unsigned long prep_zero_mask(unsigned long a, unsigned long bits, const struct word_at_a_time *c)
-{
-	return bits;
-}
-
-static inline unsigned long create_zero_mask(unsigned long bits)
-{
-	bits = (bits - 1) & ~bits;
-	return bits >> 7;
-}
-
-/* The mask we created is directly usable as a bytemask */
-#define zero_bytemask(mask) (mask)
-
-static inline unsigned long find_zero(unsigned long mask)
-{
-	return count_masked_bytes(mask);
-}
-#endif
-
-#endif
diff --git a/trunk/arch/sh/kernel/cpu/sh5/entry.S b/trunk/arch/sh/kernel/cpu/sh5/entry.S
index b7cf6a547f11..ff1f0e6e9bec 100644
--- a/trunk/arch/sh/kernel/cpu/sh5/entry.S
+++ b/trunk/arch/sh/kernel/cpu/sh5/entry.S
@@ -1568,6 +1568,86 @@ ___clear_user_exit:
 
 #endif /* CONFIG_MMU */
 
+/*
+ * int __strncpy_from_user(unsigned long __dest, unsigned long __src,
+ *			   int __count)
+ *
+ * Inputs:
+ * (r2)  target address
+ * (r3)  source address
+ * (r4)  maximum size in bytes
+ *
+ * Ouputs:
+ * (*r2) copied data
+ * (r2)  -EFAULT (in case of faulting)
+ *       copied data (otherwise)
+ */
+	.global	__strncpy_from_user
+__strncpy_from_user:
+	pta	___strncpy_from_user1, tr0
+	pta	___strncpy_from_user_done, tr1
+	or	r4, ZERO, r5		/* r5 = original count */
+	beq/u	r4, r63, tr1		/* early exit if r4==0 */
+	movi	-(EFAULT), r6		/* r6 = reply, no real fixup */
+	or	ZERO, ZERO, r7		/* r7 = data, clear top byte of data */
+
+___strncpy_from_user1:
+	ld.b	r3, 0, r7		/* Fault address: only in reading */
+	st.b	r2, 0, r7
+	addi	r2, 1, r2
+	addi	r3, 1, r3
+	beq/u	ZERO, r7, tr1
+	addi	r4, -1, r4		/* return real number of copied bytes */
+	bne/l	ZERO, r4, tr0
+
+___strncpy_from_user_done:
+	sub	r5, r4, r6		/* If done, return copied */
+
+___strncpy_from_user_exit:
+	or	r6, ZERO, r2
+	ptabs	LINK, tr0
+	blink	tr0, ZERO
+
+/*
+ * extern long __strnlen_user(const char *__s, long __n)
+ *
+ * Inputs:
+ * (r2)  source address
+ * (r3)  source size in bytes
+ *
+ * Ouputs:
+ * (r2)  -EFAULT (in case of faulting)
+ *       string length (otherwise)
+ */
+	.global	__strnlen_user
+__strnlen_user:
+	pta	___strnlen_user_set_reply, tr0
+	pta	___strnlen_user1, tr1
+	or	ZERO, ZERO, r5		/* r5 = counter */
+	movi	-(EFAULT), r6		/* r6 = reply, no real fixup */
+	or	ZERO, ZERO, r7		/* r7 = data, clear top byte of data */
+	beq	r3, ZERO, tr0
+
+___strnlen_user1:
+	ldx.b	r2, r5, r7		/* Fault address: only in reading */
+	addi	r3, -1, r3		/* No real fixup */
+	addi	r5, 1, r5
+	beq	r3, ZERO, tr0
+	bne	r7, ZERO, tr1
+! The line below used to be active.  This meant led to a junk byte lying between each pair
+! of entries in the argv & envp structures in memory.  Whilst the program saw the right data
+! via the argv and envp arguments to main, it meant the 'flat' representation visible through
+! /proc/$pid/cmdline was corrupt, causing trouble with ps, for example.
+!	addi	r5, 1, r5		/* Include '\0' */
+
+___strnlen_user_set_reply:
+	or	r5, ZERO, r6		/* If done, return counter */
+
+___strnlen_user_exit:
+	or	r6, ZERO, r2
+	ptabs	LINK, tr0
+	blink	tr0, ZERO
+
 /*
  * extern long __get_user_asm_?(void *val, long addr)
  *
@@ -1902,6 +1982,8 @@ asm_uaccess_start:
 	.long	___copy_user2, ___copy_user_exit
 	.long	___clear_user1, ___clear_user_exit
 #endif
+	.long	___strncpy_from_user1, ___strncpy_from_user_exit
+	.long	___strnlen_user1, ___strnlen_user_exit
 	.long	___get_user_asm_b1, ___get_user_asm_b_exit
 	.long	___get_user_asm_w1, ___get_user_asm_w_exit
 	.long	___get_user_asm_l1, ___get_user_asm_l_exit
diff --git a/trunk/arch/sh/kernel/sh_ksyms_64.c b/trunk/arch/sh/kernel/sh_ksyms_64.c
index 26a0774f5272..45afa5c51f67 100644
--- a/trunk/arch/sh/kernel/sh_ksyms_64.c
+++ b/trunk/arch/sh/kernel/sh_ksyms_64.c
@@ -32,6 +32,8 @@ EXPORT_SYMBOL(__get_user_asm_b);
 EXPORT_SYMBOL(__get_user_asm_w);
 EXPORT_SYMBOL(__get_user_asm_l);
 EXPORT_SYMBOL(__get_user_asm_q);
+EXPORT_SYMBOL(__strnlen_user);
+EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(__copy_user);
diff --git a/trunk/arch/x86/crypto/aesni-intel_asm.S b/trunk/arch/x86/crypto/aesni-intel_asm.S
index 3470624d7835..be6d9e365a80 100644
--- a/trunk/arch/x86/crypto/aesni-intel_asm.S
+++ b/trunk/arch/x86/crypto/aesni-intel_asm.S
@@ -2460,12 +2460,10 @@ ENTRY(aesni_cbc_dec)
 	pxor IN3, STATE4
 	movaps IN4, IV
 #else
+	pxor (INP), STATE2
+	pxor 0x10(INP), STATE3
 	pxor IN1, STATE4
 	movaps IN2, IV
-	movups (INP), IN1
-	pxor IN1, STATE2
-	movups 0x10(INP), IN2
-	pxor IN2, STATE3
 #endif
 	movups STATE1, (OUTP)
 	movups STATE2, 0x10(OUTP)
diff --git a/trunk/drivers/base/regmap/regmap.c b/trunk/drivers/base/regmap/regmap.c
index c89aa01fb1de..0bcda488f11c 100644
--- a/trunk/drivers/base/regmap/regmap.c
+++ b/trunk/drivers/base/regmap/regmap.c
@@ -246,11 +246,11 @@ struct regmap *regmap_init(struct device *dev,
 		map->lock = regmap_lock_mutex;
 		map->unlock = regmap_unlock_mutex;
 	}
+	map->format.buf_size = (config->reg_bits + config->val_bits) / 8;
 	map->format.reg_bytes = DIV_ROUND_UP(config->reg_bits, 8);
 	map->format.pad_bytes = config->pad_bits / 8;
 	map->format.val_bytes = DIV_ROUND_UP(config->val_bits, 8);
-	map->format.buf_size = DIV_ROUND_UP(config->reg_bits +
-			config->val_bits + config->pad_bits, 8);
+	map->format.buf_size += map->format.pad_bytes;
 	map->reg_shift = config->pad_bits % 8;
 	if (config->reg_stride)
 		map->reg_stride = config->reg_stride;
@@ -368,7 +368,7 @@ struct regmap *regmap_init(struct device *dev,
 
 	ret = regcache_init(map, config);
 	if (ret < 0)
-		goto err_debugfs;
+		goto err_free_workbuf;
 
 	/* Add a devres resource for dev_get_regmap() */
 	m = devres_alloc(dev_get_regmap_release, sizeof(*m), GFP_KERNEL);
@@ -383,8 +383,7 @@ struct regmap *regmap_init(struct device *dev,
 
 err_cache:
 	regcache_exit(map);
-err_debugfs:
-	regmap_debugfs_exit(map);
+err_free_workbuf:
 	kfree(map->work_buf);
 err_map:
 	kfree(map);
@@ -472,7 +471,6 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 
 	return ret;
 }
-EXPORT_SYMBOL_GPL(regmap_reinit_cache);
 
 /**
  * regmap_exit(): Free a previously allocated register map
diff --git a/trunk/drivers/char/hw_random/atmel-rng.c b/trunk/drivers/char/hw_random/atmel-rng.c
index 6289f0eee24c..f518b99f53f5 100644
--- a/trunk/drivers/char/hw_random/atmel-rng.c
+++ b/trunk/drivers/char/hw_random/atmel-rng.c
@@ -36,13 +36,6 @@ static int atmel_trng_read(struct hwrng *rng, void *buf, size_t max,
 	/* data ready? */
 	if (readl(trng->base + TRNG_ODATA) & 1) {
 		*data = readl(trng->base + TRNG_ODATA);
-		/*
-		  ensure data ready is only set again AFTER the next data
-		  word is ready in case it got set between checking ISR
-		  and reading ODATA, so we don't risk re-reading the
-		  same word
-		*/
-		readl(trng->base + TRNG_ISR);
 		return 4;
 	} else
 		return 0;
diff --git a/trunk/drivers/clocksource/sh_cmt.c b/trunk/drivers/clocksource/sh_cmt.c
index 32fe9ef5cc5c..98b06baafcc6 100644
--- a/trunk/drivers/clocksource/sh_cmt.c
+++ b/trunk/drivers/clocksource/sh_cmt.c
@@ -48,13 +48,13 @@ struct sh_cmt_priv {
 	unsigned long next_match_value;
 	unsigned long max_match_value;
 	unsigned long rate;
-	spinlock_t lock;
+	raw_spinlock_t lock;
 	struct clock_event_device ced;
 	struct clocksource cs;
 	unsigned long total_cycles;
 };
 
-static DEFINE_SPINLOCK(sh_cmt_lock);
+static DEFINE_RAW_SPINLOCK(sh_cmt_lock);
 
 #define CMSTR -1 /* shared register */
 #define CMCSR 0 /* channel register */
@@ -139,7 +139,7 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
 	unsigned long flags, value;
 
 	/* start stop register shared by multiple timer channels */
-	spin_lock_irqsave(&sh_cmt_lock, flags);
+	raw_spin_lock_irqsave(&sh_cmt_lock, flags);
 	value = sh_cmt_read(p, CMSTR);
 
 	if (start)
@@ -148,7 +148,7 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
 		value &= ~(1 << cfg->timer_bit);
 
 	sh_cmt_write(p, CMSTR, value);
-	spin_unlock_irqrestore(&sh_cmt_lock, flags);
+	raw_spin_unlock_irqrestore(&sh_cmt_lock, flags);
 }
 
 static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
@@ -328,9 +328,9 @@ static void sh_cmt_set_next(struct sh_cmt_priv *p, unsigned long delta)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&p->lock, flags);
+	raw_spin_lock_irqsave(&p->lock, flags);
 	__sh_cmt_set_next(p, delta);
-	spin_unlock_irqrestore(&p->lock, flags);
+	raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static irqreturn_t sh_cmt_interrupt(int irq, void *dev_id)
@@ -385,7 +385,7 @@ static int sh_cmt_start(struct sh_cmt_priv *p, unsigned long flag)
 	int ret = 0;
 	unsigned long flags;
 
-	spin_lock_irqsave(&p->lock, flags);
+	raw_spin_lock_irqsave(&p->lock, flags);
 
 	if (!(p->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE)))
 		ret = sh_cmt_enable(p, &p->rate);
@@ -398,7 +398,7 @@ static int sh_cmt_start(struct sh_cmt_priv *p, unsigned long flag)
 	if ((flag == FLAG_CLOCKSOURCE) && (!(p->flags & FLAG_CLOCKEVENT)))
 		__sh_cmt_set_next(p, p->max_match_value);
  out:
-	spin_unlock_irqrestore(&p->lock, flags);
+	raw_spin_unlock_irqrestore(&p->lock, flags);
 
 	return ret;
 }
@@ -408,7 +408,7 @@ static void sh_cmt_stop(struct sh_cmt_priv *p, unsigned long flag)
 	unsigned long flags;
 	unsigned long f;
 
-	spin_lock_irqsave(&p->lock, flags);
+	raw_spin_lock_irqsave(&p->lock, flags);
 
 	f = p->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE);
 	p->flags &= ~flag;
@@ -420,7 +420,7 @@ static void sh_cmt_stop(struct sh_cmt_priv *p, unsigned long flag)
 	if ((flag == FLAG_CLOCKEVENT) && (p->flags & FLAG_CLOCKSOURCE))
 		__sh_cmt_set_next(p, p->max_match_value);
 
-	spin_unlock_irqrestore(&p->lock, flags);
+	raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static struct sh_cmt_priv *cs_to_sh_cmt(struct clocksource *cs)
@@ -435,13 +435,13 @@ static cycle_t sh_cmt_clocksource_read(struct clocksource *cs)
 	unsigned long value;
 	int has_wrapped;
 
-	spin_lock_irqsave(&p->lock, flags);
+	raw_spin_lock_irqsave(&p->lock, flags);
 	value = p->total_cycles;
 	raw = sh_cmt_get_counter(p, &has_wrapped);
 
 	if (unlikely(has_wrapped))
 		raw += p->match_value + 1;
-	spin_unlock_irqrestore(&p->lock, flags);
+	raw_spin_unlock_irqrestore(&p->lock, flags);
 
 	return value + raw;
 }
@@ -591,7 +591,7 @@ static int sh_cmt_register(struct sh_cmt_priv *p, char *name,
 		p->max_match_value = (1 << p->width) - 1;
 
 	p->match_value = p->max_match_value;
-	spin_lock_init(&p->lock);
+	raw_spin_lock_init(&p->lock);
 
 	if (clockevent_rating)
 		sh_cmt_register_clockevent(p, name, clockevent_rating);
diff --git a/trunk/drivers/gpu/drm/radeon/evergreen_cs.c b/trunk/drivers/gpu/drm/radeon/evergreen_cs.c
index c16554122ccd..4e7dd2b4843d 100644
--- a/trunk/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/trunk/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -52,7 +52,6 @@ struct evergreen_cs_track {
 	u32			cb_color_view[12];
 	u32			cb_color_pitch[12];
 	u32			cb_color_slice[12];
-	u32			cb_color_slice_idx[12];
 	u32			cb_color_attrib[12];
 	u32			cb_color_cmask_slice[8];/* unused */
 	u32			cb_color_fmask_slice[8];/* unused */
@@ -128,14 +127,12 @@ static void evergreen_cs_track_init(struct evergreen_cs_track *track)
 		track->cb_color_info[i] = 0;
 		track->cb_color_view[i] = 0xFFFFFFFF;
 		track->cb_color_pitch[i] = 0;
-		track->cb_color_slice[i] = 0xfffffff;
-		track->cb_color_slice_idx[i] = 0;
+		track->cb_color_slice[i] = 0;
 	}
 	track->cb_target_mask = 0xFFFFFFFF;
 	track->cb_shader_mask = 0xFFFFFFFF;
 	track->cb_dirty = true;
 
-	track->db_depth_slice = 0xffffffff;
 	track->db_depth_view = 0xFFFFC000;
 	track->db_depth_size = 0xFFFFFFFF;
 	track->db_depth_control = 0xFFFFFFFF;
@@ -253,9 +250,10 @@ static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
 {
 	struct evergreen_cs_track *track = p->track;
 	unsigned palign, halign, tileb, slice_pt;
-	unsigned mtile_pr, mtile_ps, mtileb;
 
 	tileb = 64 * surf->bpe * surf->nsamples;
+	palign = track->group_size / (8 * surf->bpe * surf->nsamples);
+	palign = MAX(8, palign);
 	slice_pt = 1;
 	if (tileb > surf->tsplit) {
 		slice_pt = tileb / surf->tsplit;
@@ -264,10 +262,7 @@ static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
 	/* macro tile width & height */
 	palign = (8 * surf->bankw * track->npipes) * surf->mtilea;
 	halign = (8 * surf->bankh * surf->nbanks) / surf->mtilea;
-	mtileb = (palign / 8) * (halign / 8) * tileb;;
-	mtile_pr = surf->nbx / palign;
-	mtile_ps = (mtile_pr * surf->nby) / halign;
-	surf->layer_size = mtile_ps * mtileb * slice_pt;
+	surf->layer_size = surf->nbx * surf->nby * surf->bpe * slice_pt;
 	surf->base_align = (palign / 8) * (halign / 8) * tileb;
 	surf->palign = palign;
 	surf->halign = halign;
@@ -439,39 +434,6 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 
 	offset += surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->cb_color_bo[id])) {
-		/* old ddx are broken they allocate bo with w*h*bpp but
-		 * program slice with ALIGN(h, 8), catch this and patch
-		 * command stream.
-		 */
-		if (!surf.mode) {
-			volatile u32 *ib = p->ib.ptr;
-			unsigned long tmp, nby, bsize, size, min = 0;
-
-			/* find the height the ddx wants */
-			if (surf.nby > 8) {
-				min = surf.nby - 8;
-			}
-			bsize = radeon_bo_size(track->cb_color_bo[id]);
-			tmp = track->cb_color_bo_offset[id] << 8;
-			for (nby = surf.nby; nby > min; nby--) {
-				size = nby * surf.nbx * surf.bpe * surf.nsamples;
-				if ((tmp + size * mslice) <= bsize) {
-					break;
-				}
-			}
-			if (nby > min) {
-				surf.nby = nby;
-				slice = ((nby * surf.nbx) / 64) - 1;
-				if (!evergreen_surface_check(p, &surf, "cb")) {
-					/* check if this one works */
-					tmp += surf.layer_size * mslice;
-					if (tmp <= bsize) {
-						ib[track->cb_color_slice_idx[id]] = slice;
-						goto old_ddx_ok;
-					}
-				}
-			}
-		}
 		dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
 			 "offset %d, max layer %d, bo size %ld, slice %d)\n",
 			 __func__, __LINE__, id, surf.layer_size,
@@ -484,7 +446,6 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 			surf.tsplit, surf.mtilea);
 		return -EINVAL;
 	}
-old_ddx_ok:
 
 	return 0;
 }
@@ -1571,7 +1532,6 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
 	case CB_COLOR7_SLICE:
 		tmp = (reg - CB_COLOR0_SLICE) / 0x3c;
 		track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
-		track->cb_color_slice_idx[tmp] = idx;
 		track->cb_dirty = true;
 		break;
 	case CB_COLOR8_SLICE:
@@ -1580,7 +1540,6 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
 	case CB_COLOR11_SLICE:
 		tmp = ((reg - CB_COLOR8_SLICE) / 0x1c) + 8;
 		track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
-		track->cb_color_slice_idx[tmp] = idx;
 		track->cb_dirty = true;
 		break;
 	case CB_COLOR0_ATTRIB:
diff --git a/trunk/drivers/gpu/drm/radeon/radeon_drv.c b/trunk/drivers/gpu/drm/radeon/radeon_drv.c
index 03e5f5df40f1..f0bb2b543b13 100644
--- a/trunk/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/trunk/drivers/gpu/drm/radeon/radeon_drv.c
@@ -57,10 +57,9 @@
  *   2.13.0 - virtual memory support, streamout
  *   2.14.0 - add evergreen tiling informations
  *   2.15.0 - add max_pipes query
- *   2.16.0 - fix evergreen 2D tiled surface calculation
  */
 #define KMS_DRIVER_MAJOR	2
-#define KMS_DRIVER_MINOR	16
+#define KMS_DRIVER_MINOR	15
 #define KMS_DRIVER_PATCHLEVEL	0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/trunk/drivers/gpu/drm/ttm/ttm_bo.c b/trunk/drivers/gpu/drm/ttm/ttm_bo.c
index 36f4b28c1b90..b67cfcaa661f 100644
--- a/trunk/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/trunk/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1204,7 +1204,6 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
 			(*destroy)(bo);
 		else
 			kfree(bo);
-		ttm_mem_global_free(mem_glob, acc_size);
 		return -EINVAL;
 	}
 	bo->destroy = destroy;
@@ -1308,14 +1307,22 @@ int ttm_bo_create(struct ttm_bo_device *bdev,
 			struct ttm_buffer_object **p_bo)
 {
 	struct ttm_buffer_object *bo;
+	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
 	size_t acc_size;
 	int ret;
 
+	acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
+	ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
+	if (unlikely(ret != 0))
+		return ret;
+
 	bo = kzalloc(sizeof(*bo), GFP_KERNEL);
-	if (unlikely(bo == NULL))
+
+	if (unlikely(bo == NULL)) {
+		ttm_mem_global_free(mem_glob, acc_size);
 		return -ENOMEM;
+	}
 
-	acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
 	ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
 				buffer_start, interruptible,
 			  persistent_swap_storage, acc_size, NULL, NULL);
diff --git a/trunk/drivers/regulator/anatop-regulator.c b/trunk/drivers/regulator/anatop-regulator.c
index e82e7eaac0f1..3660bace123c 100644
--- a/trunk/drivers/regulator/anatop-regulator.c
+++ b/trunk/drivers/regulator/anatop-regulator.c
@@ -224,7 +224,7 @@ static struct platform_driver anatop_regulator_driver = {
 		.of_match_table = of_anatop_regulator_match_tbl,
 	},
 	.probe	= anatop_regulator_probe,
-	.remove	= __devexit_p(anatop_regulator_remove),
+	.remove	= anatop_regulator_remove,
 };
 
 static int __init anatop_regulator_init(void)
diff --git a/trunk/drivers/regulator/core.c b/trunk/drivers/regulator/core.c
index 09a737c868b5..7584a74eec8a 100644
--- a/trunk/drivers/regulator/core.c
+++ b/trunk/drivers/regulator/core.c
@@ -2050,9 +2050,6 @@ int regulator_map_voltage_linear(struct regulator_dev *rdev,
 		return -EINVAL;
 	}
 
-	if (min_uV < rdev->desc->min_uV)
-		min_uV = rdev->desc->min_uV;
-
 	ret = DIV_ROUND_UP(min_uV - rdev->desc->min_uV, rdev->desc->uV_step);
 	if (ret < 0)
 		return ret;
diff --git a/trunk/drivers/regulator/gpio-regulator.c b/trunk/drivers/regulator/gpio-regulator.c
index 242851a4c1a6..9997d7aaca84 100644
--- a/trunk/drivers/regulator/gpio-regulator.c
+++ b/trunk/drivers/regulator/gpio-regulator.c
@@ -101,20 +101,16 @@ static int gpio_regulator_get_value(struct regulator_dev *dev)
 }
 
 static int gpio_regulator_set_value(struct regulator_dev *dev,
-					int min, int max, unsigned *selector)
+					int min, int max)
 {
 	struct gpio_regulator_data *data = rdev_get_drvdata(dev);
-	int ptr, target = 0, state, best_val = INT_MAX;
+	int ptr, target, state, best_val = INT_MAX;
 
 	for (ptr = 0; ptr < data->nr_states; ptr++)
 		if (data->states[ptr].value < best_val &&
 		    data->states[ptr].value >= min &&
-		    data->states[ptr].value <= max) {
+		    data->states[ptr].value <= max)
 			target = data->states[ptr].gpios;
-			best_val = data->states[ptr].value;
-			if (selector)
-				*selector = ptr;
-		}
 
 	if (best_val == INT_MAX)
 		return -EINVAL;
@@ -132,7 +128,7 @@ static int gpio_regulator_set_voltage(struct regulator_dev *dev,
 					int min_uV, int max_uV,
 					unsigned *selector)
 {
-	return gpio_regulator_set_value(dev, min_uV, max_uV, selector);
+	return gpio_regulator_set_value(dev, min_uV, max_uV);
 }
 
 static int gpio_regulator_list_voltage(struct regulator_dev *dev,
@@ -149,7 +145,7 @@ static int gpio_regulator_list_voltage(struct regulator_dev *dev,
 static int gpio_regulator_set_current_limit(struct regulator_dev *dev,
 					int min_uA, int max_uA)
 {
-	return gpio_regulator_set_value(dev, min_uA, max_uA, NULL);
+	return gpio_regulator_set_value(dev, min_uA, max_uA);
 }
 
 static struct regulator_ops gpio_regulator_voltage_ops = {
@@ -290,7 +286,7 @@ static int __devinit gpio_regulator_probe(struct platform_device *pdev)
 
 	cfg.dev = &pdev->dev;
 	cfg.init_data = config->init_data;
-	cfg.driver_data = drvdata;
+	cfg.driver_data = &drvdata;
 
 	drvdata->dev = regulator_register(&drvdata->desc, &cfg);
 	if (IS_ERR(drvdata->dev)) {
diff --git a/trunk/drivers/regulator/max8649.c b/trunk/drivers/regulator/max8649.c
index 9d540cd02dab..1f4bb80457b3 100644
--- a/trunk/drivers/regulator/max8649.c
+++ b/trunk/drivers/regulator/max8649.c
@@ -259,7 +259,6 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
 	config.dev = &client->dev;
 	config.init_data = pdata->regulator;
 	config.driver_data = info;
-	config.regmap = info->regmap;
 
 	info->regulator = regulator_register(&dcdc_desc, &config);
 	if (IS_ERR(info->regulator)) {
diff --git a/trunk/drivers/regulator/palmas-regulator.c b/trunk/drivers/regulator/palmas-regulator.c
index 9b7ca90057d5..c4435f608df7 100644
--- a/trunk/drivers/regulator/palmas-regulator.c
+++ b/trunk/drivers/regulator/palmas-regulator.c
@@ -775,6 +775,9 @@ static __devinit int palmas_probe(struct platform_device *pdev)
 err_unregister_regulator:
 	while (--id >= 0)
 		regulator_unregister(pmic->rdev[id]);
+	kfree(pmic->rdev);
+	kfree(pmic->desc);
+	kfree(pmic);
 	return ret;
 }
 
@@ -785,6 +788,10 @@ static int __devexit palmas_remove(struct platform_device *pdev)
 
 	for (id = 0; id < PALMAS_NUM_REGS; id++)
 		regulator_unregister(pmic->rdev[id]);
+
+	kfree(pmic->rdev);
+	kfree(pmic->desc);
+	kfree(pmic);
 	return 0;
 }
 
diff --git a/trunk/fs/exofs/sys.c b/trunk/fs/exofs/sys.c
index 5a7b691e748b..e32bc919e4e3 100644
--- a/trunk/fs/exofs/sys.c
+++ b/trunk/fs/exofs/sys.c
@@ -109,7 +109,7 @@ static struct kobj_type odev_ktype = {
 static struct kobj_type uuid_ktype = {
 };
 
-void exofs_sysfs_dbg_print(void)
+void exofs_sysfs_dbg_print()
 {
 #ifdef CONFIG_EXOFS_DEBUG
 	struct kobject *k_name, *k_tmp;
diff --git a/trunk/fs/fs-writeback.c b/trunk/fs/fs-writeback.c
index 41a3ccff18d8..8d2fb8c88cf3 100644
--- a/trunk/fs/fs-writeback.c
+++ b/trunk/fs/fs-writeback.c
@@ -664,7 +664,6 @@ static long writeback_sb_inodes(struct super_block *sb,
 			/* Wait for I_SYNC. This function drops i_lock... */
 			inode_sleep_on_writeback(inode);
 			/* Inode may be gone, start again */
-			spin_lock(&wb->list_lock);
 			continue;
 		}
 		inode->i_state |= I_SYNC;
diff --git a/trunk/include/drm/drm_crtc.h b/trunk/include/drm/drm_crtc.h
index bac55c215113..73e45600f95d 100644
--- a/trunk/include/drm/drm_crtc.h
+++ b/trunk/include/drm/drm_crtc.h
@@ -54,7 +54,7 @@ struct drm_mode_object {
 	struct drm_object_properties *properties;
 };
 
-#define DRM_OBJECT_MAX_PROPERTY 24
+#define DRM_OBJECT_MAX_PROPERTY 16
 struct drm_object_properties {
 	int count;
 	uint32_t ids[DRM_OBJECT_MAX_PROPERTY];