94 files changed, 958 insertions, 807 deletions

diff --git a/.gitignore b/.gitignore
index 869e1a3b64b6..51bd99d6a260 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,6 +49,7 @@ include/linux/compile.h
 include/linux/version.h
 include/linux/utsrelease.h
 include/linux/bounds.h
+include/generated
 
 # stgit generated dirs
 patches-*
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index deeeed0faa8f..f49eecf2e573 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -277,8 +277,7 @@ or bottom half).
   unfreeze_fs: called when VFS is unlocking a filesystem and making it writable
         again.
 
-  statfs: called when the VFS needs to get filesystem statistics. This
-        is called with the kernel lock held
+  statfs: called when the VFS needs to get filesystem statistics.
 
   remount_fs: called when the filesystem is remounted. This is called
         with the kernel lock held
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index d4b05672f9f7..d76cfd8712e1 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -316,6 +316,16 @@ more details, with real examples.
                 #arch/m68k/fpsp040/Makefile
                 ldflags-y := -x
 
+    subdir-ccflags-y, subdir-asflags-y
+        The two flags listed above are similar to ccflags-y and as-falgs-y.
+        The difference is that the subdir- variants has effect for the kbuild
+        file where tey are present and all subdirectories.
+        Options specified using subdir-* are added to the commandline before
+        the options specified using the non-subdir variants.
+
+        Example:
+                subdir-ccflags-y := -Werror
+
     CFLAGS_$@, AFLAGS_$@
 
         CFLAGS_$@ and AFLAGS_$@ only apply to commands in current
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index a19f021f081a..600cdd72900c 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -231,6 +231,35 @@ and is between 256 and 4096 characters. It is defined in the file
                         power state again in power transition.
                         1 : disable the power state check
 
+        acpi_sci=       [HW,ACPI] ACPI System Control Interrupt trigger mode
+                        Format: { level | edge | high | low }
+
+        acpi_serialize  [HW,ACPI] force serialization of AML methods
+
+        acpi_skip_timer_override [HW,ACPI]
+                        Recognize and ignore IRQ0/pin2 Interrupt Override.
+                        For broken nForce2 BIOS resulting in XT-PIC timer.
+
+        acpi_sleep=     [HW,ACPI] Sleep options
+                        Format: { s3_bios, s3_mode, s3_beep, s4_nohwsig,
+                                  old_ordering, s4_nonvs }
+                        See Documentation/power/video.txt for information on
+                        s3_bios and s3_mode.
+                        s3_beep is for debugging; it makes the PC's speaker beep
+                        as soon as the kernel's real-mode entry point is called.
+                        s4_nohwsig prevents ACPI hardware signature from being
+                        used during resume from hibernation.
+                        old_ordering causes the ACPI 1.0 ordering of the _PTS
+                        control method, with respect to putting devices into
+                        low power states, to be enforced (the ACPI 2.0 ordering
+                        of _PTS is used by default).
+                        s4_nonvs prevents the kernel from saving/restoring the
+                        ACPI NVS memory during hibernation.
+
+        acpi_use_timer_override [HW,ACPI]
+                        Use timer override. For some broken Nvidia NF5 boards
+                        that require a timer override, but don't have HPET
+
         acpi_enforce_resources= [ACPI]
                         { strict | lax | no }
                         Check for resource conflicts between native drivers
@@ -250,6 +279,9 @@ and is between 256 and 4096 characters. It is defined in the file
         ad1848=         [HW,OSS]
                         Format: <io>,<irq>,<dma>,<dma2>,<type>
 
+        add_efi_memmap  [EFI; X86] Include EFI memory map in
+                        kernel's map of available physical RAM.
+
         advansys=       [HW,SCSI]
                         See header of drivers/scsi/advansys.c.
 
@@ -1838,6 +1870,12 @@ and is between 256 and 4096 characters. It is defined in the file
                         autoconfiguration.
                         Ranges are in pairs (memory base and size).
 
+        ports=          [IP_VS_FTP] IPVS ftp helper module
+                        Default is 21.
+                        Up to 8 (IP_VS_APP_MAX_PORTS) ports
+                        may be specified.
+                        Format: <port>,<port>....
+
         print-fatal-signals=
                         [KNL] debug: print fatal signals
                         print-fatal-signals=1: print segfault info to
diff --git a/Documentation/lguest/.gitignore b/Documentation/lguest/.gitignore
new file mode 100644
index 000000000000..115587fd5f65
--- /dev/null
+++ b/Documentation/lguest/.gitignore
@@ -0,0 +1 @@
+lguest
diff --git a/Documentation/lguest/lguest.txt b/Documentation/lguest/lguest.txt
index 29510dc51510..28c747362f95 100644
--- a/Documentation/lguest/lguest.txt
+++ b/Documentation/lguest/lguest.txt
@@ -3,11 +3,11 @@
  /,    /`      - or, A Young Coder's Illustrated Hypervisor
  \\"--\\    http://lguest.ozlabs.org
 
-Lguest is designed to be a minimal hypervisor for the Linux kernel, for
-Linux developers and users to experiment with virtualization with the
-minimum of complexity.  Nonetheless, it should have sufficient
-features to make it useful for specific tasks, and, of course, you are
-encouraged to fork and enhance it (see drivers/lguest/README).
+Lguest is designed to be a minimal 32-bit x86 hypervisor for the Linux kernel,
+for Linux developers and users to experiment with virtualization with the
+minimum of complexity.  Nonetheless, it should have sufficient features to
+make it useful for specific tasks, and, of course, you are encouraged to fork
+and enhance it (see drivers/lguest/README).
 
 Features:
 
@@ -37,6 +37,7 @@ Running Lguest:
      "Paravirtualized guest support" = Y
         "Lguest guest support" = Y
      "High Memory Support" = off/4GB
+     "PAE (Physical Address Extension) Support" = N
      "Alignment value to which kernel should be aligned" = 0x100000
         (CONFIG_PARAVIRT=y, CONFIG_LGUEST_GUEST=y, CONFIG_HIGHMEM64G=n and
          CONFIG_PHYSICAL_ALIGN=0x100000)
diff --git a/MAINTAINERS b/MAINTAINERS
index 0beac8a7f8f2..6baace38b24d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1287,6 +1287,14 @@ S:	Maintained
 F:      Documentation/video4linux/bttv/
 F:      drivers/media/video/bt8xx/bttv*
 
+CACHEFILES: FS-CACHE BACKEND FOR CACHING ON MOUNTED FILESYSTEMS
+P:      David Howells
+M:      dhowells@redhat.com
+L:      linux-cachefs@redhat.com
+S:      Supported
+F:      Documentation/filesystems/caching/cachefiles.txt
+F:      fs/cachefiles/
+
 CAFE CMOS INTEGRATED CAMERA CONTROLLER DRIVER
 P:      Jonathan Corbet
 M:      corbet@lwn.net
@@ -2325,6 +2333,15 @@ F:	Documentation/power/freezing-of-tasks.txt
 F:      include/linux/freezer.h
 F:      kernel/freezer.c
 
+FS-CACHE: LOCAL CACHING FOR NETWORK FILESYSTEMS
+P:      David Howells
+M:      dhowells@redhat.com
+L:      linux-cachefs@redhat.com
+S:      Supported
+F:      Documentation/filesystems/caching/
+F:      fs/fscache/
+F:      include/linux/fscache*.h
+
 FTRACE
 P:      Steven Rostedt
 M:      rostedt@goodmis.org
@@ -5235,7 +5252,12 @@ M:	perex@perex.cz
 P:      Takashi Iwai
 M:      tiwai@suse.de
 L:      alsa-devel@alsa-project.org (subscribers-only)
+W:      http://www.alsa-project.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6.git
+T:      git git://git.alsa-project.org/alsa-kernel.git
 S:      Maintained
+F:      Documentation/sound/
+F:      include/sound/
 F:      sound/
 
 SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
diff --git a/Makefile b/Makefile
index bfdef56add34..6f4208ff2d10 100644
--- a/Makefile
+++ b/Makefile
@@ -1200,7 +1200,7 @@ CLEAN_FILES +=	vmlinux System.map \
                 .tmp_kallsyms* .tmp_version .tmp_vmlinux* .tmp_System.map
 
 # Directories & files removed with 'make mrproper'
-MRPROPER_DIRS  += include/config include2 usr/include
+MRPROPER_DIRS  += include/config include2 usr/include include/generated
 MRPROPER_FILES += .config .config.old include/asm .version .old_version \
                   include/linux/autoconf.h include/linux/version.h      \
                   include/linux/utsrelease.h                            \
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index e04173c7e621..d59a0cd537f0 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -177,21 +177,12 @@ asmlinkage long sys_oabi_fstatat64(int dfd,
                                    int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
+        int error;
 
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-        error = cp_oldabi_stat64(&stat, statbuf);
-
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_oldabi_stat64(&stat, statbuf);
 }
 
 struct oabi_flock64 {
diff --git a/arch/frv/kernel/setup.c b/arch/frv/kernel/setup.c
index 0669e1382383..55e4fab7c0bc 100644
--- a/arch/frv/kernel/setup.c
+++ b/arch/frv/kernel/setup.c
@@ -46,7 +46,6 @@
 #include <asm/io.h>
 
 #ifdef CONFIG_BLK_DEV_INITRD
-#include <linux/blk.h>
 #include <asm/pgtable.h>
 #endif
 
diff --git a/arch/ia64/include/asm/paravirt_privop.h b/arch/ia64/include/asm/paravirt_privop.h
index 3d2951130b5f..8f6cb11c9fae 100644
--- a/arch/ia64/include/asm/paravirt_privop.h
+++ b/arch/ia64/include/asm/paravirt_privop.h
@@ -445,7 +445,6 @@ paravirt_set_rr0_to_rr4(unsigned long val0, unsigned long val1,
                 register unsigned long ia64_intri_res asm ("r8");       \
                 register unsigned long __reg asm ("r8") = (reg);        \
                                                                         \
-                BUILD_BUG_ON(!__builtin_constant_p(reg));               \
                 asm volatile (paravirt_alt_bundle(__PARAVIRT_BR,        \
                                                   PARAVIRT_TYPE(GETREG) \
                                                   + (reg))              \
@@ -464,7 +463,6 @@ paravirt_set_rr0_to_rr4(unsigned long val0, unsigned long val1,
                 register unsigned long ia64_clobber1 asm ("r8");        \
                 register unsigned long ia64_clobber2 asm ("r9");        \
                                                                         \
-                BUILD_BUG_ON(!__builtin_constant_p(reg));               \
                 asm volatile (paravirt_alt_bundle(__PARAVIRT_BR,        \
                                                   PARAVIRT_TYPE(SETREG) \
                                                   + (reg))              \
diff --git a/arch/ia64/kernel/smp.c b/arch/ia64/kernel/smp.c
index 2ea4199d9c57..5230eaafd83f 100644
--- a/arch/ia64/kernel/smp.c
+++ b/arch/ia64/kernel/smp.c
@@ -225,6 +225,7 @@ smp_send_reschedule (int cpu)
 {
         platform_send_ipi(cpu, IA64_IPI_RESCHEDULE, IA64_IPI_DM_INT, 0);
 }
+EXPORT_SYMBOL_GPL(smp_send_reschedule);
 
 /*
  * Called with preemption disabled.
@@ -300,15 +301,12 @@ smp_flush_tlb_mm (struct mm_struct *mm)
                 return;
         }
 
+        smp_call_function_mask(mm->cpu_vm_mask,
+                (void (*)(void *))local_finish_flush_tlb_mm, mm, 1);
+        local_irq_disable();
+        local_finish_flush_tlb_mm(mm);
+        local_irq_enable();
         preempt_enable();
-        /*
-         * We could optimize this further by using mm->cpu_vm_mask to track which CPUs
-         * have been running in the address space.  It's not clear that this is worth the
-         * trouble though: to avoid races, we have to raise the IPI on the target CPU
-         * anyhow, and once a CPU is interrupted, the cost of local_flush_tlb_all() is
-         * rather trivial.
-         */
-        on_each_cpu((void (*)(void *))local_finish_flush_tlb_mm, mm, 1);
 }
 
 void arch_send_call_function_single_ipi(int cpu)
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index 6cc87d8c8682..002c70d3cb75 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -702,20 +702,12 @@ asmlinkage long sys32_fstatat64(unsigned int dfd, char __user *filename,
                                 struct stat64_emu31 __user* statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_stat64(statbuf, &stat);
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_stat64(statbuf, &stat);
 }
 
 /*
diff --git a/arch/sparc/kernel/sys_sparc32.c b/arch/sparc/kernel/sys_sparc32.c
index e800503879e4..f5000a460c05 100644
--- a/arch/sparc/kernel/sys_sparc32.c
+++ b/arch/sparc/kernel/sys_sparc32.c
@@ -206,21 +206,12 @@ asmlinkage long compat_sys_fstatat64(unsigned int dfd, char __user *filename,
                 struct compat_stat64 __user * statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_compat_stat64(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_compat_stat64(&stat, statbuf);
 }
 
 asmlinkage long compat_sys_sysfs(int option, u32 arg1, u32 arg2)
diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
index efac92fd1efb..085a8c35f149 100644
--- a/arch/x86/ia32/sys_ia32.c
+++ b/arch/x86/ia32/sys_ia32.c
@@ -129,21 +129,12 @@ asmlinkage long sys32_fstatat(unsigned int dfd, char __user *filename,
                               struct stat64 __user *statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
+        int error;
 
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_stat64(statbuf, &stat);
-
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_stat64(statbuf, &stat);
 }
 
 /*
diff --git a/arch/x86/include/asm/lguest_hcall.h b/arch/x86/include/asm/lguest_hcall.h
index 0f4ee7148afe..faae1996487b 100644
--- a/arch/x86/include/asm/lguest_hcall.h
+++ b/arch/x86/include/asm/lguest_hcall.h
@@ -5,7 +5,6 @@
 #define LHCALL_FLUSH_ASYNC      0
 #define LHCALL_LGUEST_INIT      1
 #define LHCALL_SHUTDOWN         2
-#define LHCALL_LOAD_GDT         3
 #define LHCALL_NEW_PGTABLE      4
 #define LHCALL_FLUSH_TLB        5
 #define LHCALL_LOAD_IDT_ENTRY   6
@@ -17,6 +16,7 @@
 #define LHCALL_SET_PMD          15
 #define LHCALL_LOAD_TLS         16
 #define LHCALL_NOTIFY           17
+#define LHCALL_LOAD_GDT_ENTRY   18
 
 #define LGUEST_TRAP_ENTRY 0x1F
 
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index e94a11e42f98..a2085368a3dc 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -273,15 +273,15 @@ static void lguest_load_idt(const struct desc_ptr *desc)
  * controls the entire thing and the Guest asks it to make changes using the
  * LOAD_GDT hypercall.
  *
- * This is the opposite of the IDT code where we have a LOAD_IDT_ENTRY
- * hypercall and use that repeatedly to load a new IDT.  I don't think it
- * really matters, but wouldn't it be nice if they were the same?  Wouldn't
- * it be even better if you were the one to send the patch to fix it?
+ * This is the exactly like the IDT code.
  */
 static void lguest_load_gdt(const struct desc_ptr *desc)
 {
-        BUG_ON((desc->size + 1) / 8 != GDT_ENTRIES);
-        kvm_hypercall2(LHCALL_LOAD_GDT, __pa(desc->address), GDT_ENTRIES);
+        unsigned int i;
+        struct desc_struct *gdt = (void *)desc->address;
+
+        for (i = 0; i < (desc->size+1)/8; i++)
+                kvm_hypercall3(LHCALL_LOAD_GDT_ENTRY, i, gdt[i].a, gdt[i].b);
 }
 
 /* For a single GDT entry which changes, we do the lazy thing: alter our GDT,
@@ -291,7 +291,9 @@ static void lguest_write_gdt_entry(struct desc_struct *dt, int entrynum,
                                    const void *desc, int type)
 {
         native_write_gdt_entry(dt, entrynum, desc, type);
-        kvm_hypercall2(LHCALL_LOAD_GDT, __pa(dt), GDT_ENTRIES);
+        /* Tell Host about this new entry. */
+        kvm_hypercall3(LHCALL_LOAD_GDT_ENTRY, entrynum,
+                       dt[entrynum].a, dt[entrynum].b);
 }
 
 /* OK, I lied.  There are three "thread local storage" GDT entries which change
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 779e4e500df4..d060e6fd7fd5 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -300,9 +300,9 @@ static int acpi_suspend_state_valid(suspend_state_t pm_state)
 static struct platform_suspend_ops acpi_suspend_ops = {
         .valid = acpi_suspend_state_valid,
         .begin = acpi_suspend_begin,
-        .prepare = acpi_pm_prepare,
+        .prepare_late = acpi_pm_prepare,
         .enter = acpi_suspend_enter,
-        .finish = acpi_pm_finish,
+        .wake = acpi_pm_finish,
         .end = acpi_pm_end,
 };
 
@@ -328,9 +328,9 @@ static int acpi_suspend_begin_old(suspend_state_t pm_state)
 static struct platform_suspend_ops acpi_suspend_ops_old = {
         .valid = acpi_suspend_state_valid,
         .begin = acpi_suspend_begin_old,
-        .prepare = acpi_pm_disable_gpes,
+        .prepare_late = acpi_pm_disable_gpes,
         .enter = acpi_suspend_enter,
-        .finish = acpi_pm_finish,
+        .wake = acpi_pm_finish,
         .end = acpi_pm_end,
         .recover = acpi_pm_finish,
 };
diff --git a/drivers/base/core.c b/drivers/base/core.c
index d230ff4b3eec..4aa527b8a913 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -891,7 +891,8 @@ int device_add(struct device *dev)
                 set_dev_node(dev, dev_to_node(parent));
 
         /* first, register with generic layer. */
-        error = kobject_add(&dev->kobj, dev->kobj.parent, "%s", dev_name(dev));
+        /* we require the name to be set before, and pass NULL */
+        error = kobject_add(&dev->kobj, dev->kobj.parent, NULL);
         if (error)
                 goto Error;
 
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 10d6cbd7c05e..2224b762b7fb 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -1226,7 +1226,7 @@ int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *m
         int i, ret = -ENOMEM;
 
         for (i = 0; i < num_pages; i++) {
-                page = alloc_page(GFP_KERNEL | GFP_DMA32);
+                page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
                 /* agp_free_memory() needs gart address */
                 if (page == NULL)
                         goto out;
@@ -1257,7 +1257,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 {
         struct page * page;
 
-        page = alloc_page(GFP_KERNEL | GFP_DMA32);
+        page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
         if (page == NULL)
                 return NULL;
 
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 2c1d133819b5..08151d4de489 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2274,7 +2274,7 @@ rescan_last_byte:
                                     continue; /* nothing to display */
                                 }
                                 /* Glyph not found */
-                                if ((!(vc->vc_utf && !vc->vc_disp_ctrl) && c < 128) && !(c & ~charmask)) {
+                                if ((!(vc->vc_utf && !vc->vc_disp_ctrl) || c < 128) && !(c & ~charmask)) {
                                     /* In legacy mode use the glyph we get by a 1:1 mapping.
                                        This would make absolutely no sense with Unicode in mind,
                                        but do this for ASCII characters since a font may lack
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index d009661781bc..ef878615c49f 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -159,6 +159,9 @@ void drm_master_put(struct drm_master **master)
 int drm_setmaster_ioctl(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
+        if (file_priv->is_master)
+                return 0;
+
         if (file_priv->minor->master && file_priv->minor->master != file_priv->master)
                 return -EINVAL;
 
@@ -169,6 +172,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
             file_priv->minor->master != file_priv->master) {
                 mutex_lock(&dev->struct_mutex);
                 file_priv->minor->master = drm_master_get(file_priv->master);
+                file_priv->is_master = 1;
                 mutex_unlock(&dev->struct_mutex);
         }
 
@@ -178,10 +182,15 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
 int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *file_priv)
 {
-        if (!file_priv->master)
+        if (!file_priv->is_master)
                 return -EINVAL;
+
+        if (!file_priv->minor->master)
+                return -EINVAL;
+
         mutex_lock(&dev->struct_mutex);
         drm_master_put(&file_priv->minor->master);
+        file_priv->is_master = 0;
         mutex_unlock(&dev->struct_mutex);
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index bc0c6849360c..022876ae34f0 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -132,6 +132,7 @@ void drm_sysfs_destroy(void)
  */
 static void drm_sysfs_device_release(struct device *dev)
 {
+        memset(dev, 0, sizeof(struct device));
         return;
 }
 
diff --git a/drivers/gpu/drm/via/via_dma.c b/drivers/gpu/drm/via/via_dma.c
index 7a339dba6a69..bfb92d283260 100644
--- a/drivers/gpu/drm/via/via_dma.c
+++ b/drivers/gpu/drm/via/via_dma.c
@@ -481,11 +481,13 @@ static int via_wait_idle(drm_via_private_t * dev_priv)
 {
         int count = 10000000;
 
-        while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && count--);
+        while (!(VIA_READ(VIA_REG_STATUS) & VIA_VR_QUEUE_BUSY) && --count)
+                ;
 
-        while (count-- && (VIA_READ(VIA_REG_STATUS) &
+        while (count && (VIA_READ(VIA_REG_STATUS) &
                            (VIA_CMD_RGTR_BUSY | VIA_2D_ENG_BUSY |
-                            VIA_3D_ENG_BUSY))) ;
+                            VIA_3D_ENG_BUSY)))
+                --count;
         return count;
 }
 
@@ -705,7 +707,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file *
         switch (d_siz->func) {
         case VIA_CMDBUF_SPACE:
                 while (((tmp_size = via_cmdbuf_space(dev_priv)) < d_siz->size)
-                       && count--) {
+                       && --count) {
                         if (!d_siz->wait) {
                                 break;
                         }
@@ -717,7 +719,7 @@ static int via_cmdbuf_size(struct drm_device *dev, void *data, struct drm_file *
                 break;
         case VIA_CMDBUF_LAG:
                 while (((tmp_size = via_cmdbuf_lag(dev_priv)) > d_siz->size)
-                       && count--) {
+                       && --count) {
                         if (!d_siz->wait) {
                                 break;
                         }
diff --git a/drivers/ide/cs5536.c b/drivers/ide/cs5536.c
index 353a35bbba63..0332a95eefd4 100644
--- a/drivers/ide/cs5536.c
+++ b/drivers/ide/cs5536.c
@@ -236,6 +236,7 @@ static const struct ide_dma_ops cs5536_dma_ops = {
         .dma_test_irq           = ide_dma_test_irq,
         .dma_lost_irq           = ide_dma_lost_irq,
         .dma_timer_expiry       = ide_dma_sff_timer_expiry,
+        .dma_sff_read_status    = ide_dma_sff_read_status,
 };
 
 static const struct ide_port_info cs5536_info = {
diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
index a0eb87f59134..0feb66c720e1 100644
--- a/drivers/ide/hpt366.c
+++ b/drivers/ide/hpt366.c
@@ -3,7 +3,7 @@
  * Portions Copyright (C) 2001          Sun Microsystems, Inc.
  * Portions Copyright (C) 2003          Red Hat Inc
  * Portions Copyright (C) 2007          Bartlomiej Zolnierkiewicz
- * Portions Copyright (C) 2005-2008     MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2009     MontaVista Software, Inc.
  *
  * Thanks to HighPoint Technologies for their assistance, and hardware.
  * Special Thanks to Jon Burchmore in SanDiego for the deep pockets, his
@@ -114,6 +114,8 @@
  *   the register setting lists into the table indexed by the clock selected
  * - set the correct hwif->ultra_mask for each individual chip
  * - add Ultra and MW DMA mode filtering for the HPT37[24] based SATA cards
+ * - stop resetting HPT370's state machine before each DMA transfer as that has
+ *   caused more harm than good
  *      Sergei Shtylyov, <sshtylyov@ru.mvista.com> or <source@mvista.com>
  */
 
@@ -133,7 +135,7 @@
 #define DRV_NAME "hpt366"
 
 /* various tuning parameters */
-#define HPT_RESET_STATE_ENGINE
+#undef  HPT_RESET_STATE_ENGINE
 #undef  HPT_DELAY_INTERRUPT
 
 static const char *quirk_drives[] = {
@@ -808,7 +810,7 @@ static void hpt370_irq_timeout(ide_drive_t *drive)
         /* get DMA command mode */
         dma_cmd = inb(hwif->dma_base + ATA_DMA_CMD);
         /* stop DMA */
-        outb(dma_cmd & ~0x1, hwif->dma_base + ATA_DMA_CMD);
+        outb(dma_cmd & ~ATA_DMA_START, hwif->dma_base + ATA_DMA_CMD);
         hpt370_clear_engine(drive);
 }
 
@@ -825,11 +827,11 @@ static int hpt370_dma_end(ide_drive_t *drive)
         ide_hwif_t *hwif        = drive->hwif;
         u8  dma_stat            = inb(hwif->dma_base + ATA_DMA_STATUS);
 
-        if (dma_stat & 0x01) {
+        if (dma_stat & ATA_DMA_ACTIVE) {
                 /* wait a little */
                 udelay(20);
                 dma_stat = inb(hwif->dma_base + ATA_DMA_STATUS);
-                if (dma_stat & 0x01)
+                if (dma_stat & ATA_DMA_ACTIVE)
                         hpt370_irq_timeout(drive);
         }
         return ide_dma_end(drive);
@@ -851,7 +853,7 @@ static int hpt374_dma_test_irq(ide_drive_t *drive)
 
         dma_stat = inb(hwif->dma_base + ATA_DMA_STATUS);
         /* return 1 if INTR asserted */
-        if (dma_stat & 4)
+        if (dma_stat & ATA_DMA_INTR)
                 return 1;
 
         return 0;
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 2ae02b8d7f8e..35dc38d3b2c5 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -102,11 +102,14 @@ void ide_complete_cmd(ide_drive_t *drive, struct ide_cmd *cmd, u8 stat, u8 err)
                         drive->dev_flags |= IDE_DFLAG_PARKED;
         }
 
-        if (rq && rq->cmd_type == REQ_TYPE_ATA_TASKFILE)
-                memcpy(rq->special, cmd, sizeof(*cmd));
+        if (rq && rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
+                struct ide_cmd *orig_cmd = rq->special;
 
-        if (cmd->tf_flags & IDE_TFLAG_DYN)
-                kfree(cmd);
+                if (cmd->tf_flags & IDE_TFLAG_DYN)
+                        kfree(orig_cmd);
+                else
+                        memcpy(orig_cmd, cmd, sizeof(*cmd));
+        }
 }
 
 /* obsolete, blk_rq_bytes() should be used instead */
diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
index 052b9bf1f8fb..f76e4e6b408f 100644
--- a/drivers/ide/pmac.c
+++ b/drivers/ide/pmac.c
@@ -1682,7 +1682,7 @@ static int __devinit pmac_ide_init_dma(ide_hwif_t *hwif,
          * The +2 is +1 for the stop command and +1 to allow for
          * aligning the start address to a multiple of 16 bytes.
          */
-        pmif->dma_table_cpu = (struct dbdma_cmd*)pci_alloc_consistent(
+        pmif->dma_table_cpu = pci_alloc_consistent(
                 dev,
                 (MAX_DCMDS + 2) * sizeof(struct dbdma_cmd),
                 &hwif->dmatable_dma);
diff --git a/drivers/lguest/lg.h b/drivers/lguest/lg.h
index ac8a4a3741b8..af92a176697f 100644
--- a/drivers/lguest/lg.h
+++ b/drivers/lguest/lg.h
@@ -158,7 +158,8 @@ void free_interrupts(void);
 /* segments.c: */
 void setup_default_gdt_entries(struct lguest_ro_state *state);
 void setup_guest_gdt(struct lg_cpu *cpu);
-void load_guest_gdt(struct lg_cpu *cpu, unsigned long table, u32 num);
+void load_guest_gdt_entry(struct lg_cpu *cpu, unsigned int i,
+                          u32 low, u32 hi);
 void guest_load_tls(struct lg_cpu *cpu, unsigned long tls_array);
 void copy_gdt(const struct lg_cpu *cpu, struct desc_struct *gdt);
 void copy_gdt_tls(const struct lg_cpu *cpu, struct desc_struct *gdt);
diff --git a/drivers/lguest/segments.c b/drivers/lguest/segments.c
index 4f15439b7f12..7ede64ffeef9 100644
--- a/drivers/lguest/segments.c
+++ b/drivers/lguest/segments.c
@@ -144,18 +144,19 @@ void copy_gdt(const struct lg_cpu *cpu, struct desc_struct *gdt)
                         gdt[i] = cpu->arch.gdt[i];
 }
 
-/*H:620 This is where the Guest asks us to load a new GDT (LHCALL_LOAD_GDT).
- * We copy it from the Guest and tweak the entries. */
-void load_guest_gdt(struct lg_cpu *cpu, unsigned long table, u32 num)
+/*H:620 This is where the Guest asks us to load a new GDT entry
+ * (LHCALL_LOAD_GDT_ENTRY).  We tweak the entry and copy it in. */
+void load_guest_gdt_entry(struct lg_cpu *cpu, u32 num, u32 lo, u32 hi)
 {
         /* We assume the Guest has the same number of GDT entries as the
          * Host, otherwise we'd have to dynamically allocate the Guest GDT. */
         if (num > ARRAY_SIZE(cpu->arch.gdt))
                 kill_guest(cpu, "too many gdt entries %i", num);
 
-        /* We read the whole thing in, then fix it up. */
-        __lgread(cpu, cpu->arch.gdt, table, num * sizeof(cpu->arch.gdt[0]));
-        fixup_gdt_table(cpu, 0, ARRAY_SIZE(cpu->arch.gdt));
+        /* Set it up, then fix it. */
+        cpu->arch.gdt[num].a = lo;
+        cpu->arch.gdt[num].b = hi;
+        fixup_gdt_table(cpu, num, num+1);
         /* Mark that the GDT changed so the core knows it has to copy it again,
          * even if the Guest is run on the same CPU. */
         cpu->changed |= CHANGED_GDT;
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index a6b717644be0..1a83910f674f 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -324,6 +324,11 @@ static void rewrite_hypercall(struct lg_cpu *cpu)
         u8 insn[3] = {0xcd, 0x1f, 0x90};
 
         __lgwrite(cpu, guest_pa(cpu, cpu->regs->eip), insn, sizeof(insn));
+        /* The above write might have caused a copy of that page to be made
+         * (if it was read-only).  We need to make sure the Guest has
+         * up-to-date pagetables.  As this doesn't happen often, we can just
+         * drop them all. */
+        guest_pagetable_clear_all(cpu);
 }
 
 static bool is_hypercall(struct lg_cpu *cpu)
@@ -563,8 +568,8 @@ void __exit lguest_arch_host_fini(void)
 int lguest_arch_do_hcall(struct lg_cpu *cpu, struct hcall_args *args)
 {
         switch (args->arg0) {
-        case LHCALL_LOAD_GDT:
-                load_guest_gdt(cpu, args->arg1, args->arg2);
+        case LHCALL_LOAD_GDT_ENTRY:
+                load_guest_gdt_entry(cpu, args->arg1, args->arg2, args->arg3);
                 break;
         case LHCALL_LOAD_IDT_ENTRY:
                 load_guest_idt_entry(cpu, args->arg1, args->arg2, args->arg3);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index f8a9f7ab2cb8..1fb91edc7de2 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1479,6 +1479,7 @@ void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector)
                 s += blocks;
         }
         bitmap->last_end_sync = jiffies;
+        sysfs_notify(&bitmap->mddev->kobj, NULL, "sync_completed");
 }
 
 static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset, int needed)
@@ -1589,7 +1590,7 @@ void bitmap_destroy(mddev_t *mddev)
 int bitmap_create(mddev_t *mddev)
 {
         struct bitmap *bitmap;
-        unsigned long blocks = mddev->resync_max_sectors;
+        sector_t blocks = mddev->resync_max_sectors;
         unsigned long chunks;
         unsigned long pages;
         struct file *file = mddev->bitmap_file;
@@ -1631,8 +1632,8 @@ int bitmap_create(mddev_t *mddev)
         bitmap->chunkshift = ffz(~bitmap->chunksize);
 
         /* now that chunksize and chunkshift are set, we can use these macros */
-        chunks = (blocks + CHUNK_BLOCK_RATIO(bitmap) - 1) /
-                        CHUNK_BLOCK_RATIO(bitmap);
+        chunks = (blocks + CHUNK_BLOCK_RATIO(bitmap) - 1) >>
+                        CHUNK_BLOCK_SHIFT(bitmap);
         pages = (chunks + PAGE_COUNTER_RATIO - 1) / PAGE_COUNTER_RATIO;
 
         BUG_ON(!pages);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index ed5727c089a9..612343fdde94 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2017,6 +2017,8 @@ repeat:
         clear_bit(MD_CHANGE_PENDING, &mddev->flags);
         spin_unlock_irq(&mddev->write_lock);
         wake_up(&mddev->sb_wait);
+        if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+                sysfs_notify(&mddev->kobj, NULL, "sync_completed");
 
 }
 
@@ -2086,6 +2088,7 @@ state_store(mdk_rdev_t *rdev, const char *buf, size_t len)
          *  -writemostly - clears write_mostly
          *  blocked - sets the Blocked flag
          *  -blocked - clears the Blocked flag
+         *  insync - sets Insync providing device isn't active
          */
         int err = -EINVAL;
         if (cmd_match(buf, "faulty") && rdev->mddev->pers) {
@@ -2118,6 +2121,9 @@ state_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                 md_wakeup_thread(rdev->mddev->thread);
 
                 err = 0;
+        } else if (cmd_match(buf, "insync") && rdev->raid_disk == -1) {
+                set_bit(In_sync, &rdev->flags);
+                err = 0;
         }
         if (!err && rdev->sysfs_state)
                 sysfs_notify_dirent(rdev->sysfs_state);
@@ -2190,7 +2196,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len)
         } else if (rdev->mddev->pers) {
                 mdk_rdev_t *rdev2;
                 /* Activating a spare .. or possibly reactivating
-                 * if we every get bitmaps working here.
+                 * if we ever get bitmaps working here.
                  */
 
                 if (rdev->raid_disk != -1)
@@ -3482,12 +3488,15 @@ sync_completed_show(mddev_t *mddev, char *page)
 {
         unsigned long max_sectors, resync;
 
+        if (!test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+                return sprintf(page, "none\n");
+
         if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery))
                 max_sectors = mddev->resync_max_sectors;
         else
                 max_sectors = mddev->dev_sectors;
 
-        resync = (mddev->curr_resync - atomic_read(&mddev->recovery_active));
+        resync = mddev->curr_resync_completed;
         return sprintf(page, "%lu / %lu\n", resync, max_sectors);
 }
 
@@ -6334,18 +6343,13 @@ void md_do_sync(mddev_t *mddev)
                 sector_t sectors;
 
                 skipped = 0;
-                if (j >= mddev->resync_max) {
-                        sysfs_notify(&mddev->kobj, NULL, "sync_completed");
-                        wait_event(mddev->recovery_wait,
-                                   mddev->resync_max > j
-                                   || kthread_should_stop());
-                }
-                if (kthread_should_stop())
-                        goto interrupted;
 
-                if (mddev->curr_resync > mddev->curr_resync_completed &&
-                    (mddev->curr_resync - mddev->curr_resync_completed)
-                    > (max_sectors >> 4)) {
+                if ((mddev->curr_resync > mddev->curr_resync_completed &&
+                     (mddev->curr_resync - mddev->curr_resync_completed)
+                    > (max_sectors >> 4)) ||
+                    (j - mddev->curr_resync_completed)*2
+                    >= mddev->resync_max - mddev->curr_resync_completed
+                        ) {
                         /* time to update curr_resync_completed */
                         blk_unplug(mddev->queue);
                         wait_event(mddev->recovery_wait,
@@ -6353,7 +6357,17 @@ void md_do_sync(mddev_t *mddev)
                         mddev->curr_resync_completed =
                                 mddev->curr_resync;
                         set_bit(MD_CHANGE_CLEAN, &mddev->flags);
+                        sysfs_notify(&mddev->kobj, NULL, "sync_completed");
                 }
+
+                if (j >= mddev->resync_max)
+                        wait_event(mddev->recovery_wait,
+                                   mddev->resync_max > j
+                                   || kthread_should_stop());
+
+                if (kthread_should_stop())
+                        goto interrupted;
+
                 sectors = mddev->pers->sync_request(mddev, j, &skipped,
                                                   currspeed < speed_min(mddev));
                 if (sectors == 0) {
@@ -6461,6 +6475,7 @@ void md_do_sync(mddev_t *mddev)
 
  skip:
         mddev->curr_resync = 0;
+        mddev->curr_resync_completed = 0;
         mddev->resync_min = 0;
         mddev->resync_max = MaxSector;
         sysfs_notify(&mddev->kobj, NULL, "sync_completed");
diff --git a/drivers/md/md.h b/drivers/md/md.h
index e9b7f54c24d6..8227ab909d44 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -12,10 +12,17 @@
    Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  
 */
 
-#ifndef _MD_K_H
-#define _MD_K_H
-
-#ifdef CONFIG_BLOCK
+#ifndef _MD_MD_H
+#define _MD_MD_H
+
+#include <linux/blkdev.h>
+#include <linux/kobject.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mutex.h>
+#include <linux/timer.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
 
 #define MaxSector (~(sector_t)0)
 
@@ -408,10 +415,6 @@ static inline void safe_put_page(struct page *p)
         if (p) put_page(p);
 }
 
-#endif /* CONFIG_BLOCK */
-#endif
-
-
 extern int register_md_personality(struct mdk_personality *p);
 extern int unregister_md_personality(struct mdk_personality *p);
 extern mdk_thread_t * md_register_thread(void (*run) (mddev_t *mddev),
@@ -434,3 +437,5 @@ extern void md_new_event(mddev_t *mddev);
 extern int md_allow_write(mddev_t *mddev);
 extern void md_wait_for_blocked_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 extern void md_set_array_sectors(mddev_t *mddev, sector_t array_sectors);
+
+#endif /* _MD_MD_H */
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 3bbc6d647044..4616bc3a6e71 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3845,6 +3845,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                 wait_event(conf->wait_for_overlap,
                            atomic_read(&conf->reshape_stripes)==0);
                 mddev->reshape_position = conf->reshape_progress;
+                mddev->curr_resync_completed = mddev->curr_resync;
                 conf->reshape_checkpoint = jiffies;
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
@@ -3854,6 +3855,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                 conf->reshape_safe = mddev->reshape_position;
                 spin_unlock_irq(&conf->device_lock);
                 wake_up(&conf->wait_for_overlap);
+                sysfs_notify(&mddev->kobj, NULL, "sync_completed");
         }
 
         if (mddev->delta_disks < 0) {
@@ -3938,11 +3940,13 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
          * then we need to write out the superblock.
          */
         sector_nr += reshape_sectors;
-        if (sector_nr >= mddev->resync_max) {
+        if ((sector_nr - mddev->curr_resync_completed) * 2
+            >= mddev->resync_max - mddev->curr_resync_completed) {
                 /* Cannot proceed until we've updated the superblock... */
                 wait_event(conf->wait_for_overlap,
                            atomic_read(&conf->reshape_stripes) == 0);
                 mddev->reshape_position = conf->reshape_progress;
+                mddev->curr_resync_completed = mddev->curr_resync;
                 conf->reshape_checkpoint = jiffies;
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
@@ -3953,6 +3957,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                 conf->reshape_safe = mddev->reshape_position;
                 spin_unlock_irq(&conf->device_lock);
                 wake_up(&conf->wait_for_overlap);
+                sysfs_notify(&mddev->kobj, NULL, "sync_completed");
         }
         return reshape_sectors;
 }
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 59268266b79a..9c76a061a04d 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -190,7 +190,8 @@ static int balloon(void *_vballoon)
                 try_to_freeze();
                 wait_event_interruptible(vb->config_change,
                                          (diff = towards_target(vb)) != 0
-                                         || kthread_should_stop());
+                                         || kthread_should_stop()
+                                         || freezing(current));
                 if (diff > 0)
                         fill_balloon(vb, diff);
                 else if (diff < 0)
diff --git a/fs/autofs/dirhash.c b/fs/autofs/dirhash.c
index bf8c8af98004..4eb4d8dfb2f1 100644
--- a/fs/autofs/dirhash.c
+++ b/fs/autofs/dirhash.c
@@ -39,10 +39,12 @@ struct autofs_dir_ent *autofs_expire(struct super_block *sb,
 {
         struct autofs_dirhash *dh = &sbi->dirhash;
         struct autofs_dir_ent *ent;
-        struct dentry *dentry;
         unsigned long timeout = sbi->exp_timeout;
 
         while (1) {
+                struct path path;
+                int umount_ok;
+
                 if ( list_empty(&dh->expiry_head) || sbi->catatonic )
                         return NULL;    /* No entries */
                 /* We keep the list sorted by last_usage and want old stuff */
@@ -57,17 +59,17 @@ struct autofs_dir_ent *autofs_expire(struct super_block *sb,
                         return ent; /* Symlinks are always expirable */
 
                 /* Get the dentry for the autofs subdirectory */
-                dentry = ent->dentry;
+                path.dentry = ent->dentry;
 
-                if ( !dentry ) {
+                if (!path.dentry) {
                         /* Should only happen in catatonic mode */
                         printk("autofs: dentry == NULL but inode range is directory, entry %s\n", ent->name);
                         autofs_delete_usage(ent);
                         continue;
                 }
 
-                if ( !dentry->d_inode ) {
-                        dput(dentry);
+                if (!path.dentry->d_inode) {
+                        dput(path.dentry);
                         printk("autofs: negative dentry on expiry queue: %s\n",
                                ent->name);
                         autofs_delete_usage(ent);
@@ -76,29 +78,29 @@ struct autofs_dir_ent *autofs_expire(struct super_block *sb,
 
                 /* Make sure entry is mounted and unused; note that dentry will
                    point to the mounted-on-top root. */
-                if (!S_ISDIR(dentry->d_inode->i_mode)||!d_mountpoint(dentry)) {
+                if (!S_ISDIR(path.dentry->d_inode->i_mode) ||
+                    !d_mountpoint(path.dentry)) {
                         DPRINTK(("autofs: not expirable (not a mounted directory): %s\n", ent->name));
                         continue;
                 }
-                mntget(mnt);
-                dget(dentry);
-                if (!follow_down(&mnt, &dentry)) {
-                        dput(dentry);
-                        mntput(mnt);
+                path.mnt = mnt;
+                path_get(&path);
+                if (!follow_down(&path.mnt, &path.dentry)) {
+                        path_put(&path);
                         DPRINTK(("autofs: not expirable (not a mounted directory): %s\n", ent->name));
                         continue;
                 }
-                while (d_mountpoint(dentry) && follow_down(&mnt, &dentry))
+                while (d_mountpoint(path.dentry) &&
+                       follow_down(&path.mnt, &path.dentry))
                         ;
-                dput(dentry);
+                umount_ok = may_umount(path.mnt);
+                path_put(&path);
 
-                if ( may_umount(mnt) ) {
-                        mntput(mnt);
+                if (umount_ok) {
                         DPRINTK(("autofs: signaling expire on %s\n", ent->name));
                         return ent; /* Expirable! */
                 }
                 DPRINTK(("autofs: didn't expire due to may_umount: %s\n", ent->name));
-                mntput(mnt);
         }
         return NULL;            /* No expirable entries */
 }
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 9e5ae8a4f5c8..84168c0dcc2d 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -54,11 +54,10 @@ static int check_name(const char *name)
  * Check a string doesn't overrun the chunk of
  * memory we copied from user land.
  */
-static int invalid_str(char *str, void *end)
+static int invalid_str(char *str, size_t size)
 {
-        while ((void *) str <= end)
-                if (!*str++)
-                        return 0;
+        if (memchr(str, 0, size))
+                return 0;
         return -EINVAL;
 }
 
@@ -138,8 +137,7 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param)
         }
 
         if (param->size > sizeof(*param)) {
-                err = invalid_str(param->path,
-                                 (void *) ((size_t) param + param->size));
+                err = invalid_str(param->path, param->size - sizeof(*param));
                 if (err) {
                         AUTOFS_WARN(
                           "path string terminator missing for cmd(0x%08x)",
@@ -488,7 +486,7 @@ static int autofs_dev_ioctl_requester(struct file *fp,
         }
 
         path = param->path;
-        devid = sbi->sb->s_dev;
+        devid = new_encode_dev(sbi->sb->s_dev);
 
         param->requester.uid = param->requester.gid = -1;
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 7594bec1be10..9f135e878507 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -461,15 +461,9 @@ static int btrfs_ioctl_resize(struct btrfs_root *root, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
-
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         namelen = strlen(vol_args->name);
@@ -545,7 +539,6 @@ static int btrfs_ioctl_resize(struct btrfs_root *root, void __user *arg)
 
 out_unlock:
         mutex_unlock(&root->fs_info->volume_mutex);
-out:
         kfree(vol_args);
         return ret;
 }
@@ -565,15 +558,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,
         if (root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
-
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         namelen = strlen(vol_args->name);
@@ -675,19 +662,13 @@ static long btrfs_ioctl_add_dev(struct btrfs_root *root, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_init_new_device(root, vol_args->name);
 
-out:
         kfree(vol_args);
         return ret;
 }
@@ -703,19 +684,13 @@ static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg)
         if (root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_rm_device(root, vol_args->name);
 
-out:
         kfree(vol_args);
         return ret;
 }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 9744af9d71e9..a7acfe639a44 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -635,14 +635,9 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol = kmalloc(sizeof(*vol), GFP_KERNEL);
-        if (!vol)
-                return -ENOMEM;
-
-        if (copy_from_user(vol, (void __user *)arg, sizeof(*vol))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol = memdup_user((void __user *)arg, sizeof(*vol));
+        if (IS_ERR(vol))
+                return PTR_ERR(vol);
 
         switch (cmd) {
         case BTRFS_IOC_SCAN_DEV:
@@ -650,7 +645,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
                                             &btrfs_fs_type, &fs_devices);
                 break;
         }
-out:
+
         kfree(vol);
         return ret;
 }
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 65984006192c..9d1fb6ec8a5a 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -15,7 +15,8 @@ Posix file open support added (turned off after one attempt if server
 fails to support it properly, as with Samba server versions prior to 3.3.2)
 Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too
 little memory for the "nativeFileSystem" field returned by the server
-during mount). 
+during mount).  Endian convert inode numbers if necessary (makes it easier
+to compare inode numbers on network files from big endian systems). 
 
 Version 1.56
 ------------
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 3fd3a9df043a..67bf93a40d2e 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -41,7 +41,7 @@ cifs_spnego_key_instantiate(struct key *key, const void *data, size_t datalen)
 
         /* attach the data */
         memcpy(payload, data, datalen);
-        rcu_assign_pointer(key->payload.data, payload);
+        key->payload.data = payload;
         ret = 0;
 
 error:
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 38491fd3871d..0d6d8b573652 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -66,9 +66,6 @@ unsigned int sign_CIFS_PDUs = 1;
 extern struct task_struct *oplockThread; /* remove sparse warning */
 struct task_struct *oplockThread = NULL;
 /* extern struct task_struct * dnotifyThread; remove sparse warning */
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-static struct task_struct *dnotifyThread = NULL;
-#endif
 static const struct super_operations cifs_super_ops;
 unsigned int CIFSMaxBufSize = CIFS_MAX_MSGSIZE;
 module_param(CIFSMaxBufSize, int, 0);
@@ -316,6 +313,7 @@ cifs_alloc_inode(struct super_block *sb)
         cifs_inode->clientCanCacheAll = false;
         cifs_inode->delete_pending = false;
         cifs_inode->vfs_inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
+        cifs_inode->server_eof = 0;
 
         /* Can not set i_flags here - they get immediately overwritten
            to zero by the VFS */
@@ -1040,34 +1038,6 @@ static int cifs_oplock_thread(void *dummyarg)
         return 0;
 }
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-static int cifs_dnotify_thread(void *dummyarg)
-{
-        struct list_head *tmp;
-        struct TCP_Server_Info *server;
-
-        do {
-                if (try_to_freeze())
-                        continue;
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(15*HZ);
-                /* check if any stuck requests that need
-                   to be woken up and wakeq so the
-                   thread can wake up and error out */
-                read_lock(&cifs_tcp_ses_lock);
-                list_for_each(tmp, &cifs_tcp_ses_list) {
-                        server = list_entry(tmp, struct TCP_Server_Info,
-                                         tcp_ses_list);
-                        if (atomic_read(&server->inFlight))
-                                wake_up_all(&server->response_q);
-                }
-                read_unlock(&cifs_tcp_ses_lock);
-        } while (!kthread_should_stop());
-
-        return 0;
-}
-#endif
-
 static int __init
 init_cifs(void)
 {
@@ -1144,21 +1114,8 @@ init_cifs(void)
                 goto out_unregister_dfs_key_type;
         }
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-        dnotifyThread = kthread_run(cifs_dnotify_thread, NULL, "cifsdnotifyd");
-        if (IS_ERR(dnotifyThread)) {
-                rc = PTR_ERR(dnotifyThread);
-                cERROR(1, ("error %d create dnotify thread", rc));
-                goto out_stop_oplock_thread;
-        }
-#endif
-
         return 0;
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
- out_stop_oplock_thread:
-#endif
-        kthread_stop(oplockThread);
  out_unregister_dfs_key_type:
 #ifdef CONFIG_CIFS_DFS_UPCALL
         unregister_key_type(&key_type_dns_resolver);
@@ -1196,9 +1153,6 @@ exit_cifs(void)
         cifs_destroy_inodecache();
         cifs_destroy_mids();
         cifs_destroy_request_bufs();
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-        kthread_stop(dnotifyThread);
-#endif
         kthread_stop(oplockThread);
 }
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 9fbf4dff5da6..df40ab64cd95 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -350,7 +350,7 @@ struct cifsFileInfo {
         bool invalidHandle:1;   /* file closed via session abend */
         bool messageMode:1;     /* for pipes: message vs byte mode */
         atomic_t wrtPending;   /* handle in use - defer close */
-        struct semaphore fh_sem; /* prevents reopen race after dead ses*/
+        struct mutex fh_mutex; /* prevents reopen race after dead ses*/
         struct cifs_search_info srch_inf;
 };
 
@@ -370,6 +370,7 @@ struct cifsInodeInfo {
         bool clientCanCacheAll:1;       /* read and writebehind oplock */
         bool oplockPending:1;
         bool delete_pending:1;          /* DELETE_ON_CLOSE is set */
+        u64  server_eof;                /* current file size on server */
         struct inode vfs_inode;
 };
 
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index b370489c8da5..a785f69dbc9f 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -2163,7 +2163,7 @@ typedef struct {
         __le32 Type;
         __le64 DevMajor;
         __le64 DevMinor;
-        __u64 UniqueId;
+        __le64 UniqueId;
         __le64 Permissions;
         __le64 Nlinks;
 } __attribute__((packed)) FILE_UNIX_BASIC_INFO; /* level 0x200 QPathInfo */
@@ -2308,7 +2308,7 @@ struct unlink_psx_rq { /* level 0x20a SetPathInfo */
 } __attribute__((packed));
 
 struct file_internal_info {
-        __u64  UniqueId; /* inode number */
+        __le64  UniqueId; /* inode number */
 } __attribute__((packed));      /* level 0x3ee */
 
 struct file_mode_info {
@@ -2338,7 +2338,7 @@ typedef struct {
         __le32 Type;
         __le64 DevMajor;
         __le64 DevMinor;
-        __u64 UniqueId;
+        __le64 UniqueId;
         __le64 Permissions;
         __le64 Nlinks;
         char FileName[1];
@@ -2386,7 +2386,7 @@ typedef struct {
         __le32 FileNameLength;
         __le32 EaSize; /* EA size */
         __le32 Reserved;
-        __u64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
+        __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
         char FileName[1];
 } __attribute__((packed)) SEARCH_ID_FULL_DIR_INFO; /* level 0x105 FF rsp data */
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index bc09c998631f..a0845dc7b8a9 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1626,6 +1626,8 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
         int smb_hdr_len;
         int resp_buf_type = 0;
 
+        *nbytes = 0;
+
         cFYI(1, ("write2 at %lld %d bytes", (long long)offset, count));
 
         if (tcon->ses->capabilities & CAP_LARGE_FILES) {
@@ -1682,11 +1684,9 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
         cifs_stats_inc(&tcon->num_writes);
         if (rc) {
                 cFYI(1, ("Send error Write2 = %d", rc));
-                *nbytes = 0;
         } else if (resp_buf_type == 0) {
                 /* presumably this can not happen, but best to be safe */
                 rc = -EIO;
-                *nbytes = 0;
         } else {
                 WRITE_RSP *pSMBr = (WRITE_RSP *)iov[0].iov_base;
                 *nbytes = le16_to_cpu(pSMBr->CountHigh);
@@ -3918,7 +3918,7 @@ GetInodeNumberRetry:
                         }
                         pfinfo = (struct file_internal_info *)
                                 (data_offset + (char *) &pSMBr->hdr.Protocol);
-                        *inode_number = pfinfo->UniqueId;
+                        *inode_number = le64_to_cpu(pfinfo->UniqueId);
                 }
         }
 GetInodeNumOut:
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 0de3b5615a22..bacdef1546b7 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2214,9 +2214,58 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
         return rc;
 }
 
+static void
+cleanup_volume_info(struct smb_vol **pvolume_info)
+{
+        struct smb_vol *volume_info;
+
+        if (!pvolume_info && !*pvolume_info)
+                return;
+
+        volume_info = *pvolume_info;
+        kzfree(volume_info->password);
+        kfree(volume_info->UNC);
+        kfree(volume_info->prepath);
+        kfree(volume_info);
+        *pvolume_info = NULL;
+        return;
+}
+
+#ifdef CONFIG_CIFS_DFS_UPCALL
+/* build_path_to_root returns full path to root when
+ * we do not have an exiting connection (tcon) */
+static char *
+build_unc_path_to_root(const struct smb_vol *volume_info,
+                const struct cifs_sb_info *cifs_sb)
+{
+        char *full_path;
+
+        int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
+        full_path = kmalloc(unc_len + cifs_sb->prepathlen + 1, GFP_KERNEL);
+        if (full_path == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        strncpy(full_path, volume_info->UNC, unc_len);
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
+                int i;
+                for (i = 0; i < unc_len; i++) {
+                        if (full_path[i] == '\\')
+                                full_path[i] = '/';
+                }
+        }
+
+        if (cifs_sb->prepathlen)
+                strncpy(full_path + unc_len, cifs_sb->prepath,
+                                cifs_sb->prepathlen);
+
+        full_path[unc_len + cifs_sb->prepathlen] = 0; /* add trailing null */
+        return full_path;
+}
+#endif
+
 int
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
-           char *mount_data, const char *devname)
+                char *mount_data_global, const char *devname)
 {
         int rc = 0;
         int xid;
@@ -2225,6 +2274,13 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         struct cifsTconInfo *tcon = NULL;
         struct TCP_Server_Info *srvTcp = NULL;
         char   *full_path;
+        char *mount_data = mount_data_global;
+#ifdef CONFIG_CIFS_DFS_UPCALL
+        struct dfs_info3_param *referrals = NULL;
+        unsigned int num_referrals = 0;
+try_mount_again:
+#endif
+        full_path = NULL;
 
         xid = GetXid();
 
@@ -2371,11 +2427,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 }
                         }
 
-                        /* check for null share name ie connect to dfs root */
                         if ((strchr(volume_info->UNC + 3, '\\') == NULL)
                             && (strchr(volume_info->UNC + 3, '/') == NULL)) {
-                                /* rc = connect_to_dfs_path(...) */
-                                cFYI(1, ("DFS root not supported"));
+                                cERROR(1, ("Missing share name"));
                                 rc = -ENODEV;
                                 goto mount_fail_check;
                         } else {
@@ -2392,7 +2446,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 }
                         }
                         if (rc)
-                                goto mount_fail_check;
+                                goto remote_path_check;
                         tcon->seal = volume_info->seal;
                         write_lock(&cifs_tcp_ses_lock);
                         list_add(&tcon->tcon_list, &pSesInfo->tcon_list);
@@ -2417,19 +2471,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
         sb->s_time_gran = 100;
 
-mount_fail_check:
-        /* on error free sesinfo and tcon struct if needed */
-        if (rc) {
-                /* If find_unc succeeded then rc == 0 so we can not end */
-                /* up accidently freeing someone elses tcon struct */
-                if (tcon)
-                        cifs_put_tcon(tcon);
-                else if (pSesInfo)
-                        cifs_put_smb_ses(pSesInfo);
-                else
-                        cifs_put_tcp_session(srvTcp);
-                goto out;
-        }
+        if (rc)
+                goto remote_path_check;
+
         cifs_sb->tcon = tcon;
 
         /* do not care if following two calls succeed - informational */
@@ -2461,7 +2505,9 @@ mount_fail_check:
                 cifs_sb->rsize = min(cifs_sb->rsize,
                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
 
-        if (!rc && cifs_sb->prepathlen) {
+remote_path_check:
+        /* check if a whole path (including prepath) is not remote */
+        if (!rc && cifs_sb->prepathlen && tcon) {
                 /* build_path_to_root works only when we have a valid tcon */
                 full_path = cifs_build_path_to_root(cifs_sb);
                 if (full_path == NULL) {
@@ -2469,31 +2515,79 @@ mount_fail_check:
                         goto mount_fail_check;
                 }
                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
-                if (rc) {
-                        cERROR(1, ("Path %s in not accessible: %d",
-                                                full_path, rc));
+                if (rc != -EREMOTE) {
                         kfree(full_path);
                         goto mount_fail_check;
                 }
                 kfree(full_path);
         }
 
+        /* get referral if needed */
+        if (rc == -EREMOTE) {
+#ifdef CONFIG_CIFS_DFS_UPCALL
+                /* convert forward to back slashes in prepath here if needed */
+                if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
+                        convert_delimiter(cifs_sb->prepath,
+                                        CIFS_DIR_SEP(cifs_sb));
+                full_path = build_unc_path_to_root(volume_info, cifs_sb);
+                if (IS_ERR(full_path)) {
+                        rc = PTR_ERR(full_path);
+                        goto mount_fail_check;
+                }
+
+                cFYI(1, ("Getting referral for: %s", full_path));
+                rc = get_dfs_path(xid, pSesInfo , full_path + 1,
+                        cifs_sb->local_nls, &num_referrals, &referrals,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+                if (!rc && num_referrals > 0) {
+                        char *fake_devname = NULL;
+
+                        if (mount_data != mount_data_global)
+                                kfree(mount_data);
+                        mount_data = cifs_compose_mount_options(
+                                        cifs_sb->mountdata, full_path + 1,
+                                        referrals, &fake_devname);
+                        kfree(fake_devname);
+                        free_dfs_info_array(referrals, num_referrals);
+
+                        if (tcon)
+                                cifs_put_tcon(tcon);
+                        else if (pSesInfo)
+                                cifs_put_smb_ses(pSesInfo);
+
+                        cleanup_volume_info(&volume_info);
+                        FreeXid(xid);
+                        kfree(full_path);
+                        goto try_mount_again;
+                }
+#else /* No DFS support, return error on mount */
+                rc = -EOPNOTSUPP;
+#endif
+        }
+
+mount_fail_check:
+        /* on error free sesinfo and tcon struct if needed */
+        if (rc) {
+                if (mount_data != mount_data_global)
+                        kfree(mount_data);
+                /* If find_unc succeeded then rc == 0 so we can not end */
+                /* up accidently freeing someone elses tcon struct */
+                if (tcon)
+                        cifs_put_tcon(tcon);
+                else if (pSesInfo)
+                        cifs_put_smb_ses(pSesInfo);
+                else
+                        cifs_put_tcp_session(srvTcp);
+                goto out;
+        }
+
         /* volume_info->password is freed above when existing session found
         (in which case it is not needed anymore) but when new sesion is created
         the password ptr is put in the new session structure (in which case the
         password will be freed at unmount time) */
 out:
         /* zero out password before freeing */
-        if (volume_info) {
-                if (volume_info->password != NULL) {
-                        memset(volume_info->password, 0,
-                                strlen(volume_info->password));
-                        kfree(volume_info->password);
-                }
-                kfree(volume_info->UNC);
-                kfree(volume_info->prepath);
-                kfree(volume_info);
-        }
+        cleanup_volume_info(&volume_info);
         FreeXid(xid);
         return rc;
 }
@@ -2673,8 +2767,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
-                                if (ses->serverOS)
-                                        kfree(ses->serverOS);
+                                kfree(ses->serverOS);
                                 ses->serverOS = kzalloc(2 * (len + 1),
                                                         GFP_KERNEL);
                                 if (ses->serverOS == NULL)
@@ -2710,8 +2803,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
                                 /* last string is not always null terminated
                                    (for e.g. for Windows XP & 2000) */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                     kzalloc(2*(len+1),
                                                             GFP_KERNEL);
@@ -2725,8 +2817,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 ses->serverDomain[1+(2*len)] = 0;
                                         } else { /* else no more room so create
                                                   dummy domain string */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                         kzalloc(2, GFP_KERNEL);
                                         }
@@ -2772,8 +2863,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         bcc_ptr++;
 
                                         len = strnlen(bcc_ptr, 1024);
-                                        if (ses->serverDomain)
-                                                kfree(ses->serverDomain);
+                                        kfree(ses->serverDomain);
                                         ses->serverDomain = kzalloc(len + 1,
                                                                     GFP_KERNEL);
                                         if (ses->serverDomain == NULL)
@@ -3013,8 +3103,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
 /* We look for obvious messed up bcc or strings in response so we do not go off
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
-                                        if (ses->serverOS)
-                                                kfree(ses->serverOS);
+                                        kfree(ses->serverOS);
                                         ses->serverOS =
                                             kzalloc(2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
@@ -3086,8 +3175,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                         if (((long) bcc_ptr + len) - (long)
                                             pByteArea(smb_buffer_response)
                                             <= BCC(smb_buffer_response)) {
-                                                if (ses->serverOS)
-                                                        kfree(ses->serverOS);
+                                                kfree(ses->serverOS);
                                                 ses->serverOS =
                                                     kzalloc(len + 1,
                                                             GFP_KERNEL);
@@ -3414,8 +3502,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
-                                        if (ses->serverOS)
-                                                kfree(ses->serverOS);
+                                        kfree(ses->serverOS);
                                         ses->serverOS =
                                             kzalloc(2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
@@ -3448,8 +3535,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 if (remaining_words > 0) {
                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
      /* last string not always null terminated (e.g. for Windows XP & 2000) */
-                                                        if (ses->serverDomain)
-                                                                kfree(ses->serverDomain);
+                                                        kfree(ses->serverDomain);
                                                         ses->serverDomain =
                                                             kzalloc(2 *
                                                                     (len +
@@ -3476,13 +3562,11 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                             = 0;
                                                 } /* else no more room so create dummy domain string */
                                                 else {
-                                                        if (ses->serverDomain)
-                                                                kfree(ses->serverDomain);
+                                                        kfree(ses->serverDomain);
                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
                                                 }
                                         } else {  /* no room so create dummy domain and NOS string */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
                                                 kfree(ses->serverNOS);
                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
@@ -3492,8 +3576,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         if (((long) bcc_ptr + len) -
                                            (long) pByteArea(smb_buffer_response)
                                                 <= BCC(smb_buffer_response)) {
-                                                if (ses->serverOS)
-                                                        kfree(ses->serverOS);
+                                                kfree(ses->serverOS);
                                                 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
                                                 strncpy(ses->serverOS,bcc_ptr, len);
 
@@ -3512,8 +3595,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 bcc_ptr++;
 
                                                 len = strnlen(bcc_ptr, 1024);
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                                 kzalloc(len+1,
                                                                     GFP_KERNEL);
@@ -3674,16 +3756,15 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                             BCC(smb_buffer_response)) {
                                 kfree(tcon->nativeFileSystem);
                                 tcon->nativeFileSystem =
-                                    kzalloc(2*(length + 1), GFP_KERNEL);
-                                if (tcon->nativeFileSystem)
+                                    kzalloc((4 * length) + 2, GFP_KERNEL);
+                                if (tcon->nativeFileSystem) {
                                         cifs_strfromUCS_le(
                                                 tcon->nativeFileSystem,
                                                 (__le16 *) bcc_ptr,
                                                 length, nls_codepage);
-                                bcc_ptr += 2 * length;
-                                bcc_ptr[0] = 0; /* null terminate the string */
-                                bcc_ptr[1] = 0;
-                                bcc_ptr += 2;
+                                        cFYI(1, ("nativeFileSystem=%s",
+                                                tcon->nativeFileSystem));
+                                }
                         }
                         /* else do not bother copying these information fields*/
                 } else {
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 54dce78fbb73..461750e01364 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -129,12 +129,62 @@ cifs_bp_rename_retry:
         return full_path;
 }
 
+static void
+cifs_fill_fileinfo(struct inode *newinode, __u16 fileHandle,
+                        struct cifsTconInfo *tcon, bool write_only)
+{
+        int oplock = 0;
+        struct cifsFileInfo *pCifsFile;
+        struct cifsInodeInfo *pCifsInode;
+
+        pCifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
+
+        if (pCifsFile == NULL)
+                return;
+
+        if (oplockEnabled)
+                oplock = REQ_OPLOCK;
+
+        pCifsFile->netfid = fileHandle;
+        pCifsFile->pid = current->tgid;
+        pCifsFile->pInode = newinode;
+        pCifsFile->invalidHandle = false;
+        pCifsFile->closePend = false;
+        mutex_init(&pCifsFile->fh_mutex);
+        mutex_init(&pCifsFile->lock_mutex);
+        INIT_LIST_HEAD(&pCifsFile->llist);
+        atomic_set(&pCifsFile->wrtPending, 0);
+
+        /* set the following in open now
+                        pCifsFile->pfile = file; */
+        write_lock(&GlobalSMBSeslock);
+        list_add(&pCifsFile->tlist, &tcon->openFileList);
+        pCifsInode = CIFS_I(newinode);
+        if (pCifsInode) {
+                /* if readable file instance put first in list*/
+                if (write_only)
+                        list_add_tail(&pCifsFile->flist,
+                                      &pCifsInode->openFileList);
+                else
+                        list_add(&pCifsFile->flist, &pCifsInode->openFileList);
+
+                if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
+                        pCifsInode->clientCanCacheAll = true;
+                        pCifsInode->clientCanCacheRead = true;
+                        cFYI(1, ("Exclusive Oplock inode %p", newinode));
+                } else if ((oplock & 0xF) == OPLOCK_READ)
+                                pCifsInode->clientCanCacheRead = true;
+        }
+        write_unlock(&GlobalSMBSeslock);
+}
+
 int cifs_posix_open(char *full_path, struct inode **pinode,
                     struct super_block *sb, int mode, int oflags,
                     int *poplock, __u16 *pnetfid, int xid)
 {
         int rc;
         __u32 oplock;
+        bool write_only = false;
         FILE_UNIX_BASIC_INFO *presp_data;
         __u32 posix_flags = 0;
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
@@ -172,6 +222,8 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
         if (oflags & O_DIRECT)
                 posix_flags |= SMB_O_DIRECT;
 
+        if (!(oflags & FMODE_READ))
+                write_only = true;
 
         rc = CIFSPOSIXCreate(xid, cifs_sb->tcon, posix_flags, mode,
                         pnetfid, presp_data, &oplock, full_path,
@@ -187,8 +239,10 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
         if (!pinode)
                 goto posix_open_ret; /* caller does not need info */
 
-        if (*pinode == NULL)
-                *pinode = cifs_new_inode(sb, &presp_data->UniqueId);
+        if (*pinode == NULL) {
+                __u64 unique_id = le64_to_cpu(presp_data->UniqueId);
+                *pinode = cifs_new_inode(sb, &unique_id);
+        }
         /* else an inode was passed in. Update its info, don't create one */
 
         /* We do not need to close the file if new_inode fails since
@@ -198,6 +252,8 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
 
         posix_fill_in_inode(*pinode, presp_data, 1);
 
+        cifs_fill_fileinfo(*pinode, *pnetfid, cifs_sb->tcon, write_only);
+
 posix_open_ret:
         kfree(presp_data);
         return rc;
@@ -239,7 +295,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
         char *full_path = NULL;
         FILE_ALL_INFO *buf = NULL;
         struct inode *newinode = NULL;
-        struct cifsInodeInfo *pCifsInode;
         int disposition = FILE_OVERWRITE_IF;
         bool write_only = false;
 
@@ -410,44 +465,8 @@ cifs_create_set_dentry:
                 /* mknod case - do not leave file open */
                 CIFSSMBClose(xid, tcon, fileHandle);
         } else if (newinode) {
-                struct cifsFileInfo *pCifsFile =
-                        kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
-
-                if (pCifsFile == NULL)
-                        goto cifs_create_out;
-                pCifsFile->netfid = fileHandle;
-                pCifsFile->pid = current->tgid;
-                pCifsFile->pInode = newinode;
-                pCifsFile->invalidHandle = false;
-                pCifsFile->closePend     = false;
-                init_MUTEX(&pCifsFile->fh_sem);
-                mutex_init(&pCifsFile->lock_mutex);
-                INIT_LIST_HEAD(&pCifsFile->llist);
-                atomic_set(&pCifsFile->wrtPending, 0);
-
-                /* set the following in open now
-                                pCifsFile->pfile = file; */
-                write_lock(&GlobalSMBSeslock);
-                list_add(&pCifsFile->tlist, &tcon->openFileList);
-                pCifsInode = CIFS_I(newinode);
-                if (pCifsInode) {
-                        /* if readable file instance put first in list*/
-                        if (write_only) {
-                                list_add_tail(&pCifsFile->flist,
-                                              &pCifsInode->openFileList);
-                        } else {
-                                list_add(&pCifsFile->flist,
-                                         &pCifsInode->openFileList);
-                        }
-                        if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
-                                pCifsInode->clientCanCacheAll = true;
-                                pCifsInode->clientCanCacheRead = true;
-                                cFYI(1, ("Exclusive Oplock inode %p",
-                                        newinode));
-                        } else if ((oplock & 0xF) == OPLOCK_READ)
-                                pCifsInode->clientCanCacheRead = true;
-                }
-                write_unlock(&GlobalSMBSeslock);
+                        cifs_fill_fileinfo(newinode, fileHandle,
+                                        cifs_sb->tcon, write_only);
         }
 cifs_create_out:
         kfree(buf);
@@ -580,17 +599,21 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, int mode,
         return rc;
 }
 
-
 struct dentry *
 cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
             struct nameidata *nd)
 {
         int xid;
         int rc = 0; /* to get around spurious gcc warning, set to zero here */
+        int oplock = 0;
+        int mode;
+        __u16 fileHandle = 0;
+        bool posix_open = false;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         struct inode *newInode = NULL;
         char *full_path = NULL;
+        struct file *filp;
 
         xid = GetXid();
 
@@ -632,12 +655,37 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
         }
         cFYI(1, ("Full path: %s inode = 0x%p", full_path, direntry->d_inode));
 
-        if (pTcon->unix_ext)
-                rc = cifs_get_inode_info_unix(&newInode, full_path,
-                                              parent_dir_inode->i_sb, xid);
-        else
+        if (pTcon->unix_ext) {
+                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+                                (nd->flags & LOOKUP_OPEN)) {
+                        if (!((nd->intent.open.flags & O_CREAT) &&
+                                        (nd->intent.open.flags & O_EXCL))) {
+                                mode = nd->intent.open.create_mode &
+                                                ~current_umask();
+                                rc = cifs_posix_open(full_path, &newInode,
+                                        parent_dir_inode->i_sb, mode,
+                                        nd->intent.open.flags, &oplock,
+                                        &fileHandle, xid);
+                                /*
+                                 * This code works around a bug in
+                                 * samba posix open in samba versions 3.3.1
+                                 * and earlier where create works
+                                 * but open fails with invalid parameter.
+                                 * If either of these error codes are
+                                 * returned, follow the normal lookup.
+                                 * Otherwise, the error during posix open
+                                 * is handled.
+                                 */
+                                if ((rc != -EINVAL) && (rc != -EOPNOTSUPP))
+                                        posix_open = true;
+                        }
+                }
+                if (!posix_open)
+                        rc = cifs_get_inode_info_unix(&newInode, full_path,
+                                                parent_dir_inode->i_sb, xid);
+        } else
                 rc = cifs_get_inode_info(&newInode, full_path, NULL,
-                                         parent_dir_inode->i_sb, xid, NULL);
+                                parent_dir_inode->i_sb, xid, NULL);
 
         if ((rc == 0) && (newInode != NULL)) {
                 if (pTcon->nocase)
@@ -645,7 +693,8 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                 else
                         direntry->d_op = &cifs_dentry_ops;
                 d_add(direntry, newInode);
-
+                if (posix_open)
+                        filp = lookup_instantiate_filp(nd, direntry, NULL);
                 /* since paths are not looked up by component - the parent
                    directories are presumed to be good here */
                 renew_parental_timestamps(direntry);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 1e0c1bd8f2e4..df4a306f697e 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -78,7 +78,7 @@ dns_resolver_instantiate(struct key *key, const void *data,
         }
 
         key->type_data.x[0] = datalen;
-        rcu_assign_pointer(key->payload.data, ip);
+        key->payload.data = ip;
 
         return rc;
 }
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 81747acca4c4..50ca088d8860 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -46,7 +46,7 @@ static inline struct cifsFileInfo *cifs_init_private(
         memset(private_data, 0, sizeof(struct cifsFileInfo));
         private_data->netfid = netfid;
         private_data->pid = current->tgid;
-        init_MUTEX(&private_data->fh_sem);
+        mutex_init(&private_data->fh_mutex);
         mutex_init(&private_data->lock_mutex);
         INIT_LIST_HEAD(&private_data->llist);
         private_data->pfile = file; /* needed for writepage */
@@ -284,35 +284,32 @@ int cifs_open(struct inode *inode, struct file *file)
         cifs_sb = CIFS_SB(inode->i_sb);
         tcon = cifs_sb->tcon;
 
-        if (file->f_flags & O_CREAT) {
-                /* search inode for this file and fill in file->private_data */
-                pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-                read_lock(&GlobalSMBSeslock);
-                list_for_each(tmp, &pCifsInode->openFileList) {
-                        pCifsFile = list_entry(tmp, struct cifsFileInfo,
-                                               flist);
-                        if ((pCifsFile->pfile == NULL) &&
-                            (pCifsFile->pid == current->tgid)) {
-                                /* mode set in cifs_create */
-
-                                /* needed for writepage */
-                                pCifsFile->pfile = file;
-
-                                file->private_data = pCifsFile;
-                                break;
-                        }
-                }
-                read_unlock(&GlobalSMBSeslock);
-                if (file->private_data != NULL) {
-                        rc = 0;
-                        FreeXid(xid);
-                        return rc;
-                } else {
-                        if (file->f_flags & O_EXCL)
-                                cERROR(1, ("could not find file instance for "
-                                           "new file %p", file));
+        /* search inode for this file and fill in file->private_data */
+        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
+        read_lock(&GlobalSMBSeslock);
+        list_for_each(tmp, &pCifsInode->openFileList) {
+                pCifsFile = list_entry(tmp, struct cifsFileInfo,
+                                       flist);
+                if ((pCifsFile->pfile == NULL) &&
+                    (pCifsFile->pid == current->tgid)) {
+                        /* mode set in cifs_create */
+
+                        /* needed for writepage */
+                        pCifsFile->pfile = file;
+
+                        file->private_data = pCifsFile;
+                        break;
                 }
         }
+        read_unlock(&GlobalSMBSeslock);
+
+        if (file->private_data != NULL) {
+                rc = 0;
+                FreeXid(xid);
+                return rc;
+        } else if ((file->f_flags & O_CREAT) && (file->f_flags & O_EXCL))
+                        cERROR(1, ("could not find file instance for "
+                                   "new file %p", file));
 
         full_path = build_path_from_dentry(file->f_path.dentry);
         if (full_path == NULL) {
@@ -500,9 +497,9 @@ static int cifs_reopen_file(struct file *file, bool can_flush)
                 return -EBADF;
 
         xid = GetXid();
-        down(&pCifsFile->fh_sem);
+        mutex_unlock(&pCifsFile->fh_mutex);
         if (!pCifsFile->invalidHandle) {
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 FreeXid(xid);
                 return 0;
         }
@@ -533,7 +530,7 @@ static int cifs_reopen_file(struct file *file, bool can_flush)
         if (full_path == NULL) {
                 rc = -ENOMEM;
 reopen_error_exit:
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 FreeXid(xid);
                 return rc;
         }
@@ -575,14 +572,14 @@ reopen_error_exit:
                          cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc) {
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 cFYI(1, ("cifs_open returned 0x%x", rc));
                 cFYI(1, ("oplock: %d", oplock));
         } else {
 reopen_success:
                 pCifsFile->netfid = netfid;
                 pCifsFile->invalidHandle = false;
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 pCifsInode = CIFS_I(inode);
                 if (pCifsInode) {
                         if (can_flush) {
@@ -971,6 +968,40 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
         return rc;
 }
 
+/*
+ * Set the timeout on write requests past EOF. For some servers (Windows)
+ * these calls can be very long.
+ *
+ * If we're writing >10M past the EOF we give a 180s timeout. Anything less
+ * than that gets a 45s timeout. Writes not past EOF get 15s timeouts.
+ * The 10M cutoff is totally arbitrary. A better scheme for this would be
+ * welcome if someone wants to suggest one.
+ *
+ * We may be able to do a better job with this if there were some way to
+ * declare that a file should be sparse.
+ */
+static int
+cifs_write_timeout(struct cifsInodeInfo *cifsi, loff_t offset)
+{
+        if (offset <= cifsi->server_eof)
+                return CIFS_STD_OP;
+        else if (offset > (cifsi->server_eof + (10 * 1024 * 1024)))
+                return CIFS_VLONG_OP;
+        else
+                return CIFS_LONG_OP;
+}
+
+/* update the file size (if needed) after a write */
+static void
+cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
+                      unsigned int bytes_written)
+{
+        loff_t end_of_write = offset + bytes_written;
+
+        if (end_of_write > cifsi->server_eof)
+                cifsi->server_eof = end_of_write;
+}
+
 ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         size_t write_size, loff_t *poffset)
 {
@@ -981,6 +1012,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         struct cifsTconInfo *pTcon;
         int xid, long_op;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(file->f_path.dentry->d_inode);
 
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
 
@@ -1000,11 +1032,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
 
         xid = GetXid();
 
-        if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = CIFS_VLONG_OP; /* writes past EOF take long time */
-        else
-                long_op = CIFS_LONG_OP;
-
+        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -1048,8 +1076,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
                                 FreeXid(xid);
                                 return rc;
                         }
-                } else
+                } else {
+                        cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
+                }
                 long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
@@ -1085,6 +1115,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
         struct cifsTconInfo *pTcon;
         int xid, long_op;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(file->f_path.dentry->d_inode);
 
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
 
@@ -1099,11 +1130,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
 
         xid = GetXid();
 
-        if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = CIFS_VLONG_OP; /* writes past EOF can be slow */
-        else
-                long_op = CIFS_LONG_OP;
-
+        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -1166,8 +1193,10 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
                                 FreeXid(xid);
                                 return rc;
                         }
-                } else
+                } else {
+                        cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
+                }
                 long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
@@ -1380,11 +1409,12 @@ static int cifs_writepages(struct address_space *mapping,
         int nr_pages;
         __u64 offset = 0;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(mapping->host);
         struct page *page;
         struct pagevec pvec;
         int rc = 0;
         int scanned = 0;
-        int xid;
+        int xid, long_op;
 
         cifs_sb = CIFS_SB(mapping->host->i_sb);
 
@@ -1528,12 +1558,15 @@ retry:
                                 cERROR(1, ("No writable handles for inode"));
                                 rc = -EBADF;
                         } else {
+                                long_op = cifs_write_timeout(cifsi, offset);
                                 rc = CIFSSMBWrite2(xid, cifs_sb->tcon,
                                                    open_file->netfid,
                                                    bytes_to_write, offset,
                                                    &bytes_written, iov, n_iov,
-                                                   CIFS_LONG_OP);
+                                                   long_op);
                                 atomic_dec(&open_file->wrtPending);
+                                cifs_update_eof(cifsi, offset, bytes_written);
+
                                 if (rc || bytes_written < bytes_to_write) {
                                         cERROR(1, ("Write2 ret %d, wrote %d",
                                                   rc, bytes_written));
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f121a80fdd6f..f36b4e40e443 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -143,6 +143,7 @@ static void cifs_unix_info_to_inode(struct inode *inode,
 
         inode->i_nlink = le64_to_cpu(info->Nlinks);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /*
@@ -276,7 +277,8 @@ int cifs_get_inode_info_unix(struct inode **pinode,
 
         /* get new inode */
         if (*pinode == NULL) {
-                *pinode = cifs_new_inode(sb, &find_data.UniqueId);
+                __u64 unique_id = le64_to_cpu(find_data.UniqueId);
+                *pinode = cifs_new_inode(sb, &unique_id);
                 if (*pinode == NULL) {
                         rc = -ENOMEM;
                         goto cgiiu_exit;
@@ -605,12 +607,12 @@ int cifs_get_inode_info(struct inode **pinode,
                         inode->i_mode |= S_IFREG;
         }
 
+        cifsInfo->server_eof = le64_to_cpu(pfindData->EndOfFile);
         spin_lock(&inode->i_lock);
-        if (is_size_safe_to_change(cifsInfo,
-                                   le64_to_cpu(pfindData->EndOfFile))) {
+        if (is_size_safe_to_change(cifsInfo, cifsInfo->server_eof)) {
                 /* can not safely shrink the file size here if the
                    client is writing to it due to potential races */
-                i_size_write(inode, le64_to_cpu(pfindData->EndOfFile));
+                i_size_write(inode, cifsInfo->server_eof);
 
                 /* 512 bytes (2**9) is the fake blocksize that must be
                    used for this calculation */
@@ -1138,6 +1140,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         cFYI(1, ("posix mkdir returned 0x%x", rc));
                         d_drop(direntry);
                 } else {
+                        __u64 unique_id;
                         if (pInfo->Type == cpu_to_le32(-1)) {
                                 /* no return info, go query for it */
                                 kfree(pInfo);
@@ -1151,8 +1154,8 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         else
                                 direntry->d_op = &cifs_dentry_ops;
 
-                        newinode = cifs_new_inode(inode->i_sb,
-                                                  &pInfo->UniqueId);
+                        unique_id = le64_to_cpu(pInfo->UniqueId);
+                        newinode = cifs_new_inode(inode->i_sb, &unique_id);
                         if (newinode == NULL) {
                                 kfree(pInfo);
                                 goto mkdir_get_info;
@@ -1450,7 +1453,8 @@ int cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
                      checking the UniqueId via FILE_INTERNAL_INFO */
 
 unlink_target:
-        if ((rc == -EACCES) || (rc == -EEXIST)) {
+        /* Try unlinking the target dentry if it's not negative */
+        if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST)) {
                 tmprc = cifs_unlink(target_dir, target_dentry);
                 if (tmprc)
                         goto cifs_rename_exit;
@@ -1753,6 +1757,7 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
         }
 
         if (rc == 0) {
+                cifsInode->server_eof = attrs->ia_size;
                 rc = cifs_vmtruncate(inode, attrs->ia_size);
                 cifs_truncate_page(inode->i_mapping, inode->i_size);
         }
@@ -1792,20 +1797,21 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
                 goto out;
         }
 
-        if ((attrs->ia_valid & ATTR_MTIME) || (attrs->ia_valid & ATTR_SIZE)) {
-                /*
-                   Flush data before changing file size or changing the last
-                   write time of the file on the server. If the
-                   flush returns error, store it to report later and continue.
-                   BB: This should be smarter. Why bother flushing pages that
-                   will be truncated anyway? Also, should we error out here if
-                   the flush returns error?
-                 */
-                rc = filemap_write_and_wait(inode->i_mapping);
-                if (rc != 0) {
-                        cifsInode->write_behind_rc = rc;
-                        rc = 0;
-                }
+        /*
+         * Attempt to flush data before changing attributes. We need to do
+         * this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the
+         * ownership or mode then we may also need to do this. Here, we take
+         * the safe way out and just do the flush on all setattr requests. If
+         * the flush returns error, store it to report later and continue.
+         *
+         * BB: This should be smarter. Why bother flushing pages that
+         * will be truncated anyway? Also, should we error out here if
+         * the flush returns error?
+         */
+        rc = filemap_write_and_wait(inode->i_mapping);
+        if (rc != 0) {
+                cifsInode->write_behind_rc = rc;
+                rc = 0;
         }
 
         if (attrs->ia_valid & ATTR_SIZE) {
@@ -1903,20 +1909,21 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
                 return -ENOMEM;
         }
 
-        if ((attrs->ia_valid & ATTR_MTIME) || (attrs->ia_valid & ATTR_SIZE)) {
-                /*
-                   Flush data before changing file size or changing the last
-                   write time of the file on the server. If the
-                   flush returns error, store it to report later and continue.
-                   BB: This should be smarter. Why bother flushing pages that
-                   will be truncated anyway? Also, should we error out here if
-                   the flush returns error?
-                 */
-                rc = filemap_write_and_wait(inode->i_mapping);
-                if (rc != 0) {
-                        cifsInode->write_behind_rc = rc;
-                        rc = 0;
-                }
+        /*
+         * Attempt to flush data before changing attributes. We need to do
+         * this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the
+         * ownership or mode then we may also need to do this. Here, we take
+         * the safe way out and just do the flush on all setattr requests. If
+         * the flush returns error, store it to report later and continue.
+         *
+         * BB: This should be smarter. Why bother flushing pages that
+         * will be truncated anyway? Also, should we error out here if
+         * the flush returns error?
+         */
+        rc = filemap_write_and_wait(inode->i_mapping);
+        if (rc != 0) {
+                cifsInode->write_behind_rc = rc;
+                rc = 0;
         }
 
         if (attrs->ia_valid & ATTR_SIZE) {
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index c2c01ff4c32c..1a8be6228333 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -239,6 +239,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         if (atomic_read(&cifsInfo->inUse) == 0)
                 atomic_set(&cifsInfo->inUse, 1);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&tmp_inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /* can not safely change the file size here if the
@@ -375,6 +376,7 @@ static void unix_fill_in_inode(struct inode *tmp_inode,
                 tmp_inode->i_gid = le64_to_cpu(pfindData->Gid);
         tmp_inode->i_nlink = le64_to_cpu(pfindData->Nlinks);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&tmp_inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /* can not safely change the file size here if the
@@ -840,7 +842,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                         len = strnlen(filename, PATH_MAX);
                 }
 
-                *pinum = pFindData->UniqueId;
+                *pinum = le64_to_cpu(pFindData->UniqueId);
         } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
                 FILE_DIRECTORY_INFO *pFindData =
                         (FILE_DIRECTORY_INFO *)current_entry;
@@ -856,7 +858,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                         (SEARCH_ID_FULL_DIR_INFO *)current_entry;
                 filename = &pFindData->FileName[0];
                 len = le32_to_cpu(pFindData->FileNameLength);
-                *pinum = pFindData->UniqueId;
+                *pinum = le64_to_cpu(pFindData->UniqueId);
         } else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
                 FILE_BOTH_DIRECTORY_INFO *pFindData =
                         (FILE_BOTH_DIRECTORY_INFO *)current_entry;
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 5c68b4282be9..c652c73760dd 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -285,35 +285,36 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         int words_left, len;
         char *data = *pbcc_area;
 
-
-
         cFYI(1, ("bleft %d", bleft));
 
-
-        /* SMB header is unaligned, so cifs servers word align start of
-           Unicode strings */
-        data++;
-        bleft--; /* Windows servers do not always double null terminate
-                    their final Unicode string - in which case we
-                    now will not attempt to decode the byte of junk
-                    which follows it */
+        /*
+         * Windows servers do not always double null terminate their final
+         * Unicode string. Check to see if there are an uneven number of bytes
+         * left. If so, then add an extra NULL pad byte to the end of the
+         * response.
+         *
+         * See section 2.7.2 in "Implementing CIFS" for details
+         */
+        if (bleft % 2) {
+                data[bleft] = 0;
+                ++bleft;
+        }
 
         words_left = bleft / 2;
 
         /* save off server operating system */
         len = UniStrnlen((wchar_t *) data, words_left);
 
-/* We look for obvious messed up bcc or strings in response so we do not go off
-   the end since (at least) WIN2K and Windows XP have a major bug in not null
-   terminating last Unicode string in response  */
         if (len >= words_left)
                 return rc;
 
         kfree(ses->serverOS);
         /* UTF-8 string will not grow more than four times as big as UCS-16 */
         ses->serverOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
-        if (ses->serverOS != NULL)
+        if (ses->serverOS != NULL) {
                 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp);
+                cFYI(1, ("serverOS=%s", ses->serverOS));
+        }
         data += 2 * (len + 1);
         words_left -= len + 1;
 
@@ -328,6 +329,7 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         if (ses->serverNOS != NULL) {
                 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
                                    nls_cp);
+                cFYI(1, ("serverNOS=%s", ses->serverNOS));
                 if (strncmp(ses->serverNOS, "NT LAN Manager 4", 16) == 0) {
                         cFYI(1, ("NT4 server"));
                         ses->flags |= CIFS_SES_NT4;
@@ -343,12 +345,11 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
                 return rc;
 
         kfree(ses->serverDomain);
-        ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
+        ses->serverDomain = kzalloc((4 * len) + 2, GFP_KERNEL);
         if (ses->serverDomain != NULL) {
                 cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
                                    nls_cp);
-                ses->serverDomain[2*len] = 0;
-                ses->serverDomain[(2*len) + 1] = 0;
+                cFYI(1, ("serverDomain=%s", ses->serverDomain));
         }
         data += 2 * (len + 1);
         words_left -= len + 1;
@@ -702,12 +703,18 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
         }
 
         /* BB check if Unicode and decode strings */
-        if (smb_buf->Flags2 & SMBFLG2_UNICODE)
+        if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+                /* unicode string area must be word-aligned */
+                if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
+                        ++bcc_ptr;
+                        --bytes_remaining;
+                }
                 rc = decode_unicode_ssetup(&bcc_ptr, bytes_remaining,
-                                                   ses, nls_cp);
-        else
+                                           ses, nls_cp);
+        } else {
                 rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining,
                                          ses, nls_cp);
+        }
 
 ssetup_exit:
         if (spnego_key) {
diff --git a/fs/compat.c b/fs/compat.c
index 3f84d5f15889..379a399bf5c3 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -181,22 +181,24 @@ asmlinkage long compat_sys_newstat(char __user * filename,
                 struct compat_stat __user *statbuf)
 {
         struct kstat stat;
-        int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_compat_stat(&stat, statbuf);
-        return error;
+        error = vfs_stat(filename, &stat);
+        if (error)
+                return error;
+        return cp_compat_stat(&stat, statbuf);
 }
 
 asmlinkage long compat_sys_newlstat(char __user * filename,
                 struct compat_stat __user *statbuf)
 {
         struct kstat stat;
-        int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_compat_stat(&stat, statbuf);
-        return error;
+        error = vfs_lstat(filename, &stat);
+        if (error)
+                return error;
+        return cp_compat_stat(&stat, statbuf);
 }
 
 #ifndef __ARCH_WANT_STAT64
@@ -204,21 +206,12 @@ asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user *filename,
                 struct compat_stat __user *statbuf, int flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_compat_stat(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_compat_stat(&stat, statbuf);
 }
 #endif
 
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 3e87ce443ea2..b83f6bcfa51a 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -58,7 +58,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c-dev.h>
 #include <linux/atalk.h>
-#include <linux/loop.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci.h>
@@ -68,6 +67,7 @@
 #include <linux/gigaset_dev.h>
 
 #ifdef CONFIG_BLOCK
+#include <linux/loop.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_ioctl.h>
 #include <scsi/sg.h>
@@ -2660,6 +2660,8 @@ HANDLE_IOCTL(SONET_GETFRAMING, do_atm_ioctl)
 HANDLE_IOCTL(SONET_GETFRSENSE, do_atm_ioctl)
 /* block stuff */
 #ifdef CONFIG_BLOCK
+/* loop */
+IGNORE_IOCTL(LOOP_CLR_FD)
 /* Raw devices */
 HANDLE_IOCTL(RAW_SETBIND, raw_ioctl)
 HANDLE_IOCTL(RAW_GETBIND, raw_ioctl)
@@ -2728,9 +2730,6 @@ HANDLE_IOCTL(LPSETTIMEOUT, lp_timeout_trans)
 IGNORE_IOCTL(VFAT_IOCTL_READDIR_BOTH32)
 IGNORE_IOCTL(VFAT_IOCTL_READDIR_SHORT32)
 
-/* loop */
-IGNORE_IOCTL(LOOP_CLR_FD)
-
 #ifdef CONFIG_SPARC
 /* Sparc framebuffers, handled in sbusfb_compat_ioctl() */
 IGNORE_IOCTL(FBIOGTYPE)
diff --git a/fs/dcache.c b/fs/dcache.c
index 761d30be2683..1fcffebfb44f 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2149,7 +2149,6 @@ int is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
         int result;
         unsigned long seq;
 
-        /* FIXME: This is old behavior, needed? Please check callers. */
         if (new_dentry == old_dentry)
                 return 1;
 
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index a67fea655f49..dda3c58eefc0 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -418,18 +418,13 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
 
         if (count == 0)
                 goto out;
-        data = kmalloc(count, GFP_KERNEL);
-        if (!data) {
-                printk(KERN_ERR "%s: Out of memory whilst attempting to "
-                       "kmalloc([%zd], GFP_KERNEL)\n", __func__, count);
+
+        data = memdup_user(buf, count);
+        if (IS_ERR(data)) {
+                printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
+                       __func__, PTR_ERR(data));
                 goto out;
         }
-        rc = copy_from_user(data, buf, count);
-        if (rc) {
-                printk(KERN_ERR "%s: copy_from_user returned error [%d]\n",
-                       __func__, rc);
-                goto out_free;
-        }
         sz = count;
         i = 0;
         switch (data[i++]) {
diff --git a/fs/filesystems.c b/fs/filesystems.c
index 1aa70260e6d1..a24c58e181db 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -199,7 +199,7 @@ SYSCALL_DEFINE3(sysfs, int, option, unsigned long, arg1, unsigned long, arg2)
         return retval;
 }
 
-int get_filesystem_list(char * buf)
+int __init get_filesystem_list(char *buf)
 {
         int len = 0;
         struct file_system_type * tmp;
diff --git a/fs/namei.c b/fs/namei.c
index b8433ebfae05..78f253cd2d4f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1248,6 +1248,8 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
         int err;
         struct qstr this;
 
+        WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
+
         err = __lookup_one_len(name, &this, base, len);
         if (err)
                 return ERR_PTR(err);
diff --git a/fs/namespace.c b/fs/namespace.c
index c6f54e4c4290..41196209a906 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1377,7 +1377,7 @@ static int attach_recursive_mnt(struct vfsmount *source_mnt,
         if (parent_path) {
                 detach_mnt(source_mnt, parent_path);
                 attach_mnt(source_mnt, path);
-                touch_mnt_namespace(current->nsproxy->mnt_ns);
+                touch_mnt_namespace(parent_path->mnt->mnt_ns);
         } else {
                 mnt_set_mountpoint(dest_mnt, dest_dentry, source_mnt);
                 commit_tree(source_mnt);
@@ -1920,8 +1920,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
         if (data_page)
                 ((char *)data_page)[PAGE_SIZE - 1] = 0;
 
-        /* Default to relatime */
-        mnt_flags |= MNT_RELATIME;
+        /* Default to relatime unless overriden */
+        if (!(flags & MS_NOATIME))
+                mnt_flags |= MNT_RELATIME;
 
         /* Separate the per-mountpoint flags */
         if (flags & MS_NOSUID)
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
index f54360f50a9c..fa038df63ac8 100644
--- a/fs/ncpfs/ioctl.c
+++ b/fs/ncpfs/ioctl.c
@@ -660,13 +660,10 @@ outrel:
                         if (user.object_name_len > NCP_OBJECT_NAME_MAX_LEN)
                                 return -ENOMEM;
                         if (user.object_name_len) {
-                                newname = kmalloc(user.object_name_len, GFP_USER);
-                                if (!newname)
-                                        return -ENOMEM;
-                                if (copy_from_user(newname, user.object_name, user.object_name_len)) {
-                                        kfree(newname);
-                                        return -EFAULT;
-                                }
+                                newname = memdup_user(user.object_name,
+                                                      user.object_name_len);
+                                if (IS_ERR(newname))
+                                        return PTR_ERR(newname);
                         } else {
                                 newname = NULL;
                         }
@@ -760,13 +757,9 @@ outrel:
                         if (user.len > NCP_PRIVATE_DATA_MAX_LEN)
                                 return -ENOMEM;
                         if (user.len) {
-                                new = kmalloc(user.len, GFP_USER);
-                                if (!new)
-                                        return -ENOMEM;
-                                if (copy_from_user(new, user.data, user.len)) {
-                                        kfree(new);
-                                        return -EFAULT;
-                                }
+                                new = memdup_user(user.data, user.len);
+                                if (IS_ERR(new))
+                                        return PTR_ERR(new);
                         } else {
                                 new = NULL;
                         }
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index e6a1932c7110..35869a4921f1 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -713,7 +713,8 @@ nfs3_xdr_setaclargs(struct rpc_rqst *req, __be32 *p,
         if (args->npages != 0)
                 xdr_encode_pages(buf, args->pages, 0, args->len);
         else
-                req->rq_slen += args->len;
+                req->rq_slen = xdr_adjust_iovec(req->rq_svec,
+                                p + XDR_QUADLEN(args->len));
 
         err = nfsacl_encode(buf, base, args->inode,
                             (args->mask & NFS_ACL) ?
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 3444c0052a87..5275097a7565 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -229,21 +229,23 @@ nfsd4_list_rec_dir(struct dentry *dir, recdir_func *f)
                 goto out;
         status = vfs_readdir(filp, nfsd4_build_namelist, &names);
         fput(filp);
+        mutex_lock(&dir->d_inode->i_mutex);
         while (!list_empty(&names)) {
                 entry = list_entry(names.next, struct name_list, list);
 
                 dentry = lookup_one_len(entry->name, dir, HEXDIR_LEN-1);
                 if (IS_ERR(dentry)) {
                         status = PTR_ERR(dentry);
-                        goto out;
+                        break;
                 }
                 status = f(dir, dentry);
                 dput(dentry);
                 if (status)
-                        goto out;
+                        break;
                 list_del(&entry->list);
                 kfree(entry);
         }
+        mutex_unlock(&dir->d_inode->i_mutex);
 out:
         while (!list_empty(&names)) {
                 entry = list_entry(names.next, struct name_list, list);
@@ -255,36 +257,6 @@ out:
 }
 
 static int
-nfsd4_remove_clid_file(struct dentry *dir, struct dentry *dentry)
-{
-        int status;
-
-        if (!S_ISREG(dir->d_inode->i_mode)) {
-                printk("nfsd4: non-file found in client recovery directory\n");
-                return -EINVAL;
-        }
-        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        status = vfs_unlink(dir->d_inode, dentry);
-        mutex_unlock(&dir->d_inode->i_mutex);
-        return status;
-}
-
-static int
-nfsd4_clear_clid_dir(struct dentry *dir, struct dentry *dentry)
-{
-        int status;
-
-        /* For now this directory should already be empty, but we empty it of
-         * any regular files anyway, just in case the directory was created by
-         * a kernel from the future.... */
-        nfsd4_list_rec_dir(dentry, nfsd4_remove_clid_file);
-        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        status = vfs_rmdir(dir->d_inode, dentry);
-        mutex_unlock(&dir->d_inode->i_mutex);
-        return status;
-}
-
-static int
 nfsd4_unlink_clid_dir(char *name, int namlen)
 {
         struct dentry *dentry;
@@ -294,18 +266,18 @@ nfsd4_unlink_clid_dir(char *name, int namlen)
 
         mutex_lock(&rec_dir.dentry->d_inode->i_mutex);
         dentry = lookup_one_len(name, rec_dir.dentry, namlen);
-        mutex_unlock(&rec_dir.dentry->d_inode->i_mutex);
         if (IS_ERR(dentry)) {
                 status = PTR_ERR(dentry);
-                return status;
+                goto out_unlock;
         }
         status = -ENOENT;
         if (!dentry->d_inode)
                 goto out;
-
-        status = nfsd4_clear_clid_dir(rec_dir.dentry, dentry);
+        status = vfs_rmdir(rec_dir.dentry->d_inode, dentry);
 out:
         dput(dentry);
+out_unlock:
+        mutex_unlock(&rec_dir.dentry->d_inode->i_mutex);
         return status;
 }
 
@@ -348,7 +320,7 @@ purge_old(struct dentry *parent, struct dentry *child)
         if (nfs4_has_reclaimed_state(child->d_name.name, false))
                 return 0;
 
-        status = nfsd4_clear_clid_dir(parent, child);
+        status = vfs_rmdir(parent->d_inode, child);
         if (status)
                 printk("failed to remove client recovery directory %s\n",
                                 child->d_name.name);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index ab93fcfef254..6c68ffd6b4bb 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -116,10 +116,15 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
         }
         if ((exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
                 /* successfully crossed mount point */
-                exp_put(exp);
-                *expp = exp2;
+                /*
+                 * This is subtle: dentry is *not* under mnt at this point.
+                 * The only reason we are safe is that original mnt is pinned
+                 * down by exp, so we should dput before putting exp.
+                 */
                 dput(dentry);
                 *dpp = mounts;
+                exp_put(exp);
+                *expp = exp2;
         } else {
                 exp_put(exp2);
                 dput(mounts);
@@ -1885,8 +1890,8 @@ static int nfsd_buffered_filldir(void *__buf, const char *name, int namlen,
         return 0;
 }
 
-static int nfsd_buffered_readdir(struct file *file, filldir_t func,
-                                 struct readdir_cd *cdp, loff_t *offsetp)
+static __be32 nfsd_buffered_readdir(struct file *file, filldir_t func,
+                                    struct readdir_cd *cdp, loff_t *offsetp)
 {
         struct readdir_data buf;
         struct buffered_dirent *de;
@@ -1896,11 +1901,12 @@ static int nfsd_buffered_readdir(struct file *file, filldir_t func,
 
         buf.dirent = (void *)__get_free_page(GFP_KERNEL);
         if (!buf.dirent)
-                return -ENOMEM;
+                return nfserrno(-ENOMEM);
 
         offset = *offsetp;
 
         while (1) {
+                struct inode *dir_inode = file->f_path.dentry->d_inode;
                 unsigned int reclen;
 
                 cdp->err = nfserr_eof; /* will be cleared on successful read */
@@ -1919,26 +1925,38 @@ static int nfsd_buffered_readdir(struct file *file, filldir_t func,
                 if (!size)
                         break;
 
+                /*
+                 * Various filldir functions may end up calling back into
+                 * lookup_one_len() and the file system's ->lookup() method.
+                 * These expect i_mutex to be held, as it would within readdir.
+                 */
+                host_err = mutex_lock_killable(&dir_inode->i_mutex);
+                if (host_err)
+                        break;
+
                 de = (struct buffered_dirent *)buf.dirent;
                 while (size > 0) {
                         offset = de->offset;
 
                         if (func(cdp, de->name, de->namlen, de->offset,
                                  de->ino, de->d_type))
-                                goto done;
+                                break;
 
                         if (cdp->err != nfs_ok)
-                                goto done;
+                                break;
 
                         reclen = ALIGN(sizeof(*de) + de->namlen,
                                        sizeof(u64));
                         size -= reclen;
                         de = (struct buffered_dirent *)((char *)de + reclen);
                 }
+                mutex_unlock(&dir_inode->i_mutex);
+                if (size > 0) /* We bailed out early */
+                        break;
+
                 offset = vfs_llseek(file, 0, SEEK_CUR);
         }
 
- done:
         free_page((unsigned long)(buf.dirent));
 
         if (host_err)
diff --git a/fs/stat.c b/fs/stat.c
index 2db740a0cfb5..075694e31d8b 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -55,59 +55,54 @@ int vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
 
 EXPORT_SYMBOL(vfs_getattr);
 
-int vfs_stat_fd(int dfd, char __user *name, struct kstat *stat)
+int vfs_fstat(unsigned int fd, struct kstat *stat)
 {
-        struct path path;
-        int error;
+        struct file *f = fget(fd);
+        int error = -EBADF;
 
-        error = user_path_at(dfd, name, LOOKUP_FOLLOW, &path);
-        if (!error) {
-                error = vfs_getattr(path.mnt, path.dentry, stat);
-                path_put(&path);
+        if (f) {
+                error = vfs_getattr(f->f_path.mnt, f->f_path.dentry, stat);
+                fput(f);
         }
         return error;
 }
+EXPORT_SYMBOL(vfs_fstat);
 
-int vfs_stat(char __user *name, struct kstat *stat)
+int vfs_fstatat(int dfd, char __user *filename, struct kstat *stat, int flag)
 {
-        return vfs_stat_fd(AT_FDCWD, name, stat);
-}
+        struct path path;
+        int error = -EINVAL;
+        int lookup_flags = 0;
 
-EXPORT_SYMBOL(vfs_stat);
+        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
+                goto out;
 
-int vfs_lstat_fd(int dfd, char __user *name, struct kstat *stat)
-{
-        struct path path;
-        int error;
+        if (!(flag & AT_SYMLINK_NOFOLLOW))
+                lookup_flags |= LOOKUP_FOLLOW;
 
-        error = user_path_at(dfd, name, 0, &path);
-        if (!error) {
-                error = vfs_getattr(path.mnt, path.dentry, stat);
-                path_put(&path);
-        }
+        error = user_path_at(dfd, filename, lookup_flags, &path);
+        if (error)
+                goto out;
+
+        error = vfs_getattr(path.mnt, path.dentry, stat);
+        path_put(&path);
+out:
         return error;
 }
+EXPORT_SYMBOL(vfs_fstatat);
 
-int vfs_lstat(char __user *name, struct kstat *stat)
+int vfs_stat(char __user *name, struct kstat *stat)
 {
-        return vfs_lstat_fd(AT_FDCWD, name, stat);
+        return vfs_fstatat(AT_FDCWD, name, stat, 0);
 }
+EXPORT_SYMBOL(vfs_stat);
 
-EXPORT_SYMBOL(vfs_lstat);
-
-int vfs_fstat(unsigned int fd, struct kstat *stat)
+int vfs_lstat(char __user *name, struct kstat *stat)
 {
-        struct file *f = fget(fd);
-        int error = -EBADF;
-
-        if (f) {
-                error = vfs_getattr(f->f_path.mnt, f->f_path.dentry, stat);
-                fput(f);
-        }
-        return error;
+        return vfs_fstatat(AT_FDCWD, name, stat, AT_SYMLINK_NOFOLLOW);
 }
+EXPORT_SYMBOL(vfs_lstat);
 
-EXPORT_SYMBOL(vfs_fstat);
 
 #ifdef __ARCH_WANT_OLD_STAT
 
@@ -155,23 +150,25 @@ static int cp_old_stat(struct kstat *stat, struct __old_kernel_stat __user * sta
 SYSCALL_DEFINE2(stat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_old_stat(&stat, statbuf);
+        error = vfs_stat(filename, &stat);
+        if (error)
+                return error;
 
-        return error;
+        return cp_old_stat(&stat, statbuf);
 }
 
 SYSCALL_DEFINE2(lstat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_old_stat(&stat, statbuf);
+        error = vfs_lstat(filename, &stat);
+        if (error)
+                return error;
 
-        return error;
+        return cp_old_stat(&stat, statbuf);
 }
 
 SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, statbuf)
@@ -240,23 +237,23 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
 SYSCALL_DEFINE2(newstat, char __user *, filename, struct stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
-
-        if (!error)
-                error = cp_new_stat(&stat, statbuf);
+        int error = vfs_stat(filename, &stat);
 
-        return error;
+        if (error)
+                return error;
+        return cp_new_stat(&stat, statbuf);
 }
 
 SYSCALL_DEFINE2(newlstat, char __user *, filename, struct stat __user *, statbuf)
 {
         struct kstat stat;
-        int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
-        if (!error)
-                error = cp_new_stat(&stat, statbuf);
+        error = vfs_lstat(filename, &stat);
+        if (error)
+                return error;
 
-        return error;
+        return cp_new_stat(&stat, statbuf);
 }
 
 #if !defined(__ARCH_WANT_STAT64) || defined(__ARCH_WANT_SYS_NEWFSTATAT)
@@ -264,21 +261,12 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, char __user *, filename,
                 struct stat __user *, statbuf, int, flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_new_stat(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_new_stat(&stat, statbuf);
 }
 #endif
 
@@ -404,21 +392,12 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, char __user *, filename,
                 struct stat64 __user *, statbuf, int, flag)
 {
         struct kstat stat;
-        int error = -EINVAL;
-
-        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
-                goto out;
-
-        if (flag & AT_SYMLINK_NOFOLLOW)
-                error = vfs_lstat_fd(dfd, filename, &stat);
-        else
-                error = vfs_stat_fd(dfd, filename, &stat);
-
-        if (!error)
-                error = cp_new_stat64(&stat, statbuf);
+        int error;
 
-out:
-        return error;
+        error = vfs_fstatat(dfd, filename, &stat, flag);
+        if (error)
+                return error;
+        return cp_new_stat64(&stat, statbuf);
 }
 #endif /* __ARCH_WANT_STAT64 */
 
diff --git a/fs/sysfs/bin.c b/fs/sysfs/bin.c
index 93e0c0281d45..9345806c8853 100644
--- a/fs/sysfs/bin.c
+++ b/fs/sysfs/bin.c
@@ -157,14 +157,9 @@ static ssize_t write(struct file *file, const char __user *userbuf,
                         count = size - offs;
         }
 
-        temp = kmalloc(count, GFP_KERNEL);
-        if (!temp)
-                return -ENOMEM;
-
-        if (copy_from_user(temp, userbuf, count)) {
-                count = -EFAULT;
-                goto out_free;
-        }
+        temp = memdup_user(userbuf, count);
+        if (IS_ERR(temp))
+                return PTR_ERR(temp);
 
         mutex_lock(&bb->mutex);
 
@@ -176,8 +171,6 @@ static ssize_t write(struct file *file, const char __user *userbuf,
         if (count > 0)
                 *off = offs + count;
 
-out_free:
-        kfree(temp);
         return count;
 }
 
diff --git a/fs/xattr.c b/fs/xattr.c
index 197c4fcac032..d51b8f9db921 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -237,13 +237,9 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
         if (size) {
                 if (size > XATTR_SIZE_MAX)
                         return -E2BIG;
-                kvalue = kmalloc(size, GFP_KERNEL);
-                if (!kvalue)
-                        return -ENOMEM;
-                if (copy_from_user(kvalue, value, size)) {
-                        kfree(kvalue);
-                        return -EFAULT;
-                }
+                kvalue = memdup_user(value, size);
+                if (IS_ERR(kvalue))
+                        return PTR_ERR(kvalue);
         }
 
         error = vfs_setxattr(d, kname, kvalue, size, flags);
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index d0b499418a7d..34eaab608e6e 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -489,17 +489,12 @@ xfs_attrmulti_attr_set(
         if (len > XATTR_SIZE_MAX)
                 return EINVAL;
 
-        kbuf = kmalloc(len, GFP_KERNEL);
-        if (!kbuf)
-                return ENOMEM;
-
-        if (copy_from_user(kbuf, ubuf, len))
-                goto out_kfree;
+        kbuf = memdup_user(ubuf, len);
+        if (IS_ERR(kbuf))
+                return PTR_ERR(kbuf);
 
         error = xfs_attr_set(XFS_I(inode), name, kbuf, len, flags);
 
- out_kfree:
-        kfree(kbuf);
         return error;
 }
 
@@ -540,20 +535,16 @@ xfs_attrmulti_by_handle(
         if (!size || size > 16 * PAGE_SIZE)
                 goto out_dput;
 
-        error = ENOMEM;
-        ops = kmalloc(size, GFP_KERNEL);
-        if (!ops)
+        ops = memdup_user(am_hreq.ops, size);
+        if (IS_ERR(ops)) {
+                error = PTR_ERR(ops);
                 goto out_dput;
-
-        error = EFAULT;
-        if (copy_from_user(ops, am_hreq.ops, size))
-                goto out_kfree_ops;
+        }
 
         attr_name = kmalloc(MAXNAMELEN, GFP_KERNEL);
         if (!attr_name)
                 goto out_kfree_ops;
 
-
         error = 0;
         for (i = 0; i < am_hreq.opcount; i++) {
                 ops[i].am_error = strncpy_from_user(attr_name,
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index c70c4e3db790..0882d166239a 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -427,20 +427,16 @@ xfs_compat_attrmulti_by_handle(
         if (!size || size > 16 * PAGE_SIZE)
                 goto out_dput;
 
-        error = ENOMEM;
-        ops = kmalloc(size, GFP_KERNEL);
-        if (!ops)
+        ops = memdup_user(compat_ptr(am_hreq.ops), size);
+        if (IS_ERR(ops)) {
+                error = PTR_ERR(ops);
                 goto out_dput;
-
-        error = EFAULT;
-        if (copy_from_user(ops, compat_ptr(am_hreq.ops), size))
-                goto out_kfree_ops;
+        }
 
         attr_name = kmalloc(MAXNAMELEN, GFP_KERNEL);
         if (!attr_name)
                 goto out_kfree_ops;
 
-
         error = 0;
         for (i = 0; i < am_hreq.opcount; i++) {
                 ops[i].am_error = strncpy_from_user(attr_name,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index e766be0d4329..5bed436f4353 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2299,9 +2299,8 @@ extern int vfs_readdir(struct file *, filldir_t, void *);
 
 extern int vfs_stat(char __user *, struct kstat *);
 extern int vfs_lstat(char __user *, struct kstat *);
-extern int vfs_stat_fd(int dfd, char __user *, struct kstat *);
-extern int vfs_lstat_fd(int dfd, char __user *, struct kstat *);
 extern int vfs_fstat(unsigned int, struct kstat *);
+extern int vfs_fstatat(int , char __user *, struct kstat *, int);
 
 extern int do_vfs_ioctl(struct file *filp, unsigned int fd, unsigned int cmd,
                     unsigned long arg);
@@ -2449,7 +2448,7 @@ struct ctl_table;
 int proc_nr_files(struct ctl_table *table, int write, struct file *filp,
                   void __user *buffer, size_t *lenp, loff_t *ppos);
 
-int get_filesystem_list(char * buf);
+int __init get_filesystem_list(char *buf);
 
 #endif /* __KERNEL__ */
 #endif /* _LINUX_FS_H */
diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
index 5621d87c4479..6b361d23a499 100644
--- a/include/linux/reiserfs_fs_sb.h
+++ b/include/linux/reiserfs_fs_sb.h
@@ -193,7 +193,7 @@ struct reiserfs_journal {
         atomic_t j_wcount;      /* count of writers for current commit */
         unsigned long j_bcount; /* batch count. allows turning X transactions into 1 */
         unsigned long j_first_unflushed_offset; /* first unflushed transactions offset */
-        unsigned long j_last_flush_trans_id;    /* last fully flushed journal timestamp */
+        unsigned j_last_flush_trans_id; /* last fully flushed journal timestamp */
         struct buffer_head *j_header_bh;
 
         time_t j_trans_start_time;      /* time this transaction started */
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index 262a8dccfa81..167c33361d9c 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -21,6 +21,8 @@ extern long prctl_set_seccomp(unsigned long);
 
 #else /* CONFIG_SECCOMP */
 
+#include <linux/errno.h>
+
 typedef struct { } seccomp_t;
 
 #define secure_computing(x) do { } while (0)
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 3e3a4364cbff..795032edfc46 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -58,10 +58,17 @@ typedef int __bitwise suspend_state_t;
  *      by @begin().
  *      @prepare() is called right after devices have been suspended (ie. the
  *      appropriate .suspend() method has been executed for each device) and
- *      before the nonboot CPUs are disabled (it is executed with IRQs enabled).
- *      This callback is optional.  It returns 0 on success or a negative
- *      error code otherwise, in which case the system cannot enter the desired
- *      sleep state (@enter() and @finish() will not be called in that case).
+ *      before device drivers' late suspend callbacks are executed.  It returns
+ *      0 on success or a negative error code otherwise, in which case the
+ *      system cannot enter the desired sleep state (@prepare_late(), @enter(),
+ *      @wake(), and @finish() will not be called in that case).
+ *
+ * @prepare_late: Finish preparing the platform for entering the system sleep
+ *      state indicated by @begin().
+ *      @prepare_late is called before disabling nonboot CPUs and after
+ *      device drivers' late suspend callbacks have been executed.  It returns
+ *      0 on success or a negative error code otherwise, in which case the
+ *      system cannot enter the desired sleep state (@enter() and @wake()).
  *
  * @enter: Enter the system sleep state indicated by @begin() or represented by
  *      the argument if @begin() is not implemented.
@@ -69,19 +76,26 @@ typedef int __bitwise suspend_state_t;
  *      error code otherwise, in which case the system cannot enter the desired
  *      sleep state.
  *
- * @finish: Called when the system has just left a sleep state, right after
- *      the nonboot CPUs have been enabled and before devices are resumed (it is
- *      executed with IRQs enabled).
+ * @wake: Called when the system has just left a sleep state, right after
+ *      the nonboot CPUs have been enabled and before device drivers' early
+ *      resume callbacks are executed.
+ *      This callback is optional, but should be implemented by the platforms
+ *      that implement @prepare_late().  If implemented, it is always called
+ *      after @enter(), even if @enter() fails.
+ *
+ * @finish: Finish wake-up of the platform.
+ *      @finish is called right prior to calling device drivers' regular suspend
+ *      callbacks.
  *      This callback is optional, but should be implemented by the platforms
  *      that implement @prepare().  If implemented, it is always called after
- *      @enter() (even if @enter() fails).
+ *      @enter() and @wake(), if implemented, even if any of them fails.
  *
  * @end: Called by the PM core right after resuming devices, to indicate to
  *      the platform that the system has returned to the working state or
  *      the transition to the sleep state has been aborted.
  *      This callback is optional, but should be implemented by the platforms
- *      that implement @begin(), but platforms implementing @begin() should
- *      also provide a @end() which cleans up transitions aborted before
+ *      that implement @begin().  Accordingly, platforms implementing @begin()
+ *      should also provide a @end() which cleans up transitions aborted before
  *      @enter().
  *
  * @recover: Recover the platform from a suspend failure.
@@ -93,7 +107,9 @@ struct platform_suspend_ops {
         int (*valid)(suspend_state_t state);
         int (*begin)(suspend_state_t state);
         int (*prepare)(void);
+        int (*prepare_late)(void);
         int (*enter)(suspend_state_t state);
+        void (*wake)(void);
         void (*finish)(void);
         void (*end)(void);
         void (*recover)(void);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index dabe4ad89141..40617c1d8976 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -148,7 +148,7 @@ struct old_linux_dirent;
         asm ("\t.globl " #alias "\n\t.set " #alias ", " #name "\n"      \
              "\t.globl ." #alias "\n\t.set ." #alias ", ." #name)
 #else
-#ifdef CONFIG_ALPHA
+#if defined(CONFIG_ALPHA) || defined(CONFIG_MIPS)
 #define SYSCALL_ALIAS(alias, name)                                      \
         asm ( #alias " = " #name "\n\t.globl " #alias)
 #else
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 917ab9525568..6e7351739a82 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -734,9 +734,6 @@ int audit_tag_tree(char *old, char *new)
         dentry = dget(path.dentry);
         path_put(&path);
 
-        if (dentry == tagged->mnt_root && dentry == mnt->mnt_root)
-                follow_up(&mnt, &dentry);
-
         list_add_tail(&list, &tagged->mnt_list);
 
         mutex_lock(&audit_filter_mutex);
diff --git a/kernel/power/main.c b/kernel/power/main.c
index f172f41858bb..f99ed6a75eac 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -291,20 +291,26 @@ static int suspend_enter(suspend_state_t state)
 
         device_pm_lock();
 
+        if (suspend_ops->prepare) {
+                error = suspend_ops->prepare();
+                if (error)
+                        goto Done;
+        }
+
         error = device_power_down(PMSG_SUSPEND);
         if (error) {
                 printk(KERN_ERR "PM: Some devices failed to power down\n");
-                goto Done;
+                goto Platfrom_finish;
         }
 
-        if (suspend_ops->prepare) {
-                error = suspend_ops->prepare();
+        if (suspend_ops->prepare_late) {
+                error = suspend_ops->prepare_late();
                 if (error)
                         goto Power_up_devices;
         }
 
         if (suspend_test(TEST_PLATFORM))
-                goto Platfrom_finish;
+                goto Platform_wake;
 
         error = disable_nonboot_cpus();
         if (error || suspend_test(TEST_CPUS))
@@ -326,13 +332,17 @@ static int suspend_enter(suspend_state_t state)
  Enable_cpus:
         enable_nonboot_cpus();
 
- Platfrom_finish:
-        if (suspend_ops->finish)
-                suspend_ops->finish();
+ Platform_wake:
+        if (suspend_ops->wake)
+                suspend_ops->wake();
 
  Power_up_devices:
         device_power_up(PMSG_RESUME);
 
+ Platfrom_finish:
+        if (suspend_ops->finish)
+                suspend_ops->finish();
+
  Done:
         device_pm_unlock();
 
diff --git a/kernel/resource.c b/kernel/resource.c
index fd5d7d574bb9..ac5f3a36923f 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -533,43 +533,21 @@ static void __init __reserve_region_with_split(struct resource *root,
         res->end = end;
         res->flags = IORESOURCE_BUSY;
 
-        for (;;) {
-                conflict = __request_resource(parent, res);
-                if (!conflict)
-                        break;
-                if (conflict != parent) {
-                        parent = conflict;
-                        if (!(conflict->flags & IORESOURCE_BUSY))
-                                continue;
-                }
-
-                /* Uhhuh, that didn't work out.. */
-                kfree(res);
-                res = NULL;
-                break;
-        }
-
-        if (!res) {
-                /* failed, split and try again */
-
-                /* conflict covered whole area */
-                if (conflict->start <= start && conflict->end >= end)
-                        return;
+        conflict = __request_resource(parent, res);
+        if (!conflict)
+                return;
 
-                if (conflict->start > start)
-                        __reserve_region_with_split(root, start, conflict->start-1, name);
-                if (!(conflict->flags & IORESOURCE_BUSY)) {
-                        resource_size_t common_start, common_end;
+        /* failed, split and try again */
+        kfree(res);
 
-                        common_start = max(conflict->start, start);
-                        common_end = min(conflict->end, end);
-                        if (common_start < common_end)
-                                __reserve_region_with_split(root, common_start, common_end, name);
-                }
-                if (conflict->end < end)
-                        __reserve_region_with_split(root, conflict->end+1, end, name);
-        }
+        /* conflict covered whole area */
+        if (conflict->start <= start && conflict->end >= end)
+                return;
 
+        if (conflict->start > start)
+                __reserve_region_with_split(root, start, conflict->start-1, name);
+        if (conflict->end < end)
+                __reserve_region_with_split(root, conflict->end+1, end, name);
 }
 
 void __init reserve_region_with_split(struct resource *root,
diff --git a/lib/kobject.c b/lib/kobject.c
index a6dec32f2ddd..bacf6fe4f7a0 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -218,6 +218,9 @@ int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
         const char *old_name = kobj->name;
         char *s;
 
+        if (kobj->name && !fmt)
+                return 0;
+
         kobj->name = kvasprintf(GFP_KERNEL, fmt, vargs);
         if (!kobj->name)
                 return -ENOMEM;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 39fdfb14eeaa..99155b7b8123 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2088,13 +2088,13 @@ static void shrink_all_zones(unsigned long nr_pages, int prio,
                                 nr_reclaimed += shrink_list(l, nr_to_scan, zone,
                                                                 sc, prio);
                                 if (nr_reclaimed >= nr_pages) {
-                                        sc->nr_reclaimed = nr_reclaimed;
+                                        sc->nr_reclaimed += nr_reclaimed;
                                         return;
                                 }
                         }
                 }
         }
-        sc->nr_reclaimed = nr_reclaimed;
+        sc->nr_reclaimed += nr_reclaimed;
 }
 
 /*
@@ -2115,6 +2115,7 @@ unsigned long shrink_all_memory(unsigned long nr_pages)
                 .may_unmap = 0,
                 .may_writepage = 1,
                 .isolate_pages = isolate_pages_global,
+                .nr_reclaimed = 0,
         };
 
         current->reclaim_state = &reclaim_state;
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 39a9642927d3..5c4b7a400c18 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -27,6 +27,9 @@ ccflags-y  :=
 cppflags-y :=
 ldflags-y  :=
 
+subdir-asflags-y :=
+subdir-ccflags-y :=
+
 # Read auto.conf if it exists, otherwise ignore
 -include include/config/auto.conf
 
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 979619574f70..cba61ca403ca 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -4,6 +4,11 @@ ccflags-y  += $(EXTRA_CFLAGS)
 cppflags-y += $(EXTRA_CPPFLAGS)
 ldflags-y  += $(EXTRA_LDFLAGS)
 
+#
+# flags that take effect in sub directories
+export KBUILD_SUBDIR_ASFLAGS := $(KBUILD_SUBDIR_ASFLAGS) $(subdir-asflags-y)
+export KBUILD_SUBDIR_CCFLAGS := $(KBUILD_SUBDIR_CCFLAGS) $(subdir-ccflags-y)
+
 # Figure out what we need to build from the various variables
 # ===========================================================================
 
@@ -104,10 +109,10 @@ else
 debug_flags =
 endif
 
-orig_c_flags   = $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)                     \
+orig_c_flags   = $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(KBUILD_SUBDIR_CCFLAGS) \
                  $(ccflags-y) $(CFLAGS_$(basetarget).o)
 _c_flags       = $(filter-out $(CFLAGS_REMOVE_$(basetarget).o), $(orig_c_flags))
-_a_flags       = $(KBUILD_CPPFLAGS) $(KBUILD_AFLAGS)                     \
+_a_flags       = $(KBUILD_CPPFLAGS) $(KBUILD_AFLAGS) $(KBUILD_SUBDIR_ASFLAGS) \
                  $(asflags-y) $(AFLAGS_$(basetarget).o)
 _cpp_flags     = $(KBUILD_CPPFLAGS) $(cppflags-y) $(CPPFLAGS_$(@F))
 
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 921514902eca..98b3195347ab 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -609,8 +609,12 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
             strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
                 if (!capable(CAP_MAC_ADMIN))
                         rc = -EPERM;
-                /* a label cannot be void and cannot begin with '-' */
-                if (size == 0 || (size > 0 && ((char *)value)[0] == '-'))
+                /*
+                 * check label validity here so import wont fail on
+                 * post_setxattr
+                 */
+                if (size == 0 || size >= SMK_LABELLEN ||
+                    smk_import(value, size) == NULL)
                         rc = -EINVAL;
         } else
                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
@@ -644,9 +648,6 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
         if (strcmp(name, XATTR_NAME_SMACK))
                 return;
 
-        if (size >= SMK_LABELLEN)
-                return;
-
         isp = dentry->d_inode->i_security;
 
         /*
diff --git a/sound/pci/emu10k1/io.c b/sound/pci/emu10k1/io.c
index 4bfc31d1b281..c1a5aa15af8f 100644
--- a/sound/pci/emu10k1/io.c
+++ b/sound/pci/emu10k1/io.c
@@ -490,7 +490,7 @@ void snd_emu10k1_wait(struct snd_emu10k1 *emu, unsigned int wait)
                         if (newtime != curtime)
                                 break;
                 }
-                if (count >= 16384)
+                if (count > 16384)
                         break;
                 curtime = newtime;
         }
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index fd6e6f337d10..8820faf6c9d8 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -642,19 +642,21 @@ static int get_codec_name(struct hda_codec *codec)
  */
 static void /*__devinit*/ setup_fg_nodes(struct hda_codec *codec)
 {
-        int i, total_nodes;
+        int i, total_nodes, function_id;
         hda_nid_t nid;
 
         total_nodes = snd_hda_get_sub_nodes(codec, AC_NODE_ROOT, &nid);
         for (i = 0; i < total_nodes; i++, nid++) {
-                codec->function_id = snd_hda_param_read(codec, nid,
+                function_id = snd_hda_param_read(codec, nid,
                                                 AC_PAR_FUNCTION_TYPE) & 0xff;
-                switch (codec->function_id) {
+                switch (function_id) {
                 case AC_GRP_AUDIO_FUNCTION:
                         codec->afg = nid;
+                        codec->function_id = function_id;
                         break;
                 case AC_GRP_MODEM_FUNCTION:
                         codec->mfg = nid;
+                        codec->function_id = function_id;
                         break;
                 default:
                         break;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index bc882f8f163c..21e99cfa8c49 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -312,7 +312,6 @@ struct azx_dev {
         unsigned int period_bytes; /* size of the period in bytes */
         unsigned int frags;     /* number for period in the play buffer */
         unsigned int fifo_size; /* FIFO size */
-        unsigned int start_flag: 1;     /* stream full start flag */
         unsigned long start_jiffies;    /* start + minimum jiffies */
         unsigned long min_jiffies;      /* minimum jiffies before position is valid */
 
@@ -333,6 +332,7 @@ struct azx_dev {
         unsigned int opened :1;
         unsigned int running :1;
         unsigned int irq_pending :1;
+        unsigned int start_flag: 1;     /* stream full start flag */
         /*
          * For VIA:
          *  A flag to ensure DMA position is 0
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 38ad3f7b040f..9bcd8ab5a27f 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3977,6 +3977,14 @@ static int patch_ad1884a(struct hda_codec *codec)
                 spec->input_mux = &ad1884a_laptop_capture_source;
                 codec->patch_ops.unsol_event = ad1884a_hp_unsol_event;
                 codec->patch_ops.init = ad1884a_hp_init;
+                /* set the upper-limit for mixer amp to 0dB for avoiding the
+                 * possible damage by overloading
+                 */
+                snd_hda_override_amp_caps(codec, 0x20, HDA_INPUT,
+                                          (0x17 << AC_AMPCAP_OFFSET_SHIFT) |
+                                          (0x17 << AC_AMPCAP_NUM_STEPS_SHIFT) |
+                                          (0x05 << AC_AMPCAP_STEP_SIZE_SHIFT) |
+                                          (1 << AC_AMPCAP_MUTE_SHIFT));
                 break;
         case AD1884A_MOBILE:
                 spec->mixers[0] = ad1884a_mobile_mixers;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index ce30b459aee6..917bc5d3ac2c 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -3076,6 +3076,11 @@ static int create_multi_out_ctls(struct hda_codec *codec, int num_outs,
         unsigned int wid_caps;
 
         for (i = 0; i < num_outs && i < ARRAY_SIZE(chname); i++) {
+                if (type == AUTO_PIN_HP_OUT && !spec->hp_detect) {
+                        wid_caps = get_wcaps(codec, pins[i]);
+                        if (wid_caps & AC_WCAP_UNSOL_CAP)
+                                spec->hp_detect = 1;
+                }
                 nid = dac_nids[i];
                 if (!nid)
                         continue;
@@ -3119,11 +3124,6 @@ static int create_multi_out_ctls(struct hda_codec *codec, int num_outs,
                         err = create_controls_idx(codec, name, idx, nid, 3);
                         if (err < 0)
                                 return err;
-                        if (type == AUTO_PIN_HP_OUT && !spec->hp_detect) {
-                                wid_caps = get_wcaps(codec, pins[i]);
-                                if (wid_caps & AC_WCAP_UNSOL_CAP)
-                                        spec->hp_detect = 1;
-                        }
                 }
         }
         return 0;
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 5dced5b79387..8042d5398892 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -1854,6 +1854,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
         },
         {
                 .subvendor = 0x1028,
+                .subdevice = 0x016a,
+                .name = "Dell Inspiron 8600",   /* STAC9750/51 */
+                .type = AC97_TUNE_HP_ONLY
+        },
+        {
+                .subvendor = 0x1028,
                 .subdevice = 0x0186,
                 .name = "Dell Latitude D810", /* cf. Malone #41015 */
                 .type = AC97_TUNE_HP_MUTE_LED
@@ -1896,12 +1902,6 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
         },
         {
                 .subvendor = 0x103c,
-                .subdevice = 0x0934,
-                .name = "HP nx8220",
-                .type = AC97_TUNE_MUTE_LED
-        },
-        {
-                .subvendor = 0x103c,
                 .subdevice = 0x129d,
                 .name = "HP xw8000",
                 .type = AC97_TUNE_HP_ONLY
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index 9c09b94f0cf8..90f4df7fd906 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -283,7 +283,7 @@ static int omap_mcbsp_dai_hw_params(struct snd_pcm_substream *substream,
                 break;
         case SND_SOC_DAIFMT_DSP_B:
                 regs->srgr2     |= FPER(wlen * channels - 1);
-                regs->srgr1     |= FWID(wlen * channels - 2);
+                regs->srgr1     |= FWID(0);
                 break;
         }
 
@@ -302,6 +302,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
 {
         struct omap_mcbsp_data *mcbsp_data = to_mcbsp(cpu_dai->private_data);
         struct omap_mcbsp_reg_cfg *regs = &mcbsp_data->regs;
+        unsigned int temp_fmt = fmt;
 
         if (mcbsp_data->configured)
                 return 0;
@@ -328,6 +329,8 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 /* 0-bit data delay */
                 regs->rcr2      |= RDATDLY(0);
                 regs->xcr2      |= XDATDLY(0);
+                /* Invert FS polarity configuration */
+                temp_fmt ^= SND_SOC_DAIFMT_NB_IF;
                 break;
         default:
                 /* Unsupported data format */
@@ -351,7 +354,7 @@ static int omap_mcbsp_dai_set_dai_fmt(struct snd_soc_dai *cpu_dai,
         }
 
         /* Set bit clock (CLKX/CLKR) and FS polarities */
-        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        switch (temp_fmt & SND_SOC_DAIFMT_INV_MASK) {
         case SND_SOC_DAIFMT_NB_NF:
                 /*
                  * Normal BCLK + FS.
diff --git a/sound/soc/omap/osk5912.c b/sound/soc/omap/osk5912.c
index a952a4eb3361..a4e149b7f0eb 100644
--- a/sound/soc/omap/osk5912.c
+++ b/sound/soc/omap/osk5912.c
@@ -62,7 +62,7 @@ static int osk_hw_params(struct snd_pcm_substream *substream,
         /* Set codec DAI configuration */
         err = snd_soc_dai_set_fmt(codec_dai,
                                   SND_SOC_DAIFMT_DSP_B |
-                                  SND_SOC_DAIFMT_NB_IF |
+                                  SND_SOC_DAIFMT_NB_NF |
                                   SND_SOC_DAIFMT_CBM_CFM);
         if (err < 0) {
                 printk(KERN_ERR "can't set codec DAI configuration\n");
@@ -72,7 +72,7 @@ static int osk_hw_params(struct snd_pcm_substream *substream,
         /* Set cpu DAI configuration */
         err = snd_soc_dai_set_fmt(cpu_dai,
                                   SND_SOC_DAIFMT_DSP_B |
-                                  SND_SOC_DAIFMT_NB_IF |
+                                  SND_SOC_DAIFMT_NB_NF |
                                   SND_SOC_DAIFMT_CBM_CFM);
         if (err < 0) {
                 printk(KERN_ERR "can't set cpu DAI configuration\n");
diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index 308a657928d2..de2254475d52 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -806,6 +806,7 @@ static int pxa_ssp_probe(struct platform_device *pdev,
                 goto err_priv;
         }
 
+        priv->dai_fmt = (unsigned int) -1;
         dai->private_data = priv;
 
         return 0;
diff --git a/sound/soc/s3c24xx/jive_wm8750.c b/sound/soc/s3c24xx/jive_wm8750.c
index 32063790d95b..93e6c87b7399 100644
--- a/sound/soc/s3c24xx/jive_wm8750.c
+++ b/sound/soc/s3c24xx/jive_wm8750.c
@@ -69,8 +69,8 @@ static int jive_hw_params(struct snd_pcm_substream *substream,
                 break;
         }
 
-        s3c_i2sv2_calc_rate(&div, NULL, params_rate(params),
-                            s3c2412_get_iisclk());
+        s3c_i2sv2_iis_calc_rate(&div, NULL, params_rate(params),
+                                s3c2412_get_iisclk());
 
         /* set codec DAI configuration */
         ret = snd_soc_dai_set_fmt(codec_dai, SND_SOC_DAIFMT_I2S |
@@ -145,8 +145,9 @@ static struct snd_soc_dai_link jive_dai = {
 };
 
 /* jive audio machine driver */
-static struct snd_soc_machine snd_soc_machine_jive = {
+static struct snd_soc_card snd_soc_machine_jive = {
         .name           = "Jive",
+        .platform       = &s3c24xx_soc_platform,
         .dai_link       = &jive_dai,
         .num_links      = 1,
 };
@@ -157,9 +158,8 @@ static struct wm8750_setup_data jive_wm8750_setup = {
 
 /* jive audio subsystem */
 static struct snd_soc_device jive_snd_devdata = {
-        .machine        = &snd_soc_machine_jive,
-        .platform       = &s3c24xx_soc_platform,
-        .codec_dev      = &soc_codec_dev_wm8750_spi,
+        .card           = &snd_soc_machine_jive,
+        .codec_dev      = &soc_codec_dev_wm8750,
         .codec_data     = &jive_wm8750_setup,
 };
 
diff --git a/sound/soc/s3c24xx/s3c-i2s-v2.c b/sound/soc/s3c24xx/s3c-i2s-v2.c
index 295a4c910262..689ffcd17e1f 100644
--- a/sound/soc/s3c24xx/s3c-i2s-v2.c
+++ b/sound/soc/s3c24xx/s3c-i2s-v2.c
@@ -473,9 +473,9 @@ static int s3c2412_i2s_set_clkdiv(struct snd_soc_dai *cpu_dai,
 /* default table of all avaialable root fs divisors */
 static unsigned int iis_fs_tab[] = { 256, 512, 384, 768 };
 
-int s3c2412_iis_calc_rate(struct s3c_i2sv2_rate_calc *info,
-                          unsigned int *fstab,
-                          unsigned int rate, struct clk *clk)
+int s3c_i2sv2_iis_calc_rate(struct s3c_i2sv2_rate_calc *info,
+                            unsigned int *fstab,
+                            unsigned int rate, struct clk *clk)
 {
         unsigned long clkrate = clk_get_rate(clk);
         unsigned int div;
@@ -531,7 +531,7 @@ int s3c2412_iis_calc_rate(struct s3c_i2sv2_rate_calc *info,
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(s3c2412_iis_calc_rate);
+EXPORT_SYMBOL_GPL(s3c_i2sv2_iis_calc_rate);
 
 int s3c_i2sv2_probe(struct platform_device *pdev,
                     struct snd_soc_dai *dai,
@@ -624,10 +624,12 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai)
 
 int s3c_i2sv2_register_dai(struct snd_soc_dai *dai)
 {
-        dai->ops.trigger = s3c2412_i2s_trigger;
-        dai->ops.hw_params = s3c2412_i2s_hw_params;
-        dai->ops.set_fmt = s3c2412_i2s_set_fmt;
-        dai->ops.set_clkdiv = s3c2412_i2s_set_clkdiv;
+        struct snd_soc_dai_ops *ops = dai->ops;
+
+        ops->trigger = s3c2412_i2s_trigger;
+        ops->hw_params = s3c2412_i2s_hw_params;
+        ops->set_fmt = s3c2412_i2s_set_fmt;
+        ops->set_clkdiv = s3c2412_i2s_set_clkdiv;
 
         dai->suspend = s3c2412_i2s_suspend;
         dai->resume = s3c2412_i2s_resume;
diff --git a/sound/soc/s3c24xx/s3c2412-i2s.c b/sound/soc/s3c24xx/s3c2412-i2s.c
index 1ca3cdaa8213..b7e0b3f0bfc8 100644
--- a/sound/soc/s3c24xx/s3c2412-i2s.c
+++ b/sound/soc/s3c24xx/s3c2412-i2s.c
@@ -33,8 +33,8 @@
 
 #include <plat/regs-s3c2412-iis.h>
 
-#include <plat/regs-gpio.h>
 #include <plat/audio.h>
+#include <mach/regs-gpio.h>
 #include <mach/dma.h>
 
 #include "s3c24xx-pcm.h"