295 files changed, 2422 insertions, 2650 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 274b32d12532..492e81df2968 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -387,26 +387,6 @@ Who:	Tejun Heo <tj@kernel.org>
 
 ----------------------------
 
-What:   Support for lcd_switch and display_get in asus-laptop driver
-When:   March 2010
-Why:    These two features use non-standard interfaces. There are the
-        only features that really need multiple path to guess what's
-        the right method name on a specific laptop.
-
-        Removing them will allow to remove a lot of code an significantly
-        clean the drivers.
-
-        This will affect the backlight code which won't be able to know
-        if the backlight is on or off. The platform display file will also be
-        write only (like the one in eeepc-laptop).
-
-        This should'nt affect a lot of user because they usually know
-        when their display is on or off.
-
-Who:    Corentin Chary <corentin.chary@gmail.com>
-
-----------------------------
-
 What:   sysfs-class-rfkill state file
 When:   Feb 2014
 Files:  net/rfkill/core.c
diff --git a/MAINTAINERS b/MAINTAINERS
index 6b4b9cdec370..ec3600306289 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -184,10 +184,9 @@ F:	Documentation/filesystems/9p.txt
 F:      fs/9p/
 
 A2232 SERIAL BOARD DRIVER
-M:      Enver Haase <A2232@gmx.net>
 L:      linux-m68k@lists.linux-m68k.org
-S:      Maintained
-F:      drivers/char/ser_a2232*
+S:      Orphan
+F:      drivers/staging/generic_serial/ser_a2232*
 
 AACRAID SCSI RAID DRIVER
 M:      Adaptec OEM Raid Solutions <aacraid@adaptec.com>
@@ -877,6 +876,13 @@ F:	arch/arm/mach-mv78xx0/
 F:      arch/arm/mach-orion5x/
 F:      arch/arm/plat-orion/
 
+ARM/Orion SoC/Technologic Systems TS-78xx platform support
+M:      Alexander Clouter <alex@digriz.org.uk>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+W:      http://www.digriz.org.uk/ts78xx/kernel
+S:      Maintained
+F:      arch/arm/mach-orion5x/ts78xx-*
+
 ARM/MIOA701 MACHINE SUPPORT
 M:      Robert Jarzmik <robert.jarzmik@free.fr>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1063,7 +1069,7 @@ F:	arch/arm/mach-shmobile/
 F:      drivers/sh/
 
 ARM/TELECHIPS ARM ARCHITECTURE
-M:      "Hans J. Koch" <hjk@linutronix.de>
+M:      "Hans J. Koch" <hjk@hansjkoch.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/plat-tcc/
@@ -1823,11 +1829,10 @@ S:	Maintained
 F:      drivers/platform/x86/compal-laptop.c
 
 COMPUTONE INTELLIPORT MULTIPORT CARD
-M:      "Michael H. Warfield" <mhw@wittsend.com>
 W:      http://www.wittsend.com/computone.html
-S:      Maintained
+S:      Orphan
 F:      Documentation/serial/computone.txt
-F:      drivers/char/ip2/
+F:      drivers/staging/tty/ip2/
 
 CONEXANT ACCESSRUNNER USB DRIVER
 M:      Simon Arlott <cxacru@fire.lp0.eu>
@@ -2010,7 +2015,7 @@ F:	drivers/net/wan/cycx*
 CYCLADES ASYNC MUX DRIVER
 W:      http://www.cyclades.com/
 S:      Orphan
-F:      drivers/char/cyclades.c
+F:      drivers/tty/cyclades.c
 F:      include/linux/cyclades.h
 
 CYCLADES PC300 DRIVER
@@ -2124,8 +2129,8 @@ L:	Eng.Linux@digi.com
 W:      http://www.digi.com
 S:      Orphan
 F:      Documentation/serial/digiepca.txt
-F:      drivers/char/epca*
-F:      drivers/char/digi*
+F:      drivers/staging/tty/epca*
+F:      drivers/staging/tty/digi*
 
 DIOLAN U2C-12 I2C DRIVER
 M:      Guenter Roeck <guenter.roeck@ericsson.com>
@@ -4077,7 +4082,7 @@ F:	drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
 
 MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER
-M:      "Hans J. Koch" <hjk@linutronix.de>
+M:      "Hans J. Koch" <hjk@hansjkoch.de>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/max6650
@@ -4192,7 +4197,7 @@ MOXA SMARTIO/INDUSTIO/INTELLIO SERIAL CARD
 M:      Jiri Slaby <jirislaby@gmail.com>
 S:      Maintained
 F:      Documentation/serial/moxa-smartio
-F:      drivers/char/mxser.*
+F:      drivers/tty/mxser.*
 
 MSI LAPTOP SUPPORT
 M:      "Lee, Chun-Yi" <jlee@novell.com>
@@ -4234,7 +4239,7 @@ F:	sound/oss/msnd*
 
 MULTITECH MULTIPORT CARD (ISICOM)
 S:      Orphan
-F:      drivers/char/isicom.c
+F:      drivers/tty/isicom.c
 F:      include/linux/isicom.h
 
 MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER
@@ -5273,14 +5278,14 @@ F:	drivers/memstick/host/r592.*
 RISCOM8 DRIVER
 S:      Orphan
 F:      Documentation/serial/riscom8.txt
-F:      drivers/char/riscom8*
+F:      drivers/staging/tty/riscom8*
 
 ROCKETPORT DRIVER
 P:      Comtrol Corp.
 W:      http://www.comtrol.com
 S:      Maintained
 F:      Documentation/serial/rocket.txt
-F:      drivers/char/rocket*
+F:      drivers/tty/rocket*
 
 ROSE NETWORK LAYER
 M:      Ralf Baechle <ralf@linux-mips.org>
@@ -5916,10 +5921,9 @@ F:	arch/arm/mach-spear6xx/spear600.c
 F:      arch/arm/mach-spear6xx/spear600_evb.c
 
 SPECIALIX IO8+ MULTIPORT SERIAL CARD DRIVER
-M:      Roger Wolff <R.E.Wolff@BitWizard.nl>
-S:      Supported
+S:      Orphan
 F:      Documentation/serial/specialix.txt
-F:      drivers/char/specialix*
+F:      drivers/staging/tty/specialix*
 
 SPI SUBSYSTEM
 M:      David Brownell <dbrownell@users.sourceforge.net>
@@ -5964,7 +5968,6 @@ F:	arch/alpha/kernel/srm_env.c
 
 STABLE BRANCH
 M:      Greg Kroah-Hartman <greg@kroah.com>
-M:      Chris Wright <chrisw@sous-sol.org>
 L:      stable@kernel.org
 S:      Maintained
 
@@ -6248,7 +6251,8 @@ M:	Greg Ungerer <gerg@uclinux.org>
 W:      http://www.uclinux.org/
 L:      uclinux-dev@uclinux.org  (subscribers-only)
 S:      Maintained
-F:      arch/m68knommu/
+F:      arch/m68k/*/*_no.*
+F:      arch/m68k/include/asm/*_no.*
 
 UCLINUX FOR RENESAS H8/300 (H8300)
 M:      Yoshinori Sato <ysato@users.sourceforge.jp>
@@ -6618,7 +6622,7 @@ F:	fs/hostfs/
 F:      fs/hppfs/
 
 USERSPACE I/O (UIO)
-M:      "Hans J. Koch" <hjk@linutronix.de>
+M:      "Hans J. Koch" <hjk@hansjkoch.de>
 M:      Greg Kroah-Hartman <gregkh@suse.de>
 S:      Maintained
 F:      Documentation/DocBook/uio-howto.tmpl
@@ -6916,6 +6920,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.
 S:      Maintained
 F:      drivers/platform/x86
 
+XEN NETWORK BACKEND DRIVER
+M:      Ian Campbell <ian.campbell@citrix.com>
+L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/xen-netback/*
+
 XEN PCI SUBSYSTEM
 M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
diff --git a/Makefile b/Makefile
index 8392b64079df..322e7334ccb9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 39
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index fdc9d4dbf85b..377a7a595b08 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1540,7 +1540,6 @@ config HIGHMEM
 config HIGHPTE
         bool "Allocate 2nd-level pagetables from highmem"
         depends on HIGHMEM
-        depends on !OUTER_CACHE
 
 config HW_PERF_EVENTS
         bool "Enable hardware performance counter support for perf events"
@@ -2012,6 +2011,8 @@ source "kernel/power/Kconfig"
 
 config ARCH_SUSPEND_POSSIBLE
         depends on !ARCH_S5P64X0 && !ARCH_S5P6442
+        depends on CPU_ARM920T || CPU_ARM926T || CPU_SA1100 || \
+                CPU_V6 || CPU_V6K || CPU_V7 || CPU_XSC3 || CPU_XSCALE
         def_bool y
 
 endmenu
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 494224a9b459..03d01d783e3b 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -63,17 +63,6 @@ config DEBUG_USER
               8 - SIGSEGV faults
              16 - SIGBUS faults
 
-config DEBUG_ERRORS
-        bool "Verbose kernel error messages"
-        depends on DEBUG_KERNEL
-        help
-          This option controls verbose debugging information which can be
-          printed when the kernel detects an internal error. This debugging
-          information is useful to kernel hackers when tracking down problems,
-          but mostly meaningless to other people. It's safe to say Y unless
-          you are concerned with the code size or don't want to see these
-          messages.
-
 config DEBUG_STACK_USAGE
         bool "Enable stack utilization instrumentation"
         depends on DEBUG_KERNEL
diff --git a/arch/arm/common/Makefile b/arch/arm/common/Makefile
index e7521bca2c35..6ea9b6f3607a 100644
--- a/arch/arm/common/Makefile
+++ b/arch/arm/common/Makefile
@@ -16,5 +16,4 @@ obj-$(CONFIG_SHARP_SCOOP)	+= scoop.o
 obj-$(CONFIG_ARCH_IXP2000)      += uengine.o
 obj-$(CONFIG_ARCH_IXP23XX)      += uengine.o
 obj-$(CONFIG_PCI_HOST_ITE8152)  += it8152.o
-obj-$(CONFIG_COMMON_CLKDEV)     += clkdev.o
 obj-$(CONFIG_ARM_TIMER_SP804)   += timer-sp.o
diff --git a/arch/arm/include/asm/thread_notify.h b/arch/arm/include/asm/thread_notify.h
index c4391ba20350..1dc980675894 100644
--- a/arch/arm/include/asm/thread_notify.h
+++ b/arch/arm/include/asm/thread_notify.h
@@ -43,6 +43,7 @@ static inline void thread_notify(unsigned long rc, struct thread_info *thread)
 #define THREAD_NOTIFY_FLUSH     0
 #define THREAD_NOTIFY_EXIT      1
 #define THREAD_NOTIFY_SWITCH    2
+#define THREAD_NOTIFY_COPY      3
 
 #endif
 #endif
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 74554f1742d7..8d95446150a3 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -29,7 +29,7 @@ obj-$(CONFIG_MODULES)		+= armksyms.o module.o
 obj-$(CONFIG_ARTHUR)            += arthur.o
 obj-$(CONFIG_ISA_DMA)           += dma-isa.o
 obj-$(CONFIG_PCI)               += bios32.o isa.o
-obj-$(CONFIG_PM)                += sleep.o
+obj-$(CONFIG_PM_SLEEP)          += sleep.o
 obj-$(CONFIG_HAVE_SCHED_CLOCK)  += sched_clock.o
 obj-$(CONFIG_SMP)               += smp.o smp_tlb.o
 obj-$(CONFIG_HAVE_ARM_SCU)      += smp_scu.o
diff --git a/arch/arm/kernel/elf.c b/arch/arm/kernel/elf.c
index d4a0da1e48f4..9b05c6a0dcea 100644
--- a/arch/arm/kernel/elf.c
+++ b/arch/arm/kernel/elf.c
@@ -40,15 +40,22 @@ EXPORT_SYMBOL(elf_check_arch);
 void elf_set_personality(const struct elf32_hdr *x)
 {
         unsigned int eflags = x->e_flags;
-        unsigned int personality = PER_LINUX_32BIT;
+        unsigned int personality = current->personality & ~PER_MASK;
+
+        /*
+         * We only support Linux ELF executables, so always set the
+         * personality to LINUX.
+         */
+        personality |= PER_LINUX;
 
         /*
          * APCS-26 is only valid for OABI executables
          */
-        if ((eflags & EF_ARM_EABI_MASK) == EF_ARM_EABI_UNKNOWN) {
-                if (eflags & EF_ARM_APCS_26)
-                        personality = PER_LINUX;
-        }
+        if ((eflags & EF_ARM_EABI_MASK) == EF_ARM_EABI_UNKNOWN &&
+            (eflags & EF_ARM_APCS_26))
+                personality &= ~ADDR_LIMIT_32BIT;
+        else
+                personality |= ADDR_LIMIT_32BIT;
 
         set_personality(personality);
 
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 8dbc126f7152..87acc25d7a3e 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -868,6 +868,13 @@ static void reset_ctrl_regs(void *info)
                  */
                 asm volatile("mcr p14, 0, %0, c1, c0, 4" : : "r" (0));
                 isb();
+
+                /*
+                 * Clear any configured vector-catch events before
+                 * enabling monitor mode.
+                 */
+                asm volatile("mcr p14, 0, %0, c0, c7, 0" : : "r" (0));
+                isb();
         }
 
         if (enable_monitor_mode())
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 69cfee0fe00f..979da3947f42 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -221,7 +221,7 @@ again:
         prev_raw_count &= armpmu->max_period;
 
         if (overflow)
-                delta = armpmu->max_period - prev_raw_count + new_raw_count;
+                delta = armpmu->max_period - prev_raw_count + new_raw_count + 1;
         else
                 delta = new_raw_count - prev_raw_count;
 
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 94bbedbed639..5e1e54197227 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -372,6 +372,8 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
         if (clone_flags & CLONE_SETTLS)
                 thread->tp_value = regs->ARM_r3;
 
+        thread_notify(THREAD_NOTIFY_COPY, thread);
+
         return 0;
 }
 
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index f0000e188c8c..3b54ad19d489 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -410,8 +410,7 @@ static int bad_syscall(int n, struct pt_regs *regs)
         struct thread_info *thread = current_thread_info();
         siginfo_t info;
 
-        if (current->personality != PER_LINUX &&
-            current->personality != PER_LINUX_32BIT &&
+        if ((current->personality & PER_MASK) != PER_LINUX &&
             thread->exec_domain->handler) {
                 thread->exec_domain->handler(n, regs);
                 return regs->ARM_r0;
diff --git a/arch/arm/mach-mmp/include/mach/gpio.h b/arch/arm/mach-mmp/include/mach/gpio.h
index ee8b02ed8011..7bfb827f3fe3 100644
--- a/arch/arm/mach-mmp/include/mach/gpio.h
+++ b/arch/arm/mach-mmp/include/mach/gpio.h
@@ -10,7 +10,7 @@
 #define BANK_OFF(n)     (((n) < 3) ? (n) << 2 : 0x100 + (((n) - 3) << 2))
 #define GPIO_REG(x)     (*((volatile u32 *)(GPIO_REGS_VIRT + (x))))
 
-#define NR_BUILTIN_GPIO (192)
+#define NR_BUILTIN_GPIO         IRQ_GPIO_NUM
 
 #define gpio_to_bank(gpio)      ((gpio) >> 5)
 #define gpio_to_irq(gpio)       (IRQ_GPIO_START + (gpio))
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
index 4621067c7720..713be155a44d 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
@@ -8,6 +8,15 @@
 #define MFP_DRIVE_MEDIUM        (0x2 << 13)
 #define MFP_DRIVE_FAST          (0x3 << 13)
 
+#undef MFP_CFG
+#undef MFP_CFG_DRV
+
+#define MFP_CFG(pin, af)                \
+        (MFP_LPM_INPUT | MFP_PIN(MFP_PIN_##pin) | MFP_##af | MFP_DRIVE_MEDIUM)
+
+#define MFP_CFG_DRV(pin, af, drv)       \
+        (MFP_LPM_INPUT | MFP_PIN(MFP_PIN_##pin) | MFP_##af | MFP_DRIVE_##drv)
+
 /* GPIO */
 #define GPIO0_GPIO              MFP_CFG(GPIO0, AF5)
 #define GPIO1_GPIO              MFP_CFG(GPIO1, AF5)
diff --git a/arch/arm/mach-pxa/include/mach/gpio.h b/arch/arm/mach-pxa/include/mach/gpio.h
index b024a8b37439..c4639502efca 100644
--- a/arch/arm/mach-pxa/include/mach/gpio.h
+++ b/arch/arm/mach-pxa/include/mach/gpio.h
@@ -99,11 +99,24 @@
 #define GAFR(x)         GPIO_REG(0x54 + (((x) & 0x70) >> 2))
 
 
-#define NR_BUILTIN_GPIO 128
+#define NR_BUILTIN_GPIO         PXA_GPIO_IRQ_NUM
 
 #define gpio_to_bank(gpio)      ((gpio) >> 5)
 #define gpio_to_irq(gpio)       IRQ_GPIO(gpio)
-#define irq_to_gpio(irq)        IRQ_TO_GPIO(irq)
+
+static inline int irq_to_gpio(unsigned int irq)
+{
+        int gpio;
+
+        if (irq == IRQ_GPIO0 || irq == IRQ_GPIO1)
+                return irq - IRQ_GPIO0;
+
+        gpio = irq - PXA_GPIO_IRQ_BASE;
+        if (gpio >= 2 && gpio < NR_BUILTIN_GPIO)
+                return gpio;
+
+        return -1;
+}
 
 #ifdef CONFIG_CPU_PXA26x
 /* GPIO86/87/88/89 on PXA26x have their direction bits in GPDR2 inverted,
diff --git a/arch/arm/mach-pxa/include/mach/irqs.h b/arch/arm/mach-pxa/include/mach/irqs.h
index a4285fc00878..038402404e39 100644
--- a/arch/arm/mach-pxa/include/mach/irqs.h
+++ b/arch/arm/mach-pxa/include/mach/irqs.h
@@ -93,9 +93,6 @@
 #define GPIO_2_x_TO_IRQ(x)      (PXA_GPIO_IRQ_BASE + (x))
 #define IRQ_GPIO(x)     (((x) < 2) ? (IRQ_GPIO0 + (x)) : GPIO_2_x_TO_IRQ(x))
 
-#define IRQ_TO_GPIO_2_x(i)      ((i) - PXA_GPIO_IRQ_BASE)
-#define IRQ_TO_GPIO(i)  (((i) < IRQ_GPIO(2)) ? ((i) - IRQ_GPIO0) : IRQ_TO_GPIO_2_x(i))
-
 /*
  * The following interrupts are for board specific purposes. Since
  * the kernel can only run on one machine at a time, we can re-use
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 6bde5956358d..a4af8c52d7ee 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -285,7 +285,7 @@ static inline void pxa25x_init_pm(void) {}
 
 static int pxa25x_set_wake(struct irq_data *d, unsigned int on)
 {
-        int gpio = IRQ_TO_GPIO(d->irq);
+        int gpio = irq_to_gpio(d->irq);
         uint32_t mask = 0;
 
         if (gpio >= 0 && gpio < 85)
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index 1cb5d0f9723f..909756eaf4b7 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -345,7 +345,7 @@ static inline void pxa27x_init_pm(void) {}
  */
 static int pxa27x_set_wake(struct irq_data *d, unsigned int on)
 {
-        int gpio = IRQ_TO_GPIO(d->irq);
+        int gpio = irq_to_gpio(d->irq);
         uint32_t mask;
 
         if (gpio >= 0 && gpio < 128)
diff --git a/arch/arm/mach-tegra/gpio.c b/arch/arm/mach-tegra/gpio.c
index 76a3f654220f..65a1aba6823d 100644
--- a/arch/arm/mach-tegra/gpio.c
+++ b/arch/arm/mach-tegra/gpio.c
@@ -257,7 +257,8 @@ static void tegra_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
 void tegra_gpio_resume(void)
 {
         unsigned long flags;
-        int b, p, i;
+        int b;
+        int p;
 
         local_irq_save(flags);
 
@@ -280,7 +281,8 @@ void tegra_gpio_resume(void)
 void tegra_gpio_suspend(void)
 {
         unsigned long flags;
-        int b, p, i;
+        int b;
+        int p;
 
         local_irq_save(flags);
         for (b = 0; b < ARRAY_SIZE(tegra_gpio_banks); b++) {
diff --git a/arch/arm/mach-tegra/tegra2_clocks.c b/arch/arm/mach-tegra/tegra2_clocks.c
index 6d7c4eea4dcb..4459470c052d 100644
--- a/arch/arm/mach-tegra/tegra2_clocks.c
+++ b/arch/arm/mach-tegra/tegra2_clocks.c
@@ -1362,14 +1362,15 @@ static int tegra_clk_shared_bus_set_rate(struct clk *c, unsigned long rate)
 {
         unsigned long flags;
         int ret;
+        long new_rate = rate;
 
-        rate = clk_round_rate(c->parent, rate);
-        if (rate < 0)
-                return rate;
+        new_rate = clk_round_rate(c->parent, new_rate);
+        if (new_rate < 0)
+                return new_rate;
 
         spin_lock_irqsave(&c->parent->spinlock, flags);
 
-        c->u.shared_bus_user.rate = rate;
+        c->u.shared_bus_user.rate = new_rate;
         ret = tegra_clk_shared_bus_update(c->parent);
 
         spin_unlock_irqrestore(&c->parent->spinlock, flags);
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index afe209e1e1f8..74be05f3e03a 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -7,6 +7,7 @@
 #include <linux/shm.h>
 #include <linux/sched.h>
 #include <linux/io.h>
+#include <linux/personality.h>
 #include <linux/random.h>
 #include <asm/cputype.h>
 #include <asm/system.h>
@@ -82,7 +83,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 mm->cached_hole_size = 0;
         }
         /* 8 bits of randomness in 20 address space bits */
-        if (current->flags & PF_RANDOMIZE)
+        if ((current->flags & PF_RANDOMIZE) &&
+            !(current->personality & ADDR_NO_RANDOMIZE))
                 addr += (get_random_int() % (1 << 8)) << PAGE_SHIFT;
 
 full_search:
diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
index b46eb21f05c7..bf8a1d1cccb6 100644
--- a/arch/arm/mm/proc-arm920.S
+++ b/arch/arm/mm/proc-arm920.S
@@ -390,7 +390,7 @@ ENTRY(cpu_arm920_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm920_suspend_size
 .equ    cpu_arm920_suspend_size, 4 * 3
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm920_do_suspend)
         stmfd   sp!, {r4 - r7, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ PID
diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
index 6a4bdb2c94a7..0ed85d930c09 100644
--- a/arch/arm/mm/proc-arm926.S
+++ b/arch/arm/mm/proc-arm926.S
@@ -404,7 +404,7 @@ ENTRY(cpu_arm926_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm926_suspend_size
 .equ    cpu_arm926_suspend_size, 4 * 3
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm926_do_suspend)
         stmfd   sp!, {r4 - r7, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ PID
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index 74483d1977fe..184a9c997e36 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -171,7 +171,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
 
 .globl  cpu_sa1100_suspend_size
 .equ    cpu_sa1100_suspend_size, 4*4
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_sa1100_do_suspend)
         stmfd   sp!, {r4 - r7, lr}
         mrc     p15, 0, r4, c3, c0, 0           @ domain ID
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index bfa0c9f611c5..7c99cb4c8e4f 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -124,7 +124,7 @@ ENTRY(cpu_v6_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
 .globl  cpu_v6_suspend_size
 .equ    cpu_v6_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_v6_do_suspend)
         stmfd   sp!, {r4 - r11, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ FCSE/PID
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index c35618e42f6f..babfba09c89f 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -211,7 +211,7 @@ cpu_v7_name:
 /* Suspend/resume support: derived from arch/arm/mach-s5pv210/sleep.S */
 .globl  cpu_v7_suspend_size
 .equ    cpu_v7_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_v7_do_suspend)
         stmfd   sp!, {r4 - r11, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ FCSE/PID
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index 63d8b2044e84..596213699f37 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -417,7 +417,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
 
 .globl  cpu_xsc3_suspend_size
 .equ    cpu_xsc3_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_xsc3_do_suspend)
         stmfd   sp!, {r4 - r10, lr}
         mrc     p14, 0, r4, c6, c0, 0   @ clock configuration, for turbo mode
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 086038cd86ab..ce233bcbf506 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -518,7 +518,7 @@ ENTRY(cpu_xscale_set_pte_ext)
 
 .globl  cpu_xscale_suspend_size
 .equ    cpu_xscale_suspend_size, 4 * 7
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_xscale_do_suspend)
         stmfd   sp!, {r4 - r10, lr}
         mrc     p14, 0, r4, c6, c0, 0   @ clock configuration, for turbo mode
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index bbf3da012afd..f74695075e64 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -78,6 +78,14 @@ static void vfp_thread_exit(struct thread_info *thread)
         put_cpu();
 }
 
+static void vfp_thread_copy(struct thread_info *thread)
+{
+        struct thread_info *parent = current_thread_info();
+
+        vfp_sync_hwstate(parent);
+        thread->vfpstate = parent->vfpstate;
+}
+
 /*
  * When this function is called with the following 'cmd's, the following
  * is true while this function is being run:
@@ -104,12 +112,17 @@ static void vfp_thread_exit(struct thread_info *thread)
 static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
 {
         struct thread_info *thread = v;
+        u32 fpexc;
+#ifdef CONFIG_SMP
+        unsigned int cpu;
+#endif
 
-        if (likely(cmd == THREAD_NOTIFY_SWITCH)) {
-                u32 fpexc = fmrx(FPEXC);
+        switch (cmd) {
+        case THREAD_NOTIFY_SWITCH:
+                fpexc = fmrx(FPEXC);
 
 #ifdef CONFIG_SMP
-                unsigned int cpu = thread->cpu;
+                cpu = thread->cpu;
 
                 /*
                  * On SMP, if VFP is enabled, save the old state in
@@ -134,13 +147,20 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
                  * old state.
                  */
                 fmxr(FPEXC, fpexc & ~FPEXC_EN);
-                return NOTIFY_DONE;
-        }
+                break;
 
-        if (cmd == THREAD_NOTIFY_FLUSH)
+        case THREAD_NOTIFY_FLUSH:
                 vfp_thread_flush(thread);
-        else
+                break;
+
+        case THREAD_NOTIFY_EXIT:
                 vfp_thread_exit(thread);
+                break;
+
+        case THREAD_NOTIFY_COPY:
+                vfp_thread_copy(thread);
+                break;
+        }
 
         return NOTIFY_DONE;
 }
diff --git a/arch/avr32/include/asm/setup.h b/arch/avr32/include/asm/setup.h
index ff5b7cf6be4d..160543dbec7e 100644
--- a/arch/avr32/include/asm/setup.h
+++ b/arch/avr32/include/asm/setup.h
@@ -94,6 +94,13 @@ struct tag_ethernet {
 
 #define ETH_INVALID_PHY 0xff
 
+/* board information */
+#define ATAG_BOARDINFO  0x54410008
+
+struct tag_boardinfo {
+        u32     board_number;
+};
+
 struct tag {
         struct tag_header hdr;
         union {
@@ -102,6 +109,7 @@ struct tag {
                 struct tag_cmdline cmdline;
                 struct tag_clock clock;
                 struct tag_ethernet ethernet;
+                struct tag_boardinfo boardinfo;
         } u;
 };
 
@@ -128,6 +136,7 @@ extern struct tag *bootloader_tags;
 
 extern resource_size_t fbmem_start;
 extern resource_size_t fbmem_size;
+extern u32 board_number;
 
 void setup_processor(void);
 
diff --git a/arch/avr32/kernel/setup.c b/arch/avr32/kernel/setup.c
index 5c7083916c33..bb0974cce4ac 100644
--- a/arch/avr32/kernel/setup.c
+++ b/arch/avr32/kernel/setup.c
@@ -391,6 +391,21 @@ static int __init parse_tag_clock(struct tag *tag)
 __tagtable(ATAG_CLOCK, parse_tag_clock);
 
 /*
+ * The board_number correspond to the bd->bi_board_number in U-Boot. This
+ * parameter is only available during initialisation and can be used in some
+ * kind of board identification.
+ */
+u32 __initdata board_number;
+
+static int __init parse_tag_boardinfo(struct tag *tag)
+{
+        board_number = tag->u.boardinfo.board_number;
+
+        return 0;
+}
+__tagtable(ATAG_BOARDINFO, parse_tag_boardinfo);
+
+/*
  * Scan the tag table for this tag, and call its parse function. The
  * tag table is built by the linker from all the __tagtable
  * declarations.
diff --git a/arch/avr32/kernel/traps.c b/arch/avr32/kernel/traps.c
index b91b2044af9c..7aa25756412f 100644
--- a/arch/avr32/kernel/traps.c
+++ b/arch/avr32/kernel/traps.c
@@ -95,28 +95,6 @@ void _exception(long signr, struct pt_regs *regs, int code,
         info.si_code = code;
         info.si_addr = (void __user *)addr;
         force_sig_info(signr, &info, current);
-
-        /*
-         * Init gets no signals that it doesn't have a handler for.
-         * That's all very well, but if it has caused a synchronous
-         * exception and we ignore the resulting signal, it will just
-         * generate the same exception over and over again and we get
-         * nowhere.  Better to kill it and let the kernel panic.
-         */
-        if (is_global_init(current)) {
-                __sighandler_t handler;
-
-                spin_lock_irq(&current->sighand->siglock);
-                handler = current->sighand->action[signr-1].sa.sa_handler;
-                spin_unlock_irq(&current->sighand->siglock);
-                if (handler == SIG_DFL) {
-                        /* init has generated a synchronous exception
-                           and it doesn't have a handler for the signal */
-                        printk(KERN_CRIT "init has generated signal %ld "
-                               "but has no handler for it\n", signr);
-                        do_exit(signr);
-                }
-        }
 }
 
 asmlinkage void do_nmi(unsigned long ecr, struct pt_regs *regs)
diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
index 442f08c5e641..86925fd6ea5b 100644
--- a/arch/avr32/mach-at32ap/clock.c
+++ b/arch/avr32/mach-at32ap/clock.c
@@ -35,22 +35,30 @@ void at32_clk_register(struct clk *clk)
         spin_unlock(&clk_list_lock);
 }
 
-struct clk *clk_get(struct device *dev, const char *id)
+static struct clk *__clk_get(struct device *dev, const char *id)
 {
         struct clk *clk;
 
-        spin_lock(&clk_list_lock);
-
         list_for_each_entry(clk, &at32_clock_list, list) {
                 if (clk->dev == dev && strcmp(id, clk->name) == 0) {
-                        spin_unlock(&clk_list_lock);
                         return clk;
                 }
         }
 
-        spin_unlock(&clk_list_lock);
         return ERR_PTR(-ENOENT);
 }
+
+struct clk *clk_get(struct device *dev, const char *id)
+{
+        struct clk *clk;
+
+        spin_lock(&clk_list_lock);
+        clk = __clk_get(dev, id);
+        spin_unlock(&clk_list_lock);
+
+        return clk;
+}
+
 EXPORT_SYMBOL(clk_get);
 
 void clk_put(struct clk *clk)
@@ -257,15 +265,15 @@ static int clk_show(struct seq_file *s, void *unused)
         spin_lock(&clk_list_lock);
 
         /* show clock tree as derived from the three oscillators */
-        clk = clk_get(NULL, "osc32k");
+        clk = __clk_get(NULL, "osc32k");
         dump_clock(clk, &r);
         clk_put(clk);
 
-        clk = clk_get(NULL, "osc0");
+        clk = __clk_get(NULL, "osc0");
         dump_clock(clk, &r);
         clk_put(clk);
 
-        clk = clk_get(NULL, "osc1");
+        clk = __clk_get(NULL, "osc1");
         dump_clock(clk, &r);
         clk_put(clk);
 
diff --git a/arch/avr32/mach-at32ap/extint.c b/arch/avr32/mach-at32ap/extint.c
index 47ba4b9b6db1..fbc2aeaebddb 100644
--- a/arch/avr32/mach-at32ap/extint.c
+++ b/arch/avr32/mach-at32ap/extint.c
@@ -61,34 +61,34 @@ struct eic {
 static struct eic *nmi_eic;
 static bool nmi_enabled;
 
-static void eic_ack_irq(struct irq_chip *d)
+static void eic_ack_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, ICR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_mask_irq(struct irq_chip *d)
+static void eic_mask_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, IDR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_mask_ack_irq(struct irq_chip *d)
+static void eic_mask_ack_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, ICR, 1 << (d->irq - eic->first_irq));
         eic_writel(eic, IDR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_unmask_irq(struct irq_chip *d)
+static void eic_unmask_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, IER, 1 << (d->irq - eic->first_irq));
 }
 
-static int eic_set_irq_type(struct irq_chip *d, unsigned int flow_type)
+static int eic_set_irq_type(struct irq_data *d, unsigned int flow_type)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         unsigned int irq = d->irq;
         unsigned int i = irq - eic->first_irq;
         u32 mode, edge, level;
@@ -191,7 +191,7 @@ static int __init eic_probe(struct platform_device *pdev)
 
         regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         int_irq = platform_get_irq(pdev, 0);
-        if (!regs || !int_irq) {
+        if (!regs || (int)int_irq <= 0) {
                 dev_dbg(&pdev->dev, "missing regs and/or irq resource\n");
                 return -ENXIO;
         }
diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
index f308e1ddc629..2e0aa853a4bc 100644
--- a/arch/avr32/mach-at32ap/pio.c
+++ b/arch/avr32/mach-at32ap/pio.c
@@ -257,7 +257,7 @@ static void gpio_irq_mask(struct irq_data *d)
         pio_writel(pio, IDR, 1 << (gpio & 0x1f));
 }
 
-static void gpio_irq_unmask(struct irq_data *d))
+static void gpio_irq_unmask(struct irq_data *d)
 {
         unsigned                gpio = irq_to_gpio(d->irq);
         struct pio_device       *pio = &pio_dev[gpio >> 5];
diff --git a/arch/avr32/mach-at32ap/pm-at32ap700x.S b/arch/avr32/mach-at32ap/pm-at32ap700x.S
index 17503b0ed6c9..f868f4ce761b 100644
--- a/arch/avr32/mach-at32ap/pm-at32ap700x.S
+++ b/arch/avr32/mach-at32ap/pm-at32ap700x.S
@@ -53,7 +53,7 @@ cpu_enter_idle:
         st.w    r8[TI_flags], r9
         unmask_interrupts
         sleep   CPU_SLEEP_IDLE
-        .size   cpu_idle_sleep, . - cpu_idle_sleep
+        .size   cpu_enter_idle, . - cpu_enter_idle
 
         /*
          * Common return path for PM functions that don't run from
diff --git a/arch/blackfin/include/asm/system.h b/arch/blackfin/include/asm/system.h
index 19e2c7c3e63a..44bd0cced725 100644
--- a/arch/blackfin/include/asm/system.h
+++ b/arch/blackfin/include/asm/system.h
@@ -19,11 +19,11 @@
  * Force strict CPU ordering.
  */
 #define nop()  __asm__ __volatile__ ("nop;\n\t" : : )
-#define mb()   __asm__ __volatile__ (""   : : : "memory")
-#define rmb()  __asm__ __volatile__ (""   : : : "memory")
-#define wmb()  __asm__ __volatile__ (""   : : : "memory")
-#define set_mb(var, value) do { (void) xchg(&var, value); } while (0)
-#define read_barrier_depends()          do { } while(0)
+#define smp_mb()  mb()
+#define smp_rmb() rmb()
+#define smp_wmb() wmb()
+#define set_mb(var, value) do { var = value; mb(); } while (0)
+#define smp_read_barrier_depends()      read_barrier_depends()
 
 #ifdef CONFIG_SMP
 asmlinkage unsigned long __raw_xchg_1_asm(volatile void *ptr, unsigned long value);
@@ -37,16 +37,16 @@ asmlinkage unsigned long __raw_cmpxchg_4_asm(volatile void *ptr,
                                         unsigned long new, unsigned long old);
 
 #ifdef __ARCH_SYNC_CORE_DCACHE
-# define smp_mb()       do { barrier(); smp_check_barrier(); smp_mark_barrier(); } while (0)
-# define smp_rmb()      do { barrier(); smp_check_barrier(); } while (0)
-# define smp_wmb()      do { barrier(); smp_mark_barrier(); } while (0)
-#define smp_read_barrier_depends()      do { barrier(); smp_check_barrier(); } while (0)
-
+/* Force Core data cache coherence */
+# define mb()   do { barrier(); smp_check_barrier(); smp_mark_barrier(); } while (0)
+# define rmb()  do { barrier(); smp_check_barrier(); } while (0)
+# define wmb()  do { barrier(); smp_mark_barrier(); } while (0)
+# define read_barrier_depends() do { barrier(); smp_check_barrier(); } while (0)
 #else
-# define smp_mb()       barrier()
-# define smp_rmb()      barrier()
-# define smp_wmb()      barrier()
-#define smp_read_barrier_depends()      barrier()
+# define mb()   barrier()
+# define rmb()  barrier()
+# define wmb()  barrier()
+# define read_barrier_depends() do { } while (0)
 #endif
 
 static inline unsigned long __xchg(unsigned long x, volatile void *ptr,
@@ -99,10 +99,10 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
 
 #else /* !CONFIG_SMP */
 
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while(0)
+#define mb()    barrier()
+#define rmb()   barrier()
+#define wmb()   barrier()
+#define read_barrier_depends()  do { } while (0)
 
 struct __xchg_dummy {
         unsigned long a[100];
diff --git a/arch/blackfin/kernel/gptimers.c b/arch/blackfin/kernel/gptimers.c
index cdbe075de1dc..8b81dc04488a 100644
--- a/arch/blackfin/kernel/gptimers.c
+++ b/arch/blackfin/kernel/gptimers.c
@@ -268,7 +268,7 @@ void disable_gptimers(uint16_t mask)
         _disable_gptimers(mask);
         for (i = 0; i < MAX_BLACKFIN_GPTIMERS; ++i)
                 if (mask & (1 << i))
-                        group_regs[BFIN_TIMER_OCTET(i)]->status |= trun_mask[i];
+                        group_regs[BFIN_TIMER_OCTET(i)]->status = trun_mask[i];
         SSYNC();
 }
 EXPORT_SYMBOL(disable_gptimers);
diff --git a/arch/blackfin/kernel/time-ts.c b/arch/blackfin/kernel/time-ts.c
index 8c9a43daf80f..cdb4beb6bc8f 100644
--- a/arch/blackfin/kernel/time-ts.c
+++ b/arch/blackfin/kernel/time-ts.c
@@ -206,8 +206,14 @@ irqreturn_t bfin_gptmr0_interrupt(int irq, void *dev_id)
 {
         struct clock_event_device *evt = dev_id;
         smp_mb();
-        evt->event_handler(evt);
+        /*
+         * We want to ACK before we handle so that we can handle smaller timer
+         * intervals.  This way if the timer expires again while we're handling
+         * things, we're more likely to see that 2nd int rather than swallowing
+         * it by ACKing the int at the end of this handler.
+         */
         bfin_gptmr0_ack();
+        evt->event_handler(evt);
         return IRQ_HANDLED;
 }
 
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index 6e17a265c4d3..8bce5ed031e4 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -109,10 +109,23 @@ static void ipi_flush_icache(void *info)
         struct blackfin_flush_data *fdata = info;
 
         /* Invalidate the memory holding the bounds of the flushed region. */
-        invalidate_dcache_range((unsigned long)fdata,
-                (unsigned long)fdata + sizeof(*fdata));
+        blackfin_dcache_invalidate_range((unsigned long)fdata,
+                                         (unsigned long)fdata + sizeof(*fdata));
+
+        /* Make sure all write buffers in the data side of the core
+         * are flushed before trying to invalidate the icache.  This
+         * needs to be after the data flush and before the icache
+         * flush so that the SSYNC does the right thing in preventing
+         * the instruction prefetcher from hitting things in cached
+         * memory at the wrong time -- it runs much further ahead than
+         * the pipeline.
+         */
+        SSYNC();
 
-        flush_icache_range(fdata->start, fdata->end);
+        /* ipi_flaush_icache is invoked by generic flush_icache_range,
+         * so call blackfin arch icache flush directly here.
+         */
+        blackfin_icache_flush_range(fdata->start, fdata->end);
 }
 
 static void ipi_call_function(unsigned int cpu, struct ipi_message *msg)
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 26d851d385bb..29e17907d9f2 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -343,10 +343,14 @@
 #define __NR_fanotify_init      337
 #define __NR_fanotify_mark      338
 #define __NR_prlimit64          339
+#define __NR_name_to_handle_at  340
+#define __NR_open_by_handle_at  341
+#define __NR_clock_adjtime      342
+#define __NR_syncfs             343
 
 #ifdef __KERNEL__
 
-#define NR_syscalls             340
+#define NR_syscalls             344
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/m68k/kernel/entry_mm.S b/arch/m68k/kernel/entry_mm.S
index 1559dea36e55..1359ee659574 100644
--- a/arch/m68k/kernel/entry_mm.S
+++ b/arch/m68k/kernel/entry_mm.S
@@ -750,4 +750,8 @@ sys_call_table:
         .long sys_fanotify_init
         .long sys_fanotify_mark
         .long sys_prlimit64
+        .long sys_name_to_handle_at     /* 340 */
+        .long sys_open_by_handle_at
+        .long sys_clock_adjtime
+        .long sys_syncfs
 
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 79b1ed198c07..9b8393d8adb8 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -358,6 +358,10 @@ ENTRY(sys_call_table)
         .long sys_fanotify_init
         .long sys_fanotify_mark
         .long sys_prlimit64
+        .long sys_name_to_handle_at     /* 340 */
+        .long sys_open_by_handle_at
+        .long sys_clock_adjtime
+        .long sys_syncfs
 
         .rept NR_syscalls-(.-sys_call_table)/4
                 .long sys_ni_syscall
diff --git a/arch/powerpc/kernel/ibmebus.c b/arch/powerpc/kernel/ibmebus.c
index c00d4ca1ee15..28581f1ad2c0 100644
--- a/arch/powerpc/kernel/ibmebus.c
+++ b/arch/powerpc/kernel/ibmebus.c
@@ -527,7 +527,7 @@ static int ibmebus_bus_pm_resume_noirq(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int ibmebus_bus_pm_freeze(struct device *dev)
 {
@@ -665,7 +665,7 @@ static int ibmebus_bus_pm_restore_noirq(struct device *dev)
         return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define ibmebus_bus_pm_freeze           NULL
 #define ibmebus_bus_pm_thaw             NULL
@@ -676,7 +676,7 @@ static int ibmebus_bus_pm_restore_noirq(struct device *dev)
 #define ibmebus_bus_pm_poweroff_noirq   NULL
 #define ibmebus_bus_pm_restore_noirq    NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 static struct dev_pm_ops ibmebus_bus_dev_pm_ops = {
         .prepare = ibmebus_bus_pm_prepare,
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 14232d57369c..49798532b477 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -1457,7 +1457,6 @@ int fsl_rio_setup(struct platform_device *dev)
         port->ops = ops;
         port->priv = priv;
         port->phys_efptr = 0x100;
-        rio_register_mport(port);
 
         priv->regs_win = ioremap(regs.start, regs.end - regs.start + 1);
         rio_regs_win = priv->regs_win;
@@ -1504,6 +1503,9 @@ int fsl_rio_setup(struct platform_device *dev)
         dev_info(&dev->dev, "RapidIO Common Transport System size: %d\n",
                         port->sys_size ? 65536 : 256);
 
+        if (rio_register_mport(port))
+                goto err;
+
         if (port->host_deviceid >= 0)
                 out_be32(priv->regs_win + RIO_GCCSR, RIO_PORT_GEN_HOST |
                         RIO_PORT_GEN_MASTER | RIO_PORT_GEN_DISCOVERED);
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index 7061398341d5..fb317bf2c378 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -460,7 +460,7 @@ startup:
 #ifndef CONFIG_MARCH_G5
         # check capabilities against MARCH_{G5,Z900,Z990,Z9_109,Z10}
         xc      __LC_STFL_FAC_LIST(8),__LC_STFL_FAC_LIST
-        stfl    __LC_STFL_FAC_LIST      # store facility list
+        .insn   s,0xb2b10000,__LC_STFL_FAC_LIST # store facility list
         tm      __LC_STFL_FAC_LIST,0x01 # stfle available ?
         jz      0f
         la      %r0,0
diff --git a/arch/s390/kernel/switch_cpu.S b/arch/s390/kernel/switch_cpu.S
index 469f11b574fa..20530dd2eab1 100644
--- a/arch/s390/kernel/switch_cpu.S
+++ b/arch/s390/kernel/switch_cpu.S
@@ -46,7 +46,9 @@ smp_restart_cpu:
         ltr     %r4,%r4                 /* New stack ? */
         jz      1f
         lr      %r15,%r4
-1:      basr    %r14,%r2
+1:      lr      %r14,%r2                /* r14: Function to call */
+        lr      %r2,%r3                 /* r2 : Parameter for function*/
+        basr    %r14,%r14               /* Call function */
 
 .gprregs_addr:
         .long   .gprregs
diff --git a/arch/s390/kernel/switch_cpu64.S b/arch/s390/kernel/switch_cpu64.S
index d94aacc898cb..5be3f43898f9 100644
--- a/arch/s390/kernel/switch_cpu64.S
+++ b/arch/s390/kernel/switch_cpu64.S
@@ -42,7 +42,9 @@ smp_restart_cpu:
         ltgr    %r4,%r4                 /* New stack ? */
         jz      1f
         lgr     %r15,%r4
-1:      basr    %r14,%r2
+1:      lgr     %r14,%r2                /* r14: Function to call */
+        lgr     %r2,%r3                 /* r2 : Parameter for function*/
+        basr    %r14,%r14               /* Call function */
 
         .section .data,"aw",@progbits
 .gprregs:
diff --git a/arch/s390/oprofile/hwsampler.c b/arch/s390/oprofile/hwsampler.c
index 3d48f4db246d..4952872d6f0a 100644
--- a/arch/s390/oprofile/hwsampler.c
+++ b/arch/s390/oprofile/hwsampler.c
@@ -517,12 +517,8 @@ stop_exit:
 
 static int check_hardware_prerequisites(void)
 {
-        unsigned long long facility_bits[2];
-
-        memcpy(facility_bits, S390_lowcore.stfle_fac_list, 32);
-        if (!(facility_bits[1] & (1ULL << 59)))
+        if (!test_facility(68))
                 return -EOPNOTSUPP;
-
         return 0;
 }
 /*
diff --git a/arch/um/Kconfig.x86 b/arch/um/Kconfig.x86
index 02fb017fed47..a9da516a5274 100644
--- a/arch/um/Kconfig.x86
+++ b/arch/um/Kconfig.x86
@@ -4,6 +4,10 @@ menu "UML-specific options"
 
 menu "Host processor type and features"
 
+config CMPXCHG_LOCAL
+        bool
+        default n
+
 source "arch/x86/Kconfig.cpu"
 
 endmenu
diff --git a/arch/um/include/asm/bug.h b/arch/um/include/asm/bug.h
new file mode 100644
index 000000000000..9e33b864c359
--- /dev/null
+++ b/arch/um/include/asm/bug.h
@@ -0,0 +1,6 @@
+#ifndef __UM_BUG_H
+#define __UM_BUG_H
+
+#include <asm-generic/bug.h>
+
+#endif
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index fd5a1f365c95..3cce71413d0b 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -96,11 +96,15 @@
 #define MSR_IA32_MC0_ADDR               0x00000402
 #define MSR_IA32_MC0_MISC               0x00000403
 
+#define MSR_AMD64_MC0_MASK              0xc0010044
+
 #define MSR_IA32_MCx_CTL(x)             (MSR_IA32_MC0_CTL + 4*(x))
 #define MSR_IA32_MCx_STATUS(x)          (MSR_IA32_MC0_STATUS + 4*(x))
 #define MSR_IA32_MCx_ADDR(x)            (MSR_IA32_MC0_ADDR + 4*(x))
 #define MSR_IA32_MCx_MISC(x)            (MSR_IA32_MC0_MISC + 4*(x))
 
+#define MSR_AMD64_MCx_MASK(x)           (MSR_AMD64_MC0_MASK + (x))
+
 /* These are consecutive and not in the normal 4er MCE bank block */
 #define MSR_IA32_MC0_CTL2               0x00000280
 #define MSR_IA32_MCx_CTL2(x)            (MSR_IA32_MC0_CTL2 + (x))
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 3ecece0217ef..3532d3bf8105 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -615,6 +615,25 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
         /* As a rule processors have APIC timer running in deep C states */
         if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
                 set_cpu_cap(c, X86_FEATURE_ARAT);
+
+        /*
+         * Disable GART TLB Walk Errors on Fam10h. We do this here
+         * because this is always needed when GART is enabled, even in a
+         * kernel which has no MCE support built in.
+         */
+        if (c->x86 == 0x10) {
+                /*
+                 * BIOS should disable GartTlbWlk Errors themself. If
+                 * it doesn't do it here as suggested by the BKDG.
+                 *
+                 * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
+                 */
+                u64 mask;
+
+                rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
+                mask |= (1 << 10);
+                wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
+        }
 }
 
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index c2871d3c71b6..8ed8908cc9f7 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -312,6 +312,26 @@ void __cpuinit smp_store_cpu_info(int id)
                 identify_secondary_cpu(c);
 }
 
+static void __cpuinit check_cpu_siblings_on_same_node(int cpu1, int cpu2)
+{
+        int node1 = early_cpu_to_node(cpu1);
+        int node2 = early_cpu_to_node(cpu2);
+
+        /*
+         * Our CPU scheduler assumes all logical cpus in the same physical cpu
+         * share the same node. But, buggy ACPI or NUMA emulation might assign
+         * them to different node. Fix it.
+         */
+        if (node1 != node2) {
+                pr_warning("CPU %d in node %d and CPU %d in node %d are in the same physical CPU. forcing same node %d\n",
+                           cpu1, node1, cpu2, node2, node2);
+
+                numa_remove_cpu(cpu1);
+                numa_set_node(cpu1, node2);
+                numa_add_cpu(cpu1);
+        }
+}
+
 static void __cpuinit link_thread_siblings(int cpu1, int cpu2)
 {
         cpumask_set_cpu(cpu1, cpu_sibling_mask(cpu2));
@@ -320,6 +340,7 @@ static void __cpuinit link_thread_siblings(int cpu1, int cpu2)
         cpumask_set_cpu(cpu2, cpu_core_mask(cpu1));
         cpumask_set_cpu(cpu1, cpu_llc_shared_mask(cpu2));
         cpumask_set_cpu(cpu2, cpu_llc_shared_mask(cpu1));
+        check_cpu_siblings_on_same_node(cpu1, cpu2);
 }
 
 
@@ -361,10 +382,12 @@ void __cpuinit set_cpu_sibling_map(int cpu)
                     per_cpu(cpu_llc_id, cpu) == per_cpu(cpu_llc_id, i)) {
                         cpumask_set_cpu(i, cpu_llc_shared_mask(cpu));
                         cpumask_set_cpu(cpu, cpu_llc_shared_mask(i));
+                        check_cpu_siblings_on_same_node(cpu, i);
                 }
                 if (c->phys_proc_id == cpu_data(i).phys_proc_id) {
                         cpumask_set_cpu(i, cpu_core_mask(cpu));
                         cpumask_set_cpu(cpu, cpu_core_mask(i));
+                        check_cpu_siblings_on_same_node(cpu, i);
                         /*
                          *  Does this new cpu bringup a new core?
                          */
diff --git a/arch/x86/platform/ce4100/falconfalls.dts b/arch/x86/platform/ce4100/falconfalls.dts
index dc701ea58546..2d6d226f2b10 100644
--- a/arch/x86/platform/ce4100/falconfalls.dts
+++ b/arch/x86/platform/ce4100/falconfalls.dts
@@ -74,6 +74,7 @@
                                 compatible = "intel,ce4100-pci", "pci";
                                 device_type = "pci";
                                 bus-range = <1 1>;
+                                reg = <0x0800 0x0 0x0 0x0 0x0>;
                                 ranges = <0x2000000 0 0xdffe0000 0x2000000 0 0xdffe0000 0 0x1000>;
 
                                 interrupt-parent = <&ioapic2>;
@@ -412,6 +413,7 @@
                                 #address-cells = <2>;
                                 #size-cells = <1>;
                                 compatible = "isa";
+                                reg = <0xf800 0x0 0x0 0x0 0x0>;
                                 ranges = <1 0 0 0 0 0x100>;
 
                                 rtc@70 {
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index 5c0207bf959b..275dbc19e2cf 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -97,11 +97,11 @@ static int __init sfi_parse_mtmr(struct sfi_table_header *table)
                         pentry->freq_hz, pentry->irq);
                         if (!pentry->irq)
                                 continue;
-                        mp_irq.type = MP_IOAPIC;
+                        mp_irq.type = MP_INTSRC;
                         mp_irq.irqtype = mp_INT;
 /* triggering mode edge bit 2-3, active high polarity bit 0-1 */
                         mp_irq.irqflag = 5;
-                        mp_irq.srcbus = 0;
+                        mp_irq.srcbus = MP_BUS_ISA;
                         mp_irq.srcbusirq = pentry->irq; /* IRQ */
                         mp_irq.dstapic = MP_APIC_ALL;
                         mp_irq.dstirq = pentry->irq;
@@ -168,10 +168,10 @@ int __init sfi_parse_mrtc(struct sfi_table_header *table)
         for (totallen = 0; totallen < sfi_mrtc_num; totallen++, pentry++) {
                 pr_debug("RTC[%d]: paddr = 0x%08x, irq = %d\n",
                         totallen, (u32)pentry->phys_addr, pentry->irq);
-                mp_irq.type = MP_IOAPIC;
+                mp_irq.type = MP_INTSRC;
                 mp_irq.irqtype = mp_INT;
                 mp_irq.irqflag = 0xf;   /* level trigger and active low */
-                mp_irq.srcbus = 0;
+                mp_irq.srcbus = MP_BUS_ISA;
                 mp_irq.srcbusirq = pentry->irq; /* IRQ */
                 mp_irq.dstapic = MP_APIC_ALL;
                 mp_irq.dstirq = pentry->irq;
@@ -282,7 +282,7 @@ void __init x86_mrst_early_setup(void)
         /* Avoid searching for BIOS MP tables */
         x86_init.mpparse.find_smp_config = x86_init_noop;
         x86_init.mpparse.get_smp_config = x86_init_uint_noop;
-
+        set_bit(MP_BUS_ISA, mp_bus_not_pci);
 }
 
 /*
diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index 1c7121ba18ff..5cc821cb2e09 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -39,6 +39,7 @@ config XEN_MAX_DOMAIN_MEMORY
 config XEN_SAVE_RESTORE
        bool
        depends on XEN
+       select HIBERNATE_CALLBACKS
        default y
 
 config XEN_DEBUG_FS
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 49dbd78ec3cb..e3c6a06cf725 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -238,6 +238,7 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
 static __init void xen_init_cpuid_mask(void)
 {
         unsigned int ax, bx, cx, dx;
+        unsigned int xsave_mask;
 
         cpuid_leaf1_edx_mask =
                 ~((1 << X86_FEATURE_MCE)  |  /* disable MCE */
@@ -249,24 +250,16 @@ static __init void xen_init_cpuid_mask(void)
                 cpuid_leaf1_edx_mask &=
                         ~((1 << X86_FEATURE_APIC) |  /* disable local APIC */
                           (1 << X86_FEATURE_ACPI));  /* disable ACPI */
-
         ax = 1;
-        cx = 0;
         xen_cpuid(&ax, &bx, &cx, &dx);
 
-        /* cpuid claims we support xsave; try enabling it to see what happens */
-        if (cx & (1 << (X86_FEATURE_XSAVE % 32))) {
-                unsigned long cr4;
-
-                set_in_cr4(X86_CR4_OSXSAVE);
-                
-                cr4 = read_cr4();
+        xsave_mask =
+                (1 << (X86_FEATURE_XSAVE % 32)) |
+                (1 << (X86_FEATURE_OSXSAVE % 32));
 
-                if ((cr4 & X86_CR4_OSXSAVE) == 0)
-                        cpuid_leaf1_ecx_mask &= ~(1 << (X86_FEATURE_XSAVE % 32));
-
-                clear_in_cr4(X86_CR4_OSXSAVE);
-        }
+        /* Xen will set CR4.OSXSAVE if supported and not disabled by force */
+        if ((cx & xsave_mask) != xsave_mask)
+                cpuid_leaf1_ecx_mask &= ~xsave_mask; /* disable XSAVE & OSXSAVE */
 }
 
 static void xen_set_debugreg(int reg, unsigned long val)
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index c82df6c9c0f0..a991b57f91fe 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -565,13 +565,13 @@ pte_t xen_make_pte_debug(pteval_t pte)
         if (io_page &&
             (xen_initial_domain() || addr >= ISA_END_ADDRESS)) {
                 other_addr = pfn_to_mfn(addr >> PAGE_SHIFT) << PAGE_SHIFT;
-                WARN(addr != other_addr,
+                WARN_ONCE(addr != other_addr,
                         "0x%lx is using VM_IO, but it is 0x%lx!\n",
                         (unsigned long)addr, (unsigned long)other_addr);
         } else {
                 pteval_t iomap_set = (_pte.pte & PTE_FLAGS_MASK) & _PAGE_IOMAP;
                 other_addr = (_pte.pte & PTE_PFN_MASK);
-                WARN((addr == other_addr) && (!io_page) && (!iomap_set),
+                WARN_ONCE((addr == other_addr) && (!io_page) && (!iomap_set),
                         "0x%lx is missing VM_IO (and wasn't fixed)!\n",
                         (unsigned long)addr);
         }
diff --git a/block/blk-core.c b/block/blk-core.c
index 90f22cc30799..3c8121072507 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -198,19 +198,6 @@ void blk_dump_rq_flags(struct request *rq, char *msg)
 }
 EXPORT_SYMBOL(blk_dump_rq_flags);
 
-/*
- * Make sure that plugs that were pending when this function was entered,
- * are now complete and requests pushed to the queue.
-*/
-static inline void queue_sync_plugs(struct request_queue *q)
-{
-        /*
-         * If the current process is plugged and has barriers submitted,
-         * we will livelock if we don't unplug first.
-         */
-        blk_flush_plug(current);
-}
-
 static void blk_delay_work(struct work_struct *work)
 {
         struct request_queue *q;
@@ -298,7 +285,6 @@ void blk_sync_queue(struct request_queue *q)
 {
         del_timer_sync(&q->timeout);
         cancel_delayed_work_sync(&q->delay_work);
-        queue_sync_plugs(q);
 }
 EXPORT_SYMBOL(blk_sync_queue);
 
@@ -1311,7 +1297,15 @@ get_rq:
 
         plug = current->plug;
         if (plug) {
-                if (!plug->should_sort && !list_empty(&plug->list)) {
+                /*
+                 * If this is the first request added after a plug, fire
+                 * of a plug trace. If others have been added before, check
+                 * if we have multiple devices in this plug. If so, make a
+                 * note to sort the list before dispatch.
+                 */
+                if (list_empty(&plug->list))
+                        trace_block_plug(q);
+                else if (!plug->should_sort) {
                         struct request *__rq;
 
                         __rq = list_entry_rq(plug->list.prev);
@@ -2668,33 +2662,56 @@ static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
         return !(rqa->q <= rqb->q);
 }
 
-static void flush_plug_list(struct blk_plug *plug)
+static void queue_unplugged(struct request_queue *q, unsigned int depth,
+                            bool force_kblockd)
+{
+        trace_block_unplug_io(q, depth);
+        __blk_run_queue(q, force_kblockd);
+
+        if (q->unplugged_fn)
+                q->unplugged_fn(q);
+}
+
+void blk_flush_plug_list(struct blk_plug *plug, bool force_kblockd)
 {
         struct request_queue *q;
         unsigned long flags;
         struct request *rq;
+        LIST_HEAD(list);
+        unsigned int depth;
 
         BUG_ON(plug->magic != PLUG_MAGIC);
 
         if (list_empty(&plug->list))
                 return;
 
-        if (plug->should_sort)
-                list_sort(NULL, &plug->list, plug_rq_cmp);
+        list_splice_init(&plug->list, &list);
+
+        if (plug->should_sort) {
+                list_sort(NULL, &list, plug_rq_cmp);
+                plug->should_sort = 0;
+        }
 
         q = NULL;
+        depth = 0;
+
+        /*
+         * Save and disable interrupts here, to avoid doing it for every
+         * queue lock we have to take.
+         */
         local_irq_save(flags);
-        while (!list_empty(&plug->list)) {
-                rq = list_entry_rq(plug->list.next);
+        while (!list_empty(&list)) {
+                rq = list_entry_rq(list.next);
                 list_del_init(&rq->queuelist);
                 BUG_ON(!(rq->cmd_flags & REQ_ON_PLUG));
                 BUG_ON(!rq->q);
                 if (rq->q != q) {
                         if (q) {
-                                __blk_run_queue(q, false);
+                                queue_unplugged(q, depth, force_kblockd);
                                 spin_unlock(q->queue_lock);
                         }
                         q = rq->q;
+                        depth = 0;
                         spin_lock(q->queue_lock);
                 }
                 rq->cmd_flags &= ~REQ_ON_PLUG;
@@ -2706,38 +2723,27 @@ static void flush_plug_list(struct blk_plug *plug)
                         __elv_add_request(q, rq, ELEVATOR_INSERT_FLUSH);
                 else
                         __elv_add_request(q, rq, ELEVATOR_INSERT_SORT_MERGE);
+
+                depth++;
         }
 
         if (q) {
-                __blk_run_queue(q, false);
+                queue_unplugged(q, depth, force_kblockd);
                 spin_unlock(q->queue_lock);
         }
 
-        BUG_ON(!list_empty(&plug->list));
         local_irq_restore(flags);
 }
-
-static void __blk_finish_plug(struct task_struct *tsk, struct blk_plug *plug)
-{
-        flush_plug_list(plug);
-
-        if (plug == tsk->plug)
-                tsk->plug = NULL;
-}
+EXPORT_SYMBOL(blk_flush_plug_list);
 
 void blk_finish_plug(struct blk_plug *plug)
 {
-        if (plug)
-                __blk_finish_plug(current, plug);
-}
-EXPORT_SYMBOL(blk_finish_plug);
+        blk_flush_plug_list(plug, false);
 
-void __blk_flush_plug(struct task_struct *tsk, struct blk_plug *plug)
-{
-        __blk_finish_plug(tsk, plug);
-        tsk->plug = plug;
+        if (plug == current->plug)
+                current->plug = NULL;
 }
-EXPORT_SYMBOL(__blk_flush_plug);
+EXPORT_SYMBOL(blk_finish_plug);
 
 int __init blk_dev_init(void)
 {
diff --git a/block/blk-settings.c b/block/blk-settings.c
index 1fa769293597..eb949045bb12 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -790,6 +790,22 @@ void blk_queue_flush(struct request_queue *q, unsigned int flush)
 }
 EXPORT_SYMBOL_GPL(blk_queue_flush);
 
+/**
+ * blk_queue_unplugged - register a callback for an unplug event
+ * @q:          the request queue for the device
+ * @fn:         the function to call
+ *
+ * Some stacked drivers may need to know when IO is dispatched on an
+ * unplug event. By registrering a callback here, they will be notified
+ * when someone flushes their on-stack queue plug. The function will be
+ * called with the queue lock held.
+ */
+void blk_queue_unplugged(struct request_queue *q, unplugged_fn *fn)
+{
+        q->unplugged_fn = fn;
+}
+EXPORT_SYMBOL(blk_queue_unplugged);
+
 static int __init blk_settings_init(void)
 {
         blk_max_low_pfn = max_low_pfn - 1;
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 261c75c665ae..6d735122bc59 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -498,7 +498,6 @@ int blk_register_queue(struct gendisk *disk)
 {
         int ret;
         struct device *dev = disk_to_dev(disk);
-
         struct request_queue *q = disk->queue;
 
         if (WARN_ON(!q))
@@ -521,7 +520,7 @@ int blk_register_queue(struct gendisk *disk)
         if (ret) {
                 kobject_uevent(&q->kobj, KOBJ_REMOVE);
                 kobject_del(&q->kobj);
-                blk_trace_remove_sysfs(disk_to_dev(disk));
+                blk_trace_remove_sysfs(dev);
                 kobject_put(&dev->kobj);
                 return ret;
         }
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 821040503154..7025593a58c8 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -214,7 +214,7 @@ static int amba_pm_resume_noirq(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int amba_pm_freeze(struct device *dev)
 {
@@ -352,7 +352,7 @@ static int amba_pm_restore_noirq(struct device *dev)
         return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define amba_pm_freeze          NULL
 #define amba_pm_thaw            NULL
@@ -363,7 +363,7 @@ static int amba_pm_restore_noirq(struct device *dev)
 #define amba_pm_poweroff_noirq  NULL
 #define amba_pm_restore_noirq   NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM
 
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index f051cfff18af..9e0e4fc24c46 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -149,6 +149,7 @@ static void platform_device_release(struct device *dev)
 
         of_device_node_put(&pa->pdev.dev);
         kfree(pa->pdev.dev.platform_data);
+        kfree(pa->pdev.mfd_cell);
         kfree(pa->pdev.resource);
         kfree(pa);
 }
@@ -771,7 +772,7 @@ int __weak platform_pm_resume_noirq(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int platform_pm_freeze(struct device *dev)
 {
@@ -909,7 +910,7 @@ static int platform_pm_restore_noirq(struct device *dev)
         return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define platform_pm_freeze              NULL
 #define platform_pm_thaw                NULL
@@ -920,7 +921,7 @@ static int platform_pm_restore_noirq(struct device *dev)
 #define platform_pm_poweroff_noirq      NULL
 #define platform_pm_restore_noirq       NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM_RUNTIME
 
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 052dc53eef38..fbc5b6e7c591 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -233,7 +233,7 @@ static int pm_op(struct device *dev,
                 }
                 break;
 #endif /* CONFIG_SUSPEND */
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
         case PM_EVENT_FREEZE:
         case PM_EVENT_QUIESCE:
                 if (ops->freeze) {
@@ -260,7 +260,7 @@ static int pm_op(struct device *dev,
                         suspend_report_result(ops->restore, error);
                 }
                 break;
-#endif /* CONFIG_HIBERNATION */
+#endif /* CONFIG_HIBERNATE_CALLBACKS */
         default:
                 error = -EINVAL;
         }
@@ -308,7 +308,7 @@ static int pm_noirq_op(struct device *dev,
                 }
                 break;
 #endif /* CONFIG_SUSPEND */
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
         case PM_EVENT_FREEZE:
         case PM_EVENT_QUIESCE:
                 if (ops->freeze_noirq) {
@@ -335,7 +335,7 @@ static int pm_noirq_op(struct device *dev,
                         suspend_report_result(ops->restore_noirq, error);
                 }
                 break;
-#endif /* CONFIG_HIBERNATION */
+#endif /* CONFIG_HIBERNATE_CALLBACKS */
         default:
                 error = -EINVAL;
         }
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 6b396759e7f5..8a781540590c 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1448,7 +1448,7 @@ static const struct of_device_id fsldma_of_ids[] = {
         {}
 };
 
-static struct of_platform_driver fsldma_of_driver = {
+static struct platform_driver fsldma_of_driver = {
         .driver = {
                 .name = "fsl-elo-dma",
                 .owner = THIS_MODULE,
diff --git a/drivers/gpio/ml_ioh_gpio.c b/drivers/gpio/ml_ioh_gpio.c
index 7f6f01a4b145..0a775f7987c2 100644
--- a/drivers/gpio/ml_ioh_gpio.c
+++ b/drivers/gpio/ml_ioh_gpio.c
@@ -116,6 +116,7 @@ static int ioh_gpio_direction_output(struct gpio_chip *gpio, unsigned nr,
                 reg_val |= (1 << nr);
         else
                 reg_val &= ~(1 << nr);
+        iowrite32(reg_val, &chip->reg->regs[chip->ch].po);
 
         mutex_unlock(&chip->lock);
 
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 583e92592073..7630ab7b9bec 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -558,7 +558,7 @@ static int __devinit pca953x_probe(struct i2c_client *client,
 
         ret = gpiochip_add(&chip->gpio_chip);
         if (ret)
-                goto out_failed;
+                goto out_failed_irq;
 
         if (pdata->setup) {
                 ret = pdata->setup(client, chip->gpio_chip.base,
@@ -570,8 +570,9 @@ static int __devinit pca953x_probe(struct i2c_client *client,
         i2c_set_clientdata(client, chip);
         return 0;
 
-out_failed:
+out_failed_irq:
         pca953x_irq_teardown(chip);
+out_failed:
         kfree(chip->dyn_pdata);
         kfree(chip);
         return ret;
diff --git a/drivers/gpio/pch_gpio.c b/drivers/gpio/pch_gpio.c
index 2c6af8705103..f970a5f3585e 100644
--- a/drivers/gpio/pch_gpio.c
+++ b/drivers/gpio/pch_gpio.c
@@ -105,6 +105,7 @@ static int pch_gpio_direction_output(struct gpio_chip *gpio, unsigned nr,
                 reg_val |= (1 << nr);
         else
                 reg_val &= ~(1 << nr);
+        iowrite32(reg_val, &chip->reg->po);
 
         mutex_unlock(&chip->lock);
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index a6feb78c404c..c58f691ec3ce 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -96,6 +96,7 @@ config DRM_I915
         # i915 depends on ACPI_VIDEO when ACPI is enabled
         # but for select to work, need to select ACPI_VIDEO's dependencies, ick
         select BACKLIGHT_CLASS_DEVICE if ACPI
+        select VIDEO_OUTPUT_CONTROL if ACPI
         select INPUT if ACPI
         select ACPI_VIDEO if ACPI
         select ACPI_BUTTON if ACPI
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 8314a49b6b9a..90aef64b76f2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -269,7 +269,7 @@ struct init_tbl_entry {
         int (*handler)(struct nvbios *, uint16_t, struct init_exec *);
 };
 
-static int parse_init_table(struct nvbios *, unsigned int, struct init_exec *);
+static int parse_init_table(struct nvbios *, uint16_t, struct init_exec *);
 
 #define MACRO_INDEX_SIZE        2
 #define MACRO_SIZE              8
@@ -2011,6 +2011,27 @@ init_sub_direct(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 }
 
 static int
+init_jump(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+        /*
+         * INIT_JUMP   opcode: 0x5C ('\')
+         *
+         * offset      (8  bit): opcode
+         * offset + 1  (16 bit): offset (in bios)
+         *
+         * Continue execution of init table from 'offset'
+         */
+
+        uint16_t jmp_offset = ROM16(bios->data[offset + 1]);
+
+        if (!iexec->execute)
+                return 3;
+
+        BIOSLOG(bios, "0x%04X: Jump to 0x%04X\n", offset, jmp_offset);
+        return jmp_offset - offset;
+}
+
+static int
 init_i2c_if(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 {
         /*
@@ -3659,6 +3680,7 @@ static struct init_tbl_entry itbl_entry[] = {
         { "INIT_ZM_REG_SEQUENCE"              , 0x58, init_zm_reg_sequence            },
         /* INIT_INDIRECT_REG (0x5A, 7, 0, 0) removed due to no example of use */
         { "INIT_SUB_DIRECT"                   , 0x5B, init_sub_direct                 },
+        { "INIT_JUMP"                         , 0x5C, init_jump                       },
         { "INIT_I2C_IF"                       , 0x5E, init_i2c_if                     },
         { "INIT_COPY_NV_REG"                  , 0x5F, init_copy_nv_reg                },
         { "INIT_ZM_INDEX_IO"                  , 0x62, init_zm_index_io                },
@@ -3700,8 +3722,7 @@ static struct init_tbl_entry itbl_entry[] = {
 #define MAX_TABLE_OPS 1000
 
 static int
-parse_init_table(struct nvbios *bios, unsigned int offset,
-                 struct init_exec *iexec)
+parse_init_table(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 {
         /*
          * Parses all commands in an init table.
@@ -6333,6 +6354,32 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)
                 }
         }
 
+        /* XFX GT-240X-YA
+         *
+         * So many things wrong here, replace the entire encoder table..
+         */
+        if (nv_match_device(dev, 0x0ca3, 0x1682, 0x3003)) {
+                if (idx == 0) {
+                        *conn = 0x02001300; /* VGA, connector 1 */
+                        *conf = 0x00000028;
+                } else
+                if (idx == 1) {
+                        *conn = 0x01010312; /* DVI, connector 0 */
+                        *conf = 0x00020030;
+                } else
+                if (idx == 2) {
+                        *conn = 0x01010310; /* VGA, connector 0 */
+                        *conf = 0x00000028;
+                } else
+                if (idx == 3) {
+                        *conn = 0x02022362; /* HDMI, connector 2 */
+                        *conf = 0x00020010;
+                } else {
+                        *conn = 0x0000000e; /* EOL */
+                        *conf = 0x00000000;
+                }
+        }
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 57e5302503db..856d56a98d1e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -1190,7 +1190,7 @@ extern int  nv50_graph_load_context(struct nouveau_channel *);
 extern int  nv50_graph_unload_context(struct drm_device *);
 extern int  nv50_grctx_init(struct nouveau_grctx *);
 extern void nv50_graph_tlb_flush(struct drm_device *dev);
-extern void nv86_graph_tlb_flush(struct drm_device *dev);
+extern void nv84_graph_tlb_flush(struct drm_device *dev);
 extern struct nouveau_enum nv50_data_error_names[];
 
 /* nvc0_graph.c */
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 2683377f4131..78f467fe30be 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -552,6 +552,7 @@ nouveau_mem_timing_init(struct drm_device *dev)
         u8 tRC;         /* Byte 9 */
         u8 tUNK_10, tUNK_11, tUNK_12, tUNK_13, tUNK_14;
         u8 tUNK_18, tUNK_19, tUNK_20, tUNK_21;
+        u8 magic_number = 0; /* Yeah... sorry*/
         u8 *mem = NULL, *entry;
         int i, recordlen, entries;
 
@@ -596,6 +597,12 @@ nouveau_mem_timing_init(struct drm_device *dev)
         if (!memtimings->timing)
                 return;
 
+        /* Get "some number" from the timing reg for NV_40
+         * Used in calculations later */
+        if(dev_priv->card_type == NV_40) {
+                magic_number = (nv_rd32(dev,0x100228) & 0x0f000000) >> 24;
+        }
+
         entry = mem + mem[1];
         for (i = 0; i < entries; i++, entry += recordlen) {
                 struct nouveau_pm_memtiming *timing = &pm->memtimings.timing[i];
@@ -635,36 +642,51 @@ nouveau_mem_timing_init(struct drm_device *dev)
 
                 /* XXX: I don't trust the -1's and +1's... they must come
                  *      from somewhere! */
-                timing->reg_100224 = ((tUNK_0 + tUNK_19 + 1) << 24 |
+                timing->reg_100224 = (tUNK_0 + tUNK_19 + 1 + magic_number) << 24 |
                                       tUNK_18 << 16 |
-                                      (tUNK_1 + tUNK_19 + 1) << 8 |
-                                      (tUNK_2 - 1));
+                                      (tUNK_1 + tUNK_19 + 1 + magic_number) << 8;
+                if(dev_priv->chipset == 0xa8) {
+                        timing->reg_100224 |= (tUNK_2 - 1);
+                } else {
+                        timing->reg_100224 |= (tUNK_2 + 2 - magic_number);
+                }
 
                 timing->reg_100228 = (tUNK_12 << 16 | tUNK_11 << 8 | tUNK_10);
-                if(recordlen > 19) {
-                        timing->reg_100228 += (tUNK_19 - 1) << 24;
-                }/* I cannot back-up this else-statement right now
-                         else {
-                        timing->reg_100228 += tUNK_12 << 24;
-                }*/
-
-                /* XXX: reg_10022c */
-                timing->reg_10022c = tUNK_2 - 1;
-
-                timing->reg_100230 = (tUNK_20 << 24 | tUNK_21 << 16 |
-                                      tUNK_13 << 8  | tUNK_13);
-
-                /* XXX: +6? */
-                timing->reg_100234 = (tRAS << 24 | (tUNK_19 + 6) << 8 | tRC);
-                timing->reg_100234 += max(tUNK_10,tUNK_11) << 16;
-
-                /* XXX; reg_100238, reg_10023c
-                 * reg: 0x00??????
-                 * reg_10023c:
-                 *      0 for pre-NV50 cards
-                 *      0x????0202 for NV50+ cards (empirical evidence) */
-                if(dev_priv->card_type >= NV_50) {
+                if(dev_priv->chipset >= 0xa3 && dev_priv->chipset < 0xaa) {
+                        timing->reg_100228 |= (tUNK_19 - 1) << 24;
+                }
+
+                if(dev_priv->card_type == NV_40) {
+                        /* NV40: don't know what the rest of the regs are..
+                         * And don't need to know either */
+                        timing->reg_100228 |= 0x20200000 | magic_number << 24;
+                } else if(dev_priv->card_type >= NV_50) {
+                        /* XXX: reg_10022c */
+                        timing->reg_10022c = tUNK_2 - 1;
+
+                        timing->reg_100230 = (tUNK_20 << 24 | tUNK_21 << 16 |
+                                                  tUNK_13 << 8  | tUNK_13);
+
+                        timing->reg_100234 = (tRAS << 24 | tRC);
+                        timing->reg_100234 += max(tUNK_10,tUNK_11) << 16;
+
+                        if(dev_priv->chipset < 0xa3) {
+                                timing->reg_100234 |= (tUNK_2 + 2) << 8;
+                        } else {
+                                /* XXX: +6? */
+                                timing->reg_100234 |= (tUNK_19 + 6) << 8;
+                        }
+
+                        /* XXX; reg_100238, reg_10023c
+                         * reg_100238: 0x00??????
+                         * reg_10023c: 0x!!??0202 for NV50+ cards (empirical evidence) */
                         timing->reg_10023c = 0x202;
+                        if(dev_priv->chipset < 0xa3) {
+                                timing->reg_10023c |= 0x4000000 | (tUNK_2 - 1) << 16;
+                        } else {
+                                /* currently unknown
+                                 * 10023c seen as 06xxxxxx, 0bxxxxxx or 0fxxxxxx */
+                        }
                 }
 
                 NV_DEBUG(dev, "Entry %d: 220: %08x %08x %08x %08x\n", i,
@@ -675,7 +697,7 @@ nouveau_mem_timing_init(struct drm_device *dev)
                          timing->reg_100238, timing->reg_10023c);
         }
 
-        memtimings->nr_timing  = entries;
+        memtimings->nr_timing = entries;
         memtimings->supported = true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index ac62a1b8c4fc..670e3cb697ec 100644
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -134,7 +134,7 @@ nouveau_perf_init(struct drm_device *dev)
                 case 0x13:
                 case 0x15:
                         perflvl->fanspeed = entry[55];
-                        perflvl->voltage = entry[56];
+                        perflvl->voltage = (recordlen > 56) ? entry[56] : 0;
                         perflvl->core = ROM32(entry[1]) * 10;
                         perflvl->memory = ROM32(entry[5]) * 20;
                         break;
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 5bb2859001e2..6e2b1a6caa2d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -376,15 +376,11 @@ static int nouveau_init_engine_ptrs(struct drm_device *dev)
                 engine->graph.destroy_context   = nv50_graph_destroy_context;
                 engine->graph.load_context      = nv50_graph_load_context;
                 engine->graph.unload_context    = nv50_graph_unload_context;
-                if (dev_priv->chipset != 0x86)
+                if (dev_priv->chipset == 0x50 ||
+                    dev_priv->chipset == 0xac)
                         engine->graph.tlb_flush = nv50_graph_tlb_flush;
-                else {
-                        /* from what i can see nvidia do this on every
-                         * pre-NVA3 board except NVAC, but, we've only
-                         * ever seen problems on NV86
-                         */
-                        engine->graph.tlb_flush = nv86_graph_tlb_flush;
-                }
+                else
+                        engine->graph.tlb_flush = nv84_graph_tlb_flush;
                 engine->fifo.channels           = 128;
                 engine->fifo.init               = nv50_fifo_init;
                 engine->fifo.takedown           = nv50_fifo_takedown;
diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
index c82db37d9f41..12098bf839c4 100644
--- a/drivers/gpu/drm/nouveau/nv04_dfp.c
+++ b/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -581,12 +581,13 @@ static void nv04_dfp_restore(struct drm_encoder *encoder)
         int head = nv_encoder->restore.head;
 
         if (nv_encoder->dcb->type == OUTPUT_LVDS) {
-                struct drm_display_mode *native_mode = nouveau_encoder_connector_get(nv_encoder)->native_mode;
-                if (native_mode)
-                        call_lvds_script(dev, nv_encoder->dcb, head, LVDS_PANEL_ON,
-                                         native_mode->clock);
-                else
-                        NV_ERROR(dev, "Not restoring LVDS without native mode\n");
+                struct nouveau_connector *connector =
+                        nouveau_encoder_connector_get(nv_encoder);
+
+                if (connector && connector->native_mode)
+                        call_lvds_script(dev, nv_encoder->dcb, head,
+                                         LVDS_PANEL_ON,
+                                         connector->native_mode->clock);
 
         } else if (nv_encoder->dcb->type == OUTPUT_TMDS) {
                 int clock = nouveau_hw_pllvals_to_clk
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
index 2b9984027f41..a19ccaa025b3 100644
--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -469,9 +469,6 @@ nv50_crtc_wait_complete(struct drm_crtc *crtc)
 
         start = ptimer->read(dev);
         do {
-                nv_wr32(dev, 0x61002c, 0x370);
-                nv_wr32(dev, 0x000140, 1);
-
                 if (nv_ro32(disp->ntfy, 0x000))
                         return 0;
         } while (ptimer->read(dev) - start < 2000000000ULL);
diff --git a/drivers/gpu/drm/nouveau/nv50_evo.c b/drivers/gpu/drm/nouveau/nv50_evo.c
index a2cfaa691e9b..c8e83c1a4de8 100644
--- a/drivers/gpu/drm/nouveau/nv50_evo.c
+++ b/drivers/gpu/drm/nouveau/nv50_evo.c
@@ -186,6 +186,7 @@ nv50_evo_channel_init(struct nouveau_channel *evo)
         nv_mask(dev, 0x610028, 0x00000000, 0x00010001 << id);
 
         evo->dma.max = (4096/4) - 2;
+        evo->dma.max &= ~7;
         evo->dma.put = 0;
         evo->dma.cur = evo->dma.put;
         evo->dma.free = evo->dma.max - evo->dma.cur;
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 8675b00caf18..b02a5b1e7d37 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -503,7 +503,7 @@ nv50_graph_tlb_flush(struct drm_device *dev)
 }
 
 void
-nv86_graph_tlb_flush(struct drm_device *dev)
+nv84_graph_tlb_flush(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
diff --git a/drivers/gpu/drm/nouveau/nvc0_vm.c b/drivers/gpu/drm/nouveau/nvc0_vm.c
index 69af0ba7edd3..a0a2a0277f73 100644
--- a/drivers/gpu/drm/nouveau/nvc0_vm.c
+++ b/drivers/gpu/drm/nouveau/nvc0_vm.c
@@ -104,20 +104,26 @@ nvc0_vm_flush(struct nouveau_vm *vm)
         struct nouveau_instmem_engine *pinstmem = &dev_priv->engine.instmem;
         struct drm_device *dev = vm->dev;
         struct nouveau_vm_pgd *vpgd;
-        u32 r100c80, engine;
+        u32 engine = (dev_priv->chan_vm == vm) ? 1 : 5;
 
         pinstmem->flush(vm->dev);
 
-        if (vm == dev_priv->chan_vm)
-                engine = 1;
-        else
-                engine = 5;
-
+        spin_lock(&dev_priv->ramin_lock);
         list_for_each_entry(vpgd, &vm->pgd_list, head) {
-                r100c80 = nv_rd32(dev, 0x100c80);
+                /* looks like maybe a "free flush slots" counter, the
+                 * faster you write to 0x100cbc to more it decreases
+                 */
+                if (!nv_wait_ne(dev, 0x100c80, 0x00ff0000, 0x00000000)) {
+                        NV_ERROR(dev, "vm timeout 0: 0x%08x %d\n",
+                                 nv_rd32(dev, 0x100c80), engine);
+                }
                 nv_wr32(dev, 0x100cb8, vpgd->obj->vinst >> 8);
                 nv_wr32(dev, 0x100cbc, 0x80000000 | engine);
-                if (!nv_wait(dev, 0x100c80, 0xffffffff, r100c80))
-                        NV_ERROR(dev, "vm flush timeout eng %d\n", engine);
+                /* wait for flush to be queued? */
+                if (!nv_wait(dev, 0x100c80, 0x00008000, 0x00008000)) {
+                        NV_ERROR(dev, "vm timeout 1: 0x%08x %d\n",
+                                 nv_rd32(dev, 0x100c80), engine);
+                }
         }
+        spin_unlock(&dev_priv->ramin_lock);
 }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 258fa5e7a2d9..d71d375149f8 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -32,6 +32,7 @@
 #include "atom.h"
 #include "atom-names.h"
 #include "atom-bits.h"
+#include "radeon.h"
 
 #define ATOM_COND_ABOVE         0
 #define ATOM_COND_ABOVEOREQUAL  1
@@ -101,7 +102,9 @@ static void debug_print_spaces(int n)
 static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                                  uint32_t index, uint32_t data)
 {
+        struct radeon_device *rdev = ctx->card->dev->dev_private;
         uint32_t temp = 0xCDCDCDCD;
+
         while (1)
                 switch (CU8(base)) {
                 case ATOM_IIO_NOP:
@@ -112,7 +115,8 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                         base += 3;
                         break;
                 case ATOM_IIO_WRITE:
-                        (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
+                        if (rdev->family == CHIP_RV515)
+                                (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
                         ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
                         base += 3;
                         break;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index b41ec59c7100..9d516a8c4dfa 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -531,6 +531,12 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
                 else
                         pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+
+                if ((rdev->family == CHIP_R600) ||
+                    (rdev->family == CHIP_RV610) ||
+                    (rdev->family == CHIP_RV630) ||
+                    (rdev->family == CHIP_RV670))
+                        pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
         } else {
                 pll->flags |= RADEON_PLL_LEGACY;
 
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 0b0cc74c08c0..3453910ee0f3 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -120,11 +120,16 @@ void evergreen_pm_misc(struct radeon_device *rdev)
         struct radeon_power_state *ps = &rdev->pm.power_state[req_ps_idx];
         struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
 
-        if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
-                if (voltage->voltage != rdev->pm.current_vddc) {
-                        radeon_atom_set_voltage(rdev, voltage->voltage);
+        if (voltage->type == VOLTAGE_SW) {
+                if (voltage->voltage && (voltage->voltage != rdev->pm.current_vddc)) {
+                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
-                        DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
+                        DRM_DEBUG("Setting: vddc: %d\n", voltage->voltage);
+                }
+                if (voltage->vddci && (voltage->vddci != rdev->pm.current_vddci)) {
+                        radeon_atom_set_voltage(rdev, voltage->vddci, SET_VOLTAGE_TYPE_ASIC_VDDCI);
+                        rdev->pm.current_vddci = voltage->vddci;
+                        DRM_DEBUG("Setting: vddci: %d\n", voltage->vddci);
                 }
         }
 }
@@ -3036,9 +3041,6 @@ int evergreen_init(struct radeon_device *rdev)
 {
         int r;
 
-        r = radeon_dummy_page_init(rdev);
-        if (r)
-                return r;
         /* This don't do much */
         r = radeon_gem_init(rdev);
         if (r)
@@ -3150,7 +3152,6 @@ void evergreen_fini(struct radeon_device *rdev)
         radeon_atombios_fini(rdev);
         kfree(rdev->bios);
         rdev->bios = NULL;
-        radeon_dummy_page_fini(rdev);
 }
 
 static void evergreen_pcie_gen2_enable(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index be271c42de4d..15d58292677a 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -587,7 +587,7 @@ void r600_pm_misc(struct radeon_device *rdev)
 
         if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
                 if (voltage->voltage != rdev->pm.current_vddc) {
-                        radeon_atom_set_voltage(rdev, voltage->voltage);
+                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
                         DRM_DEBUG_DRIVER("Setting: v: %d\n", voltage->voltage);
                 }
@@ -2509,9 +2509,6 @@ int r600_init(struct radeon_device *rdev)
 {
         int r;
 
-        r = radeon_dummy_page_init(rdev);
-        if (r)
-                return r;
         if (r600_debugfs_mc_info_init(rdev)) {
                 DRM_ERROR("Failed to register debugfs file for mc !\n");
         }
@@ -2625,7 +2622,6 @@ void r600_fini(struct radeon_device *rdev)
         radeon_atombios_fini(rdev);
         kfree(rdev->bios);
         rdev->bios = NULL;
-        radeon_dummy_page_fini(rdev);
 }
 
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 93f536594c73..ba643b576054 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -177,7 +177,7 @@ void radeon_pm_suspend(struct radeon_device *rdev);
 void radeon_pm_resume(struct radeon_device *rdev);
 void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
-void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level);
+void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 voltage_type);
 void rs690_pm_info(struct radeon_device *rdev);
 extern int rv6xx_get_temp(struct radeon_device *rdev);
 extern int rv770_get_temp(struct radeon_device *rdev);
@@ -767,7 +767,9 @@ struct radeon_voltage {
         u8 vddci_id; /* index into vddci voltage table */
         bool vddci_enabled;
         /* r6xx+ sw */
-        u32 voltage;
+        u16 voltage;
+        /* evergreen+ vddci */
+        u16 vddci;
 };
 
 /* clock mode flags */
@@ -835,10 +837,12 @@ struct radeon_pm {
         int                     default_power_state_index;
         u32                     current_sclk;
         u32                     current_mclk;
-        u32                     current_vddc;
+        u16                     current_vddc;
+        u16                     current_vddci;
         u32                     default_sclk;
         u32                     default_mclk;
-        u32                     default_vddc;
+        u16                     default_vddc;
+        u16                     default_vddci;
         struct radeon_i2c_chan *i2c_bus;
         /* selected pm method */
         enum radeon_pm_method     pm_method;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index eb888ee5f674..ca576191d058 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -94,7 +94,7 @@ static void radeon_register_accessor_init(struct radeon_device *rdev)
                 rdev->mc_rreg = &rs600_mc_rreg;
                 rdev->mc_wreg = &rs600_mc_wreg;
         }
-        if ((rdev->family >= CHIP_R600) && (rdev->family <= CHIP_HEMLOCK)) {
+        if (rdev->family >= CHIP_R600) {
                 rdev->pciep_rreg = &r600_pciep_rreg;
                 rdev->pciep_wreg = &r600_pciep_wreg;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 99768d9d91da..f5d12fb103fa 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2176,24 +2176,27 @@ static void radeon_atombios_add_pplib_thermal_controller(struct radeon_device *r
         }
 }
 
-static u16 radeon_atombios_get_default_vddc(struct radeon_device *rdev)
+static void radeon_atombios_get_default_voltages(struct radeon_device *rdev,
+                                                 u16 *vddc, u16 *vddci)
 {
         struct radeon_mode_info *mode_info = &rdev->mode_info;
         int index = GetIndexIntoMasterTable(DATA, FirmwareInfo);
         u8 frev, crev;
         u16 data_offset;
         union firmware_info *firmware_info;
-        u16 vddc = 0;
+
+        *vddc = 0;
+        *vddci = 0;
 
         if (atom_parse_data_header(mode_info->atom_context, index, NULL,
                                    &frev, &crev, &data_offset)) {
                 firmware_info =
                         (union firmware_info *)(mode_info->atom_context->bios +
                                                 data_offset);
-                vddc = le16_to_cpu(firmware_info->info_14.usBootUpVDDCVoltage);
+                *vddc = le16_to_cpu(firmware_info->info_14.usBootUpVDDCVoltage);
+                if ((frev == 2) && (crev >= 2))
+                        *vddci = le16_to_cpu(firmware_info->info_22.usBootUpVDDCIVoltage);
         }
-
-        return vddc;
 }
 
 static void radeon_atombios_parse_pplib_non_clock_info(struct radeon_device *rdev,
@@ -2203,7 +2206,9 @@ static void radeon_atombios_parse_pplib_non_clock_info(struct radeon_device *rde
         int j;
         u32 misc = le32_to_cpu(non_clock_info->ulCapsAndSettings);
         u32 misc2 = le16_to_cpu(non_clock_info->usClassification);
-        u16 vddc = radeon_atombios_get_default_vddc(rdev);
+        u16 vddc, vddci;
+
+        radeon_atombios_get_default_voltages(rdev, &vddc, &vddci);
 
         rdev->pm.power_state[state_index].misc = misc;
         rdev->pm.power_state[state_index].misc2 = misc2;
@@ -2244,6 +2249,7 @@ static void radeon_atombios_parse_pplib_non_clock_info(struct radeon_device *rde
                         rdev->pm.default_sclk = rdev->pm.power_state[state_index].clock_info[0].sclk;
                         rdev->pm.default_mclk = rdev->pm.power_state[state_index].clock_info[0].mclk;
                         rdev->pm.default_vddc = rdev->pm.power_state[state_index].clock_info[0].voltage.voltage;
+                        rdev->pm.default_vddci = rdev->pm.power_state[state_index].clock_info[0].voltage.vddci;
                 } else {
                         /* patch the table values with the default slck/mclk from firmware info */
                         for (j = 0; j < mode_index; j++) {
@@ -2286,6 +2292,8 @@ static bool radeon_atombios_parse_pplib_clock_info(struct radeon_device *rdev,
                         VOLTAGE_SW;
                 rdev->pm.power_state[state_index].clock_info[mode_index].voltage.voltage =
                         le16_to_cpu(clock_info->evergreen.usVDDC);
+                rdev->pm.power_state[state_index].clock_info[mode_index].voltage.vddci =
+                        le16_to_cpu(clock_info->evergreen.usVDDCI);
         } else {
                 sclk = le16_to_cpu(clock_info->r600.usEngineClockLow);
                 sclk |= clock_info->r600.ucEngineClockHigh << 16;
@@ -2577,25 +2585,25 @@ union set_voltage {
         struct _SET_VOLTAGE_PARAMETERS_V2 v2;
 };
 
-void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level)
+void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 voltage_type)
 {
         union set_voltage args;
         int index = GetIndexIntoMasterTable(COMMAND, SetVoltage);
-        u8 frev, crev, volt_index = level;
+        u8 frev, crev, volt_index = voltage_level;
 
         if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
                 return;
 
         switch (crev) {
         case 1:
-                args.v1.ucVoltageType = SET_VOLTAGE_TYPE_ASIC_VDDC;
+                args.v1.ucVoltageType = voltage_type;
                 args.v1.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_ALL_SOURCE;
                 args.v1.ucVoltageIndex = volt_index;
                 break;
         case 2:
-                args.v2.ucVoltageType = SET_VOLTAGE_TYPE_ASIC_VDDC;
+                args.v2.ucVoltageType = voltage_type;
                 args.v2.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_SET_VOLTAGE;
-                args.v2.usVoltageLevel = cpu_to_le16(level);
+                args.v2.usVoltageLevel = cpu_to_le16(voltage_level);
                 break;
         default:
                 DRM_ERROR("Unknown table version %d, %d\n", frev, crev);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 9e59868d354e..bbcd1dd7bac0 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -79,7 +79,7 @@ static bool radeon_fence_poll_locked(struct radeon_device *rdev)
                         scratch_index = R600_WB_EVENT_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
                 else
                         scratch_index = RADEON_WB_SCRATCH_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
-                seq = rdev->wb.wb[scratch_index/4];
+                seq = le32_to_cpu(rdev->wb.wb[scratch_index/4]);
         } else
                 seq = RREG32(rdev->fence_drv.scratch_reg);
         if (seq != rdev->fence_drv.last_seq) {
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index f0534ef2f331..8a955bbdb608 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -285,4 +285,6 @@ void radeon_gart_fini(struct radeon_device *rdev)
         rdev->gart.pages = NULL;
         rdev->gart.pages_addr = NULL;
         rdev->gart.ttm_alloced = NULL;
+
+        radeon_dummy_page_fini(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index ded2a45bc95c..ccbabf734a61 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -1062,7 +1062,7 @@ void radeon_i2c_get_byte(struct radeon_i2c_chan *i2c_bus,
                 *val = in_buf[0];
                 DRM_DEBUG("val = 0x%02x\n", *val);
         } else {
-                DRM_ERROR("i2c 0x%02x 0x%02x read failed\n",
+                DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
                           addr, *val);
         }
 }
@@ -1084,7 +1084,7 @@ void radeon_i2c_put_byte(struct radeon_i2c_chan *i2c_bus,
         out_buf[1] = val;
 
         if (i2c_transfer(&i2c_bus->adapter, &msg, 1) != 1)
-                DRM_ERROR("i2c 0x%02x 0x%02x write failed\n",
+                DRM_DEBUG("i2c 0x%02x 0x%02x write failed\n",
                           addr, val);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 5b54268ed6b2..2f46e0c8df53 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -269,7 +269,7 @@ static const struct drm_encoder_helper_funcs radeon_legacy_lvds_helper_funcs = {
         .disable = radeon_legacy_encoder_disable,
 };
 
-#ifdef CONFIG_BACKLIGHT_CLASS_DEVICE
+#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
 
 #define MAX_RADEON_LEVEL 0xFF
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 08de669e025a..86eda1ea94df 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -23,6 +23,7 @@
 #include "drmP.h"
 #include "radeon.h"
 #include "avivod.h"
+#include "atom.h"
 #ifdef CONFIG_ACPI
 #include <linux/acpi.h>
 #endif
@@ -535,7 +536,11 @@ void radeon_pm_resume(struct radeon_device *rdev)
         /* set up the default clocks if the MC ucode is loaded */
         if (ASIC_IS_DCE5(rdev) && rdev->mc_fw) {
                 if (rdev->pm.default_vddc)
-                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddc);
+                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
+                                                SET_VOLTAGE_TYPE_ASIC_VDDC);
+                if (rdev->pm.default_vddci)
+                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddci,
+                                                SET_VOLTAGE_TYPE_ASIC_VDDCI);
                 if (rdev->pm.default_sclk)
                         radeon_set_engine_clock(rdev, rdev->pm.default_sclk);
                 if (rdev->pm.default_mclk)
@@ -548,6 +553,7 @@ void radeon_pm_resume(struct radeon_device *rdev)
         rdev->pm.current_sclk = rdev->pm.default_sclk;
         rdev->pm.current_mclk = rdev->pm.default_mclk;
         rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+        rdev->pm.current_vddci = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.vddci;
         if (rdev->pm.pm_method == PM_METHOD_DYNPM
             && rdev->pm.dynpm_state == DYNPM_STATE_SUSPENDED) {
                 rdev->pm.dynpm_state = DYNPM_STATE_ACTIVE;
@@ -585,7 +591,8 @@ int radeon_pm_init(struct radeon_device *rdev)
                 /* set up the default clocks if the MC ucode is loaded */
                 if (ASIC_IS_DCE5(rdev) && rdev->mc_fw) {
                         if (rdev->pm.default_vddc)
-                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc);
+                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
+                                                        SET_VOLTAGE_TYPE_ASIC_VDDC);
                         if (rdev->pm.default_sclk)
                                 radeon_set_engine_clock(rdev, rdev->pm.default_sclk);
                         if (rdev->pm.default_mclk)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index bbc9cd823334..c6776e48fdde 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -248,7 +248,7 @@ void radeon_ib_pool_fini(struct radeon_device *rdev)
 void radeon_ring_free_size(struct radeon_device *rdev)
 {
         if (rdev->wb.enabled)
-                rdev->cp.rptr = rdev->wb.wb[RADEON_WB_CP_RPTR_OFFSET/4];
+                rdev->cp.rptr = le32_to_cpu(rdev->wb.wb[RADEON_WB_CP_RPTR_OFFSET/4]);
         else {
                 if (rdev->family >= CHIP_R600)
                         rdev->cp.rptr = RREG32(R600_CP_RB_RPTR);
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 876cebc4b8ba..6e3b11e5abbe 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -114,7 +114,7 @@ void rs600_pm_misc(struct radeon_device *rdev)
                                 udelay(voltage->delay);
                 }
         } else if (voltage->type == VOLTAGE_VDDC)
-                radeon_atom_set_voltage(rdev, voltage->vddc_id);
+                radeon_atom_set_voltage(rdev, voltage->vddc_id, SET_VOLTAGE_TYPE_ASIC_VDDC);
 
         dyn_pwrmgt_sclk_length = RREG32_PLL(DYN_PWRMGT_SCLK_LENGTH);
         dyn_pwrmgt_sclk_length &= ~REDUCED_POWER_SCLK_HILEN(0xf);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index b974ac7df8df..ef8a5babe9f7 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -106,7 +106,7 @@ void rv770_pm_misc(struct radeon_device *rdev)
 
         if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
                 if (voltage->voltage != rdev->pm.current_vddc) {
-                        radeon_atom_set_voltage(rdev, voltage->voltage);
+                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
                         DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
                 }
@@ -1255,9 +1255,6 @@ int rv770_init(struct radeon_device *rdev)
 {
         int r;
 
-        r = radeon_dummy_page_init(rdev);
-        if (r)
-                return r;
         /* This don't do much */
         r = radeon_gem_init(rdev);
         if (r)
@@ -1372,7 +1369,6 @@ void rv770_fini(struct radeon_device *rdev)
         radeon_atombios_fini(rdev);
         kfree(rdev->bios);
         rdev->bios = NULL;
-        radeon_dummy_page_fini(rdev);
 }
 
 static void rv770_pcie_gen2_enable(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 737a2a2e46a5..9d9d92945f8c 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -683,22 +683,14 @@ int ttm_get_pages(struct list_head *pages, int flags,
                         gfp_flags |= GFP_HIGHUSER;
 
                 for (r = 0; r < count; ++r) {
-                        if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) {
-                                void *addr;
-                                addr = dma_alloc_coherent(NULL, PAGE_SIZE,
-                                                          &dma_address[r],
-                                                          gfp_flags);
-                                if (addr == NULL)
-                                        return -ENOMEM;
-                                p = virt_to_page(addr);
-                        } else
-                                p = alloc_page(gfp_flags);
+                        p = alloc_page(gfp_flags);
                         if (!p) {
 
                                 printk(KERN_ERR TTM_PFX
                                        "Unable to allocate page.");
                                 return -ENOMEM;
                         }
+
                         list_add(&p->lru, pages);
                 }
                 return 0;
@@ -746,24 +738,12 @@ void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags,
         unsigned long irq_flags;
         struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
         struct page *p, *tmp;
-        unsigned r;
 
         if (pool == NULL) {
                 /* No pool for this memory type so free the pages */
 
-                r = page_count-1;
                 list_for_each_entry_safe(p, tmp, pages, lru) {
-                        if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) {
-                                void *addr = page_address(p);
-                                WARN_ON(!addr || !dma_address[r]);
-                                if (addr)
-                                        dma_free_coherent(NULL, PAGE_SIZE,
-                                                          addr,
-                                                          dma_address[r]);
-                                dma_address[r] = 0;
-                        } else
-                                __free_page(p);
-                        r--;
+                        __free_page(p);
                 }
                 /* Make the pages list empty */
                 INIT_LIST_HEAD(pages);
diff --git a/drivers/gpu/stub/Kconfig b/drivers/gpu/stub/Kconfig
index 70e60a4bb678..419917955bf6 100644
--- a/drivers/gpu/stub/Kconfig
+++ b/drivers/gpu/stub/Kconfig
@@ -5,6 +5,7 @@ config STUB_POULSBO
         # Poulsbo stub depends on ACPI_VIDEO when ACPI is enabled
         # but for select to work, need to select ACPI_VIDEO's dependencies, ick
         select BACKLIGHT_CLASS_DEVICE if ACPI
+        select VIDEO_OUTPUT_CONTROL if ACPI
         select INPUT if ACPI
         select ACPI_VIDEO if ACPI
         select THERMAL if ACPI
diff --git a/drivers/leds/leds-regulator.c b/drivers/leds/leds-regulator.c
index 3790816643be..8497f56f8e46 100644
--- a/drivers/leds/leds-regulator.c
+++ b/drivers/leds/leds-regulator.c
@@ -178,6 +178,10 @@ static int __devinit regulator_led_probe(struct platform_device *pdev)
         led->cdev.flags |= LED_CORE_SUSPENDRESUME;
         led->vcc = vcc;
 
+        /* to handle correctly an already enabled regulator */
+        if (regulator_is_enabled(led->vcc))
+                led->enabled = 1;
+
         mutex_init(&led->mutex);
         INIT_WORK(&led->work, led_work);
 
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index d01574d98870..f4c8c844b913 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -55,6 +55,19 @@ int mfd_cell_disable(struct platform_device *pdev)
 }
 EXPORT_SYMBOL(mfd_cell_disable);
 
+static int mfd_platform_add_cell(struct platform_device *pdev,
+                                 const struct mfd_cell *cell)
+{
+        if (!cell)
+                return 0;
+
+        pdev->mfd_cell = kmemdup(cell, sizeof(*cell), GFP_KERNEL);
+        if (!pdev->mfd_cell)
+                return -ENOMEM;
+
+        return 0;
+}
+
 static int mfd_add_device(struct device *parent, int id,
                           const struct mfd_cell *cell,
                           struct resource *mem_base,
@@ -75,7 +88,7 @@ static int mfd_add_device(struct device *parent, int id,
 
         pdev->dev.parent = parent;
 
-        ret = platform_device_add_data(pdev, cell, sizeof(*cell));
+        ret = mfd_platform_add_cell(pdev, cell);
         if (ret)
                 goto fail_res;
 
@@ -123,7 +136,6 @@ static int mfd_add_device(struct device *parent, int id,
 
         return 0;
 
-/*      platform_device_del(pdev); */
 fail_res:
         kfree(res);
 fail_device:
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 20e4e9395b61..ecafa4ba238b 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -348,15 +348,15 @@ static unsigned long gru_chiplet_cpu_to_mmr(int chiplet, int cpu, int *corep)
 
 static int gru_irq_count[GRU_CHIPLETS_PER_BLADE];
 
-static void gru_noop(unsigned int irq)
+static void gru_noop(struct irq_data *d)
 {
 }
 
 static struct irq_chip gru_chip[GRU_CHIPLETS_PER_BLADE] = {
         [0 ... GRU_CHIPLETS_PER_BLADE - 1] {
-                .mask           = gru_noop,
-                .unmask         = gru_noop,
-                .ack            = gru_noop
+                .irq_mask       = gru_noop,
+                .irq_unmask     = gru_noop,
+                .irq_ack        = gru_noop
         }
 };
 
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 237913c5c92c..fed215c4cfa1 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -1452,7 +1452,7 @@ static void mtdswap_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
         oinfo = mtd->ecclayout;
         if (!mtd->oobsize || !oinfo || oinfo->oobavail < MTDSWAP_OOBSIZE) {
                 printk(KERN_ERR "%s: Not enough free bytes in OOB, "
-                        "%d available, %lu needed.\n",
+                        "%d available, %zu needed.\n",
                         MTDSWAP_PREFIX, oinfo->oobavail, MTDSWAP_OOBSIZE);
                 return;
         }
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index 6fae04b3fc6d..950646aa4c4b 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -209,22 +209,8 @@ static int atmel_nand_dma_op(struct mtd_info *mtd, void *buf, int len,
         int err = -EIO;
         enum dma_data_direction dir = is_read ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
 
-        if (buf >= high_memory) {
-                struct page *pg;
-
-                if (((size_t)buf & PAGE_MASK) !=
-                    ((size_t)(buf + len - 1) & PAGE_MASK)) {
-                        dev_warn(host->dev, "Buffer not fit in one page\n");
-                        goto err_buf;
-                }
-
-                pg = vmalloc_to_page(buf);
-                if (pg == 0) {
-                        dev_err(host->dev, "Failed to vmalloc_to_page\n");
-                        goto err_buf;
-                }
-                p = page_address(pg) + ((size_t)buf & ~PAGE_MASK);
-        }
+        if (buf >= high_memory)
+                goto err_buf;
 
         dma_dev = host->dma_chan->device;
 
@@ -280,7 +266,8 @@ static void atmel_read_buf(struct mtd_info *mtd, u8 *buf, int len)
         struct nand_chip *chip = mtd->priv;
         struct atmel_nand_host *host = chip->priv;
 
-        if (use_dma && len >= mtd->oobsize)
+        if (use_dma && len > mtd->oobsize)
+                /* only use DMA for bigger than oob size: better performances */
                 if (atmel_nand_dma_op(mtd, buf, len, 1) == 0)
                         return;
 
@@ -295,7 +282,8 @@ static void atmel_write_buf(struct mtd_info *mtd, const u8 *buf, int len)
         struct nand_chip *chip = mtd->priv;
         struct atmel_nand_host *host = chip->priv;
 
-        if (use_dma && len >= mtd->oobsize)
+        if (use_dma && len > mtd->oobsize)
+                /* only use DMA for bigger than oob size: better performances */
                 if (atmel_nand_dma_op(mtd, (void *)buf, len, 0) == 0)
                         return;
 
@@ -599,7 +587,10 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
                 nand_chip->options |= NAND_USE_FLASH_BBT;
         }
 
-        if (cpu_has_dma() && use_dma) {
+        if (!cpu_has_dma())
+                use_dma = 0;
+
+        if (use_dma) {
                 dma_cap_mask_t mask;
 
                 dma_cap_zero(mask);
@@ -611,7 +602,8 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
                 }
         }
         if (use_dma)
-                dev_info(host->dev, "Using DMA for NAND access.\n");
+                dev_info(host->dev, "Using %s for DMA transfers.\n",
+                                        dma_chan_name(host->dma_chan));
         else
                 dev_info(host->dev, "No DMA support for NAND access.\n");
 
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index f803c58b941d..66823eded7a3 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -154,7 +154,7 @@ struct be_eq_obj {
         u16 min_eqd;            /* in usecs */
         u16 max_eqd;            /* in usecs */
         u16 cur_eqd;            /* in usecs */
-        u8  msix_vec_idx;
+        u8  eq_idx;
 
         struct napi_struct napi;
 };
@@ -291,7 +291,7 @@ struct be_adapter {
         u32 num_rx_qs;
         u32 big_page_size;      /* Compounded page size shared by rx wrbs */
 
-        u8 msix_vec_next_idx;
+        u8 eq_next_idx;
         struct be_drv_stats drv_stats;
 
         struct vlan_group *vlan_grp;
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 9a54c8b24ff9..7cb5a114c733 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1497,7 +1497,7 @@ static int be_tx_queues_create(struct be_adapter *adapter)
         if (be_cmd_eq_create(adapter, eq, adapter->tx_eq.cur_eqd))
                 goto tx_eq_free;
 
-        adapter->tx_eq.msix_vec_idx = adapter->msix_vec_next_idx++;
+        adapter->tx_eq.eq_idx = adapter->eq_next_idx++;
 
 
         /* Alloc TX eth compl queue */
@@ -1590,7 +1590,7 @@ static int be_rx_queues_create(struct be_adapter *adapter)
                 if (rc)
                         goto err;
 
-                rxo->rx_eq.msix_vec_idx = adapter->msix_vec_next_idx++;
+                rxo->rx_eq.eq_idx = adapter->eq_next_idx++;
 
                 /* CQ */
                 cq = &rxo->cq;
@@ -1666,11 +1666,11 @@ static irqreturn_t be_intx(int irq, void *dev)
                 if (!isr)
                         return IRQ_NONE;
 
-                if ((1 << adapter->tx_eq.msix_vec_idx & isr))
+                if ((1 << adapter->tx_eq.eq_idx & isr))
                         event_handle(adapter, &adapter->tx_eq);
 
                 for_all_rx_queues(adapter, rxo, i) {
-                        if ((1 << rxo->rx_eq.msix_vec_idx & isr))
+                        if ((1 << rxo->rx_eq.eq_idx & isr))
                                 event_handle(adapter, &rxo->rx_eq);
                 }
         }
@@ -1951,7 +1951,7 @@ static void be_sriov_disable(struct be_adapter *adapter)
 static inline int be_msix_vec_get(struct be_adapter *adapter,
                                         struct be_eq_obj *eq_obj)
 {
-        return adapter->msix_entries[eq_obj->msix_vec_idx].vector;
+        return adapter->msix_entries[eq_obj->eq_idx].vector;
 }
 
 static int be_request_irq(struct be_adapter *adapter,
@@ -2345,6 +2345,7 @@ static int be_clear(struct be_adapter *adapter)
         be_mcc_queues_destroy(adapter);
         be_rx_queues_destroy(adapter);
         be_tx_queues_destroy(adapter);
+        adapter->eq_next_idx = 0;
 
         if (be_physfn(adapter) && adapter->sriov_enabled)
                 for (vf = 0; vf < num_vfs; vf++)
@@ -3141,12 +3142,14 @@ static int be_resume(struct pci_dev *pdev)
 static void be_shutdown(struct pci_dev *pdev)
 {
         struct be_adapter *adapter = pci_get_drvdata(pdev);
-        struct net_device *netdev =  adapter->netdev;
 
-        if (netif_running(netdev))
+        if (!adapter)
+                return;
+
+        if (netif_running(adapter->netdev))
                 cancel_delayed_work_sync(&adapter->work);
 
-        netif_device_detach(netdev);
+        netif_device_detach(adapter->netdev);
 
         be_cmd_reset_function(adapter);
 
diff --git a/drivers/net/bna/bfa_ioc.c b/drivers/net/bna/bfa_ioc.c
index 34933cb9569f..e3de0b8625cd 100644
--- a/drivers/net/bna/bfa_ioc.c
+++ b/drivers/net/bna/bfa_ioc.c
@@ -2219,13 +2219,9 @@ bfa_nw_ioc_get_mac(struct bfa_ioc *ioc)
 static void
 bfa_ioc_recover(struct bfa_ioc *ioc)
 {
-        u16 bdf;
-
-        bdf = (ioc->pcidev.pci_slot << 8 | ioc->pcidev.pci_func << 3 |
-                                        ioc->pcidev.device_id);
-
-        pr_crit("Firmware heartbeat failure at %d", bdf);
-        BUG_ON(1);
+        pr_crit("Heart Beat of IOC has failed\n");
+        bfa_ioc_stats(ioc, ioc_hbfails);
+        bfa_fsm_send_event(ioc, IOC_E_HBFAIL);
 }
 
 static void
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index 7513c4523ac4..330140ee266d 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -931,7 +931,8 @@ static int mcp251x_open(struct net_device *net)
         priv->tx_len = 0;
 
         ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
-                          IRQF_TRIGGER_FALLING, DEVICE_NAME, priv);
+                  pdata->irq_flags ? pdata->irq_flags : IRQF_TRIGGER_FALLING,
+                  DEVICE_NAME, priv);
         if (ret) {
                 dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
                 if (pdata->transceiver_enable)
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index cfd50bc49169..62dd21b06df4 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -345,6 +345,8 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv)
                 err = mlx4_en_init_allocator(priv, ring);
                 if (err) {
                         en_err(priv, "Failed initializing ring allocator\n");
+                        if (ring->stride <= TXBB_SIZE)
+                                ring->buf -= TXBB_SIZE;
                         ring_ind--;
                         goto err_allocator;
                 }
@@ -369,6 +371,8 @@ err_buffers:
         ring_ind = priv->rx_ring_num - 1;
 err_allocator:
         while (ring_ind >= 0) {
+                if (priv->rx_ring[ring_ind].stride <= TXBB_SIZE)
+                        priv->rx_ring[ring_ind].buf -= TXBB_SIZE;
                 mlx4_en_destroy_allocator(priv, &priv->rx_ring[ring_ind]);
                 ring_ind--;
         }
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 62fa7eec5f0c..3814fc9b1145 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -944,6 +944,10 @@ static int mlx4_setup_hca(struct mlx4_dev *dev)
         }
 
         for (port = 1; port <= dev->caps.num_ports; port++) {
+                enum mlx4_port_type port_type = 0;
+                mlx4_SENSE_PORT(dev, port, &port_type);
+                if (port_type)
+                        dev->caps.port_type[port] = port_type;
                 ib_port_default_caps = 0;
                 err = mlx4_get_port_ib_caps(dev, port, &ib_port_default_caps);
                 if (err)
@@ -958,6 +962,7 @@ static int mlx4_setup_hca(struct mlx4_dev *dev)
                         goto err_mcg_table_free;
                 }
         }
+        mlx4_set_port_mask(dev);
 
         return 0;
 
diff --git a/drivers/net/mlx4/mlx4.h b/drivers/net/mlx4/mlx4.h
index c1e0e5f1bcdb..dd7d745fbab4 100644
--- a/drivers/net/mlx4/mlx4.h
+++ b/drivers/net/mlx4/mlx4.h
@@ -431,6 +431,8 @@ void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type);
 
 void mlx4_handle_catas_err(struct mlx4_dev *dev);
 
+int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
+                    enum mlx4_port_type *type);
 void mlx4_do_sense_ports(struct mlx4_dev *dev,
                          enum mlx4_port_type *stype,
                          enum mlx4_port_type *defaults);
diff --git a/drivers/net/mlx4/sense.c b/drivers/net/mlx4/sense.c
index 015fbe785c13..e2337a7411d9 100644
--- a/drivers/net/mlx4/sense.c
+++ b/drivers/net/mlx4/sense.c
@@ -38,8 +38,8 @@
 
 #include "mlx4.h"
 
-static int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
-                           enum mlx4_port_type *type)
+int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
+                    enum mlx4_port_type *type)
 {
         u64 out_param;
         int err = 0;
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 693aaef4e3ce..718879b35b7d 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -317,7 +317,7 @@ static void pppoe_flush_dev(struct net_device *dev)
                         lock_sock(sk);
 
                         if (po->pppoe_dev == dev &&
-                            sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+                            sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
                                 pppox_unbind_sock(sk);
                                 sk->sk_state = PPPOX_ZOMBIE;
                                 sk->sk_state_change(sk);
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index c498b720b532..4b42ecc63dcf 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1818,6 +1818,7 @@ static int __devinit smsc911x_init(struct net_device *dev)
         SMSC_TRACE(PROBE, "PHY will be autodetected.");
 
         spin_lock_init(&pdata->dev_lock);
+        spin_lock_init(&pdata->mac_lock);
 
         if (pdata->ioaddr == 0) {
                 SMSC_WARNING(PROBE, "pdata->ioaddr: 0x00000000");
@@ -1895,8 +1896,11 @@ static int __devinit smsc911x_init(struct net_device *dev)
         /* workaround for platforms without an eeprom, where the mac address
          * is stored elsewhere and set by the bootloader.  This saves the
          * mac address before resetting the device */
-        if (pdata->config.flags & SMSC911X_SAVE_MAC_ADDRESS)
+        if (pdata->config.flags & SMSC911X_SAVE_MAC_ADDRESS) {
+                spin_lock_irq(&pdata->mac_lock);
                 smsc911x_read_mac_address(dev);
+                spin_unlock_irq(&pdata->mac_lock);
+        }
 
         /* Reset the LAN911x */
         if (smsc911x_soft_reset(pdata))
@@ -2059,8 +2063,6 @@ static int __devinit smsc911x_drv_probe(struct platform_device *pdev)
                 SMSC_TRACE(PROBE, "Network interface: \"%s\"", dev->name);
         }
 
-        spin_lock_init(&pdata->mac_lock);
-
         retval = smsc911x_mii_init(pdev, dev);
         if (retval) {
                 SMSC_WARNING(PROBE,
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 727874d9deb6..47a6c870b51f 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1313,6 +1313,21 @@ static const struct usb_device_id products[] = {
                 USB_DEVICE(0x0424, 0x9909),
                 .driver_info = (unsigned long) &smsc95xx_info,
         },
+        {
+                /* SMSC LAN9530 USB Ethernet Device */
+                USB_DEVICE(0x0424, 0x9530),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
+        {
+                /* SMSC LAN9730 USB Ethernet Device */
+                USB_DEVICE(0x0424, 0x9730),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
+        {
+                /* SMSC LAN89530 USB Ethernet Device */
+                USB_DEVICE(0x0424, 0x9E08),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
         { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 338b07502f1a..1ec9bcd6b281 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2546,6 +2546,7 @@ static struct {
         { AR_SREV_VERSION_9287,         "9287" },
         { AR_SREV_VERSION_9271,         "9271" },
         { AR_SREV_VERSION_9300,         "9300" },
+        { AR_SREV_VERSION_9485,         "9485" },
 };
 
 /* For devices with external radios */
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 3d5566e7af0a..ff0f5ba14b2c 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1536,7 +1536,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                 dmaaddr = meta->dmaaddr;
                 goto drop_recycle_buffer;
         }
-        if (unlikely(len > ring->rx_buffersize)) {
+        if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
                 /* The data did not fit into one descriptor buffer
                  * and is split over multiple buffers.
                  * This should never happen, as we try to allocate buffers
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index a01c2100f166..e8a80a1251bf 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
 /* DMA engine tuning knobs */
 #define B43_TXRING_SLOTS                256
 #define B43_RXRING_SLOTS                64
-#define B43_DMA0_RX_BUFFERSIZE          IEEE80211_MAX_FRAME_LEN
+#define B43_DMA0_RX_BUFFERSIZE          (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
 
 /* Pointer poison */
 #define B43_DMA_PTR_POISON              ((void *)ERR_PTR(-ENOMEM))
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 98aa8af01192..20b66469d68f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -241,7 +241,7 @@ struct iwl_eeprom_enhanced_txpwr {
 
 /* 6x00 Specific */
 #define EEPROM_6000_TX_POWER_VERSION    (4)
-#define EEPROM_6000_EEPROM_VERSION      (0x434)
+#define EEPROM_6000_EEPROM_VERSION      (0x423)
 
 /* 6x50 Specific */
 #define EEPROM_6050_TX_POWER_VERSION    (4)
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 9b344a921e74..e18358725b69 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -56,6 +56,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x0846, 0x4210)},   /* Netgear WG121 the second ? */
         {USB_DEVICE(0x0846, 0x4220)},   /* Netgear WG111 */
         {USB_DEVICE(0x09aa, 0x1000)},   /* Spinnaker Proto board */
+        {USB_DEVICE(0x0bf8, 0x1007)},   /* Fujitsu E-5400 USB */
         {USB_DEVICE(0x0cde, 0x0006)},   /* Medion 40900, Roper Europe */
         {USB_DEVICE(0x0db0, 0x6826)},   /* MSI UB54G (MS-6826) */
         {USB_DEVICE(0x107b, 0x55f2)},   /* Gateway WGU-210 (Gemtek) */
@@ -68,6 +69,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x1915, 0x2235)},   /* Linksys WUSB54G Portable OEM */
         {USB_DEVICE(0x2001, 0x3701)},   /* DLink DWL-G120 Spinnaker */
         {USB_DEVICE(0x2001, 0x3703)},   /* DLink DWL-G122 */
+        {USB_DEVICE(0x2001, 0x3762)},   /* Conceptronic C54U */
         {USB_DEVICE(0x5041, 0x2234)},   /* Linksys WUSB54G */
         {USB_DEVICE(0x5041, 0x2235)},   /* Linksys WUSB54G Portable */
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9de9dbe94399..84eb6ad36377 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1062,8 +1062,10 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
          * Stop all work.
          */
         cancel_work_sync(&rt2x00dev->intf_work);
-        cancel_work_sync(&rt2x00dev->rxdone_work);
-        cancel_work_sync(&rt2x00dev->txdone_work);
+        if (rt2x00_is_usb(rt2x00dev)) {
+                cancel_work_sync(&rt2x00dev->rxdone_work);
+                cancel_work_sync(&rt2x00dev->txdone_work);
+        }
         destroy_workqueue(rt2x00dev->workqueue);
 
         /*
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index f74a8701c67d..590f14f45a89 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -685,7 +685,7 @@ static int efuse_pg_packet_read(struct ieee80211_hw *hw, u8 offset, u8 *data)
 
         u8 efuse_data, word_cnts = 0;
         u16 efuse_addr = 0;
-        u8 hworden;
+        u8 hworden = 0;
         u8 tmpdata[8];
 
         if (data == NULL)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index 5ef91374b230..28a6ce3bc239 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -303,7 +303,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
         u16 box_reg, box_extreg;
         u8 u1b_tmp;
         bool isfw_read = false;
-        u8 buf_index;
+        u8 buf_index = 0;
         bool bwrite_sucess = false;
         u8 wait_h2c_limmit = 100;
         u8 wait_writeh2c_limmit = 100;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index a4b2613d6a8c..f5d85735d642 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -246,7 +246,7 @@ static void _rtl_usb_io_handler_init(struct device *dev,
 
 static void _rtl_usb_io_handler_release(struct ieee80211_hw *hw)
 {
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_priv __maybe_unused *rtlpriv = rtl_priv(hw);
 
         mutex_destroy(&rtlpriv->io.bb_mutex);
 }
diff --git a/drivers/net/wireless/wl12xx/sdio.c b/drivers/net/wireless/wl12xx/sdio.c
index 5b9dbeafec06..b1c7d031c391 100644
--- a/drivers/net/wireless/wl12xx/sdio.c
+++ b/drivers/net/wireless/wl12xx/sdio.c
@@ -340,7 +340,7 @@ module_init(wl1271_init);
 module_exit(wl1271_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
 MODULE_FIRMWARE(WL1271_FW_NAME);
 MODULE_FIRMWARE(WL1271_AP_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 18cf01719ae0..ffc745b17f4d 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -487,7 +487,7 @@ module_init(wl1271_init);
 module_exit(wl1271_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
 MODULE_FIRMWARE(WL1271_FW_NAME);
 MODULE_FIRMWARE(WL1271_AP_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index e64403b6896d..6ec06a4a4c6d 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -204,7 +204,10 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
 
         kfree(wl->nvs);
 
-        wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
+        if (len != sizeof(struct wl1271_nvs_file))
+                return -EINVAL;
+
+        wl->nvs = kzalloc(len, GFP_KERNEL);
         if (!wl->nvs) {
                 wl1271_error("could not allocate memory for the nvs file");
                 ret = -ENOMEM;
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 58236e6d0921..ab607bbd6291 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -643,7 +643,7 @@ static void rx_urb_complete(struct urb *urb)
         usb = urb->context;
         rx = &usb->rx;
 
-        zd_usb_reset_rx_idle_timer(usb);
+        tasklet_schedule(&rx->reset_timer_tasklet);
 
         if (length%rx->usb_packet_size > rx->usb_packet_size-4) {
                 /* If there is an old first fragment, we don't care. */
@@ -812,6 +812,7 @@ void zd_usb_disable_rx(struct zd_usb *usb)
         __zd_usb_disable_rx(usb);
         mutex_unlock(&rx->setup_mutex);
 
+        tasklet_kill(&rx->reset_timer_tasklet);
         cancel_delayed_work_sync(&rx->idle_work);
 }
 
@@ -1106,6 +1107,13 @@ static void zd_rx_idle_timer_handler(struct work_struct *work)
         zd_usb_reset_rx(usb);
 }
 
+static void zd_usb_reset_rx_idle_timer_tasklet(unsigned long param)
+{
+        struct zd_usb *usb = (struct zd_usb *)param;
+
+        zd_usb_reset_rx_idle_timer(usb);
+}
+
 void zd_usb_reset_rx_idle_timer(struct zd_usb *usb)
 {
         struct zd_usb_rx *rx = &usb->rx;
@@ -1127,6 +1135,7 @@ static inline void init_usb_interrupt(struct zd_usb *usb)
 static inline void init_usb_rx(struct zd_usb *usb)
 {
         struct zd_usb_rx *rx = &usb->rx;
+
         spin_lock_init(&rx->lock);
         mutex_init(&rx->setup_mutex);
         if (interface_to_usbdev(usb->intf)->speed == USB_SPEED_HIGH) {
@@ -1136,11 +1145,14 @@ static inline void init_usb_rx(struct zd_usb *usb)
         }
         ZD_ASSERT(rx->fragment_length == 0);
         INIT_DELAYED_WORK(&rx->idle_work, zd_rx_idle_timer_handler);
+        rx->reset_timer_tasklet.func = zd_usb_reset_rx_idle_timer_tasklet;
+        rx->reset_timer_tasklet.data = (unsigned long)usb;
 }
 
 static inline void init_usb_tx(struct zd_usb *usb)
 {
         struct zd_usb_tx *tx = &usb->tx;
+
         spin_lock_init(&tx->lock);
         atomic_set(&tx->enabled, 0);
         tx->stopped = 0;
@@ -1671,6 +1683,10 @@ static void iowrite16v_urb_complete(struct urb *urb)
 
         if (urb->status && !usb->cmd_error)
                 usb->cmd_error = urb->status;
+
+        if (!usb->cmd_error &&
+                        urb->actual_length != urb->transfer_buffer_length)
+                usb->cmd_error = -EIO;
 }
 
 static int zd_submit_waiting_urb(struct zd_usb *usb, bool last)
@@ -1805,7 +1821,7 @@ int zd_usb_iowrite16v_async(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,
         usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
                          req, req_len, iowrite16v_urb_complete, usb,
                          ep->desc.bInterval);
-        urb->transfer_flags |= URB_FREE_BUFFER | URB_SHORT_NOT_OK;
+        urb->transfer_flags |= URB_FREE_BUFFER;
 
         /* Submit previous URB */
         r = zd_submit_waiting_urb(usb, false);
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.h b/drivers/net/wireless/zd1211rw/zd_usb.h
index b3df2c8116cc..325d0f989257 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.h
+++ b/drivers/net/wireless/zd1211rw/zd_usb.h
@@ -183,6 +183,7 @@ struct zd_usb_rx {
         spinlock_t lock;
         struct mutex setup_mutex;
         struct delayed_work idle_work;
+        struct tasklet_struct reset_timer_tasklet;
         u8 fragment[2 * USB_MAX_RX_SIZE];
         unsigned int fragment_length;
         unsigned int usb_packet_size;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index d86ea8b01137..135df164a4c1 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -781,7 +781,7 @@ static int pci_pm_resume(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int pci_pm_freeze(struct device *dev)
 {
@@ -970,7 +970,7 @@ static int pci_pm_restore(struct device *dev)
         return error;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define pci_pm_freeze           NULL
 #define pci_pm_freeze_noirq     NULL
@@ -981,7 +981,7 @@ static int pci_pm_restore(struct device *dev)
 #define pci_pm_restore          NULL
 #define pci_pm_restore_noirq    NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM_RUNTIME
 
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 89d0a6a88df7..ebf51ad1b714 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -676,10 +676,10 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                         min_align = align1 >> 1;
                 align += aligns[order];
         }
-        size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), align);
+        size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), min_align);
         size1 = !add_size ? size :
                 calculate_memsize(size, min_size+add_size, 0,
-                                resource_size(b_res), align);
+                                resource_size(b_res), min_align);
         if (!size0 && !size1) {
                 if (b_res->start || b_res->end)
                         dev_info(&bus->self->dev, "disabling bridge window "
diff --git a/drivers/pcmcia/pxa2xx_balloon3.c b/drivers/pcmcia/pxa2xx_balloon3.c
index 453c54c97612..4c3e94c0ae85 100644
--- a/drivers/pcmcia/pxa2xx_balloon3.c
+++ b/drivers/pcmcia/pxa2xx_balloon3.c
@@ -25,6 +25,8 @@
 
 #include <mach/balloon3.h>
 
+#include <asm/mach-types.h>
+
 #include "soc_common.h"
 
 /*
@@ -127,6 +129,9 @@ static int __init balloon3_pcmcia_init(void)
 {
         int ret;
 
+        if (!machine_is_balloon3())
+                return -ENODEV;
+
         balloon3_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
         if (!balloon3_pcmcia_device)
                 return -ENOMEM;
diff --git a/drivers/pcmcia/pxa2xx_trizeps4.c b/drivers/pcmcia/pxa2xx_trizeps4.c
index b7e596620db1..b829e655457b 100644
--- a/drivers/pcmcia/pxa2xx_trizeps4.c
+++ b/drivers/pcmcia/pxa2xx_trizeps4.c
@@ -69,15 +69,15 @@ static int trizeps_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
         for (i = 0; i < ARRAY_SIZE(irqs); i++) {
                 if (irqs[i].sock != skt->nr)
                         continue;
-                if (gpio_request(IRQ_TO_GPIO(irqs[i].irq), irqs[i].str) < 0) {
+                if (gpio_request(irq_to_gpio(irqs[i].irq), irqs[i].str) < 0) {
                         pr_err("%s: sock %d unable to request gpio %d\n",
-                                __func__, skt->nr, IRQ_TO_GPIO(irqs[i].irq));
+                                __func__, skt->nr, irq_to_gpio(irqs[i].irq));
                         ret = -EBUSY;
                         goto error;
                 }
-                if (gpio_direction_input(IRQ_TO_GPIO(irqs[i].irq)) < 0) {
+                if (gpio_direction_input(irq_to_gpio(irqs[i].irq)) < 0) {
                         pr_err("%s: sock %d unable to set input gpio %d\n",
-                                __func__, skt->nr, IRQ_TO_GPIO(irqs[i].irq));
+                                __func__, skt->nr, irq_to_gpio(irqs[i].irq));
                         ret = -EINVAL;
                         goto error;
                 }
@@ -86,7 +86,7 @@ static int trizeps_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 
 error:
         for (; i >= 0; i--) {
-                gpio_free(IRQ_TO_GPIO(irqs[i].irq));
+                gpio_free(irq_to_gpio(irqs[i].irq));
         }
         return (ret);
 }
@@ -97,7 +97,7 @@ static void trizeps_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
         /* free allocated gpio's */
         gpio_free(GPIO_PRDY);
         for (i = 0; i < ARRAY_SIZE(irqs); i++)
-                gpio_free(IRQ_TO_GPIO(irqs[i].irq));
+                gpio_free(irq_to_gpio(irqs[i].irq));
 }
 
 static unsigned long trizeps_pcmcia_status[2];
@@ -226,6 +226,9 @@ static int __init trizeps_pcmcia_init(void)
 {
         int ret;
 
+        if (!machine_is_trizeps4() && !machine_is_trizeps4wl())
+                return -ENODEV;
+
         trizeps_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
         if (!trizeps_pcmcia_device)
                 return -ENOMEM;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 2ee442c2a5db..0485e394712a 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -187,7 +187,8 @@ config MSI_LAPTOP
         depends on ACPI
         depends on BACKLIGHT_CLASS_DEVICE
         depends on RFKILL
-        depends on SERIO_I8042
+        depends on INPUT && SERIO_I8042
+        select INPUT_SPARSEKMAP
         ---help---
           This is a driver for laptops built by MSI (MICRO-STAR
           INTERNATIONAL):
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 5ea6c3477d17..ac4e7f83ce6c 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -89,7 +89,7 @@ MODULE_LICENSE("GPL");
 #define ACERWMID_EVENT_GUID "676AA15E-6A47-4D9F-A2CC-1E6D18D14026"
 
 MODULE_ALIAS("wmi:67C3371D-95A3-4C37-BB61-DD47B491DAAB");
-MODULE_ALIAS("wmi:6AF4F258-B401-42Fd-BE91-3D4AC2D7C0D3");
+MODULE_ALIAS("wmi:6AF4F258-B401-42FD-BE91-3D4AC2D7C0D3");
 MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
 
 enum acer_wmi_event_ids {
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index efc776cb0c66..832a3fd7c1c8 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -201,8 +201,8 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
         if (!asus->inputdev)
                 return -ENOMEM;
 
-        asus->inputdev->name = asus->driver->input_phys;
-        asus->inputdev->phys = asus->driver->input_name;
+        asus->inputdev->name = asus->driver->input_name;
+        asus->inputdev->phys = asus->driver->input_phys;
         asus->inputdev->id.bustype = BUS_HOST;
         asus->inputdev->dev.parent = &asus->platform_device->dev;
 
diff --git a/drivers/platform/x86/eeepc-wmi.c b/drivers/platform/x86/eeepc-wmi.c
index 0ddc434fb93b..649dcadd8ea3 100644
--- a/drivers/platform/x86/eeepc-wmi.c
+++ b/drivers/platform/x86/eeepc-wmi.c
@@ -67,9 +67,11 @@ static const struct key_entry eeepc_wmi_keymap[] = {
         { KE_KEY, 0x82, { KEY_CAMERA } },
         { KE_KEY, 0x83, { KEY_CAMERA_ZOOMIN } },
         { KE_KEY, 0x88, { KEY_WLAN } },
+        { KE_KEY, 0xbd, { KEY_CAMERA } },
         { KE_KEY, 0xcc, { KEY_SWITCHVIDEOMODE } },
         { KE_KEY, 0xe0, { KEY_PROG1 } }, /* Task Manager */
         { KE_KEY, 0xe1, { KEY_F14 } }, /* Change Resolution */
+        { KE_KEY, 0xe8, { KEY_SCREENLOCK } },
         { KE_KEY, 0xe9, { KEY_BRIGHTNESS_ZERO } },
         { KE_KEY, 0xeb, { KEY_CAMERA_ZOOMOUT } },
         { KE_KEY, 0xec, { KEY_CAMERA_UP } },
diff --git a/drivers/platform/x86/intel_pmic_gpio.c b/drivers/platform/x86/intel_pmic_gpio.c
index d653104b59cb..464bb3fc4d88 100644
--- a/drivers/platform/x86/intel_pmic_gpio.c
+++ b/drivers/platform/x86/intel_pmic_gpio.c
@@ -74,6 +74,19 @@ struct pmic_gpio {
         u32                     trigger_type;
 };
 
+static void pmic_program_irqtype(int gpio, int type)
+{
+        if (type & IRQ_TYPE_EDGE_RISING)
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x20, 0x20);
+        else
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x00, 0x20);
+
+        if (type & IRQ_TYPE_EDGE_FALLING)
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x10, 0x10);
+        else
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x00, 0x10);
+};
+
 static int pmic_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 {
         if (offset > 8) {
@@ -166,16 +179,38 @@ static int pmic_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
         return pg->irq_base + offset;
 }
 
+static void pmic_bus_lock(struct irq_data *data)
+{
+        struct pmic_gpio *pg = irq_data_get_irq_chip_data(data);
+
+        mutex_lock(&pg->buslock);
+}
+
+static void pmic_bus_sync_unlock(struct irq_data *data)
+{
+        struct pmic_gpio *pg = irq_data_get_irq_chip_data(data);
+
+        if (pg->update_type) {
+                unsigned int gpio = pg->update_type & ~GPIO_UPDATE_TYPE;
+
+                pmic_program_irqtype(gpio, pg->trigger_type);
+                pg->update_type = 0;
+        }
+        mutex_unlock(&pg->buslock);
+}
+
 /* the gpiointr register is read-clear, so just do nothing. */
 static void pmic_irq_unmask(struct irq_data *data) { }
 
 static void pmic_irq_mask(struct irq_data *data) { }
 
 static struct irq_chip pmic_irqchip = {
-        .name           = "PMIC-GPIO",
-        .irq_mask       = pmic_irq_mask,
-        .irq_unmask     = pmic_irq_unmask,
-        .irq_set_type   = pmic_irq_type,
+        .name                   = "PMIC-GPIO",
+        .irq_mask               = pmic_irq_mask,
+        .irq_unmask             = pmic_irq_unmask,
+        .irq_set_type           = pmic_irq_type,
+        .irq_bus_lock           = pmic_bus_lock,
+        .irq_bus_sync_unlock    = pmic_bus_sync_unlock,
 };
 
 static irqreturn_t pmic_irq_handler(int irq, void *data)
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index de434c6dc2d6..d347116d150e 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -571,6 +571,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
                 .callback = dmi_check_cb,
         },
         {
+                .ident = "R410 Plus",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR,
+                                        "SAMSUNG ELECTRONICS CO., LTD."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "R410P"),
+                        DMI_MATCH(DMI_BOARD_NAME, "R460"),
+                },
+                .callback = dmi_check_cb,
+        },
+        {
                 .ident = "R518",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR,
@@ -591,12 +601,12 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
                 .callback = dmi_check_cb,
         },
         {
-                .ident = "N150/N210/N220",
+                .ident = "N150/N210/N220/N230",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR,
                                         "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220/N230"),
+                        DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220/N230"),
                 },
                 .callback = dmi_check_cb,
         },
@@ -771,6 +781,7 @@ static int __init samsung_init(void)
 
         /* create a backlight device to talk to this one */
         memset(&props, 0, sizeof(struct backlight_properties));
+        props.type = BACKLIGHT_PLATFORM;
         props.max_brightness = sabi_config->max_brightness;
         backlight_device = backlight_device_register("samsung", &sdev->dev,
                                                      NULL, &backlight_ops,
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index e642f5f29504..8f709aec4da0 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -138,6 +138,8 @@ MODULE_PARM_DESC(kbd_backlight_timeout,
                  "1 for 30 seconds, 2 for 60 seconds and 3 to disable timeout "
                  "(default: 0)");
 
+static void sony_nc_kbd_backlight_resume(void);
+
 enum sony_nc_rfkill {
         SONY_WIFI,
         SONY_BLUETOOTH,
@@ -771,11 +773,6 @@ static int sony_nc_handles_setup(struct platform_device *pd)
         if (!handles)
                 return -ENOMEM;
 
-        sysfs_attr_init(&handles->devattr.attr);
-        handles->devattr.attr.name = "handles";
-        handles->devattr.attr.mode = S_IRUGO;
-        handles->devattr.show = sony_nc_handles_show;
-
         for (i = 0; i < ARRAY_SIZE(handles->cap); i++) {
                 if (!acpi_callsetfunc(sony_nc_acpi_handle,
                                         "SN00", i + 0x20, &result)) {
@@ -785,11 +782,18 @@ static int sony_nc_handles_setup(struct platform_device *pd)
                 }
         }
 
-        /* allow reading capabilities via sysfs */
-        if (device_create_file(&pd->dev, &handles->devattr)) {
-                kfree(handles);
-                handles = NULL;
-                return -1;
+        if (debug) {
+                sysfs_attr_init(&handles->devattr.attr);
+                handles->devattr.attr.name = "handles";
+                handles->devattr.attr.mode = S_IRUGO;
+                handles->devattr.show = sony_nc_handles_show;
+
+                /* allow reading capabilities via sysfs */
+                if (device_create_file(&pd->dev, &handles->devattr)) {
+                        kfree(handles);
+                        handles = NULL;
+                        return -1;
+                }
         }
 
         return 0;
@@ -798,7 +802,8 @@ static int sony_nc_handles_setup(struct platform_device *pd)
 static int sony_nc_handles_cleanup(struct platform_device *pd)
 {
         if (handles) {
-                device_remove_file(&pd->dev, &handles->devattr);
+                if (debug)
+                        device_remove_file(&pd->dev, &handles->devattr);
                 kfree(handles);
                 handles = NULL;
         }
@@ -808,6 +813,11 @@ static int sony_nc_handles_cleanup(struct platform_device *pd)
 static int sony_find_snc_handle(int handle)
 {
         int i;
+
+        /* not initialized yet, return early */
+        if (!handles)
+                return -1;
+
         for (i = 0; i < 0x10; i++) {
                 if (handles->cap[i] == handle) {
                         dprintk("found handle 0x%.4x (offset: 0x%.2x)\n",
@@ -1168,6 +1178,9 @@ static int sony_nc_resume(struct acpi_device *device)
         /* re-read rfkill state */
         sony_nc_rfkill_update();
 
+        /* restore kbd backlight states */
+        sony_nc_kbd_backlight_resume();
+
         return 0;
 }
 
@@ -1355,6 +1368,7 @@ out_no_enum:
 #define KBDBL_HANDLER   0x137
 #define KBDBL_PRESENT   0xB00
 #define SET_MODE        0xC00
+#define SET_STATE       0xD00
 #define SET_TIMEOUT     0xE00
 
 struct kbd_backlight {
@@ -1377,6 +1391,10 @@ static ssize_t __sony_nc_kbd_backlight_mode_set(u8 value)
                                 (value << 0x10) | SET_MODE, &result))
                 return -EIO;
 
+        /* Try to turn the light on/off immediately */
+        sony_call_snc_handle(KBDBL_HANDLER, (value << 0x10) | SET_STATE,
+                        &result);
+
         kbdbl_handle->mode = value;
 
         return 0;
@@ -1458,7 +1476,7 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd)
 {
         int result;
 
-        if (sony_call_snc_handle(0x137, KBDBL_PRESENT, &result))
+        if (sony_call_snc_handle(KBDBL_HANDLER, KBDBL_PRESENT, &result))
                 return 0;
         if (!(result & 0x02))
                 return 0;
@@ -1501,13 +1519,36 @@ outkzalloc:
 static int sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
 {
         if (kbdbl_handle) {
+                int result;
+
                 device_remove_file(&pd->dev, &kbdbl_handle->mode_attr);
                 device_remove_file(&pd->dev, &kbdbl_handle->timeout_attr);
+
+                /* restore the default hw behaviour */
+                sony_call_snc_handle(KBDBL_HANDLER, 0x1000 | SET_MODE, &result);
+                sony_call_snc_handle(KBDBL_HANDLER, SET_TIMEOUT, &result);
+
                 kfree(kbdbl_handle);
         }
         return 0;
 }
 
+static void sony_nc_kbd_backlight_resume(void)
+{
+        int ignore = 0;
+
+        if (!kbdbl_handle)
+                return;
+
+        if (kbdbl_handle->mode == 0)
+                sony_call_snc_handle(KBDBL_HANDLER, SET_MODE, &ignore);
+
+        if (kbdbl_handle->timeout != 0)
+                sony_call_snc_handle(KBDBL_HANDLER,
+                                (kbdbl_handle->timeout << 0x10) | SET_TIMEOUT,
+                                &ignore);
+}
+
 static void sony_nc_backlight_setup(void)
 {
         acpi_handle unused;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index a08561f5349e..efb3b6b9bcdb 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -8618,8 +8618,7 @@ static bool __pure __init tpacpi_is_valid_fw_id(const char* const s,
                 tpacpi_is_fw_digit(s[1]) &&
                 s[2] == t && s[3] == 'T' &&
                 tpacpi_is_fw_digit(s[4]) &&
-                tpacpi_is_fw_digit(s[5]) &&
-                s[6] == 'W' && s[7] == 'W';
+                tpacpi_is_fw_digit(s[5]);
 }
 
 /* returns 0 - probe ok, or < 0 - probe error.
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index c29719cacbca..86c9a091a2ff 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1171,16 +1171,17 @@ static int rio_hdid_setup(char *str)
 
 __setup("riohdid=", rio_hdid_setup);
 
-void rio_register_mport(struct rio_mport *port)
+int rio_register_mport(struct rio_mport *port)
 {
         if (next_portid >= RIO_MAX_MPORTS) {
                 pr_err("RIO: reached specified max number of mports\n");
-                return;
+                return 1;
         }
 
         port->id = next_portid++;
         port->host_deviceid = rio_get_hdid(port->id);
         list_add_tail(&port->node, &rio_mports);
+        return 0;
 }
 
 EXPORT_SYMBOL_GPL(rio_local_get_device_id);
diff --git a/drivers/rapidio/switches/idt_gen2.c b/drivers/rapidio/switches/idt_gen2.c
index 095016a9dec1..ac2701b22e71 100644
--- a/drivers/rapidio/switches/idt_gen2.c
+++ b/drivers/rapidio/switches/idt_gen2.c
@@ -418,3 +418,4 @@ DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1848, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1616, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTVPS1616, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTSPS1616, idtg2_switch_init);
+DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1432, idtg2_switch_init);
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 09b4437b3e61..39013867cbd6 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -171,7 +171,7 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev,
         err = __rtc_read_alarm(rtc, &alrm);
 
         if (!err && !rtc_valid_tm(&alrm.time))
-                rtc_set_alarm(rtc, &alrm);
+                rtc_initialize_alarm(rtc, &alrm);
 
         strlcpy(rtc->name, name, RTC_DEVICE_NAME_SIZE);
         dev_set_name(&rtc->dev, "rtc%d", id);
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 23719f0acbf6..ef6316acec43 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -375,6 +375,32 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 }
 EXPORT_SYMBOL_GPL(rtc_set_alarm);
 
+/* Called once per device from rtc_device_register */
+int rtc_initialize_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+{
+        int err;
+
+        err = rtc_valid_tm(&alarm->time);
+        if (err != 0)
+                return err;
+
+        err = mutex_lock_interruptible(&rtc->ops_lock);
+        if (err)
+                return err;
+
+        rtc->aie_timer.node.expires = rtc_tm_to_ktime(alarm->time);
+        rtc->aie_timer.period = ktime_set(0, 0);
+        if (alarm->enabled) {
+                rtc->aie_timer.enabled = 1;
+                timerqueue_add(&rtc->timerqueue, &rtc->aie_timer.node);
+        }
+        mutex_unlock(&rtc->ops_lock);
+        return err;
+}
+EXPORT_SYMBOL_GPL(rtc_initialize_alarm);
+
+
+
 int rtc_alarm_irq_enable(struct rtc_device *rtc, unsigned int enabled)
 {
         int err = mutex_lock_interruptible(&rtc->ops_lock);
diff --git a/drivers/rtc/rtc-bfin.c b/drivers/rtc/rtc-bfin.c
index a0fc4cf42abf..90d866272c8e 100644
--- a/drivers/rtc/rtc-bfin.c
+++ b/drivers/rtc/rtc-bfin.c
@@ -250,6 +250,8 @@ static int bfin_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
                 bfin_rtc_int_set_alarm(rtc);
         else
                 bfin_rtc_int_clear(~(RTC_ISTAT_ALARM | RTC_ISTAT_ALARM_DAY));
+
+        return 0;
 }
 
 static int bfin_rtc_read_time(struct device *dev, struct rtc_time *tm)
diff --git a/drivers/rtc/rtc-mc13xxx.c b/drivers/rtc/rtc-mc13xxx.c
index c42006469559..c5ac03793e79 100644
--- a/drivers/rtc/rtc-mc13xxx.c
+++ b/drivers/rtc/rtc-mc13xxx.c
@@ -401,6 +401,7 @@ const struct platform_device_id mc13xxx_rtc_idtable[] = {
         }, {
                 .name = "mc13892-rtc",
         },
+        { }
 };
 
 static struct platform_driver mc13xxx_rtc_driver = {
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 714964913e5e..b3466c491cd3 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -336,7 +336,6 @@ static void s3c_rtc_release(struct device *dev)
 
         /* do not clear AIE here, it may be needed for wake */
 
-        s3c_rtc_setpie(dev, 0);
         free_irq(s3c_rtc_alarmno, rtc_dev);
         free_irq(s3c_rtc_tickno, rtc_dev);
 }
@@ -408,7 +407,6 @@ static int __devexit s3c_rtc_remove(struct platform_device *dev)
         platform_set_drvdata(dev, NULL);
         rtc_device_unregister(rtc);
 
-        s3c_rtc_setpie(&dev->dev, 0);
         s3c_rtc_setaie(&dev->dev, 0);
 
         clk_disable(rtc_clk);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index df14c51f6532..8e04c00cf0ad 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -541,15 +541,24 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
         int force, ret;
         unsigned long i;
 
-        if (!dev_fsm_final_state(cdev) &&
-            cdev->private->state != DEV_STATE_DISCONNECTED)
-                return -EAGAIN;
+        /* Prevent conflict between multiple on-/offline processing requests. */
         if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
                 return -EAGAIN;
+        /* Prevent conflict between internal I/Os and on-/offline processing. */
+        if (!dev_fsm_final_state(cdev) &&
+            cdev->private->state != DEV_STATE_DISCONNECTED) {
+                ret = -EAGAIN;
+                goto out_onoff;
+        }
+        /* Prevent conflict between pending work and on-/offline processing.*/
+        if (work_pending(&cdev->private->todo_work)) {
+                ret = -EAGAIN;
+                goto out_onoff;
+        }
 
         if (cdev->drv && !try_module_get(cdev->drv->driver.owner)) {
-                atomic_set(&cdev->private->onoff, 0);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_onoff;
         }
         if (!strncmp(buf, "force\n", count)) {
                 force = 1;
@@ -574,6 +583,7 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
 out:
         if (cdev->drv)
                 module_put(cdev->drv->driver.owner);
+out_onoff:
         atomic_set(&cdev->private->onoff, 0);
         return (ret < 0) ? ret : count;
 }
@@ -1311,10 +1321,12 @@ static int purge_fn(struct device *dev, void *data)
 
         spin_lock_irq(cdev->ccwlock);
         if (is_blacklisted(id->ssid, id->devno) &&
-            (cdev->private->state == DEV_STATE_OFFLINE)) {
+            (cdev->private->state == DEV_STATE_OFFLINE) &&
+            (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) {
                 CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
                               id->devno);
                 ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
+                atomic_set(&cdev->private->onoff, 0);
         }
         spin_unlock_irq(cdev->ccwlock);
         /* Abort loop in case of pending signal. */
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 479c665e9e7c..c532ba929ccd 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1649,26 +1649,26 @@ static int __init init_QDIO(void)
 {
         int rc;
 
-        rc = qdio_setup_init();
+        rc = qdio_debug_init();
         if (rc)
                 return rc;
+        rc = qdio_setup_init();
+        if (rc)
+                goto out_debug;
         rc = tiqdio_allocate_memory();
         if (rc)
                 goto out_cache;
-        rc = qdio_debug_init();
-        if (rc)
-                goto out_ti;
         rc = tiqdio_register_thinints();
         if (rc)
-                goto out_debug;
+                goto out_ti;
         return 0;
 
-out_debug:
-        qdio_debug_exit();
 out_ti:
         tiqdio_free_memory();
 out_cache:
         qdio_setup_exit();
+out_debug:
+        qdio_debug_exit();
         return rc;
 }
 
@@ -1676,8 +1676,8 @@ static void __exit exit_QDIO(void)
 {
         tiqdio_unregister_thinints();
         tiqdio_free_memory();
-        qdio_debug_exit();
         qdio_setup_exit();
+        qdio_debug_exit();
 }
 
 module_init(init_QDIO);
diff --git a/drivers/spi/amba-pl022.c b/drivers/spi/amba-pl022.c
index 5825370bad25..08de58e7f59f 100644
--- a/drivers/spi/amba-pl022.c
+++ b/drivers/spi/amba-pl022.c
@@ -1555,7 +1555,7 @@ static int stop_queue(struct pl022 *pl022)
          * A wait_queue on the pl022->busy could be used, but then the common
          * execution path (pump_messages) would be required to call wake_up or
          * friends on every SPI message. Do this instead */
-        while (!list_empty(&pl022->queue) && pl022->busy && limit--) {
+        while ((!list_empty(&pl022->queue) || pl022->busy) && limit--) {
                 spin_unlock_irqrestore(&pl022->queue_lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&pl022->queue_lock, flags);
diff --git a/drivers/spi/dw_spi.c b/drivers/spi/dw_spi.c
index b1a4b9f503ae..871e337c917f 100644
--- a/drivers/spi/dw_spi.c
+++ b/drivers/spi/dw_spi.c
@@ -821,7 +821,7 @@ static int stop_queue(struct dw_spi *dws)
 
         spin_lock_irqsave(&dws->lock, flags);
         dws->run = QUEUE_STOPPED;
-        while (!list_empty(&dws->queue) && dws->busy && limit--) {
+        while ((!list_empty(&dws->queue) || dws->busy) && limit--) {
                 spin_unlock_irqrestore(&dws->lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&dws->lock, flags);
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 9c74aad6be93..dc25bee8d33f 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1493,7 +1493,7 @@ static int stop_queue(struct driver_data *drv_data)
          * execution path (pump_messages) would be required to call wake_up or
          * friends on every SPI message. Do this instead */
         drv_data->run = QUEUE_STOPPED;
-        while (!list_empty(&drv_data->queue) && drv_data->busy && limit--) {
+        while ((!list_empty(&drv_data->queue) || drv_data->busy) && limit--) {
                 spin_unlock_irqrestore(&drv_data->lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&drv_data->lock, flags);
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index bdb7289a1d22..f706dba165cf 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -1284,7 +1284,7 @@ static inline int bfin_spi_stop_queue(struct bfin_spi_master_data *drv_data)
          * friends on every SPI message. Do this instead
          */
         drv_data->running = false;
-        while (!list_empty(&drv_data->queue) && drv_data->busy && limit--) {
+        while ((!list_empty(&drv_data->queue) || drv_data->busy) && limit--) {
                 spin_unlock_irqrestore(&drv_data->lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&drv_data->lock, flags);
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index dca4a0bb6ca9..e3786f161bc3 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -131,8 +131,6 @@ source "drivers/staging/wlags49_h2/Kconfig"
 
 source "drivers/staging/wlags49_h25/Kconfig"
 
-source "drivers/staging/samsung-laptop/Kconfig"
-
 source "drivers/staging/sm7xx/Kconfig"
 
 source "drivers/staging/dt3155v4l/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index eb93012b6f59..f0d5c5315612 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -48,7 +48,6 @@ obj-$(CONFIG_XVMALLOC)		+= zram/
 obj-$(CONFIG_ZCACHE)            += zcache/
 obj-$(CONFIG_WLAGS49_H2)        += wlags49_h2/
 obj-$(CONFIG_WLAGS49_H25)       += wlags49_h25/
-obj-$(CONFIG_SAMSUNG_LAPTOP)    += samsung-laptop/
 obj-$(CONFIG_FB_SM7XX)          += sm7xx/
 obj-$(CONFIG_VIDEO_DT3155)      += dt3155v4l/
 obj-$(CONFIG_CRYSTALHD)         += crystalhd/
diff --git a/drivers/staging/samsung-laptop/Kconfig b/drivers/staging/samsung-laptop/Kconfig
deleted file mode 100644
index f27c60864c26..000000000000
--- a/drivers/staging/samsung-laptop/Kconfig
+++ /dev/null
@@ -1,10 +0,0 @@
-config SAMSUNG_LAPTOP
-        tristate "Samsung Laptop driver"
-        default n
-        depends on RFKILL && BACKLIGHT_CLASS_DEVICE && X86
-        help
-          This module implements a driver for the N128 Samsung Laptop
-          providing control over the Wireless LED and the LCD backlight
-
-          To compile this driver as a module, choose
-          M here: the module will be called samsung-laptop.
diff --git a/drivers/staging/samsung-laptop/Makefile b/drivers/staging/samsung-laptop/Makefile
deleted file mode 100644
index 3c6f42045211..000000000000
--- a/drivers/staging/samsung-laptop/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_SAMSUNG_LAPTOP)    += samsung-laptop.o
diff --git a/drivers/staging/samsung-laptop/TODO b/drivers/staging/samsung-laptop/TODO
deleted file mode 100644
index f7a6d589916e..000000000000
--- a/drivers/staging/samsung-laptop/TODO
+++ /dev/null
@@ -1,5 +0,0 @@
-TODO:
-        - review from other developers
-        - figure out ACPI video issues
-
-Please send patches to Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/drivers/staging/samsung-laptop/samsung-laptop.c b/drivers/staging/samsung-laptop/samsung-laptop.c
deleted file mode 100644
index 25294462b8b6..000000000000
--- a/drivers/staging/samsung-laptop/samsung-laptop.c
+++ /dev/null
@@ -1,843 +0,0 @@
-/*
- * Samsung Laptop driver
- *
- * Copyright (C) 2009,2011 Greg Kroah-Hartman (gregkh@suse.de)
- * Copyright (C) 2009,2011 Novell Inc.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/delay.h>
-#include <linux/pci.h>
-#include <linux/backlight.h>
-#include <linux/fb.h>
-#include <linux/dmi.h>
-#include <linux/platform_device.h>
-#include <linux/rfkill.h>
-
-/*
- * This driver is needed because a number of Samsung laptops do not hook
- * their control settings through ACPI.  So we have to poke around in the
- * BIOS to do things like brightness values, and "special" key controls.
- */
-
-/*
- * We have 0 - 8 as valid brightness levels.  The specs say that level 0 should
- * be reserved by the BIOS (which really doesn't make much sense), we tell
- * userspace that the value is 0 - 7 and then just tell the hardware 1 - 8
- */
-#define MAX_BRIGHT      0x07
-
-
-#define SABI_IFACE_MAIN                 0x00
-#define SABI_IFACE_SUB                  0x02
-#define SABI_IFACE_COMPLETE             0x04
-#define SABI_IFACE_DATA                 0x05
-
-/* Structure to get data back to the calling function */
-struct sabi_retval {
-        u8 retval[20];
-};
-
-struct sabi_header_offsets {
-        u8 port;
-        u8 re_mem;
-        u8 iface_func;
-        u8 en_mem;
-        u8 data_offset;
-        u8 data_segment;
-};
-
-struct sabi_commands {
-        /*
-         * Brightness is 0 - 8, as described above.
-         * Value 0 is for the BIOS to use
-         */
-        u8 get_brightness;
-        u8 set_brightness;
-
-        /*
-         * first byte:
-         * 0x00 - wireless is off
-         * 0x01 - wireless is on
-         * second byte:
-         * 0x02 - 3G is off
-         * 0x03 - 3G is on
-         * TODO, verify 3G is correct, that doesn't seem right...
-         */
-        u8 get_wireless_button;
-        u8 set_wireless_button;
-
-        /* 0 is off, 1 is on */
-        u8 get_backlight;
-        u8 set_backlight;
-
-        /*
-         * 0x80 or 0x00 - no action
-         * 0x81 - recovery key pressed
-         */
-        u8 get_recovery_mode;
-        u8 set_recovery_mode;
-
-        /*
-         * on seclinux: 0 is low, 1 is high,
-         * on swsmi: 0 is normal, 1 is silent, 2 is turbo
-         */
-        u8 get_performance_level;
-        u8 set_performance_level;
-
-        /*
-         * Tell the BIOS that Linux is running on this machine.
-         * 81 is on, 80 is off
-         */
-        u8 set_linux;
-};
-
-struct sabi_performance_level {
-        const char *name;
-        u8 value;
-};
-
-struct sabi_config {
-        const char *test_string;
-        u16 main_function;
-        const struct sabi_header_offsets header_offsets;
-        const struct sabi_commands commands;
-        const struct sabi_performance_level performance_levels[4];
-        u8 min_brightness;
-        u8 max_brightness;
-};
-
-static const struct sabi_config sabi_configs[] = {
-        {
-                .test_string = "SECLINUX",
-
-                .main_function = 0x4c49,
-
-                .header_offsets = {
-                        .port = 0x00,
-                        .re_mem = 0x02,
-                        .iface_func = 0x03,
-                        .en_mem = 0x04,
-                        .data_offset = 0x05,
-                        .data_segment = 0x07,
-                },
-
-                .commands = {
-                        .get_brightness = 0x00,
-                        .set_brightness = 0x01,
-
-                        .get_wireless_button = 0x02,
-                        .set_wireless_button = 0x03,
-
-                        .get_backlight = 0x04,
-                        .set_backlight = 0x05,
-
-                        .get_recovery_mode = 0x06,
-                        .set_recovery_mode = 0x07,
-
-                        .get_performance_level = 0x08,
-                        .set_performance_level = 0x09,
-
-                        .set_linux = 0x0a,
-                },
-
-                .performance_levels = {
-                        {
-                                .name = "silent",
-                                .value = 0,
-                        },
-                        {
-                                .name = "normal",
-                                .value = 1,
-                        },
-                        { },
-                },
-                .min_brightness = 1,
-                .max_brightness = 8,
-        },
-        {
-                .test_string = "SwSmi@",
-
-                .main_function = 0x5843,
-
-                .header_offsets = {
-                        .port = 0x00,
-                        .re_mem = 0x04,
-                        .iface_func = 0x02,
-                        .en_mem = 0x03,
-                        .data_offset = 0x05,
-                        .data_segment = 0x07,
-                },
-
-                .commands = {
-                        .get_brightness = 0x10,
-                        .set_brightness = 0x11,
-
-                        .get_wireless_button = 0x12,
-                        .set_wireless_button = 0x13,
-
-                        .get_backlight = 0x2d,
-                        .set_backlight = 0x2e,
-
-                        .get_recovery_mode = 0xff,
-                        .set_recovery_mode = 0xff,
-
-                        .get_performance_level = 0x31,
-                        .set_performance_level = 0x32,
-
-                        .set_linux = 0xff,
-                },
-
-                .performance_levels = {
-                        {
-                                .name = "normal",
-                                .value = 0,
-                        },
-                        {
-                                .name = "silent",
-                                .value = 1,
-                        },
-                        {
-                                .name = "overclock",
-                                .value = 2,
-                        },
-                        { },
-                },
-                .min_brightness = 0,
-                .max_brightness = 8,
-        },
-        { },
-};
-
-static const struct sabi_config *sabi_config;
-
-static void __iomem *sabi;
-static void __iomem *sabi_iface;
-static void __iomem *f0000_segment;
-static struct backlight_device *backlight_device;
-static struct mutex sabi_mutex;
-static struct platform_device *sdev;
-static struct rfkill *rfk;
-
-static int force;
-module_param(force, bool, 0);
-MODULE_PARM_DESC(force,
-                "Disable the DMI check and forces the driver to be loaded");
-
-static int debug;
-module_param(debug, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(debug, "Debug enabled or not");
-
-static int sabi_get_command(u8 command, struct sabi_retval *sretval)
-{
-        int retval = 0;
-        u16 port = readw(sabi + sabi_config->header_offsets.port);
-        u8 complete, iface_data;
-
-        mutex_lock(&sabi_mutex);
-
-        /* enable memory to be able to write to it */
-        outb(readb(sabi + sabi_config->header_offsets.en_mem), port);
-
-        /* write out the command */
-        writew(sabi_config->main_function, sabi_iface + SABI_IFACE_MAIN);
-        writew(command, sabi_iface + SABI_IFACE_SUB);
-        writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
-        outb(readb(sabi + sabi_config->header_offsets.iface_func), port);
-
-        /* write protect memory to make it safe */
-        outb(readb(sabi + sabi_config->header_offsets.re_mem), port);
-
-        /* see if the command actually succeeded */
-        complete = readb(sabi_iface + SABI_IFACE_COMPLETE);
-        iface_data = readb(sabi_iface + SABI_IFACE_DATA);
-        if (complete != 0xaa || iface_data == 0xff) {
-                pr_warn("SABI get command 0x%02x failed with completion flag 0x%02x and data 0x%02x\n",
-                        command, complete, iface_data);
-                retval = -EINVAL;
-                goto exit;
-        }
-        /*
-         * Save off the data into a structure so the caller use it.
-         * Right now we only want the first 4 bytes,
-         * There are commands that need more, but not for the ones we
-         * currently care about.
-         */
-        sretval->retval[0] = readb(sabi_iface + SABI_IFACE_DATA);
-        sretval->retval[1] = readb(sabi_iface + SABI_IFACE_DATA + 1);
-        sretval->retval[2] = readb(sabi_iface + SABI_IFACE_DATA + 2);
-        sretval->retval[3] = readb(sabi_iface + SABI_IFACE_DATA + 3);
-
-exit:
-        mutex_unlock(&sabi_mutex);
-        return retval;
-
-}
-
-static int sabi_set_command(u8 command, u8 data)
-{
-        int retval = 0;
-        u16 port = readw(sabi + sabi_config->header_offsets.port);
-        u8 complete, iface_data;
-
-        mutex_lock(&sabi_mutex);
-
-        /* enable memory to be able to write to it */
-        outb(readb(sabi + sabi_config->header_offsets.en_mem), port);
-
-        /* write out the command */
-        writew(sabi_config->main_function, sabi_iface + SABI_IFACE_MAIN);
-        writew(command, sabi_iface + SABI_IFACE_SUB);
-        writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
-        writeb(data, sabi_iface + SABI_IFACE_DATA);
-        outb(readb(sabi + sabi_config->header_offsets.iface_func), port);
-
-        /* write protect memory to make it safe */
-        outb(readb(sabi + sabi_config->header_offsets.re_mem), port);
-
-        /* see if the command actually succeeded */
-        complete = readb(sabi_iface + SABI_IFACE_COMPLETE);
-        iface_data = readb(sabi_iface + SABI_IFACE_DATA);
-        if (complete != 0xaa || iface_data == 0xff) {
-                pr_warn("SABI set command 0x%02x failed with completion flag 0x%02x and data 0x%02x\n",
-                       command, complete, iface_data);
-                retval = -EINVAL;
-        }
-
-        mutex_unlock(&sabi_mutex);
-        return retval;
-}
-
-static void test_backlight(void)
-{
-        struct sabi_retval sretval;
-
-        sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-        printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-
-        sabi_set_command(sabi_config->commands.set_backlight, 0);
-        printk(KERN_DEBUG "backlight should be off\n");
-
-        sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-        printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-
-        msleep(1000);
-
-        sabi_set_command(sabi_config->commands.set_backlight, 1);
-        printk(KERN_DEBUG "backlight should be on\n");
-
-        sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-        printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-}
-
-static void test_wireless(void)
-{
-        struct sabi_retval sretval;
-
-        sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-        printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-
-        sabi_set_command(sabi_config->commands.set_wireless_button, 0);
-        printk(KERN_DEBUG "wireless led should be off\n");
-
-        sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-        printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-
-        msleep(1000);
-
-        sabi_set_command(sabi_config->commands.set_wireless_button, 1);
-        printk(KERN_DEBUG "wireless led should be on\n");
-
-        sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-        printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-}
-
-static u8 read_brightness(void)
-{
-        struct sabi_retval sretval;
-        int user_brightness = 0;
-        int retval;
-
-        retval = sabi_get_command(sabi_config->commands.get_brightness,
-                                  &sretval);
-        if (!retval) {
-                user_brightness = sretval.retval[0];
-                if (user_brightness != 0)
-                        user_brightness -= sabi_config->min_brightness;
-        }
-        return user_brightness;
-}
-
-static void set_brightness(u8 user_brightness)
-{
-        u8 user_level = user_brightness - sabi_config->min_brightness;
-
-        sabi_set_command(sabi_config->commands.set_brightness, user_level);
-}
-
-static int get_brightness(struct backlight_device *bd)
-{
-        return (int)read_brightness();
-}
-
-static int update_status(struct backlight_device *bd)
-{
-        set_brightness(bd->props.brightness);
-
-        if (bd->props.power == FB_BLANK_UNBLANK)
-                sabi_set_command(sabi_config->commands.set_backlight, 1);
-        else
-                sabi_set_command(sabi_config->commands.set_backlight, 0);
-        return 0;
-}
-
-static const struct backlight_ops backlight_ops = {
-        .get_brightness = get_brightness,
-        .update_status  = update_status,
-};
-
-static int rfkill_set(void *data, bool blocked)
-{
-        /* Do something with blocked...*/
-        /*
-         * blocked == false is on
-         * blocked == true is off
-         */
-        if (blocked)
-                sabi_set_command(sabi_config->commands.set_wireless_button, 0);
-        else
-                sabi_set_command(sabi_config->commands.set_wireless_button, 1);
-
-        return 0;
-}
-
-static struct rfkill_ops rfkill_ops = {
-        .set_block = rfkill_set,
-};
-
-static int init_wireless(struct platform_device *sdev)
-{
-        int retval;
-
-        rfk = rfkill_alloc("samsung-wifi", &sdev->dev, RFKILL_TYPE_WLAN,
-                           &rfkill_ops, NULL);
-        if (!rfk)
-                return -ENOMEM;
-
-        retval = rfkill_register(rfk);
-        if (retval) {
-                rfkill_destroy(rfk);
-                return -ENODEV;
-        }
-
-        return 0;
-}
-
-static void destroy_wireless(void)
-{
-        rfkill_unregister(rfk);
-        rfkill_destroy(rfk);
-}
-
-static ssize_t get_performance_level(struct device *dev,
-                                     struct device_attribute *attr, char *buf)
-{
-        struct sabi_retval sretval;
-        int retval;
-        int i;
-
-        /* Read the state */
-        retval = sabi_get_command(sabi_config->commands.get_performance_level,
-                                  &sretval);
-        if (retval)
-                return retval;
-
-        /* The logic is backwards, yeah, lots of fun... */
-        for (i = 0; sabi_config->performance_levels[i].name; ++i) {
-                if (sretval.retval[0] == sabi_config->performance_levels[i].value)
-                        return sprintf(buf, "%s\n", sabi_config->performance_levels[i].name);
-        }
-        return sprintf(buf, "%s\n", "unknown");
-}
-
-static ssize_t set_performance_level(struct device *dev,
-                                struct device_attribute *attr, const char *buf,
-                                size_t count)
-{
-        if (count >= 1) {
-                int i;
-                for (i = 0; sabi_config->performance_levels[i].name; ++i) {
-                        const struct sabi_performance_level *level =
-                                &sabi_config->performance_levels[i];
-                        if (!strncasecmp(level->name, buf, strlen(level->name))) {
-                                sabi_set_command(sabi_config->commands.set_performance_level,
-                                                 level->value);
-                                break;
-                        }
-                }
-                if (!sabi_config->performance_levels[i].name)
-                        return -EINVAL;
-        }
-        return count;
-}
-static DEVICE_ATTR(performance_level, S_IWUSR | S_IRUGO,
-                   get_performance_level, set_performance_level);
-
-
-static int __init dmi_check_cb(const struct dmi_system_id *id)
-{
-        pr_info("found laptop model '%s'\n",
-                id->ident);
-        return 0;
-}
-
-static struct dmi_system_id __initdata samsung_dmi_table[] = {
-        {
-                .ident = "N128",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N128"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N128"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N130",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N130"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N130"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "X125",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X125"),
-                        DMI_MATCH(DMI_BOARD_NAME, "X125"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "X120/X170",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X120/X170"),
-                        DMI_MATCH(DMI_BOARD_NAME, "X120/X170"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "NC10",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
-                        DMI_MATCH(DMI_BOARD_NAME, "NC10"),
-                },
-                .callback = dmi_check_cb,
-        },
-                {
-                .ident = "NP-Q45",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"),
-                        DMI_MATCH(DMI_BOARD_NAME, "SQ45S70S"),
-                },
-                .callback = dmi_check_cb,
-                },
-        {
-                .ident = "X360",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X360"),
-                        DMI_MATCH(DMI_BOARD_NAME, "X360"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R410 Plus",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R410P"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R460"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R518",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R518"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R518"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R519/R719",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R519/R719"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R519/R719"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N150/N210/N220/N230",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220/N230"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220/N230"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N150P/N210P/N220P",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N150P/N210P/N220P"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N150P/N210P/N220P"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R530/R730",
-                .matches = {
-                      DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                      DMI_MATCH(DMI_PRODUCT_NAME, "R530/R730"),
-                      DMI_MATCH(DMI_BOARD_NAME, "R530/R730"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "NF110/NF210/NF310",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "NF110/NF210/NF310"),
-                        DMI_MATCH(DMI_BOARD_NAME, "NF110/NF210/NF310"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N145P/N250P/N260P",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N145P/N250P/N260P"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N145P/N250P/N260P"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R70/R71",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R70/R71"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R70/R71"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "P460",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "P460"),
-                        DMI_MATCH(DMI_BOARD_NAME, "P460"),
-                },
-                .callback = dmi_check_cb,
-        },
-        { },
-};
-MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
-
-static int find_signature(void __iomem *memcheck, const char *testStr)
-{
-        int i = 0;
-        int loca;
-
-        for (loca = 0; loca < 0xffff; loca++) {
-                char temp = readb(memcheck + loca);
-
-                if (temp == testStr[i]) {
-                        if (i == strlen(testStr)-1)
-                                break;
-                        ++i;
-                } else {
-                        i = 0;
-                }
-        }
-        return loca;
-}
-
-static int __init samsung_init(void)
-{
-        struct backlight_properties props;
-        struct sabi_retval sretval;
-        unsigned int ifaceP;
-        int i;
-        int loca;
-        int retval;
-
-        mutex_init(&sabi_mutex);
-
-        if (!force && !dmi_check_system(samsung_dmi_table))
-                return -ENODEV;
-
-        f0000_segment = ioremap_nocache(0xf0000, 0xffff);
-        if (!f0000_segment) {
-                pr_err("Can't map the segment at 0xf0000\n");
-                return -EINVAL;
-        }
-
-        /* Try to find one of the signatures in memory to find the header */
-        for (i = 0; sabi_configs[i].test_string != 0; ++i) {
-                sabi_config = &sabi_configs[i];
-                loca = find_signature(f0000_segment, sabi_config->test_string);
-                if (loca != 0xffff)
-                        break;
-        }
-
-        if (loca == 0xffff) {
-                pr_err("This computer does not support SABI\n");
-                goto error_no_signature;
-        }
-
-        /* point to the SMI port Number */
-        loca += 1;
-        sabi = (f0000_segment + loca);
-
-        if (debug) {
-                printk(KERN_DEBUG "This computer supports SABI==%x\n",
-                        loca + 0xf0000 - 6);
-                printk(KERN_DEBUG "SABI header:\n");
-                printk(KERN_DEBUG " SMI Port Number = 0x%04x\n",
-                        readw(sabi + sabi_config->header_offsets.port));
-                printk(KERN_DEBUG " SMI Interface Function = 0x%02x\n",
-                        readb(sabi + sabi_config->header_offsets.iface_func));
-                printk(KERN_DEBUG " SMI enable memory buffer = 0x%02x\n",
-                        readb(sabi + sabi_config->header_offsets.en_mem));
-                printk(KERN_DEBUG " SMI restore memory buffer = 0x%02x\n",
-                        readb(sabi + sabi_config->header_offsets.re_mem));
-                printk(KERN_DEBUG " SABI data offset = 0x%04x\n",
-                        readw(sabi + sabi_config->header_offsets.data_offset));
-                printk(KERN_DEBUG " SABI data segment = 0x%04x\n",
-                        readw(sabi + sabi_config->header_offsets.data_segment));
-        }
-
-        /* Get a pointer to the SABI Interface */
-        ifaceP = (readw(sabi + sabi_config->header_offsets.data_segment) & 0x0ffff) << 4;
-        ifaceP += readw(sabi + sabi_config->header_offsets.data_offset) & 0x0ffff;
-        sabi_iface = ioremap_nocache(ifaceP, 16);
-        if (!sabi_iface) {
-                pr_err("Can't remap %x\n", ifaceP);
-                goto exit;
-        }
-        if (debug) {
-                printk(KERN_DEBUG "ifaceP = 0x%08x\n", ifaceP);
-                printk(KERN_DEBUG "sabi_iface = %p\n", sabi_iface);
-
-                test_backlight();
-                test_wireless();
-
-                retval = sabi_get_command(sabi_config->commands.get_brightness,
-                                          &sretval);
-                printk(KERN_DEBUG "brightness = 0x%02x\n", sretval.retval[0]);
-        }
-
-        /* Turn on "Linux" mode in the BIOS */
-        if (sabi_config->commands.set_linux != 0xff) {
-                retval = sabi_set_command(sabi_config->commands.set_linux,
-                                          0x81);
-                if (retval) {
-                        pr_warn("Linux mode was not set!\n");
-                        goto error_no_platform;
-                }
-        }
-
-        /* knock up a platform device to hang stuff off of */
-        sdev = platform_device_register_simple("samsung", -1, NULL, 0);
-        if (IS_ERR(sdev))
-                goto error_no_platform;
-
-        /* create a backlight device to talk to this one */
-        memset(&props, 0, sizeof(struct backlight_properties));
-        props.type = BACKLIGHT_PLATFORM;
-        props.max_brightness = sabi_config->max_brightness;
-        backlight_device = backlight_device_register("samsung", &sdev->dev,
-                                                     NULL, &backlight_ops,
-                                                     &props);
-        if (IS_ERR(backlight_device))
-                goto error_no_backlight;
-
-        backlight_device->props.brightness = read_brightness();
-        backlight_device->props.power = FB_BLANK_UNBLANK;
-        backlight_update_status(backlight_device);
-
-        retval = init_wireless(sdev);
-        if (retval)
-                goto error_no_rfk;
-
-        retval = device_create_file(&sdev->dev, &dev_attr_performance_level);
-        if (retval)
-                goto error_file_create;
-
-exit:
-        return 0;
-
-error_file_create:
-        destroy_wireless();
-
-error_no_rfk:
-        backlight_device_unregister(backlight_device);
-
-error_no_backlight:
-        platform_device_unregister(sdev);
-
-error_no_platform:
-        iounmap(sabi_iface);
-
-error_no_signature:
-        iounmap(f0000_segment);
-        return -EINVAL;
-}
-
-static void __exit samsung_exit(void)
-{
-        /* Turn off "Linux" mode in the BIOS */
-        if (sabi_config->commands.set_linux != 0xff)
-                sabi_set_command(sabi_config->commands.set_linux, 0x80);
-
-        device_remove_file(&sdev->dev, &dev_attr_performance_level);
-        backlight_device_unregister(backlight_device);
-        destroy_wireless();
-        iounmap(sabi_iface);
-        iounmap(f0000_segment);
-        platform_device_unregister(sdev);
-}
-
-module_init(samsung_init);
-module_exit(samsung_exit);
-
-MODULE_AUTHOR("Greg Kroah-Hartman <gregkh@suse.de>");
-MODULE_DESCRIPTION("Samsung Backlight driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index a2e5b5100ab4..0f4e8c942f9e 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -1648,7 +1648,9 @@ pxafb_freq_transition(struct notifier_block *nb, unsigned long val, void *data)
 
         switch (val) {
         case CPUFREQ_PRECHANGE:
-                if (!fbi->overlay[0].usage && !fbi->overlay[1].usage)
+#ifdef CONFIG_FB_PXA_OVERLAY
+                if (!(fbi->overlay[0].usage || fbi->overlay[1].usage))
+#endif
                         set_ctrlr_state(fbi, C_DISABLE_CLKCHANGE);
                 break;
 
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 42d6c930cc87..33167b43ac7e 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -912,8 +912,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
                               unsigned long irqflags,
                               const char *devname, void *dev_id)
 {
-        unsigned int irq;
-        int retval;
+        int irq, retval;
 
         irq = bind_evtchn_to_irq(evtchn);
         if (irq < 0)
@@ -955,8 +954,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
                             irq_handler_t handler,
                             unsigned long irqflags, const char *devname, void *dev_id)
 {
-        unsigned int irq;
-        int retval;
+        int irq, retval;
 
         irq = bind_virq_to_irq(virq, cpu);
         if (irq < 0)
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 95143dd6904d..1ac94125bf93 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -61,7 +61,7 @@ static void xen_post_suspend(int cancelled)
         xen_mm_unpin_all();
 }
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 static int xen_suspend(void *data)
 {
         struct suspend_info *si = data;
@@ -173,7 +173,7 @@ out:
 #endif
         shutting_down = SHUTDOWN_INVALID;
 }
-#endif  /* CONFIG_HIBERNATION */
+#endif  /* CONFIG_HIBERNATE_CALLBACKS */
 
 struct shutdown_handler {
         const char *command;
@@ -202,7 +202,7 @@ static void shutdown_handler(struct xenbus_watch *watch,
                 { "poweroff",   do_poweroff },
                 { "halt",       do_poweroff },
                 { "reboot",     do_reboot   },
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
                 { "suspend",    do_suspend  },
 #endif
                 {NULL, NULL},
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 0ee594569dcc..85b67ffa2a43 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -286,11 +286,9 @@ static struct p9_fid *v9fs_fid_clone_with_uid(struct dentry *dentry, uid_t uid)
 
 struct p9_fid *v9fs_writeback_fid(struct dentry *dentry)
 {
-        int err, flags;
+        int err;
         struct p9_fid *fid;
-        struct v9fs_session_info *v9ses;
 
-        v9ses = v9fs_dentry2v9ses(dentry);
         fid = v9fs_fid_clone_with_uid(dentry, 0);
         if (IS_ERR(fid))
                 goto error_out;
@@ -299,17 +297,8 @@ struct p9_fid *v9fs_writeback_fid(struct dentry *dentry)
          * dirty pages. We always request for the open fid in read-write
          * mode so that a partial page write which result in page
          * read can work.
-         *
-         * we don't have a tsyncfs operation for older version
-         * of protocol. So make sure the write back fid is
-         * opened in O_SYNC mode.
          */
-        if (!v9fs_proto_dotl(v9ses))
-                flags = O_RDWR | O_SYNC;
-        else
-                flags = O_RDWR;
-
-        err = p9_client_open(fid, flags);
+        err = p9_client_open(fid, O_RDWR);
         if (err < 0) {
                 p9_client_clunk(fid);
                 fid = ERR_PTR(err);
diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
index 9665c2b840e6..e5ebedfc5ed8 100644
--- a/fs/9p/v9fs.h
+++ b/fs/9p/v9fs.h
@@ -116,7 +116,6 @@ struct v9fs_session_info {
         struct list_head slist; /* list of sessions registered with v9fs */
         struct backing_dev_info bdi;
         struct rw_semaphore rename_sem;
-        struct p9_fid *root_fid; /* Used for file system sync */
 };
 
 /* cache_validity flags */
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index b6a3b9f7fe4d..e022890c6f40 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -126,7 +126,9 @@ static int v9fs_lookup_revalidate(struct dentry *dentry, struct nameidata *nd)
                         retval = v9fs_refresh_inode_dotl(fid, inode);
                 else
                         retval = v9fs_refresh_inode(fid, inode);
-                if (retval <= 0)
+                if (retval == -ENOENT)
+                        return 0;
+                if (retval < 0)
                         return retval;
         }
 out_valid:
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index ffbb113d5f33..82a7c38ddad0 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -811,7 +811,7 @@ v9fs_vfs_follow_link_dotl(struct dentry *dentry, struct nameidata *nd)
         fid = v9fs_fid_lookup(dentry);
         if (IS_ERR(fid)) {
                 __putname(link);
-                link = ERR_PTR(PTR_ERR(fid));
+                link = ERR_CAST(fid);
                 goto ndset;
         }
         retval = p9_client_readlink(fid, &target);
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index f3eed3383e4f..feef6cdc1fd2 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -154,6 +154,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
                 retval = PTR_ERR(inode);
                 goto release_sb;
         }
+
         root = d_alloc_root(inode);
         if (!root) {
                 iput(inode);
@@ -185,21 +186,10 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
                 p9stat_free(st);
                 kfree(st);
         }
-        v9fs_fid_add(root, fid);
         retval = v9fs_get_acl(inode, fid);
         if (retval)
                 goto release_sb;
-        /*
-         * Add the root fid to session info. This is used
-         * for file system sync. We want a cloned fid here
-         * so that we can do a sync_filesystem after a
-         * shrink_dcache_for_umount
-         */
-        v9ses->root_fid = v9fs_fid_clone(root);
-        if (IS_ERR(v9ses->root_fid)) {
-                retval = PTR_ERR(v9ses->root_fid);
-                goto release_sb;
-        }
+        v9fs_fid_add(root, fid);
 
         P9_DPRINTK(P9_DEBUG_VFS, " simple set mount, return 0\n");
         return dget(sb->s_root);
@@ -210,11 +200,15 @@ close_session:
         v9fs_session_close(v9ses);
         kfree(v9ses);
         return ERR_PTR(retval);
+
 release_sb:
         /*
-         * we will do the session_close and root dentry
-         * release in the below call.
+         * we will do the session_close and root dentry release
+         * in the below call. But we need to clunk fid, because we haven't
+         * attached the fid to dentry so it won't get clunked
+         * automatically.
          */
+        p9_client_clunk(fid);
         deactivate_locked_super(sb);
         return ERR_PTR(retval);
 }
@@ -232,7 +226,7 @@ static void v9fs_kill_super(struct super_block *s)
         P9_DPRINTK(P9_DEBUG_VFS, " %p\n", s);
 
         kill_anon_super(s);
-        p9_client_clunk(v9ses->root_fid);
+
         v9fs_session_cancel(v9ses);
         v9fs_session_close(v9ses);
         kfree(v9ses);
@@ -285,14 +279,6 @@ done:
         return res;
 }
 
-static int v9fs_sync_fs(struct super_block *sb, int wait)
-{
-        struct v9fs_session_info *v9ses = sb->s_fs_info;
-
-        P9_DPRINTK(P9_DEBUG_VFS, "v9fs_sync_fs: super_block %p\n", sb);
-        return p9_client_sync_fs(v9ses->root_fid);
-}
-
 static int v9fs_drop_inode(struct inode *inode)
 {
         struct v9fs_session_info *v9ses;
@@ -307,6 +293,51 @@ static int v9fs_drop_inode(struct inode *inode)
         return 1;
 }
 
+static int v9fs_write_inode(struct inode *inode,
+                            struct writeback_control *wbc)
+{
+        int ret;
+        struct p9_wstat wstat;
+        struct v9fs_inode *v9inode;
+        /*
+         * send an fsync request to server irrespective of
+         * wbc->sync_mode.
+         */
+        P9_DPRINTK(P9_DEBUG_VFS, "%s: inode %p\n", __func__, inode);
+        v9inode = V9FS_I(inode);
+        if (!v9inode->writeback_fid)
+                return 0;
+        v9fs_blank_wstat(&wstat);
+
+        ret = p9_client_wstat(v9inode->writeback_fid, &wstat);
+        if (ret < 0) {
+                __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+                return ret;
+        }
+        return 0;
+}
+
+static int v9fs_write_inode_dotl(struct inode *inode,
+                                 struct writeback_control *wbc)
+{
+        int ret;
+        struct v9fs_inode *v9inode;
+        /*
+         * send an fsync request to server irrespective of
+         * wbc->sync_mode.
+         */
+        P9_DPRINTK(P9_DEBUG_VFS, "%s: inode %p\n", __func__, inode);
+        v9inode = V9FS_I(inode);
+        if (!v9inode->writeback_fid)
+                return 0;
+        ret = p9_client_fsync(v9inode->writeback_fid, 0);
+        if (ret < 0) {
+                __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+                return ret;
+        }
+        return 0;
+}
+
 static const struct super_operations v9fs_super_ops = {
         .alloc_inode = v9fs_alloc_inode,
         .destroy_inode = v9fs_destroy_inode,
@@ -314,17 +345,18 @@ static const struct super_operations v9fs_super_ops = {
         .evict_inode = v9fs_evict_inode,
         .show_options = generic_show_options,
         .umount_begin = v9fs_umount_begin,
+        .write_inode = v9fs_write_inode,
 };
 
 static const struct super_operations v9fs_super_ops_dotl = {
         .alloc_inode = v9fs_alloc_inode,
         .destroy_inode = v9fs_destroy_inode,
-        .sync_fs = v9fs_sync_fs,
         .statfs = v9fs_statfs,
         .drop_inode = v9fs_drop_inode,
         .evict_inode = v9fs_evict_inode,
         .show_options = generic_show_options,
         .umount_begin = v9fs_umount_begin,
+        .write_inode = v9fs_write_inode_dotl,
 };
 
 struct file_system_type v9fs_fs_type = {
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index f34078d702d3..303983fabfd6 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -941,9 +941,13 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
         current->mm->start_stack = bprm->p;
 
 #ifdef arch_randomize_brk
-        if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1))
+        if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
                 current->mm->brk = current->mm->start_brk =
                         arch_randomize_brk(current->mm);
+#ifdef CONFIG_COMPAT_BRK
+                current->brk_randomized = 1;
+#endif
+        }
 #endif
 
         if (current->personality & MMAP_PAGE_ZERO) {
diff --git a/fs/cifs/README b/fs/cifs/README
index fe1683590828..74ab165fc646 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -685,22 +685,6 @@ LinuxExtensionsEnabled	If set to one then the client will attempt to
                         support and want to map the uid and gid fields 
                         to values supplied at mount (rather than the 
                         actual values, then set this to zero. (default 1)
-Experimental            When set to 1 used to enable certain experimental
-                        features (currently enables multipage writes
-                        when signing is enabled, the multipage write
-                        performance enhancement was disabled when
-                        signing turned on in case buffer was modified
-                        just before it was sent, also this flag will
-                        be used to use the new experimental directory change 
-                        notification code).  When set to 2 enables
-                        an additional experimental feature, "raw ntlmssp"
-                        session establishment support (which allows
-                        specifying "sec=ntlmssp" on mount). The Linux cifs
-                        module will use ntlmv2 authentication encapsulated
-                        in "raw ntlmssp" (not using SPNEGO) when
-                        "sec=ntlmssp" is specified on mount.
-                        This support also requires building cifs with
-                        the CONFIG_CIFS_EXPERIMENTAL configuration flag.
 
 These experimental features and tracing can be enabled by changing flags in 
 /proc/fs/cifs (after the cifs module has been installed or built into the 
diff --git a/fs/cifs/cache.c b/fs/cifs/cache.c
index e654dfd092c3..53d57a3fe427 100644
--- a/fs/cifs/cache.c
+++ b/fs/cifs/cache.c
@@ -50,7 +50,7 @@ void cifs_fscache_unregister(void)
  */
 struct cifs_server_key {
         uint16_t        family;         /* address family */
-        uint16_t        port;           /* IP port */
+        __be16          port;           /* IP port */
         union {
                 struct in_addr  ipv4_addr;
                 struct in6_addr ipv6_addr;
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 65829d32128c..30d01bc90855 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -423,7 +423,6 @@ static const struct file_operations cifs_lookup_cache_proc_fops;
 static const struct file_operations traceSMB_proc_fops;
 static const struct file_operations cifs_multiuser_mount_proc_fops;
 static const struct file_operations cifs_security_flags_proc_fops;
-static const struct file_operations cifs_experimental_proc_fops;
 static const struct file_operations cifs_linux_ext_proc_fops;
 
 void
@@ -441,8 +440,6 @@ cifs_proc_init(void)
         proc_create("cifsFYI", 0, proc_fs_cifs, &cifsFYI_proc_fops);
         proc_create("traceSMB", 0, proc_fs_cifs, &traceSMB_proc_fops);
         proc_create("OplockEnabled", 0, proc_fs_cifs, &cifs_oplock_proc_fops);
-        proc_create("Experimental", 0, proc_fs_cifs,
-                    &cifs_experimental_proc_fops);
         proc_create("LinuxExtensionsEnabled", 0, proc_fs_cifs,
                     &cifs_linux_ext_proc_fops);
         proc_create("MultiuserMount", 0, proc_fs_cifs,
@@ -469,7 +466,6 @@ cifs_proc_clean(void)
         remove_proc_entry("OplockEnabled", proc_fs_cifs);
         remove_proc_entry("SecurityFlags", proc_fs_cifs);
         remove_proc_entry("LinuxExtensionsEnabled", proc_fs_cifs);
-        remove_proc_entry("Experimental", proc_fs_cifs);
         remove_proc_entry("LookupCacheEnabled", proc_fs_cifs);
         remove_proc_entry("fs/cifs", NULL);
 }
@@ -550,45 +546,6 @@ static const struct file_operations cifs_oplock_proc_fops = {
         .write          = cifs_oplock_proc_write,
 };
 
-static int cifs_experimental_proc_show(struct seq_file *m, void *v)
-{
-        seq_printf(m, "%d\n", experimEnabled);
-        return 0;
-}
-
-static int cifs_experimental_proc_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cifs_experimental_proc_show, NULL);
-}
-
-static ssize_t cifs_experimental_proc_write(struct file *file,
-                const char __user *buffer, size_t count, loff_t *ppos)
-{
-        char c;
-        int rc;
-
-        rc = get_user(c, buffer);
-        if (rc)
-                return rc;
-        if (c == '0' || c == 'n' || c == 'N')
-                experimEnabled = 0;
-        else if (c == '1' || c == 'y' || c == 'Y')
-                experimEnabled = 1;
-        else if (c == '2')
-                experimEnabled = 2;
-
-        return count;
-}
-
-static const struct file_operations cifs_experimental_proc_fops = {
-        .owner          = THIS_MODULE,
-        .open           = cifs_experimental_proc_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-        .write          = cifs_experimental_proc_write,
-};
-
 static int cifs_linux_ext_proc_show(struct seq_file *m, void *v)
 {
         seq_printf(m, "%d\n", linuxExtEnabled);
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 4dfba8283165..33d221394aca 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -113,7 +113,7 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
                    MAX_MECH_STR_LEN +
                    UID_KEY_LEN + (sizeof(uid_t) * 2) +
                    CREDUID_KEY_LEN + (sizeof(uid_t) * 2) +
-                   USER_KEY_LEN + strlen(sesInfo->userName) +
+                   USER_KEY_LEN + strlen(sesInfo->user_name) +
                    PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
 
         spnego_key = ERR_PTR(-ENOMEM);
@@ -153,7 +153,7 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
         sprintf(dp, ";creduid=0x%x", sesInfo->cred_uid);
 
         dp = description + strlen(description);
-        sprintf(dp, ";user=%s", sesInfo->userName);
+        sprintf(dp, ";user=%s", sesInfo->user_name);
 
         dp = description + strlen(description);
         sprintf(dp, ";pid=0x%x", current->pid);
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index fc0fd4fde306..23d43cde4306 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -90,7 +90,7 @@ cifs_mapchar(char *target, const __u16 src_char, const struct nls_table *cp,
         case UNI_COLON:
                 *target = ':';
                 break;
-        case UNI_ASTERIK:
+        case UNI_ASTERISK:
                 *target = '*';
                 break;
         case UNI_QUESTION:
@@ -264,40 +264,40 @@ cifs_strndup_from_ucs(const char *src, const int maxlen, const bool is_unicode,
  * names are little endian 16 bit Unicode on the wire
  */
 int
-cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
+cifsConvertToUCS(__le16 *target, const char *source, int srclen,
                  const struct nls_table *cp, int mapChars)
 {
         int i, j, charlen;
-        int len_remaining = maxlen;
         char src_char;
-        __u16 temp;
+        __le16 dst_char;
+        wchar_t tmp;
 
         if (!mapChars)
                 return cifs_strtoUCS(target, source, PATH_MAX, cp);
 
-        for (i = 0, j = 0; i < maxlen; j++) {
+        for (i = 0, j = 0; i < srclen; j++) {
                 src_char = source[i];
                 switch (src_char) {
                 case 0:
-                        put_unaligned_le16(0, &target[j]);
+                        put_unaligned(0, &target[j]);
                         goto ctoUCS_out;
                 case ':':
-                        temp = UNI_COLON;
+                        dst_char = cpu_to_le16(UNI_COLON);
                         break;
                 case '*':
-                        temp = UNI_ASTERIK;
+                        dst_char = cpu_to_le16(UNI_ASTERISK);
                         break;
                 case '?':
-                        temp = UNI_QUESTION;
+                        dst_char = cpu_to_le16(UNI_QUESTION);
                         break;
                 case '<':
-                        temp = UNI_LESSTHAN;
+                        dst_char = cpu_to_le16(UNI_LESSTHAN);
                         break;
                 case '>':
-                        temp = UNI_GRTRTHAN;
+                        dst_char = cpu_to_le16(UNI_GRTRTHAN);
                         break;
                 case '|':
-                        temp = UNI_PIPE;
+                        dst_char = cpu_to_le16(UNI_PIPE);
                         break;
                 /*
                  * FIXME: We can not handle remapping backslash (UNI_SLASH)
@@ -305,17 +305,17 @@ cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
                  * as they use backslash as separator.
                  */
                 default:
-                        charlen = cp->char2uni(source+i, len_remaining,
-                                                &temp);
+                        charlen = cp->char2uni(source + i, srclen - i, &tmp);
+                        dst_char = cpu_to_le16(tmp);
+
                         /*
                          * if no match, use question mark, which at least in
                          * some cases serves as wild card
                          */
                         if (charlen < 1) {
-                                temp = 0x003f;
+                                dst_char = cpu_to_le16(0x003f);
                                 charlen = 1;
                         }
-                        len_remaining -= charlen;
                         /*
                          * character may take more than one byte in the source
                          * string, but will take exactly two bytes in the
@@ -324,9 +324,8 @@ cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
                         i += charlen;
                         continue;
                 }
-                put_unaligned_le16(temp, &target[j]);
+                put_unaligned(dst_char, &target[j]);
                 i++; /* move to next char in source string */
-                len_remaining--;
         }
 
 ctoUCS_out:
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 7fe6b52df507..644dd882a560 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -44,7 +44,7 @@
  * reserved symbols (along with \ and /), otherwise illegal to store
  * in filenames in NTFS
  */
-#define UNI_ASTERIK     (__u16) ('*' + 0xF000)
+#define UNI_ASTERISK    (__u16) ('*' + 0xF000)
 #define UNI_QUESTION    (__u16) ('?' + 0xF000)
 #define UNI_COLON       (__u16) (':' + 0xF000)
 #define UNI_GRTRTHAN    (__u16) ('>' + 0xF000)
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index a51585f9852b..d1a016be73ba 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -30,12 +30,13 @@
 #include <linux/ctype.h>
 #include <linux/random.h>
 
-/* Calculate and return the CIFS signature based on the mac key and SMB PDU */
-/* the 16 byte signature must be allocated by the caller  */
-/* Note we only use the 1st eight bytes */
-/* Note that the smb header signature field on input contains the
-        sequence number before this function is called */
-
+/*
+ * Calculate and return the CIFS signature based on the mac key and SMB PDU.
+ * The 16 byte signature must be allocated by the caller. Note we only use the
+ * 1st eight bytes and that the smb header signature field on input contains
+ * the sequence number before this function is called. Also, this function
+ * should be called with the server->srv_mutex held.
+ */
 static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
                                 struct TCP_Server_Info *server, char *signature)
 {
@@ -209,8 +210,10 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
                                         cpu_to_le32(expected_sequence_number);
         cifs_pdu->Signature.Sequence.Reserved = 0;
 
+        mutex_lock(&server->srv_mutex);
         rc = cifs_calculate_signature(cifs_pdu, server,
                 what_we_think_sig_should_be);
+        mutex_unlock(&server->srv_mutex);
 
         if (rc)
                 return rc;
@@ -469,15 +472,15 @@ static int calc_ntlmv2_hash(struct cifsSesInfo *ses, char *ntlmv2_hash,
                 return rc;
         }
 
-        /* convert ses->userName to unicode and uppercase */
-        len = strlen(ses->userName);
+        /* convert ses->user_name to unicode and uppercase */
+        len = strlen(ses->user_name);
         user = kmalloc(2 + (len * 2), GFP_KERNEL);
         if (user == NULL) {
                 cERROR(1, "calc_ntlmv2_hash: user mem alloc failure\n");
                 rc = -ENOMEM;
                 goto calc_exit_2;
         }
-        len = cifs_strtoUCS((__le16 *)user, ses->userName, len, nls_cp);
+        len = cifs_strtoUCS((__le16 *)user, ses->user_name, len, nls_cp);
         UniStrupr(user);
 
         crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f2970136d17d..5c412b33cd7c 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -53,7 +53,6 @@ int cifsFYI = 0;
 int cifsERROR = 1;
 int traceSMB = 0;
 unsigned int oplockEnabled = 1;
-unsigned int experimEnabled = 0;
 unsigned int linuxExtEnabled = 1;
 unsigned int lookupCacheEnabled = 1;
 unsigned int multiuser_mount = 0;
@@ -127,6 +126,7 @@ cifs_read_super(struct super_block *sb, void *data,
                 kfree(cifs_sb);
                 return rc;
         }
+        cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
 
 #ifdef CONFIG_CIFS_DFS_UPCALL
         /* copy mount params to sb for use in submounts */
@@ -409,8 +409,8 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
 
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
                 seq_printf(s, ",multiuser");
-        else if (tcon->ses->userName)
-                seq_printf(s, ",username=%s", tcon->ses->userName);
+        else if (tcon->ses->user_name)
+                seq_printf(s, ",username=%s", tcon->ses->user_name);
 
         if (tcon->ses->domainName)
                 seq_printf(s, ",domain=%s", tcon->ses->domainName);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 17afb0fbcaed..a5d1106fcbde 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -37,10 +37,9 @@
 
 #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1)
 #define MAX_SERVER_SIZE 15
-#define MAX_SHARE_SIZE  64      /* used to be 20, this should still be enough */
-#define MAX_USERNAME_SIZE 32    /* 32 is to allow for 15 char names + null
-                                   termination then *2 for unicode versions */
-#define MAX_PASSWORD_SIZE 512  /* max for windows seems to be 256 wide chars */
+#define MAX_SHARE_SIZE 80
+#define MAX_USERNAME_SIZE 256   /* reasonable maximum for current servers */
+#define MAX_PASSWORD_SIZE 512   /* max for windows seems to be 256 wide chars */
 
 #define CIFS_MIN_RCV_POOL 4
 
@@ -92,7 +91,8 @@ enum statusEnum {
         CifsNew = 0,
         CifsGood,
         CifsExiting,
-        CifsNeedReconnect
+        CifsNeedReconnect,
+        CifsNeedNegotiate
 };
 
 enum securityEnum {
@@ -274,7 +274,7 @@ struct cifsSesInfo {
         int capabilities;
         char serverName[SERVER_NAME_LEN_WITH_NULL * 2]; /* BB make bigger for
                                 TCP names - will ipv6 and sctp addresses fit? */
-        char userName[MAX_USERNAME_SIZE + 1];
+        char *user_name;
         char *domainName;
         char *password;
         struct session_key auth_key;
@@ -817,7 +817,6 @@ GLOBAL_EXTERN unsigned int multiuser_mount; /* if enabled allows new sessions
                                 have the uid/password or Kerberos credential
                                 or equivalent for current user */
 GLOBAL_EXTERN unsigned int oplockEnabled;
-GLOBAL_EXTERN unsigned int experimEnabled;
 GLOBAL_EXTERN unsigned int lookupCacheEnabled;
 GLOBAL_EXTERN unsigned int global_secflags;     /* if on, session setup sent
                                 with more secure ntlmssp2 challenge/resp */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 2644a5d6cc67..df959bae6728 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -142,9 +142,9 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
          */
         while (server->tcpStatus == CifsNeedReconnect) {
                 wait_event_interruptible_timeout(server->response_q,
-                        (server->tcpStatus == CifsGood), 10 * HZ);
+                        (server->tcpStatus != CifsNeedReconnect), 10 * HZ);
 
-                /* is TCP session is reestablished now ?*/
+                /* are we still trying to reconnect? */
                 if (server->tcpStatus != CifsNeedReconnect)
                         break;
 
@@ -729,7 +729,7 @@ CIFSSMBEcho(struct TCP_Server_Info *server)
                 return rc;
 
         /* set up echo request */
-        smb->hdr.Tid = cpu_to_le16(0xffff);
+        smb->hdr.Tid = 0xffff;
         smb->hdr.WordCount = 1;
         put_unaligned_le16(1, &smb->EchoCount);
         put_bcc_le(1, &smb->hdr);
@@ -1884,10 +1884,10 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                                         __constant_cpu_to_le16(CIFS_WRLCK))
                                 pLockData->fl_type = F_WRLCK;
 
-                        pLockData->fl_start = parm_data->start;
-                        pLockData->fl_end = parm_data->start +
-                                                parm_data->length - 1;
-                        pLockData->fl_pid = parm_data->pid;
+                        pLockData->fl_start = le64_to_cpu(parm_data->start);
+                        pLockData->fl_end = pLockData->fl_start +
+                                        le64_to_cpu(parm_data->length) - 1;
+                        pLockData->fl_pid = le32_to_cpu(parm_data->pid);
                 }
         }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 6e2b2addfc78..db9d55b507d0 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -199,8 +199,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         }
         spin_unlock(&GlobalMid_Lock);
 
-        while ((server->tcpStatus != CifsExiting) &&
-               (server->tcpStatus != CifsGood)) {
+        while (server->tcpStatus == CifsNeedReconnect) {
                 try_to_freeze();
 
                 /* we should try only the port we connected to before */
@@ -212,7 +211,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
                         atomic_inc(&tcpSesReconnectCount);
                         spin_lock(&GlobalMid_Lock);
                         if (server->tcpStatus != CifsExiting)
-                                server->tcpStatus = CifsGood;
+                                server->tcpStatus = CifsNeedNegotiate;
                         spin_unlock(&GlobalMid_Lock);
                 }
         }
@@ -248,24 +247,24 @@ static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 
-        remaining = total_data_size - data_in_this_rsp;
-
-        if (remaining == 0)
+        if (total_data_size == data_in_this_rsp)
                 return 0;
-        else if (remaining < 0) {
+        else if (total_data_size < data_in_this_rsp) {
                 cFYI(1, "total data %d smaller than data in frame %d",
                         total_data_size, data_in_this_rsp);
                 return -EINVAL;
-        } else {
-                cFYI(1, "missing %d bytes from transact2, check next response",
-                        remaining);
-                if (total_data_size > maxBufSize) {
-                        cERROR(1, "TotalDataSize %d is over maximum buffer %d",
-                                total_data_size, maxBufSize);
-                        return -EINVAL;
-                }
-                return remaining;
         }
+
+        remaining = total_data_size - data_in_this_rsp;
+
+        cFYI(1, "missing %d bytes from transact2, check next response",
+                remaining);
+        if (total_data_size > maxBufSize) {
+                cERROR(1, "TotalDataSize %d is over maximum buffer %d",
+                        total_data_size, maxBufSize);
+                return -EINVAL;
+        }
+        return remaining;
 }
 
 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
@@ -421,7 +420,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                 pdu_length = 4; /* enough to get RFC1001 header */
 
 incomplete_rcv:
-                if (echo_retries > 0 &&
+                if (echo_retries > 0 && server->tcpStatus == CifsGood &&
                     time_after(jiffies, server->lstrp +
                                         (echo_retries * SMB_ECHO_INTERVAL))) {
                         cERROR(1, "Server %s has not responded in %d seconds. "
@@ -881,7 +880,8 @@ cifs_parse_mount_options(char *options, const char *devname,
                                 /* null user, ie anonymous, authentication */
                                 vol->nullauth = 1;
                         }
-                        if (strnlen(value, 200) < 200) {
+                        if (strnlen(value, MAX_USERNAME_SIZE) <
+                                                MAX_USERNAME_SIZE) {
                                 vol->username = value;
                         } else {
                                 printk(KERN_WARNING "CIFS: username too long\n");
@@ -1472,7 +1472,7 @@ srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
 static bool
 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
 {
-        unsigned short int port, *sport;
+        __be16 port, *sport;
 
         switch (addr->sa_family) {
         case AF_INET:
@@ -1765,6 +1765,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                 module_put(THIS_MODULE);
                 goto out_err_crypto_release;
         }
+        tcp_ses->tcpStatus = CifsNeedNegotiate;
 
         /* thread spawned, put it on the list */
         spin_lock(&cifs_tcp_ses_lock);
@@ -1808,7 +1809,9 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
                         break;
                 default:
                         /* anything else takes username/password */
-                        if (strncmp(ses->userName, vol->username,
+                        if (ses->user_name == NULL)
+                                continue;
+                        if (strncmp(ses->user_name, vol->username,
                                     MAX_USERNAME_SIZE))
                                 continue;
                         if (strlen(vol->username) != 0 &&
@@ -1851,6 +1854,8 @@ cifs_put_smb_ses(struct cifsSesInfo *ses)
         cifs_put_tcp_session(server);
 }
 
+static bool warned_on_ntlm;  /* globals init to false automatically */
+
 static struct cifsSesInfo *
 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
 {
@@ -1906,9 +1911,11 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
         else
                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
 
-        if (volume_info->username)
-                strncpy(ses->userName, volume_info->username,
-                        MAX_USERNAME_SIZE);
+        if (volume_info->username) {
+                ses->user_name = kstrdup(volume_info->username, GFP_KERNEL);
+                if (!ses->user_name)
+                        goto get_ses_fail;
+        }
 
         /* volume_info->password freed at unmount */
         if (volume_info->password) {
@@ -1923,6 +1930,15 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
         }
         ses->cred_uid = volume_info->cred_uid;
         ses->linux_uid = volume_info->linux_uid;
+
+        /* ntlmv2 is much stronger than ntlm security, and has been broadly
+        supported for many years, time to update default security mechanism */
+        if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
+                warned_on_ntlm = true;
+                cERROR(1, "default security mechanism requested.  The default "
+                        "security mechanism will be upgraded from ntlm to "
+                        "ntlmv2 in kernel release 2.6.41");
+        }
         ses->overrideSecFlg = volume_info->secFlg;
 
         mutex_lock(&ses->session_mutex);
@@ -2276,7 +2292,7 @@ static int
 generic_ip_connect(struct TCP_Server_Info *server)
 {
         int rc = 0;
-        unsigned short int sport;
+        __be16 sport;
         int slen, sfamily;
         struct socket *socket = server->ssocket;
         struct sockaddr *saddr;
@@ -2361,7 +2377,7 @@ generic_ip_connect(struct TCP_Server_Info *server)
 static int
 ip_connect(struct TCP_Server_Info *server)
 {
-        unsigned short int *sport;
+        __be16 *sport;
         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
 
@@ -2826,7 +2842,7 @@ try_mount_again:
 
 remote_path_check:
         /* check if a whole path (including prepath) is not remote */
-        if (!rc && cifs_sb->prepathlen && tcon) {
+        if (!rc && tcon) {
                 /* build_path_to_root works only when we have a valid tcon */
                 full_path = cifs_build_path_to_root(cifs_sb, tcon);
                 if (full_path == NULL) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index c27d236738fc..faf59529e847 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -575,8 +575,10 @@ reopen_error_exit:
 
 int cifs_close(struct inode *inode, struct file *file)
 {
-        cifsFileInfo_put(file->private_data);
-        file->private_data = NULL;
+        if (file->private_data != NULL) {
+                cifsFileInfo_put(file->private_data);
+                file->private_data = NULL;
+        }
 
         /* return code from the ->release op is always ignored */
         return 0;
@@ -970,6 +972,9 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
              total_written += bytes_written) {
                 rc = -EAGAIN;
                 while (rc == -EAGAIN) {
+                        struct kvec iov[2];
+                        unsigned int len;
+
                         if (open_file->invalidHandle) {
                                 /* we could deadlock if we called
                                    filemap_fdatawait from here so tell
@@ -979,31 +984,14 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
                                 if (rc != 0)
                                         break;
                         }
-                        if (experimEnabled || (pTcon->ses->server &&
-                                ((pTcon->ses->server->secMode &
-                                (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
-                                == 0))) {
-                                struct kvec iov[2];
-                                unsigned int len;
-
-                                len = min((size_t)cifs_sb->wsize,
-                                          write_size - total_written);
-                                /* iov[0] is reserved for smb header */
-                                iov[1].iov_base = (char *)write_data +
-                                                  total_written;
-                                iov[1].iov_len = len;
-                                rc = CIFSSMBWrite2(xid, pTcon,
-                                                open_file->netfid, len,
-                                                *poffset, &bytes_written,
-                                                iov, 1, 0);
-                        } else
-                                rc = CIFSSMBWrite(xid, pTcon,
-                                         open_file->netfid,
-                                         min_t(const int, cifs_sb->wsize,
-                                               write_size - total_written),
-                                         *poffset, &bytes_written,
-                                         write_data + total_written,
-                                         NULL, 0);
+
+                        len = min((size_t)cifs_sb->wsize,
+                                  write_size - total_written);
+                        /* iov[0] is reserved for smb header */
+                        iov[1].iov_base = (char *)write_data + total_written;
+                        iov[1].iov_len = len;
+                        rc = CIFSSMBWrite2(xid, pTcon, open_file->netfid, len,
+                                           *poffset, &bytes_written, iov, 1, 0);
                 }
                 if (rc || (bytes_written == 0)) {
                         if (total_written)
@@ -1240,12 +1228,6 @@ static int cifs_writepages(struct address_space *mapping,
         }
 
         tcon = tlink_tcon(open_file->tlink);
-        if (!experimEnabled && tcon->ses->server->secMode &
-                        (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
-                cifsFileInfo_put(open_file);
-                kfree(iov);
-                return generic_writepages(mapping, wbc);
-        }
         cifsFileInfo_put(open_file);
 
         xid = GetXid();
@@ -1980,6 +1962,24 @@ static ssize_t cifs_read(struct file *file, char *read_data, size_t read_size,
         return total_read;
 }
 
+/*
+ * If the page is mmap'ed into a process' page tables, then we need to make
+ * sure that it doesn't change while being written back.
+ */
+static int
+cifs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct page *page = vmf->page;
+
+        lock_page(page);
+        return VM_FAULT_LOCKED;
+}
+
+static struct vm_operations_struct cifs_file_vm_ops = {
+        .fault = filemap_fault,
+        .page_mkwrite = cifs_page_mkwrite,
+};
+
 int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma)
 {
         int rc, xid;
@@ -1991,6 +1991,8 @@ int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma)
                 cifs_invalidate_mapping(inode);
 
         rc = generic_file_mmap(file, vma);
+        if (rc == 0)
+                vma->vm_ops = &cifs_file_vm_ops;
         FreeXid(xid);
         return rc;
 }
@@ -2007,6 +2009,8 @@ int cifs_file_mmap(struct file *file, struct vm_area_struct *vma)
                 return rc;
         }
         rc = generic_file_mmap(file, vma);
+        if (rc == 0)
+                vma->vm_ops = &cifs_file_vm_ops;
         FreeXid(xid);
         return rc;
 }
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index e8804d373404..ce417a9764a3 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -239,7 +239,7 @@ CIFSQueryMFSymLink(const int xid, struct cifsTconInfo *tcon,
         if (rc != 0)
                 return rc;
 
-        if (file_info.EndOfFile != CIFS_MF_SYMLINK_FILE_SIZE) {
+        if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) {
                 CIFSSMBClose(xid, tcon, netfid);
                 /* it's not a symlink */
                 return -EINVAL;
@@ -316,7 +316,7 @@ CIFSCheckMFSymlink(struct cifs_fattr *fattr,
         if (rc != 0)
                 goto out;
 
-        if (file_info.EndOfFile != CIFS_MF_SYMLINK_FILE_SIZE) {
+        if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) {
                 CIFSSMBClose(xid, pTcon, netfid);
                 /* it's not a symlink */
                 goto out;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 2a930a752a78..0c684ae4c071 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -100,6 +100,7 @@ sesInfoFree(struct cifsSesInfo *buf_to_free)
                 memset(buf_to_free->password, 0, strlen(buf_to_free->password));
                 kfree(buf_to_free->password);
         }
+        kfree(buf_to_free->user_name);
         kfree(buf_to_free->domainName);
         kfree(buf_to_free);
 }
@@ -520,7 +521,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                         (struct smb_com_transaction_change_notify_rsp *)buf;
                 struct file_notify_information *pnotify;
                 __u32 data_offset = 0;
-                if (pSMBr->ByteCount > sizeof(struct file_notify_information)) {
+                if (get_bcc_le(buf) > sizeof(struct file_notify_information)) {
                         data_offset = le32_to_cpu(pSMBr->DataOffset);
 
                         pnotify = (struct file_notify_information *)
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 16765703131b..f6728eb6f4b9 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -219,12 +219,12 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
                 bcc_ptr++;
         } */
         /* copy user */
-        if (ses->userName == NULL) {
+        if (ses->user_name == NULL) {
                 /* null user mount */
                 *bcc_ptr = 0;
                 *(bcc_ptr+1) = 0;
         } else {
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
+                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->user_name,
                                           MAX_USERNAME_SIZE, nls_cp);
         }
         bcc_ptr += 2 * bytes_ret;
@@ -244,12 +244,11 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
         /* copy user */
         /* BB what about null user mounts - check that we do this BB */
         /* copy user */
-        if (ses->userName == NULL) {
-                /* BB what about null user mounts - check that we do this BB */
-        } else {
-                strncpy(bcc_ptr, ses->userName, MAX_USERNAME_SIZE);
-        }
-        bcc_ptr += strnlen(ses->userName, MAX_USERNAME_SIZE);
+        if (ses->user_name != NULL)
+                strncpy(bcc_ptr, ses->user_name, MAX_USERNAME_SIZE);
+        /* else null user mount */
+
+        bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE);
         *bcc_ptr = 0;
         bcc_ptr++; /* account for null termination */
 
@@ -405,8 +404,8 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
         /* BB spec says that if AvId field of MsvAvTimestamp is populated then
                 we must set the MIC field of the AUTHENTICATE_MESSAGE */
         ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
-        tioffset = cpu_to_le16(pblob->TargetInfoArray.BufferOffset);
-        tilen = cpu_to_le16(pblob->TargetInfoArray.Length);
+        tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
+        tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
         if (tilen) {
                 ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
                 if (!ses->auth_key.response) {
@@ -523,14 +522,14 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 tmp += len;
         }
 
-        if (ses->userName == NULL) {
+        if (ses->user_name == NULL) {
                 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->UserName.Length = 0;
                 sec_blob->UserName.MaximumLength = 0;
                 tmp += 2;
         } else {
                 int len;
-                len = cifs_strtoUCS((__le16 *)tmp, ses->userName,
+                len = cifs_strtoUCS((__le16 *)tmp, ses->user_name,
                                     MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
                 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
diff --git a/fs/dcache.c b/fs/dcache.c
index ad25c4cec7d5..129a35730994 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2131,7 +2131,7 @@ EXPORT_SYMBOL(d_rehash);
  */
 void dentry_update_name_case(struct dentry *dentry, struct qstr *name)
 {
-        BUG_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
+        BUG_ON(!mutex_is_locked(&dentry->d_parent->d_inode->i_mutex));
         BUG_ON(dentry->d_name.len != name->len); /* d_lookup gives this */
 
         spin_lock(&dentry->d_lock);
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index b5c2f3c97d71..68b2e43d7c35 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -3291,7 +3291,7 @@ static int ext3_writepage_trans_blocks(struct inode *inode)
         if (ext3_should_journal_data(inode))
                 ret = 3 * (bpp + indirects) + 2;
         else
-                ret = 2 * (bpp + indirects) + 2;
+                ret = 2 * (bpp + indirects) + indirects + 2;
 
 #ifdef CONFIG_QUOTA
         /* We know that structure was already allocated during dquot_initialize so
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index e25e99bf7ee1..d0f53538a57f 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -86,8 +86,8 @@
 
 #ifdef CONFIG_QUOTA
 /* Amount of blocks needed for quota update - we know that the structure was
- * allocated so we need to update only inode+data */
-#define EXT4_QUOTA_TRANS_BLOCKS(sb) (test_opt(sb, QUOTA) ? 2 : 0)
+ * allocated so we need to update only data block */
+#define EXT4_QUOTA_TRANS_BLOCKS(sb) (test_opt(sb, QUOTA) ? 1 : 0)
 /* Amount of blocks needed for quota insert/delete - we do some block writes
  * but inode, sb and group updates are done only once */
 #define EXT4_QUOTA_INIT_BLOCKS(sb) (test_opt(sb, QUOTA) ? (DQUOT_INIT_ALLOC*\
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 4673bc05274f..e9473cbe80df 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -125,9 +125,11 @@ extern int ext4_flush_completed_IO(struct inode *inode)
  * the parent directory's parent as well, and so on recursively, if
  * they are also freshly created.
  */
-static void ext4_sync_parent(struct inode *inode)
+static int ext4_sync_parent(struct inode *inode)
 {
+        struct writeback_control wbc;
         struct dentry *dentry = NULL;
+        int ret = 0;
 
         while (inode && ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
                 ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
@@ -136,8 +138,17 @@ static void ext4_sync_parent(struct inode *inode)
                 if (!dentry || !dentry->d_parent || !dentry->d_parent->d_inode)
                         break;
                 inode = dentry->d_parent->d_inode;
-                sync_mapping_buffers(inode->i_mapping);
+                ret = sync_mapping_buffers(inode->i_mapping);
+                if (ret)
+                        break;
+                memset(&wbc, 0, sizeof(wbc));
+                wbc.sync_mode = WB_SYNC_ALL;
+                wbc.nr_to_write = 0;         /* only write out the inode */
+                ret = sync_inode(inode, &wbc);
+                if (ret)
+                        break;
         }
+        return ret;
 }
 
 /*
@@ -176,7 +187,7 @@ int ext4_sync_file(struct file *file, int datasync)
         if (!journal) {
                 ret = generic_file_fsync(file, datasync);
                 if (!ret && !list_empty(&inode->i_dentry))
-                        ext4_sync_parent(inode);
+                        ret = ext4_sync_parent(inode);
                 goto out;
         }
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ad8e303c0d29..f2fa5e8a582c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2502,6 +2502,7 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
                  * for partial write.
                  */
                 set_buffer_new(bh);
+                set_buffer_mapped(bh);
         }
         return 0;
 }
@@ -4429,8 +4430,8 @@ void ext4_truncate(struct inode *inode)
         Indirect chain[4];
         Indirect *partial;
         __le32 nr = 0;
-        int n;
-        ext4_lblk_t last_block;
+        int n = 0;
+        ext4_lblk_t last_block, max_block;
         unsigned blocksize = inode->i_sb->s_blocksize;
 
         trace_ext4_truncate_enter(inode);
@@ -4455,14 +4456,18 @@ void ext4_truncate(struct inode *inode)
 
         last_block = (inode->i_size + blocksize-1)
                                         >> EXT4_BLOCK_SIZE_BITS(inode->i_sb);
+        max_block = (EXT4_SB(inode->i_sb)->s_bitmap_maxbytes + blocksize-1)
+                                        >> EXT4_BLOCK_SIZE_BITS(inode->i_sb);
 
         if (inode->i_size & (blocksize - 1))
                 if (ext4_block_truncate_page(handle, mapping, inode->i_size))
                         goto out_stop;
 
-        n = ext4_block_to_path(inode, last_block, offsets, NULL);
-        if (n == 0)
-                goto out_stop;  /* error */
+        if (last_block != max_block) {
+                n = ext4_block_to_path(inode, last_block, offsets, NULL);
+                if (n == 0)
+                        goto out_stop;  /* error */
+        }
 
         /*
          * OK.  This truncate is going to happen.  We add the inode to the
@@ -4493,7 +4498,13 @@ void ext4_truncate(struct inode *inode)
          */
         ei->i_disksize = inode->i_size;
 
-        if (n == 1) {           /* direct blocks */
+        if (last_block == max_block) {
+                /*
+                 * It is unnecessary to free any data blocks if last_block is
+                 * equal to the indirect block limit.
+                 */
+                goto out_unlock;
+        } else if (n == 1) {            /* direct blocks */
                 ext4_free_data(handle, inode, NULL, i_data+offsets[0],
                                i_data + EXT4_NDIR_BLOCKS);
                 goto do_indirects;
@@ -4553,6 +4564,7 @@ do_indirects:
                 ;
         }
 
+out_unlock:
         up_write(&ei->i_data_sem);
         inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
@@ -5398,13 +5410,12 @@ static int ext4_indirect_trans_blocks(struct inode *inode, int nrblocks,
         /* if nrblocks are contiguous */
         if (chunk) {
                 /*
-                 * With N contiguous data blocks, it need at most
-                 * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) indirect blocks
-                 * 2 dindirect blocks
-                 * 1 tindirect block
+                 * With N contiguous data blocks, we need at most
+                 * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) + 1 indirect blocks,
+                 * 2 dindirect blocks, and 1 tindirect block
                  */
-                indirects = nrblocks / EXT4_ADDR_PER_BLOCK(inode->i_sb);
-                return indirects + 3;
+                return DIV_ROUND_UP(nrblocks,
+                                    EXT4_ADDR_PER_BLOCK(inode->i_sb)) + 4;
         }
         /*
          * if nrblocks are not contiguous, worse case, each block touch
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 056474b7b8e0..8553dfb310af 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -242,27 +242,44 @@ static void ext4_put_nojournal(handle_t *handle)
  * journal_end calls result in the superblock being marked dirty, so
  * that sync() will call the filesystem's write_super callback if
  * appropriate.
+ *
+ * To avoid j_barrier hold in userspace when a user calls freeze(),
+ * ext4 prevents a new handle from being started by s_frozen, which
+ * is in an upper layer.
  */
 handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
 {
         journal_t *journal;
+        handle_t  *handle;
 
         if (sb->s_flags & MS_RDONLY)
                 return ERR_PTR(-EROFS);
 
-        vfs_check_frozen(sb, SB_FREEZE_TRANS);
-        /* Special case here: if the journal has aborted behind our
-         * backs (eg. EIO in the commit thread), then we still need to
-         * take the FS itself readonly cleanly. */
         journal = EXT4_SB(sb)->s_journal;
-        if (journal) {
-                if (is_journal_aborted(journal)) {
-                        ext4_abort(sb, "Detected aborted journal");
-                        return ERR_PTR(-EROFS);
-                }
-                return jbd2_journal_start(journal, nblocks);
+        handle = ext4_journal_current_handle();
+
+        /*
+         * If a handle has been started, it should be allowed to
+         * finish, otherwise deadlock could happen between freeze
+         * and others(e.g. truncate) due to the restart of the
+         * journal handle if the filesystem is forzen and active
+         * handles are not stopped.
+         */
+        if (!handle)
+                vfs_check_frozen(sb, SB_FREEZE_TRANS);
+
+        if (!journal)
+                return ext4_get_nojournal();
+        /*
+         * Special case here: if the journal has aborted behind our
+         * backs (eg. EIO in the commit thread), then we still need to
+         * take the FS itself readonly cleanly.
+         */
+        if (is_journal_aborted(journal)) {
+                ext4_abort(sb, "Detected aborted journal");
+                return ERR_PTR(-EROFS);
         }
-        return ext4_get_nojournal();
+        return jbd2_journal_start(journal, nblocks);
 }
 
 /*
@@ -2975,6 +2992,12 @@ static int ext4_register_li_request(struct super_block *sb,
         mutex_unlock(&ext4_li_info->li_list_mtx);
 
         sbi->s_li_request = elr;
+        /*
+         * set elr to NULL here since it has been inserted to
+         * the request_list and the removal and free of it is
+         * handled by ext4_clear_request_list from now on.
+         */
+        elr = NULL;
 
         if (!(ext4_li_info->li_state & EXT4_LAZYINIT_RUNNING)) {
                 ret = ext4_run_lazyinit_thread();
@@ -3385,6 +3408,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         get_random_bytes(&sbi->s_next_generation, sizeof(u32));
         spin_lock_init(&sbi->s_next_gen_lock);
 
+        init_timer(&sbi->s_err_report);
+        sbi->s_err_report.function = print_daily_error_info;
+        sbi->s_err_report.data = (unsigned long) sb;
+
         err = percpu_counter_init(&sbi->s_freeblocks_counter,
                         ext4_count_free_blocks(sb));
         if (!err) {
@@ -3646,9 +3673,6 @@ no_journal:
                  "Opts: %s%s%s", descr, sbi->s_es->s_mount_opts,
                  *sbi->s_es->s_mount_opts ? "; " : "", orig_data);
 
-        init_timer(&sbi->s_err_report);
-        sbi->s_err_report.function = print_daily_error_info;
-        sbi->s_err_report.data = (unsigned long) sb;
         if (es->s_error_count)
                 mod_timer(&sbi->s_err_report, jiffies + 300*HZ); /* 5 minutes */
 
@@ -3672,6 +3696,7 @@ failed_mount_wq:
                 sbi->s_journal = NULL;
         }
 failed_mount3:
+        del_timer(&sbi->s_err_report);
         if (sbi->s_flex_groups) {
                 if (is_vmalloc_addr(sbi->s_flex_groups))
                         vfree(sbi->s_flex_groups);
@@ -4138,6 +4163,11 @@ static int ext4_sync_fs(struct super_block *sb, int wait)
 /*
  * LVM calls this function before a (read-only) snapshot is created.  This
  * gives us a chance to flush the journal completely and mark the fs clean.
+ *
+ * Note that only this function cannot bring a filesystem to be in a clean
+ * state independently, because ext4 prevents a new handle from being started
+ * by @sb->s_frozen, which stays in an upper layer.  It thus needs help from
+ * the upper layer.
  */
 static int ext4_freeze(struct super_block *sb)
 {
@@ -4614,11 +4644,24 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
 
 static int ext4_quota_off(struct super_block *sb, int type)
 {
+        struct inode *inode = sb_dqopt(sb)->files[type];
+        handle_t *handle;
+
         /* Force all delayed allocation blocks to be allocated.
          * Caller already holds s_umount sem */
         if (test_opt(sb, DELALLOC))
                 sync_filesystem(sb);
 
+        /* Update modification times of quota files when userspace can
+         * start looking at them */
+        handle = ext4_journal_start(inode, 1);
+        if (IS_ERR(handle))
+                goto out;
+        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        ext4_mark_inode_dirty(handle, inode);
+        ext4_journal_stop(handle);
+
+out:
         return dquot_quota_off(sb, type);
 }
 
@@ -4714,9 +4757,8 @@ out:
         if (inode->i_size < off + len) {
                 i_size_write(inode, off + len);
                 EXT4_I(inode)->i_disksize = inode->i_size;
+                ext4_mark_inode_dirty(handle, inode);
         }
-        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-        ext4_mark_inode_dirty(handle, inode);
         mutex_unlock(&inode->i_mutex);
         return len;
 }
diff --git a/fs/fhandle.c b/fs/fhandle.c
index bf93ad2bee07..6b088641f5bf 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -7,6 +7,7 @@
 #include <linux/exportfs.h>
 #include <linux/fs_struct.h>
 #include <linux/fsnotify.h>
+#include <linux/personality.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 20af62f4304b..6e28000a4b21 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -105,6 +105,8 @@ static int journal_submit_commit_record(journal_t *journal,
         int ret;
         struct timespec now = current_kernel_time();
 
+        *cbh = NULL;
+
         if (is_journal_aborted(journal))
                 return 0;
 
@@ -806,7 +808,7 @@ wait_for_iobuf:
                 if (err)
                         __jbd2_journal_abort_hard(journal);
         }
-        if (!err && !is_journal_aborted(journal))
+        if (cbh)
                 err = journal_wait_on_commit_record(journal, cbh);
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
                                       JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index aba8ebaec25c..e0ec3db1c395 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2413,10 +2413,12 @@ const char *jbd2_dev_to_name(dev_t device)
         new_dev = kmalloc(sizeof(struct devname_cache), GFP_KERNEL);
         if (!new_dev)
                 return "NODEV-ALLOCFAILURE"; /* Something non-NULL */
+        bd = bdget(device);
         spin_lock(&devname_cache_lock);
         if (devcache[i]) {
                 if (devcache[i]->device == device) {
                         kfree(new_dev);
+                        bdput(bd);
                         ret = devcache[i]->devname;
                         spin_unlock(&devname_cache_lock);
                         return ret;
@@ -2425,7 +2427,6 @@ const char *jbd2_dev_to_name(dev_t device)
         }
         devcache[i] = new_dev;
         devcache[i]->device = device;
-        bd = bdget(device);
         if (bd) {
                 bdevname(bd, devcache[i]->devname);
                 bdput(bd);
diff --git a/fs/namei.c b/fs/namei.c
index e6cd6113872c..54fc993e3027 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -697,6 +697,7 @@ static __always_inline void set_root_rcu(struct nameidata *nd)
                 do {
                         seq = read_seqcount_begin(&fs->seq);
                         nd->root = fs->root;
+                        nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
                 } while (read_seqcount_retry(&fs->seq, seq));
         }
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index 7dba2ed03429..d99bcf59e4c2 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1030,18 +1030,6 @@ const struct seq_operations mounts_op = {
         .show   = show_vfsmnt
 };
 
-static int uuid_is_nil(u8 *uuid)
-{
-        int i;
-        u8  *cp = (u8 *)uuid;
-
-        for (i = 0; i < 16; i++) {
-                if (*cp++)
-                        return 0;
-        }
-        return 1;
-}
-
 static int show_mountinfo(struct seq_file *m, void *v)
 {
         struct proc_mounts *p = m->private;
@@ -1085,10 +1073,6 @@ static int show_mountinfo(struct seq_file *m, void *v)
         if (IS_MNT_UNBINDABLE(mnt))
                 seq_puts(m, " unbindable");
 
-        if (!uuid_is_nil(mnt->mnt_sb->s_uuid))
-                /* print the uuid */
-                seq_printf(m, " uuid:%pU", mnt->mnt_sb->s_uuid);
-
         /* Filesystem specific data */
         seq_puts(m, " - ");
         show_type(m, sb);
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 9166fcb66da2..89fc160fd5b0 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -148,67 +148,64 @@ static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors,
         return pseudoflavor;
 }
 
-static rpc_authflavor_t nfs_negotiate_security(const struct dentry *parent, const struct dentry *dentry)
+static int nfs_negotiate_security(const struct dentry *parent,
+                                  const struct dentry *dentry,
+                                  rpc_authflavor_t *flavor)
 {
-        int status = 0;
         struct page *page;
         struct nfs4_secinfo_flavors *flavors;
         int (*secinfo)(struct inode *, const struct qstr *, struct nfs4_secinfo_flavors *);
-        rpc_authflavor_t flavor = RPC_AUTH_UNIX;
+        int ret = -EPERM;
 
         secinfo = NFS_PROTO(parent->d_inode)->secinfo;
         if (secinfo != NULL) {
                 page = alloc_page(GFP_KERNEL);
                 if (!page) {
-                        status = -ENOMEM;
+                        ret = -ENOMEM;
                         goto out;
                 }
                 flavors = page_address(page);
-                status = secinfo(parent->d_inode, &dentry->d_name, flavors);
-                flavor = nfs_find_best_sec(flavors, dentry->d_inode);
+                ret = secinfo(parent->d_inode, &dentry->d_name, flavors);
+                *flavor = nfs_find_best_sec(flavors, dentry->d_inode);
                 put_page(page);
         }
 
-        return flavor;
-
 out:
-        status = -ENOMEM;
-        return status;
+        return ret;
 }
 
-static rpc_authflavor_t nfs_lookup_with_sec(struct nfs_server *server, struct dentry *parent,
-                                     struct dentry *dentry, struct path *path,
-                                     struct nfs_fh *fh, struct nfs_fattr *fattr)
+static int nfs_lookup_with_sec(struct nfs_server *server, struct dentry *parent,
+                               struct dentry *dentry, struct path *path,
+                               struct nfs_fh *fh, struct nfs_fattr *fattr,
+                               rpc_authflavor_t *flavor)
 {
-        rpc_authflavor_t flavor;
         struct rpc_clnt *clone;
         struct rpc_auth *auth;
         int err;
 
-        flavor = nfs_negotiate_security(parent, path->dentry);
-        if (flavor < 0)
+        err = nfs_negotiate_security(parent, path->dentry, flavor);
+        if (err < 0)
                 goto out;
         clone  = rpc_clone_client(server->client);
-        auth   = rpcauth_create(flavor, clone);
+        auth   = rpcauth_create(*flavor, clone);
         if (!auth) {
-                flavor = -EIO;
+                err = -EIO;
                 goto out_shutdown;
         }
         err = server->nfs_client->rpc_ops->lookup(clone, parent->d_inode,
                                                   &path->dentry->d_name,
                                                   fh, fattr);
-        if (err < 0)
-                flavor = err;
 out_shutdown:
         rpc_shutdown_client(clone);
 out:
-        return flavor;
+        return err;
 }
 #else /* CONFIG_NFS_V4 */
-static inline rpc_authflavor_t nfs_lookup_with_sec(struct nfs_server *server,
-                                     struct dentry *parent, struct dentry *dentry,
-                                     struct path *path, struct nfs_fh *fh,
-                                     struct nfs_fattr *fattr)
+static inline int nfs_lookup_with_sec(struct nfs_server *server,
+                                      struct dentry *parent, struct dentry *dentry,
+                                      struct path *path, struct nfs_fh *fh,
+                                      struct nfs_fattr *fattr,
+                                      rpc_authflavor_t *flavor)
 {
         return -EPERM;
 }
@@ -234,7 +231,7 @@ struct vfsmount *nfs_d_automount(struct path *path)
         struct nfs_fh *fh = NULL;
         struct nfs_fattr *fattr = NULL;
         int err;
-        rpc_authflavor_t flavor = 1;
+        rpc_authflavor_t flavor = RPC_AUTH_UNIX;
 
         dprintk("--> nfs_d_automount()\n");
 
@@ -255,13 +252,8 @@ struct vfsmount *nfs_d_automount(struct path *path)
         err = server->nfs_client->rpc_ops->lookup(server->client, parent->d_inode,
                                                   &path->dentry->d_name,
                                                   fh, fattr);
-        if (err == -EPERM) {
-                flavor = nfs_lookup_with_sec(server, parent, path->dentry, path, fh, fattr);
-                if (flavor < 0)
-                        err = flavor;
-                else
-                        err = 0;
-        }
+        if (err == -EPERM && NFS_PROTO(parent->d_inode)->secinfo != NULL)
+                err = nfs_lookup_with_sec(server, parent, path->dentry, path, fh, fattr, &flavor);
         dput(parent);
         if (err != 0) {
                 mnt = ERR_PTR(err);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index dfd1e6d7e6c3..9bf41eab3e46 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2204,8 +2204,6 @@ static int nfs4_lookup_root_sec(struct nfs_server *server, struct nfs_fh *fhandl
                 goto out;
         }
         ret = nfs4_lookup_root(server, fhandle, info);
-        if (ret < 0)
-                ret = -EAGAIN;
 out:
         return ret;
 }
@@ -2226,7 +2224,7 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
 
         for (i = 0; i < len; i++) {
                 status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);
-                if (status == 0)
+                if (status != -EPERM)
                         break;
         }
         if (status == 0)
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index af0c6279a4a7..e4cbc11a74ab 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -542,11 +542,15 @@ nfs_scan_commit(struct inode *inode, struct list_head *dst, pgoff_t idx_start, u
         if (!nfs_need_commit(nfsi))
                 return 0;
 
+        spin_lock(&inode->i_lock);
         ret = nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
         if (ret > 0)
                 nfsi->ncommit -= ret;
+        spin_unlock(&inode->i_lock);
+
         if (nfs_need_commit(NFS_I(inode)))
                 __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+
         return ret;
 }
 #else
@@ -1483,9 +1487,7 @@ int nfs_commit_inode(struct inode *inode, int how)
         res = nfs_commit_set_lock(NFS_I(inode), may_wait);
         if (res <= 0)
                 goto out_mark_dirty;
-        spin_lock(&inode->i_lock);
         res = nfs_scan_commit(inode, &head, 0, 0);
-        spin_unlock(&inode->i_lock);
         if (res) {
                 int error;
 
diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
index 0c6d81670137..7c831a2731fa 100644
--- a/fs/nfsd/lockd.c
+++ b/fs/nfsd/lockd.c
@@ -38,7 +38,6 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
         exp_readlock();
         nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
         fh_put(&fh);
-        rqstp->rq_client = NULL;
         exp_readunlock();
         /* We return nlm error codes as nlm doesn't know
          * about nfsd, but nfsd does know about nlm..
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 4b36ec3eb8ea..aa309aa93fe8 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -397,10 +397,13 @@ static void unhash_generic_stateid(struct nfs4_stateid *stp)
 
 static void free_generic_stateid(struct nfs4_stateid *stp)
 {
-        int oflag = nfs4_access_bmap_to_omode(stp);
+        int oflag;
 
-        nfs4_file_put_access(stp->st_file, oflag);
-        put_nfs4_file(stp->st_file);
+        if (stp->st_access_bmap) {
+                oflag = nfs4_access_bmap_to_omode(stp);
+                nfs4_file_put_access(stp->st_file, oflag);
+                put_nfs4_file(stp->st_file);
+        }
         kmem_cache_free(stateid_slab, stp);
 }
 
diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
index b10e3540d5b7..ce4f62440425 100644
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
 
         BUG_ON (!data || !frags);
 
+        if (size < 2 * VBLK_SIZE_HEAD) {
+                ldm_error("Value of size is to small.");
+                return false;
+        }
+
         group = get_unaligned_be32(data + 0x08);
         rec   = get_unaligned_be16(data + 0x0C);
         num   = get_unaligned_be16(data + 0x0E);
@@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
                 ldm_error ("A VBLK claims to have %d parts.", num);
                 return false;
         }
+        if (rec >= num) {
+                ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+                return false;
+        }
 
         list_for_each (item, frags) {
                 f = list_entry (item, struct frag, list);
@@ -1334,10 +1343,9 @@ found:
 
         f->map |= (1 << rec);
 
-        if (num > 0) {
-                data += VBLK_SIZE_HEAD;
-                size -= VBLK_SIZE_HEAD;
-        }
+        data += VBLK_SIZE_HEAD;
+        size -= VBLK_SIZE_HEAD;
+
         memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
 
         return true;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index a925bf205497..d3c032f5fa0a 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -442,7 +442,7 @@ EXPORT_SYMBOL(dquot_acquire);
  */
 int dquot_commit(struct dquot *dquot)
 {
-        int ret = 0, ret2 = 0;
+        int ret = 0;
         struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
 
         mutex_lock(&dqopt->dqio_mutex);
@@ -454,15 +454,10 @@ int dquot_commit(struct dquot *dquot)
         spin_unlock(&dq_list_lock);
         /* Inactive dquot can be only if there was error during read/init
          * => we have better not writing it */
-        if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+        if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
                 ret = dqopt->ops[dquot->dq_type]->commit_dqblk(dquot);
-                if (info_dirty(&dqopt->info[dquot->dq_type])) {
-                        ret2 = dqopt->ops[dquot->dq_type]->write_file_info(
-                                                dquot->dq_sb, dquot->dq_type);
-                }
-                if (ret >= 0)
-                        ret = ret2;
-        }
+        else
+                ret = -EIO;
 out_sem:
         mutex_unlock(&dqopt->dqio_mutex);
         return ret;
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index 9eead2c796b7..fbb0b478a346 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -112,6 +112,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
                 SetPageDirty(page);
 
                 unlock_page(page);
+                put_page(page);
         }
 
         return 0;
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 919f0de29d8f..e6493cac193d 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -23,6 +23,12 @@
 #ifndef __UBIFS_DEBUG_H__
 #define __UBIFS_DEBUG_H__
 
+/* Checking helper functions */
+typedef int (*dbg_leaf_callback)(struct ubifs_info *c,
+                                 struct ubifs_zbranch *zbr, void *priv);
+typedef int (*dbg_znode_callback)(struct ubifs_info *c,
+                                  struct ubifs_znode *znode, void *priv);
+
 #ifdef CONFIG_UBIFS_FS_DEBUG
 
 /**
@@ -270,11 +276,6 @@ void dbg_dump_tnc(struct ubifs_info *c);
 void dbg_dump_index(struct ubifs_info *c);
 void dbg_dump_lpt_lebs(const struct ubifs_info *c);
 
-/* Checking helper functions */
-typedef int (*dbg_leaf_callback)(struct ubifs_info *c,
-                                 struct ubifs_zbranch *zbr, void *priv);
-typedef int (*dbg_znode_callback)(struct ubifs_info *c,
-                                  struct ubifs_znode *znode, void *priv);
 int dbg_walk_index(struct ubifs_info *c, dbg_leaf_callback leaf_cb,
                    dbg_znode_callback znode_cb, void *priv);
 
@@ -295,7 +296,6 @@ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size);
 int dbg_check_filesystem(struct ubifs_info *c);
 void dbg_check_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat,
                     int add_pos);
-int dbg_check_lprops(struct ubifs_info *c);
 int dbg_check_lpt_nodes(struct ubifs_info *c, struct ubifs_cnode *cnode,
                         int row, int col);
 int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
@@ -401,58 +401,94 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
 #define DBGKEY(key)  ((char *)(key))
 #define DBGKEY1(key) ((char *)(key))
 
-#define ubifs_debugging_init(c)                0
-#define ubifs_debugging_exit(c)                ({})
-
-#define dbg_ntype(type)                        ""
-#define dbg_cstate(cmt_state)                  ""
-#define dbg_jhead(jhead)                       ""
-#define dbg_get_key_dump(c, key)               ({})
-#define dbg_dump_inode(c, inode)               ({})
-#define dbg_dump_node(c, node)                 ({})
-#define dbg_dump_lpt_node(c, node, lnum, offs) ({})
-#define dbg_dump_budget_req(req)               ({})
-#define dbg_dump_lstats(lst)                   ({})
-#define dbg_dump_budg(c)                       ({})
-#define dbg_dump_lprop(c, lp)                  ({})
-#define dbg_dump_lprops(c)                     ({})
-#define dbg_dump_lpt_info(c)                   ({})
-#define dbg_dump_leb(c, lnum)                  ({})
-#define dbg_dump_znode(c, znode)               ({})
-#define dbg_dump_heap(c, heap, cat)            ({})
-#define dbg_dump_pnode(c, pnode, parent, iip)  ({})
-#define dbg_dump_tnc(c)                        ({})
-#define dbg_dump_index(c)                      ({})
-#define dbg_dump_lpt_lebs(c)                   ({})
-
-#define dbg_walk_index(c, leaf_cb, znode_cb, priv) 0
-#define dbg_old_index_check_init(c, zroot)         0
-#define dbg_save_space_info(c)                     ({})
-#define dbg_check_space_info(c)                    0
-#define dbg_check_old_index(c, zroot)              0
-#define dbg_check_cats(c)                          0
-#define dbg_check_ltab(c)                          0
-#define dbg_chk_lpt_free_spc(c)                    0
-#define dbg_chk_lpt_sz(c, action, len)             0
-#define dbg_check_synced_i_size(inode)             0
-#define dbg_check_dir_size(c, dir)                 0
-#define dbg_check_tnc(c, x)                        0
-#define dbg_check_idx_size(c, idx_size)            0
-#define dbg_check_filesystem(c)                    0
-#define dbg_check_heap(c, heap, cat, add_pos)      ({})
-#define dbg_check_lprops(c)                        0
-#define dbg_check_lpt_nodes(c, cnode, row, col)    0
-#define dbg_check_inode_size(c, inode, size)       0
-#define dbg_check_data_nodes_order(c, head)        0
-#define dbg_check_nondata_nodes_order(c, head)     0
-#define dbg_force_in_the_gaps_enabled              0
-#define dbg_force_in_the_gaps()                    0
-#define dbg_failure_mode                           0
-
-#define dbg_debugfs_init()                         0
-#define dbg_debugfs_exit()
-#define dbg_debugfs_init_fs(c)                     0
-#define dbg_debugfs_exit_fs(c)                     0
+static inline int ubifs_debugging_init(struct ubifs_info *c)      { return 0; }
+static inline void ubifs_debugging_exit(struct ubifs_info *c)     { return; }
+static inline const char *dbg_ntype(int type)                     { return ""; }
+static inline const char *dbg_cstate(int cmt_state)               { return ""; }
+static inline const char *dbg_jhead(int jhead)                    { return ""; }
+static inline const char *
+dbg_get_key_dump(const struct ubifs_info *c,
+                 const union ubifs_key *key)                      { return ""; }
+static inline void dbg_dump_inode(const struct ubifs_info *c,
+                                  const struct inode *inode)      { return; }
+static inline void dbg_dump_node(const struct ubifs_info *c,
+                                 const void *node)                { return; }
+static inline void dbg_dump_lpt_node(const struct ubifs_info *c,
+                                     void *node, int lnum,
+                                     int offs)                    { return; }
+static inline void
+dbg_dump_budget_req(const struct ubifs_budget_req *req)           { return; }
+static inline void
+dbg_dump_lstats(const struct ubifs_lp_stats *lst)                 { return; }
+static inline void dbg_dump_budg(struct ubifs_info *c)            { return; }
+static inline void dbg_dump_lprop(const struct ubifs_info *c,
+                                  const struct ubifs_lprops *lp)  { return; }
+static inline void dbg_dump_lprops(struct ubifs_info *c)          { return; }
+static inline void dbg_dump_lpt_info(struct ubifs_info *c)        { return; }
+static inline void dbg_dump_leb(const struct ubifs_info *c,
+                                int lnum)                         { return; }
+static inline void
+dbg_dump_znode(const struct ubifs_info *c,
+               const struct ubifs_znode *znode)                   { return; }
+static inline void dbg_dump_heap(struct ubifs_info *c,
+                                 struct ubifs_lpt_heap *heap,
+                                 int cat)                         { return; }
+static inline void dbg_dump_pnode(struct ubifs_info *c,
+                                  struct ubifs_pnode *pnode,
+                                  struct ubifs_nnode *parent,
+                                  int iip)                        { return; }
+static inline void dbg_dump_tnc(struct ubifs_info *c)             { return; }
+static inline void dbg_dump_index(struct ubifs_info *c)           { return; }
+static inline void dbg_dump_lpt_lebs(const struct ubifs_info *c)  { return; }
+
+static inline int dbg_walk_index(struct ubifs_info *c,
+                                 dbg_leaf_callback leaf_cb,
+                                 dbg_znode_callback znode_cb,
+                                 void *priv)                      { return 0; }
+static inline void dbg_save_space_info(struct ubifs_info *c)      { return; }
+static inline int dbg_check_space_info(struct ubifs_info *c)      { return 0; }
+static inline int dbg_check_lprops(struct ubifs_info *c)          { return 0; }
+static inline int
+dbg_old_index_check_init(struct ubifs_info *c,
+                         struct ubifs_zbranch *zroot)             { return 0; }
+static inline int
+dbg_check_old_index(struct ubifs_info *c,
+                    struct ubifs_zbranch *zroot)                  { return 0; }
+static inline int dbg_check_cats(struct ubifs_info *c)            { return 0; }
+static inline int dbg_check_ltab(struct ubifs_info *c)            { return 0; }
+static inline int dbg_chk_lpt_free_spc(struct ubifs_info *c)      { return 0; }
+static inline int dbg_chk_lpt_sz(struct ubifs_info *c,
+                                 int action, int len)             { return 0; }
+static inline int dbg_check_synced_i_size(struct inode *inode)    { return 0; }
+static inline int dbg_check_dir_size(struct ubifs_info *c,
+                                     const struct inode *dir)     { return 0; }
+static inline int dbg_check_tnc(struct ubifs_info *c, int extra)  { return 0; }
+static inline int dbg_check_idx_size(struct ubifs_info *c,
+                                     long long idx_size)          { return 0; }
+static inline int dbg_check_filesystem(struct ubifs_info *c)      { return 0; }
+static inline void dbg_check_heap(struct ubifs_info *c,
+                                  struct ubifs_lpt_heap *heap,
+                                  int cat, int add_pos)           { return; }
+static inline int dbg_check_lpt_nodes(struct ubifs_info *c,
+        struct ubifs_cnode *cnode, int row, int col)              { return 0; }
+static inline int dbg_check_inode_size(struct ubifs_info *c,
+                                       const struct inode *inode,
+                                       loff_t size)               { return 0; }
+static inline int
+dbg_check_data_nodes_order(struct ubifs_info *c,
+                           struct list_head *head)                { return 0; }
+static inline int
+dbg_check_nondata_nodes_order(struct ubifs_info *c,
+                              struct list_head *head)             { return 0; }
+
+static inline int dbg_force_in_the_gaps(void)                     { return 0; }
+#define dbg_force_in_the_gaps_enabled 0
+#define dbg_failure_mode              0
+
+static inline int dbg_debugfs_init(void)                          { return 0; }
+static inline void dbg_debugfs_exit(void)                         { return; }
+static inline int dbg_debugfs_init_fs(struct ubifs_info *c)       { return 0; }
+static inline int dbg_debugfs_exit_fs(struct ubifs_info *c)       { return 0; }
 
 #endif /* !CONFIG_UBIFS_FS_DEBUG */
 #endif /* !__UBIFS_DEBUG_H__ */
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 28be1e6a65e8..b286db79c686 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -1312,6 +1312,9 @@ int ubifs_fsync(struct file *file, int datasync)
 
         dbg_gen("syncing inode %lu", inode->i_ino);
 
+        if (inode->i_sb->s_flags & MS_RDONLY)
+                return 0;
+
         /*
          * VFS has already synchronized dirty pages for this inode. Synchronize
          * the inode unless this is a 'datasync()' call.
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 5ea402023ebd..9ef9ed2cfe2e 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -293,7 +293,6 @@ xfs_buf_allocate_memory(
         size_t                  nbytes, offset;
         gfp_t                   gfp_mask = xb_to_gfp(flags);
         unsigned short          page_count, i;
-        pgoff_t                 first;
         xfs_off_t               end;
         int                     error;
 
@@ -333,7 +332,6 @@ use_alloc_page:
                 return error;
 
         offset = bp->b_offset;
-        first = bp->b_file_offset >> PAGE_SHIFT;
         bp->b_flags |= _XBF_PAGES;
 
         for (i = 0; i < bp->b_page_count; i++) {
@@ -657,8 +655,6 @@ xfs_buf_readahead(
         xfs_off_t               ioff,
         size_t                  isize)
 {
-        struct backing_dev_info *bdi;
-
         if (bdi_read_congested(target->bt_bdi))
                 return;
 
@@ -919,8 +915,6 @@ xfs_buf_lock(
 
         if (atomic_read(&bp->b_pin_count) && (bp->b_flags & XBF_STALE))
                 xfs_log_force(bp->b_target->bt_mount, 0);
-        if (atomic_read(&bp->b_io_remaining))
-                blk_flush_plug(current);
         down(&bp->b_sema);
         XB_SET_OWNER(bp);
 
@@ -1309,8 +1303,6 @@ xfs_buf_iowait(
 {
         trace_xfs_buf_iowait(bp, _RET_IP_);
 
-        if (atomic_read(&bp->b_io_remaining))
-                blk_flush_plug(current);
         wait_for_completion(&bp->b_iowait);
 
         trace_xfs_buf_iowait_done(bp, _RET_IP_);
@@ -1747,8 +1739,8 @@ xfsbufd(
         do {
                 long    age = xfs_buf_age_centisecs * msecs_to_jiffies(10);
                 long    tout = xfs_buf_timer_centisecs * msecs_to_jiffies(10);
-                int     count = 0;
                 struct list_head tmp;
+                struct blk_plug plug;
 
                 if (unlikely(freezing(current))) {
                         set_bit(XBT_FORCE_SLEEP, &target->bt_flags);
@@ -1764,16 +1756,15 @@ xfsbufd(
 
                 xfs_buf_delwri_split(target, &tmp, age);
                 list_sort(NULL, &tmp, xfs_buf_cmp);
+
+                blk_start_plug(&plug);
                 while (!list_empty(&tmp)) {
                         struct xfs_buf *bp;
                         bp = list_first_entry(&tmp, struct xfs_buf, b_list);
                         list_del_init(&bp->b_list);
                         xfs_bdstrat_cb(bp);
-                        count++;
                 }
-                if (count)
-                        blk_flush_plug(current);
-
+                blk_finish_plug(&plug);
         } while (!kthread_should_stop());
 
         return 0;
@@ -1793,6 +1784,7 @@ xfs_flush_buftarg(
         int             pincount = 0;
         LIST_HEAD(tmp_list);
         LIST_HEAD(wait_list);
+        struct blk_plug plug;
 
         xfs_buf_runall_queues(xfsconvertd_workqueue);
         xfs_buf_runall_queues(xfsdatad_workqueue);
@@ -1807,6 +1799,8 @@ xfs_flush_buftarg(
          * we do that after issuing all the IO.
          */
         list_sort(NULL, &tmp_list, xfs_buf_cmp);
+
+        blk_start_plug(&plug);
         while (!list_empty(&tmp_list)) {
                 bp = list_first_entry(&tmp_list, struct xfs_buf, b_list);
                 ASSERT(target == bp->b_target);
@@ -1817,10 +1811,10 @@ xfs_flush_buftarg(
                 }
                 xfs_bdstrat_cb(bp);
         }
+        blk_finish_plug(&plug);
 
         if (wait) {
-                /* Expedite and wait for IO to complete. */
-                blk_flush_plug(current);
+                /* Wait for IO to complete. */
                 while (!list_empty(&wait_list)) {
                         bp = list_first_entry(&wait_list, struct xfs_buf, b_list);
 
diff --git a/fs/xfs/linux-2.6/xfs_message.c b/fs/xfs/linux-2.6/xfs_message.c
index 508e06fd7d1e..3ca795609113 100644
--- a/fs/xfs/linux-2.6/xfs_message.c
+++ b/fs/xfs/linux-2.6/xfs_message.c
@@ -28,53 +28,47 @@
 /*
  * XFS logging functions
  */
-static int
+static void
 __xfs_printk(
         const char              *level,
         const struct xfs_mount  *mp,
         struct va_format        *vaf)
 {
         if (mp && mp->m_fsname)
-                return printk("%sXFS (%s): %pV\n", level, mp->m_fsname, vaf);
-        return printk("%sXFS: %pV\n", level, vaf);
+                printk("%sXFS (%s): %pV\n", level, mp->m_fsname, vaf);
+        printk("%sXFS: %pV\n", level, vaf);
 }
 
-int xfs_printk(
+void xfs_printk(
         const char              *level,
         const struct xfs_mount  *mp,
         const char              *fmt, ...)
 {
         struct va_format        vaf;
         va_list                 args;
-        int                      r;
 
         va_start(args, fmt);
 
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        r = __xfs_printk(level, mp, &vaf);
+        __xfs_printk(level, mp, &vaf);
         va_end(args);
-
-        return r;
 }
 
 #define define_xfs_printk_level(func, kern_level)               \
-int func(const struct xfs_mount *mp, const char *fmt, ...)      \
+void func(const struct xfs_mount *mp, const char *fmt, ...)     \
 {                                                               \
         struct va_format        vaf;                            \
         va_list                 args;                           \
-        int                     r;                              \
                                                                 \
         va_start(args, fmt);                                    \
                                                                 \
         vaf.fmt = fmt;                                          \
         vaf.va = &args;                                         \
                                                                 \
-        r = __xfs_printk(kern_level, mp, &vaf);                 \
+        __xfs_printk(kern_level, mp, &vaf);                     \
         va_end(args);                                           \
-                                                                \
-        return r;                                               \
 }                                                               \
 
 define_xfs_printk_level(xfs_emerg, KERN_EMERG);
@@ -88,7 +82,7 @@ define_xfs_printk_level(xfs_info, KERN_INFO);
 define_xfs_printk_level(xfs_debug, KERN_DEBUG);
 #endif
 
-int
+void
 xfs_alert_tag(
         const struct xfs_mount  *mp,
         int                     panic_tag,
@@ -97,7 +91,6 @@ xfs_alert_tag(
         struct va_format        vaf;
         va_list                 args;
         int                     do_panic = 0;
-        int                     r;
 
         if (xfs_panic_mask && (xfs_panic_mask & panic_tag)) {
                 xfs_printk(KERN_ALERT, mp,
@@ -110,12 +103,10 @@ xfs_alert_tag(
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        r = __xfs_printk(KERN_ALERT, mp, &vaf);
+        __xfs_printk(KERN_ALERT, mp, &vaf);
         va_end(args);
 
         BUG_ON(do_panic);
-
-        return r;
 }
 
 void
diff --git a/fs/xfs/linux-2.6/xfs_message.h b/fs/xfs/linux-2.6/xfs_message.h
index e77ffa16745b..f1b3fc1b6c4e 100644
--- a/fs/xfs/linux-2.6/xfs_message.h
+++ b/fs/xfs/linux-2.6/xfs_message.h
@@ -3,32 +3,34 @@
 
 struct xfs_mount;
 
-extern int xfs_printk(const char *level, const struct xfs_mount *mp,
+extern void xfs_printk(const char *level, const struct xfs_mount *mp,
                       const char *fmt, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern int xfs_emerg(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_emerg(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_alert(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_alert(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_alert_tag(const struct xfs_mount *mp, int tag,
+extern void xfs_alert_tag(const struct xfs_mount *mp, int tag,
                          const char *fmt, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern int xfs_crit(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_crit(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_err(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_err(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_warn(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_warn(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_notice(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_notice(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_info(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_info(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
 
 #ifdef DEBUG
-extern int xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
 #else
-#define xfs_debug(mp, fmt, ...) (0)
+static inline void xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
+{
+}
 #endif
 
 extern void assfail(char *expr, char *f, int l);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 1ba5c451da36..b38e58d02299 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -816,75 +816,6 @@ xfs_setup_devices(
         return 0;
 }
 
-/*
- * XFS AIL push thread support
- */
-void
-xfsaild_wakeup(
-        struct xfs_ail          *ailp,
-        xfs_lsn_t               threshold_lsn)
-{
-        /* only ever move the target forwards */
-        if (XFS_LSN_CMP(threshold_lsn, ailp->xa_target) > 0) {
-                ailp->xa_target = threshold_lsn;
-                wake_up_process(ailp->xa_task);
-        }
-}
-
-STATIC int
-xfsaild(
-        void    *data)
-{
-        struct xfs_ail  *ailp = data;
-        xfs_lsn_t       last_pushed_lsn = 0;
-        long            tout = 0; /* milliseconds */
-
-        while (!kthread_should_stop()) {
-                /*
-                 * for short sleeps indicating congestion, don't allow us to
-                 * get woken early. Otherwise all we do is bang on the AIL lock
-                 * without making progress.
-                 */
-                if (tout && tout <= 20)
-                        __set_current_state(TASK_KILLABLE);
-                else
-                        __set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(tout ?
-                                 msecs_to_jiffies(tout) : MAX_SCHEDULE_TIMEOUT);
-
-                /* swsusp */
-                try_to_freeze();
-
-                ASSERT(ailp->xa_mount->m_log);
-                if (XFS_FORCED_SHUTDOWN(ailp->xa_mount))
-                        continue;
-
-                tout = xfsaild_push(ailp, &last_pushed_lsn);
-        }
-
-        return 0;
-}       /* xfsaild */
-
-int
-xfsaild_start(
-        struct xfs_ail  *ailp)
-{
-        ailp->xa_target = 0;
-        ailp->xa_task = kthread_run(xfsaild, ailp, "xfsaild/%s",
-                                    ailp->xa_mount->m_fsname);
-        if (IS_ERR(ailp->xa_task))
-                return -PTR_ERR(ailp->xa_task);
-        return 0;
-}
-
-void
-xfsaild_stop(
-        struct xfs_ail  *ailp)
-{
-        kthread_stop(ailp->xa_task);
-}
-
-
 /* Catch misguided souls that try to use this interface on XFS */
 STATIC struct inode *
 xfs_fs_alloc_inode(
@@ -1191,22 +1122,12 @@ xfs_fs_sync_fs(
                 return -error;
 
         if (laptop_mode) {
-                int     prev_sync_seq = mp->m_sync_seq;
-
                 /*
                  * The disk must be active because we're syncing.
                  * We schedule xfssyncd now (now that the disk is
                  * active) instead of later (when it might not be).
                  */
-                wake_up_process(mp->m_sync_task);
-                /*
-                 * We have to wait for the sync iteration to complete.
-                 * If we don't, the disk activity caused by the sync
-                 * will come after the sync is completed, and that
-                 * triggers another sync from laptop mode.
-                 */
-                wait_event(mp->m_wait_single_sync_task,
-                                mp->m_sync_seq != prev_sync_seq);
+                flush_delayed_work_sync(&mp->m_sync_work);
         }
 
         return 0;
@@ -1490,9 +1411,6 @@ xfs_fs_fill_super(
         spin_lock_init(&mp->m_sb_lock);
         mutex_init(&mp->m_growlock);
         atomic_set(&mp->m_active_trans, 0);
-        INIT_LIST_HEAD(&mp->m_sync_list);
-        spin_lock_init(&mp->m_sync_lock);
-        init_waitqueue_head(&mp->m_wait_single_sync_task);
 
         mp->m_super = sb;
         sb->s_fs_info = mp;
@@ -1799,6 +1717,38 @@ xfs_destroy_zones(void)
 }
 
 STATIC int __init
+xfs_init_workqueues(void)
+{
+        /*
+         * max_active is set to 8 to give enough concurency to allow
+         * multiple work operations on each CPU to run. This allows multiple
+         * filesystems to be running sync work concurrently, and scales with
+         * the number of CPUs in the system.
+         */
+        xfs_syncd_wq = alloc_workqueue("xfssyncd", WQ_CPU_INTENSIVE, 8);
+        if (!xfs_syncd_wq)
+                goto out;
+
+        xfs_ail_wq = alloc_workqueue("xfsail", WQ_CPU_INTENSIVE, 8);
+        if (!xfs_ail_wq)
+                goto out_destroy_syncd;
+
+        return 0;
+
+out_destroy_syncd:
+        destroy_workqueue(xfs_syncd_wq);
+out:
+        return -ENOMEM;
+}
+
+STATIC void
+xfs_destroy_workqueues(void)
+{
+        destroy_workqueue(xfs_ail_wq);
+        destroy_workqueue(xfs_syncd_wq);
+}
+
+STATIC int __init
 init_xfs_fs(void)
 {
         int                     error;
@@ -1813,10 +1763,14 @@ init_xfs_fs(void)
         if (error)
                 goto out;
 
-        error = xfs_mru_cache_init();
+        error = xfs_init_workqueues();
         if (error)
                 goto out_destroy_zones;
 
+        error = xfs_mru_cache_init();
+        if (error)
+                goto out_destroy_wq;
+
         error = xfs_filestream_init();
         if (error)
                 goto out_mru_cache_uninit;
@@ -1833,6 +1787,10 @@ init_xfs_fs(void)
         if (error)
                 goto out_cleanup_procfs;
 
+        error = xfs_init_workqueues();
+        if (error)
+                goto out_sysctl_unregister;
+
         vfs_initquota();
 
         error = register_filesystem(&xfs_fs_type);
@@ -1850,6 +1808,8 @@ init_xfs_fs(void)
         xfs_filestream_uninit();
  out_mru_cache_uninit:
         xfs_mru_cache_uninit();
+ out_destroy_wq:
+        xfs_destroy_workqueues();
  out_destroy_zones:
         xfs_destroy_zones();
  out:
@@ -1866,6 +1826,7 @@ exit_xfs_fs(void)
         xfs_buf_terminate();
         xfs_filestream_uninit();
         xfs_mru_cache_uninit();
+        xfs_destroy_workqueues();
         xfs_destroy_zones();
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 9cf35a688f53..e4f9c1b0836c 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -22,6 +22,7 @@
 #include "xfs_log.h"
 #include "xfs_inum.h"
 #include "xfs_trans.h"
+#include "xfs_trans_priv.h"
 #include "xfs_sb.h"
 #include "xfs_ag.h"
 #include "xfs_mount.h"
@@ -39,6 +40,8 @@
 #include <linux/kthread.h>
 #include <linux/freezer.h>
 
+struct workqueue_struct *xfs_syncd_wq;  /* sync workqueue */
+
 /*
  * The inode lookup is done in batches to keep the amount of lock traffic and
  * radix tree lookups to a minimum. The batch size is a trade off between
@@ -431,62 +434,12 @@ xfs_quiesce_attr(
         xfs_unmountfs_writesb(mp);
 }
 
-/*
- * Enqueue a work item to be picked up by the vfs xfssyncd thread.
- * Doing this has two advantages:
- * - It saves on stack space, which is tight in certain situations
- * - It can be used (with care) as a mechanism to avoid deadlocks.
- * Flushing while allocating in a full filesystem requires both.
- */
-STATIC void
-xfs_syncd_queue_work(
-        struct xfs_mount *mp,
-        void            *data,
-        void            (*syncer)(struct xfs_mount *, void *),
-        struct completion *completion)
-{
-        struct xfs_sync_work *work;
-
-        work = kmem_alloc(sizeof(struct xfs_sync_work), KM_SLEEP);
-        INIT_LIST_HEAD(&work->w_list);
-        work->w_syncer = syncer;
-        work->w_data = data;
-        work->w_mount = mp;
-        work->w_completion = completion;
-        spin_lock(&mp->m_sync_lock);
-        list_add_tail(&work->w_list, &mp->m_sync_list);
-        spin_unlock(&mp->m_sync_lock);
-        wake_up_process(mp->m_sync_task);
-}
-
-/*
- * Flush delayed allocate data, attempting to free up reserved space
- * from existing allocations.  At this point a new allocation attempt
- * has failed with ENOSPC and we are in the process of scratching our
- * heads, looking about for more room...
- */
-STATIC void
-xfs_flush_inodes_work(
-        struct xfs_mount *mp,
-        void            *arg)
-{
-        struct inode    *inode = arg;
-        xfs_sync_data(mp, SYNC_TRYLOCK);
-        xfs_sync_data(mp, SYNC_TRYLOCK | SYNC_WAIT);
-        iput(inode);
-}
-
-void
-xfs_flush_inodes(
-        xfs_inode_t     *ip)
+static void
+xfs_syncd_queue_sync(
+        struct xfs_mount        *mp)
 {
-        struct inode    *inode = VFS_I(ip);
-        DECLARE_COMPLETION_ONSTACK(completion);
-
-        igrab(inode);
-        xfs_syncd_queue_work(ip->i_mount, inode, xfs_flush_inodes_work, &completion);
-        wait_for_completion(&completion);
-        xfs_log_force(ip->i_mount, XFS_LOG_SYNC);
+        queue_delayed_work(xfs_syncd_wq, &mp->m_sync_work,
+                                msecs_to_jiffies(xfs_syncd_centisecs * 10));
 }
 
 /*
@@ -496,9 +449,10 @@ xfs_flush_inodes(
  */
 STATIC void
 xfs_sync_worker(
-        struct xfs_mount *mp,
-        void            *unused)
+        struct work_struct *work)
 {
+        struct xfs_mount *mp = container_of(to_delayed_work(work),
+                                        struct xfs_mount, m_sync_work);
         int             error;
 
         if (!(mp->m_flags & XFS_MOUNT_RDONLY)) {
@@ -508,73 +462,106 @@ xfs_sync_worker(
                         error = xfs_fs_log_dummy(mp);
                 else
                         xfs_log_force(mp, 0);
-                xfs_reclaim_inodes(mp, 0);
                 error = xfs_qm_sync(mp, SYNC_TRYLOCK);
+
+                /* start pushing all the metadata that is currently dirty */
+                xfs_ail_push_all(mp->m_ail);
         }
-        mp->m_sync_seq++;
-        wake_up(&mp->m_wait_single_sync_task);
+
+        /* queue us up again */
+        xfs_syncd_queue_sync(mp);
 }
 
-STATIC int
-xfssyncd(
-        void                    *arg)
+/*
+ * Queue a new inode reclaim pass if there are reclaimable inodes and there
+ * isn't a reclaim pass already in progress. By default it runs every 5s based
+ * on the xfs syncd work default of 30s. Perhaps this should have it's own
+ * tunable, but that can be done if this method proves to be ineffective or too
+ * aggressive.
+ */
+static void
+xfs_syncd_queue_reclaim(
+        struct xfs_mount        *mp)
 {
-        struct xfs_mount        *mp = arg;
-        long                    timeleft;
-        xfs_sync_work_t         *work, *n;
-        LIST_HEAD               (tmp);
-
-        set_freezable();
-        timeleft = xfs_syncd_centisecs * msecs_to_jiffies(10);
-        for (;;) {
-                if (list_empty(&mp->m_sync_list))
-                        timeleft = schedule_timeout_interruptible(timeleft);
-                /* swsusp */
-                try_to_freeze();
-                if (kthread_should_stop() && list_empty(&mp->m_sync_list))
-                        break;
 
-                spin_lock(&mp->m_sync_lock);
-                /*
-                 * We can get woken by laptop mode, to do a sync -
-                 * that's the (only!) case where the list would be
-                 * empty with time remaining.
-                 */
-                if (!timeleft || list_empty(&mp->m_sync_list)) {
-                        if (!timeleft)
-                                timeleft = xfs_syncd_centisecs *
-                                                        msecs_to_jiffies(10);
-                        INIT_LIST_HEAD(&mp->m_sync_work.w_list);
-                        list_add_tail(&mp->m_sync_work.w_list,
-                                        &mp->m_sync_list);
-                }
-                list_splice_init(&mp->m_sync_list, &tmp);
-                spin_unlock(&mp->m_sync_lock);
+        /*
+         * We can have inodes enter reclaim after we've shut down the syncd
+         * workqueue during unmount, so don't allow reclaim work to be queued
+         * during unmount.
+         */
+        if (!(mp->m_super->s_flags & MS_ACTIVE))
+                return;
 
-                list_for_each_entry_safe(work, n, &tmp, w_list) {
-                        (*work->w_syncer)(mp, work->w_data);
-                        list_del(&work->w_list);
-                        if (work == &mp->m_sync_work)
-                                continue;
-                        if (work->w_completion)
-                                complete(work->w_completion);
-                        kmem_free(work);
-                }
+        rcu_read_lock();
+        if (radix_tree_tagged(&mp->m_perag_tree, XFS_ICI_RECLAIM_TAG)) {
+                queue_delayed_work(xfs_syncd_wq, &mp->m_reclaim_work,
+                        msecs_to_jiffies(xfs_syncd_centisecs / 6 * 10));
         }
+        rcu_read_unlock();
+}
 
-        return 0;
+/*
+ * This is a fast pass over the inode cache to try to get reclaim moving on as
+ * many inodes as possible in a short period of time. It kicks itself every few
+ * seconds, as well as being kicked by the inode cache shrinker when memory
+ * goes low. It scans as quickly as possible avoiding locked inodes or those
+ * already being flushed, and once done schedules a future pass.
+ */
+STATIC void
+xfs_reclaim_worker(
+        struct work_struct *work)
+{
+        struct xfs_mount *mp = container_of(to_delayed_work(work),
+                                        struct xfs_mount, m_reclaim_work);
+
+        xfs_reclaim_inodes(mp, SYNC_TRYLOCK);
+        xfs_syncd_queue_reclaim(mp);
+}
+
+/*
+ * Flush delayed allocate data, attempting to free up reserved space
+ * from existing allocations.  At this point a new allocation attempt
+ * has failed with ENOSPC and we are in the process of scratching our
+ * heads, looking about for more room.
+ *
+ * Queue a new data flush if there isn't one already in progress and
+ * wait for completion of the flush. This means that we only ever have one
+ * inode flush in progress no matter how many ENOSPC events are occurring and
+ * so will prevent the system from bogging down due to every concurrent
+ * ENOSPC event scanning all the active inodes in the system for writeback.
+ */
+void
+xfs_flush_inodes(
+        struct xfs_inode        *ip)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+
+        queue_work(xfs_syncd_wq, &mp->m_flush_work);
+        flush_work_sync(&mp->m_flush_work);
+}
+
+STATIC void
+xfs_flush_worker(
+        struct work_struct *work)
+{
+        struct xfs_mount *mp = container_of(work,
+                                        struct xfs_mount, m_flush_work);
+
+        xfs_sync_data(mp, SYNC_TRYLOCK);
+        xfs_sync_data(mp, SYNC_TRYLOCK | SYNC_WAIT);
 }
 
 int
 xfs_syncd_init(
         struct xfs_mount        *mp)
 {
-        mp->m_sync_work.w_syncer = xfs_sync_worker;
-        mp->m_sync_work.w_mount = mp;
-        mp->m_sync_work.w_completion = NULL;
-        mp->m_sync_task = kthread_run(xfssyncd, mp, "xfssyncd/%s", mp->m_fsname);
-        if (IS_ERR(mp->m_sync_task))
-                return -PTR_ERR(mp->m_sync_task);
+        INIT_WORK(&mp->m_flush_work, xfs_flush_worker);
+        INIT_DELAYED_WORK(&mp->m_sync_work, xfs_sync_worker);
+        INIT_DELAYED_WORK(&mp->m_reclaim_work, xfs_reclaim_worker);
+
+        xfs_syncd_queue_sync(mp);
+        xfs_syncd_queue_reclaim(mp);
+
         return 0;
 }
 
@@ -582,7 +569,9 @@ void
 xfs_syncd_stop(
         struct xfs_mount        *mp)
 {
-        kthread_stop(mp->m_sync_task);
+        cancel_delayed_work_sync(&mp->m_sync_work);
+        cancel_delayed_work_sync(&mp->m_reclaim_work);
+        cancel_work_sync(&mp->m_flush_work);
 }
 
 void
@@ -601,6 +590,10 @@ __xfs_inode_set_reclaim_tag(
                                 XFS_INO_TO_AGNO(ip->i_mount, ip->i_ino),
                                 XFS_ICI_RECLAIM_TAG);
                 spin_unlock(&ip->i_mount->m_perag_lock);
+
+                /* schedule periodic background inode reclaim */
+                xfs_syncd_queue_reclaim(ip->i_mount);
+
                 trace_xfs_perag_set_reclaim(ip->i_mount, pag->pag_agno,
                                                         -1, _RET_IP_);
         }
@@ -1017,7 +1010,13 @@ xfs_reclaim_inodes(
 }
 
 /*
- * Shrinker infrastructure.
+ * Inode cache shrinker.
+ *
+ * When called we make sure that there is a background (fast) inode reclaim in
+ * progress, while we will throttle the speed of reclaim via doiing synchronous
+ * reclaim of inodes. That means if we come across dirty inodes, we wait for
+ * them to be cleaned, which we hope will not be very long due to the
+ * background walker having already kicked the IO off on those dirty inodes.
  */
 static int
 xfs_reclaim_inode_shrink(
@@ -1032,10 +1031,15 @@ xfs_reclaim_inode_shrink(
 
         mp = container_of(shrink, struct xfs_mount, m_inode_shrink);
         if (nr_to_scan) {
+                /* kick background reclaimer and push the AIL */
+                xfs_syncd_queue_reclaim(mp);
+                xfs_ail_push_all(mp->m_ail);
+
                 if (!(gfp_mask & __GFP_FS))
                         return -1;
 
-                xfs_reclaim_inodes_ag(mp, SYNC_TRYLOCK, &nr_to_scan);
+                xfs_reclaim_inodes_ag(mp, SYNC_TRYLOCK | SYNC_WAIT,
+                                        &nr_to_scan);
                 /* terminate if we don't exhaust the scan */
                 if (nr_to_scan > 0)
                         return -1;
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index 32ba6628290c..e3a6ad27415f 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -32,6 +32,8 @@ typedef struct xfs_sync_work {
 #define SYNC_WAIT               0x0001  /* wait for i/o to complete */
 #define SYNC_TRYLOCK            0x0002  /* only try to lock inodes */
 
+extern struct workqueue_struct  *xfs_syncd_wq;  /* sync workqueue */
+
 int xfs_syncd_init(struct xfs_mount *mp);
 void xfs_syncd_stop(struct xfs_mount *mp);
 
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 254ee062bd7d..69228aa8605a 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -461,12 +461,10 @@ xfs_qm_dqflush_all(
         struct xfs_quotainfo    *q = mp->m_quotainfo;
         int                     recl;
         struct xfs_dquot        *dqp;
-        int                     niters;
         int                     error;
 
         if (!q)
                 return 0;
-        niters = 0;
 again:
         mutex_lock(&q->qi_dqlist_lock);
         list_for_each_entry(dqp, &q->qi_dqlist, q_mplist) {
@@ -1314,14 +1312,9 @@ xfs_qm_dqiter_bufs(
 {
         xfs_buf_t       *bp;
         int             error;
-        int             notcommitted;
-        int             incr;
         int             type;
 
         ASSERT(blkcnt > 0);
-        notcommitted = 0;
-        incr = (blkcnt > XFS_QM_MAX_DQCLUSTER_LOGSZ) ?
-                XFS_QM_MAX_DQCLUSTER_LOGSZ : blkcnt;
         type = flags & XFS_QMOPT_UQUOTA ? XFS_DQ_USER :
                 (flags & XFS_QMOPT_PQUOTA ? XFS_DQ_PROJ : XFS_DQ_GROUP);
         error = 0;
diff --git a/fs/xfs/quota/xfs_qm.h b/fs/xfs/quota/xfs_qm.h
index c9446f1c726d..567b29b9f1b3 100644
--- a/fs/xfs/quota/xfs_qm.h
+++ b/fs/xfs/quota/xfs_qm.h
@@ -65,11 +65,6 @@ extern kmem_zone_t	*qm_dqtrxzone;
  * block in the dquot/xqm code.
  */
 #define XFS_DQUOT_CLUSTER_SIZE_FSB      (xfs_filblks_t)1
-/*
- * When doing a quotacheck, we log dquot clusters of this many FSBs at most
- * in a single transaction. We don't want to ask for too huge a log reservation.
- */
-#define XFS_QM_MAX_DQCLUSTER_LOGSZ      3
 
 typedef xfs_dqhash_t    xfs_dqlist_t;
 
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 0d62a07b7fd8..2dadb15d5ca9 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -313,14 +313,12 @@ xfs_qm_scall_quotaon(
 {
         int             error;
         uint            qf;
-        uint            accflags;
         __int64_t       sbflags;
 
         flags &= (XFS_ALL_QUOTA_ACCT | XFS_ALL_QUOTA_ENFD);
         /*
          * Switching on quota accounting must be done at mount time.
          */
-        accflags = flags & XFS_ALL_QUOTA_ACCT;
         flags &= ~(XFS_ALL_QUOTA_ACCT);
 
         sbflags = 0;
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 4bc3c649aee4..27d64d752eab 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -2395,17 +2395,33 @@ xfs_free_extent(
         memset(&args, 0, sizeof(xfs_alloc_arg_t));
         args.tp = tp;
         args.mp = tp->t_mountp;
+
+        /*
+         * validate that the block number is legal - the enables us to detect
+         * and handle a silent filesystem corruption rather than crashing.
+         */
         args.agno = XFS_FSB_TO_AGNO(args.mp, bno);
-        ASSERT(args.agno < args.mp->m_sb.sb_agcount);
+        if (args.agno >= args.mp->m_sb.sb_agcount)
+                return EFSCORRUPTED;
+
         args.agbno = XFS_FSB_TO_AGBNO(args.mp, bno);
+        if (args.agbno >= args.mp->m_sb.sb_agblocks)
+                return EFSCORRUPTED;
+
         args.pag = xfs_perag_get(args.mp, args.agno);
-        if ((error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING)))
+        ASSERT(args.pag);
+
+        error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING);
+        if (error)
                 goto error0;
-#ifdef DEBUG
-        ASSERT(args.agbp != NULL);
-        ASSERT((args.agbno + len) <=
-                be32_to_cpu(XFS_BUF_TO_AGF(args.agbp)->agf_length));
-#endif
+
+        /* validate the extent size is legal now we have the agf locked */
+        if (args.agbno + len >
+                        be32_to_cpu(XFS_BUF_TO_AGF(args.agbp)->agf_length)) {
+                error = EFSCORRUPTED;
+                goto error0;
+        }
+
         error = xfs_free_ag_extent(tp, args.agbp, args.agno, args.agbno, len, 0);
 error0:
         xfs_perag_put(args.pag);
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 46cc40131d4a..576fdfe81d60 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -198,6 +198,41 @@ xfs_inode_item_size(
 }
 
 /*
+ * xfs_inode_item_format_extents - convert in-core extents to on-disk form
+ *
+ * For either the data or attr fork in extent format, we need to endian convert
+ * the in-core extent as we place them into the on-disk inode. In this case, we
+ * need to do this conversion before we write the extents into the log. Because
+ * we don't have the disk inode to write into here, we allocate a buffer and
+ * format the extents into it via xfs_iextents_copy(). We free the buffer in
+ * the unlock routine after the copy for the log has been made.
+ *
+ * In the case of the data fork, the in-core and on-disk fork sizes can be
+ * different due to delayed allocation extents. We only log on-disk extents
+ * here, so always use the physical fork size to determine the size of the
+ * buffer we need to allocate.
+ */
+STATIC void
+xfs_inode_item_format_extents(
+        struct xfs_inode        *ip,
+        struct xfs_log_iovec    *vecp,
+        int                     whichfork,
+        int                     type)
+{
+        xfs_bmbt_rec_t          *ext_buffer;
+
+        ext_buffer = kmem_alloc(XFS_IFORK_SIZE(ip, whichfork), KM_SLEEP);
+        if (whichfork == XFS_DATA_FORK)
+                ip->i_itemp->ili_extents_buf = ext_buffer;
+        else
+                ip->i_itemp->ili_aextents_buf = ext_buffer;
+
+        vecp->i_addr = ext_buffer;
+        vecp->i_len = xfs_iextents_copy(ip, ext_buffer, whichfork);
+        vecp->i_type = type;
+}
+
+/*
  * This is called to fill in the vector of log iovecs for the
  * given inode log item.  It fills the first item with an inode
  * log format structure, the second with the on-disk inode structure,
@@ -213,7 +248,6 @@ xfs_inode_item_format(
         struct xfs_inode        *ip = iip->ili_inode;
         uint                    nvecs;
         size_t                  data_bytes;
-        xfs_bmbt_rec_t          *ext_buffer;
         xfs_mount_t             *mp;
 
         vecp->i_addr = &iip->ili_format;
@@ -320,22 +354,8 @@ xfs_inode_item_format(
                         } else
 #endif
                         {
-                                /*
-                                 * There are delayed allocation extents
-                                 * in the inode, or we need to convert
-                                 * the extents to on disk format.
-                                 * Use xfs_iextents_copy()
-                                 * to copy only the real extents into
-                                 * a separate buffer.  We'll free the
-                                 * buffer in the unlock routine.
-                                 */
-                                ext_buffer = kmem_alloc(ip->i_df.if_bytes,
-                                        KM_SLEEP);
-                                iip->ili_extents_buf = ext_buffer;
-                                vecp->i_addr = ext_buffer;
-                                vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
-                                                XFS_DATA_FORK);
-                                vecp->i_type = XLOG_REG_TYPE_IEXT;
+                                xfs_inode_item_format_extents(ip, vecp,
+                                        XFS_DATA_FORK, XLOG_REG_TYPE_IEXT);
                         }
                         ASSERT(vecp->i_len <= ip->i_df.if_bytes);
                         iip->ili_format.ilf_dsize = vecp->i_len;
@@ -445,19 +465,12 @@ xfs_inode_item_format(
                          */
                         vecp->i_addr = ip->i_afp->if_u1.if_extents;
                         vecp->i_len = ip->i_afp->if_bytes;
+                        vecp->i_type = XLOG_REG_TYPE_IATTR_EXT;
 #else
                         ASSERT(iip->ili_aextents_buf == NULL);
-                        /*
-                         * Need to endian flip before logging
-                         */
-                        ext_buffer = kmem_alloc(ip->i_afp->if_bytes,
-                                KM_SLEEP);
-                        iip->ili_aextents_buf = ext_buffer;
-                        vecp->i_addr = ext_buffer;
-                        vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
-                                        XFS_ATTR_FORK);
+                        xfs_inode_item_format_extents(ip, vecp,
+                                        XFS_ATTR_FORK, XLOG_REG_TYPE_IATTR_EXT);
 #endif
-                        vecp->i_type = XLOG_REG_TYPE_IATTR_EXT;
                         iip->ili_format.ilf_asize = vecp->i_len;
                         vecp++;
                         nvecs++;
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index dc1882adaf54..751e94fe1f77 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -204,7 +204,6 @@ xfs_bulkstat(
         xfs_agi_t               *agi;   /* agi header data */
         xfs_agino_t             agino;  /* inode # in allocation group */
         xfs_agnumber_t          agno;   /* allocation group number */
-        xfs_daddr_t             bno;    /* inode cluster start daddr */
         int                     chunkidx; /* current index into inode chunk */
         int                     clustidx; /* current index into inode cluster */
         xfs_btree_cur_t         *cur;   /* btree cursor for ialloc btree */
@@ -463,7 +462,6 @@ xfs_bulkstat(
                                                  mp->m_sb.sb_inopblog);
                                 }
                                 ino = XFS_AGINO_TO_INO(mp, agno, agino);
-                                bno = XFS_AGB_TO_DADDR(mp, agno, agbno);
                                 /*
                                  * Skip if this inode is free.
                                  */
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 25efa9b8a602..b612ce4520ae 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -761,7 +761,7 @@ xfs_log_need_covered(xfs_mount_t *mp)
                 break;
         case XLOG_STATE_COVER_NEED:
         case XLOG_STATE_COVER_NEED2:
-                if (!xfs_trans_ail_tail(log->l_ailp) &&
+                if (!xfs_ail_min_lsn(log->l_ailp) &&
                     xlog_iclogs_empty(log)) {
                         if (log->l_covered_state == XLOG_STATE_COVER_NEED)
                                 log->l_covered_state = XLOG_STATE_COVER_DONE;
@@ -801,7 +801,7 @@ xlog_assign_tail_lsn(
         xfs_lsn_t               tail_lsn;
         struct log              *log = mp->m_log;
 
-        tail_lsn = xfs_trans_ail_tail(mp->m_ail);
+        tail_lsn = xfs_ail_min_lsn(mp->m_ail);
         if (!tail_lsn)
                 tail_lsn = atomic64_read(&log->l_last_sync_lsn);
 
@@ -1239,7 +1239,7 @@ xlog_grant_push_ail(
          * the filesystem is shutting down.
          */
         if (!XLOG_FORCED_SHUTDOWN(log))
-                xfs_trans_ail_push(log->l_ailp, threshold_lsn);
+                xfs_ail_push(log->l_ailp, threshold_lsn);
 }
 
 /*
@@ -3407,6 +3407,17 @@ xlog_verify_dest_ptr(
                 xfs_emerg(log->l_mp, "%s: invalid ptr", __func__);
 }
 
+/*
+ * Check to make sure the grant write head didn't just over lap the tail.  If
+ * the cycles are the same, we can't be overlapping.  Otherwise, make sure that
+ * the cycles differ by exactly one and check the byte count.
+ *
+ * This check is run unlocked, so can give false positives. Rather than assert
+ * on failures, use a warn-once flag and a panic tag to allow the admin to
+ * determine if they want to panic the machine when such an error occurs. For
+ * debug kernels this will have the same effect as using an assert but, unlinke
+ * an assert, it can be turned off at runtime.
+ */
 STATIC void
 xlog_verify_grant_tail(
         struct log      *log)
@@ -3414,17 +3425,22 @@ xlog_verify_grant_tail(
         int             tail_cycle, tail_blocks;
         int             cycle, space;
 
-        /*
-         * Check to make sure the grant write head didn't just over lap the
-         * tail.  If the cycles are the same, we can't be overlapping.
-         * Otherwise, make sure that the cycles differ by exactly one and
-         * check the byte count.
-         */
         xlog_crack_grant_head(&log->l_grant_write_head, &cycle, &space);
         xlog_crack_atomic_lsn(&log->l_tail_lsn, &tail_cycle, &tail_blocks);
         if (tail_cycle != cycle) {
-                ASSERT(cycle - 1 == tail_cycle);
-                ASSERT(space <= BBTOB(tail_blocks));
+                if (cycle - 1 != tail_cycle &&
+                    !(log->l_flags & XLOG_TAIL_WARN)) {
+                        xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
+                                "%s: cycle - 1 != tail_cycle", __func__);
+                        log->l_flags |= XLOG_TAIL_WARN;
+                }
+
+                if (space > BBTOB(tail_blocks) &&
+                    !(log->l_flags & XLOG_TAIL_WARN)) {
+                        xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
+                                "%s: space > BBTOB(tail_blocks)", __func__);
+                        log->l_flags |= XLOG_TAIL_WARN;
+                }
         }
 }
 
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index ffae692c9832..5864850e9e34 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -144,6 +144,7 @@ static inline uint xlog_get_client_id(__be32 i)
 #define XLOG_RECOVERY_NEEDED    0x4     /* log was recovered */
 #define XLOG_IO_ERROR           0x8     /* log hit an I/O error, and being
                                            shutdown */
+#define XLOG_TAIL_WARN          0x10    /* log tail verify warning issued */
 
 #ifdef __KERNEL__
 /*
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index a62e8971539d..19af0ab0d0c6 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -203,12 +203,9 @@ typedef struct xfs_mount {
         struct mutex            m_icsb_mutex;   /* balancer sync lock */
 #endif
         struct xfs_mru_cache    *m_filestream;  /* per-mount filestream data */
-        struct task_struct      *m_sync_task;   /* generalised sync thread */
-        xfs_sync_work_t         m_sync_work;    /* work item for VFS_SYNC */
-        struct list_head        m_sync_list;    /* sync thread work item list */
-        spinlock_t              m_sync_lock;    /* work item list lock */
-        int                     m_sync_seq;     /* sync thread generation no. */
-        wait_queue_head_t       m_wait_single_sync_task;
+        struct delayed_work     m_sync_work;    /* background sync work */
+        struct delayed_work     m_reclaim_work; /* background inode reclaim */
+        struct work_struct      m_flush_work;   /* background inode flush */
         __int64_t               m_update_flags; /* sb flags we need to update
                                                    on the next remount,rw */
         struct shrinker         m_inode_shrink; /* inode reclaim shrinker */
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 12aff9584e29..acdb92f14d51 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -28,74 +28,138 @@
 #include "xfs_trans_priv.h"
 #include "xfs_error.h"
 
-STATIC void xfs_ail_splice(struct xfs_ail *, struct list_head *, xfs_lsn_t);
-STATIC void xfs_ail_delete(struct xfs_ail *, xfs_log_item_t *);
-STATIC xfs_log_item_t * xfs_ail_min(struct xfs_ail *);
-STATIC xfs_log_item_t * xfs_ail_next(struct xfs_ail *, xfs_log_item_t *);
+struct workqueue_struct *xfs_ail_wq;    /* AIL workqueue */
 
 #ifdef DEBUG
-STATIC void xfs_ail_check(struct xfs_ail *, xfs_log_item_t *);
-#else
+/*
+ * Check that the list is sorted as it should be.
+ */
+STATIC void
+xfs_ail_check(
+        struct xfs_ail  *ailp,
+        xfs_log_item_t  *lip)
+{
+        xfs_log_item_t  *prev_lip;
+
+        if (list_empty(&ailp->xa_ail))
+                return;
+
+        /*
+         * Check the next and previous entries are valid.
+         */
+        ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
+        prev_lip = list_entry(lip->li_ail.prev, xfs_log_item_t, li_ail);
+        if (&prev_lip->li_ail != &ailp->xa_ail)
+                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
+
+        prev_lip = list_entry(lip->li_ail.next, xfs_log_item_t, li_ail);
+        if (&prev_lip->li_ail != &ailp->xa_ail)
+                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) >= 0);
+
+
+#ifdef XFS_TRANS_DEBUG
+        /*
+         * Walk the list checking lsn ordering, and that every entry has the
+         * XFS_LI_IN_AIL flag set. This is really expensive, so only do it
+         * when specifically debugging the transaction subsystem.
+         */
+        prev_lip = list_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
+        list_for_each_entry(lip, &ailp->xa_ail, li_ail) {
+                if (&prev_lip->li_ail != &ailp->xa_ail)
+                        ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
+                ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
+                prev_lip = lip;
+        }
+#endif /* XFS_TRANS_DEBUG */
+}
+#else /* !DEBUG */
 #define xfs_ail_check(a,l)
 #endif /* DEBUG */
 
+/*
+ * Return a pointer to the first item in the AIL.  If the AIL is empty, then
+ * return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_min(
+        struct xfs_ail  *ailp)
+{
+        if (list_empty(&ailp->xa_ail))
+                return NULL;
+
+        return list_first_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
+}
+
+ /*
+ * Return a pointer to the last item in the AIL.  If the AIL is empty, then
+ * return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_max(
+        struct xfs_ail  *ailp)
+{
+        if (list_empty(&ailp->xa_ail))
+                return NULL;
+
+        return list_entry(ailp->xa_ail.prev, xfs_log_item_t, li_ail);
+}
+
+/*
+ * Return a pointer to the item which follows the given item in the AIL.  If
+ * the given item is the last item in the list, then return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_next(
+        struct xfs_ail  *ailp,
+        xfs_log_item_t  *lip)
+{
+        if (lip->li_ail.next == &ailp->xa_ail)
+                return NULL;
+
+        return list_first_entry(&lip->li_ail, xfs_log_item_t, li_ail);
+}
 
 /*
- * This is called by the log manager code to determine the LSN
- * of the tail of the log.  This is exactly the LSN of the first
- * item in the AIL.  If the AIL is empty, then this function
- * returns 0.
+ * This is called by the log manager code to determine the LSN of the tail of
+ * the log.  This is exactly the LSN of the first item in the AIL.  If the AIL
+ * is empty, then this function returns 0.
  *
- * We need the AIL lock in order to get a coherent read of the
- * lsn of the last item in the AIL.
+ * We need the AIL lock in order to get a coherent read of the lsn of the last
+ * item in the AIL.
  */
 xfs_lsn_t
-xfs_trans_ail_tail(
+xfs_ail_min_lsn(
         struct xfs_ail  *ailp)
 {
-        xfs_lsn_t       lsn;
+        xfs_lsn_t       lsn = 0;
         xfs_log_item_t  *lip;
 
         spin_lock(&ailp->xa_lock);
         lip = xfs_ail_min(ailp);
-        if (lip == NULL) {
-                lsn = (xfs_lsn_t)0;
-        } else {
+        if (lip)
                 lsn = lip->li_lsn;
-        }
         spin_unlock(&ailp->xa_lock);
 
         return lsn;
 }
 
 /*
- * xfs_trans_push_ail
- *
- * This routine is called to move the tail of the AIL forward.  It does this by
- * trying to flush items in the AIL whose lsns are below the given
- * threshold_lsn.
- *
- * the push is run asynchronously in a separate thread, so we return the tail
- * of the log right now instead of the tail after the push. This means we will
- * either continue right away, or we will sleep waiting on the async thread to
- * do its work.
- *
- * We do this unlocked - we only need to know whether there is anything in the
- * AIL at the time we are called. We don't need to access the contents of
- * any of the objects, so the lock is not needed.
+ * Return the maximum lsn held in the AIL, or zero if the AIL is empty.
  */
-void
-xfs_trans_ail_push(
-        struct xfs_ail  *ailp,
-        xfs_lsn_t       threshold_lsn)
+static xfs_lsn_t
+xfs_ail_max_lsn(
+        struct xfs_ail  *ailp)
 {
-        xfs_log_item_t  *lip;
+        xfs_lsn_t       lsn = 0;
+        xfs_log_item_t  *lip;
 
-        lip = xfs_ail_min(ailp);
-        if (lip && !XFS_FORCED_SHUTDOWN(ailp->xa_mount)) {
-                if (XFS_LSN_CMP(threshold_lsn, ailp->xa_target) > 0)
-                        xfsaild_wakeup(ailp, threshold_lsn);
-        }
+        spin_lock(&ailp->xa_lock);
+        lip = xfs_ail_max(ailp);
+        if (lip)
+                lsn = lip->li_lsn;
+        spin_unlock(&ailp->xa_lock);
+
+        return lsn;
 }
 
 /*
@@ -236,16 +300,57 @@ out:
 }
 
 /*
- * xfsaild_push does the work of pushing on the AIL.  Returning a timeout of
- * zero indicates that the caller should sleep until woken.
+ * splice the log item list into the AIL at the given LSN.
  */
-long
-xfsaild_push(
-        struct xfs_ail  *ailp,
-        xfs_lsn_t       *last_lsn)
+static void
+xfs_ail_splice(
+        struct xfs_ail  *ailp,
+        struct list_head *list,
+        xfs_lsn_t       lsn)
 {
-        long            tout = 0;
-        xfs_lsn_t       last_pushed_lsn = *last_lsn;
+        xfs_log_item_t  *next_lip;
+
+        /* If the list is empty, just insert the item.  */
+        if (list_empty(&ailp->xa_ail)) {
+                list_splice(list, &ailp->xa_ail);
+                return;
+        }
+
+        list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
+                if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
+                        break;
+        }
+
+        ASSERT(&next_lip->li_ail == &ailp->xa_ail ||
+               XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0);
+
+        list_splice_init(list, &next_lip->li_ail);
+}
+
+/*
+ * Delete the given item from the AIL.  Return a pointer to the item.
+ */
+static void
+xfs_ail_delete(
+        struct xfs_ail  *ailp,
+        xfs_log_item_t  *lip)
+{
+        xfs_ail_check(ailp, lip);
+        list_del(&lip->li_ail);
+        xfs_trans_ail_cursor_clear(ailp, lip);
+}
+
+/*
+ * xfs_ail_worker does the work of pushing on the AIL. It will requeue itself
+ * to run at a later time if there is more work to do to complete the push.
+ */
+STATIC void
+xfs_ail_worker(
+        struct work_struct *work)
+{
+        struct xfs_ail  *ailp = container_of(to_delayed_work(work),
+                                        struct xfs_ail, xa_work);
+        long            tout;
         xfs_lsn_t       target =  ailp->xa_target;
         xfs_lsn_t       lsn;
         xfs_log_item_t  *lip;
@@ -256,15 +361,15 @@ xfsaild_push(
 
         spin_lock(&ailp->xa_lock);
         xfs_trans_ail_cursor_init(ailp, cur);
-        lip = xfs_trans_ail_cursor_first(ailp, cur, *last_lsn);
+        lip = xfs_trans_ail_cursor_first(ailp, cur, ailp->xa_last_pushed_lsn);
         if (!lip || XFS_FORCED_SHUTDOWN(mp)) {
                 /*
                  * AIL is empty or our push has reached the end.
                  */
                 xfs_trans_ail_cursor_done(ailp, cur);
                 spin_unlock(&ailp->xa_lock);
-                *last_lsn = 0;
-                return tout;
+                ailp->xa_last_pushed_lsn = 0;
+                return;
         }
 
         XFS_STATS_INC(xs_push_ail);
@@ -301,13 +406,13 @@ xfsaild_push(
                 case XFS_ITEM_SUCCESS:
                         XFS_STATS_INC(xs_push_ail_success);
                         IOP_PUSH(lip);
-                        last_pushed_lsn = lsn;
+                        ailp->xa_last_pushed_lsn = lsn;
                         break;
 
                 case XFS_ITEM_PUSHBUF:
                         XFS_STATS_INC(xs_push_ail_pushbuf);
                         IOP_PUSHBUF(lip);
-                        last_pushed_lsn = lsn;
+                        ailp->xa_last_pushed_lsn = lsn;
                         push_xfsbufd = 1;
                         break;
 
@@ -319,7 +424,7 @@ xfsaild_push(
 
                 case XFS_ITEM_LOCKED:
                         XFS_STATS_INC(xs_push_ail_locked);
-                        last_pushed_lsn = lsn;
+                        ailp->xa_last_pushed_lsn = lsn;
                         stuck++;
                         break;
 
@@ -374,9 +479,23 @@ xfsaild_push(
                 wake_up_process(mp->m_ddev_targp->bt_task);
         }
 
+        /* assume we have more work to do in a short while */
+        tout = 10;
         if (!count) {
                 /* We're past our target or empty, so idle */
-                last_pushed_lsn = 0;
+                ailp->xa_last_pushed_lsn = 0;
+
+                /*
+                 * Check for an updated push target before clearing the
+                 * XFS_AIL_PUSHING_BIT. If the target changed, we've got more
+                 * work to do. Wait a bit longer before starting that work.
+                 */
+                smp_rmb();
+                if (ailp->xa_target == target) {
+                        clear_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags);
+                        return;
+                }
+                tout = 50;
         } else if (XFS_LSN_CMP(lsn, target) >= 0) {
                 /*
                  * We reached the target so wait a bit longer for I/O to
@@ -384,7 +503,7 @@ xfsaild_push(
                  * start the next scan from the start of the AIL.
                  */
                 tout = 50;
-                last_pushed_lsn = 0;
+                ailp->xa_last_pushed_lsn = 0;
         } else if ((stuck * 100) / count > 90) {
                 /*
                  * Either there is a lot of contention on the AIL or we
@@ -396,14 +515,61 @@ xfsaild_push(
                  * continuing from where we were.
                  */
                 tout = 20;
-        } else {
-                /* more to do, but wait a short while before continuing */
-                tout = 10;
         }
-        *last_lsn = last_pushed_lsn;
-        return tout;
+
+        /* There is more to do, requeue us.  */
+        queue_delayed_work(xfs_syncd_wq, &ailp->xa_work,
+                                        msecs_to_jiffies(tout));
+}
+
+/*
+ * This routine is called to move the tail of the AIL forward.  It does this by
+ * trying to flush items in the AIL whose lsns are below the given
+ * threshold_lsn.
+ *
+ * The push is run asynchronously in a workqueue, which means the caller needs
+ * to handle waiting on the async flush for space to become available.
+ * We don't want to interrupt any push that is in progress, hence we only queue
+ * work if we set the pushing bit approriately.
+ *
+ * We do this unlocked - we only need to know whether there is anything in the
+ * AIL at the time we are called. We don't need to access the contents of
+ * any of the objects, so the lock is not needed.
+ */
+void
+xfs_ail_push(
+        struct xfs_ail  *ailp,
+        xfs_lsn_t       threshold_lsn)
+{
+        xfs_log_item_t  *lip;
+
+        lip = xfs_ail_min(ailp);
+        if (!lip || XFS_FORCED_SHUTDOWN(ailp->xa_mount) ||
+            XFS_LSN_CMP(threshold_lsn, ailp->xa_target) <= 0)
+                return;
+
+        /*
+         * Ensure that the new target is noticed in push code before it clears
+         * the XFS_AIL_PUSHING_BIT.
+         */
+        smp_wmb();
+        ailp->xa_target = threshold_lsn;
+        if (!test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
+                queue_delayed_work(xfs_syncd_wq, &ailp->xa_work, 0);
 }
 
+/*
+ * Push out all items in the AIL immediately
+ */
+void
+xfs_ail_push_all(
+        struct xfs_ail  *ailp)
+{
+        xfs_lsn_t       threshold_lsn = xfs_ail_max_lsn(ailp);
+
+        if (threshold_lsn)
+                xfs_ail_push(ailp, threshold_lsn);
+}
 
 /*
  * This is to be called when an item is unlocked that may have
@@ -615,7 +781,6 @@ xfs_trans_ail_init(
         xfs_mount_t     *mp)
 {
         struct xfs_ail  *ailp;
-        int             error;
 
         ailp = kmem_zalloc(sizeof(struct xfs_ail), KM_MAYFAIL);
         if (!ailp)
@@ -624,15 +789,9 @@ xfs_trans_ail_init(
         ailp->xa_mount = mp;
         INIT_LIST_HEAD(&ailp->xa_ail);
         spin_lock_init(&ailp->xa_lock);
-        error = xfsaild_start(ailp);
-        if (error)
-                goto out_free_ailp;
+        INIT_DELAYED_WORK(&ailp->xa_work, xfs_ail_worker);
         mp->m_ail = ailp;
         return 0;
-
-out_free_ailp:
-        kmem_free(ailp);
-        return error;
 }
 
 void
@@ -641,124 +800,6 @@ xfs_trans_ail_destroy(
 {
         struct xfs_ail  *ailp = mp->m_ail;
 
-        xfsaild_stop(ailp);
+        cancel_delayed_work_sync(&ailp->xa_work);
         kmem_free(ailp);
 }
-
-/*
- * splice the log item list into the AIL at the given LSN.
- */
-STATIC void
-xfs_ail_splice(
-        struct xfs_ail  *ailp,
-        struct list_head *list,
-        xfs_lsn_t       lsn)
-{
-        xfs_log_item_t  *next_lip;
-
-        /*
-         * If the list is empty, just insert the item.
-         */
-        if (list_empty(&ailp->xa_ail)) {
-                list_splice(list, &ailp->xa_ail);
-                return;
-        }
-
-        list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
-                if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
-                        break;
-        }
-
-        ASSERT((&next_lip->li_ail == &ailp->xa_ail) ||
-               (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0));
-
-        list_splice_init(list, &next_lip->li_ail);
-        return;
-}
-
-/*
- * Delete the given item from the AIL.  Return a pointer to the item.
- */
-STATIC void
-xfs_ail_delete(
-        struct xfs_ail  *ailp,
-        xfs_log_item_t  *lip)
-{
-        xfs_ail_check(ailp, lip);
-        list_del(&lip->li_ail);
-        xfs_trans_ail_cursor_clear(ailp, lip);
-}
-
-/*
- * Return a pointer to the first item in the AIL.
- * If the AIL is empty, then return NULL.
- */
-STATIC xfs_log_item_t *
-xfs_ail_min(
-        struct xfs_ail  *ailp)
-{
-        if (list_empty(&ailp->xa_ail))
-                return NULL;
-
-        return list_first_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
-}
-
-/*
- * Return a pointer to the item which follows
- * the given item in the AIL.  If the given item
- * is the last item in the list, then return NULL.
- */
-STATIC xfs_log_item_t *
-xfs_ail_next(
-        struct xfs_ail  *ailp,
-        xfs_log_item_t  *lip)
-{
-        if (lip->li_ail.next == &ailp->xa_ail)
-                return NULL;
-
-        return list_first_entry(&lip->li_ail, xfs_log_item_t, li_ail);
-}
-
-#ifdef DEBUG
-/*
- * Check that the list is sorted as it should be.
- */
-STATIC void
-xfs_ail_check(
-        struct xfs_ail  *ailp,
-        xfs_log_item_t  *lip)
-{
-        xfs_log_item_t  *prev_lip;
-
-        if (list_empty(&ailp->xa_ail))
-                return;
-
-        /*
-         * Check the next and previous entries are valid.
-         */
-        ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
-        prev_lip = list_entry(lip->li_ail.prev, xfs_log_item_t, li_ail);
-        if (&prev_lip->li_ail != &ailp->xa_ail)
-                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
-
-        prev_lip = list_entry(lip->li_ail.next, xfs_log_item_t, li_ail);
-        if (&prev_lip->li_ail != &ailp->xa_ail)
-                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) >= 0);
-
-
-#ifdef XFS_TRANS_DEBUG
-        /*
-         * Walk the list checking lsn ordering, and that every entry has the
-         * XFS_LI_IN_AIL flag set. This is really expensive, so only do it
-         * when specifically debugging the transaction subsystem.
-         */
-        prev_lip = list_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
-        list_for_each_entry(lip, &ailp->xa_ail, li_ail) {
-                if (&prev_lip->li_ail != &ailp->xa_ail)
-                        ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
-                ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
-                prev_lip = lip;
-        }
-#endif /* XFS_TRANS_DEBUG */
-}
-#endif /* DEBUG */
diff --git a/fs/xfs/xfs_trans_priv.h b/fs/xfs/xfs_trans_priv.h
index 35162c238fa3..6b164e9e9a1f 100644
--- a/fs/xfs/xfs_trans_priv.h
+++ b/fs/xfs/xfs_trans_priv.h
@@ -65,16 +65,22 @@ struct xfs_ail_cursor {
 struct xfs_ail {
         struct xfs_mount        *xa_mount;
         struct list_head        xa_ail;
-        uint                    xa_gen;
-        struct task_struct      *xa_task;
         xfs_lsn_t               xa_target;
         struct xfs_ail_cursor   xa_cursors;
         spinlock_t              xa_lock;
+        struct delayed_work     xa_work;
+        xfs_lsn_t               xa_last_pushed_lsn;
+        unsigned long           xa_flags;
 };
 
+#define XFS_AIL_PUSHING_BIT     0
+
 /*
  * From xfs_trans_ail.c
  */
+
+extern struct workqueue_struct  *xfs_ail_wq;    /* AIL workqueue */
+
 void    xfs_trans_ail_update_bulk(struct xfs_ail *ailp,
                                 struct xfs_log_item **log_items, int nr_items,
                                 xfs_lsn_t lsn) __releases(ailp->xa_lock);
@@ -98,12 +104,13 @@ xfs_trans_ail_delete(
         xfs_trans_ail_delete_bulk(ailp, &lip, 1);
 }
 
-void                    xfs_trans_ail_push(struct xfs_ail *, xfs_lsn_t);
+void                    xfs_ail_push(struct xfs_ail *, xfs_lsn_t);
+void                    xfs_ail_push_all(struct xfs_ail *);
+xfs_lsn_t               xfs_ail_min_lsn(struct xfs_ail *ailp);
+
 void                    xfs_trans_unlocked_item(struct xfs_ail *,
                                         xfs_log_item_t *);
 
-xfs_lsn_t               xfs_trans_ail_tail(struct xfs_ail *ailp);
-
 struct xfs_log_item     *xfs_trans_ail_cursor_first(struct xfs_ail *ailp,
                                         struct xfs_ail_cursor *cur,
                                         xfs_lsn_t lsn);
@@ -112,11 +119,6 @@ struct xfs_log_item	*xfs_trans_ail_cursor_next(struct xfs_ail *ailp,
 void                    xfs_trans_ail_cursor_done(struct xfs_ail *ailp,
                                         struct xfs_ail_cursor *cur);
 
-long    xfsaild_push(struct xfs_ail *, xfs_lsn_t *);
-void    xfsaild_wakeup(struct xfs_ail *, xfs_lsn_t);
-int     xfsaild_start(struct xfs_ail *);
-void    xfsaild_stop(struct xfs_ail *);
-
 #if BITS_PER_LONG != 64
 static inline void
 xfs_trans_ail_copy_lsn(
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 32176cc8e715..1c76506fcf11 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -196,6 +196,7 @@ typedef void (request_fn_proc) (struct request_queue *q);
 typedef int (make_request_fn) (struct request_queue *q, struct bio *bio);
 typedef int (prep_rq_fn) (struct request_queue *, struct request *);
 typedef void (unprep_rq_fn) (struct request_queue *, struct request *);
+typedef void (unplugged_fn) (struct request_queue *);
 
 struct bio_vec;
 struct bvec_merge_data {
@@ -283,6 +284,7 @@ struct request_queue
         rq_timed_out_fn         *rq_timed_out_fn;
         dma_drain_needed_fn     *dma_drain_needed;
         lld_busy_fn             *lld_busy_fn;
+        unplugged_fn            *unplugged_fn;
 
         /*
          * Dispatch queue sorting
@@ -841,6 +843,7 @@ extern void blk_queue_dma_alignment(struct request_queue *, int);
 extern void blk_queue_update_dma_alignment(struct request_queue *, int);
 extern void blk_queue_softirq_done(struct request_queue *, softirq_done_fn *);
 extern void blk_queue_rq_timed_out(struct request_queue *, rq_timed_out_fn *);
+extern void blk_queue_unplugged(struct request_queue *, unplugged_fn *);
 extern void blk_queue_rq_timeout(struct request_queue *, unsigned int);
 extern void blk_queue_flush(struct request_queue *q, unsigned int flush);
 extern struct backing_dev_info *blk_get_backing_dev_info(struct block_device *bdev);
@@ -862,14 +865,14 @@ struct blk_plug {
 
 extern void blk_start_plug(struct blk_plug *);
 extern void blk_finish_plug(struct blk_plug *);
-extern void __blk_flush_plug(struct task_struct *, struct blk_plug *);
+extern void blk_flush_plug_list(struct blk_plug *, bool);
 
 static inline void blk_flush_plug(struct task_struct *tsk)
 {
         struct blk_plug *plug = tsk->plug;
 
-        if (unlikely(plug))
-                __blk_flush_plug(tsk, plug);
+        if (plug)
+                blk_flush_plug_list(plug, true);
 }
 
 static inline bool blk_needs_flush_plug(struct task_struct *tsk)
diff --git a/include/linux/can/platform/mcp251x.h b/include/linux/can/platform/mcp251x.h
index 8e20540043f5..089fe43211a4 100644
--- a/include/linux/can/platform/mcp251x.h
+++ b/include/linux/can/platform/mcp251x.h
@@ -12,6 +12,7 @@
 /**
  * struct mcp251x_platform_data - MCP251X SPI CAN controller platform data
  * @oscillator_frequency:       - oscillator frequency in Hz
+ * @irq_flags:                  - IRQF configuration flags
  * @board_specific_setup:       - called before probing the chip (power,reset)
  * @transceiver_enable:         - called to power on/off the transceiver
  * @power_enable:               - called to power on/off the mcp *and* the
@@ -24,6 +25,7 @@
 
 struct mcp251x_platform_data {
         unsigned long oscillator_frequency;
+        unsigned long irq_flags;
         int (*board_specific_setup)(struct spi_device *spi);
         int (*transceiver_enable)(int enable);
         int (*power_enable) (int enable);
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 5a5ce7055839..5e9840f50980 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -216,7 +216,7 @@ static inline void mem_cgroup_del_lru_list(struct page *page, int lru)
         return ;
 }
 
-static inline inline void mem_cgroup_rotate_reclaimable_page(struct page *page)
+static inline void mem_cgroup_rotate_reclaimable_page(struct page *page)
 {
         return ;
 }
diff --git a/include/linux/mfd/core.h b/include/linux/mfd/core.h
index ad1b19aa6508..aef23309a742 100644
--- a/include/linux/mfd/core.h
+++ b/include/linux/mfd/core.h
@@ -86,16 +86,25 @@ extern int mfd_clone_cell(const char *cell, const char **clones,
  */
 static inline const struct mfd_cell *mfd_get_cell(struct platform_device *pdev)
 {
-        return pdev->dev.platform_data;
+        return pdev->mfd_cell;
 }
 
 /*
  * Given a platform device that's been created by mfd_add_devices(), fetch
  * the .mfd_data entry from the mfd_cell that created it.
+ * Otherwise just return the platform_data pointer.
+ * This maintains compatibility with platform drivers whose devices aren't
+ * created by the mfd layer, and expect platform_data to contain what would've
+ * otherwise been in mfd_data.
  */
 static inline void *mfd_get_data(struct platform_device *pdev)
 {
-        return mfd_get_cell(pdev)->mfd_data;
+        const struct mfd_cell *cell = mfd_get_cell(pdev);
+
+        if (cell)
+                return cell->mfd_data;
+        else
+                return pdev->dev.platform_data;
 }
 
 extern int mfd_add_devices(struct device *parent, int id,
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index eeec00abb664..7fa95df60146 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -270,7 +270,8 @@ struct nf_afinfo {
                                             unsigned int dataoff,
                                             unsigned int len,
                                             u_int8_t protocol);
-        int             (*route)(struct dst_entry **dst, struct flowi *fl);
+        int             (*route)(struct net *net, struct dst_entry **dst,
+                                 struct flowi *fl, bool strict);
         void            (*saveroute)(const struct sk_buff *skb,
                                      struct nf_queue_entry *entry);
         int             (*reroute)(struct sk_buff *skb,
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index ec333d83f3b4..5a262e3ae715 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -293,7 +293,7 @@ struct ip_set {
         /* Lock protecting the set data */
         rwlock_t lock;
         /* References to the set */
-        atomic_t ref;
+        u32 ref;
         /* The core set type */
         struct ip_set_type *type;
         /* The type variant doing the real job */
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index ec9d9bea1e37..a0196ac79051 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -515,8 +515,7 @@ type_pf_head(struct ip_set *set, struct sk_buff *skb)
         if (h->netmask != HOST_MASK)
                 NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, h->netmask);
 #endif
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-                      htonl(atomic_read(&set->ref) - 1));
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
         NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize));
         if (with_timeout(h->timeout))
                 NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(h->timeout));
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index d96db9825708..744942c95fec 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -14,6 +14,8 @@
 #include <linux/device.h>
 #include <linux/mod_devicetable.h>
 
+struct mfd_cell;
+
 struct platform_device {
         const char      * name;
         int             id;
@@ -23,6 +25,9 @@ struct platform_device {
 
         const struct platform_device_id *id_entry;
 
+        /* MFD cell pointer */
+        struct mfd_cell *mfd_cell;
+
         /* arch specific additions */
         struct pdev_archdata    archdata;
 };
diff --git a/include/linux/rio.h b/include/linux/rio.h
index 4e37a7cfa726..4d50611112ba 100644
--- a/include/linux/rio.h
+++ b/include/linux/rio.h
@@ -396,7 +396,7 @@ union rio_pw_msg {
 };
 
 /* Architecture and hardware-specific functions */
-extern void rio_register_mport(struct rio_mport *);
+extern int rio_register_mport(struct rio_mport *);
 extern int rio_open_inb_mbox(struct rio_mport *, void *, int, int);
 extern void rio_close_inb_mbox(struct rio_mport *, int);
 extern int rio_open_outb_mbox(struct rio_mport *, void *, int, int);
diff --git a/include/linux/rio_ids.h b/include/linux/rio_ids.h
index 7410d3365e2a..0cee0152aca9 100644
--- a/include/linux/rio_ids.h
+++ b/include/linux/rio_ids.h
@@ -35,6 +35,7 @@
 #define RIO_DID_IDTCPS6Q                0x035f
 #define RIO_DID_IDTCPS10Q               0x035e
 #define RIO_DID_IDTCPS1848              0x0374
+#define RIO_DID_IDTCPS1432              0x0375
 #define RIO_DID_IDTCPS1616              0x0379
 #define RIO_DID_IDTVPS1616              0x0377
 #define RIO_DID_IDTSPS1616              0x0378
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 2ca7e8a78060..877ece45426f 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -228,6 +228,8 @@ extern int rtc_read_alarm(struct rtc_device *rtc,
                         struct rtc_wkalrm *alrm);
 extern int rtc_set_alarm(struct rtc_device *rtc,
                                 struct rtc_wkalrm *alrm);
+extern int rtc_initialize_alarm(struct rtc_device *rtc,
+                                struct rtc_wkalrm *alrm);
 extern void rtc_update_irq(struct rtc_device *rtc,
                         unsigned long num, unsigned long events);
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4ec2c027e92c..18d63cea2848 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1254,6 +1254,9 @@ struct task_struct {
 #endif
 
         struct mm_struct *mm, *active_mm;
+#ifdef CONFIG_COMPAT_BRK
+        unsigned brk_randomized:1;
+#endif
 #if defined(SPLIT_RSS_COUNTING)
         struct task_rss_stat    rss_stat;
 #endif
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 5a89e3612875..083ffea7ba18 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -249,6 +249,8 @@ extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
 extern int hibernate(void);
 extern bool system_entering_hibernation(void);
 #else /* CONFIG_HIBERNATION */
+static inline void register_nosave_region(unsigned long b, unsigned long e) {}
+static inline void register_nosave_region_late(unsigned long b, unsigned long e) {}
 static inline int swsusp_page_is_forbidden(struct page *p) { return 0; }
 static inline void swsusp_set_page_free(struct page *p) {}
 static inline void swsusp_unset_page_free(struct page *p) {}
@@ -297,14 +299,7 @@ static inline bool pm_wakeup_pending(void) { return false; }
 
 extern struct mutex pm_mutex;
 
-#ifndef CONFIG_HIBERNATION
-static inline void register_nosave_region(unsigned long b, unsigned long e)
-{
-}
-static inline void register_nosave_region_late(unsigned long b, unsigned long e)
-{
-}
-
+#ifndef CONFIG_HIBERNATE_CALLBACKS
 static inline void lock_system_sleep(void) {}
 static inline void unlock_system_sleep(void) {}
 
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 461c0119664f..2b3831b58aa4 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -58,6 +58,13 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 UNEVICTABLE_PGCLEARED,  /* on COW, page truncate */
                 UNEVICTABLE_PGSTRANDED, /* unable to isolate on unlock */
                 UNEVICTABLE_MLOCKFREED,
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+                THP_FAULT_ALLOC,
+                THP_FAULT_FALLBACK,
+                THP_COLLAPSE_ALLOC,
+                THP_COLLAPSE_ALLOC_FAILED,
+                THP_SPLIT,
+#endif
                 NR_VM_EVENT_ITEMS
 };
 
diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index cdf2e8ac4309..d2df55b0c213 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -139,8 +139,6 @@ do { \
  */
 
 enum p9_msg_t {
-        P9_TSYNCFS = 0,
-        P9_RSYNCFS,
         P9_TLERROR = 6,
         P9_RLERROR,
         P9_TSTATFS = 8,
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index 85c1413f054d..051a99f79769 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -218,8 +218,8 @@ void p9_client_disconnect(struct p9_client *clnt);
 void p9_client_begin_disconnect(struct p9_client *clnt);
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                                         char *uname, u32 n_uname, char *aname);
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-                                                                int clone);
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+                char **wnames, int clone);
 int p9_client_open(struct p9_fid *fid, int mode);
 int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
                                                         char *extension);
@@ -230,7 +230,6 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
                 gid_t gid, struct p9_qid *qid);
 int p9_client_clunk(struct p9_fid *fid);
 int p9_client_fsync(struct p9_fid *fid, int datasync);
-int p9_client_sync_fs(struct p9_fid *fid);
 int p9_client_remove(struct p9_fid *fid);
 int p9_client_read(struct p9_fid *fid, char *data, char __user *udata,
                                                         u64 offset, u32 count);
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 814b434db749..d516f00c8e0f 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -52,7 +52,7 @@ static inline struct net *skb_net(const struct sk_buff *skb)
          */
         if (likely(skb->dev && skb->dev->nd_net))
                 return dev_net(skb->dev);
-        if (skb_dst(skb)->dev)
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                 return dev_net(skb_dst(skb)->dev);
         WARN(skb->sk, "Maybe skb_sknet should be used in %s() at line:%d\n",
                       __func__, __LINE__);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index cb13239fe8e3..025d4cc7bbf8 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1753,8 +1753,19 @@ enum ieee80211_ampdu_mlme_action {
  *      that TX/RX_STOP can pass NULL for this parameter.
  *      The @buf_size parameter is only valid when the action is set to
  *      %IEEE80211_AMPDU_TX_OPERATIONAL and indicates the peer's reorder
- *      buffer size (number of subframes) for this session -- aggregates
- *      containing more subframes than this may not be transmitted to the peer.
+ *      buffer size (number of subframes) for this session -- the driver
+ *      may neither send aggregates containing more subframes than this
+ *      nor send aggregates in a way that lost frames would exceed the
+ *      buffer size. If just limiting the aggregate size, this would be
+ *      possible with a buf_size of 8:
+ *       - TX: 1.....7
+ *       - RX:  2....7 (lost frame #1)
+ *       - TX:        8..1...
+ *      which is invalid since #1 was now re-transmitted well past the
+ *      buffer size of 8. Correct ways to retransmit #1 would be:
+ *       - TX:       1 or 18 or 81
+ *      Even "189" would be wrong since 1 could be lost again.
+ *
  *      Returns a negative error code on failure.
  *      The callback can sleep.
  *
diff --git a/include/net/route.h b/include/net/route.h
index f88429cad52a..8fce0621cad1 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -64,6 +64,7 @@ struct rtable {
 
         __be32                  rt_dst; /* Path destination     */
         __be32                  rt_src; /* Path source          */
+        int                     rt_route_iif;
         int                     rt_iif;
         int                     rt_oif;
         __u32                   rt_mark;
@@ -80,12 +81,12 @@ struct rtable {
 
 static inline bool rt_is_input_route(struct rtable *rt)
 {
-        return rt->rt_iif != 0;
+        return rt->rt_route_iif != 0;
 }
 
 static inline bool rt_is_output_route(struct rtable *rt)
 {
-        return rt->rt_iif == 0;
+        return rt->rt_route_iif == 0;
 }
 
 struct ip_rt_acct {
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index 78f18adb49c8..006e60b58306 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -401,9 +401,9 @@ TRACE_EVENT(block_plug,
 
 DECLARE_EVENT_CLASS(block_unplug,
 
-        TP_PROTO(struct request_queue *q),
+        TP_PROTO(struct request_queue *q, unsigned int depth),
 
-        TP_ARGS(q),
+        TP_ARGS(q, depth),
 
         TP_STRUCT__entry(
                 __field( int,           nr_rq                   )
@@ -411,7 +411,7 @@ DECLARE_EVENT_CLASS(block_unplug,
         ),
 
         TP_fast_assign(
-                __entry->nr_rq  = q->rq.count[READ] + q->rq.count[WRITE];
+                __entry->nr_rq = depth;
                 memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
         ),
 
@@ -419,31 +419,18 @@ DECLARE_EVENT_CLASS(block_unplug,
 );
 
 /**
- * block_unplug_timer - timed release of operations requests in queue to device driver
- * @q: request queue to unplug
- *
- * Unplug the request queue @q because a timer expired and allow block
- * operation requests to be sent to the device driver.
- */
-DEFINE_EVENT(block_unplug, block_unplug_timer,
-
-        TP_PROTO(struct request_queue *q),
-
-        TP_ARGS(q)
-);
-
-/**
  * block_unplug_io - release of operations requests in request queue
  * @q: request queue to unplug
+ * @depth: number of requests just added to the queue
  *
  * Unplug request queue @q because device driver is scheduled to work
  * on elements in the request queue.
  */
 DEFINE_EVENT(block_unplug, block_unplug_io,
 
-        TP_PROTO(struct request_queue *q),
+        TP_PROTO(struct request_queue *q, unsigned int depth),
 
-        TP_ARGS(q)
+        TP_ARGS(q, depth)
 );
 
 /**
diff --git a/kernel/futex.c b/kernel/futex.c
index dfb924ffe65b..fe28dc282eae 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1886,7 +1886,7 @@ retry:
         restart->futex.val = val;
         restart->futex.time = abs_time->tv64;
         restart->futex.bitset = bitset;
-        restart->futex.flags = flags;
+        restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;
 
         ret = -ERESTART_RESTARTBLOCK;
 
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 4603f08dc47b..6de9a8fc3417 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -18,9 +18,13 @@ config SUSPEND_FREEZER
 
           Turning OFF this setting is NOT recommended! If in doubt, say Y.
 
+config HIBERNATE_CALLBACKS
+        bool
+
 config HIBERNATION
         bool "Hibernation (aka 'suspend to disk')"
         depends on SWAP && ARCH_HIBERNATION_POSSIBLE
+        select HIBERNATE_CALLBACKS
         select LZO_COMPRESS
         select LZO_DECOMPRESS
         ---help---
@@ -85,7 +89,7 @@ config PM_STD_PARTITION
 
 config PM_SLEEP
         def_bool y
-        depends on SUSPEND || HIBERNATION || XEN_SAVE_RESTORE
+        depends on SUSPEND || HIBERNATE_CALLBACKS
 
 config PM_SLEEP_SMP
         def_bool y
diff --git a/kernel/sched.c b/kernel/sched.c
index 48013633d792..a187c3fe027b 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4111,20 +4111,20 @@ need_resched:
                                         try_to_wake_up_local(to_wakeup);
                         }
                         deactivate_task(rq, prev, DEQUEUE_SLEEP);
+
+                        /*
+                         * If we are going to sleep and we have plugged IO queued, make
+                         * sure to submit it to avoid deadlocks.
+                         */
+                        if (blk_needs_flush_plug(prev)) {
+                                raw_spin_unlock(&rq->lock);
+                                blk_flush_plug(prev);
+                                raw_spin_lock(&rq->lock);
+                        }
                 }
                 switch_count = &prev->nvcsw;
         }
 
-        /*
-         * If we are going to sleep and we have plugged IO queued, make
-         * sure to submit it to avoid deadlocks.
-         */
-        if (prev->state != TASK_RUNNING && blk_needs_flush_plug(prev)) {
-                raw_spin_unlock(&rq->lock);
-                blk_flush_plug(prev);
-                raw_spin_lock(&rq->lock);
-        }
-
         pre_schedule(rq, prev);
 
         if (unlikely(!rq->nr_running))
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 7f00772e57c9..6fa833ab2cb8 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -2104,21 +2104,20 @@ balance_tasks(struct rq *this_rq, int this_cpu, struct rq *busiest,
               enum cpu_idle_type idle, int *all_pinned,
               int *this_best_prio, struct cfs_rq *busiest_cfs_rq)
 {
-        int loops = 0, pulled = 0, pinned = 0;
+        int loops = 0, pulled = 0;
         long rem_load_move = max_load_move;
         struct task_struct *p, *n;
 
         if (max_load_move == 0)
                 goto out;
 
-        pinned = 1;
-
         list_for_each_entry_safe(p, n, &busiest_cfs_rq->tasks, se.group_node) {
                 if (loops++ > sysctl_sched_nr_migrate)
                         break;
 
                 if ((p->se.load.weight >> 1) > rem_load_move ||
-                    !can_migrate_task(p, busiest, this_cpu, sd, idle, &pinned))
+                    !can_migrate_task(p, busiest, this_cpu, sd, idle,
+                                      all_pinned))
                         continue;
 
                 pull_task(busiest, p, this_rq, this_cpu);
@@ -2153,9 +2152,6 @@ out:
          */
         schedstat_add(sd, lb_gained[idle], pulled);
 
-        if (all_pinned)
-                *all_pinned = pinned;
-
         return max_load_move - rem_load_move;
 }
 
@@ -3127,6 +3123,8 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
         if (!sds.busiest || sds.busiest_nr_running == 0)
                 goto out_balanced;
 
+        sds.avg_load = (SCHED_LOAD_SCALE * sds.total_load) / sds.total_pwr;
+
         /*
          * If the busiest group is imbalanced the below checks don't
          * work because they assumes all things are equal, which typically
@@ -3151,7 +3149,6 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
          * Don't pull any tasks if this group is already above the domain
          * average load.
          */
-        sds.avg_load = (SCHED_LOAD_SCALE * sds.total_load) / sds.total_pwr;
         if (sds.this_load >= sds.avg_load)
                 goto out_balanced;
 
@@ -3340,6 +3337,7 @@ redo:
                  * still unbalanced. ld_moved simply stays zero, so it is
                  * correctly treated as an imbalance.
                  */
+                all_pinned = 1;
                 local_irq_save(flags);
                 double_rq_lock(this_rq, busiest);
                 ld_moved = move_tasks(this_rq, this_cpu, busiest,
diff --git a/kernel/signal.c b/kernel/signal.c
index 29e233fd7a0f..7165af5f1b11 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2711,8 +2711,8 @@ out:
 /**
  *  sys_rt_sigaction - alter an action taken by a process
  *  @sig: signal to be sent
- *  @act: the thread group ID of the thread
- *  @oact: the PID of the thread
+ *  @act: new sigaction
+ *  @oact: used to save the previous sigaction
  *  @sigsetsize: size of sigset_t type
  */
 SYSCALL_DEFINE4(rt_sigaction, int, sig,
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 7aa40f8e182d..3e3970d53d14 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -850,32 +850,19 @@ static void blk_add_trace_plug(void *ignore, struct request_queue *q)
                 __blk_add_trace(bt, 0, 0, 0, BLK_TA_PLUG, 0, 0, NULL);
 }
 
-static void blk_add_trace_unplug_io(void *ignore, struct request_queue *q)
+static void blk_add_trace_unplug_io(void *ignore, struct request_queue *q,
+                                    unsigned int depth)
 {
         struct blk_trace *bt = q->blk_trace;
 
         if (bt) {
-                unsigned int pdu = q->rq.count[READ] + q->rq.count[WRITE];
-                __be64 rpdu = cpu_to_be64(pdu);
+                __be64 rpdu = cpu_to_be64(depth);
 
                 __blk_add_trace(bt, 0, 0, 0, BLK_TA_UNPLUG_IO, 0,
                                 sizeof(rpdu), &rpdu);
         }
 }
 
-static void blk_add_trace_unplug_timer(void *ignore, struct request_queue *q)
-{
-        struct blk_trace *bt = q->blk_trace;
-
-        if (bt) {
-                unsigned int pdu = q->rq.count[READ] + q->rq.count[WRITE];
-                __be64 rpdu = cpu_to_be64(pdu);
-
-                __blk_add_trace(bt, 0, 0, 0, BLK_TA_UNPLUG_TIMER, 0,
-                                sizeof(rpdu), &rpdu);
-        }
-}
-
 static void blk_add_trace_split(void *ignore,
                                 struct request_queue *q, struct bio *bio,
                                 unsigned int pdu)
@@ -1015,8 +1002,6 @@ static void blk_register_tracepoints(void)
         WARN_ON(ret);
         ret = register_trace_block_plug(blk_add_trace_plug, NULL);
         WARN_ON(ret);
-        ret = register_trace_block_unplug_timer(blk_add_trace_unplug_timer, NULL);
-        WARN_ON(ret);
         ret = register_trace_block_unplug_io(blk_add_trace_unplug_io, NULL);
         WARN_ON(ret);
         ret = register_trace_block_split(blk_add_trace_split, NULL);
@@ -1033,7 +1018,6 @@ static void blk_unregister_tracepoints(void)
         unregister_trace_block_bio_remap(blk_add_trace_bio_remap, NULL);
         unregister_trace_block_split(blk_add_trace_split, NULL);
         unregister_trace_block_unplug_io(blk_add_trace_unplug_io, NULL);
-        unregister_trace_block_unplug_timer(blk_add_trace_unplug_timer, NULL);
         unregister_trace_block_plug(blk_add_trace_plug, NULL);
         unregister_trace_block_sleeprq(blk_add_trace_sleeprq, NULL);
         unregister_trace_block_getrq(blk_add_trace_getrq, NULL);
@@ -1348,7 +1332,6 @@ static const struct {
         [__BLK_TA_COMPLETE]     = {{  "C", "complete" },   blk_log_with_error },
         [__BLK_TA_PLUG]         = {{  "P", "plug" },       blk_log_plug },
         [__BLK_TA_UNPLUG_IO]    = {{  "U", "unplug_io" },  blk_log_unplug },
-        [__BLK_TA_UNPLUG_TIMER] = {{ "UT", "unplug_timer" }, blk_log_unplug },
         [__BLK_TA_INSERT]       = {{  "I", "insert" },     blk_log_generic },
         [__BLK_TA_SPLIT]        = {{  "X", "split" },      blk_log_split },
         [__BLK_TA_BOUNCE]       = {{  "B", "bounce" },     blk_log_generic },
diff --git a/lib/kstrtox.c b/lib/kstrtox.c
index 05672e819f8c..a235f3cc471c 100644
--- a/lib/kstrtox.c
+++ b/lib/kstrtox.c
@@ -49,12 +49,9 @@ static int _kstrtoull(const char *s, unsigned int base, unsigned long long *res)
                         val = *s - '0';
                 else if ('a' <= _tolower(*s) && _tolower(*s) <= 'f')
                         val = _tolower(*s) - 'a' + 10;
-                else if (*s == '\n') {
-                        if (*(s + 1) == '\0')
-                                break;
-                        else
-                                return -EINVAL;
-                } else
+                else if (*s == '\n' && *(s + 1) == '\0')
+                        break;
+                else
                         return -EINVAL;
 
                 if (val >= base)
diff --git a/lib/test-kstrtox.c b/lib/test-kstrtox.c
index 325c2f9ecebd..d55769d63cb8 100644
--- a/lib/test-kstrtox.c
+++ b/lib/test-kstrtox.c
@@ -315,12 +315,12 @@ static void __init test_kstrtou64_ok(void)
                 {"65537",       10,     65537},
                 {"2147483646",  10,     2147483646},
                 {"2147483647",  10,     2147483647},
-                {"2147483648",  10,     2147483648},
-                {"2147483649",  10,     2147483649},
-                {"4294967294",  10,     4294967294},
-                {"4294967295",  10,     4294967295},
-                {"4294967296",  10,     4294967296},
-                {"4294967297",  10,     4294967297},
+                {"2147483648",  10,     2147483648ULL},
+                {"2147483649",  10,     2147483649ULL},
+                {"4294967294",  10,     4294967294ULL},
+                {"4294967295",  10,     4294967295ULL},
+                {"4294967296",  10,     4294967296ULL},
+                {"4294967297",  10,     4294967297ULL},
                 {"9223372036854775806", 10,     9223372036854775806ULL},
                 {"9223372036854775807", 10,     9223372036854775807ULL},
                 {"9223372036854775808", 10,     9223372036854775808ULL},
@@ -369,12 +369,12 @@ static void __init test_kstrtos64_ok(void)
                 {"65537",       10,     65537},
                 {"2147483646",  10,     2147483646},
                 {"2147483647",  10,     2147483647},
-                {"2147483648",  10,     2147483648},
-                {"2147483649",  10,     2147483649},
-                {"4294967294",  10,     4294967294},
-                {"4294967295",  10,     4294967295},
-                {"4294967296",  10,     4294967296},
-                {"4294967297",  10,     4294967297},
+                {"2147483648",  10,     2147483648LL},
+                {"2147483649",  10,     2147483649LL},
+                {"4294967294",  10,     4294967294LL},
+                {"4294967295",  10,     4294967295LL},
+                {"4294967296",  10,     4294967296LL},
+                {"4294967297",  10,     4294967297LL},
                 {"9223372036854775806", 10,     9223372036854775806LL},
                 {"9223372036854775807", 10,     9223372036854775807LL},
         };
@@ -418,10 +418,10 @@ static void __init test_kstrtou32_ok(void)
                 {"65537",       10,     65537},
                 {"2147483646",  10,     2147483646},
                 {"2147483647",  10,     2147483647},
-                {"2147483648",  10,     2147483648},
-                {"2147483649",  10,     2147483649},
-                {"4294967294",  10,     4294967294},
-                {"4294967295",  10,     4294967295},
+                {"2147483648",  10,     2147483648U},
+                {"2147483649",  10,     2147483649U},
+                {"4294967294",  10,     4294967294U},
+                {"4294967295",  10,     4294967295U},
         };
         TEST_OK(kstrtou32, u32, "%u", test_u32_ok);
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 0a619e0e2e0b..470dcda10add 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -244,24 +244,28 @@ static ssize_t single_flag_show(struct kobject *kobj,
                                 struct kobj_attribute *attr, char *buf,
                                 enum transparent_hugepage_flag flag)
 {
-        if (test_bit(flag, &transparent_hugepage_flags))
-                return sprintf(buf, "[yes] no\n");
-        else
-                return sprintf(buf, "yes [no]\n");
+        return sprintf(buf, "%d\n",
+                       !!test_bit(flag, &transparent_hugepage_flags));
 }
+
 static ssize_t single_flag_store(struct kobject *kobj,
                                  struct kobj_attribute *attr,
                                  const char *buf, size_t count,
                                  enum transparent_hugepage_flag flag)
 {
-        if (!memcmp("yes", buf,
-                    min(sizeof("yes")-1, count))) {
+        unsigned long value;
+        int ret;
+
+        ret = kstrtoul(buf, 10, &value);
+        if (ret < 0)
+                return ret;
+        if (value > 1)
+                return -EINVAL;
+
+        if (value)
                 set_bit(flag, &transparent_hugepage_flags);
-        } else if (!memcmp("no", buf,
-                           min(sizeof("no")-1, count))) {
+        else
                 clear_bit(flag, &transparent_hugepage_flags);
-        } else
-                return -EINVAL;
 
         return count;
 }
@@ -680,8 +684,11 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
                         return VM_FAULT_OOM;
                 page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
                                           vma, haddr, numa_node_id(), 0);
-                if (unlikely(!page))
+                if (unlikely(!page)) {
+                        count_vm_event(THP_FAULT_FALLBACK);
                         goto out;
+                }
+                count_vm_event(THP_FAULT_ALLOC);
                 if (unlikely(mem_cgroup_newpage_charge(page, mm, GFP_KERNEL))) {
                         put_page(page);
                         goto out;
@@ -909,11 +916,13 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 new_page = NULL;
 
         if (unlikely(!new_page)) {
+                count_vm_event(THP_FAULT_FALLBACK);
                 ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
                                                    pmd, orig_pmd, page, haddr);
                 put_page(page);
                 goto out;
         }
+        count_vm_event(THP_FAULT_ALLOC);
 
         if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
                 put_page(new_page);
@@ -1390,6 +1399,7 @@ int split_huge_page(struct page *page)
 
         BUG_ON(!PageSwapBacked(page));
         __split_huge_page(page, anon_vma);
+        count_vm_event(THP_SPLIT);
 
         BUG_ON(PageCompound(page));
 out_unlock:
@@ -1784,9 +1794,11 @@ static void collapse_huge_page(struct mm_struct *mm,
                                       node, __GFP_OTHER_NODE);
         if (unlikely(!new_page)) {
                 up_read(&mm->mmap_sem);
+                count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                 *hpage = ERR_PTR(-ENOMEM);
                 return;
         }
+        count_vm_event(THP_COLLAPSE_ALLOC);
         if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
                 up_read(&mm->mmap_sem);
                 put_page(new_page);
@@ -2151,8 +2163,11 @@ static void khugepaged_do_scan(struct page **hpage)
 #ifndef CONFIG_NUMA
                 if (!*hpage) {
                         *hpage = alloc_hugepage(khugepaged_defrag());
-                        if (unlikely(!*hpage))
+                        if (unlikely(!*hpage)) {
+                                count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                                 break;
+                        }
+                        count_vm_event(THP_COLLAPSE_ALLOC);
                 }
 #else
                 if (IS_ERR(*hpage))
@@ -2192,8 +2207,11 @@ static struct page *khugepaged_alloc_hugepage(void)
 
         do {
                 hpage = alloc_hugepage(khugepaged_defrag());
-                if (!hpage)
+                if (!hpage) {
+                        count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                         khugepaged_alloc_sleep();
+                } else
+                        count_vm_event(THP_COLLAPSE_ALLOC);
         } while (unlikely(!hpage) &&
                  likely(khugepaged_enabled()));
         return hpage;
@@ -2210,8 +2228,11 @@ static void khugepaged_loop(void)
         while (likely(khugepaged_enabled())) {
 #ifndef CONFIG_NUMA
                 hpage = khugepaged_alloc_hugepage();
-                if (unlikely(!hpage))
+                if (unlikely(!hpage)) {
+                        count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                         break;
+                }
+                count_vm_event(THP_COLLAPSE_ALLOC);
 #else
                 if (IS_ERR(hpage)) {
                         khugepaged_alloc_sleep();
diff --git a/mm/memory.c b/mm/memory.c
index 9da8cab1b1b0..ce22a250926f 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1410,6 +1410,13 @@ no_page_table:
         return page;
 }
 
+static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+{
+        return (vma->vm_flags & VM_GROWSDOWN) &&
+                (vma->vm_start == addr) &&
+                !vma_stack_continue(vma->vm_prev, addr);
+}
+
 /**
  * __get_user_pages() - pin user pages in memory
  * @tsk:        task_struct of target task
@@ -1488,7 +1495,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                 vma = find_extend_vma(mm, start);
                 if (!vma && in_gate_area(mm, start)) {
                         unsigned long pg = start & PAGE_MASK;
-                        struct vm_area_struct *gate_vma = get_gate_vma(mm);
                         pgd_t *pgd;
                         pud_t *pud;
                         pmd_t *pmd;
@@ -1513,10 +1519,11 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 pte_unmap(pte);
                                 return i ? : -EFAULT;
                         }
+                        vma = get_gate_vma(mm);
                         if (pages) {
                                 struct page *page;
 
-                                page = vm_normal_page(gate_vma, start, *pte);
+                                page = vm_normal_page(vma, start, *pte);
                                 if (!page) {
                                         if (!(gup_flags & FOLL_DUMP) &&
                                              is_zero_pfn(pte_pfn(*pte)))
@@ -1530,12 +1537,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 get_page(page);
                         }
                         pte_unmap(pte);
-                        if (vmas)
-                                vmas[i] = gate_vma;
-                        i++;
-                        start += PAGE_SIZE;
-                        nr_pages--;
-                        continue;
+                        goto next_page;
                 }
 
                 if (!vma ||
@@ -1549,6 +1551,13 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         continue;
                 }
 
+                /*
+                 * If we don't actually want the page itself,
+                 * and it's the stack guard page, just skip it.
+                 */
+                if (!pages && stack_guard_page(vma, start))
+                        goto next_page;
+
                 do {
                         struct page *page;
                         unsigned int foll_flags = gup_flags;
@@ -1631,6 +1640,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 flush_anon_page(vma, page, start);
                                 flush_dcache_page(page);
                         }
+next_page:
                         if (vmas)
                                 vmas[i] = vma;
                         i++;
@@ -3678,7 +3688,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
                          */
 #ifdef CONFIG_HAVE_IOREMAP_PROT
                         vma = find_vma(mm, addr);
-                        if (!vma)
+                        if (!vma || vma->vm_start > addr)
                                 break;
                         if (vma->vm_ops && vma->vm_ops->access)
                                 ret = vma->vm_ops->access(vma, addr, buf,
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a2acaf820fe5..9ca1d604f7cd 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -375,7 +375,7 @@ void online_page(struct page *page)
 #endif
 
 #ifdef CONFIG_FLATMEM
-        max_mapnr = max(page_to_pfn(page), max_mapnr);
+        max_mapnr = max(pfn, max_mapnr);
 #endif
 
         ClearPageReserved(page);
diff --git a/mm/mlock.c b/mm/mlock.c
index 2689a08c79af..6b55e3efe0df 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -135,13 +135,6 @@ void munlock_vma_page(struct page *page)
         }
 }
 
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-{
-        return (vma->vm_flags & VM_GROWSDOWN) &&
-                (vma->vm_start == addr) &&
-                !vma_stack_continue(vma->vm_prev, addr);
-}
-
 /**
  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
  * @vma:   target vma
@@ -188,12 +181,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         if (vma->vm_flags & VM_LOCKED)
                 gup_flags |= FOLL_MLOCK;
 
-        /* We don't try to access the guard page of a stack vma */
-        if (stack_guard_page(vma, start)) {
-                addr += PAGE_SIZE;
-                nr_pages--;
-        }
-
         return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
                                 NULL, NULL, nonblocking);
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index 2ec8eb5a9cdd..e27e0cf0de03 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -259,7 +259,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
          * randomize_va_space to 2, which will still cause mm->start_brk
          * to be arbitrarily shifted
          */
-        if (mm->start_brk > PAGE_ALIGN(mm->end_data))
+        if (current->brk_randomized)
                 min_brk = mm->start_brk;
         else
                 min_brk = mm->end_data;
@@ -1814,11 +1814,14 @@ static int expand_downwards(struct vm_area_struct *vma,
                 size = vma->vm_end - address;
                 grow = (vma->vm_start - address) >> PAGE_SHIFT;
 
-                error = acct_stack_growth(vma, size, grow);
-                if (!error) {
-                        vma->vm_start = address;
-                        vma->vm_pgoff -= grow;
-                        perf_event_mmap(vma);
+                error = -ENOMEM;
+                if (grow <= vma->vm_pgoff) {
+                        error = acct_stack_growth(vma, size, grow);
+                        if (!error) {
+                                vma->vm_start = address;
+                                vma->vm_pgoff -= grow;
+                                perf_event_mmap(vma);
+                        }
                 }
         }
         vma_unlock_anon_vma(vma);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 6a819d1b2c7d..83fb72c108b7 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -84,24 +84,6 @@ static bool has_intersects_mems_allowed(struct task_struct *tsk,
 #endif /* CONFIG_NUMA */
 
 /*
- * If this is a system OOM (not a memcg OOM) and the task selected to be
- * killed is not already running at high (RT) priorities, speed up the
- * recovery by boosting the dying task to the lowest FIFO priority.
- * That helps with the recovery and avoids interfering with RT tasks.
- */
-static void boost_dying_task_prio(struct task_struct *p,
-                                  struct mem_cgroup *mem)
-{
-        struct sched_param param = { .sched_priority = 1 };
-
-        if (mem)
-                return;
-
-        if (!rt_task(p))
-                sched_setscheduler_nocheck(p, SCHED_FIFO, &param);
-}
-
-/*
  * The process p may have detached its own ->mm while exiting or through
  * use_mm(), but one or more of its subthreads may still have a valid
  * pointer.  Return p, or any of its subthreads with a valid ->mm, with
@@ -452,13 +434,6 @@ static int oom_kill_task(struct task_struct *p, struct mem_cgroup *mem)
         set_tsk_thread_flag(p, TIF_MEMDIE);
         force_sig(SIGKILL, p);
 
-        /*
-         * We give our sacrificial lamb high priority and access to
-         * all the memory it needs. That way it should be able to
-         * exit() and clear out its resources quickly...
-         */
-        boost_dying_task_prio(p, mem);
-
         return 0;
 }
 #undef K
@@ -482,7 +457,6 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
          */
         if (p->flags & PF_EXITING) {
                 set_tsk_thread_flag(p, TIF_MEMDIE);
-                boost_dying_task_prio(p, mem);
                 return 0;
         }
 
@@ -556,7 +530,6 @@ void mem_cgroup_out_of_memory(struct mem_cgroup *mem, gfp_t gfp_mask)
          */
         if (fatal_signal_pending(current)) {
                 set_thread_flag(TIF_MEMDIE);
-                boost_dying_task_prio(current, NULL);
                 return;
         }
 
@@ -712,7 +685,6 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
          */
         if (fatal_signal_pending(current)) {
                 set_thread_flag(TIF_MEMDIE);
-                boost_dying_task_prio(current, NULL);
                 return;
         }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 2747f5e5abc1..9f8a97b9a350 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3176,7 +3176,7 @@ static __init_refok int __build_all_zonelists(void *data)
  * Called with zonelists_mutex held always
  * unless system_state == SYSTEM_BOOTING.
  */
-void build_all_zonelists(void *data)
+void __ref build_all_zonelists(void *data)
 {
         set_zonelist_order();
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 58da7c150ba6..8fa27e4e582a 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -421,7 +421,8 @@ static swp_entry_t *shmem_swp_alloc(struct shmem_inode_info *info, unsigned long
                  * a waste to allocate index if we cannot allocate data.
                  */
                 if (sbinfo->max_blocks) {
-                        if (percpu_counter_compare(&sbinfo->used_blocks, (sbinfo->max_blocks - 1)) > 0)
+                        if (percpu_counter_compare(&sbinfo->used_blocks,
+                                                sbinfo->max_blocks - 1) >= 0)
                                 return ERR_PTR(-ENOSPC);
                         percpu_counter_inc(&sbinfo->used_blocks);
                         spin_lock(&inode->i_lock);
@@ -1397,7 +1398,8 @@ repeat:
                 shmem_swp_unmap(entry);
                 sbinfo = SHMEM_SB(inode->i_sb);
                 if (sbinfo->max_blocks) {
-                        if ((percpu_counter_compare(&sbinfo->used_blocks, sbinfo->max_blocks) > 0) ||
+                        if (percpu_counter_compare(&sbinfo->used_blocks,
+                                                sbinfo->max_blocks) >= 0 ||
                             shmem_acct_block(info->flags)) {
                                 spin_unlock(&info->lock);
                                 error = -ENOSPC;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c7f5a6d4b75b..f6b435c80079 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -41,6 +41,7 @@
 #include <linux/memcontrol.h>
 #include <linux/delayacct.h>
 #include <linux/sysctl.h>
+#include <linux/oom.h>
 
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -1988,17 +1989,12 @@ static bool zone_reclaimable(struct zone *zone)
         return zone->pages_scanned < zone_reclaimable_pages(zone) * 6;
 }
 
-/*
- * As hibernation is going on, kswapd is freezed so that it can't mark
- * the zone into all_unreclaimable. It can't handle OOM during hibernation.
- * So let's check zone's unreclaimable in direct reclaim as well as kswapd.
- */
+/* All zones in zonelist are unreclaimable? */
 static bool all_unreclaimable(struct zonelist *zonelist,
                 struct scan_control *sc)
 {
         struct zoneref *z;
         struct zone *zone;
-        bool all_unreclaimable = true;
 
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
                         gfp_zone(sc->gfp_mask), sc->nodemask) {
@@ -2006,13 +2002,11 @@ static bool all_unreclaimable(struct zonelist *zonelist,
                         continue;
                 if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
                         continue;
-                if (zone_reclaimable(zone)) {
-                        all_unreclaimable = false;
-                        break;
-                }
+                if (!zone->all_unreclaimable)
+                        return false;
         }
 
-        return all_unreclaimable;
+        return true;
 }
 
 /*
@@ -2108,6 +2102,14 @@ out:
         if (sc->nr_reclaimed)
                 return sc->nr_reclaimed;
 
+        /*
+         * As hibernation is going on, kswapd is freezed so that it can't mark
+         * the zone into all_unreclaimable. Thus bypassing all_unreclaimable
+         * check.
+         */
+        if (oom_killer_disabled)
+                return 0;
+
         /* top priority shrink_zones still had more to do? don't OOM, then */
         if (scanning_global_lru(sc) && !all_unreclaimable(zonelist, sc))
                 return 1;
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 772b39b87d95..897ea9e88238 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -321,9 +321,12 @@ static inline void mod_state(struct zone *zone,
                 /*
                  * The fetching of the stat_threshold is racy. We may apply
                  * a counter threshold to the wrong the cpu if we get
-                 * rescheduled while executing here. However, the following
-                 * will apply the threshold again and therefore bring the
-                 * counter under the threshold.
+                 * rescheduled while executing here. However, the next
+                 * counter update will apply the threshold again and
+                 * therefore bring the counter under the threshold again.
+                 *
+                 * Most of the time the thresholds are the same anyways
+                 * for all cpus in a zone.
                  */
                 t = this_cpu_read(pcp->stat_threshold);
 
@@ -945,7 +948,16 @@ static const char * const vmstat_text[] = {
         "unevictable_pgs_cleared",
         "unevictable_pgs_stranded",
         "unevictable_pgs_mlockfreed",
+
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        "thp_fault_alloc",
+        "thp_fault_fallback",
+        "thp_collapse_alloc",
+        "thp_collapse_alloc_failed",
+        "thp_split",
 #endif
+
+#endif /* CONFIG_VM_EVENTS_COUNTERS */
 };
 
 static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
diff --git a/net/9p/client.c b/net/9p/client.c
index 48b8e084e710..77367745be9b 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -929,15 +929,15 @@ error:
 }
 EXPORT_SYMBOL(p9_client_attach);
 
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-        int clone)
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+                char **wnames, int clone)
 {
         int err;
         struct p9_client *clnt;
         struct p9_fid *fid;
         struct p9_qid *wqids;
         struct p9_req_t *req;
-        int16_t nwqids, count;
+        uint16_t nwqids, count;
 
         err = 0;
         wqids = NULL;
@@ -955,7 +955,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
                 fid = oldfid;
 
 
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %d wname[0] %s\n",
+        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %ud wname[0] %s\n",
                 oldfid->fid, fid->fid, nwname, wnames ? wnames[0] : NULL);
 
         req = p9_client_rpc(clnt, P9_TWALK, "ddT", oldfid->fid, fid->fid,
@@ -1220,27 +1220,6 @@ error:
 }
 EXPORT_SYMBOL(p9_client_fsync);
 
-int p9_client_sync_fs(struct p9_fid *fid)
-{
-        int err = 0;
-        struct p9_req_t *req;
-        struct p9_client *clnt;
-
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TSYNC_FS fid %d\n", fid->fid);
-
-        clnt = fid->clnt;
-        req = p9_client_rpc(clnt, P9_TSYNCFS, "d", fid->fid);
-        if (IS_ERR(req)) {
-                err = PTR_ERR(req);
-                goto error;
-        }
-        P9_DPRINTK(P9_DEBUG_9P, "<<< RSYNCFS fid %d\n", fid->fid);
-        p9_free_req(clnt, req);
-error:
-        return err;
-}
-EXPORT_SYMBOL(p9_client_sync_fs);
-
 int p9_client_clunk(struct p9_fid *fid)
 {
         int err;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 8a4084fa8b5a..b58a501cf3d1 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -265,7 +265,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                         }
                         break;
                 case 'T':{
-                                int16_t *nwname = va_arg(ap, int16_t *);
+                                uint16_t *nwname = va_arg(ap, uint16_t *);
                                 char ***wnames = va_arg(ap, char ***);
 
                                 errcode = p9pdu_readf(pdu, proto_version,
@@ -468,7 +468,8 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                 case 'E':{
                                  int32_t cnt = va_arg(ap, int32_t);
                                  const char *k = va_arg(ap, const void *);
-                                 const char *u = va_arg(ap, const void *);
+                                 const char __user *u = va_arg(ap,
+                                                        const void __user *);
                                  errcode = p9pdu_writef(pdu, proto_version, "d",
                                                  cnt);
                                  if (!errcode && pdu_write_urw(pdu, k, u, cnt))
@@ -495,7 +496,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                         }
                         break;
                 case 'T':{
-                                int16_t nwname = va_arg(ap, int);
+                                uint16_t nwname = va_arg(ap, int);
                                 const char **wnames = va_arg(ap, const char **);
 
                                 errcode = p9pdu_writef(pdu, proto_version, "w",
diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
index d47880e971dd..e883172f9aa2 100644
--- a/net/9p/trans_common.c
+++ b/net/9p/trans_common.c
@@ -66,7 +66,7 @@ p9_payload_gup(struct p9_req_t *req, size_t *pdata_off, int *pdata_len,
         uint32_t pdata_mapped_pages;
         struct trans_rpage_info  *rpinfo;
 
-        *pdata_off = (size_t)req->tc->pubuf & (PAGE_SIZE-1);
+        *pdata_off = (__force size_t)req->tc->pubuf & (PAGE_SIZE-1);
 
         if (*pdata_off)
                 first_page_bytes = min(((size_t)PAGE_SIZE - *pdata_off),
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index e8f046b07182..244e70742183 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -326,8 +326,11 @@ req_retry_pinned:
                         outp = pack_sg_list_p(chan->sg, out, VIRTQUEUE_NUM,
                                         pdata_off, rpinfo->rp_data, pdata_len);
                 } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
-                                                                req->tc->pkbuf;
+                        char *pbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
                         outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
                                         req->tc->pbuf_size);
                 }
@@ -352,8 +355,12 @@ req_retry_pinned:
                         in = pack_sg_list_p(chan->sg, out+inp, VIRTQUEUE_NUM,
                                         pdata_off, rpinfo->rp_data, pdata_len);
                 } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
-                                                                req->tc->pkbuf;
+                        char *pbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
+
                         in = pack_sg_list(chan->sg, out+inp, VIRTQUEUE_NUM,
                                         pbuf, req->tc->pbuf_size);
                 }
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 50af02737a3d..5a80f41c0cba 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -579,9 +579,15 @@ static void __kick_osd_requests(struct ceph_osd_client *osdc,
 
         list_for_each_entry_safe(req, nreq, &osd->o_linger_requests,
                                  r_linger_osd) {
-                __unregister_linger_request(osdc, req);
+                /*
+                 * reregister request prior to unregistering linger so
+                 * that r_osd is preserved.
+                 */
+                BUG_ON(!list_empty(&req->r_req_lru_item));
                 __register_request(osdc, req);
-                list_move(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_osd_item, &req->r_osd->o_requests);
+                __unregister_linger_request(osdc, req);
                 dout("requeued lingering %p tid %llu osd%d\n", req, req->r_tid,
                      osd->o_osd);
         }
@@ -798,7 +804,7 @@ static void __register_request(struct ceph_osd_client *osdc,
         req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
         INIT_LIST_HEAD(&req->r_req_lru_item);
 
-        dout("register_request %p tid %lld\n", req, req->r_tid);
+        dout("__register_request %p tid %lld\n", req, req->r_tid);
         __insert_request(osdc, req);
         ceph_osdc_get_request(req);
         osdc->num_requests++;
diff --git a/net/dsa/mv88e6131.c b/net/dsa/mv88e6131.c
index d951f93644bf..3da418894efc 100644
--- a/net/dsa/mv88e6131.c
+++ b/net/dsa/mv88e6131.c
@@ -14,6 +14,13 @@
 #include "dsa_priv.h"
 #include "mv88e6xxx.h"
 
+/*
+ * Switch product IDs
+ */
+#define ID_6085         0x04a0
+#define ID_6095         0x0950
+#define ID_6131         0x1060
+
 static char *mv88e6131_probe(struct mii_bus *bus, int sw_addr)
 {
         int ret;
@@ -21,9 +28,11 @@ static char *mv88e6131_probe(struct mii_bus *bus, int sw_addr)
         ret = __mv88e6xxx_reg_read(bus, sw_addr, REG_PORT(0), 0x03);
         if (ret >= 0) {
                 ret &= 0xfff0;
-                if (ret == 0x0950)
+                if (ret == ID_6085)
+                        return "Marvell 88E6085";
+                if (ret == ID_6095)
                         return "Marvell 88E6095/88E6095F";
-                if (ret == 0x1060)
+                if (ret == ID_6131)
                         return "Marvell 88E6131";
         }
 
@@ -164,6 +173,7 @@ static int mv88e6131_setup_global(struct dsa_switch *ds)
 
 static int mv88e6131_setup_port(struct dsa_switch *ds, int p)
 {
+        struct mv88e6xxx_priv_state *ps = (void *)(ds + 1);
         int addr = REG_PORT(p);
         u16 val;
 
@@ -171,10 +181,13 @@ static int mv88e6131_setup_port(struct dsa_switch *ds, int p)
          * MAC Forcing register: don't force link, speed, duplex
          * or flow control state to any particular values on physical
          * ports, but force the CPU port and all DSA ports to 1000 Mb/s
-         * full duplex.
+         * (100 Mb/s on 6085) full duplex.
          */
         if (dsa_is_cpu_port(ds, p) || ds->dsa_port_mask & (1 << p))
-                REG_WRITE(addr, 0x01, 0x003e);
+                if (ps->id == ID_6085)
+                        REG_WRITE(addr, 0x01, 0x003d); /* 100 Mb/s */
+                else
+                        REG_WRITE(addr, 0x01, 0x003e); /* 1000 Mb/s */
         else
                 REG_WRITE(addr, 0x01, 0x0003);
 
@@ -286,6 +299,8 @@ static int mv88e6131_setup(struct dsa_switch *ds)
         mv88e6xxx_ppu_state_init(ds);
         mutex_init(&ps->stats_mutex);
 
+        ps->id = REG_READ(REG_PORT(0), 0x03) & 0xfff0;
+
         ret = mv88e6131_switch_reset(ds);
         if (ret < 0)
                 return ret;
diff --git a/net/dsa/mv88e6xxx.h b/net/dsa/mv88e6xxx.h
index eb0e0aaa9f1b..61156ca26a0d 100644
--- a/net/dsa/mv88e6xxx.h
+++ b/net/dsa/mv88e6xxx.h
@@ -39,6 +39,8 @@ struct mv88e6xxx_priv_state {
          * Hold this mutex over snapshot + dump sequences.
          */
         struct mutex    stats_mutex;
+
+        int             id; /* switch product id */
 };
 
 struct mv88e6xxx_hw_stat {
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index f3c0b549b8e1..4614babdc45f 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -221,9 +221,10 @@ static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
         return csum;
 }
 
-static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip_route(struct net *net, struct dst_entry **dst,
+                       struct flowi *fl, bool strict __always_unused)
 {
-        struct rtable *rt = ip_route_output_key(&init_net, &fl->u.ip4);
+        struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
         if (IS_ERR(rt))
                 return PTR_ERR(rt);
         *dst = &rt->dst;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ea107515c53e..c1acf69858fd 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1891,6 +1891,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 #ifdef CONFIG_IP_ROUTE_CLASSID
         rth->dst.tclassid = itag;
 #endif
+        rth->rt_route_iif = dev->ifindex;
         rth->rt_iif     = dev->ifindex;
         rth->dst.dev    = init_net.loopback_dev;
         dev_hold(rth->dst.dev);
@@ -2026,6 +2027,7 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->rt_key_src = saddr;
         rth->rt_src     = saddr;
         rth->rt_gateway = daddr;
+        rth->rt_route_iif = in_dev->dev->ifindex;
         rth->rt_iif     = in_dev->dev->ifindex;
         rth->dst.dev    = (out_dev)->dev;
         dev_hold(rth->dst.dev);
@@ -2202,6 +2204,7 @@ local_input:
 #ifdef CONFIG_IP_ROUTE_CLASSID
         rth->dst.tclassid = itag;
 #endif
+        rth->rt_route_iif = dev->ifindex;
         rth->rt_iif     = dev->ifindex;
         rth->dst.dev    = net->loopback_dev;
         dev_hold(rth->dst.dev);
@@ -2401,7 +2404,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
         rth->rt_mark    = oldflp4->flowi4_mark;
         rth->rt_dst     = fl4->daddr;
         rth->rt_src     = fl4->saddr;
-        rth->rt_iif     = 0;
+        rth->rt_route_iif = 0;
+        rth->rt_iif     = oldflp4->flowi4_oif ? : dev_out->ifindex;
         /* get references to the devices that are to be hold by the routing
            cache entry */
         rth->dst.dev    = dev_out;
@@ -2716,6 +2720,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                 rt->rt_key_dst = ort->rt_key_dst;
                 rt->rt_key_src = ort->rt_key_src;
                 rt->rt_tos = ort->rt_tos;
+                rt->rt_route_iif = ort->rt_route_iif;
                 rt->rt_iif = ort->rt_iif;
                 rt->rt_oif = ort->rt_oif;
                 rt->rt_mark = ort->rt_mark;
@@ -2725,7 +2730,6 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                 rt->rt_type = ort->rt_type;
                 rt->rt_dst = ort->rt_dst;
                 rt->rt_src = ort->rt_src;
-                rt->rt_iif = ort->rt_iif;
                 rt->rt_gateway = ort->rt_gateway;
                 rt->rt_spec_dst = ort->rt_spec_dst;
                 rt->peer = ort->peer;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 13e0e7f659ff..d20a05e970d8 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -74,6 +74,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         rt->rt_key_dst = fl4->daddr;
         rt->rt_key_src = fl4->saddr;
         rt->rt_tos = fl4->flowi4_tos;
+        rt->rt_route_iif = fl4->flowi4_iif;
         rt->rt_iif = fl4->flowi4_iif;
         rt->rt_oif = fl4->flowi4_oif;
         rt->rt_mark = fl4->flowi4_mark;
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 39aaca2b4fd2..28bc1f644b7b 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -90,9 +90,18 @@ static int nf_ip6_reroute(struct sk_buff *skb,
         return 0;
 }
 
-static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip6_route(struct net *net, struct dst_entry **dst,
+                        struct flowi *fl, bool strict)
 {
-        *dst = ip6_route_output(&init_net, NULL, &fl->u.ip6);
+        static const struct ipv6_pinfo fake_pinfo;
+        static const struct inet_sock fake_sk = {
+                /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
+                .sk.sk_bound_dev_if = 1,
+                .pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
+        };
+        const void *sk = strict ? &fake_sk : NULL;
+
+        *dst = ip6_route_output(net, sk, &fl->u.ip6);
         return (*dst)->error;
 }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 56fa12538d45..4f49e5dd41bb 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1622,6 +1622,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, GFP_ATOMIC);
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                sock_rps_save_rxhash(sk, skb->rxhash);
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
                 if (opt_skb)
@@ -1649,7 +1650,8 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                                 __kfree_skb(opt_skb);
                         return 0;
                 }
-        }
+        } else
+                sock_rps_save_rxhash(sk, skb->rxhash);
 
         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
                 goto reset;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d7037c006e13..15c37746845e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -505,6 +505,9 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
         int rc;
         int is_udplite = IS_UDPLITE(sk);
 
+        if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
+                sock_rps_save_rxhash(sk, skb->rxhash);
+
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto drop;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9d192d665ff5..c5d4530d8284 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2541,7 +2541,6 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
                  * same TID from the same station
                  */
                 rx->skb = skb;
-                rx->flags = 0;
 
                 CALL_RXH(ieee80211_rx_h_decrypt)
                 CALL_RXH(ieee80211_rx_h_check_more_data)
@@ -2612,6 +2611,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
                 .sdata = sta->sdata,
                 .local = sta->local,
                 .queue = tid,
+                .flags = 0,
         };
         struct tid_ampdu_rx *tid_agg_rx;
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index c3f988aa1152..32bff6d86cb2 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -652,7 +652,6 @@ comment "Xtables matches"
 config NETFILTER_XT_MATCH_ADDRTYPE
         tristate '"addrtype" address type match support'
         depends on NETFILTER_ADVANCED
-        depends on (IPV6 || IPV6=n)
         ---help---
           This option allows you to match what routing thinks of an address,
           eg. UNICAST, LOCAL, BROADCAST, ...
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index bca96990218d..a113ff066928 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -338,8 +338,7 @@ bitmap_ip_head(struct ip_set *set, struct sk_buff *skb)
         NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
         if (map->netmask != 32)
                 NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask);
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-                      htonl(atomic_read(&set->ref) - 1));
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
         NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                       htonl(sizeof(*map) + map->memsize));
         if (with_timeout(map->timeout))
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 5e790172deff..00a33242e90c 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -434,8 +434,7 @@ bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
                 goto nla_put_failure;
         NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
         NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-                      htonl(atomic_read(&set->ref) - 1));
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
         NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                       htonl(sizeof(*map)
                             + (map->last_ip - map->first_ip + 1) * map->dsize));
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
index 165f09b1a9cb..6b38eb8f6ed8 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -320,8 +320,7 @@ bitmap_port_head(struct ip_set *set, struct sk_buff *skb)
                 goto nla_put_failure;
         NLA_PUT_NET16(skb, IPSET_ATTR_PORT, htons(map->first_port));
         NLA_PUT_NET16(skb, IPSET_ATTR_PORT_TO, htons(map->last_port));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-                      htonl(atomic_read(&set->ref) - 1));
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
         NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                       htonl(sizeof(*map) + map->memsize));
         if (with_timeout(map->timeout))
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 253326e8d990..9152e69a162d 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -26,6 +26,7 @@
 
 static LIST_HEAD(ip_set_type_list);             /* all registered set types */
 static DEFINE_MUTEX(ip_set_type_mutex);         /* protects ip_set_type_list */
+static DEFINE_RWLOCK(ip_set_ref_lock);          /* protects the set refs */
 
 static struct ip_set **ip_set_list;             /* all individual sets */
 static ip_set_id_t ip_set_max = CONFIG_IP_SET_MAX; /* max number of sets */
@@ -301,13 +302,18 @@ EXPORT_SYMBOL_GPL(ip_set_get_ipaddr6);
 static inline void
 __ip_set_get(ip_set_id_t index)
 {
-        atomic_inc(&ip_set_list[index]->ref);
+        write_lock_bh(&ip_set_ref_lock);
+        ip_set_list[index]->ref++;
+        write_unlock_bh(&ip_set_ref_lock);
 }
 
 static inline void
 __ip_set_put(ip_set_id_t index)
 {
-        atomic_dec(&ip_set_list[index]->ref);
+        write_lock_bh(&ip_set_ref_lock);
+        BUG_ON(ip_set_list[index]->ref == 0);
+        ip_set_list[index]->ref--;
+        write_unlock_bh(&ip_set_ref_lock);
 }
 
 /*
@@ -324,7 +330,7 @@ ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
         struct ip_set *set = ip_set_list[index];
         int ret = 0;
 
-        BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+        BUG_ON(set == NULL);
         pr_debug("set %s, index %u\n", set->name, index);
 
         if (dim < set->type->dimension ||
@@ -356,7 +362,7 @@ ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
         struct ip_set *set = ip_set_list[index];
         int ret;
 
-        BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+        BUG_ON(set == NULL);
         pr_debug("set %s, index %u\n", set->name, index);
 
         if (dim < set->type->dimension ||
@@ -378,7 +384,7 @@ ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
         struct ip_set *set = ip_set_list[index];
         int ret = 0;
 
-        BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+        BUG_ON(set == NULL);
         pr_debug("set %s, index %u\n", set->name, index);
 
         if (dim < set->type->dimension ||
@@ -397,7 +403,6 @@ EXPORT_SYMBOL_GPL(ip_set_del);
  * Find set by name, reference it once. The reference makes sure the
  * thing pointed to, does not go away under our feet.
  *
- * The nfnl mutex must already be activated.
  */
 ip_set_id_t
 ip_set_get_byname(const char *name, struct ip_set **set)
@@ -423,15 +428,12 @@ EXPORT_SYMBOL_GPL(ip_set_get_byname);
  * reference count by 1. The caller shall not assume the index
  * to be valid, after calling this function.
  *
- * The nfnl mutex must already be activated.
  */
 void
 ip_set_put_byindex(ip_set_id_t index)
 {
-        if (ip_set_list[index] != NULL) {
-                BUG_ON(atomic_read(&ip_set_list[index]->ref) == 0);
+        if (ip_set_list[index] != NULL)
                 __ip_set_put(index);
-        }
 }
 EXPORT_SYMBOL_GPL(ip_set_put_byindex);
 
@@ -441,7 +443,6 @@ EXPORT_SYMBOL_GPL(ip_set_put_byindex);
  * can't be destroyed. The set cannot be renamed due to
  * the referencing either.
  *
- * The nfnl mutex must already be activated.
  */
 const char *
 ip_set_name_byindex(ip_set_id_t index)
@@ -449,7 +450,7 @@ ip_set_name_byindex(ip_set_id_t index)
         const struct ip_set *set = ip_set_list[index];
 
         BUG_ON(set == NULL);
-        BUG_ON(atomic_read(&set->ref) == 0);
+        BUG_ON(set->ref == 0);
 
         /* Referenced, so it's safe */
         return set->name;
@@ -515,10 +516,7 @@ void
 ip_set_nfnl_put(ip_set_id_t index)
 {
         nfnl_lock();
-        if (ip_set_list[index] != NULL) {
-                BUG_ON(atomic_read(&ip_set_list[index]->ref) == 0);
-                __ip_set_put(index);
-        }
+        ip_set_put_byindex(index);
         nfnl_unlock();
 }
 EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
@@ -526,7 +524,7 @@ EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
 /*
  * Communication protocol with userspace over netlink.
  *
- * We already locked by nfnl_lock.
+ * The commands are serialized by the nfnl mutex.
  */
 
 static inline bool
@@ -657,7 +655,6 @@ ip_set_create(struct sock *ctnl, struct sk_buff *skb,
                 return -ENOMEM;
         rwlock_init(&set->lock);
         strlcpy(set->name, name, IPSET_MAXNAMELEN);
-        atomic_set(&set->ref, 0);
         set->family = family;
 
         /*
@@ -690,8 +687,8 @@ ip_set_create(struct sock *ctnl, struct sk_buff *skb,
 
         /*
          * Here, we have a valid, constructed set and we are protected
-         * by nfnl_lock. Find the first free index in ip_set_list and
-         * check clashing.
+         * by the nfnl mutex. Find the first free index in ip_set_list
+         * and check clashing.
          */
         if ((ret = find_free_id(set->name, &index, &clash)) != 0) {
                 /* If this is the same set and requested, ignore error */
@@ -751,31 +748,51 @@ ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
                const struct nlattr * const attr[])
 {
         ip_set_id_t i;
+        int ret = 0;
 
         if (unlikely(protocol_failed(attr)))
                 return -IPSET_ERR_PROTOCOL;
 
-        /* References are protected by the nfnl mutex */
+        /* Commands are serialized and references are
+         * protected by the ip_set_ref_lock.
+         * External systems (i.e. xt_set) must call
+         * ip_set_put|get_nfnl_* functions, that way we
+         * can safely check references here.
+         *
+         * list:set timer can only decrement the reference
+         * counter, so if it's already zero, we can proceed
+         * without holding the lock.
+         */
+        read_lock_bh(&ip_set_ref_lock);
         if (!attr[IPSET_ATTR_SETNAME]) {
                 for (i = 0; i < ip_set_max; i++) {
-                        if (ip_set_list[i] != NULL &&
-                            (atomic_read(&ip_set_list[i]->ref)))
-                                return -IPSET_ERR_BUSY;
+                        if (ip_set_list[i] != NULL && ip_set_list[i]->ref) {
+                                ret = IPSET_ERR_BUSY;
+                                goto out;
+                        }
                 }
+                read_unlock_bh(&ip_set_ref_lock);
                 for (i = 0; i < ip_set_max; i++) {
                         if (ip_set_list[i] != NULL)
                                 ip_set_destroy_set(i);
                 }
         } else {
                 i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
-                if (i == IPSET_INVALID_ID)
-                        return -ENOENT;
-                else if (atomic_read(&ip_set_list[i]->ref))
-                        return -IPSET_ERR_BUSY;
+                if (i == IPSET_INVALID_ID) {
+                        ret = -ENOENT;
+                        goto out;
+                } else if (ip_set_list[i]->ref) {
+                        ret = -IPSET_ERR_BUSY;
+                        goto out;
+                }
+                read_unlock_bh(&ip_set_ref_lock);
 
                 ip_set_destroy_set(i);
         }
         return 0;
+out:
+        read_unlock_bh(&ip_set_ref_lock);
+        return ret;
 }
 
 /* Flush sets */
@@ -834,6 +851,7 @@ ip_set_rename(struct sock *ctnl, struct sk_buff *skb,
         struct ip_set *set;
         const char *name2;
         ip_set_id_t i;
+        int ret = 0;
 
         if (unlikely(protocol_failed(attr) ||
                      attr[IPSET_ATTR_SETNAME] == NULL ||
@@ -843,25 +861,33 @@ ip_set_rename(struct sock *ctnl, struct sk_buff *skb,
         set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
         if (set == NULL)
                 return -ENOENT;
-        if (atomic_read(&set->ref) != 0)
-                return -IPSET_ERR_REFERENCED;
+
+        read_lock_bh(&ip_set_ref_lock);
+        if (set->ref != 0) {
+                ret = -IPSET_ERR_REFERENCED;
+                goto out;
+        }
 
         name2 = nla_data(attr[IPSET_ATTR_SETNAME2]);
         for (i = 0; i < ip_set_max; i++) {
                 if (ip_set_list[i] != NULL &&
-                    STREQ(ip_set_list[i]->name, name2))
-                        return -IPSET_ERR_EXIST_SETNAME2;
+                    STREQ(ip_set_list[i]->name, name2)) {
+                        ret = -IPSET_ERR_EXIST_SETNAME2;
+                        goto out;
+                }
         }
         strncpy(set->name, name2, IPSET_MAXNAMELEN);
 
-        return 0;
+out:
+        read_unlock_bh(&ip_set_ref_lock);
+        return ret;
 }
 
 /* Swap two sets so that name/index points to the other.
  * References and set names are also swapped.
  *
- * We are protected by the nfnl mutex and references are
- * manipulated only by holding the mutex. The kernel interfaces
+ * The commands are serialized by the nfnl mutex and references are
+ * protected by the ip_set_ref_lock. The kernel interfaces
  * do not hold the mutex but the pointer settings are atomic
  * so the ip_set_list always contains valid pointers to the sets.
  */
@@ -874,7 +900,6 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
         struct ip_set *from, *to;
         ip_set_id_t from_id, to_id;
         char from_name[IPSET_MAXNAMELEN];
-        u32 from_ref;
 
         if (unlikely(protocol_failed(attr) ||
                      attr[IPSET_ATTR_SETNAME] == NULL ||
@@ -899,17 +924,15 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
               from->type->family == to->type->family))
                 return -IPSET_ERR_TYPE_MISMATCH;
 
-        /* No magic here: ref munging protected by the nfnl_lock */
         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
-        from_ref = atomic_read(&from->ref);
-
         strncpy(from->name, to->name, IPSET_MAXNAMELEN);
-        atomic_set(&from->ref, atomic_read(&to->ref));
         strncpy(to->name, from_name, IPSET_MAXNAMELEN);
-        atomic_set(&to->ref, from_ref);
 
+        write_lock_bh(&ip_set_ref_lock);
+        swap(from->ref, to->ref);
         ip_set_list[from_id] = to;
         ip_set_list[to_id] = from;
+        write_unlock_bh(&ip_set_ref_lock);
 
         return 0;
 }
@@ -926,7 +949,7 @@ ip_set_dump_done(struct netlink_callback *cb)
 {
         if (cb->args[2]) {
                 pr_debug("release set %s\n", ip_set_list[cb->args[1]]->name);
-                __ip_set_put((ip_set_id_t) cb->args[1]);
+                ip_set_put_byindex((ip_set_id_t) cb->args[1]);
         }
         return 0;
 }
@@ -1068,7 +1091,7 @@ release_refcount:
         /* If there was an error or set is done, release set */
         if (ret || !cb->args[2]) {
                 pr_debug("release set %s\n", ip_set_list[index]->name);
-                __ip_set_put(index);
+                ip_set_put_byindex(index);
         }
 
         /* If we dump all sets, continue with dumping last ones */
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index a47c32982f06..e9159e99fc4b 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -43,14 +43,19 @@ struct list_set {
 static inline struct set_elem *
 list_set_elem(const struct list_set *map, u32 id)
 {
-        return (struct set_elem *)((char *)map->members + id * map->dsize);
+        return (struct set_elem *)((void *)map->members + id * map->dsize);
+}
+
+static inline struct set_telem *
+list_set_telem(const struct list_set *map, u32 id)
+{
+        return (struct set_telem *)((void *)map->members + id * map->dsize);
 }
 
 static inline bool
 list_set_timeout(const struct list_set *map, u32 id)
 {
-        const struct set_telem *elem =
-                (const struct set_telem *) list_set_elem(map, id);
+        const struct set_telem *elem = list_set_telem(map, id);
 
         return ip_set_timeout_test(elem->timeout);
 }
@@ -58,19 +63,11 @@ list_set_timeout(const struct list_set *map, u32 id)
 static inline bool
 list_set_expired(const struct list_set *map, u32 id)
 {
-        const struct set_telem *elem =
-                (const struct set_telem *) list_set_elem(map, id);
+        const struct set_telem *elem = list_set_telem(map, id);
 
         return ip_set_timeout_expired(elem->timeout);
 }
 
-static inline int
-list_set_exist(const struct set_telem *elem)
-{
-        return elem->id != IPSET_INVALID_ID &&
-               !ip_set_timeout_expired(elem->timeout);
-}
-
 /* Set list without and with timeout */
 
 static int
@@ -146,11 +143,11 @@ list_elem_tadd(struct list_set *map, u32 i, ip_set_id_t id,
         struct set_telem *e;
 
         for (; i < map->size; i++) {
-                e = (struct set_telem *)list_set_elem(map, i);
+                e = list_set_telem(map, i);
                 swap(e->id, id);
+                swap(e->timeout, timeout);
                 if (e->id == IPSET_INVALID_ID)
                         break;
-                swap(e->timeout, timeout);
         }
 }
 
@@ -164,7 +161,7 @@ list_set_add(struct list_set *map, u32 i, ip_set_id_t id,
                 /* Last element replaced: e.g. add new,before,last */
                 ip_set_put_byindex(e->id);
         if (with_timeout(map->timeout))
-                list_elem_tadd(map, i, id, timeout);
+                list_elem_tadd(map, i, id, ip_set_timeout_set(timeout));
         else
                 list_elem_add(map, i, id);
 
@@ -172,11 +169,11 @@ list_set_add(struct list_set *map, u32 i, ip_set_id_t id,
 }
 
 static int
-list_set_del(struct list_set *map, ip_set_id_t id, u32 i)
+list_set_del(struct list_set *map, u32 i)
 {
         struct set_elem *a = list_set_elem(map, i), *b;
 
-        ip_set_put_byindex(id);
+        ip_set_put_byindex(a->id);
 
         for (; i < map->size - 1; i++) {
                 b = list_set_elem(map, i + 1);
@@ -308,11 +305,11 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],
                                  (before == 0 ||
                                   (before > 0 &&
                                    next_id_eq(map, i, refid))))
-                                ret = list_set_del(map, id, i);
+                                ret = list_set_del(map, i);
                         else if (before < 0 &&
                                  elem->id == refid &&
                                  next_id_eq(map, i, id))
-                                ret = list_set_del(map, id, i + 1);
+                                ret = list_set_del(map, i + 1);
                 }
                 break;
         default:
@@ -369,8 +366,7 @@ list_set_head(struct ip_set *set, struct sk_buff *skb)
         NLA_PUT_NET32(skb, IPSET_ATTR_SIZE, htonl(map->size));
         if (with_timeout(map->timeout))
                 NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-                      htonl(atomic_read(&set->ref) - 1));
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
         NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                       htonl(sizeof(*map) + map->size * map->dsize));
         ipset_nest_end(skb, nested);
@@ -461,16 +457,13 @@ list_set_gc(unsigned long ul_set)
         struct set_telem *e;
         u32 i;
 
-        /* We run parallel with other readers (test element)
-         * but adding/deleting new entries is locked out */
-        read_lock_bh(&set->lock);
-        for (i = map->size - 1; i >= 0; i--) {
-                e = (struct set_telem *) list_set_elem(map, i);
-                if (e->id != IPSET_INVALID_ID &&
-                    list_set_expired(map, i))
-                        list_set_del(map, e->id, i);
+        write_lock_bh(&set->lock);
+        for (i = 0; i < map->size; i++) {
+                e = list_set_telem(map, i);
+                if (e->id != IPSET_INVALID_ID && list_set_expired(map, i))
+                        list_set_del(map, i);
         }
-        read_unlock_bh(&set->lock);
+        write_unlock_bh(&set->lock);
 
         map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
         add_timer(&map->gc);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 33733c8872e7..ae47090bf45f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3120,7 +3120,7 @@ nla_put_failure:
 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
                                    struct netlink_callback *cb)
 {
-        struct net *net = skb_net(skb);
+        struct net *net = skb_sknet(skb);
         struct netns_ipvs *ipvs = net_ipvs(net);
 
         mutex_lock(&__ip_vs_mutex);
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 867882313e49..bcd5ed6b7130 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -631,7 +631,7 @@ static int decode_seqof(bitstr_t *bs, const struct field_t *f,
                 CHECK_BOUND(bs, 2);
                 count = *bs->cur++;
                 count <<= 8;
-                count = *bs->cur++;
+                count += *bs->cur++;
                 break;
         case SEMI:
                 BYTE_ALIGN(bs);
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 533a183e6661..18b2ce5c8ced 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -731,10 +731,10 @@ static int callforward_do_filter(const union nf_inet_addr *src,
 
                 memset(&fl2, 0, sizeof(fl2));
                 fl2.daddr = dst->ip;
-                if (!afinfo->route((struct dst_entry **)&rt1,
-                                   flowi4_to_flowi(&fl1))) {
-                        if (!afinfo->route((struct dst_entry **)&rt2,
-                                           flowi4_to_flowi(&fl2))) {
+                if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
+                                   flowi4_to_flowi(&fl1), false)) {
+                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
+                                           flowi4_to_flowi(&fl2), false)) {
                                 if (rt1->rt_gateway == rt2->rt_gateway &&
                                     rt1->dst.dev  == rt2->dst.dev)
                                         ret = 1;
@@ -755,10 +755,10 @@ static int callforward_do_filter(const union nf_inet_addr *src,
 
                 memset(&fl2, 0, sizeof(fl2));
                 ipv6_addr_copy(&fl2.daddr, &dst->in6);
-                if (!afinfo->route((struct dst_entry **)&rt1,
-                                   flowi6_to_flowi(&fl1))) {
-                        if (!afinfo->route((struct dst_entry **)&rt2,
-                                           flowi6_to_flowi(&fl2))) {
+                if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
+                                   flowi6_to_flowi(&fl1), false)) {
+                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
+                                           flowi6_to_flowi(&fl2), false)) {
                                 if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
                                             sizeof(rt1->rt6i_gateway)) &&
                                     rt1->dst.dev == rt2->dst.dev)
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 6e6b46cb1db9..9e63b43faeed 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -166,7 +166,7 @@ static u_int32_t tcpmss_reverse_mtu(const struct sk_buff *skb,
         rcu_read_lock();
         ai = nf_get_afinfo(family);
         if (ai != NULL)
-                ai->route((struct dst_entry **)&rt, &fl);
+                ai->route(&init_net, (struct dst_entry **)&rt, &fl, false);
         rcu_read_unlock();
 
         if (rt != NULL) {
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 2220b85e9519..b77d383cec78 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -32,11 +32,32 @@ MODULE_ALIAS("ipt_addrtype");
 MODULE_ALIAS("ip6t_addrtype");
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
+static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
+                            const struct in6_addr *addr)
 {
+        const struct nf_afinfo *afinfo;
+        struct flowi6 flow;
+        struct rt6_info *rt;
         u32 ret;
+        int route_err;
 
-        if (!rt)
+        memset(&flow, 0, sizeof(flow));
+        ipv6_addr_copy(&flow.daddr, addr);
+        if (dev)
+                flow.flowi6_oif = dev->ifindex;
+
+        rcu_read_lock();
+
+        afinfo = nf_get_afinfo(NFPROTO_IPV6);
+        if (afinfo != NULL)
+                route_err = afinfo->route(net, (struct dst_entry **)&rt,
+                                        flowi6_to_flowi(&flow), !!dev);
+        else
+                route_err = 1;
+
+        rcu_read_unlock();
+
+        if (route_err)
                 return XT_ADDRTYPE_UNREACHABLE;
 
         if (rt->rt6i_flags & RTF_REJECT)
@@ -48,6 +69,9 @@ static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
                 ret |= XT_ADDRTYPE_LOCAL;
         if (rt->rt6i_flags & RTF_ANYCAST)
                 ret |= XT_ADDRTYPE_ANYCAST;
+
+
+        dst_release(&rt->dst);
         return ret;
 }
 
@@ -65,18 +89,8 @@ static bool match_type6(struct net *net, const struct net_device *dev,
                 return false;
 
         if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
-             XT_ADDRTYPE_UNREACHABLE) & mask) {
-                struct rt6_info *rt;
-                u32 type;
-                int ifindex = dev ? dev->ifindex : 0;
-
-                rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);
-
-                type = xt_addrtype_rt6_to_type(rt);
-
-                dst_release(&rt->dst);
-                return !!(mask & type);
-        }
+             XT_ADDRTYPE_UNREACHABLE) & mask)
+                return !!(mask & match_lookup_rt6(net, dev, addr));
         return true;
 }
 
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 2c0086a4751e..481a86fdc409 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -195,7 +195,7 @@ conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
                 return info->match_flags & XT_CONNTRACK_STATE;
         if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
             (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
-            !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
+            !(info->invert_flags & XT_CONNTRACK_DIRECTION))
                 return false;
 
         if (info->match_flags & XT_CONNTRACK_ORIGSRC)
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 9022f0a6503e..0a9a2ec2e469 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -427,7 +427,7 @@ static int
 context_derive_keys_rc4(struct krb5_ctx *ctx)
 {
         struct crypto_hash *hmac;
-        static const char sigkeyconstant[] = "signaturekey";
+        char sigkeyconstant[] = "signaturekey";
         int slen = strlen(sigkeyconstant) + 1;  /* include null terminator */
         struct hash_desc desc;
         struct scatterlist sg[1];
diff --git a/sound/arm/pxa2xx-pcm-lib.c b/sound/arm/pxa2xx-pcm-lib.c
index 8808b82311b1..76e0d5695075 100644
--- a/sound/arm/pxa2xx-pcm-lib.c
+++ b/sound/arm/pxa2xx-pcm-lib.c
@@ -140,6 +140,9 @@ int __pxa2xx_pcm_prepare(struct snd_pcm_substream *substream)
         if (!prtd || !prtd->params)
                 return 0;
 
+        if (prtd->dma_ch == -1)
+                return -EINVAL;
+
         DCSR(prtd->dma_ch) &= ~DCSR_RUN;
         DCSR(prtd->dma_ch) = 0;
         DCMD(prtd->dma_ch) = 0;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 69e33869a53e..ad97d937d3a8 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3035,6 +3035,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
         SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
+        SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
         SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS),
         SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */
         {}
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 251773e45f61..715615a88a8d 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1280,6 +1280,39 @@ static int simple_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
                                              stream_tag, format, substream);
 }
 
+static void nvhdmi_8ch_7x_set_info_frame_parameters(struct hda_codec *codec,
+                                                    int channels)
+{
+        unsigned int chanmask;
+        int chan = channels ? (channels - 1) : 1;
+
+        switch (channels) {
+        default:
+        case 0:
+        case 2:
+                chanmask = 0x00;
+                break;
+        case 4:
+                chanmask = 0x08;
+                break;
+        case 6:
+                chanmask = 0x0b;
+                break;
+        case 8:
+                chanmask = 0x13;
+                break;
+        }
+
+        /* Set the audio infoframe channel allocation and checksum fields.  The
+         * channel count is computed implicitly by the hardware. */
+        snd_hda_codec_write(codec, 0x1, 0,
+                        Nv_VERB_SET_Channel_Allocation, chanmask);
+
+        snd_hda_codec_write(codec, 0x1, 0,
+                        Nv_VERB_SET_Info_Frame_Checksum,
+                        (0x71 - chan - chanmask));
+}
+
 static int nvhdmi_8ch_7x_pcm_close(struct hda_pcm_stream *hinfo,
                                    struct hda_codec *codec,
                                    struct snd_pcm_substream *substream)
@@ -1298,6 +1331,10 @@ static int nvhdmi_8ch_7x_pcm_close(struct hda_pcm_stream *hinfo,
                                 AC_VERB_SET_STREAM_FORMAT, 0);
         }
 
+        /* The audio hardware sends a channel count of 0x7 (8ch) when all the
+         * streams are disabled. */
+        nvhdmi_8ch_7x_set_info_frame_parameters(codec, 8);
+
         return snd_hda_multi_out_dig_close(codec, &spec->multiout);
 }
 
@@ -1308,37 +1345,16 @@ static int nvhdmi_8ch_7x_pcm_prepare(struct hda_pcm_stream *hinfo,
                                      struct snd_pcm_substream *substream)
 {
         int chs;
-        unsigned int dataDCC1, dataDCC2, chan, chanmask, channel_id;
+        unsigned int dataDCC1, dataDCC2, channel_id;
         int i;
 
         mutex_lock(&codec->spdif_mutex);
 
         chs = substream->runtime->channels;
-        chan = chs ? (chs - 1) : 1;
 
-        switch (chs) {
-        default:
-        case 0:
-        case 2:
-                chanmask = 0x00;
-                break;
-        case 4:
-                chanmask = 0x08;
-                break;
-        case 6:
-                chanmask = 0x0b;
-                break;
-        case 8:
-                chanmask = 0x13;
-                break;
-        }
         dataDCC1 = AC_DIG1_ENABLE | AC_DIG1_COPYRIGHT;
         dataDCC2 = 0x2;
 
-        /* set the Audio InforFrame Channel Allocation */
-        snd_hda_codec_write(codec, 0x1, 0,
-                        Nv_VERB_SET_Channel_Allocation, chanmask);
-
         /* turn off SPDIF once; otherwise the IEC958 bits won't be updated */
         if (codec->spdif_status_reset && (codec->spdif_ctls & AC_DIG1_ENABLE))
                 snd_hda_codec_write(codec,
@@ -1413,10 +1429,7 @@ static int nvhdmi_8ch_7x_pcm_prepare(struct hda_pcm_stream *hinfo,
                 }
         }
 
-        /* set the Audio Info Frame Checksum */
-        snd_hda_codec_write(codec, 0x1, 0,
-                        Nv_VERB_SET_Info_Frame_Checksum,
-                        (0x71 - chan - chanmask));
+        nvhdmi_8ch_7x_set_info_frame_parameters(codec, chs);
 
         mutex_unlock(&codec->spdif_mutex);
         return 0;
@@ -1512,6 +1525,11 @@ static int patch_nvhdmi_8ch_7x(struct hda_codec *codec)
         spec->multiout.max_channels = 8;
         spec->pcm_playback = &nvhdmi_pcm_playback_8ch_7x;
         codec->patch_ops = nvhdmi_patch_ops_8ch_7x;
+
+        /* Initialize the audio infoframe channel mask and checksum to something
+         * valid */
+        nvhdmi_8ch_7x_set_info_frame_parameters(codec, 8);
+
         return 0;
 }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7e28a64884f6..52928d9a72da 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -14124,7 +14124,7 @@ static hda_nid_t alc269vb_capsrc_nids[1] = {
 };
 
 static hda_nid_t alc269_adc_candidates[] = {
-        0x08, 0x09, 0x07,
+        0x08, 0x09, 0x07, 0x11,
 };
 
 #define alc269_modes            alc260_modes
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 1395991c39f2..94d19c03a7f4 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -3408,6 +3408,9 @@ static int get_connection_index(struct hda_codec *codec, hda_nid_t mux,
         hda_nid_t conn[HDA_MAX_NUM_INPUTS];
         int i, nums;
 
+        if (!(get_wcaps(codec, mux) & AC_WCAP_CONN_LIST))
+                return -1;
+
         nums = snd_hda_get_connections(codec, mux, conn, ARRAY_SIZE(conn));
         for (i = 0; i < nums; i++)
                 if (conn[i] == nid)
diff --git a/sound/soc/pxa/pxa2xx-pcm.c b/sound/soc/pxa/pxa2xx-pcm.c
index 02fb66416ddc..2ce0b2d891d5 100644
--- a/sound/soc/pxa/pxa2xx-pcm.c
+++ b/sound/soc/pxa/pxa2xx-pcm.c
@@ -65,6 +65,7 @@ static int pxa2xx_pcm_hw_free(struct snd_pcm_substream *substream)
         if (prtd->dma_ch >= 0) {
                 pxa_free_dma(prtd->dma_ch);
                 prtd->dma_ch = -1;
+                prtd->params = NULL;
         }
 
         return 0;
diff --git a/sound/soc/pxa/zylonite.c b/sound/soc/pxa/zylonite.c
index ac577263b3e3..b6445757fc54 100644
--- a/sound/soc/pxa/zylonite.c
+++ b/sound/soc/pxa/zylonite.c
@@ -167,7 +167,7 @@ static struct snd_soc_dai_link zylonite_dai[] = {
         .codec_name = "wm9713-codec",
         .platform_name = "pxa-pcm-audio",
         .cpu_dai_name = "pxa2xx-ac97",
-        .codec_name = "wm9713-hifi",
+        .codec_dai_name = "wm9713-hifi",
         .init = zylonite_wm9713_init,
 },
 {
@@ -176,7 +176,7 @@ static struct snd_soc_dai_link zylonite_dai[] = {
         .codec_name = "wm9713-codec",
         .platform_name = "pxa-pcm-audio",
         .cpu_dai_name = "pxa2xx-ac97-aux",
-        .codec_name = "wm9713-aux",
+        .codec_dai_name = "wm9713-aux",
 },
 {
         .name = "WM9713 Voice",
@@ -184,7 +184,7 @@ static struct snd_soc_dai_link zylonite_dai[] = {
         .codec_name = "wm9713-codec",
         .platform_name = "pxa-pcm-audio",
         .cpu_dai_name = "pxa-ssp-dai.2",
-        .codec_name = "wm9713-voice",
+        .codec_dai_name = "wm9713-voice",
         .ops = &zylonite_voice_ops,
 },
 };
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 4dda58926bc5..b76b74db0968 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -92,8 +92,8 @@ static int min_bytes_needed(unsigned long val)
 static int format_register_str(struct snd_soc_codec *codec,
                                unsigned int reg, char *buf, size_t len)
 {
-        int wordsize = codec->driver->reg_word_size * 2;
-        int regsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+        int wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+        int regsize = codec->driver->reg_word_size * 2;
         int ret;
         char tmpbuf[len + 1];
         char regbuf[regsize + 1];
@@ -132,8 +132,8 @@ static ssize_t soc_codec_reg_show(struct snd_soc_codec *codec, char *buf,
         size_t total = 0;
         loff_t p = 0;
 
-        wordsize = codec->driver->reg_word_size * 2;
-        regsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+        wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2;
+        regsize = codec->driver->reg_word_size * 2;
 
         len = wordsize + regsize + 2 + 1;
 
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index b4b39c0b6c9e..f9289102886a 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1301,6 +1301,7 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi* umidi,
         case USB_ID(0x15ca, 0x0101): /* Textech USB Midi Cable */
         case USB_ID(0x15ca, 0x1806): /* Textech USB Midi Cable */
         case USB_ID(0x1a86, 0x752d): /* QinHeng CH345 "USB2.0-MIDI" */
+        case USB_ID(0xfc08, 0x0101): /* Unknown vendor Cable */
                 ep->max_transfer = 4;
                 break;
                 /*