172 files changed, 3767 insertions, 769 deletions

diff --git a/.gitignore b/.gitignore
index b93fb7eff942..946c7ec5c922 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@
 *.elf
 *.bin
 *.gz
+*.bz2
 *.lzma
 *.patch
 *.gcno
diff --git a/Documentation/fb/framebuffer.txt b/Documentation/fb/framebuffer.txt
index b3e3a0356839..fe79e3c8847d 100644
--- a/Documentation/fb/framebuffer.txt
+++ b/Documentation/fb/framebuffer.txt
@@ -312,10 +312,8 @@ and to the following documentation:
 8. Mailing list
 ---------------
 
-There are several frame buffer device related mailing lists at SourceForge:
-  - linux-fbdev-announce@lists.sourceforge.net, for announcements,
-  - linux-fbdev-user@lists.sourceforge.net, for generic user support,
-  - linux-fbdev-devel@lists.sourceforge.net, for project developers.
+There is a frame buffer device related mailing list at kernel.org:
+linux-fbdev@vger.kernel.org.
 
 Point your web browser to http://sourceforge.net/projects/linux-fbdev/ for
 subscription information and archive browsing.
diff --git a/Documentation/filesystems/caching/fscache.txt b/Documentation/filesystems/caching/fscache.txt
index 9e94b9491d89..a91e2e2095b0 100644
--- a/Documentation/filesystems/caching/fscache.txt
+++ b/Documentation/filesystems/caching/fscache.txt
@@ -235,6 +235,7 @@ proc files.
                 neg=N   Number of negative lookups made
                 pos=N   Number of positive lookups made
                 crt=N   Number of objects created by lookup
+                tmo=N   Number of lookups timed out and requeued
         Updates n=N     Number of update cookie requests seen
                 nul=N   Number of upd reqs given a NULL parent
                 run=N   Number of upd reqs granted CPU time
@@ -250,8 +251,10 @@ proc files.
                 ok=N    Number of successful alloc reqs
                 wt=N    Number of alloc reqs that waited on lookup completion
                 nbf=N   Number of alloc reqs rejected -ENOBUFS
+                int=N   Number of alloc reqs aborted -ERESTARTSYS
                 ops=N   Number of alloc reqs submitted
                 owt=N   Number of alloc reqs waited for CPU time
+                abt=N   Number of alloc reqs aborted due to object death
         Retrvls n=N     Number of retrieval (read) requests seen
                 ok=N    Number of successful retr reqs
                 wt=N    Number of retr reqs that waited on lookup completion
@@ -261,6 +264,7 @@ proc files.
                 oom=N   Number of retr reqs failed -ENOMEM
                 ops=N   Number of retr reqs submitted
                 owt=N   Number of retr reqs waited for CPU time
+                abt=N   Number of retr reqs aborted due to object death
         Stores  n=N     Number of storage (write) requests seen
                 ok=N    Number of successful store reqs
                 agn=N   Number of store reqs on a page already pending storage
@@ -268,12 +272,37 @@ proc files.
                 oom=N   Number of store reqs failed -ENOMEM
                 ops=N   Number of store reqs submitted
                 run=N   Number of store reqs granted CPU time
+                pgs=N   Number of pages given store req processing time
+                rxd=N   Number of store reqs deleted from tracking tree
+                olm=N   Number of store reqs over store limit
+        VmScan  nos=N   Number of release reqs against pages with no pending store
+                gon=N   Number of release reqs against pages stored by time lock granted
+                bsy=N   Number of release reqs ignored due to in-progress store
+                can=N   Number of page stores cancelled due to release req
         Ops     pend=N  Number of times async ops added to pending queues
                 run=N   Number of times async ops given CPU time
                 enq=N   Number of times async ops queued for processing
+                can=N   Number of async ops cancelled
+                rej=N   Number of async ops rejected due to object lookup/create failure
                 dfr=N   Number of async ops queued for deferred release
                 rel=N   Number of async ops released
                 gc=N    Number of deferred-release async ops garbage collected
+        CacheOp alo=N   Number of in-progress alloc_object() cache ops
+                luo=N   Number of in-progress lookup_object() cache ops
+                luc=N   Number of in-progress lookup_complete() cache ops
+                gro=N   Number of in-progress grab_object() cache ops
+                upo=N   Number of in-progress update_object() cache ops
+                dro=N   Number of in-progress drop_object() cache ops
+                pto=N   Number of in-progress put_object() cache ops
+                syn=N   Number of in-progress sync_cache() cache ops
+                atc=N   Number of in-progress attr_changed() cache ops
+                rap=N   Number of in-progress read_or_alloc_page() cache ops
+                ras=N   Number of in-progress read_or_alloc_pages() cache ops
+                alp=N   Number of in-progress allocate_page() cache ops
+                als=N   Number of in-progress allocate_pages() cache ops
+                wrp=N   Number of in-progress write_page() cache ops
+                ucp=N   Number of in-progress uncache_page() cache ops
+                dsp=N   Number of in-progress dissociate_pages() cache ops
 
 
  (*) /proc/fs/fscache/histogram
@@ -299,6 +328,87 @@ proc files.
      jiffy range covered, and the SECS field the equivalent number of seconds.
 
 
+===========
+OBJECT LIST
+===========
+
+If CONFIG_FSCACHE_OBJECT_LIST is enabled, the FS-Cache facility will maintain a
+list of all the objects currently allocated and allow them to be viewed
+through:
+
+        /proc/fs/fscache/objects
+
+This will look something like:
+
+        [root@andromeda ~]# head /proc/fs/fscache/objects
+        OBJECT   PARENT   STAT CHLDN OPS OOP IPR EX READS EM EV F S | NETFS_COOKIE_DEF TY FL NETFS_DATA       OBJECT_KEY, AUX_DATA
+        ======== ======== ==== ===== === === === == ===== == == = = | ================ == == ================ ================
+           17e4b        2 ACTV     0   0   0   0  0     0 7b  4 0 8 | NFS.fh           DT  0 ffff88001dd82820 010006017edcf8bbc93b43298fdfbe71e50b57b13a172c0117f38472, e567634700000000000000000000000063f2404a000000000000000000000000c9030000000000000000000063f2404a
+           1693a        2 ACTV     0   0   0   0  0     0 7b  4 0 8 | NFS.fh           DT  0 ffff88002db23380 010006017edcf8bbc93b43298fdfbe71e50b57b1e0162c01a2df0ea6, 420ebc4a000000000000000000000000420ebc4a0000000000000000000000000e1801000000000000000000420ebc4a
+
+where the first set of columns before the '|' describe the object:
+
+        COLUMN  DESCRIPTION
+        ======= ===============================================================
+        OBJECT  Object debugging ID (appears as OBJ%x in some debug messages)
+        PARENT  Debugging ID of parent object
+        STAT    Object state
+        CHLDN   Number of child objects of this object
+        OPS     Number of outstanding operations on this object
+        OOP     Number of outstanding child object management operations
+        IPR
+        EX      Number of outstanding exclusive operations
+        READS   Number of outstanding read operations
+        EM      Object's event mask
+        EV      Events raised on this object
+        F       Object flags
+        S       Object slow-work work item flags
+
+and the second set of columns describe the object's cookie, if present:
+
+        COLUMN          DESCRIPTION
+        =============== =======================================================
+        NETFS_COOKIE_DEF Name of netfs cookie definition
+        TY              Cookie type (IX - index, DT - data, hex - special)
+        FL              Cookie flags
+        NETFS_DATA      Netfs private data stored in the cookie
+        OBJECT_KEY      Object key      } 1 column, with separating comma
+        AUX_DATA        Object aux data } presence may be configured
+
+The data shown may be filtered by attaching the a key to an appropriate keyring
+before viewing the file.  Something like:
+
+                keyctl add user fscache:objlist <restrictions> @s
+
+where <restrictions> are a selection of the following letters:
+
+        K       Show hexdump of object key (don't show if not given)
+        A       Show hexdump of object aux data (don't show if not given)
+
+and the following paired letters:
+
+        C       Show objects that have a cookie
+        c       Show objects that don't have a cookie
+        B       Show objects that are busy
+        b       Show objects that aren't busy
+        W       Show objects that have pending writes
+        w       Show objects that don't have pending writes
+        R       Show objects that have outstanding reads
+        r       Show objects that don't have outstanding reads
+        S       Show objects that have slow work queued
+        s       Show objects that don't have slow work queued
+
+If neither side of a letter pair is given, then both are implied.  For example:
+
+        keyctl add user fscache:objlist KB @s
+
+shows objects that are busy, and lists their object keys, but does not dump
+their auxiliary data.  It also implies "CcWwRrSs", but as 'B' is given, 'b' is
+not implied.
+
+By default all objects and all fields will be shown.
+
+
 =========
 DEBUGGING
 =========
diff --git a/Documentation/filesystems/caching/netfs-api.txt b/Documentation/filesystems/caching/netfs-api.txt
index 2666b1ed5e9e..1902c57b72ef 100644
--- a/Documentation/filesystems/caching/netfs-api.txt
+++ b/Documentation/filesystems/caching/netfs-api.txt
@@ -641,7 +641,7 @@ data file must be retired (see the relinquish cookie function below).
 
 Furthermore, note that this does not cancel the asynchronous read or write
 operation started by the read/alloc and write functions, so the page
-invalidation and release functions must use:
+invalidation functions must use:
 
         bool fscache_check_page_write(struct fscache_cookie *cookie,
                                       struct page *page);
@@ -654,6 +654,25 @@ to see if a page is being written to the cache, and:
 to wait for it to finish if it is.
 
 
+When releasepage() is being implemented, a special FS-Cache function exists to
+manage the heuristics of coping with vmscan trying to eject pages, which may
+conflict with the cache trying to write pages to the cache (which may itself
+need to allocate memory):
+
+        bool fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                        struct page *page,
+                                        gfp_t gfp);
+
+This takes the netfs cookie, and the page and gfp arguments as supplied to
+releasepage().  It will return false if the page cannot be released yet for
+some reason and if it returns true, the page has been uncached and can now be
+released.
+
+To make a page available for release, this function may wait for an outstanding
+storage request to complete, or it may attempt to cancel the storage request -
+in which case the page will not be stored in the cache this time.
+
+
 ==========================
 INDEX AND DATA FILE UPDATE
 ==========================
diff --git a/Documentation/filesystems/ocfs2.txt b/Documentation/filesystems/ocfs2.txt
index c2a0871280a0..c58b9f5ba002 100644
--- a/Documentation/filesystems/ocfs2.txt
+++ b/Documentation/filesystems/ocfs2.txt
@@ -20,15 +20,16 @@ Lots of code taken from ext3 and other projects.
 Authors in alphabetical order:
 Joel Becker   <joel.becker@oracle.com>
 Zach Brown    <zach.brown@oracle.com>
-Mark Fasheh   <mark.fasheh@oracle.com>
+Mark Fasheh   <mfasheh@suse.com>
 Kurt Hackel   <kurt.hackel@oracle.com>
+Tao Ma        <tao.ma@oracle.com>
 Sunil Mushran <sunil.mushran@oracle.com>
 Manish Singh  <manish.singh@oracle.com>
+Tiger Yang    <tiger.yang@oracle.com>
 
 Caveats
 =======
 Features which OCFS2 does not support yet:
-        - quotas
         - Directory change notification (F_NOTIFY)
         - Distributed Caching (F_SETLEASE/F_GETLEASE/break_lease)
 
@@ -70,7 +71,6 @@ commit=nrsec	(*)	Ocfs2 can be told to sync all its data and metadata
                         performance.
 localalloc=8(*)         Allows custom localalloc size in MB. If the value is too
                         large, the fs will silently revert it to the default.
-                        Localalloc is not enabled for local mounts.
 localflocks             This disables cluster aware flock.
 inode64                 Indicates that Ocfs2 is allowed to create inodes at
                         any location in the filesystem, including those which
diff --git a/Documentation/slow-work.txt b/Documentation/slow-work.txt
index ebc50f808ea4..52bc31433723 100644
--- a/Documentation/slow-work.txt
+++ b/Documentation/slow-work.txt
@@ -41,6 +41,13 @@ expand files, provided the time taken to do so isn't too long.
 Operations of both types may sleep during execution, thus tying up the thread
 loaned to it.
 
+A further class of work item is available, based on the slow work item class:
+
+ (*) Delayed slow work items.
+
+These are slow work items that have a timer to defer queueing of the item for
+a while.
+
 
 THREAD-TO-CLASS ALLOCATION
 --------------------------
@@ -64,9 +71,11 @@ USING SLOW WORK ITEMS
 Firstly, a module or subsystem wanting to make use of slow work items must
 register its interest:
 
-         int ret = slow_work_register_user();
+         int ret = slow_work_register_user(struct module *module);
 
-This will return 0 if successful, or a -ve error upon failure.
+This will return 0 if successful, or a -ve error upon failure.  The module
+pointer should be the module interested in using this facility (almost
+certainly THIS_MODULE).
 
 
 Slow work items may then be set up by:
@@ -93,6 +102,10 @@ Slow work items may then be set up by:
 
      or:
 
+        delayed_slow_work_init(&myitem, &myitem_ops);
+
+     or:
+
         vslow_work_init(&myitem, &myitem_ops);
 
      depending on its class.
@@ -102,15 +115,92 @@ A suitably set up work item can then be enqueued for processing:
         int ret = slow_work_enqueue(&myitem);
 
 This will return a -ve error if the thread pool is unable to gain a reference
-on the item, 0 otherwise.
+on the item, 0 otherwise, or (for delayed work):
+
+        int ret = delayed_slow_work_enqueue(&myitem, my_jiffy_delay);
 
 
 The items are reference counted, so there ought to be no need for a flush
-operation.  When all a module's slow work items have been processed, and the
+operation.  But as the reference counting is optional, means to cancel
+existing work items are also included:
+
+        cancel_slow_work(&myitem);
+        cancel_delayed_slow_work(&myitem);
+
+can be used to cancel pending work.  The above cancel function waits for
+existing work to have been executed (or prevent execution of them, depending
+on timing).
+
+
+When all a module's slow work items have been processed, and the
 module has no further interest in the facility, it should unregister its
 interest:
 
-        slow_work_unregister_user();
+        slow_work_unregister_user(struct module *module);
+
+The module pointer is used to wait for all outstanding work items for that
+module before completing the unregistration.  This prevents the put_ref() code
+from being taken away before it completes.  module should almost certainly be
+THIS_MODULE.
+
+
+================
+HELPER FUNCTIONS
+================
+
+The slow-work facility provides a function by which it can be determined
+whether or not an item is queued for later execution:
+
+        bool queued = slow_work_is_queued(struct slow_work *work);
+
+If it returns false, then the item is not on the queue (it may be executing
+with a requeue pending).  This can be used to work out whether an item on which
+another depends is on the queue, thus allowing a dependent item to be queued
+after it.
+
+If the above shows an item on which another depends not to be queued, then the
+owner of the dependent item might need to wait.  However, to avoid locking up
+the threads unnecessarily be sleeping in them, it can make sense under some
+circumstances to return the work item to the queue, thus deferring it until
+some other items have had a chance to make use of the yielded thread.
+
+To yield a thread and defer an item, the work function should simply enqueue
+the work item again and return.  However, this doesn't work if there's nothing
+actually on the queue, as the thread just vacated will jump straight back into
+the item's work function, thus busy waiting on a CPU.
+
+Instead, the item should use the thread to wait for the dependency to go away,
+but rather than using schedule() or schedule_timeout() to sleep, it should use
+the following function:
+
+        bool requeue = slow_work_sleep_till_thread_needed(
+                        struct slow_work *work,
+                        signed long *_timeout);
+
+This will add a second wait and then sleep, such that it will be woken up if
+either something appears on the queue that could usefully make use of the
+thread - and behind which this item can be queued, or if the event the caller
+set up to wait for happens.  True will be returned if something else appeared
+on the queue and this work function should perhaps return, of false if
+something else woke it up.  The timeout is as for schedule_timeout().
+
+For example:
+
+        wq = bit_waitqueue(&my_flags, MY_BIT);
+        init_wait(&wait);
+        requeue = false;
+        do {
+                prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
+                if (!test_bit(MY_BIT, &my_flags))
+                        break;
+                requeue = slow_work_sleep_till_thread_needed(&my_work,
+                                                             &timeout);
+        } while (timeout > 0 && !requeue);
+        finish_wait(wq, &wait);
+        if (!test_bit(MY_BIT, &my_flags)
+                goto do_my_thing;
+        if (requeue)
+                return; // to slow_work
 
 
 ===============
@@ -118,7 +208,8 @@ ITEM OPERATIONS
 ===============
 
 Each work item requires a table of operations of type struct slow_work_ops.
-All members are required:
+Only ->execute() is required; the getting and putting of a reference and the
+describing of an item are all optional.
 
  (*) Get a reference on an item:
 
@@ -148,6 +239,16 @@ All members are required:
      This should perform the work required of the item.  It may sleep, it may
      perform disk I/O and it may wait for locks.
 
+ (*) View an item through /proc:
+
+        void (*desc)(struct slow_work *work, struct seq_file *m);
+
+     If supplied, this should print to 'm' a small string describing the work
+     the item is to do.  This should be no more than about 40 characters, and
+     shouldn't include a newline character.
+
+     See the 'Viewing executing and queued items' section below.
+
 
 ==================
 POOL CONFIGURATION
@@ -172,3 +273,50 @@ The slow-work thread pool has a number of configurables:
      is bounded to between 1 and one fewer than the number of active threads.
      This ensures there is always at least one thread that can process very
      slow work items, and always at least one thread that won't.
+
+
+==================================
+VIEWING EXECUTING AND QUEUED ITEMS
+==================================
+
+If CONFIG_SLOW_WORK_PROC is enabled, a proc file is made available:
+
+        /proc/slow_work_rq
+
+through which the list of work items being executed and the queues of items to
+be executed may be viewed.  The owner of a work item is given the chance to
+add some information of its own.
+
+The contents look something like the following:
+
+    THR PID   ITEM ADDR        FL MARK  DESC
+    === ===== ================ == ===== ==========
+      0  3005 ffff880023f52348  a 952ms FSC: OBJ17d3: LOOK
+      1  3006 ffff880024e33668  2 160ms FSC: OBJ17e5 OP60d3b: Write1/Store fl=2
+      2  3165 ffff8800296dd180  a 424ms FSC: OBJ17e4: LOOK
+      3  4089 ffff8800262c8d78  a 212ms FSC: OBJ17ea: CRTN
+      4  4090 ffff88002792bed8  2 388ms FSC: OBJ17e8 OP60d36: Write1/Store fl=2
+      5  4092 ffff88002a0ef308  2 388ms FSC: OBJ17e7 OP60d2e: Write1/Store fl=2
+      6  4094 ffff88002abaf4b8  2 132ms FSC: OBJ17e2 OP60d4e: Write1/Store fl=2
+      7  4095 ffff88002bb188e0  a 388ms FSC: OBJ17e9: CRTN
+    vsq     - ffff880023d99668  1 308ms FSC: OBJ17e0 OP60f91: Write1/EnQ fl=2
+    vsq     - ffff8800295d1740  1 212ms FSC: OBJ16be OP4d4b6: Write1/EnQ fl=2
+    vsq     - ffff880025ba3308  1 160ms FSC: OBJ179a OP58dec: Write1/EnQ fl=2
+    vsq     - ffff880024ec83e0  1 160ms FSC: OBJ17ae OP599f2: Write1/EnQ fl=2
+    vsq     - ffff880026618e00  1 160ms FSC: OBJ17e6 OP60d33: Write1/EnQ fl=2
+    vsq     - ffff880025a2a4b8  1 132ms FSC: OBJ16a2 OP4d583: Write1/EnQ fl=2
+    vsq     - ffff880023cbe6d8  9 212ms FSC: OBJ17eb: LOOK
+    vsq     - ffff880024d37590  9 212ms FSC: OBJ17ec: LOOK
+    vsq     - ffff880027746cb0  9 212ms FSC: OBJ17ed: LOOK
+    vsq     - ffff880024d37ae8  9 212ms FSC: OBJ17ee: LOOK
+    vsq     - ffff880024d37cb0  9 212ms FSC: OBJ17ef: LOOK
+    vsq     - ffff880025036550  9 212ms FSC: OBJ17f0: LOOK
+    vsq     - ffff8800250368e0  9 212ms FSC: OBJ17f1: LOOK
+    vsq     - ffff880025036aa8  9 212ms FSC: OBJ17f2: LOOK
+
+In the 'THR' column, executing items show the thread they're occupying and
+queued threads indicate which queue they're on.  'PID' shows the process ID of
+a slow-work thread that's executing something.  'FL' shows the work item flags.
+'MARK' indicates how long since an item was queued or began executing.  Lastly,
+the 'DESC' column permits the owner of an item to give some information.
+
diff --git a/MAINTAINERS b/MAINTAINERS
index c824b4d62754..16129e67678a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -512,10 +512,32 @@ W:	http://www.arm.linux.org.uk/
 S:      Maintained
 F:      arch/arm/
 
+ARM PRIMECELL AACI PL041 DRIVER
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      sound/arm/aaci.*
+
+ARM PRIMECELL CLCD PL110 DRIVER
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      drivers/video/amba-clcd.*
+
+ARM PRIMECELL KMI PL050 DRIVER
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      drivers/input/serio/ambakmi.*
+F:      include/linux/amba/kmi.h
+
 ARM PRIMECELL MMCI PL180/1 DRIVER
 S:      Orphan
 F:      drivers/mmc/host/mmci.*
 
+ARM PRIMECELL BUS SUPPORT
+M:      Russell King <linux@arm.linux.org.uk>
+S:      Maintained
+F:      drivers/amba/
+F:      include/linux/amba/bus.h
+
 ARM/ADI ROADRUNNER MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1027,7 +1049,7 @@ F:	drivers/serial/atmel_serial.c
 
 ATMEL LCDFB DRIVER
 M:      Nicolas Ferre <nicolas.ferre@atmel.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/atmel_lcdfb.c
 F:      include/video/atmel_lcdc.h
@@ -2113,7 +2135,7 @@ F:	drivers/net/wan/dlci.c
 F:      drivers/net/wan/sdla.c
 
 FRAMEBUFFER LAYER
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 W:      http://linux-fbdev.sourceforge.net/
 S:      Orphan
 F:      Documentation/fb/
@@ -2136,7 +2158,7 @@ F:	drivers/i2c/busses/i2c-cpm.c
 
 FREESCALE IMX / MXC FRAMEBUFFER DRIVER
 M:      Sascha Hauer <kernel@pengutronix.de>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/plat-mxc/include/mach/imxfb.h
@@ -2312,6 +2334,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 S:      Maintained
 F:      drivers/media/video/gspca/finepix.c
 
+GSPCA GL860 SUBDRIVER
+M:      Olivier Lorin <o.lorin@laposte.net>
+L:      linux-media@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
+S:      Maintained
+F:      drivers/media/video/gspca/gl860/
+
 GSPCA M5602 SUBDRIVER
 M:      Erik Andren <erik.andren@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -2533,8 +2562,7 @@ S:	Maintained
 F:      Documentation/i2c/
 F:      drivers/i2c/
 F:      include/linux/i2c.h
-F:      include/linux/i2c-dev.h
-F:      include/linux/i2c-id.h
+F:      include/linux/i2c-*.h
 
 I2C-TINY-USB DRIVER
 M:      Till Harbaum <till@harbaum.org>
@@ -2635,7 +2663,7 @@ S:	Supported
 F:      security/integrity/ima/
 
 IMS TWINTURBO FRAMEBUFFER DRIVER
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Orphan
 F:      drivers/video/imsttfb.c
 
@@ -2670,14 +2698,14 @@ F:	drivers/input/
 
 INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
 M:      Sylvain Meyer <sylvain.meyer@worldonline.fr>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/fb/intelfb.txt
 F:      drivers/video/intelfb/
 
 INTEL 810/815 FRAMEBUFFER DRIVER
 M:      Antonino Daplas <adaplas@gmail.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/i810/
 
@@ -3391,7 +3419,7 @@ S:	Supported
 
 MATROX FRAMEBUFFER DRIVER
 M:      Petr Vandrovec <vandrove@vc.cvut.cz>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
@@ -3778,7 +3806,7 @@ F:	fs/ntfs/
 
 NVIDIA (rivafb and nvidiafb) FRAMEBUFFER DRIVER
 M:      Antonino Daplas <adaplas@gmail.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/riva/
 F:      drivers/video/nvidia/
@@ -3813,7 +3841,7 @@ F:	sound/soc/omap/
 
 OMAP FRAMEBUFFER SUPPORT
 M:      Imre Deak <imre.deak@nokia.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      drivers/video/omap/
@@ -4319,14 +4347,14 @@ F:	include/linux/qnxtypes.h
 
 RADEON FRAMEBUFFER DISPLAY DRIVER
 M:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/aty/radeon*
 F:      include/linux/radeonfb.h
 
 RAGE128 FRAMEBUFFER DISPLAY DRIVER
 M:      Paul Mackerras <paulus@samba.org>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/aty/aty128fb.c
 
@@ -4465,7 +4493,7 @@ F:	drivers/net/wireless/rtl818x/rtl8187*
 
 S3 SAVAGE FRAMEBUFFER DRIVER
 M:      Antonino Daplas <adaplas@gmail.com>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/savage/
 
@@ -5628,7 +5656,7 @@ S:	Maintained
 
 UVESAFB DRIVER
 M:      Michal Januszewski <spock@gentoo.org>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 W:      http://dev.gentoo.org/~spock/projects/uvesafb/
 S:      Maintained
 F:      Documentation/fb/uvesafb.txt
@@ -5661,7 +5689,7 @@ F:	drivers/mmc/host/via-sdmmc.c
 VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER
 M:      Joseph Chan <JosephChan@via.com.tw>
 M:      Scott Fang <ScottFang@viatech.com.cn>
-L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/via/
 
diff --git a/Makefile b/Makefile
index aa3e13a7e353..ad8260102f64 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 32
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc8
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
index d16ec97ec9a9..c019949a5189 100644
--- a/arch/arm/include/asm/kmap_types.h
+++ b/arch/arm/include/asm/kmap_types.h
@@ -22,4 +22,10 @@ enum km_type {
         KM_TYPE_NR
 };
 
+#ifdef CONFIG_DEBUG_HIGHMEM
+#define KM_NMI          (-1)
+#define KM_NMI_PTE      (-1)
+#define KM_IRQ_PTE      (-1)
+#endif
+
 #endif
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 2a573d4fea24..e7714f367eb8 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -662,8 +662,12 @@ static void do_signal(struct pt_regs *regs, int syscall)
                                 regs->ARM_sp -= 4;
                                 usp = (u32 __user *)regs->ARM_sp;
 
-                                put_user(regs->ARM_pc, usp);
-                                regs->ARM_pc = KERN_RESTART_CODE;
+                                if (put_user(regs->ARM_pc, usp) == 0) {
+                                        regs->ARM_pc = KERN_RESTART_CODE;
+                                } else {
+                                        regs->ARM_sp += 4;
+                                        force_sigsegv(0, current);
+                                }
 #endif
                         }
                 }
diff --git a/arch/arm/mach-pxa/cpufreq-pxa2xx.c b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
index 983cc8c20081..9e4d9816726a 100644
--- a/arch/arm/mach-pxa/cpufreq-pxa2xx.c
+++ b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
@@ -447,6 +447,7 @@ static __init int pxa_cpufreq_init(struct cpufreq_policy *policy)
                 pxa27x_freq_table[i].frequency = freq;
                 pxa27x_freq_table[i].index = i;
         }
+        pxa27x_freq_table[i].index = i;
         pxa27x_freq_table[i].frequency = CPUFREQ_TABLE_END;
 
         /*
diff --git a/arch/arm/mach-pxa/cpufreq-pxa3xx.c b/arch/arm/mach-pxa/cpufreq-pxa3xx.c
index 67f34a8d8e60..149cdd9aee4d 100644
--- a/arch/arm/mach-pxa/cpufreq-pxa3xx.c
+++ b/arch/arm/mach-pxa/cpufreq-pxa3xx.c
@@ -102,7 +102,7 @@ static int setup_freqs_table(struct cpufreq_policy *policy,
                 table[i].index = i;
                 table[i].frequency = freqs[i].cpufreq_mhz * 1000;
         }
-        table[num].frequency = i;
+        table[num].index = i;
         table[num].frequency = CPUFREQ_TABLE_END;
 
         pxa3xx_freqs = freqs;
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 3da45d051743..d98023f55503 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -802,10 +802,12 @@ static void __init spitz_init(void)
 {
         spitz_ficp_platform_data.gpio_pwdown = SPITZ_GPIO_IR_ON;
 
+#ifdef CONFIG_MACH_BORZOI
         if (machine_is_borzoi()) {
                 sharpsl_nand_platform_data.badblock_pattern = &sharpsl_akita_bbt;
                 sharpsl_nand_platform_data.ecc_layout = &akita_oobinfo;
         }
+#endif
 
         platform_scoop_config = &spitz_pcmcia_config;
 
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 94be7bb6cb9a..07b976da6174 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Fri Sep 18 21:42:00 2009
+# Last update: Wed Nov 25 22:14:58 2009
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -928,7 +928,7 @@ palmt5			MACH_PALMT5		PALMT5			917
 palmtc                  MACH_PALMTC             PALMTC                  918
 omap_apollon            MACH_OMAP_APOLLON       OMAP_APOLLON            919
 mxc30030evb             MACH_MXC30030EVB        MXC30030EVB             920
-rea_2d                  MACH_REA_2D             REA_2D                  921
+rea_cpu2                MACH_REA_2D             REA_2D                  921
 eti3e524                MACH_TI3E524            TI3E524                 922
 ateb9200                MACH_ATEB9200           ATEB9200                923
 auckland                MACH_AUCKLAND           AUCKLAND                924
@@ -2421,3 +2421,118 @@ liberty			MACH_LIBERTY		LIBERTY			2434
 mh355                   MACH_MH355              MH355                   2435
 pc7802                  MACH_PC7802             PC7802                  2436
 gnet_sgc                MACH_GNET_SGC           GNET_SGC                2437
+einstein15              MACH_EINSTEIN15         EINSTEIN15              2438
+cmpd                    MACH_CMPD               CMPD                    2439
+davinci_hase1           MACH_DAVINCI_HASE1      DAVINCI_HASE1           2440
+lgeincitephone          MACH_LGEINCITEPHONE     LGEINCITEPHONE          2441
+ea313x                  MACH_EA313X             EA313X                  2442
+fwbd_39064              MACH_FWBD_39064         FWBD_39064              2443
+fwbd_390128             MACH_FWBD_390128        FWBD_390128             2444
+pelco_moe               MACH_PELCO_MOE          PELCO_MOE               2445
+minimix27               MACH_MINIMIX27          MINIMIX27               2446
+omap3_thunder           MACH_OMAP3_THUNDER      OMAP3_THUNDER           2447
+passionc                MACH_PASSIONC           PASSIONC                2448
+mx27amata               MACH_MX27AMATA          MX27AMATA               2449
+bgat1                   MACH_BGAT1              BGAT1                   2450
+buzz                    MACH_BUZZ               BUZZ                    2451
+mb9g20                  MACH_MB9G20             MB9G20                  2452
+yushan                  MACH_YUSHAN             YUSHAN                  2453
+lizard                  MACH_LIZARD             LIZARD                  2454
+omap3polycom            MACH_OMAP3POLYCOM       OMAP3POLYCOM            2455
+smdkv210                MACH_SMDKV210           SMDKV210                2456
+bravo                   MACH_BRAVO              BRAVO                   2457
+siogentoo1              MACH_SIOGENTOO1         SIOGENTOO1              2458
+siogentoo2              MACH_SIOGENTOO2         SIOGENTOO2              2459
+sm3k                    MACH_SM3K               SM3K                    2460
+acer_tempo_f900         MACH_ACER_TEMPO_F900    ACER_TEMPO_F900         2461
+sst61vc010_dev          MACH_SST61VC010_DEV     SST61VC010_DEV          2462
+glittertind             MACH_GLITTERTIND        GLITTERTIND             2463
+omap_zoom3              MACH_OMAP_ZOOM3         OMAP_ZOOM3              2464
+omap_3630sdp            MACH_OMAP_3630SDP       OMAP_3630SDP            2465
+cybook2440              MACH_CYBOOK2440         CYBOOK2440              2466
+torino_s                MACH_TORINO_S           TORINO_S                2467
+havana                  MACH_HAVANA             HAVANA                  2468
+beaumont_11             MACH_BEAUMONT_11        BEAUMONT_11             2469
+vanguard                MACH_VANGUARD           VANGUARD                2470
+s5pc110_draco           MACH_S5PC110_DRACO      S5PC110_DRACO           2471
+cartesio_two            MACH_CARTESIO_TWO       CARTESIO_TWO            2472
+aster                   MACH_ASTER              ASTER                   2473
+voguesv210              MACH_VOGUESV210         VOGUESV210              2474
+acm500x                 MACH_ACM500X            ACM500X                 2475
+km9260                  MACH_KM9260             KM9260                  2476
+nideflexg1              MACH_NIDEFLEXG1         NIDEFLEXG1              2477
+ctera_plug_io           MACH_CTERA_PLUG_IO      CTERA_PLUG_IO           2478
+smartq7                 MACH_SMARTQ7            SMARTQ7                 2479
+at91sam9g10ek2          MACH_AT91SAM9G10EK2     AT91SAM9G10EK2          2480
+asusp527                MACH_ASUSP527           ASUSP527                2481
+at91sam9g20mpm2         MACH_AT91SAM9G20MPM2    AT91SAM9G20MPM2         2482
+topasa900               MACH_TOPASA900          TOPASA900               2483
+electrum_100            MACH_ELECTRUM_100       ELECTRUM_100            2484
+mx51grb                 MACH_MX51GRB            MX51GRB                 2485
+xea300                  MACH_XEA300             XEA300                  2486
+htcstartrek             MACH_HTCSTARTREK        HTCSTARTREK             2487
+lima                    MACH_LIMA               LIMA                    2488
+csb740                  MACH_CSB740             CSB740                  2489
+usb_s8815               MACH_USB_S8815          USB_S8815               2490
+watson_efm_plugin       MACH_WATSON_EFM_PLUGIN  WATSON_EFM_PLUGIN       2491
+milkyway                MACH_MILKYWAY           MILKYWAY                2492
+g4evm                   MACH_G4EVM              G4EVM                   2493
+picomod6                MACH_PICOMOD6           PICOMOD6                2494
+omapl138_hawkboard      MACH_OMAPL138_HAWKBOARD OMAPL138_HAWKBOARD      2495
+ip6000                  MACH_IP6000             IP6000                  2496
+ip6010                  MACH_IP6010             IP6010                  2497
+utm400                  MACH_UTM400             UTM400                  2498
+omap3_zybex             MACH_OMAP3_ZYBEX        OMAP3_ZYBEX             2499
+wireless_space          MACH_WIRELESS_SPACE     WIRELESS_SPACE          2500
+sx560                   MACH_SX560              SX560                   2501
+ts41x                   MACH_TS41X              TS41X                   2502
+elphel10373             MACH_ELPHEL10373        ELPHEL10373             2503
+rhobot                  MACH_RHOBOT             RHOBOT                  2504
+mx51_refresh            MACH_MX51_REFRESH       MX51_REFRESH            2505
+ls9260                  MACH_LS9260             LS9260                  2506
+shank                   MACH_SHANK              SHANK                   2507
+qsd8x50_st1             MACH_QSD8X50_ST1        QSD8X50_ST1             2508
+at91sam9m10ekes         MACH_AT91SAM9M10EKES    AT91SAM9M10EKES         2509
+hiram                   MACH_HIRAM              HIRAM                   2510
+phy3250                 MACH_PHY3250            PHY3250                 2511
+ea3250                  MACH_EA3250             EA3250                  2512
+fdi3250                 MACH_FDI3250            FDI3250                 2513
+whitestone              MACH_WHITESTONE         WHITESTONE              2514
+at91sam9263nit          MACH_AT91SAM9263NIT     AT91SAM9263NIT          2515
+ccmx51                  MACH_CCMX51             CCMX51                  2516
+ccmx51js                MACH_CCMX51JS           CCMX51JS                2517
+ccwmx51                 MACH_CCWMX51            CCWMX51                 2518
+ccwmx51js               MACH_CCWMX51JS          CCWMX51JS               2519
+mini6410                MACH_MINI6410           MINI6410                2520
+tiny6410                MACH_TINY6410           TINY6410                2521
+nano6410                MACH_NANO6410           NANO6410                2522
+at572d940hfnldb         MACH_AT572D940HFNLDB    AT572D940HFNLDB         2523
+htcleo                  MACH_HTCLEO             HTCLEO                  2524
+avp13                   MACH_AVP13              AVP13                   2525
+xxsvideod               MACH_XXSVIDEOD          XXSVIDEOD               2526
+vpnext                  MACH_VPNEXT             VPNEXT                  2527
+swarco_itc3             MACH_SWARCO_ITC3        SWARCO_ITC3             2528
+tx51                    MACH_TX51               TX51                    2529
+dolby_cat1021           MACH_DOLBY_CAT1021      DOLBY_CAT1021           2530
+mx28evk                 MACH_MX28EVK            MX28EVK                 2531
+phoenix260              MACH_PHOENIX260         PHOENIX260              2532
+uvaca_stork             MACH_UVACA_STORK        UVACA_STORK             2533
+smartq5                 MACH_SMARTQ5            SMARTQ5                 2534
+all3078                 MACH_ALL3078            ALL3078                 2535
+ctera_2bay_ds           MACH_CTERA_2BAY_DS      CTERA_2BAY_DS           2536
+siogentoo3              MACH_SIOGENTOO3         SIOGENTOO3              2537
+epb5000                 MACH_EPB5000            EPB5000                 2538
+hy9263                  MACH_HY9263             HY9263                  2539
+acer_tempo_m900         MACH_ACER_TEMPO_M900    ACER_TEMPO_M900         2540
+acer_tempo_dx650        MACH_ACER_TEMPO_DX900   ACER_TEMPO_DX900        2541
+acer_tempo_x960         MACH_ACER_TEMPO_X960    ACER_TEMPO_X960         2542
+acer_eten_v900          MACH_ACER_ETEN_V900     ACER_ETEN_V900          2543
+acer_eten_x900          MACH_ACER_ETEN_X900     ACER_ETEN_X900          2544
+bonnell                 MACH_BONNELL            BONNELL                 2545
+oht_mx27                MACH_OHT_MX27           OHT_MX27                2546
+htcquartz               MACH_HTCQUARTZ          HTCQUARTZ               2547
+davinci_dm6467tevm      MACH_DAVINCI_DM6467TEVM DAVINCI_DM6467TEVM      2548
+c3ax03                  MACH_C3AX03             C3AX03                  2549
+mxt_td60                MACH_MXT_TD60           MXT_TD60                2550
+esyx                    MACH_ESYX               ESYX                    2551
+bulldog                 MACH_BULLDOG            BULLDOG                 2553
diff --git a/arch/blackfin/kernel/bfin_dma_5xx.c b/arch/blackfin/kernel/bfin_dma_5xx.c
index 1f170216d2f9..3946aff4f414 100644
--- a/arch/blackfin/kernel/bfin_dma_5xx.c
+++ b/arch/blackfin/kernel/bfin_dma_5xx.c
@@ -225,8 +225,13 @@ int blackfin_dma_suspend(void)
 void blackfin_dma_resume(void)
 {
         int i;
-        for (i = 0; i < MAX_DMA_SUSPEND_CHANNELS; ++i)
-                dma_ch[i].regs->peripheral_map = dma_ch[i].saved_peripheral_map;
+
+        for (i = 0; i < MAX_DMA_CHANNELS; ++i) {
+                dma_ch[i].regs->cfg = 0;
+
+                if (i < MAX_DMA_SUSPEND_CHANNELS)
+                        dma_ch[i].regs->peripheral_map = dma_ch[i].saved_peripheral_map;
+        }
 }
 #endif
 
diff --git a/arch/blackfin/kernel/cplb-mpu/cplbinit.c b/arch/blackfin/kernel/cplb-mpu/cplbinit.c
index f7b9cdce8239..b52c1f8c4bc0 100644
--- a/arch/blackfin/kernel/cplb-mpu/cplbinit.c
+++ b/arch/blackfin/kernel/cplb-mpu/cplbinit.c
@@ -38,7 +38,7 @@ void __init generate_cplb_tables_cpu(unsigned int cpu)
 
 #ifdef CONFIG_BFIN_EXTMEM_DCACHEABLE
         d_cache = CPLB_L1_CHBL;
-#ifdef CONFIG_BFIN_EXTMEM_WRITETROUGH
+#ifdef CONFIG_BFIN_EXTMEM_WRITETHROUGH
         d_cache |= CPLB_L1_AOW | CPLB_WT;
 #endif
 #endif
diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 430ae39456e8..5cc7e2e9e415 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -151,7 +151,7 @@ void start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_
         regs->pc = new_ip;
         if (current->mm)
                 regs->p5 = current->mm->start_data;
-#ifdef CONFIG_SMP
+#ifndef CONFIG_SMP
         task_thread_info(current)->l1_task_info.stack_start =
                 (void *)current->mm->context.stack_start;
         task_thread_info(current)->l1_task_info.lowest_sp = (void *)new_sp;
diff --git a/arch/blackfin/kernel/ptrace.c b/arch/blackfin/kernel/ptrace.c
index 0982b5d5af10..56b0ba12175f 100644
--- a/arch/blackfin/kernel/ptrace.c
+++ b/arch/blackfin/kernel/ptrace.c
@@ -315,7 +315,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                         case BFIN_MEM_ACCESS_CORE:
                         case BFIN_MEM_ACCESS_CORE_ONLY:
                                 copied = access_process_vm(child, addr, &data,
-                                                           to_copy, 0);
+                                                           to_copy, 1);
                                 if (copied)
                                         break;
 
diff --git a/arch/blackfin/mach-bf518/include/mach/anomaly.h b/arch/blackfin/mach-bf518/include/mach/anomaly.h
index e9c65390edd1..2829dd0400f1 100644
--- a/arch/blackfin/mach-bf518/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf518/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf518/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -70,6 +74,10 @@
 #define ANOMALY_05000461 (1)
 /* Synchronization Problem at Startup May Cause SPORT Transmit Channels to Misalign */
 #define ANOMALY_05000462 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -133,5 +141,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf527/include/mach/anomaly.h b/arch/blackfin/mach-bf527/include/mach/anomaly.h
index 3f9052687fa8..02040df8ec80 100644
--- a/arch/blackfin/mach-bf527/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf527/include/mach/anomaly.h
@@ -1,14 +1,18 @@
 /*
- * File: include/asm-blackfin/mach-bf527/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
  *  - Revision D, 08/14/2009; ADSP-BF526 Blackfin Processor Anomaly List
- *  - Revision F, 03/03/2009; ADSP-BF527 Blackfin Processor Anomaly List
+ *  - Revision G, 08/25/2009; ADSP-BF527 Blackfin Processor Anomaly List
  */
 
 #ifndef _MACH_ANOMALY_H_
@@ -200,6 +204,10 @@
 #define ANOMALY_05000467 (1)
 /* PLL Latches Incorrect Settings During Reset */
 #define ANOMALY_05000469 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -250,5 +258,7 @@
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000447 (0)
 #define ANOMALY_05000448 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf533/include/mach/anomaly.h b/arch/blackfin/mach-bf533/include/mach/anomaly.h
index cd83db2fb1a1..9b3f7a27714d 100644
--- a/arch/blackfin/mach-bf533/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf533/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf533/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -202,6 +206,10 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* These anomalies have been "phased" out of analog.com anomaly sheets and are
  * here to show running on older silicon just isn't feasible.
@@ -349,5 +357,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf537/include/mach/anomaly.h b/arch/blackfin/mach-bf537/include/mach/anomaly.h
index f091ad2d8ea8..d2c427bc6656 100644
--- a/arch/blackfin/mach-bf537/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf537/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf537/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -156,6 +160,10 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -202,5 +210,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf538/include/mach/anomaly.h b/arch/blackfin/mach-bf538/include/mach/anomaly.h
index 26b76083e14c..d882b7e6f59b 100644
--- a/arch/blackfin/mach-bf538/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf538/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf538/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -128,6 +132,10 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -176,5 +184,7 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
+#define ANOMALY_05000475 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf548/include/mach/anomaly.h b/arch/blackfin/mach-bf548/include/mach/anomaly.h
index 52b116ae522a..7d08c7524498 100644
--- a/arch/blackfin/mach-bf548/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf548/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf548/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -24,6 +28,8 @@
 #define ANOMALY_05000119 (1)
 /* Rx.H Cannot Be Used to Access 16-bit System MMR Registers */
 #define ANOMALY_05000122 (1)
+/* Data Corruption with Cached External Memory and Non-Cached On-Chip L2 Memory */
+#define ANOMALY_05000220 (1)
 /* False Hardware Error from an Access in the Shadow of a Conditional Branch */
 #define ANOMALY_05000245 (1)
 /* Sensitivity To Noise with Slow Input Edge Rates on External SPORT TX and RX Clocks */
@@ -200,6 +206,14 @@
 #define ANOMALY_05000466 (1)
 /* Possible RX data corruption when control & data EP FIFOs are accessed via the core */
 #define ANOMALY_05000467 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* Access to DDR-SDRAM causes system hang under certain PLL/VR settings */
+#define ANOMALY_05000474 (1)
+/* Core Hang With L2/L3 Configured in Writeback Cache Mode */
+#define ANOMALY_05000475 (1)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000099 (0)
@@ -215,7 +229,6 @@
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000202 (0)
 #define ANOMALY_05000215 (0)
-#define ANOMALY_05000220 (0)
 #define ANOMALY_05000227 (0)
 #define ANOMALY_05000230 (0)
 #define ANOMALY_05000231 (0)
diff --git a/arch/blackfin/mach-bf561/atomic.S b/arch/blackfin/mach-bf561/atomic.S
index 0261a5e751b3..f99f174b129f 100644
--- a/arch/blackfin/mach-bf561/atomic.S
+++ b/arch/blackfin/mach-bf561/atomic.S
@@ -19,6 +19,16 @@
         \reg\().h = _corelock;
 .endm
 
+.macro safe_testset addr:req, scratch:req
+#if ANOMALY_05000477
+        cli \scratch;
+        testset (\addr);
+        sti \scratch;
+#else
+        testset (\addr);
+#endif
+.endm
+
 /*
  * r0 = address of atomic data to flush and invalidate (32bit).
  *
@@ -33,7 +43,7 @@ ENTRY(_get_core_lock)
         cli r0;
         coreslot_loadaddr p0;
 .Lretry_corelock:
-        testset (p0);
+        safe_testset p0, r2;
         if cc jump .Ldone_corelock;
         SSYNC(r2);
         jump .Lretry_corelock
@@ -56,7 +66,7 @@ ENTRY(_get_core_lock_noflush)
         cli r0;
         coreslot_loadaddr p0;
 .Lretry_corelock_noflush:
-        testset (p0);
+        safe_testset p0, r2;
         if cc jump .Ldone_corelock_noflush;
         SSYNC(r2);
         jump .Lretry_corelock_noflush
diff --git a/arch/blackfin/mach-bf561/include/mach/anomaly.h b/arch/blackfin/mach-bf561/include/mach/anomaly.h
index 70da495c9665..5ddc981e9937 100644
--- a/arch/blackfin/mach-bf561/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf561/include/mach/anomaly.h
@@ -1,9 +1,13 @@
 /*
- * File: include/asm-blackfin/mach-bf561/anomaly.h
- * Bugs: Enter bugs at http://blackfin.uclinux.org/
+ * DO NOT EDIT THIS FILE
+ * This file is under version control at
+ *   svn://sources.blackfin.uclinux.org/toolchain/trunk/proc-defs/header-frags/
+ * and can be replaced with that version at any time
+ * DO NOT EDIT THIS FILE
  *
- * Copyright (C) 2004-2009 Analog Devices Inc.
- * Licensed under the GPL-2 or later.
+ * Copyright 2004-2009 Analog Devices Inc.
+ * Licensed under the ADI BSD license.
+ *   https://docs.blackfin.uclinux.org/doku.php?id=adi_bsd
  */
 
 /* This file should be up to date with:
@@ -213,7 +217,11 @@
 /* Disabling Peripherals with DMA Running May Cause DMA System Instability */
 #define ANOMALY_05000278 (__SILICON_REVISION__ < 5)
 /* False Hardware Error Exception when ISR Context Is Not Restored */
-#define ANOMALY_05000281 (__SILICON_REVISION__ < 5)
+/* Temporarily walk around for bug 5423 till this issue is confirmed by
+ * official anomaly document. It looks 05000281 still exists on bf561
+ * v0.5.
+ */
+#define ANOMALY_05000281 (__SILICON_REVISION__ <= 5)
 /* System MMR Write Is Stalled Indefinitely when Killed in a Particular Stage */
 #define ANOMALY_05000283 (1)
 /* Reads Will Receive Incorrect Data under Certain Conditions */
@@ -280,6 +288,12 @@
 #define ANOMALY_05000443 (1)
 /* False Hardware Error when RETI Points to Invalid Memory */
 #define ANOMALY_05000461 (1)
+/* Interrupted 32-Bit SPORT Data Register Access Results In Underflow */
+#define ANOMALY_05000473 (1)
+/* Core Hang With L2/L3 Configured in Writeback Cache Mode */
+#define ANOMALY_05000475 (__SILICON_REVISION__ < 4)
+/* TESTSET Instruction Cannot Be Interrupted */
+#define ANOMALY_05000477 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000119 (0)
@@ -304,5 +318,6 @@
 #define ANOMALY_05000450 (0)
 #define ANOMALY_05000465 (0)
 #define ANOMALY_05000467 (0)
+#define ANOMALY_05000474 (0)
 
 #endif
diff --git a/arch/blackfin/mach-common/arch_checks.c b/arch/blackfin/mach-common/arch_checks.c
index 9dbafcdcf479..f2ca211a76a0 100644
--- a/arch/blackfin/mach-common/arch_checks.c
+++ b/arch/blackfin/mach-common/arch_checks.c
@@ -57,3 +57,8 @@
          (!defined(CONFIG_BFIN_EXTMEM_DCACHEABLE) && defined(CONFIG_BFIN_L2_WRITEBACK)))
 # error You are exposing Anomaly 220 in this config, either config L2 as Write Through, or make External Memory WB.
 #endif
+
+#if ANOMALY_05000475 && \
+        (defined(CONFIG_BFIN_EXTMEM_WRITEBACK) || defined(CONFIG_BFIN_L2_WRITEBACK))
+# error "Anomaly 475 does not allow you to use Write Back cache with L2 or External Memory"
+#endif
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index d98585f3237d..d92b168c8328 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -276,10 +276,9 @@ void smp_send_reschedule(int cpu)
         if (cpu_is_offline(cpu))
                 return;
 
-        msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        msg = kzalloc(sizeof(*msg), GFP_ATOMIC);
         if (!msg)
                 return;
-        memset(msg, 0, sizeof(msg));
         INIT_LIST_HEAD(&msg->list);
         msg->type = BFIN_IPI_RESCHEDULE;
 
@@ -305,10 +304,9 @@ void smp_send_stop(void)
         if (cpus_empty(callmap))
                 return;
 
-        msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        msg = kzalloc(sizeof(*msg), GFP_ATOMIC);
         if (!msg)
                 return;
-        memset(msg, 0, sizeof(msg));
         INIT_LIST_HEAD(&msg->list);
         msg->type = BFIN_IPI_CPU_STOP;
 
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 69dad5a850a8..a36799e85693 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -28,7 +28,7 @@
 #define dbg(x...)
 #endif
 
-#define KERNEL_START (KERNEL_BINARY_TEXT_START - 0x1000)
+#define KERNEL_START (KERNEL_BINARY_TEXT_START)
 
 extern struct unwind_table_entry __start___unwind[];
 extern struct unwind_table_entry __stop___unwind[];
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index fda4baa059b5..9dab4a4e09f7 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -78,9 +78,6 @@ SECTIONS
          */
         . = ALIGN(PAGE_SIZE);
         data_start = .;
-        EXCEPTION_TABLE(16)
-
-        NOTES
 
         /* unwind info */
         .PARISC.unwind : {
@@ -89,6 +86,9 @@ SECTIONS
                 __stop___unwind = .;
         }
 
+        EXCEPTION_TABLE(16)
+        NOTES
+
         /* Data */
         RW_DATA_SECTION(L1_CACHE_BYTES, PAGE_SIZE, THREAD_SIZE)
 
diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
index b6bac6f61c16..916369575c97 100644
--- a/arch/powerpc/include/asm/kmap_types.h
+++ b/arch/powerpc/include/asm/kmap_types.h
@@ -29,5 +29,16 @@ enum km_type {
         KM_TYPE_NR
 };
 
+/*
+ * This is a temporary build fix that (so they say on lkml....) should no longer
+ * be required after 2.6.33, because of changes planned to the kmap code.
+ * Let's try to remove this cruft then.
+ */
+#ifdef CONFIG_DEBUG_HIGHMEM
+#define KM_NMI          (-1)
+#define KM_NMI_PTE      (-1)
+#define KM_IRQ_PTE      (-1)
+#endif
+
 #endif  /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_KMAP_TYPES_H */
diff --git a/arch/sparc/mm/init_64.h b/arch/sparc/mm/init_64.h
index c2f772dbd556..77d1b313e344 100644
--- a/arch/sparc/mm/init_64.h
+++ b/arch/sparc/mm/init_64.h
@@ -45,7 +45,7 @@ extern void free_initmem(void);
 #define VMEMMAP_ALIGN(x)        (((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK)
 
 #define VMEMMAP_SIZE    ((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \
-                          sizeof(struct page *)) >> VMEMMAP_CHUNK_SHIFT)
+                          sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT)
 extern unsigned long vmemmap_table[VMEMMAP_SIZE];
 #endif
 
diff --git a/arch/x86/kernel/acpi/processor.c b/arch/x86/kernel/acpi/processor.c
index d296f4a195c9..d85d1b2432ba 100644
--- a/arch/x86/kernel/acpi/processor.c
+++ b/arch/x86/kernel/acpi/processor.c
@@ -79,7 +79,8 @@ void arch_acpi_processor_init_pdc(struct acpi_processor *pr)
         struct cpuinfo_x86 *c = &cpu_data(pr->id);
 
         pr->pdc = NULL;
-        if (c->x86_vendor == X86_VENDOR_INTEL)
+        if (c->x86_vendor == X86_VENDOR_INTEL ||
+            c->x86_vendor == X86_VENDOR_CENTAUR)
                 init_intel_pdc(pr, c);
 
         return;
diff --git a/crypto/async_tx/Kconfig b/crypto/async_tx/Kconfig
index e5aeb2b79e6f..e28e276ac611 100644
--- a/crypto/async_tx/Kconfig
+++ b/crypto/async_tx/Kconfig
@@ -23,3 +23,8 @@ config ASYNC_RAID6_RECOV
         select ASYNC_CORE
         select ASYNC_PQ
 
+config ASYNC_TX_DISABLE_PQ_VAL_DMA
+        bool
+
+config ASYNC_TX_DISABLE_XOR_VAL_DMA
+        bool
diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
index 6b5cc4fba59f..ec87f53d5059 100644
--- a/crypto/async_tx/async_pq.c
+++ b/crypto/async_tx/async_pq.c
@@ -240,6 +240,16 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
 }
 EXPORT_SYMBOL_GPL(async_gen_syndrome);
 
+static inline struct dma_chan *
+pq_val_chan(struct async_submit_ctl *submit, struct page **blocks, int disks, size_t len)
+{
+        #ifdef CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA
+        return NULL;
+        #endif
+        return async_tx_find_channel(submit, DMA_PQ_VAL, NULL, 0,  blocks,
+                                     disks, len);
+}
+
 /**
  * async_syndrome_val - asynchronously validate a raid6 syndrome
  * @blocks: source blocks from idx 0..disks-3, P @ disks-2 and Q @ disks-1
@@ -260,9 +270,7 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
                    size_t len, enum sum_check_flags *pqres, struct page *spare,
                    struct async_submit_ctl *submit)
 {
-        struct dma_chan *chan = async_tx_find_channel(submit, DMA_PQ_VAL,
-                                                      NULL, 0,  blocks, disks,
-                                                      len);
+        struct dma_chan *chan = pq_val_chan(submit, blocks, disks, len);
         struct dma_device *device = chan ? chan->device : NULL;
         struct dma_async_tx_descriptor *tx;
         unsigned char coefs[disks-2];
diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
index 79182dcb91b7..079ae8ca590b 100644
--- a/crypto/async_tx/async_xor.c
+++ b/crypto/async_tx/async_xor.c
@@ -234,6 +234,17 @@ static int page_is_zero(struct page *p, unsigned int offset, size_t len)
                 memcmp(a, a + 4, len - 4) == 0);
 }
 
+static inline struct dma_chan *
+xor_val_chan(struct async_submit_ctl *submit, struct page *dest,
+                 struct page **src_list, int src_cnt, size_t len)
+{
+        #ifdef CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA
+        return NULL;
+        #endif
+        return async_tx_find_channel(submit, DMA_XOR_VAL, &dest, 1, src_list,
+                                     src_cnt, len);
+}
+
 /**
  * async_xor_val - attempt a xor parity check with a dma engine.
  * @dest: destination page used if the xor is performed synchronously
@@ -255,9 +266,7 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset,
               int src_cnt, size_t len, enum sum_check_flags *result,
               struct async_submit_ctl *submit)
 {
-        struct dma_chan *chan = async_tx_find_channel(submit, DMA_XOR_VAL,
-                                                      &dest, 1, src_list,
-                                                      src_cnt, len);
+        struct dma_chan *chan = xor_val_chan(submit, dest, src_list, src_cnt, len);
         struct dma_device *device = chan ? chan->device : NULL;
         struct dma_async_tx_descriptor *tx = NULL;
         dma_addr_t *dma_src = NULL;
diff --git a/crypto/gcm.c b/crypto/gcm.c
index 5fc3292483ef..c6547130624c 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -40,7 +40,7 @@ struct crypto_rfc4106_ctx {
 struct crypto_gcm_ghash_ctx {
         unsigned int cryptlen;
         struct scatterlist *src;
-        crypto_completion_t complete;
+        void (*complete)(struct aead_request *req, int err);
 };
 
 struct crypto_gcm_req_priv_ctx {
@@ -267,23 +267,26 @@ static int gcm_hash_final(struct aead_request *req,
         return crypto_ahash_final(ahreq);
 }
 
-static void gcm_hash_final_done(struct crypto_async_request *areq,
-                                int err)
+static void __gcm_hash_final_done(struct aead_request *req, int err)
 {
-        struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
 
         if (!err)
                 crypto_xor(pctx->auth_tag, pctx->iauth_tag, 16);
 
-        gctx->complete(areq, err);
+        gctx->complete(req, err);
 }
 
-static void gcm_hash_len_done(struct crypto_async_request *areq,
-                              int err)
+static void gcm_hash_final_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_final_done(req, err);
+}
+
+static void __gcm_hash_len_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
 
         if (!err) {
@@ -292,13 +295,18 @@ static void gcm_hash_len_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_final_done(areq, err);
+        __gcm_hash_final_done(req, err);
 }
 
-static void gcm_hash_crypt_remain_done(struct crypto_async_request *areq,
-                                       int err)
+static void gcm_hash_len_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_len_done(req, err);
+}
+
+static void __gcm_hash_crypt_remain_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
 
         if (!err) {
@@ -307,13 +315,19 @@ static void gcm_hash_crypt_remain_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_len_done(areq, err);
+        __gcm_hash_len_done(req, err);
 }
 
-static void gcm_hash_crypt_done(struct crypto_async_request *areq,
-                                int err)
+static void gcm_hash_crypt_remain_done(struct crypto_async_request *areq,
+                                       int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_crypt_remain_done(req, err);
+}
+
+static void __gcm_hash_crypt_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
         unsigned int remain;
@@ -327,13 +341,18 @@ static void gcm_hash_crypt_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_crypt_remain_done(areq, err);
+        __gcm_hash_crypt_remain_done(req, err);
 }
 
-static void gcm_hash_assoc_remain_done(struct crypto_async_request *areq,
-                                           int err)
+static void gcm_hash_crypt_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_crypt_done(req, err);
+}
+
+static void __gcm_hash_assoc_remain_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
         crypto_completion_t complete;
@@ -350,15 +369,21 @@ static void gcm_hash_assoc_remain_done(struct crypto_async_request *areq,
         }
 
         if (remain)
-                gcm_hash_crypt_done(areq, err);
+                __gcm_hash_crypt_done(req, err);
         else
-                gcm_hash_crypt_remain_done(areq, err);
+                __gcm_hash_crypt_remain_done(req, err);
 }
 
-static void gcm_hash_assoc_done(struct crypto_async_request *areq,
-                                int err)
+static void gcm_hash_assoc_remain_done(struct crypto_async_request *areq,
+                                       int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_assoc_remain_done(req, err);
+}
+
+static void __gcm_hash_assoc_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         unsigned int remain;
 
@@ -371,13 +396,18 @@ static void gcm_hash_assoc_done(struct crypto_async_request *areq,
                         return;
         }
 
-        gcm_hash_assoc_remain_done(areq, err);
+        __gcm_hash_assoc_remain_done(req, err);
 }
 
-static void gcm_hash_init_done(struct crypto_async_request *areq,
-                               int err)
+static void gcm_hash_assoc_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
+
+        __gcm_hash_assoc_done(req, err);
+}
+
+static void __gcm_hash_init_done(struct aead_request *req, int err)
+{
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         crypto_completion_t complete;
         unsigned int remain = 0;
@@ -393,9 +423,16 @@ static void gcm_hash_init_done(struct crypto_async_request *areq,
         }
 
         if (remain)
-                gcm_hash_assoc_done(areq, err);
+                __gcm_hash_assoc_done(req, err);
         else
-                gcm_hash_assoc_remain_done(areq, err);
+                __gcm_hash_assoc_remain_done(req, err);
+}
+
+static void gcm_hash_init_done(struct crypto_async_request *areq, int err)
+{
+        struct aead_request *req = areq->data;
+
+        __gcm_hash_init_done(req, err);
 }
 
 static int gcm_hash(struct aead_request *req,
@@ -457,10 +494,8 @@ static void gcm_enc_copy_hash(struct aead_request *req,
                                  crypto_aead_authsize(aead), 1);
 }
 
-static void gcm_enc_hash_done(struct crypto_async_request *areq,
-                                     int err)
+static void gcm_enc_hash_done(struct aead_request *req, int err)
 {
-        struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
 
         if (!err)
@@ -469,8 +504,7 @@ static void gcm_enc_hash_done(struct crypto_async_request *areq,
         aead_request_complete(req, err);
 }
 
-static void gcm_encrypt_done(struct crypto_async_request *areq,
-                                     int err)
+static void gcm_encrypt_done(struct crypto_async_request *areq, int err)
 {
         struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
@@ -479,9 +513,13 @@ static void gcm_encrypt_done(struct crypto_async_request *areq,
                 err = gcm_hash(req, pctx);
                 if (err == -EINPROGRESS || err == -EBUSY)
                         return;
+                else if (!err) {
+                        crypto_xor(pctx->auth_tag, pctx->iauth_tag, 16);
+                        gcm_enc_copy_hash(req, pctx);
+                }
         }
 
-        gcm_enc_hash_done(areq, err);
+        aead_request_complete(req, err);
 }
 
 static int crypto_gcm_encrypt(struct aead_request *req)
@@ -538,9 +576,8 @@ static void gcm_decrypt_done(struct crypto_async_request *areq, int err)
         aead_request_complete(req, err);
 }
 
-static void gcm_dec_hash_done(struct crypto_async_request *areq, int err)
+static void gcm_dec_hash_done(struct aead_request *req, int err)
 {
-        struct aead_request *req = areq->data;
         struct crypto_gcm_req_priv_ctx *pctx = crypto_gcm_reqctx(req);
         struct ablkcipher_request *abreq = &pctx->u.abreq;
         struct crypto_gcm_ghash_ctx *gctx = &pctx->ghash_ctx;
@@ -552,9 +589,11 @@ static void gcm_dec_hash_done(struct crypto_async_request *areq, int err)
                 err = crypto_ablkcipher_decrypt(abreq);
                 if (err == -EINPROGRESS || err == -EBUSY)
                         return;
+                else if (!err)
+                        err = crypto_gcm_verify(req, pctx);
         }
 
-        gcm_decrypt_done(areq, err);
+        aead_request_complete(req, err);
 }
 
 static int crypto_gcm_decrypt(struct aead_request *req)
diff --git a/drivers/acpi/acpica/acpredef.h b/drivers/acpi/acpica/acpredef.h
index cd80d1dd1950..57bdaf6ffab1 100644
--- a/drivers/acpi/acpica/acpredef.h
+++ b/drivers/acpi/acpica/acpredef.h
@@ -203,8 +203,9 @@ static const union acpi_predefined_info predefined_names[] =
         {{"_BCT", 1, ACPI_RTYPE_INTEGER}},
         {{"_BDN", 0, ACPI_RTYPE_INTEGER}},
         {{"_BFS", 1, 0}},
-        {{"_BIF", 0, ACPI_RTYPE_PACKAGE}}, /* Fixed-length (9 Int),(4 Str) */
-                          {{{ACPI_PTYPE1_FIXED, ACPI_RTYPE_INTEGER, 9, ACPI_RTYPE_STRING}, 4,0}},
+        {{"_BIF", 0, ACPI_RTYPE_PACKAGE} }, /* Fixed-length (9 Int),(4 Str/Buf) */
+                          {{{ACPI_PTYPE1_FIXED, ACPI_RTYPE_INTEGER, 9,
+                             ACPI_RTYPE_STRING | ACPI_RTYPE_BUFFER}, 4, 0} },
 
         {{"_BIX", 0, ACPI_RTYPE_PACKAGE}},      /* Fixed-length (16 Int),(4 Str) */
         {{{ACPI_PTYPE1_FIXED, ACPI_RTYPE_INTEGER, 16, ACPI_RTYPE_STRING}, 4,
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index e56b2a7b53db..23e5a0519af5 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -224,6 +224,7 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
          * _OSI(Linux) helps sound
          * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad R61"),
          * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T61"),
+         * T400, T500
          * _OSI(Linux) has Linux specific hooks
          * DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X61"),
          * _OSI(Linux) is a NOP:
@@ -254,6 +255,22 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                      DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X61"),
                 },
         },
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Lenovo ThinkPad T400",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T400"),
+                },
+        },
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Lenovo ThinkPad T500",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 4cc1b8116e76..5f2c379ab7bf 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -430,6 +430,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
         },
         {
         .callback = init_set_sci_en_on_resume,
+        .ident = "Hewlett-Packard Compaq Presario C700 Notebook PC",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario C700 Notebook PC"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
         .ident = "Hewlett-Packard Compaq Presario CQ40 Notebook PC",
         .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index d344db42a002..172b57e6543f 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -707,34 +707,17 @@ static unsigned int sata_fsl_dev_classify(struct ata_port *ap)
         return ata_dev_classify(&tf);
 }
 
-static int sata_fsl_prereset(struct ata_link *link, unsigned long deadline)
-{
-        /* FIXME: Never skip softreset, sata_fsl_softreset() is
-         * combination of soft and hard resets.  sata_fsl_softreset()
-         * needs to be splitted into soft and hard resets.
-         */
-        return 0;
-}
-
-static int sata_fsl_softreset(struct ata_link *link, unsigned int *class,
+static int sata_fsl_hardreset(struct ata_link *link, unsigned int *class,
                                         unsigned long deadline)
 {
         struct ata_port *ap = link->ap;
-        struct sata_fsl_port_priv *pp = ap->private_data;
         struct sata_fsl_host_priv *host_priv = ap->host->private_data;
         void __iomem *hcr_base = host_priv->hcr_base;
-        int pmp = sata_srst_pmp(link);
         u32 temp;
-        struct ata_taskfile tf;
-        u8 *cfis;
-        u32 Serror;
         int i = 0;
         unsigned long start_jiffies;
 
-        DPRINTK("in xx_softreset\n");
-
-        if (pmp != SATA_PMP_CTRL_PORT)
-                goto issue_srst;
+        DPRINTK("in xx_hardreset\n");
 
 try_offline_again:
         /*
@@ -749,7 +732,7 @@ try_offline_again:
 
         if (temp & ONLINE) {
                 ata_port_printk(ap, KERN_ERR,
-                                "Softreset failed, not off-lined %d\n", i);
+                                "Hardreset failed, not off-lined %d\n", i);
 
                 /*
                  * Try to offline controller atleast twice
@@ -761,7 +744,7 @@ try_offline_again:
                         goto try_offline_again;
         }
 
-        DPRINTK("softreset, controller off-lined\n");
+        DPRINTK("hardreset, controller off-lined\n");
         VPRINTK("HStatus = 0x%x\n", ioread32(hcr_base + HSTATUS));
         VPRINTK("HControl = 0x%x\n", ioread32(hcr_base + HCONTROL));
 
@@ -786,11 +769,11 @@ try_offline_again:
 
         if (!(temp & ONLINE)) {
                 ata_port_printk(ap, KERN_ERR,
-                                "Softreset failed, not on-lined\n");
+                                "Hardreset failed, not on-lined\n");
                 goto err;
         }
 
-        DPRINTK("softreset, controller off-lined & on-lined\n");
+        DPRINTK("hardreset, controller off-lined & on-lined\n");
         VPRINTK("HStatus = 0x%x\n", ioread32(hcr_base + HSTATUS));
         VPRINTK("HControl = 0x%x\n", ioread32(hcr_base + HCONTROL));
 
@@ -806,7 +789,7 @@ try_offline_again:
                                 "No Device OR PHYRDY change,Hstatus = 0x%x\n",
                                 ioread32(hcr_base + HSTATUS));
                 *class = ATA_DEV_NONE;
-                goto out;
+                return 0;
         }
 
         /*
@@ -819,11 +802,44 @@ try_offline_again:
         if ((temp & 0xFF) != 0x18) {
                 ata_port_printk(ap, KERN_WARNING, "No Signature Update\n");
                 *class = ATA_DEV_NONE;
-                goto out;
+                goto do_followup_srst;
         } else {
                 ata_port_printk(ap, KERN_INFO,
                                 "Signature Update detected @ %d msecs\n",
                                 jiffies_to_msecs(jiffies - start_jiffies));
+                *class = sata_fsl_dev_classify(ap);
+                return 0;
+        }
+
+do_followup_srst:
+        /*
+         * request libATA to perform follow-up softreset
+         */
+        return -EAGAIN;
+
+err:
+        return -EIO;
+}
+
+static int sata_fsl_softreset(struct ata_link *link, unsigned int *class,
+                                        unsigned long deadline)
+{
+        struct ata_port *ap = link->ap;
+        struct sata_fsl_port_priv *pp = ap->private_data;
+        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
+        void __iomem *hcr_base = host_priv->hcr_base;
+        int pmp = sata_srst_pmp(link);
+        u32 temp;
+        struct ata_taskfile tf;
+        u8 *cfis;
+        u32 Serror;
+
+        DPRINTK("in xx_softreset\n");
+
+        if (ata_link_offline(link)) {
+                DPRINTK("PHY reports no device\n");
+                *class = ATA_DEV_NONE;
+                return 0;
         }
 
         /*
@@ -834,7 +850,6 @@ try_offline_again:
          * reached here, we can send a command to the target device
          */
 
-issue_srst:
         DPRINTK("Sending SRST/device reset\n");
 
         ata_tf_init(link->device, &tf);
@@ -860,6 +875,8 @@ issue_srst:
                 ioread32(CA + hcr_base), ioread32(CC + hcr_base));
 
         iowrite32(0xFFFF, CC + hcr_base);
+        if (pmp != SATA_PMP_CTRL_PORT)
+                iowrite32(pmp, CQPMP + hcr_base);
         iowrite32(1, CQ + hcr_base);
 
         temp = ata_wait_register(CQ + hcr_base, 0x1, 0x1, 1, 5000);
@@ -926,7 +943,6 @@ issue_srst:
                 VPRINTK("cereg = 0x%x\n", ioread32(hcr_base + CE));
         }
 
-out:
         return 0;
 
 err:
@@ -988,18 +1004,6 @@ static void sata_fsl_error_intr(struct ata_port *ap)
                 ehi->err_mask |= AC_ERR_ATA_BUS;
                 ehi->action |= ATA_EH_SOFTRESET;
 
-                /*
-                 * Ignore serror in case of fatal errors as we always want
-                 * to do a soft-reset of the FSL SATA controller. Analyzing
-                 * serror may cause libata to schedule a hard-reset action,
-                 * and hard-reset currently does not do controller
-                 * offline/online, causing command timeouts and leads to an
-                 * un-recoverable state, hence make libATA ignore
-                 * autopsy in case of fatal errors.
-                 */
-
-                ehi->flags |= ATA_EHI_NO_AUTOPSY;
-
                 freeze = 1;
         }
 
@@ -1267,8 +1271,8 @@ static struct ata_port_operations sata_fsl_ops = {
 
         .freeze = sata_fsl_freeze,
         .thaw = sata_fsl_thaw,
-        .prereset = sata_fsl_prereset,
         .softreset = sata_fsl_softreset,
+        .hardreset = sata_fsl_hardreset,
         .pmp_softreset = sata_fsl_softreset,
         .error_handler = sata_fsl_error_handler,
         .post_internal_cmd = sata_fsl_post_internal_cmd,
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index a770498a74ec..846d89e3d122 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -328,11 +328,11 @@ int __pm_runtime_resume(struct device *dev, bool from_wq)
                  * necessary.
                  */
                 parent = dev->parent;
-                spin_unlock_irq(&dev->power.lock);
+                spin_unlock(&dev->power.lock);
 
                 pm_runtime_get_noresume(parent);
 
-                spin_lock_irq(&parent->power.lock);
+                spin_lock(&parent->power.lock);
                 /*
                  * We can resume if the parent's run-time PM is disabled or it
                  * is set to ignore children.
@@ -343,9 +343,9 @@ int __pm_runtime_resume(struct device *dev, bool from_wq)
                         if (parent->power.runtime_status != RPM_ACTIVE)
                                 retval = -EBUSY;
                 }
-                spin_unlock_irq(&parent->power.lock);
+                spin_unlock(&parent->power.lock);
 
-                spin_lock_irq(&dev->power.lock);
+                spin_lock(&dev->power.lock);
                 if (retval)
                         goto out;
                 goto repeat;
@@ -777,7 +777,7 @@ int __pm_runtime_set_status(struct device *dev, unsigned int status)
         }
 
         if (parent) {
-                spin_lock_irq(&parent->power.lock);
+                spin_lock(&parent->power.lock);
 
                 /*
                  * It is invalid to put an active child under a parent that is
@@ -793,7 +793,7 @@ int __pm_runtime_set_status(struct device *dev, unsigned int status)
                                 atomic_inc(&parent->power.child_count);
                 }
 
-                spin_unlock_irq(&parent->power.lock);
+                spin_unlock(&parent->power.lock);
 
                 if (error)
                         goto out;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 6399e5090df4..92b126394fa1 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -482,7 +482,7 @@ static ssize_t host_store_rescan(struct device *dev,
 
         return count;
 }
-DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
+static DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
 
 static ssize_t dev_show_unique_id(struct device *dev,
                                  struct device_attribute *attr,
@@ -512,7 +512,7 @@ static ssize_t dev_show_unique_id(struct device *dev,
                                 sn[8], sn[9], sn[10], sn[11],
                                 sn[12], sn[13], sn[14], sn[15]);
 }
-DEVICE_ATTR(unique_id, S_IRUGO, dev_show_unique_id, NULL);
+static DEVICE_ATTR(unique_id, S_IRUGO, dev_show_unique_id, NULL);
 
 static ssize_t dev_show_vendor(struct device *dev,
                                struct device_attribute *attr,
@@ -536,7 +536,7 @@ static ssize_t dev_show_vendor(struct device *dev,
         else
                 return snprintf(buf, sizeof(vendor) + 1, "%s\n", drv->vendor);
 }
-DEVICE_ATTR(vendor, S_IRUGO, dev_show_vendor, NULL);
+static DEVICE_ATTR(vendor, S_IRUGO, dev_show_vendor, NULL);
 
 static ssize_t dev_show_model(struct device *dev,
                               struct device_attribute *attr,
@@ -560,7 +560,7 @@ static ssize_t dev_show_model(struct device *dev,
         else
                 return snprintf(buf, sizeof(model) + 1, "%s\n", drv->model);
 }
-DEVICE_ATTR(model, S_IRUGO, dev_show_model, NULL);
+static DEVICE_ATTR(model, S_IRUGO, dev_show_model, NULL);
 
 static ssize_t dev_show_rev(struct device *dev,
                             struct device_attribute *attr,
@@ -584,7 +584,7 @@ static ssize_t dev_show_rev(struct device *dev,
         else
                 return snprintf(buf, sizeof(rev) + 1, "%s\n", drv->rev);
 }
-DEVICE_ATTR(rev, S_IRUGO, dev_show_rev, NULL);
+static DEVICE_ATTR(rev, S_IRUGO, dev_show_rev, NULL);
 
 static ssize_t cciss_show_lunid(struct device *dev,
                                 struct device_attribute *attr, char *buf)
@@ -609,7 +609,7 @@ static ssize_t cciss_show_lunid(struct device *dev,
                 lunid[0], lunid[1], lunid[2], lunid[3],
                 lunid[4], lunid[5], lunid[6], lunid[7]);
 }
-DEVICE_ATTR(lunid, S_IRUGO, cciss_show_lunid, NULL);
+static DEVICE_ATTR(lunid, S_IRUGO, cciss_show_lunid, NULL);
 
 static ssize_t cciss_show_raid_level(struct device *dev,
                                      struct device_attribute *attr, char *buf)
@@ -632,7 +632,7 @@ static ssize_t cciss_show_raid_level(struct device *dev,
         return snprintf(buf, strlen(raid_label[raid]) + 7, "RAID %s\n",
                         raid_label[raid]);
 }
-DEVICE_ATTR(raid_level, S_IRUGO, cciss_show_raid_level, NULL);
+static DEVICE_ATTR(raid_level, S_IRUGO, cciss_show_raid_level, NULL);
 
 static ssize_t cciss_show_usage_count(struct device *dev,
                                       struct device_attribute *attr, char *buf)
@@ -651,7 +651,7 @@ static ssize_t cciss_show_usage_count(struct device *dev,
         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
         return snprintf(buf, 20, "%d\n", count);
 }
-DEVICE_ATTR(usage_count, S_IRUGO, cciss_show_usage_count, NULL);
+static DEVICE_ATTR(usage_count, S_IRUGO, cciss_show_usage_count, NULL);
 
 static struct attribute *cciss_host_attrs[] = {
         &dev_attr_rescan.attr,
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 10e1f0390bbb..3cb56a049e24 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -62,6 +62,7 @@
 #define PCI_DEVICE_ID_INTEL_IGDNG_D_IG      0x0042
 #define PCI_DEVICE_ID_INTEL_IGDNG_M_HB      0x0044
 #define PCI_DEVICE_ID_INTEL_IGDNG_MA_HB     0x0062
+#define PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB    0x006a
 #define PCI_DEVICE_ID_INTEL_IGDNG_M_IG      0x0046
 
 /* cover 915 and 945 variants */
@@ -96,7 +97,8 @@
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB)
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB)
 
 extern int agp_memory_reserved;
 
@@ -1358,6 +1360,7 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
         case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
         case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
         case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB:
+        case PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB:
                 *gtt_offset = *gtt_size = MB(2);
                 break;
         default:
@@ -2359,6 +2362,8 @@ static const struct intel_driver_description {
             "IGDNG/M", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_IGDNG_MA_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
             "IGDNG/MA", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
+            "IGDNG/MC2", NULL, &intel_i965_driver },
         { 0, 0, 0, NULL, NULL, NULL }
 };
 
@@ -2560,6 +2565,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
         ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
         ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
+        ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
         { }
 };
 
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 737be953cc58..950837cf9e9c 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1249,7 +1249,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
 
         if (keycode >= NR_KEYS)
                 if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
-                        keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
+                        keysym = U(K(KT_BRL, keycode - KEY_BRL_DOT1 + 1));
                 else
                         return;
         else
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index ed86d3bf249a..6aa10284104a 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -103,8 +103,8 @@ void vt_event_post(unsigned int event, unsigned int old, unsigned int new)
                 ve->event.event = event;
                 /* kernel view is consoles 0..n-1, user space view is
                    console 1..n with 0 meaning current, so we must bias */
-                ve->event.old = old + 1;
-                ve->event.new = new + 1;
+                ve->event.oldev = old + 1;
+                ve->event.newev = new + 1;
                 wake = 1;
                 ve->done = 1;
         }
@@ -186,7 +186,7 @@ int vt_waitactive(int n)
                 vt_event_wait(&vw);
                 if (vw.done == 0)
                         return -EINTR;
-        } while (vw.event.new != n);
+        } while (vw.event.newev != n);
         return 0;
 }
 
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index a9952b1236b0..84c51e177269 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -236,7 +236,7 @@ static inline void ecb_crypt(const u8 *in, u8 *out, u32 *key,
         /* Padlock in ECB mode fetches at least ecb_fetch_bytes of data.
          * We could avoid some copying here but it's probably not worth it.
          */
-        if (unlikely(((unsigned long)in & PAGE_SIZE) + ecb_fetch_bytes > PAGE_SIZE)) {
+        if (unlikely(((unsigned long)in & ~PAGE_MASK) + ecb_fetch_bytes > PAGE_SIZE)) {
                 ecb_crypt_copy(in, out, key, cword, count);
                 return;
         }
@@ -248,7 +248,7 @@ static inline u8 *cbc_crypt(const u8 *in, u8 *out, u32 *key,
                             u8 *iv, struct cword *cword, int count)
 {
         /* Padlock in CBC mode fetches at least cbc_fetch_bytes of data. */
-        if (unlikely(((unsigned long)in & PAGE_SIZE) + cbc_fetch_bytes > PAGE_SIZE))
+        if (unlikely(((unsigned long)in & ~PAGE_MASK) + cbc_fetch_bytes > PAGE_SIZE))
                 return cbc_crypt_copy(in, out, key, iv, cword, count);
 
         return rep_xcrypt_cbc(in, out, key, iv, cword, count);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 5903a88351bf..b401dadad4a8 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -26,6 +26,8 @@ config INTEL_IOATDMA
         select DMA_ENGINE
         select DCA
         select ASYNC_TX_DISABLE_CHANNEL_SWITCH
+        select ASYNC_TX_DISABLE_PQ_VAL_DMA
+        select ASYNC_TX_DISABLE_XOR_VAL_DMA
         help
           Enable support for the Intel(R) I/OAT DMA engine present
           in recent Intel Xeon chipsets.
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index bd0b248de2cf..8f99354082ce 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -632,11 +632,21 @@ static bool device_has_all_tx_types(struct dma_device *device)
         #if defined(CONFIG_ASYNC_XOR) || defined(CONFIG_ASYNC_XOR_MODULE)
         if (!dma_has_cap(DMA_XOR, device->cap_mask))
                 return false;
+
+        #ifndef CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA
+        if (!dma_has_cap(DMA_XOR_VAL, device->cap_mask))
+                return false;
+        #endif
         #endif
 
         #if defined(CONFIG_ASYNC_PQ) || defined(CONFIG_ASYNC_PQ_MODULE)
         if (!dma_has_cap(DMA_PQ, device->cap_mask))
                 return false;
+
+        #ifndef CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA
+        if (!dma_has_cap(DMA_PQ_VAL, device->cap_mask))
+                return false;
+        #endif
         #endif
 
         return true;
diff --git a/drivers/dma/ioat/dca.c b/drivers/dma/ioat/dca.c
index 69d02615c4d6..abd9038e06b1 100644
--- a/drivers/dma/ioat/dca.c
+++ b/drivers/dma/ioat/dca.c
@@ -98,17 +98,17 @@ static int dca_enabled_in_bios(struct pci_dev *pdev)
         cpuid_level_9 = cpuid_eax(9);
         res = test_bit(0, &cpuid_level_9);
         if (!res)
-                dev_err(&pdev->dev, "DCA is disabled in BIOS\n");
+                dev_dbg(&pdev->dev, "DCA is disabled in BIOS\n");
 
         return res;
 }
 
-static int system_has_dca_enabled(struct pci_dev *pdev)
+int system_has_dca_enabled(struct pci_dev *pdev)
 {
         if (boot_cpu_has(X86_FEATURE_DCA))
                 return dca_enabled_in_bios(pdev);
 
-        dev_err(&pdev->dev, "boot cpu doesn't have X86_FEATURE_DCA\n");
+        dev_dbg(&pdev->dev, "boot cpu doesn't have X86_FEATURE_DCA\n");
         return 0;
 }
 
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index c14fdfeb7f33..45edde996480 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -297,9 +297,7 @@ static inline bool is_ioat_suspended(unsigned long status)
 /* channel was fatally programmed */
 static inline bool is_ioat_bug(unsigned long err)
 {
-        return !!(err & (IOAT_CHANERR_SRC_ADDR_ERR|IOAT_CHANERR_DEST_ADDR_ERR|
-                         IOAT_CHANERR_NEXT_ADDR_ERR|IOAT_CHANERR_CONTROL_ERR|
-                         IOAT_CHANERR_LENGTH_ERR));
+        return !!err;
 }
 
 static inline void ioat_unmap(struct pci_dev *pdev, dma_addr_t addr, size_t len,
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 96ffab7d37a7..8f1f7f05deaa 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -279,6 +279,8 @@ void ioat2_timer_event(unsigned long data)
                         u32 chanerr;
 
                         chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+                        dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
+                                __func__, chanerr);
                         BUG_ON(is_ioat_bug(chanerr));
                 }
 
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 35d1e33afd5b..42f6f10fb0cc 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -378,6 +378,8 @@ static void ioat3_timer_event(unsigned long data)
                         u32 chanerr;
 
                         chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+                        dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
+                                __func__, chanerr);
                         BUG_ON(is_ioat_bug(chanerr));
                 }
 
@@ -569,7 +571,7 @@ __ioat3_prep_xor_lock(struct dma_chan *c, enum sum_check_flags *result,
         dump_desc_dbg(ioat, compl_desc);
 
         /* we leave the channel locked to ensure in order submission */
-        return &desc->txd;
+        return &compl_desc->txd;
 }
 
 static struct dma_async_tx_descriptor *
@@ -728,7 +730,7 @@ __ioat3_prep_pq_lock(struct dma_chan *c, enum sum_check_flags *result,
         dump_desc_dbg(ioat, compl_desc);
 
         /* we leave the channel locked to ensure in order submission */
-        return &desc->txd;
+        return &compl_desc->txd;
 }
 
 static struct dma_async_tx_descriptor *
@@ -736,10 +738,16 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
               unsigned int src_cnt, const unsigned char *scf, size_t len,
               unsigned long flags)
 {
+        /* specify valid address for disabled result */
+        if (flags & DMA_PREP_PQ_DISABLE_P)
+                dst[0] = dst[1];
+        if (flags & DMA_PREP_PQ_DISABLE_Q)
+                dst[1] = dst[0];
+
         /* handle the single source multiply case from the raid6
          * recovery path
          */
-        if (unlikely((flags & DMA_PREP_PQ_DISABLE_P) && src_cnt == 1)) {
+        if ((flags & DMA_PREP_PQ_DISABLE_P) && src_cnt == 1) {
                 dma_addr_t single_source[2];
                 unsigned char single_source_coef[2];
 
@@ -761,6 +769,12 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
                   unsigned int src_cnt, const unsigned char *scf, size_t len,
                   enum sum_check_flags *pqres, unsigned long flags)
 {
+        /* specify valid address for disabled result */
+        if (flags & DMA_PREP_PQ_DISABLE_P)
+                pq[0] = pq[1];
+        if (flags & DMA_PREP_PQ_DISABLE_Q)
+                pq[1] = pq[0];
+
         /* the cleanup routine only sets bits on validate failure, it
          * does not clear bits on validate success... so clear it here
          */
@@ -778,9 +792,9 @@ ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
         dma_addr_t pq[2];
 
         memset(scf, 0, src_cnt);
-        flags |= DMA_PREP_PQ_DISABLE_Q;
         pq[0] = dst;
-        pq[1] = ~0;
+        flags |= DMA_PREP_PQ_DISABLE_Q;
+        pq[1] = dst; /* specify valid address for disabled result */
 
         return __ioat3_prep_pq_lock(chan, NULL, pq, src, src_cnt, scf, len,
                                     flags);
@@ -800,9 +814,9 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
         *result = 0;
 
         memset(scf, 0, src_cnt);
-        flags |= DMA_PREP_PQ_DISABLE_Q;
         pq[0] = src[0];
-        pq[1] = ~0;
+        flags |= DMA_PREP_PQ_DISABLE_Q;
+        pq[1] = pq[0]; /* specify valid address for disabled result */
 
         return __ioat3_prep_pq_lock(chan, result, pq, &src[1], src_cnt - 1, scf,
                                     len, flags);
@@ -1117,6 +1131,7 @@ static int __devinit ioat3_dma_self_test(struct ioatdma_device *device)
 int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
 {
         struct pci_dev *pdev = device->pdev;
+        int dca_en = system_has_dca_enabled(pdev);
         struct dma_device *dma;
         struct dma_chan *c;
         struct ioat_chan_common *chan;
@@ -1137,6 +1152,11 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
         dma->device_prep_dma_interrupt = ioat3_prep_interrupt_lock;
 
         cap = readl(device->reg_base + IOAT_DMA_CAP_OFFSET);
+
+        /* dca is incompatible with raid operations */
+        if (dca_en && (cap & (IOAT_CAP_XOR|IOAT_CAP_PQ)))
+                cap &= ~(IOAT_CAP_XOR|IOAT_CAP_PQ);
+
         if (cap & IOAT_CAP_XOR) {
                 is_raid_device = true;
                 dma->max_xor = 8;
@@ -1186,6 +1206,16 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
                 device->timer_fn = ioat2_timer_event;
         }
 
+        #ifdef CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA
+        dma_cap_clear(DMA_PQ_VAL, dma->cap_mask);
+        dma->device_prep_dma_pq_val = NULL;
+        #endif
+
+        #ifdef CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA
+        dma_cap_clear(DMA_XOR_VAL, dma->cap_mask);
+        dma->device_prep_dma_xor_val = NULL;
+        #endif
+
         /* -= IOAT ver.3 workarounds =- */
         /* Write CHANERRMSK_INT with 3E07h to mask out the errors
          * that can cause stability issues for IOAT ver.3
diff --git a/drivers/dma/ioat/hw.h b/drivers/dma/ioat/hw.h
index 99afb12bd409..60e675455b6a 100644
--- a/drivers/dma/ioat/hw.h
+++ b/drivers/dma/ioat/hw.h
@@ -39,6 +39,8 @@
 #define IOAT_VER_3_0            0x30    /* Version 3.0 */
 #define IOAT_VER_3_2            0x32    /* Version 3.2 */
 
+int system_has_dca_enabled(struct pci_dev *pdev);
+
 struct ioat_dma_descriptor {
         uint32_t        size;
         union {
diff --git a/drivers/dma/ioat/registers.h b/drivers/dma/ioat/registers.h
index 63038e18ab03..f015ec196700 100644
--- a/drivers/dma/ioat/registers.h
+++ b/drivers/dma/ioat/registers.h
@@ -92,9 +92,7 @@
 #define IOAT_CHANCTRL_ERR_COMPLETION_EN         0x0004
 #define IOAT_CHANCTRL_INT_REARM                 0x0001
 #define IOAT_CHANCTRL_RUN                       (IOAT_CHANCTRL_INT_REARM |\
-                                                 IOAT_CHANCTRL_ERR_COMPLETION_EN |\
-                                                 IOAT_CHANCTRL_ANY_ERR_ABORT_EN |\
-                                                 IOAT_CHANCTRL_ERR_INT_EN)
+                                                 IOAT_CHANCTRL_ANY_ERR_ABORT_EN)
 
 #define IOAT_DMA_COMP_OFFSET                    0x02    /* 16-bit DMA channel compatibility */
 #define IOAT_DMA_COMP_V1                        0x0001  /* Compatibility with DMA version 1 */
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index b3b065c4e5c1..034ecf0ace03 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -640,17 +640,16 @@ static int __init sh_dmae_probe(struct platform_device *pdev)
 #endif
         struct sh_dmae_device *shdev;
 
+        /* get platform data */
+        if (!pdev->dev.platform_data)
+                return -ENODEV;
+
         shdev = kzalloc(sizeof(struct sh_dmae_device), GFP_KERNEL);
         if (!shdev) {
                 dev_err(&pdev->dev, "No enough memory\n");
-                err = -ENOMEM;
-                goto shdev_err;
+                return -ENOMEM;
         }
 
-        /* get platform data */
-        if (!pdev->dev.platform_data)
-                goto shdev_err;
-
         /* platform data */
         memcpy(&shdev->pdata, pdev->dev.platform_data,
                         sizeof(struct sh_dmae_pdata));
@@ -722,7 +721,6 @@ eirq_err:
 rst_err:
         kfree(shdev);
 
-shdev_err:
         return err;
 }
 
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 5d524254499e..94260aa76aa3 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -275,7 +275,7 @@ static void log_irqs(u32 evt)
             !(evt & OHCI1394_busReset))
                 return;
 
-        fw_notify("IRQ %08x%s%s%s%s%s%s%s%s%s%s%s%s%s\n", evt,
+        fw_notify("IRQ %08x%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n", evt,
             evt & OHCI1394_selfIDComplete       ? " selfID"             : "",
             evt & OHCI1394_RQPkt                ? " AR_req"             : "",
             evt & OHCI1394_RSPkt                ? " AR_resp"            : "",
@@ -286,6 +286,7 @@ static void log_irqs(u32 evt)
             evt & OHCI1394_postedWriteErr       ? " postedWriteErr"     : "",
             evt & OHCI1394_cycleTooLong         ? " cycleTooLong"       : "",
             evt & OHCI1394_cycle64Seconds       ? " cycle64Seconds"     : "",
+            evt & OHCI1394_cycleInconsistent    ? " cycleInconsistent"  : "",
             evt & OHCI1394_regAccessFail        ? " regAccessFail"      : "",
             evt & OHCI1394_busReset             ? " busReset"           : "",
             evt & ~(OHCI1394_selfIDComplete | OHCI1394_RQPkt |
@@ -293,6 +294,7 @@ static void log_irqs(u32 evt)
                     OHCI1394_respTxComplete | OHCI1394_isochRx |
                     OHCI1394_isochTx | OHCI1394_postedWriteErr |
                     OHCI1394_cycleTooLong | OHCI1394_cycle64Seconds |
+                    OHCI1394_cycleInconsistent |
                     OHCI1394_regAccessFail | OHCI1394_busReset)
                                                 ? " ?"                  : "");
 }
@@ -1439,6 +1441,17 @@ static irqreturn_t irq_handler(int irq, void *data)
                           OHCI1394_LinkControl_cycleMaster);
         }
 
+        if (unlikely(event & OHCI1394_cycleInconsistent)) {
+                /*
+                 * We need to clear this event bit in order to make
+                 * cycleMatch isochronous I/O work.  In theory we should
+                 * stop active cycleMatch iso contexts now and restart
+                 * them at least two cycles later.  (FIXME?)
+                 */
+                if (printk_ratelimit())
+                        fw_notify("isochronous cycle inconsistent\n");
+        }
+
         if (event & OHCI1394_cycle64Seconds) {
                 cycle_time = reg_read(ohci, OHCI1394_IsochronousCycleTimer);
                 if ((cycle_time & 0x80000000) == 0)
@@ -1528,6 +1541,7 @@ static int ohci_enable(struct fw_card *card, u32 *config_rom, size_t length)
                   OHCI1394_reqTxComplete | OHCI1394_respTxComplete |
                   OHCI1394_isochRx | OHCI1394_isochTx |
                   OHCI1394_postedWriteErr | OHCI1394_cycleTooLong |
+                  OHCI1394_cycleInconsistent |
                   OHCI1394_cycle64Seconds | OHCI1394_regAccessFail |
                   OHCI1394_masterIntEnable);
         if (param_debug & OHCI_PARAM_DEBUG_BUSRESETS)
@@ -1890,15 +1904,30 @@ static int handle_it_packet(struct context *context,
 {
         struct iso_context *ctx =
                 container_of(context, struct iso_context, context);
+        int i;
+        struct descriptor *pd;
 
-        if (last->transfer_status == 0)
-                /* This descriptor isn't done yet, stop iteration. */
+        for (pd = d; pd <= last; pd++)
+                if (pd->transfer_status)
+                        break;
+        if (pd > last)
+                /* Descriptor(s) not done yet, stop iteration */
                 return 0;
 
-        if (le16_to_cpu(last->control) & DESCRIPTOR_IRQ_ALWAYS)
+        i = ctx->header_length;
+        if (i + 4 < PAGE_SIZE) {
+                /* Present this value as big-endian to match the receive code */
+                *(__be32 *)(ctx->header + i) = cpu_to_be32(
+                                ((u32)le16_to_cpu(pd->transfer_status) << 16) |
+                                le16_to_cpu(pd->res_count));
+                ctx->header_length += 4;
+        }
+        if (le16_to_cpu(last->control) & DESCRIPTOR_IRQ_ALWAYS) {
                 ctx->base.callback(&ctx->base, le16_to_cpu(last->res_count),
-                                   0, NULL, ctx->base.callback_data);
-
+                                   ctx->header_length, ctx->header,
+                                   ctx->base.callback_data);
+                ctx->header_length = 0;
+        }
         return 1;
 }
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index f831ea159291..96eddd17e050 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -92,6 +92,7 @@ config DRM_I830
 config DRM_I915
         tristate "i915 driver"
         depends on AGP_INTEL
+        select SHMEM
         select DRM_KMS_HELPER
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index cea665d86dd3..b54ba63d506e 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -662,6 +662,12 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
                 return NULL;
         }
 
+        /* Some EDIDs have bogus h/vtotal values */
+        if (mode->hsync_end > mode->htotal)
+                mode->htotal = mode->hsync_end + 1;
+        if (mode->vsync_end > mode->vtotal)
+                mode->vtotal = mode->vsync_end + 1;
+
         drm_mode_set_name(mode);
 
         if (pt->misc & DRM_EDID_PT_INTERLACED)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index dc8e374a0b55..65ef011fa8ba 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -599,7 +599,7 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
         struct drm_framebuffer *fb = fb_helper->fb;
         int depth;
 
-        if (var->pixclock == -1 || !var->pixclock)
+        if (var->pixclock != 0)
                 return -EINVAL;
 
         /* Need to resize the fb object !!! */
@@ -691,7 +691,7 @@ int drm_fb_helper_set_par(struct fb_info *info)
         int ret;
         int i;
 
-        if (var->pixclock != -1) {
+        if (var->pixclock != 0) {
                 DRM_ERROR("PIXEL CLCOK SET\n");
                 return -EINVAL;
         }
@@ -904,7 +904,7 @@ int drm_fb_helper_single_fb_probe(struct drm_device *dev,
         fb_helper->fb = fb;
 
         if (new_fb) {
-                info->var.pixclock = -1;
+                info->var.pixclock = 0;
                 if (register_framebuffer(info) < 0)
                         return -EINVAL;
         } else {
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 80391995bdec..e9dbb481c469 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -552,7 +552,7 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
         vma->vm_flags |= VM_RESERVED | VM_IO | VM_PFNMAP | VM_DONTEXPAND;
         vma->vm_ops = obj->dev->driver->gem_vm_ops;
         vma->vm_private_data = map->handle;
-        vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+        vma->vm_page_prot =  pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
 
         /* Take a ref for this mapping of the object, so that the fault
          * handler can dereference the mmap offset's pointer to the object.
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index c861d80fd779..97dc5a4f0de4 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -103,6 +103,11 @@ static struct drm_mm_node *drm_mm_kmalloc(struct drm_mm *mm, int atomic)
         return child;
 }
 
+/* drm_mm_pre_get() - pre allocate drm_mm_node structure
+ * drm_mm:      memory manager struct we are pre-allocating for
+ *
+ * Returns 0 on success or -ENOMEM if allocation fails.
+ */
 int drm_mm_pre_get(struct drm_mm *mm)
 {
         struct drm_mm_node *node;
@@ -253,12 +258,14 @@ void drm_mm_put_block(struct drm_mm_node *cur)
                                 prev_node->size += next_node->size;
                                 list_del(&next_node->ml_entry);
                                 list_del(&next_node->fl_entry);
+                                spin_lock(&mm->unused_lock);
                                 if (mm->num_unused < MM_UNUSED_TARGET) {
                                         list_add(&next_node->fl_entry,
                                                  &mm->unused_nodes);
                                         ++mm->num_unused;
                                 } else
                                         kfree(next_node);
+                                spin_unlock(&mm->unused_lock);
                         } else {
                                 next_node->size += cur->size;
                                 next_node->start = cur->start;
@@ -271,11 +278,13 @@ void drm_mm_put_block(struct drm_mm_node *cur)
                 list_add(&cur->fl_entry, &mm->fl_entry);
         } else {
                 list_del(&cur->ml_entry);
+                spin_lock(&mm->unused_lock);
                 if (mm->num_unused < MM_UNUSED_TARGET) {
                         list_add(&cur->fl_entry, &mm->unused_nodes);
                         ++mm->num_unused;
                 } else
                         kfree(cur);
+                spin_unlock(&mm->unused_lock);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index f8ce9a3a420d..26bf0552b3cb 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -267,10 +267,10 @@ static void i915_dump_pages(struct seq_file *m, struct page **pages, int page_co
         uint32_t *mem;
 
         for (page = 0; page < page_count; page++) {
-                mem = kmap(pages[page]);
+                mem = kmap_atomic(pages[page], KM_USER0);
                 for (i = 0; i < PAGE_SIZE; i += 4)
                         seq_printf(m, "%08x :  %08x\n", i, mem[i / 4]);
-                kunmap(pages[page]);
+                kunmap_atomic(pages[page], KM_USER0);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 57204e298975..a725f6591192 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -296,6 +296,7 @@ typedef struct drm_i915_private {
         u32 saveVBLANK_A;
         u32 saveVSYNC_A;
         u32 saveBCLRPAT_A;
+        u32 saveTRANSACONF;
         u32 saveTRANS_HTOTAL_A;
         u32 saveTRANS_HBLANK_A;
         u32 saveTRANS_HSYNC_A;
@@ -326,6 +327,7 @@ typedef struct drm_i915_private {
         u32 saveVBLANK_B;
         u32 saveVSYNC_B;
         u32 saveBCLRPAT_B;
+        u32 saveTRANSBCONF;
         u32 saveTRANS_HTOTAL_B;
         u32 saveTRANS_HBLANK_B;
         u32 saveTRANS_HSYNC_B;
@@ -414,6 +416,16 @@ typedef struct drm_i915_private {
         u32 savePFB_WIN_SZ;
         u32 savePFA_WIN_POS;
         u32 savePFB_WIN_POS;
+        u32 savePCH_DREF_CONTROL;
+        u32 saveDISP_ARB_CTL;
+        u32 savePIPEA_DATA_M1;
+        u32 savePIPEA_DATA_N1;
+        u32 savePIPEA_LINK_M1;
+        u32 savePIPEA_LINK_N1;
+        u32 savePIPEB_DATA_M1;
+        u32 savePIPEB_DATA_N1;
+        u32 savePIPEB_LINK_M1;
+        u32 savePIPEB_LINK_N1;
 
         struct {
                 struct drm_mm gtt_space;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index c3ceffa46ea0..aa7fd82aa6eb 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -254,10 +254,15 @@ irqreturn_t igdng_irq_handler(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         int ret = IRQ_NONE;
-        u32 de_iir, gt_iir;
+        u32 de_iir, gt_iir, de_ier;
         u32 new_de_iir, new_gt_iir;
         struct drm_i915_master_private *master_priv;
 
+        /* disable master interrupt before clearing iir  */
+        de_ier = I915_READ(DEIER);
+        I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL);
+        (void)I915_READ(DEIER);
+
         de_iir = I915_READ(DEIIR);
         gt_iir = I915_READ(GTIIR);
 
@@ -290,6 +295,9 @@ irqreturn_t igdng_irq_handler(struct drm_device *dev)
                 gt_iir = new_gt_iir;
         }
 
+        I915_WRITE(DEIER, de_ier);
+        (void)I915_READ(DEIER);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 992d5617e798..6eec8171a44e 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -239,6 +239,11 @@ static void i915_save_modeset_reg(struct drm_device *dev)
         if (drm_core_check_feature(dev, DRIVER_MODESET))
                 return;
 
+        if (IS_IGDNG(dev)) {
+                dev_priv->savePCH_DREF_CONTROL = I915_READ(PCH_DREF_CONTROL);
+                dev_priv->saveDISP_ARB_CTL = I915_READ(DISP_ARB_CTL);
+        }
+
         /* Pipe & plane A info */
         dev_priv->savePIPEACONF = I915_READ(PIPEACONF);
         dev_priv->savePIPEASRC = I915_READ(PIPEASRC);
@@ -263,6 +268,11 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->saveBCLRPAT_A = I915_READ(BCLRPAT_A);
 
         if (IS_IGDNG(dev)) {
+                dev_priv->savePIPEA_DATA_M1 = I915_READ(PIPEA_DATA_M1);
+                dev_priv->savePIPEA_DATA_N1 = I915_READ(PIPEA_DATA_N1);
+                dev_priv->savePIPEA_LINK_M1 = I915_READ(PIPEA_LINK_M1);
+                dev_priv->savePIPEA_LINK_N1 = I915_READ(PIPEA_LINK_N1);
+
                 dev_priv->saveFDI_TXA_CTL = I915_READ(FDI_TXA_CTL);
                 dev_priv->saveFDI_RXA_CTL = I915_READ(FDI_RXA_CTL);
 
@@ -270,6 +280,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->savePFA_WIN_SZ = I915_READ(PFA_WIN_SZ);
                 dev_priv->savePFA_WIN_POS = I915_READ(PFA_WIN_POS);
 
+                dev_priv->saveTRANSACONF = I915_READ(TRANSACONF);
                 dev_priv->saveTRANS_HTOTAL_A = I915_READ(TRANS_HTOTAL_A);
                 dev_priv->saveTRANS_HBLANK_A = I915_READ(TRANS_HBLANK_A);
                 dev_priv->saveTRANS_HSYNC_A = I915_READ(TRANS_HSYNC_A);
@@ -314,6 +325,11 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->saveBCLRPAT_B = I915_READ(BCLRPAT_B);
 
         if (IS_IGDNG(dev)) {
+                dev_priv->savePIPEB_DATA_M1 = I915_READ(PIPEB_DATA_M1);
+                dev_priv->savePIPEB_DATA_N1 = I915_READ(PIPEB_DATA_N1);
+                dev_priv->savePIPEB_LINK_M1 = I915_READ(PIPEB_LINK_M1);
+                dev_priv->savePIPEB_LINK_N1 = I915_READ(PIPEB_LINK_N1);
+
                 dev_priv->saveFDI_TXB_CTL = I915_READ(FDI_TXB_CTL);
                 dev_priv->saveFDI_RXB_CTL = I915_READ(FDI_RXB_CTL);
 
@@ -321,6 +337,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
                 dev_priv->savePFB_WIN_SZ = I915_READ(PFB_WIN_SZ);
                 dev_priv->savePFB_WIN_POS = I915_READ(PFB_WIN_POS);
 
+                dev_priv->saveTRANSBCONF = I915_READ(TRANSBCONF);
                 dev_priv->saveTRANS_HTOTAL_B = I915_READ(TRANS_HTOTAL_B);
                 dev_priv->saveTRANS_HBLANK_B = I915_READ(TRANS_HBLANK_B);
                 dev_priv->saveTRANS_HSYNC_B = I915_READ(TRANS_HSYNC_B);
@@ -368,6 +385,11 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 fpb1_reg = FPB1;
         }
 
+        if (IS_IGDNG(dev)) {
+                I915_WRITE(PCH_DREF_CONTROL, dev_priv->savePCH_DREF_CONTROL);
+                I915_WRITE(DISP_ARB_CTL, dev_priv->saveDISP_ARB_CTL);
+        }
+
         /* Pipe & plane A info */
         /* Prime the clock */
         if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
@@ -395,6 +417,11 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(BCLRPAT_A, dev_priv->saveBCLRPAT_A);
 
         if (IS_IGDNG(dev)) {
+                I915_WRITE(PIPEA_DATA_M1, dev_priv->savePIPEA_DATA_M1);
+                I915_WRITE(PIPEA_DATA_N1, dev_priv->savePIPEA_DATA_N1);
+                I915_WRITE(PIPEA_LINK_M1, dev_priv->savePIPEA_LINK_M1);
+                I915_WRITE(PIPEA_LINK_N1, dev_priv->savePIPEA_LINK_N1);
+
                 I915_WRITE(FDI_RXA_CTL, dev_priv->saveFDI_RXA_CTL);
                 I915_WRITE(FDI_TXA_CTL, dev_priv->saveFDI_TXA_CTL);
 
@@ -402,6 +429,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(PFA_WIN_SZ, dev_priv->savePFA_WIN_SZ);
                 I915_WRITE(PFA_WIN_POS, dev_priv->savePFA_WIN_POS);
 
+                I915_WRITE(TRANSACONF, dev_priv->saveTRANSACONF);
                 I915_WRITE(TRANS_HTOTAL_A, dev_priv->saveTRANS_HTOTAL_A);
                 I915_WRITE(TRANS_HBLANK_A, dev_priv->saveTRANS_HBLANK_A);
                 I915_WRITE(TRANS_HSYNC_A, dev_priv->saveTRANS_HSYNC_A);
@@ -439,7 +467,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
         /* Actually enable it */
         I915_WRITE(dpll_b_reg, dev_priv->saveDPLL_B);
         DRM_UDELAY(150);
-        if (IS_I965G(dev))
+        if (IS_I965G(dev) && !IS_IGDNG(dev))
                 I915_WRITE(DPLL_B_MD, dev_priv->saveDPLL_B_MD);
         DRM_UDELAY(150);
 
@@ -454,6 +482,11 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(BCLRPAT_B, dev_priv->saveBCLRPAT_B);
 
         if (IS_IGDNG(dev)) {
+                I915_WRITE(PIPEB_DATA_M1, dev_priv->savePIPEB_DATA_M1);
+                I915_WRITE(PIPEB_DATA_N1, dev_priv->savePIPEB_DATA_N1);
+                I915_WRITE(PIPEB_LINK_M1, dev_priv->savePIPEB_LINK_M1);
+                I915_WRITE(PIPEB_LINK_N1, dev_priv->savePIPEB_LINK_N1);
+
                 I915_WRITE(FDI_RXB_CTL, dev_priv->saveFDI_RXB_CTL);
                 I915_WRITE(FDI_TXB_CTL, dev_priv->saveFDI_TXB_CTL);
 
@@ -461,6 +494,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
                 I915_WRITE(PFB_WIN_SZ, dev_priv->savePFB_WIN_SZ);
                 I915_WRITE(PFB_WIN_POS, dev_priv->savePFB_WIN_POS);
 
+                I915_WRITE(TRANSBCONF, dev_priv->saveTRANSBCONF);
                 I915_WRITE(TRANS_HTOTAL_B, dev_priv->saveTRANS_HTOTAL_B);
                 I915_WRITE(TRANS_HBLANK_B, dev_priv->saveTRANS_HBLANK_B);
                 I915_WRITE(TRANS_HSYNC_B, dev_priv->saveTRANS_HSYNC_B);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 212e22740fc1..e5051446c48e 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -262,8 +262,8 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
                 } while (time_after(timeout, jiffies));
         }
 
-        if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) ==
-            CRT_HOTPLUG_MONITOR_COLOR)
+        if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) !=
+            CRT_HOTPLUG_MONITOR_NONE)
                 return true;
 
         return false;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3ba6546b7c7f..099f420de57a 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -863,10 +863,8 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         intel_clock_t clock;
-        int max_n;
-        bool found;
         int err_most = 47;
-        found = false;
+        int err_min = 10000;
 
         /* eDP has only 2 clock choice, no n/m/p setting */
         if (HAS_eDP)
@@ -890,10 +888,9 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
         }
 
         memset(best_clock, 0, sizeof(*best_clock));
-        max_n = limit->n.max;
         for (clock.p1 = limit->p1.max; clock.p1 >= limit->p1.min; clock.p1--) {
                 /* based on hardware requriment prefer smaller n to precision */
-                for (clock.n = limit->n.min; clock.n <= max_n; clock.n++) {
+                for (clock.n = limit->n.min; clock.n <= limit->n.max; clock.n++) {
                         /* based on hardware requirment prefere larger m1,m2 */
                         for (clock.m1 = limit->m1.max;
                              clock.m1 >= limit->m1.min; clock.m1--) {
@@ -907,18 +904,18 @@ intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
                                         this_err = abs((10000 - (target*10000/clock.dot)));
                                         if (this_err < err_most) {
                                                 *best_clock = clock;
-                                                err_most = this_err;
-                                                max_n = clock.n;
-                                                found = true;
                                                 /* found on first matching */
                                                 goto out;
+                                        } else if (this_err < err_min) {
+                                                *best_clock = clock;
+                                                err_min = this_err;
                                         }
                                 }
                         }
                 }
         }
 out:
-        return found;
+        return true;
 }
 
 /* DisplayPort has only two frequencies, 162MHz and 270MHz */
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 663ab6de0b58..c33451aec1bd 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -77,14 +77,32 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
         struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
         u32 temp;
 
-        if (mode != DRM_MODE_DPMS_ON) {
-                temp = I915_READ(hdmi_priv->sdvox_reg);
+        temp = I915_READ(hdmi_priv->sdvox_reg);
+
+        /* HW workaround, need to toggle enable bit off and on for 12bpc, but
+         * we do this anyway which shows more stable in testing.
+         */
+        if (IS_IGDNG(dev)) {
                 I915_WRITE(hdmi_priv->sdvox_reg, temp & ~SDVO_ENABLE);
+                POSTING_READ(hdmi_priv->sdvox_reg);
+        }
+
+        if (mode != DRM_MODE_DPMS_ON) {
+                temp &= ~SDVO_ENABLE;
         } else {
-                temp = I915_READ(hdmi_priv->sdvox_reg);
-                I915_WRITE(hdmi_priv->sdvox_reg, temp | SDVO_ENABLE);
+                temp |= SDVO_ENABLE;
         }
+
+        I915_WRITE(hdmi_priv->sdvox_reg, temp);
         POSTING_READ(hdmi_priv->sdvox_reg);
+
+        /* HW workaround, need to write this twice for issue that may result
+         * in first write getting masked.
+         */
+        if (IS_IGDNG(dev)) {
+                I915_WRITE(hdmi_priv->sdvox_reg, temp);
+                POSTING_READ(hdmi_priv->sdvox_reg);
+        }
 }
 
 static void intel_hdmi_save(struct drm_connector *connector)
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 901befe03da2..d67c42555ab9 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -107,6 +107,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                         base += 3;
                         break;
                 case ATOM_IIO_WRITE:
+                        (void)ctx->card->reg_read(ctx->card, CU16(base + 1));
                         ctx->card->reg_write(ctx->card, CU16(base + 1), temp);
                         base += 3;
                         break;
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 757f5cd37744..224506a2f7b1 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -519,6 +519,7 @@ typedef int (*radeon_packet3_check_t)(struct radeon_cs_parser *p,
  * AGP
  */
 int radeon_agp_init(struct radeon_device *rdev);
+void radeon_agp_resume(struct radeon_device *rdev);
 void radeon_agp_fini(struct radeon_device *rdev);
 
 
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index 23ea9955ac59..54bf49a6d676 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -237,6 +237,18 @@ int radeon_agp_init(struct radeon_device *rdev)
 #endif
 }
 
+void radeon_agp_resume(struct radeon_device *rdev)
+{
+#if __OS_HAS_AGP
+        int r;
+        if (rdev->flags & RADEON_IS_AGP) {
+                r = radeon_agp_init(rdev);
+                if (r)
+                        dev_warn(rdev->dev, "radeon AGP reinit failed\n");
+        }
+#endif
+}
+
 void radeon_agp_fini(struct radeon_device *rdev)
 {
 #if __OS_HAS_AGP
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index fce4c4087fda..29763ceae3af 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -566,8 +566,9 @@ static enum drm_connector_status radeon_vga_detect(struct drm_connector *connect
                 radeon_i2c_do_lock(radeon_connector, 0);
 
                 if (!radeon_connector->edid) {
-                        DRM_ERROR("DDC responded but not EDID found for %s\n",
-                                  drm_get_connector_name(connector));
+                        DRM_ERROR("%s: probed a monitor but no|invalid EDID\n",
+                                        drm_get_connector_name(connector));
+                        ret = connector_status_connected;
                 } else {
                         radeon_connector->use_digital = !!(radeon_connector->edid->input & DRM_EDID_INPUT_DIGITAL);
 
@@ -720,8 +721,8 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                 radeon_i2c_do_lock(radeon_connector, 0);
 
                 if (!radeon_connector->edid) {
-                        DRM_ERROR("DDC responded but not EDID found for %s\n",
-                                  drm_get_connector_name(connector));
+                        DRM_ERROR("%s: probed a monitor but no|invalid EDID\n",
+                                        drm_get_connector_name(connector));
                 } else {
                         radeon_connector->use_digital = !!(radeon_connector->edid->input & DRM_EDID_INPUT_DIGITAL);
 
@@ -1149,6 +1150,13 @@ radeon_add_legacy_connector(struct drm_device *dev,
                         if (ret)
                                 goto failed;
                         radeon_connector->dac_load_detect = true;
+                        /* RS400,RC410,RS480 chipset seems to report a lot
+                         * of false positive on load detect, we haven't yet
+                         * found a way to make load detect reliable on those
+                         * chipset, thus just disable it for TV.
+                         */
+                        if (rdev->family == CHIP_RS400 || rdev->family == CHIP_RS480)
+                                radeon_connector->dac_load_detect = false;
                         drm_connector_attach_property(&radeon_connector->base,
                                                       rdev->mode_info.load_detect_property,
                                                       1);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index e3f9edfa40fe..41bb76fbe734 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -688,6 +688,8 @@ int radeon_resume_kms(struct drm_device *dev)
                 return -1;
         }
         pci_set_master(dev->pdev);
+        /* resume AGP if in use */
+        radeon_agp_resume(rdev);
         radeon_resume(rdev);
         radeon_restore_bios_scratch_regs(rdev);
         fb_set_suspend(rdev->fbdev_info, 0);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 7935f793bf62..ba68c9fe90a1 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -137,8 +137,6 @@ int rv515_mc_wait_for_idle(struct radeon_device *rdev)
 
 void rv515_vga_render_disable(struct radeon_device *rdev)
 {
-        WREG32(R_000330_D1VGA_CONTROL, 0);
-        WREG32(R_000338_D2VGA_CONTROL, 0);
         WREG32(R_000300_VGA_RENDER_CONTROL,
                 RREG32(R_000300_VGA_RENDER_CONTROL) & C_000300_VGA_VSTATUS_CNTL);
 }
@@ -382,7 +380,6 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
         save->d2crtc_control = RREG32(R_006880_D2CRTC_CONTROL);
 
         /* Stop all video */
-        WREG32(R_000330_D1VGA_CONTROL, 0);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
         WREG32(R_000300_VGA_RENDER_CONTROL, 0);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 1);
@@ -391,6 +388,8 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
         WREG32(R_006880_D2CRTC_CONTROL, 0);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 0);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
+        WREG32(R_000330_D1VGA_CONTROL, 0);
+        WREG32(R_000338_D2VGA_CONTROL, 0);
 }
 
 void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
@@ -404,14 +403,14 @@ void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
         WREG32(R_000328_VGA_HDP_CONTROL, save->vga_hdp_control);
         mdelay(1);
         /* Restore video state */
+        WREG32(R_000330_D1VGA_CONTROL, save->d1vga_control);
+        WREG32(R_000338_D2VGA_CONTROL, save->d2vga_control);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 1);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 1);
         WREG32(R_006080_D1CRTC_CONTROL, save->d1crtc_control);
         WREG32(R_006880_D2CRTC_CONTROL, save->d2crtc_control);
         WREG32(R_0060E8_D1CRTC_UPDATE_LOCK, 0);
         WREG32(R_0068E8_D2CRTC_UPDATE_LOCK, 0);
-        WREG32(R_000330_D1VGA_CONTROL, save->d1vga_control);
-        WREG32(R_000338_D2VGA_CONTROL, save->d2vga_control);
         WREG32(R_000300_VGA_RENDER_CONTROL, save->vga_render_control);
 }
 
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 6ff6c20f1e78..fbab6846ae64 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -19,7 +19,9 @@
 #include <linux/completion.h>
 #include <linux/platform_device.h>
 #include <linux/i2c-pnx.h>
+#include <linux/io.h>
 #include <mach/hardware.h>
+#include <mach/i2c.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 
@@ -54,6 +56,9 @@ static inline void i2c_pnx_arm_timer(struct i2c_adapter *adap)
         struct timer_list *timer = &data->mif.timer;
         int expires = I2C_PNX_TIMEOUT / (1000 / HZ);
 
+        if (expires <= 1)
+                expires = 2;
+
         del_timer_sync(timer);
 
         dev_dbg(&adap->dev, "Timer armed at %lu plus %u jiffies.\n",
@@ -645,7 +650,7 @@ static int __devinit i2c_pnx_probe(struct platform_device *pdev)
         return 0;
 
 out_irq:
-        free_irq(alg_data->irq, alg_data);
+        free_irq(alg_data->irq, i2c_pnx->adapter);
 out_clock:
         i2c_pnx->set_clock_stop(pdev);
 out_unmap:
@@ -664,7 +669,7 @@ static int __devexit i2c_pnx_remove(struct platform_device *pdev)
         struct i2c_adapter *adap = i2c_pnx->adapter;
         struct i2c_pnx_algo_data *alg_data = adap->algo_data;
 
-        free_irq(alg_data->irq, alg_data);
+        free_irq(alg_data->irq, i2c_pnx->adapter);
         i2c_del_adapter(adap);
         i2c_pnx->set_clock_stop(pdev);
         iounmap((void *)alg_data->ioaddr);
diff --git a/drivers/i2c/chips/tsl2550.c b/drivers/i2c/chips/tsl2550.c
index aa96bd2d27ea..a0702f36a72f 100644
--- a/drivers/i2c/chips/tsl2550.c
+++ b/drivers/i2c/chips/tsl2550.c
@@ -257,6 +257,7 @@ static DEVICE_ATTR(operating_mode, S_IWUSR | S_IRUGO,
 
 static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
 {
+        struct tsl2550_data *data = i2c_get_clientdata(client);
         u8 ch0, ch1;
         int ret;
 
@@ -274,6 +275,8 @@ static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
         ret = tsl2550_calculate_lux(ch0, ch1);
         if (ret < 0)
                 return ret;
+        if (data->operating_mode == 1)
+                ret *= 5;
 
         return sprintf(buf, "%d\n", ret);
 }
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 8d80fceca6a4..296504355142 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -762,6 +762,7 @@ int i2c_del_adapter(struct i2c_adapter *adap)
 {
         int res = 0;
         struct i2c_adapter *found;
+        struct i2c_client *client, *next;
 
         /* First make sure that this adapter was ever added */
         mutex_lock(&core_lock);
@@ -781,6 +782,16 @@ int i2c_del_adapter(struct i2c_adapter *adap)
         if (res)
                 return res;
 
+        /* Remove devices instantiated from sysfs */
+        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
+                if (client->adapter == adap) {
+                        dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
+                                client->name, client->addr);
+                        list_del(&client->detected);
+                        i2c_unregister_device(client);
+                }
+        }
+
         /* Detach any active clients. This can't fail, thus we do not
            checking the returned value. */
         res = device_for_each_child(&adap->dev, NULL, __unregister_client);
diff --git a/drivers/ide/ide-ioctls.c b/drivers/ide/ide-ioctls.c
index d3440b5010a5..6e7ae2b6cfc6 100644
--- a/drivers/ide/ide-ioctls.c
+++ b/drivers/ide/ide-ioctls.c
@@ -162,7 +162,7 @@ static int ide_cmd_ioctl(ide_drive_t *drive, unsigned long arg)
         if (tf->command == ATA_CMD_SET_FEATURES &&
             tf->feature == SETFEATURES_XFER &&
             tf->nsect >= XFER_SW_DMA_0) {
-                xfer_rate = ide_find_dma_mode(drive, XFER_UDMA_6);
+                xfer_rate = ide_find_dma_mode(drive, tf->nsect);
                 if (xfer_rate != tf->nsect) {
                         err = -EINVAL;
                         goto abort;
diff --git a/drivers/media/common/ir-functions.c b/drivers/media/common/ir-functions.c
index 655474b29e21..abd4791acb0e 100644
--- a/drivers/media/common/ir-functions.c
+++ b/drivers/media/common/ir-functions.c
@@ -64,7 +64,7 @@ void ir_input_init(struct input_dev *dev, struct ir_input_state *ir,
 
         ir->ir_type = ir_type;
 
-        memset(ir->ir_codes, sizeof(ir->ir_codes), 0);
+        memset(ir->ir_codes, 0, sizeof(ir->ir_codes));
 
         /*
          * FIXME: This is a temporary workaround to use the new IR tables
diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
index f65591fb7cec..2a53dd096eef 100644
--- a/drivers/media/dvb/dvb-usb/cxusb.c
+++ b/drivers/media/dvb/dvb-usb/cxusb.c
@@ -663,6 +663,14 @@ static struct zl10353_config cxusb_zl10353_xc3028_config = {
         .parallel_ts = 1,
 };
 
+static struct zl10353_config cxusb_zl10353_xc3028_config_no_i2c_gate = {
+        .demod_address = 0x0f,
+        .if2 = 45600,
+        .no_tuner = 1,
+        .parallel_ts = 1,
+        .disable_i2c_gate_ctrl = 1,
+};
+
 static struct mt352_config cxusb_mt352_xc3028_config = {
         .demod_address = 0x0f,
         .if2 = 4560,
@@ -894,7 +902,7 @@ static int cxusb_dualdig4_frontend_attach(struct dvb_usb_adapter *adap)
         cxusb_bluebird_gpio_pulse(adap->dev, 0x02, 1);
 
         if ((adap->fe = dvb_attach(zl10353_attach,
-                                   &cxusb_zl10353_xc3028_config,
+                                   &cxusb_zl10353_xc3028_config_no_i2c_gate,
                                    &adap->dev->i2c_adap)) == NULL)
                 return -EIO;
 
diff --git a/drivers/media/dvb/siano/Kconfig b/drivers/media/dvb/siano/Kconfig
index 8c1aed77ea30..85a222c4eaa0 100644
--- a/drivers/media/dvb/siano/Kconfig
+++ b/drivers/media/dvb/siano/Kconfig
@@ -4,7 +4,7 @@
 
 config SMS_SIANO_MDTV
         tristate "Siano SMS1xxx based MDTV receiver"
-        depends on DVB_CORE && INPUT
+        depends on DVB_CORE && INPUT && HAS_DMA
         ---help---
           Choose Y or M here if you have MDTV receiver with a Siano chipset.
 
diff --git a/drivers/media/radio/radio-gemtek-pci.c b/drivers/media/radio/radio-gemtek-pci.c
index c3f579de6e71..c6cf11661868 100644
--- a/drivers/media/radio/radio-gemtek-pci.c
+++ b/drivers/media/radio/radio-gemtek-pci.c
@@ -181,12 +181,10 @@ static void gemtek_pci_mute(struct gemtek_pci *card)
 
 static void gemtek_pci_unmute(struct gemtek_pci *card)
 {
-        mutex_lock(&card->lock);
         if (card->mute) {
                 gemtek_pci_setfrequency(card, card->current_frequency);
                 card->mute = false;
         }
-        mutex_unlock(&card->lock);
 }
 
 static int gemtek_pci_getsignal(struct gemtek_pci *card)
diff --git a/drivers/media/video/davinci/vpif_display.c b/drivers/media/video/davinci/vpif_display.c
index c015da813dda..d14cfb200ed0 100644
--- a/drivers/media/video/davinci/vpif_display.c
+++ b/drivers/media/video/davinci/vpif_display.c
@@ -1426,7 +1426,6 @@ static __init int vpif_probe(struct platform_device *pdev)
         struct vpif_display_config *config;
         int i, j = 0, k, q, m, err = 0;
         struct i2c_adapter *i2c_adap;
-        struct vpif_config *config;
         struct common_obj *common;
         struct channel_obj *ch;
         struct video_device *vfd;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index bdb249bd9d5d..c0fd5c6feeac 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -1584,8 +1584,8 @@ struct em28xx_board em28xx_boards[] = {
         [EM2870_BOARD_REDDO_DVB_C_USB_BOX] = {
                 .name          = "Reddo DVB-C USB TV Box",
                 .tuner_type    = TUNER_ABSENT,
+                .tuner_gpio    = reddo_dvb_c_usb_box,
                 .has_dvb       = 1,
-                .dvb_gpio      = reddo_dvb_c_usb_box,
         },
 };
 const unsigned int em28xx_bcount = ARRAY_SIZE(em28xx_boards);
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 5f37952c75cf..72802291e812 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -28,6 +28,7 @@
 #include <linux/moduleparam.h>
 #include <linux/mutex.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 #include <linux/time.h>
 #include <linux/version.h>
 #include <linux/videodev2.h>
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index dff2e5e2d8c6..7db82bdf6f31 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -17,6 +17,7 @@
 #include <linux/clk.h>
 #include <linux/vmalloc.h>
 #include <linux/interrupt.h>
+#include <linux/sched.h>
 
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 2f78b4f263f5..9c8b7c7b89ee 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -31,6 +31,7 @@
 #include <linux/platform_device.h>
 #include <linux/videodev2.h>
 #include <linux/pm_runtime.h>
+#include <linux/sched.h>
 
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
@@ -1723,11 +1724,12 @@ static int __devinit sh_mobile_ceu_probe(struct platform_device *pdev)
 
         err = soc_camera_host_register(&pcdev->ici);
         if (err)
-                goto exit_free_irq;
+                goto exit_free_clk;
 
         return 0;
 
-exit_free_irq:
+exit_free_clk:
+        pm_runtime_disable(&pdev->dev);
         free_irq(pcdev->irq, pcdev);
 exit_release_mem:
         if (platform_get_resource(pdev, IORESOURCE_MEM, 1))
@@ -1747,6 +1749,7 @@ static int __devexit sh_mobile_ceu_remove(struct platform_device *pdev)
                                         struct sh_mobile_ceu_dev, ici);
 
         soc_camera_host_unregister(soc_host);
+        pm_runtime_disable(&pdev->dev);
         free_irq(pcdev->irq, pcdev);
         if (platform_get_resource(pdev, IORESOURCE_MEM, 1))
                 dma_release_declared_memory(&pdev->dev);
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 36e617bd13c7..95fdeb23c2c1 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -1097,6 +1097,13 @@ static int default_s_crop(struct soc_camera_device *icd, struct v4l2_crop *a)
         return v4l2_subdev_call(sd, video, s_crop, a);
 }
 
+static void soc_camera_device_init(struct device *dev, void *pdata)
+{
+        dev->platform_data      = pdata;
+        dev->bus                = &soc_camera_bus_type;
+        dev->release            = dummy_release;
+}
+
 int soc_camera_host_register(struct soc_camera_host *ici)
 {
         struct soc_camera_host *ix;
@@ -1158,6 +1165,7 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
 
         list_for_each_entry(icd, &devices, list) {
                 if (icd->iface == ici->nr) {
+                        void *pdata = icd->dev.platform_data;
                         /* The bus->remove will be called */
                         device_unregister(&icd->dev);
                         /*
@@ -1169,6 +1177,7 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
                          * device private data.
                          */
                         memset(&icd->dev, 0, sizeof(icd->dev));
+                        soc_camera_device_init(&icd->dev, pdata);
                 }
         }
 
@@ -1200,10 +1209,7 @@ static int soc_camera_device_register(struct soc_camera_device *icd)
                  * man, stay reasonable... */
                 return -ENOMEM;
 
-        icd->devnum = num;
-        icd->dev.bus = &soc_camera_bus_type;
-
-        icd->dev.release        = dummy_release;
+        icd->devnum             = num;
         icd->use_count          = 0;
         icd->host_priv          = NULL;
         mutex_init(&icd->video_lock);
@@ -1311,12 +1317,13 @@ static int __devinit soc_camera_pdrv_probe(struct platform_device *pdev)
         icd->iface = icl->bus_id;
         icd->pdev = &pdev->dev;
         platform_set_drvdata(pdev, icd);
-        icd->dev.platform_data = icl;
 
         ret = soc_camera_device_register(icd);
         if (ret < 0)
                 goto escdevreg;
 
+        soc_camera_device_init(&icd->dev, icl);
+
         icd->user_width         = DEFAULT_WIDTH;
         icd->user_height        = DEFAULT_HEIGHT;
 
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 635ffc7b0391..c3065c4bcba9 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -19,6 +19,7 @@
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/dma-mapping.h>
+#include <linux/sched.h>
 #include <media/videobuf-dma-contig.h>
 
 struct videobuf_dma_contig_memory {
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index db39f4a52f53..2cb2736d65aa 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -158,6 +158,7 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         struct i2c_msg msg[2];
         u8 msgbuf[2];
         struct i2c_client *client;
+        unsigned long timeout, read_time;
         int status, i;
 
         memset(msg, 0, sizeof(msg));
@@ -183,47 +184,60 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf,
         if (count > io_limit)
                 count = io_limit;
 
-        /* Smaller eeproms can work given some SMBus extension calls */
         if (at24->use_smbus) {
+                /* Smaller eeproms can work given some SMBus extension calls */
                 if (count > I2C_SMBUS_BLOCK_MAX)
                         count = I2C_SMBUS_BLOCK_MAX;
-                status = i2c_smbus_read_i2c_block_data(client, offset,
-                                count, buf);
-                dev_dbg(&client->dev, "smbus read %zu@%d --> %d\n",
-                                count, offset, status);
-                return (status < 0) ? -EIO : status;
+        } else {
+                /*
+                 * When we have a better choice than SMBus calls, use a
+                 * combined I2C message. Write address; then read up to
+                 * io_limit data bytes. Note that read page rollover helps us
+                 * here (unlike writes). msgbuf is u8 and will cast to our
+                 * needs.
+                 */
+                i = 0;
+                if (at24->chip.flags & AT24_FLAG_ADDR16)
+                        msgbuf[i++] = offset >> 8;
+                msgbuf[i++] = offset;
+
+                msg[0].addr = client->addr;
+                msg[0].buf = msgbuf;
+                msg[0].len = i;
+
+                msg[1].addr = client->addr;
+                msg[1].flags = I2C_M_RD;
+                msg[1].buf = buf;
+                msg[1].len = count;
         }
 
         /*
-         * When we have a better choice than SMBus calls, use a combined
-         * I2C message. Write address; then read up to io_limit data bytes.
-         * Note that read page rollover helps us here (unlike writes).
-         * msgbuf is u8 and will cast to our needs.
+         * Reads fail if the previous write didn't complete yet. We may
+         * loop a few times until this one succeeds, waiting at least
+         * long enough for one entire page write to work.
          */
-        i = 0;
-        if (at24->chip.flags & AT24_FLAG_ADDR16)
-                msgbuf[i++] = offset >> 8;
-        msgbuf[i++] = offset;
-
-        msg[0].addr = client->addr;
-        msg[0].buf = msgbuf;
-        msg[0].len = i;
+        timeout = jiffies + msecs_to_jiffies(write_timeout);
+        do {
+                read_time = jiffies;
+                if (at24->use_smbus) {
+                        status = i2c_smbus_read_i2c_block_data(client, offset,
+                                        count, buf);
+                } else {
+                        status = i2c_transfer(client->adapter, msg, 2);
+                        if (status == 2)
+                                status = count;
+                }
+                dev_dbg(&client->dev, "read %zu@%d --> %d (%ld)\n",
+                                count, offset, status, jiffies);
 
-        msg[1].addr = client->addr;
-        msg[1].flags = I2C_M_RD;
-        msg[1].buf = buf;
-        msg[1].len = count;
+                if (status == count)
+                        return count;
 
-        status = i2c_transfer(client->adapter, msg, 2);
-        dev_dbg(&client->dev, "i2c read %zu@%d --> %d\n",
-                        count, offset, status);
+                /* REVISIT: at HZ=100, this is sloooow */
+                msleep(1);
+        } while (time_before(read_time, timeout));
 
-        if (status == 2)
-                return count;
-        else if (status >= 0)
-                return -EIO;
-        else
-                return status;
+        return -ETIMEDOUT;
 }
 
 static ssize_t at24_read(struct at24_data *at24,
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 2be49c817995..b25467ac895c 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -628,15 +628,6 @@ static int ep93xx_open(struct net_device *dev)
         if (ep93xx_alloc_buffers(ep))
                 return -ENOMEM;
 
-        if (is_zero_ether_addr(dev->dev_addr)) {
-                random_ether_addr(dev->dev_addr);
-                printk(KERN_INFO "%s: generated random MAC address "
-                        "%.2x:%.2x:%.2x:%.2x:%.2x:%.2x.\n", dev->name,
-                        dev->dev_addr[0], dev->dev_addr[1],
-                        dev->dev_addr[2], dev->dev_addr[3],
-                        dev->dev_addr[4], dev->dev_addr[5]);
-        }
-
         napi_enable(&ep->napi);
 
         if (ep93xx_start_hw(dev)) {
@@ -877,6 +868,9 @@ static int ep93xx_eth_probe(struct platform_device *pdev)
         ep->mii.mdio_write = ep93xx_mdio_write;
         ep->mdc_divisor = 40;   /* Max HCLK 100 MHz, min MDIO clk 2.5 MHz.  */
 
+        if (is_zero_ether_addr(dev->dev_addr))
+                random_ether_addr(dev->dev_addr);
+
         err = register_netdev(dev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to register netdev\n");
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index e046943ef29d..2a9132343b66 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -912,9 +912,6 @@ static irqreturn_t b44_interrupt(int irq, void *dev_id)
                         bp->istat = istat;
                         __b44_disable_ints(bp);
                         __napi_schedule(&bp->napi);
-                } else {
-                        printk(KERN_ERR PFX "%s: Error, poll already scheduled\n",
-                               dev->name);
                 }
 
 irq_ack:
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 3c29a20b751e..d269a68ce354 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -157,6 +157,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/mii.h>
@@ -602,6 +603,7 @@ struct nic {
         struct mem *mem;
         dma_addr_t dma_addr;
 
+        struct pci_pool *cbs_pool;
         dma_addr_t cbs_dma_addr;
         u8 adaptive_ifs;
         u8 tx_threshold;
@@ -1793,9 +1795,7 @@ static void e100_clean_cbs(struct nic *nic)
                         nic->cb_to_clean = nic->cb_to_clean->next;
                         nic->cbs_avail++;
                 }
-                pci_free_consistent(nic->pdev,
-                        sizeof(struct cb) * nic->params.cbs.count,
-                        nic->cbs, nic->cbs_dma_addr);
+                pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
                 nic->cbs = NULL;
                 nic->cbs_avail = 0;
         }
@@ -1813,8 +1813,8 @@ static int e100_alloc_cbs(struct nic *nic)
         nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL;
         nic->cbs_avail = 0;
 
-        nic->cbs = pci_alloc_consistent(nic->pdev,
-                sizeof(struct cb) * count, &nic->cbs_dma_addr);
+        nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL,
+                                  &nic->cbs_dma_addr);
         if (!nic->cbs)
                 return -ENOMEM;
 
@@ -2841,7 +2841,11 @@ static int __devinit e100_probe(struct pci_dev *pdev,
                 DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n");
                 goto err_out_free;
         }
-
+        nic->cbs_pool = pci_pool_create(netdev->name,
+                           nic->pdev,
+                           nic->params.cbs.count * sizeof(struct cb),
+                           sizeof(u32),
+                           0);
         DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n",
                 (unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
                 pdev->irq, netdev->dev_addr);
@@ -2871,6 +2875,7 @@ static void __devexit e100_remove(struct pci_dev *pdev)
                 unregister_netdev(netdev);
                 e100_free(nic);
                 pci_iounmap(pdev, nic->csr);
+                pci_pool_destroy(nic->cbs_pool);
                 free_netdev(netdev);
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index b9221bdc7184..0fe2fc90f207 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -3235,6 +3235,10 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
         flush_scheduled_work();
 
         unregister_netdev(dev);
+
+        /* restore original MAC address */
+        rtl_rar_set(tp, dev->perm_addr);
+
         rtl_disable_msi(pdev, tp);
         rtl8169_release_board(pdev, dev, tp->mmio_addr);
         pci_set_drvdata(pdev, NULL);
@@ -4881,6 +4885,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
 
         rtl8169_net_suspend(dev);
 
+        /* restore original MAC address */
+        rtl_rar_set(tp, dev->perm_addr);
+
         spin_lock_irq(&tp->lock);
 
         rtl8169_asic_down(ioaddr);
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 05c91ee6921e..f12206bdbb75 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -2283,7 +2283,7 @@ static int __devinit smc_drv_probe(struct platform_device *pdev)
 
         ndev->irq = ires->start;
 
-        if (ires->flags & IRQF_TRIGGER_MASK)
+        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
                 irq_flags = ires->flags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
diff --git a/drivers/net/smsc9420.c b/drivers/net/smsc9420.c
index b4909a2dec66..0f7909276237 100644
--- a/drivers/net/smsc9420.c
+++ b/drivers/net/smsc9420.c
@@ -252,6 +252,9 @@ static int smsc9420_ethtool_get_settings(struct net_device *dev,
 {
         struct smsc9420_pdata *pd = netdev_priv(dev);
 
+        if (!pd->phy_dev)
+                return -ENODEV;
+
         cmd->maxtxpkt = 1;
         cmd->maxrxpkt = 1;
         return phy_ethtool_gset(pd->phy_dev, cmd);
@@ -262,6 +265,9 @@ static int smsc9420_ethtool_set_settings(struct net_device *dev,
 {
         struct smsc9420_pdata *pd = netdev_priv(dev);
 
+        if (!pd->phy_dev)
+                return -ENODEV;
+
         return phy_ethtool_sset(pd->phy_dev, cmd);
 }
 
@@ -290,6 +296,10 @@ static void smsc9420_ethtool_set_msglevel(struct net_device *netdev, u32 data)
 static int smsc9420_ethtool_nway_reset(struct net_device *netdev)
 {
         struct smsc9420_pdata *pd = netdev_priv(netdev);
+
+        if (!pd->phy_dev)
+                return -ENODEV;
+
         return phy_start_aneg(pd->phy_dev);
 }
 
@@ -312,6 +322,10 @@ smsc9420_ethtool_getregs(struct net_device *dev, struct ethtool_regs *regs,
         for (i = 0; i < 0x100; i += (sizeof(u32)))
                 data[j++] = smsc9420_reg_read(pd, i);
 
+        // cannot read phy registers if the net device is down
+        if (!phy_dev)
+                return;
+
         for (i = 0; i <= 31; i++)
                 data[j++] = smsc9420_mii_read(phy_dev->bus, phy_dev->addr, i);
 }
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index e2c33c06190b..8e25ca7080c7 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -907,6 +907,7 @@ static ssize_t cosa_write(struct file *file,
                         current->state = TASK_RUNNING;
                         chan->tx_status = 1;
                         spin_unlock_irqrestore(&cosa->lock, flags);
+                        up(&chan->wsem);
                         return -ERESTARTSYS;
                 }
         }
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index e5f8fc164fd3..b952ebc7a78b 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -609,6 +609,9 @@ int __init check_zero_address(void)
                                      dmi_get_system_info(DMI_BIOS_VENDOR),
                                      dmi_get_system_info(DMI_BIOS_VERSION),
                                      dmi_get_system_info(DMI_PRODUCT_VERSION));
+#ifdef CONFIG_DMAR
+                                dmar_disabled = 1;
+#endif
                                 return 0;
                         }
                         break;
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
index 0a8f735f6c4a..ab64522aaa64 100644
--- a/drivers/platform/x86/acerhdf.c
+++ b/drivers/platform/x86/acerhdf.c
@@ -52,7 +52,7 @@
  */
 #undef START_IN_KERNEL_MODE
 
-#define DRV_VER "0.5.17"
+#define DRV_VER "0.5.18"
 
 /*
  * According to the Atom N270 datasheet,
@@ -61,7 +61,7 @@
  * measured by the on-die thermal monitor are within 0 <= Tj <= 90. So,
  * assume 89°C is critical temperature.
  */
-#define ACERHDF_TEMP_CRIT 89
+#define ACERHDF_TEMP_CRIT 89000
 #define ACERHDF_FAN_OFF 0
 #define ACERHDF_FAN_AUTO 1
 
@@ -69,7 +69,7 @@
  * No matter what value the user puts into the fanon variable, turn on the fan
  * at 80 degree Celsius to prevent hardware damage
  */
-#define ACERHDF_MAX_FANON 80
+#define ACERHDF_MAX_FANON 80000
 
 /*
  * Maximum interval between two temperature checks is 15 seconds, as the die
@@ -85,8 +85,8 @@ static int kernelmode;
 #endif
 
 static unsigned int interval = 10;
-static unsigned int fanon = 63;
-static unsigned int fanoff = 58;
+static unsigned int fanon = 63000;
+static unsigned int fanoff = 58000;
 static unsigned int verbose;
 static unsigned int fanstate = ACERHDF_FAN_AUTO;
 static char force_bios[16];
@@ -171,7 +171,7 @@ static int acerhdf_get_temp(int *temp)
         if (ec_read(bios_cfg->tempreg, &read_temp))
                 return -EINVAL;
 
-        *temp = read_temp;
+        *temp = read_temp * 1000;
 
         return 0;
 }
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index d93108d148fc..a848c7e20aeb 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -1680,36 +1680,48 @@ static void tpacpi_remove_driver_attributes(struct device_driver *drv)
                           | (__bv1) << 8 | (__bv2) }
 
 #define TPV_Q_X(__v, __bid1, __bid2, __bv1, __bv2,      \
-                __eid1, __eid2, __ev1, __ev2)           \
+                __eid, __ev1, __ev2)                    \
         { .vendor       = (__v),                        \
           .bios         = TPID(__bid1, __bid2),         \
-          .ec           = TPID(__eid1, __eid2),         \
+          .ec           = __eid,                        \
           .quirks       = (__ev1) << 24 | (__ev2) << 16 \
                           | (__bv1) << 8 | (__bv2) }
 
 #define TPV_QI0(__id1, __id2, __bv1, __bv2) \
         TPV_Q(PCI_VENDOR_ID_IBM, __id1, __id2, __bv1, __bv2)
 
+/* Outdated IBM BIOSes often lack the EC id string */
 #define TPV_QI1(__id1, __id2, __bv1, __bv2, __ev1, __ev2) \
         TPV_Q_X(PCI_VENDOR_ID_IBM, __id1, __id2,        \
-                __bv1, __bv2, __id1, __id2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__id1, __id2),       \
+                __ev1, __ev2),                          \
+        TPV_Q_X(PCI_VENDOR_ID_IBM, __id1, __id2,        \
+                __bv1, __bv2, TPACPI_MATCH_UNKNOWN,     \
+                __ev1, __ev2)
 
+/* Outdated IBM BIOSes often lack the EC id string */
 #define TPV_QI2(__bid1, __bid2, __bv1, __bv2,           \
                 __eid1, __eid2, __ev1, __ev2)           \
         TPV_Q_X(PCI_VENDOR_ID_IBM, __bid1, __bid2,      \
-                __bv1, __bv2, __eid1, __eid2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__eid1, __eid2),     \
+                __ev1, __ev2),                          \
+        TPV_Q_X(PCI_VENDOR_ID_IBM, __bid1, __bid2,      \
+                __bv1, __bv2, TPACPI_MATCH_UNKNOWN,     \
+                __ev1, __ev2)
 
 #define TPV_QL0(__id1, __id2, __bv1, __bv2) \
         TPV_Q(PCI_VENDOR_ID_LENOVO, __id1, __id2, __bv1, __bv2)
 
 #define TPV_QL1(__id1, __id2, __bv1, __bv2, __ev1, __ev2) \
         TPV_Q_X(PCI_VENDOR_ID_LENOVO, __id1, __id2,     \
-                __bv1, __bv2, __id1, __id2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__id1, __id2),       \
+                __ev1, __ev2)
 
 #define TPV_QL2(__bid1, __bid2, __bv1, __bv2,           \
                 __eid1, __eid2, __ev1, __ev2)           \
         TPV_Q_X(PCI_VENDOR_ID_LENOVO, __bid1, __bid2,   \
-                __bv1, __bv2, __eid1, __eid2, __ev1, __ev2)
+                __bv1, __bv2, TPID(__eid1, __eid2),     \
+                __ev1, __ev2)
 
 static const struct tpacpi_quirk tpacpi_bios_version_qtable[] __initconst = {
         /*  Numeric models ------------------ */
@@ -6313,7 +6325,7 @@ static int brightness_write(char *buf)
          * Doing it this way makes the syscall restartable in case of EINTR
          */
         rc = brightness_set(level);
-        return (rc == -EINTR)? ERESTARTSYS : rc;
+        return (rc == -EINTR)? -ERESTARTSYS : rc;
 }
 
 static struct ibm_struct brightness_driver_data = {
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 5fd2da494d08..c968cc31cd86 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -164,8 +164,8 @@ void scsi_remove_host(struct Scsi_Host *shost)
                         return;
                 }
         spin_unlock_irqrestore(shost->host_lock, flags);
-        mutex_unlock(&shost->scan_mutex);
         scsi_forget_host(shost);
+        mutex_unlock(&shost->scan_mutex);
         scsi_proc_host_rm(shost);
 
         spin_lock_irqsave(shost->host_lock, flags);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 0547a7f44d42..47291bcff0d5 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -952,16 +952,6 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         return SCSI_SCAN_LUN_PRESENT;
 }
 
-static inline void scsi_destroy_sdev(struct scsi_device *sdev)
-{
-        scsi_device_set_state(sdev, SDEV_DEL);
-        if (sdev->host->hostt->slave_destroy)
-                sdev->host->hostt->slave_destroy(sdev);
-        transport_destroy_device(&sdev->sdev_gendev);
-        put_device(&sdev->sdev_dev);
-        put_device(&sdev->sdev_gendev);
-}
-
 #ifdef CONFIG_SCSI_LOGGING
 /** 
  * scsi_inq_str - print INQUIRY data from min to max index, strip trailing whitespace
@@ -1139,7 +1129,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
                         }
                 }
         } else
-                scsi_destroy_sdev(sdev);
+                __scsi_remove_device(sdev);
  out:
         return res;
 }
@@ -1500,7 +1490,7 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
                 /*
                  * the sdev we used didn't appear in the report luns scan
                  */
-                scsi_destroy_sdev(sdev);
+                __scsi_remove_device(sdev);
         return ret;
 }
 
@@ -1710,7 +1700,7 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
         shost_for_each_device(sdev, shost) {
                 if (!scsi_host_scan_allowed(shost) ||
                     scsi_sysfs_add_sdev(sdev) != 0)
-                        scsi_destroy_sdev(sdev);
+                        __scsi_remove_device(sdev);
         }
 }
 
@@ -1943,7 +1933,7 @@ void scsi_free_host_dev(struct scsi_device *sdev)
 {
         BUG_ON(sdev->id != sdev->host->this_id);
 
-        scsi_destroy_sdev(sdev);
+        __scsi_remove_device(sdev);
 }
 EXPORT_SYMBOL(scsi_free_host_dev);
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 5c7eb63a19d1..392d8db33905 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -854,82 +854,73 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
         transport_configure_device(&starget->dev);
         error = device_add(&sdev->sdev_gendev);
         if (error) {
-                put_device(sdev->sdev_gendev.parent);
                 printk(KERN_INFO "error 1\n");
-                return error;
+                goto out_remove;
         }
         error = device_add(&sdev->sdev_dev);
         if (error) {
                 printk(KERN_INFO "error 2\n");
-                goto clean_device;
+                device_del(&sdev->sdev_gendev);
+                goto out_remove;
         }
+        transport_add_device(&sdev->sdev_gendev);
+        sdev->is_visible = 1;
 
         /* create queue files, which may be writable, depending on the host */
         if (sdev->host->hostt->change_queue_depth)
                 error = device_create_file(&sdev->sdev_gendev, &sdev_attr_queue_depth_rw);
         else
                 error = device_create_file(&sdev->sdev_gendev, &dev_attr_queue_depth);
-        if (error) {
-                __scsi_remove_device(sdev);
-                goto out;
-        }
+        if (error)
+                goto out_remove;
+
         if (sdev->host->hostt->change_queue_type)
                 error = device_create_file(&sdev->sdev_gendev, &sdev_attr_queue_type_rw);
         else
                 error = device_create_file(&sdev->sdev_gendev, &dev_attr_queue_type);
-        if (error) {
-                __scsi_remove_device(sdev);
-                goto out;
-        }
+        if (error)
+                goto out_remove;
 
         error = bsg_register_queue(rq, &sdev->sdev_gendev, NULL, NULL);
 
         if (error)
+                /* we're treating error on bsg register as non-fatal,
+                 * so pretend nothing went wrong */
                 sdev_printk(KERN_INFO, sdev,
                             "Failed to register bsg queue, errno=%d\n", error);
 
-        /* we're treating error on bsg register as non-fatal, so pretend
-         * nothing went wrong */
-        error = 0;
-
         /* add additional host specific attributes */
         if (sdev->host->hostt->sdev_attrs) {
                 for (i = 0; sdev->host->hostt->sdev_attrs[i]; i++) {
                         error = device_create_file(&sdev->sdev_gendev,
                                         sdev->host->hostt->sdev_attrs[i]);
-                        if (error) {
-                                __scsi_remove_device(sdev);
-                                goto out;
-                        }
+                        if (error)
+                                goto out_remove;
                 }
         }
 
-        transport_add_device(&sdev->sdev_gendev);
- out:
-        return error;
-
- clean_device:
-        scsi_device_set_state(sdev, SDEV_CANCEL);
-
-        device_del(&sdev->sdev_gendev);
-        transport_destroy_device(&sdev->sdev_gendev);
-        put_device(&sdev->sdev_dev);
-        put_device(&sdev->sdev_gendev);
+        return 0;
 
+ out_remove:
+        __scsi_remove_device(sdev);
         return error;
+
 }
 
 void __scsi_remove_device(struct scsi_device *sdev)
 {
         struct device *dev = &sdev->sdev_gendev;
 
-        if (scsi_device_set_state(sdev, SDEV_CANCEL) != 0)
-                return;
+        if (sdev->is_visible) {
+                if (scsi_device_set_state(sdev, SDEV_CANCEL) != 0)
+                        return;
 
-        bsg_unregister_queue(sdev->request_queue);
-        device_unregister(&sdev->sdev_dev);
-        transport_remove_device(dev);
-        device_del(dev);
+                bsg_unregister_queue(sdev->request_queue);
+                device_unregister(&sdev->sdev_dev);
+                transport_remove_device(dev);
+                device_del(dev);
+        } else
+                put_device(&sdev->sdev_dev);
         scsi_device_set_state(sdev, SDEV_DEL);
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
index 88da97745710..84be62149c6c 100644
--- a/drivers/scsi/sd_dif.c
+++ b/drivers/scsi/sd_dif.c
@@ -418,7 +418,7 @@ error:
                   __func__, virt, phys, be32_to_cpu(sdt->ref_tag),
                   be16_to_cpu(sdt->app_tag));
 
-        return -EIO;
+        return -EILSEQ;
 }
 
 /*
diff --git a/drivers/serial/suncore.c b/drivers/serial/suncore.c
index a2d4a19550ab..ed7d958b0a01 100644
--- a/drivers/serial/suncore.c
+++ b/drivers/serial/suncore.c
@@ -53,20 +53,21 @@ void sunserial_unregister_minors(struct uart_driver *drv, int count)
 EXPORT_SYMBOL(sunserial_unregister_minors);
 
 int sunserial_console_match(struct console *con, struct device_node *dp,
-                            struct uart_driver *drv, int line)
+                            struct uart_driver *drv, int line, bool ignore_line)
 {
-        int off;
-
         if (!con || of_console_device != dp)
                 return 0;
 
-        off = 0;
-        if (of_console_options &&
-            *of_console_options == 'b')
-                off = 1;
+        if (!ignore_line) {
+                int off = 0;
 
-        if ((line & 1) != off)
-                return 0;
+                if (of_console_options &&
+                    *of_console_options == 'b')
+                        off = 1;
+
+                if ((line & 1) != off)
+                        return 0;
+        }
 
         con->index = line;
         drv->cons = con;
@@ -76,23 +77,24 @@ int sunserial_console_match(struct console *con, struct device_node *dp,
 }
 EXPORT_SYMBOL(sunserial_console_match);
 
-void
-sunserial_console_termios(struct console *con)
+void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
 {
-        struct device_node *dp;
-        const char *od, *mode, *s;
+        const char *mode, *s;
         char mode_prop[] = "ttyX-mode";
         int baud, bits, stop, cflag;
         char parity;
 
-        dp = of_find_node_by_path("/options");
-        od = of_get_property(dp, "output-device", NULL);
-        if (!strcmp(od, "rsc")) {
-                mode = of_get_property(of_console_device,
+        if (!strcmp(uart_dp->name, "rsc") ||
+            !strcmp(uart_dp->name, "rsc-console") ||
+            !strcmp(uart_dp->name, "rsc-control")) {
+                mode = of_get_property(uart_dp,
                                        "ssp-console-modes", NULL);
                 if (!mode)
                         mode = "115200,8,n,1,-";
+        } else if (!strcmp(uart_dp->name, "lom-console")) {
+                mode = "9600,8,n,1,-";
         } else {
+                struct device_node *dp;
                 char c;
 
                 c = 'a';
@@ -101,6 +103,7 @@ sunserial_console_termios(struct console *con)
 
                 mode_prop[3] = c;
 
+                dp = of_find_node_by_path("/options");
                 mode = of_get_property(dp, mode_prop, NULL);
                 if (!mode)
                         mode = "9600,8,n,1,-";
diff --git a/drivers/serial/suncore.h b/drivers/serial/suncore.h
index 042668aa602e..db2057936c31 100644
--- a/drivers/serial/suncore.h
+++ b/drivers/serial/suncore.h
@@ -26,7 +26,8 @@ extern int sunserial_register_minors(struct uart_driver *, int);
 extern void sunserial_unregister_minors(struct uart_driver *, int);
 
 extern int sunserial_console_match(struct console *, struct device_node *,
-                                   struct uart_driver *, int);
-extern void sunserial_console_termios(struct console *);
+                                   struct uart_driver *, int, bool);
+extern void sunserial_console_termios(struct console *,
+                                      struct device_node *);
 
 #endif /* !(_SERIAL_SUN_H) */
diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c
index d548652dee50..d14cca7fb88d 100644
--- a/drivers/serial/sunhv.c
+++ b/drivers/serial/sunhv.c
@@ -566,7 +566,7 @@ static int __devinit hv_probe(struct of_device *op, const struct of_device_id *m
                 goto out_free_con_read_page;
 
         sunserial_console_match(&sunhv_console, op->node,
-                                &sunhv_reg, port->line);
+                                &sunhv_reg, port->line, false);
 
         err = uart_add_one_port(&sunhv_reg, port);
         if (err)
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index d1ad34128635..d514e28d0755 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -883,7 +883,7 @@ static int sunsab_console_setup(struct console *con, char *options)
         printk("Console: ttyS%d (SAB82532)\n",
                (sunsab_reg.minor - 64) + con->index);
 
-        sunserial_console_termios(con);
+        sunserial_console_termios(con, to_of_device(up->port.dev)->node);
 
         switch (con->cflag & CBAUD) {
         case B150: baud = 150; break;
@@ -1027,10 +1027,12 @@ static int __devinit sab_probe(struct of_device *op, const struct of_device_id *
                 goto out1;
 
         sunserial_console_match(SUNSAB_CONSOLE(), op->node,
-                                &sunsab_reg, up[0].port.line);
+                                &sunsab_reg, up[0].port.line,
+                                false);
 
         sunserial_console_match(SUNSAB_CONSOLE(), op->node,
-                                &sunsab_reg, up[1].port.line);
+                                &sunsab_reg, up[1].port.line,
+                                false);
 
         err = uart_add_one_port(&sunsab_reg, &up[0].port);
         if (err)
@@ -1116,7 +1118,6 @@ static int __init sunsab_init(void)
                 if (!sunsab_ports)
                         return -ENOMEM;
 
-                sunsab_reg.cons = SUNSAB_CONSOLE();
                 err = sunserial_register_minors(&sunsab_reg, num_channels);
                 if (err) {
                         kfree(sunsab_ports);
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index 68d262b15749..170d3d68c8f0 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1329,11 +1329,9 @@ static void sunsu_console_write(struct console *co, const char *s,
  */
 static int __init sunsu_console_setup(struct console *co, char *options)
 {
+        static struct ktermios dummy;
+        struct ktermios termios;
         struct uart_port *port;
-        int baud = 9600;
-        int bits = 8;
-        int parity = 'n';
-        int flow = 'n';
 
         printk("Console: ttyS%d (SU)\n",
                (sunsu_reg.minor - 64) + co->index);
@@ -1352,10 +1350,15 @@ static int __init sunsu_console_setup(struct console *co, char *options)
          */
         spin_lock_init(&port->lock);
 
-        if (options)
-                uart_parse_options(options, &baud, &parity, &bits, &flow);
+        /* Get firmware console settings.  */
+        sunserial_console_termios(co, to_of_device(port->dev)->node);
 
-        return uart_set_options(port, co, baud, parity, bits, flow);
+        memset(&termios, 0, sizeof(struct ktermios));
+        termios.c_cflag = co->cflag;
+        port->mctrl |= TIOCM_DTR;
+        port->ops->set_termios(port, &termios, &dummy);
+
+        return 0;
 }
 
 static struct console sunsu_console = {
@@ -1409,6 +1412,7 @@ static int __devinit su_probe(struct of_device *op, const struct of_device_id *m
         struct uart_sunsu_port *up;
         struct resource *rp;
         enum su_type type;
+        bool ignore_line;
         int err;
 
         type = su_get_type(dp);
@@ -1467,8 +1471,14 @@ static int __devinit su_probe(struct of_device *op, const struct of_device_id *m
 
         up->port.ops = &sunsu_pops;
 
+        ignore_line = false;
+        if (!strcmp(dp->name, "rsc-console") ||
+            !strcmp(dp->name, "lom-console"))
+                ignore_line = true;
+
         sunserial_console_match(SUNSU_CONSOLE(), dp,
-                                &sunsu_reg, up->port.line);
+                                &sunsu_reg, up->port.line,
+                                ignore_line);
         err = uart_add_one_port(&sunsu_reg, &up->port);
         if (err)
                 goto out_unmap;
@@ -1517,6 +1527,10 @@ static const struct of_device_id su_match[] = {
                 .name = "serial",
                 .compatible = "su",
         },
+        {
+                .type = "serial",
+                .compatible = "su",
+        },
         {},
 };
 MODULE_DEVICE_TABLE(of, su_match);
@@ -1548,6 +1562,12 @@ static int __init sunsu_init(void)
                                 num_uart++;
                 }
         }
+        for_each_node_by_type(dp, "serial") {
+                if (of_device_is_compatible(dp, "su")) {
+                        if (su_get_type(dp) == SU_PORT_PORT)
+                                num_uart++;
+                }
+        }
 
         if (num_uart) {
                 err = sunserial_register_minors(&sunsu_reg, num_uart);
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index ef693ae22e7f..2c7a66af4f52 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1180,7 +1180,7 @@ static int __init sunzilog_console_setup(struct console *con, char *options)
                (sunzilog_reg.minor - 64) + con->index, con->index);
 
         /* Get firmware console settings.  */
-        sunserial_console_termios(con);
+        sunserial_console_termios(con, to_of_device(up->port.dev)->node);
 
         /* Firmware console speed is limited to 150-->38400 baud so
          * this hackish cflag thing is OK.
@@ -1416,7 +1416,8 @@ static int __devinit zs_probe(struct of_device *op, const struct of_device_id *m
 
         if (!keyboard_mouse) {
                 if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
-                                            &sunzilog_reg, up[0].port.line))
+                                            &sunzilog_reg, up[0].port.line,
+                                            false))
                         up->flags |= SUNZILOG_FLAG_IS_CONS;
                 err = uart_add_one_port(&sunzilog_reg, &up[0].port);
                 if (err) {
@@ -1425,7 +1426,8 @@ static int __devinit zs_probe(struct of_device *op, const struct of_device_id *m
                         return err;
                 }
                 if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
-                                            &sunzilog_reg, up[1].port.line))
+                                            &sunzilog_reg, up[1].port.line,
+                                            false))
                         up->flags |= SUNZILOG_FLAG_IS_CONS;
                 err = uart_add_one_port(&sunzilog_reg, &up[1].port);
                 if (err) {
diff --git a/drivers/staging/go7007/s2250-board.c b/drivers/staging/go7007/s2250-board.c
index 8c85a9c3665a..f4a6541c3e60 100644
--- a/drivers/staging/go7007/s2250-board.c
+++ b/drivers/staging/go7007/s2250-board.c
@@ -261,7 +261,7 @@ static int read_reg_fp(struct i2c_client *client, u16 addr, u16 *val)
 
         memset(buf, 0xcd, 6);
         usb = go->hpi_context;
-        if (down_interruptible(&usb->i2c_lock) != 0) {
+        if (mutex_lock_interruptible(&usb->i2c_lock) != 0) {
                 printk(KERN_INFO "i2c lock failed\n");
                 kfree(buf);
                 return -EINTR;
@@ -270,7 +270,7 @@ static int read_reg_fp(struct i2c_client *client, u16 addr, u16 *val)
                 kfree(buf);
                 return -EFAULT;
         }
-        up(&usb->i2c_lock);
+        mutex_unlock(&usb->i2c_lock);
 
         *val = (buf[0] << 8) | buf[1];
         kfree(buf);
diff --git a/drivers/staging/go7007/s2250-loader.h b/drivers/staging/go7007/s2250-loader.h
new file mode 100644
index 000000000000..b7c301af16cc
--- /dev/null
+++ b/drivers/staging/go7007/s2250-loader.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2005-2006 Micronas USA Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (Version 2) as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+ */
+
+#ifndef _S2250_LOADER_H_
+#define _S2250_LOADER_H_
+
+extern int s2250loader_init(void);
+extern void s2250loader_cleanup(void);
+
+#endif
diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
index 42230e62a222..31a58e508924 100644
--- a/drivers/staging/octeon/ethernet-mdio.c
+++ b/drivers/staging/octeon/ethernet-mdio.c
@@ -170,7 +170,7 @@ static u32 cvm_oct_get_link(struct net_device *dev)
         return ret;
 }
 
-struct const ethtool_ops cvm_oct_ethtool_ops = {
+const struct ethtool_ops cvm_oct_ethtool_ops = {
         .get_drvinfo = cvm_oct_get_drvinfo,
         .get_settings = cvm_oct_get_settings,
         .set_settings = cvm_oct_set_settings,
diff --git a/drivers/staging/octeon/ethernet-spi.c b/drivers/staging/octeon/ethernet-spi.c
index 66190b0cb68f..00dc0f4bad19 100644
--- a/drivers/staging/octeon/ethernet-spi.c
+++ b/drivers/staging/octeon/ethernet-spi.c
@@ -317,6 +317,6 @@ void cvm_oct_spi_uninit(struct net_device *dev)
                         cvmx_write_csr(CVMX_SPXX_INT_MSK(interface), 0);
                         cvmx_write_csr(CVMX_STXX_INT_MSK(interface), 0);
                 }
-                free_irq(8 + 46, &number_spi_ports);
+                free_irq(OCTEON_IRQ_RML, &number_spi_ports);
         }
 }
diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index b8479517dce2..492c5029992d 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -111,6 +111,16 @@ MODULE_PARM_DESC(disable_core_queueing, "\n"
         "\tallows packets to be sent without lock contention in the packet\n"
         "\tscheduler resulting in some cases in improved throughput.\n");
 
+
+/*
+ * The offset from mac_addr_base that should be used for the next port
+ * that is configured.  By convention, if any mgmt ports exist on the
+ * chip, they get the first mac addresses, The ports controlled by
+ * this driver are numbered sequencially following any mgmt addresses
+ * that may exist.
+ */
+static unsigned int cvm_oct_mac_addr_offset;
+
 /**
  * Periodic timer to check auto negotiation
  */
@@ -474,16 +484,30 @@ static int cvm_oct_common_set_mac_address(struct net_device *dev, void *addr)
  */
 int cvm_oct_common_init(struct net_device *dev)
 {
-        static int count;
-        char mac[8] = { 0x00, 0x00,
-                octeon_bootinfo->mac_addr_base[0],
-                octeon_bootinfo->mac_addr_base[1],
-                octeon_bootinfo->mac_addr_base[2],
-                octeon_bootinfo->mac_addr_base[3],
-                octeon_bootinfo->mac_addr_base[4],
-                octeon_bootinfo->mac_addr_base[5] + count
-        };
         struct octeon_ethernet *priv = netdev_priv(dev);
+        struct sockaddr sa;
+        u64 mac = ((u64)(octeon_bootinfo->mac_addr_base[0] & 0xff) << 40) |
+                ((u64)(octeon_bootinfo->mac_addr_base[1] & 0xff) << 32) |
+                ((u64)(octeon_bootinfo->mac_addr_base[2] & 0xff) << 24) |
+                ((u64)(octeon_bootinfo->mac_addr_base[3] & 0xff) << 16) |
+                ((u64)(octeon_bootinfo->mac_addr_base[4] & 0xff) << 8) |
+                (u64)(octeon_bootinfo->mac_addr_base[5] & 0xff);
+
+        mac += cvm_oct_mac_addr_offset;
+        sa.sa_data[0] = (mac >> 40) & 0xff;
+        sa.sa_data[1] = (mac >> 32) & 0xff;
+        sa.sa_data[2] = (mac >> 24) & 0xff;
+        sa.sa_data[3] = (mac >> 16) & 0xff;
+        sa.sa_data[4] = (mac >> 8) & 0xff;
+        sa.sa_data[5] = mac & 0xff;
+
+        if (cvm_oct_mac_addr_offset >= octeon_bootinfo->mac_addr_count)
+                printk(KERN_DEBUG "%s: Using MAC outside of the assigned range:"
+                        " %02x:%02x:%02x:%02x:%02x:%02x\n", dev->name,
+                        sa.sa_data[0] & 0xff, sa.sa_data[1] & 0xff,
+                        sa.sa_data[2] & 0xff, sa.sa_data[3] & 0xff,
+                        sa.sa_data[4] & 0xff, sa.sa_data[5] & 0xff);
+        cvm_oct_mac_addr_offset++;
 
         /*
          * Force the interface to use the POW send if always_use_pow
@@ -496,14 +520,12 @@ int cvm_oct_common_init(struct net_device *dev)
         if (priv->queue != -1 && USE_HW_TCPUDP_CHECKSUM)
                 dev->features |= NETIF_F_IP_CSUM;
 
-        count++;
-
         /* We do our own locking, Linux doesn't need to */
         dev->features |= NETIF_F_LLTX;
         SET_ETHTOOL_OPS(dev, &cvm_oct_ethtool_ops);
 
         cvm_oct_mdio_setup_device(dev);
-        dev->netdev_ops->ndo_set_mac_address(dev, mac);
+        dev->netdev_ops->ndo_set_mac_address(dev, &sa);
         dev->netdev_ops->ndo_change_mtu(dev, dev->mtu);
 
         /*
@@ -620,6 +642,13 @@ static int __init cvm_oct_init_module(void)
 
         pr_notice("cavium-ethernet %s\n", OCTEON_ETHERNET_VERSION);
 
+        if (OCTEON_IS_MODEL(OCTEON_CN52XX))
+                cvm_oct_mac_addr_offset = 2; /* First two are the mgmt ports. */
+        else if (OCTEON_IS_MODEL(OCTEON_CN56XX))
+                cvm_oct_mac_addr_offset = 1; /* First one is the mgmt port. */
+        else
+                cvm_oct_mac_addr_offset = 0;
+
         cvm_oct_proc_initialize();
         cvm_oct_rx_initialize();
         cvm_oct_configure_common_hw();
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index f24d04132eda..4d227b152001 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -317,7 +317,7 @@ static int __devexit pnx4008_wdt_remove(struct platform_device *pdev)
 
 static struct platform_driver platform_wdt_driver = {
         .driver = {
-                .name = "watchdog",
+                .name = "pnx4008-watchdog",
                 .owner  = THIS_MODULE,
         },
         .probe = pnx4008_wdt_probe,
@@ -352,4 +352,4 @@ MODULE_PARM_DESC(nowayout,
 
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
-MODULE_ALIAS("platform:watchdog");
+MODULE_ALIAS("platform:pnx4008-watchdog");
diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index 51c94e26a346..bcc5357a9069 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -343,18 +343,7 @@ int __v9fs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!vcookie->fscache);
 
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vcookie->fscache, page)) {
-                        if (!(gfp & __GFP_WAIT))
-                                return 0;
-                        fscache_wait_on_page_write(vcookie->fscache, page);
-                }
-
-                fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
-        }
-
-        return 1;
+        return fscache_maybe_release_page(vnode->cache, page, gfp);
 }
 
 void __v9fs_fscache_invalidate_page(struct page *page)
@@ -368,7 +357,6 @@ void __v9fs_fscache_invalidate_page(struct page *page)
                 fscache_wait_on_page_write(vcookie->fscache, page);
                 BUG_ON(!PageLocked(page));
                 fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
         }
 }
 
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 681c2a7b013f..39b301662f22 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -315,7 +315,6 @@ static void afs_invalidatepage(struct page *page, unsigned long offset)
                         struct afs_vnode *vnode = AFS_FS_I(page->mapping->host);
                         fscache_wait_on_page_write(vnode->cache, page);
                         fscache_uncache_page(vnode->cache, page);
-                        ClearPageFsCache(page);
                 }
 #endif
 
@@ -349,17 +348,9 @@ static int afs_releasepage(struct page *page, gfp_t gfp_flags)
         /* deny if page is being written to the cache and the caller hasn't
          * elected to wait */
 #ifdef CONFIG_AFS_FSCACHE
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vnode->cache, page)) {
-                        if (!(gfp_flags & __GFP_WAIT)) {
-                                _leave(" = F [cache busy]");
-                                return 0;
-                        }
-                        fscache_wait_on_page_write(vnode->cache, page);
-                }
-
-                fscache_uncache_page(vnode->cache, page);
-                ClearPageFsCache(page);
+        if (!fscache_maybe_release_page(vnode->cache, page, gfp_flags)) {
+                _leave(" = F [cache busy]");
+                return 0;
         }
 #endif
 
diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c
index 431accd475a7..27089311fbea 100644
--- a/fs/cachefiles/interface.c
+++ b/fs/cachefiles/interface.c
@@ -114,8 +114,9 @@ nomem_lookup_data:
 
 /*
  * attempt to look up the nominated node in this cache
+ * - return -ETIMEDOUT to be scheduled again
  */
-static void cachefiles_lookup_object(struct fscache_object *_object)
+static int cachefiles_lookup_object(struct fscache_object *_object)
 {
         struct cachefiles_lookup_data *lookup_data;
         struct cachefiles_object *parent, *object;
@@ -145,13 +146,15 @@ static void cachefiles_lookup_object(struct fscache_object *_object)
             object->fscache.cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
                 cachefiles_attr_changed(&object->fscache);
 
-        if (ret < 0) {
-                printk(KERN_WARNING "CacheFiles: Lookup failed error %d\n",
-                       ret);
+        if (ret < 0 && ret != -ETIMEDOUT) {
+                if (ret != -ENOBUFS)
+                        printk(KERN_WARNING
+                               "CacheFiles: Lookup failed error %d\n", ret);
                 fscache_object_lookup_error(&object->fscache);
         }
 
         _leave(" [%d]", ret);
+        return ret;
 }
 
 /*
@@ -331,6 +334,7 @@ static void cachefiles_put_object(struct fscache_object *_object)
                 }
 
                 cache = object->fscache.cache;
+                fscache_object_destroy(&object->fscache);
                 kmem_cache_free(cachefiles_object_jar, object);
                 fscache_object_destroyed(cache);
         }
@@ -403,12 +407,26 @@ static int cachefiles_attr_changed(struct fscache_object *_object)
         if (oi_size == ni_size)
                 return 0;
 
-        newattrs.ia_size = ni_size;
-        newattrs.ia_valid = ATTR_SIZE;
-
         cachefiles_begin_secure(cache, &saved_cred);
         mutex_lock(&object->backer->d_inode->i_mutex);
+
+        /* if there's an extension to a partial page at the end of the backing
+         * file, we need to discard the partial page so that we pick up new
+         * data after it */
+        if (oi_size & ~PAGE_MASK && ni_size > oi_size) {
+                _debug("discard tail %llx", oi_size);
+                newattrs.ia_valid = ATTR_SIZE;
+                newattrs.ia_size = oi_size & PAGE_MASK;
+                ret = notify_change(object->backer, &newattrs);
+                if (ret < 0)
+                        goto truncate_failed;
+        }
+
+        newattrs.ia_valid = ATTR_SIZE;
+        newattrs.ia_size = ni_size;
         ret = notify_change(object->backer, &newattrs);
+
+truncate_failed:
         mutex_unlock(&object->backer->d_inode->i_mutex);
         cachefiles_end_secure(cache, saved_cred);
 
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 4ce818ae39ea..14ac4806e291 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -21,17 +21,81 @@
 #include <linux/security.h>
 #include "internal.h"
 
-static int cachefiles_wait_bit(void *flags)
+#define CACHEFILES_KEYBUF_SIZE 512
+
+/*
+ * dump debugging info about an object
+ */
+static noinline
+void __cachefiles_printk_object(struct cachefiles_object *object,
+                                const char *prefix,
+                                u8 *keybuf)
 {
-        schedule();
-        return 0;
+        struct fscache_cookie *cookie;
+        unsigned keylen, loop;
+
+        printk(KERN_ERR "%sobject: OBJ%x\n",
+               prefix, object->fscache.debug_id);
+        printk(KERN_ERR "%sobjstate=%s fl=%lx swfl=%lx ev=%lx[%lx]\n",
+               prefix, fscache_object_states[object->fscache.state],
+               object->fscache.flags, object->fscache.work.flags,
+               object->fscache.events,
+               object->fscache.event_mask & FSCACHE_OBJECT_EVENTS_MASK);
+        printk(KERN_ERR "%sops=%u inp=%u exc=%u\n",
+               prefix, object->fscache.n_ops, object->fscache.n_in_progress,
+               object->fscache.n_exclusive);
+        printk(KERN_ERR "%sparent=%p\n",
+               prefix, object->fscache.parent);
+
+        spin_lock(&object->fscache.lock);
+        cookie = object->fscache.cookie;
+        if (cookie) {
+                printk(KERN_ERR "%scookie=%p [pr=%p nd=%p fl=%lx]\n",
+                       prefix,
+                       object->fscache.cookie,
+                       object->fscache.cookie->parent,
+                       object->fscache.cookie->netfs_data,
+                       object->fscache.cookie->flags);
+                if (keybuf)
+                        keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
+                                                      CACHEFILES_KEYBUF_SIZE);
+                else
+                        keylen = 0;
+        } else {
+                printk(KERN_ERR "%scookie=NULL\n", prefix);
+                keylen = 0;
+        }
+        spin_unlock(&object->fscache.lock);
+
+        if (keylen) {
+                printk(KERN_ERR "%skey=[%u] '", prefix, keylen);
+                for (loop = 0; loop < keylen; loop++)
+                        printk("%02x", keybuf[loop]);
+                printk("'\n");
+        }
+}
+
+/*
+ * dump debugging info about a pair of objects
+ */
+static noinline void cachefiles_printk_object(struct cachefiles_object *object,
+                                              struct cachefiles_object *xobject)
+{
+        u8 *keybuf;
+
+        keybuf = kmalloc(CACHEFILES_KEYBUF_SIZE, GFP_NOIO);
+        if (object)
+                __cachefiles_printk_object(object, "", keybuf);
+        if (xobject)
+                __cachefiles_printk_object(xobject, "x", keybuf);
+        kfree(keybuf);
 }
 
 /*
  * record the fact that an object is now active
  */
-static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
-                                          struct cachefiles_object *object)
+static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
+                                         struct cachefiles_object *object)
 {
         struct cachefiles_object *xobject;
         struct rb_node **_p, *_parent = NULL;
@@ -42,8 +106,11 @@ static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
 try_again:
         write_lock(&cache->active_lock);
 
-        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags))
+        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
+                printk(KERN_ERR "CacheFiles: Error: Object already active\n");
+                cachefiles_printk_object(object, NULL);
                 BUG();
+        }
 
         dentry = object->dentry;
         _p = &cache->active_nodes.rb_node;
@@ -66,8 +133,8 @@ try_again:
         rb_insert_color(&object->active_node, &cache->active_nodes);
 
         write_unlock(&cache->active_lock);
-        _leave("");
-        return;
+        _leave(" = 0");
+        return 0;
 
         /* an old object from a previous incarnation is hogging the slot - we
          * need to wait for it to be destroyed */
@@ -76,44 +143,70 @@ wait_for_old_object:
                 printk(KERN_ERR "\n");
                 printk(KERN_ERR "CacheFiles: Error:"
                        " Unexpected object collision\n");
-                printk(KERN_ERR "xobject: OBJ%x\n",
-                       xobject->fscache.debug_id);
-                printk(KERN_ERR "xobjstate=%s\n",
-                       fscache_object_states[xobject->fscache.state]);
-                printk(KERN_ERR "xobjflags=%lx\n", xobject->fscache.flags);
-                printk(KERN_ERR "xobjevent=%lx [%lx]\n",
-                       xobject->fscache.events, xobject->fscache.event_mask);
-                printk(KERN_ERR "xops=%u inp=%u exc=%u\n",
-                       xobject->fscache.n_ops, xobject->fscache.n_in_progress,
-                       xobject->fscache.n_exclusive);
-                printk(KERN_ERR "xcookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       xobject->fscache.cookie,
-                       xobject->fscache.cookie->parent,
-                       xobject->fscache.cookie->netfs_data,
-                       xobject->fscache.cookie->flags);
-                printk(KERN_ERR "xparent=%p\n",
-                       xobject->fscache.parent);
-                printk(KERN_ERR "object: OBJ%x\n",
-                       object->fscache.debug_id);
-                printk(KERN_ERR "cookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       object->fscache.cookie,
-                       object->fscache.cookie->parent,
-                       object->fscache.cookie->netfs_data,
-                       object->fscache.cookie->flags);
-                printk(KERN_ERR "parent=%p\n",
-                       object->fscache.parent);
+                cachefiles_printk_object(object, xobject);
                 BUG();
         }
         atomic_inc(&xobject->usage);
         write_unlock(&cache->active_lock);
 
-        _debug(">>> wait");
-        wait_on_bit(&xobject->flags, CACHEFILES_OBJECT_ACTIVE,
-                    cachefiles_wait_bit, TASK_UNINTERRUPTIBLE);
-        _debug("<<< waited");
+        if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                wait_queue_head_t *wq;
+
+                signed long timeout = 60 * HZ;
+                wait_queue_t wait;
+                bool requeue;
+
+                /* if the object we're waiting for is queued for processing,
+                 * then just put ourselves on the queue behind it */
+                if (slow_work_is_queued(&xobject->fscache.work)) {
+                        _debug("queue OBJ%x behind OBJ%x immediately",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                /* otherwise we sleep until either the object we're waiting for
+                 * is done, or the slow-work facility wants the thread back to
+                 * do other work */
+                wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
+                init_wait(&wait);
+                requeue = false;
+                do {
+                        prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
+                        if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
+                                break;
+                        requeue = slow_work_sleep_till_thread_needed(
+                                &object->fscache.work, &timeout);
+                } while (timeout > 0 && !requeue);
+                finish_wait(wq, &wait);
+
+                if (requeue &&
+                    test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                        _debug("queue OBJ%x behind OBJ%x after wait",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                if (timeout <= 0) {
+                        printk(KERN_ERR "\n");
+                        printk(KERN_ERR "CacheFiles: Error: Overlong"
+                               " wait for old active object to go away\n");
+                        cachefiles_printk_object(object, xobject);
+                        goto requeue;
+                }
+        }
+
+        ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
 
         cache->cache.ops->put_object(&xobject->fscache);
         goto try_again;
+
+requeue:
+        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
+        cache->cache.ops->put_object(&xobject->fscache);
+        _leave(" = -ETIMEDOUT");
+        return -ETIMEDOUT;
 }
 
 /*
@@ -254,7 +347,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
 
         dir = dget_parent(object->dentry);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
         ret = cachefiles_bury_object(cache, dir, object->dentry);
 
         dput(dir);
@@ -307,7 +400,7 @@ lookup_again:
         /* search the current directory for the element name */
         _debug("lookup '%s'", name);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
 
         start = jiffies;
         next = lookup_one_len(name, dir, nlen);
@@ -418,12 +511,15 @@ lookup_again:
         }
 
         /* note that we're now using this object */
-        cachefiles_mark_object_active(cache, object);
+        ret = cachefiles_mark_object_active(cache, object);
 
         mutex_unlock(&dir->d_inode->i_mutex);
         dput(dir);
         dir = NULL;
 
+        if (ret == -ETIMEDOUT)
+                goto mark_active_timed_out;
+
         _debug("=== OBTAINED_OBJECT ===");
 
         if (object->new) {
@@ -467,6 +563,10 @@ create_error:
                 cachefiles_io_error(cache, "Create/mkdir failed");
         goto error;
 
+mark_active_timed_out:
+        _debug("mark active timed out");
+        goto release_dentry;
+
 check_error:
         _debug("check error %d", ret);
         write_lock(&cache->active_lock);
@@ -474,7 +574,7 @@ check_error:
         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
         wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
         write_unlock(&cache->active_lock);
-
+release_dentry:
         dput(object->dentry);
         object->dentry = NULL;
         goto error_out;
@@ -495,9 +595,6 @@ error:
 error_out2:
         dput(dir);
 error_out:
-        if (ret == -ENOSPC)
-                ret = -ENOBUFS;
-
         _leave(" = error %d", -ret);
         return ret;
 }
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index a69787e7dd96..1d8332563863 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -40,8 +40,10 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 
         _debug("--- monitor %p %lx ---", page, page->flags);
 
-        if (!PageUptodate(page) && !PageError(page))
-                dump_stack();
+        if (!PageUptodate(page) && !PageError(page)) {
+                /* unlocked, not uptodate and not erronous? */
+                _debug("page probably truncated");
+        }
 
         /* remove from the waitqueue */
         list_del(&wait->task_list);
@@ -61,6 +63,84 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 }
 
 /*
+ * handle a probably truncated page
+ * - check to see if the page is still relevant and reissue the read if
+ *   possible
+ * - return -EIO on error, -ENODATA if the page is gone, -EINPROGRESS if we
+ *   must wait again and 0 if successful
+ */
+static int cachefiles_read_reissue(struct cachefiles_object *object,
+                                   struct cachefiles_one_read *monitor)
+{
+        struct address_space *bmapping = object->backer->d_inode->i_mapping;
+        struct page *backpage = monitor->back_page, *backpage2;
+        int ret;
+
+        kenter("{ino=%lx},{%lx,%lx}",
+               object->backer->d_inode->i_ino,
+               backpage->index, backpage->flags);
+
+        /* skip if the page was truncated away completely */
+        if (backpage->mapping != bmapping) {
+                kleave(" = -ENODATA [mapping]");
+                return -ENODATA;
+        }
+
+        backpage2 = find_get_page(bmapping, backpage->index);
+        if (!backpage2) {
+                kleave(" = -ENODATA [gone]");
+                return -ENODATA;
+        }
+
+        if (backpage != backpage2) {
+                put_page(backpage2);
+                kleave(" = -ENODATA [different]");
+                return -ENODATA;
+        }
+
+        /* the page is still there and we already have a ref on it, so we don't
+         * need a second */
+        put_page(backpage2);
+
+        INIT_LIST_HEAD(&monitor->op_link);
+        add_page_wait_queue(backpage, &monitor->monitor);
+
+        if (trylock_page(backpage)) {
+                ret = -EIO;
+                if (PageError(backpage))
+                        goto unlock_discard;
+                ret = 0;
+                if (PageUptodate(backpage))
+                        goto unlock_discard;
+
+                kdebug("reissue read");
+                ret = bmapping->a_ops->readpage(NULL, backpage);
+                if (ret < 0)
+                        goto unlock_discard;
+        }
+
+        /* but the page may have been read before the monitor was installed, so
+         * the monitor may miss the event - so we have to ensure that we do get
+         * one in such a case */
+        if (trylock_page(backpage)) {
+                _debug("jumpstart %p {%lx}", backpage, backpage->flags);
+                unlock_page(backpage);
+        }
+
+        /* it'll reappear on the todo list */
+        kleave(" = -EINPROGRESS");
+        return -EINPROGRESS;
+
+unlock_discard:
+        unlock_page(backpage);
+        spin_lock_irq(&object->work_lock);
+        list_del(&monitor->op_link);
+        spin_unlock_irq(&object->work_lock);
+        kleave(" = %d", ret);
+        return ret;
+}
+
+/*
  * copy data from backing pages to netfs pages to complete a read operation
  * - driven by FS-Cache's thread pool
  */
@@ -92,20 +172,26 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
 
                 _debug("- copy {%lu}", monitor->back_page->index);
 
-                error = -EIO;
+        recheck:
                 if (PageUptodate(monitor->back_page)) {
                         copy_highpage(monitor->netfs_page, monitor->back_page);
 
                         pagevec_add(&pagevec, monitor->netfs_page);
                         fscache_mark_pages_cached(monitor->op, &pagevec);
                         error = 0;
-                }
-
-                if (error)
+                } else if (!PageError(monitor->back_page)) {
+                        /* the page has probably been truncated */
+                        error = cachefiles_read_reissue(object, monitor);
+                        if (error == -EINPROGRESS)
+                                goto next;
+                        goto recheck;
+                } else {
                         cachefiles_io_error_obj(
                                 object,
                                 "Readpage failed on backing file %lx",
                                 (unsigned long) monitor->back_page->flags);
+                        error = -EIO;
+                }
 
                 page_cache_release(monitor->back_page);
 
@@ -114,6 +200,7 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
                 fscache_put_retrieval(op);
                 kfree(monitor);
 
+        next:
                 /* let the thread pool have some air occasionally */
                 max--;
                 if (max < 0 || need_resched()) {
@@ -333,7 +420,8 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op,
 
         shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits;
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         pagevec_init(&pagevec, 0);
@@ -639,7 +727,8 @@ int cachefiles_read_or_alloc_pages(struct fscache_retrieval *op,
 
         pagevec_init(&pagevec, 0);
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         INIT_LIST_HEAD(&backpages);
@@ -801,7 +890,8 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         struct cachefiles_cache *cache;
         mm_segment_t old_fs;
         struct file *file;
-        loff_t pos;
+        loff_t pos, eof;
+        size_t len;
         void *data;
         int ret;
 
@@ -835,15 +925,29 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
                 ret = -EIO;
                 if (file->f_op->write) {
                         pos = (loff_t) page->index << PAGE_SHIFT;
+
+                        /* we mustn't write more data than we have, so we have
+                         * to beware of a partial page at EOF */
+                        eof = object->fscache.store_limit_l;
+                        len = PAGE_SIZE;
+                        if (eof & ~PAGE_MASK) {
+                                ASSERTCMP(pos, <, eof);
+                                if (eof - pos < PAGE_SIZE) {
+                                        _debug("cut short %llx to %llx",
+                                               pos, eof);
+                                        len = eof - pos;
+                                        ASSERTCMP(pos + len, ==, eof);
+                                }
+                        }
+
                         data = kmap(page);
                         old_fs = get_fs();
                         set_fs(KERNEL_DS);
                         ret = file->f_op->write(
-                                file, (const void __user *) data, PAGE_SIZE,
-                                &pos);
+                                file, (const void __user *) data, len, &pos);
                         set_fs(old_fs);
                         kunmap(page);
-                        if (ret != PAGE_SIZE)
+                        if (ret != len)
                                 ret = -EIO;
                 }
                 fput(file);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 145540a316ab..094ea65afc85 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,12 @@
+Version 1.61
+------------
+Fix append problem to Samba servers (files opened with O_APPEND could
+have duplicated data). Fix oops in cifs_lookup. Workaround problem
+mounting to OS/400 Netserve. Fix oops in cifs_get_tcp_session.
+Disable use of server inode numbers when server only
+partially supports them (e.g. for one server querying inode numbers on
+FindFirst fails but QPathInfo queries works).
+
 Version 1.60
 -------------
 Fix memory leak in reconnect.  Fix oops in DFS mount error path.
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 9a5e4f5f3122..29f1da761bbf 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1037,7 +1037,7 @@ init_cifs(void)
         if (rc)
                 goto out_unregister_key_type;
 #endif
-        rc = slow_work_register_user();
+        rc = slow_work_register_user(THIS_MODULE);
         if (rc)
                 goto out_unregister_resolver_key;
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 627a60a6c1b1..1f42f772865a 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -214,8 +214,6 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
                 posix_flags |= SMB_O_EXCL;
         if (oflags & O_TRUNC)
                 posix_flags |= SMB_O_TRUNC;
-        if (oflags & O_APPEND)
-                posix_flags |= SMB_O_APPEND;
         if (oflags & O_SYNC)
                 posix_flags |= SMB_O_SYNC;
         if (oflags & O_DIRECTORY)
@@ -643,9 +641,9 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * O_EXCL: optimize away the lookup, but don't hash the dentry. Let
          * the VFS handle the create.
          */
-        if (nd->flags & LOOKUP_EXCL) {
+        if (nd && (nd->flags & LOOKUP_EXCL)) {
                 d_instantiate(direntry, NULL);
-                return 0;
+                return NULL;
         }
 
         /* can not grab the rename sem here since it would
@@ -675,7 +673,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * reduction in network traffic in the other paths.
          */
         if (pTcon->unix_ext) {
-                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+                if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
                      (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
                      (nd->intent.open.flags & O_CREAT)) {
                         rc = cifs_posix_open(full_path, &newInode, nd->path.mnt,
diff --git a/fs/fscache/Kconfig b/fs/fscache/Kconfig
index 9bbb8ce7bea0..864dac20a242 100644
--- a/fs/fscache/Kconfig
+++ b/fs/fscache/Kconfig
@@ -54,3 +54,10 @@ config FSCACHE_DEBUG
           enabled by setting bits in /sys/modules/fscache/parameter/debug.
 
           See Documentation/filesystems/caching/fscache.txt for more information.
+
+config FSCACHE_OBJECT_LIST
+        bool "Maintain global object list for debugging purposes"
+        depends on FSCACHE && PROC_FS
+        help
+          Maintain a global list of active fscache objects that can be
+          retrieved through /proc/fs/fscache/objects for debugging purposes
diff --git a/fs/fscache/Makefile b/fs/fscache/Makefile
index 91571b95aacc..6d561531cb36 100644
--- a/fs/fscache/Makefile
+++ b/fs/fscache/Makefile
@@ -15,5 +15,6 @@ fscache-y := \
 fscache-$(CONFIG_PROC_FS) += proc.o
 fscache-$(CONFIG_FSCACHE_STATS) += stats.o
 fscache-$(CONFIG_FSCACHE_HISTOGRAM) += histogram.o
+fscache-$(CONFIG_FSCACHE_OBJECT_LIST) += object-list.o
 
 obj-$(CONFIG_FSCACHE) := fscache.o
diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c
index e21985bbb1fb..6a3c48abd677 100644
--- a/fs/fscache/cache.c
+++ b/fs/fscache/cache.c
@@ -263,6 +263,7 @@ int fscache_add_cache(struct fscache_cache *cache,
         spin_lock(&cache->object_list_lock);
         list_add_tail(&ifsdef->cache_link, &cache->object_list);
         spin_unlock(&cache->object_list_lock);
+        fscache_objlist_add(ifsdef);
 
         /* add the cache's netfs definition index object to the top level index
          * cookie as a known backing object */
@@ -380,11 +381,15 @@ void fscache_withdraw_cache(struct fscache_cache *cache)
 
         /* make sure all pages pinned by operations on behalf of the netfs are
          * written to disk */
+        fscache_stat(&fscache_n_cop_sync_cache);
         cache->ops->sync_cache(cache);
+        fscache_stat_d(&fscache_n_cop_sync_cache);
 
         /* dissociate all the netfs pages backed by this cache from the block
          * mappings in the cache */
+        fscache_stat(&fscache_n_cop_dissociate_pages);
         cache->ops->dissociate_pages(cache);
+        fscache_stat_d(&fscache_n_cop_dissociate_pages);
 
         /* we now have to destroy all the active objects pertaining to this
          * cache - which we do by passing them off to thread pool to be
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 72fd18f6c71f..990535071a8a 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -36,6 +36,7 @@ void fscache_cookie_init_once(void *_cookie)
 
         memset(cookie, 0, sizeof(*cookie));
         spin_lock_init(&cookie->lock);
+        spin_lock_init(&cookie->stores_lock);
         INIT_HLIST_HEAD(&cookie->backing_objects);
 }
 
@@ -102,7 +103,9 @@ struct fscache_cookie *__fscache_acquire_cookie(
         cookie->netfs_data      = netfs_data;
         cookie->flags           = 0;
 
-        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS);
+        /* radix tree insertion won't use the preallocation pool unless it's
+         * told it may not wait */
+        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS & ~__GFP_WAIT);
 
         switch (cookie->def->type) {
         case FSCACHE_COOKIE_TYPE_INDEX:
@@ -249,7 +252,9 @@ static int fscache_alloc_object(struct fscache_cache *cache,
 
         /* ask the cache to allocate an object (we may end up with duplicate
          * objects at this stage, but we sort that out later) */
+        fscache_stat(&fscache_n_cop_alloc_object);
         object = cache->ops->alloc_object(cache, cookie);
+        fscache_stat_d(&fscache_n_cop_alloc_object);
         if (IS_ERR(object)) {
                 fscache_stat(&fscache_n_object_no_alloc);
                 ret = PTR_ERR(object);
@@ -270,8 +275,11 @@ static int fscache_alloc_object(struct fscache_cache *cache,
         /* only attach if we managed to allocate all we needed, otherwise
          * discard the object we just allocated and instead use the one
          * attached to the cookie */
-        if (fscache_attach_object(cookie, object) < 0)
+        if (fscache_attach_object(cookie, object) < 0) {
+                fscache_stat(&fscache_n_cop_put_object);
                 cache->ops->put_object(object);
+                fscache_stat_d(&fscache_n_cop_put_object);
+        }
 
         _leave(" = 0");
         return 0;
@@ -287,7 +295,9 @@ object_already_extant:
         return 0;
 
 error_put:
+        fscache_stat(&fscache_n_cop_put_object);
         cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 error:
         _leave(" = %d", ret);
         return ret;
@@ -349,6 +359,8 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
         object->cookie = cookie;
         atomic_inc(&cookie->usage);
         hlist_add_head(&object->cookie_link, &cookie->backing_objects);
+
+        fscache_objlist_add(object);
         ret = 0;
 
 cant_attach_object:
@@ -403,6 +415,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
         unsigned long event;
 
         fscache_stat(&fscache_n_relinquishes);
+        if (retire)
+                fscache_stat(&fscache_n_relinquishes_retire);
 
         if (!cookie) {
                 fscache_stat(&fscache_n_relinquishes_null);
@@ -428,12 +442,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
 
         event = retire ? FSCACHE_OBJECT_EV_RETIRE : FSCACHE_OBJECT_EV_RELEASE;
 
-        /* detach pointers back to the netfs */
         spin_lock(&cookie->lock);
 
-        cookie->netfs_data      = NULL;
-        cookie->def             = NULL;
-
         /* break links with all the active objects */
         while (!hlist_empty(&cookie->backing_objects)) {
                 object = hlist_entry(cookie->backing_objects.first,
@@ -456,6 +466,10 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
                         BUG();
         }
 
+        /* detach pointers back to the netfs */
+        cookie->netfs_data      = NULL;
+        cookie->def             = NULL;
+
         spin_unlock(&cookie->lock);
 
         if (cookie->parent) {
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index 1c341304621f..edd7434ab6e5 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -17,6 +17,7 @@
  * - cache->object_list_lock
  * - object->lock
  * - object->parent->lock
+ * - cookie->stores_lock
  * - fscache_thread_lock
  *
  */
@@ -88,17 +89,31 @@ extern int fscache_wait_bit_interruptible(void *);
 /*
  * object.c
  */
+extern const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5];
+
 extern void fscache_withdrawing_object(struct fscache_cache *,
                                        struct fscache_object *);
 extern void fscache_enqueue_object(struct fscache_object *);
 
 /*
+ * object-list.c
+ */
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+extern const struct file_operations fscache_objlist_fops;
+
+extern void fscache_objlist_add(struct fscache_object *);
+#else
+#define fscache_objlist_add(object) do {} while(0)
+#endif
+
+/*
  * operation.c
  */
 extern int fscache_submit_exclusive_op(struct fscache_object *,
                                        struct fscache_operation *);
 extern int fscache_submit_op(struct fscache_object *,
                              struct fscache_operation *);
+extern int fscache_cancel_op(struct fscache_operation *);
 extern void fscache_abort_object(struct fscache_object *);
 extern void fscache_start_operations(struct fscache_object *);
 extern void fscache_operation_gc(struct work_struct *);
@@ -127,6 +142,8 @@ extern atomic_t fscache_n_op_enqueue;
 extern atomic_t fscache_n_op_deferred_release;
 extern atomic_t fscache_n_op_release;
 extern atomic_t fscache_n_op_gc;
+extern atomic_t fscache_n_op_cancelled;
+extern atomic_t fscache_n_op_rejected;
 
 extern atomic_t fscache_n_attr_changed;
 extern atomic_t fscache_n_attr_changed_ok;
@@ -138,6 +155,8 @@ extern atomic_t fscache_n_allocs;
 extern atomic_t fscache_n_allocs_ok;
 extern atomic_t fscache_n_allocs_wait;
 extern atomic_t fscache_n_allocs_nobufs;
+extern atomic_t fscache_n_allocs_intr;
+extern atomic_t fscache_n_allocs_object_dead;
 extern atomic_t fscache_n_alloc_ops;
 extern atomic_t fscache_n_alloc_op_waits;
 
@@ -148,6 +167,7 @@ extern atomic_t fscache_n_retrievals_nodata;
 extern atomic_t fscache_n_retrievals_nobufs;
 extern atomic_t fscache_n_retrievals_intr;
 extern atomic_t fscache_n_retrievals_nomem;
+extern atomic_t fscache_n_retrievals_object_dead;
 extern atomic_t fscache_n_retrieval_ops;
 extern atomic_t fscache_n_retrieval_op_waits;
 
@@ -158,6 +178,14 @@ extern atomic_t fscache_n_stores_nobufs;
 extern atomic_t fscache_n_stores_oom;
 extern atomic_t fscache_n_store_ops;
 extern atomic_t fscache_n_store_calls;
+extern atomic_t fscache_n_store_pages;
+extern atomic_t fscache_n_store_radix_deletes;
+extern atomic_t fscache_n_store_pages_over_limit;
+
+extern atomic_t fscache_n_store_vmscan_not_storing;
+extern atomic_t fscache_n_store_vmscan_gone;
+extern atomic_t fscache_n_store_vmscan_busy;
+extern atomic_t fscache_n_store_vmscan_cancelled;
 
 extern atomic_t fscache_n_marks;
 extern atomic_t fscache_n_uncaches;
@@ -176,6 +204,7 @@ extern atomic_t fscache_n_updates_run;
 extern atomic_t fscache_n_relinquishes;
 extern atomic_t fscache_n_relinquishes_null;
 extern atomic_t fscache_n_relinquishes_waitcrt;
+extern atomic_t fscache_n_relinquishes_retire;
 
 extern atomic_t fscache_n_cookie_index;
 extern atomic_t fscache_n_cookie_data;
@@ -186,6 +215,7 @@ extern atomic_t fscache_n_object_no_alloc;
 extern atomic_t fscache_n_object_lookups;
 extern atomic_t fscache_n_object_lookups_negative;
 extern atomic_t fscache_n_object_lookups_positive;
+extern atomic_t fscache_n_object_lookups_timed_out;
 extern atomic_t fscache_n_object_created;
 extern atomic_t fscache_n_object_avail;
 extern atomic_t fscache_n_object_dead;
@@ -195,15 +225,41 @@ extern atomic_t fscache_n_checkaux_okay;
 extern atomic_t fscache_n_checkaux_update;
 extern atomic_t fscache_n_checkaux_obsolete;
 
+extern atomic_t fscache_n_cop_alloc_object;
+extern atomic_t fscache_n_cop_lookup_object;
+extern atomic_t fscache_n_cop_lookup_complete;
+extern atomic_t fscache_n_cop_grab_object;
+extern atomic_t fscache_n_cop_update_object;
+extern atomic_t fscache_n_cop_drop_object;
+extern atomic_t fscache_n_cop_put_object;
+extern atomic_t fscache_n_cop_sync_cache;
+extern atomic_t fscache_n_cop_attr_changed;
+extern atomic_t fscache_n_cop_read_or_alloc_page;
+extern atomic_t fscache_n_cop_read_or_alloc_pages;
+extern atomic_t fscache_n_cop_allocate_page;
+extern atomic_t fscache_n_cop_allocate_pages;
+extern atomic_t fscache_n_cop_write_page;
+extern atomic_t fscache_n_cop_uncache_page;
+extern atomic_t fscache_n_cop_dissociate_pages;
+
 static inline void fscache_stat(atomic_t *stat)
 {
         atomic_inc(stat);
 }
 
+static inline void fscache_stat_d(atomic_t *stat)
+{
+        atomic_dec(stat);
+}
+
+#define __fscache_stat(stat) (stat)
+
 extern const struct file_operations fscache_stats_fops;
 #else
 
+#define __fscache_stat(stat) (NULL)
 #define fscache_stat(stat) do {} while (0)
+#define fscache_stat_d(stat) do {} while (0)
 #endif
 
 /*
diff --git a/fs/fscache/main.c b/fs/fscache/main.c
index 4de41b597499..add6bdb53f04 100644
--- a/fs/fscache/main.c
+++ b/fs/fscache/main.c
@@ -48,7 +48,7 @@ static int __init fscache_init(void)
 {
         int ret;
 
-        ret = slow_work_register_user();
+        ret = slow_work_register_user(THIS_MODULE);
         if (ret < 0)
                 goto error_slow_work;
 
@@ -80,7 +80,7 @@ error_kobj:
 error_cookie_jar:
         fscache_proc_cleanup();
 error_proc:
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 error_slow_work:
         return ret;
 }
@@ -97,7 +97,7 @@ static void __exit fscache_exit(void)
         kobject_put(fscache_root);
         kmem_cache_destroy(fscache_cookie_jar);
         fscache_proc_cleanup();
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
         printk(KERN_NOTICE "FS-Cache: Unloaded\n");
 }
 
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
new file mode 100644
index 000000000000..e590242fa41a
--- /dev/null
+++ b/fs/fscache/object-list.c
@@ -0,0 +1,432 @@
+/* Global fscache object list maintainer and viewer
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define FSCACHE_DEBUG_LEVEL COOKIE
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/key.h>
+#include <keys/user-type.h>
+#include "internal.h"
+
+static struct rb_root fscache_object_list;
+static DEFINE_RWLOCK(fscache_object_list_lock);
+
+struct fscache_objlist_data {
+        unsigned long   config;         /* display configuration */
+#define FSCACHE_OBJLIST_CONFIG_KEY      0x00000001      /* show object keys */
+#define FSCACHE_OBJLIST_CONFIG_AUX      0x00000002      /* show object auxdata */
+#define FSCACHE_OBJLIST_CONFIG_COOKIE   0x00000004      /* show objects with cookies */
+#define FSCACHE_OBJLIST_CONFIG_NOCOOKIE 0x00000008      /* show objects without cookies */
+#define FSCACHE_OBJLIST_CONFIG_BUSY     0x00000010      /* show busy objects */
+#define FSCACHE_OBJLIST_CONFIG_IDLE     0x00000020      /* show idle objects */
+#define FSCACHE_OBJLIST_CONFIG_PENDWR   0x00000040      /* show objects with pending writes */
+#define FSCACHE_OBJLIST_CONFIG_NOPENDWR 0x00000080      /* show objects without pending writes */
+#define FSCACHE_OBJLIST_CONFIG_READS    0x00000100      /* show objects with active reads */
+#define FSCACHE_OBJLIST_CONFIG_NOREADS  0x00000200      /* show objects without active reads */
+#define FSCACHE_OBJLIST_CONFIG_EVENTS   0x00000400      /* show objects with events */
+#define FSCACHE_OBJLIST_CONFIG_NOEVENTS 0x00000800      /* show objects without no events */
+#define FSCACHE_OBJLIST_CONFIG_WORK     0x00001000      /* show objects with slow work */
+#define FSCACHE_OBJLIST_CONFIG_NOWORK   0x00002000      /* show objects without slow work */
+
+        u8              buf[512];       /* key and aux data buffer */
+};
+
+/*
+ * Add an object to the object list
+ * - we use the address of the fscache_object structure as the key into the
+ *   tree
+ */
+void fscache_objlist_add(struct fscache_object *obj)
+{
+        struct fscache_object *xobj;
+        struct rb_node **p = &fscache_object_list.rb_node, *parent = NULL;
+
+        write_lock(&fscache_object_list_lock);
+
+        while (*p) {
+                parent = *p;
+                xobj = rb_entry(parent, struct fscache_object, objlist_link);
+
+                if (obj < xobj)
+                        p = &(*p)->rb_left;
+                else if (obj > xobj)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&obj->objlist_link, parent, p);
+        rb_insert_color(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+
+/**
+ * fscache_object_destroy - Note that a cache object is about to be destroyed
+ * @object: The object to be destroyed
+ *
+ * Note the imminent destruction and deallocation of a cache object record.
+ */
+void fscache_object_destroy(struct fscache_object *obj)
+{
+        write_lock(&fscache_object_list_lock);
+
+        BUG_ON(RB_EMPTY_ROOT(&fscache_object_list));
+        rb_erase(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+EXPORT_SYMBOL(fscache_object_destroy);
+
+/*
+ * find the object in the tree on or after the specified index
+ */
+static struct fscache_object *fscache_objlist_lookup(loff_t *_pos)
+{
+        struct fscache_object *pobj, *obj, *minobj = NULL;
+        struct rb_node *p;
+        unsigned long pos;
+
+        if (*_pos >= (unsigned long) ERR_PTR(-ENOENT))
+                return NULL;
+        pos = *_pos;
+
+        /* banners (can't represent line 0 by pos 0 as that would involve
+         * returning a NULL pointer) */
+        if (pos == 0)
+                return (struct fscache_object *) ++(*_pos);
+        if (pos < 3)
+                return (struct fscache_object *)pos;
+
+        pobj = (struct fscache_object *)pos;
+        p = fscache_object_list.rb_node;
+        while (p) {
+                obj = rb_entry(p, struct fscache_object, objlist_link);
+                if (pobj < obj) {
+                        if (!minobj || minobj > obj)
+                                minobj = obj;
+                        p = p->rb_left;
+                } else if (pobj > obj) {
+                        p = p->rb_right;
+                } else {
+                        minobj = obj;
+                        break;
+                }
+                obj = NULL;
+        }
+
+        if (!minobj)
+                *_pos = (unsigned long) ERR_PTR(-ENOENT);
+        else if (minobj != obj)
+                *_pos = (unsigned long) minobj;
+        return minobj;
+}
+
+/*
+ * set up the iterator to start reading from the first line
+ */
+static void *fscache_objlist_start(struct seq_file *m, loff_t *_pos)
+        __acquires(&fscache_object_list_lock)
+{
+        read_lock(&fscache_object_list_lock);
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * move to the next line
+ */
+static void *fscache_objlist_next(struct seq_file *m, void *v, loff_t *_pos)
+{
+        (*_pos)++;
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * clean up after reading
+ */
+static void fscache_objlist_stop(struct seq_file *m, void *v)
+        __releases(&fscache_object_list_lock)
+{
+        read_unlock(&fscache_object_list_lock);
+}
+
+/*
+ * display an object
+ */
+static int fscache_objlist_show(struct seq_file *m, void *v)
+{
+        struct fscache_objlist_data *data = m->private;
+        struct fscache_object *obj = v;
+        unsigned long config = data->config;
+        uint16_t keylen, auxlen;
+        char _type[3], *type;
+        bool no_cookie;
+        u8 *buf = data->buf, *p;
+
+        if ((unsigned long) v == 1) {
+                seq_puts(m, "OBJECT   PARENT   STAT CHLDN OPS OOP IPR EX READS"
+                         " EM EV F S"
+                         " | NETFS_COOKIE_DEF TY FL NETFS_DATA");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, "       ");
+                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                        seq_puts(m, "OBJECT_KEY");
+                if ((config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                               FSCACHE_OBJLIST_CONFIG_AUX)) ==
+                    (FSCACHE_OBJLIST_CONFIG_KEY | FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, ", ");
+                if (config & FSCACHE_OBJLIST_CONFIG_AUX)
+                        seq_puts(m, "AUX_DATA");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        if ((unsigned long) v == 2) {
+                seq_puts(m, "======== ======== ==== ===== === === === == ====="
+                         " == == = ="
+                         " | ================ == == ================");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, " ================");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        /* filter out any unwanted objects */
+#define FILTER(criterion, _yes, _no)                                    \
+        do {                                                            \
+                unsigned long yes = FSCACHE_OBJLIST_CONFIG_##_yes;      \
+                unsigned long no = FSCACHE_OBJLIST_CONFIG_##_no;        \
+                if (criterion) {                                        \
+                        if (!(config & yes))                            \
+                                return 0;                               \
+                } else {                                                \
+                        if (!(config & no))                             \
+                                return 0;                               \
+                }                                                       \
+        } while(0)
+
+        if (~config) {
+                FILTER(obj->cookie,
+                       COOKIE, NOCOOKIE);
+                FILTER(obj->state != FSCACHE_OBJECT_ACTIVE ||
+                       obj->n_ops != 0 ||
+                       obj->n_obj_ops != 0 ||
+                       obj->flags ||
+                       !list_empty(&obj->dependents),
+                       BUSY, IDLE);
+                FILTER(test_bit(FSCACHE_OBJECT_PENDING_WRITE, &obj->flags),
+                       PENDWR, NOPENDWR);
+                FILTER(atomic_read(&obj->n_reads),
+                       READS, NOREADS);
+                FILTER(obj->events & obj->event_mask,
+                       EVENTS, NOEVENTS);
+                FILTER(obj->work.flags & ~(1UL << SLOW_WORK_VERY_SLOW),
+                       WORK, NOWORK);
+        }
+
+        seq_printf(m,
+                   "%8x %8x %s %5u %3u %3u %3u %2u %5u %2lx %2lx %1lx %1lx | ",
+                   obj->debug_id,
+                   obj->parent ? obj->parent->debug_id : -1,
+                   fscache_object_states_short[obj->state],
+                   obj->n_children,
+                   obj->n_ops,
+                   obj->n_obj_ops,
+                   obj->n_in_progress,
+                   obj->n_exclusive,
+                   atomic_read(&obj->n_reads),
+                   obj->event_mask & FSCACHE_OBJECT_EVENTS_MASK,
+                   obj->events,
+                   obj->flags,
+                   obj->work.flags);
+
+        no_cookie = true;
+        keylen = auxlen = 0;
+        if (obj->cookie) {
+                spin_lock(&obj->lock);
+                if (obj->cookie) {
+                        switch (obj->cookie->def->type) {
+                        case 0:
+                                type = "IX";
+                                break;
+                        case 1:
+                                type = "DT";
+                                break;
+                        default:
+                                sprintf(_type, "%02u",
+                                        obj->cookie->def->type);
+                                type = _type;
+                                break;
+                        }
+
+                        seq_printf(m, "%-16s %s %2lx %16p",
+                                   obj->cookie->def->name,
+                                   type,
+                                   obj->cookie->flags,
+                                   obj->cookie->netfs_data);
+
+                        if (obj->cookie->def->get_key &&
+                            config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                keylen = obj->cookie->def->get_key(
+                                        obj->cookie->netfs_data,
+                                        buf, 400);
+
+                        if (obj->cookie->def->get_aux &&
+                            config & FSCACHE_OBJLIST_CONFIG_AUX)
+                                auxlen = obj->cookie->def->get_aux(
+                                        obj->cookie->netfs_data,
+                                        buf + keylen, 512 - keylen);
+
+                        no_cookie = false;
+                }
+                spin_unlock(&obj->lock);
+
+                if (!no_cookie && (keylen > 0 || auxlen > 0)) {
+                        seq_printf(m, " ");
+                        for (p = buf; keylen > 0; keylen--)
+                                seq_printf(m, "%02x", *p++);
+                        if (auxlen > 0) {
+                                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                        seq_printf(m, ", ");
+                                for (; auxlen > 0; auxlen--)
+                                        seq_printf(m, "%02x", *p++);
+                        }
+                }
+        }
+
+        if (no_cookie)
+                seq_printf(m, "<no_cookie>\n");
+        else
+                seq_printf(m, "\n");
+        return 0;
+}
+
+static const struct seq_operations fscache_objlist_ops = {
+        .start          = fscache_objlist_start,
+        .stop           = fscache_objlist_stop,
+        .next           = fscache_objlist_next,
+        .show           = fscache_objlist_show,
+};
+
+/*
+ * get the configuration for filtering the list
+ */
+static void fscache_objlist_config(struct fscache_objlist_data *data)
+{
+#ifdef CONFIG_KEYS
+        struct user_key_payload *confkey;
+        unsigned long config;
+        struct key *key;
+        const char *buf;
+        int len;
+
+        key = request_key(&key_type_user, "fscache:objlist", NULL);
+        if (IS_ERR(key))
+                goto no_config;
+
+        config = 0;
+        rcu_read_lock();
+
+        confkey = key->payload.data;
+        buf = confkey->data;
+
+        for (len = confkey->datalen - 1; len >= 0; len--) {
+                switch (buf[len]) {
+                case 'K': config |= FSCACHE_OBJLIST_CONFIG_KEY;         break;
+                case 'A': config |= FSCACHE_OBJLIST_CONFIG_AUX;         break;
+                case 'C': config |= FSCACHE_OBJLIST_CONFIG_COOKIE;      break;
+                case 'c': config |= FSCACHE_OBJLIST_CONFIG_NOCOOKIE;    break;
+                case 'B': config |= FSCACHE_OBJLIST_CONFIG_BUSY;        break;
+                case 'b': config |= FSCACHE_OBJLIST_CONFIG_IDLE;        break;
+                case 'W': config |= FSCACHE_OBJLIST_CONFIG_PENDWR;      break;
+                case 'w': config |= FSCACHE_OBJLIST_CONFIG_NOPENDWR;    break;
+                case 'R': config |= FSCACHE_OBJLIST_CONFIG_READS;       break;
+                case 'r': config |= FSCACHE_OBJLIST_CONFIG_NOREADS;     break;
+                case 'S': config |= FSCACHE_OBJLIST_CONFIG_WORK;        break;
+                case 's': config |= FSCACHE_OBJLIST_CONFIG_NOWORK;      break;
+                }
+        }
+
+        rcu_read_unlock();
+        key_put(key);
+
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR)))
+            config   |= FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK)))
+            config   |= FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK;
+
+        data->config = config;
+        return;
+
+no_config:
+#endif
+        data->config = ULONG_MAX;
+}
+
+/*
+ * open "/proc/fs/fscache/objects" to provide a list of active objects
+ * - can be configured by a user-defined key added to the caller's keyrings
+ */
+static int fscache_objlist_open(struct inode *inode, struct file *file)
+{
+        struct fscache_objlist_data *data;
+        struct seq_file *m;
+        int ret;
+
+        ret = seq_open(file, &fscache_objlist_ops);
+        if (ret < 0)
+                return ret;
+
+        m = file->private_data;
+
+        /* buffer for key extraction */
+        data = kmalloc(sizeof(struct fscache_objlist_data), GFP_KERNEL);
+        if (!data) {
+                seq_release(inode, file);
+                return -ENOMEM;
+        }
+
+        /* get the configuration key */
+        fscache_objlist_config(data);
+
+        m->private = data;
+        return 0;
+}
+
+/*
+ * clean up on close
+ */
+static int fscache_objlist_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *m = file->private_data;
+
+        kfree(m->private);
+        m->private = NULL;
+        return seq_release(inode, file);
+}
+
+const struct file_operations fscache_objlist_fops = {
+        .owner          = THIS_MODULE,
+        .open           = fscache_objlist_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = fscache_objlist_release,
+};
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 392a41b1b79d..e513ac599c8e 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -14,9 +14,10 @@
 
 #define FSCACHE_DEBUG_LEVEL COOKIE
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
-const char *fscache_object_states[] = {
+const char *fscache_object_states[FSCACHE_OBJECT__NSTATES] = {
         [FSCACHE_OBJECT_INIT]           = "OBJECT_INIT",
         [FSCACHE_OBJECT_LOOKING_UP]     = "OBJECT_LOOKING_UP",
         [FSCACHE_OBJECT_CREATING]       = "OBJECT_CREATING",
@@ -33,9 +34,28 @@ const char *fscache_object_states[] = {
 };
 EXPORT_SYMBOL(fscache_object_states);
 
+const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5] = {
+        [FSCACHE_OBJECT_INIT]           = "INIT",
+        [FSCACHE_OBJECT_LOOKING_UP]     = "LOOK",
+        [FSCACHE_OBJECT_CREATING]       = "CRTN",
+        [FSCACHE_OBJECT_AVAILABLE]      = "AVBL",
+        [FSCACHE_OBJECT_ACTIVE]         = "ACTV",
+        [FSCACHE_OBJECT_UPDATING]       = "UPDT",
+        [FSCACHE_OBJECT_DYING]          = "DYNG",
+        [FSCACHE_OBJECT_LC_DYING]       = "LCDY",
+        [FSCACHE_OBJECT_ABORT_INIT]     = "ABTI",
+        [FSCACHE_OBJECT_RELEASING]      = "RELS",
+        [FSCACHE_OBJECT_RECYCLING]      = "RCYC",
+        [FSCACHE_OBJECT_WITHDRAWING]    = "WTHD",
+        [FSCACHE_OBJECT_DEAD]           = "DEAD",
+};
+
 static void fscache_object_slow_work_put_ref(struct slow_work *);
 static int  fscache_object_slow_work_get_ref(struct slow_work *);
 static void fscache_object_slow_work_execute(struct slow_work *);
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *, struct seq_file *);
+#endif
 static void fscache_initialise_object(struct fscache_object *);
 static void fscache_lookup_object(struct fscache_object *);
 static void fscache_object_available(struct fscache_object *);
@@ -45,9 +65,13 @@ static void fscache_enqueue_dependents(struct fscache_object *);
 static void fscache_dequeue_object(struct fscache_object *);
 
 const struct slow_work_ops fscache_object_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_object_slow_work_get_ref,
         .put_ref        = fscache_object_slow_work_put_ref,
         .execute        = fscache_object_slow_work_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_object_slow_work_desc,
+#endif
 };
 EXPORT_SYMBOL(fscache_object_slow_work_ops);
 
@@ -81,6 +105,7 @@ static inline void fscache_done_parent_op(struct fscache_object *object)
 static void fscache_object_state_machine(struct fscache_object *object)
 {
         enum fscache_object_state new_state;
+        struct fscache_cookie *cookie;
 
         ASSERT(object != NULL);
 
@@ -120,20 +145,31 @@ static void fscache_object_state_machine(struct fscache_object *object)
         case FSCACHE_OBJECT_UPDATING:
                 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
                 fscache_stat(&fscache_n_updates_run);
+                fscache_stat(&fscache_n_cop_update_object);
                 object->cache->ops->update_object(object);
+                fscache_stat_d(&fscache_n_cop_update_object);
                 goto active_transit;
 
                 /* handle an object dying during lookup or creation */
         case FSCACHE_OBJECT_LC_DYING:
                 object->event_mask &= ~(1 << FSCACHE_OBJECT_EV_UPDATE);
+                fscache_stat(&fscache_n_cop_lookup_complete);
                 object->cache->ops->lookup_complete(object);
+                fscache_stat_d(&fscache_n_cop_lookup_complete);
 
                 spin_lock(&object->lock);
                 object->state = FSCACHE_OBJECT_DYING;
-                if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
-                                       &object->cookie->flags))
-                        wake_up_bit(&object->cookie->flags,
-                                    FSCACHE_COOKIE_CREATING);
+                cookie = object->cookie;
+                if (cookie) {
+                        if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_LOOKING_UP);
+                        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_CREATING);
+                }
                 spin_unlock(&object->lock);
 
                 fscache_done_parent_op(object);
@@ -165,6 +201,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
                 }
                 spin_unlock(&object->lock);
                 fscache_enqueue_dependents(object);
+                fscache_start_operations(object);
                 goto terminal_transit;
 
                 /* handle an abort during initialisation */
@@ -316,14 +353,29 @@ static void fscache_object_slow_work_execute(struct slow_work *work)
 
         _enter("{OBJ%x}", object->debug_id);
 
-        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
-
         start = jiffies;
         fscache_object_state_machine(object);
         fscache_hist(fscache_objs_histogram, start);
         if (object->events & object->event_mask)
                 fscache_enqueue_object(object);
+        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+}
+
+/*
+ * describe an object for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *work,
+                                          struct seq_file *m)
+{
+        struct fscache_object *object =
+                container_of(work, struct fscache_object, work);
+
+        seq_printf(m, "FSC: OBJ%x: %s",
+                   object->debug_id,
+                   fscache_object_states_short[object->state]);
 }
+#endif
 
 /*
  * initialise an object
@@ -376,7 +428,9 @@ static void fscache_initialise_object(struct fscache_object *object)
                          * binding on to us, so we need to make sure we don't
                          * add ourself to the list multiple times */
                         if (list_empty(&object->dep_link)) {
+                                fscache_stat(&fscache_n_cop_grab_object);
                                 object->cache->ops->grab_object(object);
+                                fscache_stat_d(&fscache_n_cop_grab_object);
                                 list_add(&object->dep_link,
                                          &parent->dependents);
 
@@ -414,6 +468,7 @@ static void fscache_lookup_object(struct fscache_object *object)
 {
         struct fscache_cookie *cookie = object->cookie;
         struct fscache_object *parent;
+        int ret;
 
         _enter("");
 
@@ -438,11 +493,20 @@ static void fscache_lookup_object(struct fscache_object *object)
                object->cache->tag->name);
 
         fscache_stat(&fscache_n_object_lookups);
-        object->cache->ops->lookup_object(object);
+        fscache_stat(&fscache_n_cop_lookup_object);
+        ret = object->cache->ops->lookup_object(object);
+        fscache_stat_d(&fscache_n_cop_lookup_object);
 
         if (test_bit(FSCACHE_OBJECT_EV_ERROR, &object->events))
                 set_bit(FSCACHE_COOKIE_UNAVAILABLE, &cookie->flags);
 
+        if (ret == -ETIMEDOUT) {
+                /* probably stuck behind another object, so move this one to
+                 * the back of the queue */
+                fscache_stat(&fscache_n_object_lookups_timed_out);
+                set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+        }
+
         _leave("");
 }
 
@@ -546,7 +610,8 @@ static void fscache_object_available(struct fscache_object *object)
 
         spin_lock(&object->lock);
 
-        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
+        if (object->cookie &&
+            test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
                 wake_up_bit(&object->cookie->flags, FSCACHE_COOKIE_CREATING);
 
         fscache_done_parent_op(object);
@@ -562,7 +627,9 @@ static void fscache_object_available(struct fscache_object *object)
         }
         spin_unlock(&object->lock);
 
+        fscache_stat(&fscache_n_cop_lookup_complete);
         object->cache->ops->lookup_complete(object);
+        fscache_stat_d(&fscache_n_cop_lookup_complete);
         fscache_enqueue_dependents(object);
 
         fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
@@ -581,11 +648,16 @@ static void fscache_drop_object(struct fscache_object *object)
 
         _enter("{OBJ%x,%d}", object->debug_id, object->n_children);
 
+        ASSERTCMP(object->cookie, ==, NULL);
+        ASSERT(hlist_unhashed(&object->cookie_link));
+
         spin_lock(&cache->object_list_lock);
         list_del_init(&object->cache_link);
         spin_unlock(&cache->object_list_lock);
 
+        fscache_stat(&fscache_n_cop_drop_object);
         cache->ops->drop_object(object);
+        fscache_stat_d(&fscache_n_cop_drop_object);
 
         if (parent) {
                 _debug("release parent OBJ%x {%d}",
@@ -600,7 +672,9 @@ static void fscache_drop_object(struct fscache_object *object)
         }
 
         /* this just shifts the object release to the slow work processor */
+        fscache_stat(&fscache_n_cop_put_object);
         object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 
         _leave("");
 }
@@ -690,8 +764,12 @@ static int fscache_object_slow_work_get_ref(struct slow_work *work)
 {
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
+        int ret;
 
-        return object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat(&fscache_n_cop_grab_object);
+        ret = object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat_d(&fscache_n_cop_grab_object);
+        return ret;
 }
 
 /*
@@ -702,7 +780,9 @@ static void fscache_object_slow_work_put_ref(struct slow_work *work)
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
 
-        return object->cache->ops->put_object(object);
+        fscache_stat(&fscache_n_cop_put_object);
+        object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 }
 
 /*
@@ -739,7 +819,9 @@ static void fscache_enqueue_dependents(struct fscache_object *object)
 
                 /* sort onto appropriate lists */
                 fscache_enqueue_object(dep);
+                fscache_stat(&fscache_n_cop_put_object);
                 dep->cache->ops->put_object(dep);
+                fscache_stat_d(&fscache_n_cop_put_object);
 
                 if (!list_empty(&object->dependents))
                         cond_resched_lock(&object->lock);
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index e7f8d53b8b6b..313e79a14266 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -13,6 +13,7 @@
 
 #define FSCACHE_DEBUG_LEVEL OPERATION
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
 atomic_t fscache_op_debug_id;
@@ -31,32 +32,33 @@ void fscache_enqueue_operation(struct fscache_operation *op)
         _enter("{OBJ%x OP%x,%u}",
                op->object->debug_id, op->debug_id, atomic_read(&op->usage));
 
+        fscache_set_op_state(op, "EnQ");
+
+        ASSERT(list_empty(&op->pend_link));
         ASSERT(op->processor != NULL);
         ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
-        if (list_empty(&op->pend_link)) {
-                switch (op->flags & FSCACHE_OP_TYPE) {
-                case FSCACHE_OP_FAST:
-                        _debug("queue fast");
-                        atomic_inc(&op->usage);
-                        if (!schedule_work(&op->fast_work))
-                                fscache_put_operation(op);
-                        break;
-                case FSCACHE_OP_SLOW:
-                        _debug("queue slow");
-                        slow_work_enqueue(&op->slow_work);
-                        break;
-                case FSCACHE_OP_MYTHREAD:
-                        _debug("queue for caller's attention");
-                        break;
-                default:
-                        printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
-                               op->flags);
-                        BUG();
-                        break;
-                }
-                fscache_stat(&fscache_n_op_enqueue);
+        fscache_stat(&fscache_n_op_enqueue);
+        switch (op->flags & FSCACHE_OP_TYPE) {
+        case FSCACHE_OP_FAST:
+                _debug("queue fast");
+                atomic_inc(&op->usage);
+                if (!schedule_work(&op->fast_work))
+                        fscache_put_operation(op);
+                break;
+        case FSCACHE_OP_SLOW:
+                _debug("queue slow");
+                slow_work_enqueue(&op->slow_work);
+                break;
+        case FSCACHE_OP_MYTHREAD:
+                _debug("queue for caller's attention");
+                break;
+        default:
+                printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
+                       op->flags);
+                BUG();
+                break;
         }
 }
 EXPORT_SYMBOL(fscache_enqueue_operation);
@@ -67,6 +69,8 @@ EXPORT_SYMBOL(fscache_enqueue_operation);
 static void fscache_run_op(struct fscache_object *object,
                            struct fscache_operation *op)
 {
+        fscache_set_op_state(op, "Run");
+
         object->n_in_progress++;
         if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
                 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
@@ -87,9 +91,12 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
 
         _enter("{OBJ%x OP%x},", object->debug_id, op->debug_id);
 
+        fscache_set_op_state(op, "SubmitX");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ret = -ENOBUFS;
         if (fscache_object_is_active(object)) {
@@ -190,9 +197,12 @@ int fscache_submit_op(struct fscache_object *object,
 
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
+        fscache_set_op_state(op, "Submit");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ostate = object->state;
         smp_rmb();
@@ -222,6 +232,11 @@ int fscache_submit_op(struct fscache_object *object,
                 list_add_tail(&op->pend_link, &object->pending_ops);
                 fscache_stat(&fscache_n_op_pend);
                 ret = 0;
+        } else if (object->state == FSCACHE_OBJECT_DYING ||
+                   object->state == FSCACHE_OBJECT_LC_DYING ||
+                   object->state == FSCACHE_OBJECT_WITHDRAWING) {
+                fscache_stat(&fscache_n_op_rejected);
+                ret = -ENOBUFS;
         } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
                 fscache_report_unexpected_submission(object, op, ostate);
                 ASSERT(!fscache_object_is_active(object));
@@ -264,12 +279,7 @@ void fscache_start_operations(struct fscache_object *object)
                         stop = true;
                 }
                 list_del_init(&op->pend_link);
-                object->n_in_progress++;
-
-                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
-                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
-                if (op->processor)
-                        fscache_enqueue_operation(op);
+                fscache_run_op(object, op);
 
                 /* the pending queue was holding a ref on the object */
                 fscache_put_operation(op);
@@ -282,6 +292,36 @@ void fscache_start_operations(struct fscache_object *object)
 }
 
 /*
+ * cancel an operation that's pending on an object
+ */
+int fscache_cancel_op(struct fscache_operation *op)
+{
+        struct fscache_object *object = op->object;
+        int ret;
+
+        _enter("OBJ%x OP%x}", op->object->debug_id, op->debug_id);
+
+        spin_lock(&object->lock);
+
+        ret = -EBUSY;
+        if (!list_empty(&op->pend_link)) {
+                fscache_stat(&fscache_n_op_cancelled);
+                list_del_init(&op->pend_link);
+                object->n_ops--;
+                if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
+                        object->n_exclusive--;
+                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
+                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
+                fscache_put_operation(op);
+                ret = 0;
+        }
+
+        spin_unlock(&object->lock);
+        _leave(" = %d", ret);
+        return ret;
+}
+
+/*
  * release an operation
  * - queues pending ops if this is the last in-progress op
  */
@@ -298,6 +338,8 @@ void fscache_put_operation(struct fscache_operation *op)
         if (!atomic_dec_and_test(&op->usage))
                 return;
 
+        fscache_set_op_state(op, "Put");
+
         _debug("PUT OP");
         if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
                 BUG();
@@ -311,6 +353,9 @@ void fscache_put_operation(struct fscache_operation *op)
 
         object = op->object;
 
+        if (test_bit(FSCACHE_OP_DEC_READ_CNT, &op->flags))
+                atomic_dec(&object->n_reads);
+
         /* now... we may get called with the object spinlock held, so we
          * complete the cleanup here only if we can immediately acquire the
          * lock, and defer it otherwise */
@@ -452,8 +497,27 @@ static void fscache_op_execute(struct slow_work *work)
         _leave("");
 }
 
+/*
+ * describe an operation for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_op_desc(struct slow_work *work, struct seq_file *m)
+{
+        struct fscache_operation *op =
+                container_of(work, struct fscache_operation, slow_work);
+
+        seq_printf(m, "FSC: OBJ%x OP%x: %s/%s fl=%lx",
+                   op->object->debug_id, op->debug_id,
+                   op->name, op->state, op->flags);
+}
+#endif
+
 const struct slow_work_ops fscache_op_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_op_get_ref,
         .put_ref        = fscache_op_put_ref,
         .execute        = fscache_op_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_op_desc,
+#endif
 };
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index 2568e0eb644f..c598ea4c4e7d 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -43,18 +43,102 @@ void __fscache_wait_on_page_write(struct fscache_cookie *cookie, struct page *pa
 EXPORT_SYMBOL(__fscache_wait_on_page_write);
 
 /*
- * note that a page has finished being written to the cache
+ * decide whether a page can be released, possibly by cancelling a store to it
+ * - we're allowed to sleep if __GFP_WAIT is flagged
  */
-static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *page)
+bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                  struct page *page,
+                                  gfp_t gfp)
 {
         struct page *xpage;
+        void *val;
+
+        _enter("%p,%p,%x", cookie, page, gfp);
+
+        rcu_read_lock();
+        val = radix_tree_lookup(&cookie->stores, page->index);
+        if (!val) {
+                rcu_read_unlock();
+                fscache_stat(&fscache_n_store_vmscan_not_storing);
+                __fscache_uncache_page(cookie, page);
+                return true;
+        }
+
+        /* see if the page is actually undergoing storage - if so we can't get
+         * rid of it till the cache has finished with it */
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                rcu_read_unlock();
+                goto page_busy;
+        }
+
+        /* the page is pending storage, so we attempt to cancel the store and
+         * discard the store request so that the page can be reclaimed */
+        spin_lock(&cookie->stores_lock);
+        rcu_read_unlock();
+
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                /* the page started to undergo storage whilst we were looking,
+                 * so now we can only wait or return */
+                spin_unlock(&cookie->stores_lock);
+                goto page_busy;
+        }
 
-        spin_lock(&cookie->lock);
         xpage = radix_tree_delete(&cookie->stores, page->index);
-        spin_unlock(&cookie->lock);
-        ASSERT(xpage != NULL);
+        spin_unlock(&cookie->stores_lock);
+
+        if (xpage) {
+                fscache_stat(&fscache_n_store_vmscan_cancelled);
+                fscache_stat(&fscache_n_store_radix_deletes);
+                ASSERTCMP(xpage, ==, page);
+        } else {
+                fscache_stat(&fscache_n_store_vmscan_gone);
+        }
 
         wake_up_bit(&cookie->flags, 0);
+        if (xpage)
+                page_cache_release(xpage);
+        __fscache_uncache_page(cookie, page);
+        return true;
+
+page_busy:
+        /* we might want to wait here, but that could deadlock the allocator as
+         * the slow-work threads writing to the cache may all end up sleeping
+         * on memory allocation */
+        fscache_stat(&fscache_n_store_vmscan_busy);
+        return false;
+}
+EXPORT_SYMBOL(__fscache_maybe_release_page);
+
+/*
+ * note that a page has finished being written to the cache
+ */
+static void fscache_end_page_write(struct fscache_object *object,
+                                   struct page *page)
+{
+        struct fscache_cookie *cookie;
+        struct page *xpage = NULL;
+
+        spin_lock(&object->lock);
+        cookie = object->cookie;
+        if (cookie) {
+                /* delete the page from the tree if it is now no longer
+                 * pending */
+                spin_lock(&cookie->stores_lock);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_STORING_TAG);
+                if (!radix_tree_tag_get(&cookie->stores, page->index,
+                                        FSCACHE_COOKIE_PENDING_TAG)) {
+                        fscache_stat(&fscache_n_store_radix_deletes);
+                        xpage = radix_tree_delete(&cookie->stores, page->index);
+                }
+                spin_unlock(&cookie->stores_lock);
+                wake_up_bit(&cookie->flags, 0);
+        }
+        spin_unlock(&object->lock);
+        if (xpage)
+                page_cache_release(xpage);
 }
 
 /*
@@ -63,14 +147,21 @@ static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *p
 static void fscache_attr_changed_op(struct fscache_operation *op)
 {
         struct fscache_object *object = op->object;
+        int ret;
 
         _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
 
         fscache_stat(&fscache_n_attr_changed_calls);
 
-        if (fscache_object_is_active(object) &&
-            object->cache->ops->attr_changed(object) < 0)
-                fscache_abort_object(object);
+        if (fscache_object_is_active(object)) {
+                fscache_set_op_state(op, "CallFS");
+                fscache_stat(&fscache_n_cop_attr_changed);
+                ret = object->cache->ops->attr_changed(object);
+                fscache_stat_d(&fscache_n_cop_attr_changed);
+                fscache_set_op_state(op, "Done");
+                if (ret < 0)
+                        fscache_abort_object(object);
+        }
 
         _leave("");
 }
@@ -99,6 +190,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
         fscache_operation_init(op, NULL);
         fscache_operation_init_slow(op, fscache_attr_changed_op);
         op->flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_EXCLUSIVE);
+        fscache_set_op_name(op, "Attr");
 
         spin_lock(&cookie->lock);
 
@@ -184,6 +276,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
         op->start_time  = jiffies;
         INIT_WORK(&op->op.fast_work, fscache_retrieval_work);
         INIT_LIST_HEAD(&op->to_do);
+        fscache_set_op_name(&op->op, "Retr");
         return op;
 }
 
@@ -221,6 +314,43 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
 }
 
 /*
+ * wait for an object to become active (or dead)
+ */
+static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+                                                 struct fscache_retrieval *op,
+                                                 atomic_t *stat_op_waits,
+                                                 atomic_t *stat_object_dead)
+{
+        int ret;
+
+        if (!test_bit(FSCACHE_OP_WAITING, &op->op.flags))
+                goto check_if_dead;
+
+        _debug(">>> WT");
+        fscache_stat(stat_op_waits);
+        if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                        fscache_wait_bit_interruptible,
+                        TASK_INTERRUPTIBLE) < 0) {
+                ret = fscache_cancel_op(&op->op);
+                if (ret == 0)
+                        return -ERESTARTSYS;
+
+                /* it's been removed from the pending queue by another party,
+                 * so we should get to run shortly */
+                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
+        }
+        _debug("<<< GO");
+
+check_if_dead:
+        if (unlikely(fscache_object_is_dead(object))) {
+                fscache_stat(stat_object_dead);
+                return -ENOBUFS;
+        }
+        return 0;
+}
+
+/*
  * read a page from the cache or allocate a block in which to store it
  * - we return:
  *   -ENOMEM    - out of memory, nothing done
@@ -257,6 +387,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
                 _leave(" = -ENOMEM");
                 return -ENOMEM;
         }
+        fscache_set_op_name(&op->op, "RetrRA1");
 
         spin_lock(&cookie->lock);
 
@@ -267,6 +398,9 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         ASSERTCMP(object->state, >, FSCACHE_OBJECT_LOOKING_UP);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -279,23 +413,27 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
         if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_page);
                 ret = object->cache->ops->allocate_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_page);
                 if (ret == 0)
                         ret = -ENODATA;
         } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_page);
                 ret = object->cache->ops->read_or_alloc_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_page);
         }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -347,7 +485,6 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
                                   void *context,
                                   gfp_t gfp)
 {
-        fscache_pages_retrieval_func_t func;
         struct fscache_retrieval *op;
         struct fscache_object *object;
         int ret;
@@ -369,6 +506,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(mapping, end_io_func, context);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrRAN");
 
         spin_lock(&cookie->lock);
 
@@ -377,6 +515,9 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         object = hlist_entry(cookie->backing_objects.first,
                              struct fscache_object, cookie_link);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -389,21 +530,27 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
-        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags))
-                func = object->cache->ops->allocate_pages;
-        else
-                func = object->cache->ops->read_or_alloc_pages;
-        ret = func(op, pages, nr_pages, gfp);
+        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_pages);
+                ret = object->cache->ops->allocate_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_pages);
+        } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_pages);
+                ret = object->cache->ops->read_or_alloc_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_pages);
+        }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -461,6 +608,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(page->mapping, NULL, NULL);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrAL1");
 
         spin_lock(&cookie->lock);
 
@@ -475,18 +623,22 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
 
         fscache_stat(&fscache_n_alloc_ops);
 
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_alloc_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_alloc_op_waits),
+                __fscache_stat(&fscache_n_allocs_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
+        fscache_stat(&fscache_n_cop_allocate_page);
         ret = object->cache->ops->allocate_page(op, page, gfp);
+        fscache_stat_d(&fscache_n_cop_allocate_page);
 
-        if (ret < 0)
+error:
+        if (ret == -ERESTARTSYS)
+                fscache_stat(&fscache_n_allocs_intr);
+        else if (ret < 0)
                 fscache_stat(&fscache_n_allocs_nobufs);
         else
                 fscache_stat(&fscache_n_allocs_ok);
@@ -521,7 +673,7 @@ static void fscache_write_op(struct fscache_operation *_op)
         struct fscache_storage *op =
                 container_of(_op, struct fscache_storage, op);
         struct fscache_object *object = op->op.object;
-        struct fscache_cookie *cookie = object->cookie;
+        struct fscache_cookie *cookie;
         struct page *page;
         unsigned n;
         void *results[1];
@@ -529,16 +681,19 @@ static void fscache_write_op(struct fscache_operation *_op)
 
         _enter("{OP%x,%d}", op->op.debug_id, atomic_read(&op->op.usage));
 
-        spin_lock(&cookie->lock);
+        fscache_set_op_state(&op->op, "GetPage");
+
         spin_lock(&object->lock);
+        cookie = object->cookie;
 
-        if (!fscache_object_is_active(object)) {
+        if (!fscache_object_is_active(object) || !cookie) {
                 spin_unlock(&object->lock);
-                spin_unlock(&cookie->lock);
                 _leave("");
                 return;
         }
 
+        spin_lock(&cookie->stores_lock);
+
         fscache_stat(&fscache_n_store_calls);
 
         /* find a page to store */
@@ -549,23 +704,35 @@ static void fscache_write_op(struct fscache_operation *_op)
                 goto superseded;
         page = results[0];
         _debug("gang %d [%lx]", n, page->index);
-        if (page->index > op->store_limit)
+        if (page->index > op->store_limit) {
+                fscache_stat(&fscache_n_store_pages_over_limit);
                 goto superseded;
+        }
 
-        radix_tree_tag_clear(&cookie->stores, page->index,
-                             FSCACHE_COOKIE_PENDING_TAG);
+        if (page) {
+                radix_tree_tag_set(&cookie->stores, page->index,
+                                   FSCACHE_COOKIE_STORING_TAG);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_PENDING_TAG);
+        }
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
 
         if (page) {
+                fscache_set_op_state(&op->op, "Store");
+                fscache_stat(&fscache_n_store_pages);
+                fscache_stat(&fscache_n_cop_write_page);
                 ret = object->cache->ops->write_page(op, page);
-                fscache_end_page_write(cookie, page);
-                page_cache_release(page);
-                if (ret < 0)
+                fscache_stat_d(&fscache_n_cop_write_page);
+                fscache_set_op_state(&op->op, "EndWrite");
+                fscache_end_page_write(object, page);
+                if (ret < 0) {
+                        fscache_set_op_state(&op->op, "Abort");
                         fscache_abort_object(object);
-                else
+                } else {
                         fscache_enqueue_operation(&op->op);
+                }
         }
 
         _leave("");
@@ -575,9 +742,9 @@ superseded:
         /* this writer is going away and there aren't any more things to
          * write */
         _debug("cease");
+        spin_unlock(&cookie->stores_lock);
         clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
         _leave("");
 }
 
@@ -634,6 +801,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         fscache_operation_init(&op->op, fscache_release_write_op);
         fscache_operation_init_slow(&op->op, fscache_write_op);
         op->op.flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_WAITING);
+        fscache_set_op_name(&op->op, "Write1");
 
         ret = radix_tree_preload(gfp & ~__GFP_HIGHMEM);
         if (ret < 0)
@@ -652,6 +820,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         /* add the page to the pending-storage radix tree on the backing
          * object */
         spin_lock(&object->lock);
+        spin_lock(&cookie->stores_lock);
 
         _debug("store limit %llx", (unsigned long long) object->store_limit);
 
@@ -672,6 +841,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         if (test_and_set_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags))
                 goto already_pending;
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
 
         op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
@@ -693,6 +863,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
 already_queued:
         fscache_stat(&fscache_n_stores_again);
 already_pending:
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
         spin_unlock(&cookie->lock);
         radix_tree_preload_end();
@@ -702,7 +873,9 @@ already_pending:
         return 0;
 
 submit_failed:
+        spin_lock(&cookie->stores_lock);
         radix_tree_delete(&cookie->stores, page->index);
+        spin_unlock(&cookie->stores_lock);
         page_cache_release(page);
         ret = -ENOBUFS;
         goto nobufs;
@@ -763,7 +936,9 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
         if (TestClearPageFsCache(page) &&
             object->cache->ops->uncache_page) {
                 /* the cache backend releases the cookie lock */
+                fscache_stat(&fscache_n_cop_uncache_page);
                 object->cache->ops->uncache_page(object, page);
+                fscache_stat_d(&fscache_n_cop_uncache_page);
                 goto done;
         }
 
diff --git a/fs/fscache/proc.c b/fs/fscache/proc.c
index beeab44bc31a..1d9e4951a597 100644
--- a/fs/fscache/proc.c
+++ b/fs/fscache/proc.c
@@ -37,10 +37,20 @@ int __init fscache_proc_init(void)
                 goto error_histogram;
 #endif
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        if (!proc_create("fs/fscache/objects", S_IFREG | 0444, NULL,
+                         &fscache_objlist_fops))
+                goto error_objects;
+#endif
+
         _leave(" = 0");
         return 0;
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+error_objects:
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
+        remove_proc_entry("fs/fscache/histogram", NULL);
 error_histogram:
 #endif
 #ifdef CONFIG_FSCACHE_STATS
@@ -58,6 +68,9 @@ error_dir:
  */
 void fscache_proc_cleanup(void)
 {
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        remove_proc_entry("fs/fscache/objects", NULL);
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
         remove_proc_entry("fs/fscache/histogram", NULL);
 #endif
diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
index 65deb99e756b..46435f3aae68 100644
--- a/fs/fscache/stats.c
+++ b/fs/fscache/stats.c
@@ -25,6 +25,8 @@ atomic_t fscache_n_op_requeue;
 atomic_t fscache_n_op_deferred_release;
 atomic_t fscache_n_op_release;
 atomic_t fscache_n_op_gc;
+atomic_t fscache_n_op_cancelled;
+atomic_t fscache_n_op_rejected;
 
 atomic_t fscache_n_attr_changed;
 atomic_t fscache_n_attr_changed_ok;
@@ -36,6 +38,8 @@ atomic_t fscache_n_allocs;
 atomic_t fscache_n_allocs_ok;
 atomic_t fscache_n_allocs_wait;
 atomic_t fscache_n_allocs_nobufs;
+atomic_t fscache_n_allocs_intr;
+atomic_t fscache_n_allocs_object_dead;
 atomic_t fscache_n_alloc_ops;
 atomic_t fscache_n_alloc_op_waits;
 
@@ -46,6 +50,7 @@ atomic_t fscache_n_retrievals_nodata;
 atomic_t fscache_n_retrievals_nobufs;
 atomic_t fscache_n_retrievals_intr;
 atomic_t fscache_n_retrievals_nomem;
+atomic_t fscache_n_retrievals_object_dead;
 atomic_t fscache_n_retrieval_ops;
 atomic_t fscache_n_retrieval_op_waits;
 
@@ -56,6 +61,14 @@ atomic_t fscache_n_stores_nobufs;
 atomic_t fscache_n_stores_oom;
 atomic_t fscache_n_store_ops;
 atomic_t fscache_n_store_calls;
+atomic_t fscache_n_store_pages;
+atomic_t fscache_n_store_radix_deletes;
+atomic_t fscache_n_store_pages_over_limit;
+
+atomic_t fscache_n_store_vmscan_not_storing;
+atomic_t fscache_n_store_vmscan_gone;
+atomic_t fscache_n_store_vmscan_busy;
+atomic_t fscache_n_store_vmscan_cancelled;
 
 atomic_t fscache_n_marks;
 atomic_t fscache_n_uncaches;
@@ -74,6 +87,7 @@ atomic_t fscache_n_updates_run;
 atomic_t fscache_n_relinquishes;
 atomic_t fscache_n_relinquishes_null;
 atomic_t fscache_n_relinquishes_waitcrt;
+atomic_t fscache_n_relinquishes_retire;
 
 atomic_t fscache_n_cookie_index;
 atomic_t fscache_n_cookie_data;
@@ -84,6 +98,7 @@ atomic_t fscache_n_object_no_alloc;
 atomic_t fscache_n_object_lookups;
 atomic_t fscache_n_object_lookups_negative;
 atomic_t fscache_n_object_lookups_positive;
+atomic_t fscache_n_object_lookups_timed_out;
 atomic_t fscache_n_object_created;
 atomic_t fscache_n_object_avail;
 atomic_t fscache_n_object_dead;
@@ -93,6 +108,23 @@ atomic_t fscache_n_checkaux_okay;
 atomic_t fscache_n_checkaux_update;
 atomic_t fscache_n_checkaux_obsolete;
 
+atomic_t fscache_n_cop_alloc_object;
+atomic_t fscache_n_cop_lookup_object;
+atomic_t fscache_n_cop_lookup_complete;
+atomic_t fscache_n_cop_grab_object;
+atomic_t fscache_n_cop_update_object;
+atomic_t fscache_n_cop_drop_object;
+atomic_t fscache_n_cop_put_object;
+atomic_t fscache_n_cop_sync_cache;
+atomic_t fscache_n_cop_attr_changed;
+atomic_t fscache_n_cop_read_or_alloc_page;
+atomic_t fscache_n_cop_read_or_alloc_pages;
+atomic_t fscache_n_cop_allocate_page;
+atomic_t fscache_n_cop_allocate_pages;
+atomic_t fscache_n_cop_write_page;
+atomic_t fscache_n_cop_uncache_page;
+atomic_t fscache_n_cop_dissociate_pages;
+
 /*
  * display the general statistics
  */
@@ -129,10 +161,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_acquires_nobufs),
                    atomic_read(&fscache_n_acquires_oom));
 
-        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u\n",
+        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
                    atomic_read(&fscache_n_object_lookups),
                    atomic_read(&fscache_n_object_lookups_negative),
                    atomic_read(&fscache_n_object_lookups_positive),
+                   atomic_read(&fscache_n_object_lookups_timed_out),
                    atomic_read(&fscache_n_object_created));
 
         seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
@@ -140,10 +173,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_updates_null),
                    atomic_read(&fscache_n_updates_run));
 
-        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u\n",
+        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
                    atomic_read(&fscache_n_relinquishes),
                    atomic_read(&fscache_n_relinquishes_null),
-                   atomic_read(&fscache_n_relinquishes_waitcrt));
+                   atomic_read(&fscache_n_relinquishes_waitcrt),
+                   atomic_read(&fscache_n_relinquishes_retire));
 
         seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
                    atomic_read(&fscache_n_attr_changed),
@@ -152,14 +186,16 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_attr_changed_nomem),
                    atomic_read(&fscache_n_attr_changed_calls));
 
-        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u\n",
+        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
                    atomic_read(&fscache_n_allocs),
                    atomic_read(&fscache_n_allocs_ok),
                    atomic_read(&fscache_n_allocs_wait),
-                   atomic_read(&fscache_n_allocs_nobufs));
-        seq_printf(m, "Allocs : ops=%u owt=%u\n",
+                   atomic_read(&fscache_n_allocs_nobufs),
+                   atomic_read(&fscache_n_allocs_intr));
+        seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_alloc_ops),
-                   atomic_read(&fscache_n_alloc_op_waits));
+                   atomic_read(&fscache_n_alloc_op_waits),
+                   atomic_read(&fscache_n_allocs_object_dead));
 
         seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
                    " int=%u oom=%u\n",
@@ -170,9 +206,10 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_retrievals_nobufs),
                    atomic_read(&fscache_n_retrievals_intr),
                    atomic_read(&fscache_n_retrievals_nomem));
-        seq_printf(m, "Retrvls: ops=%u owt=%u\n",
+        seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_retrieval_ops),
-                   atomic_read(&fscache_n_retrieval_op_waits));
+                   atomic_read(&fscache_n_retrieval_op_waits),
+                   atomic_read(&fscache_n_retrievals_object_dead));
 
         seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
                    atomic_read(&fscache_n_stores),
@@ -180,18 +217,49 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_stores_again),
                    atomic_read(&fscache_n_stores_nobufs),
                    atomic_read(&fscache_n_stores_oom));
-        seq_printf(m, "Stores : ops=%u run=%u\n",
+        seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
                    atomic_read(&fscache_n_store_ops),
-                   atomic_read(&fscache_n_store_calls));
+                   atomic_read(&fscache_n_store_calls),
+                   atomic_read(&fscache_n_store_pages),
+                   atomic_read(&fscache_n_store_radix_deletes),
+                   atomic_read(&fscache_n_store_pages_over_limit));
 
-        seq_printf(m, "Ops    : pend=%u run=%u enq=%u\n",
+        seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
+                   atomic_read(&fscache_n_store_vmscan_not_storing),
+                   atomic_read(&fscache_n_store_vmscan_gone),
+                   atomic_read(&fscache_n_store_vmscan_busy),
+                   atomic_read(&fscache_n_store_vmscan_cancelled));
+
+        seq_printf(m, "Ops    : pend=%u run=%u enq=%u can=%u rej=%u\n",
                    atomic_read(&fscache_n_op_pend),
                    atomic_read(&fscache_n_op_run),
-                   atomic_read(&fscache_n_op_enqueue));
+                   atomic_read(&fscache_n_op_enqueue),
+                   atomic_read(&fscache_n_op_cancelled),
+                   atomic_read(&fscache_n_op_rejected));
         seq_printf(m, "Ops    : dfr=%u rel=%u gc=%u\n",
                    atomic_read(&fscache_n_op_deferred_release),
                    atomic_read(&fscache_n_op_release),
                    atomic_read(&fscache_n_op_gc));
+
+        seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
+                   atomic_read(&fscache_n_cop_alloc_object),
+                   atomic_read(&fscache_n_cop_lookup_object),
+                   atomic_read(&fscache_n_cop_lookup_complete),
+                   atomic_read(&fscache_n_cop_grab_object));
+        seq_printf(m, "CacheOp: upo=%d dro=%d pto=%d atc=%d syn=%d\n",
+                   atomic_read(&fscache_n_cop_update_object),
+                   atomic_read(&fscache_n_cop_drop_object),
+                   atomic_read(&fscache_n_cop_put_object),
+                   atomic_read(&fscache_n_cop_attr_changed),
+                   atomic_read(&fscache_n_cop_sync_cache));
+        seq_printf(m, "CacheOp: rap=%d ras=%d alp=%d als=%d wrp=%d ucp=%d dsp=%d\n",
+                   atomic_read(&fscache_n_cop_read_or_alloc_page),
+                   atomic_read(&fscache_n_cop_read_or_alloc_pages),
+                   atomic_read(&fscache_n_cop_allocate_page),
+                   atomic_read(&fscache_n_cop_allocate_pages),
+                   atomic_read(&fscache_n_cop_write_page),
+                   atomic_read(&fscache_n_cop_uncache_page),
+                   atomic_read(&fscache_n_cop_dissociate_pages));
         return 0;
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8ada78aade58..4787ae6c5c1c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -385,6 +385,9 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (fc->no_create)
                 return -ENOSYS;
 
+        if (flags & O_DIRECT)
+                return -EINVAL;
+
         forget_req = fuse_get_req(fc);
         if (IS_ERR(forget_req))
                 return PTR_ERR(forget_req);
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index eacd78a5d082..5b31f7741a8f 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -114,7 +114,7 @@ static int __init init_gfs2_fs(void)
         if (error)
                 goto fail_unregister;
 
-        error = slow_work_register_user();
+        error = slow_work_register_user(THIS_MODULE);
         if (error)
                 goto fail_slow;
 
@@ -163,7 +163,7 @@ static void __exit exit_gfs2_fs(void)
         gfs2_unregister_debugfs();
         unregister_filesystem(&gfs2_fs_type);
         unregister_filesystem(&gfs2meta_fs_type);
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 
         kmem_cache_destroy(gfs2_quotad_cachep);
         kmem_cache_destroy(gfs2_rgrpd_cachep);
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 59d2695509d3..09fa31965576 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -7,6 +7,7 @@
  * of the GNU General Public License version 2.
  */
 
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
@@ -593,6 +594,7 @@ fail:
 }
 
 struct slow_work_ops gfs2_recover_ops = {
+        .owner   = THIS_MODULE,
         .get_ref = gfs2_recover_get_ref,
         .put_ref = gfs2_recover_put_ref,
         .execute = gfs2_recover_work,
diff --git a/fs/jffs2/read.c b/fs/jffs2/read.c
index cfe05c1966a5..3f39be1b0455 100644
--- a/fs/jffs2/read.c
+++ b/fs/jffs2/read.c
@@ -164,12 +164,15 @@ int jffs2_read_inode_range(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 
         /* XXX FIXME: Where a single physical node actually shows up in two
            frags, we read it twice. Don't do that. */
-        /* Now we're pointing at the first frag which overlaps our page */
+        /* Now we're pointing at the first frag which overlaps our page
+         * (or perhaps is before it, if we've been asked to read off the
+         * end of the file). */
         while(offset < end) {
                 D2(printk(KERN_DEBUG "jffs2_read_inode_range: offset %d, end %d\n", offset, end));
-                if (unlikely(!frag || frag->ofs > offset)) {
+                if (unlikely(!frag || frag->ofs > offset ||
+                             frag->ofs + frag->size <= offset)) {
                         uint32_t holesize = end - offset;
-                        if (frag) {
+                        if (frag && frag->ofs > offset) {
                                 D1(printk(KERN_NOTICE "Eep. Hole in ino #%u fraglist. frag->ofs = 0x%08x, offset = 0x%08x\n", f->inocache->ino, frag->ofs, offset));
                                 holesize = min(holesize, frag->ofs - offset);
                         }
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index 70fad69eb959..fa588006588d 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -359,17 +359,13 @@ int nfs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!cookie);
 
-        if (fscache_check_page_write(cookie, page)) {
-                if (!(gfp & __GFP_WAIT))
-                        return 0;
-                fscache_wait_on_page_write(cookie, page);
-        }
-
         if (PageFsCache(page)) {
                 dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
                          cookie, page, nfsi);
 
-                fscache_uncache_page(cookie, page);
+                if (!fscache_maybe_release_page(cookie, page, gfp))
+                        return 0;
+
                 nfs_add_fscache_stats(page->mapping->host,
                                       NFSIOS_FSCACHE_PAGES_UNCACHED, 1);
         }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ff37454fa783..741a562177fc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2767,7 +2767,7 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                 .pages = &page,
                 .pgbase = 0,
                 .count = count,
-                .bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask,
+                .bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask,
         };
         struct nfs4_readdir_res res;
         struct rpc_message msg = {
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 89fc8ee1f5a5..de059f490586 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1712,7 +1712,8 @@ int ocfs2_check_range_for_refcount(struct inode *inode, loff_t pos,
         struct super_block *sb = inode->i_sb;
 
         if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb)) ||
-            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL))
+            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL) ||
+            OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL)
                 return 0;
 
         cpos = pos >> OCFS2_SB(sb)->s_clustersize_bits;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index eae404602424..d963d8638709 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -35,12 +35,7 @@
 #include <linux/kref.h>
 #include <linux/mutex.h>
 #include <linux/lockdep.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-# include "ocfs2_jbd_compat.h"
-#endif
+#include <linux/jbd2.h>
 
 /* For union ocfs2_dlm_lksb */
 #include "stackglue.h"
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 60287fc56bcb..3a0df7a1b810 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -3743,6 +3743,9 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 goto out;
         }
 
+        if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL)
+                goto attach_xattr;
+
         ocfs2_init_dinode_extent_tree(&di_et, INODE_CACHE(inode), di_bh);
 
         size = i_size_read(inode);
@@ -3769,6 +3772,7 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 cpos += num_clusters;
         }
 
+attach_xattr:
         if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) {
                 ret = ocfs2_xattr_attach_refcount_tree(inode, di_bh,
                                                        &ref_tree->rf_ci,
@@ -3858,6 +3862,49 @@ out:
         return ret;
 }
 
+static int ocfs2_duplicate_inline_data(struct inode *s_inode,
+                                       struct buffer_head *s_bh,
+                                       struct inode *t_inode,
+                                       struct buffer_head *t_bh)
+{
+        int ret;
+        handle_t *handle;
+        struct ocfs2_super *osb = OCFS2_SB(s_inode->i_sb);
+        struct ocfs2_dinode *s_di = (struct ocfs2_dinode *)s_bh->b_data;
+        struct ocfs2_dinode *t_di = (struct ocfs2_dinode *)t_bh->b_data;
+
+        BUG_ON(!(OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL));
+
+        handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                mlog_errno(ret);
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(t_inode), t_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
+        t_di->id2.i_data.id_count = s_di->id2.i_data.id_count;
+        memcpy(t_di->id2.i_data.id_data, s_di->id2.i_data.id_data,
+               le16_to_cpu(s_di->id2.i_data.id_count));
+        spin_lock(&OCFS2_I(t_inode)->ip_lock);
+        OCFS2_I(t_inode)->ip_dyn_features |= OCFS2_INLINE_DATA_FL;
+        t_di->i_dyn_features = cpu_to_le16(OCFS2_I(t_inode)->ip_dyn_features);
+        spin_unlock(&OCFS2_I(t_inode)->ip_lock);
+
+        ocfs2_journal_dirty(handle, t_bh);
+
+out_commit:
+        ocfs2_commit_trans(osb, handle);
+out:
+        return ret;
+}
+
 static int ocfs2_duplicate_extent_list(struct inode *s_inode,
                                 struct inode *t_inode,
                                 struct buffer_head *t_bh,
@@ -3997,6 +4044,14 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out;
         }
 
+        if (OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                ret = ocfs2_duplicate_inline_data(s_inode, s_bh,
+                                                  t_inode, t_bh);
+                if (ret)
+                        mlog_errno(ret);
+                goto out;
+        }
+
         ret = ocfs2_lock_refcount_tree(osb, le64_to_cpu(di->i_refcount_loc),
                                        1, &ref_tree, &ref_root_bh);
         if (ret) {
@@ -4013,10 +4068,6 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out_unlock_refcount;
         }
 
-        ret = ocfs2_complete_reflink(s_inode, s_bh, t_inode, t_bh, preserve);
-        if (ret)
-                mlog_errno(ret);
-
 out_unlock_refcount:
         ocfs2_unlock_refcount_tree(osb, ref_tree, 1);
         brelse(ref_root_bh);
@@ -4068,9 +4119,17 @@ static int __ocfs2_reflink(struct dentry *old_dentry,
                 ret = ocfs2_reflink_xattrs(inode, old_bh,
                                            new_inode, new_bh,
                                            preserve);
-                if (ret)
+                if (ret) {
                         mlog_errno(ret);
+                        goto inode_unlock;
+                }
         }
+
+        ret = ocfs2_complete_reflink(inode, old_bh,
+                                     new_inode, new_bh, preserve);
+        if (ret)
+                mlog_errno(ret);
+
 inode_unlock:
         ocfs2_inode_unlock(new_inode, 1);
         brelse(new_bh);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index c0e48aeebb1c..14f47d2bfe02 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -773,18 +773,20 @@ static int ocfs2_sb_probe(struct super_block *sb,
                 if (tmpstat < 0) {
                         status = tmpstat;
                         mlog_errno(status);
-                        goto bail;
+                        break;
                 }
                 di = (struct ocfs2_dinode *) (*bh)->b_data;
                 memset(stats, 0, sizeof(struct ocfs2_blockcheck_stats));
                 spin_lock_init(&stats->b_lock);
-                status = ocfs2_verify_volume(di, *bh, blksize, stats);
-                if (status >= 0)
-                        goto bail;
-                brelse(*bh);
-                *bh = NULL;
-                if (status != -EAGAIN)
+                tmpstat = ocfs2_verify_volume(di, *bh, blksize, stats);
+                if (tmpstat < 0) {
+                        brelse(*bh);
+                        *bh = NULL;
+                }
+                if (tmpstat != -EAGAIN) {
+                        status = tmpstat;
                         break;
+                }
         }
 
 bail:
@@ -1645,6 +1647,10 @@ static int ocfs2_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bavail = buf->f_bfree;
         buf->f_files = numbits;
         buf->f_ffree = freebits;
+        buf->f_fsid.val[0] = crc32_le(0, osb->uuid_str, OCFS2_VOL_UUID_LEN)
+                                & 0xFFFFFFFFUL;
+        buf->f_fsid.val[1] = crc32_le(0, osb->uuid_str + OCFS2_VOL_UUID_LEN,
+                                OCFS2_VOL_UUID_LEN) & 0xFFFFFFFFUL;
 
         brelse(bh);
 
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index b6284f235d2f..c61369342a27 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -53,11 +53,6 @@
 #include <linux/highmem.h>
 #include <linux/buffer_head.h>
 #include <linux/rbtree.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-#endif
 
 #define MLOG_MASK_PREFIX ML_UPTODATE
 
diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
index 84d3532dd3ea..7be0c6fbe880 100644
--- a/include/linux/fscache-cache.h
+++ b/include/linux/fscache-cache.h
@@ -91,6 +91,8 @@ struct fscache_operation {
 #define FSCACHE_OP_WAITING      4       /* cleared when op is woken */
 #define FSCACHE_OP_EXCLUSIVE    5       /* exclusive op, other ops must wait */
 #define FSCACHE_OP_DEAD         6       /* op is now dead */
+#define FSCACHE_OP_DEC_READ_CNT 7       /* decrement object->n_reads on destruction */
+#define FSCACHE_OP_KEEP_FLAGS   0xc0    /* flags to keep when repurposing an op */
 
         atomic_t                usage;
         unsigned                debug_id;       /* debugging ID */
@@ -102,6 +104,16 @@ struct fscache_operation {
 
         /* operation releaser */
         fscache_operation_release_t release;
+
+#ifdef CONFIG_SLOW_WORK_PROC
+        const char *name;               /* operation name */
+        const char *state;              /* operation state */
+#define fscache_set_op_name(OP, N)      do { (OP)->name  = (N); } while(0)
+#define fscache_set_op_state(OP, S)     do { (OP)->state = (S); } while(0)
+#else
+#define fscache_set_op_name(OP, N)      do { } while(0)
+#define fscache_set_op_state(OP, S)     do { } while(0)
+#endif
 };
 
 extern atomic_t fscache_op_debug_id;
@@ -125,6 +137,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
         op->debug_id = atomic_inc_return(&fscache_op_debug_id);
         op->release = release;
         INIT_LIST_HEAD(&op->pend_link);
+        fscache_set_op_state(op, "Init");
 }
 
 /**
@@ -221,8 +234,10 @@ struct fscache_cache_ops {
         struct fscache_object *(*alloc_object)(struct fscache_cache *cache,
                                                struct fscache_cookie *cookie);
 
-        /* look up the object for a cookie */
-        void (*lookup_object)(struct fscache_object *object);
+        /* look up the object for a cookie
+         * - return -ETIMEDOUT to be requeued
+         */
+        int (*lookup_object)(struct fscache_object *object);
 
         /* finished looking up */
         void (*lookup_complete)(struct fscache_object *object);
@@ -297,12 +312,14 @@ struct fscache_cookie {
         atomic_t                        usage;          /* number of users of this cookie */
         atomic_t                        n_children;     /* number of children of this cookie */
         spinlock_t                      lock;
+        spinlock_t                      stores_lock;    /* lock on page store tree */
         struct hlist_head               backing_objects; /* object(s) backing this file/index */
         const struct fscache_cookie_def *def;           /* definition */
         struct fscache_cookie           *parent;        /* parent of this entry */
         void                            *netfs_data;    /* back pointer to netfs */
         struct radix_tree_root          stores;         /* pages to be stored on this cookie */
 #define FSCACHE_COOKIE_PENDING_TAG      0               /* pages tag: pending write to cache */
+#define FSCACHE_COOKIE_STORING_TAG      1               /* pages tag: writing to cache */
 
         unsigned long                   flags;
 #define FSCACHE_COOKIE_LOOKING_UP       0       /* T if non-index cookie being looked up still */
@@ -337,6 +354,7 @@ struct fscache_object {
                 FSCACHE_OBJECT_RECYCLING,       /* retiring object */
                 FSCACHE_OBJECT_WITHDRAWING,     /* withdrawing object */
                 FSCACHE_OBJECT_DEAD,            /* object is now dead */
+                FSCACHE_OBJECT__NSTATES
         } state;
 
         int                     debug_id;       /* debugging ID */
@@ -345,6 +363,7 @@ struct fscache_object {
         int                     n_obj_ops;      /* number of object ops outstanding on object */
         int                     n_in_progress;  /* number of ops in progress */
         int                     n_exclusive;    /* number of exclusive ops queued */
+        atomic_t                n_reads;        /* number of read ops in progress */
         spinlock_t              lock;           /* state and operations lock */
 
         unsigned long           lookup_jif;     /* time at which lookup started */
@@ -358,6 +377,7 @@ struct fscache_object {
 #define FSCACHE_OBJECT_EV_RELEASE       4       /* T if netfs requested object release */
 #define FSCACHE_OBJECT_EV_RETIRE        5       /* T if netfs requested object retirement */
 #define FSCACHE_OBJECT_EV_WITHDRAW      6       /* T if cache requested object withdrawal */
+#define FSCACHE_OBJECT_EVENTS_MASK      0x7f    /* mask of all events*/
 
         unsigned long           flags;
 #define FSCACHE_OBJECT_LOCK             0       /* T if object is busy being processed */
@@ -373,7 +393,11 @@ struct fscache_object {
         struct list_head        dependents;     /* FIFO of dependent objects */
         struct list_head        dep_link;       /* link in parent's dependents list */
         struct list_head        pending_ops;    /* unstarted operations on this object */
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        struct rb_node          objlist_link;   /* link in global object list */
+#endif
         pgoff_t                 store_limit;    /* current storage limit */
+        loff_t                  store_limit_l;  /* current storage limit */
 };
 
 extern const char *fscache_object_states[];
@@ -383,6 +407,10 @@ extern const char *fscache_object_states[];
          (obj)->state >= FSCACHE_OBJECT_AVAILABLE &&          \
          (obj)->state < FSCACHE_OBJECT_DYING)
 
+#define fscache_object_is_dead(obj)                             \
+        (test_bit(FSCACHE_IOERROR, &(obj)->cache->flags) &&     \
+         (obj)->state >= FSCACHE_OBJECT_DYING)
+
 extern const struct slow_work_ops fscache_object_slow_work_ops;
 
 /**
@@ -414,6 +442,7 @@ void fscache_object_init(struct fscache_object *object,
         object->events = object->event_mask = 0;
         object->flags = 0;
         object->store_limit = 0;
+        object->store_limit_l = 0;
         object->cache = cache;
         object->cookie = cookie;
         object->parent = NULL;
@@ -422,6 +451,12 @@ void fscache_object_init(struct fscache_object *object,
 extern void fscache_object_lookup_negative(struct fscache_object *object);
 extern void fscache_obtained_object(struct fscache_object *object);
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+extern void fscache_object_destroy(struct fscache_object *object);
+#else
+#define fscache_object_destroy(object) do {} while(0)
+#endif
+
 /**
  * fscache_object_destroyed - Note destruction of an object in a cache
  * @cache: The cache from which the object came
@@ -460,6 +495,7 @@ static inline void fscache_object_lookup_error(struct fscache_object *object)
 static inline
 void fscache_set_store_limit(struct fscache_object *object, loff_t i_size)
 {
+        object->store_limit_l = i_size;
         object->store_limit = i_size >> PAGE_SHIFT;
         if (i_size & ~PAGE_MASK)
                 object->store_limit++;
diff --git a/include/linux/fscache.h b/include/linux/fscache.h
index 6d8ee466e0a0..595ce49288b7 100644
--- a/include/linux/fscache.h
+++ b/include/linux/fscache.h
@@ -202,6 +202,8 @@ extern int __fscache_write_page(struct fscache_cookie *, struct page *, gfp_t);
 extern void __fscache_uncache_page(struct fscache_cookie *, struct page *);
 extern bool __fscache_check_page_write(struct fscache_cookie *, struct page *);
 extern void __fscache_wait_on_page_write(struct fscache_cookie *, struct page *);
+extern bool __fscache_maybe_release_page(struct fscache_cookie *, struct page *,
+                                         gfp_t);
 
 /**
  * fscache_register_netfs - Register a filesystem as desiring caching services
@@ -615,4 +617,29 @@ void fscache_wait_on_page_write(struct fscache_cookie *cookie,
                 __fscache_wait_on_page_write(cookie, page);
 }
 
+/**
+ * fscache_maybe_release_page - Consider releasing a page, cancelling a store
+ * @cookie: The cookie representing the cache object
+ * @page: The netfs page that is being cached.
+ * @gfp: The gfp flags passed to releasepage()
+ *
+ * Consider releasing a page for the vmscan algorithm, on behalf of the netfs's
+ * releasepage() call.  A storage request on the page may cancelled if it is
+ * not currently being processed.
+ *
+ * The function returns true if the page no longer has a storage request on it,
+ * and false if a storage request is left in place.  If true is returned, the
+ * page will have been passed to fscache_uncache_page().  If false is returned
+ * the page cannot be freed yet.
+ */
+static inline
+bool fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                struct page *page,
+                                gfp_t gfp)
+{
+        if (fscache_cookie_valid(cookie) && PageFsCache(page))
+                return __fscache_maybe_release_page(cookie, page, gfp);
+        return false;
+}
+
 #endif /* _LINUX_FSCACHE_H */
diff --git a/include/linux/i2c-pnx.h b/include/linux/i2c-pnx.h
index f13255e06406..9eb07bbc6522 100644
--- a/include/linux/i2c-pnx.h
+++ b/include/linux/i2c-pnx.h
@@ -21,7 +21,7 @@ struct i2c_pnx_mif {
         int                     mode;           /* Interface mode */
         struct completion       complete;       /* I/O completion */
         struct timer_list       timer;          /* Timeout */
-        char *                  buf;            /* Data buffer */
+        u8 *                    buf;            /* Data buffer */
         int                     len;            /* Length of data buffer */
 };
 
diff --git a/include/linux/slow-work.h b/include/linux/slow-work.h
index b65c8881f07a..5035a2691739 100644
--- a/include/linux/slow-work.h
+++ b/include/linux/slow-work.h
@@ -17,13 +17,20 @@
 #ifdef CONFIG_SLOW_WORK
 
 #include <linux/sysctl.h>
+#include <linux/timer.h>
 
 struct slow_work;
+#ifdef CONFIG_SLOW_WORK_PROC
+struct seq_file;
+#endif
 
 /*
  * The operations used to support slow work items
  */
 struct slow_work_ops {
+        /* owner */
+        struct module *owner;
+
         /* get a ref on a work item
          * - return 0 if successful, -ve if not
          */
@@ -34,6 +41,11 @@ struct slow_work_ops {
 
         /* execute a work item */
         void (*execute)(struct slow_work *work);
+
+#ifdef CONFIG_SLOW_WORK_PROC
+        /* describe a work item for /proc */
+        void (*desc)(struct slow_work *work, struct seq_file *m);
+#endif
 };
 
 /*
@@ -42,13 +54,24 @@ struct slow_work_ops {
  *   queued
  */
 struct slow_work {
+        struct module           *owner; /* the owning module */
         unsigned long           flags;
 #define SLOW_WORK_PENDING       0       /* item pending (further) execution */
 #define SLOW_WORK_EXECUTING     1       /* item currently executing */
 #define SLOW_WORK_ENQ_DEFERRED  2       /* item enqueue deferred */
 #define SLOW_WORK_VERY_SLOW     3       /* item is very slow */
+#define SLOW_WORK_CANCELLING    4       /* item is being cancelled, don't enqueue */
+#define SLOW_WORK_DELAYED       5       /* item is struct delayed_slow_work with active timer */
         const struct slow_work_ops *ops; /* operations table for this item */
         struct list_head        link;   /* link in queue */
+#ifdef CONFIG_SLOW_WORK_PROC
+        struct timespec         mark;   /* jiffies at which queued or exec begun */
+#endif
+};
+
+struct delayed_slow_work {
+        struct slow_work        work;
+        struct timer_list       timer;
 };
 
 /**
@@ -67,6 +90,20 @@ static inline void slow_work_init(struct slow_work *work,
 }
 
 /**
+ * slow_work_init - Initialise a delayed slow work item
+ * @work: The work item to initialise
+ * @ops: The operations to use to handle the slow work item
+ *
+ * Initialise a delayed slow work item.
+ */
+static inline void delayed_slow_work_init(struct delayed_slow_work *dwork,
+                                          const struct slow_work_ops *ops)
+{
+        init_timer(&dwork->timer);
+        slow_work_init(&dwork->work, ops);
+}
+
+/**
  * vslow_work_init - Initialise a very slow work item
  * @work: The work item to initialise
  * @ops: The operations to use to handle the slow work item
@@ -83,9 +120,40 @@ static inline void vslow_work_init(struct slow_work *work,
         INIT_LIST_HEAD(&work->link);
 }
 
+/**
+ * slow_work_is_queued - Determine if a slow work item is on the work queue
+ * work: The work item to test
+ *
+ * Determine if the specified slow-work item is on the work queue.  This
+ * returns true if it is actually on the queue.
+ *
+ * If the item is executing and has been marked for requeue when execution
+ * finishes, then false will be returned.
+ *
+ * Anyone wishing to wait for completion of execution can wait on the
+ * SLOW_WORK_EXECUTING bit.
+ */
+static inline bool slow_work_is_queued(struct slow_work *work)
+{
+        unsigned long flags = work->flags;
+        return flags & SLOW_WORK_PENDING && !(flags & SLOW_WORK_EXECUTING);
+}
+
 extern int slow_work_enqueue(struct slow_work *work);
-extern int slow_work_register_user(void);
-extern void slow_work_unregister_user(void);
+extern void slow_work_cancel(struct slow_work *work);
+extern int slow_work_register_user(struct module *owner);
+extern void slow_work_unregister_user(struct module *owner);
+
+extern int delayed_slow_work_enqueue(struct delayed_slow_work *dwork,
+                                     unsigned long delay);
+
+static inline void delayed_slow_work_cancel(struct delayed_slow_work *dwork)
+{
+        slow_work_cancel(&dwork->work);
+}
+
+extern bool slow_work_sleep_till_thread_needed(struct slow_work *work,
+                                               signed long *_timeout);
 
 #ifdef CONFIG_SYSCTL
 extern ctl_table slow_work_sysctls[];
diff --git a/include/linux/vt.h b/include/linux/vt.h
index 7afca0d72139..7ffa11f06232 100644
--- a/include/linux/vt.h
+++ b/include/linux/vt.h
@@ -70,8 +70,8 @@ struct vt_event {
 #define VT_EVENT_UNBLANK        0x0004  /* Screen unblank */
 #define VT_EVENT_RESIZE         0x0008  /* Resize display */
 #define VT_MAX_EVENT            0x000F
-        unsigned int old;               /* Old console */
-        unsigned int new;               /* New console (if changing) */
+        unsigned int oldev;             /* Old console */
+        unsigned int newev;             /* New console (if changing) */
         unsigned int pad[4];            /* Padding for expansion */
 };
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index cd2e18778f81..0a474568b003 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -893,7 +893,6 @@ struct sctp_transport {
          */
         /* RTO         : The current retransmission timeout value.  */
         unsigned long rto;
-        unsigned long last_rto;
 
         __u32 rtt;              /* This is the most recent RTT.  */
 
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 9af48cbf0036..f097ae340bc1 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -145,6 +145,7 @@ struct scsi_device {
         unsigned retry_hwerror:1;       /* Retry HARDWARE_ERROR */
         unsigned last_sector_bug:1;     /* do not use multisector accesses on
                                            SD_LAST_BUGGY_SECTORS */
+        unsigned is_visible:1;  /* is the device visible in sysfs */
 
         DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */
         struct list_head event_list;    /* asserted events */
diff --git a/init/Kconfig b/init/Kconfig
index 9e03ef8b311e..ab5c64801fe5 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1098,6 +1098,16 @@ config SLOW_WORK
 
           See Documentation/slow-work.txt.
 
+config SLOW_WORK_PROC
+        bool "Slow work debugging through /proc"
+        default n
+        depends on SLOW_WORK && PROC_FS
+        help
+          Display the contents of the slow work run queue through /proc,
+          including items currently executing.
+
+          See Documentation/slow-work.txt.
+
 endmenu         # General setup
 
 config HAVE_GENERIC_DMA_COHERENT
diff --git a/kernel/Makefile b/kernel/Makefile
index b8d4cd8ac0b9..776ffed1556d 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -94,6 +94,7 @@ obj-$(CONFIG_X86_DS) += trace/
 obj-$(CONFIG_RING_BUFFER) += trace/
 obj-$(CONFIG_SMP) += sched_cpupri.o
 obj-$(CONFIG_SLOW_WORK) += slow-work.o
+obj-$(CONFIG_SLOW_WORK_PROC) += slow-work-proc.o
 obj-$(CONFIG_PERF_EVENTS) += perf_event.o
 
 ifneq ($(CONFIG_SCHED_OMIT_FRAME_POINTER),y)
diff --git a/kernel/slow-work-proc.c b/kernel/slow-work-proc.c
new file mode 100644
index 000000000000..3988032571f5
--- /dev/null
+++ b/kernel/slow-work-proc.c
@@ -0,0 +1,227 @@
+/* Slow work debugging
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/slow-work.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/seq_file.h>
+#include "slow-work.h"
+
+#define ITERATOR_SHIFT          (BITS_PER_LONG - 4)
+#define ITERATOR_SELECTOR       (0xfUL << ITERATOR_SHIFT)
+#define ITERATOR_COUNTER        (~ITERATOR_SELECTOR)
+
+void slow_work_new_thread_desc(struct slow_work *work, struct seq_file *m)
+{
+        seq_puts(m, "Slow-work: New thread");
+}
+
+/*
+ * Render the time mark field on a work item into a 5-char time with units plus
+ * a space
+ */
+static void slow_work_print_mark(struct seq_file *m, struct slow_work *work)
+{
+        struct timespec now, diff;
+
+        now = CURRENT_TIME;
+        diff = timespec_sub(now, work->mark);
+
+        if (diff.tv_sec < 0)
+                seq_puts(m, "  -ve ");
+        else if (diff.tv_sec == 0 && diff.tv_nsec < 1000)
+                seq_printf(m, "%3luns ", diff.tv_nsec);
+        else if (diff.tv_sec == 0 && diff.tv_nsec < 1000000)
+                seq_printf(m, "%3luus ", diff.tv_nsec / 1000);
+        else if (diff.tv_sec == 0 && diff.tv_nsec < 1000000000)
+                seq_printf(m, "%3lums ", diff.tv_nsec / 1000000);
+        else if (diff.tv_sec <= 1)
+                seq_puts(m, "   1s ");
+        else if (diff.tv_sec < 60)
+                seq_printf(m, "%4lus ", diff.tv_sec);
+        else if (diff.tv_sec < 60 * 60)
+                seq_printf(m, "%4lum ", diff.tv_sec / 60);
+        else if (diff.tv_sec < 60 * 60 * 24)
+                seq_printf(m, "%4luh ", diff.tv_sec / 3600);
+        else
+                seq_puts(m, "exces ");
+}
+
+/*
+ * Describe a slow work item for /proc
+ */
+static int slow_work_runqueue_show(struct seq_file *m, void *v)
+{
+        struct slow_work *work;
+        struct list_head *p = v;
+        unsigned long id;
+
+        switch ((unsigned long) v) {
+        case 1:
+                seq_puts(m, "THR PID   ITEM ADDR        FL MARK  DESC\n");
+                return 0;
+        case 2:
+                seq_puts(m, "=== ===== ================ == ===== ==========\n");
+                return 0;
+
+        case 3 ... 3 + SLOW_WORK_THREAD_LIMIT - 1:
+                id = (unsigned long) v - 3;
+
+                read_lock(&slow_work_execs_lock);
+                work = slow_work_execs[id];
+                if (work) {
+                        smp_read_barrier_depends();
+
+                        seq_printf(m, "%3lu %5d %16p %2lx ",
+                                   id, slow_work_pids[id], work, work->flags);
+                        slow_work_print_mark(m, work);
+
+                        if (work->ops->desc)
+                                work->ops->desc(work, m);
+                        seq_putc(m, '\n');
+                }
+                read_unlock(&slow_work_execs_lock);
+                return 0;
+
+        default:
+                work = list_entry(p, struct slow_work, link);
+                seq_printf(m, "%3s     - %16p %2lx ",
+                           work->flags & SLOW_WORK_VERY_SLOW ? "vsq" : "sq",
+                           work, work->flags);
+                slow_work_print_mark(m, work);
+
+                if (work->ops->desc)
+                        work->ops->desc(work, m);
+                seq_putc(m, '\n');
+                return 0;
+        }
+}
+
+/*
+ * map the iterator to a work item
+ */
+static void *slow_work_runqueue_index(struct seq_file *m, loff_t *_pos)
+{
+        struct list_head *p;
+        unsigned long count, id;
+
+        switch (*_pos >> ITERATOR_SHIFT) {
+        case 0x0:
+                if (*_pos == 0)
+                        *_pos = 1;
+                if (*_pos < 3)
+                        return (void *)(unsigned long) *_pos;
+                if (*_pos < 3 + SLOW_WORK_THREAD_LIMIT)
+                        for (id = *_pos - 3;
+                             id < SLOW_WORK_THREAD_LIMIT;
+                             id++, (*_pos)++)
+                                if (slow_work_execs[id])
+                                        return (void *)(unsigned long) *_pos;
+                *_pos = 0x1UL << ITERATOR_SHIFT;
+
+        case 0x1:
+                count = *_pos & ITERATOR_COUNTER;
+                list_for_each(p, &slow_work_queue) {
+                        if (count == 0)
+                                return p;
+                        count--;
+                }
+                *_pos = 0x2UL << ITERATOR_SHIFT;
+
+        case 0x2:
+                count = *_pos & ITERATOR_COUNTER;
+                list_for_each(p, &vslow_work_queue) {
+                        if (count == 0)
+                                return p;
+                        count--;
+                }
+                *_pos = 0x3UL << ITERATOR_SHIFT;
+
+        default:
+                return NULL;
+        }
+}
+
+/*
+ * set up the iterator to start reading from the first line
+ */
+static void *slow_work_runqueue_start(struct seq_file *m, loff_t *_pos)
+{
+        spin_lock_irq(&slow_work_queue_lock);
+        return slow_work_runqueue_index(m, _pos);
+}
+
+/*
+ * move to the next line
+ */
+static void *slow_work_runqueue_next(struct seq_file *m, void *v, loff_t *_pos)
+{
+        struct list_head *p = v;
+        unsigned long selector = *_pos >> ITERATOR_SHIFT;
+
+        (*_pos)++;
+        switch (selector) {
+        case 0x0:
+                return slow_work_runqueue_index(m, _pos);
+
+        case 0x1:
+                if (*_pos >> ITERATOR_SHIFT == 0x1) {
+                        p = p->next;
+                        if (p != &slow_work_queue)
+                                return p;
+                }
+                *_pos = 0x2UL << ITERATOR_SHIFT;
+                p = &vslow_work_queue;
+
+        case 0x2:
+                if (*_pos >> ITERATOR_SHIFT == 0x2) {
+                        p = p->next;
+                        if (p != &vslow_work_queue)
+                                return p;
+                }
+                *_pos = 0x3UL << ITERATOR_SHIFT;
+
+        default:
+                return NULL;
+        }
+}
+
+/*
+ * clean up after reading
+ */
+static void slow_work_runqueue_stop(struct seq_file *m, void *v)
+{
+        spin_unlock_irq(&slow_work_queue_lock);
+}
+
+static const struct seq_operations slow_work_runqueue_ops = {
+        .start          = slow_work_runqueue_start,
+        .stop           = slow_work_runqueue_stop,
+        .next           = slow_work_runqueue_next,
+        .show           = slow_work_runqueue_show,
+};
+
+/*
+ * open "/proc/slow_work_rq" to list queue contents
+ */
+static int slow_work_runqueue_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &slow_work_runqueue_ops);
+}
+
+const struct file_operations slow_work_runqueue_fops = {
+        .owner          = THIS_MODULE,
+        .open           = slow_work_runqueue_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
diff --git a/kernel/slow-work.c b/kernel/slow-work.c
index 0d31135efbf4..da94f3c101af 100644
--- a/kernel/slow-work.c
+++ b/kernel/slow-work.c
@@ -16,11 +16,8 @@
 #include <linux/kthread.h>
 #include <linux/freezer.h>
 #include <linux/wait.h>
-
-#define SLOW_WORK_CULL_TIMEOUT (5 * HZ) /* cull threads 5s after running out of
-                                         * things to do */
-#define SLOW_WORK_OOM_TIMEOUT (5 * HZ)  /* can't start new threads for 5s after
-                                         * OOM */
+#include <linux/proc_fs.h>
+#include "slow-work.h"
 
 static void slow_work_cull_timeout(unsigned long);
 static void slow_work_oom_timeout(unsigned long);
@@ -46,7 +43,7 @@ static unsigned vslow_work_proportion = 50; /* % of threads that may process
 
 #ifdef CONFIG_SYSCTL
 static const int slow_work_min_min_threads = 2;
-static int slow_work_max_max_threads = 255;
+static int slow_work_max_max_threads = SLOW_WORK_THREAD_LIMIT;
 static const int slow_work_min_vslow = 1;
 static const int slow_work_max_vslow = 99;
 
@@ -98,6 +95,32 @@ static DEFINE_TIMER(slow_work_oom_timer, slow_work_oom_timeout, 0, 0);
 static struct slow_work slow_work_new_thread; /* new thread starter */
 
 /*
+ * slow work ID allocation (use slow_work_queue_lock)
+ */
+static DECLARE_BITMAP(slow_work_ids, SLOW_WORK_THREAD_LIMIT);
+
+/*
+ * Unregistration tracking to prevent put_ref() from disappearing during module
+ * unload
+ */
+#ifdef CONFIG_MODULES
+static struct module *slow_work_thread_processing[SLOW_WORK_THREAD_LIMIT];
+static struct module *slow_work_unreg_module;
+static struct slow_work *slow_work_unreg_work_item;
+static DECLARE_WAIT_QUEUE_HEAD(slow_work_unreg_wq);
+static DEFINE_MUTEX(slow_work_unreg_sync_lock);
+#endif
+
+/*
+ * Data for tracking currently executing items for indication through /proc
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+struct slow_work *slow_work_execs[SLOW_WORK_THREAD_LIMIT];
+pid_t slow_work_pids[SLOW_WORK_THREAD_LIMIT];
+DEFINE_RWLOCK(slow_work_execs_lock);
+#endif
+
+/*
  * The queues of work items and the lock governing access to them.  These are
  * shared between all the CPUs.  It doesn't make sense to have per-CPU queues
  * as the number of threads bears no relation to the number of CPUs.
@@ -105,9 +128,18 @@ static struct slow_work slow_work_new_thread; /* new thread starter */
  * There are two queues of work items: one for slow work items, and one for
  * very slow work items.
  */
-static LIST_HEAD(slow_work_queue);
-static LIST_HEAD(vslow_work_queue);
-static DEFINE_SPINLOCK(slow_work_queue_lock);
+LIST_HEAD(slow_work_queue);
+LIST_HEAD(vslow_work_queue);
+DEFINE_SPINLOCK(slow_work_queue_lock);
+
+/*
+ * The following are two wait queues that get pinged when a work item is placed
+ * on an empty queue.  These allow work items that are hogging a thread by
+ * sleeping in a way that could be deferred to yield their thread and enqueue
+ * themselves.
+ */
+static DECLARE_WAIT_QUEUE_HEAD(slow_work_queue_waits_for_occupation);
+static DECLARE_WAIT_QUEUE_HEAD(vslow_work_queue_waits_for_occupation);
 
 /*
  * The thread controls.  A variable used to signal to the threads that they
@@ -126,6 +158,20 @@ static DECLARE_COMPLETION(slow_work_last_thread_exited);
 static int slow_work_user_count;
 static DEFINE_MUTEX(slow_work_user_lock);
 
+static inline int slow_work_get_ref(struct slow_work *work)
+{
+        if (work->ops->get_ref)
+                return work->ops->get_ref(work);
+
+        return 0;
+}
+
+static inline void slow_work_put_ref(struct slow_work *work)
+{
+        if (work->ops->put_ref)
+                work->ops->put_ref(work);
+}
+
 /*
  * Calculate the maximum number of active threads in the pool that are
  * permitted to process very slow work items.
@@ -149,8 +195,11 @@ static unsigned slow_work_calc_vsmax(void)
  * Attempt to execute stuff queued on a slow thread.  Return true if we managed
  * it, false if there was nothing to do.
  */
-static bool slow_work_execute(void)
+static noinline bool slow_work_execute(int id)
 {
+#ifdef CONFIG_MODULES
+        struct module *module;
+#endif
         struct slow_work *work = NULL;
         unsigned vsmax;
         bool very_slow;
@@ -186,6 +235,16 @@ static bool slow_work_execute(void)
         } else {
                 very_slow = false; /* avoid the compiler warning */
         }
+
+#ifdef CONFIG_MODULES
+        if (work)
+                slow_work_thread_processing[id] = work->owner;
+#endif
+        if (work) {
+                slow_work_mark_time(work);
+                slow_work_begin_exec(id, work);
+        }
+
         spin_unlock_irq(&slow_work_queue_lock);
 
         if (!work)
@@ -194,12 +253,19 @@ static bool slow_work_execute(void)
         if (!test_and_clear_bit(SLOW_WORK_PENDING, &work->flags))
                 BUG();
 
-        work->ops->execute(work);
+        /* don't execute if the work is in the process of being cancelled */
+        if (!test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                work->ops->execute(work);
 
         if (very_slow)
                 atomic_dec(&vslow_work_executing_count);
         clear_bit_unlock(SLOW_WORK_EXECUTING, &work->flags);
 
+        /* wake up anyone waiting for this work to be complete */
+        wake_up_bit(&work->flags, SLOW_WORK_EXECUTING);
+
+        slow_work_end_exec(id, work);
+
         /* if someone tried to enqueue the item whilst we were executing it,
          * then it'll be left unenqueued to avoid multiple threads trying to
          * execute it simultaneously
@@ -219,7 +285,18 @@ static bool slow_work_execute(void)
                 spin_unlock_irq(&slow_work_queue_lock);
         }
 
-        work->ops->put_ref(work);
+        /* sort out the race between module unloading and put_ref() */
+        slow_work_put_ref(work);
+
+#ifdef CONFIG_MODULES
+        module = slow_work_thread_processing[id];
+        slow_work_thread_processing[id] = NULL;
+        smp_mb();
+        if (slow_work_unreg_work_item == work ||
+            slow_work_unreg_module == module)
+                wake_up_all(&slow_work_unreg_wq);
+#endif
+
         return true;
 
 auto_requeue:
@@ -227,15 +304,61 @@ auto_requeue:
          * - we transfer our ref on the item back to the appropriate queue
          * - don't wake another thread up as we're awake already
          */
+        slow_work_mark_time(work);
         if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags))
                 list_add_tail(&work->link, &vslow_work_queue);
         else
                 list_add_tail(&work->link, &slow_work_queue);
         spin_unlock_irq(&slow_work_queue_lock);
+        slow_work_thread_processing[id] = NULL;
         return true;
 }
 
 /**
+ * slow_work_sleep_till_thread_needed - Sleep till thread needed by other work
+ * work: The work item under execution that wants to sleep
+ * _timeout: Scheduler sleep timeout
+ *
+ * Allow a requeueable work item to sleep on a slow-work processor thread until
+ * that thread is needed to do some other work or the sleep is interrupted by
+ * some other event.
+ *
+ * The caller must set up a wake up event before calling this and must have set
+ * the appropriate sleep mode (such as TASK_UNINTERRUPTIBLE) and tested its own
+ * condition before calling this function as no test is made here.
+ *
+ * False is returned if there is nothing on the queue; true is returned if the
+ * work item should be requeued
+ */
+bool slow_work_sleep_till_thread_needed(struct slow_work *work,
+                                        signed long *_timeout)
+{
+        wait_queue_head_t *wfo_wq;
+        struct list_head *queue;
+
+        DEFINE_WAIT(wait);
+
+        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags)) {
+                wfo_wq = &vslow_work_queue_waits_for_occupation;
+                queue = &vslow_work_queue;
+        } else {
+                wfo_wq = &slow_work_queue_waits_for_occupation;
+                queue = &slow_work_queue;
+        }
+
+        if (!list_empty(queue))
+                return true;
+
+        add_wait_queue_exclusive(wfo_wq, &wait);
+        if (list_empty(queue))
+                *_timeout = schedule_timeout(*_timeout);
+        finish_wait(wfo_wq, &wait);
+
+        return !list_empty(queue);
+}
+EXPORT_SYMBOL(slow_work_sleep_till_thread_needed);
+
+/**
  * slow_work_enqueue - Schedule a slow work item for processing
  * @work: The work item to queue
  *
@@ -260,16 +383,22 @@ auto_requeue:
  * allowed to pick items to execute.  This ensures that very slow items won't
  * overly block ones that are just ordinarily slow.
  *
- * Returns 0 if successful, -EAGAIN if not.
+ * Returns 0 if successful, -EAGAIN if not (or -ECANCELED if cancelled work is
+ * attempted queued)
  */
 int slow_work_enqueue(struct slow_work *work)
 {
+        wait_queue_head_t *wfo_wq;
+        struct list_head *queue;
         unsigned long flags;
+        int ret;
+
+        if (test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                return -ECANCELED;
 
         BUG_ON(slow_work_user_count <= 0);
         BUG_ON(!work);
         BUG_ON(!work->ops);
-        BUG_ON(!work->ops->get_ref);
 
         /* when honouring an enqueue request, we only promise that we will run
          * the work function in the future; we do not promise to run it once
@@ -280,8 +409,19 @@ int slow_work_enqueue(struct slow_work *work)
          * maintaining our promise
          */
         if (!test_and_set_bit_lock(SLOW_WORK_PENDING, &work->flags)) {
+                if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags)) {
+                        wfo_wq = &vslow_work_queue_waits_for_occupation;
+                        queue = &vslow_work_queue;
+                } else {
+                        wfo_wq = &slow_work_queue_waits_for_occupation;
+                        queue = &slow_work_queue;
+                }
+
                 spin_lock_irqsave(&slow_work_queue_lock, flags);
 
+                if (unlikely(test_bit(SLOW_WORK_CANCELLING, &work->flags)))
+                        goto cancelled;
+
                 /* we promise that we will not attempt to execute the work
                  * function in more than one thread simultaneously
                  *
@@ -299,25 +439,221 @@ int slow_work_enqueue(struct slow_work *work)
                 if (test_bit(SLOW_WORK_EXECUTING, &work->flags)) {
                         set_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags);
                 } else {
-                        if (work->ops->get_ref(work) < 0)
-                                goto cant_get_ref;
-                        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags))
-                                list_add_tail(&work->link, &vslow_work_queue);
-                        else
-                                list_add_tail(&work->link, &slow_work_queue);
+                        ret = slow_work_get_ref(work);
+                        if (ret < 0)
+                                goto failed;
+                        slow_work_mark_time(work);
+                        list_add_tail(&work->link, queue);
                         wake_up(&slow_work_thread_wq);
+
+                        /* if someone who could be requeued is sleeping on a
+                         * thread, then ask them to yield their thread */
+                        if (work->link.prev == queue)
+                                wake_up(wfo_wq);
                 }
 
                 spin_unlock_irqrestore(&slow_work_queue_lock, flags);
         }
         return 0;
 
-cant_get_ref:
+cancelled:
+        ret = -ECANCELED;
+failed:
         spin_unlock_irqrestore(&slow_work_queue_lock, flags);
-        return -EAGAIN;
+        return ret;
 }
 EXPORT_SYMBOL(slow_work_enqueue);
 
+static int slow_work_wait(void *word)
+{
+        schedule();
+        return 0;
+}
+
+/**
+ * slow_work_cancel - Cancel a slow work item
+ * @work: The work item to cancel
+ *
+ * This function will cancel a previously enqueued work item. If we cannot
+ * cancel the work item, it is guarenteed to have run when this function
+ * returns.
+ */
+void slow_work_cancel(struct slow_work *work)
+{
+        bool wait = true, put = false;
+
+        set_bit(SLOW_WORK_CANCELLING, &work->flags);
+        smp_mb();
+
+        /* if the work item is a delayed work item with an active timer, we
+         * need to wait for the timer to finish _before_ getting the spinlock,
+         * lest we deadlock against the timer routine
+         *
+         * the timer routine will leave DELAYED set if it notices the
+         * CANCELLING flag in time
+         */
+        if (test_bit(SLOW_WORK_DELAYED, &work->flags)) {
+                struct delayed_slow_work *dwork =
+                        container_of(work, struct delayed_slow_work, work);
+                del_timer_sync(&dwork->timer);
+        }
+
+        spin_lock_irq(&slow_work_queue_lock);
+
+        if (test_bit(SLOW_WORK_DELAYED, &work->flags)) {
+                /* the timer routine aborted or never happened, so we are left
+                 * holding the timer's reference on the item and should just
+                 * drop the pending flag and wait for any ongoing execution to
+                 * finish */
+                struct delayed_slow_work *dwork =
+                        container_of(work, struct delayed_slow_work, work);
+
+                BUG_ON(timer_pending(&dwork->timer));
+                BUG_ON(!list_empty(&work->link));
+
+                clear_bit(SLOW_WORK_DELAYED, &work->flags);
+                put = true;
+                clear_bit(SLOW_WORK_PENDING, &work->flags);
+
+        } else if (test_bit(SLOW_WORK_PENDING, &work->flags) &&
+                   !list_empty(&work->link)) {
+                /* the link in the pending queue holds a reference on the item
+                 * that we will need to release */
+                list_del_init(&work->link);
+                wait = false;
+                put = true;
+                clear_bit(SLOW_WORK_PENDING, &work->flags);
+
+        } else if (test_and_clear_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags)) {
+                /* the executor is holding our only reference on the item, so
+                 * we merely need to wait for it to finish executing */
+                clear_bit(SLOW_WORK_PENDING, &work->flags);
+        }
+
+        spin_unlock_irq(&slow_work_queue_lock);
+
+        /* the EXECUTING flag is set by the executor whilst the spinlock is set
+         * and before the item is dequeued - so assuming the above doesn't
+         * actually dequeue it, simply waiting for the EXECUTING flag to be
+         * released here should be sufficient */
+        if (wait)
+                wait_on_bit(&work->flags, SLOW_WORK_EXECUTING, slow_work_wait,
+                            TASK_UNINTERRUPTIBLE);
+
+        clear_bit(SLOW_WORK_CANCELLING, &work->flags);
+        if (put)
+                slow_work_put_ref(work);
+}
+EXPORT_SYMBOL(slow_work_cancel);
+
+/*
+ * Handle expiry of the delay timer, indicating that a delayed slow work item
+ * should now be queued if not cancelled
+ */
+static void delayed_slow_work_timer(unsigned long data)
+{
+        wait_queue_head_t *wfo_wq;
+        struct list_head *queue;
+        struct slow_work *work = (struct slow_work *) data;
+        unsigned long flags;
+        bool queued = false, put = false, first = false;
+
+        if (test_bit(SLOW_WORK_VERY_SLOW, &work->flags)) {
+                wfo_wq = &vslow_work_queue_waits_for_occupation;
+                queue = &vslow_work_queue;
+        } else {
+                wfo_wq = &slow_work_queue_waits_for_occupation;
+                queue = &slow_work_queue;
+        }
+
+        spin_lock_irqsave(&slow_work_queue_lock, flags);
+        if (likely(!test_bit(SLOW_WORK_CANCELLING, &work->flags))) {
+                clear_bit(SLOW_WORK_DELAYED, &work->flags);
+
+                if (test_bit(SLOW_WORK_EXECUTING, &work->flags)) {
+                        /* we discard the reference the timer was holding in
+                         * favour of the one the executor holds */
+                        set_bit(SLOW_WORK_ENQ_DEFERRED, &work->flags);
+                        put = true;
+                } else {
+                        slow_work_mark_time(work);
+                        list_add_tail(&work->link, queue);
+                        queued = true;
+                        if (work->link.prev == queue)
+                                first = true;
+                }
+        }
+
+        spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        if (put)
+                slow_work_put_ref(work);
+        if (first)
+                wake_up(wfo_wq);
+        if (queued)
+                wake_up(&slow_work_thread_wq);
+}
+
+/**
+ * delayed_slow_work_enqueue - Schedule a delayed slow work item for processing
+ * @dwork: The delayed work item to queue
+ * @delay: When to start executing the work, in jiffies from now
+ *
+ * This is similar to slow_work_enqueue(), but it adds a delay before the work
+ * is actually queued for processing.
+ *
+ * The item can have delayed processing requested on it whilst it is being
+ * executed.  The delay will begin immediately, and if it expires before the
+ * item finishes executing, the item will be placed back on the queue when it
+ * has done executing.
+ */
+int delayed_slow_work_enqueue(struct delayed_slow_work *dwork,
+                              unsigned long delay)
+{
+        struct slow_work *work = &dwork->work;
+        unsigned long flags;
+        int ret;
+
+        if (delay == 0)
+                return slow_work_enqueue(&dwork->work);
+
+        BUG_ON(slow_work_user_count <= 0);
+        BUG_ON(!work);
+        BUG_ON(!work->ops);
+
+        if (test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                return -ECANCELED;
+
+        if (!test_and_set_bit_lock(SLOW_WORK_PENDING, &work->flags)) {
+                spin_lock_irqsave(&slow_work_queue_lock, flags);
+
+                if (test_bit(SLOW_WORK_CANCELLING, &work->flags))
+                        goto cancelled;
+
+                /* the timer holds a reference whilst it is pending */
+                ret = work->ops->get_ref(work);
+                if (ret < 0)
+                        goto cant_get_ref;
+
+                if (test_and_set_bit(SLOW_WORK_DELAYED, &work->flags))
+                        BUG();
+                dwork->timer.expires = jiffies + delay;
+                dwork->timer.data = (unsigned long) work;
+                dwork->timer.function = delayed_slow_work_timer;
+                add_timer(&dwork->timer);
+
+                spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        }
+
+        return 0;
+
+cancelled:
+        ret = -ECANCELED;
+cant_get_ref:
+        spin_unlock_irqrestore(&slow_work_queue_lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(delayed_slow_work_enqueue);
+
 /*
  * Schedule a cull of the thread pool at some time in the near future
  */
@@ -368,13 +704,23 @@ static inline bool slow_work_available(int vsmax)
  */
 static int slow_work_thread(void *_data)
 {
-        int vsmax;
+        int vsmax, id;
 
         DEFINE_WAIT(wait);
 
         set_freezable();
         set_user_nice(current, -5);
 
+        /* allocate ourselves an ID */
+        spin_lock_irq(&slow_work_queue_lock);
+        id = find_first_zero_bit(slow_work_ids, SLOW_WORK_THREAD_LIMIT);
+        BUG_ON(id < 0 || id >= SLOW_WORK_THREAD_LIMIT);
+        __set_bit(id, slow_work_ids);
+        slow_work_set_thread_pid(id, current->pid);
+        spin_unlock_irq(&slow_work_queue_lock);
+
+        sprintf(current->comm, "kslowd%03u", id);
+
         for (;;) {
                 vsmax = vslow_work_proportion;
                 vsmax *= atomic_read(&slow_work_thread_count);
@@ -395,7 +741,7 @@ static int slow_work_thread(void *_data)
                 vsmax *= atomic_read(&slow_work_thread_count);
                 vsmax /= 100;
 
-                if (slow_work_available(vsmax) && slow_work_execute()) {
+                if (slow_work_available(vsmax) && slow_work_execute(id)) {
                         cond_resched();
                         if (list_empty(&slow_work_queue) &&
                             list_empty(&vslow_work_queue) &&
@@ -412,6 +758,11 @@ static int slow_work_thread(void *_data)
                         break;
         }
 
+        spin_lock_irq(&slow_work_queue_lock);
+        slow_work_set_thread_pid(id, 0);
+        __clear_bit(id, slow_work_ids);
+        spin_unlock_irq(&slow_work_queue_lock);
+
         if (atomic_dec_and_test(&slow_work_thread_count))
                 complete_and_exit(&slow_work_last_thread_exited, 0);
         return 0;
@@ -427,21 +778,6 @@ static void slow_work_cull_timeout(unsigned long data)
 }
 
 /*
- * Get a reference on slow work thread starter
- */
-static int slow_work_new_thread_get_ref(struct slow_work *work)
-{
-        return 0;
-}
-
-/*
- * Drop a reference on slow work thread starter
- */
-static void slow_work_new_thread_put_ref(struct slow_work *work)
-{
-}
-
-/*
  * Start a new slow work thread
  */
 static void slow_work_new_thread_execute(struct slow_work *work)
@@ -475,9 +811,11 @@ static void slow_work_new_thread_execute(struct slow_work *work)
 }
 
 static const struct slow_work_ops slow_work_new_thread_ops = {
-        .get_ref        = slow_work_new_thread_get_ref,
-        .put_ref        = slow_work_new_thread_put_ref,
+        .owner          = THIS_MODULE,
         .execute        = slow_work_new_thread_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = slow_work_new_thread_desc,
+#endif
 };
 
 /*
@@ -546,12 +884,13 @@ static int slow_work_max_threads_sysctl(struct ctl_table *table, int write,
 
 /**
  * slow_work_register_user - Register a user of the facility
+ * @module: The module about to make use of the facility
  *
  * Register a user of the facility, starting up the initial threads if there
  * aren't any other users at this point.  This will return 0 if successful, or
  * an error if not.
  */
-int slow_work_register_user(void)
+int slow_work_register_user(struct module *module)
 {
         struct task_struct *p;
         int loop;
@@ -598,14 +937,79 @@ error:
 }
 EXPORT_SYMBOL(slow_work_register_user);
 
+/*
+ * wait for all outstanding items from the calling module to complete
+ * - note that more items may be queued whilst we're waiting
+ */
+static void slow_work_wait_for_items(struct module *module)
+{
+        DECLARE_WAITQUEUE(myself, current);
+        struct slow_work *work;
+        int loop;
+
+        mutex_lock(&slow_work_unreg_sync_lock);
+        add_wait_queue(&slow_work_unreg_wq, &myself);
+
+        for (;;) {
+                spin_lock_irq(&slow_work_queue_lock);
+
+                /* first of all, we wait for the last queued item in each list
+                 * to be processed */
+                list_for_each_entry_reverse(work, &vslow_work_queue, link) {
+                        if (work->owner == module) {
+                                set_current_state(TASK_UNINTERRUPTIBLE);
+                                slow_work_unreg_work_item = work;
+                                goto do_wait;
+                        }
+                }
+                list_for_each_entry_reverse(work, &slow_work_queue, link) {
+                        if (work->owner == module) {
+                                set_current_state(TASK_UNINTERRUPTIBLE);
+                                slow_work_unreg_work_item = work;
+                                goto do_wait;
+                        }
+                }
+
+                /* then we wait for the items being processed to finish */
+                slow_work_unreg_module = module;
+                smp_mb();
+                for (loop = 0; loop < SLOW_WORK_THREAD_LIMIT; loop++) {
+                        if (slow_work_thread_processing[loop] == module)
+                                goto do_wait;
+                }
+                spin_unlock_irq(&slow_work_queue_lock);
+                break; /* okay, we're done */
+
+        do_wait:
+                spin_unlock_irq(&slow_work_queue_lock);
+                schedule();
+                slow_work_unreg_work_item = NULL;
+                slow_work_unreg_module = NULL;
+        }
+
+        remove_wait_queue(&slow_work_unreg_wq, &myself);
+        mutex_unlock(&slow_work_unreg_sync_lock);
+}
+
 /**
  * slow_work_unregister_user - Unregister a user of the facility
+ * @module: The module whose items should be cleared
  *
  * Unregister a user of the facility, killing all the threads if this was the
  * last one.
+ *
+ * This waits for all the work items belonging to the nominated module to go
+ * away before proceeding.
  */
-void slow_work_unregister_user(void)
+void slow_work_unregister_user(struct module *module)
 {
+        /* first of all, wait for all outstanding items from the calling module
+         * to complete */
+        if (module)
+                slow_work_wait_for_items(module);
+
+        /* then we can actually go about shutting down the facility if need
+         * be */
         mutex_lock(&slow_work_user_lock);
 
         BUG_ON(slow_work_user_count <= 0);
@@ -639,6 +1043,10 @@ static int __init init_slow_work(void)
         if (slow_work_max_max_threads < nr_cpus * 2)
                 slow_work_max_max_threads = nr_cpus * 2;
 #endif
+#ifdef CONFIG_SLOW_WORK_PROC
+        proc_create("slow_work_rq", S_IFREG | 0400, NULL,
+                    &slow_work_runqueue_fops);
+#endif
         return 0;
 }
 
diff --git a/kernel/slow-work.h b/kernel/slow-work.h
new file mode 100644
index 000000000000..3c2f007f3ad6
--- /dev/null
+++ b/kernel/slow-work.h
@@ -0,0 +1,72 @@
+/* Slow work private definitions
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define SLOW_WORK_CULL_TIMEOUT (5 * HZ) /* cull threads 5s after running out of
+                                         * things to do */
+#define SLOW_WORK_OOM_TIMEOUT (5 * HZ)  /* can't start new threads for 5s after
+                                         * OOM */
+
+#define SLOW_WORK_THREAD_LIMIT  255     /* abs maximum number of slow-work threads */
+
+/*
+ * slow-work.c
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+extern struct slow_work *slow_work_execs[];
+extern pid_t slow_work_pids[];
+extern rwlock_t slow_work_execs_lock;
+#endif
+
+extern struct list_head slow_work_queue;
+extern struct list_head vslow_work_queue;
+extern spinlock_t slow_work_queue_lock;
+
+/*
+ * slow-work-proc.c
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+extern const struct file_operations slow_work_runqueue_fops;
+
+extern void slow_work_new_thread_desc(struct slow_work *, struct seq_file *);
+#endif
+
+/*
+ * Helper functions
+ */
+static inline void slow_work_set_thread_pid(int id, pid_t pid)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        slow_work_pids[id] = pid;
+#endif
+}
+
+static inline void slow_work_mark_time(struct slow_work *work)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        work->mark = CURRENT_TIME;
+#endif
+}
+
+static inline void slow_work_begin_exec(int id, struct slow_work *work)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        slow_work_execs[id] = work;
+#endif
+}
+
+static inline void slow_work_end_exec(int id, struct slow_work *work)
+{
+#ifdef CONFIG_SLOW_WORK_PROC
+        write_lock(&slow_work_execs_lock);
+        slow_work_execs[id] = NULL;
+        write_unlock(&slow_work_execs_lock);
+#endif
+}
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 23abbd93cae1..92cdd9936e3d 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -200,6 +200,9 @@ radix_tree_node_free(struct radix_tree_node *node)
  * ensure that the addition of a single element in the tree cannot fail.  On
  * success, return zero, with preemption disabled.  On error, return -ENOMEM
  * with preemption not disabled.
+ *
+ * To make use of this facility, the radix tree must be initialised without
+ * __GFP_WAIT being passed to INIT_RADIX_TREE().
  */
 int radix_tree_preload(gfp_t gfp_mask)
 {
@@ -543,7 +546,6 @@ out:
 }
 EXPORT_SYMBOL(radix_tree_tag_clear);
 
-#ifndef __KERNEL__      /* Only the test harness uses this at present */
 /**
  * radix_tree_tag_get - get a tag on a radix tree node
  * @root:               radix tree root
@@ -606,7 +608,6 @@ int radix_tree_tag_get(struct radix_tree_root *root,
         }
 }
 EXPORT_SYMBOL(radix_tree_tag_get);
-#endif
 
 /**
  *      radix_tree_next_hole    -    find the next hole (not-present entry)
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 11aee09dd2a6..67a33a5a1a93 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -604,10 +604,14 @@ static void bdi_wb_shutdown(struct backing_dev_info *bdi)
 
         /*
          * Finally, kill the kernel threads. We don't need to be RCU
-         * safe anymore, since the bdi is gone from visibility.
+         * safe anymore, since the bdi is gone from visibility. Force
+         * unfreeze of the thread before calling kthread_stop(), otherwise
+         * it would never exet if it is currently stuck in the refrigerator.
          */
-        list_for_each_entry(wb, &bdi->wb_list, list)
+        list_for_each_entry(wb, &bdi->wb_list, list) {
+                wb->task->flags &= ~PF_FROZEN;
                 kthread_stop(wb->task);
+        }
 }
 
 /*
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 575f9bd51ccd..d3fe10be7219 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -563,7 +563,7 @@ out_oversize:
                 printk(KERN_INFO "Oversized IP packet from %pI4.\n",
                         &qp->saddr);
 out_fail:
-        IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
+        IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
         return err;
 }
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index c9f20e28521b..23e5e97aa617 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -423,16 +423,6 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                 if ((reason == SCTP_RTXR_FAST_RTX  &&
                             (chunk->fast_retransmit == SCTP_NEED_FRTX)) ||
                     (reason != SCTP_RTXR_FAST_RTX  && !chunk->tsn_gap_acked)) {
-                        /* If this chunk was sent less then 1 rto ago, do not
-                         * retransmit this chunk, but give the peer time
-                         * to acknowlege it.  Do this only when
-                         * retransmitting due to T3 timeout.
-                         */
-                        if (reason == SCTP_RTXR_T3_RTX &&
-                            time_before(jiffies, chunk->sent_at +
-                                                 transport->last_rto))
-                                continue;
-
                         /* RFC 2960 6.2.1 Processing a Received SACK
                          *
                          * C) Any time a DATA chunk is marked for
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 8674d4919556..efa516b47e81 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -480,7 +480,6 @@ static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
          * that indicates that we have an outstanding HB.
          */
         if (!is_hb || transport->hb_sent) {
-                transport->last_rto = transport->rto;
                 transport->rto = min((transport->rto * 2), transport->asoc->rto_max);
         }
 }
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 3b141bb32faf..37a1184d789f 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -74,7 +74,7 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
          * given destination transport address, set RTO to the protocol
          * parameter 'RTO.Initial'.
          */
-        peer->last_rto = peer->rto = msecs_to_jiffies(sctp_rto_initial);
+        peer->rto = msecs_to_jiffies(sctp_rto_initial);
         peer->rtt = 0;
         peer->rttvar = 0;
         peer->srtt = 0;
@@ -386,7 +386,6 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
                 tp->rto = tp->asoc->rto_max;
 
         tp->rtt = rtt;
-        tp->last_rto = tp->rto;
 
         /* Reset rto_pending so that a new RTT measurement is started when a
          * new data chunk is sent.
@@ -602,7 +601,7 @@ void sctp_transport_reset(struct sctp_transport *t)
          */
         t->cwnd = min(4*asoc->pathmtu, max_t(__u32, 2*asoc->pathmtu, 4380));
         t->ssthresh = asoc->peer.i.a_rwnd;
-        t->last_rto = t->rto = asoc->rto_initial;
+        t->rto = asoc->rto_initial;
         t->rtt = 0;
         t->srtt = 0;
         t->rttvar = 0;
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 22e8fd89477f..c7450c8f0a7c 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -306,24 +306,25 @@ EXPORT_SYMBOL_GPL(rpc_sockaddr2uaddr);
  * @sap: buffer into which to plant socket address
  * @salen: size of buffer
  *
+ * @uaddr does not have to be '\0'-terminated, but strict_strtoul() and
+ * rpc_pton() require proper string termination to be successful.
+ *
  * Returns the size of the socket address if successful; otherwise
  * zero is returned.
  */
 size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
                           struct sockaddr *sap, const size_t salen)
 {
-        char *c, buf[RPCBIND_MAXUADDRLEN];
+        char *c, buf[RPCBIND_MAXUADDRLEN + sizeof('\0')];
         unsigned long portlo, porthi;
         unsigned short port;
 
-        if (uaddr_len > sizeof(buf))
+        if (uaddr_len > RPCBIND_MAXUADDRLEN)
                 return 0;
 
         memcpy(buf, uaddr, uaddr_len);
 
-        buf[uaddr_len] = '\n';
-        buf[uaddr_len + 1] = '\0';
-
+        buf[uaddr_len] = '\0';
         c = strrchr(buf, '.');
         if (unlikely(c == NULL))
                 return 0;
@@ -332,9 +333,7 @@ size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
         if (unlikely(portlo > 255))
                 return 0;
 
-        c[0] = '\n';
-        c[1] = '\0';
-
+        *c = '\0';
         c = strrchr(buf, '.');
         if (unlikely(c == NULL))
                 return 0;
@@ -345,8 +344,7 @@ size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
 
         port = (unsigned short)((porthi << 8) | portlo);
 
-        c[0] = '\0';
-
+        *c = '\0';
         if (rpc_pton(buf, strlen(buf), sap, salen) == 0)
                 return 0;
 
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 6d69c7ccdcc7..80599e3a7994 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -30,7 +30,7 @@ silentoldconfig: $(obj)/conf
         $< -s $(Kconfig)
 
 localmodconfig: $(obj)/streamline_config.pl $(obj)/conf
-        $(Q)perl $< $(Kconfig) > .tmp.config
+        $(Q)perl $< $(srctree) $(Kconfig) > .tmp.config
         $(Q)if [ -f .config ]; then                             \
                         cmp -s .tmp.config .config ||           \
                         (mv -f .config .config.old.1;           \
@@ -44,7 +44,7 @@ localmodconfig: $(obj)/streamline_config.pl $(obj)/conf
         $(Q)rm -f .tmp.config
 
 localyesconfig: $(obj)/streamline_config.pl $(obj)/conf
-        $(Q)perl $< $(Kconfig) > .tmp.config
+        $(Q)perl $< $(srctree) $(Kconfig) > .tmp.config
         $(Q)sed -i s/=m/=y/ .tmp.config
         $(Q)if [ -f .config ]; then                             \
                         cmp -s .tmp.config .config ||           \
diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
index 95984db8e1e0..0d800820c3cd 100644
--- a/scripts/kconfig/streamline_config.pl
+++ b/scripts/kconfig/streamline_config.pl
@@ -43,7 +43,6 @@
 #    make oldconfig
 #
 my $config = ".config";
-my $linuxpath = ".";
 
 my $uname = `uname -r`;
 chomp $uname;
@@ -111,7 +110,11 @@ sub find_config {
 
 find_config;
 
-my @makefiles = `find $linuxpath -name Makefile`;
+# Get the build source and top level Kconfig file (passed in)
+my $ksource = $ARGV[0];
+my $kconfig = $ARGV[1];
+
+my @makefiles = `find $ksource -name Makefile`;
 my %depends;
 my %selects;
 my %prompts;
@@ -119,9 +122,6 @@ my %objects;
 my $var;
 my $cont = 0;
 
-# Get the top level Kconfig file (passed in)
-my $kconfig = $ARGV[0];
-
 # prevent recursion
 my %read_kconfigs;
 
@@ -132,7 +132,7 @@ sub read_kconfig {
     my $config;
     my @kconfigs;
 
-    open(KIN, $kconfig) || die "Can't open $kconfig";
+    open(KIN, "$ksource/$kconfig") || die "Can't open $kconfig";
     while (<KIN>) {
         chomp;
 
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 1f0f8213e2d5..6c160a038b23 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -504,6 +504,10 @@ static int aaci_pcm_hw_params(struct snd_pcm_substream *substream,
         int err;
 
         aaci_pcm_hw_free(substream);
+        if (aacirun->pcm_open) {
+                snd_ac97_pcm_close(aacirun->pcm);
+                aacirun->pcm_open = 0;
+        }
 
         err = devdma_hw_alloc(NULL, substream,
                               params_buffer_bytes(params));
@@ -517,7 +521,7 @@ static int aaci_pcm_hw_params(struct snd_pcm_substream *substream,
         else
                 err = snd_ac97_pcm_open(aacirun->pcm, params_rate(params),
                                         params_channels(params),
-                                        aacirun->pcm->r[1].slots);
+                                        aacirun->pcm->r[0].slots);
 
         if (err)
                 goto out;
diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
index 6b24d8bb02bb..90a0264f7538 100644
--- a/sound/soc/codecs/tlv320aic23.c
+++ b/sound/soc/codecs/tlv320aic23.c
@@ -625,11 +625,10 @@ static int tlv320aic23_resume(struct platform_device *pdev)
 {
         struct snd_soc_device *socdev = platform_get_drvdata(pdev);
         struct snd_soc_codec *codec = socdev->card->codec;
-        int i;
         u16 reg;
 
         /* Sync reg_cache with the hardware */
-        for (reg = 0; reg < ARRAY_SIZE(tlv320aic23_reg); i++) {
+        for (reg = 0; reg < TLV320AIC23_RESET; reg++) {
                 u16 val = tlv320aic23_read_reg_cache(codec, reg);
                 tlv320aic23_write(codec, reg, val);
         }
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index d89f6dc00908..66d4c165f99b 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -973,9 +973,19 @@ static int dapm_power_widgets(struct snd_soc_codec *codec, int event)
                         if (!w->power_check)
                                 continue;
 
-                        power = w->power_check(w);
-                        if (power)
-                                sys_power = 1;
+                        /* If we're suspending then pull down all the 
+                         * power. */
+                        switch (event) {
+                        case SND_SOC_DAPM_STREAM_SUSPEND:
+                                power = 0;
+                                break;
+
+                        default:
+                                power = w->power_check(w);
+                                if (power)
+                                        sys_power = 1;
+                                break;
+                        }
 
                         if (w->power == power)
                                 continue;
@@ -999,8 +1009,12 @@ static int dapm_power_widgets(struct snd_soc_codec *codec, int event)
                 case SND_SOC_DAPM_STREAM_RESUME:
                         sys_power = 1;
                         break;
+                case SND_SOC_DAPM_STREAM_SUSPEND:
+                        sys_power = 0;
+                        break;
                 case SND_SOC_DAPM_STREAM_NOP:
                         sys_power = codec->bias_level != SND_SOC_BIAS_STANDBY;
+                        break;
                 default:
                         break;
                 }