48 files changed, 378 insertions, 275 deletions
diff --git a/arch/alpha/include/asm/percpu.h b/arch/alpha/include/asm/percpu.h
index e9e0bb5a23bf..06c5c7a4afd3 100644
--- a/arch/alpha/include/asm/percpu.h
+++ b/arch/alpha/include/asm/percpu.h
@@ -1,7 +1,9 @@
 #ifndef __ALPHA_PERCPU_H
 #define __ALPHA_PERCPU_H
 #include <linux/compiler.h>
 #include <linux/threads.h>
+#include <linux/percpu-defs.h>
 /*
 * Determine the real variable name from the name visible in the
@@ -73,6 +75,28 @@ extern unsigned long __per_cpu_offset[NR_CPUS];
 #endif /* SMP */
-#include <asm-generic/percpu.h>
+#ifdef CONFIG_SMP
+#define PER_CPU_BASE_SECTION ".data.percpu"
+#else
+#define PER_CPU_BASE_SECTION ".data"
+#endif
+#ifdef CONFIG_SMP
+#ifdef MODULE
+#define PER_CPU_SHARED_ALIGNED_SECTION ""
+#else
+#define PER_CPU_SHARED_ALIGNED_SECTION ".shared_aligned"
+#endif
+#define PER_CPU_FIRST_SECTION ".first"
+#else
+#define PER_CPU_SHARED_ALIGNED_SECTION ""
+#define PER_CPU_FIRST_SECTION ""
+#endif
+#define PER_CPU_ATTRIBUTES
 #endif /* __ALPHA_PERCPU_H */
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1821c2078199..1f8510c51d6e 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -411,7 +411,6 @@ static __init int svm_hardware_setup(void)
        iopm_va = page_address(iopm_pages);
        memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
-        clear_bit(0x80, iopm_va); /* allow direct access to PC debug port */
        iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;
        if (boot_cpu_has(X86_FEATURE_NX))
@@ -796,6 +795,11 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
        var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
        var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
+        /* AMD's VMCB does not have an explicit unusable field, so emulate it
+         * for cross vendor migration purposes by "not present"
+         */
+        var->unusable = !var->present || (var->type == 0);
        switch (seg) {
        case VCPU_SREG_CS:
                /*
@@ -827,8 +831,6 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
                        var->type |= 0x1;
                break;
        }
-        var->unusable = !var->present;
 }
 static int svm_get_cpl(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 7c1ce5ac6131..49079a46687b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1121,9 +1121,9 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 static int is_efer_nx(void)
 {
-        u64 efer;
+        unsigned long long efer = 0;
-        rdmsrl(MSR_EFER, efer);
+        rdmsrl_safe(MSR_EFER, &efer);
        return efer & EFER_NX;
 }
@@ -1259,7 +1259,7 @@ static void do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                bit(X86_FEATURE_CMOV) | bit(X86_FEATURE_PSE36) |
                bit(X86_FEATURE_MMX) | bit(X86_FEATURE_FXSR) |
                bit(X86_FEATURE_SYSCALL) |
-                (bit(X86_FEATURE_NX) && is_efer_nx()) |
+                (is_efer_nx() ? bit(X86_FEATURE_NX) : 0) |
 #ifdef CONFIG_X86_64
                bit(X86_FEATURE_LM) |
 #endif
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 92438e9dacc3..5a87384ea4ff 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -804,11 +804,14 @@ dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
        dma_addr_t dma_dest, dma_src;
        dma_cookie_t cookie;
        int cpu;
+        unsigned long flags;
        dma_src = dma_map_single(dev->dev, src, len, DMA_TO_DEVICE);
        dma_dest = dma_map_single(dev->dev, dest, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
+        flags = DMA_CTRL_ACK |
-                                         DMA_CTRL_ACK);
+                DMA_COMPL_SRC_UNMAP_SINGLE |
+                DMA_COMPL_DEST_UNMAP_SINGLE;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
        if (!tx) {
                dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -850,11 +853,12 @@ dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
        dma_addr_t dma_dest, dma_src;
        dma_cookie_t cookie;
        int cpu;
+        unsigned long flags;
        dma_src = dma_map_single(dev->dev, kdata, len, DMA_TO_DEVICE);
        dma_dest = dma_map_page(dev->dev, page, offset, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
+        flags = DMA_CTRL_ACK | DMA_COMPL_SRC_UNMAP_SINGLE;
-                                         DMA_CTRL_ACK);
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
        if (!tx) {
                dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -898,12 +902,13 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
        dma_addr_t dma_dest, dma_src;
        dma_cookie_t cookie;
        int cpu;
+        unsigned long flags;
        dma_src = dma_map_page(dev->dev, src_pg, src_off, len, DMA_TO_DEVICE);
        dma_dest = dma_map_page(dev->dev, dest_pg, dest_off, len,
                                DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
+        flags = DMA_CTRL_ACK;
-                                         DMA_CTRL_ACK);
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
        if (!tx) {
                dma_unmap_page(dev->dev, dma_src, len, DMA_TO_DEVICE);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index a27c0fb1bc11..fb7da5141e96 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -531,9 +531,7 @@ static int __init dmatest_init(void)
                chan = dma_request_channel(mask, filter, NULL);
                if (chan) {
                        err = dmatest_add_channel(chan);
-                        if (err == 0)
+                        if (err) {
-                                continue;
-                        else {
                                dma_release_channel(chan);
                                break; /* add_channel failed, punt */
                        }
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index e4fc33c1c32f..1955ee8d6d20 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -1063,22 +1063,31 @@ static void ioat_dma_cleanup_tasklet(unsigned long data)
 static void
 ioat_dma_unmap(struct ioat_dma_chan *ioat_chan, struct ioat_desc_sw *desc)
 {
-        /*
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-         * yes we are unmapping both _page and _single
+                if (desc->async_tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-         * alloc'd regions with unmap_page. Is this
+                        pci_unmap_single(ioat_chan->device->pdev,
-         * *really* that bad?
+                                         pci_unmap_addr(desc, dst),
-         */
+                                         pci_unmap_len(desc, len),
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP))
+                                         PCI_DMA_FROMDEVICE);
-                pci_unmap_page(ioat_chan->device->pdev,
+                else
-                                pci_unmap_addr(desc, dst),
+                        pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_len(desc, len),
+                                       pci_unmap_addr(desc, dst),
-                                PCI_DMA_FROMDEVICE);
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_FROMDEVICE);
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP))
+        }
-                pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_addr(desc, src),
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                                pci_unmap_len(desc, len),
+                if (desc->async_tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                                PCI_DMA_TODEVICE);
+                        pci_unmap_single(ioat_chan->device->pdev,
+                                         pci_unmap_addr(desc, src),
+                                         pci_unmap_len(desc, len),
+                                         PCI_DMA_TODEVICE);
+                else
+                        pci_unmap_page(ioat_chan->device->pdev,
+                                       pci_unmap_addr(desc, src),
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_TODEVICE);
+        }
 }
 /**
@@ -1363,6 +1372,7 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
        int err = 0;
        struct completion cmp;
        unsigned long tmo;
+        unsigned long flags;
        src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
        if (!src)
@@ -1392,8 +1402,9 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
                                 DMA_TO_DEVICE);
        dma_dest = dma_map_single(dma_chan->device->dev, dest, IOAT_TEST_SIZE,
                                  DMA_FROM_DEVICE);
+        flags = DMA_COMPL_SRC_UNMAP_SINGLE | DMA_COMPL_DEST_UNMAP_SINGLE;
        tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
-                                                   IOAT_TEST_SIZE, 0);
+                                                   IOAT_TEST_SIZE, flags);
        if (!tx) {
                dev_err(&device->pdev->dev,
                        "Self-test prep failed, disabling\n");
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index e202a6ce5573..9a5bc1a7389e 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -1272,7 +1272,8 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
        /* Other interrupts do not interfere with this channel */
        spin_lock(&ichan->lock);
        if (unlikely(chan_id != IDMAC_SDC_0 && chan_id != IDMAC_SDC_1 &&
-                     ((curbuf >> chan_id) & 1) == ichan->active_buffer)) {
+                     ((curbuf >> chan_id) & 1) == ichan->active_buffer &&
+                     !list_is_last(ichan->queue.next, &ichan->queue))) {
                int i = 100;
                /* This doesn't help. See comment in ipu_disable_channel() */
@@ -1547,7 +1548,7 @@ static irqreturn_t ic_sof_irq(int irq, void *dev_id)
        struct idmac_channel *ichan = dev_id;
        printk(KERN_DEBUG "Got SOF IRQ %d on Channel %d\n",
               irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
        return IRQ_HANDLED;
 }
@@ -1556,7 +1557,7 @@ static irqreturn_t ic_eof_irq(int irq, void *dev_id)
        struct idmac_channel *ichan = dev_id;
        printk(KERN_DEBUG "Got EOF IRQ %d on Channel %d\n",
               irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
        return IRQ_HANDLED;
 }
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 3a22eb9be378..17b24c580c09 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -71,6 +71,7 @@ config DRM_I915
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
        select FB
+        select FRAMEBUFFER_CONSOLE if !EMBEDDED
        tristate "i915 driver"
        help
          Choose this option if you have a system that has Intel 830M, 845G,
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index aa1b995dd033..4d5ee2bbc62b 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -113,6 +113,11 @@
 #define USB_VENDOR_ID_BERKSHIRE         0x0c98
 #define USB_DEVICE_ID_BERKSHIRE_PCWD    0x1140
+#define USB_VENDOR_ID_CH                0x068e
+#define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
+#define USB_DEVICE_ID_CH_COMBATSTICK    0x00f4
+#define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE        0x00ff
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 900ce18dd549..ac8049b5f1e9 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -898,7 +898,7 @@ static int usbhid_parse(struct hid_device *hid)
                goto err;
        }
-        hid->quirks = quirks;
+        hid->quirks |= quirks;
        return 0;
 err:
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 4391717d2519..d8f7423f363e 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -50,6 +50,9 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index a48c8aee0218..f1c6ca7e2852 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -467,7 +467,7 @@ config I2C_PXA_SLAVE
 config I2C_S3C2410
        tristate "S3C2410 I2C Driver"
-        depends on ARCH_S3C2410
+        depends on ARCH_S3C2410 || ARCH_S3C64XX
        help
          Say Y here to include support for I2C controller in the
          Samsung S3C2410 based System-on-Chip devices.
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index 3fcf78e906db..b5db8b883615 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -531,16 +531,16 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
        rbdf = cpm->rbase;
        for (i = 0; i < CPM_MAXBD; i++) {
-                cpm->rxbuf[i] = dma_alloc_coherent(
+                cpm->rxbuf[i] = dma_alloc_coherent(&cpm->ofdev->dev,
-                        NULL, CPM_MAX_READ + 1, &cpm->rxdma[i], GFP_KERNEL);
+                                                   CPM_MAX_READ + 1,
+                                                   &cpm->rxdma[i], GFP_KERNEL);
                if (!cpm->rxbuf[i]) {
                        ret = -ENOMEM;
                        goto out_muram;
                }
                out_be32(&rbdf[i].cbd_bufaddr, ((cpm->rxdma[i] + 1) & ~1));
-                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(
+                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
-                        NULL, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
                if (!cpm->txbuf[i]) {
                        ret = -ENOMEM;
                        goto out_muram;
@@ -585,10 +585,10 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
 out_muram:
        for (i = 0; i < CPM_MAXBD; i++) {
                if (cpm->rxbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                cpm->rxbuf[i], cpm->rxdma[i]);
                if (cpm->txbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                cpm->txbuf[i], cpm->txdma[i]);
        }
        cpm_muram_free(cpm->dp_addr);
@@ -619,9 +619,9 @@ static void cpm_i2c_shutdown(struct cpm_i2c *cpm)
        /* Free all memory */
        for (i = 0; i < CPM_MAXBD; i++) {
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                        cpm->rxbuf[i], cpm->rxdma[i]);
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                        cpm->txbuf[i], cpm->txdma[i]);
        }
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 4af5c09f0e8f..dd778d7ae047 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -164,7 +164,7 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
        return 0;
 }
-#ifdef CONFIG_PPC_52xx
+#ifdef CONFIG_PPC_MPC52xx
 static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
        {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
        {28, 0x24}, {30, 0x01}, {32, 0x25}, {34, 0x02},
@@ -188,7 +188,7 @@ static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
 int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
 {
-        const struct mpc52xx_i2c_divider *div = NULL;
+        const struct mpc_i2c_divider *div = NULL;
        unsigned int pvr = mfspr(SPRN_PVR);
        u32 divider;
        int i;
@@ -203,7 +203,7 @@ int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
         * We want to choose an FDR/DFSR that generates an I2C bus speed that
         * is equal to or lower than the requested speed.
         */
-        for (i = 0; i < ARRAY_SIZE(mpc52xx_i2c_dividers); i++) {
+        for (i = 0; i < ARRAY_SIZE(mpc_i2c_dividers_52xx); i++) {
                div = &mpc_i2c_dividers_52xx[i];
                /* Old MPC5200 rev A CPUs do not support the high bits */
                if (div->fdr & 0xc0 && pvr == 0x80822011)
@@ -219,20 +219,23 @@ static void mpc_i2c_setclock_52xx(struct device_node *node,
                                  struct mpc_i2c *i2c,
                                  u32 clock, u32 prescaler)
 {
-        int fdr = mpc52xx_i2c_get_fdr(node, clock, prescaler);
+        int ret, fdr;
+        ret = mpc_i2c_get_fdr_52xx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x3f; /* backward compatibility */
-        if (fdr < 0)
-                fdr = 0x3f; /* backward compatibility */
        writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
-        dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
 }
-#else /* !CONFIG_PPC_52xx */
+#else /* !CONFIG_PPC_MPC52xx */
 static void mpc_i2c_setclock_52xx(struct device_node *node,
                                  struct mpc_i2c *i2c,
                                  u32 clock, u32 prescaler)
 {
 }
-#endif /* CONFIG_PPC_52xx*/
+#endif /* CONFIG_PPC_MPC52xx*/
 #ifdef CONFIG_FSL_SOC
 static const struct mpc_i2c_divider mpc_i2c_dividers_8xxx[] = {
@@ -321,14 +324,17 @@ static void mpc_i2c_setclock_8xxx(struct device_node *node,
                                  struct mpc_i2c *i2c,
                                  u32 clock, u32 prescaler)
 {
-        int fdr = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        int ret, fdr;
+        ret = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x1031; /* backward compatibility */
-        if (fdr < 0)
-                fdr = 0x1031; /* backward compatibility */
        writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
        writeb((fdr >> 8) & 0xff, i2c->base + MPC_I2C_DFSRR);
-        dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
-                 clock, fdr >> 8, fdr & 0xff);
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
+                         clock, fdr >> 8, fdr & 0xff);
 }
 #else /* !CONFIG_FSL_SOC */
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index c1405c8f6ba5..acc7143d9655 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -265,10 +265,10 @@ static int i2c_pxa_wait_bus_not_busy(struct pxa_i2c *i2c)
                show_state(i2c);
        }
-        if (timeout <= 0)
+        if (timeout < 0)
                show_state(i2c);
-        return timeout <= 0 ? I2C_RETRY : 0;
+        return timeout < 0 ? I2C_RETRY : 0;
 }
 static int i2c_pxa_wait_master(struct pxa_i2c *i2c)
@@ -612,7 +612,7 @@ static int i2c_pxa_pio_set_master(struct pxa_i2c *i2c)
                show_state(i2c);
        }
-        if (timeout <= 0) {
+        if (timeout < 0) {
                show_state(i2c);
                dev_err(&i2c->adap.dev,
                        "i2c_pxa: timeout waiting for bus free\n");
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 8d71086f5a1c..62f9cf2f94ec 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -410,6 +410,7 @@ int cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
        ptr = wq->sq_rptr + count;
        sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
        while (ptr != wq->sq_wptr) {
+                sqp->signaled = 0;
                insert_sq_cqe(wq, cq, sqp);
                ptr++;
                sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 9974e886b8de..8a7dd6795fa0 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -86,6 +86,7 @@ struct mlx4_ib_mr {
 struct mlx4_ib_fast_reg_page_list {
        struct ib_fast_reg_page_list    ibfrpl;
+        __be64                         *mapped_page_list;
        dma_addr_t                      map;
 };
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 8e4d26d56a95..8f3666b20ea4 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -231,7 +231,11 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
        if (!mfrpl)
                return ERR_PTR(-ENOMEM);
-        mfrpl->ibfrpl.page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
+        mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
+        if (!mfrpl->ibfrpl.page_list)
+                goto err_free;
+        mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
                                                     size, &mfrpl->map,
                                                     GFP_KERNEL);
        if (!mfrpl->ibfrpl.page_list)
@@ -242,6 +246,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
        return &mfrpl->ibfrpl;
 err_free:
+        kfree(mfrpl->ibfrpl.page_list);
        kfree(mfrpl);
        return ERR_PTR(-ENOMEM);
 }
@@ -252,8 +257,9 @@ void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
        struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
        int size = page_list->max_page_list_len * sizeof (u64);
-        dma_free_coherent(&dev->dev->pdev->dev, size, page_list->page_list,
+        dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
                          mfrpl->map);
+        kfree(mfrpl->ibfrpl.page_list);
        kfree(mfrpl);
 }
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index f385a24d31d2..20724aee76f4 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1365,7 +1365,7 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
        int i;
        for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
-                wr->wr.fast_reg.page_list->page_list[i] =
+                mfrpl->mapped_page_list[i] =
                        cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
                                    MLX4_MTT_FLAG_PRESENT);
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index bc4e40f3ede7..2d1415e16834 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -226,7 +226,7 @@ static int get_compatible_type(struct ff_device *ff, int effect_type)
 */
 static void ml_combine_effects(struct ff_effect *effect,
                               struct ml_effect_state *state,
-                               int gain)
+                               unsigned int gain)
 {
        struct ff_effect *new = state->effect;
        unsigned int strong, weak, i;
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 4224f0112849..012a5e753991 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -843,7 +843,13 @@ static const struct input_device_id joydev_blacklist[] = {
                                INPUT_DEVICE_ID_MATCH_KEYBIT,
                .evbit = { BIT_MASK(EV_KEY) },
                .keybit = { [BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH) },
-        },      /* Avoid itouchpads, touchscreens and tablets */
+        },      /* Avoid itouchpads and touchscreens */
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_DIGI) },
+        },      /* Avoid tablets, digitisers and similar devices */
        { }     /* Terminating entry */
 };
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 444dec07e5d8..df3f8aa68115 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -895,6 +895,13 @@ static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
 };
 /*
+ * Amilo Xi 3650 key release for light touch bar not working
+ */
+static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
+        0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U
+};
+/*
 * atkbd_set_keycode_table() initializes keyboard's keycode table
 * according to the selected scancode set
 */
@@ -1560,6 +1567,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                .callback = atkbd_setup_forced_release,
                .driver_data = atkbd_amilo_pa1510_forced_release_keys,
        },
+        {
+                .ident = "Fujitsu Amilo Xi 3650",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_amilo_xi3650_forced_release_keys,
+        },
        { }
 };
diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c
index 536668fbda22..948e167557f1 100644
--- a/drivers/input/touchscreen/tsc2007.c
+++ b/drivers/input/touchscreen/tsc2007.c
@@ -200,8 +200,9 @@ static int tsc2007_read_values(struct tsc2007 *tsc)
 static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
 {
        struct tsc2007 *ts = container_of(handle, struct tsc2007, timer);
+        unsigned long flags;
-        spin_lock_irq(&ts->lock);
+        spin_lock_irqsave(&ts->lock, flags);
        if (unlikely(!ts->get_pendown_state() && ts->pendown)) {
                struct input_dev *input = ts->input;
@@ -222,7 +223,7 @@ static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
                tsc2007_send_event(ts);
        }
-        spin_unlock_irq(&ts->lock);
+        spin_unlock_irqrestore(&ts->lock, flags);
        return HRTIMER_NORESTART;
 }
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 7942c4d3cd88..9ee873e872b3 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -951,7 +951,6 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
        if (err) {
                mlx4_err(mdev, "Failed to allocate qp #%d\n", qpn);
                goto out;
-                return err;
        }
        qp->event = mlx4_en_sqp_event;
diff --git a/drivers/rtc/rtc-twl4030.c b/drivers/rtc/rtc-twl4030.c
index a6341e4f9a0f..9c8c70c497dc 100644
--- a/drivers/rtc/rtc-twl4030.c
+++ b/drivers/rtc/rtc-twl4030.c
@@ -495,9 +495,7 @@ static int twl4030_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 {
        irqstat = rtc_irq_bits;
-        /* REVISIT alarm may need to wake us from sleep */
+        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M);
-        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M |
-                         BIT_RTC_INTERRUPTS_REG_IT_ALARM_M);
        return 0;
 }
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 885194a07418..3f3c08c6ba4e 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1373,6 +1373,9 @@ static void cleanup(struct spi_device *spi)
 {
        struct chip_data *chip = spi_get_ctldata(spi);
+        if (!chip)
+                return;
        if (gpio_is_valid(chip->gpio_cs))
                gpio_free(chip->gpio_cs);
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 7826bdce4bbe..0048f1185a60 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1128,13 +1128,6 @@ config FB_INTEL
          830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
          Say Y if you have and plan to use such a board.
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-          If you say M here then "I2C support" and "I2C bit-banging support"
-          can be build either as modules or built-in.
          To compile this driver as a module, choose M here: the
          module will be called intelfb.
@@ -1207,11 +1200,10 @@ config FB_MATROX_G
          pixel and 32 bpp packed pixel. You can also use font widths
          different from 8.
-          If you need support for G400 secondary head, you must first say Y to
+          If you need support for G400 secondary head, you must say Y to
-          "I2C support" in the character devices section, and then to
+          "Matrox I2C support" and "G400 second head support" right below.
-          "Matrox I2C support" and "G400 second head support" here in the
+          G450/G550 secondary head and digital output are supported without
-          framebuffer section. G450/G550 secondary head and digital output
+          additional modules.
-          are supported without additional modules.
          The driver starts in monitor mode. You must use the matroxset tool 
          (available at <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to 
@@ -1310,13 +1302,6 @@ config FB_RADEON
          a framebuffer device.  There are both PCI and AGP versions.  You
          don't need to choose this to run the Radeon in plain VGA mode.
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-          If you say M here then "I2C support" and "I2C bit-banging support" 
-          can be build either as modules or built-in.
          There is a product page at
          http://apps.ati.com/ATIcompare/
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index e327b84820d2..a0fec298216e 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -2103,7 +2103,7 @@ static void viafb_remove_proc(struct proc_dir_entry *viafb_entry)
 static int __devinit via_pci_probe(void)
 {
-        unsigned int default_xres, default_yres;
+        unsigned long default_xres, default_yres;
        char *tmpc, *tmpm;
        char *tmpc_sec, *tmpm_sec;
        int vmode_index;
@@ -2196,8 +2196,8 @@ static int __devinit via_pci_probe(void)
        viafb_FB_MM = viaparinfo->fbmem_virt;
        tmpm = viafb_mode;
        tmpc = strsep(&tmpm, "x");
-        strict_strtoul(tmpc, 0, (unsigned long *)&default_xres);
+        strict_strtoul(tmpc, 0, &default_xres);
-        strict_strtoul(tmpm, 0, (unsigned long *)&default_yres);
+        strict_strtoul(tmpm, 0, &default_yres);
        vmode_index = viafb_get_mode_index(default_xres, default_yres, 0);
        DEBUG_MSG(KERN_INFO "0->index=%d\n", vmode_index);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index a89f370fadb5..5458e80fc558 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1212,7 +1212,7 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
 SYSCALL_DEFINE1(epoll_create, int, size)
 {
-        if (size < 0)
+        if (size <= 0)
                return -EINVAL;
        return sys_epoll_create1(0);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index d1bc4d33ccbc..91f7c85f1ffd 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -911,6 +911,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
 err_put_root:
        dput(root_dentry);
 err_put_conn:
+        bdi_destroy(&fc->bdi);
        fuse_conn_put(fc);
 err_fput:
        fput(file);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 153d9681192b..c1462d43e721 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -312,16 +312,6 @@ out:
        return retval;
 }
-/*
- * Read a page. Again trivial. If it didn't already exist
- * in the page cache, it is zero-filled.
- */
-static int hugetlbfs_readpage(struct file *file, struct page * page)
-{
-        unlock_page(page);
-        return -EINVAL;
-}
 static int hugetlbfs_write_begin(struct file *file,
                        struct address_space *mapping,
                        loff_t pos, unsigned len, unsigned flags,
@@ -701,7 +691,6 @@ static void hugetlbfs_destroy_inode(struct inode *inode)
 }
 static const struct address_space_operations hugetlbfs_aops = {
-        .readpage       = hugetlbfs_readpage,
        .write_begin    = hugetlbfs_write_begin,
        .write_end      = hugetlbfs_write_end,
        .set_page_dirty = hugetlbfs_set_page_dirty,
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index abf83881f68a..1a54ae14a192 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -104,6 +104,16 @@ static void set_grace_period(void)
        schedule_delayed_work(&grace_period_end, grace_period);
 }
+static void restart_grace(void)
+{
+        if (nlmsvc_ops) {
+                cancel_delayed_work_sync(&grace_period_end);
+                locks_end_grace(&lockd_manager);
+                nlmsvc_invalidate_all();
+                set_grace_period();
+        }
+}
 /*
 * This is the lockd kernel thread
 */
@@ -149,10 +159,7 @@ lockd(void *vrqstp)
                if (signalled()) {
                        flush_signals(current);
-                        if (nlmsvc_ops) {
+                        restart_grace();
-                                nlmsvc_invalidate_all();
-                                set_grace_period();
-                        }
                        continue;
                }
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 5275097a7565..b5348405046b 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -229,7 +229,7 @@ nfsd4_list_rec_dir(struct dentry *dir, recdir_func *f)
                goto out;
        status = vfs_readdir(filp, nfsd4_build_namelist, &names);
        fput(filp);
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
        while (!list_empty(&names)) {
                entry = list_entry(names.next, struct name_list, list);
@@ -264,7 +264,7 @@ nfsd4_unlink_clid_dir(char *name, int namlen)
        dprintk("NFSD: nfsd4_unlink_clid_dir. name %.*s\n", namlen, name);
-        mutex_lock(&rec_dir.dentry->d_inode->i_mutex);
+        mutex_lock_nested(&rec_dir.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
        dentry = lookup_one_len(name, rec_dir.dentry, namlen);
        if (IS_ERR(dentry)) {
                status = PTR_ERR(dentry);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index c65a27b76a9d..3b711f5147a7 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -580,7 +580,6 @@ free_session(struct kref *kref)
                struct nfsd4_cache_entry *e = &ses->se_slots[i].sl_cache_entry;
                nfsd4_release_respages(e->ce_respages, e->ce_resused);
        }
-        kfree(ses->se_slots);
        kfree(ses);
 }
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index b820c311931c..b73549d293be 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2214,6 +2214,15 @@ nfsd4_encode_dirent_fattr(struct nfsd4_readdir *cd,
        dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
        if (IS_ERR(dentry))
                return nfserrno(PTR_ERR(dentry));
+        if (!dentry->d_inode) {
+                /*
+                 * nfsd_buffered_readdir drops the i_mutex between
+                 * readdir and calling this callback, leaving a window
+                 * where this directory entry could have gone away.
+                 */
+                dput(dentry);
+                return nfserr_noent;
+        }
        exp_get(exp);
        /*
@@ -2276,6 +2285,7 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
        struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
        int buflen;
        __be32 *p = cd->buffer;
+        __be32 *cookiep;
        __be32 nfserr = nfserr_toosmall;
        /* In nfsv4, "." and ".." never make it onto the wire.. */
@@ -2292,7 +2302,7 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
                goto fail;
        *p++ = xdr_one;                             /* mark entry present */
-        cd->offset = p;                             /* remember pointer */
+        cookiep = p;
        p = xdr_encode_hyper(p, NFS_OFFSET_MAX);    /* offset of next entry */
        p = xdr_encode_array(p, name, namlen);      /* name length & name */
@@ -2306,6 +2316,8 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
                goto fail;
        case nfserr_dropit:
                goto fail;
+        case nfserr_noent:
+                goto skip_entry;
        default:
                /*
                 * If the client requested the RDATTR_ERROR attribute,
@@ -2324,6 +2336,8 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
        }
        cd->buflen -= (p - cd->buffer);
        cd->buffer = p;
+        cd->offset = cookiep;
+skip_entry:
        cd->common.err = nfs_ok;
        return 0;
 fail:
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 108d281ebca5..50ff3f2cdf24 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -25,6 +25,7 @@
 #include <linux/smp_lock.h>     /* lock_kernel(), unlock_kernel() */
 #include <linux/capability.h>   /* capable() */
 #include <linux/uaccess.h>      /* copy_from_user(), copy_to_user() */
+#include <linux/vmalloc.h>
 #include <linux/nilfs2_fs.h>
 #include "nilfs.h"
 #include "segment.h"
@@ -147,29 +148,12 @@ static ssize_t
 nilfs_ioctl_do_get_cpinfo(struct the_nilfs *nilfs, __u64 *posp, int flags,
                          void *buf, size_t size, size_t nmembs)
 {
-        return nilfs_cpfile_get_cpinfo(nilfs->ns_cpfile, posp, flags, buf,
-                                       nmembs);
-}
-static int nilfs_ioctl_get_cpinfo(struct inode *inode, struct file *filp,
-                                  unsigned int cmd, void __user *argp)
-{
-        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
-        struct nilfs_argv argv;
        int ret;
-        if (copy_from_user(&argv, argp, sizeof(argv)))
-                return -EFAULT;
        down_read(&nilfs->ns_segctor_sem);
-        ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
+        ret = nilfs_cpfile_get_cpinfo(nilfs->ns_cpfile, posp, flags, buf,
-                                    nilfs_ioctl_do_get_cpinfo);
+                                      nmembs);
        up_read(&nilfs->ns_segctor_sem);
-        if (ret < 0)
-                return ret;
-        if (copy_to_user(argp, &argv, sizeof(argv)))
-                ret = -EFAULT;
        return ret;
 }
@@ -195,28 +179,11 @@ static ssize_t
 nilfs_ioctl_do_get_suinfo(struct the_nilfs *nilfs, __u64 *posp, int flags,
                          void *buf, size_t size, size_t nmembs)
 {
-        return nilfs_sufile_get_suinfo(nilfs->ns_sufile, *posp, buf, nmembs);
-}
-static int nilfs_ioctl_get_suinfo(struct inode *inode, struct file *filp,
-                                  unsigned int cmd, void __user *argp)
-{
-        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
-        struct nilfs_argv argv;
        int ret;
-        if (copy_from_user(&argv, argp, sizeof(argv)))
-                return -EFAULT;
        down_read(&nilfs->ns_segctor_sem);
-        ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
+        ret = nilfs_sufile_get_suinfo(nilfs->ns_sufile, *posp, buf, nmembs);
-                                    nilfs_ioctl_do_get_suinfo);
        up_read(&nilfs->ns_segctor_sem);
-        if (ret < 0)
-                return ret;
-        if (copy_to_user(argp, &argv, sizeof(argv)))
-                ret = -EFAULT;
        return ret;
 }
@@ -242,28 +209,11 @@ static ssize_t
 nilfs_ioctl_do_get_vinfo(struct the_nilfs *nilfs, __u64 *posp, int flags,
                         void *buf, size_t size, size_t nmembs)
 {
-        return nilfs_dat_get_vinfo(nilfs_dat_inode(nilfs), buf, nmembs);
-}
-static int nilfs_ioctl_get_vinfo(struct inode *inode, struct file *filp,
-                                 unsigned int cmd, void __user *argp)
-{
-        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
-        struct nilfs_argv argv;
        int ret;
-        if (copy_from_user(&argv, argp, sizeof(argv)))
-                return -EFAULT;
        down_read(&nilfs->ns_segctor_sem);
-        ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
+        ret = nilfs_dat_get_vinfo(nilfs_dat_inode(nilfs), buf, nmembs);
-                                    nilfs_ioctl_do_get_vinfo);
        up_read(&nilfs->ns_segctor_sem);
-        if (ret < 0)
-                return ret;
-        if (copy_to_user(argp, &argv, sizeof(argv)))
-                ret = -EFAULT;
        return ret;
 }
@@ -276,17 +226,21 @@ nilfs_ioctl_do_get_bdescs(struct the_nilfs *nilfs, __u64 *posp, int flags,
        struct nilfs_bdesc *bdescs = buf;
        int ret, i;
+        down_read(&nilfs->ns_segctor_sem);
        for (i = 0; i < nmembs; i++) {
                ret = nilfs_bmap_lookup_at_level(bmap,
                                                 bdescs[i].bd_offset,
                                                 bdescs[i].bd_level + 1,
                                                 &bdescs[i].bd_blocknr);
                if (ret < 0) {
-                        if (ret != -ENOENT)
+                        if (ret != -ENOENT) {
+                                up_read(&nilfs->ns_segctor_sem);
                                return ret;
+                        }
                        bdescs[i].bd_blocknr = 0;
                }
        }
+        up_read(&nilfs->ns_segctor_sem);
        return nmembs;
 }
@@ -300,10 +254,11 @@ static int nilfs_ioctl_get_bdescs(struct inode *inode, struct file *filp,
        if (copy_from_user(&argv, argp, sizeof(argv)))
                return -EFAULT;
-        down_read(&nilfs->ns_segctor_sem);
+        if (argv.v_size != sizeof(struct nilfs_bdesc))
+                return -EINVAL;
        ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
                                    nilfs_ioctl_do_get_bdescs);
-        up_read(&nilfs->ns_segctor_sem);
        if (ret < 0)
                return ret;
@@ -346,10 +301,10 @@ static int nilfs_ioctl_move_inode_block(struct inode *inode,
        return 0;
 }
-static ssize_t
+static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
-nilfs_ioctl_do_move_blocks(struct the_nilfs *nilfs, __u64 *posp, int flags,
+                                   struct nilfs_argv *argv, void *buf)
-                           void *buf, size_t size, size_t nmembs)
 {
+        size_t nmembs = argv->v_nmembs;
        struct inode *inode;
        struct nilfs_vdesc *vdesc;
        struct buffer_head *bh, *n;
@@ -410,19 +365,10 @@ nilfs_ioctl_do_move_blocks(struct the_nilfs *nilfs, __u64 *posp, int flags,
        return ret;
 }
-static inline int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
+static int nilfs_ioctl_delete_checkpoints(struct the_nilfs *nilfs,
-                                          struct nilfs_argv *argv,
+                                          struct nilfs_argv *argv, void *buf)
-                                          int dir)
-{
-        return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
-                                     nilfs_ioctl_do_move_blocks);
-}
-static ssize_t
-nilfs_ioctl_do_delete_checkpoints(struct the_nilfs *nilfs, __u64 *posp,
-                                  int flags, void *buf, size_t size,
-                                  size_t nmembs)
 {
+        size_t nmembs = argv->v_nmembs;
        struct inode *cpfile = nilfs->ns_cpfile;
        struct nilfs_period *periods = buf;
        int ret, i;
@@ -436,36 +382,21 @@ nilfs_ioctl_do_delete_checkpoints(struct the_nilfs *nilfs, __u64 *posp,
        return nmembs;
 }
-static inline int nilfs_ioctl_delete_checkpoints(struct the_nilfs *nilfs,
+static int nilfs_ioctl_free_vblocknrs(struct the_nilfs *nilfs,
-                                                 struct nilfs_argv *argv,
+                                      struct nilfs_argv *argv, void *buf)
-                                                 int dir)
 {
-        return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
+        size_t nmembs = argv->v_nmembs;
-                                     nilfs_ioctl_do_delete_checkpoints);
+        int ret;
-}
-static ssize_t
+        ret = nilfs_dat_freev(nilfs_dat_inode(nilfs), buf, nmembs);
-nilfs_ioctl_do_free_vblocknrs(struct the_nilfs *nilfs, __u64 *posp, int flags,
-                              void *buf, size_t size, size_t nmembs)
-{
-        int ret = nilfs_dat_freev(nilfs_dat_inode(nilfs), buf, nmembs);
        return (ret < 0) ? ret : nmembs;
 }
-static inline int nilfs_ioctl_free_vblocknrs(struct the_nilfs *nilfs,
+static int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
-                                             struct nilfs_argv *argv,
+                                         struct nilfs_argv *argv, void *buf)
-                                             int dir)
-{
-        return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
-                                     nilfs_ioctl_do_free_vblocknrs);
-}
-static ssize_t
-nilfs_ioctl_do_mark_blocks_dirty(struct the_nilfs *nilfs, __u64 *posp,
-                                 int flags, void *buf, size_t size,
-                                 size_t nmembs)
 {
+        size_t nmembs = argv->v_nmembs;
        struct inode *dat = nilfs_dat_inode(nilfs);
        struct nilfs_bmap *bmap = NILFS_I(dat)->i_bmap;
        struct nilfs_bdesc *bdescs = buf;
@@ -504,55 +435,37 @@ nilfs_ioctl_do_mark_blocks_dirty(struct the_nilfs *nilfs, __u64 *posp,
        return nmembs;
 }
-static inline int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
+static int nilfs_ioctl_free_segments(struct the_nilfs *nilfs,
-                                                struct nilfs_argv *argv,
+                                     struct nilfs_argv *argv, void *buf)
-                                                int dir)
 {
-        return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
+        size_t nmembs = argv->v_nmembs;
-                                     nilfs_ioctl_do_mark_blocks_dirty);
+        struct nilfs_sb_info *sbi = nilfs->ns_writer;
-}
-static ssize_t
-nilfs_ioctl_do_free_segments(struct the_nilfs *nilfs, __u64 *posp, int flags,
-                             void *buf, size_t size, size_t nmembs)
-{
-        struct nilfs_sb_info *sbi = nilfs_get_writer(nilfs);
        int ret;
-        if (unlikely(!sbi))
+        if (unlikely(!sbi)) {
+                /* never happens because called for a writable mount */
+                WARN_ON(1);
                return -EROFS;
+        }
        ret = nilfs_segctor_add_segments_to_be_freed(
                NILFS_SC(sbi), buf, nmembs);
-        nilfs_put_writer(nilfs);
        return (ret < 0) ? ret : nmembs;
 }
-static inline int nilfs_ioctl_free_segments(struct the_nilfs *nilfs,
-                                             struct nilfs_argv *argv,
-                                             int dir)
-{
-        return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
-                                     nilfs_ioctl_do_free_segments);
-}
 int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
-                                       void __user *argp)
+                                       struct nilfs_argv *argv, void **kbufs)
 {
-        struct nilfs_argv argv[5];
        const char *msg;
-        int dir, ret;
+        int ret;
-        if (copy_from_user(argv, argp, sizeof(argv)))
-                return -EFAULT;
-        dir = _IOC_WRITE;
+        ret = nilfs_ioctl_move_blocks(nilfs, &argv[0], kbufs[0]);
-        ret = nilfs_ioctl_move_blocks(nilfs, &argv[0], dir);
        if (ret < 0) {
                msg = "cannot read source blocks";
                goto failed;
        }
-        ret = nilfs_ioctl_delete_checkpoints(nilfs, &argv[1], dir);
+        ret = nilfs_ioctl_delete_checkpoints(nilfs, &argv[1], kbufs[1]);
        if (ret < 0) {
                /*
                 * can safely abort because checkpoints can be removed
@@ -561,7 +474,7 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
                msg = "cannot delete checkpoints";
                goto failed;
        }
-        ret = nilfs_ioctl_free_vblocknrs(nilfs, &argv[2], dir);
+        ret = nilfs_ioctl_free_vblocknrs(nilfs, &argv[2], kbufs[2]);
        if (ret < 0) {
                /*
                 * can safely abort because DAT file is updated atomically
@@ -570,7 +483,7 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
                msg = "cannot delete virtual blocks from DAT file";
                goto failed;
        }
-        ret = nilfs_ioctl_mark_blocks_dirty(nilfs, &argv[3], dir);
+        ret = nilfs_ioctl_mark_blocks_dirty(nilfs, &argv[3], kbufs[3]);
        if (ret < 0) {
                /*
                 * can safely abort because the operation is nondestructive.
@@ -578,7 +491,7 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
                msg = "cannot mark copying blocks dirty";
                goto failed;
        }
-        ret = nilfs_ioctl_free_segments(nilfs, &argv[4], dir);
+        ret = nilfs_ioctl_free_segments(nilfs, &argv[4], kbufs[4]);
        if (ret < 0) {
                /*
                 * can safely abort because this operation is atomic.
@@ -598,9 +511,75 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
 static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
                                      unsigned int cmd, void __user *argp)
 {
+        struct nilfs_argv argv[5];
+        const static size_t argsz[5] = {
+                sizeof(struct nilfs_vdesc),
+                sizeof(struct nilfs_period),
+                sizeof(__u64),
+                sizeof(struct nilfs_bdesc),
+                sizeof(__u64),
+        };
+        void __user *base;
+        void *kbufs[5];
+        struct the_nilfs *nilfs;
+        size_t len, nsegs;
+        int n, ret;
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
-        return nilfs_clean_segments(inode->i_sb, argp);
+        if (copy_from_user(argv, argp, sizeof(argv)))
+                return -EFAULT;
+        nsegs = argv[4].v_nmembs;
+        if (argv[4].v_size != argsz[4])
+                return -EINVAL;
+        /*
+         * argv[4] points to segment numbers this ioctl cleans.  We
+         * use kmalloc() for its buffer because memory used for the
+         * segment numbers is enough small.
+         */
+        kbufs[4] = memdup_user((void __user *)(unsigned long)argv[4].v_base,
+                               nsegs * sizeof(__u64));
+        if (IS_ERR(kbufs[4]))
+                return PTR_ERR(kbufs[4]);
+        nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+        for (n = 0; n < 4; n++) {
+                ret = -EINVAL;
+                if (argv[n].v_size != argsz[n])
+                        goto out_free;
+                if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
+                        goto out_free;
+                len = argv[n].v_size * argv[n].v_nmembs;
+                base = (void __user *)(unsigned long)argv[n].v_base;
+                if (len == 0) {
+                        kbufs[n] = NULL;
+                        continue;
+                }
+                kbufs[n] = vmalloc(len);
+                if (!kbufs[n]) {
+                        ret = -ENOMEM;
+                        goto out_free;
+                }
+                if (copy_from_user(kbufs[n], base, len)) {
+                        ret = -EFAULT;
+                        vfree(kbufs[n]);
+                        goto out_free;
+                }
+        }
+        ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
+ out_free:
+        while (--n > 0)
+                vfree(kbufs[n]);
+        kfree(kbufs[4]);
+        return ret;
 }
 static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
@@ -621,6 +600,33 @@ static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
        return 0;
 }
+static int nilfs_ioctl_get_info(struct inode *inode, struct file *filp,
+                                unsigned int cmd, void __user *argp,
+                                size_t membsz,
+                                ssize_t (*dofunc)(struct the_nilfs *,
+                                                  __u64 *, int,
+                                                  void *, size_t, size_t))
+{
+        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+        struct nilfs_argv argv;
+        int ret;
+        if (copy_from_user(&argv, argp, sizeof(argv)))
+                return -EFAULT;
+        if (argv.v_size != membsz)
+                return -EINVAL;
+        ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd), dofunc);
+        if (ret < 0)
+                return ret;
+        if (copy_to_user(argp, &argv, sizeof(argv)))
+                ret = -EFAULT;
+        return ret;
+}
 long nilfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
        struct inode *inode = filp->f_dentry->d_inode;
@@ -632,16 +638,21 @@ long nilfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        case NILFS_IOCTL_DELETE_CHECKPOINT:
                return nilfs_ioctl_delete_checkpoint(inode, filp, cmd, argp);
        case NILFS_IOCTL_GET_CPINFO:
-                return nilfs_ioctl_get_cpinfo(inode, filp, cmd, argp);
+                return nilfs_ioctl_get_info(inode, filp, cmd, argp,
+                                            sizeof(struct nilfs_cpinfo),
+                                            nilfs_ioctl_do_get_cpinfo);
        case NILFS_IOCTL_GET_CPSTAT:
                return nilfs_ioctl_get_cpstat(inode, filp, cmd, argp);
        case NILFS_IOCTL_GET_SUINFO:
-                return nilfs_ioctl_get_suinfo(inode, filp, cmd, argp);
+                return nilfs_ioctl_get_info(inode, filp, cmd, argp,
+                                            sizeof(struct nilfs_suinfo),
+                                            nilfs_ioctl_do_get_suinfo);
        case NILFS_IOCTL_GET_SUSTAT:
                return nilfs_ioctl_get_sustat(inode, filp, cmd, argp);
        case NILFS_IOCTL_GET_VINFO:
-                /* XXX: rename to ??? */
+                return nilfs_ioctl_get_info(inode, filp, cmd, argp,
-                return nilfs_ioctl_get_vinfo(inode, filp, cmd, argp);
+                                            sizeof(struct nilfs_vinfo),
+                                            nilfs_ioctl_do_get_vinfo);
        case NILFS_IOCTL_GET_BDESCS:
                return nilfs_ioctl_get_bdescs(inode, filp, cmd, argp);
        case NILFS_IOCTL_CLEAN_SEGMENTS:
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 47dd815433fd..bb78745a0e30 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -77,19 +77,22 @@ static int nilfs_mdt_create_block(struct inode *inode, unsigned long block,
                                                     void *))
 {
        struct the_nilfs *nilfs = NILFS_MDT(inode)->mi_nilfs;
-        struct nilfs_sb_info *writer = NULL;
        struct super_block *sb = inode->i_sb;
        struct nilfs_transaction_info ti;
        struct buffer_head *bh;
        int err;
        if (!sb) {
-                writer = nilfs_get_writer(nilfs);
+                /*
-                if (!writer) {
+                 * Make sure this function is not called from any
+                 * read-only context.
+                 */
+                if (!nilfs->ns_writer) {
+                        WARN_ON(1);
                        err = -EROFS;
                        goto out;
                }
-                sb = writer->s_super;
+                sb = nilfs->ns_writer->s_super;
        }
        nilfs_transaction_begin(sb, &ti, 0);
@@ -127,8 +130,6 @@ static int nilfs_mdt_create_block(struct inode *inode, unsigned long block,
                err = nilfs_transaction_commit(sb);
        else
                nilfs_transaction_abort(sb);
-        if (writer)
-                nilfs_put_writer(nilfs);
 out:
        return err;
 }
@@ -299,7 +300,7 @@ int nilfs_mdt_delete_block(struct inode *inode, unsigned long block)
        int err;
        err = nilfs_bmap_delete(ii->i_bmap, block);
-        if (likely(!err)) {
+        if (!err || err == -ENOENT) {
                nilfs_mdt_mark_dirty(inode);
                nilfs_mdt_forget_block(inode, block);
        }
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 3d0c18a16db1..da6fc0bba2e5 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -236,7 +236,8 @@ extern int nilfs_sync_file(struct file *, struct dentry *, int);
 /* ioctl.c */
 long nilfs_ioctl(struct file *, unsigned int, unsigned long);
-int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *, void __user *);
+int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *, struct nilfs_argv *,
+                                       void **);
 /* inode.c */
 extern struct inode *nilfs_new_inode(struct inode *, int);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 1bfbba9c0e9a..a2692bbc7b50 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -128,7 +128,8 @@ void nilfs_forget_buffer(struct buffer_head *bh)
        lock_buffer(bh);
        clear_buffer_nilfs_volatile(bh);
-        if (test_clear_buffer_dirty(bh) && nilfs_page_buffers_clean(page))
+        clear_buffer_dirty(bh);
+        if (nilfs_page_buffers_clean(page))
                __nilfs_clear_page_dirty(page);
        clear_buffer_uptodate(bh);
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index 4fc081e47d70..57afa9d24061 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -407,6 +407,7 @@ void nilfs_dispose_segment_list(struct list_head *head)
 }
 static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
+                                              struct nilfs_sb_info *sbi,
                                              struct nilfs_recovery_info *ri)
 {
        struct list_head *head = &ri->ri_used_segments;
@@ -421,6 +422,7 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
        segnum[2] = ri->ri_segnum;
        segnum[3] = ri->ri_nextnum;
+        nilfs_attach_writer(nilfs, sbi);
        /*
         * Releasing the next segment of the latest super root.
         * The next segment is invalidated by this recovery.
@@ -459,10 +461,10 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
        nilfs->ns_pseg_offset = 0;
        nilfs->ns_seg_seq = ri->ri_seq + 2;
        nilfs->ns_nextnum = nilfs->ns_segnum = segnum[0];
-        return 0;
 failed:
        /* No need to recover sufile because it will be destroyed on error */
+        nilfs_detach_writer(nilfs, sbi);
        return err;
 }
@@ -728,7 +730,7 @@ int nilfs_recover_logical_segments(struct the_nilfs *nilfs,
                goto failed;
        if (ri->ri_need_recovery == NILFS_RECOVERY_ROLLFORWARD_DONE) {
-                err = nilfs_prepare_segment_for_recovery(nilfs, ri);
+                err = nilfs_prepare_segment_for_recovery(nilfs, sbi, ri);
                if (unlikely(err)) {
                        printk(KERN_ERR "NILFS: Error preparing segments for "
                               "recovery.\n");
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index fb70ec3be20e..22c7f65c2403 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2589,7 +2589,8 @@ nilfs_remove_written_gcinodes(struct the_nilfs *nilfs, struct list_head *head)
        }
 }
-int nilfs_clean_segments(struct super_block *sb, void __user *argp)
+int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
+                         void **kbufs)
 {
        struct nilfs_sb_info *sbi = NILFS_SB(sb);
        struct nilfs_sc_info *sci = NILFS_SC(sbi);
@@ -2606,7 +2607,7 @@ int nilfs_clean_segments(struct super_block *sb, void __user *argp)
        err = nilfs_init_gcdat_inode(nilfs);
        if (unlikely(err))
                goto out_unlock;
-        err = nilfs_ioctl_prepare_clean_segments(nilfs, argp);
+        err = nilfs_ioctl_prepare_clean_segments(nilfs, argv, kbufs);
        if (unlikely(err))
                goto out_unlock;
diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
index a98fc1ed0bbb..476bdd5df5be 100644
--- a/fs/nilfs2/segment.h
+++ b/fs/nilfs2/segment.h
@@ -222,7 +222,8 @@ extern int nilfs_construct_segment(struct super_block *);
 extern int nilfs_construct_dsync_segment(struct super_block *, struct inode *,
                                         loff_t, loff_t);
 extern void nilfs_flush_segment(struct super_block *, ino_t);
-extern int nilfs_clean_segments(struct super_block *, void __user *);
+extern int nilfs_clean_segments(struct super_block *, struct nilfs_argv *,
+                                void **);
 extern int nilfs_segctor_add_segments_to_be_freed(struct nilfs_sc_info *,
                                                  __u64 *, size_t);
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 2e2aa3df170c..ffefba81c818 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -78,12 +78,18 @@ enum dma_transaction_type {
 *      dependency chains
 * @DMA_COMPL_SKIP_SRC_UNMAP - set to disable dma-unmapping the source buffer(s)
 * @DMA_COMPL_SKIP_DEST_UNMAP - set to disable dma-unmapping the destination(s)
+ * @DMA_COMPL_SRC_UNMAP_SINGLE - set to do the source dma-unmapping as single
+ *      (if not set, do the source dma-unmapping as page)
+ * @DMA_COMPL_DEST_UNMAP_SINGLE - set to do the destination dma-unmapping as single
+ *      (if not set, do the destination dma-unmapping as page)
 */
 enum dma_ctrl_flags {
        DMA_PREP_INTERRUPT = (1 << 0),
        DMA_CTRL_ACK = (1 << 1),
        DMA_COMPL_SKIP_SRC_UNMAP = (1 << 2),
        DMA_COMPL_SKIP_DEST_UNMAP = (1 << 3),
+        DMA_COMPL_SRC_UNMAP_SINGLE = (1 << 4),
+        DMA_COMPL_DEST_UNMAP_SINGLE = (1 << 5),
 };
 /**
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 40617c1d8976..30520844b8da 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -433,6 +433,7 @@ asmlinkage long sys_fcntl(unsigned int fd, unsigned int cmd, unsigned long arg);
 asmlinkage long sys_fcntl64(unsigned int fd,
                                unsigned int cmd, unsigned long arg);
 #endif
+asmlinkage long sys_pipe2(int __user *fildes, int flags);
 asmlinkage long sys_dup(unsigned int fildes);
 asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd);
 asmlinkage long sys_dup3(unsigned int oldfd, unsigned int newfd, int flags);
diff --git a/mm/madvise.c b/mm/madvise.c
index 36d6ea2b6340..b9ce574827c8 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -112,14 +112,6 @@ static long madvise_willneed(struct vm_area_struct * vma,
        if (!file)
                return -EBADF;
-        /*
-         * Page cache readahead assumes page cache pages are order-0 which
-         * is not the case for hugetlbfs. Do not give a bad return value
-         * but ignore the advice.
-         */
-        if (vma->vm_flags & VM_HUGETLB)
-                return 0;
        if (file->f_mapping->a_ops->get_xip_mem) {
                /* no bad return value, but ignore advice */
                return 0;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 629a28764da9..42a6f9f20285 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -265,7 +265,7 @@ static int fast_reg_read_chunks(struct svcxprt_rdma *xprt,
                frmr->page_list->page_list[page_no] =
                        ib_dma_map_single(xprt->sc_cm_id->device,
                                          page_address(rqstp->rq_arg.pages[page_no]),
-                                          PAGE_SIZE, DMA_TO_DEVICE);
+                                          PAGE_SIZE, DMA_FROM_DEVICE);
                if (ib_dma_mapping_error(xprt->sc_cm_id->device,
                                         frmr->page_list->page_list[page_no]))
                        goto fatal_err;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 6c26a675435a..8b510c5e8777 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -183,6 +183,7 @@ static int fast_reg_xdr(struct svcxprt_rdma *xprt,
 fatal_err:
        printk("svcrdma: Error fast registering memory for xprt %p\n", xprt);
+        vec->frmr = NULL;
        svc_rdma_put_frmr(xprt, frmr);
        return -EIO;
 }
@@ -516,6 +517,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
                       "svcrdma: could not post a receive buffer, err=%d."
                       "Closing transport %p.\n", ret, rdma);
                set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                svc_rdma_put_frmr(rdma, vec->frmr);
                svc_rdma_put_context(ctxt, 0);
                return -ENOTCONN;
        }
@@ -606,6 +608,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
        return 0;
 err:
+        svc_rdma_unmap_dma(ctxt);
        svc_rdma_put_frmr(rdma, vec->frmr);
        svc_rdma_put_context(ctxt, 1);
        return -EIO;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 3d810e7df3fb..4b0c2fa15e0b 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -520,8 +520,9 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
        svc_xprt_get(&xprt->sc_xprt);
        ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
        if (ret) {
-                svc_xprt_put(&xprt->sc_xprt);
+                svc_rdma_unmap_dma(ctxt);
                svc_rdma_put_context(ctxt, 1);
+                svc_xprt_put(&xprt->sc_xprt);
        }
        return ret;