218 files changed, 2070 insertions, 903 deletions
diff --git a/CREDITS b/CREDITS
index 2b39168c06aa..5e0736722afd 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2166,7 +2166,6 @@ D: Initial implementation of VC's, pty's and select()
 N: Pavel Machek
 E: pavel@ucw.cz
-E: pavel@suse.cz
 D: Softcursor for vga, hypertech cdrom support, vcsa bugfix, nbd
 D: sun4/330 port, capabilities for elf, speedup for rm on ext2, USB,
 D: work on suspend-to-ram/disk, killing duplicates from ioctl32
diff --git a/Documentation/ABI/testing/sysfs-firmware-memmap b/Documentation/ABI/testing/sysfs-firmware-memmap
index 0d99ee6ae02e..eca0d65087dc 100644
--- a/Documentation/ABI/testing/sysfs-firmware-memmap
+++ b/Documentation/ABI/testing/sysfs-firmware-memmap
@@ -1,6 +1,6 @@
 What:           /sys/firmware/memmap/
 Date:           June 2008
-Contact:        Bernhard Walle <bwalle@suse.de>
+Contact:        Bernhard Walle <bernhard.walle@gmx.de>
 Description:
                On all platforms, the firmware provides a memory map which the
                kernel reads. The resources from that memory map are registered
diff --git a/Documentation/PCI/PCIEBUS-HOWTO.txt b/Documentation/PCI/PCIEBUS-HOWTO.txt
index 9a07e38631b0..6bd5f372adec 100644
--- a/Documentation/PCI/PCIEBUS-HOWTO.txt
+++ b/Documentation/PCI/PCIEBUS-HOWTO.txt
@@ -93,7 +93,7 @@ the PCI Express Port Bus driver from loading a service driver.
 int pcie_port_service_register(struct pcie_port_service_driver *new)
-This API replaces the Linux Driver Model's pci_module_init API. A
+This API replaces the Linux Driver Model's pci_register_driver API. A
 service driver should always calls pcie_port_service_register at
 module init. Note that after service driver being loaded, calls
 such as pci_enable_device(dev) and pci_set_master(dev) are no longer
diff --git a/Documentation/cgroups/cgroups.txt b/Documentation/cgroups/cgroups.txt
index d9e5d6f41b92..93feb8444489 100644
--- a/Documentation/cgroups/cgroups.txt
+++ b/Documentation/cgroups/cgroups.txt
@@ -252,10 +252,8 @@ cgroup file system directories.
 When a task is moved from one cgroup to another, it gets a new
 css_set pointer - if there's an already existing css_set with the
 desired collection of cgroups then that group is reused, else a new
-css_set is allocated. Note that the current implementation uses a
+css_set is allocated. The appropriate existing css_set is located by
-linear search to locate an appropriate existing css_set, so isn't
+looking into a hash table.
-very efficient. A future version will use a hash table for better
-performance.
 To allow access from a cgroup to the css_sets (and hence tasks)
 that comprise it, a set of cg_cgroup_link objects form a lattice;
diff --git a/Documentation/hwmon/hpfall.c b/Documentation/hwmon/hpfall.c
new file mode 100644
index 000000000000..bbea1ccfd46a
--- /dev/null
+++ b/Documentation/hwmon/hpfall.c
@@ -0,0 +1,101 @@
+/* Disk protection for HP machines.
+ *
+ * Copyright 2008 Eric Piel
+ * Copyright 2009 Pavel Machek <pavel@suse.cz>
+ *
+ * GPLv2.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <string.h>
+#include <stdint.h>
+#include <errno.h>
+#include <signal.h>
+void write_int(char *path, int i)
+{
+        char buf[1024];
+        int fd = open(path, O_RDWR);
+        if (fd < 0) {
+                perror("open");
+                exit(1);
+        }
+        sprintf(buf, "%d", i);
+        if (write(fd, buf, strlen(buf)) != strlen(buf)) {
+                perror("write");
+                exit(1);
+        }
+        close(fd);
+}
+void set_led(int on)
+{
+        write_int("/sys/class/leds/hp::hddprotect/brightness", on);
+}
+void protect(int seconds)
+{
+        write_int("/sys/block/sda/device/unload_heads", seconds*1000);
+}
+int on_ac(void)
+{
+//      /sys/class/power_supply/AC0/online
+}
+int lid_open(void)
+{
+//      /proc/acpi/button/lid/LID/state
+}
+void ignore_me(void)
+{
+        protect(0);
+        set_led(0);
+}
+int main(int argc, char* argv[])
+{
+       int fd, ret;
+       fd = open("/dev/freefall", O_RDONLY);
+       if (fd < 0) {
+               perror("open");
+               return EXIT_FAILURE;
+       }
+        signal(SIGALRM, ignore_me);
+       for (;;) {
+               unsigned char count;
+               ret = read(fd, &count, sizeof(count));
+               alarm(0);
+               if ((ret == -1) && (errno == EINTR)) {
+                       /* Alarm expired, time to unpark the heads */
+                       continue;
+               }
+               if (ret != sizeof(count)) {
+                       perror("read");
+                       break;
+               }
+               protect(21);
+               set_led(1);
+               if (1 || on_ac() || lid_open()) {
+                       alarm(2);
+               } else {
+                       alarm(20);
+               }
+       }
+       close(fd);
+       return EXIT_SUCCESS;
+}
diff --git a/Documentation/hwmon/lis3lv02d b/Documentation/hwmon/lis3lv02d
index 0fcfc4a7ccdc..287f8c902656 100644
--- a/Documentation/hwmon/lis3lv02d
+++ b/Documentation/hwmon/lis3lv02d
@@ -33,6 +33,14 @@ rate - reports the sampling rate of the accelerometer device in HZ
 This driver also provides an absolute input class device, allowing
 the laptop to act as a pinball machine-esque joystick.
+Another feature of the driver is misc device called "freefall" that
+acts similar to /dev/rtc and reacts on free-fall interrupts received
+from the device. It supports blocking operations, poll/select and
+fasync operation modes. You must read 1 bytes from the device.  The
+result is number of free-fall interrupts since the last successful
+read (or 255 if number of interrupts would not fit).
 Axes orientation
 ----------------
diff --git a/Documentation/tracers/mmiotrace.txt b/Documentation/tracers/mmiotrace.txt
index cde23b4a12a1..5731c67abc55 100644
--- a/Documentation/tracers/mmiotrace.txt
+++ b/Documentation/tracers/mmiotrace.txt
@@ -78,12 +78,10 @@ to view your kernel log and look for "mmiotrace has lost events" warning. If
 events were lost, the trace is incomplete. You should enlarge the buffers and
 try again. Buffers are enlarged by first seeing how large the current buffers
 are:
-$ cat /debug/tracing/trace_entries
+$ cat /debug/tracing/buffer_size_kb
 gives you a number. Approximately double this number and write it back, for
 instance:
-$ echo 0 > /debug/tracing/tracing_enabled
+$ echo 128000 > /debug/tracing/buffer_size_kb
-$ echo 128000 > /debug/tracing/trace_entries
-$ echo 1 > /debug/tracing/tracing_enabled
 Then start again from the top.
 If you are doing a trace for a driver project, e.g. Nouveau, you should also
diff --git a/MAINTAINERS b/MAINTAINERS
index db65b4e6d132..06e03913d2d3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -692,6 +692,13 @@ M:	kernel@wantstofly.org
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
 S:      Maintained
+ARM/NUVOTON W90X900 ARM ARCHITECTURE
+P:      Wan ZongShun
+M:      mcuos.com@gmail.com
+L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
+W:      http://www.mcuos.com
+S:      Maintained
 ARPD SUPPORT
 P:      Jonathan Layes
 L:      netdev@vger.kernel.org
@@ -1905,10 +1912,10 @@ W:	http://gigaset307x.sourceforge.net/
 S:      Maintained
 HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
-P:      Robert Love
+P:      Frank Seidel
-M:      rlove@rlove.org
+M:      frank@f-seidel.de
-M:      linux-kernel@vger.kernel.org
+L:      lm-sensors@lm-sensors.org
-W:      http://www.kernel.org/pub/linux/kernel/people/rml/hdaps/
+W:      http://www.kernel.org/pub/linux/kernel/people/fseidel/hdaps/
 S:      Maintained
 GSPCA FINEPIX SUBDRIVER
@@ -2001,7 +2008,7 @@ S:	Maintained
 HIBERNATION (aka Software Suspend, aka swsusp)
 P:      Pavel Machek
-M:      pavel@suse.cz
+M:      pavel@ucw.cz
 P:      Rafael J. Wysocki
 M:      rjw@sisk.pl
 L:      linux-pm@lists.linux-foundation.org
@@ -4172,7 +4179,7 @@ SUSPEND TO RAM
 P:      Len Brown
 M:      len.brown@intel.com
 P:      Pavel Machek
-M:      pavel@suse.cz
+M:      pavel@ucw.cz
 P:      Rafael J. Wysocki
 M:      rjw@sisk.pl
 L:      linux-pm@lists.linux-foundation.org
@@ -4924,11 +4931,11 @@ L:	zd1211-devs@lists.sourceforge.net (subscribers-only)
 S:      Maintained
 ZR36067 VIDEO FOR LINUX DRIVER
-P:      Ronald Bultje
-M:      rbultje@ronald.bitfreak.net
 L:      mjpeg-users@lists.sourceforge.net
+L:      linux-media@vger.kernel.org
 W:      http://mjpeg.sourceforge.net/driver-zoran/
-S:      Maintained
+T:      Mercurial http://linuxtv.org/hg/v4l-dvb
+S:      Odd Fixes
 ZS DECSTATION Z85C30 SERIAL DRIVER
 P:      Maciej W. Rozycki
diff --git a/Makefile b/Makefile
index b280cfcf1efe..96628d0b48d2 100644
--- a/Makefile
+++ b/Makefile
@@ -389,6 +389,7 @@ PHONY += outputmakefile
 # output directory.
 outputmakefile:
 ifneq ($(KBUILD_SRC),)
+        $(Q)ln -fsn $(srctree) source
        $(Q)$(CONFIG_SHELL) $(srctree)/scripts/mkmakefile \
            $(srctree) $(objtree) $(VERSION) $(PATCHLEVEL)
 endif
@@ -947,7 +948,6 @@ ifneq ($(KBUILD_SRC),)
            mkdir -p include2;                                          \
            ln -fsn $(srctree)/include/asm-$(SRCARCH) include2/asm;     \
        fi
-        ln -fsn $(srctree) source
 endif
 # prepare2 creates a makefile if using a separate output directory
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index f238370c907d..8d0097f10208 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -93,8 +93,8 @@ common_shutdown_1(void *generic_ptr)
        if (cpuid != boot_cpuid) {
                flags |= 0x00040000UL; /* "remain halted" */
                *pflags = flags;
-                cpu_clear(cpuid, cpu_present_map);
+                set_cpu_present(cpuid, false);
-                cpu_clear(cpuid, cpu_possible_map);
+                set_cpu_possible(cpuid, false);
                halt();
        }
 #endif
@@ -120,8 +120,8 @@ common_shutdown_1(void *generic_ptr)
 #ifdef CONFIG_SMP
        /* Wait for the secondaries to halt. */
-        cpu_clear(boot_cpuid, cpu_present_map);
+        set_cpu_present(boot_cpuid, false);
-        cpu_clear(boot_cpuid, cpu_possible_map);
+        set_cpu_possible(boot_cpuid, false);
        while (cpus_weight(cpu_present_map))
                barrier();
 #endif
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 00f1dc3dfd5f..b1fe5674c3a1 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -120,12 +120,12 @@ void __cpuinit
 smp_callin(void)
 {
        int cpuid = hard_smp_processor_id();
-        cpumask_t mask = cpu_online_map;
-        if (cpu_test_and_set(cpuid, mask)) {
+        if (cpu_online(cpuid)) {
                printk("??, cpu 0x%x already present??\n", cpuid);
                BUG();
        }
+        set_cpu_online(cpuid, true);
        /* Turn on machine checks.  */
        wrmces(7);
@@ -436,8 +436,8 @@ setup_smp(void)
                                ((char *)cpubase + i*hwrpb->processor_size);
                        if ((cpu->flags & 0x1cc) == 0x1cc) {
                                smp_num_probed++;
-                                cpu_set(i, cpu_possible_map);
+                                set_cpu_possible(i, true);
-                                cpu_set(i, cpu_present_map);
+                                set_cpu_present(i, true);
                                cpu->pal_revision = boot_cpu_palrev;
                        }
@@ -470,8 +470,8 @@ smp_prepare_cpus(unsigned int max_cpus)
        /* Nothing to do on a UP box, or when told not to.  */
        if (smp_num_probed == 1 || max_cpus == 0) {
-                cpu_possible_map = cpumask_of_cpu(boot_cpuid);
+                init_cpu_possible(cpumask_of(boot_cpuid));
-                cpu_present_map = cpumask_of_cpu(boot_cpuid);
+                init_cpu_present(cpumask_of(boot_cpuid));
                printk(KERN_INFO "SMP mode deactivated.\n");
                return;
        }
diff --git a/arch/arm/configs/at91sam9260ek_defconfig b/arch/arm/configs/at91sam9260ek_defconfig
index e0ee7060f9aa..98e2f3de4bc5 100644
--- a/arch/arm/configs/at91sam9260ek_defconfig
+++ b/arch/arm/configs/at91sam9260ek_defconfig
@@ -608,7 +608,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91SAM9_WATCHDOG=y
+CONFIG_AT91SAM9X_WATCHDOG=y
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/at91sam9261ek_defconfig b/arch/arm/configs/at91sam9261ek_defconfig
index 01d1ef97d8be..149456142392 100644
--- a/arch/arm/configs/at91sam9261ek_defconfig
+++ b/arch/arm/configs/at91sam9261ek_defconfig
@@ -700,7 +700,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91SAM9_WATCHDOG=y
+CONFIG_AT91SAM9X_WATCHDOG=y
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/at91sam9263ek_defconfig b/arch/arm/configs/at91sam9263ek_defconfig
index 036a126725c1..21599f3c6275 100644
--- a/arch/arm/configs/at91sam9263ek_defconfig
+++ b/arch/arm/configs/at91sam9263ek_defconfig
@@ -710,7 +710,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91SAM9_WATCHDOG=y
+CONFIG_AT91SAM9X_WATCHDOG=y
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/at91sam9rlek_defconfig b/arch/arm/configs/at91sam9rlek_defconfig
index 237a2a6a8517..e2df81a3e804 100644
--- a/arch/arm/configs/at91sam9rlek_defconfig
+++ b/arch/arm/configs/at91sam9rlek_defconfig
@@ -606,7 +606,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91SAM9_WATCHDOG=y
+CONFIG_AT91SAM9X_WATCHDOG=y
 #
 # Sonics Silicon Backplane
diff --git a/arch/arm/configs/qil-a9260_defconfig b/arch/arm/configs/qil-a9260_defconfig
index cd1d717903ac..9b32d0eb89ba 100644
--- a/arch/arm/configs/qil-a9260_defconfig
+++ b/arch/arm/configs/qil-a9260_defconfig
@@ -727,7 +727,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-# CONFIG_AT91SAM9_WATCHDOG is not set
+# CONFIG_AT91SAM9X_WATCHDOG is not set
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/kernel/elf.c b/arch/arm/kernel/elf.c
index 84849098c8e8..d4a0da1e48f4 100644
--- a/arch/arm/kernel/elf.c
+++ b/arch/arm/kernel/elf.c
@@ -74,9 +74,9 @@ EXPORT_SYMBOL(elf_set_personality);
 */
 int arm_elf_read_implies_exec(const struct elf32_hdr *x, int executable_stack)
 {
-        if (executable_stack != EXSTACK_ENABLE_X)
+        if (executable_stack != EXSTACK_DISABLE_X)
                return 1;
-        if (cpu_architecture() <= CPU_ARCH_ARMv6)
+        if (cpu_architecture() < CPU_ARCH_ARMv6)
                return 1;
        return 0;
 }
diff --git a/arch/arm/mach-at91/at91cap9_devices.c b/arch/arm/mach-at91/at91cap9_devices.c
index 9eca2209cde6..412aa49ad2fb 100644
--- a/arch/arm/mach-at91/at91cap9_devices.c
+++ b/arch/arm/mach-at91/at91cap9_devices.c
@@ -697,7 +697,7 @@ static void __init at91_add_device_rtt(void)
 *  Watchdog
 * -------------------------------------------------------------------- */
-#if defined(CONFIG_AT91SAM9_WATCHDOG) || defined(CONFIG_AT91SAM9_WATCHDOG_MODULE)
+#if defined(CONFIG_AT91SAM9X_WATCHDOG) || defined(CONFIG_AT91SAM9X_WATCHDOG_MODULE)
 static struct platform_device at91cap9_wdt_device = {
        .name           = "at91_wdt",
        .id             = -1,
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index fdde1ea21b07..d74c9ac007e7 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -643,7 +643,7 @@ static void __init at91_add_device_rtt(void)
 *  Watchdog
 * -------------------------------------------------------------------- */
-#if defined(CONFIG_AT91SAM9_WATCHDOG) || defined(CONFIG_AT91SAM9_WATCHDOG_MODULE)
+#if defined(CONFIG_AT91SAM9X_WATCHDOG) || defined(CONFIG_AT91SAM9X_WATCHDOG_MODULE)
 static struct platform_device at91sam9260_wdt_device = {
        .name           = "at91_wdt",
        .id             = -1,
diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
index 17289756f80f..59fc48311fb0 100644
--- a/arch/arm/mach-at91/at91sam9261_devices.c
+++ b/arch/arm/mach-at91/at91sam9261_devices.c
@@ -621,7 +621,7 @@ static void __init at91_add_device_rtt(void)
 *  Watchdog
 * -------------------------------------------------------------------- */
-#if defined(CONFIG_AT91SAM9_WATCHDOG) || defined(CONFIG_AT91SAM9_WATCHDOG_MODULE)
+#if defined(CONFIG_AT91SAM9X_WATCHDOG) || defined(CONFIG_AT91SAM9X_WATCHDOG_MODULE)
 static struct platform_device at91sam9261_wdt_device = {
        .name           = "at91_wdt",
        .id             = -1,
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index b753cb879d8e..134af97ff340 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -854,7 +854,7 @@ static void __init at91_add_device_rtt(void)
 *  Watchdog
 * -------------------------------------------------------------------- */
-#if defined(CONFIG_AT91SAM9_WATCHDOG) || defined(CONFIG_AT91SAM9_WATCHDOG_MODULE)
+#if defined(CONFIG_AT91SAM9X_WATCHDOG) || defined(CONFIG_AT91SAM9X_WATCHDOG_MODULE)
 static struct platform_device at91sam9263_wdt_device = {
        .name           = "at91_wdt",
        .id             = -1,
diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
index 145324f4ec56..728186515cdf 100644
--- a/arch/arm/mach-at91/at91sam9rl_devices.c
+++ b/arch/arm/mach-at91/at91sam9rl_devices.c
@@ -609,7 +609,7 @@ static void __init at91_add_device_rtt(void)
 *  Watchdog
 * -------------------------------------------------------------------- */
-#if defined(CONFIG_AT91SAM9_WATCHDOG) || defined(CONFIG_AT91SAM9_WATCHDOG_MODULE)
+#if defined(CONFIG_AT91SAM9X_WATCHDOG) || defined(CONFIG_AT91SAM9X_WATCHDOG_MODULE)
 static struct platform_device at91sam9rl_wdt_device = {
        .name           = "at91_wdt",
        .id             = -1,
diff --git a/arch/arm/mach-at91/gpio.c b/arch/arm/mach-at91/gpio.c
index 9b0447c3d59b..2f7d4977dce9 100644
--- a/arch/arm/mach-at91/gpio.c
+++ b/arch/arm/mach-at91/gpio.c
@@ -490,7 +490,8 @@ postcore_initcall(at91_gpio_debugfs_init);
 /*--------------------------------------------------------------------------*/
-/* This lock class tells lockdep that GPIO irqs are in a different
+/*
+ * This lock class tells lockdep that GPIO irqs are in a different
 * category than their parents, so it won't report false recursion.
 */
 static struct lock_class_key gpio_lock_class;
@@ -509,9 +510,6 @@ void __init at91_gpio_irq_setup(void)
                unsigned        id = this->id;
                unsigned        i;
-                /* enable PIO controller's clock */
-                clk_enable(this->clock);
                __raw_writel(~0, this->regbase + PIO_IDR);
                for (i = 0, pin = this->chipbase; i < 32; i++, pin++) {
@@ -556,7 +554,14 @@ void __init at91_gpio_init(struct at91_gpio_bank *data, int nr_banks)
                data->chipbase = PIN_BASE + i * 32;
                data->regbase = data->offset + (void __iomem *)AT91_VA_BASE_SYS;
-                /* AT91SAM9263_ID_PIOCDE groups PIOC, PIOD, PIOE */
+                /* enable PIO controller's clock */
+                clk_enable(data->clock);
+                /*
+                 * Some processors share peripheral ID between multiple GPIO banks.
+                 *  SAM9263 (PIOC, PIOD, PIOE)
+                 *  CAP9 (PIOA, PIOB, PIOC, PIOD)
+                 */
                if (last && last->id == data->id)
                        last->next = data;
        }
diff --git a/arch/arm/mach-at91/include/mach/board.h b/arch/arm/mach-at91/include/mach/board.h
index fb51f0e0a83f..0b3ae21b4565 100644
--- a/arch/arm/mach-at91/include/mach/board.h
+++ b/arch/arm/mach-at91/include/mach/board.h
@@ -93,6 +93,7 @@ struct atmel_nand_data {
        u8              enable_pin;     /* chip enable */
        u8              det_pin;        /* card detect */
        u8              rdy_pin;        /* ready/busy */
+        u8              rdy_pin_active_low;     /* rdy_pin value is inverted */
        u8              ale;            /* address line number connected to ALE */
        u8              cle;            /* address line number connected to CLE */
        u8              bus_width_16;   /* buswidth is 16 bit */
diff --git a/arch/arm/mach-ep93xx/include/mach/gesbc9312.h b/arch/arm/mach-ep93xx/include/mach/gesbc9312.h
deleted file mode 100644
index 21fe2b922aa5..000000000000
--- a/arch/arm/mach-ep93xx/include/mach/gesbc9312.h
+++ /dev/null
@@ -1,3 +0,0 @@
-/*
- * arch/arm/mach-ep93xx/include/mach/gesbc9312.h
- */
diff --git a/arch/arm/mach-ep93xx/include/mach/hardware.h b/arch/arm/mach-ep93xx/include/mach/hardware.h
index 529807d182bf..2866297310b7 100644
--- a/arch/arm/mach-ep93xx/include/mach/hardware.h
+++ b/arch/arm/mach-ep93xx/include/mach/hardware.h
@@ -10,7 +10,6 @@
 #include "platform.h"
-#include "gesbc9312.h"
 #include "ts72xx.h"
 #endif
diff --git a/arch/arm/mach-kirkwood/irq.c b/arch/arm/mach-kirkwood/irq.c
index efb86b700276..06083b23bb44 100644
--- a/arch/arm/mach-kirkwood/irq.c
+++ b/arch/arm/mach-kirkwood/irq.c
@@ -42,7 +42,7 @@ void __init kirkwood_init_irq(void)
        writel(0, GPIO_EDGE_CAUSE(32));
        for (i = IRQ_KIRKWOOD_GPIO_START; i < NR_IRQS; i++) {
-                set_irq_chip(i, &orion_gpio_irq_level_chip);
+                set_irq_chip(i, &orion_gpio_irq_chip);
                set_irq_handler(i, handle_level_irq);
                irq_desc[i].status |= IRQ_LEVEL;
                set_irq_flags(i, IRQF_VALID);
diff --git a/arch/arm/mach-mv78xx0/irq.c b/arch/arm/mach-mv78xx0/irq.c
index e273418797b4..30b7e4bcdbc7 100644
--- a/arch/arm/mach-mv78xx0/irq.c
+++ b/arch/arm/mach-mv78xx0/irq.c
@@ -40,7 +40,7 @@ void __init mv78xx0_init_irq(void)
        writel(0, GPIO_EDGE_CAUSE(0));
        for (i = IRQ_MV78XX0_GPIO_START; i < NR_IRQS; i++) {
-                set_irq_chip(i, &orion_gpio_irq_level_chip);
+                set_irq_chip(i, &orion_gpio_irq_chip);
                set_irq_handler(i, handle_level_irq);
                irq_desc[i].status |= IRQ_LEVEL;
                set_irq_flags(i, IRQF_VALID);
diff --git a/arch/arm/mach-omap2/clock.c b/arch/arm/mach-omap2/clock.c
index ad721e0cbf7a..ce4d46a4a838 100644
--- a/arch/arm/mach-omap2/clock.c
+++ b/arch/arm/mach-omap2/clock.c
@@ -565,7 +565,7 @@ u32 omap2_clksel_to_divisor(struct clk *clk, u32 field_val)
 *
 * Given a struct clk of a rate-selectable clksel clock, and a clock divisor,
 * find the corresponding register field value.  The return register value is
- * the value before left-shifting.  Returns 0xffffffff on error
+ * the value before left-shifting.  Returns ~0 on error
 */
 u32 omap2_divisor_to_clksel(struct clk *clk, u32 div)
 {
@@ -577,7 +577,7 @@ u32 omap2_divisor_to_clksel(struct clk *clk, u32 div)
        clks = omap2_get_clksel_by_parent(clk, clk->parent);
        if (clks == NULL)
-                return 0;
+                return ~0;
        for (clkr = clks->rates; clkr->div; clkr++) {
                if ((clkr->flags & cpu_mask) && (clkr->div == div))
@@ -588,7 +588,7 @@ u32 omap2_divisor_to_clksel(struct clk *clk, u32 div)
                printk(KERN_ERR "clock: Could not find divisor %d for "
                       "clock %s parent %s\n", div, clk->name,
                       clk->parent->name);
-                return 0;
+                return ~0;
        }
        return clkr->val;
@@ -708,7 +708,7 @@ static u32 omap2_clksel_get_src_field(void __iomem **src_addr,
                return 0;
        for (clkr = clks->rates; clkr->div; clkr++) {
-                if (clkr->flags & (cpu_mask | DEFAULT_RATE))
+                if (clkr->flags & cpu_mask && clkr->flags & DEFAULT_RATE)
                        break; /* Found the default rate for this platform */
        }
@@ -746,7 +746,7 @@ int omap2_clk_set_parent(struct clk *clk, struct clk *new_parent)
                return -EINVAL;
        if (clk->usecount > 0)
-                _omap2_clk_disable(clk);
+                omap2_clk_disable(clk);
        /* Set new source value (previous dividers if any in effect) */
        reg_val = __raw_readl(src_addr) & ~field_mask;
@@ -759,11 +759,11 @@ int omap2_clk_set_parent(struct clk *clk, struct clk *new_parent)
                wmb();
        }
-        if (clk->usecount > 0)
-                _omap2_clk_enable(clk);
        clk->parent = new_parent;
+        if (clk->usecount > 0)
+                omap2_clk_enable(clk);
        /* CLKSEL clocks follow their parents' rates, divided by a divisor */
        clk->rate = new_parent->rate;
diff --git a/arch/arm/mach-orion5x/irq.c b/arch/arm/mach-orion5x/irq.c
index 0caae43301e5..e03f7b45cb0d 100644
--- a/arch/arm/mach-orion5x/irq.c
+++ b/arch/arm/mach-orion5x/irq.c
@@ -44,7 +44,7 @@ void __init orion5x_init_irq(void)
         * User can use set_type() if he wants to use edge types handlers.
         */
        for (i = IRQ_ORION5X_GPIO_START; i < NR_IRQS; i++) {
-                set_irq_chip(i, &orion_gpio_irq_level_chip);
+                set_irq_chip(i, &orion_gpio_irq_chip);
                set_irq_handler(i, handle_level_irq);
                irq_desc[i].status |= IRQ_LEVEL;
                set_irq_flags(i, IRQF_VALID);
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 9b36c5cb5e9f..d4d082c5c2d4 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -693,7 +693,8 @@ static void __init sanity_check_meminfo(void)
                 * Check whether this memory bank would entirely overlap
                 * the vmalloc area.
                 */
-                if (__va(bank->start) >= VMALLOC_MIN) {
+                if (__va(bank->start) >= VMALLOC_MIN ||
+                    __va(bank->start) < PAGE_OFFSET) {
                        printk(KERN_NOTICE "Ignoring RAM at %.8lx-%.8lx "
                               "(vmalloc region overlap).\n",
                               bank->start, bank->start + bank->size - 1);
diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
index 967186425ca1..0d12c2164766 100644
--- a/arch/arm/plat-orion/gpio.c
+++ b/arch/arm/plat-orion/gpio.c
@@ -265,51 +265,36 @@ EXPORT_SYMBOL(orion_gpio_set_blink);
 *        polarity    LEVEL          mask
 *
 ****************************************************************************/
-static void gpio_irq_edge_ack(u32 irq)
-{
-        int pin = irq_to_gpio(irq);
-        writel(~(1 << (pin & 31)), GPIO_EDGE_CAUSE(pin));
-}
-static void gpio_irq_edge_mask(u32 irq)
-{
-        int pin = irq_to_gpio(irq);
-        u32 u;
-        u = readl(GPIO_EDGE_MASK(pin));
-        u &= ~(1 << (pin & 31));
-        writel(u, GPIO_EDGE_MASK(pin));
-}
-static void gpio_irq_edge_unmask(u32 irq)
+static void gpio_irq_ack(u32 irq)
 {
-        int pin = irq_to_gpio(irq);
+        int type = irq_desc[irq].status & IRQ_TYPE_SENSE_MASK;
-        u32 u;
+        if (type & (IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING)) {
+                int pin = irq_to_gpio(irq);
-        u = readl(GPIO_EDGE_MASK(pin));
+                writel(~(1 << (pin & 31)), GPIO_EDGE_CAUSE(pin));
-        u |= 1 << (pin & 31);
+        }
-        writel(u, GPIO_EDGE_MASK(pin));
 }
-static void gpio_irq_level_mask(u32 irq)
+static void gpio_irq_mask(u32 irq)
 {
        int pin = irq_to_gpio(irq);
-        u32 u;
+        int type = irq_desc[irq].status & IRQ_TYPE_SENSE_MASK;
+        u32 reg = (type & (IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING)) ?
-        u = readl(GPIO_LEVEL_MASK(pin));
+                GPIO_EDGE_MASK(pin) : GPIO_LEVEL_MASK(pin);
+        u32 u = readl(reg);
        u &= ~(1 << (pin & 31));
-        writel(u, GPIO_LEVEL_MASK(pin));
+        writel(u, reg);
 }
-static void gpio_irq_level_unmask(u32 irq)
+static void gpio_irq_unmask(u32 irq)
 {
        int pin = irq_to_gpio(irq);
-        u32 u;
+        int type = irq_desc[irq].status & IRQ_TYPE_SENSE_MASK;
+        u32 reg = (type & (IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING)) ?
-        u = readl(GPIO_LEVEL_MASK(pin));
+                GPIO_EDGE_MASK(pin) : GPIO_LEVEL_MASK(pin);
+        u32 u = readl(reg);
        u |= 1 << (pin & 31);
-        writel(u, GPIO_LEVEL_MASK(pin));
+        writel(u, reg);
 }
 static int gpio_irq_set_type(u32 irq, u32 type)
@@ -331,9 +316,9 @@ static int gpio_irq_set_type(u32 irq, u32 type)
         * Set edge/level type.
         */
        if (type & (IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING)) {
-                desc->chip = &orion_gpio_irq_edge_chip;
+                desc->handle_irq = handle_edge_irq;
        } else if (type & (IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW)) {
-                desc->chip = &orion_gpio_irq_level_chip;
+                desc->handle_irq = handle_level_irq;
        } else {
                printk(KERN_ERR "failed to set irq=%d (type=%d)\n", irq, type);
                return -EINVAL;
@@ -371,19 +356,11 @@ static int gpio_irq_set_type(u32 irq, u32 type)
        return 0;
 }
-struct irq_chip orion_gpio_irq_edge_chip = {
+struct irq_chip orion_gpio_irq_chip = {
-        .name           = "orion_gpio_irq_edge",
+        .name           = "orion_gpio",
-        .ack            = gpio_irq_edge_ack,
+        .ack            = gpio_irq_ack,
-        .mask           = gpio_irq_edge_mask,
+        .mask           = gpio_irq_mask,
-        .unmask         = gpio_irq_edge_unmask,
+        .unmask         = gpio_irq_unmask,
-        .set_type       = gpio_irq_set_type,
-};
-struct irq_chip orion_gpio_irq_level_chip = {
-        .name           = "orion_gpio_irq_level",
-        .mask           = gpio_irq_level_mask,
-        .mask_ack       = gpio_irq_level_mask,
-        .unmask         = gpio_irq_level_unmask,
        .set_type       = gpio_irq_set_type,
 };
diff --git a/arch/arm/plat-orion/include/plat/gpio.h b/arch/arm/plat-orion/include/plat/gpio.h
index 54deaf274b52..ec743e82c876 100644
--- a/arch/arm/plat-orion/include/plat/gpio.h
+++ b/arch/arm/plat-orion/include/plat/gpio.h
@@ -31,8 +31,7 @@ void orion_gpio_set_blink(unsigned pin, int blink);
 /*
 * GPIO interrupt handling.
 */
-extern struct irq_chip orion_gpio_irq_edge_chip;
+extern struct irq_chip orion_gpio_irq_chip;
-extern struct irq_chip orion_gpio_irq_level_chip;
 void orion_gpio_irq_handler(int irqoff);
diff --git a/arch/avr32/mach-at32ap/include/mach/board.h b/arch/avr32/mach-at32ap/include/mach/board.h
index aafaf7a78886..cff8e84f78f2 100644
--- a/arch/avr32/mach-at32ap/include/mach/board.h
+++ b/arch/avr32/mach-at32ap/include/mach/board.h
@@ -116,6 +116,7 @@ struct atmel_nand_data {
        int     enable_pin;     /* chip enable */
        int     det_pin;        /* card detect */
        int     rdy_pin;        /* ready/busy */
+        u8      rdy_pin_active_low;     /* rdy_pin value is inverted */
        u8      ale;            /* address line number connected to ALE */
        u8      cle;            /* address line number connected to CLE */
        u8      bus_width_16;   /* buswidth is 16 bit */
diff --git a/arch/ia64/include/asm/kvm.h b/arch/ia64/include/asm/kvm.h
index 116761ca462d..2b0a38e84705 100644
--- a/arch/ia64/include/asm/kvm.h
+++ b/arch/ia64/include/asm/kvm.h
@@ -24,6 +24,10 @@
 #include <linux/types.h>
 #include <linux/ioctl.h>
+/* Select x86 specific features in <linux/kvm.h> */
+#define __KVM_HAVE_IOAPIC
+#define __KVM_HAVE_DEVICE_ASSIGNMENT
 /* Architectural interrupt line count. */
 #define KVM_NR_INTERRUPTS 256
diff --git a/arch/ia64/include/asm/mmzone.h b/arch/ia64/include/asm/mmzone.h
index 34efe88eb849..f2ca32069b3f 100644
--- a/arch/ia64/include/asm/mmzone.h
+++ b/arch/ia64/include/asm/mmzone.h
@@ -31,10 +31,6 @@ static inline int pfn_to_nid(unsigned long pfn)
 #endif
 }
-#ifdef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID
-extern int early_pfn_to_nid(unsigned long pfn);
-#endif
 #ifdef CONFIG_IA64_DIG /* DIG systems are small */
 # define MAX_PHYSNODE_ID        8
 # define NR_NODE_MEMBLKS        (MAX_NUMNODES * 8)
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index 4e586f6110aa..28f982045f29 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -1337,6 +1337,10 @@ static void kvm_release_vm_pages(struct kvm *kvm)
        }
 }
+void kvm_arch_sync_events(struct kvm *kvm)
+{
+}
 void kvm_arch_destroy_vm(struct kvm *kvm)
 {
        kvm_iommu_unmap_guest(kvm);
diff --git a/arch/ia64/kvm/process.c b/arch/ia64/kvm/process.c
index 552d07724207..230eae482f32 100644
--- a/arch/ia64/kvm/process.c
+++ b/arch/ia64/kvm/process.c
@@ -455,13 +455,18 @@ fpswa_ret_t vmm_fp_emulate(int fp_fault, void *bundle, unsigned long *ipsr,
        if (!vmm_fpswa_interface)
                return (fpswa_ret_t) {-1, 0, 0, 0};
-        /*
-         * Just let fpswa driver to use hardware fp registers.
-         * No fp register is valid in memory.
-         */
        memset(&fp_state, 0, sizeof(fp_state_t));
        /*
+         * compute fp_state.  only FP registers f6 - f11 are used by the
+         * vmm, so set those bits in the mask and set the low volatile
+         * pointer to point to these registers.
+         */
+        fp_state.bitmask_low64 = 0xfc0;  /* bit6..bit11 */
+        fp_state.fp_state_low_volatile = (fp_state_low_volatile_t *) &regs->f6;
+   /*
         * unsigned long (*EFI_FPSWA) (
         *      unsigned long    trap_type,
         *      void             *Bundle,
@@ -545,10 +550,6 @@ void reflect_interruption(u64 ifa, u64 isr, u64 iim,
                status = vmm_handle_fpu_swa(0, regs, isr);
                if (!status)
                        return ;
-                else if (-EAGAIN == status) {
-                        vcpu_decrement_iip(vcpu);
-                        return ;
-                }
                break;
        }
diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c
index b73bf1838e57..3efea7d0a351 100644
--- a/arch/ia64/mm/numa.c
+++ b/arch/ia64/mm/numa.c
@@ -58,7 +58,7 @@ paddr_to_nid(unsigned long paddr)
 * SPARSEMEM to allocate the SPARSEMEM sectionmap on the NUMA node where
 * the section resides.
 */
-int early_pfn_to_nid(unsigned long pfn)
+int __meminit __early_pfn_to_nid(unsigned long pfn)
 {
        int i, section = pfn >> PFN_SECTION_SHIFT, ssec, esec;
@@ -70,7 +70,7 @@ int early_pfn_to_nid(unsigned long pfn)
                        return node_memblk[i].nid;
        }
-        return 0;
+        return -1;
 }
 #ifdef CONFIG_MEMORY_HOTPLUG
diff --git a/arch/powerpc/include/asm/pgtable-4k.h b/arch/powerpc/include/asm/pgtable-4k.h
index 6b18ba9d2d85..1dbca4e7de67 100644
--- a/arch/powerpc/include/asm/pgtable-4k.h
+++ b/arch/powerpc/include/asm/pgtable-4k.h
@@ -60,7 +60,7 @@
 /* It should be preserving the high 48 bits and then specifically */
 /* preserving _PAGE_SECONDARY | _PAGE_GROUP_IX */
 #define _PAGE_CHG_MASK  (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY | \
-                         _PAGE_HPTEFLAGS)
+                         _PAGE_HPTEFLAGS | _PAGE_SPECIAL)
 /* Bits to mask out from a PMD to get to the PTE page */
 #define PMD_MASKED_BITS         0
diff --git a/arch/powerpc/include/asm/pgtable-64k.h b/arch/powerpc/include/asm/pgtable-64k.h
index 07b0d8f09cb6..7389003349a6 100644
--- a/arch/powerpc/include/asm/pgtable-64k.h
+++ b/arch/powerpc/include/asm/pgtable-64k.h
@@ -114,7 +114,7 @@ static inline struct subpage_prot_table *pgd_subpage_prot(pgd_t *pgd)
 * pgprot changes
 */
 #define _PAGE_CHG_MASK  (PTE_RPN_MASK | _PAGE_HPTEFLAGS | _PAGE_DIRTY | \
-                         _PAGE_ACCESSED)
+                         _PAGE_ACCESSED | _PAGE_SPECIAL)
 /* Bits to mask out from a PMD to get to the PTE page */
 #define PMD_MASKED_BITS         0x1ff
diff --git a/arch/powerpc/include/asm/pgtable-ppc32.h b/arch/powerpc/include/asm/pgtable-ppc32.h
index f69a4d977729..820b5f0a35ce 100644
--- a/arch/powerpc/include/asm/pgtable-ppc32.h
+++ b/arch/powerpc/include/asm/pgtable-ppc32.h
@@ -429,7 +429,8 @@ extern int icache_44x_need_flush;
 #define PMD_PAGE_SIZE(pmd)      bad_call_to_PMD_PAGE_SIZE()
 #endif
-#define _PAGE_CHG_MASK  (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY)
+#define _PAGE_CHG_MASK  (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY | \
+                         _PAGE_SPECIAL)
 #define PAGE_PROT_BITS  (_PAGE_GUARDED | _PAGE_COHERENT | _PAGE_NO_CACHE | \
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index 5af4e9b2dbe2..ada06924a423 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -646,11 +646,16 @@ static int emulate_vsx(unsigned char __user *addr, unsigned int reg,
                       unsigned int areg, struct pt_regs *regs,
                       unsigned int flags, unsigned int length)
 {
-        char *ptr = (char *) &current->thread.TS_FPR(reg);
+        char *ptr;
        int ret = 0;
        flush_vsx_to_thread(current);
+        if (reg < 32)
+                ptr = (char *) &current->thread.TS_FPR(reg);
+        else
+                ptr = (char *) &current->thread.vr[reg - 32];
        if (flags & ST)
                ret = __copy_to_user(addr, ptr, length);
        else {
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 2822c8ccfaaf..5f81256287f5 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -125,6 +125,10 @@ static void kvmppc_free_vcpus(struct kvm *kvm)
        }
 }
+void kvm_arch_sync_events(struct kvm *kvm)
+{
+}
 void kvm_arch_destroy_vm(struct kvm *kvm)
 {
        kvmppc_free_vcpus(kvm);
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 7393bd76d698..5ac08b8ab654 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -19,6 +19,7 @@
 #include <linux/notifier.h>
 #include <linux/lmb.h>
 #include <linux/of.h>
+#include <linux/pfn.h>
 #include <asm/sparsemem.h>
 #include <asm/prom.h>
 #include <asm/system.h>
@@ -882,7 +883,7 @@ static void mark_reserved_regions_for_nid(int nid)
                unsigned long physbase = lmb.reserved.region[i].base;
                unsigned long size = lmb.reserved.region[i].size;
                unsigned long start_pfn = physbase >> PAGE_SHIFT;
-                unsigned long end_pfn = ((physbase + size) >> PAGE_SHIFT);
+                unsigned long end_pfn = PFN_UP(physbase + size);
                struct node_active_region node_ar;
                unsigned long node_end_pfn = node->node_start_pfn +
                                             node->node_spanned_pages;
@@ -908,7 +909,7 @@ static void mark_reserved_regions_for_nid(int nid)
                         */
                        if (end_pfn > node_ar.end_pfn)
                                reserve_size = (node_ar.end_pfn << PAGE_SHIFT)
-                                        - (start_pfn << PAGE_SHIFT);
+                                        - physbase;
                        /*
                         * Only worry about *this* node, others may not
                         * yet have valid NODE_DATA().
diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
index 67de6bf3db3d..d281cc0bca71 100644
--- a/arch/powerpc/platforms/ps3/mm.c
+++ b/arch/powerpc/platforms/ps3/mm.c
@@ -328,7 +328,7 @@ static int __init ps3_mm_add_memory(void)
        return result;
 }
-core_initcall(ps3_mm_add_memory);
+device_initcall(ps3_mm_add_memory);
 /*============================================================================*/
 /* dma routines                                                               */
diff --git a/arch/s390/include/asm/cputime.h b/arch/s390/include/asm/cputime.h
index 521726430afa..95b0f7db3c69 100644
--- a/arch/s390/include/asm/cputime.h
+++ b/arch/s390/include/asm/cputime.h
@@ -145,7 +145,7 @@ cputime_to_timeval(const cputime_t cputime, struct timeval *value)
        value->tv_usec = rp.subreg.even / 4096;
        value->tv_sec = rp.subreg.odd;
 #else
-        value->tv_usec = cputime % 4096000000ULL;
+        value->tv_usec = (cputime % 4096000000ULL) / 4096;
        value->tv_sec = cputime / 4096000000ULL;
 #endif
 }
diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
index 2bd9faeb3919..e8bd6ac22c99 100644
--- a/arch/s390/include/asm/setup.h
+++ b/arch/s390/include/asm/setup.h
@@ -43,6 +43,8 @@ struct mem_chunk {
 extern struct mem_chunk memory_chunk[];
 extern unsigned long real_memory_size;
+extern int memory_end_set;
+extern unsigned long memory_end;
 void detect_memory_layout(struct mem_chunk chunk[]);
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index d825f4950e4e..c5cfb6185eac 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -82,7 +82,9 @@ char elf_platform[ELF_PLATFORM_SIZE];
 struct mem_chunk __initdata memory_chunk[MEMORY_CHUNKS];
 volatile int __cpu_logical_map[NR_CPUS]; /* logical cpu to cpu address */
-static unsigned long __initdata memory_end;
+int __initdata memory_end_set;
+unsigned long __initdata memory_end;
 /*
 * This is set up by the setup-routine at boot-time
@@ -281,6 +283,7 @@ void (*pm_power_off)(void) = machine_power_off;
 static int __init early_parse_mem(char *p)
 {
        memory_end = memparse(p, &p);
+        memory_end_set = 1;
        return 0;
 }
 early_param("mem", early_parse_mem);
@@ -508,8 +511,10 @@ static void __init setup_memory_end(void)
        int i;
 #if defined(CONFIG_ZFCPDUMP) || defined(CONFIG_ZFCPDUMP_MODULE)
-        if (ipl_info.type == IPL_TYPE_FCP_DUMP)
+        if (ipl_info.type == IPL_TYPE_FCP_DUMP) {
                memory_end = ZFCPDUMP_HSA_SIZE;
+                memory_end_set = 1;
+        }
 #endif
        memory_size = 0;
        memory_end &= PAGE_MASK;
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index be8497186b96..0d33893e1e89 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -212,6 +212,10 @@ static void kvm_free_vcpus(struct kvm *kvm)
        }
 }
+void kvm_arch_sync_events(struct kvm *kvm)
+{
+}
 void kvm_arch_destroy_vm(struct kvm *kvm)
 {
        kvm_free_vcpus(kvm);
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index ba4781b93890..fdb45df608b6 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -175,28 +175,8 @@ config IOMMU_LEAK
          Add a simple leak tracer to the IOMMU code. This is useful when you
          are debugging a buggy device driver that leaks IOMMU mappings.
-config MMIOTRACE
+config HAVE_MMIOTRACE_SUPPORT
-        bool "Memory mapped IO tracing"
+        def_bool y
-        depends on DEBUG_KERNEL && PCI
-        select TRACING
-        help
-          Mmiotrace traces Memory Mapped I/O access and is meant for
-          debugging and reverse engineering. It is called from the ioremap
-          implementation and works via page faults. Tracing is disabled by
-          default and can be enabled at run-time.
-          See Documentation/tracers/mmiotrace.txt.
-          If you are not helping to develop drivers, say N.
-config MMIOTRACE_TEST
-        tristate "Test module for mmiotrace"
-        depends on MMIOTRACE && m
-        help
-          This is a dumb module for testing mmiotrace. It is very dangerous
-          as it will write garbage to IO memory starting at a given address.
-          However, it should be safe to use on e.g. unused portion of VRAM.
-          Say N, unless you absolutely know what you are doing.
 #
 # IO delay types:
diff --git a/arch/x86/include/asm/kvm.h b/arch/x86/include/asm/kvm.h
index d2e3bf3608af..886c9402ec45 100644
--- a/arch/x86/include/asm/kvm.h
+++ b/arch/x86/include/asm/kvm.h
@@ -9,6 +9,13 @@
 #include <linux/types.h>
 #include <linux/ioctl.h>
+/* Select x86 specific features in <linux/kvm.h> */
+#define __KVM_HAVE_PIT
+#define __KVM_HAVE_IOAPIC
+#define __KVM_HAVE_DEVICE_ASSIGNMENT
+#define __KVM_HAVE_MSI
+#define __KVM_HAVE_USER_NMI
 /* Architectural interrupt line count. */
 #define KVM_NR_INTERRUPTS 256
diff --git a/arch/x86/include/asm/mmzone_32.h b/arch/x86/include/asm/mmzone_32.h
index 07f1af494ca5..105fb90a0635 100644
--- a/arch/x86/include/asm/mmzone_32.h
+++ b/arch/x86/include/asm/mmzone_32.h
@@ -32,8 +32,6 @@ static inline void get_memcfg_numa(void)
        get_memcfg_numa_flat();
 }
-extern int early_pfn_to_nid(unsigned long pfn);
 extern void resume_map_numa_kva(pgd_t *pgd);
 #else /* !CONFIG_NUMA */
diff --git a/arch/x86/include/asm/mmzone_64.h b/arch/x86/include/asm/mmzone_64.h
index a5b3817d4b9e..a29f48c2a322 100644
--- a/arch/x86/include/asm/mmzone_64.h
+++ b/arch/x86/include/asm/mmzone_64.h
@@ -40,8 +40,6 @@ static inline __attribute__((pure)) int phys_to_nid(unsigned long addr)
 #define node_end_pfn(nid)       (NODE_DATA(nid)->node_start_pfn +       \
                                 NODE_DATA(nid)->node_spanned_pages)
-extern int early_pfn_to_nid(unsigned long pfn);
 #ifdef CONFIG_NUMA_EMU
 #define FAKE_NODE_MIN_SIZE      (64 * 1024 * 1024)
 #define FAKE_NODE_MIN_HASH_MASK (~(FAKE_NODE_MIN_SIZE - 1UL))
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index c12823eb55b5..160b3ab11e7a 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -837,7 +837,7 @@ void clear_local_APIC(void)
        }
        /* lets not touch this if we didn't frob it */
-#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(X86_MCE_INTEL)
+#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(CONFIG_X86_MCE_INTEL)
        if (maxlvt >= 5) {
                v = apic_read(APIC_LVTTHMR);
                apic_write(APIC_LVTTHMR, v | APIC_LVT_MASKED);
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index fb039cd345d8..6428aa17b40e 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -1157,8 +1157,7 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
        data->cpu = pol->cpu;
        data->currpstate = HW_PSTATE_INVALID;
-        rc = powernow_k8_cpu_init_acpi(data);
+        if (powernow_k8_cpu_init_acpi(data)) {
-        if (rc) {
                /*
                 * Use the PSB BIOS structure. This is only availabe on
                 * an UP version, and is deprecated by AMD.
@@ -1176,17 +1175,20 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
                               "ACPI maintainers and complain to your BIOS "
                               "vendor.\n");
 #endif
-                        goto err_out;
+                        kfree(data);
+                        return -ENODEV;
                }
                if (pol->cpu != 0) {
                        printk(KERN_ERR FW_BUG PFX "No ACPI _PSS objects for "
                               "CPU other than CPU0. Complain to your BIOS "
                               "vendor.\n");
-                        goto err_out;
+                        kfree(data);
+                        return -ENODEV;
                }
                rc = find_psb_table(data);
                if (rc) {
-                        goto err_out;
+                        kfree(data);
+                        return -ENODEV;
                }
                /* Take a crude guess here.
                 * That guess was in microseconds, so multiply with 1000 */
diff --git a/arch/x86/kernel/cpu/mcheck/mce_64.c b/arch/x86/kernel/cpu/mcheck/mce_64.c
index 1c838032fd37..25cf624eccb7 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_64.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_64.c
@@ -295,11 +295,11 @@ void do_machine_check(struct pt_regs * regs, long error_code)
                 * If we know that the error was in user space, send a
                 * SIGBUS.  Otherwise, panic if tolerance is low.
                 *
-                 * do_exit() takes an awful lot of locks and has a slight
+                 * force_sig() takes an awful lot of locks and has a slight
                 * risk of deadlocking.
                 */
                if (user_space) {
-                        do_exit(SIGBUS);
+                        force_sig(SIGBUS, current);
                } else if (panic_on_oops || tolerant < 2) {
                        mce_panic("Uncorrected machine check",
                                &panicm, mcestart);
@@ -734,6 +734,7 @@ __setup("mce=", mcheck_enable);
 static int mce_resume(struct sys_device *dev)
 {
        mce_init(NULL);
+        mce_cpu_features(&current_cpu_data);
        return 0;
 }
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index fec79ad85dc6..646da41a620a 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -111,9 +111,6 @@ void cpu_idle(void)
                        check_pgt_cache();
                        rmb();
-                        if (rcu_pending(cpu))
-                                rcu_check_callbacks(cpu, 0);
                        if (cpu_is_offline(cpu))
                                play_dead();
diff --git a/arch/x86/kernel/vmiclock_32.c b/arch/x86/kernel/vmiclock_32.c
index a4791ef412d1..9cd28c04952a 100644
--- a/arch/x86/kernel/vmiclock_32.c
+++ b/arch/x86/kernel/vmiclock_32.c
@@ -283,10 +283,13 @@ void __devinit vmi_time_ap_init(void)
 #endif
 /** vmi clocksource */
+static struct clocksource clocksource_vmi;
 static cycle_t read_real_cycles(void)
 {
-        return vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL);
+        cycle_t ret = (cycle_t)vmi_timer_ops.get_cycle_counter(VMI_CYCLES_REAL);
+        return ret >= clocksource_vmi.cycle_last ?
+                ret : clocksource_vmi.cycle_last;
 }
 static struct clocksource clocksource_vmi = {
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index e665d1c623ca..72bd275a9b5c 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -207,7 +207,7 @@ static int __pit_timer_fn(struct kvm_kpit_state *ps)
        hrtimer_add_expires_ns(&pt->timer, pt->period);
        pt->scheduled = hrtimer_get_expires_ns(&pt->timer);
        if (pt->period)
-                ps->channels[0].count_load_time = hrtimer_get_expires(&pt->timer);
+                ps->channels[0].count_load_time = ktime_get();
        return (pt->period == 0 ? 0 : 1);
 }
diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index c019b8edcdb7..cf17ed52f6fb 100644
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -87,13 +87,6 @@ void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu)
 }
 EXPORT_SYMBOL_GPL(kvm_inject_pending_timer_irqs);
-void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
-{
-        kvm_apic_timer_intr_post(vcpu, vec);
-        /* TODO: PIT, RTC etc. */
-}
-EXPORT_SYMBOL_GPL(kvm_timer_intr_post);
 void __kvm_migrate_timers(struct kvm_vcpu *vcpu)
 {
        __kvm_migrate_apic_timer(vcpu);
diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
index 2bf32a03ceec..82579ee538d0 100644
--- a/arch/x86/kvm/irq.h
+++ b/arch/x86/kvm/irq.h
@@ -89,7 +89,6 @@ static inline int irqchip_in_kernel(struct kvm *kvm)
 void kvm_pic_reset(struct kvm_kpic_state *s);
-void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
 void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
 void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
 void kvm_apic_nmi_wd_deliver(struct kvm_vcpu *vcpu);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index afac68c0815c..f0b67f2cdd69 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -35,6 +35,12 @@
 #include "kvm_cache_regs.h"
 #include "irq.h"
+#ifndef CONFIG_X86_64
+#define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
+#else
+#define mod_64(x, y) ((x) % (y))
+#endif
 #define PRId64 "d"
 #define PRIx64 "llx"
 #define PRIu64 "u"
@@ -511,52 +517,22 @@ static void apic_send_ipi(struct kvm_lapic *apic)
 static u32 apic_get_tmcct(struct kvm_lapic *apic)
 {
-        u64 counter_passed;
+        ktime_t remaining;
-        ktime_t passed, now;
+        s64 ns;
        u32 tmcct;
        ASSERT(apic != NULL);
-        now = apic->timer.dev.base->get_time();
-        tmcct = apic_get_reg(apic, APIC_TMICT);
        /* if initial count is 0, current count should also be 0 */
-        if (tmcct == 0)
+        if (apic_get_reg(apic, APIC_TMICT) == 0)
                return 0;
-        if (unlikely(ktime_to_ns(now) <=
+        remaining = hrtimer_expires_remaining(&apic->timer.dev);
-                ktime_to_ns(apic->timer.last_update))) {
+        if (ktime_to_ns(remaining) < 0)
-                /* Wrap around */
+                remaining = ktime_set(0, 0);
-                passed = ktime_add(( {
-                                    (ktime_t) {
+        ns = mod_64(ktime_to_ns(remaining), apic->timer.period);
-                                    .tv64 = KTIME_MAX -
+        tmcct = div64_u64(ns, (APIC_BUS_CYCLE_NS * apic->timer.divide_count));
-                                    (apic->timer.last_update).tv64}; }
-                                   ), now);
-                apic_debug("time elapsed\n");
-        } else
-                passed = ktime_sub(now, apic->timer.last_update);
-        counter_passed = div64_u64(ktime_to_ns(passed),
-                                   (APIC_BUS_CYCLE_NS * apic->timer.divide_count));
-        if (counter_passed > tmcct) {
-                if (unlikely(!apic_lvtt_period(apic))) {
-                        /* one-shot timers stick at 0 until reset */
-                        tmcct = 0;
-                } else {
-                        /*
-                         * periodic timers reset to APIC_TMICT when they
-                         * hit 0. The while loop simulates this happening N
-                         * times. (counter_passed %= tmcct) would also work,
-                         * but might be slower or not work on 32-bit??
-                         */
-                        while (counter_passed > tmcct)
-                                counter_passed -= tmcct;
-                        tmcct -= counter_passed;
-                }
-        } else {
-                tmcct -= counter_passed;
-        }
        return tmcct;
 }
@@ -653,8 +629,6 @@ static void start_apic_timer(struct kvm_lapic *apic)
 {
        ktime_t now = apic->timer.dev.base->get_time();
-        apic->timer.last_update = now;
        apic->timer.period = apic_get_reg(apic, APIC_TMICT) *
                    APIC_BUS_CYCLE_NS * apic->timer.divide_count;
        atomic_set(&apic->timer.pending, 0);
@@ -1110,16 +1084,6 @@ void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu)
        }
 }
-void kvm_apic_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
-{
-        struct kvm_lapic *apic = vcpu->arch.apic;
-        if (apic && apic_lvt_vector(apic, APIC_LVTT) == vec)
-                apic->timer.last_update = ktime_add_ns(
-                                apic->timer.last_update,
-                                apic->timer.period);
-}
 int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu)
 {
        int vector = kvm_apic_has_interrupt(vcpu);
diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
index 81858881287e..45ab6ee71209 100644
--- a/arch/x86/kvm/lapic.h
+++ b/arch/x86/kvm/lapic.h
@@ -12,7 +12,6 @@ struct kvm_lapic {
                atomic_t pending;
                s64 period;     /* unit: ns */
                u32 divide_count;
-                ktime_t last_update;
                struct hrtimer dev;
        } timer;
        struct kvm_vcpu *vcpu;
@@ -42,7 +41,6 @@ void kvm_set_apic_base(struct kvm_vcpu *vcpu, u64 data);
 void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu);
 int kvm_lapic_enabled(struct kvm_vcpu *vcpu);
 int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu);
-void kvm_apic_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
 void kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr);
 void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 83f11c7474a1..2d4477c71473 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1698,8 +1698,13 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *shadow_pte,
        if (largepage)
                spte |= PT_PAGE_SIZE_MASK;
        if (mt_mask) {
-                mt_mask = get_memory_type(vcpu, gfn) <<
+                if (!kvm_is_mmio_pfn(pfn)) {
-                          kvm_x86_ops->get_mt_mask_shift();
+                        mt_mask = get_memory_type(vcpu, gfn) <<
+                                kvm_x86_ops->get_mt_mask_shift();
+                        mt_mask |= VMX_EPT_IGMT_BIT;
+                } else
+                        mt_mask = MTRR_TYPE_UNCACHABLE <<
+                                kvm_x86_ops->get_mt_mask_shift();
                spte |= mt_mask;
        }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1452851ae258..a9e769e4e251 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1600,7 +1600,6 @@ static void svm_intr_assist(struct kvm_vcpu *vcpu)
        /* Okay, we can deliver the interrupt: grab it and update PIC state. */
        intr_vector = kvm_cpu_get_interrupt(vcpu);
        svm_inject_irq(svm, intr_vector);
-        kvm_timer_intr_post(vcpu, intr_vector);
 out:
        update_cr8_intercept(vcpu);
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 6259d7467648..7611af576829 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -903,6 +903,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
                data = vmcs_readl(GUEST_SYSENTER_ESP);
                break;
        default:
+                vmx_load_host_state(to_vmx(vcpu));
                msr = find_msr_entry(to_vmx(vcpu), msr_index);
                if (msr) {
                        data = msr->data;
@@ -3285,7 +3286,6 @@ static void vmx_intr_assist(struct kvm_vcpu *vcpu)
        }
        if (vcpu->arch.interrupt.pending) {
                vmx_inject_irq(vcpu, vcpu->arch.interrupt.nr);
-                kvm_timer_intr_post(vcpu, vcpu->arch.interrupt.nr);
                if (kvm_cpu_has_interrupt(vcpu))
                        enable_irq_window(vcpu);
        }
@@ -3687,8 +3687,7 @@ static int __init vmx_init(void)
        if (vm_need_ept()) {
                bypass_guest_pf = 0;
                kvm_mmu_set_base_ptes(VMX_EPT_READABLE_MASK |
-                        VMX_EPT_WRITABLE_MASK |
+                        VMX_EPT_WRITABLE_MASK);
-                        VMX_EPT_IGMT_BIT);
                kvm_mmu_set_mask_ptes(0ull, 0ull, 0ull, 0ull,
                                VMX_EPT_EXECUTABLE_MASK,
                                VMX_EPT_DEFAULT_MT << VMX_EPT_MT_EPTE_SHIFT);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index cc17546a2406..758b7a155ae9 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -967,7 +967,6 @@ int kvm_dev_ioctl_check_extension(long ext)
        case KVM_CAP_MMU_SHADOW_CACHE_CONTROL:
        case KVM_CAP_SET_TSS_ADDR:
        case KVM_CAP_EXT_CPUID:
-        case KVM_CAP_CLOCKSOURCE:
        case KVM_CAP_PIT:
        case KVM_CAP_NOP_IO_DELAY:
        case KVM_CAP_MP_STATE:
@@ -992,6 +991,9 @@ int kvm_dev_ioctl_check_extension(long ext)
        case KVM_CAP_IOMMU:
                r = iommu_found();
                break;
+        case KVM_CAP_CLOCKSOURCE:
+                r = boot_cpu_has(X86_FEATURE_CONSTANT_TSC);
+                break;
        default:
                r = 0;
                break;
@@ -4127,9 +4129,13 @@ static void kvm_free_vcpus(struct kvm *kvm)
 }
-void kvm_arch_destroy_vm(struct kvm *kvm)
+void kvm_arch_sync_events(struct kvm *kvm)
 {
        kvm_free_all_assigned_devices(kvm);
+}
+void kvm_arch_destroy_vm(struct kvm *kvm)
+{
        kvm_iommu_unmap_guest(kvm);
        kvm_free_pit(kvm);
        kfree(kvm->arch.vpic);
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index deb1c1ab7868..64c9cf043cdd 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -166,7 +166,7 @@ int __init compute_hash_shift(struct bootnode *nodes, int numnodes,
        return shift;
 }
-int early_pfn_to_nid(unsigned long pfn)
+int __meminit  __early_pfn_to_nid(unsigned long pfn)
 {
        return phys_to_nid(pfn << PAGE_SHIFT);
 }
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 8ca0d8566fc8..7be47d1a97e4 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -508,18 +508,13 @@ static int split_large_page(pte_t *kpte, unsigned long address)
 #endif
        /*
-         * Install the new, split up pagetable. Important details here:
+         * Install the new, split up pagetable.
         *
-         * On Intel the NX bit of all levels must be cleared to make a
+         * We use the standard kernel pagetable protections for the new
-         * page executable. See section 4.13.2 of Intel 64 and IA-32
+         * pagetable protections, the actual ptes set above control the
-         * Architectures Software Developer's Manual).
+         * primary protection behavior:
-         *
-         * Mark the entry present. The current mapping might be
-         * set to not present, which we preserved above.
         */
-        ref_prot = pte_pgprot(pte_mkexec(pte_clrhuge(*kpte)));
+        __set_pmd_pte(kpte, address, mk_pte(base, __pgprot(_KERNPG_TABLE)));
-        pgprot_val(ref_prot) |= _PAGE_PRESENT;
-        __set_pmd_pte(kpte, address, mk_pte(base, ref_prot));
        base = NULL;
 out_unlock:
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index a09535377a94..bbbdc4b8ccf2 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -209,12 +209,19 @@ void blk_abort_queue(struct request_queue *q)
 {
        unsigned long flags;
        struct request *rq, *tmp;
+        LIST_HEAD(list);
        spin_lock_irqsave(q->queue_lock, flags);
        elv_abort_queue(q);
-        list_for_each_entry_safe(rq, tmp, &q->timeout_list, timeout_list)
+        /*
+         * Splice entries to local list, to avoid deadlocking if entries
+         * get readded to the timeout list by error handling
+         */
+        list_splice_init(&q->timeout_list, &list);
+        list_for_each_entry_safe(rq, tmp, &list, timeout_list)
                blk_abort_request(rq);
        spin_unlock_irqrestore(q->queue_lock, flags);
diff --git a/block/blktrace.c b/block/blktrace.c
index 39cc3bfe56e4..7cf9d1ff45a0 100644
--- a/block/blktrace.c
+++ b/block/blktrace.c
@@ -142,7 +142,7 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
        what |= ddir_act[rw & WRITE];
        what |= MASK_TC_BIT(rw, BARRIER);
-        what |= MASK_TC_BIT(rw, SYNC);
+        what |= MASK_TC_BIT(rw, SYNCIO);
        what |= MASK_TC_BIT(rw, AHEAD);
        what |= MASK_TC_BIT(rw, META);
        what |= MASK_TC_BIT(rw, DISCARD);
diff --git a/block/bsg.c b/block/bsg.c
index d414bb5607e8..0ce8806dd0c1 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -244,7 +244,8 @@ bsg_validate_sgv4_hdr(struct request_queue *q, struct sg_io_v4 *hdr, int *rw)
 * map sg_io_v4 to a request.
 */
 static struct request *
-bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm)
+bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm,
+            u8 *sense)
 {
        struct request_queue *q = bd->queue;
        struct request *rq, *next_rq = NULL;
@@ -306,6 +307,10 @@ bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm)
                if (ret)
                        goto out;
        }
+        rq->sense = sense;
+        rq->sense_len = 0;
        return rq;
 out:
        if (rq->cmd != rq->__cmd)
@@ -348,9 +353,6 @@ static void bsg_rq_end_io(struct request *rq, int uptodate)
 static void bsg_add_command(struct bsg_device *bd, struct request_queue *q,
                            struct bsg_command *bc, struct request *rq)
 {
-        rq->sense = bc->sense;
-        rq->sense_len = 0;
        /*
         * add bc command to busy queue and submit rq for io
         */
@@ -419,7 +421,7 @@ static int blk_complete_sgv4_hdr_rq(struct request *rq, struct sg_io_v4 *hdr,
 {
        int ret = 0;
-        dprintk("rq %p bio %p %u\n", rq, bio, rq->errors);
+        dprintk("rq %p bio %p 0x%x\n", rq, bio, rq->errors);
        /*
         * fill in all the output members
         */
@@ -635,7 +637,7 @@ static int __bsg_write(struct bsg_device *bd, const char __user *buf,
                /*
                 * get a request, fill in the blanks, and add to request queue
                 */
-                rq = bsg_map_hdr(bd, &bc->hdr, has_write_perm);
+                rq = bsg_map_hdr(bd, &bc->hdr, has_write_perm, bc->sense);
                if (IS_ERR(rq)) {
                        ret = PTR_ERR(rq);
                        rq = NULL;
@@ -922,11 +924,12 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                struct request *rq;
                struct bio *bio, *bidi_bio = NULL;
                struct sg_io_v4 hdr;
+                u8 sense[SCSI_SENSE_BUFFERSIZE];
                if (copy_from_user(&hdr, uarg, sizeof(hdr)))
                        return -EFAULT;
-                rq = bsg_map_hdr(bd, &hdr, file->f_mode & FMODE_WRITE);
+                rq = bsg_map_hdr(bd, &hdr, file->f_mode & FMODE_WRITE, sense);
                if (IS_ERR(rq))
                        return PTR_ERR(rq);
diff --git a/block/genhd.c b/block/genhd.c
index 397960cf26af..e1eadcc9546a 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -1087,6 +1087,14 @@ dev_t blk_lookup_devt(const char *name, int partno)
                if (strcmp(dev_name(dev), name))
                        continue;
+                if (partno < disk->minors) {
+                        /* We need to return the right devno, even
+                         * if the partition doesn't exist yet.
+                         */
+                        devt = MKDEV(MAJOR(dev->devt),
+                                     MINOR(dev->devt) + partno);
+                        break;
+                }
                part = disk_get_part(disk, partno);
                if (part) {
                        devt = part_devt(part);
diff --git a/crypto/lrw.c b/crypto/lrw.c
index 8ef664e3bcd9..358f80be2bf9 100644
--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -45,7 +45,13 @@ struct priv {
 static inline void setbit128_bbe(void *b, int bit)
 {
-        __set_bit(bit ^ 0x78, b);
+        __set_bit(bit ^ (0x80 -
+#ifdef __BIG_ENDIAN
+                         BITS_PER_LONG
+#else
+                         BITS_PER_BYTE
+#endif
+                        ), b);
 }
 static int setkey(struct crypto_tfm *parent, const u8 *key,
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 0b299b0f8172..714cb046b594 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -773,18 +773,32 @@ unsigned int ata_sff_data_xfer32(struct ata_device *dev, unsigned char *buf,
        else
                iowrite32_rep(data_addr, buf, words);
+        /* Transfer trailing bytes, if any */
        if (unlikely(slop)) {
-                __le32 pad;
+                unsigned char pad[4];
+                /* Point buf to the tail of buffer */
+                buf += buflen - slop;
+                /*
+                 * Use io*_rep() accessors here as well to avoid pointlessly
+                 * swapping bytes to and fro on the big endian machines...
+                 */
                if (rw == READ) {
-                        pad = cpu_to_le32(ioread32(ap->ioaddr.data_addr));
+                        if (slop < 3)
-                        memcpy(buf + buflen - slop, &pad, slop);
+                                ioread16_rep(data_addr, pad, 1);
+                        else
+                                ioread32_rep(data_addr, pad, 1);
+                        memcpy(buf, pad, slop);
                } else {
-                        memcpy(&pad, buf + buflen - slop, slop);
+                        memcpy(pad, buf, slop);
-                        iowrite32(le32_to_cpu(pad), ap->ioaddr.data_addr);
+                        if (slop < 3)
+                                iowrite16_rep(data_addr, pad, 1);
+                        else
+                                iowrite32_rep(data_addr, pad, 1);
                }
-                words++;
        }
-        return words << 2;
+        return (buflen + 1) & ~1;
 }
 EXPORT_SYMBOL_GPL(ata_sff_data_xfer32);
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index 79a6c9a0b721..ba556d3e6963 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -110,7 +110,8 @@ static const struct via_isa_bridge {
        { "vt8237s",    PCI_DEVICE_ID_VIA_8237S,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
        { "vt8251",     PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
        { "cx700",      PCI_DEVICE_ID_VIA_CX700,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
-        { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES},
+        { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
+        { "vt6415",     PCI_DEVICE_ID_VIA_6415,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
        { "vt8237a",    PCI_DEVICE_ID_VIA_8237A,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
        { "vt8237",     PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
        { "vt8235",     PCI_DEVICE_ID_VIA_8235,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
@@ -593,6 +594,7 @@ static int via_reinit_one(struct pci_dev *pdev)
 #endif
 static const struct pci_device_id via[] = {
+        { PCI_VDEVICE(VIA, 0x0415), },
        { PCI_VDEVICE(VIA, 0x0571), },
        { PCI_VDEVICE(VIA, 0x0581), },
        { PCI_VDEVICE(VIA, 0x1571), },
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 444af0415ca1..55a8eed3f3a3 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -421,19 +421,21 @@ static struct ata_port_operations nv_generic_ops = {
        .hardreset              = ATA_OP_NULL,
 };
-/* OSDL bz3352 reports that nf2/3 controllers can't determine device
+/* nf2 is ripe with hardreset related problems.
- * signature reliably.  Also, the following thread reports detection
+ *
- * failure on cold boot with the standard debouncing timing.
+ * kernel bz#3352 reports nf2/3 controllers can't determine device
+ * signature reliably.  The following thread reports detection failure
+ * on cold boot with the standard debouncing timing.
 *
 * http://thread.gmane.org/gmane.linux.ide/34098
 *
- * Debounce with hotplug timing and request follow-up SRST.
+ * And bz#12176 reports that hardreset simply doesn't work on nf2.
+ * Give up on it and just don't do hardreset.
 */
 static struct ata_port_operations nv_nf2_ops = {
-        .inherits               = &nv_common_ops,
+        .inherits               = &nv_generic_ops,
        .freeze                 = nv_nf2_freeze,
        .thaw                   = nv_nf2_thaw,
-        .hardreset              = nv_noclassify_hardreset,
 };
 /* For initial probing after boot and hot plugging, hardreset mostly
diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h
index c237527b1aa5..5e41e6dd657b 100644
--- a/drivers/block/aoe/aoe.h
+++ b/drivers/block/aoe/aoe.h
@@ -18,6 +18,7 @@
 enum {
        AOECMD_ATA,
        AOECMD_CFG,
+        AOECMD_VEND_MIN = 0xf0,
        AOEFL_RSP = (1<<3),
        AOEFL_ERR = (1<<2),
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index 30de5b1c647e..c6099ba9a4b8 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -142,6 +142,8 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
                aoecmd_cfg_rsp(skb);
                break;
        default:
+                if (h->cmd >= AOECMD_VEND_MIN)
+                        break;  /* don't complain about vendor commands */
                printk(KERN_INFO "aoe: unknown cmd %d\n", h->cmd);
        }
 exit:
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 01e69383d9c0..d2cb67b61176 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -3390,6 +3390,203 @@ static void free_hba(int i)
        kfree(p);
 }
+/* Send a message CDB to the firmware. */
+static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, unsigned char type)
+{
+        typedef struct {
+                CommandListHeader_struct CommandHeader;
+                RequestBlock_struct Request;
+                ErrDescriptor_struct ErrorDescriptor;
+        } Command;
+        static const size_t cmd_sz = sizeof(Command) + sizeof(ErrorInfo_struct);
+        Command *cmd;
+        dma_addr_t paddr64;
+        uint32_t paddr32, tag;
+        void __iomem *vaddr;
+        int i, err;
+        vaddr = ioremap_nocache(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0));
+        if (vaddr == NULL)
+                return -ENOMEM;
+        /* The Inbound Post Queue only accepts 32-bit physical addresses for the
+           CCISS commands, so they must be allocated from the lower 4GiB of
+           memory. */
+        err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
+        if (err) {
+                iounmap(vaddr);
+                return -ENOMEM;
+        }
+        cmd = pci_alloc_consistent(pdev, cmd_sz, &paddr64);
+        if (cmd == NULL) {
+                iounmap(vaddr);
+                return -ENOMEM;
+        }
+        /* This must fit, because of the 32-bit consistent DMA mask.  Also,
+           although there's no guarantee, we assume that the address is at
+           least 4-byte aligned (most likely, it's page-aligned). */
+        paddr32 = paddr64;
+        cmd->CommandHeader.ReplyQueue = 0;
+        cmd->CommandHeader.SGList = 0;
+        cmd->CommandHeader.SGTotal = 0;
+        cmd->CommandHeader.Tag.lower = paddr32;
+        cmd->CommandHeader.Tag.upper = 0;
+        memset(&cmd->CommandHeader.LUN.LunAddrBytes, 0, 8);
+        cmd->Request.CDBLen = 16;
+        cmd->Request.Type.Type = TYPE_MSG;
+        cmd->Request.Type.Attribute = ATTR_HEADOFQUEUE;
+        cmd->Request.Type.Direction = XFER_NONE;
+        cmd->Request.Timeout = 0; /* Don't time out */
+        cmd->Request.CDB[0] = opcode;
+        cmd->Request.CDB[1] = type;
+        memset(&cmd->Request.CDB[2], 0, 14); /* the rest of the CDB is reserved */
+        cmd->ErrorDescriptor.Addr.lower = paddr32 + sizeof(Command);
+        cmd->ErrorDescriptor.Addr.upper = 0;
+        cmd->ErrorDescriptor.Len = sizeof(ErrorInfo_struct);
+        writel(paddr32, vaddr + SA5_REQUEST_PORT_OFFSET);
+        for (i = 0; i < 10; i++) {
+                tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
+                if ((tag & ~3) == paddr32)
+                        break;
+                schedule_timeout_uninterruptible(HZ);
+        }
+        iounmap(vaddr);
+        /* we leak the DMA buffer here ... no choice since the controller could
+           still complete the command. */
+        if (i == 10) {
+                printk(KERN_ERR "cciss: controller message %02x:%02x timed out\n",
+                        opcode, type);
+                return -ETIMEDOUT;
+        }
+        pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
+        if (tag & 2) {
+                printk(KERN_ERR "cciss: controller message %02x:%02x failed\n",
+                        opcode, type);
+                return -EIO;
+        }
+        printk(KERN_INFO "cciss: controller message %02x:%02x succeeded\n",
+                opcode, type);
+        return 0;
+}
+#define cciss_soft_reset_controller(p) cciss_message(p, 1, 0)
+#define cciss_noop(p) cciss_message(p, 3, 0)
+static __devinit int cciss_reset_msi(struct pci_dev *pdev)
+{
+/* the #defines are stolen from drivers/pci/msi.h. */
+#define msi_control_reg(base)           (base + PCI_MSI_FLAGS)
+#define PCI_MSIX_FLAGS_ENABLE           (1 << 15)
+        int pos;
+        u16 control = 0;
+        pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
+        if (pos) {
+                pci_read_config_word(pdev, msi_control_reg(pos), &control);
+                if (control & PCI_MSI_FLAGS_ENABLE) {
+                        printk(KERN_INFO "cciss: resetting MSI\n");
+                        pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSI_FLAGS_ENABLE);
+                }
+        }
+        pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
+        if (pos) {
+                pci_read_config_word(pdev, msi_control_reg(pos), &control);
+                if (control & PCI_MSIX_FLAGS_ENABLE) {
+                        printk(KERN_INFO "cciss: resetting MSI-X\n");
+                        pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSIX_FLAGS_ENABLE);
+                }
+        }
+        return 0;
+}
+/* This does a hard reset of the controller using PCI power management
+ * states. */
+static __devinit int cciss_hard_reset_controller(struct pci_dev *pdev)
+{
+        u16 pmcsr, saved_config_space[32];
+        int i, pos;
+        printk(KERN_INFO "cciss: using PCI PM to reset controller\n");
+        /* This is very nearly the same thing as
+           pci_save_state(pci_dev);
+           pci_set_power_state(pci_dev, PCI_D3hot);
+           pci_set_power_state(pci_dev, PCI_D0);
+           pci_restore_state(pci_dev);
+           but we can't use these nice canned kernel routines on
+           kexec, because they also check the MSI/MSI-X state in PCI
+           configuration space and do the wrong thing when it is
+           set/cleared.  Also, the pci_save/restore_state functions
+           violate the ordering requirements for restoring the
+           configuration space from the CCISS document (see the
+           comment below).  So we roll our own .... */
+        for (i = 0; i < 32; i++)
+                pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
+        pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
+        if (pos == 0) {
+                printk(KERN_ERR "cciss_reset_controller: PCI PM not supported\n");
+                return -ENODEV;
+        }
+        /* Quoting from the Open CISS Specification: "The Power
+         * Management Control/Status Register (CSR) controls the power
+         * state of the device.  The normal operating state is D0,
+         * CSR=00h.  The software off state is D3, CSR=03h.  To reset
+         * the controller, place the interface device in D3 then to
+         * D0, this causes a secondary PCI reset which will reset the
+         * controller." */
+        /* enter the D3hot power management state */
+        pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
+        pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+        pmcsr |= PCI_D3hot;
+        pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
+        schedule_timeout_uninterruptible(HZ >> 1);
+        /* enter the D0 power management state */
+        pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+        pmcsr |= PCI_D0;
+        pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
+        schedule_timeout_uninterruptible(HZ >> 1);
+        /* Restore the PCI configuration space.  The Open CISS
+         * Specification says, "Restore the PCI Configuration
+         * Registers, offsets 00h through 60h. It is important to
+         * restore the command register, 16-bits at offset 04h,
+         * last. Do not restore the configuration status register,
+         * 16-bits at offset 06h."  Note that the offset is 2*i. */
+        for (i = 0; i < 32; i++) {
+                if (i == 2 || i == 3)
+                        continue;
+                pci_write_config_word(pdev, 2*i, saved_config_space[i]);
+        }
+        wmb();
+        pci_write_config_word(pdev, 4, saved_config_space[2]);
+        return 0;
+}
 /*
 *  This is it.  Find all the controllers and register them.  I really hate
 *  stealing all these major device numbers.
@@ -3404,6 +3601,24 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
        int dac, return_code;
        InquiryData_struct *inq_buff = NULL;
+        if (reset_devices) {
+                /* Reset the controller with a PCI power-cycle */
+                if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
+                        return -ENODEV;
+                /* Some devices (notably the HP Smart Array 5i Controller)
+                   need a little pause here */
+                schedule_timeout_uninterruptible(30*HZ);
+                /* Now try to get the controller to respond to a no-op */
+                for (i=0; i<12; i++) {
+                        if (cciss_noop(pdev) == 0)
+                                break;
+                        else
+                                printk("cciss: no-op failed%s\n", (i < 11 ? "; re-trying" : ""));
+                }
+        }
        i = alloc_cciss_hba();
        if (i < 0)
                return -1;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index cf29cc4e6ab7..83d8ed39433d 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -558,6 +558,8 @@ static void process_fd_request(void);
 static void recalibrate_floppy(void);
 static void floppy_shutdown(unsigned long);
+static int floppy_request_regions(int);
+static void floppy_release_regions(int);
 static int floppy_grab_irq_and_dma(void);
 static void floppy_release_irq_and_dma(void);
@@ -4274,8 +4276,7 @@ static int __init floppy_init(void)
                FDCS->rawcmd = 2;
                if (user_reset_fdc(-1, FD_RESET_ALWAYS, 0)) {
                        /* free ioports reserved by floppy_grab_irq_and_dma() */
-                        release_region(FDCS->address + 2, 4);
+                        floppy_release_regions(fdc);
-                        release_region(FDCS->address + 7, 1);
                        FDCS->address = -1;
                        FDCS->version = FDC_NONE;
                        continue;
@@ -4284,8 +4285,7 @@ static int __init floppy_init(void)
                FDCS->version = get_fdc_version();
                if (FDCS->version == FDC_NONE) {
                        /* free ioports reserved by floppy_grab_irq_and_dma() */
-                        release_region(FDCS->address + 2, 4);
+                        floppy_release_regions(fdc);
-                        release_region(FDCS->address + 7, 1);
                        FDCS->address = -1;
                        continue;
                }
@@ -4358,6 +4358,47 @@ out_put_disk:
 static DEFINE_SPINLOCK(floppy_usage_lock);
+static const struct io_region {
+        int offset;
+        int size;
+} io_regions[] = {
+        { 2, 1 },
+        /* address + 3 is sometimes reserved by pnp bios for motherboard */
+        { 4, 2 },
+        /* address + 6 is reserved, and may be taken by IDE.
+         * Unfortunately, Adaptec doesn't know this :-(, */
+        { 7, 1 },
+};
+static void floppy_release_allocated_regions(int fdc, const struct io_region *p)
+{
+        while (p != io_regions) {
+                p--;
+                release_region(FDCS->address + p->offset, p->size);
+        }
+}
+#define ARRAY_END(X) (&((X)[ARRAY_SIZE(X)]))
+static int floppy_request_regions(int fdc)
+{
+        const struct io_region *p;
+        for (p = io_regions; p < ARRAY_END(io_regions); p++) {
+                if (!request_region(FDCS->address + p->offset, p->size, "floppy")) {
+                        DPRINT("Floppy io-port 0x%04lx in use\n", FDCS->address + p->offset);
+                        floppy_release_allocated_regions(fdc, p);
+                        return -EBUSY;
+                }
+        }
+        return 0;
+}
+static void floppy_release_regions(int fdc)
+{
+        floppy_release_allocated_regions(fdc, ARRAY_END(io_regions));
+}
 static int floppy_grab_irq_and_dma(void)
 {
        unsigned long flags;
@@ -4399,18 +4440,8 @@ static int floppy_grab_irq_and_dma(void)
        for (fdc = 0; fdc < N_FDC; fdc++) {
                if (FDCS->address != -1) {
-                        if (!request_region(FDCS->address + 2, 4, "floppy")) {
+                        if (floppy_request_regions(fdc))
-                                DPRINT("Floppy io-port 0x%04lx in use\n",
+                                goto cleanup;
-                                       FDCS->address + 2);
-                                goto cleanup1;
-                        }
-                        if (!request_region(FDCS->address + 7, 1, "floppy DIR")) {
-                                DPRINT("Floppy io-port 0x%04lx in use\n",
-                                       FDCS->address + 7);
-                                goto cleanup2;
-                        }
-                        /* address + 6 is reserved, and may be taken by IDE.
-                         * Unfortunately, Adaptec doesn't know this :-(, */
                }
        }
        for (fdc = 0; fdc < N_FDC; fdc++) {
@@ -4432,15 +4463,11 @@ static int floppy_grab_irq_and_dma(void)
        fdc = 0;
        irqdma_allocated = 1;
        return 0;
-cleanup2:
+cleanup:
-        release_region(FDCS->address + 2, 4);
-cleanup1:
        fd_free_irq();
        fd_free_dma();
-        while (--fdc >= 0) {
+        while (--fdc >= 0)
-                release_region(FDCS->address + 2, 4);
+                floppy_release_regions(fdc);
-                release_region(FDCS->address + 7, 1);
-        }
        spin_lock_irqsave(&floppy_usage_lock, flags);
        usage_count--;
        spin_unlock_irqrestore(&floppy_usage_lock, flags);
@@ -4501,10 +4528,8 @@ static void floppy_release_irq_and_dma(void)
 #endif
        old_fdc = fdc;
        for (fdc = 0; fdc < N_FDC; fdc++)
-                if (FDCS->address != -1) {
+                if (FDCS->address != -1)
-                        release_region(FDCS->address + 2, 4);
+                        floppy_release_regions(fdc);
-                        release_region(FDCS->address + 7, 1);
-                }
        fdc = old_fdc;
 }
diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c
index 9dfa27163001..c397b3ddba9b 100644
--- a/drivers/block/paride/pg.c
+++ b/drivers/block/paride/pg.c
@@ -422,7 +422,7 @@ static void xs(char *buf, char *targ, int len)
        for (k = 0; k < len; k++) {
                char c = *buf++;
-                if (c != ' ' || c != l)
+                if (c != ' ' && c != l)
                        l = *targ++ = c;
        }
        if (l == ' ')
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index a58993011edb..280a9d263eb3 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -518,6 +518,7 @@ struct dma_chan *__dma_request_channel(dma_cap_mask_t *mask, dma_filter_fn fn, v
                                       dma_chan_name(chan), err);
                        else
                                break;
+                        chan->private = NULL;
                        chan = NULL;
                }
        }
@@ -536,6 +537,7 @@ void dma_release_channel(struct dma_chan *chan)
        WARN_ONCE(chan->client_count != 1,
                  "chan reference count %d != 1\n", chan->client_count);
        dma_chan_put(chan);
+        chan->private = NULL;
        mutex_unlock(&dma_list_mutex);
 }
 EXPORT_SYMBOL_GPL(dma_release_channel);
diff --git a/drivers/dma/dw_dmac.c b/drivers/dma/dw_dmac.c
index 6b702cc46b3d..a97c07eef7ec 100644
--- a/drivers/dma/dw_dmac.c
+++ b/drivers/dma/dw_dmac.c
@@ -560,7 +560,7 @@ dwc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                unsigned long flags)
 {
        struct dw_dma_chan      *dwc = to_dw_dma_chan(chan);
-        struct dw_dma_slave     *dws = dwc->dws;
+        struct dw_dma_slave     *dws = chan->private;
        struct dw_desc          *prev;
        struct dw_desc          *first;
        u32                     ctllo;
@@ -790,7 +790,7 @@ static int dwc_alloc_chan_resources(struct dma_chan *chan)
        cfghi = DWC_CFGH_FIFO_MODE;
        cfglo = 0;
-        dws = dwc->dws;
+        dws = chan->private;
        if (dws) {
                /*
                 * We need controller-specific data to set up slave
@@ -866,7 +866,6 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
        spin_lock_bh(&dwc->lock);
        list_splice_init(&dwc->free_list, &list);
        dwc->descs_allocated = 0;
-        dwc->dws = NULL;
        /* Disable interrupts */
        channel_clear_bit(dw, MASK.XFER, dwc->mask);
diff --git a/drivers/dma/dw_dmac_regs.h b/drivers/dma/dw_dmac_regs.h
index 00fdd187bb0c..b252b202c5cf 100644
--- a/drivers/dma/dw_dmac_regs.h
+++ b/drivers/dma/dw_dmac_regs.h
@@ -139,8 +139,6 @@ struct dw_dma_chan {
        struct list_head        queue;
        struct list_head        free_list;
-        struct dw_dma_slave     *dws;
        unsigned int            descs_allocated;
 };
diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
index 261b9aa3f248..05aa2d406ac6 100644
--- a/drivers/firmware/memmap.c
+++ b/drivers/firmware/memmap.c
@@ -1,7 +1,7 @@
 /*
 * linux/drivers/firmware/memmap.c
 *  Copyright (C) 2008 SUSE LINUX Products GmbH
- *  by Bernhard Walle <bwalle@suse.de>
+ *  by Bernhard Walle <bernhard.walle@gmx.de>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License v2.0 as published by
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 4be3acbaaf9a..3a22eb9be378 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -80,18 +80,17 @@ config DRM_I915
          XFree86 4.4 and above. If unsure, build this and i830 as modules and
          the X server will load the correct one.
-endchoice
 config DRM_I915_KMS
        bool "Enable modesetting on intel by default"
        depends on DRM_I915
        help
-        Choose this option if you want kernel modesetting enabled by default,
+          Choose this option if you want kernel modesetting enabled by default,
-        and you have a new enough userspace to support this. Running old
+          and you have a new enough userspace to support this. Running old
-        userspaces with this enabled will cause pain.  Note that this causes
+          userspaces with this enabled will cause pain.  Note that this causes
-        the driver to bind to PCI devices, which precludes loading things
+          the driver to bind to PCI devices, which precludes loading things
-        like intelfb.
+          like intelfb.
+endchoice
 config DRM_MGA
        tristate "Matrox g200/g400"
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 6cad69ed21c5..1cc967448f4d 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1300,7 +1300,13 @@ static const struct hid_device_id hid_blacklist[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb651) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, 0x030c) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
@@ -1605,6 +1611,7 @@ static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0002) },
        { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0003) },
        { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0004) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3) },
@@ -1612,10 +1619,6 @@ static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD5) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY1) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb651) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
        { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_LABPRO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_GOTEMP) },
        { HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_SKIP) },
@@ -1626,8 +1629,6 @@ static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_1_PHIDGETSERVO_20) },
        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_8_8_4_IF_KIT) },
        { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
        { }
 };
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index e899f510ebeb..88511970508d 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -348,6 +348,9 @@
 #define USB_VENDOR_ID_PLAYDOTCOM        0x0b43
 #define USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII      0x0003
+#define USB_VENDOR_ID_POWERCOM          0x0d9f
+#define USB_DEVICE_ID_POWERCOM_UPS      0x0002
 #define USB_VENDOR_ID_SAITEK            0x06a3
 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 732449628971..02b19db5442e 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -267,8 +267,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
                default:
                        {
                                struct hid_device *hid = dev->hid;
-                                if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ)
+                                if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ) {
-                                        return -EINVAL;
+                                        ret = -EINVAL;
+                                        break;
+                                }
                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
                                        int len;
@@ -277,8 +279,9 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
                                        len = strlen(hid->name) + 1;
                                        if (len > _IOC_SIZE(cmd))
                                                len = _IOC_SIZE(cmd);
-                                        return copy_to_user(user_arg, hid->name, len) ?
+                                        ret = copy_to_user(user_arg, hid->name, len) ?
                                                -EFAULT : len;
+                                        break;
                                }
                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
@@ -288,12 +291,13 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
                                        len = strlen(hid->phys) + 1;
                                        if (len > _IOC_SIZE(cmd))
                                                len = _IOC_SIZE(cmd);
-                                        return copy_to_user(user_arg, hid->phys, len) ?
+                                        ret = copy_to_user(user_arg, hid->phys, len) ?
                                                -EFAULT : len;
+                                        break;
                                }
                }
-                        ret = -ENOTTY;
+                ret = -ENOTTY;
        }
        unlock_kernel();
        return ret;
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 609cafff86bc..5f81ddf71508 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -1872,7 +1872,7 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
        devid = superio_inw(sioaddr, SIO_REG_MANID);
        if (devid != SIO_FINTEK_ID) {
-                printk(KERN_INFO DRVNAME ": Not a Fintek device\n");
+                pr_debug(DRVNAME ": Not a Fintek device\n");
                goto exit;
        }
@@ -1932,7 +1932,7 @@ static int __init f71882fg_device_add(unsigned short address,
        res.name = f71882fg_pdev->name;
        err = acpi_check_resource_conflict(&res);
        if (err)
-                return err;
+                goto exit_device_put;
        err = platform_device_add_resources(f71882fg_pdev, &res, 1);
        if (err) {
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index abf4dfc8ec22..29c83b5b9697 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -166,6 +166,18 @@ static struct axis_conversion lis3lv02d_axis_xy_swap_yz_inverted = {2, -1, -3};
        },                                              \
        .driver_data = &lis3lv02d_axis_##_axis          \
 }
+#define AXIS_DMI_MATCH2(_ident, _class1, _name1,        \
+                                _class2, _name2,        \
+                                _axis) {                \
+        .ident = _ident,                                \
+        .callback = lis3lv02d_dmi_matched,              \
+        .matches = {                                    \
+                DMI_MATCH(DMI_##_class1, _name1),       \
+                DMI_MATCH(DMI_##_class2, _name2),       \
+        },                                              \
+        .driver_data = &lis3lv02d_axis_##_axis          \
+}
 static struct dmi_system_id lis3lv02d_dmi_ids[] = {
        /* product names are truncated to match all kinds of a same model */
        AXIS_DMI_MATCH("NC64x0", "HP Compaq nc64", x_inverted),
@@ -179,6 +191,16 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
        AXIS_DMI_MATCH("NC673x", "HP Compaq 673", xy_rotated_left_usd),
        AXIS_DMI_MATCH("NC651xx", "HP Compaq 651", xy_rotated_right),
        AXIS_DMI_MATCH("NC671xx", "HP Compaq 671", xy_swap_yz_inverted),
+        /* Intel-based HP Pavilion dv5 */
+        AXIS_DMI_MATCH2("HPDV5_I",
+                        PRODUCT_NAME, "HP Pavilion dv5",
+                        BOARD_NAME, "3603",
+                        x_inverted),
+        /* AMD-based HP Pavilion dv5 */
+        AXIS_DMI_MATCH2("HPDV5_A",
+                        PRODUCT_NAME, "HP Pavilion dv5",
+                        BOARD_NAME, "3600",
+                        y_inverted),
        { NULL, }
 /* Laptop models without axis info (yet):
 * "NC6910" "HP Compaq 6910"
@@ -213,9 +235,49 @@ static struct delayed_led_classdev hpled_led = {
        .set_brightness = hpled_set,
 };
+static acpi_status
+lis3lv02d_get_resource(struct acpi_resource *resource, void *context)
+{
+        if (resource->type == ACPI_RESOURCE_TYPE_EXTENDED_IRQ) {
+                struct acpi_resource_extended_irq *irq;
+                u32 *device_irq = context;
+                irq = &resource->data.extended_irq;
+                *device_irq = irq->interrupts[0];
+        }
+        return AE_OK;
+}
+static void lis3lv02d_enum_resources(struct acpi_device *device)
+{
+        acpi_status status;
+        status = acpi_walk_resources(device->handle, METHOD_NAME__CRS,
+                                        lis3lv02d_get_resource, &adev.irq);
+        if (ACPI_FAILURE(status))
+                printk(KERN_DEBUG DRIVER_NAME ": Error getting resources\n");
+}
+static s16 lis3lv02d_read_16(acpi_handle handle, int reg)
+{
+        u8 lo, hi;
+        adev.read(handle, reg - 1, &lo);
+        adev.read(handle, reg, &hi);
+        /* In "12 bit right justified" mode, bit 6, bit 7, bit 8 = bit 5 */
+        return (s16)((hi << 8) | lo);
+}
+static s16 lis3lv02d_read_8(acpi_handle handle, int reg)
+{
+        s8 lo;
+        adev.read(handle, reg, &lo);
+        return lo;
+}
 static int lis3lv02d_add(struct acpi_device *device)
 {
-        u8 val;
        int ret;
        if (!device)
@@ -229,10 +291,22 @@ static int lis3lv02d_add(struct acpi_device *device)
        strcpy(acpi_device_class(device), ACPI_MDPS_CLASS);
        device->driver_data = &adev;
-        lis3lv02d_acpi_read(device->handle, WHO_AM_I, &val);
+        lis3lv02d_acpi_read(device->handle, WHO_AM_I, &adev.whoami);
-        if ((val != LIS3LV02DL_ID) && (val != LIS302DL_ID)) {
+        switch (adev.whoami) {
+        case LIS_DOUBLE_ID:
+                printk(KERN_INFO DRIVER_NAME ": 2-byte sensor found\n");
+                adev.read_data = lis3lv02d_read_16;
+                adev.mdps_max_val = 2048;
+                break;
+        case LIS_SINGLE_ID:
+                printk(KERN_INFO DRIVER_NAME ": 1-byte sensor found\n");
+                adev.read_data = lis3lv02d_read_8;
+                adev.mdps_max_val = 128;
+                break;
+        default:
                printk(KERN_ERR DRIVER_NAME
-                                ": Accelerometer chip not LIS3LV02D{L,Q}\n");
+                        ": unknown sensor type 0x%X\n", adev.whoami);
+                return -EINVAL;
        }
        /* If possible use a "standard" axes order */
@@ -247,6 +321,9 @@ static int lis3lv02d_add(struct acpi_device *device)
        if (ret)
                return ret;
+        /* obtain IRQ number of our device from ACPI */
+        lis3lv02d_enum_resources(adev.device);
        ret = lis3lv02d_init_device(&adev);
        if (ret) {
                flush_work(&hpled_led.work);
diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
index 219d2d0d5a62..8bb2158f0453 100644
--- a/drivers/hwmon/lis3lv02d.c
+++ b/drivers/hwmon/lis3lv02d.c
@@ -3,7 +3,7 @@
 *
 *  Copyright (C) 2007-2008 Yan Burman
 *  Copyright (C) 2008 Eric Piel
- *  Copyright (C) 2008 Pavel Machek
+ *  Copyright (C) 2008-2009 Pavel Machek
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
@@ -35,6 +35,7 @@
 #include <linux/poll.h>
 #include <linux/freezer.h>
 #include <linux/uaccess.h>
+#include <linux/miscdevice.h>
 #include <acpi/acpi_drivers.h>
 #include <asm/atomic.h>
 #include "lis3lv02d.h"
@@ -52,24 +53,14 @@
 * joystick.
 */
-/* Maximum value our axis may get for the input device (signed 12 bits) */
+struct acpi_lis3lv02d adev = {
-#define MDPS_MAX_VAL 2048
+        .misc_wait   = __WAIT_QUEUE_HEAD_INITIALIZER(adev.misc_wait),
+};
-struct acpi_lis3lv02d adev;
 EXPORT_SYMBOL_GPL(adev);
 static int lis3lv02d_add_fs(struct acpi_device *device);
-static s16 lis3lv02d_read_16(acpi_handle handle, int reg)
-{
-        u8 lo, hi;
-        adev.read(handle, reg, &lo);
-        adev.read(handle, reg + 1, &hi);
-        /* In "12 bit right justified" mode, bit 6, bit 7, bit 8 = bit 5 */
-        return (s16)((hi << 8) | lo);
-}
 /**
 * lis3lv02d_get_axis - For the given axis, give the value converted
 * @axis:      1,2,3 - can also be negative
@@ -98,9 +89,9 @@ static void lis3lv02d_get_xyz(acpi_handle handle, int *x, int *y, int *z)
 {
        int position[3];
-        position[0] = lis3lv02d_read_16(handle, OUTX_L);
+        position[0] = adev.read_data(handle, OUTX);
-        position[1] = lis3lv02d_read_16(handle, OUTY_L);
+        position[1] = adev.read_data(handle, OUTY);
-        position[2] = lis3lv02d_read_16(handle, OUTZ_L);
+        position[2] = adev.read_data(handle, OUTZ);
        *x = lis3lv02d_get_axis(adev.ac.x, position);
        *y = lis3lv02d_get_axis(adev.ac.y, position);
@@ -110,26 +101,13 @@ static void lis3lv02d_get_xyz(acpi_handle handle, int *x, int *y, int *z)
 void lis3lv02d_poweroff(acpi_handle handle)
 {
        adev.is_on = 0;
-        /* disable X,Y,Z axis and power down */
-        adev.write(handle, CTRL_REG1, 0x00);
 }
 EXPORT_SYMBOL_GPL(lis3lv02d_poweroff);
 void lis3lv02d_poweron(acpi_handle handle)
 {
-        u8 val;
        adev.is_on = 1;
        adev.init(handle);
-        adev.write(handle, FF_WU_CFG, 0);
-        /*
-         * BDU: LSB and MSB values are not updated until both have been read.
-         *      So the value read will always be correct.
-         * IEN: Interrupt for free-fall and DD, not for data-ready.
-         */
-        adev.read(handle, CTRL_REG2, &val);
-        val |= CTRL2_BDU | CTRL2_IEN;
-        adev.write(handle, CTRL_REG2, val);
 }
 EXPORT_SYMBOL_GPL(lis3lv02d_poweron);
@@ -162,6 +140,140 @@ static void lis3lv02d_decrease_use(struct acpi_lis3lv02d *dev)
        mutex_unlock(&dev->lock);
 }
+static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
+{
+        /*
+         * Be careful: on some HP laptops the bios force DD when on battery and
+         * the lid is closed. This leads to interrupts as soon as a little move
+         * is done.
+         */
+        atomic_inc(&adev.count);
+        wake_up_interruptible(&adev.misc_wait);
+        kill_fasync(&adev.async_queue, SIGIO, POLL_IN);
+        return IRQ_HANDLED;
+}
+static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
+{
+        int ret;
+        if (test_and_set_bit(0, &adev.misc_opened))
+                return -EBUSY; /* already open */
+        atomic_set(&adev.count, 0);
+        /*
+         * The sensor can generate interrupts for free-fall and direction
+         * detection (distinguishable with FF_WU_SRC and DD_SRC) but to keep
+         * the things simple and _fast_ we activate it only for free-fall, so
+         * no need to read register (very slow with ACPI). For the same reason,
+         * we forbid shared interrupts.
+         *
+         * IRQF_TRIGGER_RISING seems pointless on HP laptops because the
+         * io-apic is not configurable (and generates a warning) but I keep it
+         * in case of support for other hardware.
+         */
+        ret = request_irq(adev.irq, lis302dl_interrupt, IRQF_TRIGGER_RISING,
+                          DRIVER_NAME, &adev);
+        if (ret) {
+                clear_bit(0, &adev.misc_opened);
+                printk(KERN_ERR DRIVER_NAME ": IRQ%d allocation failed\n", adev.irq);
+                return -EBUSY;
+        }
+        lis3lv02d_increase_use(&adev);
+        printk("lis3: registered interrupt %d\n", adev.irq);
+        return 0;
+}
+static int lis3lv02d_misc_release(struct inode *inode, struct file *file)
+{
+        fasync_helper(-1, file, 0, &adev.async_queue);
+        lis3lv02d_decrease_use(&adev);
+        free_irq(adev.irq, &adev);
+        clear_bit(0, &adev.misc_opened); /* release the device */
+        return 0;
+}
+static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
+                                size_t count, loff_t *pos)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        u32 data;
+        unsigned char byte_data;
+        ssize_t retval = 1;
+        if (count < 1)
+                return -EINVAL;
+        add_wait_queue(&adev.misc_wait, &wait);
+        while (true) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                data = atomic_xchg(&adev.count, 0);
+                if (data)
+                        break;
+                if (file->f_flags & O_NONBLOCK) {
+                        retval = -EAGAIN;
+                        goto out;
+                }
+                if (signal_pending(current)) {
+                        retval = -ERESTARTSYS;
+                        goto out;
+                }
+                schedule();
+        }
+        if (data < 255)
+                byte_data = data;
+        else
+                byte_data = 255;
+        /* make sure we are not going into copy_to_user() with
+         * TASK_INTERRUPTIBLE state */
+        set_current_state(TASK_RUNNING);
+        if (copy_to_user(buf, &byte_data, sizeof(byte_data)))
+                retval = -EFAULT;
+out:
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(&adev.misc_wait, &wait);
+        return retval;
+}
+static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
+{
+        poll_wait(file, &adev.misc_wait, wait);
+        if (atomic_read(&adev.count))
+                return POLLIN | POLLRDNORM;
+        return 0;
+}
+static int lis3lv02d_misc_fasync(int fd, struct file *file, int on)
+{
+        return fasync_helper(fd, file, on, &adev.async_queue);
+}
+static const struct file_operations lis3lv02d_misc_fops = {
+        .owner   = THIS_MODULE,
+        .llseek  = no_llseek,
+        .read    = lis3lv02d_misc_read,
+        .open    = lis3lv02d_misc_open,
+        .release = lis3lv02d_misc_release,
+        .poll    = lis3lv02d_misc_poll,
+        .fasync  = lis3lv02d_misc_fasync,
+};
+static struct miscdevice lis3lv02d_misc_device = {
+        .minor   = MISC_DYNAMIC_MINOR,
+        .name    = "freefall",
+        .fops    = &lis3lv02d_misc_fops,
+};
 /**
 * lis3lv02d_joystick_kthread - Kthread polling function
 * @data: unused - here to conform to threadfn prototype
@@ -203,7 +315,6 @@ static void lis3lv02d_joystick_close(struct input_dev *input)
        lis3lv02d_decrease_use(&adev);
 }
 static inline void lis3lv02d_calibrate_joystick(void)
 {
        lis3lv02d_get_xyz(adev.device->handle, &adev.xcalib, &adev.ycalib, &adev.zcalib);
@@ -231,9 +342,9 @@ int lis3lv02d_joystick_enable(void)
        adev.idev->close      = lis3lv02d_joystick_close;
        set_bit(EV_ABS, adev.idev->evbit);
-        input_set_abs_params(adev.idev, ABS_X, -MDPS_MAX_VAL, MDPS_MAX_VAL, 3, 3);
+        input_set_abs_params(adev.idev, ABS_X, -adev.mdps_max_val, adev.mdps_max_val, 3, 3);
-        input_set_abs_params(adev.idev, ABS_Y, -MDPS_MAX_VAL, MDPS_MAX_VAL, 3, 3);
+        input_set_abs_params(adev.idev, ABS_Y, -adev.mdps_max_val, adev.mdps_max_val, 3, 3);
-        input_set_abs_params(adev.idev, ABS_Z, -MDPS_MAX_VAL, MDPS_MAX_VAL, 3, 3);
+        input_set_abs_params(adev.idev, ABS_Z, -adev.mdps_max_val, adev.mdps_max_val, 3, 3);
        err = input_register_device(adev.idev);
        if (err) {
@@ -250,6 +361,7 @@ void lis3lv02d_joystick_disable(void)
        if (!adev.idev)
                return;
+        misc_deregister(&lis3lv02d_misc_device);
        input_unregister_device(adev.idev);
        adev.idev = NULL;
 }
@@ -268,6 +380,19 @@ int lis3lv02d_init_device(struct acpi_lis3lv02d *dev)
        if (lis3lv02d_joystick_enable())
                printk(KERN_ERR DRIVER_NAME ": joystick initialization failed\n");
+        printk("lis3_init_device: irq %d\n", dev->irq);
+        /* if we did not get an IRQ from ACPI - we have nothing more to do */
+        if (!dev->irq) {
+                printk(KERN_ERR DRIVER_NAME
+                        ": No IRQ in ACPI. Disabling /dev/freefall\n");
+                goto out;
+        }
+        printk("lis3: registering device\n");
+        if (misc_register(&lis3lv02d_misc_device))
+                printk(KERN_ERR DRIVER_NAME ": misc_register failed\n");
+out:
        lis3lv02d_decrease_use(dev);
        return 0;
 }
@@ -351,6 +476,6 @@ int lis3lv02d_remove_fs(void)
 EXPORT_SYMBOL_GPL(lis3lv02d_remove_fs);
 MODULE_DESCRIPTION("ST LIS3LV02Dx three-axis digital accelerometer driver");
-MODULE_AUTHOR("Yan Burman and Eric Piel");
+MODULE_AUTHOR("Yan Burman, Eric Piel, Pavel Machek");
 MODULE_LICENSE("GPL");
diff --git a/drivers/hwmon/lis3lv02d.h b/drivers/hwmon/lis3lv02d.h
index 223f1c0763bb..75972bf372ff 100644
--- a/drivers/hwmon/lis3lv02d.h
+++ b/drivers/hwmon/lis3lv02d.h
@@ -22,12 +22,15 @@
 /*
 * The actual chip is STMicroelectronics LIS3LV02DL or LIS3LV02DQ that seems to
 * be connected via SPI. There exists also several similar chips (such as LIS302DL or
- * LIS3L02DQ) but not in the HP laptops and they have slightly different registers.
+ * LIS3L02DQ) and they have slightly different registers, but we can provide a
+ * common interface for all of them.
 * They can also be connected via I²C.
 */
-#define LIS3LV02DL_ID   0x3A /* Also the LIS3LV02DQ */
+/* 2-byte registers */
-#define LIS302DL_ID     0x3B /* Also the LIS202DL! */
+#define LIS_DOUBLE_ID   0x3A /* LIS3LV02D[LQ] */
+/* 1-byte registers */
+#define LIS_SINGLE_ID   0x3B /* LIS[32]02DL and others */
 enum lis3lv02d_reg {
        WHO_AM_I        = 0x0F,
@@ -44,10 +47,13 @@ enum lis3lv02d_reg {
        STATUS_REG      = 0x27,
        OUTX_L          = 0x28,
        OUTX_H          = 0x29,
+        OUTX            = 0x29,
        OUTY_L          = 0x2A,
        OUTY_H          = 0x2B,
+        OUTY            = 0x2B,
        OUTZ_L          = 0x2C,
        OUTZ_H          = 0x2D,
+        OUTZ            = 0x2D,
        FF_WU_CFG       = 0x30,
        FF_WU_SRC       = 0x31,
        FF_WU_ACK       = 0x32,
@@ -159,6 +165,10 @@ struct acpi_lis3lv02d {
        acpi_status (*write) (acpi_handle handle, int reg, u8 val);
        acpi_status (*read) (acpi_handle handle, int reg, u8 *ret);
+        u8                      whoami;    /* 3Ah: 2-byte registries, 3Bh: 1-byte registries */
+        s16 (*read_data) (acpi_handle handle, int reg);
+        int                     mdps_max_val;
        struct input_dev        *idev;     /* input device */
        struct task_struct      *kthread;  /* kthread for input */
        struct mutex            lock;
@@ -170,6 +180,11 @@ struct acpi_lis3lv02d {
        unsigned char           is_on;     /* whether the device is on or off */
        unsigned char           usage;     /* usage counter */
        struct axis_conversion  ac;        /* hw -> logical axis */
+        u32                     irq;       /* IRQ number */
+        struct fasync_struct    *async_queue; /* queue for the misc device */
+        wait_queue_head_t       misc_wait; /* Wait queue for the misc device */
+        unsigned long           misc_opened; /* bit0: whether the device is open */
 };
 int lis3lv02d_init_device(struct acpi_lis3lv02d *dev);
diff --git a/drivers/hwmon/vt1211.c b/drivers/hwmon/vt1211.c
index b0ce37852281..73f77a9b8b18 100644
--- a/drivers/hwmon/vt1211.c
+++ b/drivers/hwmon/vt1211.c
@@ -1262,7 +1262,7 @@ static int __init vt1211_device_add(unsigned short address)
        res.name = pdev->name;
        err = acpi_check_resource_conflict(&res);
        if (err)
-                goto EXIT;
+                goto EXIT_DEV_PUT;
        err = platform_device_add_resources(pdev, &res, 1);
        if (err) {
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index cb808d015361..feae743ba991 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -1548,7 +1548,7 @@ static int __init sensors_w83627ehf_init(void)
        err = acpi_check_resource_conflict(&res);
        if (err)
-                goto exit;
+                goto exit_device_put;
        err = platform_device_add_resources(pdev, &res, 1);
        if (err) {
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index a34338567a2a..f14813be4eff 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -328,7 +328,7 @@ static void dispatch_io(int rw, unsigned int num_regions,
        struct dpages old_pages = *dp;
        if (sync)
-                rw |= (1 << BIO_RW_SYNC);
+                rw |= (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG);
        /*
         * For multiple regions we need to be careful to rewind
diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
index 3073618269ea..0a225da21272 100644
--- a/drivers/md/dm-kcopyd.c
+++ b/drivers/md/dm-kcopyd.c
@@ -344,7 +344,7 @@ static int run_io_job(struct kcopyd_job *job)
 {
        int r;
        struct dm_io_request io_req = {
-                .bi_rw = job->rw | (1 << BIO_RW_SYNC),
+                .bi_rw = job->rw | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG),
                .mem.type = DM_IO_PAGE_LIST,
                .mem.ptr.pl = job->pages,
                .mem.offset = job->offset,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4495104f6c9f..03b4cd0a6344 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -474,7 +474,7 @@ void md_super_write(mddev_t *mddev, mdk_rdev_t *rdev,
         * causes ENOTSUPP, we allocate a spare bio...
         */
        struct bio *bio = bio_alloc(GFP_NOIO, 1);
-        int rw = (1<<BIO_RW) | (1<<BIO_RW_SYNC);
+        int rw = (1<<BIO_RW) | (1<<BIO_RW_SYNCIO) | (1<<BIO_RW_UNPLUG);
        bio->bi_bdev = rdev->bdev;
        bio->bi_sector = sector;
@@ -531,7 +531,7 @@ int sync_page_io(struct block_device *bdev, sector_t sector, int size,
        struct completion event;
        int ret;
-        rw |= (1 << BIO_RW_SYNC);
+        rw |= (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG);
        bio->bi_bdev = bdev;
        bio->bi_sector = sector;
diff --git a/drivers/media/common/tuners/tuner-simple.c b/drivers/media/common/tuners/tuner-simple.c
index de7adaf5fa5b..78412c9c424a 100644
--- a/drivers/media/common/tuners/tuner-simple.c
+++ b/drivers/media/common/tuners/tuner-simple.c
@@ -318,7 +318,6 @@ static int simple_std_setup(struct dvb_frontend *fe,
                            u8 *config, u8 *cb)
 {
        struct tuner_simple_priv *priv = fe->tuner_priv;
-        u8 tuneraddr;
        int rc;
        /* tv norm specific stuff for multi-norm tuners */
@@ -387,6 +386,7 @@ static int simple_std_setup(struct dvb_frontend *fe,
        case TUNER_PHILIPS_TUV1236D:
        {
+                struct tuner_i2c_props i2c = priv->i2c_props;
                /* 0x40 -> ATSC antenna input 1 */
                /* 0x48 -> ATSC antenna input 2 */
                /* 0x00 -> NTSC antenna input 1 */
@@ -398,17 +398,15 @@ static int simple_std_setup(struct dvb_frontend *fe,
                        buffer[1] = 0x04;
                }
                /* set to the correct mode (analog or digital) */
-                tuneraddr = priv->i2c_props.addr;
+                i2c.addr = 0x0a;
-                priv->i2c_props.addr = 0x0a;
+                rc = tuner_i2c_xfer_send(&i2c, &buffer[0], 2);
-                rc = tuner_i2c_xfer_send(&priv->i2c_props, &buffer[0], 2);
                if (2 != rc)
                        tuner_warn("i2c i/o error: rc == %d "
                                   "(should be 2)\n", rc);
-                rc = tuner_i2c_xfer_send(&priv->i2c_props, &buffer[2], 2);
+                rc = tuner_i2c_xfer_send(&i2c, &buffer[2], 2);
                if (2 != rc)
                        tuner_warn("i2c i/o error: rc == %d "
                                   "(should be 2)\n", rc);
-                priv->i2c_props.addr = tuneraddr;
                break;
        }
        }
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index 0c733c66a441..069d847ba887 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -364,16 +364,15 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
                                       enum dmx_success success)
 {
        struct dmxdev_filter *dmxdevfilter = filter->priv;
-        unsigned long flags;
        int ret;
        if (dmxdevfilter->buffer.error) {
                wake_up(&dmxdevfilter->buffer.queue);
                return 0;
        }
-        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
+        spin_lock(&dmxdevfilter->dev->lock);
        if (dmxdevfilter->state != DMXDEV_STATE_GO) {
-                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
+                spin_unlock(&dmxdevfilter->dev->lock);
                return 0;
        }
        del_timer(&dmxdevfilter->timer);
@@ -392,7 +391,7 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
        }
        if (dmxdevfilter->params.sec.flags & DMX_ONESHOT)
                dmxdevfilter->state = DMXDEV_STATE_DONE;
-        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
+        spin_unlock(&dmxdevfilter->dev->lock);
        wake_up(&dmxdevfilter->buffer.queue);
        return 0;
 }
@@ -404,12 +403,11 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
 {
        struct dmxdev_filter *dmxdevfilter = feed->priv;
        struct dvb_ringbuffer *buffer;
-        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
+        spin_lock(&dmxdevfilter->dev->lock);
        if (dmxdevfilter->params.pes.output == DMX_OUT_DECODER) {
-                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
+                spin_unlock(&dmxdevfilter->dev->lock);
                return 0;
        }
@@ -419,7 +417,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
        else
                buffer = &dmxdevfilter->dev->dvr_buffer;
        if (buffer->error) {
-                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
+                spin_unlock(&dmxdevfilter->dev->lock);
                wake_up(&buffer->queue);
                return 0;
        }
@@ -430,7 +428,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
                dvb_ringbuffer_flush(buffer);
                buffer->error = ret;
        }
-        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
+        spin_unlock(&dmxdevfilter->dev->lock);
        wake_up(&buffer->queue);
        return 0;
 }
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index a2c1fd5d2f67..e2eca0b1fe7c 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -399,9 +399,7 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
 void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                              size_t count)
 {
-        unsigned long flags;
+        spin_lock(&demux->lock);
-        spin_lock_irqsave(&demux->lock, flags);
        while (count--) {
                if (buf[0] == 0x47)
@@ -409,17 +407,16 @@ void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                buf += 188;
        }
-        spin_unlock_irqrestore(&demux->lock, flags);
+        spin_unlock(&demux->lock);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter_packets);
 void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
-        unsigned long flags;
        int p = 0, i, j;
-        spin_lock_irqsave(&demux->lock, flags);
+        spin_lock(&demux->lock);
        if (demux->tsbufp) {
                i = demux->tsbufp;
@@ -452,18 +449,17 @@ void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
        }
 bailout:
-        spin_unlock_irqrestore(&demux->lock, flags);
+        spin_unlock(&demux->lock);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter);
 void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
-        unsigned long flags;
        int p = 0, i, j;
        u8 tmppack[188];
-        spin_lock_irqsave(&demux->lock, flags);
+        spin_lock(&demux->lock);
        if (demux->tsbufp) {
                i = demux->tsbufp;
@@ -504,7 +500,7 @@ void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
        }
 bailout:
-        spin_unlock_irqrestore(&demux->lock, flags);
+        spin_unlock(&demux->lock);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter_204);
diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c
index 67cbce82cb91..4dfed6aa2dbc 100644
--- a/drivers/media/radio/radio-si470x.c
+++ b/drivers/media/radio/radio-si470x.c
@@ -98,11 +98,16 @@
 *              - blacklisted KWorld radio in hid-core.c and hid-ids.h
 * 2008-12-03   Mark Lord <mlord@pobox.com>
 *              - add support for DealExtreme USB Radio
+ * 2009-01-31   Bob Ross <pigiron@gmx.com>
+ *              - correction of stereo detection/setting
+ *              - correction of signal strength indicator scaling
+ * 2009-01-31   Rick Bronson <rick@efn.org>
+ *              Tobias Lorenz <tobias.lorenz@gmx.net>
+ *              - add LED status output
 *
 * ToDo:
 * - add firmware download/update support
 * - RDS support: interrupt mode, instead of polling
- * - add LED status output (check if that's not already done in firmware)
 */
@@ -882,6 +887,30 @@ static int si470x_rds_on(struct si470x_device *radio)
 /**************************************************************************
+ * General Driver Functions - LED_REPORT
+ **************************************************************************/
+/*
+ * si470x_set_led_state - sets the led state
+ */
+static int si470x_set_led_state(struct si470x_device *radio,
+                unsigned char led_state)
+{
+        unsigned char buf[LED_REPORT_SIZE];
+        int retval;
+        buf[0] = LED_REPORT;
+        buf[1] = LED_COMMAND;
+        buf[2] = led_state;
+        retval = si470x_set_report(radio, (void *) &buf, sizeof(buf));
+        return (retval < 0) ? -EINVAL : 0;
+}
+/**************************************************************************
 * RDS Driver Functions
 **************************************************************************/
@@ -1385,20 +1414,22 @@ static int si470x_vidioc_g_tuner(struct file *file, void *priv,
        };
        /* stereo indicator == stereo (instead of mono) */
-        if ((radio->registers[STATUSRSSI] & STATUSRSSI_ST) == 1)
+        if ((radio->registers[STATUSRSSI] & STATUSRSSI_ST) == 0)
-                tuner->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
-        else
                tuner->rxsubchans = V4L2_TUNER_SUB_MONO;
+        else
+                tuner->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
        /* mono/stereo selector */
-        if ((radio->registers[POWERCFG] & POWERCFG_MONO) == 1)
+        if ((radio->registers[POWERCFG] & POWERCFG_MONO) == 0)
-                tuner->audmode = V4L2_TUNER_MODE_MONO;
-        else
                tuner->audmode = V4L2_TUNER_MODE_STEREO;
+        else
+                tuner->audmode = V4L2_TUNER_MODE_MONO;
        /* min is worst, max is best; signal:0..0xffff; rssi: 0..0xff */
-        tuner->signal = (radio->registers[STATUSRSSI] & STATUSRSSI_RSSI)
+        /* measured in units of dbµV in 1 db increments (max at ~75 dbµV) */
-                                * 0x0101;
+        tuner->signal = (radio->registers[STATUSRSSI] & STATUSRSSI_RSSI);
+        /* the ideal factor is 0xffff/75 = 873,8 */
+        tuner->signal = (tuner->signal * 873) + (8 * tuner->signal / 10);
        /* automatic frequency control: -1: freq to low, 1 freq to high */
        /* AFCRL does only indicate that freq. differs, not if too low/high */
@@ -1632,6 +1663,9 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
        /* set initial frequency */
        si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
+        /* set led to connect state */
+        si470x_set_led_state(radio, BLINK_GREEN_LED);
        /* rds buffer allocation */
        radio->buf_size = rds_buf * 3;
        radio->buffer = kmalloc(radio->buf_size, GFP_KERNEL);
@@ -1715,6 +1749,9 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
        cancel_delayed_work_sync(&radio->work);
        usb_set_intfdata(intf, NULL);
        if (radio->users == 0) {
+                /* set led to disconnect state */
+                si470x_set_led_state(radio, BLINK_ORANGE_LED);
                video_unregister_device(radio->videodev);
                kfree(radio->buffer);
                kfree(radio);
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 2ed24527ecd6..65e4901f4db7 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -422,6 +422,7 @@ static void destroy_urbs(struct gspca_dev *gspca_dev)
                if (urb == NULL)
                        break;
+                BUG_ON(!gspca_dev->dev);
                gspca_dev->urb[i] = NULL;
                if (!gspca_dev->present)
                        usb_kill_urb(urb);
@@ -1950,8 +1951,12 @@ void gspca_disconnect(struct usb_interface *intf)
 {
        struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
+        mutex_lock(&gspca_dev->usb_lock);
        gspca_dev->present = 0;
+        mutex_unlock(&gspca_dev->usb_lock);
+        destroy_urbs(gspca_dev);
+        gspca_dev->dev = NULL;
        usb_set_intfdata(intf, NULL);
        /* release the device */
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index f6b3ef6e691b..c13bd2aa0bea 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -393,7 +393,7 @@ static int ivtv_g_fmt_sliced_vbi_cap(struct file *file, void *fh, struct v4l2_fo
                return 0;
        }
-        v4l2_subdev_call(itv->sd_video, video, s_fmt, fmt);
+        v4l2_subdev_call(itv->sd_video, video, g_fmt, fmt);
        vbifmt->service_set = ivtv_get_service_set(vbifmt);
        return 0;
 }
@@ -1748,6 +1748,18 @@ static long ivtv_default(struct file *file, void *fh, int cmd, void *arg)
                break;
        }
+        case IVTV_IOC_DMA_FRAME:
+        case VIDEO_GET_PTS:
+        case VIDEO_GET_FRAME_COUNT:
+        case VIDEO_GET_EVENT:
+        case VIDEO_PLAY:
+        case VIDEO_STOP:
+        case VIDEO_FREEZE:
+        case VIDEO_CONTINUE:
+        case VIDEO_COMMAND:
+        case VIDEO_TRY_COMMAND:
+                return ivtv_decoder_ioctls(file, cmd, (void *)arg);
        default:
                return -EINVAL;
        }
@@ -1790,18 +1802,6 @@ static long ivtv_serialized_ioctl(struct ivtv *itv, struct file *filp,
                ivtv_vapi(itv, CX2341X_DEC_SET_AUDIO_MODE, 2, itv->audio_bilingual_mode, itv->audio_stereo_mode);
                return 0;
-        case IVTV_IOC_DMA_FRAME:
-        case VIDEO_GET_PTS:
-        case VIDEO_GET_FRAME_COUNT:
-        case VIDEO_GET_EVENT:
-        case VIDEO_PLAY:
-        case VIDEO_STOP:
-        case VIDEO_FREEZE:
-        case VIDEO_CONTINUE:
-        case VIDEO_COMMAND:
-        case VIDEO_TRY_COMMAND:
-                return ivtv_decoder_ioctls(filp, cmd, (void *)arg);
        default:
                break;
        }
diff --git a/drivers/mfd/htc-egpio.c b/drivers/mfd/htc-egpio.c
index 1a4d04664d6d..aa266e1f69b2 100644
--- a/drivers/mfd/htc-egpio.c
+++ b/drivers/mfd/htc-egpio.c
@@ -286,7 +286,7 @@ static int __init egpio_probe(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res)
                goto fail;
-        ei->base_addr = ioremap_nocache(res->start, res->end - res->start);
+        ei->base_addr = ioremap_nocache(res->start, resource_size(res));
        if (!ei->base_addr)
                goto fail;
        pr_debug("EGPIO phys=%08x virt=%p\n", (u32)res->start, ei->base_addr);
@@ -307,7 +307,7 @@ static int __init egpio_probe(struct platform_device *pdev)
        ei->nchips = pdata->num_chips;
        ei->chip = kzalloc(sizeof(struct egpio_chip) * ei->nchips, GFP_KERNEL);
-        if (!ei) {
+        if (!ei->chip) {
                ret = -ENOMEM;
                goto fail;
        }
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index ea9488e7ad6d..2e36057659e1 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -678,6 +678,7 @@ static int __devexit pcf50633_remove(struct i2c_client *client)
 static struct i2c_device_id pcf50633_id_table[] = {
        {"pcf50633", 0x73},
+        {/* end of list */}
 };
 static struct i2c_driver pcf50633_driver = {
diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
index 0e5761f12634..4c7b7962f6b8 100644
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -1050,7 +1050,7 @@ static int __devinit sm501_gpio_register_chip(struct sm501_devdata *sm,
        return gpiochip_add(gchip);
 }
-static int sm501_register_gpio(struct sm501_devdata *sm)
+static int __devinit sm501_register_gpio(struct sm501_devdata *sm)
 {
        struct sm501_gpio *gpio = &sm->gpio;
        resource_size_t iobase = sm->io_res->start + SM501_GPIO;
@@ -1321,7 +1321,7 @@ static unsigned int sm501_mem_local[] = {
 * Common init code for an SM501
 */
-static int sm501_init_dev(struct sm501_devdata *sm)
+static int __devinit sm501_init_dev(struct sm501_devdata *sm)
 {
        struct sm501_initdata *idata;
        struct sm501_platdata *pdata;
@@ -1397,7 +1397,7 @@ static int sm501_init_dev(struct sm501_devdata *sm)
        return 0;
 }
-static int sm501_plat_probe(struct platform_device *dev)
+static int __devinit sm501_plat_probe(struct platform_device *dev)
 {
        struct sm501_devdata *sm;
        int ret;
@@ -1586,8 +1586,8 @@ static struct sm501_platdata sm501_pci_platdata = {
        .gpio_base      = -1,
 };
-static int sm501_pci_probe(struct pci_dev *dev,
+static int __devinit sm501_pci_probe(struct pci_dev *dev,
-                           const struct pci_device_id *id)
+                                     const struct pci_device_id *id)
 {
        struct sm501_devdata *sm;
        int err;
@@ -1693,7 +1693,7 @@ static void sm501_dev_remove(struct sm501_devdata *sm)
        sm501_gpio_remove(sm);
 }
-static void sm501_pci_remove(struct pci_dev *dev)
+static void __devexit sm501_pci_remove(struct pci_dev *dev)
 {
        struct sm501_devdata *sm = pci_get_drvdata(dev);
@@ -1727,16 +1727,16 @@ static struct pci_device_id sm501_pci_tbl[] = {
 MODULE_DEVICE_TABLE(pci, sm501_pci_tbl);
-static struct pci_driver sm501_pci_drv = {
+static struct pci_driver sm501_pci_driver = {
        .name           = "sm501",
        .id_table       = sm501_pci_tbl,
        .probe          = sm501_pci_probe,
-        .remove         = sm501_pci_remove,
+        .remove         = __devexit_p(sm501_pci_remove),
 };
 MODULE_ALIAS("platform:sm501");
-static struct platform_driver sm501_plat_drv = {
+static struct platform_driver sm501_plat_driver = {
        .driver         = {
                .name   = "sm501",
                .owner  = THIS_MODULE,
@@ -1749,14 +1749,14 @@ static struct platform_driver sm501_plat_drv = {
 static int __init sm501_base_init(void)
 {
-        platform_driver_register(&sm501_plat_drv);
+        platform_driver_register(&sm501_plat_driver);
-        return pci_register_driver(&sm501_pci_drv);
+        return pci_register_driver(&sm501_pci_driver);
 }
 static void __exit sm501_base_exit(void)
 {
-        platform_driver_unregister(&sm501_plat_drv);
+        platform_driver_unregister(&sm501_plat_driver);
-        pci_unregister_driver(&sm501_pci_drv);
+        pci_unregister_driver(&sm501_pci_driver);
 }
 module_init(sm501_base_init);
diff --git a/drivers/mfd/twl4030-core.c b/drivers/mfd/twl4030-core.c
index e7ab0035d305..68826f1e36bc 100644
--- a/drivers/mfd/twl4030-core.c
+++ b/drivers/mfd/twl4030-core.c
@@ -38,7 +38,7 @@
 #include <linux/i2c.h>
 #include <linux/i2c/twl4030.h>
-#ifdef CONFIG_ARM
+#if defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3)
 #include <mach/cpu.h>
 #endif
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index f92595c8f165..84d5ea1ec171 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -1111,7 +1111,7 @@ int wm8350_read_auxadc(struct wm8350 *wm8350, int channel, int scale, int vref)
        do {
                schedule_timeout_interruptible(1);
                reg = wm8350_reg_read(wm8350, WM8350_DIGITISER_CONTROL_1);
-        } while (tries-- && (reg & WM8350_AUXADC_POLL));
+        } while (--tries && (reg & WM8350_AUXADC_POLL));
        if (!tries)
                dev_err(wm8350->dev, "adc chn %d read timeout\n", channel);
@@ -1297,14 +1297,29 @@ static void wm8350_client_dev_register(struct wm8350 *wm8350,
 int wm8350_device_init(struct wm8350 *wm8350, int irq,
                       struct wm8350_platform_data *pdata)
 {
-        int ret = -EINVAL;
+        int ret;
        u16 id1, id2, mask_rev;
        u16 cust_id, mode, chip_rev;
        /* get WM8350 revision and config mode */
-        wm8350->read_dev(wm8350, WM8350_RESET_ID, sizeof(id1), &id1);
+        ret = wm8350->read_dev(wm8350, WM8350_RESET_ID, sizeof(id1), &id1);
-        wm8350->read_dev(wm8350, WM8350_ID, sizeof(id2), &id2);
+        if (ret != 0) {
-        wm8350->read_dev(wm8350, WM8350_REVISION, sizeof(mask_rev), &mask_rev);
+                dev_err(wm8350->dev, "Failed to read ID: %d\n", ret);
+                goto err;
+        }
+        ret = wm8350->read_dev(wm8350, WM8350_ID, sizeof(id2), &id2);
+        if (ret != 0) {
+                dev_err(wm8350->dev, "Failed to read ID: %d\n", ret);
+                goto err;
+        }
+        ret = wm8350->read_dev(wm8350, WM8350_REVISION, sizeof(mask_rev),
+                               &mask_rev);
+        if (ret != 0) {
+                dev_err(wm8350->dev, "Failed to read revision: %d\n", ret);
+                goto err;
+        }
        id1 = be16_to_cpu(id1);
        id2 = be16_to_cpu(id2);
@@ -1404,14 +1419,12 @@ int wm8350_device_init(struct wm8350 *wm8350, int irq,
                return ret;
        }
-        if (pdata && pdata->init) {
+        wm8350_reg_write(wm8350, WM8350_SYSTEM_INTERRUPTS_MASK, 0xFFFF);
-                ret = pdata->init(wm8350);
+        wm8350_reg_write(wm8350, WM8350_INT_STATUS_1_MASK, 0xFFFF);
-                if (ret != 0) {
+        wm8350_reg_write(wm8350, WM8350_INT_STATUS_2_MASK, 0xFFFF);
-                        dev_err(wm8350->dev, "Platform init() failed: %d\n",
+        wm8350_reg_write(wm8350, WM8350_UNDER_VOLTAGE_INT_STATUS_MASK, 0xFFFF);
-                                ret);
+        wm8350_reg_write(wm8350, WM8350_GPIO_INT_STATUS_MASK, 0xFFFF);
-                        goto err;
+        wm8350_reg_write(wm8350, WM8350_COMPARATOR_INT_STATUS_MASK, 0xFFFF);
-                }
-        }
        mutex_init(&wm8350->auxadc_mutex);
        mutex_init(&wm8350->irq_mutex);
@@ -1430,6 +1443,15 @@ int wm8350_device_init(struct wm8350 *wm8350, int irq,
        }
        wm8350->chip_irq = irq;
+        if (pdata && pdata->init) {
+                ret = pdata->init(wm8350);
+                if (ret != 0) {
+                        dev_err(wm8350->dev, "Platform init() failed: %d\n",
+                                ret);
+                        goto err;
+                }
+        }
        wm8350_reg_write(wm8350, WM8350_SYSTEM_INTERRUPTS_MASK, 0x0);
        wm8350_client_dev_register(wm8350, "wm8350-codec",
diff --git a/drivers/mfd/wm8350-regmap.c b/drivers/mfd/wm8350-regmap.c
index 68887b817d17..9a4cc954cb7c 100644
--- a/drivers/mfd/wm8350-regmap.c
+++ b/drivers/mfd/wm8350-regmap.c
@@ -3188,7 +3188,7 @@ const struct wm8350_reg_access wm8350_reg_io_map[] = {
        { 0x7CFF, 0x0C00, 0x7FFF }, /* R1   - ID */
        { 0x0000, 0x0000, 0x0000 }, /* R2 */
        { 0xBE3B, 0xBE3B, 0x8000 }, /* R3   - System Control 1 */
-        { 0xFCF7, 0xFCF7, 0xF800 }, /* R4   - System Control 2 */
+        { 0xFEF7, 0xFEF7, 0xF800 }, /* R4   - System Control 2 */
        { 0x80FF, 0x80FF, 0x8000 }, /* R5   - System Hibernate */
        { 0xFB0E, 0xFB0E, 0x0000 }, /* R6   - Interface Control */
        { 0x0000, 0x0000, 0x0000 }, /* R7 */
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 45b1f430685f..513eb09a638f 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -584,7 +584,7 @@ static int mmc_blk_probe(struct mmc_card *card)
        if (err)
                goto out;
-        string_get_size(get_capacity(md->disk) << 9, STRING_UNITS_2,
+        string_get_size((u64)get_capacity(md->disk) << 9, STRING_UNITS_2,
                        cap_str, sizeof(cap_str));
        printk(KERN_INFO "%s: %s %s %s %s\n",
                md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index b92b172074ee..b9f1e84897cc 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -494,7 +494,7 @@ static int mmc_test_basic_read(struct mmc_test_card *test)
        sg_init_one(&sg, test->buffer, 512);
-        ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 1);
+        ret = mmc_test_simple_transfer(test, &sg, 1, 0, 1, 512, 0);
        if (ret)
                return ret;
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 76bfe16c09b1..2b1196e6142c 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1548,9 +1548,10 @@ static bool filter(struct dma_chan *chan, void *slave)
 {
        struct dw_dma_slave *dws = slave;
-        if (dws->dma_dev == chan->device->dev)
+        if (dws->dma_dev == chan->device->dev) {
+                chan->private = dws;
                return true;
-        else
+        } else
                return false;
 }
 #endif
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index db37490f67ec..a631c81dce12 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -55,6 +55,7 @@
 #define VS30                    (1 << 25)
 #define SDVS18                  (0x5 << 9)
 #define SDVS30                  (0x6 << 9)
+#define SDVS33                  (0x7 << 9)
 #define SDVSCLR                 0xFFFFF1FF
 #define SDVSDET                 0x00000400
 #define AUTOIDLE                0x1
@@ -375,6 +376,32 @@ static void mmc_omap_report_irq(struct mmc_omap_host *host, u32 status)
 }
 #endif  /* CONFIG_MMC_DEBUG */
+/*
+ * MMC controller internal state machines reset
+ *
+ * Used to reset command or data internal state machines, using respectively
+ *  SRC or SRD bit of SYSCTL register
+ * Can be called from interrupt context
+ */
+static inline void mmc_omap_reset_controller_fsm(struct mmc_omap_host *host,
+                unsigned long bit)
+{
+        unsigned long i = 0;
+        unsigned long limit = (loops_per_jiffy *
+                                msecs_to_jiffies(MMC_TIMEOUT_MS));
+        OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                         OMAP_HSMMC_READ(host->base, SYSCTL) | bit);
+        while ((OMAP_HSMMC_READ(host->base, SYSCTL) & bit) &&
+                (i++ < limit))
+                cpu_relax();
+        if (OMAP_HSMMC_READ(host->base, SYSCTL) & bit)
+                dev_err(mmc_dev(host->mmc),
+                        "Timeout waiting on controller reset in %s\n",
+                        __func__);
+}
 /*
 * MMC controller IRQ handler
@@ -403,21 +430,17 @@ static irqreturn_t mmc_omap_irq(int irq, void *dev_id)
                        (status & CMD_CRC)) {
                        if (host->cmd) {
                                if (status & CMD_TIMEOUT) {
-                                        OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                                        mmc_omap_reset_controller_fsm(host, SRC);
-                                                OMAP_HSMMC_READ(host->base,
-                                                                SYSCTL) | SRC);
-                                        while (OMAP_HSMMC_READ(host->base,
-                                                        SYSCTL) & SRC)
-                                                ;
                                        host->cmd->error = -ETIMEDOUT;
                                } else {
                                        host->cmd->error = -EILSEQ;
                                }
                                end_cmd = 1;
                        }
-                        if (host->data)
+                        if (host->data) {
                                mmc_dma_cleanup(host);
+                                mmc_omap_reset_controller_fsm(host, SRD);
+                        }
                }
                if ((status & DATA_TIMEOUT) ||
                        (status & DATA_CRC)) {
@@ -426,12 +449,7 @@ static irqreturn_t mmc_omap_irq(int irq, void *dev_id)
                                        mmc_dma_cleanup(host);
                                else
                                        host->data->error = -EILSEQ;
-                                OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                                mmc_omap_reset_controller_fsm(host, SRD);
-                                        OMAP_HSMMC_READ(host->base,
-                                                        SYSCTL) | SRD);
-                                while (OMAP_HSMMC_READ(host->base,
-                                                SYSCTL) & SRD)
-                                        ;
                                end_trans = 1;
                        }
                }
@@ -456,13 +474,20 @@ static irqreturn_t mmc_omap_irq(int irq, void *dev_id)
 }
 /*
- * Switch MMC operating voltage
+ * Switch MMC interface voltage ... only relevant for MMC1.
+ *
+ * MMC2 and MMC3 use fixed 1.8V levels, and maybe a transceiver.
+ * The MMC2 transceiver controls are used instead of DAT4..DAT7.
+ * Some chips, like eMMC ones, use internal transceivers.
 */
 static int omap_mmc_switch_opcond(struct mmc_omap_host *host, int vdd)
 {
        u32 reg_val = 0;
        int ret;
+        if (host->id != OMAP_MMC1_DEVID)
+                return 0;
        /* Disable the clocks */
        clk_disable(host->fclk);
        clk_disable(host->iclk);
@@ -485,19 +510,26 @@ static int omap_mmc_switch_opcond(struct mmc_omap_host *host, int vdd)
        OMAP_HSMMC_WRITE(host->base, HCTL,
                OMAP_HSMMC_READ(host->base, HCTL) & SDVSCLR);
        reg_val = OMAP_HSMMC_READ(host->base, HCTL);
        /*
         * If a MMC dual voltage card is detected, the set_ios fn calls
         * this fn with VDD bit set for 1.8V. Upon card removal from the
         * slot, omap_mmc_set_ios sets the VDD back to 3V on MMC_POWER_OFF.
         *
-         * Only MMC1 supports 3.0V.  MMC2 will not function if SDVS30 is
+         * Cope with a bit of slop in the range ... per data sheets:
-         * set in HCTL.
+         *  - "1.8V" for vdds_mmc1/vdds_mmc1a can be up to 2.45V max,
+         *    but recommended values are 1.71V to 1.89V
+         *  - "3.0V" for vdds_mmc1/vdds_mmc1a can be up to 3.5V max,
+         *    but recommended values are 2.7V to 3.3V
+         *
+         * Board setup code shouldn't permit anything very out-of-range.
+         * TWL4030-family VMMC1 and VSIM regulators are fine (avoiding the
+         * middle range) but VSIM can't power DAT4..DAT7 at more than 3V.
         */
-        if (host->id == OMAP_MMC1_DEVID && (((1 << vdd) == MMC_VDD_32_33) ||
+        if ((1 << vdd) <= MMC_VDD_23_24)
-                                ((1 << vdd) == MMC_VDD_33_34)))
-                reg_val |= SDVS30;
-        if ((1 << vdd) == MMC_VDD_165_195)
                reg_val |= SDVS18;
+        else
+                reg_val |= SDVS30;
        OMAP_HSMMC_WRITE(host->base, HCTL, reg_val);
@@ -517,16 +549,15 @@ static void mmc_omap_detect(struct work_struct *work)
 {
        struct mmc_omap_host *host = container_of(work, struct mmc_omap_host,
                                                mmc_carddetect_work);
+        struct omap_mmc_slot_data *slot = &mmc_slot(host);
+        host->carddetect = slot->card_detect(slot->card_detect_irq);
        sysfs_notify(&host->mmc->class_dev.kobj, NULL, "cover_switch");
        if (host->carddetect) {
                mmc_detect_change(host->mmc, (HZ * 200) / 1000);
        } else {
-                OMAP_HSMMC_WRITE(host->base, SYSCTL,
+                mmc_omap_reset_controller_fsm(host, SRD);
-                        OMAP_HSMMC_READ(host->base, SYSCTL) | SRD);
-                while (OMAP_HSMMC_READ(host->base, SYSCTL) & SRD)
-                        ;
                mmc_detect_change(host->mmc, (HZ * 50) / 1000);
        }
 }
@@ -538,7 +569,6 @@ static irqreturn_t omap_mmc_cd_handler(int irq, void *dev_id)
 {
        struct mmc_omap_host *host = (struct mmc_omap_host *)dev_id;
-        host->carddetect = mmc_slot(host).card_detect(irq);
        schedule_work(&host->mmc_carddetect_work);
        return IRQ_HANDLED;
@@ -757,10 +787,14 @@ static void omap_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        case MMC_POWER_OFF:
                mmc_slot(host).set_power(host->dev, host->slot_id, 0, 0);
                /*
-                 * Reset bus voltage to 3V if it got set to 1.8V earlier.
+                 * Reset interface voltage to 3V if it's 1.8V now;
+                 * only relevant on MMC-1, the others always use 1.8V.
+                 *
                 * REVISIT: If we are able to detect cards after unplugging
                 * a 1.8V card, this code should not be needed.
                 */
+                if (host->id != OMAP_MMC1_DEVID)
+                        break;
                if (!(OMAP_HSMMC_READ(host->base, HCTL) & SDVSDET)) {
                        int vdd = fls(host->mmc->ocr_avail) - 1;
                        if (omap_mmc_switch_opcond(host, vdd) != 0)
@@ -784,7 +818,9 @@ static void omap_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        }
        if (host->id == OMAP_MMC1_DEVID) {
-                /* Only MMC1 can operate at 3V/1.8V */
+                /* Only MMC1 can interface at 3V without some flavor
+                 * of external transceiver; but they all handle 1.8V.
+                 */
                if ((OMAP_HSMMC_READ(host->base, HCTL) & SDVSDET) &&
                        (ios->vdd == DUAL_VOLT_OCR_BIT)) {
                                /*
@@ -1137,7 +1173,9 @@ static int omap_mmc_suspend(struct platform_device *pdev, pm_message_t state)
                                                " level suspend\n");
                        }
-                        if (!(OMAP_HSMMC_READ(host->base, HCTL) & SDVSDET)) {
+                        if (host->id == OMAP_MMC1_DEVID
+                                        && !(OMAP_HSMMC_READ(host->base, HCTL)
+                                                        & SDVSDET)) {
                                OMAP_HSMMC_WRITE(host->base, HCTL,
                                        OMAP_HSMMC_READ(host->base, HCTL)
                                        & SDVSCLR);
diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
index 35a98eec7414..f4a67c65d301 100644
--- a/drivers/mmc/host/s3cmci.c
+++ b/drivers/mmc/host/s3cmci.c
@@ -329,7 +329,7 @@ static void do_pio_write(struct s3cmci_host *host)
        to_ptr = host->base + host->sdidata;
-        while ((fifo = fifo_free(host))) {
+        while ((fifo = fifo_free(host)) > 3) {
                if (!host->pio_bytes) {
                        res = get_data_buffer(host, &host->pio_bytes,
                                                        &host->pio_ptr);
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index f07255cb17ee..8cff5f5e7f86 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -144,8 +144,7 @@ static int jmicron_probe(struct sdhci_pci_chip *chip)
                          SDHCI_QUIRK_32BIT_DMA_SIZE |
                          SDHCI_QUIRK_32BIT_ADMA_SIZE |
                          SDHCI_QUIRK_RESET_AFTER_REQUEST |
-                          SDHCI_QUIRK_BROKEN_SMALL_PIO |
+                          SDHCI_QUIRK_BROKEN_SMALL_PIO;
-                          SDHCI_QUIRK_FORCE_HIGHSPEED;
        }
        /*
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6b2d1f99af67..f52f3053ed92 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1636,8 +1636,7 @@ int sdhci_add_host(struct sdhci_host *host)
        mmc->f_max = host->max_clk;
        mmc->caps = MMC_CAP_4_BIT_DATA | MMC_CAP_SDIO_IRQ;
-        if ((caps & SDHCI_CAN_DO_HISPD) ||
+        if (caps & SDHCI_CAN_DO_HISPD)
-                (host->quirks & SDHCI_QUIRK_FORCE_HIGHSPEED))
                mmc->caps |= MMC_CAP_SD_HIGHSPEED;
        mmc->ocr_avail = 0;
@@ -1723,7 +1722,9 @@ int sdhci_add_host(struct sdhci_host *host)
 #endif
 #ifdef SDHCI_USE_LEDS_CLASS
-        host->led.name = mmc_hostname(mmc);
+        snprintf(host->led_name, sizeof(host->led_name),
+                "%s::", mmc_hostname(mmc));
+        host->led.name = host->led_name;
        host->led.brightness = LED_OFF;
        host->led.default_trigger = mmc_hostname(mmc);
        host->led.brightness_set = sdhci_led_control;
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 3efba2363941..ebb83657e27a 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -208,8 +208,6 @@ struct sdhci_host {
 #define SDHCI_QUIRK_BROKEN_TIMEOUT_VAL                  (1<<12)
 /* Controller has an issue with buffer bits for small transfers */
 #define SDHCI_QUIRK_BROKEN_SMALL_PIO                    (1<<13)
-/* Controller supports high speed but doesn't have the caps bit set */
-#define SDHCI_QUIRK_FORCE_HIGHSPEED                     (1<<14)
        int                     irq;            /* Device IRQ */
        void __iomem *          ioaddr;         /* Mapped address */
@@ -222,6 +220,7 @@ struct sdhci_host {
 #if defined(CONFIG_LEDS_CLASS) || defined(CONFIG_LEDS_CLASS_MODULE)
        struct led_classdev     led;            /* LED control */
+        char   led_name[32];
 #endif
        spinlock_t              lock;           /* Mutex */
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index c98c1570a40b..47a33cec3793 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -139,7 +139,8 @@ static int atmel_nand_device_ready(struct mtd_info *mtd)
        struct nand_chip *nand_chip = mtd->priv;
        struct atmel_nand_host *host = nand_chip->priv;
-        return gpio_get_value(host->board->rdy_pin);
+        return gpio_get_value(host->board->rdy_pin) ^
+                !!host->board->rdy_pin_active_low;
 }
 /*
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index f4b7c79023ff..f3f686581a90 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -61,6 +61,8 @@
 /* global iommu list, set NULL for ignored DMAR units */
 static struct intel_iommu **g_iommus;
+static int rwbf_quirk;
 /*
 * 0: Present
 * 1-11: Reserved
@@ -785,7 +787,7 @@ static void iommu_flush_write_buffer(struct intel_iommu *iommu)
        u32 val;
        unsigned long flag;
-        if (!cap_rwbf(iommu->cap))
+        if (!rwbf_quirk && !cap_rwbf(iommu->cap))
                return;
        val = iommu->gcmd | DMA_GCMD_WBF;
@@ -3137,3 +3139,15 @@ static struct iommu_ops intel_iommu_ops = {
        .unmap          = intel_iommu_unmap_range,
        .iova_to_phys   = intel_iommu_iova_to_phys,
 };
+static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
+{
+        /*
+         * Mobile 4 Series Chipset neglects to set RWBF capability,
+         * but needs it:
+         */
+        printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
+        rwbf_quirk = 1;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 44f15ff70c1d..baba2eb5367d 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -103,14 +103,12 @@ static void msix_set_enable(struct pci_dev *dev, int enable)
        }
 }
-/*
- * Essentially, this is ((1 << (1 << x)) - 1), but without the
- * undefinedness of a << 32.
- */
 static inline __attribute_const__ u32 msi_mask(unsigned x)
 {
-        static const u32 mask[] = { 1, 2, 4, 0xf, 0xff, 0xffff, 0xffffffff };
+        /* Don't shift by >= width of type */
-        return mask[x];
+        if (x >= 5)
+                return 0xffffffff;
+        return (1 << (1 << x)) - 1;
 }
 static void msix_flush_writes(struct irq_desc *desc)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e3efe6b19ee7..6d6120007af4 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1540,16 +1540,21 @@ void pci_release_region(struct pci_dev *pdev, int bar)
 }
 /**
- *      pci_request_region - Reserved PCI I/O and memory resource
+ *      __pci_request_region - Reserved PCI I/O and memory resource
 *      @pdev: PCI device whose resources are to be reserved
 *      @bar: BAR to be reserved
 *      @res_name: Name to be associated with resource.
+ *      @exclusive: whether the region access is exclusive or not
 *
 *      Mark the PCI region associated with PCI device @pdev BR @bar as
 *      being reserved by owner @res_name.  Do not access any
 *      address inside the PCI regions unless this call returns
 *      successfully.
 *
+ *      If @exclusive is set, then the region is marked so that userspace
+ *      is explicitly not allowed to map the resource via /dev/mem or
+ *      sysfs MMIO access.
+ *
 *      Returns 0 on success, or %EBUSY on error.  A warning
 *      message is also printed on failure.
 */
@@ -1588,12 +1593,12 @@ err_out:
 }
 /**
- *      pci_request_region - Reserved PCI I/O and memory resource
+ *      pci_request_region - Reserve PCI I/O and memory resource
 *      @pdev: PCI device whose resources are to be reserved
 *      @bar: BAR to be reserved
- *      @res_name: Name to be associated with resource.
+ *      @res_name: Name to be associated with resource
 *
- *      Mark the PCI region associated with PCI device @pdev BR @bar as
+ *      Mark the PCI region associated with PCI device @pdev BAR @bar as
 *      being reserved by owner @res_name.  Do not access any
 *      address inside the PCI regions unless this call returns
 *      successfully.
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 26ddf78ac300..07c0aa5275e6 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -16,21 +16,21 @@ extern int pci_mmap_fits(struct pci_dev *pdev, int resno,
 #endif
 /**
- * Firmware PM callbacks
+ * struct pci_platform_pm_ops - Firmware PM callbacks
 *
- * @is_manageable - returns 'true' if given device is power manageable by the
+ * @is_manageable: returns 'true' if given device is power manageable by the
- *                  platform firmware
+ *                 platform firmware
 *
- * @set_state - invokes the platform firmware to set the device's power state
+ * @set_state: invokes the platform firmware to set the device's power state
 *
- * @choose_state - returns PCI power state of given device preferred by the
+ * @choose_state: returns PCI power state of given device preferred by the
- *                 platform; to be used during system-wide transitions from a
+ *                platform; to be used during system-wide transitions from a
- *                 sleeping state to the working state and vice versa
+ *                sleeping state to the working state and vice versa
 *
- * @can_wakeup - returns 'true' if given device is capable of waking up the
+ * @can_wakeup: returns 'true' if given device is capable of waking up the
- *               system from a sleeping state
+ *              system from a sleeping state
 *
- * @sleep_wake - enables/disables the system wake up capability of given device
+ * @sleep_wake: enables/disables the system wake up capability of given device
 *
 * If given platform is generally capable of power managing PCI devices, all of
 * these callbacks are mandatory.
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index 29cbe47f219f..36864a935d68 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -55,6 +55,7 @@ void pci_disable_rom(struct pci_dev *pdev)
 /**
 * pci_get_rom_size - obtain the actual size of the ROM image
+ * @pdev: target PCI device
 * @rom: kernel virtual pointer to image of ROM
 * @size: size of PCI window
 *  return: size of actual ROM image
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 94363115a42a..b3866ad50227 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -62,6 +62,7 @@ config DELL_LAPTOP
        depends on EXPERIMENTAL
        depends on BACKLIGHT_CLASS_DEVICE
        depends on RFKILL
+        depends on POWER_SUPPLY
        default n
        ---help---
        This driver adds support for rfkill and backlight control to Dell
@@ -301,6 +302,7 @@ config INTEL_MENLOW
 config EEEPC_LAPTOP
        tristate "Eee PC Hotkey Driver (EXPERIMENTAL)"
        depends on ACPI
+        depends on INPUT
        depends on EXPERIMENTAL
        select BACKLIGHT_CLASS_DEVICE
        select HWMON
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 1fd8f2193ed8..4377e93a43d7 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -280,8 +280,11 @@ sclp_dispatch_evbufs(struct sccb_header *sccb)
        rc = 0;
        for (offset = sizeof(struct sccb_header); offset < sccb->length;
             offset += evbuf->length) {
-                /* Search for event handler */
                evbuf = (struct evbuf_header *) ((addr_t) sccb + offset);
+                /* Check for malformed hardware response */
+                if (evbuf->length == 0)
+                        break;
+                /* Search for event handler */
                reg = NULL;
                list_for_each(l, &sclp_reg_list) {
                        reg = list_entry(l, struct sclp_register, list);
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 506390496416..77ab6e34a100 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -19,6 +19,7 @@
 #include <linux/memory.h>
 #include <asm/chpid.h>
 #include <asm/sclp.h>
+#include <asm/setup.h>
 #include "sclp.h"
@@ -474,6 +475,10 @@ static void __init add_memory_merged(u16 rn)
                goto skip_add;
        if (start + size > VMEM_MAX_PHYS)
                size = VMEM_MAX_PHYS - start;
+        if (memory_end_set && (start >= memory_end))
+                goto skip_add;
+        if (memory_end_set && (start + size > memory_end))
+                size = memory_end - start;
        add_memory(0, start, size);
 skip_add:
        first_rn = rn;
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index 89362d733d62..8f58f7ff0dd7 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -877,6 +877,10 @@ static int atmel_startup(struct uart_port *port)
                }
        }
+        /* Save current CSR for comparison in atmel_tasklet_func() */
+        atmel_port->irq_status_prev = UART_GET_CSR(port);
+        atmel_port->irq_status = atmel_port->irq_status_prev;
        /*
         * Finally, enable the serial port
         */
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index 92187e28608a..ac79cbe4c2cf 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -84,6 +84,8 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        brd->pci_dev = pdev;
        if (pdev->device == PCIE_DEVICE_ID_NEO_4_IBM)
                brd->maxports = 4;
+        else if (pdev->device == PCI_DEVICE_ID_DIGI_NEO_8)
+                brd->maxports = 8;
        else
                brd->maxports = 2;
@@ -212,6 +214,7 @@ static struct pci_device_id jsm_pci_tbl[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45), 0, 0, 2 },
        { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45PRI), 0, 0, 3 },
        { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCIE_DEVICE_ID_NEO_4_IBM), 0, 0, 4 },
+        { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_DIGI_NEO_8), 0, 0, 5 },
        { 0, }
 };
 MODULE_DEVICE_TABLE(pci, jsm_pci_tbl);
diff --git a/drivers/spi/spi_gpio.c b/drivers/spi/spi_gpio.c
index 49698cabc30d..f5ed9721aabb 100644
--- a/drivers/spi/spi_gpio.c
+++ b/drivers/spi/spi_gpio.c
@@ -114,7 +114,7 @@ static inline void setmosi(const struct spi_device *spi, int is_on)
 static inline int getmiso(const struct spi_device *spi)
 {
-        return gpio_get_value(SPI_MISO_GPIO);
+        return !!gpio_get_value(SPI_MISO_GPIO);
 }
 #undef pdata
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index c54fc40458b1..a4301dc02d27 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -298,19 +298,6 @@ int usb_hcd_pci_suspend(struct pci_dev *dev, pm_message_t message)
 EXPORT_SYMBOL_GPL(usb_hcd_pci_suspend);
 /**
- * usb_hcd_pci_resume_early - resume a PCI-based HCD before IRQs are enabled
- * @dev: USB Host Controller being resumed
- *
- * Store this function in the HCD's struct pci_driver as .resume_early.
- */
-int usb_hcd_pci_resume_early(struct pci_dev *dev)
-{
-        pci_restore_state(dev);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(usb_hcd_pci_resume_early);
-/**
 * usb_hcd_pci_resume - power management resume of a PCI-based HCD
 * @dev: USB Host Controller being resumed
 *
@@ -333,6 +320,8 @@ int usb_hcd_pci_resume(struct pci_dev *dev)
        }
 #endif
+        pci_restore_state(dev);
        hcd = pci_get_drvdata(dev);
        if (hcd->state != HC_STATE_SUSPENDED) {
                dev_dbg(hcd->self.controller,
diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
index 5b94a56bec23..f750eb1ab595 100644
--- a/drivers/usb/core/hcd.h
+++ b/drivers/usb/core/hcd.h
@@ -257,7 +257,6 @@ extern void usb_hcd_pci_remove(struct pci_dev *dev);
 #ifdef CONFIG_PM
 extern int usb_hcd_pci_suspend(struct pci_dev *dev, pm_message_t msg);
-extern int usb_hcd_pci_resume_early(struct pci_dev *dev);
 extern int usb_hcd_pci_resume(struct pci_dev *dev);
 #endif /* CONFIG_PM */
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index 9b36205c5759..0ce4e2819847 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -904,8 +904,8 @@ static void pxa25x_ep_fifo_flush(struct usb_ep *_ep)
        /* most IN status is the same, but ISO can't stall */
        *ep->reg_udccs = UDCCS_BI_TPC|UDCCS_BI_FTF|UDCCS_BI_TUR
-                | (ep->bmAttributes == USB_ENDPOINT_XFER_ISOC)
+                | (ep->bmAttributes == USB_ENDPOINT_XFER_ISOC
-                        ? 0 : UDCCS_BI_SST;
+                        ? 0 : UDCCS_BI_SST);
 }
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index bb21fb0a4969..abb9a7706ec7 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -432,7 +432,6 @@ static struct pci_driver ehci_pci_driver = {
 #ifdef  CONFIG_PM
        .suspend =      usb_hcd_pci_suspend,
-        .resume_early = usb_hcd_pci_resume_early,
        .resume =       usb_hcd_pci_resume,
 #endif
        .shutdown =     usb_hcd_pci_shutdown,
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 5d625c3fd423..f9961b4c0da3 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -487,7 +487,6 @@ static struct pci_driver ohci_pci_driver = {
 #ifdef  CONFIG_PM
        .suspend =      usb_hcd_pci_suspend,
-        .resume_early = usb_hcd_pci_resume_early,
        .resume =       usb_hcd_pci_resume,
 #endif
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 944f7e0ca4df..cf5e4cf7ea42 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -942,7 +942,6 @@ static struct pci_driver uhci_pci_driver = {
 #ifdef  CONFIG_PM
        .suspend =      usb_hcd_pci_suspend,
-        .resume_early = usb_hcd_pci_resume_early,
        .resume =       usb_hcd_pci_resume,
 #endif  /* PM */
 };
diff --git a/drivers/usb/host/whci/asl.c b/drivers/usb/host/whci/asl.c
index 2291c5f5af51..958751ccea43 100644
--- a/drivers/usb/host/whci/asl.c
+++ b/drivers/usb/host/whci/asl.c
@@ -227,13 +227,13 @@ void scan_async_work(struct work_struct *work)
         * Now that the ASL is updated, complete the removal of any
         * removed qsets.
         */
-        spin_lock(&whc->lock);
+        spin_lock_irq(&whc->lock);
        list_for_each_entry_safe(qset, t, &whc->async_removed_list, list_node) {
                qset_remove_complete(whc, qset);
        }
-        spin_unlock(&whc->lock);
+        spin_unlock_irq(&whc->lock);
 }
 /**
diff --git a/drivers/usb/host/whci/pzl.c b/drivers/usb/host/whci/pzl.c
index 7dc85a0bee7c..df8b85f07092 100644
--- a/drivers/usb/host/whci/pzl.c
+++ b/drivers/usb/host/whci/pzl.c
@@ -255,13 +255,13 @@ void scan_periodic_work(struct work_struct *work)
         * Now that the PZL is updated, complete the removal of any
         * removed qsets.
         */
-        spin_lock(&whc->lock);
+        spin_lock_irq(&whc->lock);
        list_for_each_entry_safe(qset, t, &whc->periodic_removed_list, list_node) {
                qset_remove_complete(whc, qset);
        }
-        spin_unlock(&whc->lock);
+        spin_unlock_irq(&whc->lock);
 }
 /**
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index bf0af660df8a..fb19803060cf 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1054,10 +1054,7 @@ config FB_RIVA_BACKLIGHT
 config FB_I810
        tristate "Intel 810/815 support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && PCI && X86_32
+        depends on EXPERIMENTAL && FB && PCI && X86_32 && AGP_INTEL
-        select AGP
-        select AGP_INTEL
-        select FB
        select FB_MODE_HELPERS
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
@@ -1120,10 +1117,7 @@ config FB_CARILLO_RANCH
 config FB_INTEL
        tristate "Intel 830M/845G/852GM/855GM/865G/915G/945G/945GM/965G/965GM support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && PCI && X86
+        depends on EXPERIMENTAL && FB && PCI && X86 && AGP_INTEL
-        select FB
-        select AGP
-        select AGP_INTEL
        select FB_MODE_HELPERS
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 09a3d5522b43..325c10ff6a2c 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -406,7 +406,7 @@ config ITCO_WDT
        ---help---
          Hardware driver for the intel TCO timer based watchdog devices.
          These drivers are included in the Intel 82801 I/O Controller
-          Hub family (from ICH0 up to ICH8) and in the Intel 6300ESB
+          Hub family (from ICH0 up to ICH10) and in the Intel 63xxESB
          controller hub.
          The TCO (Total Cost of Ownership) timer is a watchdog timer
diff --git a/drivers/watchdog/at91rm9200_wdt.c b/drivers/watchdog/at91rm9200_wdt.c
index 5531691f46ea..e35d54589232 100644
--- a/drivers/watchdog/at91rm9200_wdt.c
+++ b/drivers/watchdog/at91rm9200_wdt.c
@@ -107,10 +107,10 @@ static int at91_wdt_close(struct inode *inode, struct file *file)
 static int at91_wdt_settimeout(int new_time)
 {
        /*
-         * All counting occurs at SLOW_CLOCK / 128 = 0.256 Hz
+         * All counting occurs at SLOW_CLOCK / 128 = 256 Hz
         *
         * Since WDV is a 16-bit counter, the maximum period is
-         * 65536 / 0.256 = 256 seconds.
+         * 65536 / 256 = 256 seconds.
         */
        if ((new_time <= 0) || (new_time > WDT_MAX_TIME))
                return -EINVAL;
diff --git a/drivers/watchdog/at91sam9_wdt.c b/drivers/watchdog/at91sam9_wdt.c
index b1da287f90ec..a56ac84381b1 100644
--- a/drivers/watchdog/at91sam9_wdt.c
+++ b/drivers/watchdog/at91sam9_wdt.c
@@ -18,6 +18,7 @@
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
diff --git a/drivers/watchdog/iTCO_vendor_support.c b/drivers/watchdog/iTCO_vendor_support.c
index 2474ebca88f6..d8264ad0be41 100644
--- a/drivers/watchdog/iTCO_vendor_support.c
+++ b/drivers/watchdog/iTCO_vendor_support.c
@@ -1,7 +1,7 @@
 /*
 *      intel TCO vendor specific watchdog driver support
 *
- *      (c) Copyright 2006-2008 Wim Van Sebroeck <wim@iguana.be>.
+ *      (c) Copyright 2006-2009 Wim Van Sebroeck <wim@iguana.be>.
 *
 *      This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
@@ -19,7 +19,7 @@
 /* Module and version information */
 #define DRV_NAME        "iTCO_vendor_support"
-#define DRV_VERSION     "1.02"
+#define DRV_VERSION     "1.03"
 #define PFX             DRV_NAME ": "
 /* Includes */
@@ -77,6 +77,26 @@ MODULE_PARM_DESC(vendorsupport, "iTCO vendor specific support mode, default=0 (n
 *          20.6 seconds.
 */
+static void supermicro_old_pre_start(unsigned long acpibase)
+{
+        unsigned long val32;
+        /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
+        val32 = inl(SMI_EN);
+        val32 &= 0xffffdfff;    /* Turn off SMI clearing watchdog */
+        outl(val32, SMI_EN);    /* Needed to activate watchdog */
+}
+static void supermicro_old_pre_stop(unsigned long acpibase)
+{
+        unsigned long val32;
+        /* Bit 13: TCO_EN -> 1 = Enables the TCO logic to generate SMI# */
+        val32 = inl(SMI_EN);
+        val32 |= 0x00002000;    /* Turn on SMI clearing watchdog */
+        outl(val32, SMI_EN);    /* Needed to deactivate watchdog */
+}
 static void supermicro_old_pre_keepalive(unsigned long acpibase)
 {
        /* Reload TCO Timer (done in iTCO_wdt_keepalive) + */
@@ -228,14 +248,18 @@ static void supermicro_new_pre_set_heartbeat(unsigned int heartbeat)
 void iTCO_vendor_pre_start(unsigned long acpibase,
                           unsigned int heartbeat)
 {
-        if (vendorsupport == SUPERMICRO_NEW_BOARD)
+        if (vendorsupport == SUPERMICRO_OLD_BOARD)
+                supermicro_old_pre_start(acpibase);
+        else if (vendorsupport == SUPERMICRO_NEW_BOARD)
                supermicro_new_pre_start(heartbeat);
 }
 EXPORT_SYMBOL(iTCO_vendor_pre_start);
 void iTCO_vendor_pre_stop(unsigned long acpibase)
 {
-        if (vendorsupport == SUPERMICRO_NEW_BOARD)
+        if (vendorsupport == SUPERMICRO_OLD_BOARD)
+                supermicro_old_pre_stop(acpibase);
+        else if (vendorsupport == SUPERMICRO_NEW_BOARD)
                supermicro_new_pre_stop();
 }
 EXPORT_SYMBOL(iTCO_vendor_pre_stop);
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 5b395a4ddfdf..352334947ea3 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -1,7 +1,7 @@
 /*
- *      intel TCO Watchdog Driver (Used in i82801 and i6300ESB chipsets)
+ *      intel TCO Watchdog Driver (Used in i82801 and i63xxESB chipsets)
 *
- *      (c) Copyright 2006-2008 Wim Van Sebroeck <wim@iguana.be>.
+ *      (c) Copyright 2006-2009 Wim Van Sebroeck <wim@iguana.be>.
 *
 *      This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
@@ -63,7 +63,7 @@
 /* Module and version information */
 #define DRV_NAME        "iTCO_wdt"
-#define DRV_VERSION     "1.04"
+#define DRV_VERSION     "1.05"
 #define PFX             DRV_NAME ": "
 /* Includes */
@@ -236,16 +236,16 @@ MODULE_DEVICE_TABLE(pci, iTCO_wdt_pci_tbl);
 /* Address definitions for the TCO */
 /* TCO base address */
-#define TCOBASE         iTCO_wdt_private.ACPIBASE + 0x60
+#define TCOBASE         iTCO_wdt_private.ACPIBASE + 0x60
 /* SMI Control and Enable Register */
-#define SMI_EN          iTCO_wdt_private.ACPIBASE + 0x30
+#define SMI_EN          iTCO_wdt_private.ACPIBASE + 0x30
 #define TCO_RLD         TCOBASE + 0x00  /* TCO Timer Reload and Curr. Value */
 #define TCOv1_TMR       TCOBASE + 0x01  /* TCOv1 Timer Initial Value    */
-#define TCO_DAT_IN      TCOBASE + 0x02  /* TCO Data In Register         */
+#define TCO_DAT_IN      TCOBASE + 0x02  /* TCO Data In Register         */
-#define TCO_DAT_OUT     TCOBASE + 0x03  /* TCO Data Out Register        */
+#define TCO_DAT_OUT     TCOBASE + 0x03  /* TCO Data Out Register        */
-#define TCO1_STS        TCOBASE + 0x04  /* TCO1 Status Register         */
+#define TCO1_STS        TCOBASE + 0x04  /* TCO1 Status Register         */
-#define TCO2_STS        TCOBASE + 0x06  /* TCO2 Status Register         */
+#define TCO2_STS        TCOBASE + 0x06  /* TCO2 Status Register         */
 #define TCO1_CNT        TCOBASE + 0x08  /* TCO1 Control Register        */
 #define TCO2_CNT        TCOBASE + 0x0a  /* TCO2 Control Register        */
 #define TCOv2_TMR       TCOBASE + 0x12  /* TCOv2 Timer Initial Value    */
@@ -338,7 +338,6 @@ static int iTCO_wdt_unset_NO_REBOOT_bit(void)
 static int iTCO_wdt_start(void)
 {
        unsigned int val;
-        unsigned long val32;
        spin_lock(&iTCO_wdt_private.io_lock);
@@ -351,11 +350,6 @@ static int iTCO_wdt_start(void)
                return -EIO;
        }
-        /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
-        val32 = inl(SMI_EN);
-        val32 &= 0xffffdfff;    /* Turn off SMI clearing watchdog */
-        outl(val32, SMI_EN);
        /* Force the timer to its reload value by writing to the TCO_RLD
           register */
        if (iTCO_wdt_private.iTCO_version == 2)
@@ -378,7 +372,6 @@ static int iTCO_wdt_start(void)
 static int iTCO_wdt_stop(void)
 {
        unsigned int val;
-        unsigned long val32;
        spin_lock(&iTCO_wdt_private.io_lock);
@@ -390,11 +383,6 @@ static int iTCO_wdt_stop(void)
        outw(val, TCO1_CNT);
        val = inw(TCO1_CNT);
-        /* Bit 13: TCO_EN -> 1 = Enables the TCO logic to generate SMI# */
-        val32 = inl(SMI_EN);
-        val32 |= 0x00002000;
-        outl(val32, SMI_EN);
        /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
        iTCO_wdt_set_NO_REBOOT_bit();
@@ -649,6 +637,7 @@ static int __devinit iTCO_wdt_init(struct pci_dev *pdev,
        int ret;
        u32 base_address;
        unsigned long RCBA;
+        unsigned long val32;
        /*
         *      Find the ACPI/PM base I/O address which is the base
@@ -695,6 +684,10 @@ static int __devinit iTCO_wdt_init(struct pci_dev *pdev,
                ret = -EIO;
                goto out;
        }
+        /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
+        val32 = inl(SMI_EN);
+        val32 &= 0xffffdfff;    /* Turn off SMI clearing watchdog */
+        outl(val32, SMI_EN);
        /* The TCO I/O registers reside in a 32-byte range pointed to
           by the TCOBASE value */
diff --git a/fs/bio.c b/fs/bio.c
index 062299acbccd..72ab251cdb9c 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -302,9 +302,10 @@ void bio_init(struct bio *bio)
 struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
 {
        struct bio *bio = NULL;
+        void *p;
        if (bs) {
-                void *p = mempool_alloc(bs->bio_pool, gfp_mask);
+                p = mempool_alloc(bs->bio_pool, gfp_mask);
                if (p)
                        bio = p + bs->front_pad;
@@ -329,7 +330,7 @@ struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
                        }
                        if (unlikely(!bvl)) {
                                if (bs)
-                                        mempool_free(bio, bs->bio_pool);
+                                        mempool_free(p, bs->bio_pool);
                                else
                                        kfree(bio);
                                bio = NULL;
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 35443cc4b9a9..42491d728e99 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -38,19 +38,12 @@ static int balance_node_right(struct btrfs_trans_handle *trans,
 static int del_ptr(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                   struct btrfs_path *path, int level, int slot);
-inline void btrfs_init_path(struct btrfs_path *p)
-{
-        memset(p, 0, sizeof(*p));
-}
 struct btrfs_path *btrfs_alloc_path(void)
 {
        struct btrfs_path *path;
-        path = kmem_cache_alloc(btrfs_path_cachep, GFP_NOFS);
+        path = kmem_cache_zalloc(btrfs_path_cachep, GFP_NOFS);
-        if (path) {
+        if (path)
-                btrfs_init_path(path);
                path->reada = 1;
-        }
        return path;
 }
@@ -69,14 +62,38 @@ noinline void btrfs_set_path_blocking(struct btrfs_path *p)
 /*
 * reset all the locked nodes in the patch to spinning locks.
+ *
+ * held is used to keep lockdep happy, when lockdep is enabled
+ * we set held to a blocking lock before we go around and
+ * retake all the spinlocks in the path.  You can safely use NULL
+ * for held
 */
-noinline void btrfs_clear_path_blocking(struct btrfs_path *p)
+noinline void btrfs_clear_path_blocking(struct btrfs_path *p,
+                                        struct extent_buffer *held)
 {
        int i;
-        for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        /* lockdep really cares that we take all of these spinlocks
+         * in the right order.  If any of the locks in the path are not
+         * currently blocking, it is going to complain.  So, make really
+         * really sure by forcing the path to blocking before we clear
+         * the path blocking.
+         */
+        if (held)
+                btrfs_set_lock_blocking(held);
+        btrfs_set_path_blocking(p);
+#endif
+        for (i = BTRFS_MAX_LEVEL - 1; i >= 0; i--) {
                if (p->nodes[i] && p->locks[i])
                        btrfs_clear_lock_blocking(p->nodes[i]);
        }
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        if (held)
+                btrfs_clear_lock_blocking(held);
+#endif
 }
 /* this also releases the path */
@@ -286,7 +303,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
                                                  trans->transid, level, &ins);
                BUG_ON(ret);
                cow = btrfs_init_new_buffer(trans, root, prealloc_dest,
-                                            buf->len);
+                                            buf->len, level);
        } else {
                cow = btrfs_alloc_free_block(trans, root, buf->len,
                                             parent_start,
@@ -917,9 +934,9 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                /* promote the child to a root */
                child = read_node_slot(root, mid, 0);
+                BUG_ON(!child);
                btrfs_tree_lock(child);
                btrfs_set_lock_blocking(child);
-                BUG_ON(!child);
                ret = btrfs_cow_block(trans, root, child, mid, 0, &child, 0);
                BUG_ON(ret);
@@ -1566,7 +1583,7 @@ cow_done:
                if (!p->skip_locking)
                        p->locks[level] = 1;
-                btrfs_clear_path_blocking(p);
+                btrfs_clear_path_blocking(p, NULL);
                /*
                 * we have a lock on b and as long as we aren't changing
@@ -1605,7 +1622,7 @@ cow_done:
                                btrfs_set_path_blocking(p);
                                sret = split_node(trans, root, p, level);
-                                btrfs_clear_path_blocking(p);
+                                btrfs_clear_path_blocking(p, NULL);
                                BUG_ON(sret > 0);
                                if (sret) {
@@ -1625,7 +1642,7 @@ cow_done:
                                btrfs_set_path_blocking(p);
                                sret = balance_level(trans, root, p, level);
-                                btrfs_clear_path_blocking(p);
+                                btrfs_clear_path_blocking(p, NULL);
                                if (sret) {
                                        ret = sret;
@@ -1688,13 +1705,13 @@ cow_done:
                        if (!p->skip_locking) {
                                int lret;
-                                btrfs_clear_path_blocking(p);
+                                btrfs_clear_path_blocking(p, NULL);
                                lret = btrfs_try_spin_lock(b);
                                if (!lret) {
                                        btrfs_set_path_blocking(p);
                                        btrfs_tree_lock(b);
-                                        btrfs_clear_path_blocking(p);
+                                        btrfs_clear_path_blocking(p, b);
                                }
                        }
                } else {
@@ -1706,7 +1723,7 @@ cow_done:
                                btrfs_set_path_blocking(p);
                                sret = split_leaf(trans, root, key,
                                                      p, ins_len, ret == 0);
-                                btrfs_clear_path_blocking(p);
+                                btrfs_clear_path_blocking(p, NULL);
                                BUG_ON(sret > 0);
                                if (sret) {
@@ -3926,7 +3943,6 @@ find_next_key:
                                btrfs_release_path(root, path);
                                goto again;
                        } else {
-                                btrfs_clear_path_blocking(path);
                                goto out;
                        }
                }
@@ -3946,7 +3962,7 @@ find_next_key:
                path->locks[level - 1] = 1;
                path->nodes[level - 1] = cur;
                unlock_up(path, level, 1);
-                btrfs_clear_path_blocking(path);
+                btrfs_clear_path_blocking(path, NULL);
        }
 out:
        if (ret == 0)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 531db112c8bd..766b31ae3186 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -43,11 +43,7 @@ struct btrfs_ordered_sum;
 #define BTRFS_ACL_NOT_CACHED    ((void *)-1)
-#ifdef CONFIG_LOCKDEP
+#define BTRFS_MAX_LEVEL 8
-# define BTRFS_MAX_LEVEL 7
-#else
-# define BTRFS_MAX_LEVEL 8
-#endif
 /* holds pointers to all of the tree roots */
 #define BTRFS_ROOT_TREE_OBJECTID 1ULL
@@ -1715,7 +1711,8 @@ struct extent_buffer *btrfs_alloc_free_block(struct btrfs_trans_handle *trans,
                                             u64 empty_size);
 struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
                                            struct btrfs_root *root,
-                                            u64 bytenr, u32 blocksize);
+                                            u64 bytenr, u32 blocksize,
+                                            int level);
 int btrfs_alloc_extent(struct btrfs_trans_handle *trans,
                       struct btrfs_root *root,
                       u64 num_bytes, u64 parent, u64 min_bytes,
@@ -1834,9 +1831,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
 void btrfs_release_path(struct btrfs_root *root, struct btrfs_path *p);
 struct btrfs_path *btrfs_alloc_path(void);
 void btrfs_free_path(struct btrfs_path *p);
-void btrfs_init_path(struct btrfs_path *p);
 void btrfs_set_path_blocking(struct btrfs_path *p);
-void btrfs_clear_path_blocking(struct btrfs_path *p);
 void btrfs_unlock_up_safe(struct btrfs_path *p, int level);
 int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 5aebddd71193..adda739a0215 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -75,6 +75,40 @@ struct async_submit_bio {
        struct btrfs_work work;
 };
+/* These are used to set the lockdep class on the extent buffer locks.
+ * The class is set by the readpage_end_io_hook after the buffer has
+ * passed csum validation but before the pages are unlocked.
+ *
+ * The lockdep class is also set by btrfs_init_new_buffer on freshly
+ * allocated blocks.
+ *
+ * The class is based on the level in the tree block, which allows lockdep
+ * to know that lower nodes nest inside the locks of higher nodes.
+ *
+ * We also add a check to make sure the highest level of the tree is
+ * the same as our lockdep setup here.  If BTRFS_MAX_LEVEL changes, this
+ * code needs update as well.
+ */
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+# if BTRFS_MAX_LEVEL != 8
+#  error
+# endif
+static struct lock_class_key btrfs_eb_class[BTRFS_MAX_LEVEL + 1];
+static const char *btrfs_eb_name[BTRFS_MAX_LEVEL + 1] = {
+        /* leaf */
+        "btrfs-extent-00",
+        "btrfs-extent-01",
+        "btrfs-extent-02",
+        "btrfs-extent-03",
+        "btrfs-extent-04",
+        "btrfs-extent-05",
+        "btrfs-extent-06",
+        "btrfs-extent-07",
+        /* highest possible level */
+        "btrfs-extent-08",
+};
+#endif
 /*
 * extents on the btree inode are pretty simple, there's one extent
 * that covers the entire device
@@ -347,6 +381,15 @@ static int check_tree_block_fsid(struct btrfs_root *root,
        return ret;
 }
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+void btrfs_set_buffer_lockdep_class(struct extent_buffer *eb, int level)
+{
+        lockdep_set_class_and_name(&eb->lock,
+                           &btrfs_eb_class[level],
+                           btrfs_eb_name[level]);
+}
+#endif
 static int btree_readpage_end_io_hook(struct page *page, u64 start, u64 end,
                               struct extent_state *state)
 {
@@ -392,6 +435,8 @@ static int btree_readpage_end_io_hook(struct page *page, u64 start, u64 end,
        }
        found_level = btrfs_header_level(eb);
+        btrfs_set_buffer_lockdep_class(eb, found_level);
        ret = csum_tree_block(root, eb, 1);
        if (ret)
                ret = -EIO;
@@ -1777,7 +1822,6 @@ struct btrfs_root *open_ctree(struct super_block *sb,
        ret = find_and_setup_root(tree_root, fs_info,
                                  BTRFS_DEV_TREE_OBJECTID, dev_root);
        dev_root->track_dirty = 1;
        if (ret)
                goto fail_extent_root;
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index 494a56eb2986..95029db227be 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -101,4 +101,14 @@ int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
 int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
                       struct btrfs_root *root);
 int btree_lock_page_hook(struct page *page);
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+void btrfs_set_buffer_lockdep_class(struct extent_buffer *eb, int level);
+#else
+static inline void btrfs_set_buffer_lockdep_class(struct extent_buffer *eb,
+                                                 int level)
+{
+}
+#endif
 #endif
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 7527523c2d2d..0a5d796c9f7e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1323,8 +1323,25 @@ int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
 int btrfs_extent_post_op(struct btrfs_trans_handle *trans,
                         struct btrfs_root *root)
 {
-        finish_current_insert(trans, root->fs_info->extent_root, 1);
+        u64 start;
-        del_pending_extents(trans, root->fs_info->extent_root, 1);
+        u64 end;
+        int ret;
+        while(1) {
+                finish_current_insert(trans, root->fs_info->extent_root, 1);
+                del_pending_extents(trans, root->fs_info->extent_root, 1);
+                /* is there more work to do? */
+                ret = find_first_extent_bit(&root->fs_info->pending_del,
+                                            0, &start, &end, EXTENT_WRITEBACK);
+                if (!ret)
+                        continue;
+                ret = find_first_extent_bit(&root->fs_info->extent_ins,
+                                            0, &start, &end, EXTENT_WRITEBACK);
+                if (!ret)
+                        continue;
+                break;
+        }
        return 0;
 }
@@ -2211,13 +2228,12 @@ static int finish_current_insert(struct btrfs_trans_handle *trans,
        u64 end;
        u64 priv;
        u64 search = 0;
-        u64 skipped = 0;
        struct btrfs_fs_info *info = extent_root->fs_info;
        struct btrfs_path *path;
        struct pending_extent_op *extent_op, *tmp;
        struct list_head insert_list, update_list;
        int ret;
-        int num_inserts = 0, max_inserts;
+        int num_inserts = 0, max_inserts, restart = 0;
        path = btrfs_alloc_path();
        INIT_LIST_HEAD(&insert_list);
@@ -2233,19 +2249,19 @@ again:
                ret = find_first_extent_bit(&info->extent_ins, search, &start,
                                            &end, EXTENT_WRITEBACK);
                if (ret) {
-                        if (skipped && all && !num_inserts &&
+                        if (restart && !num_inserts &&
                            list_empty(&update_list)) {
-                                skipped = 0;
+                                restart = 0;
                                search = 0;
                                continue;
                        }
-                        mutex_unlock(&info->extent_ins_mutex);
                        break;
                }
                ret = try_lock_extent(&info->extent_ins, start, end, GFP_NOFS);
                if (!ret) {
-                        skipped = 1;
+                        if (all)
+                                restart = 1;
                        search = end + 1;
                        if (need_resched()) {
                                mutex_unlock(&info->extent_ins_mutex);
@@ -2264,7 +2280,7 @@ again:
                        list_add_tail(&extent_op->list, &insert_list);
                        search = end + 1;
                        if (num_inserts == max_inserts) {
-                                mutex_unlock(&info->extent_ins_mutex);
+                                restart = 1;
                                break;
                        }
                } else if (extent_op->type == PENDING_BACKREF_UPDATE) {
@@ -2280,7 +2296,6 @@ again:
         * somebody marked this thing for deletion then just unlock it and be
         * done, the free_extents will handle it
         */
-        mutex_lock(&info->extent_ins_mutex);
        list_for_each_entry_safe(extent_op, tmp, &update_list, list) {
                clear_extent_bits(&info->extent_ins, extent_op->bytenr,
                                  extent_op->bytenr + extent_op->num_bytes - 1,
@@ -2302,6 +2317,10 @@ again:
        if (!list_empty(&update_list)) {
                ret = update_backrefs(trans, extent_root, path, &update_list);
                BUG_ON(ret);
+                /* we may have COW'ed new blocks, so lets start over */
+                if (all)
+                        restart = 1;
        }
        /*
@@ -2309,9 +2328,9 @@ again:
         * need to make sure everything is cleaned then reset everything and
         * go back to the beginning
         */
-        if (!num_inserts && all && skipped) {
+        if (!num_inserts && restart) {
                search = 0;
-                skipped = 0;
+                restart = 0;
                INIT_LIST_HEAD(&update_list);
                INIT_LIST_HEAD(&insert_list);
                goto again;
@@ -2368,27 +2387,19 @@ again:
        BUG_ON(ret);
        /*
-         * if we broke out of the loop in order to insert stuff because we hit
+         * if restart is set for whatever reason we need to go back and start
-         * the maximum number of inserts at a time we can handle, then loop
+         * searching through the pending list again.
-         * back and pick up where we left off
+         *
+         * We just inserted some extents, which could have resulted in new
+         * blocks being allocated, which would result in new blocks needing
+         * updates, so if all is set we _must_ restart to get the updated
+         * blocks.
         */
-        if (num_inserts == max_inserts) {
+        if (restart || all) {
-                INIT_LIST_HEAD(&insert_list);
-                INIT_LIST_HEAD(&update_list);
-                num_inserts = 0;
-                goto again;
-        }
-        /*
-         * again, if we need to make absolutely sure there are no more pending
-         * extent operations left and we know that we skipped some, go back to
-         * the beginning and do it all again
-         */
-        if (all && skipped) {
                INIT_LIST_HEAD(&insert_list);
                INIT_LIST_HEAD(&update_list);
                search = 0;
-                skipped = 0;
+                restart = 0;
                num_inserts = 0;
                goto again;
        }
@@ -2709,6 +2720,8 @@ again:
                goto again;
        }
+        if (!err)
+                finish_current_insert(trans, extent_root, 0);
        return err;
 }
@@ -2859,7 +2872,8 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
        if (data & BTRFS_BLOCK_GROUP_METADATA) {
                last_ptr = &root->fs_info->last_alloc;
-                empty_cluster = 64 * 1024;
+                if (!btrfs_test_opt(root, SSD))
+                        empty_cluster = 64 * 1024;
        }
        if ((data & BTRFS_BLOCK_GROUP_DATA) && btrfs_test_opt(root, SSD))
@@ -3402,7 +3416,8 @@ int btrfs_alloc_extent(struct btrfs_trans_handle *trans,
 struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
                                            struct btrfs_root *root,
-                                            u64 bytenr, u32 blocksize)
+                                            u64 bytenr, u32 blocksize,
+                                            int level)
 {
        struct extent_buffer *buf;
@@ -3410,6 +3425,7 @@ struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
        if (!buf)
                return ERR_PTR(-ENOMEM);
        btrfs_set_header_generation(buf, trans->transid);
+        btrfs_set_buffer_lockdep_class(buf, level);
        btrfs_tree_lock(buf);
        clean_tree_block(trans, root, buf);
@@ -3453,7 +3469,8 @@ struct extent_buffer *btrfs_alloc_free_block(struct btrfs_trans_handle *trans,
                return ERR_PTR(ret);
        }
-        buf = btrfs_init_new_buffer(trans, root, ins.objectid, blocksize);
+        buf = btrfs_init_new_buffer(trans, root, ins.objectid,
+                                    blocksize, level);
        return buf;
 }
@@ -5641,7 +5658,9 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
                        prev_block = block_start;
                }
+                mutex_lock(&extent_root->fs_info->trans_mutex);
                btrfs_record_root_in_trans(found_root);
+                mutex_unlock(&extent_root->fs_info->trans_mutex);
                if (ref_path->owner_objectid >= BTRFS_FIRST_FREE_OBJECTID) {
                        /*
                         * try to update data extent references while
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 37d43b516b79..ebe6b29e6069 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -415,8 +415,6 @@ static int split_state(struct extent_io_tree *tree, struct extent_state *orig,
        node = tree_insert(&tree->state, prealloc->end, &prealloc->rb_node);
        if (node) {
-                struct extent_state *found;
-                found = rb_entry(node, struct extent_state, rb_node);
                free_extent_state(prealloc);
                return -EEXIST;
        }
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 2aa79873eb46..cc7334d833c9 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -84,7 +84,6 @@ int btrfs_find_free_objectid(struct btrfs_trans_handle *trans,
        search_key.type = 0;
        search_key.offset = 0;
-        btrfs_init_path(path);
        start_found = 0;
        ret = btrfs_search_slot(trans, root, &search_key, path, 0, 0);
        if (ret < 0)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 8f0706210a47..3cee77ae03c8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2531,8 +2531,6 @@ noinline int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
        key.offset = (u64)-1;
        key.type = (u8)-1;
-        btrfs_init_path(path);
 search_again:
        ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
        if (ret < 0)
@@ -4263,7 +4261,7 @@ static int btrfs_releasepage(struct page *page, gfp_t gfp_flags)
 {
        if (PageWriteback(page) || PageDirty(page))
                return 0;
-        return __btrfs_releasepage(page, gfp_flags);
+        return __btrfs_releasepage(page, gfp_flags & GFP_NOFS);
 }
 static void btrfs_invalidatepage(struct page *page, unsigned long offset)
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 9ebe9385129b..85506c4a3af7 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -25,21 +25,10 @@
 #include "extent_io.h"
 #include "locking.h"
-/*
- * btrfs_header_level() isn't free, so don't call it when lockdep isn't
- * on
- */
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-static inline void spin_nested(struct extent_buffer *eb)
-{
-        spin_lock_nested(&eb->lock, BTRFS_MAX_LEVEL - btrfs_header_level(eb));
-}
-#else
 static inline void spin_nested(struct extent_buffer *eb)
 {
        spin_lock(&eb->lock);
 }
-#endif
 /*
 * Setting a lock to blocking will drop the spinlock and set the
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index f3fd7e2cbc38..19a4daf03ccb 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -379,7 +379,6 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
        btrfs_start_delalloc_inodes(root);
        btrfs_wait_ordered_extents(root, 0);
-        btrfs_clean_old_snapshots(root);
        trans = btrfs_start_transaction(root, 1);
        ret = btrfs_commit_transaction(trans, root);
        sb->s_dirt = 0;
@@ -511,6 +510,10 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
        struct btrfs_root *root = btrfs_sb(sb);
        int ret;
+        ret = btrfs_parse_options(root, data);
+        if (ret)
+                return -EINVAL;
        if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
                return 0;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 919172de5c9a..4112d53d4f4d 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -688,7 +688,9 @@ static noinline int drop_dirty_roots(struct btrfs_root *tree_root,
                num_bytes -= btrfs_root_used(&dirty->root->root_item);
                bytes_used = btrfs_root_used(&root->root_item);
                if (num_bytes) {
+                        mutex_lock(&root->fs_info->trans_mutex);
                        btrfs_record_root_in_trans(root);
+                        mutex_unlock(&root->fs_info->trans_mutex);
                        btrfs_set_root_used(&root->root_item,
                                            bytes_used - num_bytes);
                }
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 20794290256b..9c462fbd60fa 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2832,7 +2832,9 @@ again:
                BUG_ON(!wc.replay_dest);
                wc.replay_dest->log_root = log;
+                mutex_lock(&fs_info->trans_mutex);
                btrfs_record_root_in_trans(wc.replay_dest);
+                mutex_unlock(&fs_info->trans_mutex);
                ret = walk_log_tree(trans, log, &wc);
                BUG_ON(ret);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index bcd14ebccae1..1316139bf9e8 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2894,10 +2894,6 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
                free_extent_map(em);
        }
-        map = kzalloc(sizeof(*map), GFP_NOFS);
-        if (!map)
-                return -ENOMEM;
        em = alloc_extent_map(GFP_NOFS);
        if (!em)
                return -ENOMEM;
@@ -3106,6 +3102,8 @@ int btrfs_read_sys_array(struct btrfs_root *root)
        if (!sb)
                return -ENOMEM;
        btrfs_set_buffer_uptodate(sb);
+        btrfs_set_buffer_lockdep_class(sb, 0);
        write_extent_buffer(sb, super_copy, 0, BTRFS_SUPER_INFO_SIZE);
        array_size = btrfs_super_sys_array_size(super_copy);
diff --git a/fs/buffer.c b/fs/buffer.c
index 665d446b25bc..9f697419ed8e 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -777,6 +777,7 @@ static int __set_page_dirty(struct page *page,
                        __inc_zone_page_state(page, NR_FILE_DIRTY);
                        __inc_bdi_stat(mapping->backing_dev_info,
                                        BDI_RECLAIMABLE);
+                        task_dirty_inc(current);
                        task_io_account_write(PAGE_CACHE_SIZE);
                }
                radix_tree_tag_set(&mapping->page_tree,
@@ -3108,7 +3109,7 @@ int sync_dirty_buffer(struct buffer_head *bh)
        if (test_clear_buffer_dirty(bh)) {
                get_bh(bh);
                bh->b_end_io = end_buffer_write_sync;
-                ret = submit_bh(WRITE_SYNC, bh);
+                ret = submit_bh(WRITE, bh);
                wait_on_buffer(bh);
                if (buffer_eopnotsupp(bh)) {
                        clear_buffer_eopnotsupp(bh);
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 9c6d815dd191..39bd4d38e889 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1938,6 +1938,8 @@ ULONG_IOCTL(SET_BITMAP_FILE)
 /* Big K */
 COMPATIBLE_IOCTL(PIO_FONT)
 COMPATIBLE_IOCTL(GIO_FONT)
+COMPATIBLE_IOCTL(PIO_CMAP)
+COMPATIBLE_IOCTL(GIO_CMAP)
 ULONG_IOCTL(KDSIGACCEPT)
 COMPATIBLE_IOCTL(KDGETKEYCODE)
 COMPATIBLE_IOCTL(KDSETKEYCODE)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index aafc9eba1c25..b0c87dce66a3 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -868,7 +868,7 @@ static inline unsigned ext4_rec_len_from_disk(__le16 dlen)
 {
        unsigned len = le16_to_cpu(dlen);
-        if (len == EXT4_MAX_REC_LEN)
+        if (len == EXT4_MAX_REC_LEN || len == 0)
                return 1 << 16;
        return len;
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 03ba20be1329..cbd2ca99d113 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -47,8 +47,10 @@
 static inline int ext4_begin_ordered_truncate(struct inode *inode,
                                              loff_t new_size)
 {
-        return jbd2_journal_begin_ordered_truncate(&EXT4_I(inode)->jinode,
+        return jbd2_journal_begin_ordered_truncate(
-                                                   new_size);
+                                        EXT4_SB(inode->i_sb)->s_journal,
+                                        &EXT4_I(inode)->jinode,
+                                        new_size);
 }
 static void ext4_invalidatepage(struct page *page, unsigned long offset);
@@ -2437,6 +2439,7 @@ static int ext4_da_writepages(struct address_space *mapping,
        int no_nrwrite_index_update;
        int pages_written = 0;
        long pages_skipped;
+        int range_cyclic, cycled = 1, io_done = 0;
        int needed_blocks, ret = 0, nr_to_writebump = 0;
        struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb);
@@ -2488,9 +2491,15 @@ static int ext4_da_writepages(struct address_space *mapping,
        if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
                range_whole = 1;
-        if (wbc->range_cyclic)
+        range_cyclic = wbc->range_cyclic;
+        if (wbc->range_cyclic) {
                index = mapping->writeback_index;
-        else
+                if (index)
+                        cycled = 0;
+                wbc->range_start = index << PAGE_CACHE_SHIFT;
+                wbc->range_end  = LLONG_MAX;
+                wbc->range_cyclic = 0;
+        } else
                index = wbc->range_start >> PAGE_CACHE_SHIFT;
        mpd.wbc = wbc;
@@ -2504,6 +2513,7 @@ static int ext4_da_writepages(struct address_space *mapping,
        wbc->no_nrwrite_index_update = 1;
        pages_skipped = wbc->pages_skipped;
+retry:
        while (!ret && wbc->nr_to_write > 0) {
                /*
@@ -2546,6 +2556,7 @@ static int ext4_da_writepages(struct address_space *mapping,
                        pages_written += mpd.pages_written;
                        wbc->pages_skipped = pages_skipped;
                        ret = 0;
+                        io_done = 1;
                } else if (wbc->nr_to_write)
                        /*
                         * There is no more writeout needed
@@ -2554,6 +2565,13 @@ static int ext4_da_writepages(struct address_space *mapping,
                         */
                        break;
        }
+        if (!io_done && !cycled) {
+                cycled = 1;
+                index = 0;
+                wbc->range_start = index << PAGE_CACHE_SHIFT;
+                wbc->range_end  = mapping->writeback_index - 1;
+                goto retry;
+        }
        if (pages_skipped != wbc->pages_skipped)
                printk(KERN_EMERG "This should not happen leaving %s "
                                "with nr_to_write = %ld ret = %d\n",
@@ -2561,6 +2579,7 @@ static int ext4_da_writepages(struct address_space *mapping,
        /* Update index */
        index += pages_written;
+        wbc->range_cyclic = range_cyclic;
        if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
                /*
                 * set the writeback_index so that range_cyclic
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index deba54f6cbed..4415beeb0b62 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3693,6 +3693,8 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
        pa->pa_free = pa->pa_len;
        atomic_set(&pa->pa_count, 1);
        spin_lock_init(&pa->pa_lock);
+        INIT_LIST_HEAD(&pa->pa_inode_list);
+        INIT_LIST_HEAD(&pa->pa_group_list);
        pa->pa_deleted = 0;
        pa->pa_linear = 0;
@@ -3755,6 +3757,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
        atomic_set(&pa->pa_count, 1);
        spin_lock_init(&pa->pa_lock);
        INIT_LIST_HEAD(&pa->pa_inode_list);
+        INIT_LIST_HEAD(&pa->pa_group_list);
        pa->pa_deleted = 0;
        pa->pa_linear = 1;
@@ -4476,23 +4479,26 @@ static int ext4_mb_release_context(struct ext4_allocation_context *ac)
                        pa->pa_free -= ac->ac_b_ex.fe_len;
                        pa->pa_len -= ac->ac_b_ex.fe_len;
                        spin_unlock(&pa->pa_lock);
-                        /*
-                         * We want to add the pa to the right bucket.
-                         * Remove it from the list and while adding
-                         * make sure the list to which we are adding
-                         * doesn't grow big.
-                         */
-                        if (likely(pa->pa_free)) {
-                                spin_lock(pa->pa_obj_lock);
-                                list_del_rcu(&pa->pa_inode_list);
-                                spin_unlock(pa->pa_obj_lock);
-                                ext4_mb_add_n_trim(ac);
-                        }
                }
-                ext4_mb_put_pa(ac, ac->ac_sb, pa);
        }
        if (ac->alloc_semp)
                up_read(ac->alloc_semp);
+        if (pa) {
+                /*
+                 * We want to add the pa to the right bucket.
+                 * Remove it from the list and while adding
+                 * make sure the list to which we are adding
+                 * doesn't grow big.  We need to release
+                 * alloc_semp before calling ext4_mb_add_n_trim()
+                 */
+                if (pa->pa_linear && likely(pa->pa_free)) {
+                        spin_lock(pa->pa_obj_lock);
+                        list_del_rcu(&pa->pa_inode_list);
+                        spin_unlock(pa->pa_obj_lock);
+                        ext4_mb_add_n_trim(ac);
+                }
+                ext4_mb_put_pa(ac, ac->ac_sb, pa);
+        }
        if (ac->ac_bitmap_page)
                page_cache_release(ac->ac_bitmap_page);
        if (ac->ac_buddy_page)
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index 734abca25e35..fe64d9f79852 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -481,7 +481,7 @@ int ext4_ext_migrate(struct inode *inode)
                                        + 1);
        if (IS_ERR(handle)) {
                retval = PTR_ERR(handle);
-                goto err_out;
+                return retval;
        }
        tmp_inode = ext4_new_inode(handle,
                                inode->i_sb->s_root->d_inode,
@@ -489,8 +489,7 @@ int ext4_ext_migrate(struct inode *inode)
        if (IS_ERR(tmp_inode)) {
                retval = -ENOMEM;
                ext4_journal_stop(handle);
-                tmp_inode = NULL;
+                return retval;
-                goto err_out;
        }
        i_size_write(tmp_inode, i_size_read(inode));
        /*
@@ -618,8 +617,7 @@ err_out:
        ext4_journal_stop(handle);
-        if (tmp_inode)
+        iput(tmp_inode);
-                iput(tmp_inode);
        return retval;
 }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index e5f06a5f045e..a5732c58f676 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3046,14 +3046,17 @@ static void ext4_write_super(struct super_block *sb)
 static int ext4_sync_fs(struct super_block *sb, int wait)
 {
        int ret = 0;
+        tid_t target;
        trace_mark(ext4_sync_fs, "dev %s wait %d", sb->s_id, wait);
        sb->s_dirt = 0;
        if (EXT4_SB(sb)->s_journal) {
-                if (wait)
+                if (jbd2_journal_start_commit(EXT4_SB(sb)->s_journal,
-                        ret = ext4_force_commit(sb);
+                                              &target)) {
-                else
+                        if (wait)
-                        jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, NULL);
+                                jbd2_log_wait_commit(EXT4_SB(sb)->s_journal,
+                                                     target);
+                }
        } else {
                ext4_commit_super(sb, EXT4_SB(sb)->s_es, wait);
        }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index eb343008eded..58144102bf25 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -450,7 +450,7 @@ int __jbd2_log_space_left(journal_t *journal)
 }
 /*
- * Called under j_state_lock.  Returns true if a transaction was started.
+ * Called under j_state_lock.  Returns true if a transaction commit was started.
 */
 int __jbd2_log_start_commit(journal_t *journal, tid_t target)
 {
@@ -518,7 +518,8 @@ int jbd2_journal_force_commit_nested(journal_t *journal)
 /*
 * Start a commit of the current running transaction (if any).  Returns true
- * if a transaction was started, and fills its tid in at *ptid
+ * if a transaction is going to be committed (or is currently already
+ * committing), and fills its tid in at *ptid
 */
 int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid)
 {
@@ -528,15 +529,19 @@ int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid)
        if (journal->j_running_transaction) {
                tid_t tid = journal->j_running_transaction->t_tid;
-                ret = __jbd2_log_start_commit(journal, tid);
+                __jbd2_log_start_commit(journal, tid);
-                if (ret && ptid)
+                /* There's a running transaction and we've just made sure
+                 * it's commit has been scheduled. */
+                if (ptid)
                        *ptid = tid;
-        } else if (journal->j_committing_transaction && ptid) {
+                ret = 1;
+        } else if (journal->j_committing_transaction) {
                /*
                 * If ext3_write_super() recently started a commit, then we
                 * have to wait for completion of that transaction
                 */
-                *ptid = journal->j_committing_transaction->t_tid;
+                if (ptid)
+                        *ptid = journal->j_committing_transaction->t_tid;
                ret = 1;
        }
        spin_unlock(&journal->j_state_lock);
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 46b4e347ed7d..28ce21d8598e 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2129,26 +2129,46 @@ done:
 }
 /*
- * This function must be called when inode is journaled in ordered mode
+ * File truncate and transaction commit interact with each other in a
- * before truncation happens. It starts writeout of truncated part in
+ * non-trivial way.  If a transaction writing data block A is
- * case it is in the committing transaction so that we stand to ordered
+ * committing, we cannot discard the data by truncate until we have
- * mode consistency guarantees.
+ * written them.  Otherwise if we crashed after the transaction with
+ * write has committed but before the transaction with truncate has
+ * committed, we could see stale data in block A.  This function is a
+ * helper to solve this problem.  It starts writeout of the truncated
+ * part in case it is in the committing transaction.
+ *
+ * Filesystem code must call this function when inode is journaled in
+ * ordered mode before truncation happens and after the inode has been
+ * placed on orphan list with the new inode size. The second condition
+ * avoids the race that someone writes new data and we start
+ * committing the transaction after this function has been called but
+ * before a transaction for truncate is started (and furthermore it
+ * allows us to optimize the case where the addition to orphan list
+ * happens in the same transaction as write --- we don't have to write
+ * any data in such case).
 */
-int jbd2_journal_begin_ordered_truncate(struct jbd2_inode *inode,
+int jbd2_journal_begin_ordered_truncate(journal_t *journal,
+                                        struct jbd2_inode *jinode,
                                        loff_t new_size)
 {
-        journal_t *journal;
+        transaction_t *inode_trans, *commit_trans;
-        transaction_t *commit_trans;
        int ret = 0;
-        if (!inode->i_transaction && !inode->i_next_transaction)
+        /* This is a quick check to avoid locking if not necessary */
+        if (!jinode->i_transaction)
                goto out;
-        journal = inode->i_transaction->t_journal;
+        /* Locks are here just to force reading of recent values, it is
+         * enough that the transaction was not committing before we started
+         * a transaction adding the inode to orphan list */
        spin_lock(&journal->j_state_lock);
        commit_trans = journal->j_committing_transaction;
        spin_unlock(&journal->j_state_lock);
-        if (inode->i_transaction == commit_trans) {
+        spin_lock(&journal->j_list_lock);
-                ret = filemap_fdatawrite_range(inode->i_vfs_inode->i_mapping,
+        inode_trans = jinode->i_transaction;
+        spin_unlock(&journal->j_list_lock);
+        if (inode_trans == commit_trans) {
+                ret = filemap_fdatawrite_range(jinode->i_vfs_inode->i_mapping,
                        new_size, LLONG_MAX);
                if (ret)
                        jbd2_journal_abort(journal, ret);
diff --git a/fs/namespace.c b/fs/namespace.c
index 228d8c4bfd18..06f8e63f6cb1 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -614,9 +614,11 @@ static inline void __mntput(struct vfsmount *mnt)
         */
        for_each_possible_cpu(cpu) {
                struct mnt_writer *cpu_writer = &per_cpu(mnt_writers, cpu);
-                if (cpu_writer->mnt != mnt)
-                        continue;
                spin_lock(&cpu_writer->lock);
+                if (cpu_writer->mnt != mnt) {
+                        spin_unlock(&cpu_writer->lock);
+                        continue;
+                }
                atomic_add(cpu_writer->count, &mnt->__mnt_writers);
                cpu_writer->count = 0;
                /*
diff --git a/fs/notify/inotify/inotify.c b/fs/notify/inotify/inotify.c
index dae3f28f30d4..331f2e88e284 100644
--- a/fs/notify/inotify/inotify.c
+++ b/fs/notify/inotify/inotify.c
@@ -156,7 +156,7 @@ static int inotify_handle_get_wd(struct inotify_handle *ih,
        int ret;
        do {
-                if (unlikely(!idr_pre_get(&ih->idr, GFP_KERNEL)))
+                if (unlikely(!idr_pre_get(&ih->idr, GFP_NOFS)))
                        return -ENOSPC;
                ret = idr_get_new_above(&ih->idr, watch, ih->last_wd+1, &watch->wd);
        } while (ret == -EAGAIN);
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index 3c3532e1307c..172850a9a12a 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -513,8 +513,10 @@ static inline int ocfs2_jbd2_file_inode(handle_t *handle, struct inode *inode)
 static inline int ocfs2_begin_ordered_truncate(struct inode *inode,
                                               loff_t new_size)
 {
-        return jbd2_journal_begin_ordered_truncate(&OCFS2_I(inode)->ip_jinode,
+        return jbd2_journal_begin_ordered_truncate(
-                                                   new_size);
+                                OCFS2_SB(inode->i_sb)->journal->j_journal,
+                                &OCFS2_I(inode)->ip_jinode,
+                                new_size);
 }
 #endif /* OCFS2_JOURNAL_H */
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 5267098532bf..a1a4cfe19210 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -48,8 +48,16 @@ int seq_open(struct file *file, const struct seq_operations *op)
         */
        file->f_version = 0;
-        /* SEQ files support lseek, but not pread/pwrite */
+        /*
-        file->f_mode &= ~(FMODE_PREAD | FMODE_PWRITE);
+         * seq_files support lseek() and pread().  They do not implement
+         * write() at all, but we clear FMODE_PWRITE here for historical
+         * reasons.
+         *
+         * If a client of seq_files a) implements file.write() and b) wishes to
+         * support pwrite() then that client will need to implement its own
+         * file.open() which calls seq_open() and then sets FMODE_PWRITE.
+         */
+        file->f_mode &= ~FMODE_PWRITE;
        return 0;
 }
 EXPORT_SYMBOL(seq_open);
@@ -131,6 +139,22 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
        int err = 0;
        mutex_lock(&m->lock);
+        /* Don't assume *ppos is where we left it */
+        if (unlikely(*ppos != m->read_pos)) {
+                m->read_pos = *ppos;
+                while ((err = traverse(m, *ppos)) == -EAGAIN)
+                        ;
+                if (err) {
+                        /* With prejudice... */
+                        m->read_pos = 0;
+                        m->version = 0;
+                        m->index = 0;
+                        m->count = 0;
+                        goto Done;
+                }
+        }
        /*
         * seq_file->op->..m_start/m_stop/m_next may do special actions
         * or optimisations based on the file->f_version, so we want to
@@ -230,8 +254,10 @@ Fill:
 Done:
        if (!copied)
                copied = err;
-        else
+        else {
                *ppos += copied;
+                m->read_pos += copied;
+        }
        file->f_version = m->version;
        mutex_unlock(&m->lock);
        return copied;
@@ -266,16 +292,18 @@ loff_t seq_lseek(struct file *file, loff_t offset, int origin)
                        if (offset < 0)
                                break;
                        retval = offset;
-                        if (offset != file->f_pos) {
+                        if (offset != m->read_pos) {
                                while ((retval=traverse(m, offset)) == -EAGAIN)
                                        ;
                                if (retval) {
                                        /* with extreme prejudice... */
                                        file->f_pos = 0;
+                                        m->read_pos = 0;
                                        m->version = 0;
                                        m->index = 0;
                                        m->count = 0;
                                } else {
+                                        m->read_pos = offset;
                                        retval = file->f_pos = offset;
                                }
                        }
diff --git a/fs/super.c b/fs/super.c
index 61dce001dd57..8349ed6b1412 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -82,7 +82,22 @@ static struct super_block *alloc_super(struct file_system_type *type)
                 * lock ordering than usbfs:
                 */
                lockdep_set_class(&s->s_lock, &type->s_lock_key);
-                down_write(&s->s_umount);
+                /*
+                 * sget() can have s_umount recursion.
+                 *
+                 * When it cannot find a suitable sb, it allocates a new
+                 * one (this one), and tries again to find a suitable old
+                 * one.
+                 *
+                 * In case that succeeds, it will acquire the s_umount
+                 * lock of the old one. Since these are clearly distrinct
+                 * locks, and this object isn't exposed yet, there's no
+                 * risk of deadlocks.
+                 *
+                 * Annotate this by putting this lock in a different
+                 * subclass.
+                 */
+                down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING);
                s->s_count = S_BIAS;
                atomic_set(&s->s_active, 1);
                mutex_init(&s->s_vfs_rename_mutex);
diff --git a/fs/timerfd.c b/fs/timerfd.c
index 6a123b8ff3f5..b042bd7034b1 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -186,10 +186,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
        BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
        BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
-        if (flags & ~(TFD_CLOEXEC | TFD_NONBLOCK))
+        if ((flags & ~TFD_CREATE_FLAGS) ||
-                return -EINVAL;
+            (clockid != CLOCK_MONOTONIC &&
-        if (clockid != CLOCK_MONOTONIC &&
+             clockid != CLOCK_REALTIME))
-            clockid != CLOCK_REALTIME)
                return -EINVAL;
        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
@@ -201,7 +200,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
        hrtimer_init(&ctx->tmr, clockid, HRTIMER_MODE_ABS);
        ufd = anon_inode_getfd("[timerfd]", &timerfd_fops, ctx,
-                               flags & (O_CLOEXEC | O_NONBLOCK));
+                               flags & TFD_SHARED_FCNTL_FLAGS);
        if (ufd < 0)
                kfree(ctx);
@@ -219,7 +218,8 @@ SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
        if (copy_from_user(&ktmr, utmr, sizeof(ktmr)))
                return -EFAULT;
-        if (!timespec_valid(&ktmr.it_value) ||
+        if ((flags & ~TFD_SETTIME_FLAGS) ||
+            !timespec_valid(&ktmr.it_value) ||
            !timespec_valid(&ktmr.it_interval))
                return -EINVAL;
diff --git a/include/asm-frv/pgtable.h b/include/asm-frv/pgtable.h
index 83c51aba534b..e16fdb1f4f4f 100644
--- a/include/asm-frv/pgtable.h
+++ b/include/asm-frv/pgtable.h
@@ -478,7 +478,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 #define __swp_type(x)                   (((x).val >> 2) & 0x1f)
 #define __swp_offset(x)                 ((x).val >> 8)
 #define __swp_entry(type, offset)       ((swp_entry_t) { ((type) << 2) | ((offset) << 8) })
-#define __pte_to_swp_entry(pte)         ((swp_entry_t) { (pte).pte })
+#define __pte_to_swp_entry(_pte)        ((swp_entry_t) { (_pte).pte })
 #define __swp_entry_to_pte(x)           ((pte_t) { (x).val })
 static inline int pte_file(pte_t pte)
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 2aa283ab062b..1b16108a5417 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -171,8 +171,6 @@ struct bio {
 #define BIO_RW_FAILFAST_TRANSPORT       8
 #define BIO_RW_FAILFAST_DRIVER          9
-#define BIO_RW_SYNC     (BIO_RW_SYNCIO | BIO_RW_UNPLUG)
 #define bio_rw_flagged(bio, flag)       ((bio)->bi_rw & (1 << (flag)))
 /*
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 25379cba2370..6e915878e88c 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -15,6 +15,7 @@ enum blktrace_cat {
        BLK_TC_WRITE    = 1 << 1,       /* writes */
        BLK_TC_BARRIER  = 1 << 2,       /* barrier */
        BLK_TC_SYNC     = 1 << 3,       /* sync IO */
+        BLK_TC_SYNCIO   = BLK_TC_SYNC,
        BLK_TC_QUEUE    = 1 << 4,       /* queueing/merging */
        BLK_TC_REQUEUE  = 1 << 5,       /* requeueing */
        BLK_TC_ISSUE    = 1 << 6,       /* issue */
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 3e68469c1885..f0413845f20e 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -121,6 +121,7 @@ struct dma_chan_percpu {
 * @local: per-cpu pointer to a struct dma_chan_percpu
 * @client-count: how many clients are using this channel
 * @table_count: number of appearances in the mem-to-mem allocation table
+ * @private: private data for certain client-channel associations
 */
 struct dma_chan {
        struct dma_device *device;
@@ -134,6 +135,7 @@ struct dma_chan {
        struct dma_chan_percpu *local;
        int client_count;
        int table_count;
+        void *private;
 };
 /**
diff --git a/include/linux/firmware-map.h b/include/linux/firmware-map.h
index 6e199c8dfacc..cca686b39123 100644
--- a/include/linux/firmware-map.h
+++ b/include/linux/firmware-map.h
@@ -1,7 +1,7 @@
 /*
 * include/linux/firmware-map.h:
 *  Copyright (C) 2008 SUSE LINUX Products GmbH
- *  by Bernhard Walle <bwalle@suse.de>
+ *  by Bernhard Walle <bernhard.walle@gmx.de>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License v2.0 as published by
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 6022f44043f2..92734c0012e6 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -54,24 +54,30 @@ struct inodes_stat_t {
 #define MAY_ACCESS 16
 #define MAY_OPEN 32
+/*
+ * flags in file.f_mode.  Note that FMODE_READ and FMODE_WRITE must correspond
+ * to O_WRONLY and O_RDWR via the strange trick in __dentry_open()
+ */
 /* file is open for reading */
 #define FMODE_READ              ((__force fmode_t)1)
 /* file is open for writing */
 #define FMODE_WRITE             ((__force fmode_t)2)
 /* file is seekable */
 #define FMODE_LSEEK             ((__force fmode_t)4)
-/* file can be accessed using pread/pwrite */
+/* file can be accessed using pread */
 #define FMODE_PREAD             ((__force fmode_t)8)
-#define FMODE_PWRITE            FMODE_PREAD     /* These go hand in hand */
+/* file can be accessed using pwrite */
+#define FMODE_PWRITE            ((__force fmode_t)16)
 /* File is opened for execution with sys_execve / sys_uselib */
-#define FMODE_EXEC              ((__force fmode_t)16)
+#define FMODE_EXEC              ((__force fmode_t)32)
 /* File is opened with O_NDELAY (only set for block devices) */
-#define FMODE_NDELAY            ((__force fmode_t)32)
+#define FMODE_NDELAY            ((__force fmode_t)64)
 /* File is opened with O_EXCL (only set for block devices) */
-#define FMODE_EXCL              ((__force fmode_t)64)
+#define FMODE_EXCL              ((__force fmode_t)128)
 /* File is opened using open(.., 3, ..) and is writeable only for ioctls
   (specialy hack for floppy.c) */
-#define FMODE_WRITE_IOCTL       ((__force fmode_t)128)
+#define FMODE_WRITE_IOCTL       ((__force fmode_t)256)
 /*
 * Don't update ctime and mtime.
@@ -87,10 +93,10 @@ struct inodes_stat_t {
 #define WRITE 1
 #define READA 2         /* read-ahead  - don't block if no resources */
 #define SWRITE 3        /* for ll_rw_block() - wait for buffer lock */
-#define READ_SYNC       (READ | (1 << BIO_RW_SYNC))
+#define READ_SYNC       (READ | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG))
 #define READ_META       (READ | (1 << BIO_RW_META))
-#define WRITE_SYNC      (WRITE | (1 << BIO_RW_SYNC))
+#define WRITE_SYNC      (WRITE | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG))
-#define SWRITE_SYNC     (SWRITE | (1 << BIO_RW_SYNC))
+#define SWRITE_SYNC     (SWRITE | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG))
 #define WRITE_BARRIER   (WRITE | (1 << BIO_RW_BARRIER))
 #define DISCARD_NOBARRIER (1 << BIO_RW_DISCARD)
 #define DISCARD_BARRIER ((1 << BIO_RW_DISCARD) | (1 << BIO_RW_BARRIER))
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index b28b37eb11c6..4d248b3f1323 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1150,7 +1150,8 @@ extern int	   jbd2_journal_clear_err  (journal_t *);
 extern int         jbd2_journal_bmap(journal_t *, unsigned long, unsigned long long *);
 extern int         jbd2_journal_force_commit(journal_t *);
 extern int         jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *inode);
-extern int         jbd2_journal_begin_ordered_truncate(struct jbd2_inode *inode, loff_t new_size);
+extern int         jbd2_journal_begin_ordered_truncate(journal_t *journal,
+                                struct jbd2_inode *inode, loff_t new_size);
 extern void        jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode);
 extern void        jbd2_journal_release_jbd_inode(journal_t *journal, struct jbd2_inode *jinode);
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index 5715f1907601..0424326f1679 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -58,10 +58,10 @@ struct kvm_irqchip {
        __u32 pad;
        union {
                char dummy[512];  /* reserving space */
-#ifdef CONFIG_X86
+#ifdef __KVM_HAVE_PIT
                struct kvm_pic_state pic;
 #endif
-#if defined(CONFIG_X86) || defined(CONFIG_IA64)
+#ifdef __KVM_HAVE_IOAPIC
                struct kvm_ioapic_state ioapic;
 #endif
        } chip;
@@ -384,16 +384,16 @@ struct kvm_trace_rec {
 #define KVM_CAP_MP_STATE 14
 #define KVM_CAP_COALESCED_MMIO 15
 #define KVM_CAP_SYNC_MMU 16  /* Changes to host mmap are reflected in guest */
-#if defined(CONFIG_X86)||defined(CONFIG_IA64)
+#ifdef __KVM_HAVE_DEVICE_ASSIGNMENT
 #define KVM_CAP_DEVICE_ASSIGNMENT 17
 #endif
 #define KVM_CAP_IOMMU 18
-#if defined(CONFIG_X86)
+#ifdef __KVM_HAVE_MSI
 #define KVM_CAP_DEVICE_MSI 20
 #endif
 /* Bug in KVM_SET_USER_MEMORY_REGION fixed: */
 #define KVM_CAP_DESTROY_MEMORY_REGION_WORKS 21
-#if defined(CONFIG_X86)
+#ifdef __KVM_HAVE_USER_NMI
 #define KVM_CAP_USER_NMI 22
 #endif
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index ec49d0be7f52..bf6f703642fc 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -285,6 +285,7 @@ void kvm_free_physmem(struct kvm *kvm);
 struct  kvm *kvm_arch_create_vm(void);
 void kvm_arch_destroy_vm(struct kvm *kvm);
 void kvm_free_all_assigned_devices(struct kvm *kvm);
+void kvm_arch_sync_events(struct kvm *kvm);
 int kvm_cpu_get_interrupt(struct kvm_vcpu *v);
 int kvm_cpu_has_interrupt(struct kvm_vcpu *v);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7dc04ff5ab89..065cdf8c09fb 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1041,10 +1041,23 @@ extern void free_bootmem_with_active_regions(int nid,
 typedef int (*work_fn_t)(unsigned long, unsigned long, void *);
 extern void work_with_active_regions(int nid, work_fn_t work_fn, void *data);
 extern void sparse_memory_present_with_active_regions(int nid);
-#ifndef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID
-extern int early_pfn_to_nid(unsigned long pfn);
-#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
 #endif /* CONFIG_ARCH_POPULATES_NODE_MAP */
+#if !defined(CONFIG_ARCH_POPULATES_NODE_MAP) && \
+    !defined(CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID)
+static inline int __early_pfn_to_nid(unsigned long pfn)
+{
+        return 0;
+}
+#else
+/* please see mm/page_alloc.c */
+extern int __meminit early_pfn_to_nid(unsigned long pfn);
+#ifdef CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID
+/* there is a per-arch backend function. */
+extern int __meminit __early_pfn_to_nid(unsigned long pfn);
+#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
+#endif
 extern void set_dma_reserve(unsigned long new_dma_reserve);
 extern void memmap_init_zone(unsigned long, int, unsigned long,
                                unsigned long, enum memmap_context);
@@ -1159,6 +1172,7 @@ extern int filemap_fault(struct vm_area_struct *, struct vm_fault *);
 /* mm/page-writeback.c */
 int write_one_page(struct page *page, int wait);
+void task_dirty_inc(struct task_struct *tsk);
 /* readahead.c */
 #define VM_MAX_READAHEAD        128     /* kbytes */
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 09c14e213b63..1aca6cebbb78 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -1071,7 +1071,7 @@ void sparse_init(void);
 #endif /* CONFIG_SPARSEMEM */
 #ifdef CONFIG_NODES_SPAN_OTHER_NODES
-#define early_pfn_in_nid(pfn, nid)      (early_pfn_to_nid(pfn) == (nid))
+bool early_pfn_in_nid(unsigned long pfn, int nid);
 #else
 #define early_pfn_in_nid(pfn, nid)      (1)
 #endif
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 52a9fe08451c..114b8192eab9 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1312,6 +1312,7 @@
 #define PCI_DEVICE_ID_VIA_VT3351        0x0351
 #define PCI_DEVICE_ID_VIA_VT3364        0x0364
 #define PCI_DEVICE_ID_VIA_8371_0        0x0391
+#define PCI_DEVICE_ID_VIA_6415          0x0415
 #define PCI_DEVICE_ID_VIA_8501_0        0x0501
 #define PCI_DEVICE_ID_VIA_82C561        0x0561
 #define PCI_DEVICE_ID_VIA_82C586_1      0x0571
@@ -1444,6 +1445,7 @@
 #define PCI_DEVICE_ID_DIGI_DF_M_E       0x0071
 #define PCI_DEVICE_ID_DIGI_DF_M_IOM2_A  0x0072
 #define PCI_DEVICE_ID_DIGI_DF_M_A       0x0073
+#define PCI_DEVICE_ID_DIGI_NEO_8        0x00B1
 #define PCI_DEVICE_ID_NEO_2DB9          0x00C8
 #define PCI_DEVICE_ID_NEO_2DB9PRI       0x00C9
 #define PCI_DEVICE_ID_NEO_2RJ45         0x00CA
diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index 40ea5058c2ec..f616f31576d7 100644
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -19,6 +19,7 @@ struct seq_file {
        size_t from;
        size_t count;
        loff_t index;
+        loff_t read_pos;
        u64 version;
        struct mutex lock;
        const struct seq_operations *op;
diff --git a/include/linux/timerfd.h b/include/linux/timerfd.h
index 86cb0501d3e2..2d0792983f8c 100644
--- a/include/linux/timerfd.h
+++ b/include/linux/timerfd.h
@@ -11,13 +11,21 @@
 /* For O_CLOEXEC and O_NONBLOCK */
 #include <linux/fcntl.h>
-/* Flags for timerfd_settime.  */
+/*
+ * CAREFUL: Check include/asm-generic/fcntl.h when defining
+ * new flags, since they might collide with O_* ones. We want
+ * to re-use O_* flags that couldn't possibly have a meaning
+ * from eventfd, in order to leave a free define-space for
+ * shared O_* flags.
+ */
 #define TFD_TIMER_ABSTIME (1 << 0)
-/* Flags for timerfd_create.  */
 #define TFD_CLOEXEC O_CLOEXEC
 #define TFD_NONBLOCK O_NONBLOCK
+#define TFD_SHARED_FCNTL_FLAGS (TFD_CLOEXEC | TFD_NONBLOCK)
+/* Flags for timerfd_create.  */
+#define TFD_CREATE_FLAGS TFD_SHARED_FCNTL_FLAGS
+/* Flags for timerfd_settime.  */
+#define TFD_SETTIME_FLAGS TFD_TIMER_ABSTIME
 #endif /* _LINUX_TIMERFD_H */
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 506e7620a986..9c0890c7a06a 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -84,6 +84,10 @@ extern struct vm_struct *get_vm_area_caller(unsigned long size,
                                        unsigned long flags, void *caller);
 extern struct vm_struct *__get_vm_area(unsigned long size, unsigned long flags,
                                        unsigned long start, unsigned long end);
+extern struct vm_struct *__get_vm_area_caller(unsigned long size,
+                                        unsigned long flags,
+                                        unsigned long start, unsigned long end,
+                                        void *caller);
 extern struct vm_struct *get_vm_area_node(unsigned long size,
                                          unsigned long flags, int node,
                                          gfp_t gfp_mask);
diff --git a/kernel/Makefile b/kernel/Makefile
index 170a9213c1b6..e4791b3ba55d 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -51,6 +51,7 @@ obj-$(CONFIG_UID16) += uid16.o
 obj-$(CONFIG_MODULES) += module.o
 obj-$(CONFIG_KALLSYMS) += kallsyms.o
 obj-$(CONFIG_PM) += power/
+obj-$(CONFIG_FREEZER) += power/
 obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o
 obj-$(CONFIG_KEXEC) += kexec.o
 obj-$(CONFIG_BACKTRACE_SELF_TEST) += backtracetest.o
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index e14db9c089b9..9edb5c4b79b4 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1122,8 +1122,8 @@ static void cgroup_kill_sb(struct super_block *sb) {
        mutex_unlock(&cgroup_mutex);
-        kfree(root);
        kill_litter_super(sb);
+        kfree(root);
 }
 static struct file_system_type cgroup_fs_type = {
diff --git a/kernel/futex.c b/kernel/futex.c
index f89d373a9c6d..438701adce23 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1165,6 +1165,7 @@ static int futex_wait(u32 __user *uaddr, int fshared,
                      u32 val, ktime_t *abs_time, u32 bitset, int clockrt)
 {
        struct task_struct *curr = current;
+        struct restart_block *restart;
        DECLARE_WAITQUEUE(wait, curr);
        struct futex_hash_bucket *hb;
        struct futex_q q;
@@ -1216,11 +1217,13 @@ retry:
                if (!ret)
                        goto retry;
-                return ret;
+                goto out;
        }
        ret = -EWOULDBLOCK;
-        if (uval != val)
+        if (unlikely(uval != val)) {
-                goto out_unlock_put_key;
+                queue_unlock(&q, hb);
+                goto out_put_key;
+        }
        /* Only actually queue if *uaddr contained val.  */
        queue_me(&q, hb);
@@ -1284,38 +1287,38 @@ retry:
         */
        /* If we were woken (and unqueued), we succeeded, whatever. */
+        ret = 0;
        if (!unqueue_me(&q))
-                return 0;
+                goto out_put_key;
+        ret = -ETIMEDOUT;
        if (rem)
-                return -ETIMEDOUT;
+                goto out_put_key;
        /*
         * We expect signal_pending(current), but another thread may
         * have handled it for us already.
         */
+        ret = -ERESTARTSYS;
        if (!abs_time)
-                return -ERESTARTSYS;
+                goto out_put_key;
-        else {
-                struct restart_block *restart;
-                restart = &current_thread_info()->restart_block;
-                restart->fn = futex_wait_restart;
-                restart->futex.uaddr = (u32 *)uaddr;
-                restart->futex.val = val;
-                restart->futex.time = abs_time->tv64;
-                restart->futex.bitset = bitset;
-                restart->futex.flags = 0;
-                if (fshared)
-                        restart->futex.flags |= FLAGS_SHARED;
-                if (clockrt)
-                        restart->futex.flags |= FLAGS_CLOCKRT;
-                return -ERESTART_RESTARTBLOCK;
-        }
-out_unlock_put_key:
+        restart = &current_thread_info()->restart_block;
-        queue_unlock(&q, hb);
+        restart->fn = futex_wait_restart;
-        put_futex_key(fshared, &q.key);
+        restart->futex.uaddr = (u32 *)uaddr;
+        restart->futex.val = val;
+        restart->futex.time = abs_time->tv64;
+        restart->futex.bitset = bitset;
+        restart->futex.flags = 0;
+        if (fshared)
+                restart->futex.flags |= FLAGS_SHARED;
+        if (clockrt)
+                restart->futex.flags |= FLAGS_CLOCKRT;
+        ret = -ERESTART_RESTARTBLOCK;
+out_put_key:
+        put_futex_key(fshared, &q.key);
 out:
        return ret;
 }
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 2313a4cc14ea..e976e505648d 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -681,6 +681,33 @@ static void cpu_timer_fire(struct k_itimer *timer)
 }
 /*
+ * Sample a process (thread group) timer for the given group_leader task.
+ * Must be called with tasklist_lock held for reading.
+ */
+static int cpu_timer_sample_group(const clockid_t which_clock,
+                                  struct task_struct *p,
+                                  union cpu_time_count *cpu)
+{
+        struct task_cputime cputime;
+        thread_group_cputimer(p, &cputime);
+        switch (CPUCLOCK_WHICH(which_clock)) {
+        default:
+                return -EINVAL;
+        case CPUCLOCK_PROF:
+                cpu->cpu = cputime_add(cputime.utime, cputime.stime);
+                break;
+        case CPUCLOCK_VIRT:
+                cpu->cpu = cputime.utime;
+                break;
+        case CPUCLOCK_SCHED:
+                cpu->sched = cputime.sum_exec_runtime + task_delta_exec(p);
+                break;
+        }
+        return 0;
+}
+/*
 * Guts of sys_timer_settime for CPU timers.
 * This is called with the timer locked and interrupts disabled.
 * If we return TIMER_RETRY, it's necessary to release the timer's lock
@@ -741,7 +768,7 @@ int posix_cpu_timer_set(struct k_itimer *timer, int flags,
        if (CPUCLOCK_PERTHREAD(timer->it_clock)) {
                cpu_clock_sample(timer->it_clock, p, &val);
        } else {
-                cpu_clock_sample_group(timer->it_clock, p, &val);
+                cpu_timer_sample_group(timer->it_clock, p, &val);
        }
        if (old) {
@@ -889,7 +916,7 @@ void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec *itp)
                        read_unlock(&tasklist_lock);
                        goto dead;
                } else {
-                        cpu_clock_sample_group(timer->it_clock, p, &now);
+                        cpu_timer_sample_group(timer->it_clock, p, &now);
                        clear_dead = (unlikely(p->exit_state) &&
                                      thread_group_empty(p));
                }
@@ -1244,7 +1271,7 @@ void posix_cpu_timer_schedule(struct k_itimer *timer)
                        clear_dead_task(timer, now);
                        goto out_unlock;
                }
-                cpu_clock_sample_group(timer->it_clock, p, &now);
+                cpu_timer_sample_group(timer->it_clock, p, &now);
                bump_cpu_timer(timer, now);
                /* Leave the tasklist_lock locked for the call below.  */
        }
@@ -1409,33 +1436,6 @@ void run_posix_cpu_timers(struct task_struct *tsk)
 }
 /*
- * Sample a process (thread group) timer for the given group_leader task.
- * Must be called with tasklist_lock held for reading.
- */
-static int cpu_timer_sample_group(const clockid_t which_clock,
-                                  struct task_struct *p,
-                                  union cpu_time_count *cpu)
-{
-        struct task_cputime cputime;
-        thread_group_cputimer(p, &cputime);
-        switch (CPUCLOCK_WHICH(which_clock)) {
-        default:
-                return -EINVAL;
-        case CPUCLOCK_PROF:
-                cpu->cpu = cputime_add(cputime.utime, cputime.stime);
-                break;
-        case CPUCLOCK_VIRT:
-                cpu->cpu = cputime.utime;
-                break;
-        case CPUCLOCK_SCHED:
-                cpu->sched = cputime.sum_exec_runtime + task_delta_exec(p);
-                break;
-        }
-        return 0;
-}
-/*
 * Set one of the process-wide special case CPU timers.
 * The tsk->sighand->siglock must be held by the caller.
 * The *newval argument is relative and we update it to be absolute, *oldval
diff --git a/kernel/power/Makefile b/kernel/power/Makefile
index d7a10167a25b..720ea4f781bd 100644
--- a/kernel/power/Makefile
+++ b/kernel/power/Makefile
@@ -3,7 +3,7 @@ ifeq ($(CONFIG_PM_DEBUG),y)
 EXTRA_CFLAGS    +=      -DDEBUG
 endif
-obj-y                           := main.o
+obj-$(CONFIG_PM)                += main.o
 obj-$(CONFIG_PM_SLEEP)          += console.o
 obj-$(CONFIG_FREEZER)           += process.o
 obj-$(CONFIG_HIBERNATION)       += swsusp.o disk.o snapshot.o swap.o user.o
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 6da14358537c..505f319e489c 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -60,6 +60,7 @@ static struct block_device *resume_bdev;
 static int submit(int rw, pgoff_t page_off, struct page *page,
                        struct bio **bio_chain)
 {
+        const int bio_rw = rw | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG);
        struct bio *bio;
        bio = bio_alloc(__GFP_WAIT | __GFP_HIGH, 1);
@@ -80,7 +81,7 @@ static int submit(int rw, pgoff_t page_off, struct page *page,
        bio_get(bio);
        if (bio_chain == NULL) {
-                submit_bio(rw | (1 << BIO_RW_SYNC), bio);
+                submit_bio(bio_rw, bio);
                wait_on_page_locked(page);
                if (rw == READ)
                        bio_set_pages_dirty(bio);
@@ -90,7 +91,7 @@ static int submit(int rw, pgoff_t page_off, struct page *page,
                        get_page(page); /* These pages are freed later */
                bio->bi_private = *bio_chain;
                *bio_chain = bio;
-                submit_bio(rw | (1 << BIO_RW_SYNC), bio);
+                submit_bio(bio_rw, bio);
        }
        return 0;
 }
diff --git a/kernel/sched.c b/kernel/sched.c
index 61245b8d0f16..7d97ff7c4478 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -6939,20 +6939,26 @@ static void free_rootdomain(struct root_domain *rd)
 static void rq_attach_root(struct rq *rq, struct root_domain *rd)
 {
+        struct root_domain *old_rd = NULL;
        unsigned long flags;
        spin_lock_irqsave(&rq->lock, flags);
        if (rq->rd) {
-                struct root_domain *old_rd = rq->rd;
+                old_rd = rq->rd;
                if (cpumask_test_cpu(rq->cpu, old_rd->online))
                        set_rq_offline(rq);
                cpumask_clear_cpu(rq->cpu, old_rd->span);
-                if (atomic_dec_and_test(&old_rd->refcount))
+                /*
-                        free_rootdomain(old_rd);
+                 * If we dont want to free the old_rt yet then
+                 * set old_rd to NULL to skip the freeing later
+                 * in this function:
+                 */
+                if (!atomic_dec_and_test(&old_rd->refcount))
+                        old_rd = NULL;
        }
        atomic_inc(&rd->refcount);
@@ -6963,6 +6969,9 @@ static void rq_attach_root(struct rq *rq, struct root_domain *rd)
                set_rq_online(rq);
        spin_unlock_irqrestore(&rq->lock, flags);
+        if (old_rd)
+                free_rootdomain(old_rd);
 }
 static int __init_refok init_rootdomain(struct root_domain *rd, bool bootmem)
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index e2a4ff6fc3a6..34e707e5ab87 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -52,6 +52,7 @@ config FUNCTION_TRACER
        depends on HAVE_FUNCTION_TRACER
        depends on DEBUG_KERNEL
        select FRAME_POINTER
+        select KALLSYMS
        select TRACING
        select CONTEXT_SWITCH_TRACER
        help
@@ -238,6 +239,7 @@ config STACK_TRACER
        depends on DEBUG_KERNEL
        select FUNCTION_TRACER
        select STACKTRACE
+        select KALLSYMS
        help
          This special tracer records the maximum stack footprint of the
          kernel and displays it in debugfs/tracing/stack_trace.
@@ -302,4 +304,27 @@ config FTRACE_STARTUP_TEST
          functioning properly. It will do tests on all the configured
          tracers of ftrace.
+config MMIOTRACE
+        bool "Memory mapped IO tracing"
+        depends on HAVE_MMIOTRACE_SUPPORT && DEBUG_KERNEL && PCI
+        select TRACING
+        help
+          Mmiotrace traces Memory Mapped I/O access and is meant for
+          debugging and reverse engineering. It is called from the ioremap
+          implementation and works via page faults. Tracing is disabled by
+          default and can be enabled at run-time.
+          See Documentation/tracers/mmiotrace.txt.
+          If you are not helping to develop drivers, say N.
+config MMIOTRACE_TEST
+        tristate "Test module for mmiotrace"
+        depends on MMIOTRACE && m
+        help
+          This is a dumb module for testing mmiotrace. It is very dangerous
+          as it will write garbage to IO memory starting at a given address.
+          However, it should be safe to use on e.g. unused portion of VRAM.
+          Say N, unless you absolutely know what you are doing.
 endmenu
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 9a236ffe2aa4..fdf913dfc7e8 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2033,7 +2033,7 @@ free:
 static int start_graph_tracing(void)
 {
        struct ftrace_ret_stack **ret_stack_list;
-        int ret;
+        int ret, cpu;
        ret_stack_list = kmalloc(FTRACE_RETSTACK_ALLOC_SIZE *
                                sizeof(struct ftrace_ret_stack *),
@@ -2042,6 +2042,10 @@ static int start_graph_tracing(void)
        if (!ret_stack_list)
                return -ENOMEM;
+        /* The cpu_boot init_task->ret_stack will never be freed */
+        for_each_online_cpu(cpu)
+                ftrace_graph_init_task(idle_task(cpu));
        do {
                ret = alloc_retstack_tasklist(ret_stack_list);
        } while (ret == -EAGAIN);
diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
index fffcb069f1dc..80e503ef6136 100644
--- a/kernel/trace/trace_mmiotrace.c
+++ b/kernel/trace/trace_mmiotrace.c
@@ -9,6 +9,7 @@
 #include <linux/kernel.h>
 #include <linux/mmiotrace.h>
 #include <linux/pci.h>
+#include <asm/atomic.h>
 #include "trace.h"
@@ -19,6 +20,7 @@ struct header_iter {
 static struct trace_array *mmio_trace_array;
 static bool overrun_detected;
 static unsigned long prev_overruns;
+static atomic_t dropped_count;
 static void mmio_reset_data(struct trace_array *tr)
 {
@@ -121,11 +123,11 @@ static void mmio_close(struct trace_iterator *iter)
 static unsigned long count_overruns(struct trace_iterator *iter)
 {
-        unsigned long cnt = 0;
+        unsigned long cnt = atomic_xchg(&dropped_count, 0);
        unsigned long over = ring_buffer_overruns(iter->tr->buffer);
        if (over > prev_overruns)
-                cnt = over - prev_overruns;
+                cnt += over - prev_overruns;
        prev_overruns = over;
        return cnt;
 }
@@ -310,8 +312,10 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
        event   = ring_buffer_lock_reserve(tr->buffer, sizeof(*entry),
                                           &irq_flags);
-        if (!event)
+        if (!event) {
+                atomic_inc(&dropped_count);
                return;
+        }
        entry   = ring_buffer_event_data(event);
        tracing_generic_entry_update(&entry->ent, 0, preempt_count());
        entry->ent.type                 = TRACE_MMIO_RW;
@@ -338,8 +342,10 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
        event   = ring_buffer_lock_reserve(tr->buffer, sizeof(*entry),
                                           &irq_flags);
-        if (!event)
+        if (!event) {
+                atomic_inc(&dropped_count);
                return;
+        }
        entry   = ring_buffer_event_data(event);
        tracing_generic_entry_update(&entry->ent, 0, preempt_count());
        entry->ent.type                 = TRACE_MMIO_MAP;
diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
index 88c8eb70f54a..bc8e80a86bca 100644
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -23,10 +23,20 @@ static int trace_test_buffer_cpu(struct trace_array *tr, int cpu)
 {
        struct ring_buffer_event *event;
        struct trace_entry *entry;
+        unsigned int loops = 0;
        while ((event = ring_buffer_consume(tr->buffer, cpu, NULL))) {
                entry = ring_buffer_event_data(event);
+                /*
+                 * The ring buffer is a size of trace_buf_size, if
+                 * we loop more than the size, there's something wrong
+                 * with the ring buffer.
+                 */
+                if (loops++ > trace_buf_size) {
+                        printk(KERN_CONT ".. bad ring buffer ");
+                        goto failed;
+                }
                if (!trace_valid_entry(entry)) {
                        printk(KERN_CONT ".. invalid entry %d ",
                                entry->type);
@@ -57,11 +67,20 @@ static int trace_test_buffer(struct trace_array *tr, unsigned long *count)
        cnt = ring_buffer_entries(tr->buffer);
+        /*
+         * The trace_test_buffer_cpu runs a while loop to consume all data.
+         * If the calling tracer is broken, and is constantly filling
+         * the buffer, this will run forever, and hard lock the box.
+         * We disable the ring buffer while we do this test to prevent
+         * a hard lock up.
+         */
+        tracing_off();
        for_each_possible_cpu(cpu) {
                ret = trace_test_buffer_cpu(tr, cpu);
                if (ret)
                        break;
        }
+        tracing_on();
        __raw_spin_unlock(&ftrace_max_lock);
        local_irq_restore(flags);
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 3c84128596ba..74dc57c74349 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -240,7 +240,7 @@ void bdi_writeout_inc(struct backing_dev_info *bdi)
 }
 EXPORT_SYMBOL_GPL(bdi_writeout_inc);
-static inline void task_dirty_inc(struct task_struct *tsk)
+void task_dirty_inc(struct task_struct *tsk)
 {
        prop_inc_single(&vm_dirties, &tsk->dirties);
 }
@@ -1230,6 +1230,7 @@ int __set_page_dirty_nobuffers(struct page *page)
                                __inc_zone_page_state(page, NR_FILE_DIRTY);
                                __inc_bdi_stat(mapping->backing_dev_info,
                                                BDI_RECLAIMABLE);
+                                task_dirty_inc(current);
                                task_io_account_write(PAGE_CACHE_SIZE);
                        }
                        radix_tree_tag_set(&mapping->page_tree,
@@ -1262,7 +1263,7 @@ EXPORT_SYMBOL(redirty_page_for_writepage);
 * If the mapping doesn't provide a set_page_dirty a_op, then
 * just fall through and assume that it wants buffer_heads.
 */
-static int __set_page_dirty(struct page *page)
+int set_page_dirty(struct page *page)
 {
        struct address_space *mapping = page_mapping(page);
@@ -1280,14 +1281,6 @@ static int __set_page_dirty(struct page *page)
        }
        return 0;
 }
-int set_page_dirty(struct page *page)
-{
-        int ret = __set_page_dirty(page);
-        if (ret)
-                task_dirty_inc(current);
-        return ret;
-}
 EXPORT_SYMBOL(set_page_dirty);
 /*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 5675b3073854..5c44ed49ca93 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2989,7 +2989,7 @@ static int __meminit next_active_region_index_in_nid(int index, int nid)
 * was used and there are no special requirements, this is a convenient
 * alternative
 */
-int __meminit early_pfn_to_nid(unsigned long pfn)
+int __meminit __early_pfn_to_nid(unsigned long pfn)
 {
        int i;
@@ -3000,10 +3000,33 @@ int __meminit early_pfn_to_nid(unsigned long pfn)
                if (start_pfn <= pfn && pfn < end_pfn)
                        return early_node_map[i].nid;
        }
+        /* This is a memory hole */
+        return -1;
+}
+#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
+int __meminit early_pfn_to_nid(unsigned long pfn)
+{
+        int nid;
+        nid = __early_pfn_to_nid(pfn);
+        if (nid >= 0)
+                return nid;
+        /* just returns 0 */
        return 0;
 }
-#endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
+#ifdef CONFIG_NODES_SPAN_OTHER_NODES
+bool __meminit early_pfn_in_nid(unsigned long pfn, int node)
+{
+        int nid;
+        nid = __early_pfn_to_nid(pfn);
+        if (nid >= 0 && nid != node)
+                return false;
+        return true;
+}
+#endif
 /* Basic iterator support to walk early_node_map[] */
 #define for_each_active_range_index_in_nid(i, nid) \
diff --git a/mm/page_io.c b/mm/page_io.c
index dc6ce0afbded..3023c475e041 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -111,7 +111,7 @@ int swap_writepage(struct page *page, struct writeback_control *wbc)
                goto out;
        }
        if (wbc->sync_mode == WB_SYNC_ALL)
-                rw |= (1 << BIO_RW_SYNC);
+                rw |= (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG);
        count_vm_event(PSWPOUT);
        set_page_writeback(page);
        unlock_page(page);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 75f49d312e8c..4dd2636d0b92 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1106,6 +1106,14 @@ struct vm_struct *__get_vm_area(unsigned long size, unsigned long flags,
 }
 EXPORT_SYMBOL_GPL(__get_vm_area);
+struct vm_struct *__get_vm_area_caller(unsigned long size, unsigned long flags,
+                                       unsigned long start, unsigned long end,
+                                       void *caller)
+{
+        return __get_vm_area_node(size, flags, start, end, -1, GFP_KERNEL,
+                                  caller);
+}
 /**
 *      get_vm_area  -  reserve a contiguous kernel virtual area
 *      @size:          size of the area
diff --git a/scripts/bootgraph.pl b/scripts/bootgraph.pl
index b0246307aac4..12caa822a232 100644
--- a/scripts/bootgraph.pl
+++ b/scripts/bootgraph.pl
@@ -51,7 +51,7 @@ my %pidctr;
 while (<>) {
        my $line = $_;
-        if ($line =~ /([0-9\.]+)\] calling  ([a-zA-Z0-9\_]+)\+/) {
+        if ($line =~ /([0-9\.]+)\] calling  ([a-zA-Z0-9\_\.]+)\+/) {
                my $func = $2;
                if ($done == 0) {
                        $start{$func} = $1;
@@ -87,7 +87,7 @@ while (<>) {
                $count = $count + 1;
        }
-        if ($line =~ /([0-9\.]+)\] initcall ([a-zA-Z0-9\_]+)\+.*returned/) {
+        if ($line =~ /([0-9\.]+)\] initcall ([a-zA-Z0-9\_\.]+)\+.*returned/) {
                if ($done == 0) {
                        $end{$2} = $1;
                        $maxtime = $1;
diff --git a/scripts/markup_oops.pl b/scripts/markup_oops.pl
index d40449cafa84..528492bcba5b 100644
--- a/scripts/markup_oops.pl
+++ b/scripts/markup_oops.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl -w
+#!/usr/bin/perl
 use File::Basename;
@@ -29,27 +29,151 @@ my $filename = $vmlinux_name;
 my $target = "0";
 my $function;
 my $module = "";
-my $func_offset;
+my $func_offset = 0;
 my $vmaoffset = 0;
+my %regs;
+sub parse_x86_regs
+{
+        my ($line) = @_;
+        if ($line =~ /EAX: ([0-9a-f]+) EBX: ([0-9a-f]+) ECX: ([0-9a-f]+) EDX: ([0-9a-f]+)/) {
+                $regs{"%eax"} = $1;
+                $regs{"%ebx"} = $2;
+                $regs{"%ecx"} = $3;
+                $regs{"%edx"} = $4;
+        }
+        if ($line =~ /ESI: ([0-9a-f]+) EDI: ([0-9a-f]+) EBP: ([0-9a-f]+) ESP: ([0-9a-f]+)/) {
+                $regs{"%esi"} = $1;
+                $regs{"%edi"} = $2;
+                $regs{"%esp"} = $4;
+        }
+        if ($line =~ /RAX: ([0-9a-f]+) RBX: ([0-9a-f]+) RCX: ([0-9a-f]+)/) {
+                $regs{"%eax"} = $1;
+                $regs{"%ebx"} = $2;
+                $regs{"%ecx"} = $3;
+        }
+        if ($line =~ /RDX: ([0-9a-f]+) RSI: ([0-9a-f]+) RDI: ([0-9a-f]+)/) {
+                $regs{"%edx"} = $1;
+                $regs{"%esi"} = $2;
+                $regs{"%edi"} = $3;
+        }
+        if ($line =~ /RBP: ([0-9a-f]+) R08: ([0-9a-f]+) R09: ([0-9a-f]+)/) {
+                $regs{"%r08"} = $2;
+                $regs{"%r09"} = $3;
+        }
+        if ($line =~ /R10: ([0-9a-f]+) R11: ([0-9a-f]+) R12: ([0-9a-f]+)/) {
+                $regs{"%r10"} = $1;
+                $regs{"%r11"} = $2;
+                $regs{"%r12"} = $3;
+        }
+        if ($line =~ /R13: ([0-9a-f]+) R14: ([0-9a-f]+) R15: ([0-9a-f]+)/) {
+                $regs{"%r13"} = $1;
+                $regs{"%r14"} = $2;
+                $regs{"%r15"} = $3;
+        }
+}
+sub reg_name
+{
+        my ($reg) = @_;
+        $reg =~ s/r(.)x/e\1x/;
+        $reg =~ s/r(.)i/e\1i/;
+        $reg =~ s/r(.)p/e\1p/;
+        return $reg;
+}
+sub process_x86_regs
+{
+        my ($line, $cntr) = @_;
+        my $str = "";
+        if (length($line) < 40) {
+                return ""; # not an asm istruction
+        }
+        # find the arguments to the instruction
+        if ($line =~ /([0-9a-zA-Z\,\%\(\)\-\+]+)$/) {
+                $lastword = $1;
+        } else {
+                return "";
+        }
+        # we need to find the registers that get clobbered,
+        # since their value is no longer relevant for previous
+        # instructions in the stream.
+        $clobber = $lastword;
+        # first, remove all memory operands, they're read only
+        $clobber =~ s/\([a-z0-9\%\,]+\)//g;
+        # then, remove everything before the comma, thats the read part
+        $clobber =~ s/.*\,//g;
+        # if this is the instruction that faulted, we haven't actually done
+        # the write yet... nothing is clobbered.
+        if ($cntr == 0) {
+                $clobber = "";
+        }
+        foreach $reg (keys(%regs)) {
+                my $clobberprime = reg_name($clobber);
+                my $lastwordprime = reg_name($lastword);
+                my $val = $regs{$reg};
+                if ($val =~ /^[0]+$/) {
+                        $val = "0";
+                } else {
+                        $val =~ s/^0*//;
+                }
+                # first check if we're clobbering this register; if we do
+                # we print it with a =>, and then delete its value
+                if ($clobber =~ /$reg/ || $clobberprime =~ /$reg/) {
+                        if (length($val) > 0) {
+                                $str = $str . " $reg => $val ";
+                        }
+                        $regs{$reg} = "";
+                        $val = "";
+                }
+                # now check if we're reading this register
+                if ($lastword =~ /$reg/ || $lastwordprime =~ /$reg/) {
+                        if (length($val) > 0) {
+                                $str = $str . " $reg = $val ";
+                        }
+                }
+        }
+        return $str;
+}
+# parse the oops
 while (<STDIN>) {
        my $line = $_;
        if ($line =~ /EIP: 0060:\[\<([a-z0-9]+)\>\]/) {
                $target = $1;
        }
+        if ($line =~ /RIP: 0010:\[\<([a-z0-9]+)\>\]/) {
+                $target = $1;
+        }
        if ($line =~ /EIP is at ([a-zA-Z0-9\_]+)\+(0x[0-9a-f]+)\/0x[a-f0-9]/) {
                $function = $1;
                $func_offset = $2;
        }
+        if ($line =~ /RIP: 0010:\[\<[0-9a-f]+\>\]  \[\<[0-9a-f]+\>\] ([a-zA-Z0-9\_]+)\+(0x[0-9a-f]+)\/0x[a-f0-9]/) {
+                $function = $1;
+                $func_offset = $2;
+        }
        # check if it's a module
        if ($line =~ /EIP is at ([a-zA-Z0-9\_]+)\+(0x[0-9a-f]+)\/0x[a-f0-9]+\W\[([a-zA-Z0-9\_\-]+)\]/) {
                $module = $3;
        }
+        if ($line =~ /RIP: 0010:\[\<[0-9a-f]+\>\]  \[\<[0-9a-f]+\>\] ([a-zA-Z0-9\_]+)\+(0x[0-9a-f]+)\/0x[a-f0-9]+\W\[([a-zA-Z0-9\_\-]+)\]/) {
+                $module = $3;
+        }
+        parse_x86_regs($line);
 }
 my $decodestart = hex($target) - hex($func_offset);
-my $decodestop = $decodestart + 8192;
+my $decodestop = hex($target) + 8192;
 if ($target eq "0") {
        print "No oops found!\n";
        print "Usage: \n";
@@ -84,6 +208,7 @@ my $counter = 0;
 my $state   = 0;
 my $center  = 0;
 my @lines;
+my @reglines;
 sub InRange {
        my ($address, $target) = @_;
@@ -188,16 +313,36 @@ while ($finish < $counter) {
 my $i;
-my $fulltext = "";
+# start annotating the registers in the asm.
+# this goes from the oopsing point back, so that the annotator
+# can track (opportunistically) which registers got written and
+# whos value no longer is relevant.
+$i = $center;
+while ($i >= $start) {
+        $reglines[$i] = process_x86_regs($lines[$i], $center - $i);
+        $i = $i - 1;
+}
 $i = $start;
 while ($i < $finish) {
+        my $line;
        if ($i == $center) {
-                $fulltext = $fulltext . "*$lines[$i]     <----- faulting instruction\n";
+                $line =  "*$lines[$i] ";
        } else {
-                $fulltext = $fulltext .  " $lines[$i]\n";
+                $line =  " $lines[$i] ";
+        }
+        print $line;
+        if (defined($reglines[$i]) && length($reglines[$i]) > 0) {
+                my $c = 60 - length($line);
+                while ($c > 0) { print " "; $c = $c - 1; };
+                print "| $reglines[$i]";
        }
+        if ($i == $center) {
+                print "<--- faulting instruction";
+        }
+        print "\n";
        $i = $i +1;
 }
-print $fulltext;
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 491b8b1b6abf..4eea60b1693e 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -210,6 +210,7 @@ static void do_usb_table(void *symval, unsigned long size,
 static int do_hid_entry(const char *filename,
                             struct hid_device_id *id, char *alias)
 {
+        id->bus = TO_NATIVE(id->bus);
        id->vendor = TO_NATIVE(id->vendor);
        id->product = TO_NATIVE(id->product);
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index 2500886fb90a..ee448cdc6a2b 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -86,6 +86,14 @@ echo "%endif"
 echo 'cp System.map $RPM_BUILD_ROOT'"/boot/System.map-$KERNELRELEASE"
 echo 'cp .config $RPM_BUILD_ROOT'"/boot/config-$KERNELRELEASE"
+echo "%ifnarch ppc64"
+echo 'cp vmlinux vmlinux.orig'
+echo 'bzip2 -9 vmlinux'
+echo 'mv vmlinux.bz2 $RPM_BUILD_ROOT'"/boot/vmlinux-$KERNELRELEASE.bz2"
+echo 'mv vmlinux.orig vmlinux'
+echo "%endif"
 echo ""
 echo "%clean"
 echo '#echo -rf $RPM_BUILD_ROOT'
diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index f6946cf99ce1..f1c4b35bc324 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -58,14 +58,7 @@ fi
 # Check for svn and a svn repo.
 if rev=`svn info 2>/dev/null | grep '^Last Changed Rev'`; then
        rev=`echo $rev | awk '{print $NF}'`
-        changes=`svn status 2>/dev/null | grep '^[AMD]' | wc -l`
+        printf -- '-svn%s' "$rev"
-        # Are there uncommitted changes?
-        if [ $changes != 0 ]; then
-                printf -- '-svn%s%s' "$rev" -dirty
-        else
-                printf -- '-svn%s' "$rev"
-        fi
        # All done with svn
        exit
diff --git a/scripts/tags.sh b/scripts/tags.sh
index fdbe78bb5e2b..5bd8b1003d44 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -76,7 +76,10 @@ all_sources()
 all_kconfigs()
 {
-        find_sources $ALLSOURCE_ARCHS 'Kconfig*'
+        for arch in $ALLSOURCE_ARCHS; do
+                find_sources $arch 'Kconfig*'
+        done
+        find_other_sources 'Kconfig*'
 }
 all_defconfigs()
@@ -99,7 +102,8 @@ exuberant()
        -I ____cacheline_internodealigned_in_smp                \
        -I EXPORT_SYMBOL,EXPORT_SYMBOL_GPL                      \
        --extra=+f --c-kinds=+px                                \
-        --regex-asm='/^ENTRY\(([^)]*)\).*/\1/'
+        --regex-asm='/^ENTRY\(([^)]*)\).*/\1/'                  \
+        --regex-c='/^SYSCALL_DEFINE[[:digit:]]?\(([^,)]*).*/sys_\1/'
        all_kconfigs | xargs $1 -a                              \
        --langdef=kconfig --language-force=kconfig              \
@@ -117,7 +121,9 @@ exuberant()
 emacs()
 {
-        all_sources | xargs $1 -a
+        all_sources | xargs $1 -a                               \
+        --regex='/^ENTRY(\([^)]*\)).*/\1/'                      \
+        --regex='/^SYSCALL_DEFINE[0-9]?(\([^,)]*\).*/sys_\1/'
        all_kconfigs | xargs $1 -a                              \
        --regex='/^[ \t]*\(\(menu\)*config\)[ \t]+\([a-zA-Z0-9_]+\)/\3/'
diff --git a/sound/core/jack.c b/sound/core/jack.c
index dd4a12dc09aa..077a85262c1c 100644
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -47,7 +47,7 @@ static int snd_jack_dev_register(struct snd_device *device)
        int err;
        snprintf(jack->name, sizeof(jack->name), "%s %s",
-                 card->longname, jack->id);
+                 card->shortname, jack->id);
        jack->input_dev->name = jack->name;
        /* Default to the sound card device. */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 11e791b965f6..c8d9178f47e5 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1947,16 +1947,13 @@ static int azx_suspend(struct pci_dev *pci, pm_message_t state)
        return 0;
 }
-static int azx_resume_early(struct pci_dev *pci)
-{
-        return pci_restore_state(pci);
-}
 static int azx_resume(struct pci_dev *pci)
 {
        struct snd_card *card = pci_get_drvdata(pci);
        struct azx *chip = card->private_data;
+        pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
        if (pci_enable_device(pci) < 0) {
                printk(KERN_ERR "hda-intel: pci_enable_device failed, "
                       "disabling device\n");
@@ -2468,7 +2465,6 @@ static struct pci_driver driver = {
        .remove = __devexit_p(azx_remove),
 #ifdef CONFIG_PM
        .suspend = azx_suspend,
-        .resume_early = azx_resume_early,
        .resume = azx_resume,
 #endif
 };
diff --git a/sound/pci/oxygen/virtuoso.c b/sound/pci/oxygen/virtuoso.c
index 18c7c91786bc..6c870c12a177 100644
--- a/sound/pci/oxygen/virtuoso.c
+++ b/sound/pci/oxygen/virtuoso.c
@@ -26,7 +26,7 @@
 * SPI 0 -> 1st PCM1796 (front)
 * SPI 1 -> 2nd PCM1796 (surround)
 * SPI 2 -> 3rd PCM1796 (center/LFE)
- * SPI 4 -> 4th PCM1796 (back) and EEPROM self-destruct (do not use!)
+ * SPI 4 -> 4th PCM1796 (back)
 *
 * GPIO 2 -> M0 of CS5381
 * GPIO 3 -> M1 of CS5381
@@ -207,12 +207,6 @@ static void xonar_gpio_changed(struct oxygen *chip);
 static inline void pcm1796_write_spi(struct oxygen *chip, unsigned int codec,
                                     u8 reg, u8 value)
 {
-        /*
-         * We don't want to do writes on SPI 4 because the EEPROM, which shares
-         * the same pin, might get confused and broken.  We'd better take care
-         * that the driver works with the default register values ...
-         */
-#if 0
        /* maps ALSA channel pair number to SPI output */
        static const u8 codec_map[4] = {
                0, 1, 2, 4
@@ -223,7 +217,6 @@ static inline void pcm1796_write_spi(struct oxygen *chip, unsigned int codec,
                         (codec_map[codec] << OXYGEN_SPI_CODEC_SHIFT) |
                         OXYGEN_SPI_CEN_LATCH_CLOCK_HI,
                         (reg << 8) | value);
-#endif
 }
 static inline void pcm1796_write_i2c(struct oxygen *chip, unsigned int codec,
@@ -757,9 +750,6 @@ static const DECLARE_TLV_DB_SCALE(cs4362a_db_scale, -12700, 100, 0);
 static int xonar_d2_control_filter(struct snd_kcontrol_new *template)
 {
-        if (!strncmp(template->name, "Master Playback ", 16))
-                /* disable volume/mute because they would require SPI writes */
-                return 1;
        if (!strncmp(template->name, "CD Capture ", 11))
                /* CD in is actually connected to the video in pin */
                template->private_value ^= AC97_CD ^ AC97_VIDEO;
@@ -850,8 +840,9 @@ static const struct oxygen_model model_xonar_d2 = {
        .dac_volume_min = 0x0f,
        .dac_volume_max = 0xff,
        .misc_flags = OXYGEN_MISC_MIDI,
-        .function_flags = OXYGEN_FUNCTION_SPI,
+        .function_flags = OXYGEN_FUNCTION_SPI |
-        .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S,
+                          OXYGEN_FUNCTION_ENABLE_SPI_4_5,
+        .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
        .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
 };
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index 2ab83129d9b0..19e37451c216 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2524,7 +2524,6 @@ static int parse_audio_format_rates(struct snd_usb_audio *chip, struct audioform
                 * build the rate table and bitmap flags
                 */
                int r, idx;
-                unsigned int nonzero_rates = 0;
                fp->rate_table = kmalloc(sizeof(int) * nr_rates, GFP_KERNEL);
                if (fp->rate_table == NULL) {
@@ -2532,24 +2531,27 @@ static int parse_audio_format_rates(struct snd_usb_audio *chip, struct audioform
                        return -1;
                }
-                fp->nr_rates = nr_rates;
+                fp->nr_rates = 0;
-                fp->rate_min = fp->rate_max = combine_triple(&fmt[8]);
+                fp->rate_min = fp->rate_max = 0;
                for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
                        unsigned int rate = combine_triple(&fmt[idx]);
+                        if (!rate)
+                                continue;
                        /* C-Media CM6501 mislabels its 96 kHz altsetting */
                        if (rate == 48000 && nr_rates == 1 &&
-                            chip->usb_id == USB_ID(0x0d8c, 0x0201) &&
+                            (chip->usb_id == USB_ID(0x0d8c, 0x0201) ||
+                             chip->usb_id == USB_ID(0x0d8c, 0x0102)) &&
                            fp->altsetting == 5 && fp->maxpacksize == 392)
                                rate = 96000;
-                        fp->rate_table[r] = rate;
+                        fp->rate_table[fp->nr_rates] = rate;
-                        nonzero_rates |= rate;
+                        if (!fp->rate_min || rate < fp->rate_min)
-                        if (rate < fp->rate_min)
                                fp->rate_min = rate;
-                        else if (rate > fp->rate_max)
+                        if (!fp->rate_max || rate > fp->rate_max)
                                fp->rate_max = rate;
                        fp->rates |= snd_pcm_rate_to_rate_bit(rate);
+                        fp->nr_rates++;
                }
-                if (!nonzero_rates) {
+                if (!fp->nr_rates) {
                        hwc_debug("All rates were zero. Skipping format!\n");
                        return -1;
                }
diff --git a/sound/usb/usbmidi.c b/sound/usb/usbmidi.c
index 320641ab5be7..26bad373fe65 100644
--- a/sound/usb/usbmidi.c
+++ b/sound/usb/usbmidi.c
@@ -1625,6 +1625,7 @@ static int snd_usbmidi_create_endpoints_midiman(struct snd_usb_midi* umidi,
        }
        ep_info.out_ep = get_endpoint(hostif, 2)->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+        ep_info.out_interval = 0;
        ep_info.out_cables = endpoint->out_cables & 0x5555;
        err = snd_usbmidi_out_endpoint_create(umidi, &ep_info, &umidi->endpoints[0]);
        if (err < 0)
diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
index e9693a29d00e..4c4037503600 100644
--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
@@ -73,14 +73,13 @@ static int kvm_iommu_map_memslots(struct kvm *kvm)
 {
        int i, r = 0;
-        down_read(&kvm->slots_lock);
        for (i = 0; i < kvm->nmemslots; i++) {
                r = kvm_iommu_map_pages(kvm, kvm->memslots[i].base_gfn,
                                        kvm->memslots[i].npages);
                if (r)
                        break;
        }
-        up_read(&kvm->slots_lock);
        return r;
 }
@@ -190,12 +189,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
 static int kvm_iommu_unmap_memslots(struct kvm *kvm)
 {
        int i;
-        down_read(&kvm->slots_lock);
        for (i = 0; i < kvm->nmemslots; i++) {
                kvm_iommu_put_pages(kvm, kvm->memslots[i].base_gfn,
                                    kvm->memslots[i].npages);
        }
-        up_read(&kvm->slots_lock);
        return 0;
 }
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 3a5a08298aab..29a667ce35b0 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -173,7 +173,6 @@ static void kvm_assigned_dev_interrupt_work_handler(struct work_struct *work)
                assigned_dev->host_irq_disabled = false;
        }
        mutex_unlock(&assigned_dev->kvm->lock);
-        kvm_put_kvm(assigned_dev->kvm);
 }
 static irqreturn_t kvm_assigned_dev_intr(int irq, void *dev_id)
@@ -181,8 +180,6 @@ static irqreturn_t kvm_assigned_dev_intr(int irq, void *dev_id)
        struct kvm_assigned_dev_kernel *assigned_dev =
                (struct kvm_assigned_dev_kernel *) dev_id;
-        kvm_get_kvm(assigned_dev->kvm);
        schedule_work(&assigned_dev->interrupt_work);
        disable_irq_nosync(irq);
@@ -213,6 +210,7 @@ static void kvm_assigned_dev_ack_irq(struct kvm_irq_ack_notifier *kian)
        }
 }
+/* The function implicit hold kvm->lock mutex due to cancel_work_sync() */
 static void kvm_free_assigned_irq(struct kvm *kvm,
                                  struct kvm_assigned_dev_kernel *assigned_dev)
 {
@@ -228,11 +226,24 @@ static void kvm_free_assigned_irq(struct kvm *kvm,
        if (!assigned_dev->irq_requested_type)
                return;
-        if (cancel_work_sync(&assigned_dev->interrupt_work))
+        /*
-                /* We had pending work. That means we will have to take
+         * In kvm_free_device_irq, cancel_work_sync return true if:
-                 * care of kvm_put_kvm.
+         * 1. work is scheduled, and then cancelled.
-                 */
+         * 2. work callback is executed.
-                kvm_put_kvm(kvm);
+         *
+         * The first one ensured that the irq is disabled and no more events
+         * would happen. But for the second one, the irq may be enabled (e.g.
+         * for MSI). So we disable irq here to prevent further events.
+         *
+         * Notice this maybe result in nested disable if the interrupt type is
+         * INTx, but it's OK for we are going to free it.
+         *
+         * If this function is a part of VM destroy, please ensure that till
+         * now, the kvm state is still legal for probably we also have to wait
+         * interrupt_work done.
+         */
+        disable_irq_nosync(assigned_dev->host_irq);
+        cancel_work_sync(&assigned_dev->interrupt_work);
        free_irq(assigned_dev->host_irq, (void *)assigned_dev);
@@ -285,8 +296,8 @@ static int assigned_device_update_intx(struct kvm *kvm,
        if (irqchip_in_kernel(kvm)) {
                if (!msi2intx &&
-                    adev->irq_requested_type & KVM_ASSIGNED_DEV_HOST_MSI) {
+                    (adev->irq_requested_type & KVM_ASSIGNED_DEV_HOST_MSI)) {
-                        free_irq(adev->host_irq, (void *)kvm);
+                        free_irq(adev->host_irq, (void *)adev);
                        pci_disable_msi(adev->dev);
                }
@@ -455,6 +466,7 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
        struct kvm_assigned_dev_kernel *match;
        struct pci_dev *dev;
+        down_read(&kvm->slots_lock);
        mutex_lock(&kvm->lock);
        match = kvm_find_assigned_dev(&kvm->arch.assigned_dev_head,
@@ -516,6 +528,7 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
 out:
        mutex_unlock(&kvm->lock);
+        up_read(&kvm->slots_lock);
        return r;
 out_list_del:
        list_del(&match->list);
@@ -527,6 +540,7 @@ out_put:
 out_free:
        kfree(match);
        mutex_unlock(&kvm->lock);
+        up_read(&kvm->slots_lock);
        return r;
 }
 #endif
@@ -789,11 +803,19 @@ static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
        return young;
 }
+static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
+                                     struct mm_struct *mm)
+{
+        struct kvm *kvm = mmu_notifier_to_kvm(mn);
+        kvm_arch_flush_shadow(kvm);
+}
 static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
        .invalidate_page        = kvm_mmu_notifier_invalidate_page,
        .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
        .invalidate_range_end   = kvm_mmu_notifier_invalidate_range_end,
        .clear_flush_young      = kvm_mmu_notifier_clear_flush_young,
+        .release                = kvm_mmu_notifier_release,
 };
 #endif /* CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER */
@@ -883,6 +905,7 @@ static void kvm_destroy_vm(struct kvm *kvm)
 {
        struct mm_struct *mm = kvm->mm;
+        kvm_arch_sync_events(kvm);
        spin_lock(&kvm_lock);
        list_del(&kvm->vm_list);
        spin_unlock(&kvm_lock);