Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

194 files changed, 2013 insertions, 1508 deletions

diff --git a/.gitignore b/.gitignore
index 869e1a3b64b6..51bd99d6a260 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,6 +49,7 @@ include/linux/compile.h
 include/linux/version.h
 include/linux/utsrelease.h
 include/linux/bounds.h
+include/generated
 
 # stgit generated dirs
 patches-*
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index deeeed0faa8f..f49eecf2e573 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -277,8 +277,7 @@ or bottom half).
   unfreeze_fs: called when VFS is unlocking a filesystem and making it writable
         again.
 
-  statfs: called when the VFS needs to get filesystem statistics. This
-        is called with the kernel lock held
+  statfs: called when the VFS needs to get filesystem statistics.
 
   remount_fs: called when the filesystem is remounted. This is called
         with the kernel lock held
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index d4b05672f9f7..d76cfd8712e1 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -316,6 +316,16 @@ more details, with real examples.
                 #arch/m68k/fpsp040/Makefile
                 ldflags-y := -x
 
+    subdir-ccflags-y, subdir-asflags-y
+        The two flags listed above are similar to ccflags-y and as-falgs-y.
+        The difference is that the subdir- variants has effect for the kbuild
+        file where tey are present and all subdirectories.
+        Options specified using subdir-* are added to the commandline before
+        the options specified using the non-subdir variants.
+
+        Example:
+                subdir-ccflags-y := -Werror
+
     CFLAGS_$@, AFLAGS_$@
 
         CFLAGS_$@ and AFLAGS_$@ only apply to commands in current
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index a19f021f081a..600cdd72900c 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -231,6 +231,35 @@ and is between 256 and 4096 characters. It is defined in the file
                         power state again in power transition.
                         1 : disable the power state check
 
+        acpi_sci=       [HW,ACPI] ACPI System Control Interrupt trigger mode
+                        Format: { level | edge | high | low }
+
+        acpi_serialize  [HW,ACPI] force serialization of AML methods
+
+        acpi_skip_timer_override [HW,ACPI]
+                        Recognize and ignore IRQ0/pin2 Interrupt Override.
+                        For broken nForce2 BIOS resulting in XT-PIC timer.
+
+        acpi_sleep=     [HW,ACPI] Sleep options
+                        Format: { s3_bios, s3_mode, s3_beep, s4_nohwsig,
+                                  old_ordering, s4_nonvs }
+                        See Documentation/power/video.txt for information on
+                        s3_bios and s3_mode.
+                        s3_beep is for debugging; it makes the PC's speaker beep
+                        as soon as the kernel's real-mode entry point is called.
+                        s4_nohwsig prevents ACPI hardware signature from being
+                        used during resume from hibernation.
+                        old_ordering causes the ACPI 1.0 ordering of the _PTS
+                        control method, with respect to putting devices into
+                        low power states, to be enforced (the ACPI 2.0 ordering
+                        of _PTS is used by default).
+                        s4_nonvs prevents the kernel from saving/restoring the
+                        ACPI NVS memory during hibernation.
+
+        acpi_use_timer_override [HW,ACPI]
+                        Use timer override. For some broken Nvidia NF5 boards
+                        that require a timer override, but don't have HPET
+
         acpi_enforce_resources= [ACPI]
                         { strict | lax | no }
                         Check for resource conflicts between native drivers
@@ -250,6 +279,9 @@ and is between 256 and 4096 characters. It is defined in the file
         ad1848=         [HW,OSS]
                         Format: <io>,<irq>,<dma>,<dma2>,<type>
 
+        add_efi_memmap  [EFI; X86] Include EFI memory map in
+                        kernel's map of available physical RAM.
+
         advansys=       [HW,SCSI]
                         See header of drivers/scsi/advansys.c.
 
@@ -1838,6 +1870,12 @@ and is between 256 and 4096 characters. It is defined in the file
                         autoconfiguration.
                         Ranges are in pairs (memory base and size).
 
+        ports=          [IP_VS_FTP] IPVS ftp helper module
+                        Default is 21.
+                        Up to 8 (IP_VS_APP_MAX_PORTS) ports
+                        may be specified.
+                        Format: <port>,<port>....
+
         print-fatal-signals=
                         [KNL] debug: print fatal signals
                         print-fatal-signals=1: print segfault info to
diff --git a/Documentation/lguest/.gitignore b/Documentation/lguest/.gitignore
new file mode 100644
index 000000000000..115587fd5f65
--- /dev/null
+++ b/Documentation/lguest/.gitignore
@@ -0,0 +1 @@
+lguest
diff --git a/Documentation/lguest/lguest.txt b/Documentation/lguest/lguest.txt
index 29510dc51510..28c747362f95 100644
--- a/Documentation/lguest/lguest.txt
+++ b/Documentation/lguest/lguest.txt
@@ -3,11 +3,11 @@
  /,    /`      - or, A Young Coder's Illustrated Hypervisor
  \\"--\\    http://lguest.ozlabs.org
 
-Lguest is designed to be a minimal hypervisor for the Linux kernel, for
-Linux developers and users to experiment with virtualization with the
-minimum of complexity.  Nonetheless, it should have sufficient
-features to make it useful for specific tasks, and, of course, you are
-encouraged to fork and enhance it (see drivers/lguest/README).
+Lguest is designed to be a minimal 32-bit x86 hypervisor for the Linux kernel,
+for Linux developers and users to experiment with virtualization with the
+minimum of complexity.  Nonetheless, it should have sufficient features to
+make it useful for specific tasks, and, of course, you are encouraged to fork
+and enhance it (see drivers/lguest/README).
 
 Features:
 
@@ -37,6 +37,7 @@ Running Lguest:
      "Paravirtualized guest support" = Y
         "Lguest guest support" = Y
      "High Memory Support" = off/4GB
+     "PAE (Physical Address Extension) Support" = N
      "Alignment value to which kernel should be aligned" = 0x100000
         (CONFIG_PARAVIRT=y, CONFIG_LGUEST_GUEST=y, CONFIG_HIGHMEM64G=n and
          CONFIG_PHYSICAL_ALIGN=0x100000)
diff --git a/Documentation/spi/spi-summary b/Documentation/spi/spi-summary
index 0f5122eb282b..4a02d2508bc8 100644
--- a/Documentation/spi/spi-summary
+++ b/Documentation/spi/spi-summary
@@ -511,10 +511,16 @@ SPI MASTER METHODS
         This sets up the device clock rate, SPI mode, and word sizes.
         Drivers may change the defaults provided by board_info, and then
         call spi_setup(spi) to invoke this routine.  It may sleep.
+
         Unless each SPI slave has its own configuration registers, don't
         change them right away ... otherwise drivers could corrupt I/O
         that's in progress for other SPI devices.
 
+                ** BUG ALERT:  for some reason the first version of
+                ** many spi_master drivers seems to get this wrong.
+                ** When you code setup(), ASSUME that the controller
+                ** is actively processing transfers for another device.
+
     master->transfer(struct spi_device *spi, struct spi_message *message)
         This must not sleep.  Its responsibility is arrange that the
         transfer happens and its complete() callback is issued.  The two
diff --git a/MAINTAINERS b/MAINTAINERS
index 0beac8a7f8f2..cb9571042f21 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1287,6 +1287,14 @@ S:	Maintained
 F:      Documentation/video4linux/bttv/
 F:      drivers/media/video/bt8xx/bttv*
 
+CACHEFILES: FS-CACHE BACKEND FOR CACHING ON MOUNTED FILESYSTEMS
+P:      David Howells
+M:      dhowells@redhat.com
+L:      linux-cachefs@redhat.com
+S:      Supported
+F:      Documentation/filesystems/caching/cachefiles.txt
+F:      fs/cachefiles/
+
 CAFE CMOS INTEGRATED CAMERA CONTROLLER DRIVER
 P:      Jonathan Corbet
 M:      corbet@lwn.net
@@ -2057,6 +2065,8 @@ F:	drivers/infiniband/hw/ehca/
 EMBEDDED LINUX
 P:      Paul Gortmaker
 M:      paul.gortmaker@windriver.com
+P:      Matt Mackall
+M:      mpm@selenic.com
 P:      David Woodhouse
 M:      dwmw2@infradead.org
 L:      linux-embedded@vger.kernel.org
@@ -2325,6 +2335,15 @@ F:	Documentation/power/freezing-of-tasks.txt
 F:      include/linux/freezer.h
 F:      kernel/freezer.c
 
+FS-CACHE: LOCAL CACHING FOR NETWORK FILESYSTEMS
+P:      David Howells
+M:      dhowells@redhat.com
+L:      linux-cachefs@redhat.com
+S:      Supported
+F:      Documentation/filesystems/caching/
+F:      fs/fscache/
+F:      include/linux/fscache*.h
+
 FTRACE
 P:      Steven Rostedt
 M:      rostedt@goodmis.org
@@ -2545,7 +2564,6 @@ F:	kernel/power/
 F:      include/linux/suspend.h
 F:      include/linux/freezer.h
 F:      include/linux/pm.h
-F:      include/asm-*/suspend*.h
 F:      arch/*/include/asm/suspend*.h
 
 HID CORE LAYER
@@ -3323,7 +3341,7 @@ P:	Eduard - Gabriel Munteanu
 M:      eduard.munteanu@linux360.ro
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
-F:      Documentation/vm/kmemtrace.txt
+F:      Documentation/trace/kmemtrace.txt
 F:      include/trace/kmemtrace.h
 F:      kernel/trace/kmemtrace.c
 
@@ -5235,7 +5253,12 @@ M:	perex@perex.cz
 P:      Takashi Iwai
 M:      tiwai@suse.de
 L:      alsa-devel@alsa-project.org (subscribers-only)
+W:      http://www.alsa-project.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6.git
+T:      git git://git.alsa-project.org/alsa-kernel.git
 S:      Maintained
+F:      Documentation/sound/
+F:      include/sound/
 F:      sound/
 
 SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
@@ -5382,7 +5405,6 @@ F:	kernel/power/
 F:      include/linux/suspend.h
 F:      include/linux/freezer.h
 F:      include/linux/pm.h
-F:      include/asm-*/suspend.h
 
 SVGA HANDLING
 P:      Martin Mares
@@ -5616,7 +5638,7 @@ L:	uclinux-dev@uclinux.org  (subscribers-only)
 S:      Maintained
 F:      arch/m68knommu/
 
-UCLINUX FOR RENESAS H8/300
+UCLINUX FOR RENESAS H8/300 (H8300)
 P:      Yoshinori Sato
 M:      ysato@users.sourceforge.jp
 W:      http://uclinux-h8.sourceforge.jp/
diff --git a/Makefile b/Makefile
index bfdef56add34..6f4208ff2d10 100644
--- a/Makefile
+++ b/Makefile
@@ -1200,7 +1200,7 @@ CLEAN_FILES +=	vmlinux System.map \
                 .tmp_kallsyms* .tmp_version .tmp_vmlinux* .tmp_System.map
 
 # Directories & files removed with 'make mrproper'
-MRPROPER_DIRS  += include/config include2 usr/include
+MRPROPER_DIRS  += include/config include2 usr/include include/generated
 MRPROPER_FILES += .config .config.old include/asm .version .old_version \
                   include/linux/autoconf.h include/linux/version.h      \
                   include/linux/utsrelease.h                            \
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index e04173c7e621..d59a0cd537f0 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -177,21 +177,12 @@ asmlinkage long sys_oabi_fstatat64(int dfd,
                                    int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
+        int error;
 
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-        error = cp_oldabi_stat64(&stat, statbuf);
-
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_oldabi_stat64(&stat, statbuf);
 }
 
 struct oabi_flock64 {
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index 1ff1bda0a894..309f3511aa20 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -85,7 +85,7 @@ static struct irqaction at91rm9200_timer_irq = {
         .handler        = at91rm9200_timer_interrupt
 };
 
-static cycle_t read_clk32k(void)
+static cycle_t read_clk32k(struct clocksource *cs)
 {
         return read_CRTR();
 }
diff --git a/arch/arm/mach-at91/at91sam926x_time.c b/arch/arm/mach-at91/at91sam926x_time.c
index b63e1d5f1bad..4bd56aee4370 100644
--- a/arch/arm/mach-at91/at91sam926x_time.c
+++ b/arch/arm/mach-at91/at91sam926x_time.c
@@ -31,7 +31,7 @@ static u32 pit_cnt;		/* access only w/system irq blocked */
  * Clocksource:  just a monotonic counter of MCK/16 cycles.
  * We don't care whether or not PIT irqs are enabled.
  */
-static cycle_t read_pit_clk(void)
+static cycle_t read_pit_clk(struct clocksource *cs)
 {
         unsigned long flags;
         u32 elapsed;
diff --git a/arch/arm/mach-davinci/time.c b/arch/arm/mach-davinci/time.c
index f8bcd29d17a6..6c227d4ba998 100644
--- a/arch/arm/mach-davinci/time.c
+++ b/arch/arm/mach-davinci/time.c
@@ -238,7 +238,7 @@ static void __init timer_init(void)
 /*
  * clocksource
  */
-static cycle_t read_cycles(void)
+static cycle_t read_cycles(struct clocksource *cs)
 {
         struct timer_s *t = &timers[TID_CLOCKSOURCE];
 
diff --git a/arch/arm/mach-imx/time.c b/arch/arm/mach-imx/time.c
index aff0ebcfa847..5aef18b599e5 100644
--- a/arch/arm/mach-imx/time.c
+++ b/arch/arm/mach-imx/time.c
@@ -73,7 +73,7 @@ static void __init imx_timer_hardware_init(void)
         IMX_TCTL(TIMER_BASE) = TCTL_FRR | TCTL_CLK_PCLK1 | TCTL_TEN;
 }
 
-cycle_t imx_get_cycles(void)
+cycle_t imx_get_cycles(struct clocksource *cs)
 {
         return IMX_TCN(TIMER_BASE);
 }
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index f4656d2ac8a8..1e93dfee7543 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -401,7 +401,7 @@ void __init ixp4xx_sys_init(void)
 /*
  * clocksource
  */
-cycle_t ixp4xx_get_cycles(void)
+cycle_t ixp4xx_get_cycles(struct clocksource *cs)
 {
         return *IXP4XX_OSTS;
 }
diff --git a/arch/arm/mach-msm/timer.c b/arch/arm/mach-msm/timer.c
index 444d9c0f5ca6..4855b8ca5101 100644
--- a/arch/arm/mach-msm/timer.c
+++ b/arch/arm/mach-msm/timer.c
@@ -57,12 +57,12 @@ static irqreturn_t msm_timer_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static cycle_t msm_gpt_read(void)
+static cycle_t msm_gpt_read(struct clocksource *cs)
 {
         return readl(MSM_GPT_BASE + TIMER_COUNT_VAL);
 }
 
-static cycle_t msm_dgt_read(void)
+static cycle_t msm_dgt_read(struct clocksource *cs)
 {
         return readl(MSM_DGT_BASE + TIMER_COUNT_VAL) >> MSM_DGT_SHIFT;
 }
diff --git a/arch/arm/mach-netx/time.c b/arch/arm/mach-netx/time.c
index f201fddb594f..82801dbf0579 100644
--- a/arch/arm/mach-netx/time.c
+++ b/arch/arm/mach-netx/time.c
@@ -104,7 +104,7 @@ static struct irqaction netx_timer_irq = {
         .handler        = netx_timer_interrupt,
 };
 
-cycle_t netx_get_cycles(void)
+cycle_t netx_get_cycles(struct clocksource *cs)
 {
         return readl(NETX_GPIO_COUNTER_CURRENT(TIMER_CLOCKSOURCE));
 }
diff --git a/arch/arm/mach-ns9xxx/time-ns9360.c b/arch/arm/mach-ns9xxx/time-ns9360.c
index 41df69721769..77281260358a 100644
--- a/arch/arm/mach-ns9xxx/time-ns9360.c
+++ b/arch/arm/mach-ns9xxx/time-ns9360.c
@@ -25,7 +25,7 @@
 #define TIMER_CLOCKEVENT 1
 static u32 latch;
 
-static cycle_t ns9360_clocksource_read(void)
+static cycle_t ns9360_clocksource_read(struct clocksource *cs)
 {
         return __raw_readl(SYS_TR(TIMER_CLOCKSOURCE));
 }
diff --git a/arch/arm/mach-omap1/time.c b/arch/arm/mach-omap1/time.c
index 495a32c287b4..4d56408d3cff 100644
--- a/arch/arm/mach-omap1/time.c
+++ b/arch/arm/mach-omap1/time.c
@@ -198,7 +198,7 @@ static struct irqaction omap_mpu_timer2_irq = {
         .handler        = omap_mpu_timer2_interrupt,
 };
 
-static cycle_t mpu_read(void)
+static cycle_t mpu_read(struct clocksource *cs)
 {
         return ~omap_mpu_timer_read(1);
 }
diff --git a/arch/arm/mach-omap2/timer-gp.c b/arch/arm/mach-omap2/timer-gp.c
index 9fc13a2cc3f4..1cb2c0909c2b 100644
--- a/arch/arm/mach-omap2/timer-gp.c
+++ b/arch/arm/mach-omap2/timer-gp.c
@@ -138,7 +138,7 @@ static inline void __init omap2_gp_clocksource_init(void) {}
  * clocksource
  */
 static struct omap_dm_timer *gpt_clocksource;
-static cycle_t clocksource_read_cycles(void)
+static cycle_t clocksource_read_cycles(struct clocksource *cs)
 {
         return (cycle_t)omap_dm_timer_read_counter(gpt_clocksource);
 }
diff --git a/arch/arm/mach-pxa/time.c b/arch/arm/mach-pxa/time.c
index 8eb3830fbb0b..750c448db672 100644
--- a/arch/arm/mach-pxa/time.c
+++ b/arch/arm/mach-pxa/time.c
@@ -125,7 +125,7 @@ static struct clock_event_device ckevt_pxa_osmr0 = {
         .set_mode       = pxa_osmr0_set_mode,
 };
 
-static cycle_t pxa_read_oscr(void)
+static cycle_t pxa_read_oscr(struct clocksource *cs)
 {
         return OSCR;
 }
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index 9ab947c14f26..942e1a7eb9b2 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -715,7 +715,7 @@ static struct irqaction realview_timer_irq = {
         .handler        = realview_timer_interrupt,
 };
 
-static cycle_t realview_get_cycles(void)
+static cycle_t realview_get_cycles(struct clocksource *cs)
 {
         return ~readl(timer3_va_base + TIMER_VALUE);
 }
diff --git a/arch/arm/mach-versatile/core.c b/arch/arm/mach-versatile/core.c
index 565776680d8c..1f929c391af7 100644
--- a/arch/arm/mach-versatile/core.c
+++ b/arch/arm/mach-versatile/core.c
@@ -948,7 +948,7 @@ static struct irqaction versatile_timer_irq = {
         .handler        = versatile_timer_interrupt,
 };
 
-static cycle_t versatile_get_cycles(void)
+static cycle_t versatile_get_cycles(struct clocksource *cs)
 {
         return ~readl(TIMER3_VA_BASE + TIMER_VALUE);
 }
diff --git a/arch/arm/plat-mxc/time.c b/arch/arm/plat-mxc/time.c
index ef1b3cd85bd3..dab3357196fb 100644
--- a/arch/arm/plat-mxc/time.c
+++ b/arch/arm/plat-mxc/time.c
@@ -36,7 +36,7 @@ static enum clock_event_mode clockevent_mode = CLOCK_EVT_MODE_UNUSED;
 
 /* clock source */
 
-static cycle_t mxc_get_cycles(void)
+static cycle_t mxc_get_cycles(struct clocksource *cs)
 {
         return __raw_readl(TIMER_BASE + MXC_TCN);
 }
diff --git a/arch/arm/plat-omap/common.c b/arch/arm/plat-omap/common.c
index d1797147732f..433021f3d7cc 100644
--- a/arch/arm/plat-omap/common.c
+++ b/arch/arm/plat-omap/common.c
@@ -185,7 +185,7 @@ console_initcall(omap_add_serial_console);
 
 #include <linux/clocksource.h>
 
-static cycle_t omap_32k_read(void)
+static cycle_t omap_32k_read(struct clocksource *cs)
 {
         return omap_readl(TIMER_32K_SYNCHRONIZED);
 }
@@ -207,7 +207,7 @@ unsigned long long sched_clock(void)
 {
         unsigned long long ret;
 
-        ret = (unsigned long long)omap_32k_read();
+        ret = (unsigned long long)omap_32k_read(&clocksource_32k);
         ret = (ret * clocksource_32k.mult_orig) >> clocksource_32k.shift;
         return ret;
 }
diff --git a/arch/arm/plat-orion/time.c b/arch/arm/plat-orion/time.c
index 6fa2923e6dca..2faf9dba4ef7 100644
--- a/arch/arm/plat-orion/time.c
+++ b/arch/arm/plat-orion/time.c
@@ -41,7 +41,7 @@ static u32 ticks_per_jiffy;
 /*
  * Clocksource handling.
  */
-static cycle_t orion_clksrc_read(void)
+static cycle_t orion_clksrc_read(struct clocksource *cs)
 {
         return 0xffffffff - readl(TIMER0_VAL);
 }
diff --git a/arch/avr32/kernel/time.c b/arch/avr32/kernel/time.c
index 0ff46bf873b0..f27aa3b259fa 100644
--- a/arch/avr32/kernel/time.c
+++ b/arch/avr32/kernel/time.c
@@ -18,7 +18,7 @@
 #include <mach/pm.h>
 
 
-static cycle_t read_cycle_count(void)
+static cycle_t read_cycle_count(struct clocksource *cs)
 {
         return (cycle_t)sysreg_read(COUNT);
 }
diff --git a/arch/blackfin/kernel/time-ts.c b/arch/blackfin/kernel/time-ts.c
index 0ed2badfd746..27646121280a 100644
--- a/arch/blackfin/kernel/time-ts.c
+++ b/arch/blackfin/kernel/time-ts.c
@@ -58,16 +58,11 @@ static inline unsigned long long cycles_2_ns(cycle_t cyc)
         return (cyc * cyc2ns_scale) >> CYC2NS_SCALE_FACTOR;
 }
 
-static cycle_t read_cycles(void)
+static cycle_t read_cycles(struct clocksource *cs)
 {
         return __bfin_cycles_off + (get_cycles() << __bfin_cycles_mod);
 }
 
-unsigned long long sched_clock(void)
-{
-        return cycles_2_ns(read_cycles());
-}
-
 static struct clocksource clocksource_bfin = {
         .name           = "bfin_cycles",
         .rating         = 350,
@@ -77,6 +72,11 @@ static struct clocksource clocksource_bfin = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
+unsigned long long sched_clock(void)
+{
+        return cycles_2_ns(read_cycles(&clocksource_bfin));
+}
+
 static int __init bfin_clocksource_init(void)
 {
         set_cyc2ns_scale(get_cclk() / 1000);
diff --git a/arch/frv/kernel/setup.c b/arch/frv/kernel/setup.c
index 0669e1382383..55e4fab7c0bc 100644
--- a/arch/frv/kernel/setup.c
+++ b/arch/frv/kernel/setup.c
@@ -46,7 +46,6 @@
 #include <asm/io.h>
 
 #ifdef CONFIG_BLK_DEV_INITRD
-#include <linux/blk.h>
 #include <asm/pgtable.h>
 #endif
 
diff --git a/arch/frv/mb93090-mb00/pci-vdk.c b/arch/frv/mb93090-mb00/pci-vdk.c
index 0f41c3a72da5..c0dcec65c6b7 100644
--- a/arch/frv/mb93090-mb00/pci-vdk.c
+++ b/arch/frv/mb93090-mb00/pci-vdk.c
@@ -31,6 +31,29 @@ struct pci_bus *__nongpreldata pci_root_bus;
 struct pci_ops *__nongpreldata pci_root_ops;
 
 /*
+ * The accessible PCI window does not cover the entire CPU address space, but
+ * there are devices we want to access outside of that window, so we need to
+ * insert specific PCI bus resources instead of using the platform-level bus
+ * resources directly for the PCI root bus.
+ *
+ * These are configured and inserted by pcibios_init() and are attached to the
+ * root bus by pcibios_fixup_bus().
+ */
+static struct resource pci_ioport_resource = {
+        .name   = "PCI IO",
+        .start  = 0,
+        .end    = IO_SPACE_LIMIT,
+        .flags  = IORESOURCE_IO,
+};
+
+static struct resource pci_iomem_resource = {
+        .name   = "PCI mem",
+        .start  = 0,
+        .end    = -1,
+        .flags  = IORESOURCE_MEM,
+};
+
+/*
  * Functions for accessing PCI configuration space
  */
 
@@ -304,6 +327,12 @@ void __init pcibios_fixup_bus(struct pci_bus *bus)
 #if 0
         printk("### PCIBIOS_FIXUP_BUS(%d)\n",bus->number);
 #endif
+
+        if (bus->number == 0) {
+                bus->resource[0] = &pci_ioport_resource;
+                bus->resource[1] = &pci_iomem_resource;
+        }
+
         pci_read_bridge_bases(bus);
 
         if (bus->number == 0) {
@@ -350,28 +379,36 @@ int __init pcibios_init(void)
         /* enable PCI arbitration */
         __reg_MB86943_pci_arbiter       = MB86943_PCIARB_EN;
 
-        ioport_resource.start   = (__reg_MB86943_sl_pci_io_base << 9) & 0xfffffc00;
-        ioport_resource.end     = (__reg_MB86943_sl_pci_io_range << 9) | 0x3ff;
-        ioport_resource.end     += ioport_resource.start;
+        pci_ioport_resource.start       = (__reg_MB86943_sl_pci_io_base << 9) & 0xfffffc00;
+        pci_ioport_resource.end         = (__reg_MB86943_sl_pci_io_range << 9) | 0x3ff;
+        pci_ioport_resource.end         += pci_ioport_resource.start;
 
         printk("PCI IO window:  %08llx-%08llx\n",
-               (unsigned long long) ioport_resource.start,
-               (unsigned long long) ioport_resource.end);
+               (unsigned long long) pci_ioport_resource.start,
+               (unsigned long long) pci_ioport_resource.end);
 
-        iomem_resource.start    = (__reg_MB86943_sl_pci_mem_base << 9) & 0xfffffc00;
+        pci_iomem_resource.start        = (__reg_MB86943_sl_pci_mem_base << 9) & 0xfffffc00;
+        pci_iomem_resource.end          = (__reg_MB86943_sl_pci_mem_range << 9) | 0x3ff;
+        pci_iomem_resource.end          += pci_iomem_resource.start;
 
-        /* Reserve somewhere to write to flush posted writes. */
-        iomem_resource.start += 0x400;
-
-        iomem_resource.end      = (__reg_MB86943_sl_pci_mem_range << 9) | 0x3ff;
-        iomem_resource.end      += iomem_resource.start;
+        /* Reserve somewhere to write to flush posted writes.  This is used by
+         * __flush_PCI_writes() from asm/io.h to force the write FIFO in the
+         * CPU-PCI bridge to flush as this doesn't happen automatically when a
+         * read is performed on the MB93090 development kit motherboard.
+         */
+        pci_iomem_resource.start        += 0x400;
 
         printk("PCI MEM window: %08llx-%08llx\n",
-               (unsigned long long) iomem_resource.start,
-               (unsigned long long) iomem_resource.end);
+               (unsigned long long) pci_iomem_resource.start,
+               (unsigned long long) pci_iomem_resource.end);
         printk("PCI DMA memory: %08lx-%08lx\n",
                dma_coherent_mem_start, dma_coherent_mem_end);
 
+        if (insert_resource(&iomem_resource, &pci_iomem_resource) < 0)
+                panic("Unable to insert PCI IOMEM resource\n");
+        if (insert_resource(&ioport_resource, &pci_ioport_resource) < 0)
+                panic("Unable to insert PCI IOPORT resource\n");
+
         if (!pci_probe)
                 return -ENXIO;
 
diff --git a/arch/ia64/include/asm/paravirt_privop.h b/arch/ia64/include/asm/paravirt_privop.h
index 3d2951130b5f..8f6cb11c9fae 100644
--- a/arch/ia64/include/asm/paravirt_privop.h
+++ b/arch/ia64/include/asm/paravirt_privop.h
@@ -445,7 +445,6 @@ paravirt_set_rr0_to_rr4(unsigned long val0, unsigned long val1,
                 register unsigned long ia64_intri_res asm ("r8");       \
                 register unsigned long __reg asm ("r8") = (reg);        \
                                                                         \
-                BUILD_BUG_ON(!__builtin_constant_p(reg));               \
                 asm volatile (paravirt_alt_bundle(__PARAVIRT_BR,        \
                                                   PARAVIRT_TYPE(GETREG) \
                                                   + (reg))              \
@@ -464,7 +463,6 @@ paravirt_set_rr0_to_rr4(unsigned long val0, unsigned long val1,
                 register unsigned long ia64_clobber1 asm ("r8");        \
                 register unsigned long ia64_clobber2 asm ("r9");        \
                                                                         \
-                BUILD_BUG_ON(!__builtin_constant_p(reg));               \
                 asm volatile (paravirt_alt_bundle(__PARAVIRT_BR,        \
                                                   PARAVIRT_TYPE(SETREG) \
                                                   + (reg))              \
diff --git a/arch/ia64/kernel/cyclone.c b/arch/ia64/kernel/cyclone.c
index 790ef0d87e12..71e35864d2e2 100644
--- a/arch/ia64/kernel/cyclone.c
+++ b/arch/ia64/kernel/cyclone.c
@@ -21,7 +21,7 @@ void __init cyclone_setup(void)
 
 static void __iomem *cyclone_mc;
 
-static cycle_t read_cyclone(void)
+static cycle_t read_cyclone(struct clocksource *cs)
 {
         return (cycle_t)readq((void __iomem *)cyclone_mc);
 }
diff --git a/arch/ia64/kernel/smp.c b/arch/ia64/kernel/smp.c
index 2ea4199d9c57..5230eaafd83f 100644
--- a/arch/ia64/kernel/smp.c
+++ b/arch/ia64/kernel/smp.c
@@ -225,6 +225,7 @@ smp_send_reschedule (int cpu)
 {
         platform_send_ipi(cpu, IA64_IPI_RESCHEDULE, IA64_IPI_DM_INT, 0);
 }
+EXPORT_SYMBOL_GPL(smp_send_reschedule);
 
 /*
  * Called with preemption disabled.
@@ -300,15 +301,12 @@ smp_flush_tlb_mm (struct mm_struct *mm)
                 return;
         }
 
+        smp_call_function_mask(mm->cpu_vm_mask,
+                (void (*)(void *))local_finish_flush_tlb_mm, mm, 1);
+        local_irq_disable();
+        local_finish_flush_tlb_mm(mm);
+        local_irq_enable();
         preempt_enable();
-        /*
-         * We could optimize this further by using mm->cpu_vm_mask to track which CPUs
-         * have been running in the address space.  It's not clear that this is worth the
-         * trouble though: to avoid races, we have to raise the IPI on the target CPU
-         * anyhow, and once a CPU is interrupted, the cost of local_flush_tlb_all() is
-         * rather trivial.
-         */
-        on_each_cpu((void (*)(void *))local_finish_flush_tlb_mm, mm, 1);
 }
 
 void arch_send_call_function_single_ipi(int cpu)
diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c
index 641c8b61c4f1..604c1a35db33 100644
--- a/arch/ia64/kernel/time.c
+++ b/arch/ia64/kernel/time.c
@@ -33,7 +33,7 @@
 
 #include "fsyscall_gtod_data.h"
 
-static cycle_t itc_get_cycles(void);
+static cycle_t itc_get_cycles(struct clocksource *cs);
 
 struct fsyscall_gtod_data_t fsyscall_gtod_data = {
         .lock = SEQLOCK_UNLOCKED,
@@ -383,7 +383,7 @@ ia64_init_itm (void)
         }
 }
 
-static cycle_t itc_get_cycles(void)
+static cycle_t itc_get_cycles(struct clocksource *cs)
 {
         u64 lcycle, now, ret;
 
diff --git a/arch/ia64/sn/kernel/sn2/timer.c b/arch/ia64/sn/kernel/sn2/timer.c
index cf67fc562054..21d6f09e3447 100644
--- a/arch/ia64/sn/kernel/sn2/timer.c
+++ b/arch/ia64/sn/kernel/sn2/timer.c
@@ -23,7 +23,7 @@
 
 extern unsigned long sn_rtc_cycles_per_second;
 
-static cycle_t read_sn2(void)
+static cycle_t read_sn2(struct clocksource *cs)
 {
         return (cycle_t)readq(RTC_COUNTER_ADDR);
 }
diff --git a/arch/m68knommu/platform/68328/timers.c b/arch/m68knommu/platform/68328/timers.c
index 6bafefa546e5..309f725995bf 100644
--- a/arch/m68knommu/platform/68328/timers.c
+++ b/arch/m68knommu/platform/68328/timers.c
@@ -75,7 +75,7 @@ static struct irqaction m68328_timer_irq = {
 
 /***************************************************************************/
 
-static cycle_t m68328_read_clk(void)
+static cycle_t m68328_read_clk(struct clocksource *cs)
 {
         unsigned long flags;
         u32 cycles;
diff --git a/arch/m68knommu/platform/coldfire/dma_timer.c b/arch/m68knommu/platform/coldfire/dma_timer.c
index 772578b1084f..a5f562823d7a 100644
--- a/arch/m68knommu/platform/coldfire/dma_timer.c
+++ b/arch/m68knommu/platform/coldfire/dma_timer.c
@@ -34,7 +34,7 @@
 #define DMA_DTMR_CLK_DIV_16     (2 << 1)
 #define DMA_DTMR_ENABLE         (1 << 0)
 
-static cycle_t cf_dt_get_cycles(void)
+static cycle_t cf_dt_get_cycles(struct clocksource *cs)
 {
         return __raw_readl(DTCN0);
 }
diff --git a/arch/m68knommu/platform/coldfire/pit.c b/arch/m68knommu/platform/coldfire/pit.c
index 2a12e7fa9748..61b96211f8ff 100644
--- a/arch/m68knommu/platform/coldfire/pit.c
+++ b/arch/m68knommu/platform/coldfire/pit.c
@@ -125,7 +125,7 @@ static struct irqaction pit_irq = {
 
 /***************************************************************************/
 
-static cycle_t pit_read_clk(void)
+static cycle_t pit_read_clk(struct clocksource *cs)
 {
         unsigned long flags;
         u32 cycles;
diff --git a/arch/m68knommu/platform/coldfire/timers.c b/arch/m68knommu/platform/coldfire/timers.c
index 454f25493491..1ba8a3731653 100644
--- a/arch/m68knommu/platform/coldfire/timers.c
+++ b/arch/m68knommu/platform/coldfire/timers.c
@@ -78,7 +78,7 @@ static struct irqaction mcftmr_timer_irq = {
 
 /***************************************************************************/
 
-static cycle_t mcftmr_read_clk(void)
+static cycle_t mcftmr_read_clk(struct clocksource *cs)
 {
         unsigned long flags;
         u32 cycles;
diff --git a/arch/mips/kernel/cevt-txx9.c b/arch/mips/kernel/cevt-txx9.c
index eccf7d6096bd..2e911e3da8d3 100644
--- a/arch/mips/kernel/cevt-txx9.c
+++ b/arch/mips/kernel/cevt-txx9.c
@@ -22,7 +22,7 @@
 
 static struct txx9_tmr_reg __iomem *txx9_cs_tmrptr;
 
-static cycle_t txx9_cs_read(void)
+static cycle_t txx9_cs_read(struct clocksource *cs)
 {
         return __raw_readl(&txx9_cs_tmrptr->trr);
 }
diff --git a/arch/mips/kernel/csrc-bcm1480.c b/arch/mips/kernel/csrc-bcm1480.c
index 868745e7184b..51489f8a825e 100644
--- a/arch/mips/kernel/csrc-bcm1480.c
+++ b/arch/mips/kernel/csrc-bcm1480.c
@@ -28,7 +28,7 @@
 
 #include <asm/sibyte/sb1250.h>
 
-static cycle_t bcm1480_hpt_read(void)
+static cycle_t bcm1480_hpt_read(struct clocksource *cs)
 {
         return (cycle_t) __raw_readq(IOADDR(A_SCD_ZBBUS_CYCLE_COUNT));
 }
diff --git a/arch/mips/kernel/csrc-ioasic.c b/arch/mips/kernel/csrc-ioasic.c
index 1d5f63cf8997..b551f48d3a07 100644
--- a/arch/mips/kernel/csrc-ioasic.c
+++ b/arch/mips/kernel/csrc-ioasic.c
@@ -25,7 +25,7 @@
 #include <asm/dec/ioasic.h>
 #include <asm/dec/ioasic_addrs.h>
 
-static cycle_t dec_ioasic_hpt_read(void)
+static cycle_t dec_ioasic_hpt_read(struct clocksource *cs)
 {
         return ioasic_read(IO_REG_FCTR);
 }
@@ -47,13 +47,13 @@ void __init dec_ioasic_clocksource_init(void)
         while (!ds1287_timer_state())
                 ;
 
-        start = dec_ioasic_hpt_read();
+        start = dec_ioasic_hpt_read(&clocksource_dec);
 
         while (i--)
                 while (!ds1287_timer_state())
                         ;
 
-        end = dec_ioasic_hpt_read();
+        end = dec_ioasic_hpt_read(&clocksource_dec);
 
         freq = (end - start) * 10;
         printk(KERN_INFO "I/O ASIC clock frequency %dHz\n", freq);
diff --git a/arch/mips/kernel/csrc-r4k.c b/arch/mips/kernel/csrc-r4k.c
index f1a2893931ed..e95a3cd48eea 100644
--- a/arch/mips/kernel/csrc-r4k.c
+++ b/arch/mips/kernel/csrc-r4k.c
@@ -10,7 +10,7 @@
 
 #include <asm/time.h>
 
-static cycle_t c0_hpt_read(void)
+static cycle_t c0_hpt_read(struct clocksource *cs)
 {
         return read_c0_count();
 }
diff --git a/arch/mips/kernel/csrc-sb1250.c b/arch/mips/kernel/csrc-sb1250.c
index 92212bbb8e45..d14d3d1907fa 100644
--- a/arch/mips/kernel/csrc-sb1250.c
+++ b/arch/mips/kernel/csrc-sb1250.c
@@ -33,7 +33,7 @@
  * The HPT is free running from SB1250_HPT_VALUE down to 0 then starts over
  * again.
  */
-static cycle_t sb1250_hpt_read(void)
+static cycle_t sb1250_hpt_read(struct clocksource *cs)
 {
         unsigned int count;
 
diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c
index 689719e34f08..ed20e7fe65e3 100644
--- a/arch/mips/kernel/i8253.c
+++ b/arch/mips/kernel/i8253.c
@@ -128,7 +128,7 @@ void __init setup_pit_timer(void)
  * to just read by itself. So use jiffies to emulate a free
  * running counter:
  */
-static cycle_t pit_read(void)
+static cycle_t pit_read(struct clocksource *cs)
 {
         unsigned long flags;
         int count;
diff --git a/arch/mips/nxp/pnx8550/common/time.c b/arch/mips/nxp/pnx8550/common/time.c
index cf293b279098..8df43e9e4d90 100644
--- a/arch/mips/nxp/pnx8550/common/time.c
+++ b/arch/mips/nxp/pnx8550/common/time.c
@@ -35,7 +35,7 @@
 
 static unsigned long cpj;
 
-static cycle_t hpt_read(void)
+static cycle_t hpt_read(struct clocksource *cs)
 {
         return read_c0_count2();
 }
diff --git a/arch/mips/sgi-ip27/ip27-timer.c b/arch/mips/sgi-ip27/ip27-timer.c
index f024057a35f8..f10a7cd64f7e 100644
--- a/arch/mips/sgi-ip27/ip27-timer.c
+++ b/arch/mips/sgi-ip27/ip27-timer.c
@@ -159,7 +159,7 @@ static void __init hub_rt_clock_event_global_init(void)
         setup_irq(irq, &hub_rt_irqaction);
 }
 
-static cycle_t hub_rt_read(void)
+static cycle_t hub_rt_read(struct clocksource *cs)
 {
         return REMOTE_HUB_L(cputonasid(0), PI_RT_COUNT);
 }
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 926ea864e34f..48571ac56fb7 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -77,7 +77,7 @@
 #include <linux/clockchips.h>
 #include <linux/clocksource.h>
 
-static cycle_t rtc_read(void);
+static cycle_t rtc_read(struct clocksource *);
 static struct clocksource clocksource_rtc = {
         .name         = "rtc",
         .rating       = 400,
@@ -88,7 +88,7 @@ static struct clocksource clocksource_rtc = {
         .read         = rtc_read,
 };
 
-static cycle_t timebase_read(void);
+static cycle_t timebase_read(struct clocksource *);
 static struct clocksource clocksource_timebase = {
         .name         = "timebase",
         .rating       = 400,
@@ -766,12 +766,12 @@ unsigned long read_persistent_clock(void)
 }
 
 /* clocksource code */
-static cycle_t rtc_read(void)
+static cycle_t rtc_read(struct clocksource *cs)
 {
         return (cycle_t)get_rtc();
 }
 
-static cycle_t timebase_read(void)
+static cycle_t timebase_read(struct clocksource *cs)
 {
         return (cycle_t)get_tb();
 }
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index 6cc87d8c8682..002c70d3cb75 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -702,20 +702,12 @@ asmlinkage long sys32_fstatat64(unsigned int dfd, char __user *filename,
                                 struct stat64_emu31 __user* statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_stat64(statbuf, &stat);
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_stat64(statbuf, &stat);
 }
 
 /*
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index 6ded50dfa75a..ef596d020573 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -201,7 +201,7 @@ unsigned long read_persistent_clock(void)
         return ts.tv_sec;
 }
 
-static cycle_t read_tod_clock(void)
+static cycle_t read_tod_clock(struct clocksource *cs)
 {
         return get_clock();
 }
diff --git a/arch/sh/kernel/sys_sh.c b/arch/sh/kernel/sys_sh.c
index 58dfc02c7af1..e3a7e36639ef 100644
--- a/arch/sh/kernel/sys_sh.c
+++ b/arch/sh/kernel/sys_sh.c
@@ -63,6 +63,15 @@ asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
         unsigned long prot, unsigned long flags,
         unsigned long fd, unsigned long pgoff)
 {
+        /*
+         * The shift for mmap2 is constant, regardless of PAGE_SIZE
+         * setting.
+         */
+        if (pgoff & ((1 << (PAGE_SHIFT - 12)) - 1))
+                return -EINVAL;
+
+        pgoff >>= PAGE_SHIFT - 12;
+
         return do_mmap2(addr, len, prot, flags, fd, pgoff);
 }
 
diff --git a/arch/sh/kernel/time_32.c b/arch/sh/kernel/time_32.c
index 04b8c6ab1667..c770413c3213 100644
--- a/arch/sh/kernel/time_32.c
+++ b/arch/sh/kernel/time_32.c
@@ -209,7 +209,7 @@ unsigned long long sched_clock(void)
         if (!clocksource_sh.rating)
                 return (unsigned long long)jiffies * (NSEC_PER_SEC / HZ);
 
-        cycles = clocksource_sh.read();
+        cycles = clocksource_sh.read(&clocksource_sh);
         return cyc2ns(&clocksource_sh, cycles);
 }
 #endif
diff --git a/arch/sh/kernel/timers/timer-tmu.c b/arch/sh/kernel/timers/timer-tmu.c
index c5d3396f5960..fe8d8930ccb6 100644
--- a/arch/sh/kernel/timers/timer-tmu.c
+++ b/arch/sh/kernel/timers/timer-tmu.c
@@ -81,7 +81,7 @@ static int tmu_timer_stop(void)
  */
 static int tmus_are_scaled;
 
-static cycle_t tmu_timer_read(void)
+static cycle_t tmu_timer_read(struct clocksource *cs)
 {
         return ((cycle_t)(~_tmu_read(TMU1)))<<tmus_are_scaled;
 }
diff --git a/arch/sparc/kernel/sys_sparc32.c b/arch/sparc/kernel/sys_sparc32.c
index e800503879e4..f5000a460c05 100644
--- a/arch/sparc/kernel/sys_sparc32.c
+++ b/arch/sparc/kernel/sys_sparc32.c
@@ -206,21 +206,12 @@ asmlinkage long compat_sys_fstatat64(unsigned int dfd, char __user *filename,
                 struct compat_stat64 __user * statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_compat_stat64(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_compat_stat64(&stat, statbuf);
 }
 
 asmlinkage long compat_sys_sysfs(int option, u32 arg1, u32 arg2)
diff --git a/arch/sparc/kernel/time_64.c b/arch/sparc/kernel/time_64.c
index db310aa00183..5c12e79b4bdf 100644
--- a/arch/sparc/kernel/time_64.c
+++ b/arch/sparc/kernel/time_64.c
@@ -814,6 +814,11 @@ void udelay(unsigned long usecs)
 }
 EXPORT_SYMBOL(udelay);
 
+static cycle_t clocksource_tick_read(struct clocksource *cs)
+{
+        return tick_ops->get_tick();
+}
+
 void __init time_init(void)
 {
         unsigned long freq = sparc64_init_timers();
@@ -827,7 +832,7 @@ void __init time_init(void)
         clocksource_tick.mult =
                 clocksource_hz2mult(freq,
                                     clocksource_tick.shift);
-        clocksource_tick.read = tick_ops->get_tick;
+        clocksource_tick.read = clocksource_tick_read;
 
         printk("clocksource: mult[%x] shift[%d]\n",
                clocksource_tick.mult, clocksource_tick.shift);
diff --git a/arch/um/Kconfig.rest b/arch/um/Kconfig.rest
index 7b5cea75a6c4..0ccad0ff6d6e 100644
--- a/arch/um/Kconfig.rest
+++ b/arch/um/Kconfig.rest
@@ -36,7 +36,7 @@ source "drivers/leds/Kconfig"
 
 #This is just to shut up some Kconfig warnings, so no prompt.
 config INPUT
-        bool
+        tristate
         default n
 
 source "arch/um/Kconfig.debug"
diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c
index b13a87a3ec95..c8b9c469fcd7 100644
--- a/arch/um/kernel/time.c
+++ b/arch/um/kernel/time.c
@@ -65,7 +65,7 @@ static irqreturn_t um_timer(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
-static cycle_t itimer_read(void)
+static cycle_t itimer_read(struct clocksource *cs)
 {
         return os_nsecs() / 1000;
 }
diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
index efac92fd1efb..085a8c35f149 100644
--- a/arch/x86/ia32/sys_ia32.c
+++ b/arch/x86/ia32/sys_ia32.c
@@ -129,21 +129,12 @@ asmlinkage long sys32_fstatat(unsigned int dfd, char __user *filename,
                               struct stat64 __user *statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
+        int error;
 
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_stat64(statbuf, &stat);
-
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_stat64(statbuf, &stat);
 }
 
 /*
diff --git a/arch/x86/include/asm/lguest_hcall.h b/arch/x86/include/asm/lguest_hcall.h
index 0f4ee7148afe..faae1996487b 100644
--- a/arch/x86/include/asm/lguest_hcall.h
+++ b/arch/x86/include/asm/lguest_hcall.h
@@ -5,7 +5,6 @@
 #define LHCALL_FLUSH_ASYNC      0
 #define LHCALL_LGUEST_INIT      1
 #define LHCALL_SHUTDOWN         2
-#define LHCALL_LOAD_GDT         3
 #define LHCALL_NEW_PGTABLE      4
 #define LHCALL_FLUSH_TLB        5
 #define LHCALL_LOAD_IDT_ENTRY   6
@@ -17,6 +16,7 @@
 #define LHCALL_SET_PMD          15
 #define LHCALL_LOAD_TLS         16
 #define LHCALL_NOTIFY           17
+#define LHCALL_LOAD_GDT_ENTRY   18
 
 #define LGUEST_TRAP_ENTRY 0x1F
 
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 648b3a2a3a44..3f0019e0a229 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -722,7 +722,7 @@ static int hpet_cpuhp_notify(struct notifier_block *n,
 /*
  * Clock source related code
  */
-static cycle_t read_hpet(void)
+static cycle_t read_hpet(struct clocksource *cs)
 {
         return (cycle_t)hpet_readl(HPET_COUNTER);
 }
@@ -756,7 +756,7 @@ static int hpet_clocksource_register(void)
         hpet_restart_counter();
 
         /* Verify whether hpet counter works */
-        t1 = read_hpet();
+        t1 = hpet_readl(HPET_COUNTER);
         rdtscll(start);
 
         /*
@@ -770,7 +770,7 @@ static int hpet_clocksource_register(void)
                 rdtscll(now);
         } while ((now - start) < 200000UL);
 
-        if (t1 == read_hpet()) {
+        if (t1 == hpet_readl(HPET_COUNTER)) {
                 printk(KERN_WARNING
                        "HPET counter not counting. HPET disabled\n");
                 return -ENODEV;
diff --git a/arch/x86/kernel/i8253.c b/arch/x86/kernel/i8253.c
index 3475440baa54..c2e0bb0890d4 100644
--- a/arch/x86/kernel/i8253.c
+++ b/arch/x86/kernel/i8253.c
@@ -129,7 +129,7 @@ void __init setup_pit_timer(void)
  * to just read by itself. So use jiffies to emulate a free
  * running counter:
  */
-static cycle_t pit_read(void)
+static cycle_t pit_read(struct clocksource *cs)
 {
         static int old_count;
         static u32 old_jifs;
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 137f2e8132df..223af43f1526 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -77,6 +77,11 @@ static cycle_t kvm_clock_read(void)
         return ret;
 }
 
+static cycle_t kvm_clock_get_cycles(struct clocksource *cs)
+{
+        return kvm_clock_read();
+}
+
 /*
  * If we don't do that, there is the possibility that the guest
  * will calibrate under heavy load - thus, getting a lower lpj -
@@ -107,7 +112,7 @@ static void kvm_get_preset_lpj(void)
 
 static struct clocksource kvm_clock = {
         .name = "kvm-clock",
-        .read = kvm_clock_read,
+        .read = kvm_clock_get_cycles,
         .rating = 400,
         .mask = CLOCKSOURCE_MASK(64),
         .mult = 1 << KVM_SCALE,
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 7a567ebe6361..d57de05dc430 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -699,7 +699,7 @@ static struct clocksource clocksource_tsc;
  * code, which is necessary to support wrapping clocksources like pm
  * timer.
  */
-static cycle_t read_tsc(void)
+static cycle_t read_tsc(struct clocksource *cs)
 {
         cycle_t ret = (cycle_t)get_cycles();
 
diff --git a/arch/x86/kernel/vmiclock_32.c b/arch/x86/kernel/vmiclock_32.c
index d303369a7bad..2b3eb82efeeb 100644
--- a/arch/x86/kernel/vmiclock_32.c
+++ b/arch/x86/kernel/vmiclock_32.c
@@ -283,7 +283,7 @@ void __devinit vmi_time_ap_init(void)
 /** vmi clocksource */
 static struct clocksource clocksource_vmi;
 
-static cycle_t read_real_cycles(void)
+static cycle_t read_real_cycles(struct clocksource *cs)
 {
         cycle_t ret = (cycle_t)vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL);
         return max(ret, clocksource_vmi.cycle_last);
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index e94a11e42f98..ca7ec44bafc3 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -273,15 +273,15 @@ static void lguest_load_idt(const struct desc_ptr *desc)
  * controls the entire thing and the Guest asks it to make changes using the
  * LOAD_GDT hypercall.
  *
- * This is the opposite of the IDT code where we have a LOAD_IDT_ENTRY
- * hypercall and use that repeatedly to load a new IDT.  I don't think it
- * really matters, but wouldn't it be nice if they were the same?  Wouldn't
- * it be even better if you were the one to send the patch to fix it?
+ * This is the exactly like the IDT code.
  */
 static void lguest_load_gdt(const struct desc_ptr *desc)
 {
-        BUG_ON((desc->size + 1) / 8 != GDT_ENTRIES);
-        kvm_hypercall2(LHCALL_LOAD_GDT, __pa(desc->address), GDT_ENTRIES);
+        unsigned int i;
+        struct desc_struct *gdt = (void *)desc->address;
+
+        for (i = 0; i < (desc->size+1)/8; i++)
+                kvm_hypercall3(LHCALL_LOAD_GDT_ENTRY, i, gdt[i].a, gdt[i].b);
 }
 
 /* For a single GDT entry which changes, we do the lazy thing: alter our GDT,
@@ -291,7 +291,9 @@ static void lguest_write_gdt_entry(struct desc_struct *dt, int entrynum,
                                    const void *desc, int type)
 {
         native_write_gdt_entry(dt, entrynum, desc, type);
-        kvm_hypercall2(LHCALL_LOAD_GDT, __pa(dt), GDT_ENTRIES);
+        /* Tell Host about this new entry. */
+        kvm_hypercall3(LHCALL_LOAD_GDT_ENTRY, entrynum,
+                       dt[entrynum].a, dt[entrynum].b);
 }
 
 /* OK, I lied.  There are three "thread local storage" GDT entries which change
@@ -661,7 +663,7 @@ static unsigned long lguest_tsc_khz(void)
 
 /* If we can't use the TSC, the kernel falls back to our lower-priority
  * "lguest_clock", where we read the time value given to us by the Host. */
-static cycle_t lguest_clock_read(void)
+static cycle_t lguest_clock_read(struct clocksource *cs)
 {
         unsigned long sec, nsec;
 
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 14f240623497..0a5aa44299a5 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -213,6 +213,11 @@ cycle_t xen_clocksource_read(void)
         return ret;
 }
 
+static cycle_t xen_clocksource_get_cycles(struct clocksource *cs)
+{
+        return xen_clocksource_read();
+}
+
 static void xen_read_wallclock(struct timespec *ts)
 {
         struct shared_info *s = HYPERVISOR_shared_info;
@@ -241,7 +246,7 @@ int xen_set_wallclock(unsigned long now)
 static struct clocksource xen_clocksource __read_mostly = {
         .name = "xen",
         .rating = 400,
-        .read = xen_clocksource_read,
+        .read = xen_clocksource_get_cycles,
         .mask = ~0,
         .mult = 1<<XEN_SHIFT,           /* time directly in nanoseconds */
         .shift = XEN_SHIFT,
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 779e4e500df4..d060e6fd7fd5 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -300,9 +300,9 @@ static int acpi_suspend_state_valid(suspend_state_t pm_state)
 static struct platform_suspend_ops acpi_suspend_ops = {
         .valid = acpi_suspend_state_valid,
         .begin = acpi_suspend_begin,
-        .prepare = acpi_pm_prepare,
+        .prepare_late = acpi_pm_prepare,
         .enter = acpi_suspend_enter,
-        .finish = acpi_pm_finish,
+        .wake = acpi_pm_finish,
         .end = acpi_pm_end,
 };
 
@@ -328,9 +328,9 @@ static int acpi_suspend_begin_old(suspend_state_t pm_state)
 static struct platform_suspend_ops acpi_suspend_ops_old = {
         .valid = acpi_suspend_state_valid,
         .begin = acpi_suspend_begin_old,
-        .prepare = acpi_pm_disable_gpes,
+        .prepare_late = acpi_pm_disable_gpes,
         .enter = acpi_suspend_enter,
-        .finish = acpi_pm_finish,
+        .wake = acpi_pm_finish,
         .end = acpi_pm_end,
         .recover = acpi_pm_finish,
 };
diff --git a/drivers/base/core.c b/drivers/base/core.c
index d230ff4b3eec..4aa527b8a913 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -891,7 +891,8 @@ int device_add(struct device *dev)
                 set_dev_node(dev, dev_to_node(parent));
 
         /* first, register with generic layer. */
-        error = kobject_add(&dev->kobj, dev->kobj.parent, "%s", dev_name(dev));
+        /* we require the name to be set before, and pass NULL */
+        error = kobject_add(&dev->kobj, dev->kobj.parent, NULL);
         if (error)
                 goto Error;
 
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 10d6cbd7c05e..2224b762b7fb 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -1226,7 +1226,7 @@ int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *m
         int i, ret = -ENOMEM;
 
         for (i = 0; i < num_pages; i++) {
-                page = alloc_page(GFP_KERNEL | GFP_DMA32);
+                page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
                 /* agp_free_memory() needs gart address */
                 if (page == NULL)
                         goto out;
@@ -1257,7 +1257,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 {
         struct page * page;
 
-        page = alloc_page(GFP_KERNEL | GFP_DMA32);
+        page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
         if (page == NULL)
                 return NULL;
 
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 50dfa3bc71ce..340ba4f9dc54 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -72,7 +72,7 @@ static u32 hpet_nhpet, hpet_max_freq = HPET_USER_FREQ;
 #ifdef CONFIG_IA64
 static void __iomem *hpet_mctr;
 
-static cycle_t read_hpet(void)
+static cycle_t read_hpet(struct clocksource *cs)
 {
         return (cycle_t)read_counter((void __iomem *)hpet_mctr);
 }
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index e93fc8d22fb2..aa83a0865ec1 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -285,6 +285,11 @@ enum ipmi_stat_indexes {
         /* Events that were received with the proper format. */
         IPMI_STAT_events,
 
+        /* Retransmissions on IPMB that failed. */
+        IPMI_STAT_dropped_rexmit_ipmb_commands,
+
+        /* Retransmissions on LAN that failed. */
+        IPMI_STAT_dropped_rexmit_lan_commands,
 
         /* This *must* remain last, add new values above this. */
         IPMI_NUM_STATS
@@ -445,6 +450,20 @@ static DEFINE_MUTEX(smi_watchers_mutex);
 #define ipmi_get_stat(intf, stat) \
         ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
 
+static int is_lan_addr(struct ipmi_addr *addr)
+{
+        return addr->addr_type == IPMI_LAN_ADDR_TYPE;
+}
+
+static int is_ipmb_addr(struct ipmi_addr *addr)
+{
+        return addr->addr_type == IPMI_IPMB_ADDR_TYPE;
+}
+
+static int is_ipmb_bcast_addr(struct ipmi_addr *addr)
+{
+        return addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE;
+}
 
 static void free_recv_msg_list(struct list_head *q)
 {
@@ -601,8 +620,7 @@ ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
                 return (smi_addr1->lun == smi_addr2->lun);
         }
 
-        if ((addr1->addr_type == IPMI_IPMB_ADDR_TYPE)
-            || (addr1->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
+        if (is_ipmb_addr(addr1) || is_ipmb_bcast_addr(addr1)) {
                 struct ipmi_ipmb_addr *ipmb_addr1
                     = (struct ipmi_ipmb_addr *) addr1;
                 struct ipmi_ipmb_addr *ipmb_addr2
@@ -612,7 +630,7 @@ ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2)
                         && (ipmb_addr1->lun == ipmb_addr2->lun));
         }
 
-        if (addr1->addr_type == IPMI_LAN_ADDR_TYPE) {
+        if (is_lan_addr(addr1)) {
                 struct ipmi_lan_addr *lan_addr1
                         = (struct ipmi_lan_addr *) addr1;
                 struct ipmi_lan_addr *lan_addr2
@@ -644,14 +662,13 @@ int ipmi_validate_addr(struct ipmi_addr *addr, int len)
             || (addr->channel < 0))
                 return -EINVAL;
 
-        if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
-            || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
+        if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
                 if (len < sizeof(struct ipmi_ipmb_addr))
                         return -EINVAL;
                 return 0;
         }
 
-        if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
+        if (is_lan_addr(addr)) {
                 if (len < sizeof(struct ipmi_lan_addr))
                         return -EINVAL;
                 return 0;
@@ -1503,8 +1520,7 @@ static int i_ipmi_request(ipmi_user_t          user,
                         memcpy(&(smi_msg->data[2]), msg->data, msg->data_len);
                 smi_msg->data_size = msg->data_len + 2;
                 ipmi_inc_stat(intf, sent_local_commands);
-        } else if ((addr->addr_type == IPMI_IPMB_ADDR_TYPE)
-                   || (addr->addr_type == IPMI_IPMB_BROADCAST_ADDR_TYPE)) {
+        } else if (is_ipmb_addr(addr) || is_ipmb_bcast_addr(addr)) {
                 struct ipmi_ipmb_addr *ipmb_addr;
                 unsigned char         ipmb_seq;
                 long                  seqid;
@@ -1583,8 +1599,6 @@ static int i_ipmi_request(ipmi_user_t          user,
 
                         spin_lock_irqsave(&(intf->seq_lock), flags);
 
-                        ipmi_inc_stat(intf, sent_ipmb_commands);
-
                         /*
                          * Create a sequence number with a 1 second
                          * timeout and 4 retries.
@@ -1606,6 +1620,8 @@ static int i_ipmi_request(ipmi_user_t          user,
                                 goto out_err;
                         }
 
+                        ipmi_inc_stat(intf, sent_ipmb_commands);
+
                         /*
                          * Store the sequence number in the message,
                          * so that when the send message response
@@ -1635,7 +1651,7 @@ static int i_ipmi_request(ipmi_user_t          user,
                          */
                         spin_unlock_irqrestore(&(intf->seq_lock), flags);
                 }
-        } else if (addr->addr_type == IPMI_LAN_ADDR_TYPE) {
+        } else if (is_lan_addr(addr)) {
                 struct ipmi_lan_addr  *lan_addr;
                 unsigned char         ipmb_seq;
                 long                  seqid;
@@ -1696,8 +1712,6 @@ static int i_ipmi_request(ipmi_user_t          user,
 
                         spin_lock_irqsave(&(intf->seq_lock), flags);
 
-                        ipmi_inc_stat(intf, sent_lan_commands);
-
                         /*
                          * Create a sequence number with a 1 second
                          * timeout and 4 retries.
@@ -1719,6 +1733,8 @@ static int i_ipmi_request(ipmi_user_t          user,
                                 goto out_err;
                         }
 
+                        ipmi_inc_stat(intf, sent_lan_commands);
+
                         /*
                          * Store the sequence number in the message,
                          * so that when the send message response
@@ -1937,6 +1953,10 @@ static int stat_file_read_proc(char *page, char **start, off_t off,
                        ipmi_get_stat(intf, invalid_events));
         out += sprintf(out, "events:                      %u\n",
                        ipmi_get_stat(intf, events));
+        out += sprintf(out, "failed rexmit LAN msgs:      %u\n",
+                       ipmi_get_stat(intf, dropped_rexmit_lan_commands));
+        out += sprintf(out, "failed rexmit IPMB msgs:     %u\n",
+                       ipmi_get_stat(intf, dropped_rexmit_ipmb_commands));
 
         return (out - ((char *) page));
 }
@@ -3264,6 +3284,114 @@ static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
         return rv;
 }
 
+/*
+ * This routine will handle "Get Message" command responses with
+ * channels that use an OEM Medium. The message format belongs to
+ * the OEM.  See IPMI 2.0 specification, Chapter 6 and
+ * Chapter 22, sections 22.6 and 22.24 for more details.
+ */
+static int handle_oem_get_msg_cmd(ipmi_smi_t          intf,
+                                  struct ipmi_smi_msg *msg)
+{
+        struct cmd_rcvr       *rcvr;
+        int                   rv = 0;
+        unsigned char         netfn;
+        unsigned char         cmd;
+        unsigned char         chan;
+        ipmi_user_t           user = NULL;
+        struct ipmi_system_interface_addr *smi_addr;
+        struct ipmi_recv_msg  *recv_msg;
+
+        /*
+         * We expect the OEM SW to perform error checking
+         * so we just do some basic sanity checks
+         */
+        if (msg->rsp_size < 4) {
+                /* Message not big enough, just ignore it. */
+                ipmi_inc_stat(intf, invalid_commands);
+                return 0;
+        }
+
+        if (msg->rsp[2] != 0) {
+                /* An error getting the response, just ignore it. */
+                return 0;
+        }
+
+        /*
+         * This is an OEM Message so the OEM needs to know how
+         * handle the message. We do no interpretation.
+         */
+        netfn = msg->rsp[0] >> 2;
+        cmd = msg->rsp[1];
+        chan = msg->rsp[3] & 0xf;
+
+        rcu_read_lock();
+        rcvr = find_cmd_rcvr(intf, netfn, cmd, chan);
+        if (rcvr) {
+                user = rcvr->user;
+                kref_get(&user->refcount);
+        } else
+                user = NULL;
+        rcu_read_unlock();
+
+        if (user == NULL) {
+                /* We didn't find a user, just give up. */
+                ipmi_inc_stat(intf, unhandled_commands);
+
+                /*
+                 * Don't do anything with these messages, just allow
+                 * them to be freed.
+                 */
+
+                rv = 0;
+        } else {
+                /* Deliver the message to the user. */
+                ipmi_inc_stat(intf, handled_commands);
+
+                recv_msg = ipmi_alloc_recv_msg();
+                if (!recv_msg) {
+                        /*
+                         * We couldn't allocate memory for the
+                         * message, so requeue it for handling
+                         * later.
+                         */
+                        rv = 1;
+                        kref_put(&user->refcount, free_user);
+                } else {
+                        /*
+                         * OEM Messages are expected to be delivered via
+                         * the system interface to SMS software.  We might
+                         * need to visit this again depending on OEM
+                         * requirements
+                         */
+                        smi_addr = ((struct ipmi_system_interface_addr *)
+                                    &(recv_msg->addr));
+                        smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
+                        smi_addr->channel = IPMI_BMC_CHANNEL;
+                        smi_addr->lun = msg->rsp[0] & 3;
+
+                        recv_msg->user = user;
+                        recv_msg->user_msg_data = NULL;
+                        recv_msg->recv_type = IPMI_OEM_RECV_TYPE;
+                        recv_msg->msg.netfn = msg->rsp[0] >> 2;
+                        recv_msg->msg.cmd = msg->rsp[1];
+                        recv_msg->msg.data = recv_msg->msg_data;
+
+                        /*
+                         * The message starts at byte 4 which follows the
+                         * the Channel Byte in the "GET MESSAGE" command
+                         */
+                        recv_msg->msg.data_len = msg->rsp_size - 4;
+                        memcpy(recv_msg->msg_data,
+                               &(msg->rsp[4]),
+                               msg->rsp_size - 4);
+                        deliver_response(recv_msg);
+                }
+        }
+
+        return rv;
+}
+
 static void copy_event_into_recv_msg(struct ipmi_recv_msg *recv_msg,
                                      struct ipmi_smi_msg  *msg)
 {
@@ -3519,6 +3647,17 @@ static int handle_new_recv_msg(ipmi_smi_t          intf,
                         goto out;
                 }
 
+                /*
+                ** We need to make sure the channels have been initialized.
+                ** The channel_handler routine will set the "curr_channel"
+                ** equal to or greater than IPMI_MAX_CHANNELS when all the
+                ** channels for this interface have been initialized.
+                */
+                if (intf->curr_channel < IPMI_MAX_CHANNELS) {
+                        requeue = 1;     /* Just put the message back for now */
+                        goto out;
+                }
+
                 switch (intf->channels[chan].medium) {
                 case IPMI_CHANNEL_MEDIUM_IPMB:
                         if (msg->rsp[4] & 0x04) {
@@ -3554,11 +3693,20 @@ static int handle_new_recv_msg(ipmi_smi_t          intf,
                         break;
 
                 default:
-                        /*
-                         * We don't handle the channel type, so just
-                         * free the message.
-                         */
-                        requeue = 0;
+                        /* Check for OEM Channels.  Clients had better
+                           register for these commands. */
+                        if ((intf->channels[chan].medium
+                             >= IPMI_CHANNEL_MEDIUM_OEM_MIN)
+                            && (intf->channels[chan].medium
+                                <= IPMI_CHANNEL_MEDIUM_OEM_MAX)) {
+                                requeue = handle_oem_get_msg_cmd(intf, msg);
+                        } else {
+                                /*
+                                 * We don't handle the channel type, so just
+                                 * free the message.
+                                 */
+                                requeue = 0;
+                        }
                 }
 
         } else if ((msg->rsp[0] == ((IPMI_NETFN_APP_REQUEST|1) << 2))
@@ -3730,7 +3878,7 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
                 list_add_tail(&msg->link, timeouts);
                 if (ent->broadcast)
                         ipmi_inc_stat(intf, timed_out_ipmb_broadcasts);
-                else if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
+                else if (is_lan_addr(&ent->recv_msg->addr))
                         ipmi_inc_stat(intf, timed_out_lan_commands);
                 else
                         ipmi_inc_stat(intf, timed_out_ipmb_commands);
@@ -3744,15 +3892,17 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
                  */
                 ent->timeout = MAX_MSG_TIMEOUT;
                 ent->retries_left--;
-                if (ent->recv_msg->addr.addr_type == IPMI_LAN_ADDR_TYPE)
-                        ipmi_inc_stat(intf, retransmitted_lan_commands);
-                else
-                        ipmi_inc_stat(intf, retransmitted_ipmb_commands);
-
                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
                                             ent->seqid);
-                if (!smi_msg)
+                if (!smi_msg) {
+                        if (is_lan_addr(&ent->recv_msg->addr))
+                                ipmi_inc_stat(intf,
+                                              dropped_rexmit_lan_commands);
+                        else
+                                ipmi_inc_stat(intf,
+                                              dropped_rexmit_ipmb_commands);
                         return;
+                }
 
                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
 
@@ -3764,10 +3914,17 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
                  * resent.
                  */
                 handlers = intf->handlers;
-                if (handlers)
+                if (handlers) {
+                        if (is_lan_addr(&ent->recv_msg->addr))
+                                ipmi_inc_stat(intf,
+                                              retransmitted_lan_commands);
+                        else
+                                ipmi_inc_stat(intf,
+                                              retransmitted_ipmb_commands);
+
                         intf->handlers->sender(intf->send_info,
                                                smi_msg, 0);
-                else
+                } else
                         ipmi_free_smi_msg(smi_msg);
 
                 spin_lock_irqsave(&intf->seq_lock, *flags);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index e58ea4cd55ce..259644646b82 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -82,12 +82,6 @@
 #define SI_SHORT_TIMEOUT_USEC  250 /* .25ms when the SM request a
                                       short timeout */
 
-/* Bit for BMC global enables. */
-#define IPMI_BMC_RCV_MSG_INTR     0x01
-#define IPMI_BMC_EVT_MSG_INTR     0x02
-#define IPMI_BMC_EVT_MSG_BUFF     0x04
-#define IPMI_BMC_SYS_LOG          0x08
-
 enum si_intf_state {
         SI_NORMAL,
         SI_GETTING_FLAGS,
@@ -220,6 +214,9 @@ struct smi_info {
                              OEM2_DATA_AVAIL)
         unsigned char       msg_flags;
 
+        /* Does the BMC have an event buffer? */
+        char                has_event_buffer;
+
         /*
          * If set to true, this will request events the next time the
          * state machine is idle.
@@ -968,7 +965,8 @@ static void request_events(void *send_info)
 {
         struct smi_info *smi_info = send_info;
 
-        if (atomic_read(&smi_info->stop_operation))
+        if (atomic_read(&smi_info->stop_operation) ||
+                                !smi_info->has_event_buffer)
                 return;
 
         atomic_set(&smi_info->req_events, 1);
@@ -2407,26 +2405,9 @@ static struct of_platform_driver ipmi_of_platform_driver = {
 };
 #endif /* CONFIG_PPC_OF */
 
-
-static int try_get_dev_id(struct smi_info *smi_info)
+static int wait_for_msg_done(struct smi_info *smi_info)
 {
-        unsigned char         msg[2];
-        unsigned char         *resp;
-        unsigned long         resp_len;
         enum si_sm_result     smi_result;
-        int                   rv = 0;
-
-        resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
-        if (!resp)
-                return -ENOMEM;
-
-        /*
-         * Do a Get Device ID command, since it comes back with some
-         * useful info.
-         */
-        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
-        msg[1] = IPMI_GET_DEVICE_ID_CMD;
-        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
 
         smi_result = smi_info->handlers->event(smi_info->si_sm, 0);
         for (;;) {
@@ -2441,16 +2422,39 @@ static int try_get_dev_id(struct smi_info *smi_info)
                 } else
                         break;
         }
-        if (smi_result == SI_SM_HOSED) {
+        if (smi_result == SI_SM_HOSED)
                 /*
                  * We couldn't get the state machine to run, so whatever's at
                  * the port is probably not an IPMI SMI interface.
                  */
-                rv = -ENODEV;
+                return -ENODEV;
+
+        return 0;
+}
+
+static int try_get_dev_id(struct smi_info *smi_info)
+{
+        unsigned char         msg[2];
+        unsigned char         *resp;
+        unsigned long         resp_len;
+        int                   rv = 0;
+
+        resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
+        if (!resp)
+                return -ENOMEM;
+
+        /*
+         * Do a Get Device ID command, since it comes back with some
+         * useful info.
+         */
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_GET_DEVICE_ID_CMD;
+        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+
+        rv = wait_for_msg_done(smi_info);
+        if (rv)
                 goto out;
-        }
 
-        /* Otherwise, we got some data. */
         resp_len = smi_info->handlers->get_result(smi_info->si_sm,
                                                   resp, IPMI_MAX_MSG_LENGTH);
 
@@ -2462,6 +2466,88 @@ static int try_get_dev_id(struct smi_info *smi_info)
         return rv;
 }
 
+static int try_enable_event_buffer(struct smi_info *smi_info)
+{
+        unsigned char         msg[3];
+        unsigned char         *resp;
+        unsigned long         resp_len;
+        int                   rv = 0;
+
+        resp = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
+        if (!resp)
+                return -ENOMEM;
+
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
+        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+
+        rv = wait_for_msg_done(smi_info);
+        if (rv) {
+                printk(KERN_WARNING
+                       "ipmi_si: Error getting response from get global,"
+                       " enables command, the event buffer is not"
+                       " enabled.\n");
+                goto out;
+        }
+
+        resp_len = smi_info->handlers->get_result(smi_info->si_sm,
+                                                  resp, IPMI_MAX_MSG_LENGTH);
+
+        if (resp_len < 4 ||
+                        resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
+                        resp[1] != IPMI_GET_BMC_GLOBAL_ENABLES_CMD   ||
+                        resp[2] != 0) {
+                printk(KERN_WARNING
+                       "ipmi_si: Invalid return from get global"
+                       " enables command, cannot enable the event"
+                       " buffer.\n");
+                rv = -EINVAL;
+                goto out;
+        }
+
+        if (resp[3] & IPMI_BMC_EVT_MSG_BUFF)
+                /* buffer is already enabled, nothing to do. */
+                goto out;
+
+        msg[0] = IPMI_NETFN_APP_REQUEST << 2;
+        msg[1] = IPMI_SET_BMC_GLOBAL_ENABLES_CMD;
+        msg[2] = resp[3] | IPMI_BMC_EVT_MSG_BUFF;
+        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
+
+        rv = wait_for_msg_done(smi_info);
+        if (rv) {
+                printk(KERN_WARNING
+                       "ipmi_si: Error getting response from set global,"
+                       " enables command, the event buffer is not"
+                       " enabled.\n");
+                goto out;
+        }
+
+        resp_len = smi_info->handlers->get_result(smi_info->si_sm,
+                                                  resp, IPMI_MAX_MSG_LENGTH);
+
+        if (resp_len < 3 ||
+                        resp[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 ||
+                        resp[1] != IPMI_SET_BMC_GLOBAL_ENABLES_CMD) {
+                printk(KERN_WARNING
+                       "ipmi_si: Invalid return from get global,"
+                       "enables command, not enable the event"
+                       " buffer.\n");
+                rv = -EINVAL;
+                goto out;
+        }
+
+        if (resp[2] != 0)
+                /*
+                 * An error when setting the event buffer bit means
+                 * that the event buffer is not supported.
+                 */
+                rv = -ENOENT;
+ out:
+        kfree(resp);
+        return rv;
+}
+
 static int type_file_read_proc(char *page, char **start, off_t off,
                                int count, int *eof, void *data)
 {
@@ -2847,6 +2933,10 @@ static int try_smi_init(struct smi_info *new_smi)
         new_smi->intf_num = smi_num;
         smi_num++;
 
+        rv = try_enable_event_buffer(new_smi);
+        if (rv == 0)
+                new_smi->has_event_buffer = 1;
+
         /*
          * Start clearing the flags before we enable interrupts or the
          * timer to avoid racing with the timer.
@@ -2863,7 +2953,7 @@ static int try_smi_init(struct smi_info *new_smi)
                  */
                 new_smi->pdev = platform_device_alloc("ipmi_si",
                                                       new_smi->intf_num);
-                if (rv) {
+                if (!new_smi->pdev) {
                         printk(KERN_ERR
                                "ipmi_si_intf:"
                                " Unable to allocate platform device\n");
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 2c1d133819b5..08151d4de489 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2274,7 +2274,7 @@ rescan_last_byte:
                                     continue; /* nothing to display */
                                 }
                                 /* Glyph not found */
-                                if ((!(vc->vc_utf && !vc->vc_disp_ctrl) && c < 128) && !(c & ~charmask)) {
+                                if ((!(vc->vc_utf && !vc->vc_disp_ctrl) || c < 128) && !(c & ~charmask)) {
                                     /* In legacy mode use the glyph we get by a 1:1 mapping.
                                        This would make absolutely no sense with Unicode in mind,
                                        but do this for ASCII characters since a font may lack
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index ee19b6e8fcb4..40bd8c61c7d7 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -57,7 +57,7 @@ u32 acpi_pm_read_verified(void)
         return v2;
 }
 
-static cycle_t acpi_pm_read(void)
+static cycle_t acpi_pm_read(struct clocksource *cs)
 {
         return (cycle_t)read_pmtmr();
 }
@@ -83,7 +83,7 @@ static int __init acpi_pm_good_setup(char *__str)
 }
 __setup("acpi_pm_good", acpi_pm_good_setup);
 
-static cycle_t acpi_pm_read_slow(void)
+static cycle_t acpi_pm_read_slow(struct clocksource *cs)
 {
         return (cycle_t)acpi_pm_read_verified();
 }
@@ -156,9 +156,9 @@ static int verify_pmtmr_rate(void)
         unsigned long count, delta;
 
         mach_prepare_counter();
-        value1 = clocksource_acpi_pm.read();
+        value1 = clocksource_acpi_pm.read(&clocksource_acpi_pm);
         mach_countup(&count);
-        value2 = clocksource_acpi_pm.read();
+        value2 = clocksource_acpi_pm.read(&clocksource_acpi_pm);
         delta = (value2 - value1) & ACPI_PM_MASK;
 
         /* Check that the PMTMR delta is within 5% of what we expect */
@@ -195,9 +195,9 @@ static int __init init_acpi_pm_clocksource(void)
         /* "verify" this timing source: */
         for (j = 0; j < ACPI_PM_MONOTONICITY_CHECKS; j++) {
                 udelay(100 * j);
-                value1 = clocksource_acpi_pm.read();
+                value1 = clocksource_acpi_pm.read(&clocksource_acpi_pm);
                 for (i = 0; i < ACPI_PM_READ_CHECKS; i++) {
-                        value2 = clocksource_acpi_pm.read();
+                        value2 = clocksource_acpi_pm.read(&clocksource_acpi_pm);
                         if (value2 == value1)
                                 continue;
                         if (value2 > value1)
diff --git a/drivers/clocksource/cyclone.c b/drivers/clocksource/cyclone.c
index 8615059a8729..64e528e8bfa6 100644
--- a/drivers/clocksource/cyclone.c
+++ b/drivers/clocksource/cyclone.c
@@ -19,7 +19,7 @@
 int use_cyclone = 0;
 static void __iomem *cyclone_ptr;
 
-static cycle_t read_cyclone(void)
+static cycle_t read_cyclone(struct clocksource *cs)
 {
         return (cycle_t)readl(cyclone_ptr);
 }
diff --git a/drivers/clocksource/scx200_hrt.c b/drivers/clocksource/scx200_hrt.c
index b92da677aa5d..27f4d9637b62 100644
--- a/drivers/clocksource/scx200_hrt.c
+++ b/drivers/clocksource/scx200_hrt.c
@@ -43,7 +43,7 @@ MODULE_PARM_DESC(ppm, "+-adjust to actual XO freq (ppm)");
 /* The base timer frequency, * 27 if selected */
 #define HRT_FREQ   1000000
 
-static cycle_t read_hrt(void)
+static cycle_t read_hrt(struct clocksource *cs)
 {
         /* Read the timer value */
         return (cycle_t) inl(scx200_cb_base + SCx200_TIMER_OFFSET);
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 254f1064d973..01b886e68822 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -39,7 +39,7 @@
 
 static void __iomem *tcaddr;
 
-static cycle_t tc_get_cycles(void)
+static cycle_t tc_get_cycles(struct clocksource *cs)
 {
         unsigned long   flags;
         u32             lower, upper;
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index 4637a4a757df..7c8c2d72916f 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -674,7 +674,7 @@ static void mpc85xx_mc_check(struct mem_ctl_info *mci)
         int row_index;
 
         err_detect = in_be32(pdata->mc_vbase + MPC85XX_MC_ERR_DETECT);
-        if (err_detect)
+        if (!err_detect)
                 return;
 
         mpc85xx_mc_printk(mci, KERN_ERR, "Err Detect Register: %#8.8x\n",
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index d009661781bc..ef878615c49f 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -159,6 +159,9 @@ void drm_master_put(struct drm_master **master)
 int drm_setmaster_ioctl(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
+        if (file_priv->is_master)
+                return 0;
+
         if (file_priv->minor->master && file_priv->minor->master != file_priv->master)
                 return -EINVAL;
 
@@ -169,6 +172,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
             file_priv->minor->master != file_priv->master) {
                 mutex_lock(&dev->struct_mutex);
                 file_priv->minor->master = drm_master_get(file_priv->master);
+                file_priv->is_master = 1;
                 mutex_unlock(&dev->struct_mutex);
         }
 
@@ -178,10 +182,15 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
 int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *file_priv)
 {
-        if (!file_priv->master)
+        if (!file_priv->is_master)
                 return -EINVAL;
+
+        if (!file_priv->minor->master)
+                return -EINVAL;
+
         mutex_lock(&dev->struct_mutex);
         drm_master_put(&file_priv->minor->master);
+        file_priv->is_master = 0;
         mutex_unlock(&dev->struct_mutex);
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index bc0c6849360c..022876ae34f0 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -132,6 +132,7 @@ void drm_sysfs_destroy(void)
  */
 static void drm_sysfs_device_release(struct device *dev)
 {
+        memset(dev, 0, sizeof(struct device));
         return;
 }
 
diff --git a/drivers/gpu/drm/via/via_dma.c b/drivers/gpu/drm/via/via_dma.c
index 7a339dba6a69..bfb92d283260 100644
--- a/drivers/gpu/drm/via/via_dma.c
+++ b/drivers/gpu/drm/via/via_dma.c
@@ -481,11 +481,13 @@ static int via_wait_idle(drm_via_private_t * dev_priv)
 {
         int count = 10000000;
 
-        while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && count--);
+        while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && --count)
+                ;
 
-        while (count-- && (VIA_READ(VIA_REG_STATUS) &
+        while (count && (VIA_READ(VIA_REG_STATUS) &
                            (VIA_CMD_RGTR_BUSY | VIA_2D_ENG_BUSY |
-                            VIA_3D_ENG_BUSY))) ;
+                            VIA_3D_ENG_BUSY)))
+                --count;
         return count;
 }
 
@@ -705,7 +707,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file *
         switch (d_siz->func) {
         case VIA_CMDBUF_SPACE:
                 while (((tmp_size = via_cmdbuf_space(dev_priv)) < d_siz->size)
-                       && count--) {
+                       && --count) {
                         if (!d_siz->wait) {
                                 break;
                         }
@@ -717,7 +719,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file *
                 break;
         case VIA_CMDBUF_LAG:
                 while (((tmp_size = via_cmdbuf_lag(dev_priv)) > d_siz->size)
-                       && count--) {
+                       && --count) {
                         if (!d_siz->wait) {
                                 break;
                         }
diff --git a/drivers/ide/cs5536.c b/drivers/ide/cs5536.c
index 353a35bbba63..0332a95eefd4 100644
--- a/drivers/ide/cs5536.c
+++ b/drivers/ide/cs5536.c
@@ -236,6 +236,7 @@ static const struct ide_dma_ops cs5536_dma_ops = {
         .dma_test_irq           = ide_dma_test_irq,
         .dma_lost_irq           = ide_dma_lost_irq,
         .dma_timer_expiry       = ide_dma_sff_timer_expiry,
+        .dma_sff_read_status    = ide_dma_sff_read_status,
 };
 
 static const struct ide_port_info cs5536_info = {
diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
index a0eb87f59134..0feb66c720e1 100644
--- a/drivers/ide/hpt366.c
+++ b/drivers/ide/hpt366.c
@@ -3,7 +3,7 @@
  * Portions Copyright (C) 2001          Sun Microsystems, Inc.
  * Portions Copyright (C) 2003          Red Hat Inc
  * Portions Copyright (C) 2007          Bartlomiej Zolnierkiewicz
- * Portions Copyright (C) 2005-2008     MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2009     MontaVista Software, Inc.
  *
  * Thanks to HighPoint Technologies for their assistance, and hardware.
  * Special Thanks to Jon Burchmore in SanDiego for the deep pockets, his
@@ -114,6 +114,8 @@
  *   the register setting lists into the table indexed by the clock selected
  * - set the correct hwif->ultra_mask for each individual chip
  * - add Ultra and MW DMA mode filtering for the HPT37[24] based SATA cards
+ * - stop resetting HPT370's state machine before each DMA transfer as that has
+ *   caused more harm than good
  *      Sergei Shtylyov, <sshtylyov@ru.mvista.com> or <source@mvista.com>
  */
 
@@ -133,7 +135,7 @@
 #define DRV_NAME "hpt366"
 
 /* various tuning parameters */
-#define HPT_RESET_STATE_ENGINE
+#undef  HPT_RESET_STATE_ENGINE
 #undef  HPT_DELAY_INTERRUPT
 
 static const char *quirk_drives[] = {
@@ -808,7 +810,7 @@ static void hpt370_irq_timeout(ide_drive_t *drive)
         /* get DMA command mode */
         dma_cmd = inb(hwif->dma_base + ATA_DMA_CMD);
         /* stop DMA */
-        outb(dma_cmd & ~0x1, hwif->dma_base + ATA_DMA_CMD);
+        outb(dma_cmd & ~ATA_DMA_START, hwif->dma_base + ATA_DMA_CMD);
         hpt370_clear_engine(drive);
 }
 
@@ -825,11 +827,11 @@ static int hpt370_dma_end(ide_drive_t *drive)
         ide_hwif_t *hwif        = drive->hwif;
         u8  dma_stat            = inb(hwif->dma_base + ATA_DMA_STATUS);
 
-        if (dma_stat & 0x01) {
+        if (dma_stat & ATA_DMA_ACTIVE) {
                 /* wait a little */
                 udelay(20);
                 dma_stat = inb(hwif->dma_base + ATA_DMA_STATUS);
-                if (dma_stat & 0x01)
+                if (dma_stat & ATA_DMA_ACTIVE)
                         hpt370_irq_timeout(drive);
         }
         return ide_dma_end(drive);
@@ -851,7 +853,7 @@ static int hpt374_dma_test_irq(ide_drive_t *drive)
 
         dma_stat = inb(hwif->dma_base + ATA_DMA_STATUS);
         /* return 1 if INTR asserted */
-        if (dma_stat & 4)
+        if (dma_stat & ATA_DMA_INTR)
                 return 1;
 
         return 0;
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 2ae02b8d7f8e..35dc38d3b2c5 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -102,11 +102,14 @@ void ide_complete_cmd(ide_drive_t *drive, struct ide_cmd *cmd, u8 stat, u8 err)
                         drive->dev_flags |= IDE_DFLAG_PARKED;
         }
 
-        if (rq && rq->cmd_type == REQ_TYPE_ATA_TASKFILE)
-                memcpy(rq->special, cmd, sizeof(*cmd));
+        if (rq && rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
+                struct ide_cmd *orig_cmd = rq->special;
 
-        if (cmd->tf_flags & IDE_TFLAG_DYN)
-                kfree(cmd);
+                if (cmd->tf_flags & IDE_TFLAG_DYN)
+                        kfree(orig_cmd);
+                else
+                        memcpy(orig_cmd, cmd, sizeof(*cmd));
+        }
 }
 
 /* obsolete, blk_rq_bytes() should be used instead */
diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
index 052b9bf1f8fb..f76e4e6b408f 100644
--- a/drivers/ide/pmac.c
+++ b/drivers/ide/pmac.c
@@ -1682,7 +1682,7 @@ static int __devinit pmac_ide_init_dma(ide_hwif_t *hwif,
          * The +2 is +1 for the stop command and +1 to allow for
          * aligning the start address to a multiple of 16 bytes.
          */
-        pmif->dma_table_cpu = (struct dbdma_cmd*)pci_alloc_consistent(
+        pmif->dma_table_cpu = pci_alloc_consistent(
                 dev,
                 (MAX_DCMDS + 2) * sizeof(struct dbdma_cmd),
                 &hwif->dmatable_dma);
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index bfe49243f38b..1c9410d1822c 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -819,6 +819,7 @@ static const struct parisc_device_id hp_sdc_tbl[] = {
 MODULE_DEVICE_TABLE(parisc, hp_sdc_tbl);
 
 static int __init hp_sdc_init_hppa(struct parisc_device *d);
+static struct delayed_work moduleloader_work;
 
 static struct parisc_driver hp_sdc_driver = {
         .name =         "hp_sdc",
@@ -930,8 +931,15 @@ static int __init hp_sdc_init(void)
 
 #if defined(__hppa__)
 
+static void request_module_delayed(struct work_struct *work)
+{
+        request_module("hp_sdc_mlc");
+}
+
 static int __init hp_sdc_init_hppa(struct parisc_device *d)
 {
+        int ret;
+
         if (!d)
                 return 1;
         if (hp_sdc.dev != NULL)
@@ -944,13 +952,26 @@ static int __init hp_sdc_init_hppa(struct parisc_device *d)
         hp_sdc.data_io          = d->hpa.start + 0x800;
         hp_sdc.status_io        = d->hpa.start + 0x801;
 
-        return hp_sdc_init();
+        INIT_DELAYED_WORK(&moduleloader_work, request_module_delayed);
+
+        ret = hp_sdc_init();
+        /* after sucessfull initialization give SDC some time to settle
+         * and then load the hp_sdc_mlc upper layer driver */
+        if (!ret)
+                schedule_delayed_work(&moduleloader_work,
+                        msecs_to_jiffies(2000));
+
+        return ret;
 }
 
 #endif /* __hppa__ */
 
 static void hp_sdc_exit(void)
 {
+        /* do nothing if we don't have a SDC */
+        if (!hp_sdc.dev)
+                return;
+
         write_lock_irq(&hp_sdc.lock);
 
         /* Turn off all maskable "sub-function" irq's. */
@@ -969,6 +990,7 @@ static void hp_sdc_exit(void)
         tasklet_kill(&hp_sdc.task);
 
 #if defined(__hppa__)
+        cancel_delayed_work_sync(&moduleloader_work);
         if (unregister_parisc_driver(&hp_sdc_driver))
                 printk(KERN_WARNING PREFIX "Error unregistering HP SDC");
 #endif
diff --git a/drivers/lguest/lg.h b/drivers/lguest/lg.h
index ac8a4a3741b8..af92a176697f 100644
--- a/drivers/lguest/lg.h
+++ b/drivers/lguest/lg.h
@@ -158,7 +158,8 @@ void free_interrupts(void);
 /* segments.c: */
 void setup_default_gdt_entries(struct lguest_ro_state *state);
 void setup_guest_gdt(struct lg_cpu *cpu);
-void load_guest_gdt(struct lg_cpu *cpu, unsigned long table, u32 num);
+void load_guest_gdt_entry(struct lg_cpu *cpu, unsigned int i,
+                          u32 low, u32 hi);
 void guest_load_tls(struct lg_cpu *cpu, unsigned long tls_array);
 void copy_gdt(const struct lg_cpu *cpu, struct desc_struct *gdt);
 void copy_gdt_tls(const struct lg_cpu *cpu, struct desc_struct *gdt);
diff --git a/drivers/lguest/segments.c b/drivers/lguest/segments.c
index 4f15439b7f12..7ede64ffeef9 100644
--- a/drivers/lguest/segments.c
+++ b/drivers/lguest/segments.c
@@ -144,18 +144,19 @@ void copy_gdt(const struct lg_cpu *cpu, struct desc_struct *gdt)
                         gdt[i] = cpu->arch.gdt[i];
 }
 
-/*H:620 This is where the Guest asks us to load a new GDT (LHCALL_LOAD_GDT).
- * We copy it from the Guest and tweak the entries. */
-void load_guest_gdt(struct lg_cpu *cpu, unsigned long table, u32 num)
+/*H:620 This is where the Guest asks us to load a new GDT entry
+ * (LHCALL_LOAD_GDT_ENTRY).  We tweak the entry and copy it in. */
+void load_guest_gdt_entry(struct lg_cpu *cpu, u32 num, u32 lo, u32 hi)
 {
         /* We assume the Guest has the same number of GDT entries as the
          * Host, otherwise we'd have to dynamically allocate the Guest GDT. */
         if (num > ARRAY_SIZE(cpu->arch.gdt))
                 kill_guest(cpu, "too many gdt entries %i", num);
 
-        /* We read the whole thing in, then fix it up. */
-        __lgread(cpu, cpu->arch.gdt, table, num * sizeof(cpu->arch.gdt[0]));
-        fixup_gdt_table(cpu, 0, ARRAY_SIZE(cpu->arch.gdt));
+        /* Set it up, then fix it. */
+        cpu->arch.gdt[num].a = lo;
+        cpu->arch.gdt[num].b = hi;
+        fixup_gdt_table(cpu, num, num+1);
         /* Mark that the GDT changed so the core knows it has to copy it again,
          * even if the Guest is run on the same CPU. */
         cpu->changed |= CHANGED_GDT;
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index a6b717644be0..1a83910f674f 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -324,6 +324,11 @@ static void rewrite_hypercall(struct lg_cpu *cpu)
         u8 insn[3] = {0xcd, 0x1f, 0x90};
 
         __lgwrite(cpu, guest_pa(cpu, cpu->regs->eip), insn, sizeof(insn));
+        /* The above write might have caused a copy of that page to be made
+         * (if it was read-only).  We need to make sure the Guest has
+         * up-to-date pagetables.  As this doesn't happen often, we can just
+         * drop them all. */
+        guest_pagetable_clear_all(cpu);
 }
 
 static bool is_hypercall(struct lg_cpu *cpu)
@@ -563,8 +568,8 @@ void __exit lguest_arch_host_fini(void)
 int lguest_arch_do_hcall(struct lg_cpu *cpu, struct hcall_args *args)
 {
         switch (args->arg0) {
-        case LHCALL_LOAD_GDT:
-                load_guest_gdt(cpu, args->arg1, args->arg2);
+        case LHCALL_LOAD_GDT_ENTRY:
+                load_guest_gdt_entry(cpu, args->arg1, args->arg2, args->arg3);
                 break;
         case LHCALL_LOAD_IDT_ENTRY:
                 load_guest_idt_entry(cpu, args->arg1, args->arg2, args->arg3);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index f8a9f7ab2cb8..1fb91edc7de2 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1479,6 +1479,7 @@ void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector)
                 s += blocks;
         }
         bitmap->last_end_sync = jiffies;
+        sysfs_notify(&bitmap->mddev->kobj, NULL, "sync_completed");
 }
 
 static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset, int needed)
@@ -1589,7 +1590,7 @@ void bitmap_destroy(mddev_t *mddev)
 int bitmap_create(mddev_t *mddev)
 {
         struct bitmap *bitmap;
-        unsigned long blocks = mddev->resync_max_sectors;
+        sector_t blocks = mddev->resync_max_sectors;
         unsigned long chunks;
         unsigned long pages;
         struct file *file = mddev->bitmap_file;
@@ -1631,8 +1632,8 @@ int bitmap_create(mddev_t *mddev)
         bitmap->chunkshift = ffz(~bitmap->chunksize);
 
         /* now that chunksize and chunkshift are set, we can use these macros */
-        chunks = (blocks + CHUNK_BLOCK_RATIO(bitmap) - 1) /
-                        CHUNK_BLOCK_RATIO(bitmap);
+        chunks = (blocks + CHUNK_BLOCK_RATIO(bitmap) - 1) >>
+                        CHUNK_BLOCK_SHIFT(bitmap);
         pages = (chunks + PAGE_COUNTER_RATIO - 1) / PAGE_COUNTER_RATIO;
 
         BUG_ON(!pages);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index ed5727c089a9..612343fdde94 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2017,6 +2017,8 @@ repeat:
         clear_bit(MD_CHANGE_PENDING, &mddev->flags);
         spin_unlock_irq(&mddev->write_lock);
         wake_up(&mddev->sb_wait);
+        if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+                sysfs_notify(&mddev->kobj, NULL, "sync_completed");
 
 }
 
@@ -2086,6 +2088,7 @@ state_store(mdk_rdev_t *rdev, const char *buf, size_t len)
          *  -writemostly - clears write_mostly
          *  blocked - sets the Blocked flag
          *  -blocked - clears the Blocked flag
+         *  insync - sets Insync providing device isn't active
          */
         int err = -EINVAL;
         if (cmd_match(buf, "faulty") && rdev->mddev->pers) {
@@ -2118,6 +2121,9 @@ state_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                 md_wakeup_thread(rdev->mddev->thread);
 
                 err = 0;
+        } else if (cmd_match(buf, "insync") && rdev->raid_disk == -1) {
+                set_bit(In_sync, &rdev->flags);
+                err = 0;
         }
         if (!err && rdev->sysfs_state)
                 sysfs_notify_dirent(rdev->sysfs_state);
@@ -2190,7 +2196,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len)
         } else if (rdev->mddev->pers) {
                 mdk_rdev_t *rdev2;
                 /* Activating a spare .. or possibly reactivating
-                 * if we every get bitmaps working here.
+                 * if we ever get bitmaps working here.
                  */
 
                 if (rdev->raid_disk != -1)
@@ -3482,12 +3488,15 @@ sync_completed_show(mddev_t *mddev, char *page)
 {
         unsigned long max_sectors, resync;
 
+        if (!test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+                return sprintf(page, "none\n");
+
         if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery))
                 max_sectors = mddev->resync_max_sectors;
         else
                 max_sectors = mddev->dev_sectors;
 
-        resync = (mddev->curr_resync - atomic_read(&mddev->recovery_active));
+        resync = mddev->curr_resync_completed;
         return sprintf(page, "%lu / %lu\n", resync, max_sectors);
 }
 
@@ -6334,18 +6343,13 @@ void md_do_sync(mddev_t *mddev)
                 sector_t sectors;
 
                 skipped = 0;
-                if (j >= mddev->resync_max) {
-                        sysfs_notify(&mddev->kobj, NULL, "sync_completed");
-                        wait_event(mddev->recovery_wait,
-                                   mddev->resync_max > j
-                                   || kthread_should_stop());
-                }
-                if (kthread_should_stop())
-                        goto interrupted;
 
-                if (mddev->curr_resync > mddev->curr_resync_completed &&
-                    (mddev->curr_resync - mddev->curr_resync_completed)
-                    > (max_sectors >> 4)) {
+                if ((mddev->curr_resync > mddev->curr_resync_completed &&
+                     (mddev->curr_resync - mddev->curr_resync_completed)
+                    > (max_sectors >> 4)) ||
+                    (j - mddev->curr_resync_completed)*2
+                    >= mddev->resync_max - mddev->curr_resync_completed
+                        ) {
                         /* time to update curr_resync_completed */
                         blk_unplug(mddev->queue);
                         wait_event(mddev->recovery_wait,
@@ -6353,7 +6357,17 @@ void md_do_sync(mddev_t *mddev)
                         mddev->curr_resync_completed =
                                 mddev->curr_resync;
                         set_bit(MD_CHANGE_CLEAN, &mddev->flags);
+                        sysfs_notify(&mddev->kobj, NULL, "sync_completed");
                 }
+
+                if (j >= mddev->resync_max)
+                        wait_event(mddev->recovery_wait,
+                                   mddev->resync_max > j
+                                   || kthread_should_stop());
+
+                if (kthread_should_stop())
+                        goto interrupted;
+
                 sectors = mddev->pers->sync_request(mddev, j, &skipped,
                                                   currspeed < speed_min(mddev));
                 if (sectors == 0) {
@@ -6461,6 +6475,7 @@ void md_do_sync(mddev_t *mddev)
 
  skip:
         mddev->curr_resync = 0;
+        mddev->curr_resync_completed = 0;
         mddev->resync_min = 0;
         mddev->resync_max = MaxSector;
         sysfs_notify(&mddev->kobj, NULL, "sync_completed");
diff --git a/drivers/md/md.h b/drivers/md/md.h
index e9b7f54c24d6..8227ab909d44 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -12,10 +12,17 @@
    Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  
 */
 
-#ifndef _MD_K_H
-#define _MD_K_H
-
-#ifdef CONFIG_BLOCK
+#ifndef _MD_MD_H
+#define _MD_MD_H
+
+#include <linux/blkdev.h>
+#include <linux/kobject.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mutex.h>
+#include <linux/timer.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
 
 #define MaxSector (~(sector_t)0)
 
@@ -408,10 +415,6 @@ static inline void safe_put_page(struct page *p)
         if (p) put_page(p);
 }
 
-#endif /* CONFIG_BLOCK */
-#endif
-
-
 extern int register_md_personality(struct mdk_personality *p);
 extern int unregister_md_personality(struct mdk_personality *p);
 extern mdk_thread_t * md_register_thread(void (*run) (mddev_t *mddev),
@@ -434,3 +437,5 @@ extern void md_new_event(mddev_t *mddev);
 extern int md_allow_write(mddev_t *mddev);
 extern void md_wait_for_blocked_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 extern void md_set_array_sectors(mddev_t *mddev, sector_t array_sectors);
+
+#endif /* _MD_MD_H */
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 3bbc6d647044..4616bc3a6e71 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3845,6 +3845,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                 wait_event(conf->wait_for_overlap,
                            atomic_read(&conf->reshape_stripes)==0);
                 mddev->reshape_position = conf->reshape_progress;
+                mddev->curr_resync_completed = mddev->curr_resync;
                 conf->reshape_checkpoint = jiffies;
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
@@ -3854,6 +3855,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                 conf->reshape_safe = mddev->reshape_position;
                 spin_unlock_irq(&conf->device_lock);
                 wake_up(&conf->wait_for_overlap);
+                sysfs_notify(&mddev->kobj, NULL, "sync_completed");
         }
 
         if (mddev->delta_disks < 0) {
@@ -3938,11 +3940,13 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
          * then we need to write out the superblock.
          */
         sector_nr += reshape_sectors;
-        if (sector_nr >= mddev->resync_max) {
+        if ((sector_nr - mddev->curr_resync_completed) * 2
+            >= mddev->resync_max - mddev->curr_resync_completed) {
                 /* Cannot proceed until we've updated the superblock... */
                 wait_event(conf->wait_for_overlap,
                            atomic_read(&conf->reshape_stripes) == 0);
                 mddev->reshape_position = conf->reshape_progress;
+                mddev->curr_resync_completed = mddev->curr_resync;
                 conf->reshape_checkpoint = jiffies;
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
@@ -3953,6 +3957,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                 conf->reshape_safe = mddev->reshape_position;
                 spin_unlock_irq(&conf->device_lock);
                 wake_up(&conf->wait_for_overlap);
+                sysfs_notify(&mddev->kobj, NULL, "sync_completed");
         }
         return reshape_sectors;
 }
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index d0d126c69354..5d496a99e034 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -5934,7 +5934,7 @@ mpt_config(MPT_ADAPTER *ioc, CONFIGPARMS *pCfg)
 
         /* Initalize the timer
          */
-        init_timer(&pCfg->timer);
+        init_timer_on_stack(&pCfg->timer);
         pCfg->timer.data = (unsigned long) ioc;
         pCfg->timer.function = mpt_timer_expired;
         pCfg->wait_done = 0;
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 3e6e42d2f01b..bbefe77c67a9 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -375,7 +375,7 @@ static int __init gru_init(void)
         void *gru_start_vaddr;
 
         if (!is_uv_system())
-                return -ENODEV;
+                return 0;
 
 #if defined CONFIG_IA64
         gru_start_paddr = 0xd000000000UL; /* ZZZZZZZZZZZZZZZZZZZ fixme */
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 16f8dcab2da4..7896849b16dc 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -248,19 +248,19 @@ xp_init(void)
         enum xp_retval ret;
         int ch_number;
 
+        /* initialize the connection registration mutex */
+        for (ch_number = 0; ch_number < XPC_MAX_NCHANNELS; ch_number++)
+                mutex_init(&xpc_registrations[ch_number].mutex);
+
         if (is_shub())
                 ret = xp_init_sn2();
         else if (is_uv())
                 ret = xp_init_uv();
         else
-                ret = xpUnsupported;
+                ret = 0;
 
         if (ret != xpSuccess)
-                return -ENODEV;
-
-        /* initialize the connection registration mutex */
-        for (ch_number = 0; ch_number < XPC_MAX_NCHANNELS; ch_number++)
-                mutex_init(&xpc_registrations[ch_number].mutex);
+                return ret;
 
         return 0;
 }
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index b6d35f50e404..23e10b6263d6 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -797,17 +797,15 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
                 goto cleanup2;
         }
 
-        pr_info("%s: alarms up to one %s%s, %zd bytes nvram%s\n",
-                        dev_name(&cmos_rtc.rtc->dev),
-                        is_valid_irq(rtc_irq)
-                                ?  (cmos_rtc.mon_alrm
-                                        ? "year"
-                                        : (cmos_rtc.day_alrm
-                                                ? "month" : "day"))
-                                : "no",
-                        cmos_rtc.century ? ", y3k" : "",
-                        nvram.size,
-                        is_hpet_enabled() ? ", hpet irqs" : "");
+        pr_info("%s: %s%s, %zd bytes nvram%s\n",
+                dev_name(&cmos_rtc.rtc->dev),
+                !is_valid_irq(rtc_irq) ? "no alarms" :
+                        cmos_rtc.mon_alrm ? "alarms up to one year" :
+                        cmos_rtc.day_alrm ? "alarms up to one month" :
+                        "alarms up to one day",
+                cmos_rtc.century ? ", y3k" : "",
+                nvram.size,
+                is_hpet_enabled() ? ", hpet irqs" : "");
 
         return 0;
 
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index 18ba812a4f84..d86123e03391 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -166,7 +166,7 @@ static void bfin_serial_start_tx(struct uart_port *port)
         struct tty_struct *tty = uart->port.info->port.tty;
 
 #ifdef CONFIG_SERIAL_BFIN_HARD_CTSRTS
-        if (uart->scts && (!bfin_serial_get_mctrl(&uart->port)&TIOCM_CTS)) {
+        if (uart->scts && !(bfin_serial_get_mctrl(&uart->port) & TIOCM_CTS)) {
                 uart->scts = 0;
                 uart_handle_cts_change(&uart->port, uart->scts);
         }
@@ -368,7 +368,7 @@ static irqreturn_t bfin_serial_tx_int(int irq, void *dev_id)
         struct bfin_serial_port *uart = dev_id;
 
 #ifdef CONFIG_SERIAL_BFIN_HARD_CTSRTS
-        if (uart->scts && (!bfin_serial_get_mctrl(&uart->port)&TIOCM_CTS)) {
+        if (uart->scts && !(bfin_serial_get_mctrl(&uart->port) & TIOCM_CTS)) {
                 uart->scts = 0;
                 uart_handle_cts_change(&uart->port, uart->scts);
         }
@@ -504,7 +504,7 @@ static irqreturn_t bfin_serial_dma_tx_int(int irq, void *dev_id)
         struct circ_buf *xmit = &uart->port.info->xmit;
 
 #ifdef CONFIG_SERIAL_BFIN_HARD_CTSRTS
-        if (uart->scts && (!bfin_serial_get_mctrl(&uart->port)&TIOCM_CTS)) {
+        if (uart->scts && !(bfin_serial_get_mctrl(&uart->port)&TIOCM_CTS)) {
                 uart->scts = 0;
                 uart_handle_cts_change(&uart->port, uart->scts);
         }
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index c76feea5fe25..885194a07418 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -213,7 +213,7 @@ static int flush(struct driver_data *drv_data)
                 while (read_SSSR(reg) & SSSR_RNE) {
                         read_SSDR(reg);
                 }
-        } while ((read_SSSR(reg) & SSSR_BSY) && limit--);
+        } while ((read_SSSR(reg) & SSSR_BSY) && --limit);
         write_SSSR(SSSR_ROR, reg);
 
         return limit;
@@ -484,7 +484,7 @@ static int wait_ssp_rx_stall(void const __iomem *ioaddr)
 {
         unsigned long limit = loops_per_jiffy << 1;
 
-        while ((read_SSSR(ioaddr) & SSSR_BSY) && limit--)
+        while ((read_SSSR(ioaddr) & SSSR_BSY) && --limit)
                 cpu_relax();
 
         return limit;
@@ -494,7 +494,7 @@ static int wait_dma_channel_stop(int channel)
 {
         unsigned long limit = loops_per_jiffy << 1;
 
-        while (!(DCSR(channel) & DCSR_STOPSTATE) && limit--)
+        while (!(DCSR(channel) & DCSR_STOPSTATE) && --limit)
                 cpu_relax();
 
         return limit;
@@ -1700,6 +1700,13 @@ static int pxa2xx_spi_resume(struct platform_device *pdev)
         struct ssp_device *ssp = drv_data->ssp;
         int status = 0;
 
+        if (drv_data->rx_channel != -1)
+                DRCMR(drv_data->ssp->drcmr_rx) =
+                        DRCMR_MAPVLD | drv_data->rx_channel;
+        if (drv_data->tx_channel != -1)
+                DRCMR(drv_data->ssp->drcmr_tx) =
+                        DRCMR_MAPVLD | drv_data->tx_channel;
+
         /* Enable the SSP clock */
         clk_enable(ssp->clk);
 
diff --git a/drivers/staging/go7007/go7007-driver.c b/drivers/staging/go7007/go7007-driver.c
index f47c0ce2849a..77b1e769ac92 100644
--- a/drivers/staging/go7007/go7007-driver.c
+++ b/drivers/staging/go7007/go7007-driver.c
@@ -191,8 +191,10 @@ int go7007_reset_encoder(struct go7007 *go)
 /*
  * Attempt to instantiate an I2C client by ID, probably loading a module.
  */
-static int init_i2c_module(struct i2c_adapter *adapter, int id, int addr)
+static int init_i2c_module(struct i2c_adapter *adapter, const char *type,
+                           int id, int addr)
 {
+        struct i2c_board_info info;
         char *modname;
 
         switch (id) {
@@ -226,7 +228,11 @@ static int init_i2c_module(struct i2c_adapter *adapter, int id, int addr)
         }
         if (modname != NULL)
                 request_module(modname);
-        if (wis_i2c_probe_device(adapter, id, addr) == 1)
+
+        memset(&info, 0, sizeof(struct i2c_board_info));
+        info.addr = addr;
+        strlcpy(info.type, type, I2C_NAME_SIZE);
+        if (!i2c_new_device(adapter, &info))
                 return 0;
         if (modname != NULL)
                 printk(KERN_INFO
@@ -266,6 +272,7 @@ int go7007_register_encoder(struct go7007 *go)
         if (go->i2c_adapter_online) {
                 for (i = 0; i < go->board_info->num_i2c_devs; ++i)
                         init_i2c_module(&go->i2c_adapter,
+                                        go->board_info->i2c_devs[i].type,
                                         go->board_info->i2c_devs[i].id,
                                         go->board_info->i2c_devs[i].addr);
                 if (go->board_id == GO7007_BOARDID_ADLINK_MPG24)
diff --git a/drivers/staging/go7007/go7007-i2c.c b/drivers/staging/go7007/go7007-i2c.c
index cd55b76eabc7..c82867fdd28d 100644
--- a/drivers/staging/go7007/go7007-i2c.c
+++ b/drivers/staging/go7007/go7007-i2c.c
@@ -31,87 +31,6 @@
 #include "go7007-priv.h"
 #include "wis-i2c.h"
 
-/************** Registration interface for I2C client drivers **************/
-
-/* Since there's no way to auto-probe the I2C devices connected to the I2C
- * bus on the go7007, we have this silly little registration system that
- * client drivers can use to register their I2C driver ID and their
- * detect_client function (the one that's normally passed to i2c_probe).
- *
- * When a new go7007 device is connected, we can look up in a board info
- * table by the USB or PCI vendor/product/revision ID to determine
- * which I2C client module to load.  The client driver module will register
- * itself here, and then we can call the registered detect_client function
- * to force-load a new client at the address listed in the board info table.
- *
- * Really the I2C subsystem should have a way to force-load I2C client
- * drivers when we have a priori knowledge of what's on the bus, especially
- * since the existing I2C auto-probe mechanism is so hokey, but we'll use
- * our own mechanism for the time being. */
-
-struct wis_i2c_client_driver {
-        unsigned int id;
-        found_proc found_proc;
-        struct list_head list;
-};
-
-static LIST_HEAD(i2c_client_drivers);
-static DECLARE_MUTEX(i2c_client_driver_list_lock);
-
-/* Client drivers register here by their I2C driver ID */
-int wis_i2c_add_driver(unsigned int id, found_proc found_proc)
-{
-        struct wis_i2c_client_driver *driver;
-
-        driver = kmalloc(sizeof(struct wis_i2c_client_driver), GFP_KERNEL);
-        if (driver == NULL)
-                return -ENOMEM;
-        driver->id = id;
-        driver->found_proc = found_proc;
-
-        down(&i2c_client_driver_list_lock);
-        list_add_tail(&driver->list, &i2c_client_drivers);
-        up(&i2c_client_driver_list_lock);
-
-        return 0;
-}
-EXPORT_SYMBOL(wis_i2c_add_driver);
-
-void wis_i2c_del_driver(found_proc found_proc)
-{
-        struct wis_i2c_client_driver *driver, *next;
-
-        down(&i2c_client_driver_list_lock);
-        list_for_each_entry_safe(driver, next, &i2c_client_drivers, list)
-                if (driver->found_proc == found_proc) {
-                        list_del(&driver->list);
-                        kfree(driver);
-                }
-        up(&i2c_client_driver_list_lock);
-}
-EXPORT_SYMBOL(wis_i2c_del_driver);
-
-/* The main go7007 driver calls this to instantiate a client by driver
- * ID and bus address, which are both stored in the board info table */
-int wis_i2c_probe_device(struct i2c_adapter *adapter,
-                                unsigned int id, int addr)
-{
-        struct wis_i2c_client_driver *driver;
-        int found = 0;
-
-        if (addr < 0 || addr > 0x7f)
-                return -1;
-        down(&i2c_client_driver_list_lock);
-        list_for_each_entry(driver, &i2c_client_drivers, list)
-                if (driver->id == id) {
-                        if (driver->found_proc(adapter, addr, 0) == 0)
-                                found = 1;
-                        break;
-                }
-        up(&i2c_client_driver_list_lock);
-        return found;
-}
-
 /********************* Driver for on-board I2C adapter *********************/
 
 /* #define GO7007_I2C_DEBUG */
@@ -287,9 +206,7 @@ static struct i2c_algorithm go7007_algo = {
 
 static struct i2c_adapter go7007_adap_templ = {
         .owner                  = THIS_MODULE,
-        .class                  = I2C_CLASS_TV_ANALOG,
         .name                   = "WIS GO7007SB",
-        .id                     = I2C_ALGO_GO7007,
         .algo                   = &go7007_algo,
 };
 
diff --git a/drivers/staging/go7007/go7007-priv.h b/drivers/staging/go7007/go7007-priv.h
index 372f1f1c09b2..178d18119faa 100644
--- a/drivers/staging/go7007/go7007-priv.h
+++ b/drivers/staging/go7007/go7007-priv.h
@@ -87,6 +87,7 @@ struct go7007_board_info {
         int audio_main_div;
         int num_i2c_devs;
         struct {
+                const char *type;
                 int id;
                 int addr;
         } i2c_devs[4];
diff --git a/drivers/staging/go7007/go7007-usb.c b/drivers/staging/go7007/go7007-usb.c
index 83eec920c7d3..aa4a9e0b9954 100644
--- a/drivers/staging/go7007/go7007-usb.c
+++ b/drivers/staging/go7007/go7007-usb.c
@@ -91,6 +91,7 @@ static struct go7007_usb_board board_matrix_ii = {
                 .num_i2c_devs    = 1,
                 .i2c_devs        = {
                         {
+                                .type   = "wis_saa7115",
                                 .id     = I2C_DRIVERID_WIS_SAA7115,
                                 .addr   = 0x20,
                         },
@@ -127,6 +128,7 @@ static struct go7007_usb_board board_matrix_reload = {
                 .num_i2c_devs    = 1,
                 .i2c_devs        = {
                         {
+                                .type   = "wis_saa7113",
                                 .id     = I2C_DRIVERID_WIS_SAA7113,
                                 .addr   = 0x25,
                         },
@@ -164,6 +166,7 @@ static struct go7007_usb_board board_star_trek = {
                 .num_i2c_devs    = 1,
                 .i2c_devs        = {
                         {
+                                .type   = "wis_saa7115",
                                 .id     = I2C_DRIVERID_WIS_SAA7115,
                                 .addr   = 0x20,
                         },
@@ -209,14 +212,17 @@ static struct go7007_usb_board board_px_tv402u = {
                 .num_i2c_devs    = 3,
                 .i2c_devs        = {
                         {
+                                .type   = "wis_saa7115",
                                 .id     = I2C_DRIVERID_WIS_SAA7115,
                                 .addr   = 0x20,
                         },
                         {
+                                .type   = "wis_uda1342",
                                 .id     = I2C_DRIVERID_WIS_UDA1342,
                                 .addr   = 0x1a,
                         },
                         {
+                                .type   = "wis_sony_tuner",
                                 .id     = I2C_DRIVERID_WIS_SONY_TUNER,
                                 .addr   = 0x60,
                         },
@@ -264,6 +270,7 @@ static struct go7007_usb_board board_xmen = {
                 .num_i2c_devs     = 1,
                 .i2c_devs         = {
                         {
+                                .type   = "wis_ov7640",
                                 .id     = I2C_DRIVERID_WIS_OV7640,
                                 .addr   = 0x21,
                         },
@@ -296,6 +303,7 @@ static struct go7007_usb_board board_matrix_revolution = {
                 .num_i2c_devs    = 1,
                 .i2c_devs        = {
                         {
+                                .type   = "wis_tw9903",
                                 .id     = I2C_DRIVERID_WIS_TW9903,
                                 .addr   = 0x44,
                         },
@@ -385,6 +393,7 @@ static struct go7007_usb_board board_adlink_mpg24 = {
                 .num_i2c_devs    = 1,
                 .i2c_devs        = {
                         {
+                                .type   = "wis_twTW2804",
                                 .id     = I2C_DRIVERID_WIS_TW2804,
                                 .addr   = 0x00, /* yes, really */
                         },
@@ -415,8 +424,9 @@ static struct go7007_usb_board board_sensoray_2250 = {
                 .num_i2c_devs    = 1,
                 .i2c_devs        = {
                         {
+                                .type   = "s2250_board",
                                 .id     = I2C_DRIVERID_S2250,
-                                .addr   = 0x34,
+                                .addr   = 0x43,
                         },
                 },
                 .num_inputs      = 2,
@@ -943,9 +953,7 @@ static struct i2c_algorithm go7007_usb_algo = {
 
 static struct i2c_adapter go7007_usb_adap_templ = {
         .owner                  = THIS_MODULE,
-        .class                  = I2C_CLASS_TV_ANALOG,
         .name                   = "WIS GO7007SB EZ-USB",
-        .id                     = I2C_ALGO_GO7007_USB,
         .algo                   = &go7007_usb_algo,
 };
 
diff --git a/drivers/staging/go7007/s2250-board.c b/drivers/staging/go7007/s2250-board.c
index d333ea2cd774..1706fbf06847 100644
--- a/drivers/staging/go7007/s2250-board.c
+++ b/drivers/staging/go7007/s2250-board.c
@@ -28,7 +28,6 @@ extern int s2250loader_init(void);
 extern void s2250loader_cleanup(void);
 
 #define TLV320_ADDRESS      0x34
-#define S2250_VIDDEC        0x86
 #define VPX322_ADDR_ANALOGCONTROL1      0x02
 #define VPX322_ADDR_BRIGHTNESS0         0x0127
 #define VPX322_ADDR_BRIGHTNESS1         0x0131
@@ -123,6 +122,7 @@ struct s2250 {
         int hue;
         int reg12b_val;
         int audio_input;
+        struct i2c_client *audio;
 };
 
 /* from go7007-usb.c which is Copyright (C) 2005-2006 Micronas USA Inc.*/
@@ -452,16 +452,15 @@ static int s2250_command(struct i2c_client *client,
         {
                 struct v4l2_audio *audio = arg;
 
-                client->addr = TLV320_ADDRESS;
                 switch (audio->index) {
                 case 0:
-                        write_reg(client, 0x08, 0x02); /* Line In */
+                        write_reg(dec->audio, 0x08, 0x02); /* Line In */
                         break;
                 case 1:
-                        write_reg(client, 0x08, 0x04); /* Mic */
+                        write_reg(dec->audio, 0x08, 0x04); /* Mic */
                         break;
                 case 2:
-                        write_reg(client, 0x08, 0x05); /* Mic Boost */
+                        write_reg(dec->audio, 0x08, 0x05); /* Mic Boost */
                         break;
                 default:
                         return -EINVAL;
@@ -477,31 +476,23 @@ static int s2250_command(struct i2c_client *client,
         return 0;
 }
 
-static struct i2c_driver s2250_driver;
-
-static struct i2c_client s2250_client_templ = {
-        .name           = "Sensoray 2250",
-        .driver         = &s2250_driver,
-};
-
-static int s2250_detect(struct i2c_adapter *adapter, int addr, int kind)
+static int s2250_probe(struct i2c_client *client,
+                       const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_client *audio;
+        struct i2c_adapter *adapter = client->adapter;
         struct s2250 *dec;
         u8 *data;
         struct go7007 *go = i2c_get_adapdata(adapter);
         struct go7007_usb *usb = go->hpi_context;
 
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
+        audio = i2c_new_dummy(adapter, TLV320_ADDRESS >> 1);
+        if (audio == NULL)
                 return -ENOMEM;
-        memcpy(client, &s2250_client_templ,
-               sizeof(s2250_client_templ));
-        client->adapter = adapter;
 
         dec = kmalloc(sizeof(struct s2250), GFP_KERNEL);
         if (dec == NULL) {
-                kfree(client);
+                i2c_unregister_device(audio);
                 return -ENOMEM;
         }
 
@@ -510,7 +501,7 @@ static int s2250_detect(struct i2c_adapter *adapter, int addr, int kind)
         dec->contrast = 50;
         dec->saturation = 50;
         dec->hue = 0;
-        client->addr = TLV320_ADDRESS;
+        dec->audio = audio;
         i2c_set_clientdata(client, dec);
 
         printk(KERN_DEBUG
@@ -518,28 +509,25 @@ static int s2250_detect(struct i2c_adapter *adapter, int addr, int kind)
                adapter->name);
 
         /* initialize the audio */
-        client->addr = TLV320_ADDRESS;
-        if (write_regs(client, aud_regs) < 0) {
+        if (write_regs(audio, aud_regs) < 0) {
                 printk(KERN_ERR
                        "s2250: error initializing audio\n");
-                kfree(client);
+                i2c_unregister_device(audio);
                 kfree(dec);
                 return 0;
         }
-        client->addr = S2250_VIDDEC;
-        i2c_set_clientdata(client, dec);
 
         if (write_regs(client, vid_regs) < 0) {
                 printk(KERN_ERR
                        "s2250: error initializing decoder\n");
-                kfree(client);
+                i2c_unregister_device(audio);
                 kfree(dec);
                 return 0;
         }
         if (write_regs_fp(client, vid_regs_fp) < 0) {
                 printk(KERN_ERR
                        "s2250: error initializing decoder\n");
-                kfree(client);
+                i2c_unregister_device(audio);
                 kfree(dec);
                 return 0;
         }
@@ -575,32 +563,33 @@ static int s2250_detect(struct i2c_adapter *adapter, int addr, int kind)
                 up(&usb->i2c_lock);
         }
 
-        i2c_attach_client(client);
         printk("s2250: initialized successfully\n");
         return 0;
 }
 
-static int s2250_detach(struct i2c_client *client)
+static int s2250_remove(struct i2c_client *client)
 {
         struct s2250 *dec = i2c_get_clientdata(client);
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
 
-        kfree(client);
+        i2c_set_clientdata(client, NULL);
+        i2c_unregister_device(dec->audio);
         kfree(dec);
         return 0;
 }
 
+static struct i2c_device_id s2250_id[] = {
+        { "s2250_board", 0 },
+        { }
+};
+
 static struct i2c_driver s2250_driver = {
         .driver = {
                 .name   = "Sensoray 2250 board driver",
         },
-        .id             = I2C_DRIVERID_S2250,
-        .detach_client  = s2250_detach,
+        .probe          = s2250_probe,
+        .remove         = s2250_remove,
         .command        = s2250_command,
+        .id_table       = s2250_id,
 };
 
 static int __init s2250_init(void)
@@ -613,13 +602,13 @@ static int __init s2250_init(void)
 
         r = i2c_add_driver(&s2250_driver);
         if (r < 0)
-                return r;
-        return wis_i2c_add_driver(s2250_driver.id, s2250_detect);
+                s2250loader_cleanup();
+
+        return r;
 }
 
 static void __exit s2250_cleanup(void)
 {
-        wis_i2c_del_driver(s2250_detect);
         i2c_del_driver(&s2250_driver);
 
         s2250loader_cleanup();
diff --git a/drivers/staging/go7007/wis-i2c.h b/drivers/staging/go7007/wis-i2c.h
index 431f41dd3966..3c2b9be455df 100644
--- a/drivers/staging/go7007/wis-i2c.h
+++ b/drivers/staging/go7007/wis-i2c.h
@@ -24,21 +24,12 @@
 #define I2C_DRIVERID_WIS_OV7640         0xf0f5
 #define I2C_DRIVERID_WIS_TW2804         0xf0f6
 #define I2C_DRIVERID_S2250              0xf0f7
-#define I2C_ALGO_GO7007                 0xf00000
-#define I2C_ALGO_GO7007_USB             0xf10000
 
 /* Flag to indicate that the client needs to be accessed with SCCB semantics */
 /* We re-use the I2C_M_TEN value so the flag passes through the masks in the
  * core I2C code.  Major kludge, but the I2C layer ain't exactly flexible. */
 #define I2C_CLIENT_SCCB                 0x10
 
-typedef int (*found_proc) (struct i2c_adapter *, int, int);
-int wis_i2c_add_driver(unsigned int id, found_proc found_proc);
-void wis_i2c_del_driver(found_proc found_proc);
-
-int wis_i2c_probe_device(struct i2c_adapter *adapter,
-                                unsigned int id, int addr);
-
 /* Definitions for new video decoder commands */
 
 struct video_decoder_resolution {
diff --git a/drivers/staging/go7007/wis-ov7640.c b/drivers/staging/go7007/wis-ov7640.c
index 2f9efca04606..04d6d3a498a3 100644
--- a/drivers/staging/go7007/wis-ov7640.c
+++ b/drivers/staging/go7007/wis-ov7640.c
@@ -50,76 +50,54 @@ static int write_regs(struct i2c_client *client, u8 *regs)
         return 0;
 }
 
-static struct i2c_driver wis_ov7640_driver;
-
-static struct i2c_client wis_ov7640_client_templ = {
-        .name           = "OV7640 (WIS)",
-        .driver         = &wis_ov7640_driver,
-};
-
-static int wis_ov7640_detect(struct i2c_adapter *adapter, int addr, int kind)
+static int wis_ov7640_probe(struct i2c_client *client,
+                            const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_adapter *adapter = client->adapter;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
-                return 0;
-
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
-                return -ENOMEM;
-        memcpy(client, &wis_ov7640_client_templ,
-                        sizeof(wis_ov7640_client_templ));
-        client->adapter = adapter;
-        client->addr = addr;
+                return -ENODEV;
+
         client->flags = I2C_CLIENT_SCCB;
 
         printk(KERN_DEBUG
                 "wis-ov7640: initializing OV7640 at address %d on %s\n",
-                addr, adapter->name);
+                client->addr, adapter->name);
 
         if (write_regs(client, initial_registers) < 0) {
                 printk(KERN_ERR "wis-ov7640: error initializing OV7640\n");
-                kfree(client);
-                return 0;
+                return -ENODEV;
         }
 
-        i2c_attach_client(client);
         return 0;
 }
 
-static int wis_ov7640_detach(struct i2c_client *client)
+static int wis_ov7640_remove(struct i2c_client *client)
 {
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
-
-        kfree(client);
         return 0;
 }
 
+static struct i2c_device_id wis_ov7640_id[] = {
+        { "wis_ov7640", 0 },
+        { }
+};
+
 static struct i2c_driver wis_ov7640_driver = {
         .driver = {
                 .name   = "WIS OV7640 I2C driver",
         },
-        .id             = I2C_DRIVERID_WIS_OV7640,
-        .detach_client  = wis_ov7640_detach,
+        .probe          = wis_ov7640_probe,
+        .remove         = wis_ov7640_remove,
+        .id_table       = wis_ov7640_id,
 };
 
 static int __init wis_ov7640_init(void)
 {
-        int r;
-
-        r = i2c_add_driver(&wis_ov7640_driver);
-        if (r < 0)
-                return r;
-        return wis_i2c_add_driver(wis_ov7640_driver.id, wis_ov7640_detect);
+        return i2c_add_driver(&wis_ov7640_driver);
 }
 
 static void __exit wis_ov7640_cleanup(void)
 {
-        wis_i2c_del_driver(wis_ov7640_detect);
         i2c_del_driver(&wis_ov7640_driver);
 }
 
diff --git a/drivers/staging/go7007/wis-saa7113.c b/drivers/staging/go7007/wis-saa7113.c
index 11689723945e..9ab893bd204e 100644
--- a/drivers/staging/go7007/wis-saa7113.c
+++ b/drivers/staging/go7007/wis-saa7113.c
@@ -261,34 +261,19 @@ static int wis_saa7113_command(struct i2c_client *client,
         return 0;
 }
 
-static struct i2c_driver wis_saa7113_driver;
-
-static struct i2c_client wis_saa7113_client_templ = {
-        .name           = "SAA7113 (WIS)",
-        .driver         = &wis_saa7113_driver,
-};
-
-static int wis_saa7113_detect(struct i2c_adapter *adapter, int addr, int kind)
+static int wis_saa7113_probe(struct i2c_client *client,
+                             const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_adapter *adapter = client->adapter;
         struct wis_saa7113 *dec;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
-                return 0;
-
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
-                return -ENOMEM;
-        memcpy(client, &wis_saa7113_client_templ,
-                        sizeof(wis_saa7113_client_templ));
-        client->adapter = adapter;
-        client->addr = addr;
+                return -ENODEV;
 
         dec = kmalloc(sizeof(struct wis_saa7113), GFP_KERNEL);
-        if (dec == NULL) {
-                kfree(client);
+        if (dec == NULL)
                 return -ENOMEM;
-        }
+
         dec->norm = V4L2_STD_NTSC;
         dec->brightness = 128;
         dec->contrast = 71;
@@ -298,56 +283,49 @@ static int wis_saa7113_detect(struct i2c_adapter *adapter, int addr, int kind)
 
         printk(KERN_DEBUG
                 "wis-saa7113: initializing SAA7113 at address %d on %s\n",
-                addr, adapter->name);
+                client->addr, adapter->name);
 
         if (write_regs(client, initial_registers) < 0) {
                 printk(KERN_ERR
                         "wis-saa7113: error initializing SAA7113\n");
-                kfree(client);
                 kfree(dec);
-                return 0;
+                return -ENODEV;
         }
 
-        i2c_attach_client(client);
         return 0;
 }
 
-static int wis_saa7113_detach(struct i2c_client *client)
+static int wis_saa7113_remove(struct i2c_client *client)
 {
         struct wis_saa7113 *dec = i2c_get_clientdata(client);
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
 
-        kfree(client);
+        i2c_set_clientdata(client, NULL);
         kfree(dec);
         return 0;
 }
 
+static struct i2c_device_id wis_saa7113_id[] = {
+        { "wis_saa7113", 0 },
+        { }
+};
+
 static struct i2c_driver wis_saa7113_driver = {
         .driver = {
                 .name   = "WIS SAA7113 I2C driver",
         },
-        .id             = I2C_DRIVERID_WIS_SAA7113,
-        .detach_client  = wis_saa7113_detach,
+        .probe          = wis_saa7113_probe,
+        .remove         = wis_saa7113_remove,
         .command        = wis_saa7113_command,
+        .id_table       = wis_saa7113_id,
 };
 
 static int __init wis_saa7113_init(void)
 {
-        int r;
-
-        r = i2c_add_driver(&wis_saa7113_driver);
-        if (r < 0)
-                return r;
-        return wis_i2c_add_driver(wis_saa7113_driver.id, wis_saa7113_detect);
+        return i2c_add_driver(&wis_saa7113_driver);
 }
 
 static void __exit wis_saa7113_cleanup(void)
 {
-        wis_i2c_del_driver(wis_saa7113_detect);
         i2c_del_driver(&wis_saa7113_driver);
 }
 
diff --git a/drivers/staging/go7007/wis-saa7115.c b/drivers/staging/go7007/wis-saa7115.c
index 59417a7174d7..8687ad2de761 100644
--- a/drivers/staging/go7007/wis-saa7115.c
+++ b/drivers/staging/go7007/wis-saa7115.c
@@ -394,34 +394,19 @@ static int wis_saa7115_command(struct i2c_client *client,
         return 0;
 }
 
-static struct i2c_driver wis_saa7115_driver;
-
-static struct i2c_client wis_saa7115_client_templ = {
-        .name           = "SAA7115 (WIS)",
-        .driver         = &wis_saa7115_driver,
-};
-
-static int wis_saa7115_detect(struct i2c_adapter *adapter, int addr, int kind)
+static int wis_saa7115_probe(struct i2c_client *client,
+                             const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_adapter *adapter = client->adapter;
         struct wis_saa7115 *dec;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
-                return 0;
-
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
-                return -ENOMEM;
-        memcpy(client, &wis_saa7115_client_templ,
-                        sizeof(wis_saa7115_client_templ));
-        client->adapter = adapter;
-        client->addr = addr;
+                return -ENODEV;
 
         dec = kmalloc(sizeof(struct wis_saa7115), GFP_KERNEL);
-        if (dec == NULL) {
-                kfree(client);
+        if (dec == NULL)
                 return -ENOMEM;
-        }
+
         dec->norm = V4L2_STD_NTSC;
         dec->brightness = 128;
         dec->contrast = 64;
@@ -431,56 +416,49 @@ static int wis_saa7115_detect(struct i2c_adapter *adapter, int addr, int kind)
 
         printk(KERN_DEBUG
                 "wis-saa7115: initializing SAA7115 at address %d on %s\n",
-                addr, adapter->name);
+                client->addr, adapter->name);
 
         if (write_regs(client, initial_registers) < 0) {
                 printk(KERN_ERR
                         "wis-saa7115: error initializing SAA7115\n");
-                kfree(client);
                 kfree(dec);
-                return 0;
+                return -ENODEV;
         }
 
-        i2c_attach_client(client);
         return 0;
 }
 
-static int wis_saa7115_detach(struct i2c_client *client)
+static int wis_saa7115_remove(struct i2c_client *client)
 {
         struct wis_saa7115 *dec = i2c_get_clientdata(client);
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
 
-        kfree(client);
+        i2c_set_clientdata(client, NULL);
         kfree(dec);
         return 0;
 }
 
+static struct i2c_device_id wis_saa7115_id[] = {
+        { "wis_saa7115", 0 },
+        { }
+};
+
 static struct i2c_driver wis_saa7115_driver = {
         .driver = {
                 .name   = "WIS SAA7115 I2C driver",
         },
-        .id             = I2C_DRIVERID_WIS_SAA7115,
-        .detach_client  = wis_saa7115_detach,
+        .probe          = wis_saa7115_probe,
+        .remove         = wis_saa7115_remove,
         .command        = wis_saa7115_command,
+        .id_table       = wis_saa7115_id,
 };
 
 static int __init wis_saa7115_init(void)
 {
-        int r;
-
-        r = i2c_add_driver(&wis_saa7115_driver);
-        if (r < 0)
-                return r;
-        return wis_i2c_add_driver(wis_saa7115_driver.id, wis_saa7115_detect);
+        return i2c_add_driver(&wis_saa7115_driver);
 }
 
 static void __exit wis_saa7115_cleanup(void)
 {
-        wis_i2c_del_driver(wis_saa7115_detect);
         i2c_del_driver(&wis_saa7115_driver);
 }
 
diff --git a/drivers/staging/go7007/wis-sony-tuner.c b/drivers/staging/go7007/wis-sony-tuner.c
index 0a7eeef7c008..c965c601ac90 100644
--- a/drivers/staging/go7007/wis-sony-tuner.c
+++ b/drivers/staging/go7007/wis-sony-tuner.c
@@ -653,35 +653,19 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
         return 0;
 }
 
-static struct i2c_driver wis_sony_tuner_driver;
-
-static struct i2c_client wis_sony_tuner_client_templ = {
-        .name           = "Sony TV Tuner (WIS)",
-        .driver         = &wis_sony_tuner_driver,
-};
-
-static int wis_sony_tuner_detect(struct i2c_adapter *adapter,
-                                        int addr, int kind)
+static int wis_sony_tuner_probe(struct i2c_client *client,
+                                const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_adapter *adapter = client->adapter;
         struct wis_sony_tuner *t;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_I2C_BLOCK))
-                return 0;
-
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
-                return -ENOMEM;
-        memcpy(client, &wis_sony_tuner_client_templ,
-                        sizeof(wis_sony_tuner_client_templ));
-        client->adapter = adapter;
-        client->addr = addr;
+                return -ENODEV;
 
         t = kmalloc(sizeof(struct wis_sony_tuner), GFP_KERNEL);
-        if (t == NULL) {
-                kfree(client);
+        if (t == NULL)
                 return -ENOMEM;
-        }
+
         t->type = -1;
         t->freq = 0;
         t->mpxmode = 0;
@@ -690,50 +674,42 @@ static int wis_sony_tuner_detect(struct i2c_adapter *adapter,
 
         printk(KERN_DEBUG
                 "wis-sony-tuner: initializing tuner at address %d on %s\n",
-                addr, adapter->name);
-
-        i2c_attach_client(client);
+                client->addr, adapter->name);
 
         return 0;
 }
 
-static int wis_sony_tuner_detach(struct i2c_client *client)
+static int wis_sony_tuner_remove(struct i2c_client *client)
 {
         struct wis_sony_tuner *t = i2c_get_clientdata(client);
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
 
+        i2c_set_clientdata(client, NULL);
         kfree(t);
-        kfree(client);
         return 0;
 }
 
+static struct i2c_device_id wis_sony_tuner_id[] = {
+        { "wis_sony_tuner", 0 },
+        { }
+};
+
 static struct i2c_driver wis_sony_tuner_driver = {
         .driver = {
                 .name   = "WIS Sony TV Tuner I2C driver",
         },
-        .id             = I2C_DRIVERID_WIS_SONY_TUNER,
-        .detach_client  = wis_sony_tuner_detach,
+        .probe          = wis_sony_tuner_probe,
+        .remove         = wis_sony_tuner_remove,
         .command        = tuner_command,
+        .id_table       = wis_sony_tuner_id,
 };
 
 static int __init wis_sony_tuner_init(void)
 {
-        int r;
-
-        r = i2c_add_driver(&wis_sony_tuner_driver);
-        if (r < 0)
-                return r;
-        return wis_i2c_add_driver(wis_sony_tuner_driver.id,
-                                        wis_sony_tuner_detect);
+        return i2c_add_driver(&wis_sony_tuner_driver);
 }
 
 static void __exit wis_sony_tuner_cleanup(void)
 {
-        wis_i2c_del_driver(wis_sony_tuner_detect);
         i2c_del_driver(&wis_sony_tuner_driver);
 }
 
diff --git a/drivers/staging/go7007/wis-tw2804.c b/drivers/staging/go7007/wis-tw2804.c
index 57b8f2b1caa3..e15794a2a0ae 100644
--- a/drivers/staging/go7007/wis-tw2804.c
+++ b/drivers/staging/go7007/wis-tw2804.c
@@ -291,34 +291,19 @@ static int wis_tw2804_command(struct i2c_client *client,
         return 0;
 }
 
-static struct i2c_driver wis_tw2804_driver;
-
-static struct i2c_client wis_tw2804_client_templ = {
-        .name           = "TW2804 (WIS)",
-        .driver         = &wis_tw2804_driver,
-};
-
-static int wis_tw2804_detect(struct i2c_adapter *adapter, int addr, int kind)
+static int wis_tw2804_probe(struct i2c_client *client,
+                            const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_adapter *adapter = client->adapter;
         struct wis_tw2804 *dec;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
-                return 0;
-
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
-                return -ENOMEM;
-        memcpy(client, &wis_tw2804_client_templ,
-                        sizeof(wis_tw2804_client_templ));
-        client->adapter = adapter;
-        client->addr = addr;
+                return -ENODEV;
 
         dec = kmalloc(sizeof(struct wis_tw2804), GFP_KERNEL);
-        if (dec == NULL) {
-                kfree(client);
+        if (dec == NULL)
                 return -ENOMEM;
-        }
+
         dec->channel = -1;
         dec->norm = V4L2_STD_NTSC;
         dec->brightness = 128;
@@ -328,48 +313,42 @@ static int wis_tw2804_detect(struct i2c_adapter *adapter, int addr, int kind)
         i2c_set_clientdata(client, dec);
 
         printk(KERN_DEBUG "wis-tw2804: creating TW2804 at address %d on %s\n",
-                addr, adapter->name);
+                client->addr, adapter->name);
 
-        i2c_attach_client(client);
         return 0;
 }
 
-static int wis_tw2804_detach(struct i2c_client *client)
+static int wis_tw2804_remove(struct i2c_client *client)
 {
         struct wis_tw2804 *dec = i2c_get_clientdata(client);
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
 
-        kfree(client);
+        i2c_set_clientdata(client, NULL);
         kfree(dec);
         return 0;
 }
 
+static struct i2c_device_id wis_tw2804_id[] = {
+        { "wis_tw2804", 0 },
+        { }
+};
+
 static struct i2c_driver wis_tw2804_driver = {
         .driver = {
                 .name   = "WIS TW2804 I2C driver",
         },
-        .id             = I2C_DRIVERID_WIS_TW2804,
-        .detach_client  = wis_tw2804_detach,
+        .probe          = wis_tw2804_probe,
+        .remove         = wis_tw2804_remove,
         .command        = wis_tw2804_command,
+        .id_table       = wis_tw2804_id,
 };
 
 static int __init wis_tw2804_init(void)
 {
-        int r;
-
-        r = i2c_add_driver(&wis_tw2804_driver);
-        if (r < 0)
-                return r;
-        return wis_i2c_add_driver(wis_tw2804_driver.id, wis_tw2804_detect);
+        return i2c_add_driver(&wis_tw2804_driver);
 }
 
 static void __exit wis_tw2804_cleanup(void)
 {
-        wis_i2c_del_driver(wis_tw2804_detect);
         i2c_del_driver(&wis_tw2804_driver);
 }
 
diff --git a/drivers/staging/go7007/wis-tw9903.c b/drivers/staging/go7007/wis-tw9903.c
index 40627b282cb4..6c3427bb6f4c 100644
--- a/drivers/staging/go7007/wis-tw9903.c
+++ b/drivers/staging/go7007/wis-tw9903.c
@@ -267,34 +267,19 @@ static int wis_tw9903_command(struct i2c_client *client,
         return 0;
 }
 
-static struct i2c_driver wis_tw9903_driver;
-
-static struct i2c_client wis_tw9903_client_templ = {
-        .name           = "TW9903 (WIS)",
-        .driver         = &wis_tw9903_driver,
-};
-
-static int wis_tw9903_detect(struct i2c_adapter *adapter, int addr, int kind)
+static int wis_tw9903_probe(struct i2c_client *client,
+                            const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_adapter *adapter = client->adapter;
         struct wis_tw9903 *dec;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
-                return 0;
-
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
-                return -ENOMEM;
-        memcpy(client, &wis_tw9903_client_templ,
-                        sizeof(wis_tw9903_client_templ));
-        client->adapter = adapter;
-        client->addr = addr;
+                return -ENODEV;
 
         dec = kmalloc(sizeof(struct wis_tw9903), GFP_KERNEL);
-        if (dec == NULL) {
-                kfree(client);
+        if (dec == NULL)
                 return -ENOMEM;
-        }
+
         dec->norm = V4L2_STD_NTSC;
         dec->brightness = 0;
         dec->contrast = 0x60;
@@ -303,55 +288,48 @@ static int wis_tw9903_detect(struct i2c_adapter *adapter, int addr, int kind)
 
         printk(KERN_DEBUG
                 "wis-tw9903: initializing TW9903 at address %d on %s\n",
-                addr, adapter->name);
+                client->addr, adapter->name);
 
         if (write_regs(client, initial_registers) < 0) {
                 printk(KERN_ERR "wis-tw9903: error initializing TW9903\n");
-                kfree(client);
                 kfree(dec);
-                return 0;
+                return -ENODEV;
         }
 
-        i2c_attach_client(client);
         return 0;
 }
 
-static int wis_tw9903_detach(struct i2c_client *client)
+static int wis_tw9903_remove(struct i2c_client *client)
 {
         struct wis_tw9903 *dec = i2c_get_clientdata(client);
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
 
-        kfree(client);
+        i2c_set_clientdata(client, NULL);
         kfree(dec);
         return 0;
 }
 
+static struct i2c_device_id wis_tw9903_id[] = {
+        { "wis_tw9903", 0 },
+        { }
+};
+
 static struct i2c_driver wis_tw9903_driver = {
         .driver = {
                 .name   = "WIS TW9903 I2C driver",
         },
-        .id             = I2C_DRIVERID_WIS_TW9903,
-        .detach_client  = wis_tw9903_detach,
+        .probe          = wis_tw9903_probe,
+        .remove         = wis_tw9903_remove,
         .command        = wis_tw9903_command,
+        .id_table       = wis_tw9903_id,
 };
 
 static int __init wis_tw9903_init(void)
 {
-        int r;
-
-        r = i2c_add_driver(&wis_tw9903_driver);
-        if (r < 0)
-                return r;
-        return wis_i2c_add_driver(wis_tw9903_driver.id, wis_tw9903_detect);
+        return i2c_add_driver(&wis_tw9903_driver);
 }
 
 static void __exit wis_tw9903_cleanup(void)
 {
-        wis_i2c_del_driver(wis_tw9903_detect);
         i2c_del_driver(&wis_tw9903_driver);
 }
 
diff --git a/drivers/staging/go7007/wis-uda1342.c b/drivers/staging/go7007/wis-uda1342.c
index 555645c0cc1a..739c7ae8913f 100644
--- a/drivers/staging/go7007/wis-uda1342.c
+++ b/drivers/staging/go7007/wis-uda1342.c
@@ -59,73 +59,51 @@ static int wis_uda1342_command(struct i2c_client *client,
         return 0;
 }
 
-static struct i2c_driver wis_uda1342_driver;
-
-static struct i2c_client wis_uda1342_client_templ = {
-        .name           = "UDA1342 (WIS)",
-        .driver         = &wis_uda1342_driver,
-};
-
-static int wis_uda1342_detect(struct i2c_adapter *adapter, int addr, int kind)
+static int wis_uda1342_probe(struct i2c_client *client,
+                             const struct i2c_device_id *id)
 {
-        struct i2c_client *client;
+        struct i2c_adapter *adapter = client->adapter;
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WORD_DATA))
-                return 0;
-
-        client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (client == NULL)
-                return -ENOMEM;
-        memcpy(client, &wis_uda1342_client_templ,
-                        sizeof(wis_uda1342_client_templ));
-        client->adapter = adapter;
-        client->addr = addr;
+                return -ENODEV;
 
         printk(KERN_DEBUG
                 "wis-uda1342: initializing UDA1342 at address %d on %s\n",
-                addr, adapter->name);
+                client->addr, adapter->name);
 
         write_reg(client, 0x00, 0x8000); /* reset registers */
         write_reg(client, 0x00, 0x1241); /* select input 1 */
 
-        i2c_attach_client(client);
         return 0;
 }
 
-static int wis_uda1342_detach(struct i2c_client *client)
+static int wis_uda1342_remove(struct i2c_client *client)
 {
-        int r;
-
-        r = i2c_detach_client(client);
-        if (r < 0)
-                return r;
-
-        kfree(client);
         return 0;
 }
 
+static struct i2c_device_id wis_uda1342_id[] = {
+        { "wis_uda1342", 0 },
+        { }
+};
+
 static struct i2c_driver wis_uda1342_driver = {
         .driver = {
                 .name   = "WIS UDA1342 I2C driver",
         },
-        .id             = I2C_DRIVERID_WIS_UDA1342,
-        .detach_client  = wis_uda1342_detach,
+        .probe          = wis_uda1342_probe,
+        .remove         = wis_uda1342_remove,
         .command        = wis_uda1342_command,
+        .id_table       = wis_uda1342_id,
 };
 
 static int __init wis_uda1342_init(void)
 {
-        int r;
-
-        r = i2c_add_driver(&wis_uda1342_driver);
-        if (r < 0)
-                return r;
-        return wis_i2c_add_driver(wis_uda1342_driver.id, wis_uda1342_detect);
+        return i2c_add_driver(&wis_uda1342_driver);
 }
 
 static void __exit wis_uda1342_cleanup(void)
 {
-        wis_i2c_del_driver(wis_uda1342_detect);
         i2c_del_driver(&wis_uda1342_driver);
 }
 
diff --git a/drivers/video/asiliantfb.c b/drivers/video/asiliantfb.c
index 1a1f946d8fef..9fe90ce928fb 100644
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/asiliantfb.c
@@ -533,6 +533,7 @@ static int __devinit init_asiliant(struct fb_info *p, unsigned long addr)
 
         writeb(0xff, mmio_base + 0x78c);
         chips_hw_init(p);
+        return 0;
 }
 
 static int __devinit
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 84f63205c46d..0889d50c3288 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -1439,7 +1439,7 @@ static void pxafb_disable_controller(struct pxafb_info *fbi)
 static irqreturn_t pxafb_handle_irq(int irq, void *dev_id)
 {
         struct pxafb_info *fbi = dev_id;
-        unsigned int lccr0, lcsr, lcsr1;
+        unsigned int lccr0, lcsr;
 
         lcsr = lcd_readl(fbi, LCSR);
         if (lcsr & LCSR_LDD) {
@@ -1455,14 +1455,16 @@ static irqreturn_t pxafb_handle_irq(int irq, void *dev_id)
         lcd_writel(fbi, LCSR, lcsr);
 
 #ifdef CONFIG_FB_PXA_OVERLAY
-        lcsr1 = lcd_readl(fbi, LCSR1);
-        if (lcsr1 & LCSR1_BS(1))
-                complete(&fbi->overlay[0].branch_done);
+        {
+                unsigned int lcsr1 = lcd_readl(fbi, LCSR1);
+                if (lcsr1 & LCSR1_BS(1))
+                        complete(&fbi->overlay[0].branch_done);
 
-        if (lcsr1 & LCSR1_BS(2))
-                complete(&fbi->overlay[1].branch_done);
+                if (lcsr1 & LCSR1_BS(2))
+                        complete(&fbi->overlay[1].branch_done);
 
-        lcd_writel(fbi, LCSR1, lcsr1);
+                lcd_writel(fbi, LCSR1, lcsr1);
+        }
 #endif
         return IRQ_HANDLED;
 }
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 59268266b79a..9c76a061a04d 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -190,7 +190,8 @@ static int balloon(void *_vballoon)
                 try_to_freeze();
                 wait_event_interruptible(vb->config_change,
                                          (diff = towards_target(vb)) != 0
-                                         || kthread_should_stop());
+                                         || kthread_should_stop()
+                                         || freezing(current));
                 if (diff > 0)
                         fill_balloon(vb, diff);
                 else if (diff < 0)
diff --git a/fs/autofs/dirhash.c b/fs/autofs/dirhash.c
index bf8c8af98004..4eb4d8dfb2f1 100644
--- a/fs/autofs/dirhash.c
+++ b/fs/autofs/dirhash.c
@@ -39,10 +39,12 @@ struct autofs_dir_ent *autofs_expire(struct super_block *sb,
 {
         struct autofs_dirhash *dh = &sbi->dirhash;
         struct autofs_dir_ent *ent;
-        struct dentry *dentry;
         unsigned long timeout = sbi->exp_timeout;
 
         while (1) {
+                struct path path;
+                int umount_ok;
+
                 if ( list_empty(&dh->expiry_head) || sbi->catatonic )
                         return NULL;    /* No entries */
                 /* We keep the list sorted by last_usage and want old stuff */
@@ -57,17 +59,17 @@ struct autofs_dir_ent *autofs_expire(struct super_block *sb,
                         return ent; /* Symlinks are always expirable */
 
                 /* Get the dentry for the autofs subdirectory */
-                dentry = ent->dentry;
+                path.dentry = ent->dentry;
 
-                if ( !dentry ) {
+                if (!path.dentry) {
                         /* Should only happen in catatonic mode */
                         printk("autofs: dentry == NULL but inode range is directory, entry %s\n", ent->name);
                         autofs_delete_usage(ent);
                         continue;
                 }
 
-                if ( !dentry->d_inode ) {
-                        dput(dentry);
+                if (!path.dentry->d_inode) {
+                        dput(path.dentry);
                         printk("autofs: negative dentry on expiry queue: %s\n",
                                ent->name);
                         autofs_delete_usage(ent);
@@ -76,29 +78,29 @@ struct autofs_dir_ent *autofs_expire(struct super_block *sb,
 
                 /* Make sure entry is mounted and unused; note that dentry will
                    point to the mounted-on-top root. */
-                if (!S_ISDIR(dentry->d_inode->i_mode)||!d_mountpoint(dentry)) {
+                if (!S_ISDIR(path.dentry->d_inode->i_mode) ||
+                    !d_mountpoint(path.dentry)) {
                         DPRINTK(("autofs: not expirable (not a mounted directory): %s\n", ent->name));
                         continue;
                 }
-                mntget(mnt);
-                dget(dentry);
-                if (!follow_down(&mnt, &dentry)) {
-                        dput(dentry);
-                        mntput(mnt);
+                path.mnt = mnt;
+                path_get(&path);
+                if (!follow_down(&path.mnt, &path.dentry)) {
+                        path_put(&path);
                         DPRINTK(("autofs: not expirable (not a mounted directory): %s\n", ent->name));
                         continue;
                 }
-                while (d_mountpoint(dentry) && follow_down(&mnt, &dentry))
+                while (d_mountpoint(path.dentry) &&
+                       follow_down(&path.mnt, &path.dentry))
                         ;
-                dput(dentry);
+                umount_ok = may_umount(path.mnt);
+                path_put(&path);
 
-                if ( may_umount(mnt) ) {
-                        mntput(mnt);
+                if (umount_ok) {
                         DPRINTK(("autofs: signaling expire on %s\n", ent->name));
                         return ent; /* Expirable! */
                 }
                 DPRINTK(("autofs: didn't expire due to may_umount: %s\n", ent->name));
-                mntput(mnt);
         }
         return NULL;            /* No expirable entries */
 }
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 9e5ae8a4f5c8..84168c0dcc2d 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -54,11 +54,10 @@ static int check_name(const char *name)
  * Check a string doesn't overrun the chunk of
  * memory we copied from user land.
  */
-static int invalid_str(char *str, void *end)
+static int invalid_str(char *str, size_t size)
 {
-        while ((void *) str <= end)
-                if (!*str++)
-                        return 0;
+        if (memchr(str, 0, size))
+                return 0;
         return -EINVAL;
 }
 
@@ -138,8 +137,7 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param)
         }
 
         if (param->size > sizeof(*param)) {
-                err = invalid_str(param->path,
-                                 (void *) ((size_t) param + param->size));
+                err = invalid_str(param->path, param->size - sizeof(*param));
                 if (err) {
                         AUTOFS_WARN(
                           "path string terminator missing for cmd(0x%08x)",
@@ -488,7 +486,7 @@ static int autofs_dev_ioctl_requester(struct file *fp,
         }
 
         path = param->path;
-        devid = sbi->sb->s_dev;
+        devid = new_encode_dev(sbi->sb->s_dev);
 
         param->requester.uid = param->requester.gid = -1;
 
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 51bfdfc8fcda..502c3d61de62 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -25,6 +25,7 @@
 #define WORK_QUEUED_BIT 0
 #define WORK_DONE_BIT 1
 #define WORK_ORDER_DONE_BIT 2
+#define WORK_HIGH_PRIO_BIT 3
 
 /*
  * container for the kthread task pointer and the list of pending work
@@ -36,6 +37,7 @@ struct btrfs_worker_thread {
 
         /* list of struct btrfs_work that are waiting for service */
         struct list_head pending;
+        struct list_head prio_pending;
 
         /* list of worker threads from struct btrfs_workers */
         struct list_head worker_list;
@@ -103,10 +105,16 @@ static noinline int run_ordered_completions(struct btrfs_workers *workers,
 
         spin_lock_irqsave(&workers->lock, flags);
 
-        while (!list_empty(&workers->order_list)) {
-                work = list_entry(workers->order_list.next,
-                                  struct btrfs_work, order_list);
-
+        while (1) {
+                if (!list_empty(&workers->prio_order_list)) {
+                        work = list_entry(workers->prio_order_list.next,
+                                          struct btrfs_work, order_list);
+                } else if (!list_empty(&workers->order_list)) {
+                        work = list_entry(workers->order_list.next,
+                                          struct btrfs_work, order_list);
+                } else {
+                        break;
+                }
                 if (!test_bit(WORK_DONE_BIT, &work->flags))
                         break;
 
@@ -143,8 +151,14 @@ static int worker_loop(void *arg)
         do {
                 spin_lock_irq(&worker->lock);
 again_locked:
-                while (!list_empty(&worker->pending)) {
-                        cur = worker->pending.next;
+                while (1) {
+                        if (!list_empty(&worker->prio_pending))
+                                cur = worker->prio_pending.next;
+                        else if (!list_empty(&worker->pending))
+                                cur = worker->pending.next;
+                        else
+                                break;
+
                         work = list_entry(cur, struct btrfs_work, list);
                         list_del(&work->list);
                         clear_bit(WORK_QUEUED_BIT, &work->flags);
@@ -163,7 +177,6 @@ again_locked:
 
                         spin_lock_irq(&worker->lock);
                         check_idle_worker(worker);
-
                 }
                 if (freezing(current)) {
                         worker->working = 0;
@@ -178,7 +191,8 @@ again_locked:
                                  * jump_in?
                                  */
                                 smp_mb();
-                                if (!list_empty(&worker->pending))
+                                if (!list_empty(&worker->pending) ||
+                                    !list_empty(&worker->prio_pending))
                                         continue;
 
                                 /*
@@ -191,7 +205,8 @@ again_locked:
                                  */
                                 schedule_timeout(1);
                                 smp_mb();
-                                if (!list_empty(&worker->pending))
+                                if (!list_empty(&worker->pending) ||
+                                    !list_empty(&worker->prio_pending))
                                         continue;
 
                                 if (kthread_should_stop())
@@ -200,7 +215,8 @@ again_locked:
                                 /* still no more work?, sleep for real */
                                 spin_lock_irq(&worker->lock);
                                 set_current_state(TASK_INTERRUPTIBLE);
-                                if (!list_empty(&worker->pending))
+                                if (!list_empty(&worker->pending) ||
+                                    !list_empty(&worker->prio_pending))
                                         goto again_locked;
 
                                 /*
@@ -248,6 +264,7 @@ void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max)
         INIT_LIST_HEAD(&workers->worker_list);
         INIT_LIST_HEAD(&workers->idle_list);
         INIT_LIST_HEAD(&workers->order_list);
+        INIT_LIST_HEAD(&workers->prio_order_list);
         spin_lock_init(&workers->lock);
         workers->max_workers = max;
         workers->idle_thresh = 32;
@@ -273,6 +290,7 @@ int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
                 }
 
                 INIT_LIST_HEAD(&worker->pending);
+                INIT_LIST_HEAD(&worker->prio_pending);
                 INIT_LIST_HEAD(&worker->worker_list);
                 spin_lock_init(&worker->lock);
                 atomic_set(&worker->num_pending, 0);
@@ -396,7 +414,10 @@ int btrfs_requeue_work(struct btrfs_work *work)
                 goto out;
 
         spin_lock_irqsave(&worker->lock, flags);
-        list_add_tail(&work->list, &worker->pending);
+        if (test_bit(WORK_HIGH_PRIO_BIT, &work->flags))
+                list_add_tail(&work->list, &worker->prio_pending);
+        else
+                list_add_tail(&work->list, &worker->pending);
         atomic_inc(&worker->num_pending);
 
         /* by definition we're busy, take ourselves off the idle
@@ -422,6 +443,11 @@ out:
         return 0;
 }
 
+void btrfs_set_work_high_prio(struct btrfs_work *work)
+{
+        set_bit(WORK_HIGH_PRIO_BIT, &work->flags);
+}
+
 /*
  * places a struct btrfs_work into the pending queue of one of the kthreads
  */
@@ -438,7 +464,12 @@ int btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work)
         worker = find_worker(workers);
         if (workers->ordered) {
                 spin_lock_irqsave(&workers->lock, flags);
-                list_add_tail(&work->order_list, &workers->order_list);
+                if (test_bit(WORK_HIGH_PRIO_BIT, &work->flags)) {
+                        list_add_tail(&work->order_list,
+                                      &workers->prio_order_list);
+                } else {
+                        list_add_tail(&work->order_list, &workers->order_list);
+                }
                 spin_unlock_irqrestore(&workers->lock, flags);
         } else {
                 INIT_LIST_HEAD(&work->order_list);
@@ -446,7 +477,10 @@ int btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work)
 
         spin_lock_irqsave(&worker->lock, flags);
 
-        list_add_tail(&work->list, &worker->pending);
+        if (test_bit(WORK_HIGH_PRIO_BIT, &work->flags))
+                list_add_tail(&work->list, &worker->prio_pending);
+        else
+                list_add_tail(&work->list, &worker->pending);
         atomic_inc(&worker->num_pending);
         check_busy_worker(worker);
 
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index 31be4ed8b63e..1b511c109db6 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -85,6 +85,7 @@ struct btrfs_workers {
          * of work items waiting for completion
          */
         struct list_head order_list;
+        struct list_head prio_order_list;
 
         /* lock for finding the next worker thread to queue on */
         spinlock_t lock;
@@ -98,4 +99,5 @@ int btrfs_start_workers(struct btrfs_workers *workers, int num_workers);
 int btrfs_stop_workers(struct btrfs_workers *workers);
 void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max);
 int btrfs_requeue_work(struct btrfs_work *work);
+void btrfs_set_work_high_prio(struct btrfs_work *work);
 #endif
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index e5b2533b691a..a99f1c2a710d 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1325,12 +1325,12 @@ static noinline int reada_for_balance(struct btrfs_root *root,
         int ret = 0;
         int blocksize;
 
-        parent = path->nodes[level - 1];
+        parent = path->nodes[level + 1];
         if (!parent)
                 return 0;
 
         nritems = btrfs_header_nritems(parent);
-        slot = path->slots[level];
+        slot = path->slots[level + 1];
         blocksize = btrfs_level_size(root, level);
 
         if (slot > 0) {
@@ -1341,7 +1341,7 @@ static noinline int reada_for_balance(struct btrfs_root *root,
                         block1 = 0;
                 free_extent_buffer(eb);
         }
-        if (slot < nritems) {
+        if (slot + 1 < nritems) {
                 block2 = btrfs_node_blockptr(parent, slot + 1);
                 gen = btrfs_node_ptr_generation(parent, slot + 1);
                 eb = btrfs_find_tree_block(root, block2, blocksize);
@@ -1351,7 +1351,11 @@ static noinline int reada_for_balance(struct btrfs_root *root,
         }
         if (block1 || block2) {
                 ret = -EAGAIN;
+
+                /* release the whole path */
                 btrfs_release_path(root, path);
+
+                /* read the blocks */
                 if (block1)
                         readahead_tree_block(root, block1, blocksize, 0);
                 if (block2)
@@ -1361,7 +1365,7 @@ static noinline int reada_for_balance(struct btrfs_root *root,
                         eb = read_tree_block(root, block1, blocksize, 0);
                         free_extent_buffer(eb);
                 }
-                if (block1) {
+                if (block2) {
                         eb = read_tree_block(root, block2, blocksize, 0);
                         free_extent_buffer(eb);
                 }
@@ -1481,12 +1485,15 @@ read_block_for_search(struct btrfs_trans_handle *trans,
          * of the btree by dropping locks before
          * we read.
          */
-        btrfs_release_path(NULL, p);
+        btrfs_unlock_up_safe(p, level + 1);
+        btrfs_set_path_blocking(p);
+
         if (tmp)
                 free_extent_buffer(tmp);
         if (p->reada)
                 reada_for_search(root, p, level, slot, key->objectid);
 
+        btrfs_release_path(NULL, p);
         tmp = read_tree_block(root, blocknr, blocksize, gen);
         if (tmp)
                 free_extent_buffer(tmp);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 92caa8035f36..a6b83744b05d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -579,6 +579,10 @@ int btrfs_wq_submit_bio(struct btrfs_fs_info *fs_info, struct inode *inode,
         async->bio_flags = bio_flags;
 
         atomic_inc(&fs_info->nr_async_submits);
+
+        if (rw & (1 << BIO_RW_SYNCIO))
+                btrfs_set_work_high_prio(&async->work);
+
         btrfs_queue_worker(&fs_info->workers, &async->work);
 #if 0
         int limit = btrfs_async_submit_limit(fs_info);
@@ -656,6 +660,7 @@ static int btree_submit_bio_hook(struct inode *inode, int rw, struct bio *bio,
                 return btrfs_map_bio(BTRFS_I(inode)->root, rw, bio,
                                      mirror_num, 0);
         }
+
         /*
          * kthread helpers are used to submit writes so that checksumming
          * can happen in parallel across all CPUs
@@ -2095,10 +2100,10 @@ static int write_dev_supers(struct btrfs_device *device,
                                 device->barriers = 0;
                                 get_bh(bh);
                                 lock_buffer(bh);
-                                ret = submit_bh(WRITE, bh);
+                                ret = submit_bh(WRITE_SYNC, bh);
                         }
                 } else {
-                        ret = submit_bh(WRITE, bh);
+                        ret = submit_bh(WRITE_SYNC, bh);
                 }
 
                 if (!ret && wait) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index eb2bee8b7fbf..05a1c42e25bf 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -50,7 +50,10 @@ struct extent_page_data {
         /* tells writepage not to lock the state bits for this range
          * it still does the unlocking
          */
-        int extent_locked;
+        unsigned int extent_locked:1;
+
+        /* tells the submit_bio code to use a WRITE_SYNC */
+        unsigned int sync_io:1;
 };
 
 int __init extent_io_init(void)
@@ -2101,6 +2104,16 @@ int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
         return ret;
 }
 
+static noinline void update_nr_written(struct page *page,
+                                      struct writeback_control *wbc,
+                                      unsigned long nr_written)
+{
+        wbc->nr_to_write -= nr_written;
+        if (wbc->range_cyclic || (wbc->nr_to_write > 0 &&
+            wbc->range_start == 0 && wbc->range_end == LLONG_MAX))
+                page->mapping->writeback_index = page->index + nr_written;
+}
+
 /*
  * the writepage semantics are similar to regular writepage.  extent
  * records are inserted to lock ranges in the tree, and as dirty areas
@@ -2136,8 +2149,14 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
         u64 delalloc_end;
         int page_started;
         int compressed;
+        int write_flags;
         unsigned long nr_written = 0;
 
+        if (wbc->sync_mode == WB_SYNC_ALL)
+                write_flags = WRITE_SYNC_PLUG;
+        else
+                write_flags = WRITE;
+
         WARN_ON(!PageLocked(page));
         pg_offset = i_size & (PAGE_CACHE_SIZE - 1);
         if (page->index > end_index ||
@@ -2164,6 +2183,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
         delalloc_end = 0;
         page_started = 0;
         if (!epd->extent_locked) {
+                /*
+                 * make sure the wbc mapping index is at least updated
+                 * to this page.
+                 */
+                update_nr_written(page, wbc, 0);
+
                 while (delalloc_end < page_end) {
                         nr_delalloc = find_lock_delalloc_range(inode, tree,
                                                        page,
@@ -2185,7 +2210,13 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
                  */
                 if (page_started) {
                         ret = 0;
-                        goto update_nr_written;
+                        /*
+                         * we've unlocked the page, so we can't update
+                         * the mapping's writeback index, just update
+                         * nr_to_write.
+                         */
+                        wbc->nr_to_write -= nr_written;
+                        goto done_unlocked;
                 }
         }
         lock_extent(tree, start, page_end, GFP_NOFS);
@@ -2198,13 +2229,18 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
                 if (ret == -EAGAIN) {
                         unlock_extent(tree, start, page_end, GFP_NOFS);
                         redirty_page_for_writepage(wbc, page);
+                        update_nr_written(page, wbc, nr_written);
                         unlock_page(page);
                         ret = 0;
-                        goto update_nr_written;
+                        goto done_unlocked;
                 }
         }
 
-        nr_written++;
+        /*
+         * we don't want to touch the inode after unlocking the page,
+         * so we update the mapping writeback index now
+         */
+        update_nr_written(page, wbc, nr_written + 1);
 
         end = page_end;
         if (test_range_bit(tree, start, page_end, EXTENT_DELALLOC, 0))
@@ -2314,9 +2350,9 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
                                        (unsigned long long)end);
                         }
 
-                        ret = submit_extent_page(WRITE, tree, page, sector,
-                                                 iosize, pg_offset, bdev,
-                                                 &epd->bio, max_nr,
+                        ret = submit_extent_page(write_flags, tree, page,
+                                                 sector, iosize, pg_offset,
+                                                 bdev, &epd->bio, max_nr,
                                                  end_bio_extent_writepage,
                                                  0, 0, 0);
                         if (ret)
@@ -2336,11 +2372,8 @@ done:
                 unlock_extent(tree, unlock_start, page_end, GFP_NOFS);
         unlock_page(page);
 
-update_nr_written:
-        wbc->nr_to_write -= nr_written;
-        if (wbc->range_cyclic || (wbc->nr_to_write > 0 &&
-            wbc->range_start == 0 && wbc->range_end == LLONG_MAX))
-                page->mapping->writeback_index = page->index + nr_written;
+done_unlocked:
+
         return 0;
 }
 
@@ -2460,15 +2493,23 @@ retry:
         return ret;
 }
 
-static noinline void flush_write_bio(void *data)
+static void flush_epd_write_bio(struct extent_page_data *epd)
 {
-        struct extent_page_data *epd = data;
         if (epd->bio) {
-                submit_one_bio(WRITE, epd->bio, 0, 0);
+                if (epd->sync_io)
+                        submit_one_bio(WRITE_SYNC, epd->bio, 0, 0);
+                else
+                        submit_one_bio(WRITE, epd->bio, 0, 0);
                 epd->bio = NULL;
         }
 }
 
+static noinline void flush_write_bio(void *data)
+{
+        struct extent_page_data *epd = data;
+        flush_epd_write_bio(epd);
+}
+
 int extent_write_full_page(struct extent_io_tree *tree, struct page *page,
                           get_extent_t *get_extent,
                           struct writeback_control *wbc)
@@ -2480,23 +2521,22 @@ int extent_write_full_page(struct extent_io_tree *tree, struct page *page,
                 .tree = tree,
                 .get_extent = get_extent,
                 .extent_locked = 0,
+                .sync_io = wbc->sync_mode == WB_SYNC_ALL,
         };
         struct writeback_control wbc_writepages = {
                 .bdi            = wbc->bdi,
-                .sync_mode      = WB_SYNC_NONE,
+                .sync_mode      = wbc->sync_mode,
                 .older_than_this = NULL,
                 .nr_to_write    = 64,
                 .range_start    = page_offset(page) + PAGE_CACHE_SIZE,
                 .range_end      = (loff_t)-1,
         };
 
-
         ret = __extent_writepage(page, wbc, &epd);
 
         extent_write_cache_pages(tree, mapping, &wbc_writepages,
                                  __extent_writepage, &epd, flush_write_bio);
-        if (epd.bio)
-                submit_one_bio(WRITE, epd.bio, 0, 0);
+        flush_epd_write_bio(&epd);
         return ret;
 }
 
@@ -2515,6 +2555,7 @@ int extent_write_locked_range(struct extent_io_tree *tree, struct inode *inode,
                 .tree = tree,
                 .get_extent = get_extent,
                 .extent_locked = 1,
+                .sync_io = mode == WB_SYNC_ALL,
         };
         struct writeback_control wbc_writepages = {
                 .bdi            = inode->i_mapping->backing_dev_info,
@@ -2540,8 +2581,7 @@ int extent_write_locked_range(struct extent_io_tree *tree, struct inode *inode,
                 start += PAGE_CACHE_SIZE;
         }
 
-        if (epd.bio)
-                submit_one_bio(WRITE, epd.bio, 0, 0);
+        flush_epd_write_bio(&epd);
         return ret;
 }
 
@@ -2556,13 +2596,13 @@ int extent_writepages(struct extent_io_tree *tree,
                 .tree = tree,
                 .get_extent = get_extent,
                 .extent_locked = 0,
+                .sync_io = wbc->sync_mode == WB_SYNC_ALL,
         };
 
         ret = extent_write_cache_pages(tree, mapping, wbc,
                                        __extent_writepage, &epd,
                                        flush_write_bio);
-        if (epd.bio)
-                submit_one_bio(WRITE, epd.bio, 0, 0);
+        flush_epd_write_bio(&epd);
         return ret;
 }
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 9c9fb46ccd08..482f8db2cfd0 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -830,7 +830,7 @@ again:
 
                 ret = btrfs_del_items(trans, root, path, del_slot, del_nr);
                 BUG_ON(ret);
-                goto done;
+                goto release;
         } else if (split == start) {
                 if (locked_end < extent_end) {
                         ret = try_lock_extent(&BTRFS_I(inode)->io_tree,
@@ -926,6 +926,8 @@ again:
         }
 done:
         btrfs_mark_buffer_dirty(leaf);
+
+release:
         btrfs_release_path(root, path);
         if (split_end && split == start) {
                 split = end;
@@ -1131,7 +1133,7 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
                 if (will_write) {
                         btrfs_fdatawrite_range(inode->i_mapping, pos,
                                                pos + write_bytes - 1,
-                                               WB_SYNC_NONE);
+                                               WB_SYNC_ALL);
                 } else {
                         balance_dirty_pages_ratelimited_nr(inode->i_mapping,
                                                            num_pages);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index a0d1dd492a58..65219f6a16a1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4970,10 +4970,10 @@ out_fail:
         return err;
 }
 
-static int prealloc_file_range(struct inode *inode, u64 start, u64 end,
+static int prealloc_file_range(struct btrfs_trans_handle *trans,
+                               struct inode *inode, u64 start, u64 end,
                                u64 alloc_hint, int mode)
 {
-        struct btrfs_trans_handle *trans;
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_key ins;
         u64 alloc_size;
@@ -4981,10 +4981,6 @@ static int prealloc_file_range(struct inode *inode, u64 start, u64 end,
         u64 num_bytes = end - start;
         int ret = 0;
 
-        trans = btrfs_join_transaction(root, 1);
-        BUG_ON(!trans);
-        btrfs_set_trans_block_group(trans, inode);
-
         while (num_bytes > 0) {
                 alloc_size = min(num_bytes, root->fs_info->max_extent);
                 ret = btrfs_reserve_extent(trans, root, alloc_size,
@@ -5015,7 +5011,6 @@ out:
                 BUG_ON(ret);
         }
 
-        btrfs_end_transaction(trans, root);
         return ret;
 }
 
@@ -5029,11 +5024,18 @@ static long btrfs_fallocate(struct inode *inode, int mode,
         u64 alloc_hint = 0;
         u64 mask = BTRFS_I(inode)->root->sectorsize - 1;
         struct extent_map *em;
+        struct btrfs_trans_handle *trans;
         int ret;
 
         alloc_start = offset & ~mask;
         alloc_end =  (offset + len + mask) & ~mask;
 
+        /*
+         * wait for ordered IO before we have any locks.  We'll loop again
+         * below with the locks held.
+         */
+        btrfs_wait_ordered_range(inode, alloc_start, alloc_end - alloc_start);
+
         mutex_lock(&inode->i_mutex);
         if (alloc_start > inode->i_size) {
                 ret = btrfs_cont_expand(inode, alloc_start);
@@ -5043,6 +5045,16 @@ static long btrfs_fallocate(struct inode *inode, int mode,
 
         while (1) {
                 struct btrfs_ordered_extent *ordered;
+
+                trans = btrfs_start_transaction(BTRFS_I(inode)->root, 1);
+                if (!trans) {
+                        ret = -EIO;
+                        goto out;
+                }
+
+                /* the extent lock is ordered inside the running
+                 * transaction
+                 */
                 lock_extent(&BTRFS_I(inode)->io_tree, alloc_start,
                             alloc_end - 1, GFP_NOFS);
                 ordered = btrfs_lookup_first_ordered_extent(inode,
@@ -5053,6 +5065,12 @@ static long btrfs_fallocate(struct inode *inode, int mode,
                         btrfs_put_ordered_extent(ordered);
                         unlock_extent(&BTRFS_I(inode)->io_tree,
                                       alloc_start, alloc_end - 1, GFP_NOFS);
+                        btrfs_end_transaction(trans, BTRFS_I(inode)->root);
+
+                        /*
+                         * we can't wait on the range with the transaction
+                         * running or with the extent lock held
+                         */
                         btrfs_wait_ordered_range(inode, alloc_start,
                                                  alloc_end - alloc_start);
                 } else {
@@ -5070,7 +5088,7 @@ static long btrfs_fallocate(struct inode *inode, int mode,
                 last_byte = min(extent_map_end(em), alloc_end);
                 last_byte = (last_byte + mask) & ~mask;
                 if (em->block_start == EXTENT_MAP_HOLE) {
-                        ret = prealloc_file_range(inode, cur_offset,
+                        ret = prealloc_file_range(trans, inode, cur_offset,
                                         last_byte, alloc_hint, mode);
                         if (ret < 0) {
                                 free_extent_map(em);
@@ -5089,6 +5107,8 @@ static long btrfs_fallocate(struct inode *inode, int mode,
         }
         unlock_extent(&BTRFS_I(inode)->io_tree, alloc_start, alloc_end - 1,
                       GFP_NOFS);
+
+        btrfs_end_transaction(trans, BTRFS_I(inode)->root);
 out:
         mutex_unlock(&inode->i_mutex);
         return ret;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 7594bec1be10..9f135e878507 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -461,15 +461,9 @@ static int btrfs_ioctl_resize(struct btrfs_root *root, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
-
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         namelen = strlen(vol_args->name);
@@ -545,7 +539,6 @@ static int btrfs_ioctl_resize(struct btrfs_root *root, void __user *arg)
 
 out_unlock:
         mutex_unlock(&root->fs_info->volume_mutex);
-out:
         kfree(vol_args);
         return ret;
 }
@@ -565,15 +558,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,
         if (root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
-
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         namelen = strlen(vol_args->name);
@@ -675,19 +662,13 @@ static long btrfs_ioctl_add_dev(struct btrfs_root *root, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_init_new_device(root, vol_args->name);
 
-out:
         kfree(vol_args);
         return ret;
 }
@@ -703,19 +684,13 @@ static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg)
         if (root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_rm_device(root, vol_args->name);
 
-out:
         kfree(vol_args);
         return ret;
 }
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 53c87b197d70..d6f0806c682f 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -489,7 +489,7 @@ again:
         /* start IO across the range first to instantiate any delalloc
          * extents
          */
-        btrfs_fdatawrite_range(inode->i_mapping, start, orig_end, WB_SYNC_NONE);
+        btrfs_fdatawrite_range(inode->i_mapping, start, orig_end, WB_SYNC_ALL);
 
         /* The compression code will leave pages locked but return from
          * writepage without setting the page writeback.  Starting again
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 9744af9d71e9..a7acfe639a44 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -635,14 +635,9 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol = kmalloc(sizeof(*vol), GFP_KERNEL);
-        if (!vol)
-                return -ENOMEM;
-
-        if (copy_from_user(vol, (void __user *)arg, sizeof(*vol))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol = memdup_user((void __user *)arg, sizeof(*vol));
+        if (IS_ERR(vol))
+                return PTR_ERR(vol);
 
         switch (cmd) {
         case BTRFS_IOC_SCAN_DEV:
@@ -650,7 +645,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
                                             &btrfs_fs_type, &fs_devices);
                 break;
         }
-out:
+
         kfree(vol);
         return ret;
 }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e0913e469728..e53835b88594 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -125,6 +125,20 @@ static noinline struct btrfs_fs_devices *find_fsid(u8 *fsid)
         return NULL;
 }
 
+static void requeue_list(struct btrfs_pending_bios *pending_bios,
+                        struct bio *head, struct bio *tail)
+{
+
+        struct bio *old_head;
+
+        old_head = pending_bios->head;
+        pending_bios->head = head;
+        if (pending_bios->tail)
+                tail->bi_next = old_head;
+        else
+                pending_bios->tail = tail;
+}
+
 /*
  * we try to collect pending bios for a device so we don't get a large
  * number of procs sending bios down to the same device.  This greatly
@@ -141,10 +155,12 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
         struct bio *pending;
         struct backing_dev_info *bdi;
         struct btrfs_fs_info *fs_info;
+        struct btrfs_pending_bios *pending_bios;
         struct bio *tail;
         struct bio *cur;
         int again = 0;
-        unsigned long num_run = 0;
+        unsigned long num_run;
+        unsigned long num_sync_run;
         unsigned long limit;
         unsigned long last_waited = 0;
 
@@ -153,20 +169,30 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
         limit = btrfs_async_submit_limit(fs_info);
         limit = limit * 2 / 3;
 
+        /* we want to make sure that every time we switch from the sync
+         * list to the normal list, we unplug
+         */
+        num_sync_run = 0;
+
 loop:
         spin_lock(&device->io_lock);
+        num_run = 0;
 
 loop_lock:
+
         /* take all the bios off the list at once and process them
          * later on (without the lock held).  But, remember the
          * tail and other pointers so the bios can be properly reinserted
          * into the list if we hit congestion
          */
-        pending = device->pending_bios;
-        tail = device->pending_bio_tail;
+        if (device->pending_sync_bios.head)
+                pending_bios = &device->pending_sync_bios;
+        else
+                pending_bios = &device->pending_bios;
+
+        pending = pending_bios->head;
+        tail = pending_bios->tail;
         WARN_ON(pending && !tail);
-        device->pending_bios = NULL;
-        device->pending_bio_tail = NULL;
 
         /*
          * if pending was null this time around, no bios need processing
@@ -176,16 +202,41 @@ loop_lock:
          * device->running_pending is used to synchronize with the
          * schedule_bio code.
          */
-        if (pending) {
-                again = 1;
-                device->running_pending = 1;
-        } else {
+        if (device->pending_sync_bios.head == NULL &&
+            device->pending_bios.head == NULL) {
                 again = 0;
                 device->running_pending = 0;
+        } else {
+                again = 1;
+                device->running_pending = 1;
         }
+
+        pending_bios->head = NULL;
+        pending_bios->tail = NULL;
+
         spin_unlock(&device->io_lock);
 
+        /*
+         * if we're doing the regular priority list, make sure we unplug
+         * for any high prio bios we've sent down
+         */
+        if (pending_bios == &device->pending_bios && num_sync_run > 0) {
+                num_sync_run = 0;
+                blk_run_backing_dev(bdi, NULL);
+        }
+
         while (pending) {
+
+                rmb();
+                if (pending_bios != &device->pending_sync_bios &&
+                    device->pending_sync_bios.head &&
+                    num_run > 16) {
+                        cond_resched();
+                        spin_lock(&device->io_lock);
+                        requeue_list(pending_bios, pending, tail);
+                        goto loop_lock;
+                }
+
                 cur = pending;
                 pending = pending->bi_next;
                 cur->bi_next = NULL;
@@ -196,10 +247,18 @@ loop_lock:
                         wake_up(&fs_info->async_submit_wait);
 
                 BUG_ON(atomic_read(&cur->bi_cnt) == 0);
-                bio_get(cur);
                 submit_bio(cur->bi_rw, cur);
-                bio_put(cur);
                 num_run++;
+                if (bio_sync(cur))
+                        num_sync_run++;
+
+                if (need_resched()) {
+                        if (num_sync_run) {
+                                blk_run_backing_dev(bdi, NULL);
+                                num_sync_run = 0;
+                        }
+                        cond_resched();
+                }
 
                 /*
                  * we made progress, there is more work to do and the bdi
@@ -208,7 +267,6 @@ loop_lock:
                  */
                 if (pending && bdi_write_congested(bdi) && num_run > 16 &&
                     fs_info->fs_devices->open_devices > 1) {
-                        struct bio *old_head;
                         struct io_context *ioc;
 
                         ioc = current->io_context;
@@ -233,17 +291,17 @@ loop_lock:
                                  * against it before looping
                                  */
                                 last_waited = ioc->last_waited;
+                                if (need_resched()) {
+                                        if (num_sync_run) {
+                                                blk_run_backing_dev(bdi, NULL);
+                                                num_sync_run = 0;
+                                        }
+                                        cond_resched();
+                                }
                                 continue;
                         }
                         spin_lock(&device->io_lock);
-
-                        old_head = device->pending_bios;
-                        device->pending_bios = pending;
-                        if (device->pending_bio_tail)
-                                tail->bi_next = old_head;
-                        else
-                                device->pending_bio_tail = tail;
-
+                        requeue_list(pending_bios, pending, tail);
                         device->running_pending = 1;
 
                         spin_unlock(&device->io_lock);
@@ -251,11 +309,18 @@ loop_lock:
                         goto done;
                 }
         }
+
+        if (num_sync_run) {
+                num_sync_run = 0;
+                blk_run_backing_dev(bdi, NULL);
+        }
+
+        cond_resched();
         if (again)
                 goto loop;
 
         spin_lock(&device->io_lock);
-        if (device->pending_bios)
+        if (device->pending_bios.head || device->pending_sync_bios.head)
                 goto loop_lock;
         spin_unlock(&device->io_lock);
 
@@ -2497,7 +2562,7 @@ again:
                         max_errors = 1;
                 }
         }
-        if (multi_ret && rw == WRITE &&
+        if (multi_ret && (rw & (1 << BIO_RW)) &&
             stripes_allocated < stripes_required) {
                 stripes_allocated = map->num_stripes;
                 free_extent_map(em);
@@ -2762,6 +2827,7 @@ static noinline int schedule_bio(struct btrfs_root *root,
                                  int rw, struct bio *bio)
 {
         int should_queue = 1;
+        struct btrfs_pending_bios *pending_bios;
 
         /* don't bother with additional async steps for reads, right now */
         if (!(rw & (1 << BIO_RW))) {
@@ -2783,13 +2849,17 @@ static noinline int schedule_bio(struct btrfs_root *root,
         bio->bi_rw |= rw;
 
         spin_lock(&device->io_lock);
+        if (bio_sync(bio))
+                pending_bios = &device->pending_sync_bios;
+        else
+                pending_bios = &device->pending_bios;
 
-        if (device->pending_bio_tail)
-                device->pending_bio_tail->bi_next = bio;
+        if (pending_bios->tail)
+                pending_bios->tail->bi_next = bio;
 
-        device->pending_bio_tail = bio;
-        if (!device->pending_bios)
-                device->pending_bios = bio;
+        pending_bios->tail = bio;
+        if (!pending_bios->head)
+                pending_bios->head = bio;
         if (device->running_pending)
                 should_queue = 0;
 
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 2185de72ff7d..5836327ba5dd 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -23,13 +23,22 @@
 #include "async-thread.h"
 
 struct buffer_head;
+struct btrfs_pending_bios {
+        struct bio *head;
+        struct bio *tail;
+};
+
 struct btrfs_device {
         struct list_head dev_list;
         struct list_head dev_alloc_list;
         struct btrfs_fs_devices *fs_devices;
         struct btrfs_root *dev_root;
-        struct bio *pending_bios;
-        struct bio *pending_bio_tail;
+
+        /* regular prio bios */
+        struct btrfs_pending_bios pending_bios;
+        /* WRITE_SYNC bios */
+        struct btrfs_pending_bios pending_sync_bios;
+
         int running_pending;
         u64 generation;
 
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 65984006192c..9d1fb6ec8a5a 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -15,7 +15,8 @@ Posix file open support added (turned off after one attempt if server
 fails to support it properly, as with Samba server versions prior to 3.3.2)
 Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too
 little memory for the "nativeFileSystem" field returned by the server
-during mount). 
+during mount).  Endian convert inode numbers if necessary (makes it easier
+to compare inode numbers on network files from big endian systems). 
 
 Version 1.56
 ------------
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 3fd3a9df043a..67bf93a40d2e 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -41,7 +41,7 @@ cifs_spnego_key_instantiate(struct key *key, const void *data, size_t datalen)
 
         /* attach the data */
         memcpy(payload, data, datalen);
-        rcu_assign_pointer(key->payload.data, payload);
+        key->payload.data = payload;
         ret = 0;
 
 error:
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 38491fd3871d..0d6d8b573652 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -66,9 +66,6 @@ unsigned int sign_CIFS_PDUs = 1;
 extern struct task_struct *oplockThread; /* remove sparse warning */
 struct task_struct *oplockThread = NULL;
 /* extern struct task_struct * dnotifyThread; remove sparse warning */
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-static struct task_struct *dnotifyThread = NULL;
-#endif
 static const struct super_operations cifs_super_ops;
 unsigned int CIFSMaxBufSize = CIFS_MAX_MSGSIZE;
 module_param(CIFSMaxBufSize, int, 0);
@@ -316,6 +313,7 @@ cifs_alloc_inode(struct super_block *sb)
         cifs_inode->clientCanCacheAll = false;
         cifs_inode->delete_pending = false;
         cifs_inode->vfs_inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
+        cifs_inode->server_eof = 0;
 
         /* Can not set i_flags here - they get immediately overwritten
            to zero by the VFS */
@@ -1040,34 +1038,6 @@ static int cifs_oplock_thread(void *dummyarg)
         return 0;
 }
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-static int cifs_dnotify_thread(void *dummyarg)
-{
-        struct list_head *tmp;
-        struct TCP_Server_Info *server;
-
-        do {
-                if (try_to_freeze())
-                        continue;
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(15*HZ);
-                /* check if any stuck requests that need
-                   to be woken up and wakeq so the
-                   thread can wake up and error out */
-                read_lock(&cifs_tcp_ses_lock);
-                list_for_each(tmp, &cifs_tcp_ses_list) {
-                        server = list_entry(tmp, struct TCP_Server_Info,
-                                         tcp_ses_list);
-                        if (atomic_read(&server->inFlight))
-                                wake_up_all(&server->response_q);
-                }
-                read_unlock(&cifs_tcp_ses_lock);
-        } while (!kthread_should_stop());
-
-        return 0;
-}
-#endif
-
 static int __init
 init_cifs(void)
 {
@@ -1144,21 +1114,8 @@ init_cifs(void)
                 goto out_unregister_dfs_key_type;
         }
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-        dnotifyThread = kthread_run(cifs_dnotify_thread, NULL, "cifsdnotifyd");
-        if (IS_ERR(dnotifyThread)) {
-                rc = PTR_ERR(dnotifyThread);
-                cERROR(1, ("error %d create dnotify thread", rc));
-                goto out_stop_oplock_thread;
-        }
-#endif
-
         return 0;
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
- out_stop_oplock_thread:
-#endif
-        kthread_stop(oplockThread);
  out_unregister_dfs_key_type:
 #ifdef CONFIG_CIFS_DFS_UPCALL
         unregister_key_type(&key_type_dns_resolver);
@@ -1196,9 +1153,6 @@ exit_cifs(void)
         cifs_destroy_inodecache();
         cifs_destroy_mids();
         cifs_destroy_request_bufs();
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-        kthread_stop(dnotifyThread);
-#endif
         kthread_stop(oplockThread);
 }
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 9fbf4dff5da6..df40ab64cd95 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -350,7 +350,7 @@ struct cifsFileInfo {
         bool invalidHandle:1;   /* file closed via session abend */
         bool messageMode:1;     /* for pipes: message vs byte mode */
         atomic_t wrtPending;   /* handle in use - defer close */
-        struct semaphore fh_sem; /* prevents reopen race after dead ses*/
+        struct mutex fh_mutex; /* prevents reopen race after dead ses*/
         struct cifs_search_info srch_inf;
 };
 
@@ -370,6 +370,7 @@ struct cifsInodeInfo {
         bool clientCanCacheAll:1;       /* read and writebehind oplock */
         bool oplockPending:1;
         bool delete_pending:1;          /* DELETE_ON_CLOSE is set */
+        u64  server_eof;                /* current file size on server */
         struct inode vfs_inode;
 };
 
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index b370489c8da5..a785f69dbc9f 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -2163,7 +2163,7 @@ typedef struct {
         __le32 Type;
         __le64 DevMajor;
         __le64 DevMinor;
-        __u64 UniqueId;
+        __le64 UniqueId;
         __le64 Permissions;
         __le64 Nlinks;
 } __attribute__((packed)) FILE_UNIX_BASIC_INFO; /* level 0x200 QPathInfo */
@@ -2308,7 +2308,7 @@ struct unlink_psx_rq { /* level 0x20a SetPathInfo */
 } __attribute__((packed));
 
 struct file_internal_info {
-        __u64  UniqueId; /* inode number */
+        __le64  UniqueId; /* inode number */
 } __attribute__((packed));      /* level 0x3ee */
 
 struct file_mode_info {
@@ -2338,7 +2338,7 @@ typedef struct {
         __le32 Type;
         __le64 DevMajor;
         __le64 DevMinor;
-        __u64 UniqueId;
+        __le64 UniqueId;
         __le64 Permissions;
         __le64 Nlinks;
         char FileName[1];
@@ -2386,7 +2386,7 @@ typedef struct {
         __le32 FileNameLength;
         __le32 EaSize; /* EA size */
         __le32 Reserved;
-        __u64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
+        __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
         char FileName[1];
 } __attribute__((packed)) SEARCH_ID_FULL_DIR_INFO; /* level 0x105 FF rsp data */
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index bc09c998631f..a0845dc7b8a9 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1626,6 +1626,8 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
         int smb_hdr_len;
         int resp_buf_type = 0;
 
+        *nbytes = 0;
+
         cFYI(1, ("write2 at %lld %d bytes", (long long)offset, count));
 
         if (tcon->ses->capabilities & CAP_LARGE_FILES) {
@@ -1682,11 +1684,9 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
         cifs_stats_inc(&tcon->num_writes);
         if (rc) {
                 cFYI(1, ("Send error Write2 = %d", rc));
-                *nbytes = 0;
         } else if (resp_buf_type == 0) {
                 /* presumably this can not happen, but best to be safe */
                 rc = -EIO;
-                *nbytes = 0;
         } else {
                 WRITE_RSP *pSMBr = (WRITE_RSP *)iov[0].iov_base;
                 *nbytes = le16_to_cpu(pSMBr->CountHigh);
@@ -3918,7 +3918,7 @@ GetInodeNumberRetry:
                         }
                         pfinfo = (struct file_internal_info *)
                                 (data_offset + (char *) &pSMBr->hdr.Protocol);
-                        *inode_number = pfinfo->UniqueId;
+                        *inode_number = le64_to_cpu(pfinfo->UniqueId);
                 }
         }
 GetInodeNumOut:
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 0de3b5615a22..bacdef1546b7 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2214,9 +2214,58 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
         return rc;
 }
 
+static void
+cleanup_volume_info(struct smb_vol **pvolume_info)
+{
+        struct smb_vol *volume_info;
+
+        if (!pvolume_info && !*pvolume_info)
+                return;
+
+        volume_info = *pvolume_info;
+        kzfree(volume_info->password);
+        kfree(volume_info->UNC);
+        kfree(volume_info->prepath);
+        kfree(volume_info);
+        *pvolume_info = NULL;
+        return;
+}
+
+#ifdef CONFIG_CIFS_DFS_UPCALL
+/* build_path_to_root returns full path to root when
+ * we do not have an exiting connection (tcon) */
+static char *
+build_unc_path_to_root(const struct smb_vol *volume_info,
+                const struct cifs_sb_info *cifs_sb)
+{
+        char *full_path;
+
+        int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
+        full_path = kmalloc(unc_len + cifs_sb->prepathlen + 1, GFP_KERNEL);
+        if (full_path == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        strncpy(full_path, volume_info->UNC, unc_len);
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
+                int i;
+                for (i = 0; i < unc_len; i++) {
+                        if (full_path[i] == '\\')
+                                full_path[i] = '/';
+                }
+        }
+
+        if (cifs_sb->prepathlen)
+                strncpy(full_path + unc_len, cifs_sb->prepath,
+                                cifs_sb->prepathlen);
+
+        full_path[unc_len + cifs_sb->prepathlen] = 0; /* add trailing null */
+        return full_path;
+}
+#endif
+
 int
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
-           char *mount_data, const char *devname)
+                char *mount_data_global, const char *devname)
 {
         int rc = 0;
         int xid;
@@ -2225,6 +2274,13 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         struct cifsTconInfo *tcon = NULL;
         struct TCP_Server_Info *srvTcp = NULL;
         char   *full_path;
+        char *mount_data = mount_data_global;
+#ifdef CONFIG_CIFS_DFS_UPCALL
+        struct dfs_info3_param *referrals = NULL;
+        unsigned int num_referrals = 0;
+try_mount_again:
+#endif
+        full_path = NULL;
 
         xid = GetXid();
 
@@ -2371,11 +2427,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 }
                         }
 
-                        /* check for null share name ie connect to dfs root */
                         if ((strchr(volume_info->UNC + 3, '\\') == NULL)
                             && (strchr(volume_info->UNC + 3, '/') == NULL)) {
-                                /* rc = connect_to_dfs_path(...) */
-                                cFYI(1, ("DFS root not supported"));
+                                cERROR(1, ("Missing share name"));
                                 rc = -ENODEV;
                                 goto mount_fail_check;
                         } else {
@@ -2392,7 +2446,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 }
                         }
                         if (rc)
-                                goto mount_fail_check;
+                                goto remote_path_check;
                         tcon->seal = volume_info->seal;
                         write_lock(&cifs_tcp_ses_lock);
                         list_add(&tcon->tcon_list, &pSesInfo->tcon_list);
@@ -2417,19 +2471,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
         sb->s_time_gran = 100;
 
-mount_fail_check:
-        /* on error free sesinfo and tcon struct if needed */
-        if (rc) {
-                /* If find_unc succeeded then rc == 0 so we can not end */
-                /* up accidently freeing someone elses tcon struct */
-                if (tcon)
-                        cifs_put_tcon(tcon);
-                else if (pSesInfo)
-                        cifs_put_smb_ses(pSesInfo);
-                else
-                        cifs_put_tcp_session(srvTcp);
-                goto out;
-        }
+        if (rc)
+                goto remote_path_check;
+
         cifs_sb->tcon = tcon;
 
         /* do not care if following two calls succeed - informational */
@@ -2461,7 +2505,9 @@ mount_fail_check:
                 cifs_sb->rsize = min(cifs_sb->rsize,
                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
 
-        if (!rc && cifs_sb->prepathlen) {
+remote_path_check:
+        /* check if a whole path (including prepath) is not remote */
+        if (!rc && cifs_sb->prepathlen && tcon) {
                 /* build_path_to_root works only when we have a valid tcon */
                 full_path = cifs_build_path_to_root(cifs_sb);
                 if (full_path == NULL) {
@@ -2469,31 +2515,79 @@ mount_fail_check:
                         goto mount_fail_check;
                 }
                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
-                if (rc) {
-                        cERROR(1, ("Path %s in not accessible: %d",
-                                                full_path, rc));
+                if (rc != -EREMOTE) {
                         kfree(full_path);
                         goto mount_fail_check;
                 }
                 kfree(full_path);
         }
 
+        /* get referral if needed */
+        if (rc == -EREMOTE) {
+#ifdef CONFIG_CIFS_DFS_UPCALL
+                /* convert forward to back slashes in prepath here if needed */
+                if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
+                        convert_delimiter(cifs_sb->prepath,
+                                        CIFS_DIR_SEP(cifs_sb));
+                full_path = build_unc_path_to_root(volume_info, cifs_sb);
+                if (IS_ERR(full_path)) {
+                        rc = PTR_ERR(full_path);
+                        goto mount_fail_check;
+                }
+
+                cFYI(1, ("Getting referral for: %s", full_path));
+                rc = get_dfs_path(xid, pSesInfo , full_path + 1,
+                        cifs_sb->local_nls, &num_referrals, &referrals,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+                if (!rc && num_referrals > 0) {
+                        char *fake_devname = NULL;
+
+                        if (mount_data != mount_data_global)
+                                kfree(mount_data);
+                        mount_data = cifs_compose_mount_options(
+                                        cifs_sb->mountdata, full_path + 1,
+                                        referrals, &fake_devname);
+                        kfree(fake_devname);
+                        free_dfs_info_array(referrals, num_referrals);
+
+                        if (tcon)
+                                cifs_put_tcon(tcon);
+                        else if (pSesInfo)
+                                cifs_put_smb_ses(pSesInfo);
+
+                        cleanup_volume_info(&volume_info);
+                        FreeXid(xid);
+                        kfree(full_path);
+                        goto try_mount_again;
+                }
+#else /* No DFS support, return error on mount */
+                rc = -EOPNOTSUPP;
+#endif
+        }
+
+mount_fail_check:
+        /* on error free sesinfo and tcon struct if needed */
+        if (rc) {
+                if (mount_data != mount_data_global)
+                        kfree(mount_data);
+                /* If find_unc succeeded then rc == 0 so we can not end */
+                /* up accidently freeing someone elses tcon struct */
+                if (tcon)
+                        cifs_put_tcon(tcon);
+                else if (pSesInfo)
+                        cifs_put_smb_ses(pSesInfo);
+                else
+                        cifs_put_tcp_session(srvTcp);
+                goto out;
+        }
+
         /* volume_info->password is freed above when existing session found
         (in which case it is not needed anymore) but when new sesion is created
         the password ptr is put in the new session structure (in which case the
         password will be freed at unmount time) */
 out:
         /* zero out password before freeing */
-        if (volume_info) {
-                if (volume_info->password != NULL) {
-                        memset(volume_info->password, 0,
-                                strlen(volume_info->password));
-                        kfree(volume_info->password);
-                }
-                kfree(volume_info->UNC);
-                kfree(volume_info->prepath);
-                kfree(volume_info);
-        }
+        cleanup_volume_info(&volume_info);
         FreeXid(xid);
         return rc;
 }
@@ -2673,8 +2767,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
-                                if (ses->serverOS)
-                                        kfree(ses->serverOS);
+                                kfree(ses->serverOS);
                                 ses->serverOS = kzalloc(2 * (len + 1),
                                                         GFP_KERNEL);
                                 if (ses->serverOS == NULL)
@@ -2710,8 +2803,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
                                 /* last string is not always null terminated
                                    (for e.g. for Windows XP & 2000) */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                     kzalloc(2*(len+1),
                                                             GFP_KERNEL);
@@ -2725,8 +2817,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 ses->serverDomain[1+(2*len)] = 0;
                                         } else { /* else no more room so create
                                                   dummy domain string */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                         kzalloc(2, GFP_KERNEL);
                                         }
@@ -2772,8 +2863,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         bcc_ptr++;
 
                                         len = strnlen(bcc_ptr, 1024);
-                                        if (ses->serverDomain)
-                                                kfree(ses->serverDomain);
+                                        kfree(ses->serverDomain);
                                         ses->serverDomain = kzalloc(len + 1,
                                                                     GFP_KERNEL);
                                         if (ses->serverDomain == NULL)
@@ -3013,8 +3103,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
 /* We look for obvious messed up bcc or strings in response so we do not go off
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
-                                        if (ses->serverOS)
-                                                kfree(ses->serverOS);
+                                        kfree(ses->serverOS);
                                         ses->serverOS =
                                             kzalloc(2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
@@ -3086,8 +3175,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                         if (((long) bcc_ptr + len) - (long)
                                             pByteArea(smb_buffer_response)
                                             <= BCC(smb_buffer_response)) {
-                                                if (ses->serverOS)
-                                                        kfree(ses->serverOS);
+                                                kfree(ses->serverOS);
                                                 ses->serverOS =
                                                     kzalloc(len + 1,
                                                             GFP_KERNEL);
@@ -3414,8 +3502,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
-                                        if (ses->serverOS)
-                                                kfree(ses->serverOS);
+                                        kfree(ses->serverOS);
                                         ses->serverOS =
                                             kzalloc(2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
@@ -3448,8 +3535,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 if (remaining_words > 0) {
                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
      /* last string not always null terminated (e.g. for Windows XP & 2000) */
-                                                        if (ses->serverDomain)
-                                                                kfree(ses->serverDomain);
+                                                        kfree(ses->serverDomain);
                                                         ses->serverDomain =
                                                             kzalloc(2 *
                                                                     (len +
@@ -3476,13 +3562,11 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                             = 0;
                                                 } /* else no more room so create dummy domain string */
                                                 else {
-                                                        if (ses->serverDomain)
-                                                                kfree(ses->serverDomain);
+                                                        kfree(ses->serverDomain);
                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
                                                 }
                                         } else {  /* no room so create dummy domain and NOS string */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
                                                 kfree(ses->serverNOS);
                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
@@ -3492,8 +3576,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         if (((long) bcc_ptr + len) -
                                            (long) pByteArea(smb_buffer_response)
                                                 <= BCC(smb_buffer_response)) {
-                                                if (ses->serverOS)
-                                                        kfree(ses->serverOS);
+                                                kfree(ses->serverOS);
                                                 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
                                                 strncpy(ses->serverOS,bcc_ptr, len);
 
@@ -3512,8 +3595,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 bcc_ptr++;
 
                                                 len = strnlen(bcc_ptr, 1024);
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                                 kzalloc(len+1,
                                                                     GFP_KERNEL);
@@ -3674,16 +3756,15 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                             BCC(smb_buffer_response)) {
                                 kfree(tcon->nativeFileSystem);
                                 tcon->nativeFileSystem =
-                                    kzalloc(2*(length + 1), GFP_KERNEL);
-                                if (tcon->nativeFileSystem)
+                                    kzalloc((4 * length) + 2, GFP_KERNEL);
+                                if (tcon->nativeFileSystem) {
                                         cifs_strfromUCS_le(
                                                 tcon->nativeFileSystem,
                                                 (__le16 *) bcc_ptr,
                                                 length, nls_codepage);
-                                bcc_ptr += 2 * length;
-                                bcc_ptr[0] = 0; /* null terminate the string */
-                                bcc_ptr[1] = 0;
-                                bcc_ptr += 2;
+                                        cFYI(1, ("nativeFileSystem=%s",
+                                                tcon->nativeFileSystem));
+                                }
                         }
                         /* else do not bother copying these information fields*/
                 } else {
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 54dce78fbb73..461750e01364 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -129,12 +129,62 @@ cifs_bp_rename_retry:
         return full_path;
 }
 
+static void
+cifs_fill_fileinfo(struct inode *newinode, __u16 fileHandle,
+                        struct cifsTconInfo *tcon, bool write_only)
+{
+        int oplock = 0;
+        struct cifsFileInfo *pCifsFile;
+        struct cifsInodeInfo *pCifsInode;
+
+        pCifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
+
+        if (pCifsFile == NULL)
+                return;
+
+        if (oplockEnabled)
+                oplock = REQ_OPLOCK;
+
+        pCifsFile->netfid = fileHandle;
+        pCifsFile->pid = current->tgid;
+        pCifsFile->pInode = newinode;
+        pCifsFile->invalidHandle = false;
+        pCifsFile->closePend = false;
+        mutex_init(&pCifsFile->fh_mutex);
+        mutex_init(&pCifsFile->lock_mutex);
+        INIT_LIST_HEAD(&pCifsFile->llist);
+        atomic_set(&pCifsFile->wrtPending, 0);
+
+        /* set the following in open now
+                        pCifsFile->pfile = file; */
+        write_lock(&GlobalSMBSeslock);
+        list_add(&pCifsFile->tlist, &tcon->openFileList);
+        pCifsInode = CIFS_I(newinode);
+        if (pCifsInode) {
+                /* if readable file instance put first in list*/
+                if (write_only)
+                        list_add_tail(&pCifsFile->flist,
+                                      &pCifsInode->openFileList);
+                else
+                        list_add(&pCifsFile->flist, &pCifsInode->openFileList);
+
+                if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
+                        pCifsInode->clientCanCacheAll = true;
+                        pCifsInode->clientCanCacheRead = true;
+                        cFYI(1, ("Exclusive Oplock inode %p", newinode));
+                } else if ((oplock & 0xF) == OPLOCK_READ)
+                                pCifsInode->clientCanCacheRead = true;
+        }
+        write_unlock(&GlobalSMBSeslock);
+}
+
 int cifs_posix_open(char *full_path, struct inode **pinode,
                     struct super_block *sb, int mode, int oflags,
                     int *poplock, __u16 *pnetfid, int xid)
 {
         int rc;
         __u32 oplock;
+        bool write_only = false;
         FILE_UNIX_BASIC_INFO *presp_data;
         __u32 posix_flags = 0;
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
@@ -172,6 +222,8 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
         if (oflags & O_DIRECT)
                 posix_flags |= SMB_O_DIRECT;
 
+        if (!(oflags & FMODE_READ))
+                write_only = true;
 
         rc = CIFSPOSIXCreate(xid, cifs_sb->tcon, posix_flags, mode,
                         pnetfid, presp_data, &oplock, full_path,
@@ -187,8 +239,10 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
         if (!pinode)
                 goto posix_open_ret; /* caller does not need info */
 
-        if (*pinode == NULL)
-                *pinode = cifs_new_inode(sb, &presp_data->UniqueId);
+        if (*pinode == NULL) {
+                __u64 unique_id = le64_to_cpu(presp_data->UniqueId);
+                *pinode = cifs_new_inode(sb, &unique_id);
+        }
         /* else an inode was passed in. Update its info, don't create one */
 
         /* We do not need to close the file if new_inode fails since
@@ -198,6 +252,8 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
 
         posix_fill_in_inode(*pinode, presp_data, 1);
 
+        cifs_fill_fileinfo(*pinode, *pnetfid, cifs_sb->tcon, write_only);
+
 posix_open_ret:
         kfree(presp_data);
         return rc;
@@ -239,7 +295,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
         char *full_path = NULL;
         FILE_ALL_INFO *buf = NULL;
         struct inode *newinode = NULL;
-        struct cifsInodeInfo *pCifsInode;
         int disposition = FILE_OVERWRITE_IF;
         bool write_only = false;
 
@@ -410,44 +465,8 @@ cifs_create_set_dentry:
                 /* mknod case - do not leave file open */
                 CIFSSMBClose(xid, tcon, fileHandle);
         } else if (newinode) {
-                struct cifsFileInfo *pCifsFile =
-                        kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
-
-                if (pCifsFile == NULL)
-                        goto cifs_create_out;
-                pCifsFile->netfid = fileHandle;
-                pCifsFile->pid = current->tgid;
-                pCifsFile->pInode = newinode;
-                pCifsFile->invalidHandle = false;
-                pCifsFile->closePend     = false;
-                init_MUTEX(&pCifsFile->fh_sem);
-                mutex_init(&pCifsFile->lock_mutex);
-                INIT_LIST_HEAD(&pCifsFile->llist);
-                atomic_set(&pCifsFile->wrtPending, 0);
-
-                /* set the following in open now
-                                pCifsFile->pfile = file; */
-                write_lock(&GlobalSMBSeslock);
-                list_add(&pCifsFile->tlist, &tcon->openFileList);
-                pCifsInode = CIFS_I(newinode);
-                if (pCifsInode) {
-                        /* if readable file instance put first in list*/
-                        if (write_only) {
-                                list_add_tail(&pCifsFile->flist,
-                                              &pCifsInode->openFileList);
-                        } else {
-                                list_add(&pCifsFile->flist,
-                                         &pCifsInode->openFileList);
-                        }
-                        if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
-                                pCifsInode->clientCanCacheAll = true;
-                                pCifsInode->clientCanCacheRead = true;
-                                cFYI(1, ("Exclusive Oplock inode %p",
-                                        newinode));
-                        } else if ((oplock & 0xF) == OPLOCK_READ)
-                                pCifsInode->clientCanCacheRead = true;
-                }
-                write_unlock(&GlobalSMBSeslock);
+                        cifs_fill_fileinfo(newinode, fileHandle,
+                                        cifs_sb->tcon, write_only);
         }
 cifs_create_out:
         kfree(buf);
@@ -580,17 +599,21 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, int mode,
         return rc;
 }
 
-
 struct dentry *
 cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
             struct nameidata *nd)
 {
         int xid;
         int rc = 0; /* to get around spurious gcc warning, set to zero here */
+        int oplock = 0;
+        int mode;
+        __u16 fileHandle = 0;
+        bool posix_open = false;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         struct inode *newInode = NULL;
         char *full_path = NULL;
+        struct file *filp;
 
         xid = GetXid();
 
@@ -632,12 +655,37 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
         }
         cFYI(1, ("Full path: %s inode = 0x%p", full_path, direntry->d_inode));
 
-        if (pTcon->unix_ext)
-                rc = cifs_get_inode_info_unix(&newInode, full_path,
-                                              parent_dir_inode->i_sb, xid);
-        else
+        if (pTcon->unix_ext) {
+                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+                                (nd->flags & LOOKUP_OPEN)) {
+                        if (!((nd->intent.open.flags & O_CREAT) &&
+                                        (nd->intent.open.flags & O_EXCL))) {
+                                mode = nd->intent.open.create_mode &
+                                                ~current_umask();
+                                rc = cifs_posix_open(full_path, &newInode,
+                                        parent_dir_inode->i_sb, mode,
+                                        nd->intent.open.flags, &oplock,
+                                        &fileHandle, xid);
+                                /*
+                                 * This code works around a bug in
+                                 * samba posix open in samba versions 3.3.1
+                                 * and earlier where create works
+                                 * but open fails with invalid parameter.
+                                 * If either of these error codes are
+                                 * returned, follow the normal lookup.
+                                 * Otherwise, the error during posix open
+                                 * is handled.
+                                 */
+                                if ((rc != -EINVAL) && (rc != -EOPNOTSUPP))
+                                        posix_open = true;
+                        }
+                }
+                if (!posix_open)
+                        rc = cifs_get_inode_info_unix(&newInode, full_path,
+                                                parent_dir_inode->i_sb, xid);
+        } else
                 rc = cifs_get_inode_info(&newInode, full_path, NULL,
-                                         parent_dir_inode->i_sb, xid, NULL);
+                                parent_dir_inode->i_sb, xid, NULL);
 
         if ((rc == 0) && (newInode != NULL)) {
                 if (pTcon->nocase)
@@ -645,7 +693,8 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                 else
                         direntry->d_op = &cifs_dentry_ops;
                 d_add(direntry, newInode);
-
+                if (posix_open)
+                        filp = lookup_instantiate_filp(nd, direntry, NULL);
                 /* since paths are not looked up by component - the parent
                    directories are presumed to be good here */
                 renew_parental_timestamps(direntry);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 1e0c1bd8f2e4..df4a306f697e 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -78,7 +78,7 @@ dns_resolver_instantiate(struct key *key, const void *data,
         }
 
         key->type_data.x[0] = datalen;
-        rcu_assign_pointer(key->payload.data, ip);
+        key->payload.data = ip;
 
         return rc;
 }
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 81747acca4c4..50ca088d8860 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -46,7 +46,7 @@ static inline struct cifsFileInfo *cifs_init_private(
         memset(private_data, 0, sizeof(struct cifsFileInfo));
         private_data->netfid = netfid;
         private_data->pid = current->tgid;
-        init_MUTEX(&private_data->fh_sem);
+        mutex_init(&private_data->fh_mutex);
         mutex_init(&private_data->lock_mutex);
         INIT_LIST_HEAD(&private_data->llist);
         private_data->pfile = file; /* needed for writepage */
@@ -284,35 +284,32 @@ int cifs_open(struct inode *inode, struct file *file)
         cifs_sb = CIFS_SB(inode->i_sb);
         tcon = cifs_sb->tcon;
 
-        if (file->f_flags & O_CREAT) {
-                /* search inode for this file and fill in file->private_data */
-                pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-                read_lock(&GlobalSMBSeslock);
-                list_for_each(tmp, &pCifsInode->openFileList) {
-                        pCifsFile = list_entry(tmp, struct cifsFileInfo,
-                                               flist);
-                        if ((pCifsFile->pfile == NULL) &&
-                            (pCifsFile->pid == current->tgid)) {
-                                /* mode set in cifs_create */
-
-                                /* needed for writepage */
-                                pCifsFile->pfile = file;
-
-                                file->private_data = pCifsFile;
-                                break;
-                        }
-                }
-                read_unlock(&GlobalSMBSeslock);
-                if (file->private_data != NULL) {
-                        rc = 0;
-                        FreeXid(xid);
-                        return rc;
-                } else {
-                        if (file->f_flags & O_EXCL)
-                                cERROR(1, ("could not find file instance for "
-                                           "new file %p", file));
+        /* search inode for this file and fill in file->private_data */
+        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
+        read_lock(&GlobalSMBSeslock);
+        list_for_each(tmp, &pCifsInode->openFileList) {
+                pCifsFile = list_entry(tmp, struct cifsFileInfo,
+                                       flist);
+                if ((pCifsFile->pfile == NULL) &&
+                    (pCifsFile->pid == current->tgid)) {
+                        /* mode set in cifs_create */
+
+                        /* needed for writepage */
+                        pCifsFile->pfile = file;
+
+                        file->private_data = pCifsFile;
+                        break;
                 }
         }
+        read_unlock(&GlobalSMBSeslock);
+
+        if (file->private_data != NULL) {
+                rc = 0;
+                FreeXid(xid);
+                return rc;
+        } else if ((file->f_flags & O_CREAT) && (file->f_flags & O_EXCL))
+                        cERROR(1, ("could not find file instance for "
+                                   "new file %p", file));
 
         full_path = build_path_from_dentry(file->f_path.dentry);
         if (full_path == NULL) {
@@ -500,9 +497,9 @@ static int cifs_reopen_file(struct file *file, bool can_flush)
                 return -EBADF;
 
         xid = GetXid();
-        down(&pCifsFile->fh_sem);
+        mutex_unlock(&pCifsFile->fh_mutex);
         if (!pCifsFile->invalidHandle) {
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 FreeXid(xid);
                 return 0;
         }
@@ -533,7 +530,7 @@ static int cifs_reopen_file(struct file *file, bool can_flush)
         if (full_path == NULL) {
                 rc = -ENOMEM;
 reopen_error_exit:
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 FreeXid(xid);
                 return rc;
         }
@@ -575,14 +572,14 @@ reopen_error_exit:
                          cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc) {
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 cFYI(1, ("cifs_open returned 0x%x", rc));
                 cFYI(1, ("oplock: %d", oplock));
         } else {
 reopen_success:
                 pCifsFile->netfid = netfid;
                 pCifsFile->invalidHandle = false;
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 pCifsInode = CIFS_I(inode);
                 if (pCifsInode) {
                         if (can_flush) {
@@ -971,6 +968,40 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
         return rc;
 }
 
+/*
+ * Set the timeout on write requests past EOF. For some servers (Windows)
+ * these calls can be very long.
+ *
+ * If we're writing >10M past the EOF we give a 180s timeout. Anything less
+ * than that gets a 45s timeout. Writes not past EOF get 15s timeouts.
+ * The 10M cutoff is totally arbitrary. A better scheme for this would be
+ * welcome if someone wants to suggest one.
+ *
+ * We may be able to do a better job with this if there were some way to
+ * declare that a file should be sparse.
+ */
+static int
+cifs_write_timeout(struct cifsInodeInfo *cifsi, loff_t offset)
+{
+        if (offset <= cifsi->server_eof)
+                return CIFS_STD_OP;
+        else if (offset > (cifsi->server_eof + (10 * 1024 * 1024)))
+                return CIFS_VLONG_OP;
+        else
+                return CIFS_LONG_OP;
+}
+
+/* update the file size (if needed) after a write */
+static void
+cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
+                      unsigned int bytes_written)
+{
+        loff_t end_of_write = offset + bytes_written;
+
+        if (end_of_write > cifsi->server_eof)
+                cifsi->server_eof = end_of_write;
+}
+
 ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         size_t write_size, loff_t *poffset)
 {
@@ -981,6 +1012,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         struct cifsTconInfo *pTcon;
         int xid, long_op;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(file->f_path.dentry->d_inode);
 
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
 
@@ -1000,11 +1032,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
 
         xid = GetXid();
 
-        if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = CIFS_VLONG_OP; /* writes past EOF take long time */
-        else
-                long_op = CIFS_LONG_OP;
-
+        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -1048,8 +1076,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
                                 FreeXid(xid);
                                 return rc;
                         }
-                } else
+                } else {
+                        cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
+                }
                 long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
@@ -1085,6 +1115,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
         struct cifsTconInfo *pTcon;
         int xid, long_op;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(file->f_path.dentry->d_inode);
 
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
 
@@ -1099,11 +1130,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
 
         xid = GetXid();
 
-        if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = CIFS_VLONG_OP; /* writes past EOF can be slow */
-        else
-                long_op = CIFS_LONG_OP;
-
+        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -1166,8 +1193,10 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
                                 FreeXid(xid);
                                 return rc;
                         }
-                } else
+                } else {
+                        cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
+                }
                 long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
@@ -1380,11 +1409,12 @@ static int cifs_writepages(struct address_space *mapping,
         int nr_pages;
         __u64 offset = 0;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(mapping->host);
         struct page *page;
         struct pagevec pvec;
         int rc = 0;
         int scanned = 0;
-        int xid;
+        int xid, long_op;
 
         cifs_sb = CIFS_SB(mapping->host->i_sb);
 
@@ -1528,12 +1558,15 @@ retry:
                                 cERROR(1, ("No writable handles for inode"));
                                 rc = -EBADF;
                         } else {
+                                long_op = cifs_write_timeout(cifsi, offset);
                                 rc = CIFSSMBWrite2(xid, cifs_sb->tcon,
                                                    open_file->netfid,
                                                    bytes_to_write, offset,
                                                    &bytes_written, iov, n_iov,
-                                                   CIFS_LONG_OP);
+                                                   long_op);
                                 atomic_dec(&open_file->wrtPending);
+                                cifs_update_eof(cifsi, offset, bytes_written);
+
                                 if (rc || bytes_written < bytes_to_write) {
                                         cERROR(1, ("Write2 ret %d, wrote %d",
                                                   rc, bytes_written));
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f121a80fdd6f..f36b4e40e443 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -143,6 +143,7 @@ static void cifs_unix_info_to_inode(struct inode *inode,
 
         inode->i_nlink = le64_to_cpu(info->Nlinks);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /*
@@ -276,7 +277,8 @@ int cifs_get_inode_info_unix(struct inode **pinode,
 
         /* get new inode */
         if (*pinode == NULL) {
-                *pinode = cifs_new_inode(sb, &find_data.UniqueId);
+                __u64 unique_id = le64_to_cpu(find_data.UniqueId);
+                *pinode = cifs_new_inode(sb, &unique_id);
                 if (*pinode == NULL) {
                         rc = -ENOMEM;
                         goto cgiiu_exit;
@@ -605,12 +607,12 @@ int cifs_get_inode_info(struct inode **pinode,
                         inode->i_mode |= S_IFREG;
         }
 
+        cifsInfo->server_eof = le64_to_cpu(pfindData->EndOfFile);
         spin_lock(&inode->i_lock);
-        if (is_size_safe_to_change(cifsInfo,
-                                   le64_to_cpu(pfindData->EndOfFile))) {
+        if (is_size_safe_to_change(cifsInfo, cifsInfo->server_eof)) {
                 /* can not safely shrink the file size here if the
                    client is writing to it due to potential races */
-                i_size_write(inode, le64_to_cpu(pfindData->EndOfFile));
+                i_size_write(inode, cifsInfo->server_eof);
 
                 /* 512 bytes (2**9) is the fake blocksize that must be
                    used for this calculation */
@@ -1138,6 +1140,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         cFYI(1, ("posix mkdir returned 0x%x", rc));
                         d_drop(direntry);
                 } else {
+                        __u64 unique_id;
                         if (pInfo->Type == cpu_to_le32(-1)) {
                                 /* no return info, go query for it */
                                 kfree(pInfo);
@@ -1151,8 +1154,8 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         else
                                 direntry->d_op = &cifs_dentry_ops;
 
-                        newinode = cifs_new_inode(inode->i_sb,
-                                                  &pInfo->UniqueId);
+                        unique_id = le64_to_cpu(pInfo->UniqueId);
+                        newinode = cifs_new_inode(inode->i_sb, &unique_id);
                         if (newinode == NULL) {
                                 kfree(pInfo);
                                 goto mkdir_get_info;
@@ -1450,7 +1453,8 @@ int cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
                      checking the UniqueId via FILE_INTERNAL_INFO */
 
 unlink_target:
-        if ((rc == -EACCES) || (rc == -EEXIST)) {
+        /* Try unlinking the target dentry if it's not negative */
+        if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST)) {
                 tmprc = cifs_unlink(target_dir, target_dentry);
                 if (tmprc)
                         goto cifs_rename_exit;
@@ -1753,6 +1757,7 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
         }
 
         if (rc == 0) {
+                cifsInode->server_eof = attrs->ia_size;
                 rc = cifs_vmtruncate(inode, attrs->ia_size);
                 cifs_truncate_page(inode->i_mapping, inode->i_size);
         }
@@ -1792,20 +1797,21 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
                 goto out;
         }
 
-        if ((attrs->ia_valid & ATTR_MTIME) || (attrs->ia_valid & ATTR_SIZE)) {
-                /*
-                   Flush data before changing file size or changing the last
-                   write time of the file on the server. If the
-                   flush returns error, store it to report later and continue.
-                   BB: This should be smarter. Why bother flushing pages that
-                   will be truncated anyway? Also, should we error out here if
-                   the flush returns error?
-                 */
-                rc = filemap_write_and_wait(inode->i_mapping);
-                if (rc != 0) {
-                        cifsInode->write_behind_rc = rc;
-                        rc = 0;
-                }
+        /*
+         * Attempt to flush data before changing attributes. We need to do
+         * this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the
+         * ownership or mode then we may also need to do this. Here, we take
+         * the safe way out and just do the flush on all setattr requests. If
+         * the flush returns error, store it to report later and continue.
+         *
+         * BB: This should be smarter. Why bother flushing pages that
+         * will be truncated anyway? Also, should we error out here if
+         * the flush returns error?
+         */
+        rc = filemap_write_and_wait(inode->i_mapping);
+        if (rc != 0) {
+                cifsInode->write_behind_rc = rc;
+                rc = 0;
         }
 
         if (attrs->ia_valid & ATTR_SIZE) {
@@ -1903,20 +1909,21 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
                 return -ENOMEM;
         }
 
-        if ((attrs->ia_valid & ATTR_MTIME) || (attrs->ia_valid & ATTR_SIZE)) {
-                /*
-                   Flush data before changing file size or changing the last
-                   write time of the file on the server. If the
-                   flush returns error, store it to report later and continue.
-                   BB: This should be smarter. Why bother flushing pages that
-                   will be truncated anyway? Also, should we error out here if
-                   the flush returns error?
-                 */
-                rc = filemap_write_and_wait(inode->i_mapping);
-                if (rc != 0) {
-                        cifsInode->write_behind_rc = rc;
-                        rc = 0;
-                }
+        /*
+         * Attempt to flush data before changing attributes. We need to do
+         * this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the
+         * ownership or mode then we may also need to do this. Here, we take
+         * the safe way out and just do the flush on all setattr requests. If
+         * the flush returns error, store it to report later and continue.
+         *
+         * BB: This should be smarter. Why bother flushing pages that
+         * will be truncated anyway? Also, should we error out here if
+         * the flush returns error?
+         */
+        rc = filemap_write_and_wait(inode->i_mapping);
+        if (rc != 0) {
+                cifsInode->write_behind_rc = rc;
+                rc = 0;
         }
 
         if (attrs->ia_valid & ATTR_SIZE) {
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index c2c01ff4c32c..1a8be6228333 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -239,6 +239,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         if (atomic_read(&cifsInfo->inUse) == 0)
                 atomic_set(&cifsInfo->inUse, 1);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&tmp_inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /* can not safely change the file size here if the
@@ -375,6 +376,7 @@ static void unix_fill_in_inode(struct inode *tmp_inode,
                 tmp_inode->i_gid = le64_to_cpu(pfindData->Gid);
         tmp_inode->i_nlink = le64_to_cpu(pfindData->Nlinks);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&tmp_inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /* can not safely change the file size here if the
@@ -840,7 +842,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                         len = strnlen(filename, PATH_MAX);
                 }
 
-                *pinum = pFindData->UniqueId;
+                *pinum = le64_to_cpu(pFindData->UniqueId);
         } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
                 FILE_DIRECTORY_INFO *pFindData =
                         (FILE_DIRECTORY_INFO *)current_entry;
@@ -856,7 +858,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                         (SEARCH_ID_FULL_DIR_INFO *)current_entry;
                 filename = &pFindData->FileName[0];
                 len = le32_to_cpu(pFindData->FileNameLength);
-                *pinum = pFindData->UniqueId;
+                *pinum = le64_to_cpu(pFindData->UniqueId);
         } else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
                 FILE_BOTH_DIRECTORY_INFO *pFindData =
                         (FILE_BOTH_DIRECTORY_INFO *)current_entry;
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 5c68b4282be9..c652c73760dd 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -285,35 +285,36 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         int words_left, len;
         char *data = *pbcc_area;
 
-
-
         cFYI(1, ("bleft %d", bleft));
 
-
-        /* SMB header is unaligned, so cifs servers word align start of
-           Unicode strings */
-        data++;
-        bleft--; /* Windows servers do not always double null terminate
-                    their final Unicode string - in which case we
-                    now will not attempt to decode the byte of junk
-                    which follows it */
+        /*
+         * Windows servers do not always double null terminate their final
+         * Unicode string. Check to see if there are an uneven number of bytes
+         * left. If so, then add an extra NULL pad byte to the end of the
+         * response.
+         *
+         * See section 2.7.2 in "Implementing CIFS" for details
+         */
+        if (bleft % 2) {
+                data[bleft] = 0;
+                ++bleft;
+        }
 
         words_left = bleft / 2;
 
         /* save off server operating system */
         len = UniStrnlen((wchar_t *) data, words_left);
 
-/* We look for obvious messed up bcc or strings in response so we do not go off
-   the end since (at least) WIN2K and Windows XP have a major bug in not null
-   terminating last Unicode string in response  */
         if (len >= words_left)
                 return rc;
 
         kfree(ses->serverOS);
         /* UTF-8 string will not grow more than four times as big as UCS-16 */
         ses->serverOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
-        if (ses->serverOS != NULL)
+        if (ses->serverOS != NULL) {
                 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp);
+                cFYI(1, ("serverOS=%s", ses->serverOS));
+        }
         data += 2 * (len + 1);
         words_left -= len + 1;
 
@@ -328,6 +329,7 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         if (ses->serverNOS != NULL) {
                 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
                                    nls_cp);
+                cFYI(1, ("serverNOS=%s", ses->serverNOS));
                 if (strncmp(ses->serverNOS, "NT LAN Manager 4", 16) == 0) {
                         cFYI(1, ("NT4 server"));
                         ses->flags |= CIFS_SES_NT4;
@@ -343,12 +345,11 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
                 return rc;
 
         kfree(ses->serverDomain);
-        ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
+        ses->serverDomain = kzalloc((4 * len) + 2, GFP_KERNEL);
         if (ses->serverDomain != NULL) {
                 cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
                                    nls_cp);
-                ses->serverDomain[2*len] = 0;
-                ses->serverDomain[(2*len) + 1] = 0;
+                cFYI(1, ("serverDomain=%s", ses->serverDomain));
         }
         data += 2 * (len + 1);
         words_left -= len + 1;
@@ -702,12 +703,18 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
         }
 
         /* BB check if Unicode and decode strings */
-        if (smb_buf->Flags2 & SMBFLG2_UNICODE)
+        if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+                /* unicode string area must be word-aligned */
+                if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
+                        ++bcc_ptr;
+                        --bytes_remaining;
+                }
                 rc = decode_unicode_ssetup(&bcc_ptr, bytes_remaining,
-                                                   ses, nls_cp);
-        else
+                                           ses, nls_cp);
+        } else {
                 rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining,
                                          ses, nls_cp);
+        }
 
 ssetup_exit:
         if (spnego_key) {
diff --git a/fs/compat.c b/fs/compat.c
index 3f84d5f15889..379a399bf5c3 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -181,22 +181,24 @@ asmlinkage long compat_sys_newstat(char __user * filename,
                 struct compat_stat __user *statbuf)
 {
         struct kstat stat;
-        int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_compat_stat(&stat, statbuf);
-        return error;
+        error = vfs_stat(filename, &stat);
+        if (error)
+                return error;
+        return cp_compat_stat(&stat, statbuf);
 }
 
 asmlinkage long compat_sys_newlstat(char __user * filename,
                 struct compat_stat __user *statbuf)
 {
         struct kstat stat;
-        int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_compat_stat(&stat, statbuf);
-        return error;
+        error = vfs_lstat(filename, &stat);
+        if (error)
+                return error;
+        return cp_compat_stat(&stat, statbuf);
 }
 
 #ifndef __ARCH_WANT_STAT64
@@ -204,21 +206,12 @@ asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user *filename,
                 struct compat_stat __user *statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_compat_stat(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_compat_stat(&stat, statbuf);
 }
 #endif
 
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 3e87ce443ea2..b83f6bcfa51a 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -58,7 +58,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c-dev.h>
 #include <linux/atalk.h>
-#include <linux/loop.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci.h>
@@ -68,6 +67,7 @@
 #include <linux/gigaset_dev.h>
 
 #ifdef CONFIG_BLOCK
+#include <linux/loop.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_ioctl.h>
 #include <scsi/sg.h>
@@ -2660,6 +2660,8 @@ HANDLE_IOCTL(SONET_GETFRAMING, do_atm_ioctl)
 HANDLE_IOCTL(SONET_GETFRSENSE, do_atm_ioctl)
 /* block stuff */
 #ifdef CONFIG_BLOCK
+/* loop */
+IGNORE_IOCTL(LOOP_CLR_FD)
 /* Raw devices */
 HANDLE_IOCTL(RAW_SETBIND, raw_ioctl)
 HANDLE_IOCTL(RAW_GETBIND, raw_ioctl)
@@ -2728,9 +2730,6 @@ HANDLE_IOCTL(LPSETTIMEOUT, lp_timeout_trans)
 IGNORE_IOCTL(VFAT_IOCTL_READDIR_BOTH32)
 IGNORE_IOCTL(VFAT_IOCTL_READDIR_SHORT32)
 
-/* loop */
-IGNORE_IOCTL(LOOP_CLR_FD)
-
 #ifdef CONFIG_SPARC
 /* Sparc framebuffers, handled in sbusfb_compat_ioctl() */
 IGNORE_IOCTL(FBIOGTYPE)
diff --git a/fs/dcache.c b/fs/dcache.c
index 761d30be2683..1fcffebfb44f 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2149,7 +2149,6 @@ int is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
         int result;
         unsigned long seq;
 
-        /* FIXME: This is old behavior, needed? Please check callers. */
         if (new_dentry == old_dentry)
                 return 1;
 
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index a67fea655f49..dda3c58eefc0 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -418,18 +418,13 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
 
         if (count == 0)
                 goto out;
-        data = kmalloc(count, GFP_KERNEL);
-        if (!data) {
-                printk(KERN_ERR "%s: Out of memory whilst attempting to "
-                       "kmalloc([%zd], GFP_KERNEL)\n", __func__, count);
+
+        data = memdup_user(buf, count);
+        if (IS_ERR(data)) {
+                printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
+                       __func__, PTR_ERR(data));
                 goto out;
         }
-        rc = copy_from_user(data, buf, count);
-        if (rc) {
-                printk(KERN_ERR "%s: copy_from_user returned error [%d]\n",
-                       __func__, rc);
-                goto out_free;
-        }
         sz = count;
         i = 0;
         switch (data[i++]) {
diff --git a/fs/filesystems.c b/fs/filesystems.c
index 1aa70260e6d1..a24c58e181db 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -199,7 +199,7 @@ SYSCALL_DEFINE3(sysfs, int, option, unsigned long, arg1, unsigned long, arg2)
         return retval;
 }
 
-int get_filesystem_list(char * buf)
+int __init get_filesystem_list(char *buf)
 {
         int len = 0;
         struct file_system_type * tmp;
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index bf23a62aa925..70f87f43afa2 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -156,6 +156,12 @@ static void inode_go_sync(struct gfs2_glock *gl)
         error = filemap_fdatawait(metamapping);
         mapping_set_error(metamapping, error);
         gfs2_ail_empty_gl(gl);
+        /*
+         * Writeback of the data mapping may cause the dirty flag to be set
+         * so we have to clear it again here.
+         */
+        smp_mb__before_clear_bit();
+        clear_bit(GLF_DIRTY, &gl->gl_flags);
 }
 
 /**
diff --git a/fs/gfs2/ops_file.c b/fs/gfs2/ops_file.c
index 101caf3ee861..5d82e91887e3 100644
--- a/fs/gfs2/ops_file.c
+++ b/fs/gfs2/ops_file.c
@@ -413,7 +413,9 @@ out_unlock:
         gfs2_glock_dq(&gh);
 out:
         gfs2_holder_uninit(&gh);
-        if (ret)
+        if (ret == -ENOMEM)
+                ret = VM_FAULT_OOM;
+        else if (ret)
                 ret = VM_FAULT_SIGBUS;
         return ret;
 }
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 23a3c76711e0..153d9681192b 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -26,7 +26,6 @@
 #include <linux/pagevec.h>
 #include <linux/parser.h>
 #include <linux/mman.h>
-#include <linux/quotaops.h>
 #include <linux/slab.h>
 #include <linux/dnotify.h>
 #include <linux/statfs.h>
@@ -842,7 +841,7 @@ hugetlbfs_parse_options(char *options, struct hugetlbfs_config *pconfig)
 bad_val:
         printk(KERN_ERR "hugetlbfs: Bad value '%s' for mount option '%s'\n",
                args[0].from, p);
-        return 1;
+        return -EINVAL;
 }
 
 static int
diff --git a/fs/namei.c b/fs/namei.c
index b8433ebfae05..78f253cd2d4f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1248,6 +1248,8 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
         int err;
         struct qstr this;
 
+        WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
+
         err = __lookup_one_len(name, &this, base, len);
         if (err)
                 return ERR_PTR(err);
diff --git a/fs/namespace.c b/fs/namespace.c
index c6f54e4c4290..41196209a906 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1377,7 +1377,7 @@ static int attach_recursive_mnt(struct vfsmount *source_mnt,
         if (parent_path) {
                 detach_mnt(source_mnt, parent_path);
                 attach_mnt(source_mnt, path);
-                touch_mnt_namespace(current->nsproxy->mnt_ns);
+                touch_mnt_namespace(parent_path->mnt->mnt_ns);
         } else {
                 mnt_set_mountpoint(dest_mnt, dest_dentry, source_mnt);
                 commit_tree(source_mnt);
@@ -1920,8 +1920,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
         if (data_page)
                 ((char *)data_page)[PAGE_SIZE - 1] = 0;
 
-        /* Default to relatime */
-        mnt_flags |= MNT_RELATIME;
+        /* Default to relatime unless overriden */
+        if (!(flags & MS_NOATIME))
+                mnt_flags |= MNT_RELATIME;
 
         /* Separate the per-mountpoint flags */
         if (flags & MS_NOSUID)
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
index f54360f50a9c..fa038df63ac8 100644
--- a/fs/ncpfs/ioctl.c
+++ b/fs/ncpfs/ioctl.c
@@ -660,13 +660,10 @@ outrel:
                         if (user.object_name_len > NCP_OBJECT_NAME_MAX_LEN)
                                 return -ENOMEM;
                         if (user.object_name_len) {
-                                newname = kmalloc(user.object_name_len, GFP_USER);
-                                if (!newname)
-                                        return -ENOMEM;
-                                if (copy_from_user(newname, user.object_name, user.object_name_len)) {
-                                        kfree(newname);
-                                        return -EFAULT;
-                                }
+                                newname = memdup_user(user.object_name,
+                                                      user.object_name_len);
+                                if (IS_ERR(newname))
+                                        return PTR_ERR(newname);
                         } else {
                                 newname = NULL;
                         }
@@ -760,13 +757,9 @@ outrel:
                         if (user.len > NCP_PRIVATE_DATA_MAX_LEN)
                                 return -ENOMEM;
                         if (user.len) {
-                                new = kmalloc(user.len, GFP_USER);
-                                if (!new)
-                                        return -ENOMEM;
-                                if (copy_from_user(new, user.data, user.len)) {
-                                        kfree(new);
-                                        return -EFAULT;
-                                }
+                                new = memdup_user(user.data, user.len);
+                                if (IS_ERR(new))
+                                        return PTR_ERR(new);
                         } else {
                                 new = NULL;
                         }
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index e6a1932c7110..35869a4921f1 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -713,7 +713,8 @@ nfs3_xdr_setaclargs(struct rpc_rqst *req, __be32 *p,
         if (args->npages != 0)
                 xdr_encode_pages(buf, args->pages, 0, args->len);
         else
-                req->rq_slen += args->len;
+                req->rq_slen = xdr_adjust_iovec(req->rq_svec,
+                                p + XDR_QUADLEN(args->len));
 
         err = nfsacl_encode(buf, base, args->inode,
                             (args->mask & NFS_ACL) ?
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 3444c0052a87..5275097a7565 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -229,21 +229,23 @@ nfsd4_list_rec_dir(struct dentry *dir, recdir_func *f)
                 goto out;
         status = vfs_readdir(filp, nfsd4_build_namelist, &names);
         fput(filp);
+        mutex_lock(&dir->d_inode->i_mutex);
         while (!list_empty(&names)) {
                 entry = list_entry(names.next, struct name_list, list);
 
                 dentry = lookup_one_len(entry->name, dir, HEXDIR_LEN-1);
                 if (IS_ERR(dentry)) {
                         status = PTR_ERR(dentry);
-                        goto out;
+                        break;
                 }
                 status = f(dir, dentry);
                 dput(dentry);
                 if (status)
-                        goto out;
+                        break;
                 list_del(&entry->list);
                 kfree(entry);
         }
+        mutex_unlock(&dir->d_inode->i_mutex);
 out:
         while (!list_empty(&names)) {
                 entry = list_entry(names.next, struct name_list, list);
@@ -255,36 +257,6 @@ out:
 }
 
 static int
-nfsd4_remove_clid_file(struct dentry *dir, struct dentry *dentry)
-{
-        int status;
-
-        if (!S_ISREG(dir->d_inode->i_mode)) {
-                printk("nfsd4: non-file found in client recovery directory\n");
-                return -EINVAL;
-        }
-        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        status = vfs_unlink(dir->d_inode, dentry);
-        mutex_unlock(&dir->d_inode->i_mutex);
-        return status;
-}
-
-static int
-nfsd4_clear_clid_dir(struct dentry *dir, struct dentry *dentry)
-{
-        int status;
-
-        /* For now this directory should already be empty, but we empty it of
-         * any regular files anyway, just in case the directory was created by
-         * a kernel from the future.... */
-        nfsd4_list_rec_dir(dentry, nfsd4_remove_clid_file);
-        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        status = vfs_rmdir(dir->d_inode, dentry);
-        mutex_unlock(&dir->d_inode->i_mutex);
-        return status;
-}
-
-static int
 nfsd4_unlink_clid_dir(char *name, int namlen)
 {
         struct dentry *dentry;
@@ -294,18 +266,18 @@ nfsd4_unlink_clid_dir(char *name, int namlen)
 
         mutex_lock(&rec_dir.dentry->d_inode->i_mutex);
         dentry = lookup_one_len(name, rec_dir.dentry, namlen);
-        mutex_unlock(&rec_dir.dentry->d_inode->i_mutex);
         if (IS_ERR(dentry)) {
                 status = PTR_ERR(dentry);
-                return status;
+                goto out_unlock;
         }
         status = -ENOENT;
         if (!dentry->d_inode)
                 goto out;
-
-        status = nfsd4_clear_clid_dir(rec_dir.dentry, dentry);
+        status = vfs_rmdir(rec_dir.dentry->d_inode, dentry);
 out:
         dput(dentry);
+out_unlock:
+        mutex_unlock(&rec_dir.dentry->d_inode->i_mutex);
         return status;
 }
 
@@ -348,7 +320,7 @@ purge_old(struct dentry *parent, struct dentry *child)
         if (nfs4_has_reclaimed_state(child->d_name.name, false))
                 return 0;
 
-        status = nfsd4_clear_clid_dir(parent, child);
+        status = vfs_rmdir(parent->d_inode, child);
         if (status)
                 printk("failed to remove client recovery directory %s\n",
                                 child->d_name.name);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index ab93fcfef254..6c68ffd6b4bb 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -116,10 +116,15 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
         }
         if ((exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
                 /* successfully crossed mount point */
-                exp_put(exp);
-                *expp = exp2;
+                /*
+                 * This is subtle: dentry is *not* under mnt at this point.
+                 * The only reason we are safe is that original mnt is pinned
+                 * down by exp, so we should dput before putting exp.
+                 */
                 dput(dentry);
                 *dpp = mounts;
+                exp_put(exp);
+                *expp = exp2;
         } else {
                 exp_put(exp2);
                 dput(mounts);
@@ -1885,8 +1890,8 @@ static int nfsd_buffered_filldir(void *__buf, const char *name, int namlen,
         return 0;
 }
 
-static int nfsd_buffered_readdir(struct file *file, filldir_t func,
-                                 struct readdir_cd *cdp, loff_t *offsetp)
+static __be32 nfsd_buffered_readdir(struct file *file, filldir_t func,
+                                    struct readdir_cd *cdp, loff_t *offsetp)
 {
         struct readdir_data buf;
         struct buffered_dirent *de;
@@ -1896,11 +1901,12 @@ static int nfsd_buffered_readdir(struct file *file, filldir_t func,
 
         buf.dirent = (void *)__get_free_page(GFP_KERNEL);
         if (!buf.dirent)
-                return -ENOMEM;
+                return nfserrno(-ENOMEM);
 
         offset = *offsetp;
 
         while (1) {
+                struct inode *dir_inode = file->f_path.dentry->d_inode;
                 unsigned int reclen;
 
                 cdp->err = nfserr_eof; /* will be cleared on successful read */
@@ -1919,26 +1925,38 @@ static int nfsd_buffered_readdir(struct file *file, filldir_t func,
                 if (!size)
                         break;
 
+                /*
+                 * Various filldir functions may end up calling back into
+                 * lookup_one_len() and the file system's ->lookup() method.
+                 * These expect i_mutex to be held, as it would within readdir.
+                 */
+                host_err = mutex_lock_killable(&dir_inode->i_mutex);
+                if (host_err)
+                        break;
+
                 de = (struct buffered_dirent *)buf.dirent;
                 while (size > 0) {
                         offset = de->offset;
 
                         if (func(cdp, de->name, de->namlen, de->offset,
                                  de->ino, de->d_type))
-                                goto done;
+                                break;
 
                         if (cdp->err != nfs_ok)
-                                goto done;
+                                break;
 
                         reclen = ALIGN(sizeof(*de) + de->namlen,
                                        sizeof(u64));
                         size -= reclen;
                         de = (struct buffered_dirent *)((char *)de + reclen);
                 }
+                mutex_unlock(&dir_inode->i_mutex);
+                if (size > 0) /* We bailed out early */
+                        break;
+
                 offset = vfs_llseek(file, 0, SEEK_CUR);
         }
 
- done:
         free_page((unsigned long)(buf.dirent));
 
         if (host_err)
diff --git a/fs/stat.c b/fs/stat.c
index 2db740a0cfb5..075694e31d8b 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -55,59 +55,54 @@ int vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
 
 EXPORT_SYMBOL(vfs_getattr);
 
-int vfs_stat_fd(int dfd, char __user *name, struct kstat *stat)
+int vfs_fstat(unsigned int fd, struct kstat *stat)
 {
-        struct path path;
-        int error;
+        struct file *f = fget(fd);
+        int error = -EBADF;
 
-        error = user_path_at(dfd, name, LOOKUP_FOLLOW, &path);
-        if (!error) {
-                error = vfs_getattr(path.mnt, path.dentry, stat);
-                path_put(&path);
+        if (f) {
+                error = vfs_getattr(f->f_path.mnt, f->f_path.dentry, stat);
+                fput(f);
         }
         return error;
 }
+EXPORT_SYMBOL(vfs_fstat);
 
-int vfs_stat(char __user *name, struct kstat *stat)
+int vfs_fstatat(int dfd, char __user *filename, struct kstat *stat, int flag)
 {
-        return vfs_stat_fd(AT_FDCWD, name, stat);
-}
+        struct path path;
+        int error = -EINVAL;
+        int lookup_flags = 0;
 
-EXPORT_SYMBOL(vfs_stat);
+        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
+                goto out;
 
-int vfs_lstat_fd(int dfd, char __user *name, struct kstat *stat)
-{
-        struct path path;
-        int error;
+        if (!(flag & AT_SYMLINK_NOFOLLOW))
+                lookup_flags |= LOOKUP_FOLLOW;
 
-        error = user_path_at(dfd, name, 0, &path);
-        if (!error) {
-                error = vfs_getattr(path.mnt, path.dentry, stat);
-                path_put(&path);
-        }
+        error = user_path_at(dfd, filename, lookup_flags, &path);
+        if (error)
+                goto out;
+
+        error = vfs_getattr(path.mnt, path.dentry, stat);
+        path_put(&path);
+out:
         return error;
 }
+EXPORT_SYMBOL(vfs_fstatat);
 
-int vfs_lstat(char __user *name, struct kstat *stat)
+int vfs_stat(char __user *name, struct kstat *stat)
 {
-        return vfs_lstat_fd(AT_FDCWD, name, stat);
+        return vfs_fstatat(AT_FDCWD, name, stat, 0);
 }
+EXPORT_SYMBOL(vfs_stat);
 
-EXPORT_SYMBOL(vfs_lstat);
-
-int vfs_fstat(unsigned int fd, struct kstat *stat)
+int vfs_lstat(char __user *name, struct kstat *stat)
 {
-        struct file *f = fget(fd);
-        int error = -EBADF;
-
-        if (f) {
-                error = vfs_getattr(f->f_path.mnt, f->f_path.dentry, stat);
-                fput(f);
-        }
-        return error;
+        return vfs_fstatat(AT_FDCWD, name, stat, AT_SYMLINK_NOFOLLOW);
 }
+EXPORT_SYMBOL(vfs_lstat);
 
-EXPORT_SYMBOL(vfs_fstat);
 
 #ifdef __ARCH_WANT_OLD_STAT
 
@@ -155,23 +150,25 @@ static int cp_old_stat(struct kstat *stat, struct __old_kernel_stat __user * sta
 SYSCALL_DEFINE2(stat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_old_stat(&stat, statbuf);
+        error = vfs_stat(filename, &stat);
+        if (error)
+                return error;
 
-        return error;
+        return cp_old_stat(&stat, statbuf);
 }
 
 SYSCALL_DEFINE2(lstat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_old_stat(&stat, statbuf);
+        error = vfs_lstat(filename, &stat);
+        if (error)
+                return error;
 
-        return error;
+        return cp_old_stat(&stat, statbuf);
 }
 
 SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, statbuf)
@@ -240,23 +237,23 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
 SYSCALL_DEFINE2(newstat, char __user *, filename, struct stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
-
-        if (!error)
-                error = cp_new_stat(&stat, statbuf);
+        int error = vfs_stat(filename, &stat);
 
-        return error;
+        if (error)
+                return error;
+        return cp_new_stat(&stat, statbuf);
 }
 
 SYSCALL_DEFINE2(newlstat, char __user *, filename, struct stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_new_stat(&stat, statbuf);
+        error = vfs_lstat(filename, &stat);
+        if (error)
+                return error;
 
-        return error;
+        return cp_new_stat(&stat, statbuf);
 }
 
 #if !defined(__ARCH_WANT_STAT64) || defined(__ARCH_WANT_SYS_NEWFSTATAT)
@@ -264,21 +261,12 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, char __user *, filename,
                 struct stat __user *, statbuf, int, flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_new_stat(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_new_stat(&stat, statbuf);
 }
 #endif
 
@@ -404,21 +392,12 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, char __user *, filename,
                 struct stat64 __user *, statbuf, int, flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_new_stat64(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_new_stat64(&stat, statbuf);
 }
 #endif /* __ARCH_WANT_STAT64 */
 
diff --git a/fs/sysfs/bin.c b/fs/sysfs/bin.c
index 93e0c0281d45..9345806c8853 100644
--- a/fs/sysfs/bin.c
+++ b/fs/sysfs/bin.c
@@ -157,14 +157,9 @@ static ssize_t write(struct file *file, const char __user *userbuf,
                         count = size - offs;
         }
 
-        temp = kmalloc(count, GFP_KERNEL);
-        if (!temp)
-                return -ENOMEM;
-
-        if (copy_from_user(temp, userbuf, count)) {
-                count = -EFAULT;
-                goto out_free;
-        }
+        temp = memdup_user(userbuf, count);
+        if (IS_ERR(temp))
+                return PTR_ERR(temp);
 
         mutex_lock(&bb->mutex);
 
@@ -176,8 +171,6 @@ static ssize_t write(struct file *file, const char __user *userbuf,
         if (count > 0)
                 *off = offs + count;
 
-out_free:
-        kfree(temp);
         return count;
 }
 
diff --git a/fs/xattr.c b/fs/xattr.c
index 197c4fcac032..d51b8f9db921 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -237,13 +237,9 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
         if (size) {
                 if (size > XATTR_SIZE_MAX)
                         return -E2BIG;
-                kvalue = kmalloc(size, GFP_KERNEL);
-                if (!kvalue)
-                        return -ENOMEM;
-                if (copy_from_user(kvalue, value, size)) {
-                        kfree(kvalue);
-                        return -EFAULT;
-                }
+                kvalue = memdup_user(value, size);
+                if (IS_ERR(kvalue))
+                        return PTR_ERR(kvalue);
         }
 
         error = vfs_setxattr(d, kname, kvalue, size, flags);
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index d0b499418a7d..34eaab608e6e 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -489,17 +489,12 @@ xfs_attrmulti_attr_set(
         if (len > XATTR_SIZE_MAX)
                 return EINVAL;
 
-        kbuf = kmalloc(len, GFP_KERNEL);
-        if (!kbuf)
-                return ENOMEM;
-
-        if (copy_from_user(kbuf, ubuf, len))
-                goto out_kfree;
+        kbuf = memdup_user(ubuf, len);
+        if (IS_ERR(kbuf))
+                return PTR_ERR(kbuf);
 
         error = xfs_attr_set(XFS_I(inode), name, kbuf, len, flags);
 
- out_kfree:
-        kfree(kbuf);
         return error;
 }
 
@@ -540,20 +535,16 @@ xfs_attrmulti_by_handle(
         if (!size || size > 16 * PAGE_SIZE)
                 goto out_dput;
 
-        error = ENOMEM;
-        ops = kmalloc(size, GFP_KERNEL);
-        if (!ops)
+        ops = memdup_user(am_hreq.ops, size);
+        if (IS_ERR(ops)) {
+                error = PTR_ERR(ops);
                 goto out_dput;
-
-        error = EFAULT;
-        if (copy_from_user(ops, am_hreq.ops, size))
-                goto out_kfree_ops;
+        }
 
         attr_name = kmalloc(MAXNAMELEN, GFP_KERNEL);
         if (!attr_name)
                 goto out_kfree_ops;
 
-
         error = 0;
         for (i = 0; i < am_hreq.opcount; i++) {
                 ops[i].am_error = strncpy_from_user(attr_name,
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index c70c4e3db790..0882d166239a 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -427,20 +427,16 @@ xfs_compat_attrmulti_by_handle(
         if (!size || size > 16 * PAGE_SIZE)
                 goto out_dput;
 
-        error = ENOMEM;
-        ops = kmalloc(size, GFP_KERNEL);
-        if (!ops)
+        ops = memdup_user(compat_ptr(am_hreq.ops), size);
+        if (IS_ERR(ops)) {
+                error = PTR_ERR(ops);
                 goto out_dput;
-
-        error = EFAULT;
-        if (copy_from_user(ops, compat_ptr(am_hreq.ops), size))
-                goto out_kfree_ops;
+        }
 
         attr_name = kmalloc(MAXNAMELEN, GFP_KERNEL);
         if (!attr_name)
                 goto out_kfree_ops;
 
-
         error = 0;
         for (i = 0; i < am_hreq.opcount; i++) {
                 ops[i].am_error = strncpy_from_user(attr_name,
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index 573819ef4cc0..5a40d14daa9f 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -143,7 +143,9 @@ extern u64 timecounter_cyc2time(struct timecounter *tc,
  *                      400-499: Perfect
  *                              The ideal clocksource. A must-use where
  *                              available.
- * @read:               returns a cycle value
+ * @read:               returns a cycle value, passes clocksource as argument
+ * @enable:             optional function to enable the clocksource
+ * @disable:            optional function to disable the clocksource
  * @mask:               bitmask for two's complement
  *                      subtraction of non 64 bit counters
  * @mult:               cycle to nanosecond multiplier (adjusted by NTP)
@@ -162,7 +164,9 @@ struct clocksource {
         char *name;
         struct list_head list;
         int rating;
-        cycle_t (*read)(void);
+        cycle_t (*read)(struct clocksource *cs);
+        int (*enable)(struct clocksource *cs);
+        void (*disable)(struct clocksource *cs);
         cycle_t mask;
         u32 mult;
         u32 mult_orig;
@@ -271,7 +275,34 @@ static inline u32 clocksource_hz2mult(u32 hz, u32 shift_constant)
  */
 static inline cycle_t clocksource_read(struct clocksource *cs)
 {
-        return cs->read();
+        return cs->read(cs);
+}
+
+/**
+ * clocksource_enable: - enable clocksource
+ * @cs:         pointer to clocksource
+ *
+ * Enables the specified clocksource. The clocksource callback
+ * function should start up the hardware and setup mult and field
+ * members of struct clocksource to reflect hardware capabilities.
+ */
+static inline int clocksource_enable(struct clocksource *cs)
+{
+        return cs->enable ? cs->enable(cs) : 0;
+}
+
+/**
+ * clocksource_disable: - disable clocksource
+ * @cs:         pointer to clocksource
+ *
+ * Disables the specified clocksource. The clocksource callback
+ * function should power down the now unused hardware block to
+ * save power.
+ */
+static inline void clocksource_disable(struct clocksource *cs)
+{
+        if (cs->disable)
+                cs->disable(cs);
 }
 
 /**
diff --git a/include/linux/fs.h b/include/linux/fs.h
index e766be0d4329..5bed436f4353 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2299,9 +2299,8 @@ extern int vfs_readdir(struct file *, filldir_t, void *);
 
 extern int vfs_stat(char __user *, struct kstat *);
 extern int vfs_lstat(char __user *, struct kstat *);
-extern int vfs_stat_fd(int dfd, char __user *, struct kstat *);
-extern int vfs_lstat_fd(int dfd, char __user *, struct kstat *);
 extern int vfs_fstat(unsigned int, struct kstat *);
+extern int vfs_fstatat(int , char __user *, struct kstat *, int);
 
 extern int do_vfs_ioctl(struct file *filp, unsigned int fd, unsigned int cmd,
                     unsigned long arg);
@@ -2449,7 +2448,7 @@ struct ctl_table;
 int proc_nr_files(struct ctl_table *table, int write, struct file *filp,
                   void __user *buffer, size_t *lenp, loff_t *ppos);
 
-int get_filesystem_list(char * buf);
+int __init get_filesystem_list(char *buf);
 
 #endif /* __KERNEL__ */
 #endif /* _LINUX_FS_H */
diff --git a/include/linux/ipmi.h b/include/linux/ipmi.h
index 7ebdb4fb4e54..65aae34759de 100644
--- a/include/linux/ipmi.h
+++ b/include/linux/ipmi.h
@@ -198,6 +198,8 @@ struct kernel_ipmi_msg {
                                               response.  When you send a
                                               response message, this will
                                               be returned. */
+#define IPMI_OEM_RECV_TYPE              5 /* The response for OEM Channels */
+
 /* Note that async events and received commands do not have a completion
    code as the first byte of the incoming data, unlike a response. */
 
diff --git a/include/linux/ipmi_msgdefs.h b/include/linux/ipmi_msgdefs.h
index b56a158d587a..df97e6e31e87 100644
--- a/include/linux/ipmi_msgdefs.h
+++ b/include/linux/ipmi_msgdefs.h
@@ -58,6 +58,12 @@
 #define IPMI_READ_EVENT_MSG_BUFFER_CMD  0x35
 #define IPMI_GET_CHANNEL_INFO_CMD       0x42
 
+/* Bit for BMC global enables. */
+#define IPMI_BMC_RCV_MSG_INTR     0x01
+#define IPMI_BMC_EVT_MSG_INTR     0x02
+#define IPMI_BMC_EVT_MSG_BUFF     0x04
+#define IPMI_BMC_SYS_LOG          0x08
+
 #define IPMI_NETFN_STORAGE_REQUEST              0x0a
 #define IPMI_NETFN_STORAGE_RESPONSE             0x0b
 #define IPMI_ADD_SEL_ENTRY_CMD          0x44
@@ -109,5 +115,7 @@
 #define IPMI_CHANNEL_MEDIUM_USB1        10
 #define IPMI_CHANNEL_MEDIUM_USB2        11
 #define IPMI_CHANNEL_MEDIUM_SYSINTF     12
+#define IPMI_CHANNEL_MEDIUM_OEM_MIN     0x60
+#define IPMI_CHANNEL_MEDIUM_OEM_MAX     0x7f
 
 #endif /* __LINUX_IPMI_MSGDEFS_H */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 18146c980b68..a9e3b76aa884 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -75,7 +75,7 @@ int mm_match_cgroup(const struct mm_struct *mm, const struct mem_cgroup *cgroup)
 {
         struct mem_cgroup *mem;
         rcu_read_lock();
-        mem = mem_cgroup_from_task((mm)->owner);
+        mem = mem_cgroup_from_task(rcu_dereference((mm)->owner));
         rcu_read_unlock();
         return cgroup == mem;
 }
diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
index 5621d87c4479..6b361d23a499 100644
--- a/include/linux/reiserfs_fs_sb.h
+++ b/include/linux/reiserfs_fs_sb.h
@@ -193,7 +193,7 @@ struct reiserfs_journal {
         atomic_t j_wcount;      /* count of writers for current commit */
         unsigned long j_bcount; /* batch count. allows turning X transactions into 1 */
         unsigned long j_first_unflushed_offset; /* first unflushed transactions offset */
-        unsigned long j_last_flush_trans_id;    /* last fully flushed journal timestamp */
+        unsigned j_last_flush_trans_id; /* last fully flushed journal timestamp */
         struct buffer_head *j_header_bh;
 
         time_t j_trans_start_time;      /* time this transaction started */
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index 262a8dccfa81..167c33361d9c 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -21,6 +21,8 @@ extern long prctl_set_seccomp(unsigned long);
 
 #else /* CONFIG_SECCOMP */
 
+#include <linux/errno.h>
+
 typedef struct { } seccomp_t;
 
 #define secure_computing(x) do { } while (0)
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index 2cc43fa380cb..a0faa18f7b1b 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -245,7 +245,12 @@ struct spi_master {
          */
         u16                     dma_alignment;
 
-        /* setup mode and clock, etc (spi driver may call many times) */
+        /* Setup mode and clock, etc (spi driver may call many times).
+         *
+         * IMPORTANT:  this may be called when transfers to another
+         * device are active.  DO NOT UPDATE SHARED REGISTERS in ways
+         * which could break those transfers.
+         */
         int                     (*setup)(struct spi_device *spi);
 
         /* bidirectional bulk transfers
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 3e3a4364cbff..795032edfc46 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -58,10 +58,17 @@ typedef int __bitwise suspend_state_t;
  *      by @begin().
  *      @prepare() is called right after devices have been suspended (ie. the
  *      appropriate .suspend() method has been executed for each device) and
- *      before the nonboot CPUs are disabled (it is executed with IRQs enabled).
- *      This callback is optional.  It returns 0 on success or a negative
- *      error code otherwise, in which case the system cannot enter the desired
- *      sleep state (@enter() and @finish() will not be called in that case).
+ *      before device drivers' late suspend callbacks are executed.  It returns
+ *      0 on success or a negative error code otherwise, in which case the
+ *      system cannot enter the desired sleep state (@prepare_late(), @enter(),
+ *      @wake(), and @finish() will not be called in that case).
+ *
+ * @prepare_late: Finish preparing the platform for entering the system sleep
+ *      state indicated by @begin().
+ *      @prepare_late is called before disabling nonboot CPUs and after
+ *      device drivers' late suspend callbacks have been executed.  It returns
+ *      0 on success or a negative error code otherwise, in which case the
+ *      system cannot enter the desired sleep state (@enter() and @wake()).
  *
  * @enter: Enter the system sleep state indicated by @begin() or represented by
  *      the argument if @begin() is not implemented.
@@ -69,19 +76,26 @@ typedef int __bitwise suspend_state_t;
  *      error code otherwise, in which case the system cannot enter the desired
  *      sleep state.
  *
- * @finish: Called when the system has just left a sleep state, right after
- *      the nonboot CPUs have been enabled and before devices are resumed (it is
- *      executed with IRQs enabled).
+ * @wake: Called when the system has just left a sleep state, right after
+ *      the nonboot CPUs have been enabled and before device drivers' early
+ *      resume callbacks are executed.
+ *      This callback is optional, but should be implemented by the platforms
+ *      that implement @prepare_late().  If implemented, it is always called
+ *      after @enter(), even if @enter() fails.
+ *
+ * @finish: Finish wake-up of the platform.
+ *      @finish is called right prior to calling device drivers' regular suspend
+ *      callbacks.
  *      This callback is optional, but should be implemented by the platforms
  *      that implement @prepare().  If implemented, it is always called after
- *      @enter() (even if @enter() fails).
+ *      @enter() and @wake(), if implemented, even if any of them fails.
  *
  * @end: Called by the PM core right after resuming devices, to indicate to
  *      the platform that the system has returned to the working state or
  *      the transition to the sleep state has been aborted.
  *      This callback is optional, but should be implemented by the platforms
- *      that implement @begin(), but platforms implementing @begin() should
- *      also provide a @end() which cleans up transitions aborted before
+ *      that implement @begin().  Accordingly, platforms implementing @begin()
+ *      should also provide a @end() which cleans up transitions aborted before
  *      @enter().
  *
  * @recover: Recover the platform from a suspend failure.
@@ -93,7 +107,9 @@ struct platform_suspend_ops {
         int (*valid)(suspend_state_t state);
         int (*begin)(suspend_state_t state);
         int (*prepare)(void);
+        int (*prepare_late)(void);
         int (*enter)(suspend_state_t state);
+        void (*wake)(void);
         void (*finish)(void);
         void (*end)(void);
         void (*recover)(void);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index dabe4ad89141..40617c1d8976 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -148,7 +148,7 @@ struct old_linux_dirent;
         asm ("\t.globl " #alias "\n\t.set " #alias ", " #name "\n"      \
              "\t.globl ." #alias "\n\t.set ." #alias ", ." #name)
 #else
-#ifdef CONFIG_ALPHA
+#if defined(CONFIG_ALPHA) || defined(CONFIG_MIPS)
 #define SYSCALL_ALIAS(alias, name)                                      \
         asm ( #alias " = " #name "\n\t.globl " #alias)
 #else
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 917ab9525568..6e7351739a82 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -734,9 +734,6 @@ int audit_tag_tree(char *old, char *new)
         dentry = dget(path.dentry);
         path_put(&path);
 
-        if (dentry == tagged->mnt_root && dentry == mnt->mnt_root)
-                follow_up(&mnt, &dentry);
-
         list_add_tail(&list, &tagged->mnt_list);
 
         mutex_lock(&audit_filter_mutex);
diff --git a/kernel/power/main.c b/kernel/power/main.c
index f172f41858bb..f99ed6a75eac 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -291,20 +291,26 @@ static int suspend_enter(suspend_state_t state)
 
         device_pm_lock();
 
+        if (suspend_ops->prepare) {
+                error = suspend_ops->prepare();
+                if (error)
+                        goto Done;
+        }
+
         error = device_power_down(PMSG_SUSPEND);
         if (error) {
                 printk(KERN_ERR "PM: Some devices failed to power down\n");
-                goto Done;
+                goto Platfrom_finish;
         }
 
-        if (suspend_ops->prepare) {
-                error = suspend_ops->prepare();
+        if (suspend_ops->prepare_late) {
+                error = suspend_ops->prepare_late();
                 if (error)
                         goto Power_up_devices;
         }
 
         if (suspend_test(TEST_PLATFORM))
-                goto Platfrom_finish;
+                goto Platform_wake;
 
         error = disable_nonboot_cpus();
         if (error || suspend_test(TEST_CPUS))
@@ -326,13 +332,17 @@ static int suspend_enter(suspend_state_t state)
  Enable_cpus:
         enable_nonboot_cpus();
 
- Platfrom_finish:
-        if (suspend_ops->finish)
-                suspend_ops->finish();
+ Platform_wake:
+        if (suspend_ops->wake)
+                suspend_ops->wake();
 
  Power_up_devices:
         device_power_up(PMSG_RESUME);
 
+ Platfrom_finish:
+        if (suspend_ops->finish)
+                suspend_ops->finish();
+
  Done:
         device_pm_unlock();
 
diff --git a/kernel/resource.c b/kernel/resource.c
index fd5d7d574bb9..ac5f3a36923f 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -533,43 +533,21 @@ static void __init __reserve_region_with_split(struct resource *root,
         res->end = end;
         res->flags = IORESOURCE_BUSY;
 
-        for (;;) {
-                conflict = __request_resource(parent, res);
-                if (!conflict)
-                        break;
-                if (conflict != parent) {
-                        parent = conflict;
-                        if (!(conflict->flags & IORESOURCE_BUSY))
-                                continue;
-                }
-
-                /* Uhhuh, that didn't work out.. */
-                kfree(res);
-                res = NULL;
-                break;
-        }
-
-        if (!res) {
-                /* failed, split and try again */
-
-                /* conflict covered whole area */
-                if (conflict->start <= start && conflict->end >= end)
-                        return;
+        conflict = __request_resource(parent, res);
+        if (!conflict)
+                return;
 
-                if (conflict->start > start)
-                        __reserve_region_with_split(root, start, conflict->start-1, name);
-                if (!(conflict->flags & IORESOURCE_BUSY)) {
-                        resource_size_t common_start, common_end;
+        /* failed, split and try again */
+        kfree(res);
 
-                        common_start = max(conflict->start, start);
-                        common_end = min(conflict->end, end);
-                        if (common_start < common_end)
-                                __reserve_region_with_split(root, common_start, common_end, name);
-                }
-                if (conflict->end < end)
-                        __reserve_region_with_split(root, conflict->end+1, end, name);
-        }
+        /* conflict covered whole area */
+        if (conflict->start <= start && conflict->end >= end)
+                return;
 
+        if (conflict->start > start)
+                __reserve_region_with_split(root, start, conflict->start-1, name);
+        if (conflict->end < end)
+                __reserve_region_with_split(root, conflict->end+1, end, name);
 }
 
 void __init reserve_region_with_split(struct resource *root,
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index c46c931a7fe7..ecfd7b5187e0 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -181,12 +181,12 @@ static void clocksource_watchdog(unsigned long data)
 
         resumed = test_and_clear_bit(0, &watchdog_resumed);
 
-        wdnow = watchdog->read();
+        wdnow = watchdog->read(watchdog);
         wd_nsec = cyc2ns(watchdog, (wdnow - watchdog_last) & watchdog->mask);
         watchdog_last = wdnow;
 
         list_for_each_entry_safe(cs, tmp, &watchdog_list, wd_list) {
-                csnow = cs->read();
+                csnow = cs->read(cs);
 
                 if (unlikely(resumed)) {
                         cs->wd_last = csnow;
@@ -247,7 +247,7 @@ static void clocksource_check_watchdog(struct clocksource *cs)
 
                 list_add(&cs->wd_list, &watchdog_list);
                 if (!started && watchdog) {
-                        watchdog_last = watchdog->read();
+                        watchdog_last = watchdog->read(watchdog);
                         watchdog_timer.expires = jiffies + WATCHDOG_INTERVAL;
                         add_timer_on(&watchdog_timer,
                                      cpumask_first(cpu_online_mask));
@@ -268,7 +268,7 @@ static void clocksource_check_watchdog(struct clocksource *cs)
                                 cse->flags &= ~CLOCK_SOURCE_WATCHDOG;
                         /* Start if list is not empty */
                         if (!list_empty(&watchdog_list)) {
-                                watchdog_last = watchdog->read();
+                                watchdog_last = watchdog->read(watchdog);
                                 watchdog_timer.expires =
                                         jiffies + WATCHDOG_INTERVAL;
                                 add_timer_on(&watchdog_timer,
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index 06f197560f3b..c3f6c30816e3 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -50,7 +50,7 @@
  */
 #define JIFFIES_SHIFT   8
 
-static cycle_t jiffies_read(void)
+static cycle_t jiffies_read(struct clocksource *cs)
 {
         return (cycle_t) jiffies;
 }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 900f1b6598d1..687dff49f6e7 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -182,7 +182,7 @@ EXPORT_SYMBOL(do_settimeofday);
  */
 static void change_clocksource(void)
 {
-        struct clocksource *new;
+        struct clocksource *new, *old;
 
         new = clocksource_get_next();
 
@@ -191,11 +191,16 @@ static void change_clocksource(void)
 
         clocksource_forward_now();
 
-        new->raw_time = clock->raw_time;
+        if (clocksource_enable(new))
+                return;
 
+        new->raw_time = clock->raw_time;
+        old = clock;
         clock = new;
+        clocksource_disable(old);
+
         clock->cycle_last = 0;
-        clock->cycle_last = clocksource_read(new);
+        clock->cycle_last = clocksource_read(clock);
         clock->error = 0;
         clock->xtime_nsec = 0;
         clocksource_calculate_interval(clock, NTP_INTERVAL_LENGTH);
@@ -292,6 +297,7 @@ void __init timekeeping_init(void)
         ntp_init();
 
         clock = clocksource_get_next();
+        clocksource_enable(clock);
         clocksource_calculate_interval(clock, NTP_INTERVAL_LENGTH);
         clock->cycle_last = clocksource_read(clock);
 
diff --git a/lib/kobject.c b/lib/kobject.c
index a6dec32f2ddd..bacf6fe4f7a0 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -218,6 +218,9 @@ int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
         const char *old_name = kobj->name;
         char *s;
 
+        if (kobj->name && !fmt)
+                return 0;
+
         kobj->name = kvasprintf(GFP_KERNEL, fmt, vargs);
         if (!kobj->name)
                 return -ENOMEM;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 39fdfb14eeaa..eac9577941f9 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -63,6 +63,9 @@ struct scan_control {
         /* Can mapped pages be reclaimed? */
         int may_unmap;
 
+        /* Can pages be swapped as part of reclaim? */
+        int may_swap;
+
         /* This context's SWAP_CLUSTER_MAX. If freeing memory for
          * suspend, we effectively ignore SWAP_CLUSTER_MAX.
          * In this context, it doesn't matter that we scan the
@@ -1380,7 +1383,7 @@ static void get_scan_ratio(struct zone *zone, struct scan_control *sc,
         struct zone_reclaim_stat *reclaim_stat = get_reclaim_stat(zone, sc);
 
         /* If we have no swap space, do not bother scanning anon pages. */
-        if (nr_swap_pages <= 0) {
+        if (!sc->may_swap || (nr_swap_pages <= 0)) {
                 percent[0] = 0;
                 percent[1] = 100;
                 return;
@@ -1697,6 +1700,7 @@ unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
                 .may_writepage = !laptop_mode,
                 .swap_cluster_max = SWAP_CLUSTER_MAX,
                 .may_unmap = 1,
+                .may_swap = 1,
                 .swappiness = vm_swappiness,
                 .order = order,
                 .mem_cgroup = NULL,
@@ -1717,6 +1721,7 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
         struct scan_control sc = {
                 .may_writepage = !laptop_mode,
                 .may_unmap = 1,
+                .may_swap = !noswap,
                 .swap_cluster_max = SWAP_CLUSTER_MAX,
                 .swappiness = swappiness,
                 .order = 0,
@@ -1726,9 +1731,6 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
         };
         struct zonelist *zonelist;
 
-        if (noswap)
-                sc.may_unmap = 0;
-
         sc.gfp_mask = (gfp_mask & GFP_RECLAIM_MASK) |
                         (GFP_HIGHUSER_MOVABLE & ~GFP_RECLAIM_MASK);
         zonelist = NODE_DATA(numa_node_id())->node_zonelists;
@@ -1767,6 +1769,7 @@ static unsigned long balance_pgdat(pg_data_t *pgdat, int order)
         struct scan_control sc = {
                 .gfp_mask = GFP_KERNEL,
                 .may_unmap = 1,
+                .may_swap = 1,
                 .swap_cluster_max = SWAP_CLUSTER_MAX,
                 .swappiness = vm_swappiness,
                 .order = order,
@@ -2088,13 +2091,13 @@ static void shrink_all_zones(unsigned long nr_pages, int prio,
                                 nr_reclaimed += shrink_list(l, nr_to_scan, zone,
                                                                 sc, prio);
                                 if (nr_reclaimed >= nr_pages) {
-                                        sc->nr_reclaimed = nr_reclaimed;
+                                        sc->nr_reclaimed += nr_reclaimed;
                                         return;
                                 }
                         }
                 }
         }
-        sc->nr_reclaimed = nr_reclaimed;
+        sc->nr_reclaimed += nr_reclaimed;
 }
 
 /*
@@ -2115,6 +2118,7 @@ unsigned long shrink_all_memory(unsigned long nr_pages)
                 .may_unmap = 0,
                 .may_writepage = 1,
                 .isolate_pages = isolate_pages_global,
+                .nr_reclaimed = 0,
         };
 
         current->reclaim_state = &reclaim_state;
@@ -2297,6 +2301,7 @@ static int __zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
         struct scan_control sc = {
                 .may_writepage = !!(zone_reclaim_mode & RECLAIM_WRITE),
                 .may_unmap = !!(zone_reclaim_mode & RECLAIM_SWAP),
+                .may_swap = 1,
                 .swap_cluster_max = max_t(unsigned long, nr_pages,
                                         SWAP_CLUSTER_MAX),
                 .gfp_mask = gfp_mask,
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 39a9642927d3..5c4b7a400c18 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -27,6 +27,9 @@ ccflags-y  :=
 cppflags-y :=
 ldflags-y  :=
 
+subdir-asflags-y :=
+subdir-ccflags-y :=
+
 # Read auto.conf if it exists, otherwise ignore
 -include include/config/auto.conf
 
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 979619574f70..cba61ca403ca 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -4,6 +4,11 @@ ccflags-y  += $(EXTRA_CFLAGS)
 cppflags-y += $(EXTRA_CPPFLAGS)
 ldflags-y  += $(EXTRA_LDFLAGS)
 
+#
+# flags that take effect in sub directories
+export KBUILD_SUBDIR_ASFLAGS := $(KBUILD_SUBDIR_ASFLAGS) $(subdir-asflags-y)
+export KBUILD_SUBDIR_CCFLAGS := $(KBUILD_SUBDIR_CCFLAGS) $(subdir-ccflags-y)
+
 # Figure out what we need to build from the various variables
 # ===========================================================================
 
@@ -104,10 +109,10 @@ else
 debug_flags =
 endif
 
-orig_c_flags   = $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)                     \
+orig_c_flags   = $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(KBUILD_SUBDIR_CCFLAGS) \
                  $(ccflags-y) $(CFLAGS_$(basetarget).o)
 _c_flags       = $(filter-out $(CFLAGS_REMOVE_$(basetarget).o), $(orig_c_flags))
-_a_flags       = $(KBUILD_CPPFLAGS) $(KBUILD_AFLAGS)                     \
+_a_flags       = $(KBUILD_CPPFLAGS) $(KBUILD_AFLAGS) $(KBUILD_SUBDIR_ASFLAGS) \
                  $(asflags-y) $(AFLAGS_$(basetarget).o)
 _cpp_flags     = $(KBUILD_CPPFLAGS) $(cppflags-y) $(CPPFLAGS_$(@F))
 
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 921514902eca..98b3195347ab 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -609,8 +609,12 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
             strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
                 if (!capable(CAP_MAC_ADMIN))
                         rc = -EPERM;
-                /* a label cannot be void and cannot begin with '-' */
-                if (size == 0 || (size > 0 && ((char *)value)[0] == '-'))
+                /*
+                 * check label validity here so import wont fail on
+                 * post_setxattr
+                 */
+                if (size == 0 || size >= SMK_LABELLEN ||
+                    smk_import(value, size) == NULL)
                         rc = -EINVAL;
         } else
                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
@@ -644,9 +648,6 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
         if (strcmp(name, XATTR_NAME_SMACK))
                 return;
 
-        if (size >= SMK_LABELLEN)
-                return;
-
         isp = dentry->d_inode->i_security;
 
         /*
diff --git a/sound/pci/emu10k1/io.c b/sound/pci/emu10k1/io.c
index 4bfc31d1b281..c1a5aa15af8f 100644
--- a/sound/pci/emu10k1/io.c
+++ b/sound/pci/emu10k1/io.c
@@ -490,7 +490,7 @@ void snd_emu10k1_wait(struct snd_emu10k1 *emu, unsigned int wait)
                         if (newtime != curtime)
                                 break;
                 }
-                if (count >= 16384)
+                if (count > 16384)
                         break;
                 curtime = newtime;
         }
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index fd6e6f337d10..8820faf6c9d8 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -642,19 +642,21 @@ static int get_codec_name(struct hda_codec *codec)
  */
 static void /*__devinit*/ setup_fg_nodes(struct hda_codec *codec)
 {
-        int i, total_nodes;
+        int i, total_nodes, function_id;
         hda_nid_t nid;
 
         total_nodes = snd_hda_get_sub_nodes(codec, AC_NODE_ROOT, &nid);
         for (i = 0; i < total_nodes; i++, nid++) {
-                codec->function_id = snd_hda_param_read(codec, nid,
+                function_id = snd_hda_param_read(codec, nid,
                                                 AC_PAR_FUNCTION_TYPE) & 0xff;
-                switch (codec->function_id) {
+                switch (function_id) {
                 case AC_GRP_AUDIO_FUNCTION:
                         codec->afg = nid;
+                        codec->function_id = function_id;
                         break;
                 case AC_GRP_MODEM_FUNCTION:
                         codec->mfg = nid;
+                        codec->function_id = function_id;
                         break;
                 default:
                         break;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index bc882f8f163c..21e99cfa8c49 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -312,7 +312,6 @@ struct azx_dev {
         unsigned int period_bytes; /* size of the period in bytes */
         unsigned int frags;     /* number for period in the play buffer */
         unsigned int fifo_size; /* FIFO size */
-        unsigned int start_flag: 1;     /* stream full start flag */
         unsigned long start_jiffies;    /* start + minimum jiffies */
         unsigned long min_jiffies;      /* minimum jiffies before position is valid */
 
@@ -333,6 +332,7 @@ struct azx_dev {
         unsigned int opened :1;
         unsigned int running :1;
         unsigned int irq_pending :1;
+        unsigned int start_flag: 1;     /* stream full start flag */
         /*
          * For VIA:
          *  A flag to ensure DMA position is 0
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 38ad3f7b040f..9bcd8ab5a27f 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3977,6 +3977,14 @@ static int patch_ad1884a(struct hda_codec *codec)
                 spec->input_mux = &ad1884a_laptop_capture_source;
                 codec->patch_ops.unsol_event = ad1884a_hp_unsol_event;
                 codec->patch_ops.init = ad1884a_hp_init;
+                /* set the upper-limit for mixer amp to 0dB for avoiding the
+                 * possible damage by overloading
+                 */
+                snd_hda_override_amp_caps(codec, 0x20, HDA_INPUT,
+                                          (0x17 << AC_AMPCAP_OFFSET_SHIFT) |
+                                          (0x17 << AC_AMPCAP_NUM_STEPS_SHIFT) |
+                                          (0x05 << AC_AMPCAP_STEP_SIZE_SHIFT) |
+                                          (1 << AC_AMPCAP_MUTE_SHIFT));
                 break;
         case AD1884A_MOBILE:
                 spec->mixers[0] = ad1884a_mobile_mixers;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index ce30b459aee6..917bc5d3ac2c 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -3076,6 +3076,11 @@ static int create_multi_out_ctls(struct hda_codec *codec, int num_outs,
         unsigned int wid_caps;
 
         for (i = 0; i < num_outs && i < ARRAY_SIZE(chname); i++) {
+                if (type == AUTO_PIN_HP_OUT && !spec->hp_detect) {
+                        wid_caps = get_wcaps(codec, pins[i]);
+                        if (wid_caps & AC_WCAP_UNSOL_CAP)
+                                spec->hp_detect = 1;
+                }
                 nid = dac_nids[i];
                 if (!nid)
                         continue;
@@ -3119,11 +3124,6 @@ static int create_multi_out_ctls(struct hda_codec *codec, int num_outs,
                         err = create_controls_idx(codec, name, idx, nid, 3);
                         if (err < 0)
                                 return err;
-                        if (type == AUTO_PIN_HP_OUT && !spec->hp_detect) {
-                                wid_caps = get_wcaps(codec, pins[i]);
-                                if (wid_caps & AC_WCAP_UNSOL_CAP)
-                                        spec->hp_detect = 1;
-                        }
                 }
         }
         return 0;
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 5dced5b79387..8042d5398892 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -1854,6 +1854,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
         },
         {
                 .subvendor = 0x1028,
+                .subdevice = 0x016a,
+                .name = "Dell Inspiron 8600",   /* STAC9750/51 */
+                .type = AC97_TUNE_HP_ONLY
+        },
+        {
+                .subvendor = 0x1028,
                 .subdevice = 0x0186,
                 .name = "Dell Latitude D810", /* cf. Malone #41015 */
                 .type = AC97_TUNE_HP_MUTE_LED
@@ -1896,12 +1902,6 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
         },
         {
                 .subvendor = 0x103c,
-                .subdevice = 0x0934,
-                .name = "HP nx8220",
-                .type = AC97_TUNE_MUTE_LED
-        },
-        {
-                .subvendor = 0x103c,
                 .subdevice = 0x129d,
                 .name = "HP xw8000",
                 .type = AC97_TUNE_HP_ONLY
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index 9c09b94f0cf8..90f4df7fd906 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -283,7 +283,7 @@ static int omap_mcbsp_dai_hw_params(struct snd_pcm_substream *substream,
                 break;
         case SND_SOC_DAIFMT_DSP_B:
                 regs->srgr2     |= FPER(wlen * channels - 1);
-                regs->srgr1     |= FWID(wlen * channels - 2);
+                regs->srgr1     |= FWID(0);
                 break;
         }
 
@@ -302,6 +302,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
 {
         struct omap_mcbsp_data *mcbsp_data = to_mcbsp(cpu_dai->private_data);
         struct omap_mcbsp_reg_cfg *regs = &mcbsp_data->regs;
+        unsigned int temp_fmt = fmt;
 
         if (mcbsp_data->configured)
                 return 0;
@@ -328,6 +329,8 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 /* 0-bit data delay */
                 regs->rcr2      |= RDATDLY(0);
                 regs->xcr2      |= XDATDLY(0);
+                /* Invert FS polarity configuration */
+                temp_fmt ^= SND_SOC_DAIFMT_NB_IF;
                 break;
         default:
                 /* Unsupported data format */
@@ -351,7 +354,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
         }
 
         /* Set bit clock (CLKX/CLKR) and FS polarities */
-        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        switch (temp_fmt & SND_SOC_DAIFMT_INV_MASK) {
         case SND_SOC_DAIFMT_NB_NF:
                 /*
                  * Normal BCLK + FS.
diff --git a/sound/soc/omap/osk5912.c b/sound/soc/omap/osk5912.c
index a952a4eb3361..a4e149b7f0eb 100644
--- a/sound/soc/omap/osk5912.c
+++ b/sound/soc/omap/osk5912.c
@@ -62,7 +62,7 @@ static int osk_hw_params(struct snd_pcm_substream *substream,
         /* Set codec DAI configuration */
         err = snd_soc_dai_set_fmt(codec_dai,
                                   SND_SOC_DAIFMT_DSP_B |
-                                  SND_SOC_DAIFMT_NB_IF |
+                                  SND_SOC_DAIFMT_NB_NF |
                                   SND_SOC_DAIFMT_CBM_CFM);
         if (err < 0) {
                 printk(KERN_ERR "can't set codec DAI configuration\n");
@@ -72,7 +72,7 @@ static int osk_hw_params(struct snd_pcm_substream *substream,
         /* Set cpu DAI configuration */
         err = snd_soc_dai_set_fmt(cpu_dai,
                                   SND_SOC_DAIFMT_DSP_B |
-                                  SND_SOC_DAIFMT_NB_IF |
+                                  SND_SOC_DAIFMT_NB_NF |
                                   SND_SOC_DAIFMT_CBM_CFM);
         if (err < 0) {
                 printk(KERN_ERR "can't set cpu DAI configuration\n");
diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index 308a657928d2..de2254475d52 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -806,6 +806,7 @@ static int pxa_ssp_probe(struct platform_device *pdev,
                 goto err_priv;
         }
 
+        priv->dai_fmt = (unsigned int) -1;
         dai->private_data = priv;
 
         return 0;
diff --git a/sound/soc/s3c24xx/jive_wm8750.c b/sound/soc/s3c24xx/jive_wm8750.c
index 32063790d95b..93e6c87b7399 100644
--- a/sound/soc/s3c24xx/jive_wm8750.c
+++ b/sound/soc/s3c24xx/jive_wm8750.c
@@ -69,8 +69,8 @@ static int jive_hw_params(struct snd_pcm_substream *substream,
                 break;
         }
 
-        s3c_i2sv2_calc_rate(&div, NULL, params_rate(params),
-                            s3c2412_get_iisclk());
+        s3c_i2sv2_iis_calc_rate(&div, NULL, params_rate(params),
+                                s3c2412_get_iisclk());
 
         /* set codec DAI configuration */
         ret = snd_soc_dai_set_fmt(codec_dai, SND_SOC_DAIFMT_I2S |
@@ -145,8 +145,9 @@ static struct snd_soc_dai_link jive_dai = {
 };
 
 /* jive audio machine driver */
-static struct snd_soc_machine snd_soc_machine_jive = {
+static struct snd_soc_card snd_soc_machine_jive = {
         .name           = "Jive",
+        .platform       = &s3c24xx_soc_platform,
         .dai_link       = &jive_dai,
         .num_links      = 1,
 };
@@ -157,9 +158,8 @@ static struct wm8750_setup_data jive_wm8750_setup = {
 
 /* jive audio subsystem */
 static struct snd_soc_device jive_snd_devdata = {
-        .machine        = &snd_soc_machine_jive,
-        .platform       = &s3c24xx_soc_platform,
-        .codec_dev      = &soc_codec_dev_wm8750_spi,
+        .card           = &snd_soc_machine_jive,
+        .codec_dev      = &soc_codec_dev_wm8750,
         .codec_data     = &jive_wm8750_setup,
 };
 
diff --git a/sound/soc/s3c24xx/s3c-i2s-v2.c b/sound/soc/s3c24xx/s3c-i2s-v2.c
index 295a4c910262..689ffcd17e1f 100644
--- a/sound/soc/s3c24xx/s3c-i2s-v2.c
+++ b/sound/soc/s3c24xx/s3c-i2s-v2.c
@@ -473,9 +473,9 @@ static int s3c2412_i2s_set_clkdiv(struct snd_soc_dai *cpu_dai,
 /* default table of all avaialable root fs divisors */
 static unsigned int iis_fs_tab[] = { 256, 512, 384, 768 };
 
-int s3c2412_iis_calc_rate(struct s3c_i2sv2_rate_calc *info,
-                          unsigned int *fstab,
-                          unsigned int rate, struct clk *clk)
+int s3c_i2sv2_iis_calc_rate(struct s3c_i2sv2_rate_calc *info,
+                            unsigned int *fstab,
+                            unsigned int rate, struct clk *clk)
 {
         unsigned long clkrate = clk_get_rate(clk);
         unsigned int div;
@@ -531,7 +531,7 @@ int s3c2412_iis_calc_rate(struct s3c_i2sv2_rate_calc *info,
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(s3c2412_iis_calc_rate);
+EXPORT_SYMBOL_GPL(s3c_i2sv2_iis_calc_rate);
 
 int s3c_i2sv2_probe(struct platform_device *pdev,
                     struct snd_soc_dai *dai,
@@ -624,10 +624,12 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai)
 
 int s3c_i2sv2_register_dai(struct snd_soc_dai *dai)
 {
-        dai->ops.trigger = s3c2412_i2s_trigger;
-        dai->ops.hw_params = s3c2412_i2s_hw_params;
-        dai->ops.set_fmt = s3c2412_i2s_set_fmt;
-        dai->ops.set_clkdiv = s3c2412_i2s_set_clkdiv;
+        struct snd_soc_dai_ops *ops = dai->ops;
+
+        ops->trigger = s3c2412_i2s_trigger;
+        ops->hw_params = s3c2412_i2s_hw_params;
+        ops->set_fmt = s3c2412_i2s_set_fmt;
+        ops->set_clkdiv = s3c2412_i2s_set_clkdiv;
 
         dai->suspend = s3c2412_i2s_suspend;
         dai->resume = s3c2412_i2s_resume;
diff --git a/sound/soc/s3c24xx/s3c2412-i2s.c b/sound/soc/s3c24xx/s3c2412-i2s.c
index 1ca3cdaa8213..b7e0b3f0bfc8 100644
--- a/sound/soc/s3c24xx/s3c2412-i2s.c
+++ b/sound/soc/s3c24xx/s3c2412-i2s.c
@@ -33,8 +33,8 @@
 
 #include <plat/regs-s3c2412-iis.h>
 
-#include <plat/regs-gpio.h>
 #include <plat/audio.h>
+#include <mach/regs-gpio.h>
 #include <mach/dma.h>
 
 #include "s3c24xx-pcm.h"