151 files changed, 2144 insertions, 1336 deletions
diff --git a/Documentation/block/biodoc.txt b/Documentation/block/biodoc.txt
index ecad6ee75705..6fab97ea7e6b 100644
--- a/Documentation/block/biodoc.txt
+++ b/Documentation/block/biodoc.txt
@@ -1040,23 +1040,21 @@ Front merges are handled by the binary trees in AS and deadline schedulers.
 iii. Plugging the queue to batch requests in anticipation of opportunities for
     merge/sort optimizations
-This is just the same as in 2.4 so far, though per-device unplugging
-support is anticipated for 2.5. Also with a priority-based i/o scheduler,
-such decisions could be based on request priorities.
 Plugging is an approach that the current i/o scheduling algorithm resorts to so
 that it collects up enough requests in the queue to be able to take
 advantage of the sorting/merging logic in the elevator. If the
 queue is empty when a request comes in, then it plugs the request queue
-(sort of like plugging the bottom of a vessel to get fluid to build up)
+(sort of like plugging the bath tub of a vessel to get fluid to build up)
 till it fills up with a few more requests, before starting to service
 the requests. This provides an opportunity to merge/sort the requests before
 passing them down to the device. There are various conditions when the queue is
 unplugged (to open up the flow again), either through a scheduled task or
 could be on demand. For example wait_on_buffer sets the unplugging going
-(by running tq_disk) so the read gets satisfied soon. So in the read case,
+through sync_buffer() running blk_run_address_space(mapping). Or the caller
-the queue gets explicitly unplugged as part of waiting for completion,
+can do it explicity through blk_unplug(bdev). So in the read case,
-in fact all queues get unplugged as a side-effect.
+the queue gets explicitly unplugged as part of waiting for completion on that
+buffer. For page driven IO, the address space ->sync_page() takes care of
+doing the blk_run_address_space().
 Aside:
  This is kind of controversial territory, as it's not clear if plugging is
@@ -1067,11 +1065,6 @@ Aside:
  multi-page bios being queued in one shot, we may not need to wait to merge
  a big request from the broken up pieces coming by.
-  Per-queue granularity unplugging (still a Todo) may help reduce some of the
-  concerns with just a single tq_disk flush approach. Something like
-  blk_kick_queue() to unplug a specific queue (right away ?)
-  or optionally, all queues, is in the plan.
 4.4 I/O contexts
 I/O contexts provide a dynamically allocated per process data area. They may
 be used in I/O schedulers, and in the block layer (could be used for IO statis,
diff --git a/Documentation/powerpc/dts-bindings/fsl/i2c.txt b/Documentation/powerpc/dts-bindings/fsl/i2c.txt
index d0ab33e21fe6..b6d2e21474f9 100644
--- a/Documentation/powerpc/dts-bindings/fsl/i2c.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/i2c.txt
@@ -7,8 +7,10 @@ Required properties :
 Recommended properties :
- - compatible : Should be "fsl-i2c" for parts compatible with
+ - compatible : compatibility list with 2 entries, the first should
-   Freescale I2C specifications.
+   be "fsl,CHIP-i2c" where CHIP is the name of a compatible processor,
+   e.g. mpc8313, mpc8543, mpc8544, mpc5200 or mpc5200b. The second one
+   should be "fsl-i2c".
 - interrupts : <a b> where a is the interrupt number and b is a
   field that represents an encoding of the sense and level
   information for the interrupt.  This should be encoded based on
@@ -16,17 +18,31 @@ Recommended properties :
   controller you have.
 - interrupt-parent : the phandle for the interrupt controller that
   services interrupts for this device.
- - dfsrr : boolean; if defined, indicates that this I2C device has
+ - fsl,preserve-clocking : boolean; if defined, the clock settings
-   a digital filter sampling rate register
+   from the bootloader are preserved (not touched).
- - fsl5200-clocking : boolean; if defined, indicated that this device
+ - clock-frequency : desired I2C bus clock frequency in Hz.
-   uses the FSL 5200 clocking mechanism.
+Examples :
-Example :
-        i2c@3000 {
+        i2c@3d00 {
-                interrupt-parent = <40000>;
+                #address-cells = <1>;
-                interrupts = <1b 3>;
+                #size-cells = <0>;
-                reg = <3000 18>;
+                compatible = "fsl,mpc5200b-i2c","fsl,mpc5200-i2c","fsl-i2c";
-                device_type = "i2c";
+                cell-index = <0>;
-                compatible  = "fsl-i2c";
+                reg = <0x3d00 0x40>;
-                dfsrr;
+                interrupts = <2 15 0>;
+                interrupt-parent = <&mpc5200_pic>;
+                fsl,preserve-clocking;
        };
+        i2c@3100 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                cell-index = <1>;
+                compatible = "fsl,mpc8544-i2c", "fsl-i2c";
+                reg = <0x3100 0x100>;
+                interrupts = <43 2>;
+                interrupt-parent = <&mpic>;
+                clock-frequency = <400000>;
+        };
diff --git a/Documentation/sound/alsa/HD-Audio.txt b/Documentation/sound/alsa/HD-Audio.txt
index c5948f2f9a25..88b7433d2f11 100644
--- a/Documentation/sound/alsa/HD-Audio.txt
+++ b/Documentation/sound/alsa/HD-Audio.txt
@@ -169,7 +169,7 @@ PCI SSID look-up.
 What `model` option values are available depends on the codec chip.
 Check your codec chip from the codec proc file (see "Codec Proc-File"
 section below).  It will show the vendor/product name of your codec
-chip.  Then, see Documentation/sound/alsa/HD-Audio-Modelstxt file,
+chip.  Then, see Documentation/sound/alsa/HD-Audio-Models.txt file,
 the section of HD-audio driver.  You can find a list of codecs
 and `model` options belonging to each codec.  For example, for Realtek
 ALC262 codec chip, pass `model=ultra` for devices that are compatible
@@ -177,7 +177,7 @@ with Samsung Q1 Ultra.
 Thus, the first thing you can do for any brand-new, unsupported and
 non-working HD-audio hardware is to check HD-audio codec and several
-different `model` option values.  If you have a luck, some of them
+different `model` option values.  If you have any luck, some of them
 might suit with your device well.
 Some codecs such as ALC880 have a special model option `model=test`.
diff --git a/MAINTAINERS b/MAINTAINERS
index 29d74f47ba86..0cb20d821694 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3680,6 +3680,7 @@ L:	microblaze-uclinux@itee.uq.edu.au
 W:      http://www.monstr.eu/fdt/
 T:      git git://git.monstr.eu/linux-2.6-microblaze.git
 S:      Supported
+F:      arch/microblaze/
 MICROTEK X6 SCANNER
 P:      Oliver Neukum
@@ -5313,7 +5314,9 @@ L:	linux-sh@vger.kernel.org
 W:      http://www.linux-sh.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6.git
 S:      Supported
+F:      Documentation/sh/
 F:      arch/sh/
+F:      drivers/sh/
 SUSPEND TO RAM
 P:      Len Brown
diff --git a/Makefile b/Makefile
index ad830bd45a4b..bfdef56add34 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 30
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Temporary Tasmanian Devil
 # *DOCUMENTATION*
@@ -169,7 +169,7 @@ SUBARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
                                  -e s/arm.*/arm/ -e s/sa110/arm/ \
                                  -e s/s390x/s390/ -e s/parisc64/parisc/ \
                                  -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
-                                  -e s/sh.*/sh/ )
+                                  -e s/sh[234].*/sh/ )
 # Cross compiling and selecting different set of gcc/bin-utils
 # ---------------------------------------------------------------------------
@@ -210,6 +210,11 @@ ifeq ($(ARCH),sparc64)
       SRCARCH := sparc
 endif
+# Additional ARCH settings for sh
+ifeq ($(ARCH),sh64)
+       SRCARCH := sh
+endif
 # Where to locate arch specific headers
 hdr-arch  := $(SRCARCH)
diff --git a/arch/microblaze/include/asm/auxvec.h b/arch/microblaze/include/asm/auxvec.h
index e69de29bb2d1..8b137891791f 100644
--- a/arch/microblaze/include/asm/auxvec.h
+++ b/arch/microblaze/include/asm/auxvec.h
@@ -0,0 +1 @@
diff --git a/arch/microblaze/include/asm/cputable.h b/arch/microblaze/include/asm/cputable.h
index e69de29bb2d1..8b137891791f 100644
--- a/arch/microblaze/include/asm/cputable.h
+++ b/arch/microblaze/include/asm/cputable.h
@@ -0,0 +1 @@
diff --git a/arch/microblaze/include/asm/ftrace.h b/arch/microblaze/include/asm/ftrace.h
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/arch/microblaze/include/asm/ftrace.h
@@ -0,0 +1 @@
diff --git a/arch/microblaze/include/asm/hw_irq.h b/arch/microblaze/include/asm/hw_irq.h
index e69de29bb2d1..8b137891791f 100644
--- a/arch/microblaze/include/asm/hw_irq.h
+++ b/arch/microblaze/include/asm/hw_irq.h
@@ -0,0 +1 @@
diff --git a/arch/microblaze/include/asm/io.h b/arch/microblaze/include/asm/io.h
index cfab0342588d..8b5853ee6b5c 100644
--- a/arch/microblaze/include/asm/io.h
+++ b/arch/microblaze/include/asm/io.h
@@ -12,7 +12,6 @@
 #include <asm/byteorder.h>
 #include <asm/page.h>
 #include <linux/types.h>
-#include <asm/page.h>
 #define IO_SPACE_LIMIT (0xFFFFFFFF)
diff --git a/arch/microblaze/include/asm/socket.h b/arch/microblaze/include/asm/socket.h
index f919b6b540ac..825936860314 100644
--- a/arch/microblaze/include/asm/socket.h
+++ b/arch/microblaze/include/asm/socket.h
@@ -63,4 +63,7 @@
 #define SO_MARK                 36
+#define SO_TIMESTAMPING         37
+#define SCM_TIMESTAMPING        SO_TIMESTAMPING
 #endif /* _ASM_MICROBLAZE_SOCKET_H */
diff --git a/arch/microblaze/include/asm/user.h b/arch/microblaze/include/asm/user.h
index e69de29bb2d1..8b137891791f 100644
--- a/arch/microblaze/include/asm/user.h
+++ b/arch/microblaze/include/asm/user.h
@@ -0,0 +1 @@
diff --git a/arch/microblaze/include/asm/vga.h b/arch/microblaze/include/asm/vga.h
index e69de29bb2d1..8b137891791f 100644
--- a/arch/microblaze/include/asm/vga.h
+++ b/arch/microblaze/include/asm/vga.h
@@ -0,0 +1 @@
diff --git a/arch/microblaze/kernel/of_device.c b/arch/microblaze/kernel/of_device.c
index 717edf4ad0b4..9a0f7632c47c 100644
--- a/arch/microblaze/kernel/of_device.c
+++ b/arch/microblaze/kernel/of_device.c
@@ -13,7 +13,6 @@ void of_device_make_bus_id(struct of_device *dev)
 {
        static atomic_t bus_no_reg_magic;
        struct device_node *node = dev->node;
-        char *name = dev->dev.bus_id;
        const u32 *reg;
        u64 addr;
        int magic;
@@ -25,9 +24,8 @@ void of_device_make_bus_id(struct of_device *dev)
        if (reg) {
                addr = of_translate_address(node, reg);
                if (addr != OF_BAD_ADDR) {
-                        snprintf(name, BUS_ID_SIZE,
+                        dev_set_name(&dev->dev, "%llx.%s",
-                                 "%llx.%s", (unsigned long long)addr,
+                                     (unsigned long long)addr, node->name);
-                                 node->name);
                        return;
                }
        }
@@ -37,7 +35,7 @@ void of_device_make_bus_id(struct of_device *dev)
         * counter (and pray...)
         */
        magic = atomic_add_return(1, &bus_no_reg_magic);
-        snprintf(name, BUS_ID_SIZE, "%s.%d", node->name, magic - 1);
+        dev_set_name(&dev->dev, "%s.%d", node->name, magic - 1);
 }
 EXPORT_SYMBOL(of_device_make_bus_id);
@@ -58,7 +56,7 @@ struct of_device *of_device_alloc(struct device_node *np,
        dev->dev.archdata.of_node = np;
        if (bus_id)
-                strlcpy(dev->dev.bus_id, bus_id, BUS_ID_SIZE);
+                dev_set_name(&dev->dev, bus_id);
        else
                of_device_make_bus_id(dev);
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index 60e9ed7d3132..436f26ccbfa9 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -115,8 +115,7 @@ void flush_thread(void)
 {
 }
-/* FIXME - here will be a proposed change -> remove nr parameter */
+int copy_thread(unsigned long clone_flags, unsigned long usp,
-int copy_thread(int nr, unsigned long clone_flags, unsigned long usp,
                unsigned long unused,
                struct task_struct *p, struct pt_regs *regs)
 {
diff --git a/arch/microblaze/kernel/prom.c b/arch/microblaze/kernel/prom.c
index 475b1fac5cfd..34c48718061a 100644
--- a/arch/microblaze/kernel/prom.c
+++ b/arch/microblaze/kernel/prom.c
@@ -39,7 +39,6 @@
 #include <asm/system.h>
 #include <asm/mmu.h>
 #include <asm/pgtable.h>
-#include <linux/pci.h>
 #include <asm/sections.h>
 #include <asm/pci-bridge.h>
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 3171e39e3220..b86aa623e36d 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -32,7 +32,6 @@
 #include <linux/signal.h>
 #include <linux/errno.h>
-#include <linux/ptrace.h>
 #include <asm/processor.h>
 #include <linux/uaccess.h>
 #include <asm/asm-offsets.h>
diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index ff347b98863a..3889cf45fa71 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -37,7 +37,6 @@
 #include <linux/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
-#include <linux/signal.h>
 #include <linux/syscalls.h>
 #include <asm/cacheflush.h>
 #include <asm/syscalls.h>
diff --git a/arch/microblaze/kernel/sys_microblaze.c b/arch/microblaze/kernel/sys_microblaze.c
index d90b548fb1bb..ba0568c2cc1c 100644
--- a/arch/microblaze/kernel/sys_microblaze.c
+++ b/arch/microblaze/kernel/sys_microblaze.c
@@ -29,9 +29,7 @@
 #include <linux/module.h>
 #include <linux/err.h>
 #include <linux/fs.h>
-#include <linux/ipc.h>
 #include <linux/semaphore.h>
-#include <linux/syscalls.h>
 #include <linux/uaccess.h>
 #include <linux/unistd.h>
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 5b50e1ac6179..4c7804551362 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -462,7 +462,7 @@ config PPC_64K_PAGES
 config PPC_256K_PAGES
        bool "256k page size" if 44x
-        depends on !STDBINUTILS && (!SHMEM || BROKEN)
+        depends on !STDBINUTILS
        help
          Make the page size 256k.
diff --git a/arch/powerpc/boot/dts/tqm8540.dts b/arch/powerpc/boot/dts/tqm8540.dts
index 231bae756637..b6f1fc6eb960 100644
--- a/arch/powerpc/boot/dts/tqm8540.dts
+++ b/arch/powerpc/boot/dts/tqm8540.dts
@@ -84,9 +84,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/boot/dts/tqm8541.dts b/arch/powerpc/boot/dts/tqm8541.dts
index 4356a1f08295..fa6a3d54a8a5 100644
--- a/arch/powerpc/boot/dts/tqm8541.dts
+++ b/arch/powerpc/boot/dts/tqm8541.dts
@@ -83,9 +83,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/boot/dts/tqm8548-bigflash.dts b/arch/powerpc/boot/dts/tqm8548-bigflash.dts
index 19aa72301c83..00f7ed7a2455 100644
--- a/arch/powerpc/boot/dts/tqm8548-bigflash.dts
+++ b/arch/powerpc/boot/dts/tqm8548-bigflash.dts
@@ -85,9 +85,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
@@ -247,7 +247,7 @@
                        interrupts = <31 2 32 2 33 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi2>;
-                        phy-handle = <&phy3>;
+                        phy-handle = <&phy4>;
                        mdio@520 {
                                #address-cells = <1>;
@@ -275,7 +275,7 @@
                        interrupts = <37 2 38 2 39 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi3>;
-                        phy-handle = <&phy4>;
+                        phy-handle = <&phy5>;
                        mdio@520 {
                                #address-cells = <1>;
diff --git a/arch/powerpc/boot/dts/tqm8548.dts b/arch/powerpc/boot/dts/tqm8548.dts
index 49145a04fc6c..673e4a778ac8 100644
--- a/arch/powerpc/boot/dts/tqm8548.dts
+++ b/arch/powerpc/boot/dts/tqm8548.dts
@@ -85,9 +85,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
@@ -247,7 +247,7 @@
                        interrupts = <31 2 32 2 33 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi2>;
-                        phy-handle = <&phy3>;
+                        phy-handle = <&phy4>;
                        mdio@520 {
                                #address-cells = <1>;
@@ -275,7 +275,7 @@
                        interrupts = <37 2 38 2 39 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi3>;
-                        phy-handle = <&phy4>;
+                        phy-handle = <&phy5>;
                        mdio@520 {
                                #address-cells = <1>;
diff --git a/arch/powerpc/boot/dts/tqm8555.dts b/arch/powerpc/boot/dts/tqm8555.dts
index 06d366ebbda3..6a99f1eef7ad 100644
--- a/arch/powerpc/boot/dts/tqm8555.dts
+++ b/arch/powerpc/boot/dts/tqm8555.dts
@@ -83,9 +83,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/boot/dts/tqm8560.dts b/arch/powerpc/boot/dts/tqm8560.dts
index feff915e0492..b6c2d71defd3 100644
--- a/arch/powerpc/boot/dts/tqm8560.dts
+++ b/arch/powerpc/boot/dts/tqm8560.dts
@@ -85,9 +85,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/configs/85xx/tqm8548_defconfig b/arch/powerpc/configs/85xx/tqm8548_defconfig
index 0bc45975911a..43030fea2eee 100644
--- a/arch/powerpc/configs/85xx/tqm8548_defconfig
+++ b/arch/powerpc/configs/85xx/tqm8548_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.29-rc2
+# Linux kernel version: 2.6.29-rc7
-# Mon Jan 26 15:36:20 2009
+# Mon Mar 16 09:03:28 2009
 #
 # CONFIG_PPC64 is not set
@@ -22,6 +22,7 @@ CONFIG_FSL_EMB_PERFMON=y
 # CONFIG_PHYS_64BIT is not set
 CONFIG_SPE=y
 CONFIG_PPC_MMU_NOHASH=y
+CONFIG_PPC_BOOK3E_MMU=y
 # CONFIG_PPC_MM_SLICES is not set
 # CONFIG_SMP is not set
 CONFIG_PPC32=y
@@ -75,6 +76,15 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_GROUP_SCHED=y
@@ -152,11 +162,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
-# CONFIG_TREE_RCU is not set
-# CONFIG_PREEMPT_RCU is not set
-# CONFIG_TREE_RCU_TRACE is not set
-# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_FREEZER is not set
 #
@@ -202,7 +207,7 @@ CONFIG_MPIC=y
 #
 # Kernel options
 #
-# CONFIG_HIGHMEM is not set
+CONFIG_HIGHMEM=y
 CONFIG_TICK_ONESHOT=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -244,6 +249,7 @@ CONFIG_UNEVICTABLE_LRU=y
 CONFIG_PPC_4K_PAGES=y
 # CONFIG_PPC_16K_PAGES is not set
 # CONFIG_PPC_64K_PAGES is not set
+# CONFIG_PPC_256K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -259,6 +265,7 @@ CONFIG_ZONE_DMA=y
 CONFIG_PPC_INDIRECT_PCI=y
 CONFIG_FSL_SOC=y
 CONFIG_FSL_PCI=y
+CONFIG_FSL_LBC=y
 CONFIG_PPC_PCI_CHOICE=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
@@ -284,10 +291,11 @@ CONFIG_ARCH_SUPPORTS_MSI=y
 # Default settings for advanced configuration options are used
 #
 CONFIG_LOWMEM_SIZE=0x30000000
+CONFIG_LOWMEM_CAM_NUM=3
 CONFIG_PAGE_OFFSET=0xc0000000
 CONFIG_KERNEL_START=0xc0000000
 CONFIG_PHYSICAL_START=0x00000000
-CONFIG_PHYSICAL_ALIGN=0x10000000
+CONFIG_PHYSICAL_ALIGN=0x04000000
 CONFIG_TASK_SIZE=0xc0000000
 CONFIG_NET=y
@@ -363,12 +371,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
-CONFIG_WIRELESS=y
+# CONFIG_WIRELESS is not set
-# CONFIG_CFG80211 is not set
-CONFIG_WIRELESS_OLD_REGULATORY=y
-# CONFIG_WIRELESS_EXT is not set
-# CONFIG_LIB80211 is not set
-# CONFIG_MAC80211 is not set
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
@@ -471,27 +474,18 @@ CONFIG_MTD_NAND_IDS=y
 # CONFIG_MTD_NAND_NANDSIM is not set
 # CONFIG_MTD_NAND_PLATFORM is not set
 # CONFIG_MTD_NAND_FSL_ELBC is not set
-# CONFIG_MTD_NAND_FSL_UPM is not set
+CONFIG_MTD_NAND_FSL_UPM=y
 # CONFIG_MTD_ONENAND is not set
 #
 # LPDDR flash memory drivers
 #
 # CONFIG_MTD_LPDDR is not set
-# CONFIG_MTD_QINFO_PROBE is not set
 #
 # UBI - Unsorted block images
 #
-CONFIG_MTD_UBI=m
+# CONFIG_MTD_UBI is not set
-CONFIG_MTD_UBI_WL_THRESHOLD=4096
-CONFIG_MTD_UBI_BEB_RESERVE=1
-# CONFIG_MTD_UBI_GLUEBI is not set
-#
-# UBI debugging options
-#
-# CONFIG_MTD_UBI_DEBUG is not set
 CONFIG_OF_DEVICE=y
 CONFIG_OF_I2C=y
 # CONFIG_PARPORT is not set
@@ -515,69 +509,21 @@ CONFIG_BLK_DEV_RAM_SIZE=32768
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
 # CONFIG_C2PORT is not set
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
-CONFIG_IDE=y
+# CONFIG_IDE is not set
-#
-# Please see Documentation/ide/ide.txt for help/info on IDE drives
-#
-CONFIG_IDE_TIMINGS=y
-# CONFIG_BLK_DEV_IDE_SATA is not set
-CONFIG_IDE_GD=y
-CONFIG_IDE_GD_ATA=y
-# CONFIG_IDE_GD_ATAPI is not set
-# CONFIG_BLK_DEV_IDECD is not set
-# CONFIG_BLK_DEV_IDETAPE is not set
-# CONFIG_IDE_TASK_IOCTL is not set
-CONFIG_IDE_PROC_FS=y
-#
-# IDE chipset support/bugfixes
-#
-# CONFIG_BLK_DEV_PLATFORM is not set
-CONFIG_BLK_DEV_IDEDMA_SFF=y
-#
-# PCI IDE chipsets support
-#
-CONFIG_BLK_DEV_IDEPCI=y
-CONFIG_IDEPCI_PCIBUS_ORDER=y
-# CONFIG_BLK_DEV_OFFBOARD is not set
-CONFIG_BLK_DEV_GENERIC=y
-# CONFIG_BLK_DEV_OPTI621 is not set
-CONFIG_BLK_DEV_IDEDMA_PCI=y
-# CONFIG_BLK_DEV_AEC62XX is not set
-# CONFIG_BLK_DEV_ALI15X3 is not set
-# CONFIG_BLK_DEV_AMD74XX is not set
-# CONFIG_BLK_DEV_CMD64X is not set
-# CONFIG_BLK_DEV_TRIFLEX is not set
-# CONFIG_BLK_DEV_CS5520 is not set
-# CONFIG_BLK_DEV_CS5530 is not set
-# CONFIG_BLK_DEV_HPT366 is not set
-# CONFIG_BLK_DEV_JMICRON is not set
-# CONFIG_BLK_DEV_SC1200 is not set
-# CONFIG_BLK_DEV_PIIX is not set
-# CONFIG_BLK_DEV_IT8172 is not set
-# CONFIG_BLK_DEV_IT8213 is not set
-# CONFIG_BLK_DEV_IT821X is not set
-# CONFIG_BLK_DEV_NS87415 is not set
-# CONFIG_BLK_DEV_PDC202XX_OLD is not set
-# CONFIG_BLK_DEV_PDC202XX_NEW is not set
-# CONFIG_BLK_DEV_SVWKS is not set
-# CONFIG_BLK_DEV_SIIMAGE is not set
-# CONFIG_BLK_DEV_SL82C105 is not set
-# CONFIG_BLK_DEV_SLC90E66 is not set
-# CONFIG_BLK_DEV_TRM290 is not set
-CONFIG_BLK_DEV_VIA82CXXX=y
-# CONFIG_BLK_DEV_TC86C001 is not set
-CONFIG_BLK_DEV_IDEDMA=y
 #
 # SCSI device support
@@ -650,7 +596,7 @@ CONFIG_MII=y
 CONFIG_NETDEV_1000=y
 # CONFIG_ACENIC is not set
 # CONFIG_DL2K is not set
-CONFIG_E1000=y
+# CONFIG_E1000 is not set
 # CONFIG_E1000E is not set
 # CONFIG_IP1000 is not set
 # CONFIG_IGB is not set
@@ -668,6 +614,7 @@ CONFIG_GIANFAR=y
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
+# CONFIG_ATL1C is not set
 # CONFIG_JME is not set
 CONFIG_NETDEV_10000=y
 # CONFIG_CHELSIO_T1 is not set
@@ -835,8 +782,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -975,26 +920,7 @@ CONFIG_HID=y
 # Special HID drivers
 #
 CONFIG_HID_COMPAT=y
-CONFIG_USB_SUPPORT=y
+# CONFIG_USB_SUPPORT is not set
-CONFIG_USB_ARCH_HAS_HCD=y
-CONFIG_USB_ARCH_HAS_OHCI=y
-CONFIG_USB_ARCH_HAS_EHCI=y
-# CONFIG_USB is not set
-# CONFIG_USB_OTG_WHITELIST is not set
-# CONFIG_USB_OTG_BLACKLIST_HUB is not set
-#
-# Enable Host or Gadget support to see Inventra options
-#
-#
-# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
-#
-# CONFIG_USB_GADGET is not set
-#
-# OTG and related infrastructure
-#
 # CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
@@ -1064,16 +990,9 @@ CONFIG_RTC_DRV_DS1307=y
 #
 # File systems
 #
-CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS is not set
-# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT3_FS is not set
-# CONFIG_EXT2_FS_XIP is not set
-CONFIG_EXT3_FS=y
-CONFIG_EXT3_FS_XATTR=y
-# CONFIG_EXT3_FS_POSIX_ACL is not set
-# CONFIG_EXT3_FS_SECURITY is not set
 # CONFIG_EXT4_FS is not set
-CONFIG_JBD=y
-CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
@@ -1122,8 +1041,17 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
-# CONFIG_JFFS2_FS is not set
+CONFIG_JFFS2_FS=y
-# CONFIG_UBIFS_FS is not set
+CONFIG_JFFS2_FS_DEBUG=0
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+# CONFIG_JFFS2_SUMMARY is not set
+# CONFIG_JFFS2_FS_XATTR is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
+CONFIG_JFFS2_ZLIB=y
+# CONFIG_JFFS2_LZO is not set
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -1184,6 +1112,8 @@ CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
 # CONFIG_LIBCRC32C is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
 CONFIG_PLIST=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
@@ -1219,6 +1149,7 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_HIGHMEM is not set
 # CONFIG_DEBUG_BUGVERBOSE is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
@@ -1236,6 +1167,7 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
 CONFIG_HAVE_DYNAMIC_FTRACE=y
 CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
index 6d406c5c5de4..9696cc36d2dc 100644
--- a/arch/powerpc/include/asm/futex.h
+++ b/arch/powerpc/include/asm/futex.h
@@ -27,7 +27,7 @@
        PPC_LONG "1b,4b,2b,4b\n" \
        ".previous" \
        : "=&r" (oldval), "=&r" (ret) \
-        : "b" (uaddr), "i" (-EFAULT), "1" (oparg) \
+        : "b" (uaddr), "i" (-EFAULT), "r" (oparg) \
        : "cr0", "memory")
 static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
@@ -47,19 +47,19 @@ static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
        switch (op) {
        case FUTEX_OP_SET:
-                __futex_atomic_op("", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("mr %1,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_ADD:
-                __futex_atomic_op("add %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("add %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_OR:
-                __futex_atomic_op("or %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("or %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_ANDN:
-                __futex_atomic_op("andc %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("andc %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_XOR:
-                __futex_atomic_op("xor %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("xor %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        default:
                ret = -ENOSYS;
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index cbf154387091..86d2366ab6a1 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -52,6 +52,12 @@
 */
 #define MMU_FTR_NEED_DTLB_SW_LRU        ASM_CONST(0x00200000)
+/* This indicates that the processor uses the wrong opcode for tlbilx
+ * instructions.  During the ISA 2.06 development the opcode for tlbilx
+ * changed and some early implementations used to old opcode
+ */
+#define MMU_FTR_TLBILX_EARLY_OPCODE     ASM_CONST(0x00400000)
 #ifndef __ASSEMBLY__
 #include <asm/cputable.h>
diff --git a/arch/powerpc/include/asm/parport.h b/arch/powerpc/include/asm/parport.h
index 414c50e2e881..94942d60ddfd 100644
--- a/arch/powerpc/include/asm/parport.h
+++ b/arch/powerpc/include/asm/parport.h
@@ -29,7 +29,7 @@ static int __devinit parport_pc_find_nonpci_ports (int autoirq, int autodma)
                prop = of_get_property(np, "interrupts", NULL);
                if (!prop)
                        continue;
-                if (parport_pc_probe_port(io1, io2, prop[0], autodma, NULL) != NULL)
+                if (parport_pc_probe_port(io1, io2, prop[0], autodma, NULL, 0) != NULL)
                        count++;
        }
        return count;
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index f4a4db8d5555..ef4da37f3c10 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -43,7 +43,8 @@
 #define PPC_INST_STSWI                  0x7c0005aa
 #define PPC_INST_STSWX                  0x7c00052a
-#define PPC_INST_TLBILX                 0x7c000626
+#define PPC_INST_TLBILX                 0x7c000024
+#define PPC_INST_TLBILX_EARLY           0x7c000626
 #define PPC_INST_WAIT                   0x7c00007c
 /* macros to insert fields into opcodes */
@@ -63,10 +64,18 @@
 #define PPC_RFDI                stringify_in_c(.long PPC_INST_RFDI)
 #define PPC_RFMCI               stringify_in_c(.long PPC_INST_RFMCI)
 #define PPC_TLBILX(t, a, b)     stringify_in_c(.long PPC_INST_TLBILX | \
-                                        __PPC_T_TLB(t) | __PPC_RA(a) | __PPC_RB(b))
+                                        __PPC_T_TLB(t) | \
+                                        __PPC_RA(a) | __PPC_RB(b))
 #define PPC_TLBILX_ALL(a, b)    PPC_TLBILX(0, a, b)
 #define PPC_TLBILX_PID(a, b)    PPC_TLBILX(1, a, b)
 #define PPC_TLBILX_VA(a, b)     PPC_TLBILX(3, a, b)
+#define PPC_TLBILX_EARLY(t, a, b) stringify_in_c(.long PPC_INST_TLBILX_EARLY | \
+                                                __PPC_T_TLB(t) | \
+                                                __PPC_RA(a) | __PPC_RB(b))
+#define PPC_TLBILX_ALL_EARLY(a, b)      PPC_TLBILX_EARLY(0, a, b)
+#define PPC_TLBILX_PID_EARLY(a, b)      PPC_TLBILX_EARLY(1, a, b)
+#define PPC_TLBILX_VA_EARLY(a, b)       PPC_TLBILX_EARLY(3, a, b)
 #define PPC_WAIT(w)             stringify_in_c(.long PPC_INST_WAIT | \
                                        __PPC_WC(w))
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index cd1b687544f3..57db50f40289 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -1766,7 +1766,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .cpu_features           = CPU_FTRS_E500MC,
                .cpu_user_features      = COMMON_USER_BOOKE | PPC_FEATURE_HAS_FPU,
                .mmu_features           = MMU_FTR_TYPE_FSL_E | MMU_FTR_BIG_PHYS |
-                        MMU_FTR_USE_TLBILX,
+                        MMU_FTR_USE_TLBILX | MMU_FTR_TLBILX_EARLY_OPCODE,
                .icache_bsize           = 64,
                .dcache_bsize           = 64,
                .num_pmcs               = 4,
diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
index 7af72970faed..ad2eb4d34dd4 100644
--- a/arch/powerpc/mm/tlb_nohash.c
+++ b/arch/powerpc/mm/tlb_nohash.c
@@ -125,7 +125,6 @@ static void do_flush_tlb_page_ipi(void *param)
 void flush_tlb_mm(struct mm_struct *mm)
 {
-        cpumask_t cpu_mask;
        unsigned int pid;
        preempt_disable();
diff --git a/arch/powerpc/mm/tlb_nohash_low.S b/arch/powerpc/mm/tlb_nohash_low.S
index 788b87c36f77..45fed3698349 100644
--- a/arch/powerpc/mm/tlb_nohash_low.S
+++ b/arch/powerpc/mm/tlb_nohash_low.S
@@ -138,7 +138,11 @@ BEGIN_MMU_FTR_SECTION
        andi.   r3,r3,MMUCSR0_TLBFI@l
        bne     1b
 MMU_FTR_SECTION_ELSE
-        PPC_TLBILX_ALL(0,0)
+  BEGIN_MMU_FTR_SECTION_NESTED(96)
+        PPC_TLBILX_ALL(0,r3)
+  MMU_FTR_SECTION_ELSE_NESTED(96)
+        PPC_TLBILX_ALL_EARLY(0,r3)
+  ALT_MMU_FTR_SECTION_END_NESTED_IFCLR(MMU_FTR_TLBILX_EARLY_OPCODE, 96)
 ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_USE_TLBILX)
        msync
        isync
@@ -151,7 +155,11 @@ BEGIN_MMU_FTR_SECTION
        wrteei  0
        mfspr   r4,SPRN_MAS6    /* save MAS6 */
        mtspr   SPRN_MAS6,r3
+  BEGIN_MMU_FTR_SECTION_NESTED(96)
        PPC_TLBILX_PID(0,0)
+  MMU_FTR_SECTION_ELSE_NESTED(96)
+        PPC_TLBILX_PID_EARLY(0,0)
+  ALT_MMU_FTR_SECTION_END_NESTED_IFCLR(MMU_FTR_TLBILX_EARLY_OPCODE, 96)
        mtspr   SPRN_MAS6,r4    /* restore MAS6 */
        wrtee   r10
 MMU_FTR_SECTION_ELSE
@@ -185,7 +193,11 @@ BEGIN_MMU_FTR_SECTION
        mtspr   SPRN_MAS1,r4
        tlbwe
 MMU_FTR_SECTION_ELSE
+  BEGIN_MMU_FTR_SECTION_NESTED(96)
        PPC_TLBILX_VA(0,r3)
+  MMU_FTR_SECTION_ELSE_NESTED(96)
+        PPC_TLBILX_VA_EARLY(0,r3)
+  ALT_MMU_FTR_SECTION_END_NESTED_IFCLR(MMU_FTR_TLBILX_EARLY_OPCODE, 96)
 ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_USE_TLBILX)
        msync
        isync
diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
index fafcaa0e81ef..ab69925d579b 100644
--- a/arch/powerpc/platforms/pseries/dtl.c
+++ b/arch/powerpc/platforms/pseries/dtl.c
@@ -25,6 +25,7 @@
 #include <asm/smp.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <asm/firmware.h>
 #include "plpar_wrappers.h"
diff --git a/arch/powerpc/platforms/pseries/eeh_driver.c b/arch/powerpc/platforms/pseries/eeh_driver.c
index 380420f8c400..9a2a6e32f00f 100644
--- a/arch/powerpc/platforms/pseries/eeh_driver.c
+++ b/arch/powerpc/platforms/pseries/eeh_driver.c
@@ -182,6 +182,8 @@ static void eeh_report_reset(struct pci_dev *dev, void *userdata)
        if (!driver)
                return;
+        dev->error_state = pci_channel_io_normal;
        eeh_enable_irq(dev);
        if (!driver->err_handler ||
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 5e4babecf934..e7390dd0283d 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -14,6 +14,7 @@ config SUPERH
        select HAVE_GENERIC_DMA_COHERENT
        select HAVE_IOREMAP_PROT if MMU
        select HAVE_ARCH_TRACEHOOK
+        select HAVE_DMA_API_DEBUG
        help
          The SuperH is a RISC processor targeted for use in embedded systems
          and consumer electronics; it was also used in the Sega Dreamcast
@@ -21,7 +22,7 @@ config SUPERH
          <http://www.linux-sh.org/>.
 config SUPERH32
-        def_bool !SUPERH64
+        def_bool ARCH = "sh"
        select HAVE_KPROBES
        select HAVE_KRETPROBES
        select HAVE_FUNCTION_TRACER
@@ -31,7 +32,7 @@ config SUPERH32
        select ARCH_HIBERNATION_POSSIBLE if MMU
 config SUPERH64
-        def_bool y if CPU_SH5
+        def_bool ARCH = "sh64"
 config ARCH_DEFCONFIG
        string
@@ -187,6 +188,8 @@ config ARCH_SHMOBILE
        bool
        select ARCH_SUSPEND_POSSIBLE
+if SUPERH32
 choice
        prompt "Processor sub-type selection"
@@ -408,6 +411,15 @@ config CPU_SUBTYPE_SH7366
        select SYS_SUPPORTS_NUMA
        select SYS_SUPPORTS_CMT
+endchoice
+endif
+if SUPERH64
+choice
+        prompt "Processor sub-type selection"
 # SH-5 Processor Support
 config CPU_SUBTYPE_SH5_101
@@ -420,6 +432,8 @@ config CPU_SUBTYPE_SH5_103
 endchoice
+endif
 source "arch/sh/mm/Kconfig"
 
 source "arch/sh/Kconfig.cpu"
diff --git a/arch/sh/boards/board-ap325rxa.c b/arch/sh/boards/board-ap325rxa.c
index 912458f666eb..39e46919df14 100644
--- a/arch/sh/boards/board-ap325rxa.c
+++ b/arch/sh/boards/board-ap325rxa.c
@@ -349,6 +349,7 @@ static int ov7725_power(struct device *dev, int mode)
 static struct ov772x_camera_info ov7725_info = {
        .buswidth  = SOCAM_DATAWIDTH_8,
        .flags = OV772X_FLAG_VFLIP | OV772X_FLAG_HFLIP,
+        .edgectrl = OV772X_AUTO_EDGECTRL(0xf, 0),
        .link = {
                .power  = ov7725_power,
        },
diff --git a/arch/sh/boards/board-urquell.c b/arch/sh/boards/board-urquell.c
index 8367d1d789c3..beb88c4da2c1 100644
--- a/arch/sh/boards/board-urquell.c
+++ b/arch/sh/boards/board-urquell.c
@@ -2,6 +2,8 @@
 * Renesas Technology Corp. SH7786 Urquell Support.
 *
 * Copyright (C) 2008  Kuninori Morimoto <morimoto.kuninori@renesas.com>
+ *
+ * Based on board-sh7785lcr.c
 * Copyright (C) 2008  Yoshihiro Shimoda
 *
 * This file is subject to the terms and conditions of the GNU General Public
@@ -21,6 +23,32 @@
 #include <asm/heartbeat.h>
 #include <asm/sizes.h>
+/*
+ * bit  1234 5678
+ *----------------------------
+ * SW1  0101 0010  -> Pck 33MHz version
+ *     (1101 0010)    Pck 66MHz version
+ * SW2  0x1x xxxx  -> little endian
+ *                    29bit mode
+ * SW47 0001 1000  -> CS0 : on-board flash
+ *                    CS1 : SRAM, registers, LAN, PCMCIA
+ *                    38400 bps for SCIF1
+ *
+ * Address
+ * 0x00000000 - 0x04000000  (CS0)     Nor Flash
+ * 0x04000000 - 0x04200000  (CS1)     SRAM
+ * 0x05000000 - 0x05800000  (CS1)     on board register
+ * 0x05800000 - 0x06000000  (CS1)     LAN91C111
+ * 0x06000000 - 0x06400000  (CS1)     PCMCIA
+ * 0x08000000 - 0x10000000  (CS2-CS3) DDR3
+ * 0x10000000 - 0x14000000  (CS4)     PCIe
+ * 0x14000000 - 0x14800000  (CS5)     Core0 LRAM/URAM
+ * 0x14800000 - 0x15000000  (CS5)     Core1 LRAM/URAM
+ * 0x18000000 - 0x1C000000  (CS6)     ATA/NAND-Flash
+ * 0x1C000000 -             (CS7)     SH7786 Control register
+ */
+/* HeartBeat */
 static struct resource heartbeat_resources[] = {
        [0] = {
                .start  = BOARDREG(SLEDR),
@@ -43,6 +71,7 @@ static struct platform_device heartbeat_device = {
        .resource       = heartbeat_resources,
 };
+/* LAN91C111 */
 static struct smc91x_platdata smc91x_info = {
        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
 };
@@ -69,6 +98,7 @@ static struct platform_device smc91x_eth_device = {
        },
 };
+/* Nor Flash */
 static struct mtd_partition nor_flash_partitions[] = {
        {
                .name           = "loader",
diff --git a/arch/sh/drivers/pci/ops-sh7785lcr.c b/arch/sh/drivers/pci/ops-sh7785lcr.c
index e8b7446a7c2b..fb0869f0bef8 100644
--- a/arch/sh/drivers/pci/ops-sh7785lcr.c
+++ b/arch/sh/drivers/pci/ops-sh7785lcr.c
@@ -48,8 +48,13 @@ EXPORT_SYMBOL(board_pci_channels);
 static struct sh4_pci_address_map sh7785_pci_map = {
        .window0        = {
+#if defined(CONFIG_32BIT)
+                .base   = SH7780_32BIT_DDR_BASE_ADDR,
+                .size   = 0x40000000,
+#else
                .base   = SH7780_CS0_BASE_ADDR,
                .size   = 0x20000000,
+#endif
        },
        .flags  = SH4_PCIC_NO_RESET,
diff --git a/arch/sh/drivers/pci/pci-sh7780.h b/arch/sh/drivers/pci/pci-sh7780.h
index 97b2c98f05c4..93adc7119b79 100644
--- a/arch/sh/drivers/pci/pci-sh7780.h
+++ b/arch/sh/drivers/pci/pci-sh7780.h
@@ -104,6 +104,8 @@
 #define SH7780_CS5_BASE_ADDR    (SH7780_CS4_BASE_ADDR + SH7780_MEM_REGION_SIZE)
 #define SH7780_CS6_BASE_ADDR    (SH7780_CS5_BASE_ADDR + SH7780_MEM_REGION_SIZE)
+#define SH7780_32BIT_DDR_BASE_ADDR      0x40000000
 struct sh4_pci_address_map;
 /* arch/sh/drivers/pci/pci-sh7780.c */
diff --git a/arch/sh/drivers/pci/pci.c b/arch/sh/drivers/pci/pci.c
index e36c7b870861..0d6ac7a1db49 100644
--- a/arch/sh/drivers/pci/pci.c
+++ b/arch/sh/drivers/pci/pci.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/dma-debug.h>
 #include <asm/io.h>
 static int __init pcibios_init(void)
@@ -43,6 +44,8 @@ static int __init pcibios_init(void)
        pci_fixup_irqs(pci_common_swizzle, pcibios_map_platform_irq);
+        dma_debug_add_bus(&pci_bus_type);
        return 0;
 }
 subsys_initcall(pcibios_init);
diff --git a/arch/sh/include/asm/dma-mapping.h b/arch/sh/include/asm/dma-mapping.h
index 627315ecdb52..ea9d4f41c9d2 100644
--- a/arch/sh/include/asm/dma-mapping.h
+++ b/arch/sh/include/asm/dma-mapping.h
@@ -3,6 +3,7 @@
 #include <linux/mm.h>
 #include <linux/scatterlist.h>
+#include <linux/dma-debug.h>
 #include <asm/cacheflush.h>
 #include <asm/io.h>
 #include <asm-generic/dma-coherent.h>
@@ -38,16 +39,26 @@ static inline dma_addr_t dma_map_single(struct device *dev,
                                        void *ptr, size_t size,
                                        enum dma_data_direction dir)
 {
+        dma_addr_t addr = virt_to_phys(ptr);
 #if defined(CONFIG_PCI) && !defined(CONFIG_SH_PCIDMA_NONCOHERENT)
        if (dev->bus == &pci_bus_type)
-                return virt_to_phys(ptr);
+                return addr;
 #endif
        dma_cache_sync(dev, ptr, size, dir);
-        return virt_to_phys(ptr);
+        debug_dma_map_page(dev, virt_to_page(ptr),
+                           (unsigned long)ptr & ~PAGE_MASK, size,
+                           dir, addr, true);
+        return addr;
 }
-#define dma_unmap_single(dev, addr, size, dir)  do { } while (0)
+static inline void dma_unmap_single(struct device *dev, dma_addr_t addr,
+                                    size_t size, enum dma_data_direction dir)
+{
+        debug_dma_unmap_page(dev, addr, size, dir, true);
+}
 static inline int dma_map_sg(struct device *dev, struct scatterlist *sg,
                             int nents, enum dma_data_direction dir)
@@ -59,12 +70,19 @@ static inline int dma_map_sg(struct device *dev, struct scatterlist *sg,
                dma_cache_sync(dev, sg_virt(&sg[i]), sg[i].length, dir);
 #endif
                sg[i].dma_address = sg_phys(&sg[i]);
+                sg[i].dma_length = sg[i].length;
        }
+        debug_dma_map_sg(dev, sg, nents, i, dir);
        return nents;
 }
-#define dma_unmap_sg(dev, sg, nents, dir)       do { } while (0)
+static inline void dma_unmap_sg(struct device *dev, struct scatterlist *sg,
+                                int nents, enum dma_data_direction dir)
+{
+        debug_dma_unmap_sg(dev, sg, nents, dir);
+}
 static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
                                      unsigned long offset, size_t size,
@@ -111,6 +129,7 @@ static inline void dma_sync_sg(struct device *dev, struct scatterlist *sg,
                dma_cache_sync(dev, sg_virt(&sg[i]), sg[i].length, dir);
 #endif
                sg[i].dma_address = sg_phys(&sg[i]);
+                sg[i].dma_length = sg[i].length;
        }
 }
@@ -119,6 +138,7 @@ static inline void dma_sync_single_for_cpu(struct device *dev,
                                           enum dma_data_direction dir)
 {
        dma_sync_single(dev, dma_handle, size, dir);
+        debug_dma_sync_single_for_cpu(dev, dma_handle, size, dir);
 }
 static inline void dma_sync_single_for_device(struct device *dev,
@@ -127,6 +147,7 @@ static inline void dma_sync_single_for_device(struct device *dev,
                                              enum dma_data_direction dir)
 {
        dma_sync_single(dev, dma_handle, size, dir);
+        debug_dma_sync_single_for_device(dev, dma_handle, size, dir);
 }
 static inline void dma_sync_single_range_for_cpu(struct device *dev,
@@ -136,6 +157,8 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
                                                 enum dma_data_direction direction)
 {
        dma_sync_single_for_cpu(dev, dma_handle+offset, size, direction);
+        debug_dma_sync_single_range_for_cpu(dev, dma_handle,
+                                            offset, size, direction);
 }
 static inline void dma_sync_single_range_for_device(struct device *dev,
@@ -145,6 +168,8 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
                                                    enum dma_data_direction direction)
 {
        dma_sync_single_for_device(dev, dma_handle+offset, size, direction);
+        debug_dma_sync_single_range_for_device(dev, dma_handle,
+                                               offset, size, direction);
 }
@@ -153,6 +178,7 @@ static inline void dma_sync_sg_for_cpu(struct device *dev,
                                       enum dma_data_direction dir)
 {
        dma_sync_sg(dev, sg, nelems, dir);
+        debug_dma_sync_sg_for_cpu(dev, sg, nelems, dir);
 }
 static inline void dma_sync_sg_for_device(struct device *dev,
@@ -160,9 +186,9 @@ static inline void dma_sync_sg_for_device(struct device *dev,
                                          enum dma_data_direction dir)
 {
        dma_sync_sg(dev, sg, nelems, dir);
+        debug_dma_sync_sg_for_device(dev, sg, nelems, dir);
 }
 static inline int dma_get_cache_alignment(void)
 {
        /*
diff --git a/arch/sh/include/asm/scatterlist.h b/arch/sh/include/asm/scatterlist.h
index 2084d0373693..c693d268a413 100644
--- a/arch/sh/include/asm/scatterlist.h
+++ b/arch/sh/include/asm/scatterlist.h
@@ -5,12 +5,13 @@
 struct scatterlist {
 #ifdef CONFIG_DEBUG_SG
-    unsigned long sg_magic;
+        unsigned long   sg_magic;
 #endif
-    unsigned long page_link;
+        unsigned long   page_link;
-    unsigned int offset;/* for highmem, page offset */
+        unsigned int    offset;         /* for highmem, page offset */
-    dma_addr_t dma_address;
+        unsigned int    length;
-    unsigned int length;
+        dma_addr_t      dma_address;
+        unsigned int    dma_length;
 };
 #define ISA_DMA_THRESHOLD       PHYS_ADDR_MASK
diff --git a/arch/sh/include/asm/topology.h b/arch/sh/include/asm/topology.h
index a3f239545897..8489a0905a87 100644
--- a/arch/sh/include/asm/topology.h
+++ b/arch/sh/include/asm/topology.h
@@ -37,8 +37,11 @@
 #define pcibus_to_node(bus)     ((void)(bus), -1)
 #define pcibus_to_cpumask(bus)  (pcibus_to_node(bus) == -1 ? \
                                        CPU_MASK_ALL : \
-                                        node_to_cpumask(pcibus_to_node(bus)) \
+                                        node_to_cpumask(pcibus_to_node(bus)))
-                                )
+#define cpumask_of_pcibus(bus)  (pcibus_to_node(bus) == -1 ? \
+                                        CPU_MASK_ALL_PTR : \
+                                        cpumask_of_node(pcibus_to_node(bus)))
 #endif
 #include <asm-generic/topology.h>
diff --git a/arch/sh/include/asm/unistd_32.h b/arch/sh/include/asm/unistd_32.h
index d52c000cf924..2efb819e2db3 100644
--- a/arch/sh/include/asm/unistd_32.h
+++ b/arch/sh/include/asm/unistd_32.h
@@ -341,8 +341,10 @@
 #define __NR_dup3               330
 #define __NR_pipe2              331
 #define __NR_inotify_init1      332
+#define __NR_preadv             333
+#define __NR_pwritev            334
-#define NR_syscalls 333
+#define NR_syscalls 335
 #ifdef __KERNEL__
diff --git a/arch/sh/include/asm/unistd_64.h b/arch/sh/include/asm/unistd_64.h
index 7c54e91753c1..6eb9d2934c0f 100644
--- a/arch/sh/include/asm/unistd_64.h
+++ b/arch/sh/include/asm/unistd_64.h
@@ -381,10 +381,12 @@
 #define __NR_dup3               358
 #define __NR_pipe2              359
 #define __NR_inotify_init1      360
+#define __NR_preadv             361
+#define __NR_pwritev            362
 #ifdef __KERNEL__
-#define NR_syscalls 361
+#define NR_syscalls 363
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7786.c b/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
index 5a47e1cf442e..90e8cfff55fd 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
@@ -143,14 +143,14 @@ static void __init sh7786_usb_setup(void)
         * Set the PHY and PLL enable bit
         */
        __raw_writel(PHY_ENB | PLL_ENB, USBPCTL1);
-        while (i-- &&
+        while (i--) {
-               ((__raw_readl(USBST) & ACT_PLL_STATUS) != ACT_PLL_STATUS))
+                if (ACT_PLL_STATUS == (__raw_readl(USBST) & ACT_PLL_STATUS)) {
+                        /* Set the PHY RST bit */
+                        __raw_writel(PHY_ENB | PLL_ENB | PHY_RST, USBPCTL1);
+                        printk(KERN_INFO "sh7786 usb setup done\n");
+                        break;
+                }
                cpu_relax();
-        if (i) {
-                /* Set the PHY RST bit */
-                __raw_writel(PHY_ENB | PLL_ENB | PHY_RST, USBPCTL1);
-                printk(KERN_INFO "sh7786 usb setup done\n");
        }
 }
diff --git a/arch/sh/kernel/syscalls_32.S b/arch/sh/kernel/syscalls_32.S
index e67c1733e1b9..05202edd8e21 100644
--- a/arch/sh/kernel/syscalls_32.S
+++ b/arch/sh/kernel/syscalls_32.S
@@ -349,3 +349,5 @@ ENTRY(sys_call_table)
        .long sys_dup3                  /* 330 */
        .long sys_pipe2
        .long sys_inotify_init1
+        .long sys_preadv
+        .long sys_writev
diff --git a/arch/sh/kernel/syscalls_64.S b/arch/sh/kernel/syscalls_64.S
index 557cb91f5caf..a083609f9284 100644
--- a/arch/sh/kernel/syscalls_64.S
+++ b/arch/sh/kernel/syscalls_64.S
@@ -387,3 +387,5 @@ sys_call_table:
        .long sys_dup3
        .long sys_pipe2
        .long sys_inotify_init1         /* 360 */
+        .long sys_preadv
+        .long sys_pwritev
diff --git a/arch/sh/mm/consistent.c b/arch/sh/mm/consistent.c
index edcd5fbf9651..e098ec158ddb 100644
--- a/arch/sh/mm/consistent.c
+++ b/arch/sh/mm/consistent.c
@@ -10,11 +10,22 @@
 * for more details.
 */
 #include <linux/mm.h>
+#include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
+#include <linux/dma-debug.h>
+#include <linux/io.h>
 #include <asm/cacheflush.h>
 #include <asm/addrspace.h>
-#include <asm/io.h>
+#define PREALLOC_DMA_DEBUG_ENTRIES      4096
+static int __init dma_init(void)
+{
+        dma_debug_init(PREALLOC_DMA_DEBUG_ENTRIES);
+        return 0;
+}
+fs_initcall(dma_init);
 void *dma_alloc_coherent(struct device *dev, size_t size,
                           dma_addr_t *dma_handle, gfp_t gfp)
@@ -45,6 +56,9 @@ void *dma_alloc_coherent(struct device *dev, size_t size,
        split_page(pfn_to_page(virt_to_phys(ret) >> PAGE_SHIFT), order);
        *dma_handle = virt_to_phys(ret);
+        debug_dma_alloc_coherent(dev, size, *dma_handle, ret_nocache);
        return ret_nocache;
 }
 EXPORT_SYMBOL(dma_alloc_coherent);
@@ -56,12 +70,15 @@ void dma_free_coherent(struct device *dev, size_t size,
        unsigned long pfn = dma_handle >> PAGE_SHIFT;
        int k;
-        if (!dma_release_from_coherent(dev, order, vaddr)) {
+        WARN_ON(irqs_disabled());       /* for portability */
-                WARN_ON(irqs_disabled());       /* for portability */
-                for (k = 0; k < (1 << order); k++)
+        if (dma_release_from_coherent(dev, order, vaddr))
-                        __free_pages(pfn_to_page(pfn + k), 0);
+                return;
-                iounmap(vaddr);
-        }
+        debug_dma_free_coherent(dev, size, vaddr, dma_handle);
+        for (k = 0; k < (1 << order); k++)
+                __free_pages(pfn_to_page(pfn + k), 0);
+        iounmap(vaddr);
 }
 EXPORT_SYMBOL(dma_free_coherent);
diff --git a/arch/sparc/include/asm/parport.h b/arch/sparc/include/asm/parport.h
index dff3f0253aa8..ff9ead640c4a 100644
--- a/arch/sparc/include/asm/parport.h
+++ b/arch/sparc/include/asm/parport.h
@@ -117,7 +117,7 @@ static int __devinit ecpp_probe(struct of_device *op, const struct of_device_id
        if (!strcmp(parent->name, "dma")) {
                p = parport_pc_probe_port(base, base + 0x400,
                                          op->irqs[0], PARPORT_DMA_NOFIFO,
-                                          op->dev.parent->parent);
+                                          op->dev.parent->parent, 0);
                if (!p)
                        return -ENOMEM;
                dev_set_drvdata(&op->dev, p);
@@ -168,7 +168,8 @@ static int __devinit ecpp_probe(struct of_device *op, const struct of_device_id
        p = parport_pc_probe_port(base, base + 0x400,
                                  op->irqs[0],
                                  slot,
-                                  op->dev.parent);
+                                  op->dev.parent,
+                                  0);
        err = -ENOMEM;
        if (!p)
                goto out_disable_irq;
diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
index 837c2c4cc203..ecdb682ab516 100644
--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -204,7 +204,13 @@ static void drv_read(struct drv_cmd *cmd)
 static void drv_write(struct drv_cmd *cmd)
 {
+        int this_cpu;
+        this_cpu = get_cpu();
+        if (cpumask_test_cpu(this_cpu, cmd->mask))
+                do_drv_write(cmd);
        smp_call_function_many(cmd->mask, do_drv_write, cmd, 1);
+        put_cpu();
 }
 static u32 get_cur_val(const struct cpumask *mask)
diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
index a0f3851ef310..2e0eb4140951 100644
--- a/arch/x86/kernel/microcode_core.c
+++ b/arch/x86/kernel/microcode_core.c
@@ -108,40 +108,29 @@ struct ucode_cpu_info		ucode_cpu_info[NR_CPUS];
 EXPORT_SYMBOL_GPL(ucode_cpu_info);
 #ifdef CONFIG_MICROCODE_OLD_INTERFACE
-struct update_for_cpu {
-        const void __user       *buf;
-        size_t                  size;
-};
-static long update_for_cpu(void *_ufc)
-{
-        struct update_for_cpu *ufc = _ufc;
-        int error;
-        error = microcode_ops->request_microcode_user(smp_processor_id(),
-                                                      ufc->buf, ufc->size);
-        if (error < 0)
-                return error;
-        if (!error)
-                microcode_ops->apply_microcode(smp_processor_id());
-        return error;
-}
 static int do_microcode_update(const void __user *buf, size_t size)
 {
+        cpumask_t old;
        int error = 0;
        int cpu;
-        struct update_for_cpu ufc = { .buf = buf, .size = size };
+        old = current->cpus_allowed;
        for_each_online_cpu(cpu) {
                struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
                if (!uci->valid)
                        continue;
-                error = work_on_cpu(cpu, update_for_cpu, &ufc);
+                set_cpus_allowed_ptr(current, &cpumask_of_cpu(cpu));
+                error = microcode_ops->request_microcode_user(cpu, buf, size);
                if (error < 0)
-                        break;
+                        goto out;
+                if (!error)
+                        microcode_ops->apply_microcode(cpu);
        }
+out:
+        set_cpus_allowed_ptr(current, &old);
        return error;
 }
diff --git a/block/as-iosched.c b/block/as-iosched.c
index 631f6f44460a..c48fa670d221 100644
--- a/block/as-iosched.c
+++ b/block/as-iosched.c
@@ -17,9 +17,6 @@
 #include <linux/rbtree.h>
 #include <linux/interrupt.h>
-#define REQ_SYNC        1
-#define REQ_ASYNC       0
 /*
 * See Documentation/block/as-iosched.txt
 */
@@ -93,7 +90,7 @@ struct as_data {
        struct list_head fifo_list[2];
        struct request *next_rq[2];     /* next in sort order */
-        sector_t last_sector[2];        /* last REQ_SYNC & REQ_ASYNC sectors */
+        sector_t last_sector[2];        /* last SYNC & ASYNC sectors */
        unsigned long exit_prob;        /* probability a task will exit while
                                           being waited on */
@@ -109,7 +106,7 @@ struct as_data {
        unsigned long last_check_fifo[2];
        int changed_batch;              /* 1: waiting for old batch to end */
        int new_batch;                  /* 1: waiting on first read complete */
-        int batch_data_dir;             /* current batch REQ_SYNC / REQ_ASYNC */
+        int batch_data_dir;             /* current batch SYNC / ASYNC */
        int write_batch_count;          /* max # of reqs in a write batch */
        int current_write_count;        /* how many requests left this batch */
        int write_batch_idled;          /* has the write batch gone idle? */
@@ -554,7 +551,7 @@ static void as_update_iohist(struct as_data *ad, struct as_io_context *aic,
        if (aic == NULL)
                return;
-        if (data_dir == REQ_SYNC) {
+        if (data_dir == BLK_RW_SYNC) {
                unsigned long in_flight = atomic_read(&aic->nr_queued)
                                        + atomic_read(&aic->nr_dispatched);
                spin_lock(&aic->lock);
@@ -811,7 +808,7 @@ static void as_update_rq(struct as_data *ad, struct request *rq)
 */
 static void update_write_batch(struct as_data *ad)
 {
-        unsigned long batch = ad->batch_expire[REQ_ASYNC];
+        unsigned long batch = ad->batch_expire[BLK_RW_ASYNC];
        long write_time;
        write_time = (jiffies - ad->current_batch_expires) + batch;
@@ -855,7 +852,7 @@ static void as_completed_request(struct request_queue *q, struct request *rq)
                kblockd_schedule_work(q, &ad->antic_work);
                ad->changed_batch = 0;
-                if (ad->batch_data_dir == REQ_SYNC)
+                if (ad->batch_data_dir == BLK_RW_SYNC)
                        ad->new_batch = 1;
        }
        WARN_ON(ad->nr_dispatched == 0);
@@ -869,7 +866,7 @@ static void as_completed_request(struct request_queue *q, struct request *rq)
        if (ad->new_batch && ad->batch_data_dir == rq_is_sync(rq)) {
                update_write_batch(ad);
                ad->current_batch_expires = jiffies +
-                                ad->batch_expire[REQ_SYNC];
+                                ad->batch_expire[BLK_RW_SYNC];
                ad->new_batch = 0;
        }
@@ -960,7 +957,7 @@ static inline int as_batch_expired(struct as_data *ad)
        if (ad->changed_batch || ad->new_batch)
                return 0;
-        if (ad->batch_data_dir == REQ_SYNC)
+        if (ad->batch_data_dir == BLK_RW_SYNC)
                /* TODO! add a check so a complete fifo gets written? */
                return time_after(jiffies, ad->current_batch_expires);
@@ -986,7 +983,7 @@ static void as_move_to_dispatch(struct as_data *ad, struct request *rq)
         */
        ad->last_sector[data_dir] = rq->sector + rq->nr_sectors;
-        if (data_dir == REQ_SYNC) {
+        if (data_dir == BLK_RW_SYNC) {
                struct io_context *ioc = RQ_IOC(rq);
                /* In case we have to anticipate after this */
                copy_io_context(&ad->io_context, &ioc);
@@ -1025,41 +1022,41 @@ static void as_move_to_dispatch(struct as_data *ad, struct request *rq)
 static int as_dispatch_request(struct request_queue *q, int force)
 {
        struct as_data *ad = q->elevator->elevator_data;
-        const int reads = !list_empty(&ad->fifo_list[REQ_SYNC]);
+        const int reads = !list_empty(&ad->fifo_list[BLK_RW_SYNC]);
-        const int writes = !list_empty(&ad->fifo_list[REQ_ASYNC]);
+        const int writes = !list_empty(&ad->fifo_list[BLK_RW_ASYNC]);
        struct request *rq;
        if (unlikely(force)) {
                /*
                 * Forced dispatch, accounting is useless.  Reset
                 * accounting states and dump fifo_lists.  Note that
-                 * batch_data_dir is reset to REQ_SYNC to avoid
+                 * batch_data_dir is reset to BLK_RW_SYNC to avoid
                 * screwing write batch accounting as write batch
                 * accounting occurs on W->R transition.
                 */
                int dispatched = 0;
-                ad->batch_data_dir = REQ_SYNC;
+                ad->batch_data_dir = BLK_RW_SYNC;
                ad->changed_batch = 0;
                ad->new_batch = 0;
-                while (ad->next_rq[REQ_SYNC]) {
+                while (ad->next_rq[BLK_RW_SYNC]) {
-                        as_move_to_dispatch(ad, ad->next_rq[REQ_SYNC]);
+                        as_move_to_dispatch(ad, ad->next_rq[BLK_RW_SYNC]);
                        dispatched++;
                }
-                ad->last_check_fifo[REQ_SYNC] = jiffies;
+                ad->last_check_fifo[BLK_RW_SYNC] = jiffies;
-                while (ad->next_rq[REQ_ASYNC]) {
+                while (ad->next_rq[BLK_RW_ASYNC]) {
-                        as_move_to_dispatch(ad, ad->next_rq[REQ_ASYNC]);
+                        as_move_to_dispatch(ad, ad->next_rq[BLK_RW_ASYNC]);
                        dispatched++;
                }
-                ad->last_check_fifo[REQ_ASYNC] = jiffies;
+                ad->last_check_fifo[BLK_RW_ASYNC] = jiffies;
                return dispatched;
        }
        /* Signal that the write batch was uncontended, so we can't time it */
-        if (ad->batch_data_dir == REQ_ASYNC && !reads) {
+        if (ad->batch_data_dir == BLK_RW_ASYNC && !reads) {
                if (ad->current_write_count == 0 || !writes)
                        ad->write_batch_idled = 1;
        }
@@ -1076,8 +1073,8 @@ static int as_dispatch_request(struct request_queue *q, int force)
                 */
                rq = ad->next_rq[ad->batch_data_dir];
-                if (ad->batch_data_dir == REQ_SYNC && ad->antic_expire) {
+                if (ad->batch_data_dir == BLK_RW_SYNC && ad->antic_expire) {
-                        if (as_fifo_expired(ad, REQ_SYNC))
+                        if (as_fifo_expired(ad, BLK_RW_SYNC))
                                goto fifo_expired;
                        if (as_can_anticipate(ad, rq)) {
@@ -1090,7 +1087,7 @@ static int as_dispatch_request(struct request_queue *q, int force)
                        /* we have a "next request" */
                        if (reads && !writes)
                                ad->current_batch_expires =
-                                        jiffies + ad->batch_expire[REQ_SYNC];
+                                        jiffies + ad->batch_expire[BLK_RW_SYNC];
                        goto dispatch_request;
                }
        }
@@ -1101,20 +1098,20 @@ static int as_dispatch_request(struct request_queue *q, int force)
         */
        if (reads) {
-                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[REQ_SYNC]));
+                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[BLK_RW_SYNC]));
-                if (writes && ad->batch_data_dir == REQ_SYNC)
+                if (writes && ad->batch_data_dir == BLK_RW_SYNC)
                        /*
                         * Last batch was a read, switch to writes
                         */
                        goto dispatch_writes;
-                if (ad->batch_data_dir == REQ_ASYNC) {
+                if (ad->batch_data_dir == BLK_RW_ASYNC) {
                        WARN_ON(ad->new_batch);
                        ad->changed_batch = 1;
                }
-                ad->batch_data_dir = REQ_SYNC;
+                ad->batch_data_dir = BLK_RW_SYNC;
-                rq = rq_entry_fifo(ad->fifo_list[REQ_SYNC].next);
+                rq = rq_entry_fifo(ad->fifo_list[BLK_RW_SYNC].next);
                ad->last_check_fifo[ad->batch_data_dir] = jiffies;
                goto dispatch_request;
        }
@@ -1125,9 +1122,9 @@ static int as_dispatch_request(struct request_queue *q, int force)
        if (writes) {
 dispatch_writes:
-                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[REQ_ASYNC]));
+                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[BLK_RW_ASYNC]));
-                if (ad->batch_data_dir == REQ_SYNC) {
+                if (ad->batch_data_dir == BLK_RW_SYNC) {
                        ad->changed_batch = 1;
                        /*
@@ -1137,11 +1134,11 @@ dispatch_writes:
                         */
                        ad->new_batch = 0;
                }
-                ad->batch_data_dir = REQ_ASYNC;
+                ad->batch_data_dir = BLK_RW_ASYNC;
                ad->current_write_count = ad->write_batch_count;
                ad->write_batch_idled = 0;
-                rq = rq_entry_fifo(ad->fifo_list[REQ_ASYNC].next);
+                rq = rq_entry_fifo(ad->fifo_list[BLK_RW_ASYNC].next);
-                ad->last_check_fifo[REQ_ASYNC] = jiffies;
+                ad->last_check_fifo[BLK_RW_ASYNC] = jiffies;
                goto dispatch_request;
        }
@@ -1164,9 +1161,9 @@ fifo_expired:
                if (ad->nr_dispatched)
                        return 0;
-                if (ad->batch_data_dir == REQ_ASYNC)
+                if (ad->batch_data_dir == BLK_RW_ASYNC)
                        ad->current_batch_expires = jiffies +
-                                        ad->batch_expire[REQ_ASYNC];
+                                        ad->batch_expire[BLK_RW_ASYNC];
                else
                        ad->new_batch = 1;
@@ -1238,8 +1235,8 @@ static int as_queue_empty(struct request_queue *q)
 {
        struct as_data *ad = q->elevator->elevator_data;
-        return list_empty(&ad->fifo_list[REQ_ASYNC])
+        return list_empty(&ad->fifo_list[BLK_RW_ASYNC])
-                && list_empty(&ad->fifo_list[REQ_SYNC]);
+                && list_empty(&ad->fifo_list[BLK_RW_SYNC]);
 }
 static int
@@ -1346,8 +1343,8 @@ static void as_exit_queue(struct elevator_queue *e)
        del_timer_sync(&ad->antic_timer);
        cancel_work_sync(&ad->antic_work);
-        BUG_ON(!list_empty(&ad->fifo_list[REQ_SYNC]));
+        BUG_ON(!list_empty(&ad->fifo_list[BLK_RW_SYNC]));
-        BUG_ON(!list_empty(&ad->fifo_list[REQ_ASYNC]));
+        BUG_ON(!list_empty(&ad->fifo_list[BLK_RW_ASYNC]));
        put_io_context(ad->io_context);
        kfree(ad);
@@ -1372,18 +1369,18 @@ static void *as_init_queue(struct request_queue *q)
        init_timer(&ad->antic_timer);
        INIT_WORK(&ad->antic_work, as_work_handler);
-        INIT_LIST_HEAD(&ad->fifo_list[REQ_SYNC]);
+        INIT_LIST_HEAD(&ad->fifo_list[BLK_RW_SYNC]);
-        INIT_LIST_HEAD(&ad->fifo_list[REQ_ASYNC]);
+        INIT_LIST_HEAD(&ad->fifo_list[BLK_RW_ASYNC]);
-        ad->sort_list[REQ_SYNC] = RB_ROOT;
+        ad->sort_list[BLK_RW_SYNC] = RB_ROOT;
-        ad->sort_list[REQ_ASYNC] = RB_ROOT;
+        ad->sort_list[BLK_RW_ASYNC] = RB_ROOT;
-        ad->fifo_expire[REQ_SYNC] = default_read_expire;
+        ad->fifo_expire[BLK_RW_SYNC] = default_read_expire;
-        ad->fifo_expire[REQ_ASYNC] = default_write_expire;
+        ad->fifo_expire[BLK_RW_ASYNC] = default_write_expire;
        ad->antic_expire = default_antic_expire;
-        ad->batch_expire[REQ_SYNC] = default_read_batch_expire;
+        ad->batch_expire[BLK_RW_SYNC] = default_read_batch_expire;
-        ad->batch_expire[REQ_ASYNC] = default_write_batch_expire;
+        ad->batch_expire[BLK_RW_ASYNC] = default_write_batch_expire;
-        ad->current_batch_expires = jiffies + ad->batch_expire[REQ_SYNC];
+        ad->current_batch_expires = jiffies + ad->batch_expire[BLK_RW_SYNC];
-        ad->write_batch_count = ad->batch_expire[REQ_ASYNC] / 10;
+        ad->write_batch_count = ad->batch_expire[BLK_RW_ASYNC] / 10;
        if (ad->write_batch_count < 2)
                ad->write_batch_count = 2;
@@ -1432,11 +1429,11 @@ static ssize_t __FUNC(struct elevator_queue *e, char *page)	\
        struct as_data *ad = e->elevator_data;                  \
        return as_var_show(jiffies_to_msecs((__VAR)), (page));  \
 }
-SHOW_FUNCTION(as_read_expire_show, ad->fifo_expire[REQ_SYNC]);
+SHOW_FUNCTION(as_read_expire_show, ad->fifo_expire[BLK_RW_SYNC]);
-SHOW_FUNCTION(as_write_expire_show, ad->fifo_expire[REQ_ASYNC]);
+SHOW_FUNCTION(as_write_expire_show, ad->fifo_expire[BLK_RW_ASYNC]);
 SHOW_FUNCTION(as_antic_expire_show, ad->antic_expire);
-SHOW_FUNCTION(as_read_batch_expire_show, ad->batch_expire[REQ_SYNC]);
+SHOW_FUNCTION(as_read_batch_expire_show, ad->batch_expire[BLK_RW_SYNC]);
-SHOW_FUNCTION(as_write_batch_expire_show, ad->batch_expire[REQ_ASYNC]);
+SHOW_FUNCTION(as_write_batch_expire_show, ad->batch_expire[BLK_RW_ASYNC]);
 #undef SHOW_FUNCTION
 #define STORE_FUNCTION(__FUNC, __PTR, MIN, MAX)                         \
@@ -1451,13 +1448,14 @@ static ssize_t __FUNC(struct elevator_queue *e, const char *page, size_t count)
        *(__PTR) = msecs_to_jiffies(*(__PTR));                          \
        return ret;                                                     \
 }
-STORE_FUNCTION(as_read_expire_store, &ad->fifo_expire[REQ_SYNC], 0, INT_MAX);
+STORE_FUNCTION(as_read_expire_store, &ad->fifo_expire[BLK_RW_SYNC], 0, INT_MAX);
-STORE_FUNCTION(as_write_expire_store, &ad->fifo_expire[REQ_ASYNC], 0, INT_MAX);
+STORE_FUNCTION(as_write_expire_store,
+                        &ad->fifo_expire[BLK_RW_ASYNC], 0, INT_MAX);
 STORE_FUNCTION(as_antic_expire_store, &ad->antic_expire, 0, INT_MAX);
 STORE_FUNCTION(as_read_batch_expire_store,
-                        &ad->batch_expire[REQ_SYNC], 0, INT_MAX);
+                        &ad->batch_expire[BLK_RW_SYNC], 0, INT_MAX);
 STORE_FUNCTION(as_write_batch_expire_store,
-                        &ad->batch_expire[REQ_ASYNC], 0, INT_MAX);
+                        &ad->batch_expire[BLK_RW_ASYNC], 0, INT_MAX);
 #undef STORE_FUNCTION
 #define AS_ATTR(name) \
diff --git a/block/blk-barrier.c b/block/blk-barrier.c
index f7dae57e6cab..20b4111fa050 100644
--- a/block/blk-barrier.c
+++ b/block/blk-barrier.c
@@ -319,9 +319,6 @@ int blkdev_issue_flush(struct block_device *bdev, sector_t *error_sector)
                return -ENXIO;
        bio = bio_alloc(GFP_KERNEL, 0);
-        if (!bio)
-                return -ENOMEM;
        bio->bi_end_io = bio_end_empty_barrier;
        bio->bi_private = &wait;
        bio->bi_bdev = bdev;
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 73f36beff5cd..cac4e9febe6a 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -209,14 +209,14 @@ static ssize_t queue_iostats_store(struct request_queue *q, const char *page,
        ssize_t ret = queue_var_store(&stats, page, count);
        spin_lock_irq(q->queue_lock);
-        elv_quisce_start(q);
+        elv_quiesce_start(q);
        if (stats)
                queue_flag_set(QUEUE_FLAG_IO_STAT, q);
        else
                queue_flag_clear(QUEUE_FLAG_IO_STAT, q);
-        elv_quisce_end(q);
+        elv_quiesce_end(q);
        spin_unlock_irq(q->queue_lock);
        return ret;
diff --git a/block/blk.h b/block/blk.h
index 24fcaeeaf620..5dfc41267a08 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -70,8 +70,8 @@ void blk_queue_congestion_threshold(struct request_queue *q);
 int blk_dev_init(void);
-void elv_quisce_start(struct request_queue *q);
+void elv_quiesce_start(struct request_queue *q);
-void elv_quisce_end(struct request_queue *q);
+void elv_quiesce_end(struct request_queue *q);
 /*
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index a4809de6fea6..0d3b70de3d80 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -56,9 +56,6 @@ static DEFINE_SPINLOCK(ioc_gone_lock);
 #define cfq_class_idle(cfqq)    ((cfqq)->ioprio_class == IOPRIO_CLASS_IDLE)
 #define cfq_class_rt(cfqq)      ((cfqq)->ioprio_class == IOPRIO_CLASS_RT)
-#define ASYNC                   (0)
-#define SYNC                    (1)
 #define sample_valid(samples)   ((samples) > 80)
 /*
@@ -83,6 +80,14 @@ struct cfq_data {
         * rr list of queues with requests and the count of them
         */
        struct cfq_rb_root service_tree;
+        /*
+         * Each priority tree is sorted by next_request position.  These
+         * trees are used when determining if two or more queues are
+         * interleaving requests (see cfq_close_cooperator).
+         */
+        struct rb_root prio_trees[CFQ_PRIO_LISTS];
        unsigned int busy_queues;
        /*
         * Used to track any pending rt requests so we can pre-empt current
@@ -147,6 +152,8 @@ struct cfq_queue {
        struct rb_node rb_node;
        /* service_tree key */
        unsigned long rb_key;
+        /* prio tree member */
+        struct rb_node p_node;
        /* sorted list of pending requests */
        struct rb_root sort_list;
        /* if fifo isn't expired, next request to serve */
@@ -185,6 +192,7 @@ enum cfqq_state_flags {
        CFQ_CFQQ_FLAG_prio_changed,     /* task priority has changed */
        CFQ_CFQQ_FLAG_slice_new,        /* no requests dispatched in slice */
        CFQ_CFQQ_FLAG_sync,             /* synchronous queue */
+        CFQ_CFQQ_FLAG_coop,             /* has done a coop jump of the queue */
 };
 #define CFQ_CFQQ_FNS(name)                                              \
@@ -211,6 +219,7 @@ CFQ_CFQQ_FNS(idle_window);
 CFQ_CFQQ_FNS(prio_changed);
 CFQ_CFQQ_FNS(slice_new);
 CFQ_CFQQ_FNS(sync);
+CFQ_CFQQ_FNS(coop);
 #undef CFQ_CFQQ_FNS
 #define cfq_log_cfqq(cfqd, cfqq, fmt, args...)  \
@@ -419,13 +428,17 @@ static struct cfq_queue *cfq_rb_first(struct cfq_rb_root *root)
        return NULL;
 }
+static void rb_erase_init(struct rb_node *n, struct rb_root *root)
+{
+        rb_erase(n, root);
+        RB_CLEAR_NODE(n);
+}
 static void cfq_rb_erase(struct rb_node *n, struct cfq_rb_root *root)
 {
        if (root->left == n)
                root->left = NULL;
+        rb_erase_init(n, &root->rb);
-        rb_erase(n, &root->rb);
-        RB_CLEAR_NODE(n);
 }
 /*
@@ -470,8 +483,8 @@ static unsigned long cfq_slice_offset(struct cfq_data *cfqd,
 * requests waiting to be processed. It is sorted in the order that
 * we will service the queues.
 */
-static void cfq_service_tree_add(struct cfq_data *cfqd,
+static void cfq_service_tree_add(struct cfq_data *cfqd, struct cfq_queue *cfqq,
-                                    struct cfq_queue *cfqq, int add_front)
+                                 int add_front)
 {
        struct rb_node **p, *parent;
        struct cfq_queue *__cfqq;
@@ -544,6 +557,63 @@ static void cfq_service_tree_add(struct cfq_data *cfqd,
        rb_insert_color(&cfqq->rb_node, &cfqd->service_tree.rb);
 }
+static struct cfq_queue *
+cfq_prio_tree_lookup(struct cfq_data *cfqd, int ioprio, sector_t sector,
+                     struct rb_node **ret_parent, struct rb_node ***rb_link)
+{
+        struct rb_root *root = &cfqd->prio_trees[ioprio];
+        struct rb_node **p, *parent;
+        struct cfq_queue *cfqq = NULL;
+        parent = NULL;
+        p = &root->rb_node;
+        while (*p) {
+                struct rb_node **n;
+                parent = *p;
+                cfqq = rb_entry(parent, struct cfq_queue, p_node);
+                /*
+                 * Sort strictly based on sector.  Smallest to the left,
+                 * largest to the right.
+                 */
+                if (sector > cfqq->next_rq->sector)
+                        n = &(*p)->rb_right;
+                else if (sector < cfqq->next_rq->sector)
+                        n = &(*p)->rb_left;
+                else
+                        break;
+                p = n;
+        }
+        *ret_parent = parent;
+        if (rb_link)
+                *rb_link = p;
+        return NULL;
+}
+static void cfq_prio_tree_add(struct cfq_data *cfqd, struct cfq_queue *cfqq)
+{
+        struct rb_root *root = &cfqd->prio_trees[cfqq->ioprio];
+        struct rb_node **p, *parent;
+        struct cfq_queue *__cfqq;
+        if (!RB_EMPTY_NODE(&cfqq->p_node))
+                rb_erase_init(&cfqq->p_node, root);
+        if (cfq_class_idle(cfqq))
+                return;
+        if (!cfqq->next_rq)
+                return;
+        __cfqq = cfq_prio_tree_lookup(cfqd, cfqq->ioprio, cfqq->next_rq->sector,
+                                         &parent, &p);
+        BUG_ON(__cfqq);
+        rb_link_node(&cfqq->p_node, parent, p);
+        rb_insert_color(&cfqq->p_node, root);
+}
 /*
 * Update cfqq's position in the service tree.
 */
@@ -552,8 +622,10 @@ static void cfq_resort_rr_list(struct cfq_data *cfqd, struct cfq_queue *cfqq)
        /*
         * Resorting requires the cfqq to be on the RR list already.
         */
-        if (cfq_cfqq_on_rr(cfqq))
+        if (cfq_cfqq_on_rr(cfqq)) {
                cfq_service_tree_add(cfqd, cfqq, 0);
+                cfq_prio_tree_add(cfqd, cfqq);
+        }
 }
 /*
@@ -584,6 +656,8 @@ static void cfq_del_cfqq_rr(struct cfq_data *cfqd, struct cfq_queue *cfqq)
        if (!RB_EMPTY_NODE(&cfqq->rb_node))
                cfq_rb_erase(&cfqq->rb_node, &cfqd->service_tree);
+        if (!RB_EMPTY_NODE(&cfqq->p_node))
+                rb_erase_init(&cfqq->p_node, &cfqd->prio_trees[cfqq->ioprio]);
        BUG_ON(!cfqd->busy_queues);
        cfqd->busy_queues--;
@@ -613,7 +687,7 @@ static void cfq_add_rq_rb(struct request *rq)
 {
        struct cfq_queue *cfqq = RQ_CFQQ(rq);
        struct cfq_data *cfqd = cfqq->cfqd;
-        struct request *__alias;
+        struct request *__alias, *prev;
        cfqq->queued[rq_is_sync(rq)]++;
@@ -630,7 +704,15 @@ static void cfq_add_rq_rb(struct request *rq)
        /*
         * check if this request is a better next-serve candidate
         */
+        prev = cfqq->next_rq;
        cfqq->next_rq = cfq_choose_req(cfqd, cfqq->next_rq, rq);
+        /*
+         * adjust priority tree position, if ->next_rq changes
+         */
+        if (prev != cfqq->next_rq)
+                cfq_prio_tree_add(cfqd, cfqq);
        BUG_ON(!cfqq->next_rq);
 }
@@ -843,11 +925,15 @@ static struct cfq_queue *cfq_get_next_queue(struct cfq_data *cfqd)
 /*
 * Get and set a new active queue for service.
 */
-static struct cfq_queue *cfq_set_active_queue(struct cfq_data *cfqd)
+static struct cfq_queue *cfq_set_active_queue(struct cfq_data *cfqd,
+                                              struct cfq_queue *cfqq)
 {
-        struct cfq_queue *cfqq;
+        if (!cfqq) {
+                cfqq = cfq_get_next_queue(cfqd);
+                if (cfqq)
+                        cfq_clear_cfqq_coop(cfqq);
+        }
-        cfqq = cfq_get_next_queue(cfqd);
        __cfq_set_active_queue(cfqd, cfqq);
        return cfqq;
 }
@@ -871,17 +957,89 @@ static inline int cfq_rq_close(struct cfq_data *cfqd, struct request *rq)
        return cfq_dist_from_last(cfqd, rq) <= cic->seek_mean;
 }
-static int cfq_close_cooperator(struct cfq_data *cfq_data,
+static struct cfq_queue *cfqq_close(struct cfq_data *cfqd,
-                                struct cfq_queue *cfqq)
+                                    struct cfq_queue *cur_cfqq)
+{
+        struct rb_root *root = &cfqd->prio_trees[cur_cfqq->ioprio];
+        struct rb_node *parent, *node;
+        struct cfq_queue *__cfqq;
+        sector_t sector = cfqd->last_position;
+        if (RB_EMPTY_ROOT(root))
+                return NULL;
+        /*
+         * First, if we find a request starting at the end of the last
+         * request, choose it.
+         */
+        __cfqq = cfq_prio_tree_lookup(cfqd, cur_cfqq->ioprio,
+                                      sector, &parent, NULL);
+        if (__cfqq)
+                return __cfqq;
+        /*
+         * If the exact sector wasn't found, the parent of the NULL leaf
+         * will contain the closest sector.
+         */
+        __cfqq = rb_entry(parent, struct cfq_queue, p_node);
+        if (cfq_rq_close(cfqd, __cfqq->next_rq))
+                return __cfqq;
+        if (__cfqq->next_rq->sector < sector)
+                node = rb_next(&__cfqq->p_node);
+        else
+                node = rb_prev(&__cfqq->p_node);
+        if (!node)
+                return NULL;
+        __cfqq = rb_entry(node, struct cfq_queue, p_node);
+        if (cfq_rq_close(cfqd, __cfqq->next_rq))
+                return __cfqq;
+        return NULL;
+}
+/*
+ * cfqd - obvious
+ * cur_cfqq - passed in so that we don't decide that the current queue is
+ *            closely cooperating with itself.
+ *
+ * So, basically we're assuming that that cur_cfqq has dispatched at least
+ * one request, and that cfqd->last_position reflects a position on the disk
+ * associated with the I/O issued by cur_cfqq.  I'm not sure this is a valid
+ * assumption.
+ */
+static struct cfq_queue *cfq_close_cooperator(struct cfq_data *cfqd,
+                                              struct cfq_queue *cur_cfqq,
+                                              int probe)
 {
+        struct cfq_queue *cfqq;
+        /*
+         * A valid cfq_io_context is necessary to compare requests against
+         * the seek_mean of the current cfqq.
+         */
+        if (!cfqd->active_cic)
+                return NULL;
        /*
         * We should notice if some of the queues are cooperating, eg
         * working closely on the same area of the disk. In that case,
         * we can group them together and don't waste time idling.
         */
-        return 0;
+        cfqq = cfqq_close(cfqd, cur_cfqq);
+        if (!cfqq)
+                return NULL;
+        if (cfq_cfqq_coop(cfqq))
+                return NULL;
+        if (!probe)
+                cfq_mark_cfqq_coop(cfqq);
+        return cfqq;
 }
 #define CIC_SEEKY(cic) ((cic)->seek_mean > (8 * 1024))
 static void cfq_arm_slice_timer(struct cfq_data *cfqd)
@@ -920,13 +1078,6 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
        if (!cic || !atomic_read(&cic->ioc->nr_tasks))
                return;
-        /*
-         * See if this prio level has a good candidate
-         */
-        if (cfq_close_cooperator(cfqd, cfqq) &&
-            (sample_valid(cic->ttime_samples) && cic->ttime_mean > 2))
-                return;
        cfq_mark_cfqq_wait_request(cfqq);
        /*
@@ -939,7 +1090,7 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
                sl = min(sl, msecs_to_jiffies(CFQ_MIN_TT));
        mod_timer(&cfqd->idle_slice_timer, jiffies + sl);
-        cfq_log(cfqd, "arm_idle: %lu", sl);
+        cfq_log_cfqq(cfqd, cfqq, "arm_idle: %lu", sl);
 }
 /*
@@ -1003,7 +1154,7 @@ cfq_prio_to_maxrq(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 */
 static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
 {
-        struct cfq_queue *cfqq;
+        struct cfq_queue *cfqq, *new_cfqq = NULL;
        cfqq = cfqd->active_queue;
        if (!cfqq)
@@ -1037,6 +1188,16 @@ static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
                goto keep_queue;
        /*
+         * If another queue has a request waiting within our mean seek
+         * distance, let it run.  The expire code will check for close
+         * cooperators and put the close queue at the front of the service
+         * tree.
+         */
+        new_cfqq = cfq_close_cooperator(cfqd, cfqq, 0);
+        if (new_cfqq)
+                goto expire;
+        /*
         * No requests pending. If the active queue still has requests in
         * flight or is idling for a new request, allow either of these
         * conditions to happen (or time out) before selecting a new queue.
@@ -1050,7 +1211,7 @@ static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
 expire:
        cfq_slice_expired(cfqd, 0);
 new_queue:
-        cfqq = cfq_set_active_queue(cfqd);
+        cfqq = cfq_set_active_queue(cfqd, new_cfqq);
 keep_queue:
        return cfqq;
 }
@@ -1333,14 +1494,14 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
        if (ioc->ioc_data == cic)
                rcu_assign_pointer(ioc->ioc_data, NULL);
-        if (cic->cfqq[ASYNC]) {
+        if (cic->cfqq[BLK_RW_ASYNC]) {
-                cfq_exit_cfqq(cfqd, cic->cfqq[ASYNC]);
+                cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
-                cic->cfqq[ASYNC] = NULL;
+                cic->cfqq[BLK_RW_ASYNC] = NULL;
        }
-        if (cic->cfqq[SYNC]) {
+        if (cic->cfqq[BLK_RW_SYNC]) {
-                cfq_exit_cfqq(cfqd, cic->cfqq[SYNC]);
+                cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_SYNC]);
-                cic->cfqq[SYNC] = NULL;
+                cic->cfqq[BLK_RW_SYNC] = NULL;
        }
 }
@@ -1449,17 +1610,18 @@ static void changed_ioprio(struct io_context *ioc, struct cfq_io_context *cic)
        spin_lock_irqsave(cfqd->queue->queue_lock, flags);
-        cfqq = cic->cfqq[ASYNC];
+        cfqq = cic->cfqq[BLK_RW_ASYNC];
        if (cfqq) {
                struct cfq_queue *new_cfqq;
-                new_cfqq = cfq_get_queue(cfqd, ASYNC, cic->ioc, GFP_ATOMIC);
+                new_cfqq = cfq_get_queue(cfqd, BLK_RW_ASYNC, cic->ioc,
+                                                GFP_ATOMIC);
                if (new_cfqq) {
-                        cic->cfqq[ASYNC] = new_cfqq;
+                        cic->cfqq[BLK_RW_ASYNC] = new_cfqq;
                        cfq_put_queue(cfqq);
                }
        }
-        cfqq = cic->cfqq[SYNC];
+        cfqq = cic->cfqq[BLK_RW_SYNC];
        if (cfqq)
                cfq_mark_cfqq_prio_changed(cfqq);
@@ -1510,6 +1672,7 @@ retry:
                }
                RB_CLEAR_NODE(&cfqq->rb_node);
+                RB_CLEAR_NODE(&cfqq->p_node);
                INIT_LIST_HEAD(&cfqq->fifo);
                atomic_set(&cfqq->ref, 0);
@@ -1905,10 +2068,20 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                 * Remember that we saw a request from this process, but
                 * don't start queuing just yet. Otherwise we risk seeing lots
                 * of tiny requests, because we disrupt the normal plugging
-                 * and merging.
+                 * and merging. If the request is already larger than a single
+                 * page, let it rip immediately. For that case we assume that
+                 * merging is already done. Ditto for a busy system that
+                 * has other work pending, don't risk delaying until the
+                 * idle timer unplug to continue working.
                 */
-                if (cfq_cfqq_wait_request(cfqq))
+                if (cfq_cfqq_wait_request(cfqq)) {
+                        if (blk_rq_bytes(rq) > PAGE_CACHE_SIZE ||
+                            cfqd->busy_queues > 1) {
+                                del_timer(&cfqd->idle_slice_timer);
+                                blk_start_queueing(cfqd->queue);
+                        }
                        cfq_mark_cfqq_must_dispatch(cfqq);
+                }
        } else if (cfq_should_preempt(cfqd, cfqq, rq)) {
                /*
                 * not the active queue - expire current slice if it is
@@ -1992,16 +2165,24 @@ static void cfq_completed_request(struct request_queue *q, struct request *rq)
         * or if we want to idle in case it has no pending requests.
         */
        if (cfqd->active_queue == cfqq) {
+                const bool cfqq_empty = RB_EMPTY_ROOT(&cfqq->sort_list);
                if (cfq_cfqq_slice_new(cfqq)) {
                        cfq_set_prio_slice(cfqd, cfqq);
                        cfq_clear_cfqq_slice_new(cfqq);
                }
+                /*
+                 * If there are no requests waiting in this queue, and
+                 * there are other queues ready to issue requests, AND
+                 * those other queues are issuing requests within our
+                 * mean seek distance, give them a chance to run instead
+                 * of idling.
+                 */
                if (cfq_slice_used(cfqq) || cfq_class_idle(cfqq))
                        cfq_slice_expired(cfqd, 1);
-                else if (sync && !rq_noidle(rq) &&
+                else if (cfqq_empty && !cfq_close_cooperator(cfqd, cfqq, 1) &&
-                         RB_EMPTY_ROOT(&cfqq->sort_list)) {
+                         sync && !rq_noidle(rq))
                        cfq_arm_slice_timer(cfqd);
-                }
        }
        if (!cfqd->rq_in_driver)
@@ -2062,7 +2243,7 @@ static int cfq_may_queue(struct request_queue *q, int rw)
        if (!cic)
                return ELV_MQUEUE_MAY;
-        cfqq = cic_to_cfqq(cic, rw & REQ_RW_SYNC);
+        cfqq = cic_to_cfqq(cic, rw_is_sync(rw));
        if (cfqq) {
                cfq_init_prio_data(cfqq, cic->ioc);
                cfq_prio_boost(cfqq);
@@ -2152,11 +2333,10 @@ static void cfq_kick_queue(struct work_struct *work)
        struct cfq_data *cfqd =
                container_of(work, struct cfq_data, unplug_work);
        struct request_queue *q = cfqd->queue;
-        unsigned long flags;
-        spin_lock_irqsave(q->queue_lock, flags);
+        spin_lock_irq(q->queue_lock);
        blk_start_queueing(q);
-        spin_unlock_irqrestore(q->queue_lock, flags);
+        spin_unlock_irq(q->queue_lock);
 }
 /*
diff --git a/block/elevator.c b/block/elevator.c
index fb81bcc14a8c..7073a9072577 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -590,7 +590,7 @@ void elv_drain_elevator(struct request_queue *q)
 /*
 * Call with queue lock held, interrupts disabled
 */
-void elv_quisce_start(struct request_queue *q)
+void elv_quiesce_start(struct request_queue *q)
 {
        queue_flag_set(QUEUE_FLAG_ELVSWITCH, q);
@@ -607,7 +607,7 @@ void elv_quisce_start(struct request_queue *q)
        }
 }
-void elv_quisce_end(struct request_queue *q)
+void elv_quiesce_end(struct request_queue *q)
 {
        queue_flag_clear(QUEUE_FLAG_ELVSWITCH, q);
 }
@@ -1126,7 +1126,7 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         * Turn on BYPASS and drain all requests w/ elevator private data
         */
        spin_lock_irq(q->queue_lock);
-        elv_quisce_start(q);
+        elv_quiesce_start(q);
        /*
         * Remember old elevator.
@@ -1150,7 +1150,7 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         */
        elevator_exit(old_elevator);
        spin_lock_irq(q->queue_lock);
-        elv_quisce_end(q);
+        elv_quiesce_end(q);
        spin_unlock_irq(q->queue_lock);
        blk_add_trace_msg(q, "elv switch: %s", e->elevator_type->elevator_name);
diff --git a/block/ioctl.c b/block/ioctl.c
index 0f22e629b13c..ad474d4bbcce 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -146,8 +146,6 @@ static int blk_ioctl_discard(struct block_device *bdev, uint64_t start,
                struct bio *bio;
                bio = bio_alloc(GFP_KERNEL, 0);
-                if (!bio)
-                        return -ENOMEM;
                bio->bi_end_io = blk_ioc_discard_endio;
                bio->bi_bdev = bdev;
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 626ee274c5c4..84b7f8709f41 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -217,7 +217,7 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
 static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                                 struct bio *bio)
 {
-        int ret = 0;
+        int r, ret = 0;
        /*
         * fill in all the output members
@@ -242,7 +242,9 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                        ret = -EFAULT;
        }
-        blk_rq_unmap_user(bio);
+        r = blk_rq_unmap_user(bio);
+        if (!ret)
+                ret = r;
        blk_put_request(rq);
        return ret;
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index bdd4f5f45575..5f7e64ba87e5 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -275,8 +275,10 @@ static int brd_do_bvec(struct brd_device *brd, struct page *page,
        if (rw == READ) {
                copy_from_brd(mem + off, brd, sector, len);
                flush_dcache_page(page);
-        } else
+        } else {
+                flush_dcache_page(page);
                copy_to_brd(brd, mem + off, sector, len);
+        }
        kunmap_atomic(mem, KM_USER0);
 out:
@@ -436,6 +438,7 @@ static struct brd_device *brd_alloc(int i)
        if (!brd->brd_queue)
                goto out_free_dev;
        blk_queue_make_request(brd->brd_queue, brd_make_request);
+        blk_queue_ordered(brd->brd_queue, QUEUE_ORDERED_TAG, NULL);
        blk_queue_max_sectors(brd->brd_queue, 1024);
        blk_queue_bounce_limit(brd->brd_queue, BLK_BOUNCE_ANY);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 3750d8003048..473a8f7fbdb5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -446,6 +446,9 @@ struct drm_i915_gem_object {
        uint32_t tiling_mode;
        uint32_t stride;
+        /** Record of address bit 17 of each page at last unbind. */
+        long *bit_17;
        /** AGP mapping type (AGP_USER_MEMORY or AGP_USER_CACHED_MEMORY */
        uint32_t agp_type;
@@ -635,9 +638,13 @@ int i915_gem_attach_phys_object(struct drm_device *dev,
 void i915_gem_detach_phys_object(struct drm_device *dev,
                                 struct drm_gem_object *obj);
 void i915_gem_free_all_phys_object(struct drm_device *dev);
+int i915_gem_object_get_pages(struct drm_gem_object *obj);
+void i915_gem_object_put_pages(struct drm_gem_object *obj);
 /* i915_gem_tiling.c */
 void i915_gem_detect_bit_6_swizzle(struct drm_device *dev);
+void i915_gem_object_do_bit_17_swizzle(struct drm_gem_object *obj);
+void i915_gem_object_save_bit_17_swizzle(struct drm_gem_object *obj);
 /* i915_gem_debug.c */
 void i915_gem_dump_object(struct drm_gem_object *obj, int len,
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 1449b452cc63..4642115902d6 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -43,8 +43,6 @@ static int i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
                                                     uint64_t offset,
                                                     uint64_t size);
 static void i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj);
-static int i915_gem_object_get_pages(struct drm_gem_object *obj);
-static void i915_gem_object_put_pages(struct drm_gem_object *obj);
 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
 static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
                                           unsigned alignment);
@@ -143,15 +141,27 @@ fast_shmem_read(struct page **pages,
                int length)
 {
        char __iomem *vaddr;
-        int ret;
+        int unwritten;
        vaddr = kmap_atomic(pages[page_base >> PAGE_SHIFT], KM_USER0);
        if (vaddr == NULL)
                return -ENOMEM;
-        ret = __copy_to_user_inatomic(data, vaddr + page_offset, length);
+        unwritten = __copy_to_user_inatomic(data, vaddr + page_offset, length);
        kunmap_atomic(vaddr, KM_USER0);
-        return ret;
+        if (unwritten)
+                return -EFAULT;
+        return 0;
+}
+static int i915_gem_object_needs_bit17_swizzle(struct drm_gem_object *obj)
+{
+        drm_i915_private_t *dev_priv = obj->dev->dev_private;
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        return dev_priv->mm.bit_6_swizzle_x == I915_BIT_6_SWIZZLE_9_10_17 &&
+                obj_priv->tiling_mode != I915_TILING_NONE;
 }
 static inline int
@@ -181,6 +191,64 @@ slow_shmem_copy(struct page *dst_page,
        return 0;
 }
+static inline int
+slow_shmem_bit17_copy(struct page *gpu_page,
+                      int gpu_offset,
+                      struct page *cpu_page,
+                      int cpu_offset,
+                      int length,
+                      int is_read)
+{
+        char *gpu_vaddr, *cpu_vaddr;
+        /* Use the unswizzled path if this page isn't affected. */
+        if ((page_to_phys(gpu_page) & (1 << 17)) == 0) {
+                if (is_read)
+                        return slow_shmem_copy(cpu_page, cpu_offset,
+                                               gpu_page, gpu_offset, length);
+                else
+                        return slow_shmem_copy(gpu_page, gpu_offset,
+                                               cpu_page, cpu_offset, length);
+        }
+        gpu_vaddr = kmap_atomic(gpu_page, KM_USER0);
+        if (gpu_vaddr == NULL)
+                return -ENOMEM;
+        cpu_vaddr = kmap_atomic(cpu_page, KM_USER1);
+        if (cpu_vaddr == NULL) {
+                kunmap_atomic(gpu_vaddr, KM_USER0);
+                return -ENOMEM;
+        }
+        /* Copy the data, XORing A6 with A17 (1). The user already knows he's
+         * XORing with the other bits (A9 for Y, A9 and A10 for X)
+         */
+        while (length > 0) {
+                int cacheline_end = ALIGN(gpu_offset + 1, 64);
+                int this_length = min(cacheline_end - gpu_offset, length);
+                int swizzled_gpu_offset = gpu_offset ^ 64;
+                if (is_read) {
+                        memcpy(cpu_vaddr + cpu_offset,
+                               gpu_vaddr + swizzled_gpu_offset,
+                               this_length);
+                } else {
+                        memcpy(gpu_vaddr + swizzled_gpu_offset,
+                               cpu_vaddr + cpu_offset,
+                               this_length);
+                }
+                cpu_offset += this_length;
+                gpu_offset += this_length;
+                length -= this_length;
+        }
+        kunmap_atomic(cpu_vaddr, KM_USER1);
+        kunmap_atomic(gpu_vaddr, KM_USER0);
+        return 0;
+}
 /**
 * This is the fast shmem pread path, which attempts to copy_from_user directly
 * from the backing pages of the object to the user's address space.  On a
@@ -269,6 +337,7 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
        int page_length;
        int ret;
        uint64_t data_ptr = args->data_ptr;
+        int do_bit17_swizzling;
        remain = args->size;
@@ -286,13 +355,15 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
        down_read(&mm->mmap_sem);
        pinned_pages = get_user_pages(current, mm, (uintptr_t)args->data_ptr,
-                                      num_pages, 0, 0, user_pages, NULL);
+                                      num_pages, 1, 0, user_pages, NULL);
        up_read(&mm->mmap_sem);
        if (pinned_pages < num_pages) {
                ret = -EFAULT;
                goto fail_put_user_pages;
        }
+        do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
        mutex_lock(&dev->struct_mutex);
        ret = i915_gem_object_get_pages(obj);
@@ -327,11 +398,20 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
                if ((data_page_offset + page_length) > PAGE_SIZE)
                        page_length = PAGE_SIZE - data_page_offset;
-                ret = slow_shmem_copy(user_pages[data_page_index],
+                if (do_bit17_swizzling) {
-                                      data_page_offset,
+                        ret = slow_shmem_bit17_copy(obj_priv->pages[shmem_page_index],
-                                      obj_priv->pages[shmem_page_index],
+                                                    shmem_page_offset,
-                                      shmem_page_offset,
+                                                    user_pages[data_page_index],
-                                      page_length);
+                                                    data_page_offset,
+                                                    page_length,
+                                                    1);
+                } else {
+                        ret = slow_shmem_copy(user_pages[data_page_index],
+                                              data_page_offset,
+                                              obj_priv->pages[shmem_page_index],
+                                              shmem_page_offset,
+                                              page_length);
+                }
                if (ret)
                        goto fail_put_pages;
@@ -383,9 +463,14 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                return -EINVAL;
        }
-        ret = i915_gem_shmem_pread_fast(dev, obj, args, file_priv);
+        if (i915_gem_object_needs_bit17_swizzle(obj)) {
-        if (ret != 0)
                ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);
+        } else {
+                ret = i915_gem_shmem_pread_fast(dev, obj, args, file_priv);
+                if (ret != 0)
+                        ret = i915_gem_shmem_pread_slow(dev, obj, args,
+                                                        file_priv);
+        }
        drm_gem_object_unreference(obj);
@@ -727,6 +812,7 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
        int page_length;
        int ret;
        uint64_t data_ptr = args->data_ptr;
+        int do_bit17_swizzling;
        remain = args->size;
@@ -751,6 +837,8 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
                goto fail_put_user_pages;
        }
+        do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
        mutex_lock(&dev->struct_mutex);
        ret = i915_gem_object_get_pages(obj);
@@ -785,11 +873,20 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
                if ((data_page_offset + page_length) > PAGE_SIZE)
                        page_length = PAGE_SIZE - data_page_offset;
-                ret = slow_shmem_copy(obj_priv->pages[shmem_page_index],
+                if (do_bit17_swizzling) {
-                                      shmem_page_offset,
+                        ret = slow_shmem_bit17_copy(obj_priv->pages[shmem_page_index],
-                                      user_pages[data_page_index],
+                                                    shmem_page_offset,
-                                      data_page_offset,
+                                                    user_pages[data_page_index],
-                                      page_length);
+                                                    data_page_offset,
+                                                    page_length,
+                                                    0);
+                } else {
+                        ret = slow_shmem_copy(obj_priv->pages[shmem_page_index],
+                                              shmem_page_offset,
+                                              user_pages[data_page_index],
+                                              data_page_offset,
+                                              page_length);
+                }
                if (ret)
                        goto fail_put_pages;
@@ -854,6 +951,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                        ret = i915_gem_gtt_pwrite_slow(dev, obj, args,
                                                       file_priv);
                }
+        } else if (i915_gem_object_needs_bit17_swizzle(obj)) {
+                ret = i915_gem_shmem_pwrite_slow(dev, obj, args, file_priv);
        } else {
                ret = i915_gem_shmem_pwrite_fast(dev, obj, args, file_priv);
                if (ret == -EFAULT) {
@@ -1285,7 +1384,7 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
        return 0;
 }
-static void
+void
 i915_gem_object_put_pages(struct drm_gem_object *obj)
 {
        struct drm_i915_gem_object *obj_priv = obj->driver_private;
@@ -1297,6 +1396,9 @@ i915_gem_object_put_pages(struct drm_gem_object *obj)
        if (--obj_priv->pages_refcount != 0)
                return;
+        if (obj_priv->tiling_mode != I915_TILING_NONE)
+                i915_gem_object_save_bit_17_swizzle(obj);
        for (i = 0; i < page_count; i++)
                if (obj_priv->pages[i] != NULL) {
                        if (obj_priv->dirty)
@@ -1494,8 +1596,19 @@ i915_gem_retire_request(struct drm_device *dev,
                if (obj->write_domain != 0)
                        i915_gem_object_move_to_flushing(obj);
-                else
+                else {
+                        /* Take a reference on the object so it won't be
+                         * freed while the spinlock is held.  The list
+                         * protection for this spinlock is safe when breaking
+                         * the lock like this since the next thing we do
+                         * is just get the head of the list again.
+                         */
+                        drm_gem_object_reference(obj);
                        i915_gem_object_move_to_inactive(obj);
+                        spin_unlock(&dev_priv->mm.active_list_lock);
+                        drm_gem_object_unreference(obj);
+                        spin_lock(&dev_priv->mm.active_list_lock);
+                }
        }
 out:
        spin_unlock(&dev_priv->mm.active_list_lock);
@@ -1884,7 +1997,7 @@ i915_gem_evict_everything(struct drm_device *dev)
        return ret;
 }
-static int
+int
 i915_gem_object_get_pages(struct drm_gem_object *obj)
 {
        struct drm_i915_gem_object *obj_priv = obj->driver_private;
@@ -1922,6 +2035,10 @@ i915_gem_object_get_pages(struct drm_gem_object *obj)
                }
                obj_priv->pages[i] = page;
        }
+        if (obj_priv->tiling_mode != I915_TILING_NONE)
+                i915_gem_object_do_bit_17_swizzle(obj);
        return 0;
 }
@@ -3002,13 +3119,13 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
                        drm_free(*relocs, reloc_count * sizeof(**relocs),
                                 DRM_MEM_DRIVER);
                        *relocs = NULL;
-                        return ret;
+                        return -EFAULT;
                }
                reloc_index += exec_list[i].relocation_count;
        }
-        return ret;
+        return 0;
 }
 static int
@@ -3017,23 +3134,28 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object *exec_list,
                            struct drm_i915_gem_relocation_entry *relocs)
 {
        uint32_t reloc_count = 0, i;
-        int ret;
+        int ret = 0;
        for (i = 0; i < buffer_count; i++) {
                struct drm_i915_gem_relocation_entry __user *user_relocs;
+                int unwritten;
                user_relocs = (void __user *)(uintptr_t)exec_list[i].relocs_ptr;
-                if (ret == 0) {
+                unwritten = copy_to_user(user_relocs,
-                        ret = copy_to_user(user_relocs,
+                                         &relocs[reloc_count],
-                                           &relocs[reloc_count],
+                                         exec_list[i].relocation_count *
-                                           exec_list[i].relocation_count *
+                                         sizeof(*relocs));
-                                           sizeof(*relocs));
+                if (unwritten) {
+                        ret = -EFAULT;
+                        goto err;
                }
                reloc_count += exec_list[i].relocation_count;
        }
+err:
        drm_free(relocs, reloc_count * sizeof(*relocs), DRM_MEM_DRIVER);
        return ret;
@@ -3243,7 +3365,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
        exec_offset = exec_list[args->buffer_count - 1].offset;
 #if WATCH_EXEC
-        i915_gem_dump_object(object_list[args->buffer_count - 1],
+        i915_gem_dump_object(batch_obj,
                              args->batch_len,
                              __func__,
                              ~0);
@@ -3308,10 +3430,12 @@ err:
                                   (uintptr_t) args->buffers_ptr,
                                   exec_list,
                                   sizeof(*exec_list) * args->buffer_count);
-                if (ret)
+                if (ret) {
+                        ret = -EFAULT;
                        DRM_ERROR("failed to copy %d exec entries "
                                  "back to user (%d)\n",
                                  args->buffer_count, ret);
+                }
        }
        /* Copy the updated relocations out regardless of current error
@@ -3593,6 +3717,7 @@ void i915_gem_free_object(struct drm_gem_object *obj)
        i915_gem_free_mmap_offset(obj);
        drm_free(obj_priv->page_cpu_valid, 1, DRM_MEM_DRIVER);
+        kfree(obj_priv->bit_17);
        drm_free(obj->driver_private, 1, DRM_MEM_DRIVER);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_debugfs.c b/drivers/gpu/drm/i915/i915_gem_debugfs.c
index a1ac0c5e7307..986f1082c596 100644
--- a/drivers/gpu/drm/i915/i915_gem_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_gem_debugfs.c
@@ -234,6 +234,96 @@ static int i915_hws_info(struct seq_file *m, void *data)
        return 0;
 }
+static void i915_dump_pages(struct seq_file *m, struct page **pages, int page_count)
+{
+        int page, i;
+        uint32_t *mem;
+        for (page = 0; page < page_count; page++) {
+                mem = kmap(pages[page]);
+                for (i = 0; i < PAGE_SIZE; i += 4)
+                        seq_printf(m, "%08x :  %08x\n", i, mem[i / 4]);
+                kunmap(pages[page]);
+        }
+}
+static int i915_batchbuffer_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj_priv;
+        int ret;
+        spin_lock(&dev_priv->mm.active_list_lock);
+        list_for_each_entry(obj_priv, &dev_priv->mm.active_list, list) {
+                obj = obj_priv->obj;
+                if (obj->read_domains & I915_GEM_DOMAIN_COMMAND) {
+                    ret = i915_gem_object_get_pages(obj);
+                    if (ret) {
+                            DRM_ERROR("Failed to get pages: %d\n", ret);
+                            spin_unlock(&dev_priv->mm.active_list_lock);
+                            return ret;
+                    }
+                    seq_printf(m, "--- gtt_offset = 0x%08x\n", obj_priv->gtt_offset);
+                    i915_dump_pages(m, obj_priv->pages, obj->size / PAGE_SIZE);
+                    i915_gem_object_put_pages(obj);
+                }
+        }
+        spin_unlock(&dev_priv->mm.active_list_lock);
+        return 0;
+}
+static int i915_ringbuffer_data(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        u8 *virt;
+        uint32_t *ptr, off;
+        if (!dev_priv->ring.ring_obj) {
+                seq_printf(m, "No ringbuffer setup\n");
+                return 0;
+        }
+        virt = dev_priv->ring.virtual_start;
+        for (off = 0; off < dev_priv->ring.Size; off += 4) {
+                ptr = (uint32_t *)(virt + off);
+                seq_printf(m, "%08x :  %08x\n", off, *ptr);
+        }
+        return 0;
+}
+static int i915_ringbuffer_info(struct seq_file *m, void *data)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        unsigned int head, tail, mask;
+        head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
+        tail = I915_READ(PRB0_TAIL) & TAIL_ADDR;
+        mask = dev_priv->ring.tail_mask;
+        seq_printf(m, "RingHead :  %08x\n", head);
+        seq_printf(m, "RingTail :  %08x\n", tail);
+        seq_printf(m, "RingMask :  %08x\n", mask);
+        seq_printf(m, "RingSize :  %08lx\n", dev_priv->ring.Size);
+        seq_printf(m, "Acthd :  %08x\n", I915_READ(IS_I965G(dev) ? ACTHD_I965 : ACTHD));
+        return 0;
+}
 static struct drm_info_list i915_gem_debugfs_list[] = {
        {"i915_gem_active", i915_gem_object_list_info, 0, (void *) ACTIVE_LIST},
        {"i915_gem_flushing", i915_gem_object_list_info, 0, (void *) FLUSHING_LIST},
@@ -243,6 +333,9 @@ static struct drm_info_list i915_gem_debugfs_list[] = {
        {"i915_gem_fence_regs", i915_gem_fence_regs_info, 0},
        {"i915_gem_interrupt", i915_interrupt_info, 0},
        {"i915_gem_hws", i915_hws_info, 0},
+        {"i915_ringbuffer_data", i915_ringbuffer_data, 0},
+        {"i915_ringbuffer_info", i915_ringbuffer_info, 0},
+        {"i915_batchbuffers", i915_batchbuffer_info, 0},
 };
 #define I915_GEM_DEBUGFS_ENTRIES ARRAY_SIZE(i915_gem_debugfs_list)
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 6be3f927c86a..f27e523c764f 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -25,6 +25,8 @@
 *
 */
+#include "linux/string.h"
+#include "linux/bitops.h"
 #include "drmP.h"
 #include "drm.h"
 #include "i915_drm.h"
@@ -127,8 +129,8 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
                                swizzle_y = I915_BIT_6_SWIZZLE_9_11;
                        } else {
                                /* Bit 17 swizzling by the CPU in addition. */
-                                swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
+                                swizzle_x = I915_BIT_6_SWIZZLE_9_10_17;
-                                swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
+                                swizzle_y = I915_BIT_6_SWIZZLE_9_17;
                        }
                        break;
                }
@@ -288,6 +290,19 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                        args->swizzle_mode = dev_priv->mm.bit_6_swizzle_x;
                else
                        args->swizzle_mode = dev_priv->mm.bit_6_swizzle_y;
+                /* Hide bit 17 swizzling from the user.  This prevents old Mesa
+                 * from aborting the application on sw fallbacks to bit 17,
+                 * and we use the pread/pwrite bit17 paths to swizzle for it.
+                 * If there was a user that was relying on the swizzle
+                 * information for drm_intel_bo_map()ed reads/writes this would
+                 * break it, but we don't have any of those.
+                 */
+                if (args->swizzle_mode == I915_BIT_6_SWIZZLE_9_17)
+                        args->swizzle_mode = I915_BIT_6_SWIZZLE_9;
+                if (args->swizzle_mode == I915_BIT_6_SWIZZLE_9_10_17)
+                        args->swizzle_mode = I915_BIT_6_SWIZZLE_9_10;
                /* If we can't handle the swizzling, make it untiled. */
                if (args->swizzle_mode == I915_BIT_6_SWIZZLE_UNKNOWN) {
                        args->tiling_mode = I915_TILING_NONE;
@@ -354,8 +369,100 @@ i915_gem_get_tiling(struct drm_device *dev, void *data,
                DRM_ERROR("unknown tiling mode\n");
        }
+        /* Hide bit 17 from the user -- see comment in i915_gem_set_tiling */
+        if (args->swizzle_mode == I915_BIT_6_SWIZZLE_9_17)
+                args->swizzle_mode = I915_BIT_6_SWIZZLE_9;
+        if (args->swizzle_mode == I915_BIT_6_SWIZZLE_9_10_17)
+                args->swizzle_mode = I915_BIT_6_SWIZZLE_9_10;
        drm_gem_object_unreference(obj);
        mutex_unlock(&dev->struct_mutex);
        return 0;
 }
+/**
+ * Swap every 64 bytes of this page around, to account for it having a new
+ * bit 17 of its physical address and therefore being interpreted differently
+ * by the GPU.
+ */
+static int
+i915_gem_swizzle_page(struct page *page)
+{
+        char *vaddr;
+        int i;
+        char temp[64];
+        vaddr = kmap(page);
+        if (vaddr == NULL)
+                return -ENOMEM;
+        for (i = 0; i < PAGE_SIZE; i += 128) {
+                memcpy(temp, &vaddr[i], 64);
+                memcpy(&vaddr[i], &vaddr[i + 64], 64);
+                memcpy(&vaddr[i + 64], temp, 64);
+        }
+        kunmap(page);
+        return 0;
+}
+void
+i915_gem_object_do_bit_17_swizzle(struct drm_gem_object *obj)
+{
+        struct drm_device *dev = obj->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        int page_count = obj->size >> PAGE_SHIFT;
+        int i;
+        if (dev_priv->mm.bit_6_swizzle_x != I915_BIT_6_SWIZZLE_9_10_17)
+                return;
+        if (obj_priv->bit_17 == NULL)
+                return;
+        for (i = 0; i < page_count; i++) {
+                char new_bit_17 = page_to_phys(obj_priv->pages[i]) >> 17;
+                if ((new_bit_17 & 0x1) !=
+                    (test_bit(i, obj_priv->bit_17) != 0)) {
+                        int ret = i915_gem_swizzle_page(obj_priv->pages[i]);
+                        if (ret != 0) {
+                                DRM_ERROR("Failed to swizzle page\n");
+                                return;
+                        }
+                        set_page_dirty(obj_priv->pages[i]);
+                }
+        }
+}
+void
+i915_gem_object_save_bit_17_swizzle(struct drm_gem_object *obj)
+{
+        struct drm_device *dev = obj->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        int page_count = obj->size >> PAGE_SHIFT;
+        int i;
+        if (dev_priv->mm.bit_6_swizzle_x != I915_BIT_6_SWIZZLE_9_10_17)
+                return;
+        if (obj_priv->bit_17 == NULL) {
+                obj_priv->bit_17 = kmalloc(BITS_TO_LONGS(page_count) *
+                                           sizeof(long), GFP_KERNEL);
+                if (obj_priv->bit_17 == NULL) {
+                        DRM_ERROR("Failed to allocate memory for bit 17 "
+                                  "record\n");
+                        return;
+                }
+        }
+        for (i = 0; i < page_count; i++) {
+                if (page_to_phys(obj_priv->pages[i]) & (1 << 17))
+                        __set_bit(i, obj_priv->bit_17);
+                else
+                        __clear_bit(i, obj_priv->bit_17);
+        }
+}
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 64773ce52964..c2c8e95ff14d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -367,6 +367,7 @@ static const intel_limit_t intel_limits[] = {
        .p1  = { .min = I9XX_P1_MIN,            .max = I9XX_P1_MAX },
        .p2  = { .dot_limit = I9XX_P2_SDVO_DAC_SLOW_LIMIT,
                 .p2_slow = I9XX_P2_SDVO_DAC_SLOW,      .p2_fast = I9XX_P2_SDVO_DAC_FAST },
+        .find_pll = intel_find_best_PLL,
    },
    { /* INTEL_LIMIT_IGD_LVDS */
        .dot = { .min = I9XX_DOT_MIN,           .max = I9XX_DOT_MAX },
@@ -380,6 +381,7 @@ static const intel_limit_t intel_limits[] = {
        /* IGD only supports single-channel mode. */
        .p2  = { .dot_limit = I9XX_P2_LVDS_SLOW_LIMIT,
                 .p2_slow = I9XX_P2_LVDS_SLOW,  .p2_fast = I9XX_P2_LVDS_SLOW },
+        .find_pll = intel_find_best_PLL,
    },
 };
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index b7f0ebe9f810..3e094beecb99 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -864,8 +864,8 @@ static void intelfb_sysrq(int dummy1, struct tty_struct *dummy3)
 static struct sysrq_key_op sysrq_intelfb_restore_op = {
        .handler = intelfb_sysrq,
-        .help_msg = "force fb",
+        .help_msg = "force-fb(G)",
-        .action_msg = "force restore of fb console",
+        .action_msg = "Restore framebuffer console",
 };
 int intelfb_probe(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index b06a4a3ff08d..550374225388 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -38,7 +38,7 @@
 struct intel_hdmi_priv {
        u32 sdvox_reg;
        u32 save_SDVOX;
-        int has_hdmi_sink;
+        bool has_hdmi_sink;
 };
 static void intel_hdmi_mode_set(struct drm_encoder *encoder,
@@ -128,6 +128,22 @@ static bool intel_hdmi_mode_fixup(struct drm_encoder *encoder,
        return true;
 }
+static void
+intel_hdmi_sink_detect(struct drm_connector *connector)
+{
+        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
+        struct edid *edid = NULL;
+        edid = drm_get_edid(&intel_output->base,
+                            &intel_output->ddc_bus->adapter);
+        if (edid != NULL) {
+                hdmi_priv->has_hdmi_sink = drm_detect_hdmi_monitor(edid);
+                kfree(edid);
+                intel_output->base.display_info.raw_edid = NULL;
+        }
+}
 static enum drm_connector_status
 intel_hdmi_detect(struct drm_connector *connector)
 {
@@ -158,9 +174,10 @@ intel_hdmi_detect(struct drm_connector *connector)
                return connector_status_unknown;
        }
-        if ((I915_READ(PORT_HOTPLUG_STAT) & bit) != 0)
+        if ((I915_READ(PORT_HOTPLUG_STAT) & bit) != 0) {
+                intel_hdmi_sink_detect(connector);
                return connector_status_connected;
-        else
+        } else
                return connector_status_disconnected;
 }
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 7b31f55f55c8..9913651c1e17 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1357,6 +1357,23 @@ void intel_sdvo_set_hotplug(struct drm_connector *connector, int on)
        intel_sdvo_read_response(intel_output, &response, 2);
 }
+static void
+intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
+{
+        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct edid *edid = NULL;
+        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
+        edid = drm_get_edid(&intel_output->base,
+                            &intel_output->ddc_bus->adapter);
+        if (edid != NULL) {
+                sdvo_priv->is_hdmi = drm_detect_hdmi_monitor(edid);
+                kfree(edid);
+                intel_output->base.display_info.raw_edid = NULL;
+        }
+}
 static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connector)
 {
        u8 response[2];
@@ -1371,9 +1388,10 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
        if (status != SDVO_CMD_STATUS_SUCCESS)
                return connector_status_unknown;
-        if ((response[0] != 0) || (response[1] != 0))
+        if ((response[0] != 0) || (response[1] != 0)) {
+                intel_sdvo_hdmi_sink_detect(connector);
                return connector_status_connected;
-        else
+        } else
                return connector_status_disconnected;
 }
diff --git a/drivers/md/dm-bio-list.h b/drivers/md/dm-bio-list.h
deleted file mode 100644
index 345098b4ca77..000000000000
--- a/drivers/md/dm-bio-list.h
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright (C) 2004 Red Hat UK Ltd.
- *
- * This file is released under the GPL.
- */
-#ifndef DM_BIO_LIST_H
-#define DM_BIO_LIST_H
-#include <linux/bio.h>
-#ifdef CONFIG_BLOCK
-struct bio_list {
-        struct bio *head;
-        struct bio *tail;
-};
-static inline int bio_list_empty(const struct bio_list *bl)
-{
-        return bl->head == NULL;
-}
-static inline void bio_list_init(struct bio_list *bl)
-{
-        bl->head = bl->tail = NULL;
-}
-#define bio_list_for_each(bio, bl) \
-        for (bio = (bl)->head; bio; bio = bio->bi_next)
-static inline unsigned bio_list_size(const struct bio_list *bl)
-{
-        unsigned sz = 0;
-        struct bio *bio;
-        bio_list_for_each(bio, bl)
-                sz++;
-        return sz;
-}
-static inline void bio_list_add(struct bio_list *bl, struct bio *bio)
-{
-        bio->bi_next = NULL;
-        if (bl->tail)
-                bl->tail->bi_next = bio;
-        else
-                bl->head = bio;
-        bl->tail = bio;
-}
-static inline void bio_list_add_head(struct bio_list *bl, struct bio *bio)
-{
-        bio->bi_next = bl->head;
-        bl->head = bio;
-        if (!bl->tail)
-                bl->tail = bio;
-}
-static inline void bio_list_merge(struct bio_list *bl, struct bio_list *bl2)
-{
-        if (!bl2->head)
-                return;
-        if (bl->tail)
-                bl->tail->bi_next = bl2->head;
-        else
-                bl->head = bl2->head;
-        bl->tail = bl2->tail;
-}
-static inline void bio_list_merge_head(struct bio_list *bl,
-                                       struct bio_list *bl2)
-{
-        if (!bl2->head)
-                return;
-        if (bl->head)
-                bl2->tail->bi_next = bl->head;
-        else
-                bl->tail = bl2->tail;
-        bl->head = bl2->head;
-}
-static inline struct bio *bio_list_pop(struct bio_list *bl)
-{
-        struct bio *bio = bl->head;
-        if (bio) {
-                bl->head = bl->head->bi_next;
-                if (!bl->head)
-                        bl->tail = NULL;
-                bio->bi_next = NULL;
-        }
-        return bio;
-}
-static inline struct bio *bio_list_get(struct bio_list *bl)
-{
-        struct bio *bio = bl->head;
-        bl->head = bl->tail = NULL;
-        return bio;
-}
-#endif /* CONFIG_BLOCK */
-#endif
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 59ee1b015d2d..559dbb52bc85 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -15,8 +15,6 @@
 #include <linux/device-mapper.h>
-#include "dm-bio-list.h"
 #define DM_MSG_PREFIX "delay"
 struct delay_c {
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 095f77bf9681..6a386ab4f7eb 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -8,7 +8,6 @@
 #include <linux/device-mapper.h>
 #include "dm-path-selector.h"
-#include "dm-bio-list.h"
 #include "dm-bio-record.h"
 #include "dm-uevent.h"
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 536ef0bef154..076fbb4e967a 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -5,7 +5,6 @@
 * This file is released under the GPL.
 */
-#include "dm-bio-list.h"
 #include "dm-bio-record.h"
 #include <linux/init.h>
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index 59f8d9df9e1a..7b899be0b087 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -14,7 +14,6 @@
 #include <linux/vmalloc.h>
 #include "dm.h"
-#include "dm-bio-list.h"
 #define DM_MSG_PREFIX   "region hash"
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 981a0413068f..d73f17fc7778 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -22,7 +22,6 @@
 #include <linux/workqueue.h>
 #include "dm-exception-store.h"
-#include "dm-bio-list.h"
 #define DM_MSG_PREFIX "snapshots"
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 8a994be035ba..424f7b048c30 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -6,7 +6,6 @@
 */
 #include "dm.h"
-#include "dm-bio-list.h"
 #include "dm-uevent.h"
 #include <linux/init.h>
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 274b491a11c1..36df9109cde1 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -35,7 +35,6 @@
 #include <linux/blkdev.h>
 #include <linux/seq_file.h>
 #include "md.h"
-#include "dm-bio-list.h"
 #include "raid1.h"
 #include "bitmap.h"
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index e293d92641ac..81a54f17417e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -22,7 +22,6 @@
 #include <linux/blkdev.h>
 #include <linux/seq_file.h>
 #include "md.h"
-#include "dm-bio-list.h"
 #include "raid10.h"
 #include "bitmap.h"
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index 4fa3bb2ddfe4..33e5ade774ca 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -434,7 +434,8 @@ static void __init superio_parport_init(void)
                        0 /*base_hi*/,
                        PAR_IRQ, 
                        PARPORT_DMA_NONE /* dma */,
-                        NULL /*struct pci_dev* */) )
+                        NULL /*struct pci_dev* */),
+                        0 /* shared irq flags */ )
                printk(KERN_WARNING PFX "Probing parallel port failed.\n");
 #endif  /* CONFIG_PARPORT_PC */
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index b1bd3fc7bae8..36fd2e75da1c 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -1394,7 +1394,7 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd,
                 */
                cmd->sense_buffer[8] = 0;     /* Information */
                cmd->sense_buffer[9] = 0xa;   /* Add. length */
-                do_div(bghm, cmd->device->sector_size);
+                bghm /= cmd->device->sector_size;
                failing_sector = scsi_get_lba(cmd);
                failing_sector += bghm;
diff --git a/drivers/sh/intc.c b/drivers/sh/intc.c
index 7fb9b5c4669a..12d13d99b6f0 100644
--- a/drivers/sh/intc.c
+++ b/drivers/sh/intc.c
@@ -44,6 +44,7 @@ struct intc_handle_int {
 struct intc_desc_int {
        struct list_head list;
        struct sys_device sysdev;
+        pm_message_t state;
        unsigned long *reg;
 #ifdef CONFIG_SMP
        unsigned long *smp;
@@ -786,18 +787,44 @@ static int intc_suspend(struct sys_device *dev, pm_message_t state)
        /* get intc controller associated with this sysdev */
        d = container_of(dev, struct intc_desc_int, sysdev);
-        /* enable wakeup irqs belonging to this intc controller */
+        switch (state.event) {
-        for_each_irq_desc(irq, desc) {
+        case PM_EVENT_ON:
-                if ((desc->status & IRQ_WAKEUP) && (desc->chip == &d->chip))
+                if (d->state.event != PM_EVENT_FREEZE)
-                        intc_enable(irq);
+                        break;
+                for_each_irq_desc(irq, desc) {
+                        if (desc->chip != &d->chip)
+                                continue;
+                        if (desc->status & IRQ_DISABLED)
+                                intc_disable(irq);
+                        else
+                                intc_enable(irq);
+                }
+                break;
+        case PM_EVENT_FREEZE:
+                /* nothing has to be done */
+                break;
+        case PM_EVENT_SUSPEND:
+                /* enable wakeup irqs belonging to this intc controller */
+                for_each_irq_desc(irq, desc) {
+                        if ((desc->status & IRQ_WAKEUP) && (desc->chip == &d->chip))
+                                intc_enable(irq);
+                }
+                break;
        }
+        d->state = state;
        return 0;
 }
+static int intc_resume(struct sys_device *dev)
+{
+        return intc_suspend(dev, PMSG_ON);
+}
 static struct sysdev_class intc_sysdev_class = {
        .name = "intc",
        .suspend = intc_suspend,
+        .resume = intc_resume,
 };
 /* register this intc as sysdev to allow suspend/resume */
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 869d47cb6db3..0a69c0977e3f 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -546,10 +546,6 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
        tty->driver_data = acm;
        acm->tty = tty;
-        /* force low_latency on so that our tty_push actually forces the data through,
-           otherwise it is scheduled, and with high data rates data can get lost. */
-        tty->low_latency = 1;
        if (usb_autopm_get_interface(acm->control) < 0)
                goto early_bail;
        else
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 2620bf6fe5e1..9c4c700c7cc6 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1215,20 +1215,22 @@ static void ti_bulk_in_callback(struct urb *urb)
        }
        tty = tty_port_tty_get(&port->port);
-        if (tty && urb->actual_length) {
+        if (tty) {
-                usb_serial_debug_data(debug, dev, __func__,
+                if (urb->actual_length) {
-                        urb->actual_length, urb->transfer_buffer);
+                        usb_serial_debug_data(debug, dev, __func__,
+                                urb->actual_length, urb->transfer_buffer);
-                if (!tport->tp_is_open)
-                        dbg("%s - port closed, dropping data", __func__);
+                        if (!tport->tp_is_open)
-                else
+                                dbg("%s - port closed, dropping data",
-                        ti_recv(&urb->dev->dev, tty,
+                                        __func__);
+                        else
+                                ti_recv(&urb->dev->dev, tty,
                                                urb->transfer_buffer,
                                                urb->actual_length);
+                        spin_lock(&tport->tp_lock);
-                spin_lock(&tport->tp_lock);
+                        tport->tp_icount.rx += urb->actual_length;
-                tport->tp_icount.rx += urb->actual_length;
+                        spin_unlock(&tport->tp_lock);
-                spin_unlock(&tport->tp_lock);
+                }
                tty_kref_put(tty);
        }
diff --git a/fs/bio.c b/fs/bio.c
index e0c9e545bbfa..cd42bb882f30 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -348,6 +348,24 @@ err:
        return NULL;
 }
+/**
+ * bio_alloc - allocate a bio for I/O
+ * @gfp_mask:   the GFP_ mask given to the slab allocator
+ * @nr_iovecs:  number of iovecs to pre-allocate
+ *
+ * Description:
+ *   bio_alloc will allocate a bio and associated bio_vec array that can hold
+ *   at least @nr_iovecs entries. Allocations will be done from the
+ *   fs_bio_set. Also see @bio_alloc_bioset.
+ *
+ *   If %__GFP_WAIT is set, then bio_alloc will always be able to allocate
+ *   a bio. This is due to the mempool guarantees. To make this work, callers
+ *   must never allocate more than 1 bio at the time from this pool. Callers
+ *   that need to allocate more than 1 bio must always submit the previously
+ *   allocate bio for IO before attempting to allocate a new one. Failure to
+ *   do so can cause livelocks under memory pressure.
+ *
+ **/
 struct bio *bio_alloc(gfp_t gfp_mask, int nr_iovecs)
 {
        struct bio *bio = bio_alloc_bioset(gfp_mask, nr_iovecs, fs_bio_set);
diff --git a/fs/buffer.c b/fs/buffer.c
index 13edf7ad3ff1..ff8bb1f2333a 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -547,7 +547,7 @@ repeat:
        return err;
 }
-void do_thaw_all(unsigned long unused)
+void do_thaw_all(struct work_struct *work)
 {
        struct super_block *sb;
        char b[BDEVNAME_SIZE];
@@ -567,6 +567,7 @@ restart:
                        goto restart;
        }
        spin_unlock(&sb_lock);
+        kfree(work);
        printk(KERN_WARNING "Emergency Thaw complete\n");
 }
@@ -577,7 +578,13 @@ restart:
 */
 void emergency_thaw_all(void)
 {
-        pdflush_operation(do_thaw_all, 0);
+        struct work_struct *work;
+        work = kmalloc(sizeof(*work), GFP_ATOMIC);
+        if (work) {
+                INIT_WORK(work, do_thaw_all);
+                schedule_work(work);
+        }
 }
 /**
diff --git a/fs/direct-io.c b/fs/direct-io.c
index da258e7249cc..05763bbc2050 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -307,8 +307,6 @@ dio_bio_alloc(struct dio *dio, struct block_device *bdev,
        struct bio *bio;
        bio = bio_alloc(GFP_KERNEL, nr_vecs);
-        if (bio == NULL)
-                return -ENOMEM;
        bio->bi_bdev = bdev;
        bio->bi_sector = first_sector;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 6132353dcf62..2a1cb0979768 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2416,8 +2416,6 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
                        len = ee_len;
                bio = bio_alloc(GFP_NOIO, len);
-                if (!bio)
-                        return -ENOMEM;
                bio->bi_sector = ee_pblock;
                bio->bi_bdev   = inode->i_sb->s_bdev;
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 2b25133524a3..06f30e965676 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -938,9 +938,9 @@ static void fuse_release_user_pages(struct fuse_req *req, int write)
 }
 static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
-                               unsigned *nbytesp, int write)
+                               size_t *nbytesp, int write)
 {
-        unsigned nbytes = *nbytesp;
+        size_t nbytes = *nbytesp;
        unsigned long user_addr = (unsigned long) buf;
        unsigned offset = user_addr & ~PAGE_MASK;
        int npages;
@@ -955,7 +955,7 @@ static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
                return 0;
        }
-        nbytes = min(nbytes, (unsigned) FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
+        nbytes = min_t(size_t, nbytes, FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
        npages = (nbytes + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
        npages = clamp(npages, 1, FUSE_MAX_PAGES_PER_REQ);
        down_read(&current->mm->mmap_sem);
@@ -1298,6 +1298,8 @@ static int fuse_direct_mmap(struct file *file, struct vm_area_struct *vma)
        if (vma->vm_flags & VM_MAYSHARE)
                return -ENODEV;
+        invalidate_inode_pages2(file->f_mapping);
        return generic_file_mmap(file, vma);
 }
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 3984e47d1d33..1afd9f26bcb1 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -597,7 +597,6 @@ __acquires(&gl->gl_spin)
        GLOCK_BUG_ON(gl, test_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags));
-        down_read(&gfs2_umount_flush_sem);
        if (test_bit(GLF_DEMOTE, &gl->gl_flags) &&
            gl->gl_demote_state != gl->gl_state) {
                if (find_first_holder(gl))
@@ -614,15 +613,14 @@ __acquires(&gl->gl_spin)
                if (ret == 0)
                        goto out_unlock;
                if (ret == 2)
-                        goto out_sem;
+                        goto out;
                gh = find_first_waiter(gl);
                gl->gl_target = gh->gh_state;
                if (!(gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)))
                        do_error(gl, 0); /* Fail queued try locks */
        }
        do_xmote(gl, gh, gl->gl_target);
-out_sem:
+out:
-        up_read(&gfs2_umount_flush_sem);
        return;
 out_sched:
@@ -631,7 +629,7 @@ out_sched:
                gfs2_glock_put(gl);
 out_unlock:
        clear_bit(GLF_LOCK, &gl->gl_flags);
-        goto out_sem;
+        goto out;
 }
 static void glock_work_func(struct work_struct *work)
@@ -641,6 +639,7 @@ static void glock_work_func(struct work_struct *work)
        if (test_and_clear_bit(GLF_REPLY_PENDING, &gl->gl_flags))
                finish_xmote(gl, gl->gl_reply);
+        down_read(&gfs2_umount_flush_sem);
        spin_lock(&gl->gl_spin);
        if (test_and_clear_bit(GLF_PENDING_DEMOTE, &gl->gl_flags) &&
            gl->gl_state != LM_ST_UNLOCKED &&
@@ -653,6 +652,7 @@ static void glock_work_func(struct work_struct *work)
        }
        run_queue(gl, 0);
        spin_unlock(&gl->gl_spin);
+        up_read(&gfs2_umount_flush_sem);
        if (!delay ||
            queue_delayed_work(glock_workqueue, &gl->gl_work, delay) == 0)
                gfs2_glock_put(gl);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 7b277d449155..5a31d426116f 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -137,15 +137,15 @@ void gfs2_set_iop(struct inode *inode)
        if (S_ISREG(mode)) {
                inode->i_op = &gfs2_file_iops;
                if (gfs2_localflocks(sdp))
-                        inode->i_fop = gfs2_file_fops_nolock;
+                        inode->i_fop = &gfs2_file_fops_nolock;
                else
-                        inode->i_fop = gfs2_file_fops;
+                        inode->i_fop = &gfs2_file_fops;
        } else if (S_ISDIR(mode)) {
                inode->i_op = &gfs2_dir_iops;
                if (gfs2_localflocks(sdp))
-                        inode->i_fop = gfs2_dir_fops_nolock;
+                        inode->i_fop = &gfs2_dir_fops_nolock;
                else
-                        inode->i_fop = gfs2_dir_fops;
+                        inode->i_fop = &gfs2_dir_fops;
        } else if (S_ISLNK(mode)) {
                inode->i_op = &gfs2_symlink_iops;
        } else {
diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h
index dca4fee3078b..c30be2b66580 100644
--- a/fs/gfs2/inode.h
+++ b/fs/gfs2/inode.h
@@ -101,21 +101,23 @@ void gfs2_dinode_print(const struct gfs2_inode *ip);
 extern const struct inode_operations gfs2_file_iops;
 extern const struct inode_operations gfs2_dir_iops;
 extern const struct inode_operations gfs2_symlink_iops;
-extern const struct file_operations *gfs2_file_fops_nolock;
+extern const struct file_operations gfs2_file_fops_nolock;
-extern const struct file_operations *gfs2_dir_fops_nolock;
+extern const struct file_operations gfs2_dir_fops_nolock;
 extern void gfs2_set_inode_flags(struct inode *inode);
 
 #ifdef CONFIG_GFS2_FS_LOCKING_DLM
-extern const struct file_operations *gfs2_file_fops;
+extern const struct file_operations gfs2_file_fops;
-extern const struct file_operations *gfs2_dir_fops;
+extern const struct file_operations gfs2_dir_fops;
 static inline int gfs2_localflocks(const struct gfs2_sbd *sdp)
 {
        return sdp->sd_args.ar_localflocks;
 }
 #else /* Single node only */
-#define gfs2_file_fops NULL
+#define gfs2_file_fops gfs2_file_fops_nolock
-#define gfs2_dir_fops NULL
+#define gfs2_dir_fops gfs2_dir_fops_nolock
 static inline int gfs2_localflocks(const struct gfs2_sbd *sdp)
 {
        return 1;
diff --git a/fs/gfs2/ops_file.c b/fs/gfs2/ops_file.c
index 70b9b8548945..101caf3ee861 100644
--- a/fs/gfs2/ops_file.c
+++ b/fs/gfs2/ops_file.c
@@ -705,7 +705,7 @@ static int gfs2_flock(struct file *file, int cmd, struct file_lock *fl)
        }
 }
-const struct file_operations *gfs2_file_fops = &(const struct file_operations){
+const struct file_operations gfs2_file_fops = {
        .llseek         = gfs2_llseek,
        .read           = do_sync_read,
        .aio_read       = generic_file_aio_read,
@@ -723,7 +723,7 @@ const struct file_operations *gfs2_file_fops = &(const struct file_operations){
        .setlease       = gfs2_setlease,
 };
-const struct file_operations *gfs2_dir_fops = &(const struct file_operations){
+const struct file_operations gfs2_dir_fops = {
        .readdir        = gfs2_readdir,
        .unlocked_ioctl = gfs2_ioctl,
        .open           = gfs2_open,
@@ -735,7 +735,7 @@ const struct file_operations *gfs2_dir_fops = &(const struct file_operations){
 #endif /* CONFIG_GFS2_FS_LOCKING_DLM */
-const struct file_operations *gfs2_file_fops_nolock = &(const struct file_operations){
+const struct file_operations gfs2_file_fops_nolock = {
        .llseek         = gfs2_llseek,
        .read           = do_sync_read,
        .aio_read       = generic_file_aio_read,
@@ -751,7 +751,7 @@ const struct file_operations *gfs2_file_fops_nolock = &(const struct file_operat
        .setlease       = generic_setlease,
 };
-const struct file_operations *gfs2_dir_fops_nolock = &(const struct file_operations){
+const struct file_operations gfs2_dir_fops_nolock = {
        .readdir        = gfs2_readdir,
        .unlocked_ioctl = gfs2_ioctl,
        .open           = gfs2_open,
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 51883b3ad89c..650a730707b7 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -272,11 +272,6 @@ static int gfs2_read_super(struct gfs2_sbd *sdp, sector_t sector)
        lock_page(page);
        bio = bio_alloc(GFP_NOFS, 1);
-        if (unlikely(!bio)) {
-                __free_page(page);
-                return -ENOBUFS;
-        }
        bio->bi_sector = sector * (sb->s_blocksize >> 9);
        bio->bi_bdev = sb->s_bdev;
        bio_add_page(bio, page, PAGE_SIZE, 0);
diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
index abd5429ae285..1c70fa5168d6 100644
--- a/fs/gfs2/ops_inode.c
+++ b/fs/gfs2/ops_inode.c
@@ -371,6 +371,7 @@ static int gfs2_symlink(struct inode *dir, struct dentry *dentry,
        ip = ghs[1].gh_gl->gl_object;
        ip->i_disksize = size;
+        i_size_write(inode, size);
        error = gfs2_meta_inode_buffer(ip, &dibh);
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 8d53f66b5bcc..152e6c4a0dca 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -81,7 +81,7 @@ struct gfs2_quota_change_host {
 static LIST_HEAD(qd_lru_list);
 static atomic_t qd_lru_count = ATOMIC_INIT(0);
-static spinlock_t qd_lru_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(qd_lru_lock);
 int gfs2_shrink_qd_memory(int nr, gfp_t gfp_mask)
 {
@@ -1364,7 +1364,7 @@ int gfs2_quotad(void *data)
                        refrigerator();
                t = min(quotad_timeo, statfs_timeo);
-                prepare_to_wait(&sdp->sd_quota_wait, &wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(&sdp->sd_quota_wait, &wait, TASK_INTERRUPTIBLE);
                spin_lock(&sdp->sd_trunc_lock);
                empty = list_empty(&sdp->sd_trunc_list);
                spin_unlock(&sdp->sd_trunc_lock);
diff --git a/fs/inode.c b/fs/inode.c
index d06d6d268de9..6ad14a1cd8c9 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1470,42 +1470,6 @@ static void __wait_on_freeing_inode(struct inode *inode)
        spin_lock(&inode_lock);
 }
-/*
- * We rarely want to lock two inodes that do not have a parent/child
- * relationship (such as directory, child inode) simultaneously. The
- * vast majority of file systems should be able to get along fine
- * without this. Do not use these functions except as a last resort.
- */
-void inode_double_lock(struct inode *inode1, struct inode *inode2)
-{
-        if (inode1 == NULL || inode2 == NULL || inode1 == inode2) {
-                if (inode1)
-                        mutex_lock(&inode1->i_mutex);
-                else if (inode2)
-                        mutex_lock(&inode2->i_mutex);
-                return;
-        }
-        if (inode1 < inode2) {
-                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_CHILD);
-        } else {
-                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_CHILD);
-        }
-}
-EXPORT_SYMBOL(inode_double_lock);
-void inode_double_unlock(struct inode *inode1, struct inode *inode2)
-{
-        if (inode1)
-                mutex_unlock(&inode1->i_mutex);
-        if (inode2 && inode2 != inode1)
-                mutex_unlock(&inode2->i_mutex);
-}
-EXPORT_SYMBOL(inode_double_unlock);
 static __initdata unsigned long ihash_entries;
 static int __init set_ihash_entries(char *str)
 {
diff --git a/fs/nilfs2/bmap.c b/fs/nilfs2/bmap.c
index 24638e059bf3..064279e33bbb 100644
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -688,6 +688,8 @@ static const struct nilfs_bmap_ptr_operations nilfs_bmap_ptr_ops_gc = {
        .bpop_translate         =       NULL,
 };
+static struct lock_class_key nilfs_bmap_dat_lock_key;
 /**
 * nilfs_bmap_read - read a bmap from an inode
 * @bmap: bmap
@@ -715,6 +717,7 @@ int nilfs_bmap_read(struct nilfs_bmap *bmap, struct nilfs_inode *raw_inode)
                bmap->b_pops = &nilfs_bmap_ptr_ops_p;
                bmap->b_last_allocated_key = 0; /* XXX: use macro */
                bmap->b_last_allocated_ptr = NILFS_BMAP_NEW_PTR_INIT;
+                lockdep_set_class(&bmap->b_sem, &nilfs_bmap_dat_lock_key);
                break;
        case NILFS_CPFILE_INO:
        case NILFS_SUFILE_INO:
@@ -772,6 +775,7 @@ void nilfs_bmap_init_gcdat(struct nilfs_bmap *gcbmap, struct nilfs_bmap *bmap)
 {
        memcpy(gcbmap, bmap, sizeof(union nilfs_bmap_union));
        init_rwsem(&gcbmap->b_sem);
+        lockdep_set_class(&bmap->b_sem, &nilfs_bmap_dat_lock_key);
        gcbmap->b_inode = &NILFS_BMAP_I(gcbmap)->vfs_inode;
 }
@@ -779,5 +783,6 @@ void nilfs_bmap_commit_gcdat(struct nilfs_bmap *gcbmap, struct nilfs_bmap *bmap)
 {
        memcpy(bmap, gcbmap, sizeof(union nilfs_bmap_union));
        init_rwsem(&bmap->b_sem);
+        lockdep_set_class(&bmap->b_sem, &nilfs_bmap_dat_lock_key);
        bmap->b_inode = &NILFS_BMAP_I(bmap)->vfs_inode;
 }
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 7558c977db02..3d0c18a16db1 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -35,11 +35,6 @@
 #include "bmap_union.h"
 /*
- * NILFS filesystem version
- */
-#define NILFS_VERSION           "2.0.5"
-/*
 * nilfs inode data in memory
 */
 struct nilfs_inode_info {
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index 6ade0963fc1d..4fc081e47d70 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -413,7 +413,6 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
        struct nilfs_segment_entry *ent, *n;
        struct inode *sufile = nilfs->ns_sufile;
        __u64 segnum[4];
-        time_t mtime;
        int err;
        int i;
@@ -442,24 +441,13 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
         * Collecting segments written after the latest super root.
         * These are marked dirty to avoid being reallocated in the next write.
         */
-        mtime = get_seconds();
        list_for_each_entry_safe(ent, n, head, list) {
-                if (ent->segnum == segnum[0]) {
+                if (ent->segnum != segnum[0]) {
-                        list_del(&ent->list);
+                        err = nilfs_sufile_scrap(sufile, ent->segnum);
-                        nilfs_free_segment_entry(ent);
+                        if (unlikely(err))
-                        continue;
+                                goto failed;
-                }
-                err = nilfs_open_segment_entry(ent, sufile);
-                if (unlikely(err))
-                        goto failed;
-                if (!nilfs_segment_usage_dirty(ent->raw_su)) {
-                        /* make the segment garbage */
-                        ent->raw_su->su_nblocks = cpu_to_le32(0);
-                        ent->raw_su->su_lastmod = cpu_to_le32(mtime);
-                        nilfs_segment_usage_set_dirty(ent->raw_su);
                }
                list_del(&ent->list);
-                nilfs_close_segment_entry(ent, sufile);
                nilfs_free_segment_entry(ent);
        }
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index c774cf397e2f..98e68677f045 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -93,6 +93,52 @@ nilfs_sufile_get_segment_usage_block(struct inode *sufile, __u64 segnum,
                                   create, NULL, bhp);
 }
+static void nilfs_sufile_mod_counter(struct buffer_head *header_bh,
+                                     u64 ncleanadd, u64 ndirtyadd)
+{
+        struct nilfs_sufile_header *header;
+        void *kaddr;
+        kaddr = kmap_atomic(header_bh->b_page, KM_USER0);
+        header = kaddr + bh_offset(header_bh);
+        le64_add_cpu(&header->sh_ncleansegs, ncleanadd);
+        le64_add_cpu(&header->sh_ndirtysegs, ndirtyadd);
+        kunmap_atomic(kaddr, KM_USER0);
+        nilfs_mdt_mark_buffer_dirty(header_bh);
+}
+int nilfs_sufile_update(struct inode *sufile, __u64 segnum, int create,
+                        void (*dofunc)(struct inode *, __u64,
+                                       struct buffer_head *,
+                                       struct buffer_head *))
+{
+        struct buffer_head *header_bh, *bh;
+        int ret;
+        if (unlikely(segnum >= nilfs_sufile_get_nsegments(sufile))) {
+                printk(KERN_WARNING "%s: invalid segment number: %llu\n",
+                       __func__, (unsigned long long)segnum);
+                return -EINVAL;
+        }
+        down_write(&NILFS_MDT(sufile)->mi_sem);
+        ret = nilfs_sufile_get_header_block(sufile, &header_bh);
+        if (ret < 0)
+                goto out_sem;
+        ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, create, &bh);
+        if (!ret) {
+                dofunc(sufile, segnum, header_bh, bh);
+                brelse(bh);
+        }
+        brelse(header_bh);
+ out_sem:
+        up_write(&NILFS_MDT(sufile)->mi_sem);
+        return ret;
+}
 /**
 * nilfs_sufile_alloc - allocate a segment
 * @sufile: inode of segment usage file
@@ -113,7 +159,6 @@ nilfs_sufile_get_segment_usage_block(struct inode *sufile, __u64 segnum,
 int nilfs_sufile_alloc(struct inode *sufile, __u64 *segnump)
 {
        struct buffer_head *header_bh, *su_bh;
-        struct the_nilfs *nilfs;
        struct nilfs_sufile_header *header;
        struct nilfs_segment_usage *su;
        size_t susz = NILFS_MDT(sufile)->mi_entry_size;
@@ -124,8 +169,6 @@ int nilfs_sufile_alloc(struct inode *sufile, __u64 *segnump)
        down_write(&NILFS_MDT(sufile)->mi_sem);
-        nilfs = NILFS_MDT(sufile)->mi_nilfs;
        ret = nilfs_sufile_get_header_block(sufile, &header_bh);
        if (ret < 0)
                goto out_sem;
@@ -192,165 +235,84 @@ int nilfs_sufile_alloc(struct inode *sufile, __u64 *segnump)
        return ret;
 }
-/**
+void nilfs_sufile_do_cancel_free(struct inode *sufile, __u64 segnum,
- * nilfs_sufile_cancel_free -
+                                 struct buffer_head *header_bh,
- * @sufile: inode of segment usage file
+                                 struct buffer_head *su_bh)
- * @segnum: segment number
- *
- * Description:
- *
- * Return Value: On success, 0 is returned. On error, one of the following
- * negative error codes is returned.
- *
- * %-EIO - I/O error.
- *
- * %-ENOMEM - Insufficient amount of memory available.
- */
-int nilfs_sufile_cancel_free(struct inode *sufile, __u64 segnum)
 {
-        struct buffer_head *header_bh, *su_bh;
-        struct the_nilfs *nilfs;
-        struct nilfs_sufile_header *header;
        struct nilfs_segment_usage *su;
        void *kaddr;
-        int ret;
-        down_write(&NILFS_MDT(sufile)->mi_sem);
-        nilfs = NILFS_MDT(sufile)->mi_nilfs;
-        ret = nilfs_sufile_get_header_block(sufile, &header_bh);
-        if (ret < 0)
-                goto out_sem;
-        ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &su_bh);
-        if (ret < 0)
-                goto out_header;
        kaddr = kmap_atomic(su_bh->b_page, KM_USER0);
-        su = nilfs_sufile_block_get_segment_usage(
+        su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
-                sufile, segnum, su_bh, kaddr);
        if (unlikely(!nilfs_segment_usage_clean(su))) {
                printk(KERN_WARNING "%s: segment %llu must be clean\n",
                       __func__, (unsigned long long)segnum);
                kunmap_atomic(kaddr, KM_USER0);
-                goto out_su_bh;
+                return;
        }
        nilfs_segment_usage_set_dirty(su);
        kunmap_atomic(kaddr, KM_USER0);
-        kaddr = kmap_atomic(header_bh->b_page, KM_USER0);
+        nilfs_sufile_mod_counter(header_bh, -1, 1);
-        header = nilfs_sufile_block_get_header(sufile, header_bh, kaddr);
-        le64_add_cpu(&header->sh_ncleansegs, -1);
-        le64_add_cpu(&header->sh_ndirtysegs, 1);
-        kunmap_atomic(kaddr, KM_USER0);
-        nilfs_mdt_mark_buffer_dirty(header_bh);
        nilfs_mdt_mark_buffer_dirty(su_bh);
        nilfs_mdt_mark_dirty(sufile);
- out_su_bh:
-        brelse(su_bh);
- out_header:
-        brelse(header_bh);
- out_sem:
-        up_write(&NILFS_MDT(sufile)->mi_sem);
-        return ret;
 }
-/**
+void nilfs_sufile_do_scrap(struct inode *sufile, __u64 segnum,
- * nilfs_sufile_freev - free segments
+                           struct buffer_head *header_bh,
- * @sufile: inode of segment usage file
+                           struct buffer_head *su_bh)
- * @segnum: array of segment numbers
- * @nsegs: number of segments
- *
- * Description: nilfs_sufile_freev() frees segments specified by @segnum and
- * @nsegs, which must have been returned by a previous call to
- * nilfs_sufile_alloc().
- *
- * Return Value: On success, 0 is returned. On error, one of the following
- * negative error codes is returned.
- *
- * %-EIO - I/O error.
- *
- * %-ENOMEM - Insufficient amount of memory available.
- */
-#define NILFS_SUFILE_FREEV_PREALLOC     16
-int nilfs_sufile_freev(struct inode *sufile, __u64 *segnum, size_t nsegs)
 {
-        struct buffer_head *header_bh, **su_bh,
-                *su_bh_prealloc[NILFS_SUFILE_FREEV_PREALLOC];
-        struct the_nilfs *nilfs;
-        struct nilfs_sufile_header *header;
        struct nilfs_segment_usage *su;
        void *kaddr;
-        int ret, i;
+        int clean, dirty;
-        down_write(&NILFS_MDT(sufile)->mi_sem);
+        kaddr = kmap_atomic(su_bh->b_page, KM_USER0);
+        su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
-        nilfs = NILFS_MDT(sufile)->mi_nilfs;
+        if (su->su_flags == cpu_to_le32(1UL << NILFS_SEGMENT_USAGE_DIRTY) &&
+            su->su_nblocks == cpu_to_le32(0)) {
-        /* prepare resources */
-        if (nsegs <= NILFS_SUFILE_FREEV_PREALLOC)
-                su_bh = su_bh_prealloc;
-        else {
-                su_bh = kmalloc(sizeof(*su_bh) * nsegs, GFP_NOFS);
-                if (su_bh == NULL) {
-                        ret = -ENOMEM;
-                        goto out_sem;
-                }
-        }
-        ret = nilfs_sufile_get_header_block(sufile, &header_bh);
-        if (ret < 0)
-                goto out_su_bh;
-        for (i = 0; i < nsegs; i++) {
-                ret = nilfs_sufile_get_segment_usage_block(sufile, segnum[i],
-                                                           0, &su_bh[i]);
-                if (ret < 0)
-                        goto out_bh;
-        }
-        /* free segments */
-        for (i = 0; i < nsegs; i++) {
-                kaddr = kmap_atomic(su_bh[i]->b_page, KM_USER0);
-                su = nilfs_sufile_block_get_segment_usage(
-                        sufile, segnum[i], su_bh[i], kaddr);
-                WARN_ON(nilfs_segment_usage_error(su));
-                nilfs_segment_usage_set_clean(su);
                kunmap_atomic(kaddr, KM_USER0);
-                nilfs_mdt_mark_buffer_dirty(su_bh[i]);
+                return;
        }
-        kaddr = kmap_atomic(header_bh->b_page, KM_USER0);
+        clean = nilfs_segment_usage_clean(su);
-        header = nilfs_sufile_block_get_header(sufile, header_bh, kaddr);
+        dirty = nilfs_segment_usage_dirty(su);
-        le64_add_cpu(&header->sh_ncleansegs, nsegs);
-        le64_add_cpu(&header->sh_ndirtysegs, -(u64)nsegs);
+        /* make the segment garbage */
+        su->su_lastmod = cpu_to_le64(0);
+        su->su_nblocks = cpu_to_le32(0);
+        su->su_flags = cpu_to_le32(1UL << NILFS_SEGMENT_USAGE_DIRTY);
        kunmap_atomic(kaddr, KM_USER0);
-        nilfs_mdt_mark_buffer_dirty(header_bh);
+        nilfs_sufile_mod_counter(header_bh, clean ? (u64)-1 : 0, dirty ? 0 : 1);
+        nilfs_mdt_mark_buffer_dirty(su_bh);
        nilfs_mdt_mark_dirty(sufile);
+}
- out_bh:
+void nilfs_sufile_do_free(struct inode *sufile, __u64 segnum,
-        for (i--; i >= 0; i--)
+                          struct buffer_head *header_bh,
-                brelse(su_bh[i]);
+                          struct buffer_head *su_bh)
-        brelse(header_bh);
+{
+        struct nilfs_segment_usage *su;
+        void *kaddr;
+        int sudirty;
- out_su_bh:
+        kaddr = kmap_atomic(su_bh->b_page, KM_USER0);
-        if (su_bh != su_bh_prealloc)
+        su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
-                kfree(su_bh);
+        if (nilfs_segment_usage_clean(su)) {
+                printk(KERN_WARNING "%s: segment %llu is already clean\n",
+                       __func__, (unsigned long long)segnum);
+                kunmap_atomic(kaddr, KM_USER0);
+                return;
+        }
+        WARN_ON(nilfs_segment_usage_error(su));
+        WARN_ON(!nilfs_segment_usage_dirty(su));
- out_sem:
+        sudirty = nilfs_segment_usage_dirty(su);
-        up_write(&NILFS_MDT(sufile)->mi_sem);
+        nilfs_segment_usage_set_clean(su);
-        return ret;
+        kunmap_atomic(kaddr, KM_USER0);
-}
+        nilfs_mdt_mark_buffer_dirty(su_bh);
-/**
+        nilfs_sufile_mod_counter(header_bh, 1, sudirty ? (u64)-1 : 0);
- * nilfs_sufile_free -
+        nilfs_mdt_mark_dirty(sufile);
- * @sufile:
- * @segnum:
- */
-int nilfs_sufile_free(struct inode *sufile, __u64 segnum)
-{
-        return nilfs_sufile_freev(sufile, &segnum, 1);
 }
 /**
@@ -500,72 +462,28 @@ int nilfs_sufile_get_ncleansegs(struct inode *sufile, unsigned long *nsegsp)
        return ret;
 }
-/**
+void nilfs_sufile_do_set_error(struct inode *sufile, __u64 segnum,
- * nilfs_sufile_set_error - mark a segment as erroneous
+                               struct buffer_head *header_bh,
- * @sufile: inode of segment usage file
+                               struct buffer_head *su_bh)
- * @segnum: segment number
- *
- * Description: nilfs_sufile_set_error() marks the segment specified by
- * @segnum as erroneous. The error segment will never be used again.
- *
- * Return Value: On success, 0 is returned. On error, one of the following
- * negative error codes is returned.
- *
- * %-EIO - I/O error.
- *
- * %-ENOMEM - Insufficient amount of memory available.
- *
- * %-EINVAL - Invalid segment usage number.
- */
-int nilfs_sufile_set_error(struct inode *sufile, __u64 segnum)
 {
-        struct buffer_head *header_bh, *su_bh;
        struct nilfs_segment_usage *su;
-        struct nilfs_sufile_header *header;
        void *kaddr;
-        int ret;
+        int suclean;
-        if (unlikely(segnum >= nilfs_sufile_get_nsegments(sufile))) {
-                printk(KERN_WARNING "%s: invalid segment number: %llu\n",
-                       __func__, (unsigned long long)segnum);
-                return -EINVAL;
-        }
-        down_write(&NILFS_MDT(sufile)->mi_sem);
-        ret = nilfs_sufile_get_header_block(sufile, &header_bh);
-        if (ret < 0)
-                goto out_sem;
-        ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &su_bh);
-        if (ret < 0)
-                goto out_header;
        kaddr = kmap_atomic(su_bh->b_page, KM_USER0);
        su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
        if (nilfs_segment_usage_error(su)) {
                kunmap_atomic(kaddr, KM_USER0);
-                brelse(su_bh);
+                return;
-                goto out_header;
        }
+        suclean = nilfs_segment_usage_clean(su);
        nilfs_segment_usage_set_error(su);
        kunmap_atomic(kaddr, KM_USER0);
-        brelse(su_bh);
-        kaddr = kmap_atomic(header_bh->b_page, KM_USER0);
+        if (suclean)
-        header = nilfs_sufile_block_get_header(sufile, header_bh, kaddr);
+                nilfs_sufile_mod_counter(header_bh, -1, 0);
-        le64_add_cpu(&header->sh_ndirtysegs, -1);
-        kunmap_atomic(kaddr, KM_USER0);
-        nilfs_mdt_mark_buffer_dirty(header_bh);
        nilfs_mdt_mark_buffer_dirty(su_bh);
        nilfs_mdt_mark_dirty(sufile);
-        brelse(su_bh);
- out_header:
-        brelse(header_bh);
- out_sem:
-        up_write(&NILFS_MDT(sufile)->mi_sem);
-        return ret;
 }
 /**
@@ -625,7 +543,7 @@ ssize_t nilfs_sufile_get_suinfo(struct inode *sufile, __u64 segnum,
                        si[i + j].sui_nblocks = le32_to_cpu(su->su_nblocks);
                        si[i + j].sui_flags = le32_to_cpu(su->su_flags) &
                                ~(1UL << NILFS_SEGMENT_USAGE_ACTIVE);
-                        if (nilfs_segment_is_active(nilfs, segnum + i + j))
+                        if (nilfs_segment_is_active(nilfs, segnum + j))
                                si[i + j].sui_flags |=
                                        (1UL << NILFS_SEGMENT_USAGE_ACTIVE);
                }
diff --git a/fs/nilfs2/sufile.h b/fs/nilfs2/sufile.h
index d595f33a768d..a2e2efd4ade1 100644
--- a/fs/nilfs2/sufile.h
+++ b/fs/nilfs2/sufile.h
@@ -36,9 +36,6 @@ static inline unsigned long nilfs_sufile_get_nsegments(struct inode *sufile)
 }
 int nilfs_sufile_alloc(struct inode *, __u64 *);
-int nilfs_sufile_cancel_free(struct inode *, __u64);
-int nilfs_sufile_freev(struct inode *, __u64 *, size_t);
-int nilfs_sufile_free(struct inode *, __u64);
 int nilfs_sufile_get_segment_usage(struct inode *, __u64,
                                   struct nilfs_segment_usage **,
                                   struct buffer_head **);
@@ -46,9 +43,83 @@ void nilfs_sufile_put_segment_usage(struct inode *, __u64,
                                    struct buffer_head *);
 int nilfs_sufile_get_stat(struct inode *, struct nilfs_sustat *);
 int nilfs_sufile_get_ncleansegs(struct inode *, unsigned long *);
-int nilfs_sufile_set_error(struct inode *, __u64);
 ssize_t nilfs_sufile_get_suinfo(struct inode *, __u64, struct nilfs_suinfo *,
                                size_t);
+int nilfs_sufile_update(struct inode *, __u64, int,
+                        void (*dofunc)(struct inode *, __u64,
+                                       struct buffer_head *,
+                                       struct buffer_head *));
+void nilfs_sufile_do_cancel_free(struct inode *, __u64, struct buffer_head *,
+                                 struct buffer_head *);
+void nilfs_sufile_do_scrap(struct inode *, __u64, struct buffer_head *,
+                           struct buffer_head *);
+void nilfs_sufile_do_free(struct inode *, __u64, struct buffer_head *,
+                          struct buffer_head *);
+void nilfs_sufile_do_set_error(struct inode *, __u64, struct buffer_head *,
+                               struct buffer_head *);
+/**
+ * nilfs_sufile_cancel_free -
+ * @sufile: inode of segment usage file
+ * @segnum: segment number
+ *
+ * Description:
+ *
+ * Return Value: On success, 0 is returned. On error, one of the following
+ * negative error codes is returned.
+ *
+ * %-EIO - I/O error.
+ *
+ * %-ENOMEM - Insufficient amount of memory available.
+ */
+static inline int nilfs_sufile_cancel_free(struct inode *sufile, __u64 segnum)
+{
+        return nilfs_sufile_update(sufile, segnum, 0,
+                                   nilfs_sufile_do_cancel_free);
+}
+/**
+ * nilfs_sufile_scrap - make a segment garbage
+ * @sufile: inode of segment usage file
+ * @segnum: segment number to be freed
+ */
+static inline int nilfs_sufile_scrap(struct inode *sufile, __u64 segnum)
+{
+        return nilfs_sufile_update(sufile, segnum, 1, nilfs_sufile_do_scrap);
+}
+/**
+ * nilfs_sufile_free - free segment
+ * @sufile: inode of segment usage file
+ * @segnum: segment number to be freed
+ */
+static inline int nilfs_sufile_free(struct inode *sufile, __u64 segnum)
+{
+        return nilfs_sufile_update(sufile, segnum, 0, nilfs_sufile_do_free);
+}
+/**
+ * nilfs_sufile_set_error - mark a segment as erroneous
+ * @sufile: inode of segment usage file
+ * @segnum: segment number
+ *
+ * Description: nilfs_sufile_set_error() marks the segment specified by
+ * @segnum as erroneous. The error segment will never be used again.
+ *
+ * Return Value: On success, 0 is returned. On error, one of the following
+ * negative error codes is returned.
+ *
+ * %-EIO - I/O error.
+ *
+ * %-ENOMEM - Insufficient amount of memory available.
+ *
+ * %-EINVAL - Invalid segment usage number.
+ */
+static inline int nilfs_sufile_set_error(struct inode *sufile, __u64 segnum)
+{
+        return nilfs_sufile_update(sufile, segnum, 0,
+                                   nilfs_sufile_do_set_error);
+}
 #endif  /* _NILFS_SUFILE_H */
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index e117e1ea9bff..6989b03e97ab 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -63,7 +63,6 @@
 MODULE_AUTHOR("NTT Corp.");
 MODULE_DESCRIPTION("A New Implementation of the Log-structured Filesystem "
                   "(NILFS)");
-MODULE_VERSION(NILFS_VERSION);
 MODULE_LICENSE("GPL");
 static int nilfs_remount(struct super_block *sb, int *flags, char *data);
@@ -476,11 +475,12 @@ static int nilfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
        struct super_block *sb = dentry->d_sb;
        struct nilfs_sb_info *sbi = NILFS_SB(sb);
+        struct the_nilfs *nilfs = sbi->s_nilfs;
+        u64 id = huge_encode_dev(sb->s_bdev->bd_dev);
        unsigned long long blocks;
        unsigned long overhead;
        unsigned long nrsvblocks;
        sector_t nfreeblocks;
-        struct the_nilfs *nilfs = sbi->s_nilfs;
        int err;
        /*
@@ -514,6 +514,9 @@ static int nilfs_statfs(struct dentry *dentry, struct kstatfs *buf)
        buf->f_files = atomic_read(&sbi->s_inodes_count);
        buf->f_ffree = 0; /* nilfs_count_free_inodes(sb); */
        buf->f_namelen = NILFS_NAME_LEN;
+        buf->f_fsid.val[0] = (u32)id;
+        buf->f_fsid.val[1] = (u32)(id >> 32);
        return 0;
 }
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 33400cf0bbe2..7f65b3be4aa9 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -115,6 +115,7 @@ void put_nilfs(struct the_nilfs *nilfs)
 static int nilfs_load_super_root(struct the_nilfs *nilfs,
                                 struct nilfs_sb_info *sbi, sector_t sr_block)
 {
+        static struct lock_class_key dat_lock_key;
        struct buffer_head *bh_sr;
        struct nilfs_super_root *raw_sr;
        struct nilfs_super_block **sbp = nilfs->ns_sbp;
@@ -163,6 +164,9 @@ static int nilfs_load_super_root(struct the_nilfs *nilfs,
        if (unlikely(err))
                goto failed_sufile;
+        lockdep_set_class(&NILFS_MDT(nilfs->ns_dat)->mi_sem, &dat_lock_key);
+        lockdep_set_class(&NILFS_MDT(nilfs->ns_gc_dat)->mi_sem, &dat_lock_key);
        nilfs_mdt_set_shadow(nilfs->ns_dat, nilfs->ns_gc_dat);
        nilfs_mdt_set_entry_size(nilfs->ns_cpfile, checkpoint_size,
                                 sizeof(struct nilfs_cpfile_header));
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8672b9536039..c2a87c885b73 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1912,6 +1912,22 @@ out_sems:
        return written ? written : ret;
 }
+static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
+                                struct file *out,
+                                struct splice_desc *sd)
+{
+        int ret;
+        ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, &sd->pos,
+                                            sd->total_len, 0, NULL);
+        if (ret < 0) {
+                mlog_errno(ret);
+                return ret;
+        }
+        return splice_from_pipe_feed(pipe, sd, pipe_to_file);
+}
 static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                                       struct file *out,
                                       loff_t *ppos,
@@ -1919,38 +1935,76 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                                       unsigned int flags)
 {
        int ret;
-        struct inode *inode = out->f_path.dentry->d_inode;
+        struct address_space *mapping = out->f_mapping;
+        struct inode *inode = mapping->host;
+        struct splice_desc sd = {
+                .total_len = len,
+                .flags = flags,
+                .pos = *ppos,
+                .u.file = out,
+        };
        mlog_entry("(0x%p, 0x%p, %u, '%.*s')\n", out, pipe,
                   (unsigned int)len,
                   out->f_path.dentry->d_name.len,
                   out->f_path.dentry->d_name.name);
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);
-        ret = ocfs2_rw_lock(inode, 1);
+        splice_from_pipe_begin(&sd);
-        if (ret < 0) {
+        do {
-                mlog_errno(ret);
+                ret = splice_from_pipe_next(pipe, &sd);
-                goto out;
+                if (ret <= 0)
-        }
+                        break;
-        ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, ppos, len, 0,
+                mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
-                                            NULL);
+                ret = ocfs2_rw_lock(inode, 1);
-        if (ret < 0) {
+                if (ret < 0)
-                mlog_errno(ret);
+                        mlog_errno(ret);
-                goto out_unlock;
+                else {
-        }
+                        ret = ocfs2_splice_to_file(pipe, out, &sd);
+                        ocfs2_rw_unlock(inode, 1);
+                }
+                mutex_unlock(&inode->i_mutex);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, &sd);
        if (pipe->inode)
-                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
-        ret = generic_file_splice_write_nolock(pipe, out, ppos, len, flags);
-        if (pipe->inode)
                mutex_unlock(&pipe->inode->i_mutex);
-out_unlock:
+        if (sd.num_spliced)
-        ocfs2_rw_unlock(inode, 1);
+                ret = sd.num_spliced;
-out:
-        mutex_unlock(&inode->i_mutex);
+        if (ret > 0) {
+                unsigned long nr_pages;
+                *ppos += ret;
+                nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+                /*
+                 * If file or inode is SYNC and we actually wrote some data,
+                 * sync it.
+                 */
+                if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
+                        int err;
+                        mutex_lock(&inode->i_mutex);
+                        err = ocfs2_rw_lock(inode, 1);
+                        if (err < 0) {
+                                mlog_errno(err);
+                        } else {
+                                err = generic_osync_inode(inode, mapping,
+                                                  OSYNC_METADATA|OSYNC_DATA);
+                                ocfs2_rw_unlock(inode, 1);
+                        }
+                        mutex_unlock(&inode->i_mutex);
+                        if (err)
+                                ret = err;
+                }
+                balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
+        }
        mlog_exit(ret);
        return ret;
diff --git a/fs/pipe.c b/fs/pipe.c
index 4af7aa521813..13414ec45b8d 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -37,6 +37,42 @@
 * -- Manfred Spraul <manfred@colorfullife.com> 2002-05-09
 */
+static void pipe_lock_nested(struct pipe_inode_info *pipe, int subclass)
+{
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, subclass);
+}
+void pipe_lock(struct pipe_inode_info *pipe)
+{
+        /*
+         * pipe_lock() nests non-pipe inode locks (for writing to a file)
+         */
+        pipe_lock_nested(pipe, I_MUTEX_PARENT);
+}
+EXPORT_SYMBOL(pipe_lock);
+void pipe_unlock(struct pipe_inode_info *pipe)
+{
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
+}
+EXPORT_SYMBOL(pipe_unlock);
+void pipe_double_lock(struct pipe_inode_info *pipe1,
+                      struct pipe_inode_info *pipe2)
+{
+        BUG_ON(pipe1 == pipe2);
+        if (pipe1 < pipe2) {
+                pipe_lock_nested(pipe1, I_MUTEX_PARENT);
+                pipe_lock_nested(pipe2, I_MUTEX_CHILD);
+        } else {
+                pipe_lock_nested(pipe2, I_MUTEX_CHILD);
+                pipe_lock_nested(pipe1, I_MUTEX_PARENT);
+        }
+}
 /* Drop the inode semaphore and wait for a pipe event, atomically */
 void pipe_wait(struct pipe_inode_info *pipe)
 {
@@ -47,12 +83,10 @@ void pipe_wait(struct pipe_inode_info *pipe)
         * is considered a noninteractive wait:
         */
        prepare_to_wait(&pipe->wait, &wait, TASK_INTERRUPTIBLE);
-        if (pipe->inode)
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
        schedule();
        finish_wait(&pipe->wait, &wait);
-        if (pipe->inode)
+        pipe_lock(pipe);
-                mutex_lock(&pipe->inode->i_mutex);
 }
 static int
diff --git a/fs/splice.c b/fs/splice.c
index c18aa7e03e2b..5384a90665d0 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -182,8 +182,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
        do_wakeup = 0;
        page_nr = 0;
-        if (pipe->inode)
+        pipe_lock(pipe);
-                mutex_lock(&pipe->inode->i_mutex);
        for (;;) {
                if (!pipe->readers) {
@@ -245,15 +244,13 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
                pipe->waiting_writers--;
        }
-        if (pipe->inode) {
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
-                if (do_wakeup) {
+        if (do_wakeup) {
-                        smp_mb();
+                smp_mb();
-                        if (waitqueue_active(&pipe->wait))
+                if (waitqueue_active(&pipe->wait))
-                                wake_up_interruptible(&pipe->wait);
+                        wake_up_interruptible(&pipe->wait);
-                        kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+                kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
-                }
        }
        while (page_nr < spd_pages)
@@ -555,8 +552,8 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
 * SPLICE_F_MOVE isn't set, or we cannot move the page, we simply create
 * a new page in the output file page cache and fill/dirty that.
 */
-static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
+int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
-                        struct splice_desc *sd)
+                 struct splice_desc *sd)
 {
        struct file *file = sd->u.file;
        struct address_space *mapping = file->f_mapping;
@@ -600,108 +597,178 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 out:
        return ret;
 }
+EXPORT_SYMBOL(pipe_to_file);
+static void wakeup_pipe_writers(struct pipe_inode_info *pipe)
+{
+        smp_mb();
+        if (waitqueue_active(&pipe->wait))
+                wake_up_interruptible(&pipe->wait);
+        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
+}
 /**
- * __splice_from_pipe - splice data from a pipe to given actor
+ * splice_from_pipe_feed - feed available data from a pipe to a file
 * @pipe:       pipe to splice from
 * @sd:         information to @actor
 * @actor:      handler that splices the data
 *
 * Description:
- *    This function does little more than loop over the pipe and call
- *    @actor to do the actual moving of a single struct pipe_buffer to
+ *    This function loops over the pipe and calls @actor to do the
- *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
+ *    actual moving of a single struct pipe_buffer to the desired
- *    pipe_to_user.
+ *    destination.  It returns when there's no more buffers left in
+ *    the pipe or if the requested number of bytes (@sd->total_len)
+ *    have been copied.  It returns a positive number (one) if the
+ *    pipe needs to be filled with more data, zero if the required
+ *    number of bytes have been copied and -errno on error.
 *
+ *    This, together with splice_from_pipe_{begin,end,next}, may be
+ *    used to implement the functionality of __splice_from_pipe() when
+ *    locking is required around copying the pipe buffers to the
+ *    destination.
 */
-ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
+int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
-                           splice_actor *actor)
+                          splice_actor *actor)
 {
-        int ret, do_wakeup, err;
+        int ret;
-        ret = 0;
-        do_wakeup = 0;
-        for (;;) {
-                if (pipe->nrbufs) {
-                        struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
-                        const struct pipe_buf_operations *ops = buf->ops;
-                        sd->len = buf->len;
+        while (pipe->nrbufs) {
-                        if (sd->len > sd->total_len)
+                struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
-                                sd->len = sd->total_len;
+                const struct pipe_buf_operations *ops = buf->ops;
-                        err = actor(pipe, buf, sd);
+                sd->len = buf->len;
-                        if (err <= 0) {
+                if (sd->len > sd->total_len)
-                                if (!ret && err != -ENODATA)
+                        sd->len = sd->total_len;
-                                        ret = err;
-                                break;
+                ret = actor(pipe, buf, sd);
-                        }
+                if (ret <= 0) {
+                        if (ret == -ENODATA)
+                                ret = 0;
+                        return ret;
+                }
+                buf->offset += ret;
+                buf->len -= ret;
-                        ret += err;
+                sd->num_spliced += ret;
-                        buf->offset += err;
+                sd->len -= ret;
-                        buf->len -= err;
+                sd->pos += ret;
+                sd->total_len -= ret;
-                        sd->len -= err;
+                if (!buf->len) {
-                        sd->pos += err;
+                        buf->ops = NULL;
-                        sd->total_len -= err;
+                        ops->release(pipe, buf);
-                        if (sd->len)
+                        pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
-                                continue;
+                        pipe->nrbufs--;
+                        if (pipe->inode)
+                                sd->need_wakeup = true;
+                }
-                        if (!buf->len) {
+                if (!sd->total_len)
-                                buf->ops = NULL;
+                        return 0;
-                                ops->release(pipe, buf);
+        }
-                                pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
-                                pipe->nrbufs--;
-                                if (pipe->inode)
-                                        do_wakeup = 1;
-                        }
-                        if (!sd->total_len)
+        return 1;
-                                break;
+}
-                }
+EXPORT_SYMBOL(splice_from_pipe_feed);
-                if (pipe->nrbufs)
+/**
-                        continue;
+ * splice_from_pipe_next - wait for some data to splice from
+ * @pipe:       pipe to splice from
+ * @sd:         information about the splice operation
+ *
+ * Description:
+ *    This function will wait for some data and return a positive
+ *    value (one) if pipe buffers are available.  It will return zero
+ *    or -errno if no more data needs to be spliced.
+ */
+int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+{
+        while (!pipe->nrbufs) {
                if (!pipe->writers)
-                        break;
+                        return 0;
-                if (!pipe->waiting_writers) {
-                        if (ret)
-                                break;
-                }
-                if (sd->flags & SPLICE_F_NONBLOCK) {
+                if (!pipe->waiting_writers && sd->num_spliced)
-                        if (!ret)
+                        return 0;
-                                ret = -EAGAIN;
-                        break;
-                }
-                if (signal_pending(current)) {
+                if (sd->flags & SPLICE_F_NONBLOCK)
-                        if (!ret)
+                        return -EAGAIN;
-                                ret = -ERESTARTSYS;
-                        break;
-                }
-                if (do_wakeup) {
+                if (signal_pending(current))
-                        smp_mb();
+                        return -ERESTARTSYS;
-                        if (waitqueue_active(&pipe->wait))
-                                wake_up_interruptible_sync(&pipe->wait);
+                if (sd->need_wakeup) {
-                        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
+                        wakeup_pipe_writers(pipe);
-                        do_wakeup = 0;
+                        sd->need_wakeup = false;
                }
                pipe_wait(pipe);
        }
-        if (do_wakeup) {
+        return 1;
-                smp_mb();
+}
-                if (waitqueue_active(&pipe->wait))
+EXPORT_SYMBOL(splice_from_pipe_next);
-                        wake_up_interruptible(&pipe->wait);
-                kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
-        }
-        return ret;
+/**
+ * splice_from_pipe_begin - start splicing from pipe
+ * @pipe:       pipe to splice from
+ *
+ * Description:
+ *    This function should be called before a loop containing
+ *    splice_from_pipe_next() and splice_from_pipe_feed() to
+ *    initialize the necessary fields of @sd.
+ */
+void splice_from_pipe_begin(struct splice_desc *sd)
+{
+        sd->num_spliced = 0;
+        sd->need_wakeup = false;
+}
+EXPORT_SYMBOL(splice_from_pipe_begin);
+/**
+ * splice_from_pipe_end - finish splicing from pipe
+ * @pipe:       pipe to splice from
+ * @sd:         information about the splice operation
+ *
+ * Description:
+ *    This function will wake up pipe writers if necessary.  It should
+ *    be called after a loop containing splice_from_pipe_next() and
+ *    splice_from_pipe_feed().
+ */
+void splice_from_pipe_end(struct pipe_inode_info *pipe, struct splice_desc *sd)
+{
+        if (sd->need_wakeup)
+                wakeup_pipe_writers(pipe);
+}
+EXPORT_SYMBOL(splice_from_pipe_end);
+/**
+ * __splice_from_pipe - splice data from a pipe to given actor
+ * @pipe:       pipe to splice from
+ * @sd:         information to @actor
+ * @actor:      handler that splices the data
+ *
+ * Description:
+ *    This function does little more than loop over the pipe and call
+ *    @actor to do the actual moving of a single struct pipe_buffer to
+ *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
+ *    pipe_to_user.
+ *
+ */
+ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
+                           splice_actor *actor)
+{
+        int ret;
+        splice_from_pipe_begin(sd);
+        do {
+                ret = splice_from_pipe_next(pipe, sd);
+                if (ret > 0)
+                        ret = splice_from_pipe_feed(pipe, sd, actor);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, sd);
+        return sd->num_spliced ? sd->num_spliced : ret;
 }
 EXPORT_SYMBOL(__splice_from_pipe);
@@ -715,7 +782,7 @@ EXPORT_SYMBOL(__splice_from_pipe);
 * @actor:      handler that splices the data
 *
 * Description:
- *    See __splice_from_pipe. This function locks the input and output inodes,
+ *    See __splice_from_pipe. This function locks the pipe inode,
 *    otherwise it's identical to __splice_from_pipe().
 *
 */
@@ -724,7 +791,6 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                         splice_actor *actor)
 {
        ssize_t ret;
-        struct inode *inode = out->f_mapping->host;
        struct splice_desc sd = {
                .total_len = len,
                .flags = flags,
@@ -732,30 +798,15 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                .u.file = out,
        };
-        /*
+        pipe_lock(pipe);
-         * The actor worker might be calling ->write_begin and
-         * ->write_end. Most of the time, these expect i_mutex to
-         * be held. Since this may result in an ABBA deadlock with
-         * pipe->inode, we have to order lock acquiry here.
-         *
-         * Outer lock must be inode->i_mutex, as pipe_wait() will
-         * release and reacquire pipe->inode->i_mutex, AND inode must
-         * never be a pipe.
-         */
-        WARN_ON(S_ISFIFO(inode->i_mode));
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-        if (pipe->inode)
-                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
        ret = __splice_from_pipe(pipe, &sd, actor);
-        if (pipe->inode)
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
-        mutex_unlock(&inode->i_mutex);
        return ret;
 }
 /**
- * generic_file_splice_write_nolock - generic_file_splice_write without mutexes
+ * generic_file_splice_write - splice data from a pipe to a file
 * @pipe:       pipe info
 * @out:        file to write to
 * @ppos:       position in @out
@@ -764,13 +815,12 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
 *
 * Description:
 *    Will either move or copy pages (determined by @flags options) from
- *    the given pipe inode to the given file. The caller is responsible
+ *    the given pipe inode to the given file.
- *    for acquiring i_mutex on both inodes.
 *
 */
 ssize_t
-generic_file_splice_write_nolock(struct pipe_inode_info *pipe, struct file *out,
+generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
-                                 loff_t *ppos, size_t len, unsigned int flags)
+                          loff_t *ppos, size_t len, unsigned int flags)
 {
        struct address_space *mapping = out->f_mapping;
        struct inode *inode = mapping->host;
@@ -781,76 +831,28 @@ generic_file_splice_write_nolock(struct pipe_inode_info *pipe, struct file *out,
                .u.file = out,
        };
        ssize_t ret;
-        int err;
-        err = file_remove_suid(out);
-        if (unlikely(err))
-                return err;
-        ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
-        if (ret > 0) {
-                unsigned long nr_pages;
-                *ppos += ret;
+        pipe_lock(pipe);
-                nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-                /*
+        splice_from_pipe_begin(&sd);
-                 * If file or inode is SYNC and we actually wrote some data,
+        do {
-                 * sync it.
+                ret = splice_from_pipe_next(pipe, &sd);
-                 */
+                if (ret <= 0)
-                if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
+                        break;
-                        err = generic_osync_inode(inode, mapping,
-                                                  OSYNC_METADATA|OSYNC_DATA);
-                        if (err)
-                                ret = err;
-                }
-                balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
-        }
-        return ret;
+                mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
-}
+                ret = file_remove_suid(out);
+                if (!ret)
+                        ret = splice_from_pipe_feed(pipe, &sd, pipe_to_file);
+                mutex_unlock(&inode->i_mutex);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, &sd);
-EXPORT_SYMBOL(generic_file_splice_write_nolock);
+        pipe_unlock(pipe);
-/**
+        if (sd.num_spliced)
- * generic_file_splice_write - splice data from a pipe to a file
+                ret = sd.num_spliced;
- * @pipe:       pipe info
- * @out:        file to write to
- * @ppos:       position in @out
- * @len:        number of bytes to splice
- * @flags:      splice modifier flags
- *
- * Description:
- *    Will either move or copy pages (determined by @flags options) from
- *    the given pipe inode to the given file.
- *
- */
-ssize_t
-generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
-                          loff_t *ppos, size_t len, unsigned int flags)
-{
-        struct address_space *mapping = out->f_mapping;
-        struct inode *inode = mapping->host;
-        struct splice_desc sd = {
-                .total_len = len,
-                .flags = flags,
-                .pos = *ppos,
-                .u.file = out,
-        };
-        ssize_t ret;
-        WARN_ON(S_ISFIFO(inode->i_mode));
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-        ret = file_remove_suid(out);
-        if (likely(!ret)) {
-                if (pipe->inode)
-                        mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
-                ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
-                if (pipe->inode)
-                        mutex_unlock(&pipe->inode->i_mutex);
-        }
-        mutex_unlock(&inode->i_mutex);
        if (ret > 0) {
                unsigned long nr_pages;
@@ -1339,8 +1341,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
        if (!pipe)
                return -EBADF;
-        if (pipe->inode)
+        pipe_lock(pipe);
-                mutex_lock(&pipe->inode->i_mutex);
        error = ret = 0;
        while (nr_segs) {
@@ -1395,8 +1396,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
                iov++;
        }
-        if (pipe->inode)
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
        if (!ret)
                ret = error;
@@ -1524,7 +1524,7 @@ static int link_ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                return 0;
        ret = 0;
-        mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
        while (!pipe->nrbufs) {
                if (signal_pending(current)) {
@@ -1542,7 +1542,7 @@ static int link_ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                pipe_wait(pipe);
        }
-        mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
        return ret;
 }
@@ -1562,7 +1562,7 @@ static int link_opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                return 0;
        ret = 0;
-        mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
        while (pipe->nrbufs >= PIPE_BUFFERS) {
                if (!pipe->readers) {
@@ -1583,7 +1583,7 @@ static int link_opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                pipe->waiting_writers--;
        }
-        mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
        return ret;
 }
@@ -1599,10 +1599,10 @@ static int link_pipe(struct pipe_inode_info *ipipe,
        /*
         * Potential ABBA deadlock, work around it by ordering lock
-         * grabbing by inode address. Otherwise two different processes
+         * grabbing by pipe info address. Otherwise two different processes
         * could deadlock (one doing tee from A -> B, the other from B -> A).
         */
-        inode_double_lock(ipipe->inode, opipe->inode);
+        pipe_double_lock(ipipe, opipe);
        do {
                if (!opipe->readers) {
@@ -1653,7 +1653,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
        if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
                ret = -EAGAIN;
-        inode_double_unlock(ipipe->inode, opipe->inode);
+        pipe_unlock(ipipe);
+        pipe_unlock(opipe);
        /*
         * If we put data in the output pipe, wakeup any potential readers.
diff --git a/include/drm/i915_drm.h b/include/drm/i915_drm.h
index 67e3353a56d6..95962fa8398a 100644
--- a/include/drm/i915_drm.h
+++ b/include/drm/i915_drm.h
@@ -594,6 +594,9 @@ struct drm_i915_gem_busy {
 #define I915_BIT_6_SWIZZLE_9_10_11      4
 /* Not seen by userland */
 #define I915_BIT_6_SWIZZLE_UNKNOWN      5
+/* Seen by userland. */
+#define I915_BIT_6_SWIZZLE_9_17         6
+#define I915_BIT_6_SWIZZLE_9_10_17      7
 struct drm_i915_gem_set_tiling {
        /** Handle of the buffer to have its tiling state updated */
diff --git a/include/linux/bio.h b/include/linux/bio.h
index b900d2c67d29..b89cf2d82898 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -504,6 +504,115 @@ static inline int bio_has_data(struct bio *bio)
        return bio && bio->bi_io_vec != NULL;
 }
+/*
+ * BIO list managment for use by remapping drivers (e.g. DM or MD).
+ *
+ * A bio_list anchors a singly-linked list of bios chained through the bi_next
+ * member of the bio.  The bio_list also caches the last list member to allow
+ * fast access to the tail.
+ */
+struct bio_list {
+        struct bio *head;
+        struct bio *tail;
+};
+static inline int bio_list_empty(const struct bio_list *bl)
+{
+        return bl->head == NULL;
+}
+static inline void bio_list_init(struct bio_list *bl)
+{
+        bl->head = bl->tail = NULL;
+}
+#define bio_list_for_each(bio, bl) \
+        for (bio = (bl)->head; bio; bio = bio->bi_next)
+static inline unsigned bio_list_size(const struct bio_list *bl)
+{
+        unsigned sz = 0;
+        struct bio *bio;
+        bio_list_for_each(bio, bl)
+                sz++;
+        return sz;
+}
+static inline void bio_list_add(struct bio_list *bl, struct bio *bio)
+{
+        bio->bi_next = NULL;
+        if (bl->tail)
+                bl->tail->bi_next = bio;
+        else
+                bl->head = bio;
+        bl->tail = bio;
+}
+static inline void bio_list_add_head(struct bio_list *bl, struct bio *bio)
+{
+        bio->bi_next = bl->head;
+        bl->head = bio;
+        if (!bl->tail)
+                bl->tail = bio;
+}
+static inline void bio_list_merge(struct bio_list *bl, struct bio_list *bl2)
+{
+        if (!bl2->head)
+                return;
+        if (bl->tail)
+                bl->tail->bi_next = bl2->head;
+        else
+                bl->head = bl2->head;
+        bl->tail = bl2->tail;
+}
+static inline void bio_list_merge_head(struct bio_list *bl,
+                                       struct bio_list *bl2)
+{
+        if (!bl2->head)
+                return;
+        if (bl->head)
+                bl2->tail->bi_next = bl->head;
+        else
+                bl->tail = bl2->tail;
+        bl->head = bl2->head;
+}
+static inline struct bio *bio_list_pop(struct bio_list *bl)
+{
+        struct bio *bio = bl->head;
+        if (bio) {
+                bl->head = bl->head->bi_next;
+                if (!bl->head)
+                        bl->tail = NULL;
+                bio->bi_next = NULL;
+        }
+        return bio;
+}
+static inline struct bio *bio_list_get(struct bio_list *bl)
+{
+        struct bio *bio = bl->head;
+        bl->head = bl->tail = NULL;
+        return bio;
+}
 #if defined(CONFIG_BLK_DEV_INTEGRITY)
 #define bip_vec_idx(bip, idx)   (&(bip->bip_vec[(idx)]))
diff --git a/include/linux/debug_locks.h b/include/linux/debug_locks.h
index 493dedb7a67b..29b3ce3f2a1d 100644
--- a/include/linux/debug_locks.h
+++ b/include/linux/debug_locks.h
@@ -3,6 +3,7 @@
 #include <linux/kernel.h>
 #include <asm/atomic.h>
+#include <asm/system.h>
 struct task_struct;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 562d2855cf30..e766be0d4329 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -87,6 +87,60 @@ struct inodes_stat_t {
 */
 #define FMODE_NOCMTIME          ((__force fmode_t)2048)
+/*
+ * The below are the various read and write types that we support. Some of
+ * them include behavioral modifiers that send information down to the
+ * block layer and IO scheduler. Terminology:
+ *
+ *      The block layer uses device plugging to defer IO a little bit, in
+ *      the hope that we will see more IO very shortly. This increases
+ *      coalescing of adjacent IO and thus reduces the number of IOs we
+ *      have to send to the device. It also allows for better queuing,
+ *      if the IO isn't mergeable. If the caller is going to be waiting
+ *      for the IO, then he must ensure that the device is unplugged so
+ *      that the IO is dispatched to the driver.
+ *
+ *      All IO is handled async in Linux. This is fine for background
+ *      writes, but for reads or writes that someone waits for completion
+ *      on, we want to notify the block layer and IO scheduler so that they
+ *      know about it. That allows them to make better scheduling
+ *      decisions. So when the below references 'sync' and 'async', it
+ *      is referencing this priority hint.
+ *
+ * With that in mind, the available types are:
+ *
+ * READ                 A normal read operation. Device will be plugged.
+ * READ_SYNC            A synchronous read. Device is not plugged, caller can
+ *                      immediately wait on this read without caring about
+ *                      unplugging.
+ * READA                Used for read-ahead operations. Lower priority, and the
+ *                       block layer could (in theory) choose to ignore this
+ *                      request if it runs into resource problems.
+ * WRITE                A normal async write. Device will be plugged.
+ * SWRITE               Like WRITE, but a special case for ll_rw_block() that
+ *                      tells it to lock the buffer first. Normally a buffer
+ *                      must be locked before doing IO.
+ * WRITE_SYNC_PLUG      Synchronous write. Identical to WRITE, but passes down
+ *                      the hint that someone will be waiting on this IO
+ *                      shortly. The device must still be unplugged explicitly,
+ *                      WRITE_SYNC_PLUG does not do this as we could be
+ *                      submitting more writes before we actually wait on any
+ *                      of them.
+ * WRITE_SYNC           Like WRITE_SYNC_PLUG, but also unplugs the device
+ *                      immediately after submission. The write equivalent
+ *                      of READ_SYNC.
+ * WRITE_ODIRECT        Special case write for O_DIRECT only.
+ * SWRITE_SYNC
+ * SWRITE_SYNC_PLUG     Like WRITE_SYNC/WRITE_SYNC_PLUG, but locks the buffer.
+ *                      See SWRITE.
+ * WRITE_BARRIER        Like WRITE, but tells the block layer that all
+ *                      previously submitted writes must be safely on storage
+ *                      before this one is started. Also guarantees that when
+ *                      this write is complete, it itself is also safely on
+ *                      storage. Prevents reordering of writes on both sides
+ *                      of this IO.
+ *
+ */
 #define RW_MASK         1
 #define RWA_MASK        2
 #define READ 0
@@ -102,6 +156,11 @@ struct inodes_stat_t {
                        (SWRITE | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_NOIDLE))
 #define SWRITE_SYNC     (SWRITE_SYNC_PLUG | (1 << BIO_RW_UNPLUG))
 #define WRITE_BARRIER   (WRITE | (1 << BIO_RW_BARRIER))
+/*
+ * These aren't really reads or writes, they pass down information about
+ * parts of device that are now unused by the file system.
+ */
 #define DISCARD_NOBARRIER (1 << BIO_RW_DISCARD)
 #define DISCARD_BARRIER ((1 << BIO_RW_DISCARD) | (1 << BIO_RW_BARRIER))
@@ -738,9 +797,6 @@ enum inode_i_mutex_lock_class
        I_MUTEX_QUOTA
 };
-extern void inode_double_lock(struct inode *inode1, struct inode *inode2);
-extern void inode_double_unlock(struct inode *inode1, struct inode *inode2);
 /*
 * NOTE: in a 32bit arch with a preemptable kernel and
 * an UP compile the i_size_read/write must be atomic
@@ -2150,8 +2206,6 @@ extern ssize_t generic_file_splice_read(struct file *, loff_t *,
                struct pipe_inode_info *, size_t, unsigned int);
 extern ssize_t generic_file_splice_write(struct pipe_inode_info *,
                struct file *, loff_t *, size_t, unsigned int);
-extern ssize_t generic_file_splice_write_nolock(struct pipe_inode_info *,
-                struct file *, loff_t *, size_t, unsigned int);
 extern ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe,
                struct file *out, loff_t *, size_t len, unsigned int flags);
 extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
diff --git a/include/linux/fsl_devices.h b/include/linux/fsl_devices.h
index f2a78b5e8b55..43fc95d822d5 100644
--- a/include/linux/fsl_devices.h
+++ b/include/linux/fsl_devices.h
@@ -43,10 +43,6 @@
 *
 */
-/* Flags related to I2C device features */
-#define FSL_I2C_DEV_SEPARATE_DFSRR      0x00000001
-#define FSL_I2C_DEV_CLOCK_5200          0x00000002
 enum fsl_usb2_operating_modes {
        FSL_USB2_MPH_HOST,
        FSL_USB2_DR_HOST,
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 8e4120285f72..c8f038554e80 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -134,6 +134,11 @@ struct pipe_buf_operations {
   memory allocation, whereas PIPE_BUF makes atomicity guarantees.  */
 #define PIPE_SIZE               PAGE_SIZE
+/* Pipe lock and unlock operations */
+void pipe_lock(struct pipe_inode_info *);
+void pipe_unlock(struct pipe_inode_info *);
+void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
 /* Drop the inode semaphore and wait for a pipe event, atomically */
 void pipe_wait(struct pipe_inode_info *pipe);
diff --git a/include/linux/splice.h b/include/linux/splice.h
index 528dcb93c2f2..5f3faa9d15ae 100644
--- a/include/linux/splice.h
+++ b/include/linux/splice.h
@@ -36,6 +36,8 @@ struct splice_desc {
                void *data;             /* cookie */
        } u;
        loff_t pos;                     /* file position */
+        size_t num_spliced;             /* number of bytes already spliced */
+        bool need_wakeup;               /* need to wake up writer */
 };
 struct partial_page {
@@ -66,6 +68,16 @@ extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
                                splice_actor *);
 extern ssize_t __splice_from_pipe(struct pipe_inode_info *,
                                  struct splice_desc *, splice_actor *);
+extern int splice_from_pipe_feed(struct pipe_inode_info *, struct splice_desc *,
+                                 splice_actor *);
+extern int splice_from_pipe_next(struct pipe_inode_info *,
+                                 struct splice_desc *);
+extern void splice_from_pipe_begin(struct splice_desc *);
+extern void splice_from_pipe_end(struct pipe_inode_info *,
+                                 struct splice_desc *);
+extern int pipe_to_file(struct pipe_inode_info *, struct pipe_buffer *,
+                        struct splice_desc *);
 extern ssize_t splice_to_pipe(struct pipe_inode_info *,
                              struct splice_pipe_desc *);
 extern ssize_t splice_direct_to_actor(struct file *, struct splice_desc *,
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index b95842542590..625e9e4639c6 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -29,7 +29,7 @@
 /**
 * usb_serial_port: structure for the specific ports of a device.
 * @serial: pointer back to the struct usb_serial owner of this port.
- * @tty: pointer to the corresponding tty for this port.
+ * @port: pointer to the corresponding tty_port for this port.
 * @lock: spinlock to grab when updating portions of this structure.
 * @mutex: mutex used to synchronize serial_open() and serial_close()
 *      access for this port.
@@ -44,19 +44,22 @@
 * @interrupt_out_endpointAddress: endpoint address for the interrupt out pipe
 *      for this port.
 * @bulk_in_buffer: pointer to the bulk in buffer for this port.
+ * @bulk_in_size: the size of the bulk_in_buffer, in bytes.
 * @read_urb: pointer to the bulk in struct urb for this port.
 * @bulk_in_endpointAddress: endpoint address for the bulk in pipe for this
 *      port.
 * @bulk_out_buffer: pointer to the bulk out buffer for this port.
 * @bulk_out_size: the size of the bulk_out_buffer, in bytes.
 * @write_urb: pointer to the bulk out struct urb for this port.
+ * @write_urb_busy: port`s writing status
 * @bulk_out_endpointAddress: endpoint address for the bulk out pipe for this
 *      port.
 * @write_wait: a wait_queue_head_t used by the port.
 * @work: work queue entry for the line discipline waking up.
- * @open_count: number of times this port has been opened.
 * @throttled: nonzero if the read urb is inactive to throttle the device
 * @throttle_req: nonzero if the tty wants to throttle us
+ * @console: attached usb serial console
+ * @dev: pointer to the serial device
 *
 * This structure is used by the usb-serial core and drivers for the specific
 * ports of a device.
diff --git a/include/sound/jack.h b/include/sound/jack.h
index 6b013c6f6a04..f236e426a706 100644
--- a/include/sound/jack.h
+++ b/include/sound/jack.h
@@ -50,6 +50,8 @@ struct snd_jack {
        int type;
        const char *id;
        char name[100];
+        void *private_data;
+        void (*private_free)(struct snd_jack *);
 };
 #ifdef CONFIG_SND_JACK
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index 8904b1900d7f..c17296891617 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -268,7 +268,8 @@ struct snd_pcm_runtime {
        int overrange;
        snd_pcm_uframes_t avail_max;
        snd_pcm_uframes_t hw_ptr_base;  /* Position at buffer restart */
-        snd_pcm_uframes_t hw_ptr_interrupt; /* Position at interrupt time*/
+        snd_pcm_uframes_t hw_ptr_interrupt; /* Position at interrupt time */
+        unsigned long hw_ptr_jiffies;   /* Time when hw_ptr is updated */
        /* -- HW params -- */
        snd_pcm_access_t access;        /* access mode */
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 505f319e489c..8ba052c86d48 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -64,8 +64,6 @@ static int submit(int rw, pgoff_t page_off, struct page *page,
        struct bio *bio;
        bio = bio_alloc(__GFP_WAIT | __GFP_HIGH, 1);
-        if (!bio)
-                return -ENOMEM;
        bio->bi_sector = page_off * (PAGE_SIZE >> 9);
        bio->bi_bdev = resume_bdev;
        bio->bi_end_io = end_swap_bio_read;
diff --git a/sound/core/control.c b/sound/core/control.c
index 4b20fa2b7e6d..17b8d47a5cd0 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -723,14 +723,11 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
 {
        struct snd_ctl_elem_value *control;
        int result;
-        
-        control = kmalloc(sizeof(*control), GFP_KERNEL);
+        control = memdup_user(_control, sizeof(*control));
-        if (control == NULL)
+        if (IS_ERR(control))
-                return -ENOMEM; 
+                return PTR_ERR(control);
-        if (copy_from_user(control, _control, sizeof(*control))) {
-                kfree(control);
-                return -EFAULT;
-        }
        snd_power_lock(card);
        result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
        if (result >= 0)
@@ -784,13 +781,10 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
        struct snd_card *card;
        int result;
-        control = kmalloc(sizeof(*control), GFP_KERNEL);
+        control = memdup_user(_control, sizeof(*control));
-        if (control == NULL)
+        if (IS_ERR(control))
-                return -ENOMEM; 
+                return PTR_ERR(control);
-        if (copy_from_user(control, _control, sizeof(*control))) {
-                kfree(control);
-                return -EFAULT;
-        }
        card = file->card;
        snd_power_lock(card);
        result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
@@ -916,13 +910,10 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
        if (op_flag > 0) {
                if (size > 1024 * 128)  /* sane value */
                        return -EINVAL;
-                new_data = kmalloc(size, GFP_KERNEL);
-                if (new_data == NULL)
+                new_data = memdup_user(tlv, size);
-                        return -ENOMEM;
+                if (IS_ERR(new_data))
-                if (copy_from_user(new_data, tlv, size)) {
+                        return PTR_ERR(new_data);
-                        kfree(new_data);
-                        return -EFAULT;
-                }
                change = ue->tlv_data_size != size;
                if (!change)
                        change = memcmp(ue->tlv_data, new_data, size);
diff --git a/sound/core/jack.c b/sound/core/jack.c
index c8254c667c62..d54d1a05fe65 100644
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -35,6 +35,9 @@ static int snd_jack_dev_free(struct snd_device *device)
 {
        struct snd_jack *jack = device->device_data;
+        if (jack->private_free)
+                jack->private_free(jack);
        /* If the input device is registered with the input subsystem
         * then we need to use a different deallocator. */
        if (jack->registered)
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 36d7a5998234..08bfed594a83 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -232,14 +232,11 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
        if (! (runtime = substream->runtime))
                return -ENOTTY;
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (data == NULL)
-                return -ENOMEM;
        /* only fifo_size is different, so just copy all */
-        if (copy_from_user(data, data32, sizeof(*data32))) {
+        data = memdup_user(data32, sizeof(*data32));
-                err = -EFAULT;
+        if (IS_ERR(data))
-                goto error;
+                return PTR_ERR(data);
-        }
        if (refine)
                err = snd_pcm_hw_refine(substream, data);
        else
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index fbb2e391591e..63d088f2265f 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -209,9 +209,11 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
 {
        struct snd_pcm_runtime *runtime = substream->runtime;
        snd_pcm_uframes_t pos;
-        snd_pcm_uframes_t new_hw_ptr, hw_ptr_interrupt, hw_base;
+        snd_pcm_uframes_t old_hw_ptr, new_hw_ptr, hw_ptr_interrupt, hw_base;
-        snd_pcm_sframes_t delta;
+        snd_pcm_sframes_t hdelta, delta;
+        unsigned long jdelta;
+        old_hw_ptr = runtime->status->hw_ptr;
        pos = snd_pcm_update_hw_ptr_pos(substream, runtime);
        if (pos == SNDRV_PCM_POS_XRUN) {
                xrun(substream);
@@ -247,7 +249,30 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                        new_hw_ptr = hw_base + pos;
                }
        }
-        if (delta > runtime->period_size) {
+        hdelta = new_hw_ptr - old_hw_ptr;
+        jdelta = jiffies - runtime->hw_ptr_jiffies;
+        if (((hdelta * HZ) / runtime->rate) > jdelta + HZ/100) {
+                delta = jdelta /
+                        (((runtime->period_size * HZ) / runtime->rate)
+                                                                + HZ/100);
+                hw_ptr_error(substream,
+                             "hw_ptr skipping! [Q] "
+                             "(pos=%ld, delta=%ld, period=%ld, "
+                             "jdelta=%lu/%lu/%lu)\n",
+                             (long)pos, (long)hdelta,
+                             (long)runtime->period_size, jdelta,
+                             ((hdelta * HZ) / runtime->rate), delta);
+                hw_ptr_interrupt = runtime->hw_ptr_interrupt +
+                                   runtime->period_size * delta;
+                if (hw_ptr_interrupt >= runtime->boundary)
+                        hw_ptr_interrupt -= runtime->boundary;
+                /* rebase to interrupt position */
+                hw_base = new_hw_ptr = hw_ptr_interrupt;
+                /* align hw_base to buffer_size */
+                hw_base -= hw_base % runtime->buffer_size;
+                delta = 0;
+        }
+        if (delta > runtime->period_size + runtime->period_size / 2) {
                hw_ptr_error(substream,
                             "Lost interrupts? "
                             "(stream=%i, delta=%ld, intr_ptr=%ld)\n",
@@ -263,6 +288,7 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
        runtime->hw_ptr_base = hw_base;
        runtime->status->hw_ptr = new_hw_ptr;
+        runtime->hw_ptr_jiffies = jiffies;
        runtime->hw_ptr_interrupt = hw_ptr_interrupt;
        return snd_pcm_update_hw_ptr_post(substream, runtime);
@@ -275,6 +301,7 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
        snd_pcm_uframes_t pos;
        snd_pcm_uframes_t old_hw_ptr, new_hw_ptr, hw_base;
        snd_pcm_sframes_t delta;
+        unsigned long jdelta;
        old_hw_ptr = runtime->status->hw_ptr;
        pos = snd_pcm_update_hw_ptr_pos(substream, runtime);
@@ -286,14 +313,15 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
        new_hw_ptr = hw_base + pos;
        delta = new_hw_ptr - old_hw_ptr;
+        jdelta = jiffies - runtime->hw_ptr_jiffies;
        if (delta < 0) {
                delta += runtime->buffer_size;
                if (delta < 0) {
                        hw_ptr_error(substream, 
                                     "Unexpected hw_pointer value [2] "
-                                     "(stream=%i, pos=%ld, old_ptr=%ld)\n",
+                                     "(stream=%i, pos=%ld, old_ptr=%ld, jdelta=%li)\n",
                                     substream->stream, (long)pos,
-                                     (long)old_hw_ptr);
+                                     (long)old_hw_ptr, jdelta);
                        return 0;
                }
                hw_base += runtime->buffer_size;
@@ -301,12 +329,13 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
                        hw_base = 0;
                new_hw_ptr = hw_base + pos;
        }
-        if (delta > runtime->period_size && runtime->periods > 1) {
+        if (((delta * HZ) / runtime->rate) > jdelta + HZ/100) {
                hw_ptr_error(substream,
                             "hw_ptr skipping! "
-                             "(pos=%ld, delta=%ld, period=%ld)\n",
+                             "(pos=%ld, delta=%ld, period=%ld, jdelta=%lu/%lu)\n",
                             (long)pos, (long)delta,
-                             (long)runtime->period_size);
+                             (long)runtime->period_size, jdelta,
+                             ((delta * HZ) / runtime->rate));
                return 0;
        }
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
@@ -315,6 +344,7 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
        runtime->hw_ptr_base = hw_base;
        runtime->status->hw_ptr = new_hw_ptr;
+        runtime->hw_ptr_jiffies = jiffies;
        return snd_pcm_update_hw_ptr_post(substream, runtime);
 }
@@ -1441,6 +1471,7 @@ static int snd_pcm_lib_ioctl_reset(struct snd_pcm_substream *substream,
                runtime->status->hw_ptr %= runtime->buffer_size;
        else
                runtime->status->hw_ptr = 0;
+        runtime->hw_ptr_jiffies = jiffies;
        snd_pcm_stream_unlock_irqrestore(substream, flags);
        return 0;
 }
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index a151fb01ba82..fc6f98e257df 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -327,21 +327,16 @@ static int snd_pcm_hw_refine_user(struct snd_pcm_substream *substream,
        struct snd_pcm_hw_params *params;
        int err;
-        params = kmalloc(sizeof(*params), GFP_KERNEL);
+        params = memdup_user(_params, sizeof(*params));
-        if (!params) {
+        if (IS_ERR(params))
-                err = -ENOMEM;
+                return PTR_ERR(params);
-                goto out;
-        }
-        if (copy_from_user(params, _params, sizeof(*params))) {
-                err = -EFAULT;
-                goto out;
-        }
        err = snd_pcm_hw_refine(substream, params);
        if (copy_to_user(_params, params, sizeof(*params))) {
                if (!err)
                        err = -EFAULT;
        }
-out:
        kfree(params);
        return err;
 }
@@ -465,21 +460,16 @@ static int snd_pcm_hw_params_user(struct snd_pcm_substream *substream,
        struct snd_pcm_hw_params *params;
        int err;
-        params = kmalloc(sizeof(*params), GFP_KERNEL);
+        params = memdup_user(_params, sizeof(*params));
-        if (!params) {
+        if (IS_ERR(params))
-                err = -ENOMEM;
+                return PTR_ERR(params);
-                goto out;
-        }
-        if (copy_from_user(params, _params, sizeof(*params))) {
-                err = -EFAULT;
-                goto out;
-        }
        err = snd_pcm_hw_params(substream, params);
        if (copy_to_user(_params, params, sizeof(*params))) {
                if (!err)
                        err = -EFAULT;
        }
-out:
        kfree(params);
        return err;
 }
@@ -2593,13 +2583,11 @@ static int snd_pcm_playback_ioctl1(struct file *file,
                        return -EFAULT;
                if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
                        return -EFAULT;
-                bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
-                if (bufs == NULL)
+                bufs = memdup_user(xfern.bufs,
-                        return -ENOMEM;
+                                   sizeof(void *) * runtime->channels);
-                if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
+                if (IS_ERR(bufs))
-                        kfree(bufs);
+                        return PTR_ERR(bufs);
-                        return -EFAULT;
-                }
                result = snd_pcm_lib_writev(substream, bufs, xfern.frames);
                kfree(bufs);
                __put_user(result, &_xfern->result);
@@ -2675,13 +2663,11 @@ static int snd_pcm_capture_ioctl1(struct file *file,
                        return -EFAULT;
                if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
                        return -EFAULT;
-                bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
-                if (bufs == NULL)
+                bufs = memdup_user(xfern.bufs,
-                        return -ENOMEM;
+                                   sizeof(void *) * runtime->channels);
-                if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
+                if (IS_ERR(bufs))
-                        kfree(bufs);
+                        return PTR_ERR(bufs);
-                        return -EFAULT;
-                }
                result = snd_pcm_lib_readv(substream, bufs, xfern.frames);
                kfree(bufs);
                __put_user(result, &_xfern->result);
@@ -3312,18 +3298,12 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
        int err;
        params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
+        if (!params)
-                err = -ENOMEM;
+                return -ENOMEM;
-                goto out;
-        }
-        oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
-        if (!oparams) {
-                err = -ENOMEM;
-                goto out;
-        }
-        if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
+        oparams = memdup_user(_oparams, sizeof(*oparams));
-                err = -EFAULT;
+        if (IS_ERR(oparams)) {
+                err = PTR_ERR(oparams);
                goto out;
        }
        snd_pcm_hw_convert_from_old_params(params, oparams);
@@ -3333,9 +3313,10 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
                if (!err)
                        err = -EFAULT;
        }
+        kfree(oparams);
 out:
        kfree(params);
-        kfree(oparams);
        return err;
 }
@@ -3347,17 +3328,12 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
        int err;
        params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
+        if (!params)
-                err = -ENOMEM;
+                return -ENOMEM;
-                goto out;
-        }
+        oparams = memdup_user(_oparams, sizeof(*oparams));
-        oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
+        if (IS_ERR(oparams)) {
-        if (!oparams) {
+                err = PTR_ERR(oparams);
-                err = -ENOMEM;
-                goto out;
-        }
-        if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
-                err = -EFAULT;
                goto out;
        }
        snd_pcm_hw_convert_from_old_params(params, oparams);
@@ -3367,9 +3343,10 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
                if (!err)
                        err = -EFAULT;
        }
+        kfree(oparams);
 out:
        kfree(params);
-        kfree(oparams);
        return err;
 }
 #endif /* CONFIG_SND_SUPPORT_OLD_API */
diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
index 38693f47c262..c956fe462569 100644
--- a/sound/core/seq/seq_compat.c
+++ b/sound/core/seq/seq_compat.c
@@ -48,12 +48,11 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
        struct snd_seq_port_info *data;
        mm_segment_t fs;
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        data = memdup_user(data32, sizeof(*data32));
-        if (! data)
+        if (IS_ERR(data))
-                return -ENOMEM;
+                return PTR_ERR(data);
-        if (copy_from_user(data, data32, sizeof(*data32)) ||
+        if (get_user(data->flags, &data32->flags) ||
-            get_user(data->flags, &data32->flags) ||
            get_user(data->time_queue, &data32->time_queue))
                goto error;
        data->kernel = NULL;
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 3f0050d0b71e..8f8b17ac074d 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1395,13 +1395,10 @@ static int snd_timer_user_ginfo(struct file *file,
        struct list_head *p;
        int err = 0;
-        ginfo = kmalloc(sizeof(*ginfo), GFP_KERNEL);
+        ginfo = memdup_user(_ginfo, sizeof(*ginfo));
-        if (! ginfo)
+        if (IS_ERR(ginfo))
-                return -ENOMEM;
+                return PTR_ERR(ginfo);
-        if (copy_from_user(ginfo, _ginfo, sizeof(*ginfo))) {
-                kfree(ginfo);
-                return -EFAULT;
-        }
        tid = ginfo->tid;
        memset(ginfo, 0, sizeof(*ginfo));
        ginfo->tid = tid;
diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index 49037d074c71..bdc8dde4e4a2 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -684,15 +684,16 @@ static int snd_sb_csp_load(struct snd_sb_csp * p, const unsigned char *buf, int
 
 static int snd_sb_csp_load_user(struct snd_sb_csp * p, const unsigned char __user *buf, int size, int load_flags)
 {
-        int err = -ENOMEM;
+        int err;
-        unsigned char *kbuf = kmalloc(size, GFP_KERNEL);
+        unsigned char *kbuf;
-        if (kbuf) {
-                if (copy_from_user(kbuf, buf, size))
+        kbuf = memdup_user(buf, size);
-                        err = -EFAULT;
+        if (IS_ERR(kbuf))
-                else
+                return PTR_ERR(kbuf);
-                        err = snd_sb_csp_load(p, kbuf, size, load_flags);
-                kfree(kbuf);
+        err = snd_sb_csp_load(p, kbuf, size, load_flags);
-        }
+        kfree(kbuf);
        return err;
 }
diff --git a/sound/isa/wavefront/wavefront_fx.c b/sound/isa/wavefront/wavefront_fx.c
index a4345fc07561..2bb1cee09255 100644
--- a/sound/isa/wavefront/wavefront_fx.c
+++ b/sound/isa/wavefront/wavefront_fx.c
@@ -202,15 +202,11 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file,
                                            "> 512 bytes to FX\n");
                                return -EIO;
                        }
-                        page_data = kmalloc(r.data[2] * sizeof(short), GFP_KERNEL);
+                        page_data = memdup_user((unsigned char __user *)
-                        if (!page_data)
+                                                r.data[3],
-                                return -ENOMEM;
+                                                r.data[2] * sizeof(short));
-                        if (copy_from_user (page_data,
+                        if (IS_ERR(page_data))
-                                            (unsigned char __user *) r.data[3],
+                                return PTR_ERR(page_data);
-                                            r.data[2] * sizeof(short))) {
-                                kfree(page_data);
-                                return -EFAULT;
-                        }
                        pd = page_data;
                }
diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
index beb312cca75b..5d4ff48c4345 100644
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -1664,12 +1664,11 @@ snd_wavefront_synth_ioctl (struct snd_hwdep *hw, struct file *file,
                break;
        case WFCTL_WFCMD:
-                wc = kmalloc(sizeof(*wc), GFP_KERNEL);
+                wc = memdup_user(argp, sizeof(*wc));
-                if (! wc)
+                if (IS_ERR(wc))
-                        return -ENOMEM;
+                        return PTR_ERR(wc);
-                if (copy_from_user (wc, argp, sizeof (*wc)))
-                        err = -EFAULT;
+                if (wavefront_synth_control (acard, wc) < 0)
-                else if (wavefront_synth_control (acard, wc) < 0)
                        err = -EIO;
                else if (copy_to_user (argp, wc, sizeof (*wc)))
                        err = -EFAULT;
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index 191e1cd9997d..4b302d86f5f2 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -2493,24 +2493,17 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
        case SNDRV_EMU10K1_IOCTL_CODE_POKE:
                if (!capable(CAP_SYS_ADMIN))
                        return -EPERM;
-                icode = kmalloc(sizeof(*icode), GFP_KERNEL);
-                if (icode == NULL)
+                icode = memdup_user(argp, sizeof(*icode));
-                        return -ENOMEM;
+                if (IS_ERR(icode))
-                if (copy_from_user(icode, argp, sizeof(*icode))) {
+                        return PTR_ERR(icode);
-                        kfree(icode);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_icode_poke(emu, icode);
                kfree(icode);
                return res;
        case SNDRV_EMU10K1_IOCTL_CODE_PEEK:
-                icode = kmalloc(sizeof(*icode), GFP_KERNEL);
+                icode = memdup_user(argp, sizeof(*icode));
-                if (icode == NULL)
+                if (IS_ERR(icode))
-                        return -ENOMEM;
+                        return PTR_ERR(icode);
-                if (copy_from_user(icode, argp, sizeof(*icode))) {
-                        kfree(icode);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_icode_peek(emu, icode);
                if (res == 0 && copy_to_user(argp, icode, sizeof(*icode))) {
                        kfree(icode);
@@ -2519,24 +2512,16 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
                kfree(icode);
                return res;
        case SNDRV_EMU10K1_IOCTL_PCM_POKE:
-                ipcm = kmalloc(sizeof(*ipcm), GFP_KERNEL);
+                ipcm = memdup_user(argp, sizeof(*ipcm));
-                if (ipcm == NULL)
+                if (IS_ERR(ipcm))
-                        return -ENOMEM;
+                        return PTR_ERR(ipcm);
-                if (copy_from_user(ipcm, argp, sizeof(*ipcm))) {
-                        kfree(ipcm);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_ipcm_poke(emu, ipcm);
                kfree(ipcm);
                return res;
        case SNDRV_EMU10K1_IOCTL_PCM_PEEK:
-                ipcm = kzalloc(sizeof(*ipcm), GFP_KERNEL);
+                ipcm = memdup_user(argp, sizeof(*ipcm));
-                if (ipcm == NULL)
+                if (IS_ERR(ipcm))
-                        return -ENOMEM;
+                        return PTR_ERR(ipcm);
-                if (copy_from_user(ipcm, argp, sizeof(*ipcm))) {
-                        kfree(ipcm);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_ipcm_peek(emu, ipcm);
                if (res == 0 && copy_to_user(argp, ipcm, sizeof(*ipcm))) {
                        kfree(ipcm);
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index a4e5e5952115..fd6e6f337d10 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2250,7 +2250,11 @@ int snd_hda_codec_write_cache(struct hda_codec *codec, hda_nid_t nid,
        err = bus->ops.command(bus, res);
        if (!err) {
                struct hda_cache_head *c;
-                u32 key = build_cmd_cache_key(nid, verb);
+                u32 key;
+                /* parm may contain the verb stuff for get/set amp */
+                verb = verb | (parm >> 8);
+                parm &= 0xff;
+                key = build_cmd_cache_key(nid, verb);
                c = get_alloc_hash(&codec->cmd_cache, key);
                if (c)
                        c->val = parm;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 7ba8db5d4c42..bc882f8f163c 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -312,6 +312,9 @@ struct azx_dev {
        unsigned int period_bytes; /* size of the period in bytes */
        unsigned int frags;     /* number for period in the play buffer */
        unsigned int fifo_size; /* FIFO size */
+        unsigned int start_flag: 1;     /* stream full start flag */
+        unsigned long start_jiffies;    /* start + minimum jiffies */
+        unsigned long min_jiffies;      /* minimum jiffies before position is valid */
        void __iomem *sd_addr;  /* stream descriptor pointer */
@@ -330,7 +333,6 @@ struct azx_dev {
        unsigned int opened :1;
        unsigned int running :1;
        unsigned int irq_pending :1;
-        unsigned int irq_ignore :1;
        /*
         * For VIA:
         *  A flag to ensure DMA position is 0
@@ -975,7 +977,7 @@ static irqreturn_t azx_interrupt(int irq, void *dev_id)
        struct azx *chip = dev_id;
        struct azx_dev *azx_dev;
        u32 status;
-        int i;
+        int i, ok;
        spin_lock(&chip->reg_lock);
@@ -991,18 +993,14 @@ static irqreturn_t azx_interrupt(int irq, void *dev_id)
                        azx_sd_writeb(azx_dev, SD_STS, SD_INT_MASK);
                        if (!azx_dev->substream || !azx_dev->running)
                                continue;
-                        /* ignore the first dummy IRQ (due to pos_adj) */
-                        if (azx_dev->irq_ignore) {
-                                azx_dev->irq_ignore = 0;
-                                continue;
-                        }
                        /* check whether this IRQ is really acceptable */
-                        if (azx_position_ok(chip, azx_dev)) {
+                        ok = azx_position_ok(chip, azx_dev);
+                        if (ok == 1) {
                                azx_dev->irq_pending = 0;
                                spin_unlock(&chip->reg_lock);
                                snd_pcm_period_elapsed(azx_dev->substream);
                                spin_lock(&chip->reg_lock);
-                        } else if (chip->bus && chip->bus->workq) {
+                        } else if (ok == 0 && chip->bus && chip->bus->workq) {
                                /* bogus IRQ, process it later */
                                azx_dev->irq_pending = 1;
                                queue_work(chip->bus->workq,
@@ -1088,7 +1086,6 @@ static int azx_setup_periods(struct azx *chip,
        bdl = (u32 *)azx_dev->bdl.area;
        ofs = 0;
        azx_dev->frags = 0;
-        azx_dev->irq_ignore = 0;
        pos_adj = bdl_pos_adj[chip->dev_index];
        if (pos_adj > 0) {
                struct snd_pcm_runtime *runtime = substream->runtime;
@@ -1109,7 +1106,6 @@ static int azx_setup_periods(struct azx *chip,
                                         &bdl, ofs, pos_adj, 1);
                        if (ofs < 0)
                                goto error;
-                        azx_dev->irq_ignore = 1;
                }
        } else
                pos_adj = 0;
@@ -1155,6 +1151,9 @@ static void azx_stream_reset(struct azx *chip, struct azx_dev *azx_dev)
        while (((val = azx_sd_readb(azx_dev, SD_CTL)) & SD_CTL_STREAM_RESET) &&
               --timeout)
                ;
+        /* reset first position - may not be synced with hw at this time */
+        *azx_dev->posbuf = 0;
 }
 /*
@@ -1409,7 +1408,6 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
        snd_pcm_set_sync(substream);
        mutex_unlock(&chip->open_mutex);
-        azx_stream_reset(chip, azx_dev);
        return 0;
 }
@@ -1474,6 +1472,7 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
        unsigned int bufsize, period_bytes, format_val;
        int err;
+        azx_stream_reset(chip, azx_dev);
        format_val = snd_hda_calc_stream_format(runtime->rate,
                                                runtime->channels,
                                                runtime->format,
@@ -1502,6 +1501,8 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
                        return err;
        }
+        azx_dev->min_jiffies = (runtime->period_size * HZ) /
+                                                (runtime->rate * 2);
        azx_setup_controller(chip, azx_dev);
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                azx_dev->fifo_size = azx_sd_readw(azx_dev, SD_FIFOSIZE) + 1;
@@ -1518,13 +1519,14 @@ static int azx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
        struct azx *chip = apcm->chip;
        struct azx_dev *azx_dev;
        struct snd_pcm_substream *s;
-        int start, nsync = 0, sbits = 0;
+        int rstart = 0, start, nsync = 0, sbits = 0;
        int nwait, timeout;
        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+                rstart = 1;
        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
        case SNDRV_PCM_TRIGGER_RESUME:
-        case SNDRV_PCM_TRIGGER_START:
                start = 1;
                break;
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
@@ -1554,6 +1556,10 @@ static int azx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
                if (s->pcm->card != substream->pcm->card)
                        continue;
                azx_dev = get_azx_dev(s);
+                if (rstart) {
+                        azx_dev->start_flag = 1;
+                        azx_dev->start_jiffies = jiffies + azx_dev->min_jiffies;
+                }
                if (start)
                        azx_stream_start(chip, azx_dev);
                else
@@ -1703,6 +1709,11 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
 {
        unsigned int pos;
+        if (azx_dev->start_flag &&
+            time_before_eq(jiffies, azx_dev->start_jiffies))
+                return -1;      /* bogus (too early) interrupt */
+        azx_dev->start_flag = 0;
        pos = azx_get_position(chip, azx_dev);
        if (chip->position_fix == POS_FIX_AUTO) {
                if (!pos) {
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 1f2ad76ca94b..56ce19e68cb5 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -350,12 +350,20 @@ static int conexant_mux_enum_put(struct snd_kcontrol *kcontrol,
 }
 #ifdef CONFIG_SND_JACK
+static void conexant_free_jack_priv(struct snd_jack *jack)
+{
+        struct conexant_jack *jacks = jack->private_data;
+        jacks->nid = 0;
+        jacks->jack = NULL;
+}
 static int conexant_add_jack(struct hda_codec *codec,
                hda_nid_t nid, int type)
 {
        struct conexant_spec *spec;
        struct conexant_jack *jack;
        const char *name;
+        int err;
        spec = codec->spec;
        snd_array_init(&spec->jacks, sizeof(*jack), 32);
@@ -368,7 +376,12 @@ static int conexant_add_jack(struct hda_codec *codec,
        jack->nid = nid;
        jack->type = type;
-        return snd_jack_new(codec->bus->card, name, type, &jack->jack);
+        err = snd_jack_new(codec->bus->card, name, type, &jack->jack);
+        if (err < 0)
+                return err;
+        jack->jack->private_data = jack;
+        jack->jack->private_free = conexant_free_jack_priv;
+        return 0;
 }
 static void conexant_report_jack(struct hda_codec *codec, hda_nid_t nid)
@@ -455,8 +468,10 @@ static void conexant_free(struct hda_codec *codec)
        if (spec->jacks.list) {
                struct conexant_jack *jacks = spec->jacks.list;
                int i;
-                for (i = 0; i < spec->jacks.used; i++)
+                for (i = 0; i < spec->jacks.used; i++, jacks++) {
-                        snd_device_free(codec->bus->card, &jacks[i].jack);
+                        if (jacks->jack)
+                                snd_device_free(codec->bus->card, jacks->jack);
+                }
                snd_array_free(&spec->jacks);
        }
 #endif
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f35e58a2d921..6ed787eedd06 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8742,10 +8742,9 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
        SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC883_LAPTOP_EAPD),
        SND_PCI_QUIRK(0x15d9, 0x8780, "Supermicro PDSBA", ALC883_3ST_6ch),
        SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_MEDION),
-        SND_PCI_QUIRK(0x1734, 0x1107, "FSC AMILO Xi2550",
+        SND_PCI_QUIRK_MASK(0x1734, 0xfff0, 0x1100, "FSC AMILO Xi/Pi25xx",
                      ALC883_FUJITSU_PI2515),
-        SND_PCI_QUIRK(0x1734, 0x1108, "Fujitsu AMILO Pi2515", ALC883_FUJITSU_PI2515),
+        SND_PCI_QUIRK_MASK(0x1734, 0xfff0, 0x1130, "Fujitsu AMILO Xa35xx",
-        SND_PCI_QUIRK(0x1734, 0x113d, "Fujitsu AMILO Xa3530",
                ALC888_FUJITSU_XA3530),
        SND_PCI_QUIRK(0x17aa, 0x101e, "Lenovo 101e", ALC883_LENOVO_101E_2ch),
        SND_PCI_QUIRK(0x17aa, 0x2085, "Lenovo NB0763", ALC883_LENOVO_NB0763),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 61996a2f45df..ce30b459aee6 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -3851,6 +3851,15 @@ static void stac_gpio_set(struct hda_codec *codec, unsigned int mask,
                           AC_VERB_SET_GPIO_DATA, gpiostate); /* sync */
 }
+#ifdef CONFIG_SND_JACK
+static void stac92xx_free_jack_priv(struct snd_jack *jack)
+{
+        struct sigmatel_jack *jacks = jack->private_data;
+        jacks->nid = 0;
+        jacks->jack = NULL;
+}
+#endif
 static int stac92xx_add_jack(struct hda_codec *codec,
                hda_nid_t nid, int type)
 {
@@ -3860,6 +3869,7 @@ static int stac92xx_add_jack(struct hda_codec *codec,
        int def_conf = snd_hda_codec_get_pincfg(codec, nid);
        int connectivity = get_defcfg_connect(def_conf);
        char name[32];
+        int err;
        if (connectivity && connectivity != AC_JACK_PORT_FIXED)
                return 0;
@@ -3876,10 +3886,15 @@ static int stac92xx_add_jack(struct hda_codec *codec,
                snd_hda_get_jack_connectivity(def_conf),
                snd_hda_get_jack_location(def_conf));
-        return snd_jack_new(codec->bus->card, name, type, &jack->jack);
+        err = snd_jack_new(codec->bus->card, name, type, &jack->jack);
-#else
+        if (err < 0) {
-        return 0;
+                jack->nid = 0;
+                return err;
+        }
+        jack->jack->private_data = jack;
+        jack->jack->private_free = stac92xx_free_jack_priv;
 #endif
+        return 0;
 }
 static int stac_add_event(struct sigmatel_spec *spec, hda_nid_t nid,
@@ -4138,8 +4153,10 @@ static void stac92xx_free_jacks(struct hda_codec *codec)
        if (!codec->bus->shutdown && spec->jacks.list) {
                struct sigmatel_jack *jacks = spec->jacks.list;
                int i;
-                for (i = 0; i < spec->jacks.used; i++)
+                for (i = 0; i < spec->jacks.used; i++, jacks++) {
-                        snd_device_free(codec->bus->card, &jacks[i].jack);
+                        if (jacks->jack)
+                                snd_device_free(codec->bus->card, jacks->jack);
+                }
        }
        snd_array_free(&spec->jacks);
 #endif
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 57648810eaf1..5dced5b79387 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -355,6 +355,9 @@ struct ichdev {
        unsigned int fragsize1;
        unsigned int position;
        unsigned int pos_shift;
+        unsigned int last_pos;
+        unsigned long last_pos_jiffies;
+        unsigned int jiffy_to_bytes;
        int frags;
        int lvi;
        int lvi_frag;
@@ -838,7 +841,10 @@ static int snd_intel8x0_pcm_trigger(struct snd_pcm_substream *substream, int cmd
                ichdev->suspended = 0;
                /* fallthru */
        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
                val = ICH_IOCE | ICH_STARTBM;
+                ichdev->last_pos = ichdev->position;
+                ichdev->last_pos_jiffies = jiffies;
                break;
        case SNDRV_PCM_TRIGGER_SUSPEND:
                ichdev->suspended = 1;
@@ -849,9 +855,6 @@ static int snd_intel8x0_pcm_trigger(struct snd_pcm_substream *substream, int cmd
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                val = ICH_IOCE;
                break;
-        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                val = ICH_IOCE | ICH_STARTBM;
-                break;
        default:
                return -EINVAL;
        }
@@ -1045,6 +1048,7 @@ static int snd_intel8x0_pcm_prepare(struct snd_pcm_substream *substream)
                        ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1;
        }
        snd_intel8x0_setup_periods(chip, ichdev);
+        ichdev->jiffy_to_bytes = (runtime->rate * 4 * ichdev->pos_shift) / HZ;
        return 0;
 }
@@ -1053,7 +1057,7 @@ static snd_pcm_uframes_t snd_intel8x0_pcm_pointer(struct snd_pcm_substream *subs
        struct intel8x0 *chip = snd_pcm_substream_chip(substream);
        struct ichdev *ichdev = get_ichdev(substream);
        size_t ptr1, ptr;
-        int civ, timeout = 100;
+        int civ, timeout = 10;
        unsigned int position;
        spin_lock(&chip->reg_lock);
@@ -1069,9 +1073,19 @@ static snd_pcm_uframes_t snd_intel8x0_pcm_pointer(struct snd_pcm_substream *subs
                    ptr1 == igetword(chip, ichdev->reg_offset + ichdev->roff_picb))
                        break;
        } while (timeout--);
-        ptr1 <<= ichdev->pos_shift;
+        if (ptr1 != 0) {
-        ptr = ichdev->fragsize1 - ptr1;
+                ptr1 <<= ichdev->pos_shift;
-        ptr += position;
+                ptr = ichdev->fragsize1 - ptr1;
+                ptr += position;
+                ichdev->last_pos = ptr;
+                ichdev->last_pos_jiffies = jiffies;
+        } else {
+                ptr1 = jiffies - ichdev->last_pos_jiffies;
+                if (ptr1)
+                        ptr1 -= 1;
+                ptr = ichdev->last_pos + ptr1 * ichdev->jiffy_to_bytes;
+                ptr %= ichdev->size;
+        }
        spin_unlock(&chip->reg_lock);
        if (ptr >= ichdev->size)
                return 0;
@@ -2661,12 +2675,14 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
        struct snd_pcm_substream *subs;
        struct ichdev *ichdev;
        unsigned long port;
-        unsigned long pos, t;
+        unsigned long pos, pos1, t;
-        struct timeval start_time, stop_time;
+        int civ, timeout = 1000, attempt = 1;
+        struct timespec start_time, stop_time;
        if (chip->ac97_bus->clock != 48000)
                return; /* specified in module option */
+      __again:
        subs = chip->pcm[0]->streams[0].substream;
        if (! subs || subs->dma_buffer.bytes < INTEL8X0_TESTBUF_SIZE) {
                snd_printk(KERN_WARNING "no playback buffer allocated - aborting measure ac97 clock\n");
@@ -2674,7 +2690,7 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
        }
        ichdev = &chip->ichd[ICHD_PCMOUT];
        ichdev->physbuf = subs->dma_buffer.addr;
-        ichdev->size = chip->ichd[ICHD_PCMOUT].fragsize = INTEL8X0_TESTBUF_SIZE;
+        ichdev->size = ichdev->fragsize = INTEL8X0_TESTBUF_SIZE;
        ichdev->substream = NULL; /* don't process interrupts */
        /* set rate */
@@ -2693,16 +2709,31 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
                iputbyte(chip, port + ICH_REG_OFF_CR, ICH_IOCE);
                iputdword(chip, ICHREG(ALI_DMACR), 1 << ichdev->ali_slot);
        }
-        do_gettimeofday(&start_time);
+        do_posix_clock_monotonic_gettime(&start_time);
        spin_unlock_irq(&chip->reg_lock);
        msleep(50);
        spin_lock_irq(&chip->reg_lock);
        /* check the position */
-        pos = ichdev->fragsize1;
+        do {
-        pos -= igetword(chip, ichdev->reg_offset + ichdev->roff_picb) << ichdev->pos_shift;
+                civ = igetbyte(chip, ichdev->reg_offset + ICH_REG_OFF_CIV);
-        pos += ichdev->position;
+                pos1 = igetword(chip, ichdev->reg_offset + ichdev->roff_picb);
+                if (pos1 == 0) {
+                        udelay(10);
+                        continue;
+                }
+                if (civ == igetbyte(chip, ichdev->reg_offset + ICH_REG_OFF_CIV) &&
+                    pos1 == igetword(chip, ichdev->reg_offset + ichdev->roff_picb))
+                        break;
+        } while (timeout--);
+        if (pos1 == 0) {        /* oops, this value is not reliable */
+                pos = 0;
+        } else {
+                pos = ichdev->fragsize1;
+                pos -= pos1 << ichdev->pos_shift;
+                pos += ichdev->position;
+        }
        chip->in_measurement = 0;
-        do_gettimeofday(&stop_time);
+        do_posix_clock_monotonic_gettime(&stop_time);
        /* stop */
        if (chip->device_type == DEVICE_ALI) {
                iputdword(chip, ICHREG(ALI_DMACR), 1 << (ichdev->ali_slot + 16));
@@ -2717,19 +2748,37 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
        iputbyte(chip, port + ICH_REG_OFF_CR, ICH_RESETREGS);
        spin_unlock_irq(&chip->reg_lock);
+        if (pos == 0) {
+                snd_printk(KERN_ERR "intel8x0: measure - unreliable DMA position..\n");
+              __retry:
+                if (attempt < 2) {
+                        attempt++;
+                        goto __again;
+                }
+                return;
+        }
+        pos /= 4;
        t = stop_time.tv_sec - start_time.tv_sec;
        t *= 1000000;
-        t += stop_time.tv_usec - start_time.tv_usec;
+        t += (stop_time.tv_nsec - start_time.tv_nsec) / 1000;
-        printk(KERN_INFO "%s: measured %lu usecs\n", __func__, t);
+        printk(KERN_INFO "%s: measured %lu usecs (%lu samples)\n", __func__, t, pos);
        if (t == 0) {
-                snd_printk(KERN_ERR "?? calculation error..\n");
+                snd_printk(KERN_ERR "intel8x0: ?? calculation error..\n");
-                return;
+                goto __retry;
        }
-        pos = (pos / 4) * 1000;
+        pos *= 1000;
        pos = (pos / t) * 1000 + ((pos % t) * 1000) / t;
-        if (pos < 40000 || pos >= 60000) 
+        if (pos < 40000 || pos >= 60000) {
                /* abnormal value. hw problem? */
                printk(KERN_INFO "intel8x0: measured clock %ld rejected\n", pos);
+                goto __retry;
+        } else if (pos > 40500 && pos < 41500)
+                /* first exception - 41000Hz reference clock */
+                chip->ac97_bus->clock = 41000;
+        else if (pos > 43600 && pos < 44600)
+                /* second exception - 44100HZ reference clock */
+                chip->ac97_bus->clock = 44100;
        else if (pos < 47500 || pos > 48500)
                /* not 48000Hz, tuning the clock.. */
                chip->ac97_bus->clock = (chip->ac97_bus->clock * 48000) / pos;
diff --git a/sound/soc/pxa/magician.c b/sound/soc/pxa/magician.c
index f7c4544f7859..0625c342a1c9 100644
--- a/sound/soc/pxa/magician.c
+++ b/sound/soc/pxa/magician.c
@@ -27,8 +27,6 @@
 #include <sound/soc.h>
 #include <sound/soc-dapm.h>
-#include <mach/pxa-regs.h>
-#include <mach/hardware.h>
 #include <mach/magician.h>
 #include <asm/mach-types.h>
 #include "../codecs/uda1380.h"
diff --git a/sound/soc/s3c24xx/Kconfig b/sound/soc/s3c24xx/Kconfig
index 2f3a21eee051..df494d1e346f 100644
--- a/sound/soc/s3c24xx/Kconfig
+++ b/sound/soc/s3c24xx/Kconfig
@@ -1,10 +1,10 @@
 config SND_S3C24XX_SOC
        tristate "SoC Audio for the Samsung S3CXXXX chips"
-        depends on ARCH_S3C2410 || ARCH_S3C64XX
+        depends on ARCH_S3C2410
        help
          Say Y or M if you want to add support for codecs attached to
-          the S3C24XX and S3C64XX AC97, I2S or SSP interface. You will
+          the S3C24XX AC97 or I2S interfaces. You will also need to
-          also need to select the audio interfaces to support below.
+          select the audio interfaces to support below.
 config SND_S3C24XX_SOC_I2S
        tristate
diff --git a/sound/usb/caiaq/Makefile b/sound/usb/caiaq/Makefile
index 23dadd5a11cd..388999653aaa 100644
--- a/sound/usb/caiaq/Makefile
+++ b/sound/usb/caiaq/Makefile
@@ -1,4 +1,4 @@
-snd-usb-caiaq-y := caiaq-device.o caiaq-audio.o caiaq-midi.o caiaq-control.o
+snd-usb-caiaq-y := device.o audio.o midi.o control.o
-snd-usb-caiaq-$(CONFIG_SND_USB_CAIAQ_INPUT) += caiaq-input.o
+snd-usb-caiaq-$(CONFIG_SND_USB_CAIAQ_INPUT) += input.o
 obj-$(CONFIG_SND_USB_CAIAQ) += snd-usb-caiaq.o
diff --git a/sound/usb/caiaq/caiaq-audio.c b/sound/usb/caiaq/audio.c
index 08d51e0c9fea..3f45c0fe61ab 100644
--- a/sound/usb/caiaq/caiaq-audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -16,20 +16,14 @@
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
+#include <linux/spinlock.h>
 #include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/interrupt.h>
 #include <linux/usb.h>
-#include <linux/spinlock.h>
 #include <sound/core.h>
-#include <sound/initval.h>
 #include <sound/pcm.h>
-#include <sound/rawmidi.h>
-#include <linux/input.h>
-#include "caiaq-device.h"
+#include "device.h"
-#include "caiaq-audio.h"
+#include "audio.h"
 #define N_URBS                  32
 #define CLOCK_DRIFT_TOLERANCE   5
diff --git a/sound/usb/caiaq/caiaq-audio.h b/sound/usb/caiaq/audio.h
index 8ab1f8d9529e..8ab1f8d9529e 100644
--- a/sound/usb/caiaq/caiaq-audio.h
+++ b/sound/usb/caiaq/audio.h
diff --git a/sound/usb/caiaq/caiaq-control.c b/sound/usb/caiaq/control.c
index e92c2bbf4fe9..537102ba6b9d 100644
--- a/sound/usb/caiaq/caiaq-control.c
+++ b/sound/usb/caiaq/control.c
@@ -18,17 +18,13 @@
 */
 #include <linux/init.h>
-#include <linux/interrupt.h>
 #include <linux/usb.h>
+#include <sound/control.h>
 #include <sound/core.h>
-#include <sound/initval.h>
 #include <sound/pcm.h>
-#include <sound/rawmidi.h>
-#include <sound/control.h>
-#include <linux/input.h>
-#include "caiaq-device.h"
+#include "device.h"
-#include "caiaq-control.h"
+#include "control.h"
 #define CNT_INTVAL 0x10000
diff --git a/sound/usb/caiaq/caiaq-control.h b/sound/usb/caiaq/control.h
index 2e7ab1aa4fb3..2e7ab1aa4fb3 100644
--- a/sound/usb/caiaq/caiaq-control.h
+++ b/sound/usb/caiaq/control.h
diff --git a/sound/usb/caiaq/caiaq-device.c b/sound/usb/caiaq/device.c
index cf573a982fdc..6d517705da0e 100644
--- a/sound/usb/caiaq/caiaq-device.c
+++ b/sound/usb/caiaq/device.c
@@ -19,27 +19,20 @@
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
-#include <linux/init.h>
-#include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/init.h>
 #include <linux/usb.h>
-#include <linux/input.h>
-#include <linux/spinlock.h>
-#include <sound/core.h>
 #include <sound/initval.h>
+#include <sound/core.h>
 #include <sound/pcm.h>
-#include <sound/rawmidi.h>
-#include <sound/control.h>
-#include "caiaq-device.h"
-#include "caiaq-audio.h"
-#include "caiaq-midi.h"
-#include "caiaq-control.h"
-#ifdef CONFIG_SND_USB_CAIAQ_INPUT
+#include "device.h"
-#include "caiaq-input.h"
+#include "audio.h"
-#endif
+#include "midi.h"
+#include "control.h"
+#include "input.h"
 MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
 MODULE_DESCRIPTION("caiaq USB audio, version 1.3.13");
diff --git a/sound/usb/caiaq/caiaq-device.h b/sound/usb/caiaq/device.h
index 4cce1ad7493d..4cce1ad7493d 100644
--- a/sound/usb/caiaq/caiaq-device.h
+++ b/sound/usb/caiaq/device.h
diff --git a/sound/usb/caiaq/caiaq-input.c b/sound/usb/caiaq/input.c
index f743847a5e5a..a48d309bd94c 100644
--- a/sound/usb/caiaq/caiaq-input.c
+++ b/sound/usb/caiaq/input.c
@@ -17,17 +17,12 @@
 */
 #include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/input.h>
 #include <linux/usb.h>
 #include <linux/usb/input.h>
-#include <linux/spinlock.h>
-#include <sound/core.h>
-#include <sound/rawmidi.h>
 #include <sound/pcm.h>
-#include "caiaq-device.h"
-#include "caiaq-input.h"
+#include "device.h"
+#include "input.h"
 static unsigned short keycode_ak1[] =  { KEY_C, KEY_B, KEY_A };
 static unsigned short keycode_rk2[] =  { KEY_1, KEY_2, KEY_3, KEY_4,
diff --git a/sound/usb/caiaq/caiaq-input.h b/sound/usb/caiaq/input.h
index ced535577864..ced535577864 100644
--- a/sound/usb/caiaq/caiaq-input.h
+++ b/sound/usb/caiaq/input.h
diff --git a/sound/usb/caiaq/caiaq-midi.c b/sound/usb/caiaq/midi.c
index f19fd360c936..8fa8cd88d763 100644
--- a/sound/usb/caiaq/caiaq-midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -16,20 +16,13 @@
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/interrupt.h>
 #include <linux/usb.h>
-#include <linux/input.h>
-#include <linux/spinlock.h>
-#include <sound/core.h>
 #include <sound/rawmidi.h>
+#include <sound/core.h>
 #include <sound/pcm.h>
-#include "caiaq-device.h"
+#include "device.h"
-#include "caiaq-midi.h"
+#include "midi.h"
 static int snd_usb_caiaq_midi_input_open(struct snd_rawmidi_substream *substream)
 {
diff --git a/sound/usb/caiaq/caiaq-midi.h b/sound/usb/caiaq/midi.h
index 9d16db027fc3..9d16db027fc3 100644
--- a/sound/usb/caiaq/caiaq-midi.h
+++ b/sound/usb/caiaq/midi.h
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index 98276aafefe6..012ff1f6f8af 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -349,14 +349,10 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
        if (cmd != SNDRV_USB_STREAM_IOCTL_SET_PARAMS)
                return -ENOTTY;
-        cfg = kmalloc(sizeof(*cfg), GFP_KERNEL);
+        cfg = memdup_user((void *)arg, sizeof(*cfg));
-        if (!cfg)
+        if (IS_ERR(cfg))
-                return -ENOMEM;
+                return PTR_ERR(cfg);
-        if (copy_from_user(cfg, (void *)arg, sizeof(*cfg))) {
-                err = -EFAULT;
-                goto free;
-        }
        if (cfg->version != USB_STREAM_INTERFACE_VERSION) {
                err = -ENXIO;
                goto free;
diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
index 4af8740db717..f3d8f71265dd 100644
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -203,13 +203,12 @@ static int snd_usX2Y_hwdep_dsp_load(struct snd_hwdep *hw,
        if (access_ok(VERIFY_READ, dsp->image, dsp->length)) {
                struct usb_device* dev = priv->chip.dev;
-                char *buf = kmalloc(dsp->length, GFP_KERNEL);
+                char *buf;
-                if (!buf)
-                        return -ENOMEM;
+                buf = memdup_user(dsp->image, dsp->length);
-                if (copy_from_user(buf, dsp->image, dsp->length)) {
+                if (IS_ERR(buf))
-                        kfree(buf);
+                        return PTR_ERR(buf);
-                        return -EFAULT;
-                }
                err = usb_set_interface(dev, 0, 1);
                if (err)
                        snd_printk(KERN_ERR "usb_set_interface error \n");