Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	net/mac80211/ht.c

233 files changed, 4034 insertions, 928 deletions

diff --git a/.gitignore b/.gitignore
index b93fb7eff942..946c7ec5c922 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@
 *.elf
 *.bin
 *.gz
+*.bz2
 *.lzma
 *.patch
 *.gcno
diff --git a/Documentation/fb/framebuffer.txt b/Documentation/fb/framebuffer.txt
index b3e3a0356839..fe79e3c8847d 100644
--- a/Documentation/fb/framebuffer.txt
+++ b/Documentation/fb/framebuffer.txt
@@ -312,10 +312,8 @@ and to the following documentation:
 8. Mailing list
 ---------------
 
-There are several frame buffer device related mailing lists at SourceForge:
-  - linux-fbdev-announce@lists.sourceforge.net, for announcements,
-  - linux-fbdev-user@lists.sourceforge.net, for generic user support,
-  - linux-fbdev-devel@lists.sourceforge.net, for project developers.
+There is a frame buffer device related mailing list at kernel.org:
+linux-fbdev@vger.kernel.org.
 
 Point your web browser to http://sourceforge.net/projects/linux-fbdev/ for
 subscription information and archive browsing.
diff --git a/Documentation/filesystems/caching/fscache.txt b/Documentation/filesystems/caching/fscache.txt
index 9e94b9491d89..a91e2e2095b0 100644
--- a/Documentation/filesystems/caching/fscache.txt
+++ b/Documentation/filesystems/caching/fscache.txt
@@ -235,6 +235,7 @@ proc files.
                 neg=N   Number of negative lookups made
                 pos=N   Number of positive lookups made
                 crt=N   Number of objects created by lookup
+                tmo=N   Number of lookups timed out and requeued
         Updates n=N     Number of update cookie requests seen
                 nul=N   Number of upd reqs given a NULL parent
                 run=N   Number of upd reqs granted CPU time
@@ -250,8 +251,10 @@ proc files.
                 ok=N    Number of successful alloc reqs
                 wt=N    Number of alloc reqs that waited on lookup completion
                 nbf=N   Number of alloc reqs rejected -ENOBUFS
+                int=N   Number of alloc reqs aborted -ERESTARTSYS
                 ops=N   Number of alloc reqs submitted
                 owt=N   Number of alloc reqs waited for CPU time
+                abt=N   Number of alloc reqs aborted due to object death
         Retrvls n=N     Number of retrieval (read) requests seen
                 ok=N    Number of successful retr reqs
                 wt=N    Number of retr reqs that waited on lookup completion
@@ -261,6 +264,7 @@ proc files.
                 oom=N   Number of retr reqs failed -ENOMEM
                 ops=N   Number of retr reqs submitted
                 owt=N   Number of retr reqs waited for CPU time
+                abt=N   Number of retr reqs aborted due to object death
         Stores  n=N     Number of storage (write) requests seen
                 ok=N    Number of successful store reqs
                 agn=N   Number of store reqs on a page already pending storage
@@ -268,12 +272,37 @@ proc files.
                 oom=N   Number of store reqs failed -ENOMEM
                 ops=N   Number of store reqs submitted
                 run=N   Number of store reqs granted CPU time
+                pgs=N   Number of pages given store req processing time
+                rxd=N   Number of store reqs deleted from tracking tree
+                olm=N   Number of store reqs over store limit
+        VmScan  nos=N   Number of release reqs against pages with no pending store
+                gon=N   Number of release reqs against pages stored by time lock granted
+                bsy=N   Number of release reqs ignored due to in-progress store
+                can=N   Number of page stores cancelled due to release req
         Ops     pend=N  Number of times async ops added to pending queues
                 run=N   Number of times async ops given CPU time
                 enq=N   Number of times async ops queued for processing
+                can=N   Number of async ops cancelled
+                rej=N   Number of async ops rejected due to object lookup/create failure
                 dfr=N   Number of async ops queued for deferred release
                 rel=N   Number of async ops released
                 gc=N    Number of deferred-release async ops garbage collected
+        CacheOp alo=N   Number of in-progress alloc_object() cache ops
+                luo=N   Number of in-progress lookup_object() cache ops
+                luc=N   Number of in-progress lookup_complete() cache ops
+                gro=N   Number of in-progress grab_object() cache ops
+                upo=N   Number of in-progress update_object() cache ops
+                dro=N   Number of in-progress drop_object() cache ops
+                pto=N   Number of in-progress put_object() cache ops
+                syn=N   Number of in-progress sync_cache() cache ops
+                atc=N   Number of in-progress attr_changed() cache ops
+                rap=N   Number of in-progress read_or_alloc_page() cache ops
+                ras=N   Number of in-progress read_or_alloc_pages() cache ops
+                alp=N   Number of in-progress allocate_page() cache ops
+                als=N   Number of in-progress allocate_pages() cache ops
+                wrp=N   Number of in-progress write_page() cache ops
+                ucp=N   Number of in-progress uncache_page() cache ops
+                dsp=N   Number of in-progress dissociate_pages() cache ops
 
 
  (*) /proc/fs/fscache/histogram
@@ -299,6 +328,87 @@ proc files.
      jiffy range covered, and the SECS field the equivalent number of seconds.
 
 
+===========
+OBJECT LIST
+===========
+
+If CONFIG_FSCACHE_OBJECT_LIST is enabled, the FS-Cache facility will maintain a
+list of all the objects currently allocated and allow them to be viewed
+through:
+
+        /proc/fs/fscache/objects
+
+This will look something like:
+
+        [root@andromeda ~]# head /proc/fs/fscache/objects
+        OBJECT   PARENT   STAT CHLDN OPS OOP IPR EX READS EM EV F S | NETFS_COOKIE_DEF TY FL NETFS_DATA       OBJECT_KEY, AUX_DATA
+        ======== ======== ==== ===== === === === == ===== == == = = | ================ == == ================ ================
+           17e4b        2 ACTV     0   0   0   0  0     0 7b  4 0 8 | NFS.fh           DT  0 ffff88001dd82820 010006017edcf8bbc93b43298fdfbe71e50b57b13a172c0117f38472, e567634700000000000000000000000063f2404a000000000000000000000000c9030000000000000000000063f2404a
+           1693a        2 ACTV     0   0   0   0  0     0 7b  4 0 8 | NFS.fh           DT  0 ffff88002db23380 010006017edcf8bbc93b43298fdfbe71e50b57b1e0162c01a2df0ea6, 420ebc4a000000000000000000000000420ebc4a0000000000000000000000000e1801000000000000000000420ebc4a
+
+where the first set of columns before the '|' describe the object:
+
+        COLUMN  DESCRIPTION
+        ======= ===============================================================
+        OBJECT  Object debugging ID (appears as OBJ%x in some debug messages)
+        PARENT  Debugging ID of parent object
+        STAT    Object state
+        CHLDN   Number of child objects of this object
+        OPS     Number of outstanding operations on this object
+        OOP     Number of outstanding child object management operations
+        IPR
+        EX      Number of outstanding exclusive operations
+        READS   Number of outstanding read operations
+        EM      Object's event mask
+        EV      Events raised on this object
+        F       Object flags
+        S       Object slow-work work item flags
+
+and the second set of columns describe the object's cookie, if present:
+
+        COLUMN          DESCRIPTION
+        =============== =======================================================
+        NETFS_COOKIE_DEF Name of netfs cookie definition
+        TY              Cookie type (IX - index, DT - data, hex - special)
+        FL              Cookie flags
+        NETFS_DATA      Netfs private data stored in the cookie
+        OBJECT_KEY      Object key      } 1 column, with separating comma
+        AUX_DATA        Object aux data } presence may be configured
+
+The data shown may be filtered by attaching the a key to an appropriate keyring
+before viewing the file.  Something like:
+
+                keyctl add user fscache:objlist <restrictions> @s
+
+where <restrictions> are a selection of the following letters:
+
+        K       Show hexdump of object key (don't show if not given)
+        A       Show hexdump of object aux data (don't show if not given)
+
+and the following paired letters:
+
+        C       Show objects that have a cookie
+        c       Show objects that don't have a cookie
+        B       Show objects that are busy
+        b       Show objects that aren't busy
+        W       Show objects that have pending writes
+        w       Show objects that don't have pending writes
+        R       Show objects that have outstanding reads
+        r       Show objects that don't have outstanding reads
+        S       Show objects that have slow work queued
+        s       Show objects that don't have slow work queued
+
+If neither side of a letter pair is given, then both are implied.  For example:
+
+        keyctl add user fscache:objlist KB @s
+
+shows objects that are busy, and lists their object keys, but does not dump
+their auxiliary data.  It also implies "CcWwRrSs", but as 'B' is given, 'b' is
+not implied.
+
+By default all objects and all fields will be shown.
+
+
 =========
 DEBUGGING
 =========
diff --git a/Documentation/filesystems/caching/netfs-api.txt b/Documentation/filesystems/caching/netfs-api.txt
index 2666b1ed5e9e..1902c57b72ef 100644
--- a/Documentation/filesystems/caching/netfs-api.txt
+++ b/Documentation/filesystems/caching/netfs-api.txt
@@ -641,7 +641,7 @@ data file must be retired (see the relinquish cookie function below).
 
 Furthermore, note that this does not cancel the asynchronous read or write
 operation started by the read/alloc and write functions, so the page
-invalidation and release functions must use:
+invalidation functions must use:
 
         bool fscache_check_page_write(struct fscache_cookie *cookie,
                                       struct page *page);
@@ -654,6 +654,25 @@ to see if a page is being written to the cache, and:
 to wait for it to finish if it is.
 
 
+When releasepage() is being implemented, a special FS-Cache function exists to
+manage the heuristics of coping with vmscan trying to eject pages, which may
+conflict with the cache trying to write pages to the cache (which may itself
+need to allocate memory):
+
+        bool fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                        struct page *page,
+                                        gfp_t gfp);
+
+This takes the netfs cookie, and the page and gfp arguments as supplied to
+releasepage().  It will return false if the page cannot be released yet for
+some reason and if it returns true, the page has been uncached and can now be
+released.
+
+To make a page available for release, this function may wait for an outstanding
+storage request to complete, or it may attempt to cancel the storage request -
+in which case the page will not be stored in the cache this time.
+
+
 ==========================
 INDEX AND DATA FILE UPDATE
 ==========================
diff --git a/Documentation/filesystems/ocfs2.txt b/Documentation/filesystems/ocfs2.txt
index c2a0871280a0..c58b9f5ba002 100644
--- a/Documentation/filesystems/ocfs2.txt
+++ b/Documentation/filesystems/ocfs2.txt
@@ -20,15 +20,16 @@ Lots of code taken from ext3 and other projects.
 Authors in alphabetical order:
 Joel Becker   <joel.becker@oracle.com>
 Zach Brown    <zach.brown@oracle.com>
-Mark Fasheh   <mark.fasheh@oracle.com>
+Mark Fasheh   <mfasheh@suse.com>
 Kurt Hackel   <kurt.hackel@oracle.com>
+Tao Ma        <tao.ma@oracle.com>
 Sunil Mushran <sunil.mushran@oracle.com>
 Manish Singh  <manish.singh@oracle.com>
+Tiger Yang    <tiger.yang@oracle.com>
 
 Caveats
 =======
 Features which OCFS2 does not support yet:
-        - quotas
         - Directory change notification (F_NOTIFY)
         - Distributed Caching (F_SETLEASE/F_GETLEASE/break_lease)
 
@@ -70,7 +71,6 @@ commit=nrsec	(*)	Ocfs2 can be told to sync all its data and metadata
                         performance.
 localalloc=8(*)         Allows custom localalloc size in MB. If the value is too
                         large, the fs will silently revert it to the default.
-                        Localalloc is not enabled for local mounts.
 localflocks             This disables cluster aware flock.
 inode64                 Indicates that Ocfs2 is allowed to create inodes at
                         any location in the filesystem, including those which
diff --git a/Documentation/slow-work.txt b/Documentation/slow-work.txt
index ebc50f808ea4..9dbf4470c7e1 100644
--- a/Documentation/slow-work.txt
+++ b/Documentation/slow-work.txt
@@ -41,6 +41,13 @@ expand files, provided the time taken to do so isn't too long.
 Operations of both types may sleep during execution, thus tying up the thread
 loaned to it.
 
+A further class of work item is available, based on the slow work item class:
+
+ (*) Delayed slow work items.
+
+These are slow work items that have a timer to defer queueing of the item for
+a while.
+
 
 THREAD-TO-CLASS ALLOCATION
 --------------------------
@@ -64,9 +71,11 @@ USING SLOW WORK ITEMS
 Firstly, a module or subsystem wanting to make use of slow work items must
 register its interest:
 
-         int ret = slow_work_register_user();
+         int ret = slow_work_register_user(struct module *module);
 
-This will return 0 if successful, or a -ve error upon failure.
+This will return 0 if successful, or a -ve error upon failure.  The module
+pointer should be the module interested in using this facility (almost
+certainly THIS_MODULE).
 
 
 Slow work items may then be set up by:
@@ -93,6 +102,10 @@ Slow work items may then be set up by:
 
      or:
 
+        delayed_slow_work_init(&myitem, &myitem_ops);
+
+     or:
+
         vslow_work_init(&myitem, &myitem_ops);
 
      depending on its class.
@@ -102,15 +115,92 @@ A suitably set up work item can then be enqueued for processing:
         int ret = slow_work_enqueue(&myitem);
 
 This will return a -ve error if the thread pool is unable to gain a reference
-on the item, 0 otherwise.
+on the item, 0 otherwise, or (for delayed work):
+
+        int ret = delayed_slow_work_enqueue(&myitem, my_jiffy_delay);
 
 
 The items are reference counted, so there ought to be no need for a flush
-operation.  When all a module's slow work items have been processed, and the
+operation.  But as the reference counting is optional, means to cancel
+existing work items are also included:
+
+        cancel_slow_work(&myitem);
+        cancel_delayed_slow_work(&myitem);
+
+can be used to cancel pending work.  The above cancel function waits for
+existing work to have been executed (or prevent execution of them, depending
+on timing).
+
+
+When all a module's slow work items have been processed, and the
 module has no further interest in the facility, it should unregister its
 interest:
 
-        slow_work_unregister_user();
+        slow_work_unregister_user(struct module *module);
+
+The module pointer is used to wait for all outstanding work items for that
+module before completing the unregistration.  This prevents the put_ref() code
+from being taken away before it completes.  module should almost certainly be
+THIS_MODULE.
+
+
+================
+HELPER FUNCTIONS
+================
+
+The slow-work facility provides a function by which it can be determined
+whether or not an item is queued for later execution:
+
+        bool queued = slow_work_is_queued(struct slow_work *work);
+
+If it returns false, then the item is not on the queue (it may be executing
+with a requeue pending).  This can be used to work out whether an item on which
+another depends is on the queue, thus allowing a dependent item to be queued
+after it.
+
+If the above shows an item on which another depends not to be queued, then the
+owner of the dependent item might need to wait.  However, to avoid locking up
+the threads unnecessarily be sleeping in them, it can make sense under some
+circumstances to return the work item to the queue, thus deferring it until
+some other items have had a chance to make use of the yielded thread.
+
+To yield a thread and defer an item, the work function should simply enqueue
+the work item again and return.  However, this doesn't work if there's nothing
+actually on the queue, as the thread just vacated will jump straight back into
+the item's work function, thus busy waiting on a CPU.
+
+Instead, the item should use the thread to wait for the dependency to go away,
+but rather than using schedule() or schedule_timeout() to sleep, it should use
+the following function:
+
+        bool requeue = slow_work_sleep_till_thread_needed(
+                        struct slow_work *work,
+                        signed long *_timeout);
+
+This will add a second wait and then sleep, such that it will be woken up if
+either something appears on the queue that could usefully make use of the
+thread - and behind which this item can be queued, or if the event the caller
+set up to wait for happens.  True will be returned if something else appeared
+on the queue and this work function should perhaps return, of false if
+something else woke it up.  The timeout is as for schedule_timeout().
+
+For example:
+
+        wq = bit_waitqueue(&my_flags, MY_BIT);
+        init_wait(&wait);
+        requeue = false;
+        do {
+                prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
+                if (!test_bit(MY_BIT, &my_flags))
+                        break;
+                requeue = slow_work_sleep_till_thread_needed(&my_work,
+                                                             &timeout);
+        } while (timeout > 0 && !requeue);
+        finish_wait(wq, &wait);
+        if (!test_bit(MY_BIT, &my_flags)
+                goto do_my_thing;
+        if (requeue)
+                return; // to slow_work
 
 
 ===============
@@ -118,7 +208,8 @@ ITEM OPERATIONS
 ===============
 
 Each work item requires a table of operations of type struct slow_work_ops.
-All members are required:
+Only ->execute() is required; the getting and putting of a reference and the
+describing of an item are all optional.
 
  (*) Get a reference on an item:
 
@@ -148,6 +239,16 @@ All members are required:
      This should perform the work required of the item.  It may sleep, it may
      perform disk I/O and it may wait for locks.
 
+ (*) View an item through /proc:
+
+        void (*desc)(struct slow_work *work, struct seq_file *m);
+
+     If supplied, this should print to 'm' a small string describing the work
+     the item is to do.  This should be no more than about 40 characters, and
+     shouldn't include a newline character.
+
+     See the 'Viewing executing and queued items' section below.
+
 
 ==================
 POOL CONFIGURATION
@@ -172,3 +273,50 @@ The slow-work thread pool has a number of configurables:
      is bounded to between 1 and one fewer than the number of active threads.
      This ensures there is always at least one thread that can process very
      slow work items, and always at least one thread that won't.
+
+
+==================================
+VIEWING EXECUTING AND QUEUED ITEMS
+==================================
+
+If CONFIG_SLOW_WORK_DEBUG is enabled, a debugfs file is made available:
+
+        /sys/kernel/debug/slow_work/runqueue
+
+through which the list of work items being executed and the queues of items to
+be executed may be viewed.  The owner of a work item is given the chance to
+add some information of its own.
+
+The contents look something like the following:
+
+    THR PID   ITEM ADDR        FL MARK  DESC
+    === ===== ================ == ===== ==========
+      0  3005 ffff880023f52348  a 952ms FSC: OBJ17d3: LOOK
+      1  3006 ffff880024e33668  2 160ms FSC: OBJ17e5 OP60d3b: Write1/Store fl=2
+      2  3165 ffff8800296dd180  a 424ms FSC: OBJ17e4: LOOK
+      3  4089 ffff8800262c8d78  a 212ms FSC: OBJ17ea: CRTN
+      4  4090 ffff88002792bed8  2 388ms FSC: OBJ17e8 OP60d36: Write1/Store fl=2
+      5  4092 ffff88002a0ef308  2 388ms FSC: OBJ17e7 OP60d2e: Write1/Store fl=2
+      6  4094 ffff88002abaf4b8  2 132ms FSC: OBJ17e2 OP60d4e: Write1/Store fl=2
+      7  4095 ffff88002bb188e0  a 388ms FSC: OBJ17e9: CRTN
+    vsq     - ffff880023d99668  1 308ms FSC: OBJ17e0 OP60f91: Write1/EnQ fl=2
+    vsq     - ffff8800295d1740  1 212ms FSC: OBJ16be OP4d4b6: Write1/EnQ fl=2
+    vsq     - ffff880025ba3308  1 160ms FSC: OBJ179a OP58dec: Write1/EnQ fl=2
+    vsq     - ffff880024ec83e0  1 160ms FSC: OBJ17ae OP599f2: Write1/EnQ fl=2
+    vsq     - ffff880026618e00  1 160ms FSC: OBJ17e6 OP60d33: Write1/EnQ fl=2
+    vsq     - ffff880025a2a4b8  1 132ms FSC: OBJ16a2 OP4d583: Write1/EnQ fl=2
+    vsq     - ffff880023cbe6d8  9 212ms FSC: OBJ17eb: LOOK
+    vsq     - ffff880024d37590  9 212ms FSC: OBJ17ec: LOOK
+    vsq     - ffff880027746cb0  9 212ms FSC: OBJ17ed: LOOK
+    vsq     - ffff880024d37ae8  9 212ms FSC: OBJ17ee: LOOK
+    vsq     - ffff880024d37cb0  9 212ms FSC: OBJ17ef: LOOK
+    vsq     - ffff880025036550  9 212ms FSC: OBJ17f0: LOOK
+    vsq     - ffff8800250368e0  9 212ms FSC: OBJ17f1: LOOK
+    vsq     - ffff880025036aa8  9 212ms FSC: OBJ17f2: LOOK
+
+In the 'THR' column, executing items show the thread they're occupying and
+queued threads indicate which queue they're on.  'PID' shows the process ID of
+a slow-work thread that's executing something.  'FL' shows the work item flags.
+'MARK' indicates how long since an item was queued or began executing.  Lastly,
+the 'DESC' column permits the owner of an item to give some information.
+
diff --git a/MAINTAINERS b/MAINTAINERS
index 808e4dfb34be..cdf5ce46b38b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -512,10 +512,32 @@ W:	http://www.arm.linux.org.uk/
 S:      Maintained
 F:      arch/arm/
 
+ARM PRIMECELL AACI PL041 DRIVER
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      sound/arm/aaci.*
+
+ARM PRIMECELL CLCD PL110 DRIVER
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      drivers/video/amba-clcd.*
+
+ARM PRIMECELL KMI PL050 DRIVER
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      drivers/input/serio/ambakmi.*
+F:      include/linux/amba/kmi.h
+
 ARM PRIMECELL MMCI PL180/1 DRIVER
 S:      Orphan
 F:      drivers/mmc/host/mmci.*
 
+ARM PRIMECELL BUS SUPPORT
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      drivers/amba/
+F:      include/linux/amba/bus.h
+
 ARM/ADI ROADRUNNER MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1027,7 +1049,7 @@ F:	drivers/serial/atmel_serial.c
 
 ATMEL LCDFB DRIVER
 M:      Nicolas Ferre <nicolas.ferre@atmel.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/atmel_lcdfb.c
 F:      include/video/atmel_lcdc.h
@@ -2112,7 +2134,7 @@ F:	drivers/net/wan/dlci.c
 F:      drivers/net/wan/sdla.c
 
 FRAMEBUFFER LAYER
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 W:      http://linux-fbdev.sourceforge.net/
 S:      Orphan
 F:      Documentation/fb/
@@ -2135,7 +2157,7 @@ F:	drivers/i2c/busses/i2c-cpm.c
 
 FREESCALE IMX / MXC FRAMEBUFFER DRIVER
 M:      Sascha Hauer <kernel@pengutronix.de>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/plat-mxc/include/mach/imxfb.h
@@ -2311,6 +2333,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 S:      Maintained
 F:      drivers/media/video/gspca/finepix.c
 
+GSPCA GL860 SUBDRIVER
+M:      Olivier Lorin <o.lorin@laposte.net>
+L:      linux-media@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
+S:      Maintained
+F:      drivers/media/video/gspca/gl860/
+
 GSPCA M5602 SUBDRIVER
 M:      Erik Andren <erik.andren@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -2532,8 +2561,7 @@ S:	Maintained
 F:      Documentation/i2c/
 F:      drivers/i2c/
 F:      include/linux/i2c.h
-F:      include/linux/i2c-dev.h
-F:      include/linux/i2c-id.h
+F:      include/linux/i2c-*.h
 
 I2C-TINY-USB DRIVER
 M:      Till Harbaum <till@harbaum.org>
@@ -2634,7 +2662,7 @@ S:	Supported
 F:      security/integrity/ima/
 
 IMS TWINTURBO FRAMEBUFFER DRIVER
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Orphan
 F:      drivers/video/imsttfb.c
 
@@ -2669,14 +2697,14 @@ F:	drivers/input/
 
 INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
 M:      Sylvain Meyer <sylvain.meyer@worldonline.fr>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/fb/intelfb.txt
 F:      drivers/video/intelfb/
 
 INTEL 810/815 FRAMEBUFFER DRIVER
 M:      Antonino Daplas <adaplas@gmail.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/i810/
 
@@ -3390,7 +3418,7 @@ S:	Supported
 
 MATROX FRAMEBUFFER DRIVER
 M:      Petr Vandrovec <vandrove@vc.cvut.cz>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
@@ -3777,7 +3805,7 @@ F:	fs/ntfs/
 
 NVIDIA (rivafb and nvidiafb) FRAMEBUFFER DRIVER
 M:      Antonino Daplas <adaplas@gmail.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/riva/
 F:      drivers/video/nvidia/
@@ -3812,7 +3840,7 @@ F:	sound/soc/omap/
 
 OMAP FRAMEBUFFER SUPPORT
 M:      Imre Deak <imre.deak@nokia.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      drivers/video/omap/
@@ -4318,14 +4346,14 @@ F:	include/linux/qnxtypes.h
 
 RADEON FRAMEBUFFER DISPLAY DRIVER
 M:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/aty/radeon*
 F:      include/linux/radeonfb.h
 
 RAGE128 FRAMEBUFFER DISPLAY DRIVER
 M:      Paul Mackerras <paulus@samba.org>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/aty/aty128fb.c
 
@@ -4464,7 +4492,7 @@ F:	drivers/net/wireless/rtl818x/rtl8187*
 
 S3 SAVAGE FRAMEBUFFER DRIVER
 M:      Antonino Daplas <adaplas@gmail.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/savage/
 
@@ -5627,7 +5655,7 @@ S:	Maintained
 
 UVESAFB DRIVER
 M:      Michal Januszewski <spock@gentoo.org>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 W:      http://dev.gentoo.org/~spock/projects/uvesafb/
 S:      Maintained
 F:      Documentation/fb/uvesafb.txt
@@ -5660,7 +5688,7 @@ F:	drivers/mmc/host/via-sdmmc.c
 VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER
 M:      Joseph Chan <JosephChan@via.com.tw>
 M:      Scott Fang <ScottFang@viatech.com.cn>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/via/
 
diff --git a/Makefile b/Makefile
index aa3e13a7e353..ad8260102f64 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 32
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc8
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/thread_info.h b/arch/alpha/include/asm/thread_info.h
index 815680b585ed..b3e888638bb7 100644
--- a/arch/alpha/include/asm/thread_info.h
+++ b/arch/alpha/include/asm/thread_info.h
@@ -61,21 +61,24 @@ register struct thread_info *__current_thread_info __asm__("$8");
 /*
  * Thread information flags:
  * - these are process state flags and used from assembly
- * - pending work-to-be-done flags come first to fit in and immediate operand.
+ * - pending work-to-be-done flags come first and must be assigned to be
+ *   within bits 0 to 7 to fit in and immediate operand.
+ * - ALPHA_UAC_SHIFT below must be kept consistent with the unaligned
+ *   control flags.
  *
  * TIF_SYSCALL_TRACE is known to be 0 via blbs.
  */
 #define TIF_SYSCALL_TRACE       0       /* syscall trace active */
-#define TIF_SIGPENDING          1       /* signal pending */
-#define TIF_NEED_RESCHED        2       /* rescheduling necessary */
-#define TIF_POLLING_NRFLAG      3       /* poll_idle is polling NEED_RESCHED */
-#define TIF_DIE_IF_KERNEL       4       /* dik recursion lock */
-#define TIF_UAC_NOPRINT         5       /* see sysinfo.h */
-#define TIF_UAC_NOFIX           6
-#define TIF_UAC_SIGBUS          7
-#define TIF_MEMDIE              8
-#define TIF_RESTORE_SIGMASK     9       /* restore signal mask in do_signal */
-#define TIF_NOTIFY_RESUME       10      /* callback before returning to user */
+#define TIF_NOTIFY_RESUME       1       /* callback before returning to user */
+#define TIF_SIGPENDING          2       /* signal pending */
+#define TIF_NEED_RESCHED        3       /* rescheduling necessary */
+#define TIF_POLLING_NRFLAG      8       /* poll_idle is polling NEED_RESCHED */
+#define TIF_DIE_IF_KERNEL       9       /* dik recursion lock */
+#define TIF_UAC_NOPRINT         10      /* see sysinfo.h */
+#define TIF_UAC_NOFIX           11
+#define TIF_UAC_SIGBUS          12
+#define TIF_MEMDIE              13
+#define TIF_RESTORE_SIGMASK     14      /* restore signal mask in do_signal */
 #define TIF_FREEZE              16      /* is freezing for suspend */
 
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
@@ -94,7 +97,7 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define _TIF_ALLWORK_MASK       (_TIF_WORK_MASK         \
                                  | _TIF_SYSCALL_TRACE)
 
-#define ALPHA_UAC_SHIFT         6
+#define ALPHA_UAC_SHIFT         10
 #define ALPHA_UAC_MASK          (1 << TIF_UAC_NOPRINT | 1 << TIF_UAC_NOFIX | \
                                  1 << TIF_UAC_SIGBUS)
 
diff --git a/arch/alpha/kernel/core_marvel.c b/arch/alpha/kernel/core_marvel.c
index 8e059e58b0ac..53dd2f1a53aa 100644
--- a/arch/alpha/kernel/core_marvel.c
+++ b/arch/alpha/kernel/core_marvel.c
@@ -1103,6 +1103,8 @@ marvel_agp_info(void)
          * Allocate the info structure.
          */
         agp = kmalloc(sizeof(*agp), GFP_KERNEL);
+        if (!agp)
+                return NULL;
 
         /*
          * Fill it in.
diff --git a/arch/alpha/kernel/core_titan.c b/arch/alpha/kernel/core_titan.c
index 76686497b1e2..219bf271c0ba 100644
--- a/arch/alpha/kernel/core_titan.c
+++ b/arch/alpha/kernel/core_titan.c
@@ -757,6 +757,8 @@ titan_agp_info(void)
          * Allocate the info structure.
          */
         agp = kmalloc(sizeof(*agp), GFP_KERNEL);
+        if (!agp)
+                return NULL;
 
         /*
          * Fill it in.
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index cc7834661427..c0de072b8305 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -92,7 +92,7 @@ show_interrupts(struct seq_file *p, void *v)
                 for_each_online_cpu(j)
                         seq_printf(p, "%10u ", kstat_irqs_cpu(irq, j));
 #endif
-                seq_printf(p, " %14s", irq_desc[irq].chip->typename);
+                seq_printf(p, " %14s", irq_desc[irq].chip->name);
                 seq_printf(p, "  %c%s",
                         (action->flags & IRQF_DISABLED)?'+':' ',
                         action->name);
diff --git a/arch/alpha/kernel/irq_alpha.c b/arch/alpha/kernel/irq_alpha.c
index 38c805dfc544..cfde865b78e0 100644
--- a/arch/alpha/kernel/irq_alpha.c
+++ b/arch/alpha/kernel/irq_alpha.c
@@ -228,7 +228,7 @@ struct irqaction timer_irqaction = {
 };
 
 static struct irq_chip rtc_irq_type = {
-        .typename       = "RTC",
+        .name           = "RTC",
         .startup        = rtc_startup,
         .shutdown       = rtc_enable_disable,
         .enable         = rtc_enable_disable,
diff --git a/arch/alpha/kernel/irq_i8259.c b/arch/alpha/kernel/irq_i8259.c
index 50bfec9b588f..83a9ac280890 100644
--- a/arch/alpha/kernel/irq_i8259.c
+++ b/arch/alpha/kernel/irq_i8259.c
@@ -84,7 +84,7 @@ i8259a_end_irq(unsigned int irq)
 }
 
 struct irq_chip i8259a_irq_type = {
-        .typename       = "XT-PIC",
+        .name           = "XT-PIC",
         .startup        = i8259a_startup_irq,
         .shutdown       = i8259a_disable_irq,
         .enable         = i8259a_enable_irq,
diff --git a/arch/alpha/kernel/irq_pyxis.c b/arch/alpha/kernel/irq_pyxis.c
index 69199a76ec4a..989ce46a0cf3 100644
--- a/arch/alpha/kernel/irq_pyxis.c
+++ b/arch/alpha/kernel/irq_pyxis.c
@@ -71,7 +71,7 @@ pyxis_mask_and_ack_irq(unsigned int irq)
 }
 
 static struct irq_chip pyxis_irq_type = {
-        .typename       = "PYXIS",
+        .name           = "PYXIS",
         .startup        = pyxis_startup_irq,
         .shutdown       = pyxis_disable_irq,
         .enable         = pyxis_enable_irq,
diff --git a/arch/alpha/kernel/irq_srm.c b/arch/alpha/kernel/irq_srm.c
index 85229369a1f8..d63e93e1e8bf 100644
--- a/arch/alpha/kernel/irq_srm.c
+++ b/arch/alpha/kernel/irq_srm.c
@@ -49,7 +49,7 @@ srm_end_irq(unsigned int irq)
 
 /* Handle interrupts from the SRM, assuming no additional weirdness.  */
 static struct irq_chip srm_irq_type = {
-        .typename       = "SRM",
+        .name           = "SRM",
         .startup        = srm_startup_irq,
         .shutdown       = srm_disable_irq,
         .enable         = srm_enable_irq,
diff --git a/arch/alpha/kernel/sys_alcor.c b/arch/alpha/kernel/sys_alcor.c
index 382035ef7394..20a30b8b9655 100644
--- a/arch/alpha/kernel/sys_alcor.c
+++ b/arch/alpha/kernel/sys_alcor.c
@@ -90,7 +90,7 @@ alcor_end_irq(unsigned int irq)
 }
 
 static struct irq_chip alcor_irq_type = {
-        .typename       = "ALCOR",
+        .name           = "ALCOR",
         .startup        = alcor_startup_irq,
         .shutdown       = alcor_disable_irq,
         .enable         = alcor_enable_irq,
diff --git a/arch/alpha/kernel/sys_cabriolet.c b/arch/alpha/kernel/sys_cabriolet.c
index ed349436732b..affd0f3f25df 100644
--- a/arch/alpha/kernel/sys_cabriolet.c
+++ b/arch/alpha/kernel/sys_cabriolet.c
@@ -72,7 +72,7 @@ cabriolet_end_irq(unsigned int irq)
 }
 
 static struct irq_chip cabriolet_irq_type = {
-        .typename       = "CABRIOLET",
+        .name           = "CABRIOLET",
         .startup        = cabriolet_startup_irq,
         .shutdown       = cabriolet_disable_irq,
         .enable         = cabriolet_enable_irq,
diff --git a/arch/alpha/kernel/sys_dp264.c b/arch/alpha/kernel/sys_dp264.c
index 46e70ece5176..d64e1e497e76 100644
--- a/arch/alpha/kernel/sys_dp264.c
+++ b/arch/alpha/kernel/sys_dp264.c
@@ -199,7 +199,7 @@ clipper_set_affinity(unsigned int irq, const struct cpumask *affinity)
 }
 
 static struct irq_chip dp264_irq_type = {
-        .typename       = "DP264",
+        .name           = "DP264",
         .startup        = dp264_startup_irq,
         .shutdown       = dp264_disable_irq,
         .enable         = dp264_enable_irq,
@@ -210,7 +210,7 @@ static struct irq_chip dp264_irq_type = {
 };
 
 static struct irq_chip clipper_irq_type = {
-        .typename       = "CLIPPER",
+        .name           = "CLIPPER",
         .startup        = clipper_startup_irq,
         .shutdown       = clipper_disable_irq,
         .enable         = clipper_enable_irq,
diff --git a/arch/alpha/kernel/sys_eb64p.c b/arch/alpha/kernel/sys_eb64p.c
index 660c23ef661f..df2090ce5e7f 100644
--- a/arch/alpha/kernel/sys_eb64p.c
+++ b/arch/alpha/kernel/sys_eb64p.c
@@ -70,7 +70,7 @@ eb64p_end_irq(unsigned int irq)
 }
 
 static struct irq_chip eb64p_irq_type = {
-        .typename       = "EB64P",
+        .name           = "EB64P",
         .startup        = eb64p_startup_irq,
         .shutdown       = eb64p_disable_irq,
         .enable         = eb64p_enable_irq,
diff --git a/arch/alpha/kernel/sys_eiger.c b/arch/alpha/kernel/sys_eiger.c
index b99ea488d844..3ca1dbcf4044 100644
--- a/arch/alpha/kernel/sys_eiger.c
+++ b/arch/alpha/kernel/sys_eiger.c
@@ -81,7 +81,7 @@ eiger_end_irq(unsigned int irq)
 }
 
 static struct irq_chip eiger_irq_type = {
-        .typename       = "EIGER",
+        .name           = "EIGER",
         .startup        = eiger_startup_irq,
         .shutdown       = eiger_disable_irq,
         .enable         = eiger_enable_irq,
diff --git a/arch/alpha/kernel/sys_jensen.c b/arch/alpha/kernel/sys_jensen.c
index ef0b83a070ac..7a7ae36fff91 100644
--- a/arch/alpha/kernel/sys_jensen.c
+++ b/arch/alpha/kernel/sys_jensen.c
@@ -119,7 +119,7 @@ jensen_local_end(unsigned int irq)
 }
 
 static struct irq_chip jensen_local_irq_type = {
-        .typename       = "LOCAL",
+        .name           = "LOCAL",
         .startup        = jensen_local_startup,
         .shutdown       = jensen_local_shutdown,
         .enable         = jensen_local_enable,
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index bbfc4f20ca72..0bb3b5c4f693 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -170,7 +170,7 @@ marvel_irq_noop_return(unsigned int irq)
 }
 
 static struct irq_chip marvel_legacy_irq_type = {
-        .typename       = "LEGACY",
+        .name           = "LEGACY",
         .startup        = marvel_irq_noop_return,
         .shutdown       = marvel_irq_noop,
         .enable         = marvel_irq_noop,
@@ -180,7 +180,7 @@ static struct irq_chip marvel_legacy_irq_type = {
 };
 
 static struct irq_chip io7_lsi_irq_type = {
-        .typename       = "LSI",
+        .name           = "LSI",
         .startup        = io7_startup_irq,
         .shutdown       = io7_disable_irq,
         .enable         = io7_enable_irq,
@@ -190,7 +190,7 @@ static struct irq_chip io7_lsi_irq_type = {
 };
 
 static struct irq_chip io7_msi_irq_type = {
-        .typename       = "MSI",
+        .name           = "MSI",
         .startup        = io7_startup_irq,
         .shutdown       = io7_disable_irq,
         .enable         = io7_enable_irq,
diff --git a/arch/alpha/kernel/sys_mikasa.c b/arch/alpha/kernel/sys_mikasa.c
index 4e366641a08e..ee8865169811 100644
--- a/arch/alpha/kernel/sys_mikasa.c
+++ b/arch/alpha/kernel/sys_mikasa.c
@@ -69,7 +69,7 @@ mikasa_end_irq(unsigned int irq)
 }
 
 static struct irq_chip mikasa_irq_type = {
-        .typename       = "MIKASA",
+        .name           = "MIKASA",
         .startup        = mikasa_startup_irq,
         .shutdown       = mikasa_disable_irq,
         .enable         = mikasa_enable_irq,
diff --git a/arch/alpha/kernel/sys_noritake.c b/arch/alpha/kernel/sys_noritake.c
index 35753a173bac..86503fe73a88 100644
--- a/arch/alpha/kernel/sys_noritake.c
+++ b/arch/alpha/kernel/sys_noritake.c
@@ -74,7 +74,7 @@ noritake_end_irq(unsigned int irq)
 }
 
 static struct irq_chip noritake_irq_type = {
-        .typename       = "NORITAKE",
+        .name           = "NORITAKE",
         .startup        = noritake_startup_irq,
         .shutdown       = noritake_disable_irq,
         .enable         = noritake_enable_irq,
diff --git a/arch/alpha/kernel/sys_rawhide.c b/arch/alpha/kernel/sys_rawhide.c
index f3aec7e085c8..26c322bf89ee 100644
--- a/arch/alpha/kernel/sys_rawhide.c
+++ b/arch/alpha/kernel/sys_rawhide.c
@@ -136,7 +136,7 @@ rawhide_end_irq(unsigned int irq)
 }
 
 static struct irq_chip rawhide_irq_type = {
-        .typename       = "RAWHIDE",
+        .name           = "RAWHIDE",
         .startup        = rawhide_startup_irq,
         .shutdown       = rawhide_disable_irq,
         .enable         = rawhide_enable_irq,
diff --git a/arch/alpha/kernel/sys_ruffian.c b/arch/alpha/kernel/sys_ruffian.c
index d9f9cfeb9931..8de1046fe91e 100644
--- a/arch/alpha/kernel/sys_ruffian.c
+++ b/arch/alpha/kernel/sys_ruffian.c
@@ -66,7 +66,7 @@ ruffian_init_irq(void)
         common_init_isa_dma();
 }
 
-#define RUFFIAN_LATCH   ((PIT_TICK_RATE + HZ / 2) / HZ)
+#define RUFFIAN_LATCH   DIV_ROUND_CLOSEST(PIT_TICK_RATE, HZ)
 
 static void __init
 ruffian_init_rtc(void)
diff --git a/arch/alpha/kernel/sys_rx164.c b/arch/alpha/kernel/sys_rx164.c
index fc9246373452..be161129eab9 100644
--- a/arch/alpha/kernel/sys_rx164.c
+++ b/arch/alpha/kernel/sys_rx164.c
@@ -73,7 +73,7 @@ rx164_end_irq(unsigned int irq)
 }
 
 static struct irq_chip rx164_irq_type = {
-        .typename       = "RX164",
+        .name           = "RX164",
         .startup        = rx164_startup_irq,
         .shutdown       = rx164_disable_irq,
         .enable         = rx164_enable_irq,
diff --git a/arch/alpha/kernel/sys_sable.c b/arch/alpha/kernel/sys_sable.c
index 426eb6906d01..b2abe27a23cf 100644
--- a/arch/alpha/kernel/sys_sable.c
+++ b/arch/alpha/kernel/sys_sable.c
@@ -502,7 +502,7 @@ sable_lynx_mask_and_ack_irq(unsigned int irq)
 }
 
 static struct irq_chip sable_lynx_irq_type = {
-        .typename       = "SABLE/LYNX",
+        .name           = "SABLE/LYNX",
         .startup        = sable_lynx_startup_irq,
         .shutdown       = sable_lynx_disable_irq,
         .enable         = sable_lynx_enable_irq,
diff --git a/arch/alpha/kernel/sys_takara.c b/arch/alpha/kernel/sys_takara.c
index 830318c21661..230464885b5c 100644
--- a/arch/alpha/kernel/sys_takara.c
+++ b/arch/alpha/kernel/sys_takara.c
@@ -75,7 +75,7 @@ takara_end_irq(unsigned int irq)
 }
 
 static struct irq_chip takara_irq_type = {
-        .typename       = "TAKARA",
+        .name           = "TAKARA",
         .startup        = takara_startup_irq,
         .shutdown       = takara_disable_irq,
         .enable         = takara_enable_irq,
diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index 88978fc60f83..288053342c83 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -195,7 +195,7 @@ init_titan_irqs(struct irq_chip * ops, int imin, int imax)
 }
 
 static struct irq_chip titan_irq_type = {
-       .typename       = "TITAN",
+       .name           = "TITAN",
        .startup        = titan_startup_irq,
        .shutdown       = titan_disable_irq,
        .enable         = titan_enable_irq,
diff --git a/arch/alpha/kernel/sys_wildfire.c b/arch/alpha/kernel/sys_wildfire.c
index e91b4c3838a8..62fd972e18ef 100644
--- a/arch/alpha/kernel/sys_wildfire.c
+++ b/arch/alpha/kernel/sys_wildfire.c
@@ -158,7 +158,7 @@ wildfire_end_irq(unsigned int irq)
 }
 
 static struct irq_chip wildfire_irq_type = {
-        .typename       = "WILDFIRE",
+        .name           = "WILDFIRE",
         .startup        = wildfire_startup_irq,
         .shutdown       = wildfire_disable_irq,
         .enable         = wildfire_enable_irq,
diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
index d16ec97ec9a9..c019949a5189 100644
--- a/arch/arm/include/asm/kmap_types.h
+++ b/arch/arm/include/asm/kmap_types.h
@@ -22,4 +22,10 @@ enum km_type {
         KM_TYPE_NR
 };
 
+#ifdef CONFIG_DEBUG_HIGHMEM
+#define KM_NMI          (-1)
+#define KM_NMI_PTE      (-1)
+#define KM_IRQ_PTE      (-1)
+#endif
+
 #endif
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 2a573d4fea24..e7714f367eb8 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -662,8 +662,12 @@ static void do_signal(struct pt_regs *regs, int syscall)
                                 regs->ARM_sp -= 4;
                                 usp = (u32 __user *)regs->ARM_sp;
 
-                                put_user(regs->ARM_pc, usp);
-                                regs->ARM_pc = KERN_RESTART_CODE;
+                                if (put_user(regs->ARM_pc, usp) == 0) {
+                                        regs->ARM_pc = KERN_RESTART_CODE;
+                                } else {
+                                        regs->ARM_sp += 4;
+                                        force_sigsegv(0, current);
+                                }
 #endif
                         }
                 }
diff --git a/arch/arm/mach-pxa/cpufreq-pxa2xx.c b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
index 983cc8c20081..9e4d9816726a 100644
--- a/arch/arm/mach-pxa/cpufreq-pxa2xx.c
+++ b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
@@ -447,6 +447,7 @@ static __init int pxa_cpufreq_init(struct cpufreq_policy *policy)
                 pxa27x_freq_table[i].frequency = freq;
                 pxa27x_freq_table[i].index = i;
         }
+        pxa27x_freq_table[i].index = i;
         pxa27x_freq_table[i].frequency = CPUFREQ_TABLE_END;
 
         /*
diff --git a/arch/arm/mach-pxa/cpufreq-pxa3xx.c b/arch/arm/mach-pxa/cpufreq-pxa3xx.c
index 67f34a8d8e60..149cdd9aee4d 100644
--- a/arch/arm/mach-pxa/cpufreq-pxa3xx.c
+++ b/arch/arm/mach-pxa/cpufreq-pxa3xx.c
@@ -102,7 +102,7 @@ static int setup_freqs_table(struct cpufreq_policy *policy,
                 table[i].index = i;
                 table[i].frequency = freqs[i].cpufreq_mhz * 1000;
         }
-        table[num].frequency = i;
+        table[num].index = i;
         table[num].frequency = CPUFREQ_TABLE_END;
 
         pxa3xx_freqs = freqs;
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 3da45d051743..d98023f55503 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -802,10 +802,12 @@ static void __init spitz_init(void)
 {
         spitz_ficp_platform_data.gpio_pwdown = SPITZ_GPIO_IR_ON;
 
+#ifdef CONFIG_MACH_BORZOI
         if (machine_is_borzoi()) {
                 sharpsl_nand_platform_data.badblock_pattern = &sharpsl_akita_bbt;
                 sharpsl_nand_platform_data.ecc_layout = &akita_oobinfo;
         }
+#endif
 
         platform_scoop_config = &spitz_pcmcia_config;
 
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 94be7bb6cb9a..07b976da6174 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Fri Sep 18 21:42:00 2009
+# Last update: Wed Nov 25 22:14:58 2009
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -928,7 +928,7 @@ palmt5			MACH_PALMT5		PALMT5			917
 palmtc                  MACH_PALMTC             PALMTC                  918
 omap_apollon            MACH_OMAP_APOLLON       OMAP_APOLLON            919
 mxc30030evb             MACH_MXC30030EVB        MXC30030EVB             920
-rea_2d                  MACH_REA_2D             REA_2D                  921
+rea_cpu2                MACH_REA_2D             REA_2D                  921
 eti3e524                MACH_TI3E524            TI3E524                 922
 ateb9200                MACH_ATEB9200           ATEB9200                923
 auckland                MACH_AUCKLAND           AUCKLAND                924
@@ -2421,3 +2421,118 @@ liberty			MACH_LIBERTY		LIBERTY			2434
 mh355                   MACH_MH355              MH355                   2435
 pc7802                  MACH_PC7802             PC7802                  2436
 gnet_sgc                MACH_GNET_SGC           GNET_SGC                2437
+einstein15              MACH_EINSTEIN15         EINSTEIN15              2438
+cmpd                    MACH_CMPD               CMPD                    2439
+davinci_hase1           MACH_DAVINCI_HASE1      DAVINCI_HASE1           2440
+lgeincitephone          MACH_LGEINCITEPHONE     LGEINCITEPHONE          2441
+ea313x                  MACH_EA313X             EA313X                  2442
+fwbd_39064              MACH_FWBD_39064         FWBD_39064              2443
+fwbd_390128             MACH_FWBD_390128        FWBD_390128             2444
+pelco_moe               MACH_PELCO_MOE          PELCO_MOE               2445
+minimix27               MACH_MINIMIX27          MINIMIX27               2446
+omap3_thunder           MACH_OMAP3_THUNDER      OMAP3_THUNDER           2447
+passionc                MACH_PASSIONC           PASSIONC                2448
+mx27amata               MACH_MX27AMATA          MX27AMATA               2449
+bgat1                   MACH_BGAT1              BGAT1                   2450
+buzz                    MACH_BUZZ               BUZZ                    2451
+mb9g20                  MACH_MB9G20             MB9G20                  2452
+yushan                  MACH_YUSHAN             YUSHAN                  2453
+lizard                  MACH_LIZARD             LIZARD                  2454
+omap3polycom            MACH_OMAP3POLYCOM       OMAP3POLYCOM            2455
+smdkv210                MACH_SMDKV210           SMDKV210                2456
+bravo                   MACH_BRAVO              BRAVO                   2457
+siogentoo1              MACH_SIOGENTOO1         SIOGENTOO1              2458
+siogentoo2              MACH_SIOGENTOO2         SIOGENTOO2              2459
+sm3k                    MACH_SM3K               SM3K                    2460
+acer_tempo_f900         MACH_ACER_TEMPO_F900    ACER_TEMPO_F900         2461
+sst61vc010_dev          MACH_SST61VC010_DEV     SST61VC010_DEV          2462
+glittertind             MACH_GLITTERTIND        GLITTERTIND             2463
+omap_zoom3              MACH_OMAP_ZOOM3         OMAP_ZOOM3              2464
+omap_3630sdp            MACH_OMAP_3630SDP       OMAP_3630SDP            2465
+cybook2440              MACH_CYBOOK2440         CYBOOK2440              2466
+torino_s                MACH_TORINO_S           TORINO_S                2467
+havana                  MACH_HAVANA             HAVANA                  2468
+beaumont_11             MACH_BEAUMONT_11        BEAUMONT_11             2469
+vanguard                MACH_VANGUARD           VANGUARD                2470
+s5pc110_draco           MACH_S5PC110_DRACO      S5PC110_DRACO           2471
+cartesio_two            MACH_CARTESIO_TWO       CARTESIO_TWO            2472
+aster                   MACH_ASTER              ASTER                   2473
+voguesv210              MACH_VOGUESV210         VOGUESV210              2474
+acm500x                 MACH_ACM500X            ACM500X                 2475
+km9260                  MACH_KM9260             KM9260                  2476
+nideflexg1              MACH_NIDEFLEXG1         NIDEFLEXG1              2477
+ctera_plug_io           MACH_CTERA_PLUG_IO      CTERA_PLUG_IO           2478
+smartq7                 MACH_SMARTQ7            SMARTQ7                 2479
+at91sam9g10ek2          MACH_AT91SAM9G10EK2     AT91SAM9G10EK2          2480
+asusp527                MACH_ASUSP527           ASUSP527                2481
+at91sam9g20mpm2         MACH_AT91SAM9G20MPM2    AT91SAM9G20MPM2         2482
+topasa900               MACH_TOPASA900          TOPASA900               2483
+electrum_100            MACH_ELECTRUM_100       ELECTRUM_100            2484
+mx51grb                 MACH_MX51GRB            MX51GRB                 2485
+xea300                  MACH_XEA300             XEA300                  2486
+htcstartrek             MACH_HTCSTARTREK        HTCSTARTREK             2487
+lima                    MACH_LIMA               LIMA                    2488
+csb740                  MACH_CSB740             CSB740                  2489
+usb_s8815               MACH_USB_S8815          USB_S8815               2490
+watson_efm_plugin       MACH_WATSON_EFM_PLUGIN  WATSON_EFM_PLUGIN       2491
+milkyway                MACH_MILKYWAY           MILKYWAY                2492
+g4evm                   MACH_G4EVM              G4EVM                   2493
+picomod6                MACH_PICOMOD6           PICOMOD6                2494
+omapl138_hawkboard      MACH_OMAPL138_HAWKBOARD OMAPL138_HAWKBOARD      2495
+ip6000                  MACH_IP6000             IP6000                  2496
+ip6010                  MACH_IP6010             IP6010                  2497
+utm400                  MACH_UTM400             UTM400                  2498
+omap3_zybex             MACH_OMAP3_ZYBEX        OMAP3_ZYBEX             2499
+wireless_space          MACH_WIRELESS_SPACE     WIRELESS_SPACE          2500
+sx560                   MACH_SX560              SX560                   2501
+ts41x                   MACH_TS41X              TS41X                   2502
+elphel10373             MACH_ELPHEL10373        ELPHEL10373             2503
+rhobot                  MACH_RHOBOT             RHOBOT                  2504
+mx51_refresh            MACH_MX51_REFRESH       MX51_REFRESH            2505
+ls9260                  MACH_LS9260             LS9260                  2506
+shank                   MACH_SHANK              SHANK                   2507
+qsd8x50_st1             MACH_QSD8X50_ST1        QSD8X50_ST1             2508
+at91sam9m10ekes         MACH_AT91SAM9M10EKES    AT91SAM9M10EKES         2509
+hiram                   MACH_HIRAM              HIRAM                   2510
+phy3250                 MACH_PHY3250            PHY3250                 2511
+ea3250                  MACH_EA3250             EA3250                  2512
+fdi3250                 MACH_FDI3250            FDI3250                 2513
+whitestone              MACH_WHITESTONE         WHITESTONE              2514
+at91sam9263nit          MACH_AT91SAM9263NIT     AT91SAM9263NIT          2515
+ccmx51                  MACH_CCMX51             CCMX51                  2516
+ccmx51js                MACH_CCMX51JS           CCMX51JS                2517
+ccwmx51                 MACH_CCWMX51            CCWMX51                 2518
+ccwmx51js               MACH_CCWMX51JS          CCWMX51JS               2519
+mini6410                MACH_MINI6410           MINI6410                2520
+tiny6410                MACH_TINY6410           TINY6410                2521
+nano6410                MACH_NANO6410           NANO6410                2522
+at572d940hfnldb         MACH_AT572D940HFNLDB    AT572D940HFNLDB         2523
+htcleo                  MACH_HTCLEO             HTCLEO                  2524
+avp13                   MACH_AVP13              AVP13                   2525
+xxsvideod               MACH_XXSVIDEOD          XXSVIDEOD               2526
+vpnext                  MACH_VPNEXT             VPNEXT                  2527
+swarco_itc3             MACH_SWARCO_ITC3        SWARCO_ITC3             2528
+tx51                    MACH_TX51               TX51                    2529
+dolby_cat1021           MACH_DOLBY_CAT1021      DOLBY_CAT1021           2530
+mx28evk                 MACH_MX28EVK            MX28EVK                 2531
+phoenix260              MACH_PHOENIX260         PHOENIX260              2532
+uvaca_stork             MACH_UVACA_STORK        UVACA_STORK             2533
+smartq5                 MACH_SMARTQ5            SMARTQ5                 2534
+all3078                 MACH_ALL3078            ALL3078                 2535
+ctera_2bay_ds           MACH_CTERA_2BAY_DS      CTERA_2BAY_DS           2536
+siogentoo3              MACH_SIOGENTOO3         SIOGENTOO3              2537
+epb5000                 MACH_EPB5000            EPB5000                 2538
+hy9263                  MACH_HY9263             HY9263                  2539
+acer_tempo_m900         MACH_ACER_TEMPO_M900    ACER_TEMPO_M900         2540
+acer_tempo_dx650        MACH_ACER_TEMPO_DX900   ACER_TEMPO_DX900        2541
+acer_tempo_x960         MACH_ACER_TEMPO_X960    ACER_TEMPO_X960         2542
+acer_eten_v900          MACH_ACER_ETEN_V900     ACER_ETEN_V900          2543
+acer_eten_x900          MACH_ACER_ETEN_X900     ACER_ETEN_X900          2544
+bonnell                 MACH_BONNELL            BONNELL                 2545
+oht_mx27                MACH_OHT_MX27           OHT_MX27                2546
+htcquartz               MACH_HTCQUARTZ          HTCQUARTZ               2547
+davinci_dm6467tevm      MACH_DAVINCI_DM6467TEVM DAVINCI_DM6467TEVM      2548
+c3ax03                  MACH_C3AX03             C3AX03                  2549
+mxt_td60                MACH_MXT_TD60           MXT_TD60                2550
+esyx                    MACH_ESYX               ESYX                    2551
+bulldog                 MACH_BULLDOG            BULLDOG                 2553
diff --git a/arch/blackfin/kernel/bfin_dma_5xx.c b/arch/blackfin/kernel/bfin_dma_5xx.c
index 1f170216d2f9..3946aff4f414 100644
--- a/arch/blackfin/kernel/bfin_dma_5xx.c
+++ b/arch/blackfin/kernel/bfin_dma_5xx.c
@@ -225,8 +225,13 @@ int blackfin_dma_suspend(void)
 void blackfin_dma_resume(void)
 {
         int i;
-        for (i = 0; i < MAX_DMA_SUSPEND_CHANNELS; ++i)
-                dma_ch[i].regs->peripheral_map = dma_ch[i].saved_peripheral_map;
+
+        for (i = 0; i < MAX_DMA_CHANNELS; ++i) {
+                dma_ch[i].regs->cfg = 0;
+
+                if (i < MAX_DMA_SUSPEND_CHANNELS)
+                        dma_ch[i].regs->peripheral_map = dma_ch[i].saved_peripheral_map;
+        }
 }
 #endif
 
diff --git a/arch/blackfin/kernel/cplb-mpu/cplbinit.c b/arch/blackfin/kernel/cplb-mpu/cplbinit.c
index f7b9cdce8239..b52c1f8c4bc0 100644
--- a/arch/blackfin/kernel/cplb-mpu/cplbinit.c
+++ b/arch/blackfin/kernel/cplb-mpu/cplbinit.c
@@ -38,7 +38,7 @@ void __init generate_cplb_tables_cpu(unsigned int cpu)
 
 #ifdef CONFIG_BFIN_EXTMEM_DCACHEABLE
         d_cache = CPLB_L1_CHBL;
-#ifdef CONFIG_BFIN_EXTMEM_WRITETROUGH
+#ifdef CONFIG_BFIN_EXTMEM_WRITETHROUGH
         d_cache |= CPLB_L1_AOW | CPLB_WT;
 #endif
 #endif
diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 430ae39456e8..5cc7e2e9e415 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -151,7 +151,7 @@ void start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_
         regs->pc = new_ip;
         if (current->mm)
                 regs->p5 = current->mm->start_data;
-#ifdef CONFIG_SMP
+#ifndef CONFIG_SMP
         task_thread_info(current)->l1_task_info.stack_start =
                 (void *)current->mm->context.stack_start;
         task_thread_info(current)->l1_task_info.lowest_sp = (void *)new_sp;
diff --git a/arch/blackfin/kernel/ptrace.c b/arch/blackfin/kernel/ptrace.c
index 0982b5d5af10..56b0ba12175f 100644
--- a/arch/blackfin/kernel/ptrace.c
+++ b/arch/blackfin/kernel/ptrace.c
@@ -315,7 +315,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                         case BFIN_MEM_ACCESS_CORE:
                         case BFIN_MEM_ACCESS_CORE_ONLY:
                                 copied = access_process_vm(child, addr, &data,
-                                                           to_copy, 0);
+                                                           to_copy, 1);
                                 if (copied)
                                         break;
 
diff --git a/arch/blackfin/mach-bf518/include/mach/anomaly.h b/arch/blackfin/mach-bf518/include/mach/anomaly.h
index e9c65390edd1..2829dd0400f1 100644
--- a/arch/blackfin/mach-bf518/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf518/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf518/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -70,6 +74,10 @@
 #define ANOMALY_05000461 (1)
 /* Synchronization Problem at Startup May Cause SPORT Transmit Channels to Misalign */
 #define ANOMALY_05000462 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -133,5 +141,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf527/include/mach/anomaly.h b/arch/blackfin/mach-bf527/include/mach/anomaly.h
index 3f9052687fa8..02040df8ec80 100644
--- a/arch/blackfin/mach-bf527/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf527/include/mach/anomaly.h
@@ -1,14 +1,18 @@
 /*
- * File: include/asm-blackfin/mach-bf527/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
  *  - Revision D, 08/14/2009; ADSP-BF526 Blackfin Processor Anomaly List
- *  - Revision F, 03/03/2009; ADSP-BF527 Blackfin Processor Anomaly List
+ *  - Revision G, 08/25/2009; ADSP-BF527 Blackfin Processor Anomaly List
  */
 
 #ifndef _MACH_ANOMALY_H_
@@ -200,6 +204,10 @@
 #define ANOMALY_05000467 (1)
 /* PLL Latches Incorrect Settings During Reset */
 #define ANOMALY_05000469 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -250,5 +258,7 @@
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000447 (0)
 #define ANOMALY_05000448 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf533/include/mach/anomaly.h b/arch/blackfin/mach-bf533/include/mach/anomaly.h
index cd83db2fb1a1..9b3f7a27714d 100644
--- a/arch/blackfin/mach-bf533/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf533/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf533/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -202,6 +206,10 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* These anomalies have been "phased" out of analog.com anomaly sheets and are
  * here to show running on older silicon just isn't feasible.
@@ -349,5 +357,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf537/include/mach/anomaly.h b/arch/blackfin/mach-bf537/include/mach/anomaly.h
index f091ad2d8ea8..d2c427bc6656 100644
--- a/arch/blackfin/mach-bf537/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf537/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf537/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -156,6 +160,10 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -202,5 +210,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf538/include/mach/anomaly.h b/arch/blackfin/mach-bf538/include/mach/anomaly.h
index 26b76083e14c..d882b7e6f59b 100644
--- a/arch/blackfin/mach-bf538/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf538/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf538/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -128,6 +132,10 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -176,5 +184,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf548/include/mach/anomaly.h b/arch/blackfin/mach-bf548/include/mach/anomaly.h
index 52b116ae522a..7d08c7524498 100644
--- a/arch/blackfin/mach-bf548/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf548/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf548/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -24,6 +28,8 @@
 #define ANOMALY_05000119 (1)
 /* Rx.H Cannot Be Used to Access 16-bit System MMR Registers */
 #define ANOMALY_05000122 (1)
+/* Data Corruption with Cached External Memory and Non-Cached On-Chip L2 Memory */
+#define ANOMALY_05000220 (1)
 /* False Hardware Error from an Access in the Shadow of a Conditional Branch */
 #define ANOMALY_05000245 (1)
 /* Sensitivity To Noise with Slow Input Edge Rates on External SPORT TX and RX Clocks */
@@ -200,6 +206,14 @@
 #define ANOMALY_05000466 (1)
 /* Possible RX data corruption when control & data EP FIFOs are accessed via the core */
 #define ANOMALY_05000467 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* Access to DDR-SDRAM causes system hang under certain PLL/VR settings */
+#define ANOMALY_05000474 (1)
+/* Core Hang With L2/L3 Configured in Writeback Cache Mode */
+#define ANOMALY_05000475 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -215,7 +229,6 @@
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000202 (0)
 #define ANOMALY_05000215 (0)
-#define ANOMALY_05000220 (0)
 #define ANOMALY_05000227 (0)
 #define ANOMALY_05000230 (0)
 #define ANOMALY_05000231 (0)
diff --git a/arch/blackfin/mach-bf561/atomic.S b/arch/blackfin/mach-bf561/atomic.S
index 0261a5e751b3..f99f174b129f 100644
--- a/arch/blackfin/mach-bf561/atomic.S
+++ b/arch/blackfin/mach-bf561/atomic.S
@@ -19,6 +19,16 @@
         \reg\().h = _corelock;
 .endm
 
+.macro safe_testset addr:req, scratch:req
+#if ANOMALY_05000477
+        cli \scratch;
+        testset (\addr);
+        sti \scratch;
+#else
+        testset (\addr);
+#endif
+.endm
+
 /*
  * r0 = address of atomic data to flush and invalidate (32bit).
  *
@@ -33,7 +43,7 @@ ENTRY(_get_core_lock)
         cli r0;
         coreslot_loadaddr p0;
 .Lretry_corelock:
-        testset (p0);
+        safe_testset p0, r2;
         if cc jump .Ldone_corelock;
         SSYNC(r2);
         jump .Lretry_corelock
@@ -56,7 +66,7 @@ ENTRY(_get_core_lock_noflush)
         cli r0;
         coreslot_loadaddr p0;
 .Lretry_corelock_noflush:
-        testset (p0);
+        safe_testset p0, r2;
         if cc jump .Ldone_corelock_noflush;
         SSYNC(r2);
         jump .Lretry_corelock_noflush
diff --git a/arch/blackfin/mach-bf561/include/mach/anomaly.h b/arch/blackfin/mach-bf561/include/mach/anomaly.h
index 70da495c9665..5ddc981e9937 100644
--- a/arch/blackfin/mach-bf561/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf561/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf561/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -213,7 +217,11 @@
 /* Disabling Peripherals with DMA Running May Cause DMA System Instability */
 #define ANOMALY_05000278 (__SILICON_REVISION__ < 5)
 /* False Hardware Error Exception when ISR Context Is Not Restored */
-#define ANOMALY_05000281 (__SILICON_REVISION__ < 5)
+/* Temporarily walk around for bug 5423 till this issue is confirmed by
+ * official anomaly document. It looks 05000281 still exists on bf561
+ * v0.5.
+ */
+#define ANOMALY_05000281 (__SILICON_REVISION__ <= 5)
 /* System MMR Write Is Stalled Indefinitely when Killed in a Particular Stage */
 #define ANOMALY_05000283 (1)
 /* Reads Will Receive Incorrect Data under Certain Conditions */
@@ -280,6 +288,12 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* Core Hang With L2/L3 Configured in Writeback Cache Mode */
+#define ANOMALY_05000475 (__SILICON_REVISION__ < 4)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000119 (0)
@@ -304,5 +318,6 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
 
 #endif
diff --git a/arch/blackfin/mach-common/arch_checks.c b/arch/blackfin/mach-common/arch_checks.c
index 9dbafcdcf479..f2ca211a76a0 100644
--- a/arch/blackfin/mach-common/arch_checks.c
+++ b/arch/blackfin/mach-common/arch_checks.c
@@ -57,3 +57,8 @@
          (!defined(CONFIG_BFIN_EXTMEM_DCACHEABLE) && defined(CONFIG_BFIN_L2_WRITEBACK)))
 # error You are exposing Anomaly 220 in this config, either config L2 as Write Through, or make External Memory WB.
 #endif
+
+#if ANOMALY_05000475 && \
+        (defined(CONFIG_BFIN_EXTMEM_WRITEBACK) || defined(CONFIG_BFIN_L2_WRITEBACK))
+# error "Anomaly 475 does not allow you to use Write Back cache with L2 or External Memory"
+#endif
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index d98585f3237d..d92b168c8328 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -276,10 +276,9 @@ void smp_send_reschedule(int cpu)
         if (cpu_is_offline(cpu))
                 return;
 
-        msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        msg = kzalloc(sizeof(*msg), GFP_ATOMIC);
         if (!msg)
                 return;
-        memset(msg, 0, sizeof(msg));
         INIT_LIST_HEAD(&msg->list);
         msg->type = BFIN_IPI_RESCHEDULE;
 
@@ -305,10 +304,9 @@ void smp_send_stop(void)
         if (cpus_empty(callmap))
                 return;
 
-        msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        msg = kzalloc(sizeof(*msg), GFP_ATOMIC);
         if (!msg)
                 return;
-        memset(msg, 0, sizeof(msg));
         INIT_LIST_HEAD(&msg->list);
         msg->type = BFIN_IPI_CPU_STOP;
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 1aad0d9f5074..fd7620f025fa 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -358,7 +358,14 @@ config SGI_IP22
         select SWAP_IO_SPACE
         select SYS_HAS_CPU_R4X00
         select SYS_HAS_CPU_R5000
-        select SYS_HAS_EARLY_PRINTK
+        #
+        # Disable EARLY_PRINTK for now since it leads to overwritten prom
+        # memory during early boot on some machines.
+        #
+        # See http://www.linux-mips.org/cgi-bin/mesg.cgi?a=linux-mips&i=20091119164009.GA15038%40deprecation.cyrius.com
+        # for a more details discussion
+        #
+        # select SYS_HAS_EARLY_PRINTK
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_BIG_ENDIAN
@@ -410,7 +417,14 @@ config SGI_IP28
         select SGI_HAS_ZILOG
         select SWAP_IO_SPACE
         select SYS_HAS_CPU_R10000
-        select SYS_HAS_EARLY_PRINTK
+        #
+        # Disable EARLY_PRINTK for now since it leads to overwritten prom
+        # memory during early boot on some machines.
+        #
+        # See http://www.linux-mips.org/cgi-bin/mesg.cgi?a=linux-mips&i=20091119164009.GA15038%40deprecation.cyrius.com
+        # for a more details discussion
+        #
+        # select SYS_HAS_EARLY_PRINTK
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_BIG_ENDIAN
       help
@@ -1439,6 +1453,7 @@ choice
 
 config PAGE_SIZE_4KB
         bool "4kB"
+        depends on !CPU_LOONGSON2
         help
          This option select the standard 4kB Linux page size.  On some
          R3000-family processors this is the only available page size.  Using
@@ -1763,7 +1778,7 @@ config SYS_SUPPORTS_SMARTMIPS
 
 config ARCH_FLATMEM_ENABLE
         def_bool y
-        depends on !NUMA
+        depends on !NUMA && !CPU_LOONGSON2
 
 config ARCH_DISCONTIGMEM_ENABLE
         bool
diff --git a/arch/mips/include/asm/mman.h b/arch/mips/include/asm/mman.h
index a2250f390a29..c892bfb3e2c1 100644
--- a/arch/mips/include/asm/mman.h
+++ b/arch/mips/include/asm/mman.h
@@ -75,6 +75,7 @@
 
 #define MADV_MERGEABLE   12             /* KSM may merge identical pages */
 #define MADV_UNMERGEABLE 13             /* KSM may not merge identical pages */
+#define MADV_HWPOISON    100            /* poison a page for testing */
 
 /* compatibility flags */
 #define MAP_FILE        0
diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
index fcf5f98d90cc..83b5509e09e8 100644
--- a/arch/mips/include/asm/system.h
+++ b/arch/mips/include/asm/system.h
@@ -12,6 +12,7 @@
 #ifndef _ASM_SYSTEM_H
 #define _ASM_SYSTEM_H
 
+#include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/irqflags.h>
 
@@ -193,10 +194,6 @@ extern __u64 __xchg_u64_unsupported_on_32bit_kernels(volatile __u64 * m, __u64 v
 #define __xchg_u64 __xchg_u64_unsupported_on_32bit_kernels
 #endif
 
-/* This function doesn't exist, so you'll get a linker error
-   if something tries to do an invalid xchg().  */
-extern void __xchg_called_with_bad_pointer(void);
-
 static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int size)
 {
         switch (size) {
@@ -205,11 +202,17 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
         case 8:
                 return __xchg_u64(ptr, x);
         }
-        __xchg_called_with_bad_pointer();
+
         return x;
 }
 
-#define xchg(ptr, x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
+#define xchg(ptr, x)                                                    \
+({                                                                      \
+        BUILD_BUG_ON(sizeof(*(ptr)) & ~0xc);                            \
+                                                                        \
+        ((__typeof__(*(ptr)))                                           \
+                __xchg((unsigned long)(x), (ptr), sizeof(*(ptr))));     \
+})
 
 extern void set_handler(unsigned long offset, void *addr, unsigned long len);
 extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len);
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 69dad5a850a8..a36799e85693 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -28,7 +28,7 @@
 #define dbg(x...)
 #endif
 
-#define KERNEL_START (KERNEL_BINARY_TEXT_START - 0x1000)
+#define KERNEL_START (KERNEL_BINARY_TEXT_START)
 
 extern struct unwind_table_entry __start___unwind[];
 extern struct unwind_table_entry __stop___unwind[];
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index fda4baa059b5..9dab4a4e09f7 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -78,9 +78,6 @@ SECTIONS
          */
         . = ALIGN(PAGE_SIZE);
         data_start = .;
-        EXCEPTION_TABLE(16)
-
-        NOTES
 
         /* unwind info */
         .PARISC.unwind : {
@@ -89,6 +86,9 @@ SECTIONS
                 __stop___unwind = .;
         }
 
+        EXCEPTION_TABLE(16)
+        NOTES
+
         /* Data */
         RW_DATA_SECTION(L1_CACHE_BYTES, PAGE_SIZE, THREAD_SIZE)
 
diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
index b6bac6f61c16..916369575c97 100644
--- a/arch/powerpc/include/asm/kmap_types.h
+++ b/arch/powerpc/include/asm/kmap_types.h
@@ -29,5 +29,16 @@ enum km_type {
         KM_TYPE_NR
 };
 
+/*
+ * This is a temporary build fix that (so they say on lkml....) should no longer
+ * be required after 2.6.33, because of changes planned to the kmap code.
+ * Let's try to remove this cruft then.
+ */
+#ifdef CONFIG_DEBUG_HIGHMEM
+#define KM_NMI          (-1)
+#define KM_NMI_PTE      (-1)
+#define KM_IRQ_PTE      (-1)
+#endif
+
 #endif  /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_KMAP_TYPES_H */
diff --git a/arch/sparc/mm/init_64.h b/arch/sparc/mm/init_64.h
index c2f772dbd556..77d1b313e344 100644
--- a/arch/sparc/mm/init_64.h
+++ b/arch/sparc/mm/init_64.h
@@ -45,7 +45,7 @@ extern void free_initmem(void);
 #define VMEMMAP_ALIGN(x)        (((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK)
 
 #define VMEMMAP_SIZE    ((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \
-                          sizeof(struct page *)) >> VMEMMAP_CHUNK_SHIFT)
+                          sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT)
 extern unsigned long vmemmap_table[VMEMMAP_SIZE];
 #endif
 
diff --git a/arch/x86/kernel/acpi/processor.c b/arch/x86/kernel/acpi/processor.c
index d296f4a195c9..d85d1b2432ba 100644
--- a/arch/x86/kernel/acpi/processor.c
+++ b/arch/x86/kernel/acpi/processor.c
@@ -79,7 +79,8 @@ void arch_acpi_processor_init_pdc(struct acpi_processor *pr)
         struct cpuinfo_x86 *c = &cpu_data(pr->id);
 
         pr->pdc = NULL;
-        if (c->x86_vendor == X86_VENDOR_INTEL)
+        if (c->x86_vendor == X86_VENDOR_INTEL ||
+            c->x86_vendor == X86_VENDOR_CENTAUR)
                 init_intel_pdc(pr, c);
 
         return;
diff --git a/crypto/async_tx/Kconfig b/crypto/async_tx/Kconfig
index e5aeb2b79e6f..e28e276ac611 100644
--- a/crypto/async_tx/Kconfig
+++ b/crypto/async_tx/Kconfig
@@ -23,3 +23,8 @@ config ASYNC_RAID6_RECOV
         select ASYNC_CORE
         select ASYNC_PQ
 
+config ASYNC_TX_DISABLE_PQ_VAL_DMA
+        bool
+
+config ASYNC_TX_DISABLE_XOR_VAL_DMA
+        bool
diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
index 6b5cc4fba59f..ec87f53d5059 100644
--- a/crypto/async_tx/async_pq.c
+++ b/crypto/async_tx/async_pq.c
@@ -240,6 +240,16 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
 }
 EXPORT_SYMBOL_GPL(async_gen_syndrome);
 
+static inline struct dma_chan *
+pq_val_chan(struct async_submit_ctl *submit, struct page **blocks, int disks, size_t len)
+{
+        #ifdef CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA
+        return NULL;
+        #endif
+        return async_tx_find_channel(submit, DMA_PQ_VAL, NULL, 0,  blocks,
+                                     disks, len);
+}
+
 /**
  * async_syndrome_val - asynchronously validate a raid6 syndrome
  * @blocks: source blocks from idx 0..disks-3, P @ disks-2 and Q @ disks-1
@@ -260,9 +270,7 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
                    size_t len, enum sum_check_flags *pqres, struct page *spare,
                    struct async_submit_ctl *submit)
 {
-        struct dma_chan *chan = async_tx_find_channel(submit, DMA_PQ_VAL,
-                                                      NULL, 0,  blocks, disks,
-                                                      len);
+        struct dma_chan *chan = pq_val_chan(submit, blocks, disks, len);
         struct dma_device *device = chan ? chan->device : NULL;
         struct dma_async_tx_descriptor *tx;
         unsigned char coefs[disks-2];
diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
index 79182dcb91b7..079ae8ca590b 100644
--- a/crypto/async_tx/async_xor.c
+++ b/crypto/async_tx/async_xor.c
@@ -234,6 +234,17 @@ static int page_is_zero(struct page *p, unsigned int offset, size_t len)
                 memcmp(a, a + 4, len - 4) == 0);
 }
 
+static inline struct dma_chan *
+xor_val_chan(struct async_submit_ctl *submit, struct page *dest,
+                 struct page **src_list, int src_cnt, size_t len)
+{
+        #ifdef CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA
+        return NULL;
+        #endif
+        return async_tx_find_channel(submit, DMA_XOR_VAL, &dest, 1, src_list,
+                                     src_cnt, len);
+}
+
 /**
  * async_xor_val - attempt a xor parity check with a dma engine.
  * @dest: destination page used if the xor is performed synchronously
@@ -255,9 +266,7 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset,
               int src_cnt, size_t len, enum sum_check_flags *result,
               struct async_submit_ctl *submit)
 {
-        struct dma_chan *chan = async_tx_find_channel(submit, DMA_XOR_VAL,
-                                                      &dest, 1, src_list,
-                                                      src_cnt, len);
+        struct dma_chan *chan = xor_val_chan(submit, dest, src_list, src_cnt, len);
         struct dma_device *device = chan ? chan->device : NULL;
         struct dma_async_tx_descriptor *tx = NULL;
         dma_addr_t *dma_src = NULL;
diff --git a/crypto/gcm.c b/crypto/gcm.c
index 5fc3292483ef..c6547130624c 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -40,7 +40,7 @@ struct crypto_rfc4106_ctx {
 struct crypto_gcm_ghash_ctx {
         unsigned int cryptlen;
         struct scatterlist *src;
-        crypto_completion_t complete;
+        void (*complete)(struct aead_request *req, int err);
 };
 
 struct crypto_gcm_req_priv_ctx {
@@ -267,23 +267,26 @@ static int gcm_hash_final(struct aead_request *req,
         return crypto_ahash_final(ahreq);
 }
 
-static void gcm_hash_final_done(struct crypto_async_request *areq,
-                                int err)
+static void __gcm_hash_final_done(struct aead_request *req, int err)
 {
-        struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
 
         if (!err)
                 crypto_xor(pctx->auth_tag, pctx->iauth_tag, 16);
 
-        gctx->complete(areq, err);
+        gctx->complete(req, err);
 }
 
-static void gcm_hash_len_done(struct crypto_async_request *areq,
-                              int err)
+static void gcm_hash_final_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_final_done(req, err);
+}
+
+static void __gcm_hash_len_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
 
         if (!err) {
@@ -292,13 +295,18 @@ static void gcm_hash_len_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_final_done(areq, err);
+        __gcm_hash_final_done(req, err);
 }
 
-static void gcm_hash_crypt_remain_done(struct crypto_async_request *areq,
-                                       int err)
+static void gcm_hash_len_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_len_done(req, err);
+}
+
+static void __gcm_hash_crypt_remain_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
 
         if (!err) {
@@ -307,13 +315,19 @@ static void gcm_hash_crypt_remain_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_len_done(areq, err);
+        __gcm_hash_len_done(req, err);
 }
 
-static void gcm_hash_crypt_done(struct crypto_async_request *areq,
-                                int err)
+static void gcm_hash_crypt_remain_done(struct crypto_async_request *areq,
+                                       int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_crypt_remain_done(req, err);
+}
+
+static void __gcm_hash_crypt_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
         unsigned int remain;
@@ -327,13 +341,18 @@ static void gcm_hash_crypt_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_crypt_remain_done(areq, err);
+        __gcm_hash_crypt_remain_done(req, err);
 }
 
-static void gcm_hash_assoc_remain_done(struct crypto_async_request *areq,
-                                           int err)
+static void gcm_hash_crypt_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_crypt_done(req, err);
+}
+
+static void __gcm_hash_assoc_remain_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
         crypto_completion_t complete;
@@ -350,15 +369,21 @@ static void gcm_hash_assoc_remain_done(struct crypto_async_request *areq,
         }
 
         if (remain)
-                gcm_hash_crypt_done(areq, err);
+                __gcm_hash_crypt_done(req, err);
         else
-                gcm_hash_crypt_remain_done(areq, err);
+                __gcm_hash_crypt_remain_done(req, err);
 }
 
-static void gcm_hash_assoc_done(struct crypto_async_request *areq,
-                                int err)
+static void gcm_hash_assoc_remain_done(struct crypto_async_request *areq,
+                                       int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_assoc_remain_done(req, err);
+}
+
+static void __gcm_hash_assoc_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         unsigned int remain;
 
@@ -371,13 +396,18 @@ static void gcm_hash_assoc_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_assoc_remain_done(areq, err);
+        __gcm_hash_assoc_remain_done(req, err);
 }
 
-static void gcm_hash_init_done(struct crypto_async_request *areq,
-                               int err)
+static void gcm_hash_assoc_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_assoc_done(req, err);
+}
+
+static void __gcm_hash_init_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         crypto_completion_t complete;
         unsigned int remain = 0;
@@ -393,9 +423,16 @@ static void gcm_hash_init_done(struct crypto_async_request *areq,
         }
 
         if (remain)
-                gcm_hash_assoc_done(areq, err);
+                __gcm_hash_assoc_done(req, err);
         else
-                gcm_hash_assoc_remain_done(areq, err);
+                __gcm_hash_assoc_remain_done(req, err);
+}
+
+static void gcm_hash_init_done(struct crypto_async_request *areq, int err)
+{
+        struct aead_request *req = areq->data;
+
+        __gcm_hash_init_done(req, err);
 }
 
 static int gcm_hash(struct aead_request *req,
@@ -457,10 +494,8 @@ static void gcm_enc_copy_hash(struct aead_request *req,
                                  crypto_aead_authsize(aead), 1);
 }
 
-static void gcm_enc_hash_done(struct crypto_async_request *areq,
-                                     int err)
+static void gcm_enc_hash_done(struct aead_request *req, int err)
 {
-        struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
 
         if (!err)
@@ -469,8 +504,7 @@ static void gcm_enc_hash_done(struct crypto_async_request *areq,
         aead_request_complete(req, err);
 }
 
-static void gcm_encrypt_done(struct crypto_async_request *areq,
-                                     int err)
+static void gcm_encrypt_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
@@ -479,9 +513,13 @@ static void gcm_encrypt_done(struct crypto_async_request *areq,
                 err = gcm_hash(req, pctx);
                 if (err == -EINPROGRESS || err == -EBUSY)
                         return;
+                else if (!err) {
+                        crypto_xor(pctx->auth_tag, pctx->iauth_tag, 16);
+                        gcm_enc_copy_hash(req, pctx);
+                }
         }
 
-        gcm_enc_hash_done(areq, err);
+        aead_request_complete(req, err);
 }
 
 static int crypto_gcm_encrypt(struct aead_request *req)
@@ -538,9 +576,8 @@ static void gcm_decrypt_done(struct crypto_async_request *areq, int err)
         aead_request_complete(req, err);
 }
 
-static void gcm_dec_hash_done(struct crypto_async_request *areq, int err)
+static void gcm_dec_hash_done(struct aead_request *req, int err)
 {
-        struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct ablkcipher_request *abreq = &pctx->u.abreq;
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
@@ -552,9 +589,11 @@ static void gcm_dec_hash_done(struct crypto_async_request *areq, int err)
                 err = crypto_ablkcipher_decrypt(abreq);
                 if (err == -EINPROGRESS || err == -EBUSY)
                         return;
+                else if (!err)
+                        err = crypto_gcm_verify(req, pctx);
         }
 
-        gcm_decrypt_done(areq, err);
+        aead_request_complete(req, err);
 }
 
 static int crypto_gcm_decrypt(struct aead_request *req)
diff --git a/drivers/acpi/acpica/acpredef.h b/drivers/acpi/acpica/acpredef.h
index cd80d1dd1950..57bdaf6ffab1 100644
--- a/drivers/acpi/acpica/acpredef.h
+++ b/drivers/acpi/acpica/acpredef.h
@@ -203,8 +203,9 @@ static const union acpi_predefined_info predefined_names[] =
         {{"_BCT", 1, ACPI_RTYPE_INTEGER}},
         {{"_BDN", 0, ACPI_RTYPE_INTEGER}},
         {{"_BFS", 1, 0}},
-        {{"_BIF", 0, ACPI_RTYPE_PACKAGE}}, /* Fixed-length (9 Int),(4 Str) */
-                          {{{ACPI_PTYPE1_FIXED, ACPI_RTYPE_INTEGER, 9, ACPI_RTYPE_STRING}, 4,0}},
+        {{"_BIF", 0, ACPI_RTYPE_PACKAGE} }, /* Fixed-length (9 Int),(4 Str/Buf) */
+                          {{{ACPI_PTYPE1_FIXED, ACPI_RTYPE_INTEGER, 9,
+                             ACPI_RTYPE_STRING | ACPI_RTYPE_BUFFER}, 4, 0} },
 
         {{"_BIX", 0, ACPI_RTYPE_PACKAGE}},      /* Fixed-length (16 Int),(4 Str) */
         {{{ACPI_PTYPE1_FIXED, ACPI_RTYPE_INTEGER, 16, ACPI_RTYPE_STRING}, 4,
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index e56b2a7b53db..23e5a0519af5 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -224,6 +224,7 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
          * _OSI(Linux) helps sound
          * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad R61"),
          * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T61"),
+         * T400, T500
          * _OSI(Linux) has Linux specific hooks
          * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X61"),
          * _OSI(Linux) is a NOP:
@@ -254,6 +255,22 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                      DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X61"),
                 },
         },
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Lenovo ThinkPad T400",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T400"),
+                },
+        },
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Lenovo ThinkPad T500",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 4cc1b8116e76..5f2c379ab7bf 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -430,6 +430,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
         },
         {
         .callback = init_set_sci_en_on_resume,
+        .ident = "Hewlett-Packard Compaq Presario C700 Notebook PC",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario C700 Notebook PC"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
         .ident = "Hewlett-Packard Compaq Presario CQ40 Notebook PC",
         .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index d344db42a002..172b57e6543f 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -707,34 +707,17 @@ static unsigned int sata_fsl_dev_classify(struct ata_port *ap)
         return ata_dev_classify(&tf);
 }
 
-static int sata_fsl_prereset(struct ata_link *link, unsigned long deadline)
-{
-        /* FIXME: Never skip softreset, sata_fsl_softreset() is
-         * combination of soft and hard resets.  sata_fsl_softreset()
-         * needs to be splitted into soft and hard resets.
-         */
-        return 0;
-}
-
-static int sata_fsl_softreset(struct ata_link *link, unsigned int *class,
+static int sata_fsl_hardreset(struct ata_link *link, unsigned int *class,
                                         unsigned long deadline)
 {
         struct ata_port *ap = link->ap;
-        struct sata_fsl_port_priv *pp = ap->private_data;
         struct sata_fsl_host_priv *host_priv = ap->host->private_data;
         void __iomem *hcr_base = host_priv->hcr_base;
-        int pmp = sata_srst_pmp(link);
         u32 temp;
-        struct ata_taskfile tf;
-        u8 *cfis;
-        u32 Serror;
         int i = 0;
         unsigned long start_jiffies;
 
-        DPRINTK("in xx_softreset\n");
-
-        if (pmp != SATA_PMP_CTRL_PORT)
-                goto issue_srst;
+        DPRINTK("in xx_hardreset\n");
 
 try_offline_again:
         /*
@@ -749,7 +732,7 @@ try_offline_again:
 
         if (temp & ONLINE) {
                 ata_port_printk(ap, KERN_ERR,
-                                "Softreset failed, not off-lined %d\n", i);
+                                "Hardreset failed, not off-lined %d\n", i);
 
                 /*
                  * Try to offline controller atleast twice
@@ -761,7 +744,7 @@ try_offline_again:
                         goto try_offline_again;
         }
 
-        DPRINTK("softreset, controller off-lined\n");
+        DPRINTK("hardreset, controller off-lined\n");
         VPRINTK("HStatus = 0x%x\n", ioread32(hcr_base + HSTATUS));
         VPRINTK("HControl = 0x%x\n", ioread32(hcr_base + HCONTROL));
 
@@ -786,11 +769,11 @@ try_offline_again:
 
         if (!(temp & ONLINE)) {
                 ata_port_printk(ap, KERN_ERR,
-                                "Softreset failed, not on-lined\n");
+                                "Hardreset failed, not on-lined\n");
                 goto err;
         }
 
-        DPRINTK("softreset, controller off-lined & on-lined\n");
+        DPRINTK("hardreset, controller off-lined & on-lined\n");
         VPRINTK("HStatus = 0x%x\n", ioread32(hcr_base + HSTATUS));
         VPRINTK("HControl = 0x%x\n", ioread32(hcr_base + HCONTROL));
 
@@ -806,7 +789,7 @@ try_offline_again:
                                 "No Device OR PHYRDY change,Hstatus = 0x%x\n",
                                 ioread32(hcr_base + HSTATUS));
                 *class = ATA_DEV_NONE;
-                goto out;
+                return 0;
         }
 
         /*
@@ -819,11 +802,44 @@ try_offline_again:
         if ((temp & 0xFF) != 0x18) {
                 ata_port_printk(ap, KERN_WARNING, "No Signature Update\n");
                 *class = ATA_DEV_NONE;
-                goto out;
+                goto do_followup_srst;
         } else {
                 ata_port_printk(ap, KERN_INFO,
                                 "Signature Update detected @ %d msecs\n",
                                 jiffies_to_msecs(jiffies - start_jiffies));
+                *class = sata_fsl_dev_classify(ap);
+                return 0;
+        }
+
+do_followup_srst:
+        /*
+         * request libATA to perform follow-up softreset
+         */
+        return -EAGAIN;
+
+err:
+        return -EIO;
+}
+
+static int sata_fsl_softreset(struct ata_link *link, unsigned int *class,
+                                        unsigned long deadline)
+{
+        struct ata_port *ap = link->ap;
+        struct sata_fsl_port_priv *pp = ap->private_data;
+        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
+        void __iomem *hcr_base = host_priv->hcr_base;
+        int pmp = sata_srst_pmp(link);
+        u32 temp;
+        struct ata_taskfile tf;
+        u8 *cfis;
+        u32 Serror;
+
+        DPRINTK("in xx_softreset\n");
+
+        if (ata_link_offline(link)) {
+                DPRINTK("PHY reports no device\n");
+                *class = ATA_DEV_NONE;
+                return 0;
         }
 
         /*
@@ -834,7 +850,6 @@ try_offline_again:
          * reached here, we can send a command to the target device
          */
 
-issue_srst:
         DPRINTK("Sending SRST/device reset\n");
 
         ata_tf_init(link->device, &tf);
@@ -860,6 +875,8 @@ issue_srst:
                 ioread32(CA + hcr_base), ioread32(CC + hcr_base));
 
         iowrite32(0xFFFF, CC + hcr_base);
+        if (pmp != SATA_PMP_CTRL_PORT)
+                iowrite32(pmp, CQPMP + hcr_base);
         iowrite32(1, CQ + hcr_base);
 
         temp = ata_wait_register(CQ + hcr_base, 0x1, 0x1, 1, 5000);
@@ -926,7 +943,6 @@ issue_srst:
                 VPRINTK("cereg = 0x%x\n", ioread32(hcr_base + CE));
         }
 
-out:
         return 0;
 
 err:
@@ -988,18 +1004,6 @@ static void sata_fsl_error_intr(struct ata_port *ap)
                 ehi->err_mask |= AC_ERR_ATA_BUS;
                 ehi->action |= ATA_EH_SOFTRESET;
 
-                /*
-                 * Ignore serror in case of fatal errors as we always want
-                 * to do a soft-reset of the FSL SATA controller. Analyzing
-                 * serror may cause libata to schedule a hard-reset action,
-                 * and hard-reset currently does not do controller
-                 * offline/online, causing command timeouts and leads to an
-                 * un-recoverable state, hence make libATA ignore
-                 * autopsy in case of fatal errors.
-                 */
-
-                ehi->flags |= ATA_EHI_NO_AUTOPSY;
-
                 freeze = 1;
         }
 
@@ -1267,8 +1271,8 @@ static struct ata_port_operations sata_fsl_ops = {
 
         .freeze = sata_fsl_freeze,
         .thaw = sata_fsl_thaw,
-        .prereset = sata_fsl_prereset,
         .softreset = sata_fsl_softreset,
+        .hardreset = sata_fsl_hardreset,
         .pmp_softreset = sata_fsl_softreset,
         .error_handler = sata_fsl_error_handler,
         .post_internal_cmd = sata_fsl_post_internal_cmd,
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index a770498a74ec..846d89e3d122 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -328,11 +328,11 @@ int __pm_runtime_resume(struct device *dev, bool from_wq)
                  * necessary.
                  */
                 parent = dev->parent;
-                spin_unlock_irq(&dev->power.lock);
+                spin_unlock(&dev->power.lock);
 
                 pm_runtime_get_noresume(parent);
 
-                spin_lock_irq(&parent->power.lock);
+                spin_lock(&parent->power.lock);
                 /*
                  * We can resume if the parent's run-time PM is disabled or it
                  * is set to ignore children.
@@ -343,9 +343,9 @@ int __pm_runtime_resume(struct device *dev, bool from_wq)
                         if (parent->power.runtime_status != RPM_ACTIVE)
                                 retval = -EBUSY;
                 }
-                spin_unlock_irq(&parent->power.lock);
+                spin_unlock(&parent->power.lock);
 
-                spin_lock_irq(&dev->power.lock);
+                spin_lock(&dev->power.lock);
                 if (retval)
                         goto out;
                 goto repeat;
@@ -777,7 +777,7 @@ int __pm_runtime_set_status(struct device *dev, unsigned int status)
         }
 
         if (parent) {
-                spin_lock_irq(&parent->power.lock);
+                spin_lock(&parent->power.lock);
 
                 /*
                  * It is invalid to put an active child under a parent that is
@@ -793,7 +793,7 @@ int __pm_runtime_set_status(struct device *dev, unsigned int status)
                                 atomic_inc(&parent->power.child_count);
                 }
 
-                spin_unlock_irq(&parent->power.lock);
+                spin_unlock(&parent->power.lock);
 
                 if (error)
                         goto out;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 6399e5090df4..92b126394fa1 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -482,7 +482,7 @@ static ssize_t host_store_rescan(struct device *dev,
 
         return count;
 }
-DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
+static DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
 
 static ssize_t dev_show_unique_id(struct device *dev,
                                  struct device_attribute *attr,
@@ -512,7 +512,7 @@ static ssize_t dev_show_unique_id(struct device *dev,
                                 sn[8], sn[9], sn[10], sn[11],
                                 sn[12], sn[13], sn[14], sn[15]);
 }
-DEVICE_ATTR(unique_id, S_IRUGO, dev_show_unique_id, NULL);
+static DEVICE_ATTR(unique_id, S_IRUGO, dev_show_unique_id, NULL);
 
 static ssize_t dev_show_vendor(struct device *dev,
                                struct device_attribute *attr,
@@ -536,7 +536,7 @@ static ssize_t dev_show_vendor(struct device *dev,
         else
                 return snprintf(buf, sizeof(vendor) + 1, "%s\n", drv->vendor);
 }
-DEVICE_ATTR(vendor, S_IRUGO, dev_show_vendor, NULL);
+static DEVICE_ATTR(vendor, S_IRUGO, dev_show_vendor, NULL);
 
 static ssize_t dev_show_model(struct device *dev,
                               struct device_attribute *attr,
@@ -560,7 +560,7 @@ static ssize_t dev_show_model(struct device *dev,
         else
                 return snprintf(buf, sizeof(model) + 1, "%s\n", drv->model);
 }
-DEVICE_ATTR(model, S_IRUGO, dev_show_model, NULL);
+static DEVICE_ATTR(model, S_IRUGO, dev_show_model, NULL);
 
 static ssize_t dev_show_rev(struct device *dev,
                             struct device_attribute *attr,
@@ -584,7 +584,7 @@ static ssize_t dev_show_rev(struct device *dev,
         else
                 return snprintf(buf, sizeof(rev) + 1, "%s\n", drv->rev);
 }
-DEVICE_ATTR(rev, S_IRUGO, dev_show_rev, NULL);
+static DEVICE_ATTR(rev, S_IRUGO, dev_show_rev, NULL);
 
 static ssize_t cciss_show_lunid(struct device *dev,
                                 struct device_attribute *attr, char *buf)
@@ -609,7 +609,7 @@ static ssize_t cciss_show_lunid(struct device *dev,
                 lunid[0], lunid[1], lunid[2], lunid[3],
                 lunid[4], lunid[5], lunid[6], lunid[7]);
 }
-DEVICE_ATTR(lunid, S_IRUGO, cciss_show_lunid, NULL);
+static DEVICE_ATTR(lunid, S_IRUGO, cciss_show_lunid, NULL);
 
 static ssize_t cciss_show_raid_level(struct device *dev,
                                      struct device_attribute *attr, char *buf)
@@ -632,7 +632,7 @@ static ssize_t cciss_show_raid_level(struct device *dev,
         return snprintf(buf, strlen(raid_label[raid]) + 7, "RAID %s\n",
                         raid_label[raid]);
 }
-DEVICE_ATTR(raid_level, S_IRUGO, cciss_show_raid_level, NULL);
+static DEVICE_ATTR(raid_level, S_IRUGO, cciss_show_raid_level, NULL);
 
 static ssize_t cciss_show_usage_count(struct device *dev,
                                       struct device_attribute *attr, char *buf)
@@ -651,7 +651,7 @@ static ssize_t cciss_show_usage_count(struct device *dev,
         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
         return snprintf(buf, 20, "%d\n", count);
 }
-DEVICE_ATTR(usage_count, S_IRUGO, cciss_show_usage_count, NULL);
+static DEVICE_ATTR(usage_count, S_IRUGO, cciss_show_usage_count, NULL);
 
 static struct attribute *cciss_host_attrs[] = {
         &dev_attr_rescan.attr,
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 10e1f0390bbb..3cb56a049e24 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -62,6 +62,7 @@
 #define PCI_DEVICE_ID_INTEL_IGDNG_D_IG      0x0042
 #define PCI_DEVICE_ID_INTEL_IGDNG_M_HB      0x0044
 #define PCI_DEVICE_ID_INTEL_IGDNG_MA_HB     0x0062
+#define PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB    0x006a
 #define PCI_DEVICE_ID_INTEL_IGDNG_M_IG      0x0046
 
 /* cover 915 and 945 variants */
@@ -96,7 +97,8 @@
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB)
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB)
 
 extern int agp_memory_reserved;
 
@@ -1358,6 +1360,7 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
         case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
         case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
         case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB:
+        case PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB:
                 *gtt_offset = *gtt_size = MB(2);
                 break;
         default:
@@ -2359,6 +2362,8 @@ static const struct intel_driver_description {
             "IGDNG/M", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_IGDNG_MA_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
             "IGDNG/MA", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
+            "IGDNG/MC2", NULL, &intel_i965_driver },
         { 0, 0, 0, NULL, NULL, NULL }
 };
 
@@ -2560,6 +2565,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
         ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
         ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
+        ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
         { }
 };
 
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 737be953cc58..950837cf9e9c 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1249,7 +1249,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
 
         if (keycode >= NR_KEYS)
                 if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
-                        keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
+                        keysym = U(K(KT_BRL, keycode - KEY_BRL_DOT1 + 1));
                 else
                         return;
         else
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index 2e8552dc5eda..c63f3d33914a 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -219,8 +219,11 @@ int tty_port_block_til_ready(struct tty_port *port,
 
         /* if non-blocking mode is set we can pass directly to open unless
            the port has just hung up or is in another error state */
-        if ((filp->f_flags & O_NONBLOCK) ||
-                        (tty->flags & (1 << TTY_IO_ERROR))) {
+        if (tty->flags & (1 << TTY_IO_ERROR)) {
+                port->flags |= ASYNC_NORMAL_ACTIVE;
+                return 0;
+        }
+        if (filp->f_flags & O_NONBLOCK) {
                 /* Indicate we are open */
                 if (tty->termios->c_cflag & CBAUD)
                         tty_port_raise_dtr_rts(port);
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index ed86d3bf249a..6aa10284104a 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -103,8 +103,8 @@ void vt_event_post(unsigned int event, unsigned int old, unsigned int new)
                 ve->event.event = event;
                 /* kernel view is consoles 0..n-1, user space view is
                    console 1..n with 0 meaning current, so we must bias */
-                ve->event.old = old + 1;
-                ve->event.new = new + 1;
+                ve->event.oldev = old + 1;
+                ve->event.newev = new + 1;
                 wake = 1;
                 ve->done = 1;
         }
@@ -186,7 +186,7 @@ int vt_waitactive(int n)
                 vt_event_wait(&vw);
                 if (vw.done == 0)
                         return -EINTR;
-        } while (vw.event.new != n);
+        } while (vw.event.newev != n);
         return 0;
 }
 
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index a9952b1236b0..84c51e177269 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -236,7 +236,7 @@ static inline void ecb_crypt(const u8 *in, u8 *out, u32 *key,
         /* Padlock in ECB mode fetches at least ecb_fetch_bytes of data.
          * We could avoid some copying here but it's probably not worth it.
          */
-        if (unlikely(((unsigned long)in & PAGE_SIZE) + ecb_fetch_bytes > PAGE_SIZE)) {
+        if (unlikely(((unsigned long)in & ~PAGE_MASK) + ecb_fetch_bytes > PAGE_SIZE)) {
                 ecb_crypt_copy(in, out, key, cword, count);
                 return;
         }
@@ -248,7 +248,7 @@ static inline u8 *cbc_crypt(const u8 *in, u8 *out, u32 *key,
                             u8 *iv, struct cword *cword, int count)
 {
         /* Padlock in CBC mode fetches at least cbc_fetch_bytes of data. */
-        if (unlikely(((unsigned long)in & PAGE_SIZE) + cbc_fetch_bytes > PAGE_SIZE))
+        if (unlikely(((unsigned long)in & ~PAGE_MASK) + cbc_fetch_bytes > PAGE_SIZE))
                 return cbc_crypt_copy(in, out, key, iv, cword, count);
 
         return rep_xcrypt_cbc(in, out, key, iv, cword, count);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 5903a88351bf..b401dadad4a8 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -26,6 +26,8 @@ config INTEL_IOATDMA
         select DMA_ENGINE
         select DCA
         select ASYNC_TX_DISABLE_CHANNEL_SWITCH
+        select ASYNC_TX_DISABLE_PQ_VAL_DMA
+        select ASYNC_TX_DISABLE_XOR_VAL_DMA
         help
           Enable support for the Intel(R) I/OAT DMA engine present
           in recent Intel Xeon chipsets.
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index bd0b248de2cf..8f99354082ce 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -632,11 +632,21 @@ static bool device_has_all_tx_types(struct dma_device *device)
         #if defined(CONFIG_ASYNC_XOR) || defined(CONFIG_ASYNC_XOR_MODULE)
         if (!dma_has_cap(DMA_XOR, device->cap_mask))
                 return false;
+
+        #ifndef CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA
+        if (!dma_has_cap(DMA_XOR_VAL, device->cap_mask))
+                return false;
+        #endif
         #endif
 
         #if defined(CONFIG_ASYNC_PQ) || defined(CONFIG_ASYNC_PQ_MODULE)
         if (!dma_has_cap(DMA_PQ, device->cap_mask))
                 return false;
+
+        #ifndef CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA
+        if (!dma_has_cap(DMA_PQ_VAL, device->cap_mask))
+                return false;
+        #endif
         #endif
 
         return true;
diff --git a/drivers/dma/ioat/dca.c b/drivers/dma/ioat/dca.c
index 69d02615c4d6..abd9038e06b1 100644
--- a/drivers/dma/ioat/dca.c
+++ b/drivers/dma/ioat/dca.c
@@ -98,17 +98,17 @@ static int dca_enabled_in_bios(struct pci_dev *pdev)
         cpuid_level_9 = cpuid_eax(9);
         res = test_bit(0, &cpuid_level_9);
         if (!res)
-                dev_err(&pdev->dev, "DCA is disabled in BIOS\n");
+                dev_dbg(&pdev->dev, "DCA is disabled in BIOS\n");
 
         return res;
 }
 
-static int system_has_dca_enabled(struct pci_dev *pdev)
+int system_has_dca_enabled(struct pci_dev *pdev)
 {
         if (boot_cpu_has(X86_FEATURE_DCA))
                 return dca_enabled_in_bios(pdev);
 
-        dev_err(&pdev->dev, "boot cpu doesn't have X86_FEATURE_DCA\n");
+        dev_dbg(&pdev->dev, "boot cpu doesn't have X86_FEATURE_DCA\n");
         return 0;
 }
 
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index c14fdfeb7f33..45edde996480 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -297,9 +297,7 @@ static inline bool is_ioat_suspended(unsigned long status)
 /* channel was fatally programmed */
 static inline bool is_ioat_bug(unsigned long err)
 {
-        return !!(err & (IOAT_CHANERR_SRC_ADDR_ERR|IOAT_CHANERR_DEST_ADDR_ERR|
-                         IOAT_CHANERR_NEXT_ADDR_ERR|IOAT_CHANERR_CONTROL_ERR|
-                         IOAT_CHANERR_LENGTH_ERR));
+        return !!err;
 }
 
 static inline void ioat_unmap(struct pci_dev *pdev, dma_addr_t addr, size_t len,
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 96ffab7d37a7..8f1f7f05deaa 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -279,6 +279,8 @@ void ioat2_timer_event(unsigned long data)
                         u32 chanerr;
 
                         chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+                        dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
+                                __func__, chanerr);
                         BUG_ON(is_ioat_bug(chanerr));
                 }
 
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 35d1e33afd5b..42f6f10fb0cc 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -378,6 +378,8 @@ static void ioat3_timer_event(unsigned long data)
                         u32 chanerr;
 
                         chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+                        dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
+                                __func__, chanerr);
                         BUG_ON(is_ioat_bug(chanerr));
                 }
 
@@ -569,7 +571,7 @@ __ioat3_prep_xor_lock(struct dma_chan *c, enum sum_check_flags *result,
         dump_desc_dbg(ioat, compl_desc);
 
         /* we leave the channel locked to ensure in order submission */
-        return &desc->txd;
+        return &compl_desc->txd;
 }
 
 static struct dma_async_tx_descriptor *
@@ -728,7 +730,7 @@ __ioat3_prep_pq_lock(struct dma_chan *c, enum sum_check_flags *result,
         dump_desc_dbg(ioat, compl_desc);
 
         /* we leave the channel locked to ensure in order submission */
-        return &desc->txd;
+        return &compl_desc->txd;
 }
 
 static struct dma_async_tx_descriptor *
@@ -736,10 +738,16 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
               unsigned int src_cnt, const unsigned char *scf, size_t len,
               unsigned long flags)
 {
+        /* specify valid address for disabled result */
+        if (flags & DMA_PREP_PQ_DISABLE_P)
+                dst[0] = dst[1];
+        if (flags & DMA_PREP_PQ_DISABLE_Q)
+                dst[1] = dst[0];
+
         /* handle the single source multiply case from the raid6
          * recovery path
          */
-        if (unlikely((flags & DMA_PREP_PQ_DISABLE_P) && src_cnt == 1)) {
+        if ((flags & DMA_PREP_PQ_DISABLE_P) && src_cnt == 1) {
                 dma_addr_t single_source[2];
                 unsigned char single_source_coef[2];
 
@@ -761,6 +769,12 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
                   unsigned int src_cnt, const unsigned char *scf, size_t len,
                   enum sum_check_flags *pqres, unsigned long flags)
 {
+        /* specify valid address for disabled result */
+        if (flags & DMA_PREP_PQ_DISABLE_P)
+                pq[0] = pq[1];
+        if (flags & DMA_PREP_PQ_DISABLE_Q)
+                pq[1] = pq[0];
+
         /* the cleanup routine only sets bits on validate failure, it
          * does not clear bits on validate success... so clear it here
          */
@@ -778,9 +792,9 @@ ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
         dma_addr_t pq[2];
 
         memset(scf, 0, src_cnt);
-        flags |= DMA_PREP_PQ_DISABLE_Q;
         pq[0] = dst;
-        pq[1] = ~0;
+        flags |= DMA_PREP_PQ_DISABLE_Q;
+        pq[1] = dst; /* specify valid address for disabled result */
 
         return __ioat3_prep_pq_lock(chan, NULL, pq, src, src_cnt, scf, len,
                                     flags);
@@ -800,9 +814,9 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
         *result = 0;
 
         memset(scf, 0, src_cnt);
-        flags |= DMA_PREP_PQ_DISABLE_Q;
         pq[0] = src[0];
-        pq[1] = ~0;
+        flags |= DMA_PREP_PQ_DISABLE_Q;
+        pq[1] = pq[0]; /* specify valid address for disabled result */
 
         return __ioat3_prep_pq_lock(chan, result, pq, &src[1], src_cnt - 1, scf,
                                     len, flags);
@@ -1117,6 +1131,7 @@ static int __devinit ioat3_dma_self_test(struct ioatdma_device *device)
 int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
 {
         struct pci_dev *pdev = device->pdev;
+        int dca_en = system_has_dca_enabled(pdev);
         struct dma_device *dma;
         struct dma_chan *c;
         struct ioat_chan_common *chan;
@@ -1137,6 +1152,11 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
         dma->device_prep_dma_interrupt = ioat3_prep_interrupt_lock;
 
         cap = readl(device->reg_base + IOAT_DMA_CAP_OFFSET);
+
+        /* dca is incompatible with raid operations */
+        if (dca_en && (cap & (IOAT_CAP_XOR|IOAT_CAP_PQ)))
+                cap &= ~(IOAT_CAP_XOR|IOAT_CAP_PQ);
+
         if (cap & IOAT_CAP_XOR) {
                 is_raid_device = true;
                 dma->max_xor = 8;
@@ -1186,6 +1206,16 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
                 device->timer_fn = ioat2_timer_event;
         }
 
+        #ifdef CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA
+        dma_cap_clear(DMA_PQ_VAL, dma->cap_mask);
+        dma->device_prep_dma_pq_val = NULL;
+        #endif
+
+        #ifdef CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA
+        dma_cap_clear(DMA_XOR_VAL, dma->cap_mask);
+        dma->device_prep_dma_xor_val = NULL;
+        #endif
+
         /* -= IOAT ver.3 workarounds =- */
         /* Write CHANERRMSK_INT with 3E07h to mask out the errors
          * that can cause stability issues for IOAT ver.3
diff --git a/drivers/dma/ioat/hw.h b/drivers/dma/ioat/hw.h
index 99afb12bd409..60e675455b6a 100644
--- a/drivers/dma/ioat/hw.h
+++ b/drivers/dma/ioat/hw.h
@@ -39,6 +39,8 @@
 #define IOAT_VER_3_0            0x30    /* Version 3.0 */
 #define IOAT_VER_3_2            0x32    /* Version 3.2 */
 
+int system_has_dca_enabled(struct pci_dev *pdev);
+
 struct ioat_dma_descriptor {
         uint32_t        size;
         union {
diff --git a/drivers/dma/ioat/registers.h b/drivers/dma/ioat/registers.h
index 63038e18ab03..f015ec196700 100644
--- a/drivers/dma/ioat/registers.h
+++ b/drivers/dma/ioat/registers.h
@@ -92,9 +92,7 @@
 #define IOAT_CHANCTRL_ERR_COMPLETION_EN         0x0004
 #define IOAT_CHANCTRL_INT_REARM                 0x0001
 #define IOAT_CHANCTRL_RUN                       (IOAT_CHANCTRL_INT_REARM |\
-                                                 IOAT_CHANCTRL_ERR_COMPLETION_EN |\
-                                                 IOAT_CHANCTRL_ANY_ERR_ABORT_EN |\
-                                                 IOAT_CHANCTRL_ERR_INT_EN)
+                                                 IOAT_CHANCTRL_ANY_ERR_ABORT_EN)
 
 #define IOAT_DMA_COMP_OFFSET                    0x02    /* 16-bit DMA channel compatibility */
 #define IOAT_DMA_COMP_V1                        0x0001  /* Compatibility with DMA version 1 */
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index b3b065c4e5c1..034ecf0ace03 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -640,17 +640,16 @@ static int __init sh_dmae_probe(struct platform_device *pdev)
 #endif
         struct sh_dmae_device *shdev;
 
+        /* get platform data */
+        if (!pdev->dev.platform_data)
+                return -ENODEV;
+
         shdev = kzalloc(sizeof(struct sh_dmae_device), GFP_KERNEL);
         if (!shdev) {
                 dev_err(&pdev->dev, "No enough memory\n");
-                err = -ENOMEM;
-                goto shdev_err;
+                return -ENOMEM;
         }
 
-        /* get platform data */
-        if (!pdev->dev.platform_data)
-                goto shdev_err;
-
         /* platform data */
         memcpy(&shdev->pdata, pdev->dev.platform_data,
                         sizeof(struct sh_dmae_pdata));
@@ -722,7 +721,6 @@ eirq_err:
 rst_err:
         kfree(shdev);
 
-shdev_err:
         return err;
 }
 
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 5d524254499e..94260aa76aa3 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -275,7 +275,7 @@ static void log_irqs(u32 evt)
             !(evt & OHCI1394_busReset))
                 return;
 
-        fw_notify("IRQ %08x%s%s%s%s%s%s%s%s%s%s%s%s%s\n", evt,
+        fw_notify("IRQ %08x%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n", evt,
             evt & OHCI1394_selfIDComplete       ? " selfID"             : "",
             evt & OHCI1394_RQPkt                ? " AR_req"             : "",
             evt & OHCI1394_RSPkt                ? " AR_resp"            : "",
@@ -286,6 +286,7 @@ static void log_irqs(u32 evt)
             evt & OHCI1394_postedWriteErr       ? " postedWriteErr"     : "",
             evt & OHCI1394_cycleTooLong         ? " cycleTooLong"       : "",
             evt & OHCI1394_cycle64Seconds       ? " cycle64Seconds"     : "",
+            evt & OHCI1394_cycleInconsistent    ? " cycleInconsistent"  : "",
             evt & OHCI1394_regAccessFail        ? " regAccessFail"      : "",
             evt & OHCI1394_busReset             ? " busReset"           : "",
             evt & ~(OHCI1394_selfIDComplete | OHCI1394_RQPkt |
@@ -293,6 +294,7 @@ static void log_irqs(u32 evt)
                     OHCI1394_respTxComplete | OHCI1394_isochRx |
                     OHCI1394_isochTx | OHCI1394_postedWriteErr |
                     OHCI1394_cycleTooLong | OHCI1394_cycle64Seconds |
+                    OHCI1394_cycleInconsistent |
                     OHCI1394_regAccessFail | OHCI1394_busReset)
                                                 ? " ?"                  : "");
 }
@@ -1439,6 +1441,17 @@ static irqreturn_t irq_handler(int irq, void *data)
                           OHCI1394_LinkControl_cycleMaster);
         }
 
+        if (unlikely(event & OHCI1394_cycleInconsistent)) {
+                /*
+                 * We need to clear this event bit in order to make
+                 * cycleMatch isochronous I/O work.  In theory we should
+                 * stop active cycleMatch iso contexts now and restart
+                 * them at least two cycles later.  (FIXME?)
+                 */
+                if (printk_ratelimit())
+                        fw_notify("isochronous cycle inconsistent\n");
+        }
+
         if (event & OHCI1394_cycle64Seconds) {
                 cycle_time = reg_read(ohci, OHCI1394_IsochronousCycleTimer);
                 if ((cycle_time & 0x80000000) == 0)
@@ -1528,6 +1541,7 @@ static int ohci_enable(struct fw_card *card, u32 *config_rom, size_t length)
                   OHCI1394_reqTxComplete | OHCI1394_respTxComplete |
                   OHCI1394_isochRx | OHCI1394_isochTx |
                   OHCI1394_postedWriteErr | OHCI1394_cycleTooLong |
+                  OHCI1394_cycleInconsistent |
                   OHCI1394_cycle64Seconds | OHCI1394_regAccessFail |
                   OHCI1394_masterIntEnable);
         if (param_debug & OHCI_PARAM_DEBUG_BUSRESETS)
@@ -1890,15 +1904,30 @@ static int handle_it_packet(struct context *context,
 {
         struct iso_context *ctx =
                 container_of(context, struct iso_context, context);
+        int i;
+        struct descriptor *pd;
 
-        if (last->transfer_status == 0)
-                /* This descriptor isn't done yet, stop iteration. */
+        for (pd = d; pd <= last; pd++)
+                if (pd->transfer_status)
+                        break;
+        if (pd > last)
+                /* Descriptor(s) not done yet, stop iteration */
                 return 0;
 
-        if (le16_to_cpu(last->control) & DESCRIPTOR_IRQ_ALWAYS)
+        i = ctx->header_length;
+        if (i + 4 < PAGE_SIZE) {
+                /* Present this value as big-endian to match the receive code */
+                *(__be32 *)(ctx->header + i) = cpu_to_be32(
+                                ((u32)le16_to_cpu(pd->transfer_status) << 16) |
+                                le16_to_cpu(pd->res_count));
+                ctx->header_length += 4;
+        }
+        if (le16_to_cpu(last->control) & DESCRIPTOR_IRQ_ALWAYS) {
                 ctx->base.callback(&ctx->base, le16_to_cpu(last->res_count),
-                                   0, NULL, ctx->base.callback_data);
-
+                                   ctx->header_length, ctx->header,
+                                   ctx->base.callback_data);
+                ctx->header_length = 0;
+        }
         return 1;
 }
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index f831ea159291..96eddd17e050 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -92,6 +92,7 @@ config DRM_I830
 config DRM_I915
         tristate "i915 driver"
         depends on AGP_INTEL
+        select SHMEM
         select DRM_KMS_HELPER
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index cea665d86dd3..b54ba63d506e 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -662,6 +662,12 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
                 return NULL;
         }
 
+        /* Some EDIDs have bogus h/vtotal values */
+        if (mode->hsync_end > mode->htotal)
+                mode->htotal = mode->hsync_end + 1;
+        if (mode->vsync_end > mode->vtotal)
+                mode->vtotal = mode->vsync_end + 1;
+
         drm_mode_set_name(mode);
 
         if (pt->misc & DRM_EDID_PT_INTERLACED)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index dc8e374a0b55..65ef011fa8ba 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -599,7 +599,7 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
         struct drm_framebuffer *fb = fb_helper->fb;
         int depth;
 
-        if (var->pixclock == -1 || !var->pixclock)
+        if (var->pixclock != 0)
                 return -EINVAL;
 
         /* Need to resize the fb object !!! */
@@ -691,7 +691,7 @@ int drm_fb_helper_set_par(struct fb_info *info)
         int ret;
         int i;
 
-        if (var->pixclock != -1) {
+        if (var->pixclock != 0) {
                 DRM_ERROR("PIXEL CLCOK SET\n");
                 return -EINVAL;
         }
@@ -904,7 +904,7 @@ int drm_fb_helper_single_fb_probe(struct drm_device *dev,
         fb_helper->fb = fb;
 
         if (new_fb) {
-                info->var.pixclock = -1;
+                info->var.pixclock = 0;
                 if (register_framebuffer(info) < 0)
                         return -EINVAL;
         } else {
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 80391995bdec..e9dbb481c469 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -552,7 +552,7 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
         vma->vm_flags |= VM_RESERVED | VM_IO | VM_PFNMAP | VM_DONTEXPAND;
         vma->vm_ops = obj->dev->driver->gem_vm_ops;
         vma->vm_private_data = map->handle;
-        vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+        vma->vm_page_prot =  pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
 
         /* Take a ref for this mapping of the object, so that the fault
          * handler can dereference the mmap offset's pointer to the object.
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index c861d80fd779..97dc5a4f0de4 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -103,6 +103,11 @@ static struct drm_mm_node *drm_mm_kmalloc(struct drm_mm *mm, int atomic)
         return child;
 }
 
+/* drm_mm_pre_get() - pre allocate drm_mm_node structure
+ * drm_mm:      memory manager struct we are pre-allocating for
+ *
+ * Returns 0 on success or -ENOMEM if allocation fails.
+ */
 int drm_mm_pre_get(struct drm_mm *mm)
 {
         struct drm_mm_node *node;
@@ -253,12 +258,14 @@ void drm_mm_put_block(struct drm_mm_node *cur)
                                 prev_node->size += next_node->size;
                                 list_del(&next_node->ml_entry);
                                 list_del(&next_node->fl_entry);
+                                spin_lock(&mm->unused_lock);
                                 if (mm->num_unused < MM_UNUSED_TARGET) {
                                         list_add(&next_node->fl_entry,
                                                  &mm->unused_nodes);
                                         ++mm->num_unused;
                                 } else
                                         kfree(next_node);
+                                spin_unlock(&mm->unused_lock);
                         } else {
                                 next_node->size += cur->size;
                                 next_node->start = cur->start;
@@ -271,11 +278,13 @@ void drm_mm_put_block(struct drm_mm_node *cur)
                 list_add(&cur->fl_entry, &mm->fl_entry);
         } else {
                 list_del(&cur->ml_entry);
+                spin_lock(&mm->unused_lock);
                 if (mm->num_unused < MM_UNUSED_TARGET) {
                         list_add(&cur->fl_entry, &mm->unused_nodes);
                         ++mm->num_unused;
                 } else
                         kfree(cur);
+                spin_unlock(&mm->unused_lock);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index f8ce9a3a420d..26bf0552b3cb 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -267,10 +267,10 @@ static void i915_dump_pages(struct seq_file *m, struct page **pages, int page_co
         uint32_t *mem;
 
         for (page = 0; page < page_count; page++) {
-                mem = kmap(pages[page]);
+                mem = kmap_atomic(pages[page], KM_USER0);
                 for (i = 0; i < PAGE_SIZE; i += 4)
                         seq_printf(m, "%08x :  %08x\n", i, mem[i / 4]);
-                kunmap(pages[page]);
+                kunmap_atomic(pages[page], KM_USER0);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 57204e298975..a725f6591192 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -296,6 +296,7 @@ typedef struct drm_i915_private {
         u32 saveVBLANK_A;
         u32 saveVSYNC_A;
         u32 saveBCLRPAT_A;
+        u32 saveTRANSACONF;
         u32 saveTRANS_HTOTAL_A;
         u32 saveTRANS_HBLANK_A;
         u32 saveTRANS_HSYNC_A;
@@ -326,6 +327,7 @@ typedef struct drm_i915_private {
         u32 saveVBLANK_B;
         u32 saveVSYNC_B;
         u32 saveBCLRPAT_B;
+        u32 saveTRANSBCONF;
         u32 saveTRANS_HTOTAL_B;
         u32 saveTRANS_HBLANK_B;
         u32 saveTRANS_HSYNC_B;
@@ -414,6 +416,16 @@ typedef struct drm_i915_private {
         u32 savePFB_WIN_SZ;
         u32 savePFA_WIN_POS;
         u32 savePFB_WIN_POS;
+        u32 savePCH_DREF_CONTROL;
+        u32 saveDISP_ARB_CTL;
+        u32 savePIPEA_DATA_M1;
+        u32 savePIPEA_DATA_N1;
+        u32 savePIPEA_LINK_M1;
+        u32 savePIPEA_LINK_N1;
+        u32 savePIPEB_DATA_M1;
+        u32 savePIPEB_DATA_N1;
+        u32 savePIPEB_LINK_M1;
+        u32 savePIPEB_LINK_N1;
 
         struct {
                 struct drm_mm gtt_space;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index c3ceffa46ea0..aa7fd82aa6eb 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -254,10 +254,15 @@ irqreturn_t igdng_irq_handler(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         int ret = IRQ_NONE;
-        u32 de_iir, gt_iir;
+        u32 de_iir, gt_iir, de_ier;
         u32 new_de_iir, new_gt_iir;
         struct drm_i915_master_private *master_priv;
 
+        /* disable master interrupt before clearing iir  */
+        de_ier = I915_READ(DEIER);
+        I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL);
+        (void)I915_READ(DEIER);
+
         de_iir = I915_READ(DEIIR);
         gt_iir = I915_READ(GTIIR);
 
@@ -290,6 +295,9 @@ irqreturn_t igdng_irq_handler(struct drm_device *dev)
                 gt_iir = new_gt_iir;
         }
 
+        I915_WRITE(DEIER, de_ier);
+        (void)I915_READ(DEIER);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 992d5617e798..6eec8171a44e 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -239,6 +239,11 @@ static void i915_save_modeset_reg(struct drm_device *dev)
         if (drm_core_check_feature(dev, DRIVER_MODESET))
                 return;
 
+        if (IS_IGDNG(dev)) {
+                dev_priv->savePCH_DREF_CONTROL = I915_READ(PCH_DREF_CONTROL);
+                dev_priv->saveDISP_ARB_CTL = I915_READ(DISP_ARB_CTL);
+        }
+
         /* Pipe & plane A info */
         dev_priv->savePIPEACONF = I915_READ(PIPEACONF);
         dev_priv->savePIPEASRC = I915_READ(PIPEASRC);
@@ -263,6 +268,11 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->saveBCLRPAT_A = I915_READ(BCLRPAT_A);
 
         if (IS_IGDNG(dev)) {
+                dev_priv->savePIPEA_DATA_M1 = I915_READ(PIPEA_DATA_M1);
+                dev_priv->savePIPEA_DATA_N1 = I915_READ(PIPEA_DATA_N1);
+                dev_priv->savePIPEA_LINK_M1 = I915_READ(PIPEA_LINK_M1);
+                dev_priv->savePIPEA_LINK_N1 = I915_READ(PIPEA_LINK_N1);
+
                 dev_priv->saveFDI_TXA_CTL = I915_READ(FDI_TXA_CTL);
                 dev_priv->saveFDI_RXA_CTL = I915_READ(FDI_RXA_CTL);
 
@@ -270,6 +280,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->savePFA_WIN_SZ = I915_READ(PFA_WIN_SZ);
                 dev_priv->savePFA_WIN_POS = I915_READ(PFA_WIN_POS);
 
+                dev_priv->saveTRANSACONF = I915_READ(TRANSACONF);
                 dev_priv->saveTRANS_HTOTAL_A = I915_READ(TRANS_HTOTAL_A);
                 dev_priv->saveTRANS_HBLANK_A = I915_READ(TRANS_HBLANK_A);
                 dev_priv->saveTRANS_HSYNC_A = I915_READ(TRANS_HSYNC_A);
@@ -314,6 +325,11 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->saveBCLRPAT_B = I915_READ(BCLRPAT_B);
 
         if (IS_IGDNG(dev)) {
+                dev_priv->savePIPEB_DATA_M1 = I915_READ(PIPEB_DATA_M1);
+                dev_priv->savePIPEB_DATA_N1 = I915_READ(PIPEB_DATA_N1);
+                dev_priv->savePIPEB_LINK_M1 = I915_READ(PIPEB_LINK_M1);
+                dev_priv->savePIPEB_LINK_N1 = I915_READ(PIPEB_LINK_N1);
+
                 dev_priv->saveFDI_TXB_CTL = I915_READ(FDI_TXB_CTL);
                 dev_priv->saveFDI_RXB_CTL = I915_READ(FDI_RXB_CTL);
 
@@ -321,6 +337,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->savePFB_WIN_SZ = I915_READ(PFB_WIN_SZ);
                 dev_priv->savePFB_WIN_POS = I915_READ(PFB_WIN_POS);
 
+                dev_priv->saveTRANSBCONF = I915_READ(TRANSBCONF);
                 dev_priv->saveTRANS_HTOTAL_B = I915_READ(TRANS_HTOTAL_B);
                 dev_priv->saveTRANS_HBLANK_B = I915_READ(TRANS_HBLANK_B);
                 dev_priv->saveTRANS_HSYNC_B = I915_READ(TRANS_HSYNC_B);
@@ -368,6 +385,11 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 fpb1_reg = FPB1;
         }
 
+        if (IS_IGDNG(dev)) {
+                I915_WRITE(PCH_DREF_CONTROL, dev_priv->savePCH_DREF_CONTROL);
+                I915_WRITE(DISP_ARB_CTL, dev_priv->saveDISP_ARB_CTL);
+        }
+
         /* Pipe & plane A info */
         /* Prime the clock */
         if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
@@ -395,6 +417,11 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(BCLRPAT_A, dev_priv->saveBCLRPAT_A);
 
         if (IS_IGDNG(dev)) {
+                I915_WRITE(PIPEA_DATA_M1, dev_priv->savePIPEA_DATA_M1);
+                I915_WRITE(PIPEA_DATA_N1, dev_priv->savePIPEA_DATA_N1);
+                I915_WRITE(PIPEA_LINK_M1, dev_priv->savePIPEA_LINK_M1);
+                I915_WRITE(PIPEA_LINK_N1, dev_priv->savePIPEA_LINK_N1);
+
                 I915_WRITE(FDI_RXA_CTL, dev_priv->saveFDI_RXA_CTL);
                 I915_WRITE(FDI_TXA_CTL, dev_priv->saveFDI_TXA_CTL);
 
@@ -402,6 +429,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(PFA_WIN_SZ, dev_priv->savePFA_WIN_SZ);
                 I915_WRITE(PFA_WIN_POS, dev_priv->savePFA_WIN_POS);
 
+                I915_WRITE(TRANSACONF, dev_priv->saveTRANSACONF);
                 I915_WRITE(TRANS_HTOTAL_A, dev_priv->saveTRANS_HTOTAL_A);
                 I915_WRITE(TRANS_HBLANK_A, dev_priv->saveTRANS_HBLANK_A);
                 I915_WRITE(TRANS_HSYNC_A, dev_priv->saveTRANS_HSYNC_A);
@@ -439,7 +467,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
         /* Actually enable it */
         I915_WRITE(dpll_b_reg, dev_priv->saveDPLL_B);
         DRM_UDELAY(150);
-        if (IS_I965G(dev))
+        if (IS_I965G(dev) && !IS_IGDNG(dev))
                 I915_WRITE(DPLL_B_MD, dev_priv->saveDPLL_B_MD);
         DRM_UDELAY(150);
 
@@ -454,6 +482,11 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(BCLRPAT_B, dev_priv->saveBCLRPAT_B);
 
         if (IS_IGDNG(dev)) {
+                I915_WRITE(PIPEB_DATA_M1, dev_priv->savePIPEB_DATA_M1);
+                I915_WRITE(PIPEB_DATA_N1, dev_priv->savePIPEB_DATA_N1);
+                I915_WRITE(PIPEB_LINK_M1, dev_priv->savePIPEB_LINK_M1);
+                I915_WRITE(PIPEB_LINK_N1, dev_priv->savePIPEB_LINK_N1);
+
                 I915_WRITE(FDI_RXB_CTL, dev_priv->saveFDI_RXB_CTL);
                 I915_WRITE(FDI_TXB_CTL, dev_priv->saveFDI_TXB_CTL);
 
@@ -461,6 +494,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(PFB_WIN_SZ, dev_priv->savePFB_WIN_SZ);
                 I915_WRITE(PFB_WIN_POS, dev_priv->savePFB_WIN_POS);
 
+                I915_WRITE(TRANSBCONF, dev_priv->saveTRANSBCONF);
                 I915_WRITE(TRANS_HTOTAL_B, dev_priv->saveTRANS_HTOTAL_B);
                 I915_WRITE(TRANS_HBLANK_B, dev_priv->saveTRANS_HBLANK_B);
                 I915_WRITE(TRANS_HSYNC_B, dev_priv->saveTRANS_HSYNC_B);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 212e22740fc1..e5051446c48e 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -262,8 +262,8 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
                 } while (time_after(timeout, jiffies));
         }
 
-        if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) ==
-            CRT_HOTPLUG_MONITOR_COLOR)
+        if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) !=
+            CRT_HOTPLUG_MONITOR_NONE)
                 return true;
 
         return false;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3ba6546b7c7f..099f420de57a 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -863,10 +863,8 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         intel_clock_t clock;
-        int max_n;
-        bool found;
         int err_most = 47;
-        found = false;
+        int err_min = 10000;
 
         /* eDP has only 2 clock choice, no n/m/p setting */
         if (HAS_eDP)
@@ -890,10 +888,9 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
         }
 
         memset(best_clock, 0, sizeof(*best_clock));
-        max_n = limit->n.max;
         for (clock.p1 = limit->p1.max; clock.p1 >= limit->p1.min; clock.p1--) {
                 /* based on hardware requriment prefer smaller n to precision */
-                for (clock.n = limit->n.min; clock.n <= max_n; clock.n++) {
+                for (clock.n = limit->n.min; clock.n <= limit->n.max; clock.n++) {
                         /* based on hardware requirment prefere larger m1,m2 */
                         for (clock.m1 = limit->m1.max;
                              clock.m1 >= limit->m1.min; clock.m1--) {
@@ -907,18 +904,18 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
                                         this_err = abs((10000 - (target*10000/clock.dot)));
                                         if (this_err < err_most) {
                                                 *best_clock = clock;
-                                                err_most = this_err;
-                                                max_n = clock.n;
-                                                found = true;
                                                 /* found on first matching */
                                                 goto out;
+                                        } else if (this_err < err_min) {
+                                                *best_clock = clock;
+                                                err_min = this_err;
                                         }
                                 }
                         }
                 }
         }
 out:
-        return found;
+        return true;
 }
 
 /* DisplayPort has only two frequencies, 162MHz and 270MHz */
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 663ab6de0b58..c33451aec1bd 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -77,14 +77,32 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
         struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
         u32 temp;
 
-        if (mode != DRM_MODE_DPMS_ON) {
-                temp = I915_READ(hdmi_priv->sdvox_reg);
+        temp = I915_READ(hdmi_priv->sdvox_reg);
+
+        /* HW workaround, need to toggle enable bit off and on for 12bpc, but
+         * we do this anyway which shows more stable in testing.
+         */
+        if (IS_IGDNG(dev)) {
                 I915_WRITE(hdmi_priv->sdvox_reg, temp & ~SDVO_ENABLE);
+                POSTING_READ(hdmi_priv->sdvox_reg);
+        }
+
+        if (mode != DRM_MODE_DPMS_ON) {
+                temp &= ~SDVO_ENABLE;
         } else {
-                temp = I915_READ(hdmi_priv->sdvox_reg);
-                I915_WRITE(hdmi_priv->sdvox_reg, temp | SDVO_ENABLE);
+                temp |= SDVO_ENABLE;
         }
+
+        I915_WRITE(hdmi_priv->sdvox_reg, temp);
         POSTING_READ(hdmi_priv->sdvox_reg);
+
+        /* HW workaround, need to write this twice for issue that may result
+         * in first write getting masked.
+         */
+        if (IS_IGDNG(dev)) {
+                I915_WRITE(hdmi_priv->sdvox_reg, temp);
+                POSTING_READ(hdmi_priv->sdvox_reg);
+        }
 }
 
 static void intel_hdmi_save(struct drm_connector *connector)
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 901befe03da2..d67c42555ab9 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -107,6 +107,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                         base += 3;
                         break;
                 case ATOM_IIO_WRITE:
+                        (void)ctx->card->reg_read(ctx->card, CU16(base + 1));
                         ctx->card->reg_write(ctx->card, CU16(base + 1), temp);
                         base += 3;
                         break;
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 757f5cd37744..224506a2f7b1 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -519,6 +519,7 @@ typedef int (*radeon_packet3_check_t)(struct radeon_cs_parser *p,
  * AGP
  */
 int radeon_agp_init(struct radeon_device *rdev);
+void radeon_agp_resume(struct radeon_device *rdev);
 void radeon_agp_fini(struct radeon_device *rdev);
 
 
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index 23ea9955ac59..54bf49a6d676 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -237,6 +237,18 @@ int radeon_agp_init(struct radeon_device *rdev)
 #endif
 }
 
+void radeon_agp_resume(struct radeon_device *rdev)
+{
+#if __OS_HAS_AGP
+        int r;
+        if (rdev->flags & RADEON_IS_AGP) {
+                r = radeon_agp_init(rdev);
+                if (r)
+                        dev_warn(rdev->dev, "radeon AGP reinit failed\n");
+        }
+#endif
+}
+
 void radeon_agp_fini(struct radeon_device *rdev)
 {
 #if __OS_HAS_AGP
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index fce4c4087fda..29763ceae3af 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -566,8 +566,9 @@ static enum drm_connector_status radeon_vga_detect(struct drm_connector *connect
                 radeon_i2c_do_lock(radeon_connector, 0);
 
                 if (!radeon_connector->edid) {
-                        DRM_ERROR("DDC responded but not EDID found for %s\n",
-                                  drm_get_connector_name(connector));
+                        DRM_ERROR("%s: probed a monitor but no|invalid EDID\n",
+                                        drm_get_connector_name(connector));
+                        ret = connector_status_connected;
                 } else {
                         radeon_connector->use_digital = !!(radeon_connector->edid->input & DRM_EDID_INPUT_DIGITAL);
 
@@ -720,8 +721,8 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                 radeon_i2c_do_lock(radeon_connector, 0);
 
                 if (!radeon_connector->edid) {
-                        DRM_ERROR("DDC responded but not EDID found for %s\n",
-                                  drm_get_connector_name(connector));
+                        DRM_ERROR("%s: probed a monitor but no|invalid EDID\n",
+                                        drm_get_connector_name(connector));
                 } else {
                         radeon_connector->use_digital = !!(radeon_connector->edid->input & DRM_EDID_INPUT_DIGITAL);
 
@@ -1149,6 +1150,13 @@ radeon_add_legacy_connector(struct drm_device *dev,
                         if (ret)
                                 goto failed;
                         radeon_connector->dac_load_detect = true;
+                        /* RS400,RC410,RS480 chipset seems to report a lot
+                         * of false positive on load detect, we haven't yet
+                         * found a way to make load detect reliable on those
+                         * chipset, thus just disable it for TV.
+                         */
+                        if (rdev->family == CHIP_RS400 || rdev->family == CHIP_RS480)
+                                radeon_connector->dac_load_detect = false;
                         drm_connector_attach_property(&radeon_connector->base,
                                                       rdev->mode_info.load_detect_property,
                                                       1);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index e3f9edfa40fe..41bb76fbe734 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -688,6 +688,8 @@ int radeon_resume_kms(struct drm_device *dev)
                 return -1;
         }
         pci_set_master(dev->pdev);
+        /* resume AGP if in use */
+        radeon_agp_resume(rdev);
         radeon_resume(rdev);
         radeon_restore_bios_scratch_regs(rdev);
         fb_set_suspend(rdev->fbdev_info, 0);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 7935f793bf62..ba68c9fe90a1 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -137,8 +137,6 @@ int rv515_mc_wait_for_idle(struct radeon_device *rdev)
 
 void rv515_vga_render_disable(struct radeon_device *rdev)
 {
-        WREG32(R_000330_D1VGA_CONTROL, 0);
-        WREG32(R_000338_D2VGA_CONTROL, 0);
         WREG32(R_000300_VGA_RENDER_CONTROL,
                 RREG32(R_000300_VGA_RENDER_CONTROL) & C_000300_VGA_VSTATUS_CNTL);
 }
@@ -382,7 +380,6 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
         save->d2crtc_control = RREG32(R_006880_D2CRTC_CONTROL);
 
         /* Stop all video */
-        WREG32(R_000330_D1VGA_CONTROL, 0);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
         WREG32(R_000300_VGA_RENDER_CONTROL, 0);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 1);
@@ -391,6 +388,8 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
         WREG32(R_006880_D2CRTC_CONTROL, 0);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 0);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
+        WREG32(R_000330_D1VGA_CONTROL, 0);
+        WREG32(R_000338_D2VGA_CONTROL, 0);
 }
 
 void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
@@ -404,14 +403,14 @@ void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
         WREG32(R_000328_VGA_HDP_CONTROL, save->vga_hdp_control);
         mdelay(1);
         /* Restore video state */
+        WREG32(R_000330_D1VGA_CONTROL, save->d1vga_control);
+        WREG32(R_000338_D2VGA_CONTROL, save->d2vga_control);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 1);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 1);
         WREG32(R_006080_D1CRTC_CONTROL, save->d1crtc_control);
         WREG32(R_006880_D2CRTC_CONTROL, save->d2crtc_control);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 0);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
-        WREG32(R_000330_D1VGA_CONTROL, save->d1vga_control);
-        WREG32(R_000338_D2VGA_CONTROL, save->d2vga_control);
         WREG32(R_000300_VGA_RENDER_CONTROL, save->vga_render_control);
 }
 
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 6ff6c20f1e78..fbab6846ae64 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -19,7 +19,9 @@
 #include <linux/completion.h>
 #include <linux/platform_device.h>
 #include <linux/i2c-pnx.h>
+#include <linux/io.h>
 #include <mach/hardware.h>
+#include <mach/i2c.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 
@@ -54,6 +56,9 @@ static inline void i2c_pnx_arm_timer(struct i2c_adapter *adap)
         struct timer_list *timer = &data->mif.timer;
         int expires = I2C_PNX_TIMEOUT / (1000 / HZ);
 
+        if (expires <= 1)
+                expires = 2;
+
         del_timer_sync(timer);
 
         dev_dbg(&adap->dev, "Timer armed at %lu plus %u jiffies.\n",
@@ -645,7 +650,7 @@ static int __devinit i2c_pnx_probe(struct platform_device *pdev)
         return 0;
 
 out_irq:
-        free_irq(alg_data->irq, alg_data);
+        free_irq(alg_data->irq, i2c_pnx->adapter);
 out_clock:
         i2c_pnx->set_clock_stop(pdev);
 out_unmap:
@@ -664,7 +669,7 @@ static int __devexit i2c_pnx_remove(struct platform_device *pdev)
         struct i2c_adapter *adap = i2c_pnx->adapter;
         struct i2c_pnx_algo_data *alg_data = adap->algo_data;
 
-        free_irq(alg_data->irq, alg_data);
+        free_irq(alg_data->irq, i2c_pnx->adapter);
         i2c_del_adapter(adap);
         i2c_pnx->set_clock_stop(pdev);
         iounmap((void *)alg_data->ioaddr);
diff --git a/drivers/i2c/chips/tsl2550.c b/drivers/i2c/chips/tsl2550.c
index aa96bd2d27ea..a0702f36a72f 100644
--- a/drivers/i2c/chips/tsl2550.c
+++ b/drivers/i2c/chips/tsl2550.c
@@ -257,6 +257,7 @@ static DEVICE_ATTR(operating_mode, S_IWUSR | S_IRUGO,
 
 static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
 {
+        struct tsl2550_data *data = i2c_get_clientdata(client);
         u8 ch0, ch1;
         int ret;
 
@@ -274,6 +275,8 @@ static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
         ret = tsl2550_calculate_lux(ch0, ch1);
         if (ret < 0)
                 return ret;
+        if (data->operating_mode == 1)
+                ret *= 5;
 
         return sprintf(buf, "%d\n", ret);
 }
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 8d80fceca6a4..296504355142 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -762,6 +762,7 @@ int i2c_del_adapter(struct i2c_adapter *adap)
 {
         int res = 0;
         struct i2c_adapter *found;
+        struct i2c_client *client, *next;
 
         /* First make sure that this adapter was ever added */
         mutex_lock(&core_lock);
@@ -781,6 +782,16 @@ int i2c_del_adapter(struct i2c_adapter *adap)
         if (res)
                 return res;
 
+        /* Remove devices instantiated from sysfs */
+        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
+                if (client->adapter == adap) {
+                        dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
+                                client->name, client->addr);
+                        list_del(&client->detected);
+                        i2c_unregister_device(client);
+                }
+        }
+
         /* Detach any active clients. This can't fail, thus we do not
            checking the returned value. */
         res = device_for_each_child(&adap->dev, NULL, __unregister_client);
diff --git a/drivers/ide/ide-ioctls.c b/drivers/ide/ide-ioctls.c
index d3440b5010a5..6e7ae2b6cfc6 100644
--- a/drivers/ide/ide-ioctls.c
+++ b/drivers/ide/ide-ioctls.c
@@ -162,7 +162,7 @@ static int ide_cmd_ioctl(ide_drive_t *drive, unsigned long arg)
         if (tf->command == ATA_CMD_SET_FEATURES &&
             tf->feature == SETFEATURES_XFER &&
             tf->nsect >= XFER_SW_DMA_0) {
-                xfer_rate = ide_find_dma_mode(drive, XFER_UDMA_6);
+                xfer_rate = ide_find_dma_mode(drive, tf->nsect);
                 if (xfer_rate != tf->nsect) {
                         err = -EINVAL;
                         goto abort;
diff --git a/drivers/media/common/ir-functions.c b/drivers/media/common/ir-functions.c
index 655474b29e21..abd4791acb0e 100644
--- a/drivers/media/common/ir-functions.c
+++ b/drivers/media/common/ir-functions.c
@@ -64,7 +64,7 @@ void ir_input_init(struct input_dev *dev, struct ir_input_state *ir,
 
         ir->ir_type = ir_type;
 
-        memset(ir->ir_codes, sizeof(ir->ir_codes), 0);
+        memset(ir->ir_codes, 0, sizeof(ir->ir_codes));
 
         /*
          * FIXME: This is a temporary workaround to use the new IR tables
diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
index f65591fb7cec..2a53dd096eef 100644
--- a/drivers/media/dvb/dvb-usb/cxusb.c
+++ b/drivers/media/dvb/dvb-usb/cxusb.c
@@ -663,6 +663,14 @@ static struct zl10353_config cxusb_zl10353_xc3028_config = {
         .parallel_ts = 1,
 };
 
+static struct zl10353_config cxusb_zl10353_xc3028_config_no_i2c_gate = {
+        .demod_address = 0x0f,
+        .if2 = 45600,
+        .no_tuner = 1,
+        .parallel_ts = 1,
+        .disable_i2c_gate_ctrl = 1,
+};
+
 static struct mt352_config cxusb_mt352_xc3028_config = {
         .demod_address = 0x0f,
         .if2 = 4560,
@@ -894,7 +902,7 @@ static int cxusb_dualdig4_frontend_attach(struct dvb_usb_adapter *adap)
         cxusb_bluebird_gpio_pulse(adap->dev, 0x02, 1);
 
         if ((adap->fe = dvb_attach(zl10353_attach,
-                                   &cxusb_zl10353_xc3028_config,
+                                   &cxusb_zl10353_xc3028_config_no_i2c_gate,
                                    &adap->dev->i2c_adap)) == NULL)
                 return -EIO;
 
diff --git a/drivers/media/dvb/siano/Kconfig b/drivers/media/dvb/siano/Kconfig
index 8c1aed77ea30..85a222c4eaa0 100644
--- a/drivers/media/dvb/siano/Kconfig
+++ b/drivers/media/dvb/siano/Kconfig
@@ -4,7 +4,7 @@
 
 config SMS_SIANO_MDTV
         tristate "Siano SMS1xxx based MDTV receiver"
-        depends on DVB_CORE && INPUT
+        depends on DVB_CORE && INPUT && HAS_DMA
         ---help---
           Choose Y or M here if you have MDTV receiver with a Siano chipset.
 
diff --git a/drivers/media/radio/radio-gemtek-pci.c b/drivers/media/radio/radio-gemtek-pci.c
index c3f579de6e71..c6cf11661868 100644
--- a/drivers/media/radio/radio-gemtek-pci.c
+++ b/drivers/media/radio/radio-gemtek-pci.c
@@ -181,12 +181,10 @@ static void gemtek_pci_mute(struct gemtek_pci *card)
 
 static void gemtek_pci_unmute(struct gemtek_pci *card)
 {
-        mutex_lock(&card->lock);
         if (card->mute) {
                 gemtek_pci_setfrequency(card, card->current_frequency);
                 card->mute = false;
         }
-        mutex_unlock(&card->lock);
 }
 
 static int gemtek_pci_getsignal(struct gemtek_pci *card)
diff --git a/drivers/media/video/davinci/vpif_display.c b/drivers/media/video/davinci/vpif_display.c
index c015da813dda..d14cfb200ed0 100644
--- a/drivers/media/video/davinci/vpif_display.c
+++ b/drivers/media/video/davinci/vpif_display.c
@@ -1426,7 +1426,6 @@ static __init int vpif_probe(struct platform_device *pdev)
         struct vpif_display_config *config;
         int i, j = 0, k, q, m, err = 0;
         struct i2c_adapter *i2c_adap;
-        struct vpif_config *config;
         struct common_obj *common;
         struct channel_obj *ch;
         struct video_device *vfd;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index bdb249bd9d5d..c0fd5c6feeac 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -1584,8 +1584,8 @@ struct em28xx_board em28xx_boards[] = {
         [EM2870_BOARD_REDDO_DVB_C_USB_BOX] = {
                 .name          = "Reddo DVB-C USB TV Box",
                 .tuner_type    = TUNER_ABSENT,
+                .tuner_gpio    = reddo_dvb_c_usb_box,
                 .has_dvb       = 1,
-                .dvb_gpio      = reddo_dvb_c_usb_box,
         },
 };
 const unsigned int em28xx_bcount = ARRAY_SIZE(em28xx_boards);
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 5f37952c75cf..72802291e812 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -28,6 +28,7 @@
 #include <linux/moduleparam.h>
 #include <linux/mutex.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 #include <linux/time.h>
 #include <linux/version.h>
 #include <linux/videodev2.h>
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index dff2e5e2d8c6..7db82bdf6f31 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -17,6 +17,7 @@
 #include <linux/clk.h>
 #include <linux/vmalloc.h>
 #include <linux/interrupt.h>
+#include <linux/sched.h>
 
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 2f78b4f263f5..9c8b7c7b89ee 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -31,6 +31,7 @@
 #include <linux/platform_device.h>
 #include <linux/videodev2.h>
 #include <linux/pm_runtime.h>
+#include <linux/sched.h>
 
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
@@ -1723,11 +1724,12 @@ static int __devinit sh_mobile_ceu_probe(struct platform_device *pdev)
 
         err = soc_camera_host_register(&pcdev->ici);
         if (err)
-                goto exit_free_irq;
+                goto exit_free_clk;
 
         return 0;
 
-exit_free_irq:
+exit_free_clk:
+        pm_runtime_disable(&pdev->dev);
         free_irq(pcdev->irq, pcdev);
 exit_release_mem:
         if (platform_get_resource(pdev, IORESOURCE_MEM, 1))
@@ -1747,6 +1749,7 @@ static int __devexit sh_mobile_ceu_remove(struct platform_device *pdev)
                                         struct sh_mobile_ceu_dev, ici);
 
         soc_camera_host_unregister(soc_host);
+        pm_runtime_disable(&pdev->dev);
         free_irq(pcdev->irq, pcdev);
         if (platform_get_resource(pdev, IORESOURCE_MEM, 1))
                 dma_release_declared_memory(&pdev->dev);
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 36e617bd13c7..95fdeb23c2c1 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -1097,6 +1097,13 @@ static int default_s_crop(struct soc_camera_device *icd, struct v4l2_crop *a)
         return v4l2_subdev_call(sd, video, s_crop, a);
 }
 
+static void soc_camera_device_init(struct device *dev, void *pdata)
+{
+        dev->platform_data      = pdata;
+        dev->bus                = &soc_camera_bus_type;
+        dev->release            = dummy_release;
+}
+
 int soc_camera_host_register(struct soc_camera_host *ici)
 {
         struct soc_camera_host *ix;
@@ -1158,6 +1165,7 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
 
         list_for_each_entry(icd, &devices, list) {
                 if (icd->iface == ici->nr) {
+                        void *pdata = icd->dev.platform_data;
                         /* The bus->remove will be called */
                         device_unregister(&icd->dev);
                         /*
@@ -1169,6 +1177,7 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
                          * device private data.
                          */
                         memset(&icd->dev, 0, sizeof(icd->dev));
+                        soc_camera_device_init(&icd->dev, pdata);
                 }
         }
 
@@ -1200,10 +1209,7 @@ static int soc_camera_device_register(struct soc_camera_device *icd)
                  * man, stay reasonable... */
                 return -ENOMEM;
 
-        icd->devnum = num;
-        icd->dev.bus = &soc_camera_bus_type;
-
-        icd->dev.release        = dummy_release;
+        icd->devnum             = num;
         icd->use_count          = 0;
         icd->host_priv          = NULL;
         mutex_init(&icd->video_lock);
@@ -1311,12 +1317,13 @@ static int __devinit soc_camera_pdrv_probe(struct platform_device *pdev)
         icd->iface = icl->bus_id;
         icd->pdev = &pdev->dev;
         platform_set_drvdata(pdev, icd);
-        icd->dev.platform_data = icl;
 
         ret = soc_camera_device_register(icd);
         if (ret < 0)
                 goto escdevreg;
 
+        soc_camera_device_init(&icd->dev, icl);
+
         icd->user_width         = DEFAULT_WIDTH;
         icd->user_height        = DEFAULT_HEIGHT;
 
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 635ffc7b0391..c3065c4bcba9 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -19,6 +19,7 @@
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/dma-mapping.h>
+#include <linux/sched.h>
 #include <media/videobuf-dma-contig.h>
 
 struct videobuf_dma_contig_memory {
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index db39f4a52f53..2cb2736d65aa 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -158,6 +158,7 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         struct i2c_msg msg[2];
         u8 msgbuf[2];
         struct i2c_client *client;
+        unsigned long timeout, read_time;
         int status, i;
 
         memset(msg, 0, sizeof(msg));
@@ -183,47 +184,60 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         if (count > io_limit)
                 count = io_limit;
 
-        /* Smaller eeproms can work given some SMBus extension calls */
         if (at24->use_smbus) {
+                /* Smaller eeproms can work given some SMBus extension calls */
                 if (count > I2C_SMBUS_BLOCK_MAX)
                         count = I2C_SMBUS_BLOCK_MAX;
-                status = i2c_smbus_read_i2c_block_data(client, offset,
-                                count, buf);
-                dev_dbg(&client->dev, "smbus read %zu@%d --> %d\n",
-                                count, offset, status);
-                return (status < 0) ? -EIO : status;
+        } else {
+                /*
+                 * When we have a better choice than SMBus calls, use a
+                 * combined I2C message. Write address; then read up to
+                 * io_limit data bytes. Note that read page rollover helps us
+                 * here (unlike writes). msgbuf is u8 and will cast to our
+                 * needs.
+                 */
+                i = 0;
+                if (at24->chip.flags & AT24_FLAG_ADDR16)
+                        msgbuf[i++] = offset >> 8;
+                msgbuf[i++] = offset;
+
+                msg[0].addr = client->addr;
+                msg[0].buf = msgbuf;
+                msg[0].len = i;
+
+                msg[1].addr = client->addr;
+                msg[1].flags = I2C_M_RD;
+                msg[1].buf = buf;
+                msg[1].len = count;
         }
 
         /*
-         * When we have a better choice than SMBus calls, use a combined
-         * I2C message. Write address; then read up to io_limit data bytes.
-         * Note that read page rollover helps us here (unlike writes).
-         * msgbuf is u8 and will cast to our needs.
+         * Reads fail if the previous write didn't complete yet. We may
+         * loop a few times until this one succeeds, waiting at least
+         * long enough for one entire page write to work.
          */
-        i = 0;
-        if (at24->chip.flags & AT24_FLAG_ADDR16)
-                msgbuf[i++] = offset >> 8;
-        msgbuf[i++] = offset;
-
-        msg[0].addr = client->addr;
-        msg[0].buf = msgbuf;
-        msg[0].len = i;
+        timeout = jiffies + msecs_to_jiffies(write_timeout);
+        do {
+                read_time = jiffies;
+                if (at24->use_smbus) {
+                        status = i2c_smbus_read_i2c_block_data(client, offset,
+                                        count, buf);
+                } else {
+                        status = i2c_transfer(client->adapter, msg, 2);
+                        if (status == 2)
+                                status = count;
+                }
+                dev_dbg(&client->dev, "read %zu@%d --> %d (%ld)\n",
+                                count, offset, status, jiffies);
 
-        msg[1].addr = client->addr;
-        msg[1].flags = I2C_M_RD;
-        msg[1].buf = buf;
-        msg[1].len = count;
+                if (status == count)
+                        return count;
 
-        status = i2c_transfer(client->adapter, msg, 2);
-        dev_dbg(&client->dev, "i2c read %zu@%d --> %d\n",
-                        count, offset, status);
+                /* REVISIT: at HZ=100, this is sloooow */
+                msleep(1);
+        } while (time_before(read_time, timeout));
 
-        if (status == 2)
-                return count;
-        else if (status >= 0)
-                return -EIO;
-        else
-                return status;
+        return -ETIMEDOUT;
 }
 
 static ssize_t at24_read(struct at24_data *at24,
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 2be49c817995..b25467ac895c 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -628,15 +628,6 @@ static int ep93xx_open(struct net_device *dev)
         if (ep93xx_alloc_buffers(ep))
                 return -ENOMEM;
 
-        if (is_zero_ether_addr(dev->dev_addr)) {
-                random_ether_addr(dev->dev_addr);
-                printk(KERN_INFO "%s: generated random MAC address "
-                        "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x.\n", dev->name,
-                        dev->dev_addr[0], dev->dev_addr[1],
-                        dev->dev_addr[2], dev->dev_addr[3],
-                        dev->dev_addr[4], dev->dev_addr[5]);
-        }
-
         napi_enable(&ep->napi);
 
         if (ep93xx_start_hw(dev)) {
@@ -877,6 +868,9 @@ static int ep93xx_eth_probe(struct platform_device *pdev)
         ep->mii.mdio_write = ep93xx_mdio_write;
         ep->mdc_divisor = 40;   /* Max HCLK 100 MHz, min MDIO clk 2.5 MHz.  */
 
+        if (is_zero_ether_addr(dev->dev_addr))
+                random_ether_addr(dev->dev_addr);
+
         err = register_netdev(dev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to register netdev\n");
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index e046943ef29d..2a9132343b66 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -912,9 +912,6 @@ static irqreturn_t b44_interrupt(int irq, void *dev_id)
                         bp->istat = istat;
                         __b44_disable_ints(bp);
                         __napi_schedule(&bp->napi);
-                } else {
-                        printk(KERN_ERR PFX "%s: Error, poll already scheduled\n",
-                               dev->name);
                 }
 
 irq_ack:
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index a81c7b0c41b0..929701ca07d3 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -157,6 +157,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/mii.h>
@@ -602,6 +603,7 @@ struct nic {
         struct mem *mem;
         dma_addr_t dma_addr;
 
+        struct pci_pool *cbs_pool;
         dma_addr_t cbs_dma_addr;
         u8 adaptive_ifs;
         u8 tx_threshold;
@@ -1805,9 +1807,7 @@ static void e100_clean_cbs(struct nic *nic)
                         nic->cb_to_clean = nic->cb_to_clean->next;
                         nic->cbs_avail++;
                 }
-                pci_free_consistent(nic->pdev,
-                        sizeof(struct cb) * nic->params.cbs.count,
-                        nic->cbs, nic->cbs_dma_addr);
+                pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
                 nic->cbs = NULL;
                 nic->cbs_avail = 0;
         }
@@ -1825,8 +1825,8 @@ static int e100_alloc_cbs(struct nic *nic)
         nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL;
         nic->cbs_avail = 0;
 
-        nic->cbs = pci_alloc_consistent(nic->pdev,
-                sizeof(struct cb) * count, &nic->cbs_dma_addr);
+        nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL,
+                                  &nic->cbs_dma_addr);
         if (!nic->cbs)
                 return -ENOMEM;
 
@@ -2852,7 +2852,11 @@ static int __devinit e100_probe(struct pci_dev *pdev,
                 DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n");
                 goto err_out_free;
         }
-
+        nic->cbs_pool = pci_pool_create(netdev->name,
+                           nic->pdev,
+                           nic->params.cbs.count * sizeof(struct cb),
+                           sizeof(u32),
+                           0);
         DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n",
                 (unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
                 pdev->irq, netdev->dev_addr);
@@ -2882,6 +2886,7 @@ static void __devexit e100_remove(struct pci_dev *pdev)
                 unregister_netdev(netdev);
                 e100_free(nic);
                 pci_iounmap(pdev, nic->csr);
+                pci_pool_destroy(nic->cbs_pool);
                 free_netdev(netdev);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 5dba9fa2bc19..f6899c3500b5 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -3235,6 +3235,10 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
         flush_scheduled_work();
 
         unregister_netdev(dev);
+
+        /* restore original MAC address */
+        rtl_rar_set(tp, dev->perm_addr);
+
         rtl_disable_msi(pdev, tp);
         rtl8169_release_board(pdev, dev, tp->mmio_addr);
         pci_set_drvdata(pdev, NULL);
@@ -4880,6 +4884,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
 
         rtl8169_net_suspend(dev);
 
+        /* restore original MAC address */
+        rtl_rar_set(tp, dev->perm_addr);
+
         spin_lock_irq(&tp->lock);
 
         rtl8169_asic_down(ioaddr);
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 2ab90260d4a6..ae4983a5127d 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -2283,7 +2283,7 @@ static int __devinit smc_drv_probe(struct platform_device *pdev)
 
         ndev->irq = ires->start;
 
-        if (ires->flags & IRQF_TRIGGER_MASK)
+        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
                 irq_flags = ires->flags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
diff --git a/drivers/net/smsc9420.c b/drivers/net/smsc9420.c
index 92e2bbe6b49b..12f0f5d74e3c 100644
--- a/drivers/net/smsc9420.c
+++ b/drivers/net/smsc9420.c
@@ -252,6 +252,9 @@ static int smsc9420_ethtool_get_settings(struct net_device *dev,
 {
         struct smsc9420_pdata *pd = netdev_priv(dev);
 
+        if (!pd->phy_dev)
+                return -ENODEV;
+
         cmd->maxtxpkt = 1;
         cmd->maxrxpkt = 1;
         return phy_ethtool_gset(pd->phy_dev, cmd);
@@ -262,6 +265,9 @@ static int smsc9420_ethtool_set_settings(struct net_device *dev,
 {
         struct smsc9420_pdata *pd = netdev_priv(dev);
 
+        if (!pd->phy_dev)
+                return -ENODEV;
+
         return phy_ethtool_sset(pd->phy_dev, cmd);
 }
 
@@ -290,6 +296,10 @@ static void smsc9420_ethtool_set_msglevel(struct net_device *netdev, u32 data)
 static int smsc9420_ethtool_nway_reset(struct net_device *netdev)
 {
         struct smsc9420_pdata *pd = netdev_priv(netdev);
+
+        if (!pd->phy_dev)
+                return -ENODEV;
+
         return phy_start_aneg(pd->phy_dev);
 }
 
@@ -312,6 +322,10 @@ smsc9420_ethtool_getregs(struct net_device *dev, struct ethtool_regs *regs,
         for (i = 0; i < 0x100; i += (sizeof(u32)))
                 data[j++] = smsc9420_reg_read(pd, i);
 
+        // cannot read phy registers if the net device is down
+        if (!phy_dev)
+                return;
+
         for (i = 0; i <= 31; i++)
                 data[j++] = smsc9420_mii_read(phy_dev->bus, phy_dev->addr, i);
 }
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index cd8f04afed8f..b36bf96eb502 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -907,6 +907,7 @@ static ssize_t cosa_write(struct file *file,
                         current->state = TASK_RUNNING;
                         chan->tx_status = 1;
                         spin_unlock_irqrestore(&cosa->lock, flags);
+                        up(&chan->wsem);
                         return -ERESTARTSYS;
                 }
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 888a8e9fe9ef..58b132f9cf28 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1350,8 +1350,16 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
                 return -ENXIO;
         }
 
+        if (priv->stations[sta_id].tid[tid].agg.state ==
+                                IWL_EMPTYING_HW_QUEUE_ADDBA) {
+                IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
+                ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid);
+                priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+                return 0;
+        }
+
         if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
-                IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n");
+                IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
 
         tid_data = &priv->stations[sta_id].tid[tid];
         ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index e5f8fc164fd3..b952ebc7a78b 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -609,6 +609,9 @@ int __init check_zero_address(void)
                                      dmi_get_system_info(DMI_BIOS_VENDOR),
                                      dmi_get_system_info(DMI_BIOS_VERSION),
                                      dmi_get_system_info(DMI_PRODUCT_VERSION));
+#ifdef CONFIG_DMAR
+                                dmar_disabled = 1;
+#endif
                                 return 0;
                         }
                         break;
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
index 0a8f735f6c4a..ab64522aaa64 100644
--- a/drivers/platform/x86/acerhdf.c
+++ b/drivers/platform/x86/acerhdf.c
@@ -52,7 +52,7 @@
  */
 #undef START_IN_KERNEL_MODE
 
-#define DRV_VER "0.5.17"
+#define DRV_VER "0.5.18"
 
 /*
  * According to the Atom N270 datasheet,
@@ -61,7 +61,7 @@
  * measured by the on-die thermal monitor are within 0 <= Tj <= 90. So,
  * assume 89°C is critical temperature.
  */
-#define ACERHDF_TEMP_CRIT 89
+#define ACERHDF_TEMP_CRIT 89000
 #define ACERHDF_FAN_OFF 0
 #define ACERHDF_FAN_AUTO 1
 
@@ -69,7 +69,7 @@
  * No matter what value the user puts into the fanon variable, turn on the fan
  * at 80 degree Celsius to prevent hardware damage
  */
-#define ACERHDF_MAX_FANON 80
+#define ACERHDF_MAX_FANON 80000
 
 /*
  * Maximum interval between two temperature checks is 15 seconds, as the die
@@ -85,8 +85,8 @@ static int kernelmode;
 #endif
 
 static unsigned int interval = 10;
-static unsigned int fanon = 63;
-static unsigned int fanoff = 58;
+static unsigned int fanon = 63000;
+static unsigned int fanoff = 58000;
 static unsigned int verbose;
 static unsigned int fanstate = ACERHDF_FAN_AUTO;
 static char force_bios[16];
@@ -171,7 +171,7 @@ static int acerhdf_get_temp(int *temp)
         if (ec_read(bios_cfg->tempreg, &read_temp))
                 return -EINVAL;
 
-        *temp = read_temp;
+        *temp = read_temp * 1000;
 
         return 0;
 }
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index d93108d148fc..a848c7e20aeb 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -1680,36 +1680,48 @@ static void tpacpi_remove_driver_attributes(struct device_driver *drv)
                           | (__bv1) << 8 | (__bv2) }
 
 #define TPV_Q_X(__v, __bid1, __bid2, __bv1, __bv2,      \
-                __eid1, __eid2, __ev1, __ev2)           \
+                __eid, __ev1, __ev2)                    \
         { .vendor       = (__v),                        \
           .bios         = TPID(__bid1, __bid2),         \
-          .ec           = TPID(__eid1, __eid2),         \
+          .ec           = __eid,                        \
           .quirks       = (__ev1) << 24 | (__ev2) << 16 \
                           | (__bv1) << 8 | (__bv2) }
 
 #define TPV_QI0(__id1, __id2, __bv1, __bv2) \
         TPV_Q(PCI_VENDOR_ID_IBM, __id1, __id2, __bv1, __bv2)
 
+/* Outdated IBM BIOSes often lack the EC id string */
 #define TPV_QI1(__id1, __id2, __bv1, __bv2, __ev1, __ev2) \
         TPV_Q_X(PCI_VENDOR_ID_IBM, __id1, __id2,        \
-                __bv1, __bv2, __id1, __id2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__id1, __id2),       \
+                __ev1, __ev2),                          \
+        TPV_Q_X(PCI_VENDOR_ID_IBM, __id1, __id2,        \
+                __bv1, __bv2, TPACPI_MATCH_UNKNOWN,     \
+                __ev1, __ev2)
 
+/* Outdated IBM BIOSes often lack the EC id string */
 #define TPV_QI2(__bid1, __bid2, __bv1, __bv2,           \
                 __eid1, __eid2, __ev1, __ev2)           \
         TPV_Q_X(PCI_VENDOR_ID_IBM, __bid1, __bid2,      \
-                __bv1, __bv2, __eid1, __eid2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__eid1, __eid2),     \
+                __ev1, __ev2),                          \
+        TPV_Q_X(PCI_VENDOR_ID_IBM, __bid1, __bid2,      \
+                __bv1, __bv2, TPACPI_MATCH_UNKNOWN,     \
+                __ev1, __ev2)
 
 #define TPV_QL0(__id1, __id2, __bv1, __bv2) \
         TPV_Q(PCI_VENDOR_ID_LENOVO, __id1, __id2, __bv1, __bv2)
 
 #define TPV_QL1(__id1, __id2, __bv1, __bv2, __ev1, __ev2) \
         TPV_Q_X(PCI_VENDOR_ID_LENOVO, __id1, __id2,     \
-                __bv1, __bv2, __id1, __id2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__id1, __id2),       \
+                __ev1, __ev2)
 
 #define TPV_QL2(__bid1, __bid2, __bv1, __bv2,           \
                 __eid1, __eid2, __ev1, __ev2)           \
         TPV_Q_X(PCI_VENDOR_ID_LENOVO, __bid1, __bid2,   \
-                __bv1, __bv2, __eid1, __eid2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__eid1, __eid2),     \
+                __ev1, __ev2)
 
 static const struct tpacpi_quirk tpacpi_bios_version_qtable[] __initconst = {
         /*  Numeric models ------------------ */
@@ -6313,7 +6325,7 @@ static int brightness_write(char *buf)
          * Doing it this way makes the syscall restartable in case of EINTR
          */
         rc = brightness_set(level);
-        return (rc == -EINTR)? ERESTARTSYS : rc;
+        return (rc == -EINTR)? -ERESTARTSYS : rc;
 }
 
 static struct ibm_struct brightness_driver_data = {
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 5fd2da494d08..c968cc31cd86 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -164,8 +164,8 @@ void scsi_remove_host(struct Scsi_Host *shost)
                         return;
                 }
         spin_unlock_irqrestore(shost->host_lock, flags);
-        mutex_unlock(&shost->scan_mutex);
         scsi_forget_host(shost);
+        mutex_unlock(&shost->scan_mutex);
         scsi_proc_host_rm(shost);
 
         spin_lock_irqsave(shost->host_lock, flags);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 0547a7f44d42..47291bcff0d5 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -952,16 +952,6 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         return SCSI_SCAN_LUN_PRESENT;
 }
 
-static inline void scsi_destroy_sdev(struct scsi_device *sdev)
-{
-        scsi_device_set_state(sdev, SDEV_DEL);
-        if (sdev->host->hostt->slave_destroy)
-                sdev->host->hostt->slave_destroy(sdev);
-        transport_destroy_device(&sdev->sdev_gendev);
-        put_device(&sdev->sdev_dev);
-        put_device(&sdev->sdev_gendev);
-}
-
 #ifdef CONFIG_SCSI_LOGGING
 /** 
  * scsi_inq_str - print INQUIRY data from min to max index, strip trailing whitespace
@@ -1139,7 +1129,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
                         }
                 }
         } else
-                scsi_destroy_sdev(sdev);
+                __scsi_remove_device(sdev);
  out:
         return res;
 }
@@ -1500,7 +1490,7 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
                 /*
                  * the sdev we used didn't appear in the report luns scan
                  */
-                scsi_destroy_sdev(sdev);
+                __scsi_remove_device(sdev);
         return ret;
 }
 
@@ -1710,7 +1700,7 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
         shost_for_each_device(sdev, shost) {
                 if (!scsi_host_scan_allowed(shost) ||
                     scsi_sysfs_add_sdev(sdev) != 0)
-                        scsi_destroy_sdev(sdev);
+                        __scsi_remove_device(sdev);
         }
 }
 
@@ -1943,7 +1933,7 @@ void scsi_free_host_dev(struct scsi_device *sdev)
 {
         BUG_ON(sdev->id != sdev->host->this_id);
 
-        scsi_destroy_sdev(sdev);
+        __scsi_remove_device(sdev);
 }
 EXPORT_SYMBOL(scsi_free_host_dev);
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 5c7eb63a19d1..392d8db33905 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -854,82 +854,73 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
         transport_configure_device(&starget->dev);
         error = device_add(&sdev->sdev_gendev);
         if (error) {
-                put_device(sdev->sdev_gendev.parent);
                 printk(KERN_INFO "error 1\n");
-                return error;
+                goto out_remove;
         }
         error = device_add(&sdev->sdev_dev);
         if (error) {
                 printk(KERN_INFO "error 2\n");
-                goto clean_device;
+                device_del(&sdev->sdev_gendev);
+                goto out_remove;
         }
+        transport_add_device(&sdev->sdev_gendev);
+        sdev->is_visible = 1;
 
         /* create queue files, which may be writable, depending on the host */
         if (sdev->host->hostt->change_queue_depth)
                 error = device_create_file(&sdev->sdev_gendev, &sdev_attr_queue_depth_rw);
         else
                 error = device_create_file(&sdev->sdev_gendev, &dev_attr_queue_depth);
-        if (error) {
-                __scsi_remove_device(sdev);
-                goto out;
-        }
+        if (error)
+                goto out_remove;
+
         if (sdev->host->hostt->change_queue_type)
                 error = device_create_file(&sdev->sdev_gendev, &sdev_attr_queue_type_rw);
         else
                 error = device_create_file(&sdev->sdev_gendev, &dev_attr_queue_type);
-        if (error) {
-                __scsi_remove_device(sdev);
-                goto out;
-        }
+        if (error)
+                goto out_remove;
 
         error = bsg_register_queue(rq, &sdev->sdev_gendev, NULL, NULL);
 
         if (error)
+                /* we're treating error on bsg register as non-fatal,
+                 * so pretend nothing went wrong */
                 sdev_printk(KERN_INFO, sdev,
                             "Failed to register bsg queue, errno=%d\n", error);
 
-        /* we're treating error on bsg register as non-fatal, so pretend
-         * nothing went wrong */
-        error = 0;
-
         /* add additional host specific attributes */
         if (sdev->host->hostt->sdev_attrs) {
                 for (i = 0; sdev->host->hostt->sdev_attrs[i]; i++) {
                         error = device_create_file(&sdev->sdev_gendev,
                                         sdev->host->hostt->sdev_attrs[i]);
-                        if (error) {
-                                __scsi_remove_device(sdev);
-                                goto out;
-                        }
+                        if (error)
+                                goto out_remove;
                 }
         }
 
-        transport_add_device(&sdev->sdev_gendev);
- out:
-        return error;
-
- clean_device:
-        scsi_device_set_state(sdev, SDEV_CANCEL);
-
-        device_del(&sdev->sdev_gendev);
-        transport_destroy_device(&sdev->sdev_gendev);
-        put_device(&sdev->sdev_dev);
-        put_device(&sdev->sdev_gendev);
+        return 0;
 
+ out_remove:
+        __scsi_remove_device(sdev);
         return error;
+
 }
 
 void __scsi_remove_device(struct scsi_device *sdev)
 {
         struct device *dev = &sdev->sdev_gendev;
 
-        if (scsi_device_set_state(sdev, SDEV_CANCEL) != 0)
-                return;
+        if (sdev->is_visible) {
+                if (scsi_device_set_state(sdev, SDEV_CANCEL) != 0)
+                        return;
 
-        bsg_unregister_queue(sdev->request_queue);
-        device_unregister(&sdev->sdev_dev);
-        transport_remove_device(dev);
-        device_del(dev);
+                bsg_unregister_queue(sdev->request_queue);
+                device_unregister(&sdev->sdev_dev);
+                transport_remove_device(dev);
+                device_del(dev);
+        } else
+                put_device(&sdev->sdev_dev);
         scsi_device_set_state(sdev, SDEV_DEL);
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
index 88da97745710..84be62149c6c 100644
--- a/drivers/scsi/sd_dif.c
+++ b/drivers/scsi/sd_dif.c
@@ -418,7 +418,7 @@ error:
                   __func__, virt, phys, be32_to_cpu(sdt->ref_tag),
                   be16_to_cpu(sdt->app_tag));
 
-        return -EIO;
+        return -EILSEQ;
 }
 
 /*
diff --git a/drivers/serial/bcm63xx_uart.c b/drivers/serial/bcm63xx_uart.c
index beddaa6e9069..37ad0c449937 100644
--- a/drivers/serial/bcm63xx_uart.c
+++ b/drivers/serial/bcm63xx_uart.c
@@ -242,7 +242,7 @@ static void bcm_uart_do_rx(struct uart_port *port)
          * higher than fifo size anyway since we're much faster than
          * serial port */
         max_count = 32;
-        tty = port->info->port.tty;
+        tty = port->state->port.tty;
         do {
                 unsigned int iestat, c, cstat;
                 char flag;
@@ -318,7 +318,7 @@ static void bcm_uart_do_tx(struct uart_port *port)
                 return;
         }
 
-        xmit = &port->info->xmit;
+        xmit = &port->state->xmit;
         if (uart_circ_empty(xmit))
                 goto txq_empty;
 
diff --git a/drivers/serial/of_serial.c b/drivers/serial/of_serial.c
index 02406ba6da1c..cdf172eda2e3 100644
--- a/drivers/serial/of_serial.c
+++ b/drivers/serial/of_serial.c
@@ -161,6 +161,7 @@ static int of_platform_serial_remove(struct of_device *ofdev)
 static struct of_device_id __devinitdata of_platform_serial_table[] = {
         { .type = "serial", .compatible = "ns8250",   .data = (void *)PORT_8250, },
         { .type = "serial", .compatible = "ns16450",  .data = (void *)PORT_16450, },
+        { .type = "serial", .compatible = "ns16550a", .data = (void *)PORT_16550A, },
         { .type = "serial", .compatible = "ns16550",  .data = (void *)PORT_16550, },
         { .type = "serial", .compatible = "ns16750",  .data = (void *)PORT_16750, },
         { .type = "serial", .compatible = "ns16850",  .data = (void *)PORT_16850, },
diff --git a/drivers/serial/suncore.c b/drivers/serial/suncore.c
index a2d4a19550ab..ed7d958b0a01 100644
--- a/drivers/serial/suncore.c
+++ b/drivers/serial/suncore.c
@@ -53,20 +53,21 @@ void sunserial_unregister_minors(struct uart_driver *drv, int count)
 EXPORT_SYMBOL(sunserial_unregister_minors);
 
 int sunserial_console_match(struct console *con, struct device_node *dp,
-                            struct uart_driver *drv, int line)
+                            struct uart_driver *drv, int line, bool ignore_line)
 {
-        int off;
-
         if (!con || of_console_device != dp)
                 return 0;
 
-        off = 0;
-        if (of_console_options &&
-            *of_console_options == 'b')
-                off = 1;
+        if (!ignore_line) {
+                int off = 0;
 
-        if ((line & 1) != off)
-                return 0;
+                if (of_console_options &&
+                    *of_console_options == 'b')
+                        off = 1;
+
+                if ((line & 1) != off)
+                        return 0;
+        }
 
         con->index = line;
         drv->cons = con;
@@ -76,23 +77,24 @@ int sunserial_console_match(struct console *con, struct device_node *dp,
 }
 EXPORT_SYMBOL(sunserial_console_match);
 
-void
-sunserial_console_termios(struct console *con)
+void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
 {
-        struct device_node *dp;
-        const char *od, *mode, *s;
+        const char *mode, *s;
         char mode_prop[] = "ttyX-mode";
         int baud, bits, stop, cflag;
         char parity;
 
-        dp = of_find_node_by_path("/options");
-        od = of_get_property(dp, "output-device", NULL);
-        if (!strcmp(od, "rsc")) {
-                mode = of_get_property(of_console_device,
+        if (!strcmp(uart_dp->name, "rsc") ||
+            !strcmp(uart_dp->name, "rsc-console") ||
+            !strcmp(uart_dp->name, "rsc-control")) {
+                mode = of_get_property(uart_dp,
                                        "ssp-console-modes", NULL);
                 if (!mode)
                         mode = "115200,8,n,1,-";
+        } else if (!strcmp(uart_dp->name, "lom-console")) {
+                mode = "9600,8,n,1,-";
         } else {
+                struct device_node *dp;
                 char c;
 
                 c = 'a';
@@ -101,6 +103,7 @@ sunserial_console_termios(struct console *con)
 
                 mode_prop[3] = c;
 
+                dp = of_find_node_by_path("/options");
                 mode = of_get_property(dp, mode_prop, NULL);
                 if (!mode)
                         mode = "9600,8,n,1,-";
diff --git a/drivers/serial/suncore.h b/drivers/serial/suncore.h
index 042668aa602e..db2057936c31 100644
--- a/drivers/serial/suncore.h
+++ b/drivers/serial/suncore.h
@@ -26,7 +26,8 @@ extern int sunserial_register_minors(struct uart_driver *, int);
 extern void sunserial_unregister_minors(struct uart_driver *, int);
 
 extern int sunserial_console_match(struct console *, struct device_node *,
-                                   struct uart_driver *, int);
-extern void sunserial_console_termios(struct console *);
+                                   struct uart_driver *, int, bool);
+extern void sunserial_console_termios(struct console *,
+                                      struct device_node *);
 
 #endif /* !(_SERIAL_SUN_H) */
diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c
index d548652dee50..d14cca7fb88d 100644
--- a/drivers/serial/sunhv.c
+++ b/drivers/serial/sunhv.c
@@ -566,7 +566,7 @@ static int __devinit hv_probe(struct of_device *op, const struct of_device_id *m
                 goto out_free_con_read_page;
 
         sunserial_console_match(&sunhv_console, op->node,
-                                &sunhv_reg, port->line);
+                                &sunhv_reg, port->line, false);
 
         err = uart_add_one_port(&sunhv_reg, port);
         if (err)
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index d1ad34128635..d514e28d0755 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -883,7 +883,7 @@ static int sunsab_console_setup(struct console *con, char *options)
         printk("Console: ttyS%d (SAB82532)\n",
                (sunsab_reg.minor - 64) + con->index);
 
-        sunserial_console_termios(con);
+        sunserial_console_termios(con, to_of_device(up->port.dev)->node);
 
         switch (con->cflag & CBAUD) {
         case B150: baud = 150; break;
@@ -1027,10 +1027,12 @@ static int __devinit sab_probe(struct of_device *op, const struct of_device_id *
                 goto out1;
 
         sunserial_console_match(SUNSAB_CONSOLE(), op->node,
-                                &sunsab_reg, up[0].port.line);
+                                &sunsab_reg, up[0].port.line,
+                                false);
 
         sunserial_console_match(SUNSAB_CONSOLE(), op->node,
-                                &sunsab_reg, up[1].port.line);
+                                &sunsab_reg, up[1].port.line,
+                                false);
 
         err = uart_add_one_port(&sunsab_reg, &up[0].port);
         if (err)
@@ -1116,7 +1118,6 @@ static int __init sunsab_init(void)
                 if (!sunsab_ports)
                         return -ENOMEM;
 
-                sunsab_reg.cons = SUNSAB_CONSOLE();
                 err = sunserial_register_minors(&sunsab_reg, num_channels);
                 if (err) {
                         kfree(sunsab_ports);
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index 68d262b15749..170d3d68c8f0 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1329,11 +1329,9 @@ static void sunsu_console_write(struct console *co, const char *s,
  */
 static int __init sunsu_console_setup(struct console *co, char *options)
 {
+        static struct ktermios dummy;
+        struct ktermios termios;
         struct uart_port *port;
-        int baud = 9600;
-        int bits = 8;
-        int parity = 'n';
-        int flow = 'n';
 
         printk("Console: ttyS%d (SU)\n",
                (sunsu_reg.minor - 64) + co->index);
@@ -1352,10 +1350,15 @@ static int __init sunsu_console_setup(struct console *co, char *options)
          */
         spin_lock_init(&port->lock);
 
-        if (options)
-                uart_parse_options(options, &baud, &parity, &bits, &flow);
+        /* Get firmware console settings.  */
+        sunserial_console_termios(co, to_of_device(port->dev)->node);
 
-        return uart_set_options(port, co, baud, parity, bits, flow);
+        memset(&termios, 0, sizeof(struct ktermios));
+        termios.c_cflag = co->cflag;
+        port->mctrl |= TIOCM_DTR;
+        port->ops->set_termios(port, &termios, &dummy);
+
+        return 0;
 }
 
 static struct console sunsu_console = {
@@ -1409,6 +1412,7 @@ static int __devinit su_probe(struct of_device *op, const struct of_device_id *m
         struct uart_sunsu_port *up;
         struct resource *rp;
         enum su_type type;
+        bool ignore_line;
         int err;
 
         type = su_get_type(dp);
@@ -1467,8 +1471,14 @@ static int __devinit su_probe(struct of_device *op, const struct of_device_id *m
 
         up->port.ops = &sunsu_pops;
 
+        ignore_line = false;
+        if (!strcmp(dp->name, "rsc-console") ||
+            !strcmp(dp->name, "lom-console"))
+                ignore_line = true;
+
         sunserial_console_match(SUNSU_CONSOLE(), dp,
-                                &sunsu_reg, up->port.line);
+                                &sunsu_reg, up->port.line,
+                                ignore_line);
         err = uart_add_one_port(&sunsu_reg, &up->port);
         if (err)
                 goto out_unmap;
@@ -1517,6 +1527,10 @@ static const struct of_device_id su_match[] = {
                 .name = "serial",
                 .compatible = "su",
         },
+        {
+                .type = "serial",
+                .compatible = "su",
+        },
         {},
 };
 MODULE_DEVICE_TABLE(of, su_match);
@@ -1548,6 +1562,12 @@ static int __init sunsu_init(void)
                                 num_uart++;
                 }
         }
+        for_each_node_by_type(dp, "serial") {
+                if (of_device_is_compatible(dp, "su")) {
+                        if (su_get_type(dp) == SU_PORT_PORT)
+                                num_uart++;
+                }
+        }
 
         if (num_uart) {
                 err = sunserial_register_minors(&sunsu_reg, num_uart);
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index ef693ae22e7f..2c7a66af4f52 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1180,7 +1180,7 @@ static int __init sunzilog_console_setup(struct console *con, char *options)
                (sunzilog_reg.minor - 64) + con->index, con->index);
 
         /* Get firmware console settings.  */
-        sunserial_console_termios(con);
+        sunserial_console_termios(con, to_of_device(up->port.dev)->node);
 
         /* Firmware console speed is limited to 150-->38400 baud so
          * this hackish cflag thing is OK.
@@ -1416,7 +1416,8 @@ static int __devinit zs_probe(struct of_device *op, const struct of_device_id *m
 
         if (!keyboard_mouse) {
                 if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
-                                            &sunzilog_reg, up[0].port.line))
+                                            &sunzilog_reg, up[0].port.line,
+                                            false))
                         up->flags |= SUNZILOG_FLAG_IS_CONS;
                 err = uart_add_one_port(&sunzilog_reg, &up[0].port);
                 if (err) {
@@ -1425,7 +1426,8 @@ static int __devinit zs_probe(struct of_device *op, const struct of_device_id *m
                         return err;
                 }
                 if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
-                                            &sunzilog_reg, up[1].port.line))
+                                            &sunzilog_reg, up[1].port.line,
+                                            false))
                         up->flags |= SUNZILOG_FLAG_IS_CONS;
                 err = uart_add_one_port(&sunzilog_reg, &up[1].port);
                 if (err) {
diff --git a/drivers/staging/go7007/s2250-board.c b/drivers/staging/go7007/s2250-board.c
index 8c85a9c3665a..f4a6541c3e60 100644
--- a/drivers/staging/go7007/s2250-board.c
+++ b/drivers/staging/go7007/s2250-board.c
@@ -261,7 +261,7 @@ static int read_reg_fp(struct i2c_client *client, u16 addr, u16 *val)
 
         memset(buf, 0xcd, 6);
         usb = go->hpi_context;
-        if (down_interruptible(&usb->i2c_lock) != 0) {
+        if (mutex_lock_interruptible(&usb->i2c_lock) != 0) {
                 printk(KERN_INFO "i2c lock failed\n");
                 kfree(buf);
                 return -EINTR;
@@ -270,7 +270,7 @@ static int read_reg_fp(struct i2c_client *client, u16 addr, u16 *val)
                 kfree(buf);
                 return -EFAULT;
         }
-        up(&usb->i2c_lock);
+        mutex_unlock(&usb->i2c_lock);
 
         *val = (buf[0] << 8) | buf[1];
         kfree(buf);
diff --git a/drivers/staging/go7007/s2250-loader.h b/drivers/staging/go7007/s2250-loader.h
new file mode 100644
index 000000000000..b7c301af16cc
--- /dev/null
+++ b/drivers/staging/go7007/s2250-loader.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2005-2006 Micronas USA Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (Version 2) as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+ */
+
+#ifndef _S2250_LOADER_H_
+#define _S2250_LOADER_H_
+
+extern int s2250loader_init(void);
+extern void s2250loader_cleanup(void);
+
+#endif
diff --git a/drivers/staging/hv/BlkVsc.c b/drivers/staging/hv/BlkVsc.c
index 51aa861292fc..a48ee3a12646 100644
--- a/drivers/staging/hv/BlkVsc.c
+++ b/drivers/staging/hv/BlkVsc.c
@@ -16,6 +16,7 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  *
  * Authors:
+ *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  *
  */
diff --git a/drivers/staging/hv/Channel.c b/drivers/staging/hv/Channel.c
index d649ee169d95..746370e82115 100644
--- a/drivers/staging/hv/Channel.c
+++ b/drivers/staging/hv/Channel.c
@@ -611,7 +611,7 @@ void VmbusChannelClose(struct vmbus_channel *Channel)
 
         /* Stop callback and cancel the timer asap */
         Channel->OnChannelCallback = NULL;
-        del_timer(&Channel->poll_timer);
+        del_timer_sync(&Channel->poll_timer);
 
         /* Send a closing message */
         info = kmalloc(sizeof(*info) +
@@ -978,14 +978,10 @@ void VmbusChannelOnChannelEvent(struct vmbus_channel *Channel)
 {
         DumpVmbusChannel(Channel);
         ASSERT(Channel->OnChannelCallback);
-#ifdef ENABLE_POLLING
-        del_timer(&Channel->poll_timer);
-        Channel->OnChannelCallback(Channel->ChannelCallbackContext);
-        channel->poll_timer.expires(jiffies + usecs_to_jiffies(100);
-        add_timer(&channel->poll_timer);
-#else
+
         Channel->OnChannelCallback(Channel->ChannelCallbackContext);
-#endif
+
+        mod_timer(&Channel->poll_timer, jiffies + usecs_to_jiffies(100));
 }
 
 /**
@@ -997,10 +993,6 @@ void VmbusChannelOnTimer(unsigned long data)
 
         if (channel->OnChannelCallback) {
                 channel->OnChannelCallback(channel->ChannelCallbackContext);
-#ifdef ENABLE_POLLING
-                channel->poll_timer.expires(jiffies + usecs_to_jiffies(100);
-                add_timer(&channel->poll_timer);
-#endif
         }
 }
 
diff --git a/drivers/staging/hv/ChannelMgmt.c b/drivers/staging/hv/ChannelMgmt.c
index 3db62caedcff..ef38467ed4e2 100644
--- a/drivers/staging/hv/ChannelMgmt.c
+++ b/drivers/staging/hv/ChannelMgmt.c
@@ -119,7 +119,7 @@ static inline void ReleaseVmbusChannel(void *context)
  */
 void FreeVmbusChannel(struct vmbus_channel *Channel)
 {
-        del_timer(&Channel->poll_timer);
+        del_timer_sync(&Channel->poll_timer);
 
         /*
          * We have to release the channel's workqueue/thread in the vmbus's
diff --git a/drivers/staging/hv/NetVsc.c b/drivers/staging/hv/NetVsc.c
index d384c0ddf069..1c717f9a554e 100644
--- a/drivers/staging/hv/NetVsc.c
+++ b/drivers/staging/hv/NetVsc.c
@@ -15,6 +15,7 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  *
  * Authors:
+ *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
 #include <linux/kernel.h>
diff --git a/drivers/staging/hv/NetVsc.h b/drivers/staging/hv/NetVsc.h
index 3e7112f7c755..6e0e03494126 100644
--- a/drivers/staging/hv/NetVsc.h
+++ b/drivers/staging/hv/NetVsc.h
@@ -16,6 +16,7 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  *
  * Authors:
+ *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  *
  */
diff --git a/drivers/staging/hv/StorVsc.c b/drivers/staging/hv/StorVsc.c
index 14015c927940..2f7c425896f7 100644
--- a/drivers/staging/hv/StorVsc.c
+++ b/drivers/staging/hv/StorVsc.c
@@ -196,7 +196,7 @@ static int StorVscChannelInit(struct hv_device *Device)
          * Now, initiate the vsc/vsp initialization protocol on the open
          * channel
          */
-        memset(request, sizeof(struct storvsc_request_extension), 0);
+        memset(request, 0, sizeof(struct storvsc_request_extension));
         request->WaitEvent = osd_WaitEventCreate();
 
         vstorPacket->Operation = VStorOperationBeginInitialization;
@@ -233,7 +233,7 @@ static int StorVscChannelInit(struct hv_device *Device)
         DPRINT_INFO(STORVSC, "QUERY_PROTOCOL_VERSION_OPERATION...");
 
         /* reuse the packet for version range supported */
-        memset(vstorPacket, sizeof(struct vstor_packet), 0);
+        memset(vstorPacket, 0, sizeof(struct vstor_packet));
         vstorPacket->Operation = VStorOperationQueryProtocolVersion;
         vstorPacket->Flags = REQUEST_COMPLETION_FLAG;
 
@@ -266,7 +266,7 @@ static int StorVscChannelInit(struct hv_device *Device)
         /* Query channel properties */
         DPRINT_INFO(STORVSC, "QUERY_PROPERTIES_OPERATION...");
 
-        memset(vstorPacket, sizeof(struct vstor_packet), 0);
+        memset(vstorPacket, 0, sizeof(struct vstor_packet));
         vstorPacket->Operation = VStorOperationQueryProperties;
         vstorPacket->Flags = REQUEST_COMPLETION_FLAG;
         vstorPacket->StorageChannelProperties.PortNumber =
@@ -305,7 +305,7 @@ static int StorVscChannelInit(struct hv_device *Device)
 
         DPRINT_INFO(STORVSC, "END_INITIALIZATION_OPERATION...");
 
-        memset(vstorPacket, sizeof(struct vstor_packet), 0);
+        memset(vstorPacket, 0, sizeof(struct vstor_packet));
         vstorPacket->Operation = VStorOperationEndInitialization;
         vstorPacket->Flags = REQUEST_COMPLETION_FLAG;
 
@@ -508,7 +508,7 @@ static int StorVscConnectToVsp(struct hv_device *Device)
         int ret;
 
         storDriver = (struct storvsc_driver_object *)Device->Driver;
-        memset(&props, sizeof(struct vmstorage_channel_properties), 0);
+        memset(&props, 0, sizeof(struct vmstorage_channel_properties));
 
         /* Open the channel */
         ret = Device->Driver->VmbusChannelInterface.Open(Device,
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index 99c49261a8b4..62b282844a53 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -15,6 +15,7 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  *
  * Authors:
+ *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
 #include <linux/init.h>
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 3192d50f7251..0d7459e2d036 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -15,6 +15,7 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  *
  * Authors:
+ *   Haiyang Zhang <haiyangz@microsoft.com>
  *   Hank Janssen  <hjanssen@microsoft.com>
  */
 #include <linux/init.h>
diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
index 42230e62a222..31a58e508924 100644
--- a/drivers/staging/octeon/ethernet-mdio.c
+++ b/drivers/staging/octeon/ethernet-mdio.c
@@ -170,7 +170,7 @@ static u32 cvm_oct_get_link(struct net_device *dev)
         return ret;
 }
 
-struct const ethtool_ops cvm_oct_ethtool_ops = {
+const struct ethtool_ops cvm_oct_ethtool_ops = {
         .get_drvinfo = cvm_oct_get_drvinfo,
         .get_settings = cvm_oct_get_settings,
         .set_settings = cvm_oct_set_settings,
diff --git a/drivers/staging/octeon/ethernet-spi.c b/drivers/staging/octeon/ethernet-spi.c
index 66190b0cb68f..00dc0f4bad19 100644
--- a/drivers/staging/octeon/ethernet-spi.c
+++ b/drivers/staging/octeon/ethernet-spi.c
@@ -317,6 +317,6 @@ void cvm_oct_spi_uninit(struct net_device *dev)
                         cvmx_write_csr(CVMX_SPXX_INT_MSK(interface), 0);
                         cvmx_write_csr(CVMX_STXX_INT_MSK(interface), 0);
                 }
-                free_irq(8 + 46, &number_spi_ports);
+                free_irq(OCTEON_IRQ_RML, &number_spi_ports);
         }
 }
diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index b8479517dce2..492c5029992d 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -111,6 +111,16 @@ MODULE_PARM_DESC(disable_core_queueing, "\n"
         "\tallows packets to be sent without lock contention in the packet\n"
         "\tscheduler resulting in some cases in improved throughput.\n");
 
+
+/*
+ * The offset from mac_addr_base that should be used for the next port
+ * that is configured.  By convention, if any mgmt ports exist on the
+ * chip, they get the first mac addresses, The ports controlled by
+ * this driver are numbered sequencially following any mgmt addresses
+ * that may exist.
+ */
+static unsigned int cvm_oct_mac_addr_offset;
+
 /**
  * Periodic timer to check auto negotiation
  */
@@ -474,16 +484,30 @@ static int cvm_oct_common_set_mac_address(struct net_device *dev, void *addr)
  */
 int cvm_oct_common_init(struct net_device *dev)
 {
-        static int count;
-        char mac[8] = { 0x00, 0x00,
-                octeon_bootinfo->mac_addr_base[0],
-                octeon_bootinfo->mac_addr_base[1],
-                octeon_bootinfo->mac_addr_base[2],
-                octeon_bootinfo->mac_addr_base[3],
-                octeon_bootinfo->mac_addr_base[4],
-                octeon_bootinfo->mac_addr_base[5] + count
-        };
         struct octeon_ethernet *priv = netdev_priv(dev);
+        struct sockaddr sa;
+        u64 mac = ((u64)(octeon_bootinfo->mac_addr_base[0] & 0xff) << 40) |
+                ((u64)(octeon_bootinfo->mac_addr_base[1] & 0xff) << 32) |
+                ((u64)(octeon_bootinfo->mac_addr_base[2] & 0xff) << 24) |
+                ((u64)(octeon_bootinfo->mac_addr_base[3] & 0xff) << 16) |
+                ((u64)(octeon_bootinfo->mac_addr_base[4] & 0xff) << 8) |
+                (u64)(octeon_bootinfo->mac_addr_base[5] & 0xff);
+
+        mac += cvm_oct_mac_addr_offset;
+        sa.sa_data[0] = (mac >> 40) & 0xff;
+        sa.sa_data[1] = (mac >> 32) & 0xff;
+        sa.sa_data[2] = (mac >> 24) & 0xff;
+        sa.sa_data[3] = (mac >> 16) & 0xff;
+        sa.sa_data[4] = (mac >> 8) & 0xff;
+        sa.sa_data[5] = mac & 0xff;
+
+        if (cvm_oct_mac_addr_offset >= octeon_bootinfo->mac_addr_count)
+                printk(KERN_DEBUG "%s: Using MAC outside of the assigned range:"
+                        " %02x:%02x:%02x:%02x:%02x:%02x\n", dev->name,
+                        sa.sa_data[0] & 0xff, sa.sa_data[1] & 0xff,
+                        sa.sa_data[2] & 0xff, sa.sa_data[3] & 0xff,
+                        sa.sa_data[4] & 0xff, sa.sa_data[5] & 0xff);
+        cvm_oct_mac_addr_offset++;
 
         /*
          * Force the interface to use the POW send if always_use_pow
@@ -496,14 +520,12 @@ int cvm_oct_common_init(struct net_device *dev)
         if (priv->queue != -1 && USE_HW_TCPUDP_CHECKSUM)
                 dev->features |= NETIF_F_IP_CSUM;
 
-        count++;
-
         /* We do our own locking, Linux doesn't need to */
         dev->features |= NETIF_F_LLTX;
         SET_ETHTOOL_OPS(dev, &cvm_oct_ethtool_ops);
 
         cvm_oct_mdio_setup_device(dev);
-        dev->netdev_ops->ndo_set_mac_address(dev, mac);
+        dev->netdev_ops->ndo_set_mac_address(dev, &sa);
         dev->netdev_ops->ndo_change_mtu(dev, dev->mtu);
 
         /*
@@ -620,6 +642,13 @@ static int __init cvm_oct_init_module(void)
 
         pr_notice("cavium-ethernet %s\n", OCTEON_ETHERNET_VERSION);
 
+        if (OCTEON_IS_MODEL(OCTEON_CN52XX))
+                cvm_oct_mac_addr_offset = 2; /* First two are the mgmt ports. */
+        else if (OCTEON_IS_MODEL(OCTEON_CN56XX))
+                cvm_oct_mac_addr_offset = 1; /* First one is the mgmt port. */
+        else
+                cvm_oct_mac_addr_offset = 0;
+
         cvm_oct_proc_initialize();
         cvm_oct_rx_initialize();
         cvm_oct_configure_common_hw();
diff --git a/drivers/staging/rtl8187se/TODO b/drivers/staging/rtl8187se/TODO
index c09a9160739d..a762e79873e9 100644
--- a/drivers/staging/rtl8187se/TODO
+++ b/drivers/staging/rtl8187se/TODO
@@ -11,5 +11,4 @@ TODO:
 - sparse fixes
 - integrate with drivers/net/wireless/rtl818x
 
-Please send any patches to Greg Kroah-Hartman <greg@kroah.com> and
-Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>.
+Please send any patches to Greg Kroah-Hartman <greg@kroah.com>.
diff --git a/drivers/staging/rtl8192su/TODO b/drivers/staging/rtl8192su/TODO
index b13be9edb278..f11eec700030 100644
--- a/drivers/staging/rtl8192su/TODO
+++ b/drivers/staging/rtl8192su/TODO
@@ -14,5 +14,4 @@ TODO:
 - sparse fixes
 - integrate with drivers/net/wireless/rtl818x
 
-Please send any patches to Greg Kroah-Hartman <greg@kroah.com> and
-Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>.
+Please send any patches to Greg Kroah-Hartman <greg@kroah.com>.
diff --git a/drivers/staging/vt6655/TODO b/drivers/staging/vt6655/TODO
index 8462cd17eb61..cb04aaafc46f 100644
--- a/drivers/staging/vt6655/TODO
+++ b/drivers/staging/vt6655/TODO
@@ -16,6 +16,5 @@ TODO:
 - sparse fixes
 - integrate with drivers/net/wireless
 
-Please send any patches to Greg Kroah-Hartman <greg@kroah.com>,
-Forest Bond <forest@alittletooquiet.net> and Bartlomiej Zolnierkiewicz
-<bzolnier@gmail.com>.
+Please send any patches to Greg Kroah-Hartman <greg@kroah.com>
+and Forest Bond <forest@alittletooquiet.net>.
diff --git a/drivers/staging/vt6656/TODO b/drivers/staging/vt6656/TODO
index 17cf50c6735e..a318995ba07f 100644
--- a/drivers/staging/vt6656/TODO
+++ b/drivers/staging/vt6656/TODO
@@ -15,6 +15,5 @@ TODO:
 - sparse fixes
 - integrate with drivers/net/wireless
 
-Please send any patches to Greg Kroah-Hartman <greg@kroah.com>,
-Forest Bond <forest@alittletooquiet.net> and Bartlomiej Zolnierkiewicz
-<bzolnier@gmail.com>.
+Please send any patches to Greg Kroah-Hartman <greg@kroah.com>
+and Forest Bond <forest@alittletooquiet.net>.
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 5ce839137ad6..0f857e645058 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -444,7 +444,7 @@ resubmit:
 static inline int
 hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
 {
-        return usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
+        return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
                                HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
                                tt, NULL, 0, 1000);
 }
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index d5b65962dd36..731150d4b1d9 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -1213,7 +1213,12 @@ udc_queue(struct usb_ep *usbep, struct usb_request *usbreq, gfp_t gfp)
                                 tmp &= AMD_UNMASK_BIT(ep->num);
                                 writel(tmp, &dev->regs->ep_irqmsk);
                         }
-                }
+                } else if (ep->in) {
+                                /* enable ep irq */
+                                tmp = readl(&dev->regs->ep_irqmsk);
+                                tmp &= AMD_UNMASK_BIT(ep->num);
+                                writel(tmp, &dev->regs->ep_irqmsk);
+                        }
 
         } else if (ep->dma) {
 
@@ -2005,18 +2010,17 @@ __acquires(dev->lock)
 {
         int tmp;
 
-        /* empty queues and init hardware */
-        udc_basic_init(dev);
-        for (tmp = 0; tmp < UDC_EP_NUM; tmp++) {
-                empty_req_queue(&dev->ep[tmp]);
-        }
-
         if (dev->gadget.speed != USB_SPEED_UNKNOWN) {
                 spin_unlock(&dev->lock);
                 driver->disconnect(&dev->gadget);
                 spin_lock(&dev->lock);
         }
-        /* init */
+
+        /* empty queues and init hardware */
+        udc_basic_init(dev);
+        for (tmp = 0; tmp < UDC_EP_NUM; tmp++)
+                empty_req_queue(&dev->ep[tmp]);
+
         udc_setup_endpoints(dev);
 }
 
@@ -2472,6 +2476,13 @@ static irqreturn_t udc_data_in_isr(struct udc *dev, int ep_ix)
                                 }
                         }
 
+                } else if (!use_dma && ep->in) {
+                        /* disable interrupt */
+                        tmp = readl(
+                                &dev->regs->ep_irqmsk);
+                        tmp |= AMD_BIT(ep->num);
+                        writel(tmp,
+                                &dev->regs->ep_irqmsk);
                 }
         }
         /* clear status bits */
@@ -3279,6 +3290,17 @@ static int udc_pci_probe(
                 goto finished;
         }
 
+        spin_lock_init(&dev->lock);
+        /* udc csr registers base */
+        dev->csr = dev->virt_addr + UDC_CSR_ADDR;
+        /* dev registers base */
+        dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR;
+        /* ep registers base */
+        dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR;
+        /* fifo's base */
+        dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR);
+        dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
+
         if (request_irq(pdev->irq, udc_irq, IRQF_SHARED, name, dev) != 0) {
                 dev_dbg(&dev->pdev->dev, "request_irq(%d) fail\n", pdev->irq);
                 kfree(dev);
@@ -3331,7 +3353,6 @@ static int udc_probe(struct udc *dev)
         udc_pollstall_timer.data = 0;
 
         /* device struct setup */
-        spin_lock_init(&dev->lock);
         dev->gadget.ops = &udc_ops;
 
         dev_set_name(&dev->gadget.dev, "gadget");
@@ -3340,16 +3361,6 @@ static int udc_probe(struct udc *dev)
         dev->gadget.name = name;
         dev->gadget.is_dualspeed = 1;
 
-        /* udc csr registers base */
-        dev->csr = dev->virt_addr + UDC_CSR_ADDR;
-        /* dev registers base */
-        dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR;
-        /* ep registers base */
-        dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR;
-        /* fifo's base */
-        dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR);
-        dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
-
         /* init registers, interrupts, ... */
         startup_registers(dev);
 
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 9835e0713943..f5f5601701c9 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -28,6 +28,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/timer.h>
+#include <linux/ktime.h>
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/usb.h>
@@ -676,6 +677,7 @@ static int ehci_run (struct usb_hcd *hcd)
         ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
         msleep(5);
         up_write(&ehci_cf_port_reset_rwsem);
+        ehci->last_periodic_enable = ktime_get_real();
 
         temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase));
         ehci_info (ehci,
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 378861b9d79a..ead5f4f2aa5a 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -111,6 +111,10 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
         switch (pdev->vendor) {
         case PCI_VENDOR_ID_INTEL:
                 ehci->need_io_watchdog = 0;
+                if (pdev->device == 0x27cc) {
+                        ehci->broken_periodic = 1;
+                        ehci_info(ehci, "using broken periodic workaround\n");
+                }
                 break;
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 00ad9ce392ed..139a2cc3f641 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -487,8 +487,20 @@ halt:
                          * we must clear the TT buffer (11.17.5).
                          */
                         if (unlikely(last_status != -EINPROGRESS &&
-                                        last_status != -EREMOTEIO))
-                                ehci_clear_tt_buffer(ehci, qh, urb, token);
+                                        last_status != -EREMOTEIO)) {
+                                /* The TT's in some hubs malfunction when they
+                                 * receive this request following a STALL (they
+                                 * stop sending isochronous packets).  Since a
+                                 * STALL can't leave the TT buffer in a busy
+                                 * state (if you believe Figures 11-48 - 11-51
+                                 * in the USB 2.0 spec), we won't clear the TT
+                                 * buffer in this case.  Strictly speaking this
+                                 * is a violation of the spec.
+                                 */
+                                if (last_status != -EPIPE)
+                                        ehci_clear_tt_buffer(ehci, qh, urb,
+                                                        token);
+                        }
                 }
 
                 /* if we're removing something not at the queue head,
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index b25cdea93a1f..a5535b5e3fe2 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -475,6 +475,8 @@ static int enable_periodic (struct ehci_hcd *ehci)
         /* make sure ehci_work scans these */
         ehci->next_uframe = ehci_readl(ehci, &ehci->regs->frame_index)
                 % (ehci->periodic_size << 3);
+        if (unlikely(ehci->broken_periodic))
+                ehci->last_periodic_enable = ktime_get_real();
         return 0;
 }
 
@@ -486,6 +488,16 @@ static int disable_periodic (struct ehci_hcd *ehci)
         if (--ehci->periodic_sched)
                 return 0;
 
+        if (unlikely(ehci->broken_periodic)) {
+                /* delay experimentally determined */
+                ktime_t safe = ktime_add_us(ehci->last_periodic_enable, 1000);
+                ktime_t now = ktime_get_real();
+                s64 delay = ktime_us_delta(safe, now);
+
+                if (unlikely(delay > 0))
+                        udelay(delay);
+        }
+
         /* did setting PSE not take effect yet?
          * takes effect only at frame boundaries...
          */
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 064e76821ff5..2d85e21ff282 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -118,6 +118,7 @@ struct ehci_hcd {			/* one per controller */
         unsigned                stamp;
         unsigned                random_frame;
         unsigned long           next_statechange;
+        ktime_t                 last_periodic_enable;
         u32                     command;
 
         /* SILICON QUIRKS */
@@ -127,6 +128,7 @@ struct ehci_hcd {			/* one per controller */
         unsigned                big_endian_desc:1;
         unsigned                has_amcc_usb23:1;
         unsigned                need_io_watchdog:1;
+        unsigned                broken_periodic:1;
 
         /* required for usb32 quirk */
         #define OHCI_CTRL_HCFS          (3 << 6)
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index c3577bbbae6c..ef2332a9941d 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -1442,11 +1442,6 @@ static int cppi_channel_abort(struct dma_channel *channel)
                 musb_writew(regs, MUSB_TXCSR, value);
                 musb_writew(regs, MUSB_TXCSR, value);
 
-                /* re-enable interrupt */
-                if (enabled)
-                        musb_writel(tibase, DAVINCI_TXCPPI_INTENAB_REG,
-                                        (1 << cppi_ch->index));
-
                 /* While we scrub the TX state RAM, ensure that we clean
                  * up any interrupt that's currently asserted:
                  * 1. Write to completion Ptr value 0x1(bit 0 set)
@@ -1459,6 +1454,11 @@ static int cppi_channel_abort(struct dma_channel *channel)
                 cppi_reset_tx(tx_ram, 1);
                 musb_writel(&tx_ram->tx_complete, 0, 0);
 
+                /* re-enable interrupt */
+                if (enabled)
+                        musb_writel(tibase, DAVINCI_TXCPPI_INTENAB_REG,
+                                        (1 << cppi_ch->index));
+
                 cppi_dump_tx(5, cppi_ch, " (done teardown)");
 
                 /* REVISIT tx side _should_ clean up the same way
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 3a61ddb62bd2..547e0e390726 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1450,7 +1450,7 @@ static int __init musb_core_init(u16 musb_type, struct musb *musb)
 #endif
 
                 if (hw_ep->max_packet_sz_tx) {
-                        printk(KERN_DEBUG
+                        DBG(1,
                                 "%s: hw_ep %d%s, %smax %d\n",
                                 musb_driver_name, i,
                                 hw_ep->is_shared_fifo ? "shared" : "tx",
@@ -1459,7 +1459,7 @@ static int __init musb_core_init(u16 musb_type, struct musb *musb)
                                 hw_ep->max_packet_sz_tx);
                 }
                 if (hw_ep->max_packet_sz_rx && !hw_ep->is_shared_fifo) {
-                        printk(KERN_DEBUG
+                        DBG(1,
                                 "%s: hw_ep %d%s, %smax %d\n",
                                 musb_driver_name, i,
                                 "rx",
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 8b3c4e2ed7b8..74073f9a43f0 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -4,6 +4,7 @@
  * Copyright 2005 Mentor Graphics Corporation
  * Copyright (C) 2005-2006 by Texas Instruments
  * Copyright (C) 2006-2007 Nokia Corporation
+ * Copyright (C) 2009 MontaVista Software, Inc. <source@mvista.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -436,14 +437,6 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                         csr |= MUSB_TXCSR_P_WZC_BITS;
                         csr &= ~MUSB_TXCSR_P_SENTSTALL;
                         musb_writew(epio, MUSB_TXCSR, csr);
-                        if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
-                                dma->status = MUSB_DMA_STATUS_CORE_ABORT;
-                                musb->dma_controller->channel_abort(dma);
-                        }
-
-                        if (request)
-                                musb_g_giveback(musb_ep, request, -EPIPE);
-
                         break;
                 }
 
@@ -582,15 +575,25 @@ void musb_g_tx(struct musb *musb, u8 epnum)
  */
 static void rxstate(struct musb *musb, struct musb_request *req)
 {
-        u16                     csr = 0;
         const u8                epnum = req->epnum;
         struct usb_request      *request = &req->request;
         struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
         void __iomem            *epio = musb->endpoints[epnum].regs;
         unsigned                fifo_count = 0;
         u16                     len = musb_ep->packet_sz;
+        u16                     csr = musb_readw(epio, MUSB_RXCSR);
 
-        csr = musb_readw(epio, MUSB_RXCSR);
+        /* We shouldn't get here while DMA is active, but we do... */
+        if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
+                DBG(4, "DMA pending...\n");
+                return;
+        }
+
+        if (csr & MUSB_RXCSR_P_SENDSTALL) {
+                DBG(5, "%s stalling, RXCSR %04x\n",
+                    musb_ep->end_point.name, csr);
+                return;
+        }
 
         if (is_cppi_enabled() && musb_ep->dma) {
                 struct dma_controller   *c = musb->dma_controller;
@@ -761,19 +764,10 @@ void musb_g_rx(struct musb *musb, u8 epnum)
                         csr, dma ? " (dma)" : "", request);
 
         if (csr & MUSB_RXCSR_P_SENTSTALL) {
-                if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
-                        dma->status = MUSB_DMA_STATUS_CORE_ABORT;
-                        (void) musb->dma_controller->channel_abort(dma);
-                        request->actual += musb_ep->dma->actual_len;
-                }
-
                 csr |= MUSB_RXCSR_P_WZC_BITS;
                 csr &= ~MUSB_RXCSR_P_SENTSTALL;
                 musb_writew(epio, MUSB_RXCSR, csr);
-
-                if (request)
-                        musb_g_giveback(musb_ep, request, -EPIPE);
-                goto done;
+                return;
         }
 
         if (csr & MUSB_RXCSR_P_OVERRUN) {
@@ -795,7 +789,7 @@ void musb_g_rx(struct musb *musb, u8 epnum)
                 DBG((csr & MUSB_RXCSR_DMAENAB) ? 4 : 1,
                         "%s busy, csr %04x\n",
                         musb_ep->end_point.name, csr);
-                goto done;
+                return;
         }
 
         if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
@@ -826,22 +820,15 @@ void musb_g_rx(struct musb *musb, u8 epnum)
                 if ((request->actual < request->length)
                                 && (musb_ep->dma->actual_len
                                         == musb_ep->packet_sz))
-                        goto done;
+                        return;
 #endif
                 musb_g_giveback(musb_ep, request, 0);
 
                 request = next_request(musb_ep);
                 if (!request)
-                        goto done;
-
-                /* don't start more i/o till the stall clears */
-                musb_ep_select(mbase, epnum);
-                csr = musb_readw(epio, MUSB_RXCSR);
-                if (csr & MUSB_RXCSR_P_SENDSTALL)
-                        goto done;
+                        return;
         }
 
-
         /* analyze request if the ep is hot */
         if (request)
                 rxstate(musb, to_musb_request(request));
@@ -849,8 +836,6 @@ void musb_g_rx(struct musb *musb, u8 epnum)
                 DBG(3, "packet waiting for %s%s request\n",
                                 musb_ep->desc ? "" : "inactive ",
                                 musb_ep->end_point.name);
-
-done:
         return;
 }
 
@@ -1244,7 +1229,7 @@ int musb_gadget_set_halt(struct usb_ep *ep, int value)
         void __iomem            *mbase;
         unsigned long           flags;
         u16                     csr;
-        struct musb_request     *request = NULL;
+        struct musb_request     *request;
         int                     status = 0;
 
         if (!ep)
@@ -1260,24 +1245,29 @@ int musb_gadget_set_halt(struct usb_ep *ep, int value)
 
         musb_ep_select(mbase, epnum);
 
-        /* cannot portably stall with non-empty FIFO */
         request = to_musb_request(next_request(musb_ep));
-        if (value && musb_ep->is_in) {
-                csr = musb_readw(epio, MUSB_TXCSR);
-                if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
-                        DBG(3, "%s fifo busy, cannot halt\n", ep->name);
-                        spin_unlock_irqrestore(&musb->lock, flags);
-                        return -EAGAIN;
+        if (value) {
+                if (request) {
+                        DBG(3, "request in progress, cannot halt %s\n",
+                            ep->name);
+                        status = -EAGAIN;
+                        goto done;
+                }
+                /* Cannot portably stall with non-empty FIFO */
+                if (musb_ep->is_in) {
+                        csr = musb_readw(epio, MUSB_TXCSR);
+                        if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
+                                DBG(3, "FIFO busy, cannot halt %s\n", ep->name);
+                                status = -EAGAIN;
+                                goto done;
+                        }
                 }
-
         }
 
         /* set/clear the stall and toggle bits */
         DBG(2, "%s: %s stall\n", ep->name, value ? "set" : "clear");
         if (musb_ep->is_in) {
                 csr = musb_readw(epio, MUSB_TXCSR);
-                if (csr & MUSB_TXCSR_FIFONOTEMPTY)
-                        csr |= MUSB_TXCSR_FLUSHFIFO;
                 csr |= MUSB_TXCSR_P_WZC_BITS
                         | MUSB_TXCSR_CLRDATATOG;
                 if (value)
@@ -1300,14 +1290,13 @@ int musb_gadget_set_halt(struct usb_ep *ep, int value)
                 musb_writew(epio, MUSB_RXCSR, csr);
         }
 
-done:
-
         /* maybe start the first request in the queue */
         if (!musb_ep->busy && !value && request) {
                 DBG(3, "restarting the request\n");
                 musb_ep_restart(musb, request);
         }
 
+done:
         spin_unlock_irqrestore(&musb->lock, flags);
         return status;
 }
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 7a6778675ad3..522efb31b56b 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -511,7 +511,8 @@ static void ep0_txstate(struct musb *musb)
 
         /* update the flags */
         if (fifo_count < MUSB_MAX_END0_PACKET
-                        || request->actual == request->length) {
+                        || (request->actual == request->length
+                                && !request->zero)) {
                 musb->ep0_state = MUSB_EP0_STAGE_STATUSOUT;
                 csr |= MUSB_CSR0_P_DATAEND;
         } else
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index cf94511485f2..e3ab40a966eb 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1301,8 +1301,11 @@ void musb_host_tx(struct musb *musb, u8 epnum)
                 return;
         } else  if (usb_pipeisoc(pipe) && dma) {
                 if (musb_tx_dma_program(musb->dma_controller, hw_ep, qh, urb,
-                                offset, length))
+                                offset, length)) {
+                        if (is_cppi_enabled() || tusb_dma_omap())
+                                musb_h_tx_dma_start(hw_ep);
                         return;
+                }
         } else  if (tx_csr & MUSB_TXCSR_DMAENAB) {
                 DBG(1, "not complete, but DMA enabled?\n");
                 return;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 9c60d6d4908a..ebcc6d0e2e91 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1937,7 +1937,7 @@ static void ftdi_write_bulk_callback(struct urb *urb)
                 return;
         }
         /* account for transferred data */
-        countback = urb->actual_length;
+        countback = urb->transfer_buffer_length;
         data_offset = priv->write_offset;
         if (data_offset > 0) {
                 /* Subtract the control bytes */
@@ -1950,7 +1950,6 @@ static void ftdi_write_bulk_callback(struct urb *urb)
 
         if (status) {
                 dbg("nonzero write bulk status received: %d", status);
-                return;
         }
 
         usb_serial_port_softint(port);
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 319aaf9725b3..0577e4b61114 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -336,6 +336,10 @@ static int  option_resume(struct usb_serial *serial);
 #define AIRPLUS_VENDOR_ID                       0x1011
 #define AIRPLUS_PRODUCT_MCD650                  0x3198
 
+/* 4G Systems products */
+#define FOUR_G_SYSTEMS_VENDOR_ID                0x1c9e
+#define FOUR_G_SYSTEMS_PRODUCT_W14              0x9603
+
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -599,6 +603,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
         { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
         { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+        { USB_DEVICE(FOUR_G_SYSTEMS_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index f24d04132eda..4d227b152001 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -317,7 +317,7 @@ static int __devexit pnx4008_wdt_remove(struct platform_device *pdev)
 
 static struct platform_driver platform_wdt_driver = {
         .driver = {
-                .name = "watchdog",
+                .name = "pnx4008-watchdog",
                 .owner  = THIS_MODULE,
         },
         .probe = pnx4008_wdt_probe,
@@ -352,4 +352,4 @@ MODULE_PARM_DESC(nowayout,
 
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
-MODULE_ALIAS("platform:watchdog");
+MODULE_ALIAS("platform:pnx4008-watchdog");
diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index 51c94e26a346..e777961939f3 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -343,18 +343,7 @@ int __v9fs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!vcookie->fscache);
 
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vcookie->fscache, page)) {
-                        if (!(gfp & __GFP_WAIT))
-                                return 0;
-                        fscache_wait_on_page_write(vcookie->fscache, page);
-                }
-
-                fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
-        }
-
-        return 1;
+        return fscache_maybe_release_page(vcookie->fscache, page, gfp);
 }
 
 void __v9fs_fscache_invalidate_page(struct page *page)
@@ -368,7 +357,6 @@ void __v9fs_fscache_invalidate_page(struct page *page)
                 fscache_wait_on_page_write(vcookie->fscache, page);
                 BUG_ON(!PageLocked(page));
                 fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
         }
 }
 
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 681c2a7b013f..39b301662f22 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -315,7 +315,6 @@ static void afs_invalidatepage(struct page *page, unsigned long offset)
                         struct afs_vnode *vnode = AFS_FS_I(page->mapping->host);
                         fscache_wait_on_page_write(vnode->cache, page);
                         fscache_uncache_page(vnode->cache, page);
-                        ClearPageFsCache(page);
                 }
 #endif
 
@@ -349,17 +348,9 @@ static int afs_releasepage(struct page *page, gfp_t gfp_flags)
         /* deny if page is being written to the cache and the caller hasn't
          * elected to wait */
 #ifdef CONFIG_AFS_FSCACHE
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vnode->cache, page)) {
-                        if (!(gfp_flags & __GFP_WAIT)) {
-                                _leave(" = F [cache busy]");
-                                return 0;
-                        }
-                        fscache_wait_on_page_write(vnode->cache, page);
-                }
-
-                fscache_uncache_page(vnode->cache, page);
-                ClearPageFsCache(page);
+        if (!fscache_maybe_release_page(vnode->cache, page, gfp_flags)) {
+                _leave(" = F [cache busy]");
+                return 0;
         }
 #endif
 
diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c
index 431accd475a7..27089311fbea 100644
--- a/fs/cachefiles/interface.c
+++ b/fs/cachefiles/interface.c
@@ -114,8 +114,9 @@ nomem_lookup_data:
 
 /*
  * attempt to look up the nominated node in this cache
+ * - return -ETIMEDOUT to be scheduled again
  */
-static void cachefiles_lookup_object(struct fscache_object *_object)
+static int cachefiles_lookup_object(struct fscache_object *_object)
 {
         struct cachefiles_lookup_data *lookup_data;
         struct cachefiles_object *parent, *object;
@@ -145,13 +146,15 @@ static void cachefiles_lookup_object(struct fscache_object *_object)
             object->fscache.cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
                 cachefiles_attr_changed(&object->fscache);
 
-        if (ret < 0) {
-                printk(KERN_WARNING "CacheFiles: Lookup failed error %d\n",
-                       ret);
+        if (ret < 0 && ret != -ETIMEDOUT) {
+                if (ret != -ENOBUFS)
+                        printk(KERN_WARNING
+                               "CacheFiles: Lookup failed error %d\n", ret);
                 fscache_object_lookup_error(&object->fscache);
         }
 
         _leave(" [%d]", ret);
+        return ret;
 }
 
 /*
@@ -331,6 +334,7 @@ static void cachefiles_put_object(struct fscache_object *_object)
                 }
 
                 cache = object->fscache.cache;
+                fscache_object_destroy(&object->fscache);
                 kmem_cache_free(cachefiles_object_jar, object);
                 fscache_object_destroyed(cache);
         }
@@ -403,12 +407,26 @@ static int cachefiles_attr_changed(struct fscache_object *_object)
         if (oi_size == ni_size)
                 return 0;
 
-        newattrs.ia_size = ni_size;
-        newattrs.ia_valid = ATTR_SIZE;
-
         cachefiles_begin_secure(cache, &saved_cred);
         mutex_lock(&object->backer->d_inode->i_mutex);
+
+        /* if there's an extension to a partial page at the end of the backing
+         * file, we need to discard the partial page so that we pick up new
+         * data after it */
+        if (oi_size & ~PAGE_MASK && ni_size > oi_size) {
+                _debug("discard tail %llx", oi_size);
+                newattrs.ia_valid = ATTR_SIZE;
+                newattrs.ia_size = oi_size & PAGE_MASK;
+                ret = notify_change(object->backer, &newattrs);
+                if (ret < 0)
+                        goto truncate_failed;
+        }
+
+        newattrs.ia_valid = ATTR_SIZE;
+        newattrs.ia_size = ni_size;
         ret = notify_change(object->backer, &newattrs);
+
+truncate_failed:
         mutex_unlock(&object->backer->d_inode->i_mutex);
         cachefiles_end_secure(cache, saved_cred);
 
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 4ce818ae39ea..14ac4806e291 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -21,17 +21,81 @@
 #include <linux/security.h>
 #include "internal.h"
 
-static int cachefiles_wait_bit(void *flags)
+#define CACHEFILES_KEYBUF_SIZE 512
+
+/*
+ * dump debugging info about an object
+ */
+static noinline
+void __cachefiles_printk_object(struct cachefiles_object *object,
+                                const char *prefix,
+                                u8 *keybuf)
 {
-        schedule();
-        return 0;
+        struct fscache_cookie *cookie;
+        unsigned keylen, loop;
+
+        printk(KERN_ERR "%sobject: OBJ%x\n",
+               prefix, object->fscache.debug_id);
+        printk(KERN_ERR "%sobjstate=%s fl=%lx swfl=%lx ev=%lx[%lx]\n",
+               prefix, fscache_object_states[object->fscache.state],
+               object->fscache.flags, object->fscache.work.flags,
+               object->fscache.events,
+               object->fscache.event_mask & FSCACHE_OBJECT_EVENTS_MASK);
+        printk(KERN_ERR "%sops=%u inp=%u exc=%u\n",
+               prefix, object->fscache.n_ops, object->fscache.n_in_progress,
+               object->fscache.n_exclusive);
+        printk(KERN_ERR "%sparent=%p\n",
+               prefix, object->fscache.parent);
+
+        spin_lock(&object->fscache.lock);
+        cookie = object->fscache.cookie;
+        if (cookie) {
+                printk(KERN_ERR "%scookie=%p [pr=%p nd=%p fl=%lx]\n",
+                       prefix,
+                       object->fscache.cookie,
+                       object->fscache.cookie->parent,
+                       object->fscache.cookie->netfs_data,
+                       object->fscache.cookie->flags);
+                if (keybuf)
+                        keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
+                                                      CACHEFILES_KEYBUF_SIZE);
+                else
+                        keylen = 0;
+        } else {
+                printk(KERN_ERR "%scookie=NULL\n", prefix);
+                keylen = 0;
+        }
+        spin_unlock(&object->fscache.lock);
+
+        if (keylen) {
+                printk(KERN_ERR "%skey=[%u] '", prefix, keylen);
+                for (loop = 0; loop < keylen; loop++)
+                        printk("%02x", keybuf[loop]);
+                printk("'\n");
+        }
+}
+
+/*
+ * dump debugging info about a pair of objects
+ */
+static noinline void cachefiles_printk_object(struct cachefiles_object *object,
+                                              struct cachefiles_object *xobject)
+{
+        u8 *keybuf;
+
+        keybuf = kmalloc(CACHEFILES_KEYBUF_SIZE, GFP_NOIO);
+        if (object)
+                __cachefiles_printk_object(object, "", keybuf);
+        if (xobject)
+                __cachefiles_printk_object(xobject, "x", keybuf);
+        kfree(keybuf);
 }
 
 /*
  * record the fact that an object is now active
  */
-static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
-                                          struct cachefiles_object *object)
+static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
+                                         struct cachefiles_object *object)
 {
         struct cachefiles_object *xobject;
         struct rb_node **_p, *_parent = NULL;
@@ -42,8 +106,11 @@ static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
 try_again:
         write_lock(&cache->active_lock);
 
-        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags))
+        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
+                printk(KERN_ERR "CacheFiles: Error: Object already active\n");
+                cachefiles_printk_object(object, NULL);
                 BUG();
+        }
 
         dentry = object->dentry;
         _p = &cache->active_nodes.rb_node;
@@ -66,8 +133,8 @@ try_again:
         rb_insert_color(&object->active_node, &cache->active_nodes);
 
         write_unlock(&cache->active_lock);
-        _leave("");
-        return;
+        _leave(" = 0");
+        return 0;
 
         /* an old object from a previous incarnation is hogging the slot - we
          * need to wait for it to be destroyed */
@@ -76,44 +143,70 @@ wait_for_old_object:
                 printk(KERN_ERR "\n");
                 printk(KERN_ERR "CacheFiles: Error:"
                        " Unexpected object collision\n");
-                printk(KERN_ERR "xobject: OBJ%x\n",
-                       xobject->fscache.debug_id);
-                printk(KERN_ERR "xobjstate=%s\n",
-                       fscache_object_states[xobject->fscache.state]);
-                printk(KERN_ERR "xobjflags=%lx\n", xobject->fscache.flags);
-                printk(KERN_ERR "xobjevent=%lx [%lx]\n",
-                       xobject->fscache.events, xobject->fscache.event_mask);
-                printk(KERN_ERR "xops=%u inp=%u exc=%u\n",
-                       xobject->fscache.n_ops, xobject->fscache.n_in_progress,
-                       xobject->fscache.n_exclusive);
-                printk(KERN_ERR "xcookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       xobject->fscache.cookie,
-                       xobject->fscache.cookie->parent,
-                       xobject->fscache.cookie->netfs_data,
-                       xobject->fscache.cookie->flags);
-                printk(KERN_ERR "xparent=%p\n",
-                       xobject->fscache.parent);
-                printk(KERN_ERR "object: OBJ%x\n",
-                       object->fscache.debug_id);
-                printk(KERN_ERR "cookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       object->fscache.cookie,
-                       object->fscache.cookie->parent,
-                       object->fscache.cookie->netfs_data,
-                       object->fscache.cookie->flags);
-                printk(KERN_ERR "parent=%p\n",
-                       object->fscache.parent);
+                cachefiles_printk_object(object, xobject);
                 BUG();
         }
         atomic_inc(&xobject->usage);
         write_unlock(&cache->active_lock);
 
-        _debug(">>> wait");
-        wait_on_bit(&xobject->flags, CACHEFILES_OBJECT_ACTIVE,
-                    cachefiles_wait_bit, TASK_UNINTERRUPTIBLE);
-        _debug("<<< waited");
+        if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                wait_queue_head_t *wq;
+
+                signed long timeout = 60 * HZ;
+                wait_queue_t wait;
+                bool requeue;
+
+                /* if the object we're waiting for is queued for processing,
+                 * then just put ourselves on the queue behind it */
+                if (slow_work_is_queued(&xobject->fscache.work)) {
+                        _debug("queue OBJ%x behind OBJ%x immediately",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                /* otherwise we sleep until either the object we're waiting for
+                 * is done, or the slow-work facility wants the thread back to
+                 * do other work */
+                wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
+                init_wait(&wait);
+                requeue = false;
+                do {
+                        prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
+                        if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
+                                break;
+                        requeue = slow_work_sleep_till_thread_needed(
+                                &object->fscache.work, &timeout);
+                } while (timeout > 0 && !requeue);
+                finish_wait(wq, &wait);
+
+                if (requeue &&
+                    test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                        _debug("queue OBJ%x behind OBJ%x after wait",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                if (timeout <= 0) {
+                        printk(KERN_ERR "\n");
+                        printk(KERN_ERR "CacheFiles: Error: Overlong"
+                               " wait for old active object to go away\n");
+                        cachefiles_printk_object(object, xobject);
+                        goto requeue;
+                }
+        }
+
+        ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
 
         cache->cache.ops->put_object(&xobject->fscache);
         goto try_again;
+
+requeue:
+        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
+        cache->cache.ops->put_object(&xobject->fscache);
+        _leave(" = -ETIMEDOUT");
+        return -ETIMEDOUT;
 }
 
 /*
@@ -254,7 +347,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
 
         dir = dget_parent(object->dentry);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
         ret = cachefiles_bury_object(cache, dir, object->dentry);
 
         dput(dir);
@@ -307,7 +400,7 @@ lookup_again:
         /* search the current directory for the element name */
         _debug("lookup '%s'", name);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
 
         start = jiffies;
         next = lookup_one_len(name, dir, nlen);
@@ -418,12 +511,15 @@ lookup_again:
         }
 
         /* note that we're now using this object */
-        cachefiles_mark_object_active(cache, object);
+        ret = cachefiles_mark_object_active(cache, object);
 
         mutex_unlock(&dir->d_inode->i_mutex);
         dput(dir);
         dir = NULL;
 
+        if (ret == -ETIMEDOUT)
+                goto mark_active_timed_out;
+
         _debug("=== OBTAINED_OBJECT ===");
 
         if (object->new) {
@@ -467,6 +563,10 @@ create_error:
                 cachefiles_io_error(cache, "Create/mkdir failed");
         goto error;
 
+mark_active_timed_out:
+        _debug("mark active timed out");
+        goto release_dentry;
+
 check_error:
         _debug("check error %d", ret);
         write_lock(&cache->active_lock);
@@ -474,7 +574,7 @@ check_error:
         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
         wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
         write_unlock(&cache->active_lock);
-
+release_dentry:
         dput(object->dentry);
         object->dentry = NULL;
         goto error_out;
@@ -495,9 +595,6 @@ error:
 error_out2:
         dput(dir);
 error_out:
-        if (ret == -ENOSPC)
-                ret = -ENOBUFS;
-
         _leave(" = error %d", -ret);
         return ret;
 }
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index a69787e7dd96..a6c8c6fe8df9 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -11,6 +11,7 @@
 
 #include <linux/mount.h>
 #include <linux/file.h>
+#include <linux/ima.h>
 #include "internal.h"
 
 /*
@@ -40,8 +41,10 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 
         _debug("--- monitor %p %lx ---", page, page->flags);
 
-        if (!PageUptodate(page) && !PageError(page))
-                dump_stack();
+        if (!PageUptodate(page) && !PageError(page)) {
+                /* unlocked, not uptodate and not erronous? */
+                _debug("page probably truncated");
+        }
 
         /* remove from the waitqueue */
         list_del(&wait->task_list);
@@ -61,6 +64,84 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 }
 
 /*
+ * handle a probably truncated page
+ * - check to see if the page is still relevant and reissue the read if
+ *   possible
+ * - return -EIO on error, -ENODATA if the page is gone, -EINPROGRESS if we
+ *   must wait again and 0 if successful
+ */
+static int cachefiles_read_reissue(struct cachefiles_object *object,
+                                   struct cachefiles_one_read *monitor)
+{
+        struct address_space *bmapping = object->backer->d_inode->i_mapping;
+        struct page *backpage = monitor->back_page, *backpage2;
+        int ret;
+
+        kenter("{ino=%lx},{%lx,%lx}",
+               object->backer->d_inode->i_ino,
+               backpage->index, backpage->flags);
+
+        /* skip if the page was truncated away completely */
+        if (backpage->mapping != bmapping) {
+                kleave(" = -ENODATA [mapping]");
+                return -ENODATA;
+        }
+
+        backpage2 = find_get_page(bmapping, backpage->index);
+        if (!backpage2) {
+                kleave(" = -ENODATA [gone]");
+                return -ENODATA;
+        }
+
+        if (backpage != backpage2) {
+                put_page(backpage2);
+                kleave(" = -ENODATA [different]");
+                return -ENODATA;
+        }
+
+        /* the page is still there and we already have a ref on it, so we don't
+         * need a second */
+        put_page(backpage2);
+
+        INIT_LIST_HEAD(&monitor->op_link);
+        add_page_wait_queue(backpage, &monitor->monitor);
+
+        if (trylock_page(backpage)) {
+                ret = -EIO;
+                if (PageError(backpage))
+                        goto unlock_discard;
+                ret = 0;
+                if (PageUptodate(backpage))
+                        goto unlock_discard;
+
+                kdebug("reissue read");
+                ret = bmapping->a_ops->readpage(NULL, backpage);
+                if (ret < 0)
+                        goto unlock_discard;
+        }
+
+        /* but the page may have been read before the monitor was installed, so
+         * the monitor may miss the event - so we have to ensure that we do get
+         * one in such a case */
+        if (trylock_page(backpage)) {
+                _debug("jumpstart %p {%lx}", backpage, backpage->flags);
+                unlock_page(backpage);
+        }
+
+        /* it'll reappear on the todo list */
+        kleave(" = -EINPROGRESS");
+        return -EINPROGRESS;
+
+unlock_discard:
+        unlock_page(backpage);
+        spin_lock_irq(&object->work_lock);
+        list_del(&monitor->op_link);
+        spin_unlock_irq(&object->work_lock);
+        kleave(" = %d", ret);
+        return ret;
+}
+
+/*
  * copy data from backing pages to netfs pages to complete a read operation
  * - driven by FS-Cache's thread pool
  */
@@ -92,20 +173,26 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
 
                 _debug("- copy {%lu}", monitor->back_page->index);
 
-                error = -EIO;
+        recheck:
                 if (PageUptodate(monitor->back_page)) {
                         copy_highpage(monitor->netfs_page, monitor->back_page);
 
                         pagevec_add(&pagevec, monitor->netfs_page);
                         fscache_mark_pages_cached(monitor->op, &pagevec);
                         error = 0;
-                }
-
-                if (error)
+                } else if (!PageError(monitor->back_page)) {
+                        /* the page has probably been truncated */
+                        error = cachefiles_read_reissue(object, monitor);
+                        if (error == -EINPROGRESS)
+                                goto next;
+                        goto recheck;
+                } else {
                         cachefiles_io_error_obj(
                                 object,
                                 "Readpage failed on backing file %lx",
                                 (unsigned long) monitor->back_page->flags);
+                        error = -EIO;
+                }
 
                 page_cache_release(monitor->back_page);
 
@@ -114,6 +201,7 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
                 fscache_put_retrieval(op);
                 kfree(monitor);
 
+        next:
                 /* let the thread pool have some air occasionally */
                 max--;
                 if (max < 0 || need_resched()) {
@@ -333,7 +421,8 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op,
 
         shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits;
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         pagevec_init(&pagevec, 0);
@@ -639,7 +728,8 @@ int cachefiles_read_or_alloc_pages(struct fscache_retrieval *op,
 
         pagevec_init(&pagevec, 0);
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         INIT_LIST_HEAD(&backpages);
@@ -801,7 +891,8 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         struct cachefiles_cache *cache;
         mm_segment_t old_fs;
         struct file *file;
-        loff_t pos;
+        loff_t pos, eof;
+        size_t len;
         void *data;
         int ret;
 
@@ -832,18 +923,33 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         if (IS_ERR(file)) {
                 ret = PTR_ERR(file);
         } else {
+                ima_counts_get(file);
                 ret = -EIO;
                 if (file->f_op->write) {
                         pos = (loff_t) page->index << PAGE_SHIFT;
+
+                        /* we mustn't write more data than we have, so we have
+                         * to beware of a partial page at EOF */
+                        eof = object->fscache.store_limit_l;
+                        len = PAGE_SIZE;
+                        if (eof & ~PAGE_MASK) {
+                                ASSERTCMP(pos, <, eof);
+                                if (eof - pos < PAGE_SIZE) {
+                                        _debug("cut short %llx to %llx",
+                                               pos, eof);
+                                        len = eof - pos;
+                                        ASSERTCMP(pos + len, ==, eof);
+                                }
+                        }
+
                         data = kmap(page);
                         old_fs = get_fs();
                         set_fs(KERNEL_DS);
                         ret = file->f_op->write(
-                                file, (const void __user *) data, PAGE_SIZE,
-                                &pos);
+                                file, (const void __user *) data, len, &pos);
                         set_fs(old_fs);
                         kunmap(page);
-                        if (ret != PAGE_SIZE)
+                        if (ret != len)
                                 ret = -EIO;
                 }
                 fput(file);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 145540a316ab..094ea65afc85 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,12 @@
+Version 1.61
+------------
+Fix append problem to Samba servers (files opened with O_APPEND could
+have duplicated data). Fix oops in cifs_lookup. Workaround problem
+mounting to OS/400 Netserve. Fix oops in cifs_get_tcp_session.
+Disable use of server inode numbers when server only
+partially supports them (e.g. for one server querying inode numbers on
+FindFirst fails but QPathInfo queries works).
+
 Version 1.60
 -------------
 Fix memory leak in reconnect.  Fix oops in DFS mount error path.
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 9a5e4f5f3122..29f1da761bbf 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1037,7 +1037,7 @@ init_cifs(void)
         if (rc)
                 goto out_unregister_key_type;
 #endif
-        rc = slow_work_register_user();
+        rc = slow_work_register_user(THIS_MODULE);
         if (rc)
                 goto out_unregister_resolver_key;
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 627a60a6c1b1..1f42f772865a 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -214,8 +214,6 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
                 posix_flags |= SMB_O_EXCL;
         if (oflags & O_TRUNC)
                 posix_flags |= SMB_O_TRUNC;
-        if (oflags & O_APPEND)
-                posix_flags |= SMB_O_APPEND;
         if (oflags & O_SYNC)
                 posix_flags |= SMB_O_SYNC;
         if (oflags & O_DIRECTORY)
@@ -643,9 +641,9 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * O_EXCL: optimize away the lookup, but don't hash the dentry. Let
          * the VFS handle the create.
          */
-        if (nd->flags & LOOKUP_EXCL) {
+        if (nd && (nd->flags & LOOKUP_EXCL)) {
                 d_instantiate(direntry, NULL);
-                return 0;
+                return NULL;
         }
 
         /* can not grab the rename sem here since it would
@@ -675,7 +673,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * reduction in network traffic in the other paths.
          */
         if (pTcon->unix_ext) {
-                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+                if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
                      (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
                      (nd->intent.open.flags & O_CREAT)) {
                         rc = cifs_posix_open(full_path, &newInode, nd->path.mnt,
diff --git a/fs/fscache/Kconfig b/fs/fscache/Kconfig
index 9bbb8ce7bea0..864dac20a242 100644
--- a/fs/fscache/Kconfig
+++ b/fs/fscache/Kconfig
@@ -54,3 +54,10 @@ config FSCACHE_DEBUG
           enabled by setting bits in /sys/modules/fscache/parameter/debug.
 
           See Documentation/filesystems/caching/fscache.txt for more information.
+
+config FSCACHE_OBJECT_LIST
+        bool "Maintain global object list for debugging purposes"
+        depends on FSCACHE && PROC_FS
+        help
+          Maintain a global list of active fscache objects that can be
+          retrieved through /proc/fs/fscache/objects for debugging purposes
diff --git a/fs/fscache/Makefile b/fs/fscache/Makefile
index 91571b95aacc..6d561531cb36 100644
--- a/fs/fscache/Makefile
+++ b/fs/fscache/Makefile
@@ -15,5 +15,6 @@ fscache-y := \
 fscache-$(CONFIG_PROC_FS) += proc.o
 fscache-$(CONFIG_FSCACHE_STATS) += stats.o
 fscache-$(CONFIG_FSCACHE_HISTOGRAM) += histogram.o
+fscache-$(CONFIG_FSCACHE_OBJECT_LIST) += object-list.o
 
 obj-$(CONFIG_FSCACHE) := fscache.o
diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c
index e21985bbb1fb..6a3c48abd677 100644
--- a/fs/fscache/cache.c
+++ b/fs/fscache/cache.c
@@ -263,6 +263,7 @@ int fscache_add_cache(struct fscache_cache *cache,
         spin_lock(&cache->object_list_lock);
         list_add_tail(&ifsdef->cache_link, &cache->object_list);
         spin_unlock(&cache->object_list_lock);
+        fscache_objlist_add(ifsdef);
 
         /* add the cache's netfs definition index object to the top level index
          * cookie as a known backing object */
@@ -380,11 +381,15 @@ void fscache_withdraw_cache(struct fscache_cache *cache)
 
         /* make sure all pages pinned by operations on behalf of the netfs are
          * written to disk */
+        fscache_stat(&fscache_n_cop_sync_cache);
         cache->ops->sync_cache(cache);
+        fscache_stat_d(&fscache_n_cop_sync_cache);
 
         /* dissociate all the netfs pages backed by this cache from the block
          * mappings in the cache */
+        fscache_stat(&fscache_n_cop_dissociate_pages);
         cache->ops->dissociate_pages(cache);
+        fscache_stat_d(&fscache_n_cop_dissociate_pages);
 
         /* we now have to destroy all the active objects pertaining to this
          * cache - which we do by passing them off to thread pool to be
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 72fd18f6c71f..990535071a8a 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -36,6 +36,7 @@ void fscache_cookie_init_once(void *_cookie)
 
         memset(cookie, 0, sizeof(*cookie));
         spin_lock_init(&cookie->lock);
+        spin_lock_init(&cookie->stores_lock);
         INIT_HLIST_HEAD(&cookie->backing_objects);
 }
 
@@ -102,7 +103,9 @@ struct fscache_cookie *__fscache_acquire_cookie(
         cookie->netfs_data      = netfs_data;
         cookie->flags           = 0;
 
-        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS);
+        /* radix tree insertion won't use the preallocation pool unless it's
+         * told it may not wait */
+        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS & ~__GFP_WAIT);
 
         switch (cookie->def->type) {
         case FSCACHE_COOKIE_TYPE_INDEX:
@@ -249,7 +252,9 @@ static int fscache_alloc_object(struct fscache_cache *cache,
 
         /* ask the cache to allocate an object (we may end up with duplicate
          * objects at this stage, but we sort that out later) */
+        fscache_stat(&fscache_n_cop_alloc_object);
         object = cache->ops->alloc_object(cache, cookie);
+        fscache_stat_d(&fscache_n_cop_alloc_object);
         if (IS_ERR(object)) {
                 fscache_stat(&fscache_n_object_no_alloc);
                 ret = PTR_ERR(object);
@@ -270,8 +275,11 @@ static int fscache_alloc_object(struct fscache_cache *cache,
         /* only attach if we managed to allocate all we needed, otherwise
          * discard the object we just allocated and instead use the one
          * attached to the cookie */
-        if (fscache_attach_object(cookie, object) < 0)
+        if (fscache_attach_object(cookie, object) < 0) {
+                fscache_stat(&fscache_n_cop_put_object);
                 cache->ops->put_object(object);
+                fscache_stat_d(&fscache_n_cop_put_object);
+        }
 
         _leave(" = 0");
         return 0;
@@ -287,7 +295,9 @@ object_already_extant:
         return 0;
 
 error_put:
+        fscache_stat(&fscache_n_cop_put_object);
         cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 error:
         _leave(" = %d", ret);
         return ret;
@@ -349,6 +359,8 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
         object->cookie = cookie;
         atomic_inc(&cookie->usage);
         hlist_add_head(&object->cookie_link, &cookie->backing_objects);
+
+        fscache_objlist_add(object);
         ret = 0;
 
 cant_attach_object:
@@ -403,6 +415,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
         unsigned long event;
 
         fscache_stat(&fscache_n_relinquishes);
+        if (retire)
+                fscache_stat(&fscache_n_relinquishes_retire);
 
         if (!cookie) {
                 fscache_stat(&fscache_n_relinquishes_null);
@@ -428,12 +442,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
 
         event = retire ? FSCACHE_OBJECT_EV_RETIRE : FSCACHE_OBJECT_EV_RELEASE;
 
-        /* detach pointers back to the netfs */
         spin_lock(&cookie->lock);
 
-        cookie->netfs_data      = NULL;
-        cookie->def             = NULL;
-
         /* break links with all the active objects */
         while (!hlist_empty(&cookie->backing_objects)) {
                 object = hlist_entry(cookie->backing_objects.first,
@@ -456,6 +466,10 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
                         BUG();
         }
 
+        /* detach pointers back to the netfs */
+        cookie->netfs_data      = NULL;
+        cookie->def             = NULL;
+
         spin_unlock(&cookie->lock);
 
         if (cookie->parent) {
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index 1c341304621f..edd7434ab6e5 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -17,6 +17,7 @@
  * - cache->object_list_lock
  * - object->lock
  * - object->parent->lock
+ * - cookie->stores_lock
  * - fscache_thread_lock
  *
  */
@@ -88,17 +89,31 @@ extern int fscache_wait_bit_interruptible(void *);
 /*
  * object.c
  */
+extern const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5];
+
 extern void fscache_withdrawing_object(struct fscache_cache *,
                                        struct fscache_object *);
 extern void fscache_enqueue_object(struct fscache_object *);
 
 /*
+ * object-list.c
+ */
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+extern const struct file_operations fscache_objlist_fops;
+
+extern void fscache_objlist_add(struct fscache_object *);
+#else
+#define fscache_objlist_add(object) do {} while(0)
+#endif
+
+/*
  * operation.c
  */
 extern int fscache_submit_exclusive_op(struct fscache_object *,
                                        struct fscache_operation *);
 extern int fscache_submit_op(struct fscache_object *,
                              struct fscache_operation *);
+extern int fscache_cancel_op(struct fscache_operation *);
 extern void fscache_abort_object(struct fscache_object *);
 extern void fscache_start_operations(struct fscache_object *);
 extern void fscache_operation_gc(struct work_struct *);
@@ -127,6 +142,8 @@ extern atomic_t fscache_n_op_enqueue;
 extern atomic_t fscache_n_op_deferred_release;
 extern atomic_t fscache_n_op_release;
 extern atomic_t fscache_n_op_gc;
+extern atomic_t fscache_n_op_cancelled;
+extern atomic_t fscache_n_op_rejected;
 
 extern atomic_t fscache_n_attr_changed;
 extern atomic_t fscache_n_attr_changed_ok;
@@ -138,6 +155,8 @@ extern atomic_t fscache_n_allocs;
 extern atomic_t fscache_n_allocs_ok;
 extern atomic_t fscache_n_allocs_wait;
 extern atomic_t fscache_n_allocs_nobufs;
+extern atomic_t fscache_n_allocs_intr;
+extern atomic_t fscache_n_allocs_object_dead;
 extern atomic_t fscache_n_alloc_ops;
 extern atomic_t fscache_n_alloc_op_waits;
 
@@ -148,6 +167,7 @@ extern atomic_t fscache_n_retrievals_nodata;
 extern atomic_t fscache_n_retrievals_nobufs;
 extern atomic_t fscache_n_retrievals_intr;
 extern atomic_t fscache_n_retrievals_nomem;
+extern atomic_t fscache_n_retrievals_object_dead;
 extern atomic_t fscache_n_retrieval_ops;
 extern atomic_t fscache_n_retrieval_op_waits;
 
@@ -158,6 +178,14 @@ extern atomic_t fscache_n_stores_nobufs;
 extern atomic_t fscache_n_stores_oom;
 extern atomic_t fscache_n_store_ops;
 extern atomic_t fscache_n_store_calls;
+extern atomic_t fscache_n_store_pages;
+extern atomic_t fscache_n_store_radix_deletes;
+extern atomic_t fscache_n_store_pages_over_limit;
+
+extern atomic_t fscache_n_store_vmscan_not_storing;
+extern atomic_t fscache_n_store_vmscan_gone;
+extern atomic_t fscache_n_store_vmscan_busy;
+extern atomic_t fscache_n_store_vmscan_cancelled;
 
 extern atomic_t fscache_n_marks;
 extern atomic_t fscache_n_uncaches;
@@ -176,6 +204,7 @@ extern atomic_t fscache_n_updates_run;
 extern atomic_t fscache_n_relinquishes;
 extern atomic_t fscache_n_relinquishes_null;
 extern atomic_t fscache_n_relinquishes_waitcrt;
+extern atomic_t fscache_n_relinquishes_retire;
 
 extern atomic_t fscache_n_cookie_index;
 extern atomic_t fscache_n_cookie_data;
@@ -186,6 +215,7 @@ extern atomic_t fscache_n_object_no_alloc;
 extern atomic_t fscache_n_object_lookups;
 extern atomic_t fscache_n_object_lookups_negative;
 extern atomic_t fscache_n_object_lookups_positive;
+extern atomic_t fscache_n_object_lookups_timed_out;
 extern atomic_t fscache_n_object_created;
 extern atomic_t fscache_n_object_avail;
 extern atomic_t fscache_n_object_dead;
@@ -195,15 +225,41 @@ extern atomic_t fscache_n_checkaux_okay;
 extern atomic_t fscache_n_checkaux_update;
 extern atomic_t fscache_n_checkaux_obsolete;
 
+extern atomic_t fscache_n_cop_alloc_object;
+extern atomic_t fscache_n_cop_lookup_object;
+extern atomic_t fscache_n_cop_lookup_complete;
+extern atomic_t fscache_n_cop_grab_object;
+extern atomic_t fscache_n_cop_update_object;
+extern atomic_t fscache_n_cop_drop_object;
+extern atomic_t fscache_n_cop_put_object;
+extern atomic_t fscache_n_cop_sync_cache;
+extern atomic_t fscache_n_cop_attr_changed;
+extern atomic_t fscache_n_cop_read_or_alloc_page;
+extern atomic_t fscache_n_cop_read_or_alloc_pages;
+extern atomic_t fscache_n_cop_allocate_page;
+extern atomic_t fscache_n_cop_allocate_pages;
+extern atomic_t fscache_n_cop_write_page;
+extern atomic_t fscache_n_cop_uncache_page;
+extern atomic_t fscache_n_cop_dissociate_pages;
+
 static inline void fscache_stat(atomic_t *stat)
 {
         atomic_inc(stat);
 }
 
+static inline void fscache_stat_d(atomic_t *stat)
+{
+        atomic_dec(stat);
+}
+
+#define __fscache_stat(stat) (stat)
+
 extern const struct file_operations fscache_stats_fops;
 #else
 
+#define __fscache_stat(stat) (NULL)
 #define fscache_stat(stat) do {} while (0)
+#define fscache_stat_d(stat) do {} while (0)
 #endif
 
 /*
diff --git a/fs/fscache/main.c b/fs/fscache/main.c
index 4de41b597499..add6bdb53f04 100644
--- a/fs/fscache/main.c
+++ b/fs/fscache/main.c
@@ -48,7 +48,7 @@ static int __init fscache_init(void)
 {
         int ret;
 
-        ret = slow_work_register_user();
+        ret = slow_work_register_user(THIS_MODULE);
         if (ret < 0)
                 goto error_slow_work;
 
@@ -80,7 +80,7 @@ error_kobj:
 error_cookie_jar:
         fscache_proc_cleanup();
 error_proc:
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 error_slow_work:
         return ret;
 }
@@ -97,7 +97,7 @@ static void __exit fscache_exit(void)
         kobject_put(fscache_root);
         kmem_cache_destroy(fscache_cookie_jar);
         fscache_proc_cleanup();
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
         printk(KERN_NOTICE "FS-Cache: Unloaded\n");
 }
 
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
new file mode 100644
index 000000000000..e590242fa41a
--- /dev/null
+++ b/fs/fscache/object-list.c
@@ -0,0 +1,432 @@
+/* Global fscache object list maintainer and viewer
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define FSCACHE_DEBUG_LEVEL COOKIE
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/key.h>
+#include <keys/user-type.h>
+#include "internal.h"
+
+static struct rb_root fscache_object_list;
+static DEFINE_RWLOCK(fscache_object_list_lock);
+
+struct fscache_objlist_data {
+        unsigned long   config;         /* display configuration */
+#define FSCACHE_OBJLIST_CONFIG_KEY      0x00000001      /* show object keys */
+#define FSCACHE_OBJLIST_CONFIG_AUX      0x00000002      /* show object auxdata */
+#define FSCACHE_OBJLIST_CONFIG_COOKIE   0x00000004      /* show objects with cookies */
+#define FSCACHE_OBJLIST_CONFIG_NOCOOKIE 0x00000008      /* show objects without cookies */
+#define FSCACHE_OBJLIST_CONFIG_BUSY     0x00000010      /* show busy objects */
+#define FSCACHE_OBJLIST_CONFIG_IDLE     0x00000020      /* show idle objects */
+#define FSCACHE_OBJLIST_CONFIG_PENDWR   0x00000040      /* show objects with pending writes */
+#define FSCACHE_OBJLIST_CONFIG_NOPENDWR 0x00000080      /* show objects without pending writes */
+#define FSCACHE_OBJLIST_CONFIG_READS    0x00000100      /* show objects with active reads */
+#define FSCACHE_OBJLIST_CONFIG_NOREADS  0x00000200      /* show objects without active reads */
+#define FSCACHE_OBJLIST_CONFIG_EVENTS   0x00000400      /* show objects with events */
+#define FSCACHE_OBJLIST_CONFIG_NOEVENTS 0x00000800      /* show objects without no events */
+#define FSCACHE_OBJLIST_CONFIG_WORK     0x00001000      /* show objects with slow work */
+#define FSCACHE_OBJLIST_CONFIG_NOWORK   0x00002000      /* show objects without slow work */
+
+        u8              buf[512];       /* key and aux data buffer */
+};
+
+/*
+ * Add an object to the object list
+ * - we use the address of the fscache_object structure as the key into the
+ *   tree
+ */
+void fscache_objlist_add(struct fscache_object *obj)
+{
+        struct fscache_object *xobj;
+        struct rb_node **p = &fscache_object_list.rb_node, *parent = NULL;
+
+        write_lock(&fscache_object_list_lock);
+
+        while (*p) {
+                parent = *p;
+                xobj = rb_entry(parent, struct fscache_object, objlist_link);
+
+                if (obj < xobj)
+                        p = &(*p)->rb_left;
+                else if (obj > xobj)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&obj->objlist_link, parent, p);
+        rb_insert_color(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+
+/**
+ * fscache_object_destroy - Note that a cache object is about to be destroyed
+ * @object: The object to be destroyed
+ *
+ * Note the imminent destruction and deallocation of a cache object record.
+ */
+void fscache_object_destroy(struct fscache_object *obj)
+{
+        write_lock(&fscache_object_list_lock);
+
+        BUG_ON(RB_EMPTY_ROOT(&fscache_object_list));
+        rb_erase(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+EXPORT_SYMBOL(fscache_object_destroy);
+
+/*
+ * find the object in the tree on or after the specified index
+ */
+static struct fscache_object *fscache_objlist_lookup(loff_t *_pos)
+{
+        struct fscache_object *pobj, *obj, *minobj = NULL;
+        struct rb_node *p;
+        unsigned long pos;
+
+        if (*_pos >= (unsigned long) ERR_PTR(-ENOENT))
+                return NULL;
+        pos = *_pos;
+
+        /* banners (can't represent line 0 by pos 0 as that would involve
+         * returning a NULL pointer) */
+        if (pos == 0)
+                return (struct fscache_object *) ++(*_pos);
+        if (pos < 3)
+                return (struct fscache_object *)pos;
+
+        pobj = (struct fscache_object *)pos;
+        p = fscache_object_list.rb_node;
+        while (p) {
+                obj = rb_entry(p, struct fscache_object, objlist_link);
+                if (pobj < obj) {
+                        if (!minobj || minobj > obj)
+                                minobj = obj;
+                        p = p->rb_left;
+                } else if (pobj > obj) {
+                        p = p->rb_right;
+                } else {
+                        minobj = obj;
+                        break;
+                }
+                obj = NULL;
+        }
+
+        if (!minobj)
+                *_pos = (unsigned long) ERR_PTR(-ENOENT);
+        else if (minobj != obj)
+                *_pos = (unsigned long) minobj;
+        return minobj;
+}
+
+/*
+ * set up the iterator to start reading from the first line
+ */
+static void *fscache_objlist_start(struct seq_file *m, loff_t *_pos)
+        __acquires(&fscache_object_list_lock)
+{
+        read_lock(&fscache_object_list_lock);
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * move to the next line
+ */
+static void *fscache_objlist_next(struct seq_file *m, void *v, loff_t *_pos)
+{
+        (*_pos)++;
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * clean up after reading
+ */
+static void fscache_objlist_stop(struct seq_file *m, void *v)
+        __releases(&fscache_object_list_lock)
+{
+        read_unlock(&fscache_object_list_lock);
+}
+
+/*
+ * display an object
+ */
+static int fscache_objlist_show(struct seq_file *m, void *v)
+{
+        struct fscache_objlist_data *data = m->private;
+        struct fscache_object *obj = v;
+        unsigned long config = data->config;
+        uint16_t keylen, auxlen;
+        char _type[3], *type;
+        bool no_cookie;
+        u8 *buf = data->buf, *p;
+
+        if ((unsigned long) v == 1) {
+                seq_puts(m, "OBJECT   PARENT   STAT CHLDN OPS OOP IPR EX READS"
+                         " EM EV F S"
+                         " | NETFS_COOKIE_DEF TY FL NETFS_DATA");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, "       ");
+                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                        seq_puts(m, "OBJECT_KEY");
+                if ((config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                               FSCACHE_OBJLIST_CONFIG_AUX)) ==
+                    (FSCACHE_OBJLIST_CONFIG_KEY | FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, ", ");
+                if (config & FSCACHE_OBJLIST_CONFIG_AUX)
+                        seq_puts(m, "AUX_DATA");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        if ((unsigned long) v == 2) {
+                seq_puts(m, "======== ======== ==== ===== === === === == ====="
+                         " == == = ="
+                         " | ================ == == ================");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, " ================");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        /* filter out any unwanted objects */
+#define FILTER(criterion, _yes, _no)                                    \
+        do {                                                            \
+                unsigned long yes = FSCACHE_OBJLIST_CONFIG_##_yes;      \
+                unsigned long no = FSCACHE_OBJLIST_CONFIG_##_no;        \
+                if (criterion) {                                        \
+                        if (!(config & yes))                            \
+                                return 0;                               \
+                } else {                                                \
+                        if (!(config & no))                             \
+                                return 0;                               \
+                }                                                       \
+        } while(0)
+
+        if (~config) {
+                FILTER(obj->cookie,
+                       COOKIE, NOCOOKIE);
+                FILTER(obj->state != FSCACHE_OBJECT_ACTIVE ||
+                       obj->n_ops != 0 ||
+                       obj->n_obj_ops != 0 ||
+                       obj->flags ||
+                       !list_empty(&obj->dependents),
+                       BUSY, IDLE);
+                FILTER(test_bit(FSCACHE_OBJECT_PENDING_WRITE, &obj->flags),
+                       PENDWR, NOPENDWR);
+                FILTER(atomic_read(&obj->n_reads),
+                       READS, NOREADS);
+                FILTER(obj->events & obj->event_mask,
+                       EVENTS, NOEVENTS);
+                FILTER(obj->work.flags & ~(1UL << SLOW_WORK_VERY_SLOW),
+                       WORK, NOWORK);
+        }
+
+        seq_printf(m,
+                   "%8x %8x %s %5u %3u %3u %3u %2u %5u %2lx %2lx %1lx %1lx | ",
+                   obj->debug_id,
+                   obj->parent ? obj->parent->debug_id : -1,
+                   fscache_object_states_short[obj->state],
+                   obj->n_children,
+                   obj->n_ops,
+                   obj->n_obj_ops,
+                   obj->n_in_progress,
+                   obj->n_exclusive,
+                   atomic_read(&obj->n_reads),
+                   obj->event_mask & FSCACHE_OBJECT_EVENTS_MASK,
+                   obj->events,
+                   obj->flags,
+                   obj->work.flags);
+
+        no_cookie = true;
+        keylen = auxlen = 0;
+        if (obj->cookie) {
+                spin_lock(&obj->lock);
+                if (obj->cookie) {
+                        switch (obj->cookie->def->type) {
+                        case 0:
+                                type = "IX";
+                                break;
+                        case 1:
+                                type = "DT";
+                                break;
+                        default:
+                                sprintf(_type, "%02u",
+                                        obj->cookie->def->type);
+                                type = _type;
+                                break;
+                        }
+
+                        seq_printf(m, "%-16s %s %2lx %16p",
+                                   obj->cookie->def->name,
+                                   type,
+                                   obj->cookie->flags,
+                                   obj->cookie->netfs_data);
+
+                        if (obj->cookie->def->get_key &&
+                            config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                keylen = obj->cookie->def->get_key(
+                                        obj->cookie->netfs_data,
+                                        buf, 400);
+
+                        if (obj->cookie->def->get_aux &&
+                            config & FSCACHE_OBJLIST_CONFIG_AUX)
+                                auxlen = obj->cookie->def->get_aux(
+                                        obj->cookie->netfs_data,
+                                        buf + keylen, 512 - keylen);
+
+                        no_cookie = false;
+                }
+                spin_unlock(&obj->lock);
+
+                if (!no_cookie && (keylen > 0 || auxlen > 0)) {
+                        seq_printf(m, " ");
+                        for (p = buf; keylen > 0; keylen--)
+                                seq_printf(m, "%02x", *p++);
+                        if (auxlen > 0) {
+                                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                        seq_printf(m, ", ");
+                                for (; auxlen > 0; auxlen--)
+                                        seq_printf(m, "%02x", *p++);
+                        }
+                }
+        }
+
+        if (no_cookie)
+                seq_printf(m, "<no_cookie>\n");
+        else
+                seq_printf(m, "\n");
+        return 0;
+}
+
+static const struct seq_operations fscache_objlist_ops = {
+        .start          = fscache_objlist_start,
+        .stop           = fscache_objlist_stop,
+        .next           = fscache_objlist_next,
+        .show           = fscache_objlist_show,
+};
+
+/*
+ * get the configuration for filtering the list
+ */
+static void fscache_objlist_config(struct fscache_objlist_data *data)
+{
+#ifdef CONFIG_KEYS
+        struct user_key_payload *confkey;
+        unsigned long config;
+        struct key *key;
+        const char *buf;
+        int len;
+
+        key = request_key(&key_type_user, "fscache:objlist", NULL);
+        if (IS_ERR(key))
+                goto no_config;
+
+        config = 0;
+        rcu_read_lock();
+
+        confkey = key->payload.data;
+        buf = confkey->data;
+
+        for (len = confkey->datalen - 1; len >= 0; len--) {
+                switch (buf[len]) {
+                case 'K': config |= FSCACHE_OBJLIST_CONFIG_KEY;         break;
+                case 'A': config |= FSCACHE_OBJLIST_CONFIG_AUX;         break;
+                case 'C': config |= FSCACHE_OBJLIST_CONFIG_COOKIE;      break;
+                case 'c': config |= FSCACHE_OBJLIST_CONFIG_NOCOOKIE;    break;
+                case 'B': config |= FSCACHE_OBJLIST_CONFIG_BUSY;        break;
+                case 'b': config |= FSCACHE_OBJLIST_CONFIG_IDLE;        break;
+                case 'W': config |= FSCACHE_OBJLIST_CONFIG_PENDWR;      break;
+                case 'w': config |= FSCACHE_OBJLIST_CONFIG_NOPENDWR;    break;
+                case 'R': config |= FSCACHE_OBJLIST_CONFIG_READS;       break;
+                case 'r': config |= FSCACHE_OBJLIST_CONFIG_NOREADS;     break;
+                case 'S': config |= FSCACHE_OBJLIST_CONFIG_WORK;        break;
+                case 's': config |= FSCACHE_OBJLIST_CONFIG_NOWORK;      break;
+                }
+        }
+
+        rcu_read_unlock();
+        key_put(key);
+
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR)))
+            config   |= FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK)))
+            config   |= FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK;
+
+        data->config = config;
+        return;
+
+no_config:
+#endif
+        data->config = ULONG_MAX;
+}
+
+/*
+ * open "/proc/fs/fscache/objects" to provide a list of active objects
+ * - can be configured by a user-defined key added to the caller's keyrings
+ */
+static int fscache_objlist_open(struct inode *inode, struct file *file)
+{
+        struct fscache_objlist_data *data;
+        struct seq_file *m;
+        int ret;
+
+        ret = seq_open(file, &fscache_objlist_ops);
+        if (ret < 0)
+                return ret;
+
+        m = file->private_data;
+
+        /* buffer for key extraction */
+        data = kmalloc(sizeof(struct fscache_objlist_data), GFP_KERNEL);
+        if (!data) {
+                seq_release(inode, file);
+                return -ENOMEM;
+        }
+
+        /* get the configuration key */
+        fscache_objlist_config(data);
+
+        m->private = data;
+        return 0;
+}
+
+/*
+ * clean up on close
+ */
+static int fscache_objlist_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *m = file->private_data;
+
+        kfree(m->private);
+        m->private = NULL;
+        return seq_release(inode, file);
+}
+
+const struct file_operations fscache_objlist_fops = {
+        .owner          = THIS_MODULE,
+        .open           = fscache_objlist_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = fscache_objlist_release,
+};
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 392a41b1b79d..e513ac599c8e 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -14,9 +14,10 @@
 
 #define FSCACHE_DEBUG_LEVEL COOKIE
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
-const char *fscache_object_states[] = {
+const char *fscache_object_states[FSCACHE_OBJECT__NSTATES] = {
         [FSCACHE_OBJECT_INIT]           = "OBJECT_INIT",
         [FSCACHE_OBJECT_LOOKING_UP]     = "OBJECT_LOOKING_UP",
         [FSCACHE_OBJECT_CREATING]       = "OBJECT_CREATING",
@@ -33,9 +34,28 @@ const char *fscache_object_states[] = {
 };
 EXPORT_SYMBOL(fscache_object_states);
 
+const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5] = {
+        [FSCACHE_OBJECT_INIT]           = "INIT",
+        [FSCACHE_OBJECT_LOOKING_UP]     = "LOOK",
+        [FSCACHE_OBJECT_CREATING]       = "CRTN",
+        [FSCACHE_OBJECT_AVAILABLE]      = "AVBL",
+        [FSCACHE_OBJECT_ACTIVE]         = "ACTV",
+        [FSCACHE_OBJECT_UPDATING]       = "UPDT",
+        [FSCACHE_OBJECT_DYING]          = "DYNG",
+        [FSCACHE_OBJECT_LC_DYING]       = "LCDY",
+        [FSCACHE_OBJECT_ABORT_INIT]     = "ABTI",
+        [FSCACHE_OBJECT_RELEASING]      = "RELS",
+        [FSCACHE_OBJECT_RECYCLING]      = "RCYC",
+        [FSCACHE_OBJECT_WITHDRAWING]    = "WTHD",
+        [FSCACHE_OBJECT_DEAD]           = "DEAD",
+};
+
 static void fscache_object_slow_work_put_ref(struct slow_work *);
 static int  fscache_object_slow_work_get_ref(struct slow_work *);
 static void fscache_object_slow_work_execute(struct slow_work *);
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *, struct seq_file *);
+#endif
 static void fscache_initialise_object(struct fscache_object *);
 static void fscache_lookup_object(struct fscache_object *);
 static void fscache_object_available(struct fscache_object *);
@@ -45,9 +65,13 @@ static void fscache_enqueue_dependents(struct fscache_object *);
 static void fscache_dequeue_object(struct fscache_object *);
 
 const struct slow_work_ops fscache_object_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_object_slow_work_get_ref,
         .put_ref        = fscache_object_slow_work_put_ref,
         .execute        = fscache_object_slow_work_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_object_slow_work_desc,
+#endif
 };
 EXPORT_SYMBOL(fscache_object_slow_work_ops);
 
@@ -81,6 +105,7 @@ static inline void fscache_done_parent_op(struct fscache_object *object)
 static void fscache_object_state_machine(struct fscache_object *object)
 {
         enum fscache_object_state new_state;
+        struct fscache_cookie *cookie;
 
         ASSERT(object != NULL);
 
@@ -120,20 +145,31 @@ static void fscache_object_state_machine(struct fscache_object *object)
         case FSCACHE_OBJECT_UPDATING:
                 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
                 fscache_stat(&fscache_n_updates_run);
+                fscache_stat(&fscache_n_cop_update_object);
                 object->cache->ops->update_object(object);
+                fscache_stat_d(&fscache_n_cop_update_object);
                 goto active_transit;
 
                 /* handle an object dying during lookup or creation */
         case FSCACHE_OBJECT_LC_DYING:
                 object->event_mask &= ~(1 << FSCACHE_OBJECT_EV_UPDATE);
+                fscache_stat(&fscache_n_cop_lookup_complete);
                 object->cache->ops->lookup_complete(object);
+                fscache_stat_d(&fscache_n_cop_lookup_complete);
 
                 spin_lock(&object->lock);
                 object->state = FSCACHE_OBJECT_DYING;
-                if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
-                                       &object->cookie->flags))
-                        wake_up_bit(&object->cookie->flags,
-                                    FSCACHE_COOKIE_CREATING);
+                cookie = object->cookie;
+                if (cookie) {
+                        if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_LOOKING_UP);
+                        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_CREATING);
+                }
                 spin_unlock(&object->lock);
 
                 fscache_done_parent_op(object);
@@ -165,6 +201,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
                 }
                 spin_unlock(&object->lock);
                 fscache_enqueue_dependents(object);
+                fscache_start_operations(object);
                 goto terminal_transit;
 
                 /* handle an abort during initialisation */
@@ -316,14 +353,29 @@ static void fscache_object_slow_work_execute(struct slow_work *work)
 
         _enter("{OBJ%x}", object->debug_id);
 
-        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
-
         start = jiffies;
         fscache_object_state_machine(object);
         fscache_hist(fscache_objs_histogram, start);
         if (object->events & object->event_mask)
                 fscache_enqueue_object(object);
+        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+}
+
+/*
+ * describe an object for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *work,
+                                          struct seq_file *m)
+{
+        struct fscache_object *object =
+                container_of(work, struct fscache_object, work);
+
+        seq_printf(m, "FSC: OBJ%x: %s",
+                   object->debug_id,
+                   fscache_object_states_short[object->state]);
 }
+#endif
 
 /*
  * initialise an object
@@ -376,7 +428,9 @@ static void fscache_initialise_object(struct fscache_object *object)
                          * binding on to us, so we need to make sure we don't
                          * add ourself to the list multiple times */
                         if (list_empty(&object->dep_link)) {
+                                fscache_stat(&fscache_n_cop_grab_object);
                                 object->cache->ops->grab_object(object);
+                                fscache_stat_d(&fscache_n_cop_grab_object);
                                 list_add(&object->dep_link,
                                          &parent->dependents);
 
@@ -414,6 +468,7 @@ static void fscache_lookup_object(struct fscache_object *object)
 {
         struct fscache_cookie *cookie = object->cookie;
         struct fscache_object *parent;
+        int ret;
 
         _enter("");
 
@@ -438,11 +493,20 @@ static void fscache_lookup_object(struct fscache_object *object)
                object->cache->tag->name);
 
         fscache_stat(&fscache_n_object_lookups);
-        object->cache->ops->lookup_object(object);
+        fscache_stat(&fscache_n_cop_lookup_object);
+        ret = object->cache->ops->lookup_object(object);
+        fscache_stat_d(&fscache_n_cop_lookup_object);
 
         if (test_bit(FSCACHE_OBJECT_EV_ERROR, &object->events))
                 set_bit(FSCACHE_COOKIE_UNAVAILABLE, &cookie->flags);
 
+        if (ret == -ETIMEDOUT) {
+                /* probably stuck behind another object, so move this one to
+                 * the back of the queue */
+                fscache_stat(&fscache_n_object_lookups_timed_out);
+                set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+        }
+
         _leave("");
 }
 
@@ -546,7 +610,8 @@ static void fscache_object_available(struct fscache_object *object)
 
         spin_lock(&object->lock);
 
-        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
+        if (object->cookie &&
+            test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
                 wake_up_bit(&object->cookie->flags, FSCACHE_COOKIE_CREATING);
 
         fscache_done_parent_op(object);
@@ -562,7 +627,9 @@ static void fscache_object_available(struct fscache_object *object)
         }
         spin_unlock(&object->lock);
 
+        fscache_stat(&fscache_n_cop_lookup_complete);
         object->cache->ops->lookup_complete(object);
+        fscache_stat_d(&fscache_n_cop_lookup_complete);
         fscache_enqueue_dependents(object);
 
         fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
@@ -581,11 +648,16 @@ static void fscache_drop_object(struct fscache_object *object)
 
         _enter("{OBJ%x,%d}", object->debug_id, object->n_children);
 
+        ASSERTCMP(object->cookie, ==, NULL);
+        ASSERT(hlist_unhashed(&object->cookie_link));
+
         spin_lock(&cache->object_list_lock);
         list_del_init(&object->cache_link);
         spin_unlock(&cache->object_list_lock);
 
+        fscache_stat(&fscache_n_cop_drop_object);
         cache->ops->drop_object(object);
+        fscache_stat_d(&fscache_n_cop_drop_object);
 
         if (parent) {
                 _debug("release parent OBJ%x {%d}",
@@ -600,7 +672,9 @@ static void fscache_drop_object(struct fscache_object *object)
         }
 
         /* this just shifts the object release to the slow work processor */
+        fscache_stat(&fscache_n_cop_put_object);
         object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 
         _leave("");
 }
@@ -690,8 +764,12 @@ static int fscache_object_slow_work_get_ref(struct slow_work *work)
 {
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
+        int ret;
 
-        return object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat(&fscache_n_cop_grab_object);
+        ret = object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat_d(&fscache_n_cop_grab_object);
+        return ret;
 }
 
 /*
@@ -702,7 +780,9 @@ static void fscache_object_slow_work_put_ref(struct slow_work *work)
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
 
-        return object->cache->ops->put_object(object);
+        fscache_stat(&fscache_n_cop_put_object);
+        object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 }
 
 /*
@@ -739,7 +819,9 @@ static void fscache_enqueue_dependents(struct fscache_object *object)
 
                 /* sort onto appropriate lists */
                 fscache_enqueue_object(dep);
+                fscache_stat(&fscache_n_cop_put_object);
                 dep->cache->ops->put_object(dep);
+                fscache_stat_d(&fscache_n_cop_put_object);
 
                 if (!list_empty(&object->dependents))
                         cond_resched_lock(&object->lock);
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index e7f8d53b8b6b..313e79a14266 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -13,6 +13,7 @@
 
 #define FSCACHE_DEBUG_LEVEL OPERATION
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
 atomic_t fscache_op_debug_id;
@@ -31,32 +32,33 @@ void fscache_enqueue_operation(struct fscache_operation *op)
         _enter("{OBJ%x OP%x,%u}",
                op->object->debug_id, op->debug_id, atomic_read(&op->usage));
 
+        fscache_set_op_state(op, "EnQ");
+
+        ASSERT(list_empty(&op->pend_link));
         ASSERT(op->processor != NULL);
         ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
-        if (list_empty(&op->pend_link)) {
-                switch (op->flags & FSCACHE_OP_TYPE) {
-                case FSCACHE_OP_FAST:
-                        _debug("queue fast");
-                        atomic_inc(&op->usage);
-                        if (!schedule_work(&op->fast_work))
-                                fscache_put_operation(op);
-                        break;
-                case FSCACHE_OP_SLOW:
-                        _debug("queue slow");
-                        slow_work_enqueue(&op->slow_work);
-                        break;
-                case FSCACHE_OP_MYTHREAD:
-                        _debug("queue for caller's attention");
-                        break;
-                default:
-                        printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
-                               op->flags);
-                        BUG();
-                        break;
-                }
-                fscache_stat(&fscache_n_op_enqueue);
+        fscache_stat(&fscache_n_op_enqueue);
+        switch (op->flags & FSCACHE_OP_TYPE) {
+        case FSCACHE_OP_FAST:
+                _debug("queue fast");
+                atomic_inc(&op->usage);
+                if (!schedule_work(&op->fast_work))
+                        fscache_put_operation(op);
+                break;
+        case FSCACHE_OP_SLOW:
+                _debug("queue slow");
+                slow_work_enqueue(&op->slow_work);
+                break;
+        case FSCACHE_OP_MYTHREAD:
+                _debug("queue for caller's attention");
+                break;
+        default:
+                printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
+                       op->flags);
+                BUG();
+                break;
         }
 }
 EXPORT_SYMBOL(fscache_enqueue_operation);
@@ -67,6 +69,8 @@ EXPORT_SYMBOL(fscache_enqueue_operation);
 static void fscache_run_op(struct fscache_object *object,
                            struct fscache_operation *op)
 {
+        fscache_set_op_state(op, "Run");
+
         object->n_in_progress++;
         if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
                 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
@@ -87,9 +91,12 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
 
         _enter("{OBJ%x OP%x},", object->debug_id, op->debug_id);
 
+        fscache_set_op_state(op, "SubmitX");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ret = -ENOBUFS;
         if (fscache_object_is_active(object)) {
@@ -190,9 +197,12 @@ int fscache_submit_op(struct fscache_object *object,
 
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
+        fscache_set_op_state(op, "Submit");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ostate = object->state;
         smp_rmb();
@@ -222,6 +232,11 @@ int fscache_submit_op(struct fscache_object *object,
                 list_add_tail(&op->pend_link, &object->pending_ops);
                 fscache_stat(&fscache_n_op_pend);
                 ret = 0;
+        } else if (object->state == FSCACHE_OBJECT_DYING ||
+                   object->state == FSCACHE_OBJECT_LC_DYING ||
+                   object->state == FSCACHE_OBJECT_WITHDRAWING) {
+                fscache_stat(&fscache_n_op_rejected);
+                ret = -ENOBUFS;
         } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
                 fscache_report_unexpected_submission(object, op, ostate);
                 ASSERT(!fscache_object_is_active(object));
@@ -264,12 +279,7 @@ void fscache_start_operations(struct fscache_object *object)
                         stop = true;
                 }
                 list_del_init(&op->pend_link);
-                object->n_in_progress++;
-
-                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
-                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
-                if (op->processor)
-                        fscache_enqueue_operation(op);
+                fscache_run_op(object, op);
 
                 /* the pending queue was holding a ref on the object */
                 fscache_put_operation(op);
@@ -282,6 +292,36 @@ void fscache_start_operations(struct fscache_object *object)
 }
 
 /*
+ * cancel an operation that's pending on an object
+ */
+int fscache_cancel_op(struct fscache_operation *op)
+{
+        struct fscache_object *object = op->object;
+        int ret;
+
+        _enter("OBJ%x OP%x}", op->object->debug_id, op->debug_id);
+
+        spin_lock(&object->lock);
+
+        ret = -EBUSY;
+        if (!list_empty(&op->pend_link)) {
+                fscache_stat(&fscache_n_op_cancelled);
+                list_del_init(&op->pend_link);
+                object->n_ops--;
+                if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
+                        object->n_exclusive--;
+                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
+                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
+                fscache_put_operation(op);
+                ret = 0;
+        }
+
+        spin_unlock(&object->lock);
+        _leave(" = %d", ret);
+        return ret;
+}
+
+/*
  * release an operation
  * - queues pending ops if this is the last in-progress op
  */
@@ -298,6 +338,8 @@ void fscache_put_operation(struct fscache_operation *op)
         if (!atomic_dec_and_test(&op->usage))
                 return;
 
+        fscache_set_op_state(op, "Put");
+
         _debug("PUT OP");
         if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
                 BUG();
@@ -311,6 +353,9 @@ void fscache_put_operation(struct fscache_operation *op)
 
         object = op->object;
 
+        if (test_bit(FSCACHE_OP_DEC_READ_CNT, &op->flags))
+                atomic_dec(&object->n_reads);
+
         /* now... we may get called with the object spinlock held, so we
          * complete the cleanup here only if we can immediately acquire the
          * lock, and defer it otherwise */
@@ -452,8 +497,27 @@ static void fscache_op_execute(struct slow_work *work)
         _leave("");
 }
 
+/*
+ * describe an operation for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_op_desc(struct slow_work *work, struct seq_file *m)
+{
+        struct fscache_operation *op =
+                container_of(work, struct fscache_operation, slow_work);
+
+        seq_printf(m, "FSC: OBJ%x OP%x: %s/%s fl=%lx",
+                   op->object->debug_id, op->debug_id,
+                   op->name, op->state, op->flags);
+}
+#endif
+
 const struct slow_work_ops fscache_op_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_op_get_ref,
         .put_ref        = fscache_op_put_ref,
         .execute        = fscache_op_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_op_desc,
+#endif
 };
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index 2568e0eb644f..c598ea4c4e7d 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -43,18 +43,102 @@ void __fscache_wait_on_page_write(struct fscache_cookie *cookie, struct page *pa
 EXPORT_SYMBOL(__fscache_wait_on_page_write);
 
 /*
- * note that a page has finished being written to the cache
+ * decide whether a page can be released, possibly by cancelling a store to it
+ * - we're allowed to sleep if __GFP_WAIT is flagged
  */
-static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *page)
+bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                  struct page *page,
+                                  gfp_t gfp)
 {
         struct page *xpage;
+        void *val;
+
+        _enter("%p,%p,%x", cookie, page, gfp);
+
+        rcu_read_lock();
+        val = radix_tree_lookup(&cookie->stores, page->index);
+        if (!val) {
+                rcu_read_unlock();
+                fscache_stat(&fscache_n_store_vmscan_not_storing);
+                __fscache_uncache_page(cookie, page);
+                return true;
+        }
+
+        /* see if the page is actually undergoing storage - if so we can't get
+         * rid of it till the cache has finished with it */
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                rcu_read_unlock();
+                goto page_busy;
+        }
+
+        /* the page is pending storage, so we attempt to cancel the store and
+         * discard the store request so that the page can be reclaimed */
+        spin_lock(&cookie->stores_lock);
+        rcu_read_unlock();
+
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                /* the page started to undergo storage whilst we were looking,
+                 * so now we can only wait or return */
+                spin_unlock(&cookie->stores_lock);
+                goto page_busy;
+        }
 
-        spin_lock(&cookie->lock);
         xpage = radix_tree_delete(&cookie->stores, page->index);
-        spin_unlock(&cookie->lock);
-        ASSERT(xpage != NULL);
+        spin_unlock(&cookie->stores_lock);
+
+        if (xpage) {
+                fscache_stat(&fscache_n_store_vmscan_cancelled);
+                fscache_stat(&fscache_n_store_radix_deletes);
+                ASSERTCMP(xpage, ==, page);
+        } else {
+                fscache_stat(&fscache_n_store_vmscan_gone);
+        }
 
         wake_up_bit(&cookie->flags, 0);
+        if (xpage)
+                page_cache_release(xpage);
+        __fscache_uncache_page(cookie, page);
+        return true;
+
+page_busy:
+        /* we might want to wait here, but that could deadlock the allocator as
+         * the slow-work threads writing to the cache may all end up sleeping
+         * on memory allocation */
+        fscache_stat(&fscache_n_store_vmscan_busy);
+        return false;
+}
+EXPORT_SYMBOL(__fscache_maybe_release_page);
+
+/*
+ * note that a page has finished being written to the cache
+ */
+static void fscache_end_page_write(struct fscache_object *object,
+                                   struct page *page)
+{
+        struct fscache_cookie *cookie;
+        struct page *xpage = NULL;
+
+        spin_lock(&object->lock);
+        cookie = object->cookie;
+        if (cookie) {
+                /* delete the page from the tree if it is now no longer
+                 * pending */
+                spin_lock(&cookie->stores_lock);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_STORING_TAG);
+                if (!radix_tree_tag_get(&cookie->stores, page->index,
+                                        FSCACHE_COOKIE_PENDING_TAG)) {
+                        fscache_stat(&fscache_n_store_radix_deletes);
+                        xpage = radix_tree_delete(&cookie->stores, page->index);
+                }
+                spin_unlock(&cookie->stores_lock);
+                wake_up_bit(&cookie->flags, 0);
+        }
+        spin_unlock(&object->lock);
+        if (xpage)
+                page_cache_release(xpage);
 }
 
 /*
@@ -63,14 +147,21 @@ static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *p
 static void fscache_attr_changed_op(struct fscache_operation *op)
 {
         struct fscache_object *object = op->object;
+        int ret;
 
         _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
 
         fscache_stat(&fscache_n_attr_changed_calls);
 
-        if (fscache_object_is_active(object) &&
-            object->cache->ops->attr_changed(object) < 0)
-                fscache_abort_object(object);
+        if (fscache_object_is_active(object)) {
+                fscache_set_op_state(op, "CallFS");
+                fscache_stat(&fscache_n_cop_attr_changed);
+                ret = object->cache->ops->attr_changed(object);
+                fscache_stat_d(&fscache_n_cop_attr_changed);
+                fscache_set_op_state(op, "Done");
+                if (ret < 0)
+                        fscache_abort_object(object);
+        }
 
         _leave("");
 }
@@ -99,6 +190,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
         fscache_operation_init(op, NULL);
         fscache_operation_init_slow(op, fscache_attr_changed_op);
         op->flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_EXCLUSIVE);
+        fscache_set_op_name(op, "Attr");
 
         spin_lock(&cookie->lock);
 
@@ -184,6 +276,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
         op->start_time  = jiffies;
         INIT_WORK(&op->op.fast_work, fscache_retrieval_work);
         INIT_LIST_HEAD(&op->to_do);
+        fscache_set_op_name(&op->op, "Retr");
         return op;
 }
 
@@ -221,6 +314,43 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
 }
 
 /*
+ * wait for an object to become active (or dead)
+ */
+static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+                                                 struct fscache_retrieval *op,
+                                                 atomic_t *stat_op_waits,
+                                                 atomic_t *stat_object_dead)
+{
+        int ret;
+
+        if (!test_bit(FSCACHE_OP_WAITING, &op->op.flags))
+                goto check_if_dead;
+
+        _debug(">>> WT");
+        fscache_stat(stat_op_waits);
+        if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                        fscache_wait_bit_interruptible,
+                        TASK_INTERRUPTIBLE) < 0) {
+                ret = fscache_cancel_op(&op->op);
+                if (ret == 0)
+                        return -ERESTARTSYS;
+
+                /* it's been removed from the pending queue by another party,
+                 * so we should get to run shortly */
+                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
+        }
+        _debug("<<< GO");
+
+check_if_dead:
+        if (unlikely(fscache_object_is_dead(object))) {
+                fscache_stat(stat_object_dead);
+                return -ENOBUFS;
+        }
+        return 0;
+}
+
+/*
  * read a page from the cache or allocate a block in which to store it
  * - we return:
  *   -ENOMEM    - out of memory, nothing done
@@ -257,6 +387,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
                 _leave(" = -ENOMEM");
                 return -ENOMEM;
         }
+        fscache_set_op_name(&op->op, "RetrRA1");
 
         spin_lock(&cookie->lock);
 
@@ -267,6 +398,9 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         ASSERTCMP(object->state, >, FSCACHE_OBJECT_LOOKING_UP);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -279,23 +413,27 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
         if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_page);
                 ret = object->cache->ops->allocate_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_page);
                 if (ret == 0)
                         ret = -ENODATA;
         } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_page);
                 ret = object->cache->ops->read_or_alloc_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_page);
         }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -347,7 +485,6 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
                                   void *context,
                                   gfp_t gfp)
 {
-        fscache_pages_retrieval_func_t func;
         struct fscache_retrieval *op;
         struct fscache_object *object;
         int ret;
@@ -369,6 +506,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(mapping, end_io_func, context);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrRAN");
 
         spin_lock(&cookie->lock);
 
@@ -377,6 +515,9 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         object = hlist_entry(cookie->backing_objects.first,
                              struct fscache_object, cookie_link);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -389,21 +530,27 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
-        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags))
-                func = object->cache->ops->allocate_pages;
-        else
-                func = object->cache->ops->read_or_alloc_pages;
-        ret = func(op, pages, nr_pages, gfp);
+        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_pages);
+                ret = object->cache->ops->allocate_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_pages);
+        } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_pages);
+                ret = object->cache->ops->read_or_alloc_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_pages);
+        }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -461,6 +608,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(page->mapping, NULL, NULL);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrAL1");
 
         spin_lock(&cookie->lock);
 
@@ -475,18 +623,22 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
 
         fscache_stat(&fscache_n_alloc_ops);
 
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_alloc_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_alloc_op_waits),
+                __fscache_stat(&fscache_n_allocs_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
+        fscache_stat(&fscache_n_cop_allocate_page);
         ret = object->cache->ops->allocate_page(op, page, gfp);
+        fscache_stat_d(&fscache_n_cop_allocate_page);
 
-        if (ret < 0)
+error:
+        if (ret == -ERESTARTSYS)
+                fscache_stat(&fscache_n_allocs_intr);
+        else if (ret < 0)
                 fscache_stat(&fscache_n_allocs_nobufs);
         else
                 fscache_stat(&fscache_n_allocs_ok);
@@ -521,7 +673,7 @@ static void fscache_write_op(struct fscache_operation *_op)
         struct fscache_storage *op =
                 container_of(_op, struct fscache_storage, op);
         struct fscache_object *object = op->op.object;
-        struct fscache_cookie *cookie = object->cookie;
+        struct fscache_cookie *cookie;
         struct page *page;
         unsigned n;
         void *results[1];
@@ -529,16 +681,19 @@ static void fscache_write_op(struct fscache_operation *_op)
 
         _enter("{OP%x,%d}", op->op.debug_id, atomic_read(&op->op.usage));
 
-        spin_lock(&cookie->lock);
+        fscache_set_op_state(&op->op, "GetPage");
+
         spin_lock(&object->lock);
+        cookie = object->cookie;
 
-        if (!fscache_object_is_active(object)) {
+        if (!fscache_object_is_active(object) || !cookie) {
                 spin_unlock(&object->lock);
-                spin_unlock(&cookie->lock);
                 _leave("");
                 return;
         }
 
+        spin_lock(&cookie->stores_lock);
+
         fscache_stat(&fscache_n_store_calls);
 
         /* find a page to store */
@@ -549,23 +704,35 @@ static void fscache_write_op(struct fscache_operation *_op)
                 goto superseded;
         page = results[0];
         _debug("gang %d [%lx]", n, page->index);
-        if (page->index > op->store_limit)
+        if (page->index > op->store_limit) {
+                fscache_stat(&fscache_n_store_pages_over_limit);
                 goto superseded;
+        }
 
-        radix_tree_tag_clear(&cookie->stores, page->index,
-                             FSCACHE_COOKIE_PENDING_TAG);
+        if (page) {
+                radix_tree_tag_set(&cookie->stores, page->index,
+                                   FSCACHE_COOKIE_STORING_TAG);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_PENDING_TAG);
+        }
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
 
         if (page) {
+                fscache_set_op_state(&op->op, "Store");
+                fscache_stat(&fscache_n_store_pages);
+                fscache_stat(&fscache_n_cop_write_page);
                 ret = object->cache->ops->write_page(op, page);
-                fscache_end_page_write(cookie, page);
-                page_cache_release(page);
-                if (ret < 0)
+                fscache_stat_d(&fscache_n_cop_write_page);
+                fscache_set_op_state(&op->op, "EndWrite");
+                fscache_end_page_write(object, page);
+                if (ret < 0) {
+                        fscache_set_op_state(&op->op, "Abort");
                         fscache_abort_object(object);
-                else
+                } else {
                         fscache_enqueue_operation(&op->op);
+                }
         }
 
         _leave("");
@@ -575,9 +742,9 @@ superseded:
         /* this writer is going away and there aren't any more things to
          * write */
         _debug("cease");
+        spin_unlock(&cookie->stores_lock);
         clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
         _leave("");
 }
 
@@ -634,6 +801,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         fscache_operation_init(&op->op, fscache_release_write_op);
         fscache_operation_init_slow(&op->op, fscache_write_op);
         op->op.flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_WAITING);
+        fscache_set_op_name(&op->op, "Write1");
 
         ret = radix_tree_preload(gfp & ~__GFP_HIGHMEM);
         if (ret < 0)
@@ -652,6 +820,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         /* add the page to the pending-storage radix tree on the backing
          * object */
         spin_lock(&object->lock);
+        spin_lock(&cookie->stores_lock);
 
         _debug("store limit %llx", (unsigned long long) object->store_limit);
 
@@ -672,6 +841,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         if (test_and_set_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags))
                 goto already_pending;
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
 
         op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
@@ -693,6 +863,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
 already_queued:
         fscache_stat(&fscache_n_stores_again);
 already_pending:
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
         spin_unlock(&cookie->lock);
         radix_tree_preload_end();
@@ -702,7 +873,9 @@ already_pending:
         return 0;
 
 submit_failed:
+        spin_lock(&cookie->stores_lock);
         radix_tree_delete(&cookie->stores, page->index);
+        spin_unlock(&cookie->stores_lock);
         page_cache_release(page);
         ret = -ENOBUFS;
         goto nobufs;
@@ -763,7 +936,9 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
         if (TestClearPageFsCache(page) &&
             object->cache->ops->uncache_page) {
                 /* the cache backend releases the cookie lock */
+                fscache_stat(&fscache_n_cop_uncache_page);
                 object->cache->ops->uncache_page(object, page);
+                fscache_stat_d(&fscache_n_cop_uncache_page);
                 goto done;
         }
 
diff --git a/fs/fscache/proc.c b/fs/fscache/proc.c
index beeab44bc31a..1d9e4951a597 100644
--- a/fs/fscache/proc.c
+++ b/fs/fscache/proc.c
@@ -37,10 +37,20 @@ int __init fscache_proc_init(void)
                 goto error_histogram;
 #endif
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        if (!proc_create("fs/fscache/objects", S_IFREG | 0444, NULL,
+                         &fscache_objlist_fops))
+                goto error_objects;
+#endif
+
         _leave(" = 0");
         return 0;
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+error_objects:
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
+        remove_proc_entry("fs/fscache/histogram", NULL);
 error_histogram:
 #endif
 #ifdef CONFIG_FSCACHE_STATS
@@ -58,6 +68,9 @@ error_dir:
  */
 void fscache_proc_cleanup(void)
 {
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        remove_proc_entry("fs/fscache/objects", NULL);
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
         remove_proc_entry("fs/fscache/histogram", NULL);
 #endif
diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
index 65deb99e756b..46435f3aae68 100644
--- a/fs/fscache/stats.c
+++ b/fs/fscache/stats.c
@@ -25,6 +25,8 @@ atomic_t fscache_n_op_requeue;
 atomic_t fscache_n_op_deferred_release;
 atomic_t fscache_n_op_release;
 atomic_t fscache_n_op_gc;
+atomic_t fscache_n_op_cancelled;
+atomic_t fscache_n_op_rejected;
 
 atomic_t fscache_n_attr_changed;
 atomic_t fscache_n_attr_changed_ok;
@@ -36,6 +38,8 @@ atomic_t fscache_n_allocs;
 atomic_t fscache_n_allocs_ok;
 atomic_t fscache_n_allocs_wait;
 atomic_t fscache_n_allocs_nobufs;
+atomic_t fscache_n_allocs_intr;
+atomic_t fscache_n_allocs_object_dead;
 atomic_t fscache_n_alloc_ops;
 atomic_t fscache_n_alloc_op_waits;
 
@@ -46,6 +50,7 @@ atomic_t fscache_n_retrievals_nodata;
 atomic_t fscache_n_retrievals_nobufs;
 atomic_t fscache_n_retrievals_intr;
 atomic_t fscache_n_retrievals_nomem;
+atomic_t fscache_n_retrievals_object_dead;
 atomic_t fscache_n_retrieval_ops;
 atomic_t fscache_n_retrieval_op_waits;
 
@@ -56,6 +61,14 @@ atomic_t fscache_n_stores_nobufs;
 atomic_t fscache_n_stores_oom;
 atomic_t fscache_n_store_ops;
 atomic_t fscache_n_store_calls;
+atomic_t fscache_n_store_pages;
+atomic_t fscache_n_store_radix_deletes;
+atomic_t fscache_n_store_pages_over_limit;
+
+atomic_t fscache_n_store_vmscan_not_storing;
+atomic_t fscache_n_store_vmscan_gone;
+atomic_t fscache_n_store_vmscan_busy;
+atomic_t fscache_n_store_vmscan_cancelled;
 
 atomic_t fscache_n_marks;
 atomic_t fscache_n_uncaches;
@@ -74,6 +87,7 @@ atomic_t fscache_n_updates_run;
 atomic_t fscache_n_relinquishes;
 atomic_t fscache_n_relinquishes_null;
 atomic_t fscache_n_relinquishes_waitcrt;
+atomic_t fscache_n_relinquishes_retire;
 
 atomic_t fscache_n_cookie_index;
 atomic_t fscache_n_cookie_data;
@@ -84,6 +98,7 @@ atomic_t fscache_n_object_no_alloc;
 atomic_t fscache_n_object_lookups;
 atomic_t fscache_n_object_lookups_negative;
 atomic_t fscache_n_object_lookups_positive;
+atomic_t fscache_n_object_lookups_timed_out;
 atomic_t fscache_n_object_created;
 atomic_t fscache_n_object_avail;
 atomic_t fscache_n_object_dead;
@@ -93,6 +108,23 @@ atomic_t fscache_n_checkaux_okay;
 atomic_t fscache_n_checkaux_update;
 atomic_t fscache_n_checkaux_obsolete;
 
+atomic_t fscache_n_cop_alloc_object;
+atomic_t fscache_n_cop_lookup_object;
+atomic_t fscache_n_cop_lookup_complete;
+atomic_t fscache_n_cop_grab_object;
+atomic_t fscache_n_cop_update_object;
+atomic_t fscache_n_cop_drop_object;
+atomic_t fscache_n_cop_put_object;
+atomic_t fscache_n_cop_sync_cache;
+atomic_t fscache_n_cop_attr_changed;
+atomic_t fscache_n_cop_read_or_alloc_page;
+atomic_t fscache_n_cop_read_or_alloc_pages;
+atomic_t fscache_n_cop_allocate_page;
+atomic_t fscache_n_cop_allocate_pages;
+atomic_t fscache_n_cop_write_page;
+atomic_t fscache_n_cop_uncache_page;
+atomic_t fscache_n_cop_dissociate_pages;
+
 /*
  * display the general statistics
  */
@@ -129,10 +161,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_acquires_nobufs),
                    atomic_read(&fscache_n_acquires_oom));
 
-        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u\n",
+        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
                    atomic_read(&fscache_n_object_lookups),
                    atomic_read(&fscache_n_object_lookups_negative),
                    atomic_read(&fscache_n_object_lookups_positive),
+                   atomic_read(&fscache_n_object_lookups_timed_out),
                    atomic_read(&fscache_n_object_created));
 
         seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
@@ -140,10 +173,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_updates_null),
                    atomic_read(&fscache_n_updates_run));
 
-        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u\n",
+        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
                    atomic_read(&fscache_n_relinquishes),
                    atomic_read(&fscache_n_relinquishes_null),
-                   atomic_read(&fscache_n_relinquishes_waitcrt));
+                   atomic_read(&fscache_n_relinquishes_waitcrt),
+                   atomic_read(&fscache_n_relinquishes_retire));
 
         seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
                    atomic_read(&fscache_n_attr_changed),
@@ -152,14 +186,16 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_attr_changed_nomem),
                    atomic_read(&fscache_n_attr_changed_calls));
 
-        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u\n",
+        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
                    atomic_read(&fscache_n_allocs),
                    atomic_read(&fscache_n_allocs_ok),
                    atomic_read(&fscache_n_allocs_wait),
-                   atomic_read(&fscache_n_allocs_nobufs));
-        seq_printf(m, "Allocs : ops=%u owt=%u\n",
+                   atomic_read(&fscache_n_allocs_nobufs),
+                   atomic_read(&fscache_n_allocs_intr));
+        seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_alloc_ops),
-                   atomic_read(&fscache_n_alloc_op_waits));
+                   atomic_read(&fscache_n_alloc_op_waits),
+                   atomic_read(&fscache_n_allocs_object_dead));
 
         seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
                    " int=%u oom=%u\n",
@@ -170,9 +206,10 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_retrievals_nobufs),
                    atomic_read(&fscache_n_retrievals_intr),
                    atomic_read(&fscache_n_retrievals_nomem));
-        seq_printf(m, "Retrvls: ops=%u owt=%u\n",
+        seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_retrieval_ops),
-                   atomic_read(&fscache_n_retrieval_op_waits));
+                   atomic_read(&fscache_n_retrieval_op_waits),
+                   atomic_read(&fscache_n_retrievals_object_dead));
 
         seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
                    atomic_read(&fscache_n_stores),
@@ -180,18 +217,49 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_stores_again),
                    atomic_read(&fscache_n_stores_nobufs),
                    atomic_read(&fscache_n_stores_oom));
-        seq_printf(m, "Stores : ops=%u run=%u\n",
+        seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
                    atomic_read(&fscache_n_store_ops),
-                   atomic_read(&fscache_n_store_calls));
+                   atomic_read(&fscache_n_store_calls),
+                   atomic_read(&fscache_n_store_pages),
+                   atomic_read(&fscache_n_store_radix_deletes),
+                   atomic_read(&fscache_n_store_pages_over_limit));
 
-        seq_printf(m, "Ops    : pend=%u run=%u enq=%u\n",
+        seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
+                   atomic_read(&fscache_n_store_vmscan_not_storing),
+                   atomic_read(&fscache_n_store_vmscan_gone),
+                   atomic_read(&fscache_n_store_vmscan_busy),
+                   atomic_read(&fscache_n_store_vmscan_cancelled));
+
+        seq_printf(m, "Ops    : pend=%u run=%u enq=%u can=%u rej=%u\n",
                    atomic_read(&fscache_n_op_pend),
                    atomic_read(&fscache_n_op_run),
-                   atomic_read(&fscache_n_op_enqueue));
+                   atomic_read(&fscache_n_op_enqueue),
+                   atomic_read(&fscache_n_op_cancelled),
+                   atomic_read(&fscache_n_op_rejected));
         seq_printf(m, "Ops    : dfr=%u rel=%u gc=%u\n",
                    atomic_read(&fscache_n_op_deferred_release),
                    atomic_read(&fscache_n_op_release),
                    atomic_read(&fscache_n_op_gc));
+
+        seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
+                   atomic_read(&fscache_n_cop_alloc_object),
+                   atomic_read(&fscache_n_cop_lookup_object),
+                   atomic_read(&fscache_n_cop_lookup_complete),
+                   atomic_read(&fscache_n_cop_grab_object));
+        seq_printf(m, "CacheOp: upo=%d dro=%d pto=%d atc=%d syn=%d\n",
+                   atomic_read(&fscache_n_cop_update_object),
+                   atomic_read(&fscache_n_cop_drop_object),
+                   atomic_read(&fscache_n_cop_put_object),
+                   atomic_read(&fscache_n_cop_attr_changed),
+                   atomic_read(&fscache_n_cop_sync_cache));
+        seq_printf(m, "CacheOp: rap=%d ras=%d alp=%d als=%d wrp=%d ucp=%d dsp=%d\n",
+                   atomic_read(&fscache_n_cop_read_or_alloc_page),
+                   atomic_read(&fscache_n_cop_read_or_alloc_pages),
+                   atomic_read(&fscache_n_cop_allocate_page),
+                   atomic_read(&fscache_n_cop_allocate_pages),
+                   atomic_read(&fscache_n_cop_write_page),
+                   atomic_read(&fscache_n_cop_uncache_page),
+                   atomic_read(&fscache_n_cop_dissociate_pages));
         return 0;
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8ada78aade58..4787ae6c5c1c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -385,6 +385,9 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (fc->no_create)
                 return -ENOSYS;
 
+        if (flags & O_DIRECT)
+                return -EINVAL;
+
         forget_req = fuse_get_req(fc);
         if (IS_ERR(forget_req))
                 return PTR_ERR(forget_req);
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index eacd78a5d082..5b31f7741a8f 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -114,7 +114,7 @@ static int __init init_gfs2_fs(void)
         if (error)
                 goto fail_unregister;
 
-        error = slow_work_register_user();
+        error = slow_work_register_user(THIS_MODULE);
         if (error)
                 goto fail_slow;
 
@@ -163,7 +163,7 @@ static void __exit exit_gfs2_fs(void)
         gfs2_unregister_debugfs();
         unregister_filesystem(&gfs2_fs_type);
         unregister_filesystem(&gfs2meta_fs_type);
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 
         kmem_cache_destroy(gfs2_quotad_cachep);
         kmem_cache_destroy(gfs2_rgrpd_cachep);
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 59d2695509d3..09fa31965576 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -7,6 +7,7 @@
  * of the GNU General Public License version 2.
  */
 
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
@@ -593,6 +594,7 @@ fail:
 }
 
 struct slow_work_ops gfs2_recover_ops = {
+        .owner   = THIS_MODULE,
         .get_ref = gfs2_recover_get_ref,
         .put_ref = gfs2_recover_put_ref,
         .execute = gfs2_recover_work,
diff --git a/fs/jffs2/read.c b/fs/jffs2/read.c
index cfe05c1966a5..3f39be1b0455 100644
--- a/fs/jffs2/read.c
+++ b/fs/jffs2/read.c
@@ -164,12 +164,15 @@ int jffs2_read_inode_range(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 
         /* XXX FIXME: Where a single physical node actually shows up in two
            frags, we read it twice. Don't do that. */
-        /* Now we're pointing at the first frag which overlaps our page */
+        /* Now we're pointing at the first frag which overlaps our page
+         * (or perhaps is before it, if we've been asked to read off the
+         * end of the file). */
         while(offset < end) {
                 D2(printk(KERN_DEBUG "jffs2_read_inode_range: offset %d, end %d\n", offset, end));
-                if (unlikely(!frag || frag->ofs > offset)) {
+                if (unlikely(!frag || frag->ofs > offset ||
+                             frag->ofs + frag->size <= offset)) {
                         uint32_t holesize = end - offset;
-                        if (frag) {
+                        if (frag && frag->ofs > offset) {
                                 D1(printk(KERN_NOTICE "Eep. Hole in ino #%u fraglist. frag->ofs = 0x%08x, offset = 0x%08x\n", f->inocache->ino, frag->ofs, offset));
                                 holesize = min(holesize, frag->ofs - offset);
                         }
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index 70fad69eb959..fa588006588d 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -359,17 +359,13 @@ int nfs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!cookie);
 
-        if (fscache_check_page_write(cookie, page)) {
-                if (!(gfp & __GFP_WAIT))
-                        return 0;
-                fscache_wait_on_page_write(cookie, page);
-        }
-
         if (PageFsCache(page)) {
                 dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
                          cookie, page, nfsi);
 
-                fscache_uncache_page(cookie, page);
+                if (!fscache_maybe_release_page(cookie, page, gfp))
+                        return 0;
+
                 nfs_add_fscache_stats(page->mapping->host,
                                       NFSIOS_FSCACHE_PAGES_UNCACHED, 1);
         }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ff37454fa783..741a562177fc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2767,7 +2767,7 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                 .pages = &page,
                 .pgbase = 0,
                 .count = count,
-                .bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask,
+                .bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask,
         };
         struct nfs4_readdir_res res;
         struct rpc_message msg = {
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 89fc8ee1f5a5..de059f490586 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1712,7 +1712,8 @@ int ocfs2_check_range_for_refcount(struct inode *inode, loff_t pos,
         struct super_block *sb = inode->i_sb;
 
         if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb)) ||
-            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL))
+            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL) ||
+            OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL)
                 return 0;
 
         cpos = pos >> OCFS2_SB(sb)->s_clustersize_bits;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index eae404602424..d963d8638709 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -35,12 +35,7 @@
 #include <linux/kref.h>
 #include <linux/mutex.h>
 #include <linux/lockdep.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-# include "ocfs2_jbd_compat.h"
-#endif
+#include <linux/jbd2.h>
 
 /* For union ocfs2_dlm_lksb */
 #include "stackglue.h"
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 60287fc56bcb..3a0df7a1b810 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -3743,6 +3743,9 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 goto out;
         }
 
+        if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL)
+                goto attach_xattr;
+
         ocfs2_init_dinode_extent_tree(&di_et, INODE_CACHE(inode), di_bh);
 
         size = i_size_read(inode);
@@ -3769,6 +3772,7 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 cpos += num_clusters;
         }
 
+attach_xattr:
         if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) {
                 ret = ocfs2_xattr_attach_refcount_tree(inode, di_bh,
                                                        &ref_tree->rf_ci,
@@ -3858,6 +3862,49 @@ out:
         return ret;
 }
 
+static int ocfs2_duplicate_inline_data(struct inode *s_inode,
+                                       struct buffer_head *s_bh,
+                                       struct inode *t_inode,
+                                       struct buffer_head *t_bh)
+{
+        int ret;
+        handle_t *handle;
+        struct ocfs2_super *osb = OCFS2_SB(s_inode->i_sb);
+        struct ocfs2_dinode *s_di = (struct ocfs2_dinode *)s_bh->b_data;
+        struct ocfs2_dinode *t_di = (struct ocfs2_dinode *)t_bh->b_data;
+
+        BUG_ON(!(OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL));
+
+        handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                mlog_errno(ret);
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(t_inode), t_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
+        t_di->id2.i_data.id_count = s_di->id2.i_data.id_count;
+        memcpy(t_di->id2.i_data.id_data, s_di->id2.i_data.id_data,
+               le16_to_cpu(s_di->id2.i_data.id_count));
+        spin_lock(&OCFS2_I(t_inode)->ip_lock);
+        OCFS2_I(t_inode)->ip_dyn_features |= OCFS2_INLINE_DATA_FL;
+        t_di->i_dyn_features = cpu_to_le16(OCFS2_I(t_inode)->ip_dyn_features);
+        spin_unlock(&OCFS2_I(t_inode)->ip_lock);
+
+        ocfs2_journal_dirty(handle, t_bh);
+
+out_commit:
+        ocfs2_commit_trans(osb, handle);
+out:
+        return ret;
+}
+
 static int ocfs2_duplicate_extent_list(struct inode *s_inode,
                                 struct inode *t_inode,
                                 struct buffer_head *t_bh,
@@ -3997,6 +4044,14 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out;
         }
 
+        if (OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                ret = ocfs2_duplicate_inline_data(s_inode, s_bh,
+                                                  t_inode, t_bh);
+                if (ret)
+                        mlog_errno(ret);
+                goto out;
+        }
+
         ret = ocfs2_lock_refcount_tree(osb, le64_to_cpu(di->i_refcount_loc),
                                        1, &ref_tree, &ref_root_bh);
         if (ret) {
@@ -4013,10 +4068,6 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out_unlock_refcount;
         }
 
-        ret = ocfs2_complete_reflink(s_inode, s_bh, t_inode, t_bh, preserve);
-        if (ret)
-                mlog_errno(ret);
-
 out_unlock_refcount:
         ocfs2_unlock_refcount_tree(osb, ref_tree, 1);
         brelse(ref_root_bh);
@@ -4068,9 +4119,17 @@ static int __ocfs2_reflink(struct dentry *old_dentry,
                 ret = ocfs2_reflink_xattrs(inode, old_bh,
                                            new_inode, new_bh,
                                            preserve);
-                if (ret)
+                if (ret) {
                         mlog_errno(ret);
+                        goto inode_unlock;
+                }
         }
+
+        ret = ocfs2_complete_reflink(inode, old_bh,
+                                     new_inode, new_bh, preserve);
+        if (ret)
+                mlog_errno(ret);
+
 inode_unlock:
         ocfs2_inode_unlock(new_inode, 1);
         brelse(new_bh);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index c0e48aeebb1c..14f47d2bfe02 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -773,18 +773,20 @@ static int ocfs2_sb_probe(struct super_block *sb,
                 if (tmpstat < 0) {
                         status = tmpstat;
                         mlog_errno(status);
-                        goto bail;
+                        break;
                 }
                 di = (struct ocfs2_dinode *) (*bh)->b_data;
                 memset(stats, 0, sizeof(struct ocfs2_blockcheck_stats));
                 spin_lock_init(&stats->b_lock);
-                status = ocfs2_verify_volume(di, *bh, blksize, stats);
-                if (status >= 0)
-                        goto bail;
-                brelse(*bh);
-                *bh = NULL;
-                if (status != -EAGAIN)
+                tmpstat = ocfs2_verify_volume(di, *bh, blksize, stats);
+                if (tmpstat < 0) {
+                        brelse(*bh);
+                        *bh = NULL;
+                }
+                if (tmpstat != -EAGAIN) {
+                        status = tmpstat;
                         break;
+                }
         }
 
 bail:
@@ -1645,6 +1647,10 @@ static int ocfs2_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bavail = buf->f_bfree;
         buf->f_files = numbits;
         buf->f_ffree = freebits;
+        buf->f_fsid.val[0] = crc32_le(0, osb->uuid_str, OCFS2_VOL_UUID_LEN)
+                                & 0xFFFFFFFFUL;
+        buf->f_fsid.val[1] = crc32_le(0, osb->uuid_str + OCFS2_VOL_UUID_LEN,
+                                OCFS2_VOL_UUID_LEN) & 0xFFFFFFFFUL;
 
         brelse(bh);
 
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index b6284f235d2f..c61369342a27 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -53,11 +53,6 @@
 #include <linux/highmem.h>
 #include <linux/buffer_head.h>
 #include <linux/rbtree.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-#endif
 
 #define MLOG_MASK_PREFIX ML_UPTODATE
 
diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
index 84d3532dd3ea..7be0c6fbe880 100644
--- a/include/linux/fscache-cache.h
+++ b/include/linux/fscache-cache.h
@@ -91,6 +91,8 @@ struct fscache_operation {
 #define FSCACHE_OP_WAITING      4       /* cleared when op is woken */
 #define FSCACHE_OP_EXCLUSIVE    5       /* exclusive op, other ops must wait */
 #define FSCACHE_OP_DEAD         6       /* op is now dead */
+#define FSCACHE_OP_DEC_READ_CNT 7       /* decrement object->n_reads on destruction */
+#define FSCACHE_OP_KEEP_FLAGS   0xc0    /* flags to keep when repurposing an op */
 
         atomic_t                usage;
         unsigned                debug_id;       /* debugging ID */
@@ -102,6 +104,16 @@ struct fscache_operation {
 
         /* operation releaser */
         fscache_operation_release_t release;
+
+#ifdef CONFIG_SLOW_WORK_PROC
+        const char *name;               /* operation name */
+        const char *state;              /* operation state */
+#define fscache_set_op_name(OP, N)      do { (OP)->name  = (N); } while(0)
+#define fscache_set_op_state(OP, S)     do { (OP)->state = (S); } while(0)
+#else
+#define fscache_set_op_name(OP, N)      do { } while(0)
+#define fscache_set_op_state(OP, S)     do { } while(0)
+#endif
 };
 
 extern atomic_t fscache_op_debug_id;
@@ -125,6 +137,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
         op->debug_id = atomic_inc_return(&fscache_op_debug_id);
         op->release = release;
         INIT_LIST_HEAD(&op->pend_link);
+        fscache_set_op_state(op, "Init");
 }
 
 /**
@@ -221,8 +234,10 @@ struct fscache_cache_ops {
         struct fscache_object *(*alloc_object)(struct fscache_cache *cache,
                                                struct fscache_cookie *cookie);
 
-        /* look up the object for a cookie */
-        void (*lookup_object)(struct fscache_object *object);
+        /* look up the object for a cookie
+         * - return -ETIMEDOUT to be requeued
+         */
+        int (*lookup_object)(struct fscache_object *object);
 
         /* finished looking up */
         void (*lookup_complete)(struct fscache_object *object);
@@ -297,12 +312,14 @@ struct fscache_cookie {
         atomic_t                        usage;          /* number of users of this cookie */
         atomic_t                        n_children;     /* number of children of this cookie */
         spinlock_t                      lock;
+        spinlock_t                      stores_lock;    /* lock on page store tree */
         struct hlist_head               backing_objects; /* object(s) backing this file/index */
         const struct fscache_cookie_def *def;           /* definition */
         struct fscache_cookie           *parent;        /* parent of this entry */
         void                            *netfs_data;    /* back pointer to netfs */
         struct radix_tree_root          stores;         /* pages to be stored on this cookie */
 #define FSCACHE_COOKIE_PENDING_TAG      0               /* pages tag: pending write to cache */
+#define FSCACHE_COOKIE_STORING_TAG      1               /* pages tag: writing to cache */
 
         unsigned long                   flags;
 #define FSCACHE_COOKIE_LOOKING_UP       0       /* T if non-index cookie being looked up still */
@@ -337,6 +354,7 @@ struct fscache_object {
                 FSCACHE_OBJECT_RECYCLING,       /* retiring object */
                 FSCACHE_OBJECT_WITHDRAWING,     /* withdrawing object */
                 FSCACHE_OBJECT_DEAD,            /* object is now dead */
+                FSCACHE_OBJECT__NSTATES
         } state;
 
         int                     debug_id;       /* debugging ID */
@@ -345,6 +363,7 @@ struct fscache_object {
         int                     n_obj_ops;      /* number of object ops outstanding on object */
         int                     n_in_progress;  /* number of ops in progress */
         int                     n_exclusive;    /* number of exclusive ops queued */
+        atomic_t                n_reads;        /* number of read ops in progress */
         spinlock_t              lock;           /* state and operations lock */
 
         unsigned long           lookup_jif;     /* time at which lookup started */
@@ -358,6 +377,7 @@ struct fscache_object {
 #define FSCACHE_OBJECT_EV_RELEASE       4       /* T if netfs requested object release */
 #define FSCACHE_OBJECT_EV_RETIRE        5       /* T if netfs requested object retirement */
 #define FSCACHE_OBJECT_EV_WITHDRAW      6       /* T if cache requested object withdrawal */
+#define FSCACHE_OBJECT_EVENTS_MASK      0x7f    /* mask of all events*/
 
         unsigned long           flags;
 #define FSCACHE_OBJECT_LOCK             0       /* T if object is busy being processed */
@@ -373,7 +393,11 @@ struct fscache_object {
         struct list_head        dependents;     /* FIFO of dependent objects */
         struct list_head        dep_link;       /* link in parent's dependents list */
         struct list_head        pending_ops;    /* unstarted operations on this object */
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        struct rb_node          objlist_link;   /* link in global object list */
+#endif
         pgoff_t                 store_limit;    /* current storage limit */
+        loff_t                  store_limit_l;  /* current storage limit */
 };
 
 extern const char *fscache_object_states[];
@@ -383,6 +407,10 @@ extern const char *fscache_object_states[];
          (obj)->state >= FSCACHE_OBJECT_AVAILABLE &&          \
          (obj)->state < FSCACHE_OBJECT_DYING)
 
+#define fscache_object_is_dead(obj)                             \
+        (test_bit(FSCACHE_IOERROR, &(obj)->cache->flags) &&     \
+         (obj)->state >= FSCACHE_OBJECT_DYING)
+
 extern const struct slow_work_ops fscache_object_slow_work_ops;
 
 /**
@@ -414,6 +442,7 @@ void fscache_object_init(struct fscache_object *object,
         object->events = object->event_mask = 0;
         object->flags = 0;
         object->store_limit = 0;
+        object->store_limit_l = 0;
         object->cache = cache;
         object->cookie = cookie;
         object->parent = NULL;
@@ -422,6 +451,12 @@ void fscache_object_init(struct fscache_object *object,
 extern void fscache_object_lookup_negative(struct fscache_object *object);
 extern void fscache_obtained_object(struct fscache_object *object);
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+extern void fscache_object_destroy(struct fscache_object *object);
+#else
+#define fscache_object_destroy(object) do {} while(0)
+#endif
+
 /**
  * fscache_object_destroyed - Note destruction of an object in a cache
  * @cache: The cache from which the object came
@@ -460,6 +495,7 @@ static inline void fscache_object_lookup_error(struct fscache_object *object)
 static inline
 void fscache_set_store_limit(struct fscache_object *object, loff_t i_size)
 {
+        object->store_limit_l = i_size;
         object->store_limit = i_size >> PAGE_SHIFT;
         if (i_size & ~PAGE_MASK)
                 object->store_limit++;
diff --git a/include/linux/fscache.h b/include/linux/fscache.h
index 6d8ee466e0a0..595ce49288b7 100644
--- a/include/linux/fscache.h
+++ b/include/linux/fscache.h
@@ -202,6 +202,8 @@ extern int __fscache_write_page(struct fscache_cookie *, struct page *, gfp_t);
 extern void __fscache_uncache_page(struct fscache_cookie *, struct page *);
 extern bool __fscache_check_page_write(struct fscache_cookie *, struct page *);
 extern void __fscache_wait_on_page_write(struct fscache_cookie *, struct page *);
+extern bool __fscache_maybe_release_page(struct fscache_cookie *, struct page *,
+                                         gfp_t);
 
 /**
  * fscache_register_netfs - Register a filesystem as desiring caching services
@@ -615,4 +617,29 @@ void fscache_wait_on_page_write(struct fscache_cookie *cookie,
                 __fscache_wait_on_page_write(cookie, page);
 }
 
+/**
+ * fscache_maybe_release_page - Consider releasing a page, cancelling a store
+ * @cookie: The cookie representing the cache object
+ * @page: The netfs page that is being cached.
+ * @gfp: The gfp flags passed to releasepage()
+ *
+ * Consider releasing a page for the vmscan algorithm, on behalf of the netfs's
+ * releasepage() call.  A storage request on the page may cancelled if it is
+ * not currently being processed.
+ *
+ * The function returns true if the page no longer has a storage request on it,
+ * and false if a storage request is left in place.  If true is returned, the
+ * page will have been passed to fscache_uncache_page().  If false is returned
+ * the page cannot be freed yet.
+ */
+static inline
+bool fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                struct page *page,
+                                gfp_t gfp)
+{
+        if (fscache_cookie_valid(cookie) && PageFsCache(page))
+                return __fscache_maybe_release_page(cookie, page, gfp);
+        return false;
+}
+
 #endif /* _LINUX_FSCACHE_H */
diff --git a/include/linux/i2c-pnx.h b/include/linux/i2c-pnx.h
index f13255e06406..9eb07bbc6522 100644
--- a/include/linux/i2c-pnx.h
+++ b/include/linux/i2c-pnx.h
@@ -21,7 +21,7 @@ struct i2c_pnx_mif {
         int                     mode;           /* Interface mode */
         struct completion       complete;       /* I/O completion */
         struct timer_list       timer;          /* Timeout */
-        char *                  buf;            /* Data buffer */
+        u8 *                    buf;            /* Data buffer */
         int                     len;            /* Length of data buffer */
 };
 
diff --git a/include/linux/slow-work.h b/include/linux/slow-work.h
index b65c8881f07a..13337bf6c3f5 100644
--- a/include/linux/slow-work.h
+++ b/include/linux/slow-work.h
@@ -17,13 +17,20 @@
 #ifdef CONFIG_SLOW_WORK
 
 #include <linux/sysctl.h>
+#include <linux/timer.h>
 
 struct slow_work;
+#ifdef CONFIG_SLOW_WORK_DEBUG
+struct seq_file;
+#endif
 
 /*
  * The operations used to support slow work items
  */
 struct slow_work_ops {
+        /* owner */
+        struct module *owner;
+
         /* get a ref on a work item
          * - return 0 if successful, -ve if not
          */
@@ -34,6 +41,11 @@ struct slow_work_ops {
 
         /* execute a work item */
         void (*execute)(struct slow_work *work);
+
+#ifdef CONFIG_SLOW_WORK_DEBUG
+        /* describe a work item for debugfs */
+        void (*desc)(struct slow_work *work, struct seq_file *m);
+#endif
 };
 
 /*
@@ -42,13 +54,24 @@ struct slow_work_ops {
  *   queued
  */
 struct slow_work {
+        struct module           *owner; /* the owning module */
         unsigned long           flags;
 #define SLOW_WORK_PENDING       0       /* item pending (further) execution */
 #define SLOW_WORK_EXECUTING     1       /* item currently executing */
 #define SLOW_WORK_ENQ_DEFERRED  2       /* item enqueue deferred */
 #define SLOW_WORK_VERY_SLOW     3       /* item is very slow */
+#define SLOW_WORK_CANCELLING    4       /* item is being cancelled, don't enqueue */
+#define SLOW_WORK_DELAYED       5       /* item is struct delayed_slow_work with active timer */
         const struct slow_work_ops *ops; /* operations table for this item */
         struct list_head        link;   /* link in queue */
+#ifdef CONFIG_SLOW_WORK_DEBUG
+        struct timespec         mark;   /* jiffies at which queued or exec begun */
+#endif
+};
+
+struct delayed_slow_work {
+        struct slow_work        work;
+        struct timer_list       timer;
 };
 
 /**
@@ -67,6 +90,20 @@ static inline void slow_work_init(struct slow_work *work,
 }
 
 /**
+ * slow_work_init - Initialise a delayed slow work item
+ * @work: The work item to initialise
+ * @ops: The operations to use to handle the slow work item
+ *
+ * Initialise a delayed slow work item.
+ */
+static inline void delayed_slow_work_init(struct delayed_slow_work *dwork,
+                                          const struct slow_work_ops *ops)
+{
+        init_timer(&dwork->timer);
+        slow_work_init(&dwork->work, ops);
+}
+
+/**
  * vslow_work_init - Initialise a very slow work item
  * @work: The work item to initialise
  * @ops: The operations to use to handle the slow work item
@@ -83,9 +120,40 @@ static inline void vslow_work_init(struct slow_work *work,
         INIT_LIST_HEAD(&work->link);
 }
 
+/**
+ * slow_work_is_queued - Determine if a slow work item is on the work queue
+ * work: The work item to test
+ *
+ * Determine if the specified slow-work item is on the work queue.  This
+ * returns true if it is actually on the queue.
+ *
+ * If the item is executing and has been marked for requeue when execution
+ * finishes, then false will be returned.
+ *
+ * Anyone wishing to wait for completion of execution can wait on the
+ * SLOW_WORK_EXECUTING bit.
+ */
+static inline bool slow_work_is_queued(struct slow_work *work)
+{
+        unsigned long flags = work->flags;
+        return flags & SLOW_WORK_PENDING && !(flags & SLOW_WORK_EXECUTING);
+}
+
 extern int slow_work_enqueue(struct slow_work *work);
-extern int slow_work_register_user(void);
-extern void slow_work_unregister_user(void);
+extern void slow_work_cancel(struct slow_work *work);
+extern int slow_work_register_user(struct module *owner);
+extern void slow_work_unregister_user(struct module *owner);
+
+extern int delayed_slow_work_enqueue(struct delayed_slow_work *dwork,
+                                     unsigned long delay);
+
+static inline void delayed_slow_work_cancel(struct delayed_slow_work *dwork)
+{
+        slow_work_cancel(&dwork->work);
+}
+
+extern bool slow_work_sleep_till_thread_needed(struct slow_work *work,
+                                               signed long *_timeout);
 
 #ifdef CONFIG_SYSCTL
 extern ctl_table slow_work_sysctls[];
diff --git a/include/linux/vt.h b/include/linux/vt.h
index 7afca0d72139..7ffa11f06232 100644
--- a/include/linux/vt.h
+++ b/include/linux/vt.h
@@ -70,8 +70,8 @@ struct vt_event {
 #define VT_EVENT_UNBLANK        0x0004  /* Screen unblank */
 #define VT_EVENT_RESIZE         0x0008  /* Resize display */
 #define VT_MAX_EVENT            0x000F
-        unsigned int old;               /* Old console */
-        unsigned int new;               /* New console (if changing) */
+        unsigned int oldev;             /* Old console */
+        unsigned int newev;             /* New console (if changing) */
         unsigned int pad[4];            /* Padding for expansion */
 };
 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 3754ea405c88..68a9c5f3412f 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1300,6 +1300,12 @@ enum ieee80211_filter_flags {
  *
  * These flags are used with the ampdu_action() callback in
  * &struct ieee80211_ops to indicate which action is needed.
+ *
+ * Note that drivers MUST be able to deal with a TX aggregation
+ * session being stopped even before they OK'ed starting it by
+ * calling ieee80211_start_tx_ba_cb(_irqsafe), because the peer
+ * might receive the addBA frame and send a delBA right away!
+ *
  * @IEEE80211_AMPDU_RX_START: start Rx aggregation
  * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation
  * @IEEE80211_AMPDU_TX_START: start Tx aggregation
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 9af48cbf0036..f097ae340bc1 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -145,6 +145,7 @@ struct scsi_device {
         unsigned retry_hwerror:1;       /* Retry HARDWARE_ERROR */
         unsigned last_sector_bug:1;     /* do not use multisector accesses on
                                            SD_LAST_BUGGY_SECTORS */
+        unsigned is_visible:1;  /* is the device visible in sysfs */
 
         DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */
         struct list_head event_list;    /* asserted events */
diff --git a/init/Kconfig b/init/Kconfig
index 9e03ef8b311e..39923ccc287b 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1098,6 +1098,16 @@ config SLOW_WORK
 
           See Documentation/slow-work.txt.
 
+config SLOW_WORK_DEBUG
+        bool "Slow work debugging through debugfs"
+        default n
+        depends on SLOW_WORK && DEBUG_FS
+        help
+          Display the contents of the slow work run queue through debugfs,
+          including items currently executing.
+
+          See Documentation/slow-work.txt.
+
 endmenu         # General setup
 
 config HAVE_GENERIC_DMA_COHERENT
diff --git a/kernel/Makefile b/kernel/Makefile
index b8d4cd8ac0b9..d7c13d249b2d 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -94,6 +94,7 @@ obj-$(CONFIG_X86_DS) += trace/
 obj-$(CONFIG_RING_BUFFER) += trace/
 obj-$(CONFIG_SMP) += sched_cpupri.o
 obj-$(CONFIG_SLOW_WORK) += slow-work.o
+obj-$(CONFIG_SLOW_WORK_DEBUG) += slow-work-debugfs.o
 obj-$(CONFIG_PERF_EVENTS) += perf_event.o
 
 ifneq ($(CONFIG_SCHED_OMIT_FRAME_POINTER),y)
diff --git a/kernel/slow-work-debugfs.c b/kernel/slow-work-debugfs.c
new file mode 100644
index 000000000000..e45c43645298
--- /dev/null
+++ b/kernel/slow-work-debugfs.c
@@ -0,0 +1,227 @@
+/* Slow work debugging
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/slow-work.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/seq_file.h>
+#include "slow-work.h"
+
+#define ITERATOR_SHIFT          (BITS_PER_LONG - 4)
+#define ITERATOR_SELECTOR       (0xfUL << ITERATOR_SHIFT)
+#define ITERATOR_COUNTER        (~ITERATOR_SELECTOR)
+
+void slow_work_new_thread_desc(struct slow_work *work, struct seq_file *m)
+{
+        seq_puts(m, "Slow-work: New thread");
+}
+
+/*
+ * Render the time mark field on a work item into a 5-char time with units plus
+ * a space
+ */
+static void slow_work_print_mark(struct seq_file *m, struct slow_work *work)
+{
+        struct timespec now, diff;
+
+        now = CURRENT_TIME;
+        diff = timespec_sub(now, work->mark);
+
+        if (diff.tv_sec < 0)
+                seq_puts(m, "  -ve ");
+        else if (diff.tv_sec == 0 && diff.tv_nsec < 1000)
+                seq_printf(m, "%3luns ", diff.tv_nsec);
+        else if (diff.tv_sec == 0 && diff.tv_nsec < 1000000)
+                seq_printf(m, "%3luus ", diff.tv_nsec / 1000);
+        else if (diff.tv_sec == 0 && diff.tv_nsec < 1000000000)
+                seq_printf(m, "%3lums ", diff.tv_nsec / 1000000);
+        else if (diff.tv_sec <= 1)
+                seq_puts(m, "   1s ");
+        else if (diff.tv_sec < 60)
+                seq_printf(m, "%4lus ", diff.tv_sec);
+        else if (diff.tv_sec < 60 * 60)
+                seq_printf(m, "%4lum ", diff.tv_sec / 60);
+        else if (diff.tv_sec < 60 * 60 * 24)
+                seq_printf(m, "%4luh ", diff.tv_sec / 3600);
+        else
+                seq_puts(m, "exces ");
+}
+
+/*
+ * Describe a slow work item for debugfs
+ */
+static int slow_work_runqueue_show(struct seq_file *m, void *v)
+{
+        struct slow_work *work;
+        struct list_head *p = v;
+        unsigned long id;
+
+        switch ((unsigned long) v) {
+        case 1:
+                seq_puts(m, "THR PID   ITEM ADDR        FL MARK  DESC\n");
+                return 0;
+        case 2:
+                seq_puts(m, "=== ===== ================ == ===== ==========\n");
+                return 0;
+
+        case 3 ... 3 + SLOW_WORK_THREAD_LIMIT - 1:
+                id = (unsigned long) v - 3;
+
+                read_lock(&slow_work_execs_lock);
+                work = slow_work_execs[id];
+                if (work) {
+                        smp_read_barrier_depends();
+
+                        seq_printf(m, "%3lu %5d %16p %2lx ",
+                                   id, slow_work_pids[id], work, work->flags);
+                        slow_work_print_mark(m, work);
+
+                        if (work->ops->desc)
+                                work->ops->desc(work, m);
+                        seq_putc(m, '\n');
+                }
+                read_unlock(&slow_work_execs_lock);
+                return 0;
+
+        default:
+                work = list_entry(p, struct slow_work, link);
+                seq_printf(m, "%3s     - %16p %2lx ",
+                           work->flags & SLOW_WORK_VERY_SLOW ? "vsq" : "sq",
+                           work, work->flags);
+                slow_work_print_mark(m, work);
+
+                if (work->ops->desc)
+                        work->ops->desc(work, m);
+                seq_putc(m, '\n');
+                return 0;
+        }
+}
+
+/*
+ * map the iterator to a work item
+ */
+static void *slow_work_runqueue_index(struct seq_file *m, loff_t *_pos)
+{
+        struct list_head *p;
+        unsigned long count, id;
+
+        switch (*_pos >> ITERATOR_SHIFT) {
+        case 0x0:
+                if (*_pos == 0)
+                        *_pos = 1;
+                if (*_pos < 3)
+                        return (void *)(unsigned long) *_pos;
+                if (*_pos < 3 + SLOW_WORK_THREAD_LIMIT)
+                        for (id = *_pos - 3;
+                             id < SLOW_WORK_THREAD_LIMIT;
+                             id++, (*_pos)++)
+                                if (slow_work_execs[id])
+                                        return (void *)(unsigned long) *_pos;
+                *_pos = 0x1UL << ITERATOR_SHIFT;
+
+        case 0x1:
+                count = *_pos & ITERATOR_COUNTER;
+                list_for_each(p, &slow_work_queue) {
+                        if (count == 0)
+                                return p;
+                        count--;
+                }
+                *_pos = 0x2UL << ITERATOR_SHIFT;
+
+        case 0x2:
+                count = *_pos & ITERATOR_COUNTER;
+                list_for_each(p, &vslow_work_queue) {
+                        if (count == 0)
+                                return p;
+                        count--;
+                }
+                *_pos = 0x3UL << ITERATOR_SHIFT;
+
+        default:
+                return NULL;
+        }
+}
+
+/*
+ * set up the iterator to start reading from the first line
+ */
+static void *slow_work_runqueue_start(struct seq_file *m, loff_t *_pos)
+{
+        spin_lock_irq(&slow_work_queue_lock);
+        return slow_work_runqueue_index(m, _pos);
+}
+
+/*
+ * move to the next line
+ */
+static void *slow_work_runqueue_next(struct seq_file *m, void *v, loff_t *_pos)
+{
+        struct list_head *p = v;
+        unsigned long selector = *_pos >> ITERATOR_SHIFT;
+
+        (*_pos)++;
+        switch (selector) {
+        case 0x0:
+                return slow_work_runqueue_index(m, _pos);
+
+        case 0x1:
+                if (*_pos >> ITERATOR_SHIFT == 0x1) {
+                        p = p->next;
+                        if (p != &slow_work_queue)
+                                return p;
+                }
+                *_pos = 0x2UL << ITERATOR_SHIFT;
+                p = &vslow_work_queue;
+
+        case 0x2:
+                if (*_pos >> ITERATOR_SHIFT == 0x2) {
+                        p = p->next;
+                        if (p != &vslow_work_queue)
+                                return p;
+                }
+                *_pos = 0x3UL << ITERATOR_SHIFT;
+
+        default:
+                return NULL;
+        }
+}
+
+/*
+ * clean up after reading
+ */
+static void slow_work_runqueue_stop(struct seq_file *m, void *v)
+{
+        spin_unlock_irq(&slow_work_queue_lock);
+}
+
+static const struct seq_operations slow_work_runqueue_ops = {
+        .start          = slow_work_runqueue_start,
+        .stop           = slow_work_runqueue_stop,
+        .next           = slow_work_runqueue_next,
+        .show           = slow_work_runqueue_show,
+};
+
+/*
+ * open "/sys/kernel/debug/slow_work/runqueue" to list queue contents
+ */
+static int slow_work_runqueue_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &slow_work_runqueue_ops);
+}
+
+const struct file_operations slow_work_runqueue_fops = {
+        .owner          = THIS_MODULE,
+        .open           = slow_work_runqueue_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
diff --git a/kernel/slow-work.c b/kernel/slow-work.c
index 0d31135efbf4..00889bd3c590 100644
--- a/kernel/slow-work.c
+++ b/kernel/slow-work.c
@@ -16,11 +16,8 @@
 #include <linux/kthread.h>
 #include <linux/freezer.h>
 #include <linux/wait.h>
-
-#define SLOW_WORK_CULL_TIMEOUT (5 * HZ) /* cull threads 5s after running out of
-                                         * things to do */
-#define SLOW_WORK_OOM_TIMEOUT (5 * HZ)  /* can't start new threads for 5s after
-                                         * OOM */
+#include <linux/debugfs.h>
+#include "slow-work.h"
 
 static void slow_work_cull_timeout(unsigned long);
 static void slow_work_oom_timeout(unsigned long);
@@ -46,7 +43,7 @@ static unsigned vslow_work_proportion = 50; /* % of threads that may process
 
 #ifdef CONFIG_SYSCTL
 static const int slow_work_min_min_threads = 2;
-static int slow_work_max_max_threads = 255;
+static int slow_work_max_max_threads = SLOW_WORK_THREAD_LIMIT;
 static const int slow_work_min_vslow = 1;
 static const int slow_work_max_vslow = 99;
 
@@ -98,6 +95,56 @@ static DEFINE_TIMER(slow_work_oom_timer, slow_work_oom_timeout, 0, 0);
 static struct slow_work slow_work_new_thread; /* new thread starter */
 
 /*
+ * slow work ID allocation (use slow_work_queue_lock)
+ */
+static DECLARE_BITMAP(slow_work_ids, SLOW_WORK_THREAD_LIMIT);
+
+/*
+ * Unregistration tracking to prevent put_ref() from disappearing during module
+ * unload
+ */
+#ifdef CONFIG_MODULES
+static struct module *slow_work_thread_processing[SLOW_WORK_THREAD_LIMIT];
+static struct module *slow_work_unreg_module;
+static struct slow_work *slow_work_unreg_work_item;
+static DECLARE_WAIT_QUEUE_HEAD(slow_work_unreg_wq);
+static DEFINE_MUTEX(slow_work_unreg_sync_lock);
+
+static void slow_work_set_thread_processing(int id, struct slow_work *work)
+{
+        if (work)
+                slow_work_thread_processing[id] = work->owner;
+}
+static void slow_work_done_thread_processing(int id, struct slow_work *work)
+{
+        struct module *module = slow_work_thread_processing[id];
+
+        slow_work_thread_processing[id] = NULL;
+        smp_mb();
+        if (slow_work_unreg_work_item == work ||
+            slow_work_unreg_module == module)
+                wake_up_all(&slow_work_unreg_wq);
+}
+static void slow_work_clear_thread_processing(int id)
+{
+        slow_work_thread_processing[id] = NULL;
+}
+#else
+static void slow_work_set_thread_processing(int id, struct slow_work *work) {}
+static void slow_work_done_thread_processing(int id, struct slow_work *work) {}
+static void slow_work_clear_thread_processing(int id) {}
+#endif
+
+/*
+ * Data for tracking currently executing items for indication through /proc
+ */
+#ifdef CONFIG_SLOW_WORK_DEBUG
+struct slow_work *slow_work_execs[SLOW_WORK_THREAD_LIMIT];
+pid_t slow_work_pids[SLOW_WORK_THREAD_LIMIT];
+DEFINE_RWLOCK(slow_work_execs_lock);
+#endif
+
+/*
  * The queues of work items and the lock governing access to them.  These are
  * shared between all the CPUs.  It doesn't make sense to have per-CPU queues
  * as the number of threads bears no relation to the number of CPUs.
@@ -105,9 +152,18 @@ static struct slow_work slow_work_new_thread; /* new thread starter */
  * There are two queues of work items: one for slow work items, and one for
  * very slow work items.
  */
-static LIST_HEAD(slow_work_queue);
-static LIST_HEAD(vslow_work_queue);
-static DEFINE_SPINLOCK(slow_work_queue_lock);
+LIST_HEAD(slow_work_queue);
+LIST_HEAD(vslow_work_queue);
+DEFINE_SPINLOCK(slow_work_queue_lock);
+
+/*
+ * The following are two wait queues that get pinged when a work item is placed
+ * on an empty queue.  These allow work items that are hogging a thread by
+ * sleeping in a way that could be deferred to yield their thread and enqueue
+ * themselves.
+ */
+static DECLARE_WAIT_QUEUE_HEAD(slow_work_queue_waits_for_occupation);
+static DECLARE_WAIT_QUEUE_HEAD(vslow_work_queue_waits_for_occupation);
 
 /*
  * The thread controls.  A variable used to signal to the threads that they
@@ -126,6 +182,20 @@ static DECLARE_COMPLETION(slow_work_last_thread_exited);
 static int slow_work_user_count;
 static DEFINE_MUTEX(slow_work_user_lock);
 
+static inline int slow_work_get_ref(struct slow_work *work)
+{
+        if (work->ops->get_ref)
+                return work->ops->get_ref(work);
+
+        return 0;
+}
+
+static inline void slow_work_put_ref(struct slow_work *work)
+{
+        if (work->ops->put_ref)
+                work->ops->put_ref(work);
+}
+
 /*
  * Calculate the maximum number of active threads in the pool that are
  * permitted to process very slow work items.
@@ -149,7 +219,7 @@ static unsigned slow_work_calc_vsmax(void)
  * Attempt to execute stuff queued on a slow thread.  Return true if we managed
  * it, false if there was nothing to do.
  */
-static bool slow_work_execute(void)
+static noinline bool slow_work_execute(int id)
 {
         struct slow_work *work = NULL;
         unsigned vsmax;
@@ -186,6 +256,13 @@ static bool slow_work_execute(void)
         } else {
                 very_slow = false; /* avoid the compiler warning */
         }
+
+        slow_work_set_thread_processing(id, work);
+        if (work) {
+                slow_work_mark_time(work);
+                slow_work_begin_exec(id, work);
+        }
+
         spin_unlock_irq(&slow_work_queue_lock);
 
         if (!work)
@@ -194,12 +271,19 @@ static bool slow_work_execute(void)
         if (!test_and_clear_bit(SLOW_WORK_PENDING, &work->flags))
                 BUG();
 
-        work->ops->execute(work);
+        /* don't execute if the work is in the process of being cancelled */
+        if (!test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                work->ops->execute(work);
 
         if (very_slow)
                 atomic_dec(&vslow_work_executing_count);
         clear_bit_unlock(SLOW_WORK_EXECUTING, &work->flags);
 
+        /* wake up anyone waiting for this work to be complete */
+        wake_up_bit(&work->flags, SLOW_WORK_EXECUTING);
+
+        slow_work_end_exec(id, work);
+
         /* if someone tried to enqueue the item whilst we were executing it,
          * then it'll be left unenqueued to avoid multiple threads trying to
          * execute it simultaneously
@@ -219,7 +303,10 @@ static bool slow_work_execute(void)
                 spin_unlock_irq(&slow_work_queue_lock);
         }
 
-        work->ops->put_ref(work);
+        /* sort out the race between module unloading and put_ref() */
+        slow_work_put_ref(work);
+        slow_work_done_thread_processing(id, work);
+
         return true;
 
 auto_requeue:
@@ -227,15 +314,61 @@ auto_requeue:
          * - we transfer our ref on the item back to the appropriate queue
          * - don't wake another thread up as we're awake already
          */
+        slow_work_mark_time(work);
         if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags))
                 list_add_tail(&work->link, &vslow_work_queue);
         else
                 list_add_tail(&work->link, &slow_work_queue);
         spin_unlock_irq(&slow_work_queue_lock);
+        slow_work_clear_thread_processing(id);
         return true;
 }
 
 /**
+ * slow_work_sleep_till_thread_needed - Sleep till thread needed by other work
+ * work: The work item under execution that wants to sleep
+ * _timeout: Scheduler sleep timeout
+ *
+ * Allow a requeueable work item to sleep on a slow-work processor thread until
+ * that thread is needed to do some other work or the sleep is interrupted by
+ * some other event.
+ *
+ * The caller must set up a wake up event before calling this and must have set
+ * the appropriate sleep mode (such as TASK_UNINTERRUPTIBLE) and tested its own
+ * condition before calling this function as no test is made here.
+ *
+ * False is returned if there is nothing on the queue; true is returned if the
+ * work item should be requeued
+ */
+bool slow_work_sleep_till_thread_needed(struct slow_work *work,
+                                        signed long *_timeout)
+{
+        wait_queue_head_t *wfo_wq;
+        struct list_head *queue;
+
+        DEFINE_WAIT(wait);
+
+        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags)) {
+                wfo_wq = &vslow_work_queue_waits_for_occupation;
+                queue = &vslow_work_queue;
+        } else {
+                wfo_wq = &slow_work_queue_waits_for_occupation;
+                queue = &slow_work_queue;
+        }
+
+        if (!list_empty(queue))
+                return true;
+
+        add_wait_queue_exclusive(wfo_wq, &wait);
+        if (list_empty(queue))
+                *_timeout = schedule_timeout(*_timeout);
+        finish_wait(wfo_wq, &wait);
+
+        return !list_empty(queue);
+}
+EXPORT_SYMBOL(slow_work_sleep_till_thread_needed);
+
+/**
  * slow_work_enqueue - Schedule a slow work item for processing
  * @work: The work item to queue
  *
@@ -260,16 +393,22 @@ auto_requeue:
  * allowed to pick items to execute.  This ensures that very slow items won't
  * overly block ones that are just ordinarily slow.
  *
- * Returns 0 if successful, -EAGAIN if not.
+ * Returns 0 if successful, -EAGAIN if not (or -ECANCELED if cancelled work is
+ * attempted queued)
  */
 int slow_work_enqueue(struct slow_work *work)
 {
+        wait_queue_head_t *wfo_wq;
+        struct list_head *queue;
         unsigned long flags;
+        int ret;
+
+        if (test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                return -ECANCELED;
 
         BUG_ON(slow_work_user_count <= 0);
         BUG_ON(!work);
         BUG_ON(!work->ops);
-        BUG_ON(!work->ops->get_ref);
 
         /* when honouring an enqueue request, we only promise that we will run
          * the work function in the future; we do not promise to run it once
@@ -280,8 +419,19 @@ int slow_work_enqueue(struct slow_work *work)
          * maintaining our promise
          */
         if (!test_and_set_bit_lock(SLOW_WORK_PENDING, &work->flags)) {
+                if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags)) {
+                        wfo_wq = &vslow_work_queue_waits_for_occupation;
+                        queue = &vslow_work_queue;
+                } else {
+                        wfo_wq = &slow_work_queue_waits_for_occupation;
+                        queue = &slow_work_queue;
+                }
+
                 spin_lock_irqsave(&slow_work_queue_lock, flags);
 
+                if (unlikely(test_bit(SLOW_WORK_CANCELLING, &work->flags)))
+                        goto cancelled;
+
                 /* we promise that we will not attempt to execute the work
                  * function in more than one thread simultaneously
                  *
@@ -299,25 +449,221 @@ int slow_work_enqueue(struct slow_work *work)
                 if (test_bit(SLOW_WORK_EXECUTING, &work->flags)) {
                         set_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags);
                 } else {
-                        if (work->ops->get_ref(work) < 0)
-                                goto cant_get_ref;
-                        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags))
-                                list_add_tail(&work->link, &vslow_work_queue);
-                        else
-                                list_add_tail(&work->link, &slow_work_queue);
+                        ret = slow_work_get_ref(work);
+                        if (ret < 0)
+                                goto failed;
+                        slow_work_mark_time(work);
+                        list_add_tail(&work->link, queue);
                         wake_up(&slow_work_thread_wq);
+
+                        /* if someone who could be requeued is sleeping on a
+                         * thread, then ask them to yield their thread */
+                        if (work->link.prev == queue)
+                                wake_up(wfo_wq);
                 }
 
                 spin_unlock_irqrestore(&slow_work_queue_lock, flags);
         }
         return 0;
 
-cant_get_ref:
+cancelled:
+        ret = -ECANCELED;
+failed:
         spin_unlock_irqrestore(&slow_work_queue_lock, flags);
-        return -EAGAIN;
+        return ret;
 }
 EXPORT_SYMBOL(slow_work_enqueue);
 
+static int slow_work_wait(void *word)
+{
+        schedule();
+        return 0;
+}
+
+/**
+ * slow_work_cancel - Cancel a slow work item
+ * @work: The work item to cancel
+ *
+ * This function will cancel a previously enqueued work item. If we cannot
+ * cancel the work item, it is guarenteed to have run when this function
+ * returns.
+ */
+void slow_work_cancel(struct slow_work *work)
+{
+        bool wait = true, put = false;
+
+        set_bit(SLOW_WORK_CANCELLING, &work->flags);
+        smp_mb();
+
+        /* if the work item is a delayed work item with an active timer, we
+         * need to wait for the timer to finish _before_ getting the spinlock,
+         * lest we deadlock against the timer routine
+         *
+         * the timer routine will leave DELAYED set if it notices the
+         * CANCELLING flag in time
+         */
+        if (test_bit(SLOW_WORK_DELAYED, &work->flags)) {
+                struct delayed_slow_work *dwork =
+                        container_of(work, struct delayed_slow_work, work);
+                del_timer_sync(&dwork->timer);
+        }
+
+        spin_lock_irq(&slow_work_queue_lock);
+
+        if (test_bit(SLOW_WORK_DELAYED, &work->flags)) {
+                /* the timer routine aborted or never happened, so we are left
+                 * holding the timer's reference on the item and should just
+                 * drop the pending flag and wait for any ongoing execution to
+                 * finish */
+                struct delayed_slow_work *dwork =
+                        container_of(work, struct delayed_slow_work, work);
+
+                BUG_ON(timer_pending(&dwork->timer));
+                BUG_ON(!list_empty(&work->link));
+
+                clear_bit(SLOW_WORK_DELAYED, &work->flags);
+                put = true;
+                clear_bit(SLOW_WORK_PENDING, &work->flags);
+
+        } else if (test_bit(SLOW_WORK_PENDING, &work->flags) &&
+                   !list_empty(&work->link)) {
+                /* the link in the pending queue holds a reference on the item
+                 * that we will need to release */
+                list_del_init(&work->link);
+                wait = false;
+                put = true;
+                clear_bit(SLOW_WORK_PENDING, &work->flags);
+
+        } else if (test_and_clear_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags)) {
+                /* the executor is holding our only reference on the item, so
+                 * we merely need to wait for it to finish executing */
+                clear_bit(SLOW_WORK_PENDING, &work->flags);
+        }
+
+        spin_unlock_irq(&slow_work_queue_lock);
+
+        /* the EXECUTING flag is set by the executor whilst the spinlock is set
+         * and before the item is dequeued - so assuming the above doesn't
+         * actually dequeue it, simply waiting for the EXECUTING flag to be
+         * released here should be sufficient */
+        if (wait)
+                wait_on_bit(&work->flags, SLOW_WORK_EXECUTING, slow_work_wait,
+                            TASK_UNINTERRUPTIBLE);
+
+        clear_bit(SLOW_WORK_CANCELLING, &work->flags);
+        if (put)
+                slow_work_put_ref(work);
+}
+EXPORT_SYMBOL(slow_work_cancel);
+
+/*
+ * Handle expiry of the delay timer, indicating that a delayed slow work item
+ * should now be queued if not cancelled
+ */
+static void delayed_slow_work_timer(unsigned long data)
+{
+        wait_queue_head_t *wfo_wq;
+        struct list_head *queue;
+        struct slow_work *work = (struct slow_work *) data;
+        unsigned long flags;
+        bool queued = false, put = false, first = false;
+
+        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags)) {
+                wfo_wq = &vslow_work_queue_waits_for_occupation;
+                queue = &vslow_work_queue;
+        } else {
+                wfo_wq = &slow_work_queue_waits_for_occupation;
+                queue = &slow_work_queue;
+        }
+
+        spin_lock_irqsave(&slow_work_queue_lock, flags);
+        if (likely(!test_bit(SLOW_WORK_CANCELLING, &work->flags))) {
+                clear_bit(SLOW_WORK_DELAYED, &work->flags);
+
+                if (test_bit(SLOW_WORK_EXECUTING, &work->flags)) {
+                        /* we discard the reference the timer was holding in
+                         * favour of the one the executor holds */
+                        set_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags);
+                        put = true;
+                } else {
+                        slow_work_mark_time(work);
+                        list_add_tail(&work->link, queue);
+                        queued = true;
+                        if (work->link.prev == queue)
+                                first = true;
+                }
+        }
+
+        spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        if (put)
+                slow_work_put_ref(work);
+        if (first)
+                wake_up(wfo_wq);
+        if (queued)
+                wake_up(&slow_work_thread_wq);
+}
+
+/**
+ * delayed_slow_work_enqueue - Schedule a delayed slow work item for processing
+ * @dwork: The delayed work item to queue
+ * @delay: When to start executing the work, in jiffies from now
+ *
+ * This is similar to slow_work_enqueue(), but it adds a delay before the work
+ * is actually queued for processing.
+ *
+ * The item can have delayed processing requested on it whilst it is being
+ * executed.  The delay will begin immediately, and if it expires before the
+ * item finishes executing, the item will be placed back on the queue when it
+ * has done executing.
+ */
+int delayed_slow_work_enqueue(struct delayed_slow_work *dwork,
+                              unsigned long delay)
+{
+        struct slow_work *work = &dwork->work;
+        unsigned long flags;
+        int ret;
+
+        if (delay == 0)
+                return slow_work_enqueue(&dwork->work);
+
+        BUG_ON(slow_work_user_count <= 0);
+        BUG_ON(!work);
+        BUG_ON(!work->ops);
+
+        if (test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                return -ECANCELED;
+
+        if (!test_and_set_bit_lock(SLOW_WORK_PENDING, &work->flags)) {
+                spin_lock_irqsave(&slow_work_queue_lock, flags);
+
+                if (test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                        goto cancelled;
+
+                /* the timer holds a reference whilst it is pending */
+                ret = work->ops->get_ref(work);
+                if (ret < 0)
+                        goto cant_get_ref;
+
+                if (test_and_set_bit(SLOW_WORK_DELAYED, &work->flags))
+                        BUG();
+                dwork->timer.expires = jiffies + delay;
+                dwork->timer.data = (unsigned long) work;
+                dwork->timer.function = delayed_slow_work_timer;
+                add_timer(&dwork->timer);
+
+                spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        }
+
+        return 0;
+
+cancelled:
+        ret = -ECANCELED;
+cant_get_ref:
+        spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(delayed_slow_work_enqueue);
+
 /*
  * Schedule a cull of the thread pool at some time in the near future
  */
@@ -368,13 +714,23 @@ static inline bool slow_work_available(int vsmax)
  */
 static int slow_work_thread(void *_data)
 {
-        int vsmax;
+        int vsmax, id;
 
         DEFINE_WAIT(wait);
 
         set_freezable();
         set_user_nice(current, -5);
 
+        /* allocate ourselves an ID */
+        spin_lock_irq(&slow_work_queue_lock);
+        id = find_first_zero_bit(slow_work_ids, SLOW_WORK_THREAD_LIMIT);
+        BUG_ON(id < 0 || id >= SLOW_WORK_THREAD_LIMIT);
+        __set_bit(id, slow_work_ids);
+        slow_work_set_thread_pid(id, current->pid);
+        spin_unlock_irq(&slow_work_queue_lock);
+
+        sprintf(current->comm, "kslowd%03u", id);
+
         for (;;) {
                 vsmax = vslow_work_proportion;
                 vsmax *= atomic_read(&slow_work_thread_count);
@@ -395,7 +751,7 @@ static int slow_work_thread(void *_data)
                 vsmax *= atomic_read(&slow_work_thread_count);
                 vsmax /= 100;
 
-                if (slow_work_available(vsmax) && slow_work_execute()) {
+                if (slow_work_available(vsmax) && slow_work_execute(id)) {
                         cond_resched();
                         if (list_empty(&slow_work_queue) &&
                             list_empty(&vslow_work_queue) &&
@@ -412,6 +768,11 @@ static int slow_work_thread(void *_data)
                         break;
         }
 
+        spin_lock_irq(&slow_work_queue_lock);
+        slow_work_set_thread_pid(id, 0);
+        __clear_bit(id, slow_work_ids);
+        spin_unlock_irq(&slow_work_queue_lock);
+
         if (atomic_dec_and_test(&slow_work_thread_count))
                 complete_and_exit(&slow_work_last_thread_exited, 0);
         return 0;
@@ -427,21 +788,6 @@ static void slow_work_cull_timeout(unsigned long data)
 }
 
 /*
- * Get a reference on slow work thread starter
- */
-static int slow_work_new_thread_get_ref(struct slow_work *work)
-{
-        return 0;
-}
-
-/*
- * Drop a reference on slow work thread starter
- */
-static void slow_work_new_thread_put_ref(struct slow_work *work)
-{
-}
-
-/*
  * Start a new slow work thread
  */
 static void slow_work_new_thread_execute(struct slow_work *work)
@@ -475,9 +821,11 @@ static void slow_work_new_thread_execute(struct slow_work *work)
 }
 
 static const struct slow_work_ops slow_work_new_thread_ops = {
-        .get_ref        = slow_work_new_thread_get_ref,
-        .put_ref        = slow_work_new_thread_put_ref,
+        .owner          = THIS_MODULE,
         .execute        = slow_work_new_thread_execute,
+#ifdef CONFIG_SLOW_WORK_DEBUG
+        .desc           = slow_work_new_thread_desc,
+#endif
 };
 
 /*
@@ -546,12 +894,13 @@ static int slow_work_max_threads_sysctl(struct ctl_table *table, int write,
 
 /**
  * slow_work_register_user - Register a user of the facility
+ * @module: The module about to make use of the facility
  *
  * Register a user of the facility, starting up the initial threads if there
  * aren't any other users at this point.  This will return 0 if successful, or
  * an error if not.
  */
-int slow_work_register_user(void)
+int slow_work_register_user(struct module *module)
 {
         struct task_struct *p;
         int loop;
@@ -598,14 +947,81 @@ error:
 }
 EXPORT_SYMBOL(slow_work_register_user);
 
+/*
+ * wait for all outstanding items from the calling module to complete
+ * - note that more items may be queued whilst we're waiting
+ */
+static void slow_work_wait_for_items(struct module *module)
+{
+#ifdef CONFIG_MODULES
+        DECLARE_WAITQUEUE(myself, current);
+        struct slow_work *work;
+        int loop;
+
+        mutex_lock(&slow_work_unreg_sync_lock);
+        add_wait_queue(&slow_work_unreg_wq, &myself);
+
+        for (;;) {
+                spin_lock_irq(&slow_work_queue_lock);
+
+                /* first of all, we wait for the last queued item in each list
+                 * to be processed */
+                list_for_each_entry_reverse(work, &vslow_work_queue, link) {
+                        if (work->owner == module) {
+                                set_current_state(TASK_UNINTERRUPTIBLE);
+                                slow_work_unreg_work_item = work;
+                                goto do_wait;
+                        }
+                }
+                list_for_each_entry_reverse(work, &slow_work_queue, link) {
+                        if (work->owner == module) {
+                                set_current_state(TASK_UNINTERRUPTIBLE);
+                                slow_work_unreg_work_item = work;
+                                goto do_wait;
+                        }
+                }
+
+                /* then we wait for the items being processed to finish */
+                slow_work_unreg_module = module;
+                smp_mb();
+                for (loop = 0; loop < SLOW_WORK_THREAD_LIMIT; loop++) {
+                        if (slow_work_thread_processing[loop] == module)
+                                goto do_wait;
+                }
+                spin_unlock_irq(&slow_work_queue_lock);
+                break; /* okay, we're done */
+
+        do_wait:
+                spin_unlock_irq(&slow_work_queue_lock);
+                schedule();
+                slow_work_unreg_work_item = NULL;
+                slow_work_unreg_module = NULL;
+        }
+
+        remove_wait_queue(&slow_work_unreg_wq, &myself);
+        mutex_unlock(&slow_work_unreg_sync_lock);
+#endif /* CONFIG_MODULES */
+}
+
 /**
  * slow_work_unregister_user - Unregister a user of the facility
+ * @module: The module whose items should be cleared
  *
  * Unregister a user of the facility, killing all the threads if this was the
  * last one.
+ *
+ * This waits for all the work items belonging to the nominated module to go
+ * away before proceeding.
  */
-void slow_work_unregister_user(void)
+void slow_work_unregister_user(struct module *module)
 {
+        /* first of all, wait for all outstanding items from the calling module
+         * to complete */
+        if (module)
+                slow_work_wait_for_items(module);
+
+        /* then we can actually go about shutting down the facility if need
+         * be */
         mutex_lock(&slow_work_user_lock);
 
         BUG_ON(slow_work_user_count <= 0);
@@ -639,6 +1055,16 @@ static int __init init_slow_work(void)
         if (slow_work_max_max_threads < nr_cpus * 2)
                 slow_work_max_max_threads = nr_cpus * 2;
 #endif
+#ifdef CONFIG_SLOW_WORK_DEBUG
+        {
+                struct dentry *dbdir;
+
+                dbdir = debugfs_create_dir("slow_work", NULL);
+                if (dbdir && !IS_ERR(dbdir))
+                        debugfs_create_file("runqueue", S_IFREG | 0400, dbdir,
+                                            NULL, &slow_work_runqueue_fops);
+        }
+#endif
         return 0;
 }
 
diff --git a/kernel/slow-work.h b/kernel/slow-work.h
new file mode 100644
index 000000000000..321f3c59d732
--- /dev/null
+++ b/kernel/slow-work.h
@@ -0,0 +1,72 @@
+/* Slow work private definitions
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define SLOW_WORK_CULL_TIMEOUT (5 * HZ) /* cull threads 5s after running out of
+                                         * things to do */
+#define SLOW_WORK_OOM_TIMEOUT (5 * HZ)  /* can't start new threads for 5s after
+                                         * OOM */
+
+#define SLOW_WORK_THREAD_LIMIT  255     /* abs maximum number of slow-work threads */
+
+/*
+ * slow-work.c
+ */
+#ifdef CONFIG_SLOW_WORK_DEBUG
+extern struct slow_work *slow_work_execs[];
+extern pid_t slow_work_pids[];
+extern rwlock_t slow_work_execs_lock;
+#endif
+
+extern struct list_head slow_work_queue;
+extern struct list_head vslow_work_queue;
+extern spinlock_t slow_work_queue_lock;
+
+/*
+ * slow-work-debugfs.c
+ */
+#ifdef CONFIG_SLOW_WORK_DEBUG
+extern const struct file_operations slow_work_runqueue_fops;
+
+extern void slow_work_new_thread_desc(struct slow_work *, struct seq_file *);
+#endif
+
+/*
+ * Helper functions
+ */
+static inline void slow_work_set_thread_pid(int id, pid_t pid)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        slow_work_pids[id] = pid;
+#endif
+}
+
+static inline void slow_work_mark_time(struct slow_work *work)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        work->mark = CURRENT_TIME;
+#endif
+}
+
+static inline void slow_work_begin_exec(int id, struct slow_work *work)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        slow_work_execs[id] = work;
+#endif
+}
+
+static inline void slow_work_end_exec(int id, struct slow_work *work)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        write_lock(&slow_work_execs_lock);
+        slow_work_execs[id] = NULL;
+        write_unlock(&slow_work_execs_lock);
+#endif
+}
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 23abbd93cae1..92cdd9936e3d 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -200,6 +200,9 @@ radix_tree_node_free(struct radix_tree_node *node)
  * ensure that the addition of a single element in the tree cannot fail.  On
  * success, return zero, with preemption disabled.  On error, return -ENOMEM
  * with preemption not disabled.
+ *
+ * To make use of this facility, the radix tree must be initialised without
+ * __GFP_WAIT being passed to INIT_RADIX_TREE().
  */
 int radix_tree_preload(gfp_t gfp_mask)
 {
@@ -543,7 +546,6 @@ out:
 }
 EXPORT_SYMBOL(radix_tree_tag_clear);
 
-#ifndef __KERNEL__      /* Only the test harness uses this at present */
 /**
  * radix_tree_tag_get - get a tag on a radix tree node
  * @root:               radix tree root
@@ -606,7 +608,6 @@ int radix_tree_tag_get(struct radix_tree_root *root,
         }
 }
 EXPORT_SYMBOL(radix_tree_tag_get);
-#endif
 
 /**
  *      radix_tree_next_hole    -    find the next hole (not-present entry)
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 11aee09dd2a6..67a33a5a1a93 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -604,10 +604,14 @@ static void bdi_wb_shutdown(struct backing_dev_info *bdi)
 
         /*
          * Finally, kill the kernel threads. We don't need to be RCU
-         * safe anymore, since the bdi is gone from visibility.
+         * safe anymore, since the bdi is gone from visibility. Force
+         * unfreeze of the thread before calling kthread_stop(), otherwise
+         * it would never exet if it is currently stuck in the refrigerator.
          */
-        list_for_each_entry(wb, &bdi->wb_list, list)
+        list_for_each_entry(wb, &bdi->wb_list, list) {
+                wb->task->flags &= ~PF_FROZEN;
                 kthread_stop(wb->task);
+        }
 }
 
 /*
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 1472d8e3c191..c4735310a923 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -564,7 +564,7 @@ out_oversize:
                 printk(KERN_INFO "Oversized IP packet from %pI4.\n",
                         &qp->saddr);
 out_fail:
-        IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
+        IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
         return err;
 }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index b78e61502efe..e34013a78ef4 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -503,8 +503,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                truesizes += frag->truesize;
                         }
+                        truesizes += frag->truesize;
                 }
 
                 /* Everything is OK. Generate! */
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 524f9760193b..7d4648f8b3d3 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2059,6 +2059,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_cnt = 0;
         tp->bytes_acked = 0;
+        tp->window_clamp = 0;
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 614c65d62ae4..51c7dc3c4c3b 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -86,10 +86,6 @@ void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *r
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
 
-        /* stop HW Rx aggregation. ampdu_action existence
-         * already verified in session init so we add the BUG_ON */
-        BUG_ON(!local->ops->ampdu_action);
-
         rcu_read_lock();
 
         sta = sta_info_get(local, ra);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index adf01fcd462e..5e3a7eccef5a 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -124,13 +124,18 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         ieee80211_tx_skb(sdata, skb);
 }
 
-static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                           enum ieee80211_back_parties initiator)
+int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                    enum ieee80211_back_parties initiator)
 {
         struct ieee80211_local *local = sta->local;
         int ret;
         u8 *state;
 
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
+               sta->sta.addr, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
         if (*state == HT_AGG_STATE_OPERATIONAL)
@@ -145,7 +150,6 @@ static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         /* HW shall not deny going back to legacy */
         if (WARN_ON(ret)) {
-                *state = HT_AGG_STATE_OPERATIONAL;
                 /*
                  * We may have pending packets get stuck in this case...
                  * Not bothering with a workaround for now.
@@ -515,11 +519,6 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 goto unlock;
         }
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
-               sta->sta.addr, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
         ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator);
 
  unlock:
@@ -534,7 +533,7 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
 
-        if (WARN_ON(!local->ops->ampdu_action))
+        if (!local->ops->ampdu_action)
                 return -EINVAL;
 
         if (tid >= STA_TID_NUM)
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 15c9d4f94cee..3787455fb696 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -160,10 +160,9 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                                                  WLAN_BACK_INITIATOR, 0);
         else { /* WLAN_BACK_RECIPIENT */
                 spin_lock_bh(&sta->lock);
-                sta->ampdu_mlme.tid_state_tx[tid] =
-                                HT_AGG_STATE_OPERATIONAL;
+                if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK)
+                        ___ieee80211_stop_tx_ba_session(sta, tid,
+                                                        WLAN_BACK_RECIPIENT);
                 spin_unlock_bh(&sta->lock);
-                ieee80211_stop_tx_ba_session(&sta->sta, tid,
-                                             WLAN_BACK_RECIPIENT);
         }
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ab2894211638..039affa7c871 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -995,6 +995,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_back_parties initiator);
+int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                    enum ieee80211_back_parties initiator);
 
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 22e8fd89477f..c7450c8f0a7c 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -306,24 +306,25 @@ EXPORT_SYMBOL_GPL(rpc_sockaddr2uaddr);
  * @sap: buffer into which to plant socket address
  * @salen: size of buffer
  *
+ * @uaddr does not have to be '\0'-terminated, but strict_strtoul() and
+ * rpc_pton() require proper string termination to be successful.
+ *
  * Returns the size of the socket address if successful; otherwise
  * zero is returned.
  */
 size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
                           struct sockaddr *sap, const size_t salen)
 {
-        char *c, buf[RPCBIND_MAXUADDRLEN];
+        char *c, buf[RPCBIND_MAXUADDRLEN + sizeof('\0')];
         unsigned long portlo, porthi;
         unsigned short port;
 
-        if (uaddr_len > sizeof(buf))
+        if (uaddr_len > RPCBIND_MAXUADDRLEN)
                 return 0;
 
         memcpy(buf, uaddr, uaddr_len);
 
-        buf[uaddr_len] = '\n';
-        buf[uaddr_len + 1] = '\0';
-
+        buf[uaddr_len] = '\0';
         c = strrchr(buf, '.');
         if (unlikely(c == NULL))
                 return 0;
@@ -332,9 +333,7 @@ size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
         if (unlikely(portlo > 255))
                 return 0;
 
-        c[0] = '\n';
-        c[1] = '\0';
-
+        *c = '\0';
         c = strrchr(buf, '.');
         if (unlikely(c == NULL))
                 return 0;
@@ -345,8 +344,7 @@ size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
 
         port = (unsigned short)((porthi << 8) | portlo);
 
-        c[0] = '\0';
-
+        *c = '\0';
         if (rpc_pton(buf, strlen(buf), sap, salen) == 0)
                 return 0;
 
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index ef8d61d50462..743c0134a6a9 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -399,6 +399,7 @@ static struct xfrm_algo_desc ealg_list[] = {
 },
 {
         .name = "cbc(camellia)",
+        .compat = "camellia",
 
         .uinfo = {
                 .encr = {
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 6d69c7ccdcc7..80599e3a7994 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -30,7 +30,7 @@ silentoldconfig: $(obj)/conf
         $< -s $(Kconfig)
 
 localmodconfig: $(obj)/streamline_config.pl $(obj)/conf
-        $(Q)perl $< $(Kconfig) > .tmp.config
+        $(Q)perl $< $(srctree) $(Kconfig) > .tmp.config
         $(Q)if [ -f .config ]; then                             \
                         cmp -s .tmp.config .config ||           \
                         (mv -f .config .config.old.1;           \
@@ -44,7 +44,7 @@ localmodconfig: $(obj)/streamline_config.pl $(obj)/conf
         $(Q)rm -f .tmp.config
 
 localyesconfig: $(obj)/streamline_config.pl $(obj)/conf
-        $(Q)perl $< $(Kconfig) > .tmp.config
+        $(Q)perl $< $(srctree) $(Kconfig) > .tmp.config
         $(Q)sed -i s/=m/=y/ .tmp.config
         $(Q)if [ -f .config ]; then                             \
                         cmp -s .tmp.config .config ||           \
diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
index 95984db8e1e0..0d800820c3cd 100644
--- a/scripts/kconfig/streamline_config.pl
+++ b/scripts/kconfig/streamline_config.pl
@@ -43,7 +43,6 @@
 #    make oldconfig
 #
 my $config = ".config";
-my $linuxpath = ".";
 
 my $uname = `uname -r`;
 chomp $uname;
@@ -111,7 +110,11 @@ sub find_config {
 
 find_config;
 
-my @makefiles = `find $linuxpath -name Makefile`;
+# Get the build source and top level Kconfig file (passed in)
+my $ksource = $ARGV[0];
+my $kconfig = $ARGV[1];
+
+my @makefiles = `find $ksource -name Makefile`;
 my %depends;
 my %selects;
 my %prompts;
@@ -119,9 +122,6 @@ my %objects;
 my $var;
 my $cont = 0;
 
-# Get the top level Kconfig file (passed in)
-my $kconfig = $ARGV[0];
-
 # prevent recursion
 my %read_kconfigs;
 
@@ -132,7 +132,7 @@ sub read_kconfig {
     my $config;
     my @kconfigs;
 
-    open(KIN, $kconfig) || die "Can't open $kconfig";
+    open(KIN, "$ksource/$kconfig") || die "Can't open $kconfig";
     while (<KIN>) {
         chomp;
 
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 1f0f8213e2d5..6c160a038b23 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -504,6 +504,10 @@ static int aaci_pcm_hw_params(struct snd_pcm_substream *substream,
         int err;
 
         aaci_pcm_hw_free(substream);
+        if (aacirun->pcm_open) {
+                snd_ac97_pcm_close(aacirun->pcm);
+                aacirun->pcm_open = 0;
+        }
 
         err = devdma_hw_alloc(NULL, substream,
                               params_buffer_bytes(params));
@@ -517,7 +521,7 @@ static int aaci_pcm_hw_params(struct snd_pcm_substream *substream,
         else
                 err = snd_ac97_pcm_open(aacirun->pcm, params_rate(params),
                                         params_channels(params),
-                                        aacirun->pcm->r[1].slots);
+                                        aacirun->pcm->r[0].slots);
 
         if (err)
                 goto out;
diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
index 6b24d8bb02bb..90a0264f7538 100644
--- a/sound/soc/codecs/tlv320aic23.c
+++ b/sound/soc/codecs/tlv320aic23.c
@@ -625,11 +625,10 @@ static int tlv320aic23_resume(struct platform_device *pdev)
 {
         struct snd_soc_device *socdev = platform_get_drvdata(pdev);
         struct snd_soc_codec *codec = socdev->card->codec;
-        int i;
         u16 reg;
 
         /* Sync reg_cache with the hardware */
-        for (reg = 0; reg < ARRAY_SIZE(tlv320aic23_reg); i++) {
+        for (reg = 0; reg < TLV320AIC23_RESET; reg++) {
                 u16 val = tlv320aic23_read_reg_cache(codec, reg);
                 tlv320aic23_write(codec, reg, val);
         }
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index d89f6dc00908..66d4c165f99b 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -973,9 +973,19 @@ static int dapm_power_widgets(struct snd_soc_codec *codec, int event)
                         if (!w->power_check)
                                 continue;
 
-                        power = w->power_check(w);
-                        if (power)
-                                sys_power = 1;
+                        /* If we're suspending then pull down all the 
+                         * power. */
+                        switch (event) {
+                        case SND_SOC_DAPM_STREAM_SUSPEND:
+                                power = 0;
+                                break;
+
+                        default:
+                                power = w->power_check(w);
+                                if (power)
+                                        sys_power = 1;
+                                break;
+                        }
 
                         if (w->power == power)
                                 continue;
@@ -999,8 +1009,12 @@ static int dapm_power_widgets(struct snd_soc_codec *codec, int event)
                 case SND_SOC_DAPM_STREAM_RESUME:
                         sys_power = 1;
                         break;
+                case SND_SOC_DAPM_STREAM_SUSPEND:
+                        sys_power = 0;
+                        break;
                 case SND_SOC_DAPM_STREAM_NOP:
                         sys_power = codec->bias_level != SND_SOC_BIAS_STANDBY;
+                        break;
                 default:
                         break;
                 }