24 files changed, 190 insertions, 175 deletions

diff --git a/arch/s390/appldata/appldata_os.c b/arch/s390/appldata/appldata_os.c
index 55c80ffd42b9..92f1cb745d69 100644
--- a/arch/s390/appldata/appldata_os.c
+++ b/arch/s390/appldata/appldata_os.c
@@ -181,7 +181,7 @@ static int __init appldata_os_init(void)
                 goto out;
         }
 
-        appldata_os_data = kzalloc(max_size, GFP_DMA);
+        appldata_os_data = kzalloc(max_size, GFP_KERNEL | GFP_DMA);
         if (appldata_os_data == NULL) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index bcd6884985ad..253f158db668 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.34-rc3
-# Fri Apr  9 09:57:10 2010
+# Linux kernel version: 2.6.35-rc1
+# Fri Jun  4 11:32:40 2010
 #
 CONFIG_SCHED_MC=y
 CONFIG_MMU=y
@@ -35,11 +35,13 @@ CONFIG_CONSTRUCTORS=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_CROSS_COMPILE=""
 CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_HAVE_KERNEL_GZIP=y
 CONFIG_HAVE_KERNEL_BZIP2=y
 CONFIG_HAVE_KERNEL_LZMA=y
+CONFIG_HAVE_KERNEL_LZO=y
 CONFIG_KERNEL_GZIP=y
 # CONFIG_KERNEL_BZIP2 is not set
 # CONFIG_KERNEL_LZMA is not set
@@ -77,6 +79,7 @@ CONFIG_CGROUP_NS=y
 # CONFIG_CGROUP_CPUACCT is not set
 # CONFIG_RESOURCE_COUNTERS is not set
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_BLK_CGROUP is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -157,7 +160,6 @@ CONFIG_STOP_MACHINE=y
 CONFIG_BLOCK=y
 CONFIG_BLK_DEV_BSG=y
 # CONFIG_BLK_DEV_INTEGRITY is not set
-# CONFIG_BLK_CGROUP is not set
 CONFIG_BLOCK_COMPAT=y
 
 #
@@ -166,7 +168,6 @@ CONFIG_BLOCK_COMPAT=y
 CONFIG_IOSCHED_NOOP=y
 CONFIG_IOSCHED_DEADLINE=y
 CONFIG_IOSCHED_CFQ=y
-# CONFIG_CFQ_GROUP_IOSCHED is not set
 CONFIG_DEFAULT_DEADLINE=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
@@ -247,7 +248,6 @@ CONFIG_64BIT=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=32
 CONFIG_HOTPLUG_CPU=y
-# CONFIG_SCHED_BOOK is not set
 CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_AUDIT_ARCH=y
@@ -320,7 +320,6 @@ CONFIG_COMPAT_BINFMT_ELF=y
 # CONFIG_HAVE_AOUT is not set
 CONFIG_BINFMT_MISC=m
 CONFIG_FORCE_MAX_ZONEORDER=9
-# CONFIG_PROCESS_DEBUG is not set
 CONFIG_PFAULT=y
 # CONFIG_SHARED_KERNEL is not set
 # CONFIG_CMM is not set
@@ -457,6 +456,7 @@ CONFIG_NF_CONNTRACK=m
 # CONFIG_IP6_NF_IPTABLES is not set
 # CONFIG_IP_DCCP is not set
 CONFIG_IP_SCTP=m
+# CONFIG_NET_SCTPPROBE is not set
 # CONFIG_SCTP_DBG_MSG is not set
 # CONFIG_SCTP_DBG_OBJCNT is not set
 # CONFIG_SCTP_HMAC_NONE is not set
@@ -465,6 +465,7 @@ CONFIG_SCTP_HMAC_MD5=y
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
+# CONFIG_L2TP is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
@@ -525,6 +526,7 @@ CONFIG_NET_ACT_NAT=m
 # CONFIG_NET_CLS_IND is not set
 CONFIG_NET_SCH_FIFO=y
 # CONFIG_DCB is not set
+CONFIG_RPS=y
 
 #
 # Network testing
@@ -546,6 +548,7 @@ CONFIG_CAN_VCAN=m
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
+# CONFIG_CAIF is not set
 # CONFIG_PCMCIA is not set
 CONFIG_CCW=y
 
@@ -728,6 +731,7 @@ CONFIG_VIRTIO_NET=m
 # Character devices
 #
 CONFIG_DEVKMEM=y
+# CONFIG_N_GSM is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
@@ -775,6 +779,7 @@ CONFIG_S390_TAPE_34XX=m
 # CONFIG_MONREADER is not set
 CONFIG_MONWRITER=m
 CONFIG_S390_VMUR=m
+# CONFIG_RAMOOPS is not set
 
 #
 # PPS support
@@ -788,10 +793,6 @@ CONFIG_S390_VMUR=m
 # CONFIG_NEW_LEDS is not set
 CONFIG_ACCESSIBILITY=y
 # CONFIG_AUXDISPLAY is not set
-
-#
-# TI VLYNQ
-#
 # CONFIG_STAGING is not set
 
 #
@@ -976,6 +977,7 @@ CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
 # CONFIG_LKDTM is not set
+# CONFIG_CPU_NOTIFIER_ERROR_INJECT is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
@@ -1010,6 +1012,7 @@ CONFIG_BRANCH_PROFILE_NONE=y
 CONFIG_KPROBE_EVENT=y
 # CONFIG_RING_BUFFER_BENCHMARK is not set
 # CONFIG_DYNAMIC_DEBUG is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
 CONFIG_SAMPLES=y
 # CONFIG_SAMPLE_TRACEPOINTS is not set
 # CONFIG_SAMPLE_TRACE_EVENTS is not set
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 639380a0c45c..22cfd634c355 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -55,8 +55,10 @@ void *module_alloc(unsigned long size)
 /* Free memory returned from module_alloc */
 void module_free(struct module *mod, void *module_region)
 {
-        vfree(mod->arch.syminfo);
-        mod->arch.syminfo = NULL;
+        if (mod) {
+                vfree(mod->arch.syminfo);
+                mod->arch.syminfo = NULL;
+        }
         vfree(module_region);
 }
 
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 8093e6f47f49..ae3705816878 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -761,7 +761,7 @@ static int __init kvm_s390_init(void)
          * to hold the maximum amount of facilites. On the other hand, we
          * only set facilities that are known to work in KVM.
          */
-        facilities = (unsigned long long *) get_zeroed_page(GFP_DMA);
+        facilities = (unsigned long long *) get_zeroed_page(GFP_KERNEL|GFP_DMA);
         if (!facilities) {
                 kvm_exit();
                 return -ENOMEM;
diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
index eff3c5989b46..702276f5e2fa 100644
--- a/arch/s390/kvm/sigp.c
+++ b/arch/s390/kvm/sigp.c
@@ -113,7 +113,7 @@ static int __inject_sigp_stop(struct kvm_s390_local_interrupt *li, int action)
 {
         struct kvm_s390_interrupt_info *inti;
 
-        inti = kzalloc(sizeof(*inti), GFP_KERNEL);
+        inti = kzalloc(sizeof(*inti), GFP_ATOMIC);
         if (!inti)
                 return -ENOMEM;
         inti->type = KVM_S390_SIGP_STOP;
diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c
index 6409fd57eb04..3cc95dd0a3a6 100644
--- a/arch/s390/mm/extmem.c
+++ b/arch/s390/mm/extmem.c
@@ -105,7 +105,7 @@ static int
 dcss_set_subcodes(void)
 {
 #ifdef CONFIG_64BIT
-        char *name = kmalloc(8 * sizeof(char), GFP_DMA);
+        char *name = kmalloc(8 * sizeof(char), GFP_KERNEL | GFP_DMA);
         unsigned long rx, ry;
         int rc;
 
@@ -252,12 +252,13 @@ dcss_diag_translate_rc (int vm_rc) {
 static int
 query_segment_type (struct dcss_segment *seg)
 {
-        struct qin64  *qin = kmalloc (sizeof(struct qin64), GFP_DMA);
-        struct qout64 *qout = kmalloc (sizeof(struct qout64), GFP_DMA);
-
-        int diag_cc, rc, i;
         unsigned long dummy, vmrc;
+        int diag_cc, rc, i;
+        struct qout64 *qout;
+        struct qin64 *qin;
 
+        qin = kmalloc(sizeof(*qin), GFP_KERNEL | GFP_DMA);
+        qout = kmalloc(sizeof(*qout), GFP_KERNEL | GFP_DMA);
         if ((qin == NULL) || (qout == NULL)) {
                 rc = -ENOMEM;
                 goto out_free;
@@ -286,7 +287,7 @@ query_segment_type (struct dcss_segment *seg)
            copy data for the new format. */
         if (segext_scode == DCSS_SEGEXT) {
                 struct qout64_old *qout_old;
-                qout_old = kzalloc(sizeof(struct qout64_old), GFP_DMA);
+                qout_old = kzalloc(sizeof(*qout_old), GFP_KERNEL | GFP_DMA);
                 if (qout_old == NULL) {
                         rc = -ENOMEM;
                         goto out_free;
@@ -407,11 +408,11 @@ segment_overlaps_others (struct dcss_segment *seg)
 static int
 __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long *end)
 {
-        struct dcss_segment *seg = kmalloc(sizeof(struct dcss_segment),
-                        GFP_DMA);
-        int rc, diag_cc;
         unsigned long start_addr, end_addr, dummy;
+        struct dcss_segment *seg;
+        int rc, diag_cc;
 
+        seg = kmalloc(sizeof(*seg), GFP_KERNEL | GFP_DMA);
         if (seg == NULL) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 1984a6e89e84..261f86d102e8 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -541,29 +541,11 @@ static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
         return -EINVAL;
 }
 
-static int ahci_is_device_present(void __iomem *port_mmio)
-{
-        u8 status = readl(port_mmio + PORT_TFDATA) & 0xff;
-
-        /* Make sure PxTFD.STS.BSY and PxTFD.STS.DRQ are 0 */
-        if (status & (ATA_BUSY | ATA_DRQ))
-                return 0;
-
-        /* Make sure PxSSTS.DET is 3h */
-        status = readl(port_mmio + PORT_SCR_STAT) & 0xf;
-        if (status != 3)
-                return 0;
-        return 1;
-}
-
 void ahci_start_engine(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
         u32 tmp;
 
-        if (!ahci_is_device_present(port_mmio))
-                return;
-
         /* start DMA */
         tmp = readl(port_mmio + PORT_CMD);
         tmp |= PORT_CMD_START;
@@ -1892,6 +1874,9 @@ static void ahci_error_handler(struct ata_port *ap)
         }
 
         sata_pmp_error_handler(ap);
+
+        if (!ata_dev_enabled(ap->link.device))
+                ahci_stop_engine(ap);
 }
 
 static void ahci_post_internal_cmd(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index e9250514734b..70b58fe9e5b1 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -539,12 +539,12 @@ static void sil24_config_port(struct ata_port *ap)
                 writel(PORT_CS_IRQ_WOC, port + PORT_CTRL_CLR);
 
         /* zero error counters. */
-        writel(0x8000, port + PORT_DECODE_ERR_THRESH);
-        writel(0x8000, port + PORT_CRC_ERR_THRESH);
-        writel(0x8000, port + PORT_HSHK_ERR_THRESH);
-        writel(0x0000, port + PORT_DECODE_ERR_CNT);
-        writel(0x0000, port + PORT_CRC_ERR_CNT);
-        writel(0x0000, port + PORT_HSHK_ERR_CNT);
+        writew(0x8000, port + PORT_DECODE_ERR_THRESH);
+        writew(0x8000, port + PORT_CRC_ERR_THRESH);
+        writew(0x8000, port + PORT_HSHK_ERR_THRESH);
+        writew(0x0000, port + PORT_DECODE_ERR_CNT);
+        writew(0x0000, port + PORT_CRC_ERR_CNT);
+        writew(0x0000, port + PORT_HSHK_ERR_CNT);
 
         /* always use 64bit activation */
         writel(PORT_CS_32BIT_ACTV, port + PORT_CTRL_CLR);
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 0ecd0f6aa2c0..4730c42a5ee5 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -578,10 +578,24 @@ static void svia_configure(struct pci_dev *pdev)
 
         /*
          * vt6421 has problems talking to some drives.  The following
-         * is the magic fix from Joseph Chan <JosephChan@via.com.tw>.
-         * Please add proper documentation if possible.
+         * is the fix from Joseph Chan <JosephChan@via.com.tw>.
+         *
+         * When host issues HOLD, device may send up to 20DW of data
+         * before acknowledging it with HOLDA and the host should be
+         * able to buffer them in FIFO.  Unfortunately, some WD drives
+         * send upto 40DW before acknowledging HOLD and, in the
+         * default configuration, this ends up overflowing vt6421's
+         * FIFO, making the controller abort the transaction with
+         * R_ERR.
+         *
+         * Rx52[2] is the internal 128DW FIFO Flow control watermark
+         * adjusting mechanism enable bit and the default value 0
+         * means host will issue HOLD to device when the left FIFO
+         * size goes below 32DW.  Setting it to 1 makes the watermark
+         * 64DW.
          *
          * https://bugzilla.kernel.org/show_bug.cgi?id=15173
+         * http://article.gmane.org/gmane.linux.ide/46352
          */
         if (pdev->device == 0x3249) {
                 pci_read_config_byte(pdev, 0x52, &tmp8);
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index e00a1cc79c0a..c19066479057 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -678,7 +678,7 @@ static const struct file_operations hp_sdc_rtc_fops = {
         .llseek =               no_llseek,
         .read =                 hp_sdc_rtc_read,
         .poll =                 hp_sdc_rtc_poll,
-        .unlocked_ioctl =       hp_sdc_rtc_ioctl,
+        .unlocked_ioctl =       hp_sdc_rtc_unlocked_ioctl,
         .open =                 hp_sdc_rtc_open,
         .fasync =               hp_sdc_rtc_fasync,
 };
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 000d65ea55a4..91c8013cf0d9 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -404,14 +404,9 @@ static int mtd_do_writeoob(struct file *file, struct mtd_info *mtd,
         if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
                 return -EINVAL;
 
-        ops.oobbuf = kmalloc(length, GFP_KERNEL);
-        if (!ops.oobbuf)
-                return -ENOMEM;
-
-        if (copy_from_user(ops.oobbuf, ptr, length)) {
-                kfree(ops.oobbuf);
-                return -EFAULT;
-        }
+        ops.oobbuf = memdup_user(ptr, length);
+        if (IS_ERR(ops.oobbuf))
+                return PTR_ERR(ops.oobbuf);
 
         start &= ~((uint64_t)mtd->oobsize - 1);
         ret = mtd->write_oob(mtd, start, &ops);
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 98a04b3c9526..ffc3720929f1 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -1,13 +1,3 @@
-menuconfig MTD_NAND
-        tristate "NAND Device Support"
-        depends on MTD
-        select MTD_NAND_IDS
-        select MTD_NAND_ECC
-        help
-          This enables support for accessing all type of NAND flash
-          devices. For further information see
-          <http://www.linux-mtd.infradead.org/doc/nand.html>.
-
 config MTD_NAND_ECC
         tristate
 
@@ -19,6 +9,17 @@ config MTD_NAND_ECC_SMC
           Software ECC according to the Smart Media Specification.
           The original Linux implementation had byte 0 and 1 swapped.
 
+
+menuconfig MTD_NAND
+        tristate "NAND Device Support"
+        depends on MTD
+        select MTD_NAND_IDS
+        select MTD_NAND_ECC
+        help
+          This enables support for accessing all type of NAND flash
+          devices. For further information see
+          <http://www.linux-mtd.infradead.org/doc/nand.html>.
+
 if MTD_NAND
 
 config MTD_NAND_VERIFY_WRITE
diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
index 78a423295474..bcfc851fe550 100644
--- a/drivers/mtd/nand/r852.c
+++ b/drivers/mtd/nand/r852.c
@@ -150,7 +150,6 @@ static void r852_dma_done(struct r852_device *dev, int error)
         if (dev->phys_dma_addr && dev->phys_dma_addr != dev->phys_bounce_buffer)
                 pci_unmap_single(dev->pci_dev, dev->phys_dma_addr, R852_DMA_LEN,
                         dev->dma_dir ? PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
-        complete(&dev->dma_done);
 }
 
 /*
@@ -182,6 +181,7 @@ static void r852_do_dma(struct r852_device *dev, uint8_t *buf, int do_read)
         /* Set dma direction */
         dev->dma_dir = do_read;
         dev->dma_stage = 1;
+        INIT_COMPLETION(dev->dma_done);
 
         dbg_verbose("doing dma %s ", do_read ? "read" : "write");
 
@@ -494,6 +494,11 @@ int r852_ecc_correct(struct mtd_info *mtd, uint8_t *dat,
         if (dev->card_unstable)
                 return 0;
 
+        if (dev->dma_error) {
+                dev->dma_error = 0;
+                return -1;
+        }
+
         r852_write_reg(dev, R852_CTL, dev->ctlreg | R852_CTL_ECC_ACCESS);
         ecc_reg = r852_read_reg_dword(dev, R852_DATALINE);
         r852_write_reg(dev, R852_CTL, dev->ctlreg);
@@ -707,6 +712,7 @@ void r852_card_detect_work(struct work_struct *work)
                 container_of(work, struct r852_device, card_detect_work.work);
 
         r852_card_update_present(dev);
+        r852_update_card_detect(dev);
         dev->card_unstable = 0;
 
         /* False alarm */
@@ -722,7 +728,6 @@ void r852_card_detect_work(struct work_struct *work)
         else
                 r852_unregister_nand_device(dev);
 exit:
-        /* Update detection logic */
         r852_update_card_detect(dev);
 }
 
@@ -796,6 +801,7 @@ static irqreturn_t r852_irq(int irq, void *data)
                 if (dma_status & R852_DMA_IRQ_ERROR) {
                         dbg("recieved dma error IRQ");
                         r852_dma_done(dev, -EIO);
+                        complete(&dev->dma_done);
                         goto out;
                 }
 
@@ -825,8 +831,10 @@ static irqreturn_t r852_irq(int irq, void *data)
                         r852_dma_enable(dev);
 
                 /* Operation done */
-                if (dev->dma_stage == 3)
+                if (dev->dma_stage == 3) {
                         r852_dma_done(dev, 0);
+                        complete(&dev->dma_done);
+                }
                 goto out;
         }
 
@@ -940,18 +948,19 @@ int  r852_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
 
         r852_dma_test(dev);
 
+        dev->irq = pci_dev->irq;
+        spin_lock_init(&dev->irqlock);
+
+        dev->card_detected = 0;
+        r852_card_update_present(dev);
+
         /*register irq handler*/
         error = -ENODEV;
         if (request_irq(pci_dev->irq, &r852_irq, IRQF_SHARED,
                           DRV_NAME, dev))
                 goto error10;
 
-        dev->irq = pci_dev->irq;
-        spin_lock_init(&dev->irqlock);
-
         /* kick initial present test */
-        dev->card_detected = 0;
-        r852_card_update_present(dev);
         queue_delayed_work(dev->card_workqueue,
                 &dev->card_detect_work, 0);
 
@@ -1081,7 +1090,7 @@ int r852_resume(struct device *device)
                         dev->card_detected ? "added" : "removed");
 
                 queue_delayed_work(dev->card_workqueue,
-                &dev->card_detect_work, 1000);
+                &dev->card_detect_work, msecs_to_jiffies(1000));
                 return 0;
         }
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b7512cf08c58..477345d41641 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1457,7 +1457,8 @@ static void quirk_jmicron_ata(struct pci_dev *pdev)
         conf5 &= ~(1 << 24);  /* Clear bit 24 */
 
         switch (pdev->device) {
-        case PCI_DEVICE_ID_JMICRON_JMB360:
+        case PCI_DEVICE_ID_JMICRON_JMB360: /* SATA single port */
+        case PCI_DEVICE_ID_JMICRON_JMB362: /* SATA dual ports */
                 /* The controller should be in single function ahci mode */
                 conf1 |= 0x0002A100; /* Set 8, 13, 15, 17 */
                 break;
@@ -1493,12 +1494,14 @@ static void quirk_jmicron_ata(struct pci_dev *pdev)
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata);
diff --git a/drivers/s390/cio/itcw.c b/drivers/s390/cio/itcw.c
index 17da9ab932ed..a0ae29564774 100644
--- a/drivers/s390/cio/itcw.c
+++ b/drivers/s390/cio/itcw.c
@@ -42,7 +42,7 @@
  * size_t size;
  *
  * size = itcw_calc_size(1, 2, 0);
- * buffer = kmalloc(size, GFP_DMA);
+ * buffer = kmalloc(size, GFP_KERNEL | GFP_DMA);
  * if (!buffer)
  *      return -ENOMEM;
  * itcw = itcw_init(buffer, size, ITCW_OP_READ, 1, 2, 0);
diff --git a/drivers/watchdog/wm8350_wdt.c b/drivers/watchdog/wm8350_wdt.c
index 89dd7b035295..b68d928c8f90 100644
--- a/drivers/watchdog/wm8350_wdt.c
+++ b/drivers/watchdog/wm8350_wdt.c
@@ -284,7 +284,7 @@ static int __devinit wm8350_wdt_probe(struct platform_device *pdev)
         struct wm8350 *wm8350 = platform_get_drvdata(pdev);
 
         if (!wm8350) {
-                dev_err(wm8350->dev, "No driver data supplied\n");
+                pr_err("No driver data supplied\n");
                 return -ENODEV;
         }
 
diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
index a33aab6b5e68..54a92fd02bbd 100644
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -234,8 +234,9 @@ static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
                         if (inode->i_mode != mode) {
                                 struct iattr attr;
 
-                                attr.ia_valid = ATTR_MODE;
+                                attr.ia_valid = ATTR_MODE | ATTR_CTIME;
                                 attr.ia_mode = mode;
+                                attr.ia_ctime = CURRENT_TIME_SEC;
                                 rc = jffs2_do_setattr(inode, &attr);
                                 if (rc < 0)
                                         return rc;
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index 7aa4417e085f..166062a68230 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -222,15 +222,18 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(ri->ctime));
 
         jffs2_free_raw_inode(ri);
-        d_instantiate(dentry, inode);
 
         D1(printk(KERN_DEBUG "jffs2_create: Created ino #%lu with mode %o, nlink %d(%d). nrpages %ld\n",
                   inode->i_ino, inode->i_mode, inode->i_nlink,
                   f->inocache->pino_nlink, inode->i_mapping->nrpages));
+
+        d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
 
  fail:
         make_bad_inode(inode);
+        unlock_new_inode(inode);
         iput(inode);
         jffs2_free_raw_inode(ri);
         return ret;
@@ -360,8 +363,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
 
         /* We use f->target field to store the target path. */
@@ -370,8 +373,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 printk(KERN_WARNING "Can't allocate %d bytes of memory\n", targetlen + 1);
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         memcpy(f->target, target, targetlen + 1);
@@ -386,30 +389,24 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -437,8 +434,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -453,7 +450,14 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 
@@ -519,8 +523,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
         /* No data here. Only a metadata node, which will be
            obsoleted by the first data write
@@ -531,30 +535,24 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -582,8 +580,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -599,7 +597,14 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
@@ -693,8 +698,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
         /* No data here. Only a metadata node, which will be
            obsoleted by the first data write
@@ -705,30 +710,24 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -759,8 +758,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -775,8 +774,14 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
-
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 static int jffs2_rename (struct inode *old_dir_i, struct dentry *old_dentry,
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 8bc2c80ab159..459d39d1ea0b 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -465,7 +465,12 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i
         inode->i_blocks = 0;
         inode->i_size = 0;
 
-        insert_inode_hash(inode);
+        if (insert_inode_locked(inode) < 0) {
+                make_bad_inode(inode);
+                unlock_new_inode(inode);
+                iput(inode);
+                return ERR_PTR(-EINVAL);
+        }
 
         return inode;
 }
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index a0fa3bf0d1bb..34640d6dbdcb 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1381,14 +1381,6 @@ xfs_vm_writepage(
         if (!page_has_buffers(page))
                 create_empty_buffers(page, 1 << inode->i_blkbits, 0);
 
-
-        /*
-         *  VM calculation for nr_to_write seems off.  Bump it way
-         *  up, this gets simple streaming writes zippy again.
-         *  To be reviewed again after Jens' writeback changes.
-         */
-        wbc->nr_to_write *= 4;
-
         /*
          * Convert delayed allocate, unwritten or unmapped space
          * to real space and flush out to disk.
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index f149dd10908b..4eb467910a45 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2321,6 +2321,7 @@
 #define PCI_VENDOR_ID_JMICRON           0x197B
 #define PCI_DEVICE_ID_JMICRON_JMB360    0x2360
 #define PCI_DEVICE_ID_JMICRON_JMB361    0x2361
+#define PCI_DEVICE_ID_JMICRON_JMB362    0x2362
 #define PCI_DEVICE_ID_JMICRON_JMB363    0x2363
 #define PCI_DEVICE_ID_JMICRON_JMB365    0x2365
 #define PCI_DEVICE_ID_JMICRON_JMB366    0x2366
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index f64134653a8c..d63ef8f9609f 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -56,15 +56,6 @@ struct writeback_control {
         unsigned for_reclaim:1;         /* Invoked from the page allocator */
         unsigned range_cyclic:1;        /* range_start is cyclic */
         unsigned more_io:1;             /* more io to be dispatched */
-        /*
-         * write_cache_pages() won't update wbc->nr_to_write and
-         * mapping->writeback_index if no_nrwrite_index_update
-         * is set.  write_cache_pages() may write more than we
-         * requested and we want to make sure nr_to_write and
-         * writeback_index are updated in a consistent manner
-         * so we use a single control to update them
-         */
-        unsigned no_nrwrite_index_update:1;
 };
 
 /*
diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
index f5b1ba90e952..f3865c7b4166 100644
--- a/include/trace/events/ext4.h
+++ b/include/trace/events/ext4.h
@@ -306,7 +306,6 @@ TRACE_EVENT(ext4_da_writepages_result,
                 __field(        int,    pages_written           )
                 __field(        long,   pages_skipped           )
                 __field(        char,   more_io                 )       
-                __field(        char,   no_nrwrite_index_update )
                 __field(       pgoff_t, writeback_index         )
         ),
 
@@ -317,16 +316,14 @@ TRACE_EVENT(ext4_da_writepages_result,
                 __entry->pages_written  = pages_written;
                 __entry->pages_skipped  = wbc->pages_skipped;
                 __entry->more_io        = wbc->more_io;
-                __entry->no_nrwrite_index_update = wbc->no_nrwrite_index_update;
                 __entry->writeback_index = inode->i_mapping->writeback_index;
         ),
 
-        TP_printk("dev %s ino %lu ret %d pages_written %d pages_skipped %ld more_io %d no_nrwrite_index_update %d writeback_index %lu",
+        TP_printk("dev %s ino %lu ret %d pages_written %d pages_skipped %ld more_io %d writeback_index %lu",
                   jbd2_dev_to_name(__entry->dev),
                   (unsigned long) __entry->ino, __entry->ret,
                   __entry->pages_written, __entry->pages_skipped,
                   __entry->more_io,
-                  __entry->no_nrwrite_index_update,
                   (unsigned long) __entry->writeback_index)
 );
 
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 5fa63bdf52e4..bbd396ac9546 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -835,7 +835,6 @@ int write_cache_pages(struct address_space *mapping,
         pgoff_t done_index;
         int cycled;
         int range_whole = 0;
-        long nr_to_write = wbc->nr_to_write;
 
         pagevec_init(&pvec, 0);
         if (wbc->range_cyclic) {
@@ -852,7 +851,22 @@ int write_cache_pages(struct address_space *mapping,
                 if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
                         range_whole = 1;
                 cycled = 1; /* ignore range_cyclic tests */
+
+                /*
+                 * If this is a data integrity sync, cap the writeback to the
+                 * current end of file. Any extension to the file that occurs
+                 * after this is a new write and we don't need to write those
+                 * pages out to fulfil our data integrity requirements. If we
+                 * try to write them out, we can get stuck in this scan until
+                 * the concurrent writer stops adding dirty pages and extending
+                 * EOF.
+                 */
+                if (wbc->sync_mode == WB_SYNC_ALL &&
+                    wbc->range_end == LLONG_MAX) {
+                        end = i_size_read(mapping->host) >> PAGE_CACHE_SHIFT;
+                }
         }
+
 retry:
         done_index = index;
         while (!done && (index <= end)) {
@@ -935,11 +949,10 @@ continue_unlock:
                                         done = 1;
                                         break;
                                 }
-                        }
+                        }
 
-                        if (nr_to_write > 0) {
-                                nr_to_write--;
-                                if (nr_to_write == 0 &&
+                        if (wbc->nr_to_write > 0) {
+                                if (--wbc->nr_to_write == 0 &&
                                     wbc->sync_mode == WB_SYNC_NONE) {
                                         /*
                                          * We stop writing back only if we are
@@ -970,11 +983,8 @@ continue_unlock:
                 end = writeback_index - 1;
                 goto retry;
         }
-        if (!wbc->no_nrwrite_index_update) {
-                if (wbc->range_cyclic || (range_whole && nr_to_write > 0))
-                        mapping->writeback_index = done_index;
-                wbc->nr_to_write = nr_to_write;
-        }
+        if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
+                mapping->writeback_index = done_index;
 
         return ret;
 }