91 files changed, 812 insertions, 455 deletions
diff --git a/Documentation/gpio.txt b/Documentation/gpio.txt
index 576ce463cf44..989f1130f4f3 100644
--- a/Documentation/gpio.txt
+++ b/Documentation/gpio.txt
@@ -105,12 +105,15 @@ setting up a platform_device using the GPIO, is mark its direction:
        /* set as input or output, returning 0 or negative errno */
        int gpio_direction_input(unsigned gpio);
-        int gpio_direction_output(unsigned gpio);
+        int gpio_direction_output(unsigned gpio, int value);
 The return value is zero for success, else a negative errno.  It should
 be checked, since the get/set calls don't have error returns and since
 misconfiguration is possible.  (These calls could sleep.)
+For output GPIOs, the value provided becomes the initial output value.
+This helps avoid signal glitching during system startup.
 Setting the direction can fail if the GPIO number is invalid, or when
 that particular GPIO can't be used in that mode.  It's generally a bad
 idea to rely on boot firmware to have set the direction correctly, since
diff --git a/MAINTAINERS b/MAINTAINERS
index 17555bba20af..6d8d5b917d1f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3103,6 +3103,9 @@ TPM DEVICE DRIVER
 P:      Kylene Hall
 M:      kjhall@us.ibm.com
 W:      http://tpmdd.sourceforge.net
+P:      Marcel Selhorst
+M:      tpm@selhorst.net
+W:      http://www.prosec.rub.de/tpm/
 L:      tpmdd-devel@lists.sourceforge.net
 S:      Maintained
diff --git a/arch/arm/mach-at91/gpio.c b/arch/arm/mach-at91/gpio.c
index 44211a0af19a..ba4a1bb3ee40 100644
--- a/arch/arm/mach-at91/gpio.c
+++ b/arch/arm/mach-at91/gpio.c
@@ -215,13 +215,14 @@ int gpio_direction_input(unsigned pin)
 }
 EXPORT_SYMBOL(gpio_direction_input);
-int gpio_direction_output(unsigned pin)
+int gpio_direction_output(unsigned pin, int value)
 {
        void __iomem    *pio = pin_to_controller(pin);
        unsigned        mask = pin_to_mask(pin);
        if (!pio || !(__raw_readl(pio + PIO_PSR) & mask))
                return -EINVAL;
+        __raw_writel(mask, pio + (value ? PIO_SODR : PIO_CODR));
        __raw_writel(mask, pio + PIO_OER);
        return 0;
 }
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 192a5a26cf2b..edc349e5fcf7 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -153,7 +153,7 @@ int gpio_direction_input(unsigned gpio)
 EXPORT_SYMBOL(gpio_direction_input);
-int gpio_direction_output(unsigned gpio)
+int gpio_direction_output(unsigned gpio, int value)
 {
        unsigned long flags;
@@ -161,6 +161,7 @@ int gpio_direction_output(unsigned gpio)
                return -EINVAL;
        local_irq_save(flags);
+        gpio_set_value(gpio, value);
        GPDR |= GPIO_GPIO(gpio);
        local_irq_restore(flags);
        return 0;
diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
index 9ba5654cde11..1eb99b814f5b 100644
--- a/arch/avr32/mach-at32ap/pio.c
+++ b/arch/avr32/mach-at32ap/pio.c
@@ -214,7 +214,7 @@ int gpio_direction_input(unsigned int gpio)
 }
 EXPORT_SYMBOL(gpio_direction_input);
-int gpio_direction_output(unsigned int gpio)
+int gpio_direction_output(unsigned int gpio, int value)
 {
        struct pio_device *pio;
        unsigned int pin;
@@ -223,6 +223,8 @@ int gpio_direction_output(unsigned int gpio)
        if (!pio)
                return -ENODEV;
+        gpio_set_value(gpio, value);
        pin = gpio & 0x1f;
        pio_writel(pio, OER, 1 << pin);
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 2b9c65c3b5d1..5f29018a6533 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -250,7 +250,7 @@ config LASAT
        select R5000_CPU_SCACHE
        select SYS_HAS_CPU_R5000
        select SYS_SUPPORTS_32BIT_KERNEL
-        select SYS_SUPPORTS_64BIT_KERNEL if EXPERIMENTAL
+        select SYS_SUPPORTS_64BIT_KERNEL if BROKEN
        select SYS_SUPPORTS_LITTLE_ENDIAN
        select GENERIC_HARDIRQS_NO__DO_IRQ
@@ -1559,6 +1559,7 @@ config MIPS_MT_SMP
        select CPU_MIPSR2_IRQ_VI
        select CPU_MIPSR2_SRS
        select MIPS_MT
+        select NR_CPUS_DEFAULT_2
        select SMP
        select SYS_SUPPORTS_SMP
        help
@@ -1573,7 +1574,6 @@ config MIPS_MT_SMTC
        select CPU_MIPSR2_IRQ_VI
        select CPU_MIPSR2_SRS
        select MIPS_MT
-        select NR_CPUS_DEFAULT_2
        select NR_CPUS_DEFAULT_8
        select SMP
        select SYS_SUPPORTS_SMP
diff --git a/arch/mips/kernel/kspd.c b/arch/mips/kernel/kspd.c
index 241ee7a2906e..29eadd404fa5 100644
--- a/arch/mips/kernel/kspd.c
+++ b/arch/mips/kernel/kspd.c
@@ -191,6 +191,8 @@ void sp_work_handle_request(void)
        struct mtsp_syscall_generic generic;
        struct mtsp_syscall_ret ret;
        struct kspd_notifications *n;
+        unsigned long written;
+        mm_segment_t old_fs;
        struct timeval tv;
        struct timezone tz;
        int cmd;
@@ -201,7 +203,11 @@ void sp_work_handle_request(void)
        ret.retval = -1;
-        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall), 0)) {
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall))) {
+                set_fs(old_fs);
                printk(KERN_ERR "Expected request but nothing to read\n");
                return;
        }
@@ -209,7 +215,8 @@ void sp_work_handle_request(void)
        size = sc.size;
        if (size) {
-                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size, 0)) {
+                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size)) {
+                        set_fs(old_fs);
                        printk(KERN_ERR "Expected request but nothing to read\n");
                        return;
                }
@@ -282,8 +289,11 @@ void sp_work_handle_request(void)
        if (vpe_getuid(SP_VPE))
                sp_setfsuidgid( 0, 0);
-        if ((rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(struct mtsp_syscall_ret), 0))
+        old_fs = get_fs();
-            < sizeof(struct mtsp_syscall_ret))
+        set_fs(KERNEL_DS);
+        written = rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(ret));
+        set_fs(old_fs);
+        if (written < sizeof(ret))
                printk("KSPD: sp_work_handle_request failed to send to SP\n");
 }
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 1df544c1f966..37849edd0645 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -311,6 +311,8 @@ asmlinkage int sys32_sched_rr_get_interval(compat_pid_t pid,
        return ret;
 }
+#ifdef CONFIG_SYSVIPC
 asmlinkage long
 sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 {
@@ -368,6 +370,16 @@ sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
        return err;
 }
+#else
+asmlinkage long
+sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
+{
+        return -ENOSYS;
+}
+#endif /* CONFIG_SYSVIPC */
 #ifdef CONFIG_MIPS32_N32
 asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
 {
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 656bde2e11b1..28c2e2e6af73 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -49,8 +49,7 @@ LEAF(resume)
 #ifndef CONFIG_CPU_HAS_LLSC
        sw      zero, ll_bit
 #endif
-        mfc0    t1, CP0_STATUS
+        mfc0    t2, CP0_STATUS
-        sw      t1, THREAD_STATUS(a0)
        cpu_save_nonscratch a0
        sw      ra, THREAD_REG31(a0)
@@ -60,8 +59,8 @@ LEAF(resume)
        lw      t3, TASK_THREAD_INFO(a0)
        lw      t0, TI_FLAGS(t3)
        li      t1, _TIF_USEDFPU
-        and     t2, t0, t1
+        and     t1, t0
-        beqz    t2, 1f
+        beqz    t1, 1f
        nor     t1, zero, t1
        and     t0, t0, t1
@@ -74,10 +73,13 @@ LEAF(resume)
        li      t1, ~ST0_CU1
        and     t0, t0, t1
        sw      t0, ST_OFF(t3)
+        /* clear thread_struct CU1 bit */
+        and     t2, t1
        fpu_save_single a0, t0                  # clobbers t0
 1:
+        sw      t2, THREAD_STATUS(a0)
        /*
         * The order of restoring the registers takes care of the race
         * updating $28, $29 and kernelsp without disabling ints.
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 59c1577ecbb3..dbd42adc52ed 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -114,14 +114,6 @@ LEAF(_save_fp_context32)
 */
 LEAF(_restore_fp_context)
        EX      lw t0, SC_FPC_CSR(a0)
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
 #ifdef CONFIG_64BIT
        EX      ldc1 $f1, SC_FPREGS+8(a0)
        EX      ldc1 $f3, SC_FPREGS+24(a0)
@@ -165,14 +157,6 @@ LEAF(_restore_fp_context)
 LEAF(_restore_fp_context32)
        /* Restore an o32 sigcontext.  */
        EX      lw t0, SC32_FPC_CSR(a0)
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
        EX      ldc1 $f0, SC32_FPREGS+0(a0)
        EX      ldc1 $f2, SC32_FPREGS+16(a0)
        EX      ldc1 $f4, SC32_FPREGS+32(a0)
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index cc566cf12246..c7698fd9955c 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -48,8 +48,7 @@
 #ifndef CONFIG_CPU_HAS_LLSC
        sw      zero, ll_bit
 #endif
-        mfc0    t1, CP0_STATUS
+        mfc0    t2, CP0_STATUS
-        LONG_S  t1, THREAD_STATUS(a0)
        cpu_save_nonscratch a0
        LONG_S  ra, THREAD_REG31(a0)
@@ -59,8 +58,8 @@
        PTR_L   t3, TASK_THREAD_INFO(a0)
        LONG_L  t0, TI_FLAGS(t3)
        li      t1, _TIF_USEDFPU
-        and     t2, t0, t1
+        and     t1, t0
-        beqz    t2, 1f
+        beqz    t1, 1f
        nor     t1, zero, t1
        and     t0, t0, t1
@@ -73,10 +72,13 @@
        li      t1, ~ST0_CU1
        and     t0, t0, t1
        LONG_S  t0, ST_OFF(t3)
+        /* clear thread_struct CU1 bit */
+        and     t2, t1
        fpu_save_double a0 t0 t1                # c0_status passed in t0
                                                # clobbers t1
 1:
+        LONG_S  t2, THREAD_STATUS(a0)
        /*
         * The order of restoring the registers takes care of the race
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
index e14ae09eda2b..e6e3047151a6 100644
--- a/arch/mips/kernel/rtlx.c
+++ b/arch/mips/kernel/rtlx.c
@@ -54,6 +54,7 @@ static struct chan_waitqueues {
        wait_queue_head_t rt_queue;
        wait_queue_head_t lx_queue;
        atomic_t in_open;
+        struct mutex mutex;
 } channel_wqs[RTLX_CHANNELS];
 static struct irqaction irq;
@@ -146,7 +147,7 @@ static void stopping(int vpe)
 int rtlx_open(int index, int can_sleep)
 {
-        volatile struct rtlx_info **p;
+        struct rtlx_info **p;
        struct rtlx_channel *chan;
        enum rtlx_state state;
        int ret = 0;
@@ -179,13 +180,24 @@ int rtlx_open(int index, int can_sleep)
                        }
                }
+                smp_rmb();
                if (*p == NULL) {
                        if (can_sleep) {
-                                __wait_event_interruptible(channel_wqs[index].lx_queue,
+                                DEFINE_WAIT(wait);
-                                                           *p != NULL,
-                                                           ret);
+                                for (;;) {
-                                if (ret)
+                                        prepare_to_wait(&channel_wqs[index].lx_queue, &wait, TASK_INTERRUPTIBLE);
+                                        smp_rmb();
+                                        if (*p != NULL)
+                                                break;
+                                        if (!signal_pending(current)) {
+                                                schedule();
+                                                continue;
+                                        }
+                                        ret = -ERESTARTSYS;
                                        goto out_fail;
+                                }
+                                finish_wait(&channel_wqs[index].lx_queue, &wait);
                        } else {
                                printk(" *vpe_get_shared is NULL. "
                                       "Has an SP program been loaded?\n");
@@ -277,56 +289,52 @@ unsigned int rtlx_write_poll(int index)
        return write_spacefree(chan->rt_read, chan->rt_write, chan->buffer_size);
 }
-static inline void copy_to(void *dst, void *src, size_t count, int user)
+ssize_t rtlx_read(int index, void __user *buff, size_t count, int user)
-{
-        if (user)
-                copy_to_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-static inline void copy_from(void *dst, void *src, size_t count, int user)
 {
-        if (user)
+        size_t lx_write, fl = 0L;
-                copy_from_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-ssize_t rtlx_read(int index, void *buff, size_t count, int user)
-{
-        size_t fl = 0L;
        struct rtlx_channel *lx;
+        unsigned long failed;
        if (rtlx == NULL)
                return -ENOSYS;
        lx = &rtlx->channel[index];
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        lx_write = lx->lx_write;
        /* find out how much in total */
        count = min(count,
-                     (size_t)(lx->lx_write + lx->buffer_size - lx->lx_read)
+                     (size_t)(lx_write + lx->buffer_size - lx->lx_read)
                     % lx->buffer_size);
        /* then how much from the read pointer onwards */
-        fl = min( count, (size_t)lx->buffer_size - lx->lx_read);
+        fl = min(count, (size_t)lx->buffer_size - lx->lx_read);
-        copy_to(buff, &lx->lx_buffer[lx->lx_read], fl, user);
+        failed = copy_to_user(buff, lx->lx_buffer + lx->lx_read, fl);
+        if (failed)
+                goto out;
        /* and if there is anything left at the beginning of the buffer */
-        if ( count - fl )
+        if (count - fl)
-                copy_to (buff + fl, lx->lx_buffer, count - fl, user);
+                failed = copy_to_user(buff + fl, lx->lx_buffer, count - fl);
-        /* update the index */
+out:
-        lx->lx_read += count;
+        count -= failed;
-        lx->lx_read %= lx->buffer_size;
+        smp_wmb();
+        lx->lx_read = (lx->lx_read + count) % lx->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
        return count;
 }
-ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
+ssize_t rtlx_write(int index, const void __user *buffer, size_t count, int user)
 {
        struct rtlx_channel *rt;
+        size_t rt_read;
        size_t fl;
        if (rtlx == NULL)
@@ -334,24 +342,35 @@ ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
        rt = &rtlx->channel[index];
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        rt_read = rt->rt_read;
        /* total number of bytes to copy */
        count = min(count,
-                    (size_t)write_spacefree(rt->rt_read, rt->rt_write,
+                    (size_t)write_spacefree(rt_read, rt->rt_write, rt->buffer_size));
-                                            rt->buffer_size));
        /* first bit from write pointer to the end of the buffer, or count */
        fl = min(count, (size_t) rt->buffer_size - rt->rt_write);
-        copy_from (&rt->rt_buffer[rt->rt_write], buffer, fl, user);
+        failed = copy_from_user(rt->rt_buffer + rt->rt_write, buffer, fl);
+        if (failed)
+                goto out;
        /* if there's any left copy to the beginning of the buffer */
-        if( count - fl )
+        if (count - fl) {
-                copy_from (rt->rt_buffer, buffer + fl, count - fl, user);
+                failed = copy_from_user(rt->rt_buffer, buffer + fl, count - fl);
+        }
+out:
+        count -= cailed;
-        rt->rt_write += count;
+        smp_wmb();
-        rt->rt_write %= rt->buffer_size;
+        rt->rt_write = (rt->rt_write + count) % rt->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
-        return(count);
+        return count;
 }
@@ -403,7 +422,7 @@ static ssize_t file_read(struct file *file, char __user * buffer, size_t count,
                return 0;       // -EAGAIN makes cat whinge
        }
-        return rtlx_read(minor, buffer, count, 1);
+        return rtlx_read(minor, buffer, count);
 }
 static ssize_t file_write(struct file *file, const char __user * buffer,
@@ -429,7 +448,7 @@ static ssize_t file_write(struct file *file, const char __user * buffer,
                        return ret;
        }
-        return rtlx_write(minor, (void *)buffer, count, 1);
+        return rtlx_write(minor, buffer, count);
 }
 static const struct file_operations rtlx_fops = {
@@ -468,6 +487,7 @@ static int rtlx_module_init(void)
                init_waitqueue_head(&channel_wqs[i].rt_queue);
                init_waitqueue_head(&channel_wqs[i].lx_queue);
                atomic_set(&channel_wqs[i].in_open, 0);
+                mutex_init(&channel_wqs[i].mutex);
                dev = device_create(mt_class, NULL, MKDEV(major, i),
                                    "%s%d", module_name, i);
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index fdbdbdc65b54..297dfcb97524 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -31,4 +31,7 @@ extern void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
 */
 extern int install_sigtramp(unsigned int __user *tramp, unsigned int syscall);
+/* Check and clear pending FPU exceptions in saved CSR */
+extern int fpcsr_pending(unsigned int __user *fpcsr);
 #endif  /* __SIGNAL_COMMON_H */
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index f091786187a6..8c3c5a5789b0 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -82,6 +82,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
        int err = 0;
        int i;
+        unsigned int used_math;
        err |= __put_user(regs->cp0_epc, &sc->sc_pc);
@@ -104,26 +105,53 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
        }
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
-        if (used_math()) {
+        if (used_math) {
                /*
                 * Save FPU state to signal context. Signal handler
                 * will "inherit" current FPU state.
                 */
-                preempt_disable();
+                own_fpu(1);
+                enable_fp_in_kernel();
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
                err |= save_fp_context(sc);
+                disable_fp_in_kernel();
-                preempt_enable();
        }
        return err;
 }
+int fpcsr_pending(unsigned int __user *fpcsr)
+{
+        int err, sig = 0;
+        unsigned int csr, enabled;
+        err = __get_user(csr, fpcsr);
+        enabled = FPU_CSR_UNI_X | ((csr & FPU_CSR_ALL_E) << 5);
+        /*
+         * If the signal handler set some FPU exceptions, clear it and
+         * send SIGFPE.
+         */
+        if (csr & enabled) {
+                csr &= ~enabled;
+                err |= __put_user(csr, fpcsr);
+                sig = SIGFPE;
+        }
+        return err ?: sig;
+}
+static int
+check_and_restore_fp_context(struct sigcontext __user *sc)
+{
+        int err, sig;
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= restore_fp_context(sc);
+        return err ?: sig;
+}
 int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
        unsigned int used_math;
@@ -157,19 +185,18 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
        err |= __get_user(used_math, &sc->sc_used_math);
        conditional_used_math(used_math);
-        preempt_disable();
+        if (used_math) {
-        if (used_math()) {
                /* restore fpu context if we have used it before */
-                own_fpu();
+                own_fpu(0);
-                err |= restore_fp_context(sc);
+                enable_fp_in_kernel();
+                if (!err)
+                        err = check_and_restore_fp_context(sc);
+                disable_fp_in_kernel();
        } else {
                /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
        }
-        preempt_enable();
        return err;
 }
@@ -332,6 +359,7 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
        struct sigframe __user *frame;
        sigset_t blocked;
+        int sig;
        frame = (struct sigframe __user *) regs.regs[29];
        if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -345,8 +373,11 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        if (restore_sigcontext(&regs, &frame->sf_sc))
+        sig = restore_sigcontext(&regs, &frame->sf_sc);
+        if (sig < 0)
                goto badframe;
+        else if (sig)
+                force_sig(sig, current);
        /*
         * Don't let your children do this ...
@@ -368,6 +399,7 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
        struct rt_sigframe __user *frame;
        sigset_t set;
        stack_t st;
+        int sig;
        frame = (struct rt_sigframe __user *) regs.regs[29];
        if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -381,8 +413,11 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                goto badframe;
+        else if (sig)
+                force_sig(sig, current);
        if (__copy_from_user(&st, &frame->rs_uc.uc_stack, sizeof(st)))
                goto badframe;
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 19bbef001959..151fd2f0893a 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -181,6 +181,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
 {
        int err = 0;
        int i;
+        u32 used_math;
        err |= __put_user(regs->cp0_epc, &sc->sc_pc);
@@ -200,26 +201,34 @@ static int setup_sigcontext32(struct pt_regs *regs,
                err |= __put_user(mflo3(), &sc->sc_lo3);
        }
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
-        if (used_math()) {
+        if (used_math) {
                /*
                 * Save FPU state to signal context.  Signal handler
                 * will "inherit" current FPU state.
                 */
-                preempt_disable();
+                own_fpu(1);
+                enable_fp_in_kernel();
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
                err |= save_fp_context32(sc);
+                disable_fp_in_kernel();
-                preempt_enable();
        }
        return err;
 }
+static int
+check_and_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, sig;
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= restore_fp_context32(sc);
+        return err ?: sig;
+}
 static int restore_sigcontext32(struct pt_regs *regs,
                                struct sigcontext32 __user *sc)
 {
@@ -250,19 +259,18 @@ static int restore_sigcontext32(struct pt_regs *regs,
        err |= __get_user(used_math, &sc->sc_used_math);
        conditional_used_math(used_math);
-        preempt_disable();
+        if (used_math) {
-        if (used_math()) {
                /* restore fpu context if we have used it before */
-                own_fpu();
+                own_fpu(0);
-                err |= restore_fp_context32(sc);
+                enable_fp_in_kernel();
+                if (!err)
+                        err = check_and_restore_fp_context32(sc);
+                disable_fp_in_kernel();
        } else {
                /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
        }
-        preempt_enable();
        return err;
 }
@@ -508,6 +516,7 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
        struct sigframe32 __user *frame;
        sigset_t blocked;
+        int sig;
        frame = (struct sigframe32 __user *) regs.regs[29];
        if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -521,8 +530,11 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        if (restore_sigcontext32(&regs, &frame->sf_sc))
+        sig = restore_sigcontext32(&regs, &frame->sf_sc);
+        if (sig < 0)
                goto badframe;
+        else if (sig)
+                force_sig(sig, current);
        /*
         * Don't let your children do this ...
@@ -545,6 +557,7 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
        sigset_t set;
        stack_t st;
        s32 sp;
+        int sig;
        frame = (struct rt_sigframe32 __user *) regs.regs[29];
        if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -558,8 +571,11 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        if (restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                goto badframe;
+        else if (sig)
+                force_sig(sig, current);
        /* The ucontext contains a stack32_t, so we must convert!  */
        if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index ecf1f7ecaad9..a9202fa95987 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -127,6 +127,7 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
        sigset_t set;
        stack_t st;
        s32 sp;
+        int sig;
        frame = (struct rt_sigframe_n32 __user *) regs.regs[29];
        if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -140,8 +141,11 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                goto badframe;
+        else if (sig)
+                force_sig(sig, current);
        /* The ucontext contains a stack32_t, so we must convert!  */
        if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 18f56a9dbcfa..7d76a85422b2 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -610,16 +610,6 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
        if (fcr31 & FPU_CSR_UNI_X) {
                int sig;
-                preempt_disable();
-#ifdef CONFIG_PREEMPT
-                if (!is_fpu_owner()) {
-                        /* We might lose fpu before disabling preempt... */
-                        own_fpu();
-                        BUG_ON(!used_math());
-                        restore_fp(current);
-                }
-#endif
                /*
                 * Unimplemented operation exception.  If we've got the full
                 * software emulator on-board, let's use it...
@@ -630,18 +620,12 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                 * register operands before invoking the emulator, which seems
                 * a bit extreme for what should be an infrequent event.
                 */
-                save_fp(current);
                /* Ensure 'resume' not overwrite saved fp context again. */
-                lose_fpu();
+                lose_fpu(1);
-                preempt_enable();
                /* Run the emulator */
                sig = fpu_emulator_cop1Handler (regs, &current->thread.fpu, 1);
-                preempt_disable();
-                own_fpu();      /* Using the FPU again.  */
                /*
                 * We can't allow the emulated instruction to leave any of
                 * the cause bit set in $fcr31.
@@ -649,9 +633,7 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
                /* Restore the hardware register state */
-                restore_fp(current);
+                own_fpu(1);     /* Using the FPU again.  */
-                preempt_enable();
                /* If something went wrong, signal */
                if (sig)
@@ -775,12 +757,11 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 {
        unsigned int cpid;
-        die_if_kernel("do_cpu invoked from kernel context!", regs);
        cpid = (regs->cp0_cause >> CAUSEB_CE) & 3;
        switch (cpid) {
        case 0:
+                die_if_kernel("do_cpu invoked from kernel context!", regs);
                if (!cpu_has_llsc)
                        if (!simulate_llsc(regs))
                                return;
@@ -791,21 +772,30 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                break;
        case 1:
-                preempt_disable();
+                if (!test_thread_flag(TIF_ALLOW_FP_IN_KERNEL))
+                        die_if_kernel("do_cpu invoked from kernel context!",
-                own_fpu();
+                                      regs);
-                if (used_math()) {      /* Using the FPU again.  */
+                if (used_math())        /* Using the FPU again.  */
-                        restore_fp(current);
+                        own_fpu(1);
-                } else {                        /* First time FPU user.  */
+                else {                  /* First time FPU user.  */
                        init_fpu();
                        set_used_math();
                }
-                if (cpu_has_fpu) {
+                if (raw_cpu_has_fpu) {
-                        preempt_enable();
+                        if (test_thread_flag(TIF_ALLOW_FP_IN_KERNEL)) {
+                                local_irq_disable();
+                                if (cpu_has_fpu)
+                                        regs->cp0_status |= ST0_CU1;
+                                /*
+                                 * We must return without enabling
+                                 * interrupts to ensure keep FPU
+                                 * ownership until resume.
+                                 */
+                                return;
+                        }
                } else {
                        int sig;
-                        preempt_enable();
                        sig = fpu_emulator_cop1Handler(regs,
                                                &current->thread.fpu, 0);
                        if (sig)
@@ -1259,26 +1249,26 @@ static inline void mips_srs_init(void)
 /*
 * This is used by native signal handling
 */
-asmlinkage int (*save_fp_context)(struct sigcontext *sc);
+asmlinkage int (*save_fp_context)(struct sigcontext __user *sc);
-asmlinkage int (*restore_fp_context)(struct sigcontext *sc);
+asmlinkage int (*restore_fp_context)(struct sigcontext __user *sc);
-extern asmlinkage int _save_fp_context(struct sigcontext *sc);
+extern asmlinkage int _save_fp_context(struct sigcontext __user *sc);
-extern asmlinkage int _restore_fp_context(struct sigcontext *sc);
+extern asmlinkage int _restore_fp_context(struct sigcontext __user *sc);
-extern asmlinkage int fpu_emulator_save_context(struct sigcontext *sc);
+extern asmlinkage int fpu_emulator_save_context(struct sigcontext __user *sc);
-extern asmlinkage int fpu_emulator_restore_context(struct sigcontext *sc);
+extern asmlinkage int fpu_emulator_restore_context(struct sigcontext __user *sc);
 #ifdef CONFIG_SMP
-static int smp_save_fp_context(struct sigcontext *sc)
+static int smp_save_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
               ? _save_fp_context(sc)
               : fpu_emulator_save_context(sc);
 }
-static int smp_restore_fp_context(struct sigcontext *sc)
+static int smp_restore_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
               ? _restore_fp_context(sc)
               : fpu_emulator_restore_context(sc);
 }
@@ -1306,14 +1296,14 @@ static inline void signal_init(void)
 /*
 * This is used by 32-bit signal stuff on the 64-bit kernel
 */
-asmlinkage int (*save_fp_context32)(struct sigcontext32 *sc);
+asmlinkage int (*save_fp_context32)(struct sigcontext32 __user *sc);
-asmlinkage int (*restore_fp_context32)(struct sigcontext32 *sc);
+asmlinkage int (*restore_fp_context32)(struct sigcontext32 __user *sc);
-extern asmlinkage int _save_fp_context32(struct sigcontext32 *sc);
+extern asmlinkage int _save_fp_context32(struct sigcontext32 __user *sc);
-extern asmlinkage int _restore_fp_context32(struct sigcontext32 *sc);
+extern asmlinkage int _restore_fp_context32(struct sigcontext32 __user *sc);
-extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 *sc);
+extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 __user *sc);
-extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 *sc);
+extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 __user *sc);
 static inline void signal32_init(void)
 {
diff --git a/arch/mips/math-emu/kernel_linkage.c b/arch/mips/math-emu/kernel_linkage.c
index 5b3390f64917..ed49ef01ac53 100644
--- a/arch/mips/math-emu/kernel_linkage.c
+++ b/arch/mips/math-emu/kernel_linkage.c
@@ -51,7 +51,7 @@ void fpu_emulator_init_fpu(void)
 * with appropriate macros from uaccess.h
 */
-int fpu_emulator_save_context(struct sigcontext *sc)
+int fpu_emulator_save_context(struct sigcontext __user *sc)
 {
        int i;
        int err = 0;
@@ -65,7 +65,7 @@ int fpu_emulator_save_context(struct sigcontext *sc)
        return err;
 }
-int fpu_emulator_restore_context(struct sigcontext *sc)
+int fpu_emulator_restore_context(struct sigcontext __user *sc)
 {
        int i;
        int err = 0;
@@ -84,7 +84,7 @@ int fpu_emulator_restore_context(struct sigcontext *sc)
 * This is the o32 version
 */
-int fpu_emulator_save_context32(struct sigcontext32 *sc)
+int fpu_emulator_save_context32(struct sigcontext32 __user *sc)
 {
        int i;
        int err = 0;
@@ -98,7 +98,7 @@ int fpu_emulator_save_context32(struct sigcontext32 *sc)
        return err;
 }
-int fpu_emulator_restore_context32(struct sigcontext32 *sc)
+int fpu_emulator_restore_context32(struct sigcontext32 __user *sc)
 {
        int i;
        int err = 0;
diff --git a/arch/sparc64/kernel/ktlb.S b/arch/sparc64/kernel/ktlb.S
index e492db845ea3..d4024ac0d619 100644
--- a/arch/sparc64/kernel/ktlb.S
+++ b/arch/sparc64/kernel/ktlb.S
@@ -138,9 +138,15 @@ kvmap_dtlb_4v:
        brgez,pn        %g4, kvmap_dtlb_nonlinear
         nop
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        /* Index through the base page size TSB even for linear
+         * mappings when using page allocation debugging.
+         */
+        KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
+#else
        /* Correct TAG_TARGET is already in %g6, check 4mb TSB.  */
        KERN_TSB4M_LOOKUP_TL1(%g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
+#endif
        /* TSB entry address left in %g1, lookup linear PTE.
         * Must preserve %g1 and %g6 (TAG).
         */
diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
index b1a1ee0cc6bd..f146071a4b2a 100644
--- a/arch/sparc64/mm/init.c
+++ b/arch/sparc64/mm/init.c
@@ -59,8 +59,10 @@ unsigned long kern_linear_pte_xor[2] __read_mostly;
 */
 unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
+#ifndef CONFIG_DEBUG_PAGEALLOC
 /* A special kernel TSB for 4MB and 256MB linear mappings.  */
 struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
+#endif
 #define MAX_BANKS       32
@@ -1301,7 +1303,12 @@ static void __init tsb_phys_patch(void)
 }
 /* Don't mark as init, we give this to the Hypervisor.  */
-static struct hv_tsb_descr ktsb_descr[2];
+#ifndef CONFIG_DEBUG_PAGEALLOC
+#define NUM_KTSB_DESCR  2
+#else
+#define NUM_KTSB_DESCR  1
+#endif
+static struct hv_tsb_descr ktsb_descr[NUM_KTSB_DESCR];
 extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
 static void __init sun4v_ktsb_init(void)
@@ -1340,6 +1347,7 @@ static void __init sun4v_ktsb_init(void)
        ktsb_descr[0].tsb_base = ktsb_pa;
        ktsb_descr[0].resv = 0;
+#ifndef CONFIG_DEBUG_PAGEALLOC
        /* Second KTSB for 4MB/256MB mappings.  */
        ktsb_pa = (kern_base +
                   ((unsigned long)&swapper_4m_tsb[0] - KERNBASE));
@@ -1352,6 +1360,7 @@ static void __init sun4v_ktsb_init(void)
        ktsb_descr[1].ctx_idx = 0;
        ktsb_descr[1].tsb_base = ktsb_pa;
        ktsb_descr[1].resv = 0;
+#endif
 }
 void __cpuinit sun4v_ktsb_register(void)
@@ -1364,7 +1373,7 @@ void __cpuinit sun4v_ktsb_register(void)
        pa = kern_base + ((unsigned long)&ktsb_descr[0] - KERNBASE);
        func = HV_FAST_MMU_TSB_CTX0;
-        arg0 = 2;
+        arg0 = NUM_KTSB_DESCR;
        arg1 = pa;
        __asm__ __volatile__("ta        %6"
                             : "=&r" (func), "=&r" (arg0), "=&r" (arg1)
@@ -1393,7 +1402,9 @@ void __init paging_init(void)
        /* Invalidate both kernel TSBs.  */
        memset(swapper_tsb, 0x40, sizeof(swapper_tsb));
+#ifndef CONFIG_DEBUG_PAGEALLOC
        memset(swapper_4m_tsb, 0x40, sizeof(swapper_4m_tsb));
+#endif
        if (tlb_type == hypervisor)
                sun4v_pgprot_init();
@@ -1725,8 +1736,13 @@ static void __init sun4u_pgprot_init(void)
        pg_iobits = (_PAGE_VALID | _PAGE_PRESENT_4U | __DIRTY_BITS_4U |
                     __ACCESS_BITS_4U | _PAGE_E_4U);
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4U) ^
+                0xfffff80000000000;
+#else
        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4U) ^
                0xfffff80000000000;
+#endif
        kern_linear_pte_xor[0] |= (_PAGE_CP_4U | _PAGE_CV_4U |
                                   _PAGE_P_4U | _PAGE_W_4U);
@@ -1769,13 +1785,23 @@ static void __init sun4v_pgprot_init(void)
        _PAGE_E = _PAGE_E_4V;
        _PAGE_CACHE = _PAGE_CACHE_4V;
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
+                0xfffff80000000000;
+#else
        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4V) ^
                0xfffff80000000000;
+#endif
        kern_linear_pte_xor[0] |= (_PAGE_CP_4V | _PAGE_CV_4V |
                                   _PAGE_P_4V | _PAGE_W_4V);
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
+                0xfffff80000000000;
+#else
        kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZ256MB_4V) ^
                0xfffff80000000000;
+#endif
        kern_linear_pte_xor[1] |= (_PAGE_CP_4V | _PAGE_CV_4V |
                                   _PAGE_P_4V | _PAGE_W_4V);
diff --git a/drivers/char/lcd.c b/drivers/char/lcd.c
index 5f4fdcf7c96e..1f0962616ee5 100644
--- a/drivers/char/lcd.c
+++ b/drivers/char/lcd.c
@@ -11,9 +11,6 @@
 *       March 2001: Ported from 2.0.34  by Liam Davies
 *
 */
-#define RTC_IO_EXTENT   0x10    /*Only really two ports, but... */
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/miscdevice.h>
@@ -32,8 +29,6 @@
 #include "lcd.h"
-static DEFINE_SPINLOCK(lcd_lock);
 static int lcd_ioctl(struct inode *inode, struct file *file,
                     unsigned int cmd, unsigned long arg);
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index c3f8e383933b..1bbb45b937fd 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -724,6 +724,7 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
                return -ENOMEM;
            memset(vc, 0, sizeof(*vc));
            vc_cons[currcons].d = vc;
+            INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
            visual_init(vc, currcons, 1);
            if (!*vc->vc_uni_pagedir_loc)
                con_set_default_unimap(vc);
@@ -2185,10 +2186,28 @@ static void console_callback(struct work_struct *ignored)
        release_console_sem();
 }
-void set_console(int nr)
+int set_console(int nr)
 {
+        struct vc_data *vc = vc_cons[fg_console].d;
+        if (!vc_cons_allocated(nr) || vt_dont_switch ||
+                (vc->vt_mode.mode == VT_AUTO && vc->vc_mode == KD_GRAPHICS)) {
+                /*
+                 * Console switch will fail in console_callback() or
+                 * change_console() so there is no point scheduling
+                 * the callback
+                 *
+                 * Existing set_console() users don't check the return
+                 * value so this shouldn't break anything
+                 */
+                return -EINVAL;
+        }
        want_console = nr;
        schedule_console_callback();
+        return 0;
 }
 struct tty_driver *console_driver;
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 3a5d301e783b..1fa2da8f4fbe 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -34,7 +34,7 @@
 #include <linux/kbd_diacr.h>
 #include <linux/selection.h>
-static char vt_dont_switch;
+char vt_dont_switch;
 extern struct tty_driver *console_driver;
 #define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 15278044295c..322ee2984e3d 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -176,6 +176,7 @@ void dma_chan_cleanup(struct kref *kref)
        chan->client = NULL;
        kref_put(&chan->device->refcount, dma_async_device_cleanup);
 }
+EXPORT_SYMBOL(dma_chan_cleanup);
 static void dma_chan_free_rcu(struct rcu_head *rcu)
 {
@@ -261,6 +262,7 @@ struct dma_client *dma_async_client_register(dma_event_callback event_callback)
        return client;
 }
+EXPORT_SYMBOL(dma_async_client_register);
 /**
 * dma_async_client_unregister - unregister a client and free the &dma_client
@@ -287,6 +289,7 @@ void dma_async_client_unregister(struct dma_client *client)
        kfree(client);
        dma_chans_rebalance();
 }
+EXPORT_SYMBOL(dma_async_client_unregister);
 /**
 * dma_async_client_chan_request - request DMA channels
@@ -304,6 +307,7 @@ void dma_async_client_chan_request(struct dma_client *client,
        client->chans_desired = number;
        dma_chans_rebalance();
 }
+EXPORT_SYMBOL(dma_async_client_chan_request);
 /**
 * dma_async_device_register - registers DMA devices found
@@ -346,6 +350,7 @@ int dma_async_device_register(struct dma_device *device)
        return 0;
 }
+EXPORT_SYMBOL(dma_async_device_register);
 /**
 * dma_async_device_cleanup - function called when all references are released
@@ -390,23 +395,12 @@ void dma_async_device_unregister(struct dma_device *device)
        kref_put(&device->refcount, dma_async_device_cleanup);
        wait_for_completion(&device->done);
 }
+EXPORT_SYMBOL(dma_async_device_unregister);
 static int __init dma_bus_init(void)
 {
        mutex_init(&dma_list_mutex);
        return class_register(&dma_devclass);
 }
 subsys_initcall(dma_bus_init);
-EXPORT_SYMBOL(dma_async_client_register);
-EXPORT_SYMBOL(dma_async_client_unregister);
-EXPORT_SYMBOL(dma_async_client_chan_request);
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_buf);
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_pg);
-EXPORT_SYMBOL(dma_async_memcpy_pg_to_pg);
-EXPORT_SYMBOL(dma_async_memcpy_complete);
-EXPORT_SYMBOL(dma_async_memcpy_issue_pending);
-EXPORT_SYMBOL(dma_async_device_register);
-EXPORT_SYMBOL(dma_async_device_unregister);
-EXPORT_SYMBOL(dma_chan_cleanup);
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index c3d4856fb618..6d105a1d41b1 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -527,6 +527,7 @@ config SENSORS_W83792D
 config SENSORS_W83793
        tristate "Winbond W83793"
        depends on HWMON && I2C && EXPERIMENTAL
+        select HWMON_VID
        help
          If you say yes here you get support for the Winbond W83793
          hardware monitoring chip.
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index c625ddb8833d..d5ecd2d53046 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -188,7 +188,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
        for (i=0; i < cnt-1 ; i++) {
                sector_t sz = 0;
                int j;
-                for (j=i; i<cnt-1 && sz < min_spacing ; j++)
+                for (j = i; j < cnt - 1 && sz < min_spacing; j++)
                        sz += conf->disks[j].size;
                if (sz >= min_spacing && sz < conf->hash_spacing)
                        conf->hash_spacing = sz;
diff --git a/drivers/pnp/manager.c b/drivers/pnp/manager.c
index 5026b345cb30..57e6ab1004d0 100644
--- a/drivers/pnp/manager.c
+++ b/drivers/pnp/manager.c
@@ -451,7 +451,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
                return -EINVAL;
        if(!pnp_can_configure(dev)) {
-                pnp_info("Device %s does not support resource configuration.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support resource configuration.", dev->dev.bus_id);
                return -ENODEV;
        }
@@ -482,7 +482,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
 int pnp_start_dev(struct pnp_dev *dev)
 {
        if (!pnp_can_write(dev)) {
-                pnp_info("Device %s does not support activation.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support activation.", dev->dev.bus_id);
                return -EINVAL;
        }
@@ -506,7 +506,7 @@ int pnp_start_dev(struct pnp_dev *dev)
 int pnp_stop_dev(struct pnp_dev *dev)
 {
        if (!pnp_can_disable(dev)) {
-                pnp_info("Device %s does not support disabling.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support disabling.", dev->dev.bus_id);
                return -EINVAL;
        }
        if (dev->protocol->disable(dev)<0) {
diff --git a/drivers/spi/at25.c b/drivers/spi/at25.c
index 48e4f48e779f..8efa07e8b8c2 100644
--- a/drivers/spi/at25.c
+++ b/drivers/spi/at25.c
@@ -291,7 +291,7 @@ static int at25_probe(struct spi_device *spi)
         */
        sr = spi_w8r8(spi, AT25_RDSR);
        if (sr < 0 || sr & AT25_SR_nRDY) {
-                dev_dbg(&at25->spi->dev, "rdsr --> %d (%02x)\n", sr, sr);
+                dev_dbg(&spi->dev, "rdsr --> %d (%02x)\n", sr, sr);
                err = -ENXIO;
                goto fail;
        }
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index 6fa260d1a9be..66e7bc985797 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -425,7 +425,7 @@ static int atmel_spi_setup(struct spi_device *spi)
                if (ret)
                        return ret;
                spi->controller_state = (void *)npcs_pin;
-                gpio_direction_output(npcs_pin);
+                gpio_direction_output(npcs_pin, !(spi->mode & SPI_CS_HIGH));
        }
        dev_dbg(&spi->dev,
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
index 24a330d82395..88425e1af4d3 100644
--- a/drivers/spi/spi_bitbang.c
+++ b/drivers/spi/spi_bitbang.c
@@ -302,10 +302,6 @@ static void bitbang_work(struct work_struct *work)
                setup_transfer = NULL;
                list_for_each_entry (t, &m->transfers, transfer_list) {
-                        if (bitbang->shutdown) {
-                                status = -ESHUTDOWN;
-                                break;
-                        }
                        /* override or restore speed and wordsize */
                        if (t->speed_hz || t->bits_per_word) {
@@ -410,8 +406,6 @@ int spi_bitbang_transfer(struct spi_device *spi, struct spi_message *m)
        m->status = -EINPROGRESS;
        bitbang = spi_master_get_devdata(spi->master);
-        if (bitbang->shutdown)
-                return -ESHUTDOWN;
        spin_lock_irqsave(&bitbang->lock, flags);
        if (!spi->max_speed_hz)
@@ -507,28 +501,12 @@ EXPORT_SYMBOL_GPL(spi_bitbang_start);
 */
 int spi_bitbang_stop(struct spi_bitbang *bitbang)
 {
-        unsigned        limit = 500;
+        spi_unregister_master(bitbang->master);
-        spin_lock_irq(&bitbang->lock);
-        bitbang->shutdown = 0;
-        while (!list_empty(&bitbang->queue) && limit--) {
-                spin_unlock_irq(&bitbang->lock);
-                dev_dbg(bitbang->master->cdev.dev, "wait for queue\n");
+        WARN_ON(!list_empty(&bitbang->queue));
-                msleep(10);
-                spin_lock_irq(&bitbang->lock);
-        }
-        spin_unlock_irq(&bitbang->lock);
-        if (!list_empty(&bitbang->queue)) {
-                dev_err(bitbang->master->cdev.dev, "queue didn't empty\n");
-                return -EBUSY;
-        }
        destroy_workqueue(bitbang->workqueue);
-        spi_unregister_master(bitbang->master);
        return 0;
 }
 EXPORT_SYMBOL_GPL(spi_bitbang_stop);
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 651379c51ae6..220abce63e4a 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -41,7 +41,7 @@ struct s3c24xx_spi {
        int                      len;
        int                      count;
-        int                     (*set_cs)(struct s3c2410_spi_info *spi,
+        void                    (*set_cs)(struct s3c2410_spi_info *spi,
                                          int cs, int pol);
        /* data buffers */
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 7f5a59836818..e4f0dd00ae85 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1320,7 +1320,7 @@ config FB_AU1100
 config FB_AU1200
        bool "Au1200 LCD Driver"
-        depends on FB && MIPS && SOC_AU1200
+        depends on (FB = y) && MIPS && SOC_AU1200
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
@@ -1470,7 +1470,7 @@ config FB_G364
 config FB_68328
        bool "Motorola 68328 native frame buffer support"
-        depends on FB && (M68328 || M68EZ328 || M68VZ328)
+        depends on (FB = y) && (M68328 || M68EZ328 || M68VZ328)
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
@@ -1616,7 +1616,7 @@ config FB_IBM_GXT4500
 config FB_PS3
        bool "PS3 GPU framebuffer driver"
-        depends on FB && PS3_PS3AV
+        depends on (FB = y) && PS3_PS3AV
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 4afa30522fdb..0166ec2ccf32 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -384,6 +384,19 @@ SavageSetup2DEngine(struct savagefb_par  *par)
        BCI_SEND(0);
        BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD2);
        BCI_SEND(GlobalBitmapDescriptor);
+        /*
+         * I don't know why, sending this twice fixes the intial black screen,
+         * prevents X from crashing at least in Toshiba laptops with SavageIX.
+         * --Tony
+         */
+        par->bci_ptr = 0;
+        par->SavageWaitFifo(par, 4);
+        BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD1);
+        BCI_SEND(0);
+        BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD2);
+        BCI_SEND(GlobalBitmapDescriptor);
 }
 static void savagefb_set_clip(struct fb_info *info)
@@ -496,7 +509,7 @@ static int common_calc_clock(long freq, int min_m, int min_n1, int max_n1,
 #ifdef SAVAGEFB_DEBUG
 /* This function is used to debug, it prints out the contents of s3 regs */
-static void SavagePrintRegs(void)
+static void SavagePrintRegs(struct savagefb_par *par)
 {
        unsigned char i;
        int vgaCRIndex = 0x3d4;
@@ -1525,7 +1538,7 @@ static int savagefb_set_par(struct fb_info *info)
        savagefb_set_fix(info);
        savagefb_set_clip(info);
-        SavagePrintRegs();
+        SavagePrintRegs(par);
        return 0;
 }
@@ -2155,7 +2168,6 @@ static int __devinit savagefb_probe(struct pci_dev* dev,
        int video_len;
        DBG("savagefb_probe");
-        SavagePrintRegs();
        info = framebuffer_alloc(sizeof(struct savagefb_par), &dev->dev);
        if (!info)
diff --git a/drivers/video/sstfb.c b/drivers/video/sstfb.c
index 59cd1e750f30..62fa5500361d 100644
--- a/drivers/video/sstfb.c
+++ b/drivers/video/sstfb.c
@@ -257,6 +257,7 @@ static void __sst_dac_write(u8 __iomem *vbase, u8 reg, u8 val)
        r_dprintk("sst_dac_write(%#x, %#x)\n", reg, val);
        reg &= 0x07;
        __sst_write(vbase, DAC_DATA,(((u32)reg << 8)) | (u32)val);
+        __sst_wait_idle(vbase);
 }
 /* indexed access to ti/att dacs */
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 51db1182b27e..a2fceba7ef8e 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -507,7 +507,7 @@ out:
 #define INTERPRETER_ELF 2
 #ifndef STACK_RND_MASK
-#define STACK_RND_MASK 0x7ff            /* with 4K pages 8MB of VA */
+#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 #endif
 static unsigned long randomize_stack_top(unsigned long stack_top)
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 329efcd3d8c9..cb20b964419f 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -78,18 +78,13 @@ struct kmem_cache *ecryptfs_dentry_info_cache;
 */
 static void ecryptfs_d_release(struct dentry *dentry)
 {
-        struct dentry *lower_dentry;
+        if (ecryptfs_dentry_to_private(dentry)) {
+                if (ecryptfs_dentry_to_lower(dentry)) {
-        lower_dentry = ecryptfs_dentry_to_lower(dentry);
+                        mntput(ecryptfs_dentry_to_lower_mnt(dentry));
-        if (ecryptfs_dentry_to_private(dentry))
+                        dput(ecryptfs_dentry_to_lower(dentry));
+                }
                kmem_cache_free(ecryptfs_dentry_info_cache,
                                ecryptfs_dentry_to_private(dentry));
-        if (lower_dentry) {
-                struct vfsmount *lower_mnt =
-                        ecryptfs_dentry_to_lower_mnt(dentry);
-                mntput(lower_mnt);
-                dput(lower_dentry);
        }
        return;
 }
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index af53c02f473b..93d046c85f52 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -429,7 +429,8 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
        int err;
        /* Flush out writes to the server in order to update c/mtime */
-        nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
+        if (S_ISREG(inode->i_mode))
+                nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
        /*
         * We may force a getattr if the user cares about atime.
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index bb516a2cfbaf..f1eae44b9a1a 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -151,10 +151,10 @@ int __init register_nfs_fs(void)
        if (ret < 0)
                goto error_0;
-#ifdef CONFIG_NFS_V4
        ret = nfs_register_sysctl();
        if (ret < 0)
                goto error_1;
+#ifdef CONFIG_NFS_V4
        ret = register_filesystem(&nfs4_fs_type);
        if (ret < 0)
                goto error_2;
@@ -165,9 +165,9 @@ int __init register_nfs_fs(void)
 #ifdef CONFIG_NFS_V4
 error_2:
        nfs_unregister_sysctl();
+#endif
 error_1:
        unregister_filesystem(&nfs_fs_type);
-#endif
 error_0:
        return ret;
 }
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index fcdcafbb3293..b62481dabae9 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -50,6 +50,14 @@ static ctl_table nfs_cb_sysctls[] = {
                .proc_handler   = &proc_dointvec_jiffies,
                .strategy       = &sysctl_jiffies,
        },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "nfs_congestion_kb",
+                .data           = &nfs_congestion_kb,
+                .maxlen         = sizeof(nfs_congestion_kb),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
        { .ctl_name = 0 }
 };
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index febdade91670..2867e6b7096f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -12,6 +12,7 @@
 #include <linux/pagemap.h>
 #include <linux/file.h>
 #include <linux/writeback.h>
+#include <linux/swap.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs_fs.h>
@@ -38,7 +39,6 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context*,
                                            struct page *,
                                            unsigned int, unsigned int);
 static void nfs_mark_request_dirty(struct nfs_page *req);
-static int nfs_wait_on_write_congestion(struct address_space *, int);
 static long nfs_flush_mapping(struct address_space *mapping, struct writeback_control *wbc, int how);
 static const struct rpc_call_ops nfs_write_partial_ops;
 static const struct rpc_call_ops nfs_write_full_ops;
@@ -48,8 +48,6 @@ static struct kmem_cache *nfs_wdata_cachep;
 static mempool_t *nfs_wdata_mempool;
 static mempool_t *nfs_commit_mempool;
-static DECLARE_WAIT_QUEUE_HEAD(nfs_write_congestion);
 struct nfs_write_data *nfs_commit_alloc(void)
 {
        struct nfs_write_data *p = mempool_alloc(nfs_commit_mempool, GFP_NOFS);
@@ -211,6 +209,40 @@ static int wb_priority(struct writeback_control *wbc)
 }
 /*
+ * NFS congestion control
+ */
+int nfs_congestion_kb;
+#define NFS_CONGESTION_ON_THRESH        (nfs_congestion_kb >> (PAGE_SHIFT-10))
+#define NFS_CONGESTION_OFF_THRESH       \
+        (NFS_CONGESTION_ON_THRESH - (NFS_CONGESTION_ON_THRESH >> 2))
+static void nfs_set_page_writeback(struct page *page)
+{
+        if (!test_set_page_writeback(page)) {
+                struct inode *inode = page->mapping->host;
+                struct nfs_server *nfss = NFS_SERVER(inode);
+                if (atomic_inc_return(&nfss->writeback) >
+                                NFS_CONGESTION_ON_THRESH)
+                        set_bdi_congested(&nfss->backing_dev_info, WRITE);
+        }
+}
+static void nfs_end_page_writeback(struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        struct nfs_server *nfss = NFS_SERVER(inode);
+        end_page_writeback(page);
+        if (atomic_dec_return(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH) {
+                clear_bdi_congested(&nfss->backing_dev_info, WRITE);
+                congestion_end(WRITE);
+        }
+}
+/*
 * Find an associated nfs write request, and prepare to flush it out
 * Returns 1 if there was no write request, or if the request was
 * already tagged by nfs_set_page_dirty.Returns 0 if the request
@@ -247,7 +279,7 @@ static int nfs_page_mark_flush(struct page *page)
        spin_unlock(req_lock);
        if (test_and_set_bit(PG_FLUSHING, &req->wb_flags) == 0) {
                nfs_mark_request_dirty(req);
-                set_page_writeback(page);
+                nfs_set_page_writeback(page);
        }
        ret = test_bit(PG_NEED_FLUSH, &req->wb_flags);
        nfs_unlock_request(req);
@@ -302,13 +334,8 @@ int nfs_writepage(struct page *page, struct writeback_control *wbc)
        return err; 
 }
-/*
- * Note: causes nfs_update_request() to block on the assumption
- *       that the writeback is generated due to memory pressure.
- */
 int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
 {
-        struct backing_dev_info *bdi = mapping->backing_dev_info;
        struct inode *inode = mapping->host;
        int err;
@@ -317,20 +344,12 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
        err = generic_writepages(mapping, wbc);
        if (err)
                return err;
-        while (test_and_set_bit(BDI_write_congested, &bdi->state) != 0) {
-                if (wbc->nonblocking)
-                        return 0;
-                nfs_wait_on_write_congestion(mapping, 0);
-        }
        err = nfs_flush_mapping(mapping, wbc, wb_priority(wbc));
        if (err < 0)
                goto out;
        nfs_add_stats(inode, NFSIOS_WRITEPAGES, err);
        err = 0;
 out:
-        clear_bit(BDI_write_congested, &bdi->state);
-        wake_up_all(&nfs_write_congestion);
-        congestion_end(WRITE);
        return err;
 }
@@ -360,7 +379,7 @@ static int nfs_inode_add_request(struct inode *inode, struct nfs_page *req)
 }
 /*
- * Insert a write request into an inode
+ * Remove a write request from an inode
 */
 static void nfs_inode_remove_request(struct nfs_page *req)
 {
@@ -531,10 +550,10 @@ static inline int nfs_scan_commit(struct inode *inode, struct list_head *dst, un
 }
 #endif
-static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
+static int nfs_wait_on_write_congestion(struct address_space *mapping)
 {
+        struct inode *inode = mapping->host;
        struct backing_dev_info *bdi = mapping->backing_dev_info;
-        DEFINE_WAIT(wait);
        int ret = 0;
        might_sleep();
@@ -542,31 +561,23 @@ static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
        if (!bdi_write_congested(bdi))
                return 0;
-        nfs_inc_stats(mapping->host, NFSIOS_CONGESTIONWAIT);
+        nfs_inc_stats(inode, NFSIOS_CONGESTIONWAIT);
-        if (intr) {
+        do {
-                struct rpc_clnt *clnt = NFS_CLIENT(mapping->host);
+                struct rpc_clnt *clnt = NFS_CLIENT(inode);
                sigset_t oldset;
                rpc_clnt_sigmask(clnt, &oldset);
-                prepare_to_wait(&nfs_write_congestion, &wait, TASK_INTERRUPTIBLE);
+                ret = congestion_wait_interruptible(WRITE, HZ/10);
-                if (bdi_write_congested(bdi)) {
-                        if (signalled())
-                                ret = -ERESTARTSYS;
-                        else
-                                schedule();
-                }
                rpc_clnt_sigunmask(clnt, &oldset);
-        } else {
+                if (ret == -ERESTARTSYS)
-                prepare_to_wait(&nfs_write_congestion, &wait, TASK_UNINTERRUPTIBLE);
+                        break;
-                if (bdi_write_congested(bdi))
+                ret = 0;
-                        schedule();
+        } while (bdi_write_congested(bdi));
-        }
-        finish_wait(&nfs_write_congestion, &wait);
        return ret;
 }
 /*
 * Try to update any existing write request, or create one if there is none.
 * In order to match, the request's credentials must match those of
@@ -577,14 +588,15 @@ static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
 static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
                struct page *page, unsigned int offset, unsigned int bytes)
 {
-        struct inode *inode = page->mapping->host;
+        struct address_space *mapping = page->mapping;
+        struct inode *inode = mapping->host;
        struct nfs_inode *nfsi = NFS_I(inode);
        struct nfs_page         *req, *new = NULL;
        unsigned long           rqend, end;
        end = offset + bytes;
-        if (nfs_wait_on_write_congestion(page->mapping, NFS_SERVER(inode)->flags & NFS_MOUNT_INTR))
+        if (nfs_wait_on_write_congestion(mapping))
                return ERR_PTR(-ERESTARTSYS);
        for (;;) {
                /* Loop over all inode entries and see if we find
@@ -727,7 +739,7 @@ int nfs_updatepage(struct file *file, struct page *page,
 static void nfs_writepage_release(struct nfs_page *req)
 {
-        end_page_writeback(req->wb_page);
+        nfs_end_page_writeback(req->wb_page);
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
        if (!PageError(req->wb_page)) {
@@ -1042,12 +1054,12 @@ static void nfs_writeback_done_full(struct rpc_task *task, void *calldata)
                if (task->tk_status < 0) {
                        nfs_set_pageerror(page);
                        req->wb_context->error = task->tk_status;
-                        end_page_writeback(page);
+                        nfs_end_page_writeback(page);
                        nfs_inode_remove_request(req);
                        dprintk(", error = %d\n", task->tk_status);
                        goto next;
                }
-                end_page_writeback(page);
+                nfs_end_page_writeback(page);
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
                if (data->args.stable != NFS_UNSTABLE || data->verf.committed == NFS_FILE_SYNC) {
@@ -1514,6 +1526,26 @@ int __init nfs_init_writepagecache(void)
        if (nfs_commit_mempool == NULL)
                return -ENOMEM;
+        /*
+         * NFS congestion size, scale with available memory.
+         *
+         *  64MB:    8192k
+         * 128MB:   11585k
+         * 256MB:   16384k
+         * 512MB:   23170k
+         *   1GB:   32768k
+         *   2GB:   46340k
+         *   4GB:   65536k
+         *   8GB:   92681k
+         *  16GB:  131072k
+         *
+         * This allows larger machines to have larger/more transfers.
+         * Limit the default to 256M
+         */
+        nfs_congestion_kb = (16*int_sqrt(totalram_pages)) << (PAGE_SHIFT-10);
+        if (nfs_congestion_kb > 256*1024)
+                nfs_congestion_kb = 256*1024;
        return 0;
 }
diff --git a/fs/partitions/Kconfig b/fs/partitions/Kconfig
index 74552c60b671..6e8bb66fe619 100644
--- a/fs/partitions/Kconfig
+++ b/fs/partitions/Kconfig
@@ -235,5 +235,4 @@ config EFI_PARTITION
        select CRC32
        help
          Say Y here if you would like to use hard disks under Linux which
-          were partitioned using EFI GPT.  Presently only useful on the
+          were partitioned using EFI GPT.
-          IA-64 platform.
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index e46d237b10f9..8a7d0035ad7a 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -541,7 +541,7 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
        if (!get_capacity(disk) || !(state = check_partition(disk, bdev)))
                return 0;
        if (IS_ERR(state))      /* I/O error reading the partition table */
-                return PTR_ERR(state);
+                return -EIO;
        for (p = 1; p < state->limit; p++) {
                sector_t size = state->parts[p].size;
                sector_t from = state->parts[p].from;
diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
index 42261dbdf60f..723f7c667661 100644
--- a/fs/smbfs/request.c
+++ b/fs/smbfs/request.c
@@ -181,6 +181,7 @@ static int smb_setup_request(struct smb_request *req)
        req->rq_errno = 0;
        req->rq_fragment = 0;
        kfree(req->rq_trans2buffer);
+        req->rq_trans2buffer = NULL;
        return 0;
 }
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index bcc44084e004..841ac25fd950 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -244,62 +244,87 @@ failed:
 * We can come here from ufs_writepage or ufs_prepare_write,
 * locked_page is argument of these functions, so we already lock it.
 */
-static void ufs_change_blocknr(struct inode *inode, unsigned int beg,
+static void ufs_change_blocknr(struct inode *inode, sector_t beg,
-                               unsigned int count, unsigned int oldb,
+                               unsigned int count, sector_t oldb,
-                               unsigned int newb, struct page *locked_page)
+                               sector_t newb, struct page *locked_page)
 {
-        const unsigned mask = (1 << (PAGE_CACHE_SHIFT - inode->i_blkbits)) - 1;
+        const unsigned blks_per_page =
+                1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        const unsigned mask = blks_per_page - 1;
        struct address_space * const mapping = inode->i_mapping;
-        pgoff_t index, cur_index;
+        pgoff_t index, cur_index, last_index;
-        unsigned end, pos, j;
+        unsigned pos, j, lblock;
+        sector_t end, i;
        struct page *page;
        struct buffer_head *head, *bh;
-        UFSD("ENTER, ino %lu, count %u, oldb %u, newb %u\n",
+        UFSD("ENTER, ino %lu, count %u, oldb %llu, newb %llu\n",
-              inode->i_ino, count, oldb, newb);
+              inode->i_ino, count,
+             (unsigned long long)oldb, (unsigned long long)newb);
        BUG_ON(!locked_page);
        BUG_ON(!PageLocked(locked_page));
        cur_index = locked_page->index;
+        end = count + beg;
-        for (end = count + beg; beg < end; beg = (beg | mask) + 1) {
+        last_index = end >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
-                index = beg >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        for (i = beg; i < end; i = (i | mask) + 1) {
+                index = i >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
                if (likely(cur_index != index)) {
                        page = ufs_get_locked_page(mapping, index);
-                        if (!page || IS_ERR(page)) /* it was truncated or EIO */
+                        if (!page)/* it was truncated */
+                                continue;
+                        if (IS_ERR(page)) {/* or EIO */
+                                ufs_error(inode->i_sb, __FUNCTION__,
+                                          "read of page %llu failed\n",
+                                          (unsigned long long)index);
                                continue;
+                        }
                } else
                        page = locked_page;
                head = page_buffers(page);
                bh = head;
-                pos = beg & mask;
+                pos = i & mask;
                for (j = 0; j < pos; ++j)
                        bh = bh->b_this_page;
-                j = 0;
+                if (unlikely(index == last_index))
+                        lblock = end & mask;
+                else
+                        lblock = blks_per_page;
                do {
-                        if (buffer_mapped(bh)) {
+                        if (j >= lblock)
-                                pos = bh->b_blocknr - oldb;
+                                break;
-                                if (pos < count) {
+                        pos = (i - beg) + j;
-                                        UFSD(" change from %llu to %llu\n",
-                                             (unsigned long long)pos + oldb,
+                        if (!buffer_mapped(bh))
-                                             (unsigned long long)pos + newb);
+                                        map_bh(bh, inode->i_sb, oldb + pos);
-                                        bh->b_blocknr = newb + pos;
+                        if (!buffer_uptodate(bh)) {
-                                        unmap_underlying_metadata(bh->b_bdev,
+                                ll_rw_block(READ, 1, &bh);
-                                                                  bh->b_blocknr);
+                                wait_on_buffer(bh);
-                                        mark_buffer_dirty(bh);
+                                if (!buffer_uptodate(bh)) {
-                                        ++j;
+                                        ufs_error(inode->i_sb, __FUNCTION__,
+                                                  "read of block failed\n");
+                                        break;
                                }
                        }
+                        UFSD(" change from %llu to %llu, pos %u\n",
+                             (unsigned long long)pos + oldb,
+                             (unsigned long long)pos + newb, pos);
+                        bh->b_blocknr = newb + pos;
+                        unmap_underlying_metadata(bh->b_bdev,
+                                                  bh->b_blocknr);
+                        mark_buffer_dirty(bh);
+                        ++j;
                        bh = bh->b_this_page;
                } while (bh != head);
-                if (j)
-                        set_page_dirty(page);
                if (likely(cur_index != index))
                        ufs_put_locked_page(page);
        }
@@ -457,8 +482,9 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
        if (result) {
                ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
                                locked_page != NULL);
-                ufs_change_blocknr(inode, fragment - oldcount, oldcount, tmp,
+                ufs_change_blocknr(inode, fragment - oldcount, oldcount,
-                                   result, locked_page);
+                                   uspi->s_sbbase + tmp,
+                                   uspi->s_sbbase + result, locked_page);
                ufs_cpu_to_data_ptr(sb, p, result);
                *err = 0;
                UFS_I(inode)->i_lastfrag = max_t(u32, UFS_I(inode)->i_lastfrag, fragment + count);
diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c
index b868878009b6..c28a8b6f2feb 100644
--- a/fs/ufs/ialloc.c
+++ b/fs/ufs/ialloc.c
@@ -343,9 +343,8 @@ cg_found:
                lock_buffer(bh);
                ufs2_inode = (struct ufs2_inode *)bh->b_data;
                ufs2_inode += ufs_inotofsbo(inode->i_ino);
-                ufs2_inode->ui_birthtime.tv_sec =
+                ufs2_inode->ui_birthtime = cpu_to_fs64(sb, CURRENT_TIME.tv_sec);
-                        cpu_to_fs32(sb, CURRENT_TIME_SEC.tv_sec);
+                ufs2_inode->ui_birthnsec = cpu_to_fs32(sb, CURRENT_TIME.tv_nsec);
-                ufs2_inode->ui_birthtime.tv_usec = 0;
                mark_buffer_dirty(bh);
                unlock_buffer(bh);
                if (sb->s_flags & MS_SYNCHRONOUS)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index fb34ad03e224..013d7afe7cde 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -212,7 +212,7 @@ repeat:
                        brelse (result);
                        goto repeat;
                } else {
-                        *phys = tmp + blockoff;
+                        *phys = uspi->s_sbbase + tmp + blockoff;
                        return NULL;
                }
        }
@@ -282,9 +282,9 @@ repeat:
        }
        if (!phys) {
-                result = sb_getblk(sb, tmp + blockoff);
+                result = sb_getblk(sb, uspi->s_sbbase + tmp + blockoff);
        } else {
-                *phys = tmp + blockoff;
+                *phys = uspi->s_sbbase + tmp + blockoff;
                result = NULL;
                *err = 0;
                *new = 1;
@@ -368,7 +368,7 @@ repeat:
                        brelse (result);
                        goto repeat;
                } else {
-                        *phys = tmp + blockoff;
+                        *phys = uspi->s_sbbase + tmp + blockoff;
                        goto out;
                }
        }
@@ -389,9 +389,9 @@ repeat:
        if (!phys) {
-                result = sb_getblk(sb, tmp + blockoff);
+                result = sb_getblk(sb, uspi->s_sbbase + tmp + blockoff);
        } else {
-                *phys = tmp + blockoff;
+                *phys = uspi->s_sbbase + tmp + blockoff;
                *new = 1;
        }
@@ -668,12 +668,12 @@ static void ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
        inode->i_gid = fs32_to_cpu(sb, ufs2_inode->ui_gid);
        inode->i_size = fs64_to_cpu(sb, ufs2_inode->ui_size);
-        inode->i_atime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_atime.tv_sec);
+        inode->i_atime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_atime);
-        inode->i_ctime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_ctime.tv_sec);
+        inode->i_ctime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_ctime);
-        inode->i_mtime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_mtime.tv_sec);
+        inode->i_mtime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_mtime);
-        inode->i_mtime.tv_nsec = 0;
+        inode->i_atime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_atimensec);
-        inode->i_atime.tv_nsec = 0;
+        inode->i_ctime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_ctimensec);
-        inode->i_ctime.tv_nsec = 0;
+        inode->i_mtime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_mtimensec);
        inode->i_blocks = fs64_to_cpu(sb, ufs2_inode->ui_blocks);
        inode->i_generation = fs32_to_cpu(sb, ufs2_inode->ui_gen);
        ufsi->i_flags = fs32_to_cpu(sb, ufs2_inode->ui_flags);
@@ -803,12 +803,12 @@ static void ufs2_update_inode(struct inode *inode, struct ufs2_inode *ufs_inode)
        ufs_inode->ui_gid = cpu_to_fs32(sb, inode->i_gid);
        ufs_inode->ui_size = cpu_to_fs64(sb, inode->i_size);
-        ufs_inode->ui_atime.tv_sec = cpu_to_fs32(sb, inode->i_atime.tv_sec);
+        ufs_inode->ui_atime = cpu_to_fs64(sb, inode->i_atime.tv_sec);
-        ufs_inode->ui_atime.tv_usec = 0;
+        ufs_inode->ui_atimensec = cpu_to_fs32(sb, inode->i_atime.tv_nsec);
-        ufs_inode->ui_ctime.tv_sec = cpu_to_fs32(sb, inode->i_ctime.tv_sec);
+        ufs_inode->ui_ctime = cpu_to_fs64(sb, inode->i_ctime.tv_sec);
-        ufs_inode->ui_ctime.tv_usec = 0;
+        ufs_inode->ui_ctimensec = cpu_to_fs32(sb, inode->i_ctime.tv_nsec);
-        ufs_inode->ui_mtime.tv_sec = cpu_to_fs32(sb, inode->i_mtime.tv_sec);
+        ufs_inode->ui_mtime = cpu_to_fs64(sb, inode->i_mtime.tv_sec);
-        ufs_inode->ui_mtime.tv_usec = 0;
+        ufs_inode->ui_mtimensec = cpu_to_fs32(sb, inode->i_mtime.tv_nsec);
        ufs_inode->ui_blocks = cpu_to_fs64(sb, inode->i_blocks);
        ufs_inode->ui_flags = cpu_to_fs32(sb, ufsi->i_flags);
diff --git a/fs/ufs/truncate.c b/fs/ufs/truncate.c
index 749581fa7729..79c54c85fb58 100644
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -74,7 +74,7 @@ static int ufs_trunc_direct(struct inode *inode)
        unsigned i, tmp;
        int retry;
        
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
        sb = inode->i_sb;
        uspi = UFS_SB(sb)->s_uspi;
@@ -96,8 +96,8 @@ static int ufs_trunc_direct(struct inode *inode)
                block2 = ufs_fragstoblks (frag3);
        }
-        UFSD("frag1 %llu, frag2 %llu, block1 %llu, block2 %llu, frag3 %llu,"
+        UFSD("ino %lu, frag1 %llu, frag2 %llu, block1 %llu, block2 %llu,"
-             " frag4 %llu\n",
+             " frag3 %llu, frag4 %llu\n", inode->i_ino,
             (unsigned long long)frag1, (unsigned long long)frag2,
             (unsigned long long)block1, (unsigned long long)block2,
             (unsigned long long)frag3, (unsigned long long)frag4);
@@ -163,7 +163,7 @@ next1:
        mark_inode_dirty(inode);
 next3:
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
        return retry;
 }
@@ -248,7 +248,7 @@ static int ufs_trunc_indirect(struct inode *inode, u64 offset, void *p)
        }
        ubh_brelse (ind_ubh);
        
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
        
        return retry;
 }
@@ -262,7 +262,7 @@ static int ufs_trunc_dindirect(struct inode *inode, u64 offset, void *p)
        void *dind;
        int retry = 0;
        
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
        
        sb = inode->i_sb;
        uspi = UFS_SB(sb)->s_uspi;
@@ -312,7 +312,7 @@ static int ufs_trunc_dindirect(struct inode *inode, u64 offset, void *p)
        }
        ubh_brelse (dind_bh);
        
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
        
        return retry;
 }
@@ -327,7 +327,7 @@ static int ufs_trunc_tindirect(struct inode *inode)
        void *tind, *p;
        int retry;
        
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
        retry = 0;
        
@@ -348,7 +348,7 @@ static int ufs_trunc_tindirect(struct inode *inode)
        }
        for (i = tindirect_block ; i < uspi->s_apb ; i++) {
-                tind = ubh_get_addr32 (tind_bh, i);
+                tind = ubh_get_data_ptr(uspi, tind_bh, i);
                retry |= ufs_trunc_dindirect(inode, UFS_NDADDR + 
                        uspi->s_apb + ((i + 1) << uspi->s_2apbshift), tind);
                ubh_mark_buffer_dirty(tind_bh);
@@ -372,19 +372,21 @@ static int ufs_trunc_tindirect(struct inode *inode)
        }
        ubh_brelse (tind_bh);
        
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
        return retry;
 }
 static int ufs_alloc_lastblock(struct inode *inode)
 {
        int err = 0;
+        struct super_block *sb = inode->i_sb;
        struct address_space *mapping = inode->i_mapping;
-        struct ufs_sb_private_info *uspi = UFS_SB(inode->i_sb)->s_uspi;
+        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
        unsigned i, end;
        sector_t lastfrag;
        struct page *lastpage;
        struct buffer_head *bh;
+        u64 phys64;
        lastfrag = (i_size_read(inode) + uspi->s_fsize - 1) >> uspi->s_fshift;
@@ -424,6 +426,20 @@ static int ufs_alloc_lastblock(struct inode *inode)
               set_page_dirty(lastpage);
       }
+       if (lastfrag >= UFS_IND_FRAGMENT) {
+               end = uspi->s_fpb - ufs_fragnum(lastfrag) - 1;
+               phys64 = bh->b_blocknr + 1;
+               for (i = 0; i < end; ++i) {
+                       bh = sb_getblk(sb, i + phys64);
+                       lock_buffer(bh);
+                       memset(bh->b_data, 0, sb->s_blocksize);
+                       set_buffer_uptodate(bh);
+                       mark_buffer_dirty(bh);
+                       unlock_buffer(bh);
+                       sync_dirty_buffer(bh);
+                       brelse(bh);
+               }
+       }
 out_unlock:
       ufs_put_locked_page(lastpage);
 out:
diff --git a/include/asm-arm/arch-at91/gpio.h b/include/asm-arm/arch-at91/gpio.h
index 98ad2114f43a..0a241e2fb672 100644
--- a/include/asm-arm/arch-at91/gpio.h
+++ b/include/asm-arm/arch-at91/gpio.h
@@ -223,7 +223,7 @@ static inline void gpio_free(unsigned gpio)
 }
 extern int gpio_direction_input(unsigned gpio);
-extern int gpio_direction_output(unsigned gpio);
+extern int gpio_direction_output(unsigned gpio, int value);
 static inline int gpio_get_value(unsigned gpio)
 {
diff --git a/include/asm-arm/arch-omap/gpio.h b/include/asm-arm/arch-omap/gpio.h
index 3762a6ae6a7f..590917efc94a 100644
--- a/include/asm-arm/arch-omap/gpio.h
+++ b/include/asm-arm/arch-omap/gpio.h
@@ -113,8 +113,9 @@ static inline int gpio_direction_input(unsigned gpio)
        return __gpio_set_direction(gpio, 1);
 }
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
+        omap_set_gpio_dataout(gpio, value);
        return __gpio_set_direction(gpio, 0);
 }
diff --git a/include/asm-arm/arch-pxa/gpio.h b/include/asm-arm/arch-pxa/gpio.h
index 3d348a351157..aeba24347f8e 100644
--- a/include/asm-arm/arch-pxa/gpio.h
+++ b/include/asm-arm/arch-pxa/gpio.h
@@ -43,9 +43,9 @@ static inline int gpio_direction_input(unsigned gpio)
        return pxa_gpio_mode(gpio | GPIO_IN);
 }
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
-        return pxa_gpio_mode(gpio | GPIO_OUT);
+        return pxa_gpio_mode(gpio | GPIO_OUT | (value ? 0 : GPIO_DFLT_LOW));
 }
 static inline int __gpio_get_value(unsigned gpio)
diff --git a/include/asm-arm/arch-s3c2410/gpio.h b/include/asm-arm/arch-s3c2410/gpio.h
index d47ae453f8ca..7583895fd336 100644
--- a/include/asm-arm/arch-s3c2410/gpio.h
+++ b/include/asm-arm/arch-s3c2410/gpio.h
@@ -44,9 +44,11 @@ static inline int gpio_direction_input(unsigned gpio)
        return 0;
 }
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
        s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_OUTPUT);
+        /* REVISIT can we write the value first, to avoid glitching? */
+        s3c2410_gpio_setpin(gpio, value);
        return 0;
 }
diff --git a/include/asm-arm/arch-sa1100/gpio.h b/include/asm-arm/arch-sa1100/gpio.h
index da7575b0e5d0..e7a9d26e22a8 100644
--- a/include/asm-arm/arch-sa1100/gpio.h
+++ b/include/asm-arm/arch-sa1100/gpio.h
@@ -38,7 +38,7 @@ static inline void gpio_free(unsigned gpio)
 }
 extern int gpio_direction_input(unsigned gpio);
-extern int gpio_direction_output(unsigned gpio);
+extern int gpio_direction_output(unsigned gpio, int value);
 static inline int gpio_get_value(unsigned gpio)
diff --git a/include/asm-avr32/arch-at32ap/gpio.h b/include/asm-avr32/arch-at32ap/gpio.h
index fcb756bdaa8e..80a21aa9ae77 100644
--- a/include/asm-avr32/arch-at32ap/gpio.h
+++ b/include/asm-avr32/arch-at32ap/gpio.h
@@ -10,7 +10,7 @@ int __must_check gpio_request(unsigned int gpio, const char *label);
 void gpio_free(unsigned int gpio);
 int gpio_direction_input(unsigned int gpio);
-int gpio_direction_output(unsigned int gpio);
+int gpio_direction_output(unsigned int gpio, int value);
 int gpio_get_value(unsigned int gpio);
 void gpio_set_value(unsigned int gpio, int value);
diff --git a/include/asm-i386/sync_bitops.h b/include/asm-i386/sync_bitops.h
index c94d51c993ee..7d72351bea75 100644
--- a/include/asm-i386/sync_bitops.h
+++ b/include/asm-i386/sync_bitops.h
@@ -130,7 +130,7 @@ static inline int sync_test_and_change_bit(int nr, volatile unsigned long* addr)
        return oldbit;
 }
-static __always_inline int sync_const_test_bit(int nr, const volatile unsigned long *addr)
+static __always_inline int sync_constant_test_bit(int nr, const volatile unsigned long *addr)
 {
        return ((1UL << (nr & 31)) &
                (((const volatile unsigned int *)addr)[nr >> 5])) != 0;
diff --git a/include/asm-mips/atomic.h b/include/asm-mips/atomic.h
index 8578869a8bcf..1ac50b6c47ad 100644
--- a/include/asm-mips/atomic.h
+++ b/include/asm-mips/atomic.h
@@ -79,9 +79,9 @@ static __inline__ void atomic_add(int i, atomic_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                v->counter += i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
 }
@@ -124,9 +124,9 @@ static __inline__ void atomic_sub(int i, atomic_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                v->counter -= i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
 }
@@ -173,11 +173,11 @@ static __inline__ int atomic_add_return(int i, atomic_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                result = v->counter;
                result += i;
                v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
        smp_mb();
@@ -225,11 +225,11 @@ static __inline__ int atomic_sub_return(int i, atomic_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                result = v->counter;
                result -= i;
                v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
        smp_mb();
@@ -293,12 +293,12 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                result = v->counter;
                result -= i;
                if (result >= 0)
                        v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
        smp_mb();
@@ -454,9 +454,9 @@ static __inline__ void atomic64_add(long i, atomic64_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                v->counter += i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
 }
@@ -499,9 +499,9 @@ static __inline__ void atomic64_sub(long i, atomic64_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                v->counter -= i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
 }
@@ -548,11 +548,11 @@ static __inline__ long atomic64_add_return(long i, atomic64_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                result = v->counter;
                result += i;
                v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
        smp_mb();
@@ -600,11 +600,11 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                result = v->counter;
                result -= i;
                v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
        smp_mb();
@@ -668,12 +668,12 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                result = v->counter;
                result -= i;
                if (result >= 0)
                        v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
        smp_mb();
diff --git a/include/asm-mips/bitops.h b/include/asm-mips/bitops.h
index 8959da245cfb..d995413e11fd 100644
--- a/include/asm-mips/bitops.h
+++ b/include/asm-mips/bitops.h
@@ -100,9 +100,9 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                a += nr >> SZLONG_LOG;
                mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                *a |= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
 }
@@ -165,9 +165,9 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                a += nr >> SZLONG_LOG;
                mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                *a &= ~mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
 }
@@ -220,9 +220,9 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
                a += nr >> SZLONG_LOG;
                mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                *a ^= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
        }
 }
@@ -287,10 +287,10 @@ static inline int test_and_set_bit(unsigned long nr,
                a += nr >> SZLONG_LOG;
                mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                retval = (mask & *a) != 0;
                *a |= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
                return retval;
        }
@@ -381,10 +381,10 @@ static inline int test_and_clear_bit(unsigned long nr,
                a += nr >> SZLONG_LOG;
                mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                retval = (mask & *a) != 0;
                *a &= ~mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
                return retval;
        }
@@ -452,10 +452,10 @@ static inline int test_and_change_bit(unsigned long nr,
                a += nr >> SZLONG_LOG;
                mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                retval = (mask & *a) != 0;
                *a ^= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
                return retval;
        }
diff --git a/include/asm-mips/cpu-features.h b/include/asm-mips/cpu-features.h
index eadca266f159..5e4bed123b48 100644
--- a/include/asm-mips/cpu-features.h
+++ b/include/asm-mips/cpu-features.h
@@ -40,6 +40,9 @@
 #endif
 #ifndef cpu_has_fpu
 #define cpu_has_fpu             (current_cpu_data.options & MIPS_CPU_FPU)
+#define raw_cpu_has_fpu         (raw_current_cpu_data.options & MIPS_CPU_FPU)
+#else
+#define raw_cpu_has_fpu         cpu_has_fpu
 #endif
 #ifndef cpu_has_32fpr
 #define cpu_has_32fpr           (cpu_data[0].options & MIPS_CPU_32FPR)
diff --git a/include/asm-mips/cpu-info.h b/include/asm-mips/cpu-info.h
index 610d0cdeaa9e..22fe8453fcc7 100644
--- a/include/asm-mips/cpu-info.h
+++ b/include/asm-mips/cpu-info.h
@@ -87,6 +87,7 @@ struct cpuinfo_mips {
 extern struct cpuinfo_mips cpu_data[];
 #define current_cpu_data cpu_data[smp_processor_id()]
+#define raw_current_cpu_data cpu_data[raw_smp_processor_id()]
 extern void cpu_probe(void);
 extern void cpu_report(void);
diff --git a/include/asm-mips/fpu.h b/include/asm-mips/fpu.h
index efef843b93f0..4e12d1f9534f 100644
--- a/include/asm-mips/fpu.h
+++ b/include/asm-mips/fpu.h
@@ -27,11 +27,11 @@
 struct sigcontext;
 struct sigcontext32;
-extern asmlinkage int (*save_fp_context)(struct sigcontext *sc);
+extern asmlinkage int (*save_fp_context)(struct sigcontext __user *sc);
-extern asmlinkage int (*restore_fp_context)(struct sigcontext *sc);
+extern asmlinkage int (*restore_fp_context)(struct sigcontext __user *sc);
-extern asmlinkage int (*save_fp_context32)(struct sigcontext32 *sc);
+extern asmlinkage int (*save_fp_context32)(struct sigcontext32 __user *sc);
-extern asmlinkage int (*restore_fp_context32)(struct sigcontext32 *sc);
+extern asmlinkage int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 extern void fpu_emulator_init_fpu(void);
 extern void _init_fpu(void);
@@ -68,6 +68,8 @@ do {									\
        /* We don't care about the c0 hazard here  */                   \
 } while (0)
+#define __fpu_enabled() (read_c0_status() & ST0_CU1)
 #define enable_fpu()                                                    \
 do {                                                                    \
        if (cpu_has_fpu)                                                \
@@ -93,31 +95,47 @@ static inline int is_fpu_owner(void)
        return cpu_has_fpu && __is_fpu_owner();
 }
-static inline void own_fpu(void)
+static inline void __own_fpu(void)
 {
-        if (cpu_has_fpu) {
+        __enable_fpu();
-                __enable_fpu();
+        KSTK_STATUS(current) |= ST0_CU1;
-                KSTK_STATUS(current) |= ST0_CU1;
+        set_thread_flag(TIF_USEDFPU);
-                set_thread_flag(TIF_USEDFPU);
+}
+static inline void own_fpu(int restore)
+{
+        preempt_disable();
+        if (cpu_has_fpu && !__is_fpu_owner()) {
+                __own_fpu();
+                if (restore)
+                        _restore_fp(current);
        }
+        preempt_enable();
 }
-static inline void lose_fpu(void)
+static inline void lose_fpu(int save)
 {
-        if (cpu_has_fpu) {
+        preempt_disable();
+        if (is_fpu_owner()) {
+                if (save)
+                        _save_fp(current);
                KSTK_STATUS(current) &= ~ST0_CU1;
                clear_thread_flag(TIF_USEDFPU);
                __disable_fpu();
        }
+        preempt_enable();
 }
 static inline void init_fpu(void)
 {
+        preempt_disable();
        if (cpu_has_fpu) {
+                __own_fpu();
                _init_fpu();
        } else {
                fpu_emulator_init_fpu();
        }
+        preempt_enable();
 }
 static inline void save_fp(struct task_struct *tsk)
@@ -144,4 +162,18 @@ static inline fpureg_t *get_fpu_regs(struct task_struct *tsk)
        return tsk->thread.fpu.fpr;
 }
+static inline void enable_fp_in_kernel(void)
+{
+        set_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
+        /* make sure CU1 and FPU ownership are consistent */
+        if (!__is_fpu_owner() && __fpu_enabled())
+                __disable_fpu();
+}
+static inline void disable_fp_in_kernel(void)
+{
+        BUG_ON(!__is_fpu_owner() && __fpu_enabled());
+        clear_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
+}
 #endif /* _ASM_FPU_H */
diff --git a/include/asm-mips/mach-ip27/dma-coherence.h b/include/asm-mips/mach-ip27/dma-coherence.h
index 659816e200d4..3fdbbf68e952 100644
--- a/include/asm-mips/mach-ip27/dma-coherence.h
+++ b/include/asm-mips/mach-ip27/dma-coherence.h
@@ -18,7 +18,8 @@
 struct device;
-static dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+static inline dma_addr_t plat_map_dma_mem(struct device *dev, void *addr,
+        size_t size)
 {
        dma_addr_t pa = dev_to_baddr(dev, virt_to_phys(addr));
@@ -37,7 +38,7 @@ static unsigned long plat_dma_addr_to_phys(dma_addr_t dma_addr)
        return dma_addr & (0xffUL << 56);
 }
-static void plat_unmap_dma_mem(dma_addr_t dma_addr)
+static inline void plat_unmap_dma_mem(dma_addr_t dma_addr)
 {
 }
diff --git a/include/asm-mips/mach-ip32/dma-coherence.h b/include/asm-mips/mach-ip32/dma-coherence.h
index 950be17bbb86..c3f9a6a20eb0 100644
--- a/include/asm-mips/mach-ip32/dma-coherence.h
+++ b/include/asm-mips/mach-ip32/dma-coherence.h
@@ -26,7 +26,8 @@ struct device;
 #define RAM_OFFSET_MASK 0x3fffffffUL
-static dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+static inline dma_addr_t plat_map_dma_mem(struct device *dev, void *addr,
+        size_t size)
 {
        dma_addr_t pa = virt_to_phys(addr) & RAM_OFFSET_MASK;
@@ -59,7 +60,7 @@ static unsigned long plat_dma_addr_to_phys(dma_addr_t dma_addr)
        return addr;
 }
-static void plat_unmap_dma_mem(dma_addr_t dma_addr)
+static inline void plat_unmap_dma_mem(dma_addr_t dma_addr)
 {
 }
diff --git a/include/asm-mips/rtlx.h b/include/asm-mips/rtlx.h
index 59162f74a798..65778c890a62 100644
--- a/include/asm-mips/rtlx.h
+++ b/include/asm-mips/rtlx.h
@@ -23,8 +23,8 @@
 extern int rtlx_open(int index, int can_sleep);
 extern int rtlx_release(int index);
-extern ssize_t rtlx_read(int index, void *buff, size_t count, int user);
+extern ssize_t rtlx_read(int index, void __user *buff, size_t count);
-extern ssize_t rtlx_write(int index, void *buffer, size_t count, int user);
+extern ssize_t rtlx_write(int index, const void __user *buffer, size_t count);
 extern unsigned int rtlx_read_poll(int index, int can_sleep);
 extern unsigned int rtlx_write_poll(int index);
diff --git a/include/asm-mips/system.h b/include/asm-mips/system.h
index 597a3743f6a1..290887077e44 100644
--- a/include/asm-mips/system.h
+++ b/include/asm-mips/system.h
@@ -121,10 +121,10 @@ static inline unsigned long __xchg_u32(volatile int * m, unsigned int val)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                retval = *m;
                *m = val;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
        }
        smp_mb();
@@ -169,10 +169,10 @@ static inline __u64 __xchg_u64(volatile __u64 * m, __u64 val)
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                retval = *m;
                *m = val;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
        }
        smp_mb();
@@ -250,11 +250,11 @@ static inline unsigned long __cmpxchg_u32(volatile int * m, unsigned long old,
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                retval = *m;
                if (retval == old)
                        *m = new;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
        }
        smp_mb();
@@ -304,11 +304,11 @@ static inline unsigned long __cmpxchg_u64(volatile int * m, unsigned long old,
        } else {
                unsigned long flags;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                retval = *m;
                if (retval == old)
                        *m = new;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
        }
        smp_mb();
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index fbcda8204473..6cf05f4a4e7e 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -119,6 +119,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
 #define TIF_FREEZE              19
+#define TIF_ALLOW_FP_IN_KERNEL  20
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
diff --git a/include/asm-sparc64/tsb.h b/include/asm-sparc64/tsb.h
index e82612cd9f33..ab55ffcb7bf4 100644
--- a/include/asm-sparc64/tsb.h
+++ b/include/asm-sparc64/tsb.h
@@ -264,6 +264,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
        be,a,pt         %xcc, OK_LABEL; \
         mov            REG4, REG1;
+#ifndef CONFIG_DEBUG_PAGEALLOC
        /* This version uses a trick, the TAG is already (VADDR >> 22) so
         * we can make use of that for the index computation.
         */
@@ -277,5 +278,6 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
        cmp             REG3, TAG; \
        be,a,pt         %xcc, OK_LABEL; \
         mov            REG4, REG1;
+#endif
 #endif /* !(_SPARC64_TSB_H) */
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index 7011d6255593..f2542c24b328 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -93,6 +93,7 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
 void clear_bdi_congested(struct backing_dev_info *bdi, int rw);
 void set_bdi_congested(struct backing_dev_info *bdi, int rw);
 long congestion_wait(int rw, long timeout);
+long congestion_wait_interruptible(int rw, long timeout);
 void congestion_end(int rw);
 #define bdi_cap_writeback_dirty(bdi) \
diff --git a/include/linux/kbd_kern.h b/include/linux/kbd_kern.h
index 06c58c423fe1..506ad20c18f8 100644
--- a/include/linux/kbd_kern.h
+++ b/include/linux/kbd_kern.h
@@ -75,7 +75,7 @@ extern int do_poke_blanked_console;
 extern void (*kbd_ledfunc)(unsigned int led);
-extern void set_console(int nr);
+extern int set_console(int nr);
 extern void schedule_console_callback(void);
 static inline void set_leds(void)
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index c68c7ac6b232..248305bb9a18 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -57,7 +57,11 @@ typedef union {
 } ktime_t;
 #define KTIME_MAX                       ((s64)~((u64)1 << 63))
-#define KTIME_SEC_MAX                   (KTIME_MAX / NSEC_PER_SEC)
+#if (BITS_PER_LONG == 64)
+# define KTIME_SEC_MAX                  (KTIME_MAX / NSEC_PER_SEC)
+#else
+# define KTIME_SEC_MAX                  LONG_MAX
+#endif
 /*
 * ktime_t definitions when using the 64-bit scalar representation:
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 47aaa2c66738..e9ae0c6e2c62 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -415,6 +415,7 @@ extern void nfs_complete_unlink(struct dentry *);
 /*
 * linux/fs/nfs/write.c
 */
+extern int  nfs_congestion_kb;
 extern int  nfs_writepage(struct page *page, struct writeback_control *wbc);
 extern int  nfs_writepages(struct address_space *, struct writeback_control *);
 extern int  nfs_flush_incompatible(struct file *file, struct page *page);
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 95796e6924f1..c95d5e642548 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -82,6 +82,7 @@ struct nfs_server {
        struct rpc_clnt *       client_acl;     /* ACL RPC client handle */
        struct nfs_iostats *    io_stats;       /* I/O statistics */
        struct backing_dev_info backing_dev_info;
+        atomic_t                writeback;      /* number of writeback pages */
        int                     flags;          /* various flags */
        unsigned int            caps;           /* server capabilities */
        unsigned int            rsize;          /* read size */
diff --git a/include/linux/spi/spi_bitbang.h b/include/linux/spi/spi_bitbang.h
index 2e8c048b9b80..9dbca629dcfb 100644
--- a/include/linux/spi/spi_bitbang.h
+++ b/include/linux/spi/spi_bitbang.h
@@ -25,7 +25,6 @@ struct spi_bitbang {
        spinlock_t              lock;
        struct list_head        queue;
        u8                      busy;
-        u8                      shutdown;
        u8                      use_dma;
        struct spi_master       *master;
diff --git a/include/linux/ufs_fs.h b/include/linux/ufs_fs.h
index dc2e9fe69418..daeba22b7656 100644
--- a/include/linux/ufs_fs.h
+++ b/include/linux/ufs_fs.h
@@ -649,10 +649,10 @@ struct ufs2_inode {
        __fs32     ui_blksize;     /*  12: Inode blocksize. */
        __fs64     ui_size;        /*  16: File byte count. */
        __fs64     ui_blocks;      /*  24: Bytes actually held. */
-        struct ufs_timeval   ui_atime;       /*  32: Last access time. */
+        __fs64   ui_atime;       /*  32: Last access time. */
-        struct ufs_timeval   ui_mtime;       /*  40: Last modified time. */
+        __fs64   ui_mtime;       /*  40: Last modified time. */
-        struct ufs_timeval   ui_ctime;       /*  48: Last inode change time. */
+        __fs64   ui_ctime;       /*  48: Last inode change time. */
-        struct ufs_timeval   ui_birthtime;   /*  56: Inode creation time. */
+        __fs64   ui_birthtime;   /*  56: Inode creation time. */
        __fs32     ui_mtimensec;   /*  64: Last modified time. */
        __fs32     ui_atimensec;   /*  68: Last access time. */
        __fs32     ui_ctimensec;   /*  72: Last inode change time. */
diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
index 37a1a41f5b65..e0db669998f3 100644
--- a/include/linux/vt_kern.h
+++ b/include/linux/vt_kern.h
@@ -83,6 +83,7 @@ void reset_vc(struct vc_data *vc);
 #define CON_BUF_SIZE (CONFIG_BASE_SMALL ? 256 : PAGE_SIZE)
 extern char con_buf[CON_BUF_SIZE];
 extern struct semaphore con_buf_sem;
+extern char vt_dont_switch;
 struct vt_spawn_console {
        spinlock_t lock;
diff --git a/kernel/fork.c b/kernel/fork.c
index d154cc786489..6af959c034d8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -933,8 +933,8 @@ asmlinkage long sys_set_tid_address(int __user *tidptr)
 static inline void rt_mutex_init_task(struct task_struct *p)
 {
-#ifdef CONFIG_RT_MUTEXES
        spin_lock_init(&p->pi_lock);
+#ifdef CONFIG_RT_MUTEXES
        plist_head_init(&p->pi_waiters, &p->pi_lock);
        p->pi_blocked_on = NULL;
 #endif
diff --git a/kernel/futex.c b/kernel/futex.c
index e749e7df14b1..5a270b5e3f95 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -565,6 +565,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
        if (!pi_state)
                return -EINVAL;
+        spin_lock(&pi_state->pi_mutex.wait_lock);
        new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
        /*
@@ -604,6 +605,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
        pi_state->owner = new_owner;
        spin_unlock_irq(&new_owner->pi_lock);
+        spin_unlock(&pi_state->pi_mutex.wait_lock);
        rt_mutex_unlock(&pi_state->pi_mutex);
        return 0;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index ec4cb9f3e3b7..6a7938a0d513 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -135,7 +135,7 @@ EXPORT_SYMBOL_GPL(ktime_get_ts);
 static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
 {
        ktime_t xtim, tomono;
-        struct timespec xts;
+        struct timespec xts, tom;
        unsigned long seq;
        do {
@@ -145,10 +145,11 @@ static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
 #else
                xts = xtime;
 #endif
+                tom = wall_to_monotonic;
        } while (read_seqretry(&xtime_lock, seq));
        xtim = timespec_to_ktime(xts);
-        tomono = timespec_to_ktime(wall_to_monotonic);
+        tomono = timespec_to_ktime(tom);
        base->clock_base[CLOCK_REALTIME].softirq_time = xtim;
        base->clock_base[CLOCK_MONOTONIC].softirq_time =
                ktime_add(xtim, tomono);
@@ -644,6 +645,12 @@ hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
                orun++;
        }
        timer->expires = ktime_add(timer->expires, interval);
+        /*
+         * Make sure, that the result did not wrap with a very large
+         * interval.
+         */
+        if (timer->expires.tv64 < 0)
+                timer->expires = ktime_set(KTIME_SEC_MAX, 0);
        return orun;
 }
diff --git a/kernel/power/console.c b/kernel/power/console.c
index 623786d44159..89bcf4973ee5 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -27,7 +27,15 @@ int pm_prepare_console(void)
                return 1;
        }
-        set_console(SUSPEND_CONSOLE);
+        if (set_console(SUSPEND_CONSOLE)) {
+                /*
+                 * We're unable to switch to the SUSPEND_CONSOLE.
+                 * Let the calling function know so it can decide
+                 * what to do.
+                 */
+                release_console_sem();
+                return 1;
+        }
        release_console_sem();
        if (vt_waitactive(SUSPEND_CONSOLE)) {
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index 406b20adb27a..873cdf8ea5a4 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -58,6 +58,7 @@ static inline int platform_prepare(void)
 static void power_down(suspend_disk_method_t mode)
 {
+        disable_nonboot_cpus();
        switch(mode) {
        case PM_DISK_PLATFORM:
                if (pm_ops && pm_ops->enter) {
@@ -251,6 +252,7 @@ static int software_resume(void)
        error = swsusp_read();
        if (error) {
                swsusp_free();
+                platform_finish();
                goto Thaw;
        }
diff --git a/kernel/power/user.c b/kernel/power/user.c
index dd09efe7df54..d6a8dcc26ae5 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -398,9 +398,10 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                case PMOPS_ENTER:
                        if (data->platform_suspend) {
+                                disable_nonboot_cpus();
                                kernel_shutdown_prepare(SYSTEM_SUSPEND_DISK);
                                error = pm_ops->enter(PM_SUSPEND_DISK);
-                                error = 0;
+                                enable_nonboot_cpus();
                        }
                        break;
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 5567745470f7..eadfce2fff74 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -307,12 +307,19 @@ int tick_resume_broadcast(void)
        spin_lock_irqsave(&tick_broadcast_lock, flags);
        bc = tick_broadcast_device.evtdev;
-        if (bc) {
-                if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC &&
-                    !cpus_empty(tick_broadcast_mask))
-                        tick_broadcast_start_periodic(bc);
-                broadcast = cpu_isset(smp_processor_id(), tick_broadcast_mask);
+        if (bc) {
+                switch (tick_broadcast_device.mode) {
+                case TICKDEV_MODE_PERIODIC:
+                        if(!cpus_empty(tick_broadcast_mask))
+                                tick_broadcast_start_periodic(bc);
+                        broadcast = cpu_isset(smp_processor_id(),
+                                              tick_broadcast_mask);
+                        break;
+                case TICKDEV_MODE_ONESHOT:
+                        broadcast = tick_resume_broadcast_oneshot(bc);
+                        break;
+                }
        }
        spin_unlock_irqrestore(&tick_broadcast_lock, flags);
@@ -347,6 +354,16 @@ static int tick_broadcast_set_event(ktime_t expires, int force)
        }
 }
+int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
+{
+        clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+        if(!cpus_empty(tick_broadcast_oneshot_mask))
+                tick_broadcast_set_event(ktime_get(), 1);
+        return cpu_isset(smp_processor_id(), tick_broadcast_oneshot_mask);
+}
 /*
 * Reprogram the broadcast device:
 *
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 43ba1bdec14c..bfda3f7f0716 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -298,18 +298,17 @@ static void tick_shutdown(unsigned int *cpup)
        spin_unlock_irqrestore(&tick_device_lock, flags);
 }
-static void tick_suspend_periodic(void)
+static void tick_suspend(void)
 {
        struct tick_device *td = &__get_cpu_var(tick_cpu_device);
        unsigned long flags;
        spin_lock_irqsave(&tick_device_lock, flags);
-        if (td->mode == TICKDEV_MODE_PERIODIC)
+        clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_SHUTDOWN);
-                clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_SHUTDOWN);
        spin_unlock_irqrestore(&tick_device_lock, flags);
 }
-static void tick_resume_periodic(void)
+static void tick_resume(void)
 {
        struct tick_device *td = &__get_cpu_var(tick_cpu_device);
        unsigned long flags;
@@ -317,6 +316,8 @@ static void tick_resume_periodic(void)
        spin_lock_irqsave(&tick_device_lock, flags);
        if (td->mode == TICKDEV_MODE_PERIODIC)
                tick_setup_periodic(td->evtdev, 0);
+        else
+                tick_resume_oneshot();
        spin_unlock_irqrestore(&tick_device_lock, flags);
 }
@@ -348,13 +349,13 @@ static int tick_notify(struct notifier_block *nb, unsigned long reason,
                break;
        case CLOCK_EVT_NOTIFY_SUSPEND:
-                tick_suspend_periodic();
+                tick_suspend();
                tick_suspend_broadcast();
                break;
        case CLOCK_EVT_NOTIFY_RESUME:
                if (!tick_resume_broadcast())
-                        tick_resume_periodic();
+                        tick_resume();
                break;
        default:
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 75890efd24ff..c9d203bde518 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -19,12 +19,13 @@ extern void tick_setup_oneshot(struct clock_event_device *newdev,
 extern int tick_program_event(ktime_t expires, int force);
 extern void tick_oneshot_notify(void);
 extern int tick_switch_to_oneshot(void (*handler)(struct clock_event_device *));
+extern void tick_resume_oneshot(void);
 # ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
 extern void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
 extern void tick_broadcast_oneshot_control(unsigned long reason);
 extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
+extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
 # else /* BROADCAST */
 static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
@@ -43,6 +44,10 @@ void tick_setup_oneshot(struct clock_event_device *newdev,
 {
        BUG();
 }
+static inline void tick_resume_oneshot(void)
+{
+        BUG();
+}
 static inline int tick_program_event(ktime_t expires, int force)
 {
        return 0;
@@ -54,6 +59,10 @@ static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 }
 static inline void tick_broadcast_oneshot_control(unsigned long reason) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
+static inline int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
+{
+        return 0;
+}
 #endif /* !TICK_ONESHOT */
 /*
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index 2e8b7ff863cc..f6997ab0c3c9 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -41,6 +41,18 @@ int tick_program_event(ktime_t expires, int force)
 }
 /**
+ * tick_resume_onshot - resume oneshot mode
+ */
+void tick_resume_oneshot(void)
+{
+        struct tick_device *td = &__get_cpu_var(tick_cpu_device);
+        struct clock_event_device *dev = td->evtdev;
+        clockevents_set_mode(dev, CLOCK_EVT_MODE_ONESHOT);
+        tick_program_event(ktime_get(), 1);
+}
+/**
 * tick_setup_oneshot - setup the event device for oneshot mode (hres or nohz)
 */
 void tick_setup_oneshot(struct clock_event_device *newdev,
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index f50a2811f9dc..e5de3781d3fe 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -55,6 +55,22 @@ long congestion_wait(int rw, long timeout)
 }
 EXPORT_SYMBOL(congestion_wait);
+long congestion_wait_interruptible(int rw, long timeout)
+{
+        long ret;
+        DEFINE_WAIT(wait);
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+        prepare_to_wait(wqh, &wait, TASK_INTERRUPTIBLE);
+        if (signal_pending(current))
+                ret = -ERESTARTSYS;
+        else
+                ret = io_schedule_timeout(timeout);
+        finish_wait(wqh, &wait);
+        return ret;
+}
+EXPORT_SYMBOL(congestion_wait_interruptible);
 /**
 * congestion_end - wake up sleepers on a congested backing_dev_info
 * @rw: READ or WRITE
diff --git a/mm/filemap.c b/mm/filemap.c
index d1060b8d3cd6..5dfc093ceb3d 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2379,7 +2379,8 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
        struct file *file = iocb->ki_filp;
        struct address_space *mapping = file->f_mapping;
        ssize_t retval;
-        size_t write_len = 0;
+        size_t write_len;
+        pgoff_t end = 0; /* silence gcc */
        /*
         * If it's a write, unmap all mmappings of the file up-front.  This
@@ -2388,23 +2389,46 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
         */
        if (rw == WRITE) {
                write_len = iov_length(iov, nr_segs);
+                end = (offset + write_len - 1) >> PAGE_CACHE_SHIFT;
                if (mapping_mapped(mapping))
                        unmap_mapping_range(mapping, offset, write_len, 0);
        }
        retval = filemap_write_and_wait(mapping);
-        if (retval == 0) {
+        if (retval)
-                retval = mapping->a_ops->direct_IO(rw, iocb, iov,
+                goto out;
-                                                offset, nr_segs);
-                if (rw == WRITE && mapping->nrpages) {
+        /*
-                        pgoff_t end = (offset + write_len - 1)
+         * After a write we want buffered reads to be sure to go to disk to get
-                                                >> PAGE_CACHE_SHIFT;
+         * the new data.  We invalidate clean cached page from the region we're
-                        int err = invalidate_inode_pages2_range(mapping,
+         * about to write.  We do this *before* the write so that we can return
+         * -EIO without clobbering -EIOCBQUEUED from ->direct_IO().
+         */
+        if (rw == WRITE && mapping->nrpages) {
+                retval = invalidate_inode_pages2_range(mapping,
                                        offset >> PAGE_CACHE_SHIFT, end);
-                        if (err)
+                if (retval)
-                                retval = err;
+                        goto out;
-                }
        }
+        retval = mapping->a_ops->direct_IO(rw, iocb, iov, offset, nr_segs);
+        if (retval)
+                goto out;
+        /*
+         * Finally, try again to invalidate clean pages which might have been
+         * faulted in by get_user_pages() if the source of the write was an
+         * mmap()ed region of the file we're writing.  That's a pretty crazy
+         * thing to do, so we don't support it 100%.  If this invalidation
+         * fails and we have -EIOCBQUEUED we ignore the failure.
+         */
+        if (rw == WRITE && mapping->nrpages) {
+                int err = invalidate_inode_pages2_range(mapping,
+                                              offset >> PAGE_CACHE_SHIFT, end);
+                if (err && retval >= 0)
+                        retval = err;
+        }
+out:
        return retval;
 }
diff --git a/mm/madvise.c b/mm/madvise.c
index 4e196155a0c3..77916e9fc52b 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -155,11 +155,14 @@ static long madvise_dontneed(struct vm_area_struct * vma,
 * Other filesystems return -ENOSYS.
 */
 static long madvise_remove(struct vm_area_struct *vma,
+                                struct vm_area_struct **prev,
                                unsigned long start, unsigned long end)
 {
        struct address_space *mapping;
        loff_t offset, endoff;
+        *prev = vma;
        if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
                return -EINVAL;
@@ -199,7 +202,7 @@ madvise_vma(struct vm_area_struct *vma, struct vm_area_struct **prev,
                error = madvise_behavior(vma, prev, start, end, behavior);
                break;
        case MADV_REMOVE:
-                error = madvise_remove(vma, start, end);
+                error = madvise_remove(vma, prev, start, end);
                break;
        case MADV_WILLNEED:
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b278b8d60eee..2f3916986abf 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -320,7 +320,7 @@ static int oom_kill_task(struct task_struct *p)
         * Don't kill the process if any threads are set to OOM_DISABLE
         */
        do_each_thread(g, q) {
-                if (q->mm == mm && p->oomkilladj == OOM_DISABLE)
+                if (q->mm == mm && q->oomkilladj == OOM_DISABLE)
                        return 1;
        } while_each_thread(g, q);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 820761f9eeef..702fa8f08747 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -463,6 +463,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
        memcpy(n->cb, skb->cb, sizeof(skb->cb));
        C(len);
        C(data_len);
+        C(mac_len);
        C(csum);
        C(local_df);
        n->cloned = 1;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 72b3036bbc09..ada9b3db507d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1527,7 +1527,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
        t->revision++;
        t->size--;
-        preempt_disable();
        tp = NODE_PARENT(n);
        tnode_free((struct tnode *) n);
@@ -1537,7 +1536,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
                rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
        } else
                rcu_assign_pointer(t->trie, NULL);
-        preempt_enable();
        return 1;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 74c4d103ebc2..3834b10b5115 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2458,11 +2458,18 @@ void __init tcp_init(void)
                sysctl_max_syn_backlog = 128;
        }
-        /* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
+        /* Set the pressure threshold to be a fraction of global memory that
-        sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
+         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
-        sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+         * memory, with a floor of 128 pages.
+         */
+        limit = min(nr_all_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        limit = (limit * (nr_all_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = max(limit, 128UL);
+        sysctl_tcp_mem[0] = limit / 4 * 3;
+        sysctl_tcp_mem[1] = limit;
        sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
+        /* Set per-socket limits to no more than 1/128 the pressure threshold */
        limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
        max_share = min(4UL*1024*1024, limit);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f57a9baa6b27..92f99927d12d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
           First: no IPv4 options.
         */
        newinet->opt = NULL;
+        newnp->ipv6_fl_list = NULL;
        /* Clone RX bits */
        newnp->rxopt.all = np->rxopt.all;