125 files changed, 1596 insertions, 1163 deletions
diff --git a/Documentation/block/biodoc.txt b/Documentation/block/biodoc.txt
index ecad6ee75705..6fab97ea7e6b 100644
--- a/Documentation/block/biodoc.txt
+++ b/Documentation/block/biodoc.txt
@@ -1040,23 +1040,21 @@ Front merges are handled by the binary trees in AS and deadline schedulers.
 iii. Plugging the queue to batch requests in anticipation of opportunities for
     merge/sort optimizations
-This is just the same as in 2.4 so far, though per-device unplugging
-support is anticipated for 2.5. Also with a priority-based i/o scheduler,
-such decisions could be based on request priorities.
 Plugging is an approach that the current i/o scheduling algorithm resorts to so
 that it collects up enough requests in the queue to be able to take
 advantage of the sorting/merging logic in the elevator. If the
 queue is empty when a request comes in, then it plugs the request queue
-(sort of like plugging the bottom of a vessel to get fluid to build up)
+(sort of like plugging the bath tub of a vessel to get fluid to build up)
 till it fills up with a few more requests, before starting to service
 the requests. This provides an opportunity to merge/sort the requests before
 passing them down to the device. There are various conditions when the queue is
 unplugged (to open up the flow again), either through a scheduled task or
 could be on demand. For example wait_on_buffer sets the unplugging going
-(by running tq_disk) so the read gets satisfied soon. So in the read case,
+through sync_buffer() running blk_run_address_space(mapping). Or the caller
-the queue gets explicitly unplugged as part of waiting for completion,
+can do it explicity through blk_unplug(bdev). So in the read case,
-in fact all queues get unplugged as a side-effect.
+the queue gets explicitly unplugged as part of waiting for completion on that
+buffer. For page driven IO, the address space ->sync_page() takes care of
+doing the blk_run_address_space().
 Aside:
  This is kind of controversial territory, as it's not clear if plugging is
@@ -1067,11 +1065,6 @@ Aside:
  multi-page bios being queued in one shot, we may not need to wait to merge
  a big request from the broken up pieces coming by.
-  Per-queue granularity unplugging (still a Todo) may help reduce some of the
-  concerns with just a single tq_disk flush approach. Something like
-  blk_kick_queue() to unplug a specific queue (right away ?)
-  or optionally, all queues, is in the plan.
 4.4 I/O contexts
 I/O contexts provide a dynamically allocated per process data area. They may
 be used in I/O schedulers, and in the block layer (could be used for IO statis,
diff --git a/Documentation/powerpc/dts-bindings/fsl/i2c.txt b/Documentation/powerpc/dts-bindings/fsl/i2c.txt
index d0ab33e21fe6..b6d2e21474f9 100644
--- a/Documentation/powerpc/dts-bindings/fsl/i2c.txt
+++ b/Documentation/powerpc/dts-bindings/fsl/i2c.txt
@@ -7,8 +7,10 @@ Required properties :
 Recommended properties :
- - compatible : Should be "fsl-i2c" for parts compatible with
+ - compatible : compatibility list with 2 entries, the first should
-   Freescale I2C specifications.
+   be "fsl,CHIP-i2c" where CHIP is the name of a compatible processor,
+   e.g. mpc8313, mpc8543, mpc8544, mpc5200 or mpc5200b. The second one
+   should be "fsl-i2c".
 - interrupts : <a b> where a is the interrupt number and b is a
   field that represents an encoding of the sense and level
   information for the interrupt.  This should be encoded based on
@@ -16,17 +18,31 @@ Recommended properties :
   controller you have.
 - interrupt-parent : the phandle for the interrupt controller that
   services interrupts for this device.
- - dfsrr : boolean; if defined, indicates that this I2C device has
+ - fsl,preserve-clocking : boolean; if defined, the clock settings
-   a digital filter sampling rate register
+   from the bootloader are preserved (not touched).
- - fsl5200-clocking : boolean; if defined, indicated that this device
+ - clock-frequency : desired I2C bus clock frequency in Hz.
-   uses the FSL 5200 clocking mechanism.
+Examples :
-Example :
-        i2c@3000 {
+        i2c@3d00 {
-                interrupt-parent = <40000>;
+                #address-cells = <1>;
-                interrupts = <1b 3>;
+                #size-cells = <0>;
-                reg = <3000 18>;
+                compatible = "fsl,mpc5200b-i2c","fsl,mpc5200-i2c","fsl-i2c";
-                device_type = "i2c";
+                cell-index = <0>;
-                compatible  = "fsl-i2c";
+                reg = <0x3d00 0x40>;
-                dfsrr;
+                interrupts = <2 15 0>;
+                interrupt-parent = <&mpc5200_pic>;
+                fsl,preserve-clocking;
        };
+        i2c@3100 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                cell-index = <1>;
+                compatible = "fsl,mpc8544-i2c", "fsl-i2c";
+                reg = <0x3100 0x100>;
+                interrupts = <43 2>;
+                interrupt-parent = <&mpic>;
+                clock-frequency = <400000>;
+        };
diff --git a/Documentation/sound/alsa/HD-Audio.txt b/Documentation/sound/alsa/HD-Audio.txt
index c5948f2f9a25..88b7433d2f11 100644
--- a/Documentation/sound/alsa/HD-Audio.txt
+++ b/Documentation/sound/alsa/HD-Audio.txt
@@ -169,7 +169,7 @@ PCI SSID look-up.
 What `model` option values are available depends on the codec chip.
 Check your codec chip from the codec proc file (see "Codec Proc-File"
 section below).  It will show the vendor/product name of your codec
-chip.  Then, see Documentation/sound/alsa/HD-Audio-Modelstxt file,
+chip.  Then, see Documentation/sound/alsa/HD-Audio-Models.txt file,
 the section of HD-audio driver.  You can find a list of codecs
 and `model` options belonging to each codec.  For example, for Realtek
 ALC262 codec chip, pass `model=ultra` for devices that are compatible
@@ -177,7 +177,7 @@ with Samsung Q1 Ultra.
 Thus, the first thing you can do for any brand-new, unsupported and
 non-working HD-audio hardware is to check HD-audio codec and several
-different `model` option values.  If you have a luck, some of them
+different `model` option values.  If you have any luck, some of them
 might suit with your device well.
 Some codecs such as ALC880 have a special model option `model=test`.
diff --git a/arch/mn10300/include/asm/bug.h b/arch/mn10300/include/asm/bug.h
index 4fcf3384e259..aa6a38886391 100644
--- a/arch/mn10300/include/asm/bug.h
+++ b/arch/mn10300/include/asm/bug.h
@@ -11,10 +11,12 @@
 #ifndef _ASM_BUG_H
 #define _ASM_BUG_H
+#ifdef CONFIG_BUG
 /*
 * Tell the user there is some problem.
 */
-#define _debug_bug_trap()                                       \
+#define BUG()                                                   \
 do {                                                            \
        asm volatile(                                           \
                "       syscall 15                      \n"     \
@@ -25,11 +27,11 @@ do {								\
                :                                               \
                : "i"(__FILE__), "i"(__LINE__)                  \
                );                                              \
-} while (0)
+} while (1)
-#define BUG() _debug_bug_trap()
 #define HAVE_ARCH_BUG
+#endif /* CONFIG_BUG */
 #include <asm-generic/bug.h>
 #endif /* _ASM_BUG_H */
diff --git a/arch/mn10300/include/asm/unistd.h b/arch/mn10300/include/asm/unistd.h
index 543a4f98695d..fef5b434dadc 100644
--- a/arch/mn10300/include/asm/unistd.h
+++ b/arch/mn10300/include/asm/unistd.h
@@ -344,6 +344,8 @@
 #define __NR_dup3               331
 #define __NR_pipe2              332
 #define __NR_inotify_init1      333
+#define __NR_preadv             334
+#define __NR_pwritev            335
 #ifdef __KERNEL__
diff --git a/arch/mn10300/kernel/entry.S b/arch/mn10300/kernel/entry.S
index 34ab5a293153..3dc3e462f92a 100644
--- a/arch/mn10300/kernel/entry.S
+++ b/arch/mn10300/kernel/entry.S
@@ -723,6 +723,8 @@ ENTRY(sys_call_table)
        .long sys_dup3
        .long sys_pipe2
        .long sys_inotify_init1
+        .long sys_preadv
+        .long sys_pwritev               /* 335 */
 nr_syscalls=(.-sys_call_table)/4
diff --git a/arch/mn10300/kernel/setup.c b/arch/mn10300/kernel/setup.c
index 71414e19fd16..79890edfd67a 100644
--- a/arch/mn10300/kernel/setup.c
+++ b/arch/mn10300/kernel/setup.c
@@ -136,10 +136,6 @@ void __init setup_arch(char **cmdline_p)
        data_resource.start = virt_to_bus(&_etext);
        data_resource.end = virt_to_bus(&_edata)-1;
-#define PFN_UP(x)       (((x) + PAGE_SIZE-1) >> PAGE_SHIFT)
-#define PFN_DOWN(x)     ((x) >> PAGE_SHIFT)
-#define PFN_PHYS(x)     ((x) << PAGE_SHIFT)
        start_pfn = (CONFIG_KERNEL_RAM_BASE_ADDRESS >> PAGE_SHIFT);
        kstart_pfn = PFN_UP(__pa(&_text));
        free_pfn = PFN_UP(__pa(&_end));
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 5b50e1ac6179..4c7804551362 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -462,7 +462,7 @@ config PPC_64K_PAGES
 config PPC_256K_PAGES
        bool "256k page size" if 44x
-        depends on !STDBINUTILS && (!SHMEM || BROKEN)
+        depends on !STDBINUTILS
        help
          Make the page size 256k.
diff --git a/arch/powerpc/boot/dts/tqm8540.dts b/arch/powerpc/boot/dts/tqm8540.dts
index 231bae756637..b6f1fc6eb960 100644
--- a/arch/powerpc/boot/dts/tqm8540.dts
+++ b/arch/powerpc/boot/dts/tqm8540.dts
@@ -84,9 +84,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/boot/dts/tqm8541.dts b/arch/powerpc/boot/dts/tqm8541.dts
index 4356a1f08295..fa6a3d54a8a5 100644
--- a/arch/powerpc/boot/dts/tqm8541.dts
+++ b/arch/powerpc/boot/dts/tqm8541.dts
@@ -83,9 +83,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/boot/dts/tqm8548-bigflash.dts b/arch/powerpc/boot/dts/tqm8548-bigflash.dts
index 19aa72301c83..00f7ed7a2455 100644
--- a/arch/powerpc/boot/dts/tqm8548-bigflash.dts
+++ b/arch/powerpc/boot/dts/tqm8548-bigflash.dts
@@ -85,9 +85,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
@@ -247,7 +247,7 @@
                        interrupts = <31 2 32 2 33 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi2>;
-                        phy-handle = <&phy3>;
+                        phy-handle = <&phy4>;
                        mdio@520 {
                                #address-cells = <1>;
@@ -275,7 +275,7 @@
                        interrupts = <37 2 38 2 39 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi3>;
-                        phy-handle = <&phy4>;
+                        phy-handle = <&phy5>;
                        mdio@520 {
                                #address-cells = <1>;
diff --git a/arch/powerpc/boot/dts/tqm8548.dts b/arch/powerpc/boot/dts/tqm8548.dts
index 49145a04fc6c..673e4a778ac8 100644
--- a/arch/powerpc/boot/dts/tqm8548.dts
+++ b/arch/powerpc/boot/dts/tqm8548.dts
@@ -85,9 +85,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
@@ -247,7 +247,7 @@
                        interrupts = <31 2 32 2 33 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi2>;
-                        phy-handle = <&phy3>;
+                        phy-handle = <&phy4>;
                        mdio@520 {
                                #address-cells = <1>;
@@ -275,7 +275,7 @@
                        interrupts = <37 2 38 2 39 2>;
                        interrupt-parent = <&mpic>;
                        tbi-handle = <&tbi3>;
-                        phy-handle = <&phy4>;
+                        phy-handle = <&phy5>;
                        mdio@520 {
                                #address-cells = <1>;
diff --git a/arch/powerpc/boot/dts/tqm8555.dts b/arch/powerpc/boot/dts/tqm8555.dts
index 06d366ebbda3..6a99f1eef7ad 100644
--- a/arch/powerpc/boot/dts/tqm8555.dts
+++ b/arch/powerpc/boot/dts/tqm8555.dts
@@ -83,9 +83,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/boot/dts/tqm8560.dts b/arch/powerpc/boot/dts/tqm8560.dts
index feff915e0492..b6c2d71defd3 100644
--- a/arch/powerpc/boot/dts/tqm8560.dts
+++ b/arch/powerpc/boot/dts/tqm8560.dts
@@ -85,9 +85,9 @@
                        interrupt-parent = <&mpic>;
                        dfsrr;
-                        dtt@50 {
+                        dtt@48 {
                                compatible = "national,lm75";
-                                reg = <0x50>;
+                                reg = <0x48>;
                        };
                        rtc@68 {
diff --git a/arch/powerpc/configs/85xx/tqm8548_defconfig b/arch/powerpc/configs/85xx/tqm8548_defconfig
index 0bc45975911a..43030fea2eee 100644
--- a/arch/powerpc/configs/85xx/tqm8548_defconfig
+++ b/arch/powerpc/configs/85xx/tqm8548_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.29-rc2
+# Linux kernel version: 2.6.29-rc7
-# Mon Jan 26 15:36:20 2009
+# Mon Mar 16 09:03:28 2009
 #
 # CONFIG_PPC64 is not set
@@ -22,6 +22,7 @@ CONFIG_FSL_EMB_PERFMON=y
 # CONFIG_PHYS_64BIT is not set
 CONFIG_SPE=y
 CONFIG_PPC_MMU_NOHASH=y
+CONFIG_PPC_BOOK3E_MMU=y
 # CONFIG_PPC_MM_SLICES is not set
 # CONFIG_SMP is not set
 CONFIG_PPC32=y
@@ -75,6 +76,15 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_GROUP_SCHED=y
@@ -152,11 +162,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
-# CONFIG_TREE_RCU is not set
-# CONFIG_PREEMPT_RCU is not set
-# CONFIG_TREE_RCU_TRACE is not set
-# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_FREEZER is not set
 #
@@ -202,7 +207,7 @@ CONFIG_MPIC=y
 #
 # Kernel options
 #
-# CONFIG_HIGHMEM is not set
+CONFIG_HIGHMEM=y
 CONFIG_TICK_ONESHOT=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -244,6 +249,7 @@ CONFIG_UNEVICTABLE_LRU=y
 CONFIG_PPC_4K_PAGES=y
 # CONFIG_PPC_16K_PAGES is not set
 # CONFIG_PPC_64K_PAGES is not set
+# CONFIG_PPC_256K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -259,6 +265,7 @@ CONFIG_ZONE_DMA=y
 CONFIG_PPC_INDIRECT_PCI=y
 CONFIG_FSL_SOC=y
 CONFIG_FSL_PCI=y
+CONFIG_FSL_LBC=y
 CONFIG_PPC_PCI_CHOICE=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
@@ -284,10 +291,11 @@ CONFIG_ARCH_SUPPORTS_MSI=y
 # Default settings for advanced configuration options are used
 #
 CONFIG_LOWMEM_SIZE=0x30000000
+CONFIG_LOWMEM_CAM_NUM=3
 CONFIG_PAGE_OFFSET=0xc0000000
 CONFIG_KERNEL_START=0xc0000000
 CONFIG_PHYSICAL_START=0x00000000
-CONFIG_PHYSICAL_ALIGN=0x10000000
+CONFIG_PHYSICAL_ALIGN=0x04000000
 CONFIG_TASK_SIZE=0xc0000000
 CONFIG_NET=y
@@ -363,12 +371,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
-CONFIG_WIRELESS=y
+# CONFIG_WIRELESS is not set
-# CONFIG_CFG80211 is not set
-CONFIG_WIRELESS_OLD_REGULATORY=y
-# CONFIG_WIRELESS_EXT is not set
-# CONFIG_LIB80211 is not set
-# CONFIG_MAC80211 is not set
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
@@ -471,27 +474,18 @@ CONFIG_MTD_NAND_IDS=y
 # CONFIG_MTD_NAND_NANDSIM is not set
 # CONFIG_MTD_NAND_PLATFORM is not set
 # CONFIG_MTD_NAND_FSL_ELBC is not set
-# CONFIG_MTD_NAND_FSL_UPM is not set
+CONFIG_MTD_NAND_FSL_UPM=y
 # CONFIG_MTD_ONENAND is not set
 #
 # LPDDR flash memory drivers
 #
 # CONFIG_MTD_LPDDR is not set
-# CONFIG_MTD_QINFO_PROBE is not set
 #
 # UBI - Unsorted block images
 #
-CONFIG_MTD_UBI=m
+# CONFIG_MTD_UBI is not set
-CONFIG_MTD_UBI_WL_THRESHOLD=4096
-CONFIG_MTD_UBI_BEB_RESERVE=1
-# CONFIG_MTD_UBI_GLUEBI is not set
-#
-# UBI debugging options
-#
-# CONFIG_MTD_UBI_DEBUG is not set
 CONFIG_OF_DEVICE=y
 CONFIG_OF_I2C=y
 # CONFIG_PARPORT is not set
@@ -515,69 +509,21 @@ CONFIG_BLK_DEV_RAM_SIZE=32768
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
 # CONFIG_C2PORT is not set
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
-CONFIG_IDE=y
+# CONFIG_IDE is not set
-#
-# Please see Documentation/ide/ide.txt for help/info on IDE drives
-#
-CONFIG_IDE_TIMINGS=y
-# CONFIG_BLK_DEV_IDE_SATA is not set
-CONFIG_IDE_GD=y
-CONFIG_IDE_GD_ATA=y
-# CONFIG_IDE_GD_ATAPI is not set
-# CONFIG_BLK_DEV_IDECD is not set
-# CONFIG_BLK_DEV_IDETAPE is not set
-# CONFIG_IDE_TASK_IOCTL is not set
-CONFIG_IDE_PROC_FS=y
-#
-# IDE chipset support/bugfixes
-#
-# CONFIG_BLK_DEV_PLATFORM is not set
-CONFIG_BLK_DEV_IDEDMA_SFF=y
-#
-# PCI IDE chipsets support
-#
-CONFIG_BLK_DEV_IDEPCI=y
-CONFIG_IDEPCI_PCIBUS_ORDER=y
-# CONFIG_BLK_DEV_OFFBOARD is not set
-CONFIG_BLK_DEV_GENERIC=y
-# CONFIG_BLK_DEV_OPTI621 is not set
-CONFIG_BLK_DEV_IDEDMA_PCI=y
-# CONFIG_BLK_DEV_AEC62XX is not set
-# CONFIG_BLK_DEV_ALI15X3 is not set
-# CONFIG_BLK_DEV_AMD74XX is not set
-# CONFIG_BLK_DEV_CMD64X is not set
-# CONFIG_BLK_DEV_TRIFLEX is not set
-# CONFIG_BLK_DEV_CS5520 is not set
-# CONFIG_BLK_DEV_CS5530 is not set
-# CONFIG_BLK_DEV_HPT366 is not set
-# CONFIG_BLK_DEV_JMICRON is not set
-# CONFIG_BLK_DEV_SC1200 is not set
-# CONFIG_BLK_DEV_PIIX is not set
-# CONFIG_BLK_DEV_IT8172 is not set
-# CONFIG_BLK_DEV_IT8213 is not set
-# CONFIG_BLK_DEV_IT821X is not set
-# CONFIG_BLK_DEV_NS87415 is not set
-# CONFIG_BLK_DEV_PDC202XX_OLD is not set
-# CONFIG_BLK_DEV_PDC202XX_NEW is not set
-# CONFIG_BLK_DEV_SVWKS is not set
-# CONFIG_BLK_DEV_SIIMAGE is not set
-# CONFIG_BLK_DEV_SL82C105 is not set
-# CONFIG_BLK_DEV_SLC90E66 is not set
-# CONFIG_BLK_DEV_TRM290 is not set
-CONFIG_BLK_DEV_VIA82CXXX=y
-# CONFIG_BLK_DEV_TC86C001 is not set
-CONFIG_BLK_DEV_IDEDMA=y
 #
 # SCSI device support
@@ -650,7 +596,7 @@ CONFIG_MII=y
 CONFIG_NETDEV_1000=y
 # CONFIG_ACENIC is not set
 # CONFIG_DL2K is not set
-CONFIG_E1000=y
+# CONFIG_E1000 is not set
 # CONFIG_E1000E is not set
 # CONFIG_IP1000 is not set
 # CONFIG_IGB is not set
@@ -668,6 +614,7 @@ CONFIG_GIANFAR=y
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
+# CONFIG_ATL1C is not set
 # CONFIG_JME is not set
 CONFIG_NETDEV_10000=y
 # CONFIG_CHELSIO_T1 is not set
@@ -835,8 +782,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -975,26 +920,7 @@ CONFIG_HID=y
 # Special HID drivers
 #
 CONFIG_HID_COMPAT=y
-CONFIG_USB_SUPPORT=y
+# CONFIG_USB_SUPPORT is not set
-CONFIG_USB_ARCH_HAS_HCD=y
-CONFIG_USB_ARCH_HAS_OHCI=y
-CONFIG_USB_ARCH_HAS_EHCI=y
-# CONFIG_USB is not set
-# CONFIG_USB_OTG_WHITELIST is not set
-# CONFIG_USB_OTG_BLACKLIST_HUB is not set
-#
-# Enable Host or Gadget support to see Inventra options
-#
-#
-# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
-#
-# CONFIG_USB_GADGET is not set
-#
-# OTG and related infrastructure
-#
 # CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
@@ -1064,16 +990,9 @@ CONFIG_RTC_DRV_DS1307=y
 #
 # File systems
 #
-CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS is not set
-# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT3_FS is not set
-# CONFIG_EXT2_FS_XIP is not set
-CONFIG_EXT3_FS=y
-CONFIG_EXT3_FS_XATTR=y
-# CONFIG_EXT3_FS_POSIX_ACL is not set
-# CONFIG_EXT3_FS_SECURITY is not set
 # CONFIG_EXT4_FS is not set
-CONFIG_JBD=y
-CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
@@ -1122,8 +1041,17 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
-# CONFIG_JFFS2_FS is not set
+CONFIG_JFFS2_FS=y
-# CONFIG_UBIFS_FS is not set
+CONFIG_JFFS2_FS_DEBUG=0
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+# CONFIG_JFFS2_SUMMARY is not set
+# CONFIG_JFFS2_FS_XATTR is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
+CONFIG_JFFS2_ZLIB=y
+# CONFIG_JFFS2_LZO is not set
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -1184,6 +1112,8 @@ CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
 # CONFIG_LIBCRC32C is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
 CONFIG_PLIST=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
@@ -1219,6 +1149,7 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_HIGHMEM is not set
 # CONFIG_DEBUG_BUGVERBOSE is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
@@ -1236,6 +1167,7 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
 CONFIG_HAVE_DYNAMIC_FTRACE=y
 CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
index 6d406c5c5de4..9696cc36d2dc 100644
--- a/arch/powerpc/include/asm/futex.h
+++ b/arch/powerpc/include/asm/futex.h
@@ -27,7 +27,7 @@
        PPC_LONG "1b,4b,2b,4b\n" \
        ".previous" \
        : "=&r" (oldval), "=&r" (ret) \
-        : "b" (uaddr), "i" (-EFAULT), "1" (oparg) \
+        : "b" (uaddr), "i" (-EFAULT), "r" (oparg) \
        : "cr0", "memory")
 static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
@@ -47,19 +47,19 @@ static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
        switch (op) {
        case FUTEX_OP_SET:
-                __futex_atomic_op("", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("mr %1,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_ADD:
-                __futex_atomic_op("add %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("add %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_OR:
-                __futex_atomic_op("or %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("or %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_ANDN:
-                __futex_atomic_op("andc %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("andc %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_XOR:
-                __futex_atomic_op("xor %1,%0,%1\n", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("xor %1,%0,%4\n", ret, oldval, uaddr, oparg);
                break;
        default:
                ret = -ENOSYS;
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index cbf154387091..86d2366ab6a1 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -52,6 +52,12 @@
 */
 #define MMU_FTR_NEED_DTLB_SW_LRU        ASM_CONST(0x00200000)
+/* This indicates that the processor uses the wrong opcode for tlbilx
+ * instructions.  During the ISA 2.06 development the opcode for tlbilx
+ * changed and some early implementations used to old opcode
+ */
+#define MMU_FTR_TLBILX_EARLY_OPCODE     ASM_CONST(0x00400000)
 #ifndef __ASSEMBLY__
 #include <asm/cputable.h>
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index f4a4db8d5555..ef4da37f3c10 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -43,7 +43,8 @@
 #define PPC_INST_STSWI                  0x7c0005aa
 #define PPC_INST_STSWX                  0x7c00052a
-#define PPC_INST_TLBILX                 0x7c000626
+#define PPC_INST_TLBILX                 0x7c000024
+#define PPC_INST_TLBILX_EARLY           0x7c000626
 #define PPC_INST_WAIT                   0x7c00007c
 /* macros to insert fields into opcodes */
@@ -63,10 +64,18 @@
 #define PPC_RFDI                stringify_in_c(.long PPC_INST_RFDI)
 #define PPC_RFMCI               stringify_in_c(.long PPC_INST_RFMCI)
 #define PPC_TLBILX(t, a, b)     stringify_in_c(.long PPC_INST_TLBILX | \
-                                        __PPC_T_TLB(t) | __PPC_RA(a) | __PPC_RB(b))
+                                        __PPC_T_TLB(t) | \
+                                        __PPC_RA(a) | __PPC_RB(b))
 #define PPC_TLBILX_ALL(a, b)    PPC_TLBILX(0, a, b)
 #define PPC_TLBILX_PID(a, b)    PPC_TLBILX(1, a, b)
 #define PPC_TLBILX_VA(a, b)     PPC_TLBILX(3, a, b)
+#define PPC_TLBILX_EARLY(t, a, b) stringify_in_c(.long PPC_INST_TLBILX_EARLY | \
+                                                __PPC_T_TLB(t) | \
+                                                __PPC_RA(a) | __PPC_RB(b))
+#define PPC_TLBILX_ALL_EARLY(a, b)      PPC_TLBILX_EARLY(0, a, b)
+#define PPC_TLBILX_PID_EARLY(a, b)      PPC_TLBILX_EARLY(1, a, b)
+#define PPC_TLBILX_VA_EARLY(a, b)       PPC_TLBILX_EARLY(3, a, b)
 #define PPC_WAIT(w)             stringify_in_c(.long PPC_INST_WAIT | \
                                        __PPC_WC(w))
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index cd1b687544f3..57db50f40289 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -1766,7 +1766,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .cpu_features           = CPU_FTRS_E500MC,
                .cpu_user_features      = COMMON_USER_BOOKE | PPC_FEATURE_HAS_FPU,
                .mmu_features           = MMU_FTR_TYPE_FSL_E | MMU_FTR_BIG_PHYS |
-                        MMU_FTR_USE_TLBILX,
+                        MMU_FTR_USE_TLBILX | MMU_FTR_TLBILX_EARLY_OPCODE,
                .icache_bsize           = 64,
                .dcache_bsize           = 64,
                .num_pmcs               = 4,
diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
index 7af72970faed..ad2eb4d34dd4 100644
--- a/arch/powerpc/mm/tlb_nohash.c
+++ b/arch/powerpc/mm/tlb_nohash.c
@@ -125,7 +125,6 @@ static void do_flush_tlb_page_ipi(void *param)
 void flush_tlb_mm(struct mm_struct *mm)
 {
-        cpumask_t cpu_mask;
        unsigned int pid;
        preempt_disable();
diff --git a/arch/powerpc/mm/tlb_nohash_low.S b/arch/powerpc/mm/tlb_nohash_low.S
index 788b87c36f77..45fed3698349 100644
--- a/arch/powerpc/mm/tlb_nohash_low.S
+++ b/arch/powerpc/mm/tlb_nohash_low.S
@@ -138,7 +138,11 @@ BEGIN_MMU_FTR_SECTION
        andi.   r3,r3,MMUCSR0_TLBFI@l
        bne     1b
 MMU_FTR_SECTION_ELSE
-        PPC_TLBILX_ALL(0,0)
+  BEGIN_MMU_FTR_SECTION_NESTED(96)
+        PPC_TLBILX_ALL(0,r3)
+  MMU_FTR_SECTION_ELSE_NESTED(96)
+        PPC_TLBILX_ALL_EARLY(0,r3)
+  ALT_MMU_FTR_SECTION_END_NESTED_IFCLR(MMU_FTR_TLBILX_EARLY_OPCODE, 96)
 ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_USE_TLBILX)
        msync
        isync
@@ -151,7 +155,11 @@ BEGIN_MMU_FTR_SECTION
        wrteei  0
        mfspr   r4,SPRN_MAS6    /* save MAS6 */
        mtspr   SPRN_MAS6,r3
+  BEGIN_MMU_FTR_SECTION_NESTED(96)
        PPC_TLBILX_PID(0,0)
+  MMU_FTR_SECTION_ELSE_NESTED(96)
+        PPC_TLBILX_PID_EARLY(0,0)
+  ALT_MMU_FTR_SECTION_END_NESTED_IFCLR(MMU_FTR_TLBILX_EARLY_OPCODE, 96)
        mtspr   SPRN_MAS6,r4    /* restore MAS6 */
        wrtee   r10
 MMU_FTR_SECTION_ELSE
@@ -185,7 +193,11 @@ BEGIN_MMU_FTR_SECTION
        mtspr   SPRN_MAS1,r4
        tlbwe
 MMU_FTR_SECTION_ELSE
+  BEGIN_MMU_FTR_SECTION_NESTED(96)
        PPC_TLBILX_VA(0,r3)
+  MMU_FTR_SECTION_ELSE_NESTED(96)
+        PPC_TLBILX_VA_EARLY(0,r3)
+  ALT_MMU_FTR_SECTION_END_NESTED_IFCLR(MMU_FTR_TLBILX_EARLY_OPCODE, 96)
 ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_USE_TLBILX)
        msync
        isync
diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
index fafcaa0e81ef..ab69925d579b 100644
--- a/arch/powerpc/platforms/pseries/dtl.c
+++ b/arch/powerpc/platforms/pseries/dtl.c
@@ -25,6 +25,7 @@
 #include <asm/smp.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <asm/firmware.h>
 #include "plpar_wrappers.h"
diff --git a/arch/powerpc/platforms/pseries/eeh_driver.c b/arch/powerpc/platforms/pseries/eeh_driver.c
index 380420f8c400..9a2a6e32f00f 100644
--- a/arch/powerpc/platforms/pseries/eeh_driver.c
+++ b/arch/powerpc/platforms/pseries/eeh_driver.c
@@ -182,6 +182,8 @@ static void eeh_report_reset(struct pci_dev *dev, void *userdata)
        if (!driver)
                return;
+        dev->error_state = pci_channel_io_normal;
        eeh_enable_irq(dev);
        if (!driver->err_handler ||
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index 27b70d8a359c..aeb3cff95f63 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -176,7 +176,7 @@ static void __appldata_mod_vtimer_wrap(void *p) {
                struct vtimer_list *timer;
                u64    expires;
        } *args = p;
-        mod_virt_timer(args->timer, args->expires);
+        mod_virt_timer_periodic(args->timer, args->expires);
 }
 #define APPLDATA_ADD_TIMER      0
diff --git a/arch/s390/include/asm/cpuid.h b/arch/s390/include/asm/cpuid.h
new file mode 100644
index 000000000000..07836a2e5222
--- /dev/null
+++ b/arch/s390/include/asm/cpuid.h
@@ -0,0 +1,25 @@
+/*
+ *    Copyright IBM Corp. 2000,2009
+ *    Author(s): Hartmut Penner <hp@de.ibm.com>,
+ *               Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *               Christian Ehrhardt <ehrhardt@de.ibm.com>
+ */
+#ifndef _ASM_S390_CPUID_H_
+#define _ASM_S390_CPUID_H_
+/*
+ *  CPU type and hardware bug flags. Kept separately for each CPU.
+ *  Members of this structure are referenced in head.S, so think twice
+ *  before touching them. [mj]
+ */
+typedef struct
+{
+        unsigned int version :  8;
+        unsigned int ident   : 24;
+        unsigned int machine : 16;
+        unsigned int unused  : 16;
+} __attribute__ ((packed)) cpuid_t;
+#endif /* _ASM_S390_CPUID_H_ */
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index c6e674f5fca9..54ea39f96ecd 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -15,6 +15,7 @@
 #define ASM_KVM_HOST_H
 #include <linux/kvm_host.h>
 #include <asm/debug.h>
+#include <asm/cpuid.h>
 #define KVM_MAX_VCPUS 64
 #define KVM_MEMORY_SLOTS 32
diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index b349f1c7fdfa..3aeca492b147 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -66,6 +66,7 @@
 #define __LC_USER_EXEC_ASCE             0x02ac
 #define __LC_CPUID                      0x02b0
 #define __LC_INT_CLOCK                  0x02c8
+#define __LC_MACHINE_FLAGS              0x02d8
 #define __LC_IRB                        0x0300
 #define __LC_PFAULT_INTPARM             0x0080
 #define __LC_CPU_TIMER_SAVE_AREA        0x00d8
@@ -110,6 +111,7 @@
 #define __LC_CPUID                      0x0320
 #define __LC_INT_CLOCK                  0x0340
 #define __LC_VDSO_PER_CPU               0x0350
+#define __LC_MACHINE_FLAGS              0x0358
 #define __LC_IRB                        0x0380
 #define __LC_PASTE                      0x03c0
 #define __LC_PFAULT_INTPARM             0x11b8
@@ -127,9 +129,9 @@
 #ifndef __ASSEMBLY__
-#include <asm/processor.h>
+#include <asm/cpuid.h>
+#include <asm/ptrace.h>
 #include <linux/types.h>
-#include <asm/sigp.h>
 void restart_int_handler(void);
 void ext_int_handler(void);
@@ -277,7 +279,8 @@ struct _lowcore
        __u32   ext_call_fast;                  /* 0x02c4 */
        __u64   int_clock;                      /* 0x02c8 */
        __u64   clock_comparator;               /* 0x02d0 */
-        __u8    pad_0x02d8[0x0300-0x02d8];      /* 0x02d8 */
+        __u32   machine_flags;                  /* 0x02d8 */
+        __u8    pad_0x02dc[0x0300-0x02dc];      /* 0x02dc */
        /* Interrupt response block */
        __u8    irb[64];                        /* 0x0300 */
@@ -381,7 +384,8 @@ struct _lowcore
        __u64   int_clock;                      /* 0x0340 */
        __u64   clock_comparator;               /* 0x0348 */
        __u64   vdso_per_cpu_data;              /* 0x0350 */
-        __u8    pad_0x0358[0x0380-0x0358];      /* 0x0358 */
+        __u64   machine_flags;                  /* 0x0358 */
+        __u8    pad_0x0360[0x0380-0x0360];      /* 0x0360 */
        /* Interrupt response block. */
        __u8    irb[64];                        /* 0x0380 */
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 61862b3ac794..c139fa7b8e89 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -14,7 +14,10 @@
 #define __ASM_S390_PROCESSOR_H
 #include <linux/linkage.h>
+#include <asm/cpuid.h>
+#include <asm/page.h>
 #include <asm/ptrace.h>
+#include <asm/setup.h>
 #ifdef __KERNEL__
 /*
@@ -23,20 +26,6 @@
 */
 #define current_text_addr() ({ void *pc; asm("basr %0,0" : "=a" (pc)); pc; })
-/*
- *  CPU type and hardware bug flags. Kept separately for each CPU.
- *  Members of this structure are referenced in head.S, so think twice
- *  before touching them. [mj]
- */
-typedef struct
-{
-        unsigned int version :  8;
-        unsigned int ident   : 24;
-        unsigned int machine : 16;
-        unsigned int unused  : 16;
-} __attribute__ ((packed)) cpuid_t;
 static inline void get_cpu_id(cpuid_t *ptr)
 {
        asm volatile("stidp 0(%1)" : "=m" (*ptr) : "a" (ptr));
diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index f1b051630c50..539263fc9ab9 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -313,8 +313,6 @@ typedef struct
 #ifdef __KERNEL__
-#include <asm/setup.h>
-#include <asm/page.h>
 /*
 * The pt_regs struct defines the way the registers are stored on
diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
index e8bd6ac22c99..38b0fc221ed7 100644
--- a/arch/s390/include/asm/setup.h
+++ b/arch/s390/include/asm/setup.h
@@ -14,6 +14,7 @@
 #ifdef __KERNEL__
+#include <asm/lowcore.h>
 #include <asm/types.h>
 #define PARMAREA                0x10400
@@ -63,7 +64,6 @@ extern unsigned int s390_noexec;
 /*
 * Machine features detected in head.S
 */
-extern unsigned long machine_flags;
 #define MACHINE_FLAG_VM         (1UL << 0)
 #define MACHINE_FLAG_IEEE       (1UL << 1)
@@ -77,28 +77,28 @@ extern unsigned long machine_flags;
 #define MACHINE_FLAG_HPAGE      (1UL << 10)
 #define MACHINE_FLAG_PFMF       (1UL << 11)
-#define MACHINE_IS_VM           (machine_flags & MACHINE_FLAG_VM)
+#define MACHINE_IS_VM           (S390_lowcore.machine_flags & MACHINE_FLAG_VM)
-#define MACHINE_IS_KVM          (machine_flags & MACHINE_FLAG_KVM)
+#define MACHINE_IS_KVM          (S390_lowcore.machine_flags & MACHINE_FLAG_KVM)
-#define MACHINE_HAS_DIAG9C      (machine_flags & MACHINE_FLAG_DIAG9C)
+#define MACHINE_HAS_DIAG9C      (S390_lowcore.machine_flags & MACHINE_FLAG_DIAG9C)
 #ifndef __s390x__
-#define MACHINE_HAS_IEEE        (machine_flags & MACHINE_FLAG_IEEE)
+#define MACHINE_HAS_IEEE        (S390_lowcore.machine_flags & MACHINE_FLAG_IEEE)
-#define MACHINE_HAS_CSP         (machine_flags & MACHINE_FLAG_CSP)
+#define MACHINE_HAS_CSP         (S390_lowcore.machine_flags & MACHINE_FLAG_CSP)
 #define MACHINE_HAS_IDTE        (0)
 #define MACHINE_HAS_DIAG44      (1)
-#define MACHINE_HAS_MVPG        (machine_flags & MACHINE_FLAG_MVPG)
+#define MACHINE_HAS_MVPG        (S390_lowcore.machine_flags & MACHINE_FLAG_MVPG)
 #define MACHINE_HAS_MVCOS       (0)
 #define MACHINE_HAS_HPAGE       (0)
 #define MACHINE_HAS_PFMF        (0)
 #else /* __s390x__ */
 #define MACHINE_HAS_IEEE        (1)
 #define MACHINE_HAS_CSP         (1)
-#define MACHINE_HAS_IDTE        (machine_flags & MACHINE_FLAG_IDTE)
+#define MACHINE_HAS_IDTE        (S390_lowcore.machine_flags & MACHINE_FLAG_IDTE)
-#define MACHINE_HAS_DIAG44      (machine_flags & MACHINE_FLAG_DIAG44)
+#define MACHINE_HAS_DIAG44      (S390_lowcore.machine_flags & MACHINE_FLAG_DIAG44)
 #define MACHINE_HAS_MVPG        (1)
-#define MACHINE_HAS_MVCOS       (machine_flags & MACHINE_FLAG_MVCOS)
+#define MACHINE_HAS_MVCOS       (S390_lowcore.machine_flags & MACHINE_FLAG_MVCOS)
-#define MACHINE_HAS_HPAGE       (machine_flags & MACHINE_FLAG_HPAGE)
+#define MACHINE_HAS_HPAGE       (S390_lowcore.machine_flags & MACHINE_FLAG_HPAGE)
-#define MACHINE_HAS_PFMF        (machine_flags & MACHINE_FLAG_PFMF)
+#define MACHINE_HAS_PFMF        (S390_lowcore.machine_flags & MACHINE_FLAG_PFMF)
 #endif /* __s390x__ */
 #define ZFCPDUMP_HSA_SIZE       (32UL<<20)
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index c544aa524535..461f2abd2e6f 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -31,8 +31,9 @@
 #define ASYNC_SIZE  (PAGE_SIZE << ASYNC_ORDER)
 #ifndef __ASSEMBLY__
-#include <asm/processor.h>
 #include <asm/lowcore.h>
+#include <asm/page.h>
+#include <asm/processor.h>
 /*
 * low level task data that entry.S needs immediate access to
diff --git a/arch/s390/include/asm/timer.h b/arch/s390/include/asm/timer.h
index e4bcab739c19..814243cafdfe 100644
--- a/arch/s390/include/asm/timer.h
+++ b/arch/s390/include/asm/timer.h
@@ -41,6 +41,7 @@ extern void init_virt_timer(struct vtimer_list *timer);
 extern void add_virt_timer(void *new);
 extern void add_virt_timer_periodic(void *new);
 extern int mod_virt_timer(struct vtimer_list *timer, __u64 expires);
+extern int mod_virt_timer_periodic(struct vtimer_list *timer, __u64 expires);
 extern int del_virt_timer(struct vtimer_list *timer);
 extern void init_cpu_vtimer(void);
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index d744c3d62de5..cc21e3e20fd7 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -11,6 +11,9 @@
 #ifndef _ASM_S390_TIMEX_H
 #define _ASM_S390_TIMEX_H
+/* The value of the TOD clock for 1.1.1970. */
+#define TOD_UNIX_EPOCH 0x7d91048bca000000ULL
 /* Inline functions for clock register access. */
 static inline int set_clock(__u64 time)
 {
@@ -85,4 +88,6 @@ int get_sync_clock(unsigned long long *clock);
 void init_cpu_timer(void);
 unsigned long long monotonic_clock(void);
+extern u64 sched_clock_base_cc;
 #endif
diff --git a/arch/s390/include/asm/unistd.h b/arch/s390/include/asm/unistd.h
index c8ad350d1444..f0f19e6ace6c 100644
--- a/arch/s390/include/asm/unistd.h
+++ b/arch/s390/include/asm/unistd.h
@@ -265,7 +265,9 @@
 #define __NR_pipe2              325
 #define __NR_dup3               326
 #define __NR_epoll_create1      327
-#define NR_syscalls 328
+#define __NR_preadv             328
+#define __NR_pwritev            329
+#define NR_syscalls 330
 /* 
 * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 67a60016babb..fa9905ce7d0b 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -27,6 +27,8 @@ int main(void)
        DEFINE(__TI_flags, offsetof(struct thread_info, flags));
        DEFINE(__TI_cpu, offsetof(struct thread_info, cpu));
        DEFINE(__TI_precount, offsetof(struct thread_info, preempt_count));
+        DEFINE(__TI_user_timer, offsetof(struct thread_info, user_timer));
+        DEFINE(__TI_system_timer, offsetof(struct thread_info, system_timer));
        BLANK();
        DEFINE(__PT_ARGS, offsetof(struct pt_regs, args));
        DEFINE(__PT_PSW, offsetof(struct pt_regs, psw));
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 87cf5a79a351..fb38af6316bb 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1805,3 +1805,21 @@ compat_sys_keyctl_wrapper:
        llgfr   %r5,%r5                 # u32
        llgfr   %r6,%r6                 # u32
        jg      compat_sys_keyctl       # branch to system call
+        .globl  compat_sys_preadv_wrapper
+compat_sys_preadv_wrapper:
+        llgfr   %r2,%r2                 # unsigned long
+        llgtr   %r3,%r3                 # compat_iovec *
+        llgfr   %r4,%r4                 # unsigned long
+        llgfr   %r5,%r5                 # u32
+        llgfr   %r6,%r6                 # u32
+        jg      compat_sys_preadv       # branch to system call
+        .globl  compat_sys_pwritev_wrapper
+compat_sys_pwritev_wrapper:
+        llgfr   %r2,%r2                 # unsigned long
+        llgtr   %r3,%r3                 # compat_iovec *
+        llgfr   %r4,%r4                 # unsigned long
+        llgfr   %r5,%r5                 # u32
+        llgfr   %r6,%r6                 # u32
+        jg      compat_sys_pwritev      # branch to system call
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 4d221c81c849..cf09948faad6 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -34,8 +34,25 @@
 char kernel_nss_name[NSS_NAME_SIZE + 1];
+static unsigned long machine_flags;
 static void __init setup_boot_command_line(void);
+/*
+ * Get the TOD clock running.
+ */
+static void __init reset_tod_clock(void)
+{
+        u64 time;
+        if (store_clock(&time) == 0)
+                return;
+        /* TOD clock not running. Set the clock to Unix Epoch. */
+        if (set_clock(TOD_UNIX_EPOCH) != 0 || store_clock(&time) != 0)
+                disabled_wait(0);
+        sched_clock_base_cc = TOD_UNIX_EPOCH;
+}
 #ifdef CONFIG_SHARED_KERNEL
 int __init savesys_ipl_nss(char *cmd, const int cmdlen);
@@ -370,6 +387,7 @@ static void __init setup_boot_command_line(void)
 */
 void __init startup_init(void)
 {
+        reset_tod_clock();
        ipl_save_parameters();
        rescue_initrd();
        clear_bss_section();
@@ -391,5 +409,6 @@ void __init startup_init(void)
        setup_hpage();
        sclp_facilities_detect();
        detect_memory_layout(memory_chunk);
+        S390_lowcore.machine_flags = machine_flags;
        lockdep_on();
 }
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 1268aa2991bf..f3e275934213 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -837,16 +837,29 @@ mcck_return:
        __CPUINIT
        .globl restart_int_handler
 restart_int_handler:
+        basr    %r1,0
+restart_base:
+        spt     restart_vtime-restart_base(%r1)
+        stck    __LC_LAST_UPDATE_CLOCK
+        mvc     __LC_LAST_UPDATE_TIMER(8),restart_vtime-restart_base(%r1)
+        mvc     __LC_EXIT_TIMER(8),restart_vtime-restart_base(%r1)
        l       %r15,__LC_SAVE_AREA+60  # load ksp
        lctl    %c0,%c15,__LC_CREGS_SAVE_AREA # get new ctl regs
        lam     %a0,%a15,__LC_AREGS_SAVE_AREA
        lm      %r6,%r15,__SF_GPRS(%r15) # load registers from clone
+        l       %r1,__LC_THREAD_INFO
+        mvc     __LC_USER_TIMER(8),__TI_user_timer(%r1)
+        mvc     __LC_SYSTEM_TIMER(8),__TI_system_timer(%r1)
+        xc      __LC_STEAL_TIMER(8),__LC_STEAL_TIMER
        stosm   __SF_EMPTY(%r15),0x04   # now we can turn dat on
        basr    %r14,0
        l       %r14,restart_addr-.(%r14)
        br      %r14                    # branch to start_secondary
 restart_addr:
        .long   start_secondary
+        .align  8
+restart_vtime:
+        .long   0x7fffffff,0xffffffff
        .previous
 #else
 /*
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index c6fbde13971a..84a105838e03 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -831,14 +831,27 @@ mcck_return:
        __CPUINIT
        .globl restart_int_handler
 restart_int_handler:
+        basr    %r1,0
+restart_base:
+        spt     restart_vtime-restart_base(%r1)
+        stck    __LC_LAST_UPDATE_CLOCK
+        mvc     __LC_LAST_UPDATE_TIMER(8),restart_vtime-restart_base(%r1)
+        mvc     __LC_EXIT_TIMER(8),restart_vtime-restart_base(%r1)
        lg      %r15,__LC_SAVE_AREA+120 # load ksp
        lghi    %r10,__LC_CREGS_SAVE_AREA
        lctlg   %c0,%c15,0(%r10) # get new ctl regs
        lghi    %r10,__LC_AREGS_SAVE_AREA
        lam     %a0,%a15,0(%r10)
        lmg     %r6,%r15,__SF_GPRS(%r15) # load registers from clone
+        lg      %r1,__LC_THREAD_INFO
+        mvc     __LC_USER_TIMER(8),__TI_user_timer(%r1)
+        mvc     __LC_SYSTEM_TIMER(8),__TI_system_timer(%r1)
+        xc      __LC_STEAL_TIMER(8),__LC_STEAL_TIMER
        stosm   __SF_EMPTY(%r15),0x04   # now we can turn dat on
        jg      start_secondary
+        .align  8
+restart_vtime:
+        .long   0x7fffffff,0xffffffff
        .previous
 #else
 /*
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index 1046c2c9f8d1..bba14494ee00 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -471,7 +471,12 @@ startup:basr	%r13,0			# get base
 .LPG0:
        xc      0x200(256),0x200        # partially clear lowcore
        xc      0x300(256),0x300
+        l       %r1,5f-.LPG0(%r13)
+        stck    0(%r1)
+        spt     6f-.LPG0(%r13)
+        mvc     __LC_LAST_UPDATE_CLOCK(8),0(%r1)
+        mvc     __LC_LAST_UPDATE_TIMER(8),6f-.LPG0(%r13)
+        mvc     __LC_EXIT_TIMER(8),5f-.LPG0(%r13)
 #ifndef CONFIG_MARCH_G5
        # check processor version against MARCH_{G5,Z900,Z990,Z9_109,Z10}
        stidp   __LC_CPUID              # store cpuid
@@ -496,9 +501,13 @@ startup:basr	%r13,0			# get base
        brct    %r0,0b
 #endif
-        l       %r13,0f-.LPG0(%r13)
+        l       %r13,4f-.LPG0(%r13)
        b       0(%r13)
-0:      .long   startup_continue
+        .align  4
+4:      .long   startup_continue
+5:      .long   sched_clock_base_cc
+        .align  8
+6:      .long   0x7fffffff,0xffffffff
 #
 # params at 10400 (setup.h)
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index 4bfdc421d7e9..28cf196ba775 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -10,6 +10,7 @@
 #include <linux/init.h>
 #include <linux/errno.h>
+#include <linux/hardirq.h>
 #include <linux/time.h>
 #include <linux/module.h>
 #include <asm/lowcore.h>
@@ -253,7 +254,7 @@ void notrace s390_do_machine_check(struct pt_regs *regs)
        struct mci *mci;
        int umode;
-        lockdep_off();
+        nmi_enter();
        s390_idle_check();
        mci = (struct mci *) &S390_lowcore.mcck_interruption_code;
@@ -363,7 +364,7 @@ void notrace s390_do_machine_check(struct pt_regs *regs)
                mcck->warning = 1;
                set_thread_flag(TIF_MCCK_PENDING);
        }
-        lockdep_on();
+        nmi_exit();
 }
 static int __init machine_check_init(void)
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 06201b93cbbf..7402b6a39ead 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -82,9 +82,6 @@ EXPORT_SYMBOL(console_devno);
 unsigned int console_irq = -1;
 EXPORT_SYMBOL(console_irq);
-unsigned long machine_flags;
-EXPORT_SYMBOL(machine_flags);
 unsigned long elf_hwcap = 0;
 char elf_platform[ELF_PLATFORM_SIZE];
@@ -426,6 +423,7 @@ setup_lowcore(void)
                __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, 0) + PAGE_SIZE;
        lc->current_task = (unsigned long) init_thread_union.thread_info.task;
        lc->thread_info = (unsigned long) &init_thread_union;
+        lc->machine_flags = S390_lowcore.machine_flags;
 #ifndef CONFIG_64BIT
        if (MACHINE_HAS_IEEE) {
                lc->extended_save_area_addr = (__u32)
@@ -436,6 +434,14 @@ setup_lowcore(void)
 #else
        lc->vdso_per_cpu_data = (unsigned long) &lc->paste[0];
 #endif
+        lc->sync_enter_timer = S390_lowcore.sync_enter_timer;
+        lc->async_enter_timer = S390_lowcore.async_enter_timer;
+        lc->exit_timer = S390_lowcore.exit_timer;
+        lc->user_timer = S390_lowcore.user_timer;
+        lc->system_timer = S390_lowcore.system_timer;
+        lc->steal_timer = S390_lowcore.steal_timer;
+        lc->last_update_timer = S390_lowcore.last_update_timer;
+        lc->last_update_clock = S390_lowcore.last_update_clock;
        set_prefix((u32)(unsigned long) lc);
        lowcore_ptr[0] = lc;
 }
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 006ed5016eb4..a985a3ba4401 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -571,6 +571,7 @@ int __cpuinit __cpu_up(unsigned int cpu)
        cpu_lowcore->current_task = (unsigned long) idle;
        cpu_lowcore->cpu_nr = cpu;
        cpu_lowcore->kernel_asce = S390_lowcore.kernel_asce;
+        cpu_lowcore->machine_flags = S390_lowcore.machine_flags;
        eieio();
        while (signal_processor(cpu, sigp_restart) == sigp_busy)
@@ -590,7 +591,8 @@ static int __init setup_possible_cpus(char *s)
        int pcpus, cpu;
        pcpus = simple_strtoul(s, NULL, 0);
-        for (cpu = 0; cpu < pcpus && cpu < nr_cpu_ids; cpu++)
+        init_cpu_possible(cpumask_of(0));
+        for (cpu = 1; cpu < pcpus && cpu < nr_cpu_ids; cpu++)
                set_cpu_possible(cpu, true);
        return 0;
 }
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index fe5b25a988ab..2c7739fe70b1 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -336,3 +336,5 @@ SYSCALL(sys_inotify_init1,sys_inotify_init1,sys_inotify_init1_wrapper)
 SYSCALL(sys_pipe2,sys_pipe2,sys_pipe2_wrapper) /* 325 */
 SYSCALL(sys_dup3,sys_dup3,sys_dup3_wrapper)
 SYSCALL(sys_epoll_create1,sys_epoll_create1,sys_epoll_create1_wrapper)
+SYSCALL(sys_preadv,sys_preadv,compat_sys_preadv_wrapper)
+SYSCALL(sys_pwritev,sys_pwritev,compat_sys_pwritev_wrapper)
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index f72d41068dc2..6ded50dfa75a 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -52,9 +52,6 @@
 #define USECS_PER_JIFFY     ((unsigned long) 1000000/HZ)
 #define CLK_TICKS_PER_JIFFY ((unsigned long) USECS_PER_JIFFY << 12)
-/* The value of the TOD clock for 1.1.1970. */
-#define TOD_UNIX_EPOCH 0x7d91048bca000000ULL
 /*
 * Create a small time difference between the timer interrupts
 * on the different cpus to avoid lock contention.
@@ -63,9 +60,10 @@
 #define TICK_SIZE tick
+u64 sched_clock_base_cc = -1;   /* Force to data section. */
 static ext_int_info_t ext_int_info_cc;
 static ext_int_info_t ext_int_etr_cc;
-static u64 sched_clock_base_cc;
 static DEFINE_PER_CPU(struct clock_event_device, comparators);
@@ -195,22 +193,12 @@ static void timing_alert_interrupt(__u16 code)
 static void etr_reset(void);
 static void stp_reset(void);
-/*
+unsigned long read_persistent_clock(void)
- * Get the TOD clock running.
- */
-static u64 __init reset_tod_clock(void)
 {
-        u64 time;
+        struct timespec ts;
-        etr_reset();
-        stp_reset();
-        if (store_clock(&time) == 0)
-                return time;
-        /* TOD clock not running. Set the clock to Unix Epoch. */
-        if (set_clock(TOD_UNIX_EPOCH) != 0 || store_clock(&time) != 0)
-                panic("TOD clock not operational.");
-        return TOD_UNIX_EPOCH;
+        tod_to_timeval(get_clock() - TOD_UNIX_EPOCH, &ts);
+        return ts.tv_sec;
 }
 static cycle_t read_tod_clock(void)
@@ -265,12 +253,13 @@ void update_vsyscall_tz(void)
 */
 void __init time_init(void)
 {
-        sched_clock_base_cc = reset_tod_clock();
+        struct timespec ts;
+        unsigned long flags;
+        cycle_t now;
-        /* set xtime */
+        /* Reset time synchronization interfaces. */
-        tod_to_timeval(sched_clock_base_cc - TOD_UNIX_EPOCH, &xtime);
+        etr_reset();
-        set_normalized_timespec(&wall_to_monotonic,
+        stp_reset();
-                                -xtime.tv_sec, -xtime.tv_nsec);
        /* request the clock comparator external interrupt */
        if (register_early_external_interrupt(0x1004,
@@ -278,17 +267,38 @@ void __init time_init(void)
                                              &ext_int_info_cc) != 0)
                panic("Couldn't request external interrupt 0x1004");
-        if (clocksource_register(&clocksource_tod) != 0)
-                panic("Could not register TOD clock source");
        /* request the timing alert external interrupt */
        if (register_early_external_interrupt(0x1406,
                                              timing_alert_interrupt,
                                              &ext_int_etr_cc) != 0)
                panic("Couldn't request external interrupt 0x1406");
+        if (clocksource_register(&clocksource_tod) != 0)
+                panic("Could not register TOD clock source");
+        /*
+         * The TOD clock is an accurate clock. The xtime should be
+         * initialized in a way that the difference between TOD and
+         * xtime is reasonably small. Too bad that timekeeping_init
+         * sets xtime.tv_nsec to zero. In addition the clock source
+         * change from the jiffies clock source to the TOD clock
+         * source add another error of up to 1/HZ second. The same
+         * function sets wall_to_monotonic to a value that is too
+         * small for /proc/uptime to be accurate.
+         * Reset xtime and wall_to_monotonic to sane values.
+         */
+        write_seqlock_irqsave(&xtime_lock, flags);
+        now = get_clock();
+        tod_to_timeval(now - TOD_UNIX_EPOCH, &xtime);
+        clocksource_tod.cycle_last = now;
+        clocksource_tod.raw_time = xtime;
+        tod_to_timeval(sched_clock_base_cc - TOD_UNIX_EPOCH, &ts);
+        set_normalized_timespec(&wall_to_monotonic, -ts.tv_sec, -ts.tv_nsec);
+        write_sequnlock_irqrestore(&xtime_lock, flags);
        /* Enable TOD clock interrupts on the boot cpu. */
        init_cpu_timer();
        /* Enable cpu timer interrupts on the boot cpu. */
        vtime_init();
 }
@@ -1423,6 +1433,7 @@ static void *stp_page;
 static void stp_work_fn(struct work_struct *work);
 static DEFINE_MUTEX(stp_work_mutex);
 static DECLARE_WORK(stp_work, stp_work_fn);
+static struct timer_list stp_timer;
 static int __init early_parse_stp(char *p)
 {
@@ -1454,10 +1465,16 @@ static void __init stp_reset(void)
        }
 }
+static void stp_timeout(unsigned long dummy)
+{
+        queue_work(time_sync_wq, &stp_work);
+}
 static int __init stp_init(void)
 {
        if (!test_bit(CLOCK_SYNC_HAS_STP, &clock_sync_flags))
                return 0;
+        setup_timer(&stp_timer, stp_timeout, 0UL);
        time_init_wq();
        if (!stp_online)
                return 0;
@@ -1565,6 +1582,7 @@ static void stp_work_fn(struct work_struct *work)
        if (!stp_online) {
                chsc_sstpc(stp_page, STP_OP_CTRL, 0x0000);
+                del_timer_sync(&stp_timer);
                goto out_unlock;
        }
@@ -1586,6 +1604,13 @@ static void stp_work_fn(struct work_struct *work)
        stop_machine(stp_sync_clock, &stp_sync, &cpu_online_map);
        put_online_cpus();
+        if (!check_sync_clock())
+                /*
+                 * There is a usable clock but the synchonization failed.
+                 * Retry after a second.
+                 */
+                mod_timer(&stp_timer, jiffies + HZ);
 out_unlock:
        mutex_unlock(&stp_work_mutex);
 }
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index ecf0304e61c1..38ea92ff04f9 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -134,6 +134,8 @@ void vtime_start_cpu(void)
        /* Account time spent with enabled wait psw loaded as idle time. */
        idle_time = S390_lowcore.int_clock - idle->idle_enter;
        account_idle_time(idle_time);
+        S390_lowcore.steal_timer +=
+                idle->idle_enter - S390_lowcore.last_update_clock;
        S390_lowcore.last_update_clock = S390_lowcore.int_clock;
        /* Account system time spent going idle. */
@@ -425,17 +427,7 @@ void add_virt_timer_periodic(void *new)
 }
 EXPORT_SYMBOL(add_virt_timer_periodic);
-/*
+int __mod_vtimer(struct vtimer_list *timer, __u64 expires, int periodic)
- * If we change a pending timer the function must be called on the CPU
- * where the timer is running on, e.g. by smp_call_function_single()
- *
- * The original mod_timer adds the timer if it is not pending. For
- * compatibility we do the same. The timer will be added on the current
- * CPU as a oneshot timer.
- *
- * returns whether it has modified a pending timer (1) or not (0)
- */
-int mod_virt_timer(struct vtimer_list *timer, __u64 expires)
 {
        struct vtimer_queue *vq;
        unsigned long flags;
@@ -444,39 +436,35 @@ int mod_virt_timer(struct vtimer_list *timer, __u64 expires)
        BUG_ON(!timer->function);
        BUG_ON(!expires || expires > VTIMER_MAX_SLICE);
-        /*
-         * This is a common optimization triggered by the
-         * networking code - if the timer is re-modified
-         * to be the same thing then just return:
-         */
        if (timer->expires == expires && vtimer_pending(timer))
                return 1;
        cpu = get_cpu();
        vq = &per_cpu(virt_cpu_timer, cpu);
-        /* check if we run on the right CPU */
-        BUG_ON(timer->cpu != cpu);
        /* disable interrupts before test if timer is pending */
        spin_lock_irqsave(&vq->lock, flags);
        /* if timer isn't pending add it on the current CPU */
        if (!vtimer_pending(timer)) {
                spin_unlock_irqrestore(&vq->lock, flags);
-                /* we do not activate an interval timer with mod_virt_timer */
-                timer->interval = 0;
+                if (periodic)
+                        timer->interval = expires;
+                else
+                        timer->interval = 0;
                timer->expires = expires;
                timer->cpu = cpu;
                internal_add_vtimer(timer);
                return 0;
        }
+        /* check if we run on the right CPU */
+        BUG_ON(timer->cpu != cpu);
        list_del_init(&timer->entry);
        timer->expires = expires;
+        if (periodic)
-        /* also change the interval if we have an interval timer */
-        if (timer->interval)
                timer->interval = expires;
        /* the timer can't expire anymore so we can release the lock */
@@ -484,9 +472,32 @@ int mod_virt_timer(struct vtimer_list *timer, __u64 expires)
        internal_add_vtimer(timer);
        return 1;
 }
+/*
+ * If we change a pending timer the function must be called on the CPU
+ * where the timer is running on.
+ *
+ * returns whether it has modified a pending timer (1) or not (0)
+ */
+int mod_virt_timer(struct vtimer_list *timer, __u64 expires)
+{
+        return __mod_vtimer(timer, expires, 0);
+}
 EXPORT_SYMBOL(mod_virt_timer);
 /*
+ * If we change a pending timer the function must be called on the CPU
+ * where the timer is running on.
+ *
+ * returns whether it has modified a pending timer (1) or not (0)
+ */
+int mod_virt_timer_periodic(struct vtimer_list *timer, __u64 expires)
+{
+        return __mod_vtimer(timer, expires, 1);
+}
+EXPORT_SYMBOL(mod_virt_timer_periodic);
+/*
 * delete a virtual timer
 *
 * returns whether the deleted timer was pending (1) or not (0)
@@ -516,16 +527,8 @@ EXPORT_SYMBOL(del_virt_timer);
 */
 void init_cpu_vtimer(void)
 {
-        struct thread_info *ti = current_thread_info();
        struct vtimer_queue *vq;
-        S390_lowcore.user_timer = ti->user_timer;
-        S390_lowcore.system_timer = ti->system_timer;
-        /* kick the virtual timer */
-        asm volatile ("STCK %0" : "=m" (S390_lowcore.last_update_clock));
-        asm volatile ("STPT %0" : "=m" (S390_lowcore.last_update_timer));
        /* initialize per cpu vtimer structure */
        vq = &__get_cpu_var(virt_cpu_timer);
        INIT_LIST_HEAD(&vq->list);
diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
index 837c2c4cc203..ecdb682ab516 100644
--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -204,7 +204,13 @@ static void drv_read(struct drv_cmd *cmd)
 static void drv_write(struct drv_cmd *cmd)
 {
+        int this_cpu;
+        this_cpu = get_cpu();
+        if (cpumask_test_cpu(this_cpu, cmd->mask))
+                do_drv_write(cmd);
        smp_call_function_many(cmd->mask, do_drv_write, cmd, 1);
+        put_cpu();
 }
 static u32 get_cur_val(const struct cpumask *mask)
diff --git a/block/as-iosched.c b/block/as-iosched.c
index 631f6f44460a..c48fa670d221 100644
--- a/block/as-iosched.c
+++ b/block/as-iosched.c
@@ -17,9 +17,6 @@
 #include <linux/rbtree.h>
 #include <linux/interrupt.h>
-#define REQ_SYNC        1
-#define REQ_ASYNC       0
 /*
 * See Documentation/block/as-iosched.txt
 */
@@ -93,7 +90,7 @@ struct as_data {
        struct list_head fifo_list[2];
        struct request *next_rq[2];     /* next in sort order */
-        sector_t last_sector[2];        /* last REQ_SYNC & REQ_ASYNC sectors */
+        sector_t last_sector[2];        /* last SYNC & ASYNC sectors */
        unsigned long exit_prob;        /* probability a task will exit while
                                           being waited on */
@@ -109,7 +106,7 @@ struct as_data {
        unsigned long last_check_fifo[2];
        int changed_batch;              /* 1: waiting for old batch to end */
        int new_batch;                  /* 1: waiting on first read complete */
-        int batch_data_dir;             /* current batch REQ_SYNC / REQ_ASYNC */
+        int batch_data_dir;             /* current batch SYNC / ASYNC */
        int write_batch_count;          /* max # of reqs in a write batch */
        int current_write_count;        /* how many requests left this batch */
        int write_batch_idled;          /* has the write batch gone idle? */
@@ -554,7 +551,7 @@ static void as_update_iohist(struct as_data *ad, struct as_io_context *aic,
        if (aic == NULL)
                return;
-        if (data_dir == REQ_SYNC) {
+        if (data_dir == BLK_RW_SYNC) {
                unsigned long in_flight = atomic_read(&aic->nr_queued)
                                        + atomic_read(&aic->nr_dispatched);
                spin_lock(&aic->lock);
@@ -811,7 +808,7 @@ static void as_update_rq(struct as_data *ad, struct request *rq)
 */
 static void update_write_batch(struct as_data *ad)
 {
-        unsigned long batch = ad->batch_expire[REQ_ASYNC];
+        unsigned long batch = ad->batch_expire[BLK_RW_ASYNC];
        long write_time;
        write_time = (jiffies - ad->current_batch_expires) + batch;
@@ -855,7 +852,7 @@ static void as_completed_request(struct request_queue *q, struct request *rq)
                kblockd_schedule_work(q, &ad->antic_work);
                ad->changed_batch = 0;
-                if (ad->batch_data_dir == REQ_SYNC)
+                if (ad->batch_data_dir == BLK_RW_SYNC)
                        ad->new_batch = 1;
        }
        WARN_ON(ad->nr_dispatched == 0);
@@ -869,7 +866,7 @@ static void as_completed_request(struct request_queue *q, struct request *rq)
        if (ad->new_batch && ad->batch_data_dir == rq_is_sync(rq)) {
                update_write_batch(ad);
                ad->current_batch_expires = jiffies +
-                                ad->batch_expire[REQ_SYNC];
+                                ad->batch_expire[BLK_RW_SYNC];
                ad->new_batch = 0;
        }
@@ -960,7 +957,7 @@ static inline int as_batch_expired(struct as_data *ad)
        if (ad->changed_batch || ad->new_batch)
                return 0;
-        if (ad->batch_data_dir == REQ_SYNC)
+        if (ad->batch_data_dir == BLK_RW_SYNC)
                /* TODO! add a check so a complete fifo gets written? */
                return time_after(jiffies, ad->current_batch_expires);
@@ -986,7 +983,7 @@ static void as_move_to_dispatch(struct as_data *ad, struct request *rq)
         */
        ad->last_sector[data_dir] = rq->sector + rq->nr_sectors;
-        if (data_dir == REQ_SYNC) {
+        if (data_dir == BLK_RW_SYNC) {
                struct io_context *ioc = RQ_IOC(rq);
                /* In case we have to anticipate after this */
                copy_io_context(&ad->io_context, &ioc);
@@ -1025,41 +1022,41 @@ static void as_move_to_dispatch(struct as_data *ad, struct request *rq)
 static int as_dispatch_request(struct request_queue *q, int force)
 {
        struct as_data *ad = q->elevator->elevator_data;
-        const int reads = !list_empty(&ad->fifo_list[REQ_SYNC]);
+        const int reads = !list_empty(&ad->fifo_list[BLK_RW_SYNC]);
-        const int writes = !list_empty(&ad->fifo_list[REQ_ASYNC]);
+        const int writes = !list_empty(&ad->fifo_list[BLK_RW_ASYNC]);
        struct request *rq;
        if (unlikely(force)) {
                /*
                 * Forced dispatch, accounting is useless.  Reset
                 * accounting states and dump fifo_lists.  Note that
-                 * batch_data_dir is reset to REQ_SYNC to avoid
+                 * batch_data_dir is reset to BLK_RW_SYNC to avoid
                 * screwing write batch accounting as write batch
                 * accounting occurs on W->R transition.
                 */
                int dispatched = 0;
-                ad->batch_data_dir = REQ_SYNC;
+                ad->batch_data_dir = BLK_RW_SYNC;
                ad->changed_batch = 0;
                ad->new_batch = 0;
-                while (ad->next_rq[REQ_SYNC]) {
+                while (ad->next_rq[BLK_RW_SYNC]) {
-                        as_move_to_dispatch(ad, ad->next_rq[REQ_SYNC]);
+                        as_move_to_dispatch(ad, ad->next_rq[BLK_RW_SYNC]);
                        dispatched++;
                }
-                ad->last_check_fifo[REQ_SYNC] = jiffies;
+                ad->last_check_fifo[BLK_RW_SYNC] = jiffies;
-                while (ad->next_rq[REQ_ASYNC]) {
+                while (ad->next_rq[BLK_RW_ASYNC]) {
-                        as_move_to_dispatch(ad, ad->next_rq[REQ_ASYNC]);
+                        as_move_to_dispatch(ad, ad->next_rq[BLK_RW_ASYNC]);
                        dispatched++;
                }
-                ad->last_check_fifo[REQ_ASYNC] = jiffies;
+                ad->last_check_fifo[BLK_RW_ASYNC] = jiffies;
                return dispatched;
        }
        /* Signal that the write batch was uncontended, so we can't time it */
-        if (ad->batch_data_dir == REQ_ASYNC && !reads) {
+        if (ad->batch_data_dir == BLK_RW_ASYNC && !reads) {
                if (ad->current_write_count == 0 || !writes)
                        ad->write_batch_idled = 1;
        }
@@ -1076,8 +1073,8 @@ static int as_dispatch_request(struct request_queue *q, int force)
                 */
                rq = ad->next_rq[ad->batch_data_dir];
-                if (ad->batch_data_dir == REQ_SYNC && ad->antic_expire) {
+                if (ad->batch_data_dir == BLK_RW_SYNC && ad->antic_expire) {
-                        if (as_fifo_expired(ad, REQ_SYNC))
+                        if (as_fifo_expired(ad, BLK_RW_SYNC))
                                goto fifo_expired;
                        if (as_can_anticipate(ad, rq)) {
@@ -1090,7 +1087,7 @@ static int as_dispatch_request(struct request_queue *q, int force)
                        /* we have a "next request" */
                        if (reads && !writes)
                                ad->current_batch_expires =
-                                        jiffies + ad->batch_expire[REQ_SYNC];
+                                        jiffies + ad->batch_expire[BLK_RW_SYNC];
                        goto dispatch_request;
                }
        }
@@ -1101,20 +1098,20 @@ static int as_dispatch_request(struct request_queue *q, int force)
         */
        if (reads) {
-                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[REQ_SYNC]));
+                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[BLK_RW_SYNC]));
-                if (writes && ad->batch_data_dir == REQ_SYNC)
+                if (writes && ad->batch_data_dir == BLK_RW_SYNC)
                        /*
                         * Last batch was a read, switch to writes
                         */
                        goto dispatch_writes;
-                if (ad->batch_data_dir == REQ_ASYNC) {
+                if (ad->batch_data_dir == BLK_RW_ASYNC) {
                        WARN_ON(ad->new_batch);
                        ad->changed_batch = 1;
                }
-                ad->batch_data_dir = REQ_SYNC;
+                ad->batch_data_dir = BLK_RW_SYNC;
-                rq = rq_entry_fifo(ad->fifo_list[REQ_SYNC].next);
+                rq = rq_entry_fifo(ad->fifo_list[BLK_RW_SYNC].next);
                ad->last_check_fifo[ad->batch_data_dir] = jiffies;
                goto dispatch_request;
        }
@@ -1125,9 +1122,9 @@ static int as_dispatch_request(struct request_queue *q, int force)
        if (writes) {
 dispatch_writes:
-                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[REQ_ASYNC]));
+                BUG_ON(RB_EMPTY_ROOT(&ad->sort_list[BLK_RW_ASYNC]));
-                if (ad->batch_data_dir == REQ_SYNC) {
+                if (ad->batch_data_dir == BLK_RW_SYNC) {
                        ad->changed_batch = 1;
                        /*
@@ -1137,11 +1134,11 @@ dispatch_writes:
                         */
                        ad->new_batch = 0;
                }
-                ad->batch_data_dir = REQ_ASYNC;
+                ad->batch_data_dir = BLK_RW_ASYNC;
                ad->current_write_count = ad->write_batch_count;
                ad->write_batch_idled = 0;
-                rq = rq_entry_fifo(ad->fifo_list[REQ_ASYNC].next);
+                rq = rq_entry_fifo(ad->fifo_list[BLK_RW_ASYNC].next);
-                ad->last_check_fifo[REQ_ASYNC] = jiffies;
+                ad->last_check_fifo[BLK_RW_ASYNC] = jiffies;
                goto dispatch_request;
        }
@@ -1164,9 +1161,9 @@ fifo_expired:
                if (ad->nr_dispatched)
                        return 0;
-                if (ad->batch_data_dir == REQ_ASYNC)
+                if (ad->batch_data_dir == BLK_RW_ASYNC)
                        ad->current_batch_expires = jiffies +
-                                        ad->batch_expire[REQ_ASYNC];
+                                        ad->batch_expire[BLK_RW_ASYNC];
                else
                        ad->new_batch = 1;
@@ -1238,8 +1235,8 @@ static int as_queue_empty(struct request_queue *q)
 {
        struct as_data *ad = q->elevator->elevator_data;
-        return list_empty(&ad->fifo_list[REQ_ASYNC])
+        return list_empty(&ad->fifo_list[BLK_RW_ASYNC])
-                && list_empty(&ad->fifo_list[REQ_SYNC]);
+                && list_empty(&ad->fifo_list[BLK_RW_SYNC]);
 }
 static int
@@ -1346,8 +1343,8 @@ static void as_exit_queue(struct elevator_queue *e)
        del_timer_sync(&ad->antic_timer);
        cancel_work_sync(&ad->antic_work);
-        BUG_ON(!list_empty(&ad->fifo_list[REQ_SYNC]));
+        BUG_ON(!list_empty(&ad->fifo_list[BLK_RW_SYNC]));
-        BUG_ON(!list_empty(&ad->fifo_list[REQ_ASYNC]));
+        BUG_ON(!list_empty(&ad->fifo_list[BLK_RW_ASYNC]));
        put_io_context(ad->io_context);
        kfree(ad);
@@ -1372,18 +1369,18 @@ static void *as_init_queue(struct request_queue *q)
        init_timer(&ad->antic_timer);
        INIT_WORK(&ad->antic_work, as_work_handler);
-        INIT_LIST_HEAD(&ad->fifo_list[REQ_SYNC]);
+        INIT_LIST_HEAD(&ad->fifo_list[BLK_RW_SYNC]);
-        INIT_LIST_HEAD(&ad->fifo_list[REQ_ASYNC]);
+        INIT_LIST_HEAD(&ad->fifo_list[BLK_RW_ASYNC]);
-        ad->sort_list[REQ_SYNC] = RB_ROOT;
+        ad->sort_list[BLK_RW_SYNC] = RB_ROOT;
-        ad->sort_list[REQ_ASYNC] = RB_ROOT;
+        ad->sort_list[BLK_RW_ASYNC] = RB_ROOT;
-        ad->fifo_expire[REQ_SYNC] = default_read_expire;
+        ad->fifo_expire[BLK_RW_SYNC] = default_read_expire;
-        ad->fifo_expire[REQ_ASYNC] = default_write_expire;
+        ad->fifo_expire[BLK_RW_ASYNC] = default_write_expire;
        ad->antic_expire = default_antic_expire;
-        ad->batch_expire[REQ_SYNC] = default_read_batch_expire;
+        ad->batch_expire[BLK_RW_SYNC] = default_read_batch_expire;
-        ad->batch_expire[REQ_ASYNC] = default_write_batch_expire;
+        ad->batch_expire[BLK_RW_ASYNC] = default_write_batch_expire;
-        ad->current_batch_expires = jiffies + ad->batch_expire[REQ_SYNC];
+        ad->current_batch_expires = jiffies + ad->batch_expire[BLK_RW_SYNC];
-        ad->write_batch_count = ad->batch_expire[REQ_ASYNC] / 10;
+        ad->write_batch_count = ad->batch_expire[BLK_RW_ASYNC] / 10;
        if (ad->write_batch_count < 2)
                ad->write_batch_count = 2;
@@ -1432,11 +1429,11 @@ static ssize_t __FUNC(struct elevator_queue *e, char *page)	\
        struct as_data *ad = e->elevator_data;                  \
        return as_var_show(jiffies_to_msecs((__VAR)), (page));  \
 }
-SHOW_FUNCTION(as_read_expire_show, ad->fifo_expire[REQ_SYNC]);
+SHOW_FUNCTION(as_read_expire_show, ad->fifo_expire[BLK_RW_SYNC]);
-SHOW_FUNCTION(as_write_expire_show, ad->fifo_expire[REQ_ASYNC]);
+SHOW_FUNCTION(as_write_expire_show, ad->fifo_expire[BLK_RW_ASYNC]);
 SHOW_FUNCTION(as_antic_expire_show, ad->antic_expire);
-SHOW_FUNCTION(as_read_batch_expire_show, ad->batch_expire[REQ_SYNC]);
+SHOW_FUNCTION(as_read_batch_expire_show, ad->batch_expire[BLK_RW_SYNC]);
-SHOW_FUNCTION(as_write_batch_expire_show, ad->batch_expire[REQ_ASYNC]);
+SHOW_FUNCTION(as_write_batch_expire_show, ad->batch_expire[BLK_RW_ASYNC]);
 #undef SHOW_FUNCTION
 #define STORE_FUNCTION(__FUNC, __PTR, MIN, MAX)                         \
@@ -1451,13 +1448,14 @@ static ssize_t __FUNC(struct elevator_queue *e, const char *page, size_t count)
        *(__PTR) = msecs_to_jiffies(*(__PTR));                          \
        return ret;                                                     \
 }
-STORE_FUNCTION(as_read_expire_store, &ad->fifo_expire[REQ_SYNC], 0, INT_MAX);
+STORE_FUNCTION(as_read_expire_store, &ad->fifo_expire[BLK_RW_SYNC], 0, INT_MAX);
-STORE_FUNCTION(as_write_expire_store, &ad->fifo_expire[REQ_ASYNC], 0, INT_MAX);
+STORE_FUNCTION(as_write_expire_store,
+                        &ad->fifo_expire[BLK_RW_ASYNC], 0, INT_MAX);
 STORE_FUNCTION(as_antic_expire_store, &ad->antic_expire, 0, INT_MAX);
 STORE_FUNCTION(as_read_batch_expire_store,
-                        &ad->batch_expire[REQ_SYNC], 0, INT_MAX);
+                        &ad->batch_expire[BLK_RW_SYNC], 0, INT_MAX);
 STORE_FUNCTION(as_write_batch_expire_store,
-                        &ad->batch_expire[REQ_ASYNC], 0, INT_MAX);
+                        &ad->batch_expire[BLK_RW_ASYNC], 0, INT_MAX);
 #undef STORE_FUNCTION
 #define AS_ATTR(name) \
diff --git a/block/blk-barrier.c b/block/blk-barrier.c
index f7dae57e6cab..20b4111fa050 100644
--- a/block/blk-barrier.c
+++ b/block/blk-barrier.c
@@ -319,9 +319,6 @@ int blkdev_issue_flush(struct block_device *bdev, sector_t *error_sector)
                return -ENXIO;
        bio = bio_alloc(GFP_KERNEL, 0);
-        if (!bio)
-                return -ENOMEM;
        bio->bi_end_io = bio_end_empty_barrier;
        bio->bi_private = &wait;
        bio->bi_bdev = bdev;
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 73f36beff5cd..cac4e9febe6a 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -209,14 +209,14 @@ static ssize_t queue_iostats_store(struct request_queue *q, const char *page,
        ssize_t ret = queue_var_store(&stats, page, count);
        spin_lock_irq(q->queue_lock);
-        elv_quisce_start(q);
+        elv_quiesce_start(q);
        if (stats)
                queue_flag_set(QUEUE_FLAG_IO_STAT, q);
        else
                queue_flag_clear(QUEUE_FLAG_IO_STAT, q);
-        elv_quisce_end(q);
+        elv_quiesce_end(q);
        spin_unlock_irq(q->queue_lock);
        return ret;
diff --git a/block/blk.h b/block/blk.h
index 24fcaeeaf620..5dfc41267a08 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -70,8 +70,8 @@ void blk_queue_congestion_threshold(struct request_queue *q);
 int blk_dev_init(void);
-void elv_quisce_start(struct request_queue *q);
+void elv_quiesce_start(struct request_queue *q);
-void elv_quisce_end(struct request_queue *q);
+void elv_quiesce_end(struct request_queue *q);
 /*
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index a4809de6fea6..0d3b70de3d80 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -56,9 +56,6 @@ static DEFINE_SPINLOCK(ioc_gone_lock);
 #define cfq_class_idle(cfqq)    ((cfqq)->ioprio_class == IOPRIO_CLASS_IDLE)
 #define cfq_class_rt(cfqq)      ((cfqq)->ioprio_class == IOPRIO_CLASS_RT)
-#define ASYNC                   (0)
-#define SYNC                    (1)
 #define sample_valid(samples)   ((samples) > 80)
 /*
@@ -83,6 +80,14 @@ struct cfq_data {
         * rr list of queues with requests and the count of them
         */
        struct cfq_rb_root service_tree;
+        /*
+         * Each priority tree is sorted by next_request position.  These
+         * trees are used when determining if two or more queues are
+         * interleaving requests (see cfq_close_cooperator).
+         */
+        struct rb_root prio_trees[CFQ_PRIO_LISTS];
        unsigned int busy_queues;
        /*
         * Used to track any pending rt requests so we can pre-empt current
@@ -147,6 +152,8 @@ struct cfq_queue {
        struct rb_node rb_node;
        /* service_tree key */
        unsigned long rb_key;
+        /* prio tree member */
+        struct rb_node p_node;
        /* sorted list of pending requests */
        struct rb_root sort_list;
        /* if fifo isn't expired, next request to serve */
@@ -185,6 +192,7 @@ enum cfqq_state_flags {
        CFQ_CFQQ_FLAG_prio_changed,     /* task priority has changed */
        CFQ_CFQQ_FLAG_slice_new,        /* no requests dispatched in slice */
        CFQ_CFQQ_FLAG_sync,             /* synchronous queue */
+        CFQ_CFQQ_FLAG_coop,             /* has done a coop jump of the queue */
 };
 #define CFQ_CFQQ_FNS(name)                                              \
@@ -211,6 +219,7 @@ CFQ_CFQQ_FNS(idle_window);
 CFQ_CFQQ_FNS(prio_changed);
 CFQ_CFQQ_FNS(slice_new);
 CFQ_CFQQ_FNS(sync);
+CFQ_CFQQ_FNS(coop);
 #undef CFQ_CFQQ_FNS
 #define cfq_log_cfqq(cfqd, cfqq, fmt, args...)  \
@@ -419,13 +428,17 @@ static struct cfq_queue *cfq_rb_first(struct cfq_rb_root *root)
        return NULL;
 }
+static void rb_erase_init(struct rb_node *n, struct rb_root *root)
+{
+        rb_erase(n, root);
+        RB_CLEAR_NODE(n);
+}
 static void cfq_rb_erase(struct rb_node *n, struct cfq_rb_root *root)
 {
        if (root->left == n)
                root->left = NULL;
+        rb_erase_init(n, &root->rb);
-        rb_erase(n, &root->rb);
-        RB_CLEAR_NODE(n);
 }
 /*
@@ -470,8 +483,8 @@ static unsigned long cfq_slice_offset(struct cfq_data *cfqd,
 * requests waiting to be processed. It is sorted in the order that
 * we will service the queues.
 */
-static void cfq_service_tree_add(struct cfq_data *cfqd,
+static void cfq_service_tree_add(struct cfq_data *cfqd, struct cfq_queue *cfqq,
-                                    struct cfq_queue *cfqq, int add_front)
+                                 int add_front)
 {
        struct rb_node **p, *parent;
        struct cfq_queue *__cfqq;
@@ -544,6 +557,63 @@ static void cfq_service_tree_add(struct cfq_data *cfqd,
        rb_insert_color(&cfqq->rb_node, &cfqd->service_tree.rb);
 }
+static struct cfq_queue *
+cfq_prio_tree_lookup(struct cfq_data *cfqd, int ioprio, sector_t sector,
+                     struct rb_node **ret_parent, struct rb_node ***rb_link)
+{
+        struct rb_root *root = &cfqd->prio_trees[ioprio];
+        struct rb_node **p, *parent;
+        struct cfq_queue *cfqq = NULL;
+        parent = NULL;
+        p = &root->rb_node;
+        while (*p) {
+                struct rb_node **n;
+                parent = *p;
+                cfqq = rb_entry(parent, struct cfq_queue, p_node);
+                /*
+                 * Sort strictly based on sector.  Smallest to the left,
+                 * largest to the right.
+                 */
+                if (sector > cfqq->next_rq->sector)
+                        n = &(*p)->rb_right;
+                else if (sector < cfqq->next_rq->sector)
+                        n = &(*p)->rb_left;
+                else
+                        break;
+                p = n;
+        }
+        *ret_parent = parent;
+        if (rb_link)
+                *rb_link = p;
+        return NULL;
+}
+static void cfq_prio_tree_add(struct cfq_data *cfqd, struct cfq_queue *cfqq)
+{
+        struct rb_root *root = &cfqd->prio_trees[cfqq->ioprio];
+        struct rb_node **p, *parent;
+        struct cfq_queue *__cfqq;
+        if (!RB_EMPTY_NODE(&cfqq->p_node))
+                rb_erase_init(&cfqq->p_node, root);
+        if (cfq_class_idle(cfqq))
+                return;
+        if (!cfqq->next_rq)
+                return;
+        __cfqq = cfq_prio_tree_lookup(cfqd, cfqq->ioprio, cfqq->next_rq->sector,
+                                         &parent, &p);
+        BUG_ON(__cfqq);
+        rb_link_node(&cfqq->p_node, parent, p);
+        rb_insert_color(&cfqq->p_node, root);
+}
 /*
 * Update cfqq's position in the service tree.
 */
@@ -552,8 +622,10 @@ static void cfq_resort_rr_list(struct cfq_data *cfqd, struct cfq_queue *cfqq)
        /*
         * Resorting requires the cfqq to be on the RR list already.
         */
-        if (cfq_cfqq_on_rr(cfqq))
+        if (cfq_cfqq_on_rr(cfqq)) {
                cfq_service_tree_add(cfqd, cfqq, 0);
+                cfq_prio_tree_add(cfqd, cfqq);
+        }
 }
 /*
@@ -584,6 +656,8 @@ static void cfq_del_cfqq_rr(struct cfq_data *cfqd, struct cfq_queue *cfqq)
        if (!RB_EMPTY_NODE(&cfqq->rb_node))
                cfq_rb_erase(&cfqq->rb_node, &cfqd->service_tree);
+        if (!RB_EMPTY_NODE(&cfqq->p_node))
+                rb_erase_init(&cfqq->p_node, &cfqd->prio_trees[cfqq->ioprio]);
        BUG_ON(!cfqd->busy_queues);
        cfqd->busy_queues--;
@@ -613,7 +687,7 @@ static void cfq_add_rq_rb(struct request *rq)
 {
        struct cfq_queue *cfqq = RQ_CFQQ(rq);
        struct cfq_data *cfqd = cfqq->cfqd;
-        struct request *__alias;
+        struct request *__alias, *prev;
        cfqq->queued[rq_is_sync(rq)]++;
@@ -630,7 +704,15 @@ static void cfq_add_rq_rb(struct request *rq)
        /*
         * check if this request is a better next-serve candidate
         */
+        prev = cfqq->next_rq;
        cfqq->next_rq = cfq_choose_req(cfqd, cfqq->next_rq, rq);
+        /*
+         * adjust priority tree position, if ->next_rq changes
+         */
+        if (prev != cfqq->next_rq)
+                cfq_prio_tree_add(cfqd, cfqq);
        BUG_ON(!cfqq->next_rq);
 }
@@ -843,11 +925,15 @@ static struct cfq_queue *cfq_get_next_queue(struct cfq_data *cfqd)
 /*
 * Get and set a new active queue for service.
 */
-static struct cfq_queue *cfq_set_active_queue(struct cfq_data *cfqd)
+static struct cfq_queue *cfq_set_active_queue(struct cfq_data *cfqd,
+                                              struct cfq_queue *cfqq)
 {
-        struct cfq_queue *cfqq;
+        if (!cfqq) {
+                cfqq = cfq_get_next_queue(cfqd);
+                if (cfqq)
+                        cfq_clear_cfqq_coop(cfqq);
+        }
-        cfqq = cfq_get_next_queue(cfqd);
        __cfq_set_active_queue(cfqd, cfqq);
        return cfqq;
 }
@@ -871,17 +957,89 @@ static inline int cfq_rq_close(struct cfq_data *cfqd, struct request *rq)
        return cfq_dist_from_last(cfqd, rq) <= cic->seek_mean;
 }
-static int cfq_close_cooperator(struct cfq_data *cfq_data,
+static struct cfq_queue *cfqq_close(struct cfq_data *cfqd,
-                                struct cfq_queue *cfqq)
+                                    struct cfq_queue *cur_cfqq)
+{
+        struct rb_root *root = &cfqd->prio_trees[cur_cfqq->ioprio];
+        struct rb_node *parent, *node;
+        struct cfq_queue *__cfqq;
+        sector_t sector = cfqd->last_position;
+        if (RB_EMPTY_ROOT(root))
+                return NULL;
+        /*
+         * First, if we find a request starting at the end of the last
+         * request, choose it.
+         */
+        __cfqq = cfq_prio_tree_lookup(cfqd, cur_cfqq->ioprio,
+                                      sector, &parent, NULL);
+        if (__cfqq)
+                return __cfqq;
+        /*
+         * If the exact sector wasn't found, the parent of the NULL leaf
+         * will contain the closest sector.
+         */
+        __cfqq = rb_entry(parent, struct cfq_queue, p_node);
+        if (cfq_rq_close(cfqd, __cfqq->next_rq))
+                return __cfqq;
+        if (__cfqq->next_rq->sector < sector)
+                node = rb_next(&__cfqq->p_node);
+        else
+                node = rb_prev(&__cfqq->p_node);
+        if (!node)
+                return NULL;
+        __cfqq = rb_entry(node, struct cfq_queue, p_node);
+        if (cfq_rq_close(cfqd, __cfqq->next_rq))
+                return __cfqq;
+        return NULL;
+}
+/*
+ * cfqd - obvious
+ * cur_cfqq - passed in so that we don't decide that the current queue is
+ *            closely cooperating with itself.
+ *
+ * So, basically we're assuming that that cur_cfqq has dispatched at least
+ * one request, and that cfqd->last_position reflects a position on the disk
+ * associated with the I/O issued by cur_cfqq.  I'm not sure this is a valid
+ * assumption.
+ */
+static struct cfq_queue *cfq_close_cooperator(struct cfq_data *cfqd,
+                                              struct cfq_queue *cur_cfqq,
+                                              int probe)
 {
+        struct cfq_queue *cfqq;
+        /*
+         * A valid cfq_io_context is necessary to compare requests against
+         * the seek_mean of the current cfqq.
+         */
+        if (!cfqd->active_cic)
+                return NULL;
        /*
         * We should notice if some of the queues are cooperating, eg
         * working closely on the same area of the disk. In that case,
         * we can group them together and don't waste time idling.
         */
-        return 0;
+        cfqq = cfqq_close(cfqd, cur_cfqq);
+        if (!cfqq)
+                return NULL;
+        if (cfq_cfqq_coop(cfqq))
+                return NULL;
+        if (!probe)
+                cfq_mark_cfqq_coop(cfqq);
+        return cfqq;
 }
 #define CIC_SEEKY(cic) ((cic)->seek_mean > (8 * 1024))
 static void cfq_arm_slice_timer(struct cfq_data *cfqd)
@@ -920,13 +1078,6 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
        if (!cic || !atomic_read(&cic->ioc->nr_tasks))
                return;
-        /*
-         * See if this prio level has a good candidate
-         */
-        if (cfq_close_cooperator(cfqd, cfqq) &&
-            (sample_valid(cic->ttime_samples) && cic->ttime_mean > 2))
-                return;
        cfq_mark_cfqq_wait_request(cfqq);
        /*
@@ -939,7 +1090,7 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
                sl = min(sl, msecs_to_jiffies(CFQ_MIN_TT));
        mod_timer(&cfqd->idle_slice_timer, jiffies + sl);
-        cfq_log(cfqd, "arm_idle: %lu", sl);
+        cfq_log_cfqq(cfqd, cfqq, "arm_idle: %lu", sl);
 }
 /*
@@ -1003,7 +1154,7 @@ cfq_prio_to_maxrq(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 */
 static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
 {
-        struct cfq_queue *cfqq;
+        struct cfq_queue *cfqq, *new_cfqq = NULL;
        cfqq = cfqd->active_queue;
        if (!cfqq)
@@ -1037,6 +1188,16 @@ static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
                goto keep_queue;
        /*
+         * If another queue has a request waiting within our mean seek
+         * distance, let it run.  The expire code will check for close
+         * cooperators and put the close queue at the front of the service
+         * tree.
+         */
+        new_cfqq = cfq_close_cooperator(cfqd, cfqq, 0);
+        if (new_cfqq)
+                goto expire;
+        /*
         * No requests pending. If the active queue still has requests in
         * flight or is idling for a new request, allow either of these
         * conditions to happen (or time out) before selecting a new queue.
@@ -1050,7 +1211,7 @@ static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
 expire:
        cfq_slice_expired(cfqd, 0);
 new_queue:
-        cfqq = cfq_set_active_queue(cfqd);
+        cfqq = cfq_set_active_queue(cfqd, new_cfqq);
 keep_queue:
        return cfqq;
 }
@@ -1333,14 +1494,14 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
        if (ioc->ioc_data == cic)
                rcu_assign_pointer(ioc->ioc_data, NULL);
-        if (cic->cfqq[ASYNC]) {
+        if (cic->cfqq[BLK_RW_ASYNC]) {
-                cfq_exit_cfqq(cfqd, cic->cfqq[ASYNC]);
+                cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
-                cic->cfqq[ASYNC] = NULL;
+                cic->cfqq[BLK_RW_ASYNC] = NULL;
        }
-        if (cic->cfqq[SYNC]) {
+        if (cic->cfqq[BLK_RW_SYNC]) {
-                cfq_exit_cfqq(cfqd, cic->cfqq[SYNC]);
+                cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_SYNC]);
-                cic->cfqq[SYNC] = NULL;
+                cic->cfqq[BLK_RW_SYNC] = NULL;
        }
 }
@@ -1449,17 +1610,18 @@ static void changed_ioprio(struct io_context *ioc, struct cfq_io_context *cic)
        spin_lock_irqsave(cfqd->queue->queue_lock, flags);
-        cfqq = cic->cfqq[ASYNC];
+        cfqq = cic->cfqq[BLK_RW_ASYNC];
        if (cfqq) {
                struct cfq_queue *new_cfqq;
-                new_cfqq = cfq_get_queue(cfqd, ASYNC, cic->ioc, GFP_ATOMIC);
+                new_cfqq = cfq_get_queue(cfqd, BLK_RW_ASYNC, cic->ioc,
+                                                GFP_ATOMIC);
                if (new_cfqq) {
-                        cic->cfqq[ASYNC] = new_cfqq;
+                        cic->cfqq[BLK_RW_ASYNC] = new_cfqq;
                        cfq_put_queue(cfqq);
                }
        }
-        cfqq = cic->cfqq[SYNC];
+        cfqq = cic->cfqq[BLK_RW_SYNC];
        if (cfqq)
                cfq_mark_cfqq_prio_changed(cfqq);
@@ -1510,6 +1672,7 @@ retry:
                }
                RB_CLEAR_NODE(&cfqq->rb_node);
+                RB_CLEAR_NODE(&cfqq->p_node);
                INIT_LIST_HEAD(&cfqq->fifo);
                atomic_set(&cfqq->ref, 0);
@@ -1905,10 +2068,20 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                 * Remember that we saw a request from this process, but
                 * don't start queuing just yet. Otherwise we risk seeing lots
                 * of tiny requests, because we disrupt the normal plugging
-                 * and merging.
+                 * and merging. If the request is already larger than a single
+                 * page, let it rip immediately. For that case we assume that
+                 * merging is already done. Ditto for a busy system that
+                 * has other work pending, don't risk delaying until the
+                 * idle timer unplug to continue working.
                 */
-                if (cfq_cfqq_wait_request(cfqq))
+                if (cfq_cfqq_wait_request(cfqq)) {
+                        if (blk_rq_bytes(rq) > PAGE_CACHE_SIZE ||
+                            cfqd->busy_queues > 1) {
+                                del_timer(&cfqd->idle_slice_timer);
+                                blk_start_queueing(cfqd->queue);
+                        }
                        cfq_mark_cfqq_must_dispatch(cfqq);
+                }
        } else if (cfq_should_preempt(cfqd, cfqq, rq)) {
                /*
                 * not the active queue - expire current slice if it is
@@ -1992,16 +2165,24 @@ static void cfq_completed_request(struct request_queue *q, struct request *rq)
         * or if we want to idle in case it has no pending requests.
         */
        if (cfqd->active_queue == cfqq) {
+                const bool cfqq_empty = RB_EMPTY_ROOT(&cfqq->sort_list);
                if (cfq_cfqq_slice_new(cfqq)) {
                        cfq_set_prio_slice(cfqd, cfqq);
                        cfq_clear_cfqq_slice_new(cfqq);
                }
+                /*
+                 * If there are no requests waiting in this queue, and
+                 * there are other queues ready to issue requests, AND
+                 * those other queues are issuing requests within our
+                 * mean seek distance, give them a chance to run instead
+                 * of idling.
+                 */
                if (cfq_slice_used(cfqq) || cfq_class_idle(cfqq))
                        cfq_slice_expired(cfqd, 1);
-                else if (sync && !rq_noidle(rq) &&
+                else if (cfqq_empty && !cfq_close_cooperator(cfqd, cfqq, 1) &&
-                         RB_EMPTY_ROOT(&cfqq->sort_list)) {
+                         sync && !rq_noidle(rq))
                        cfq_arm_slice_timer(cfqd);
-                }
        }
        if (!cfqd->rq_in_driver)
@@ -2062,7 +2243,7 @@ static int cfq_may_queue(struct request_queue *q, int rw)
        if (!cic)
                return ELV_MQUEUE_MAY;
-        cfqq = cic_to_cfqq(cic, rw & REQ_RW_SYNC);
+        cfqq = cic_to_cfqq(cic, rw_is_sync(rw));
        if (cfqq) {
                cfq_init_prio_data(cfqq, cic->ioc);
                cfq_prio_boost(cfqq);
@@ -2152,11 +2333,10 @@ static void cfq_kick_queue(struct work_struct *work)
        struct cfq_data *cfqd =
                container_of(work, struct cfq_data, unplug_work);
        struct request_queue *q = cfqd->queue;
-        unsigned long flags;
-        spin_lock_irqsave(q->queue_lock, flags);
+        spin_lock_irq(q->queue_lock);
        blk_start_queueing(q);
-        spin_unlock_irqrestore(q->queue_lock, flags);
+        spin_unlock_irq(q->queue_lock);
 }
 /*
diff --git a/block/elevator.c b/block/elevator.c
index fb81bcc14a8c..7073a9072577 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -590,7 +590,7 @@ void elv_drain_elevator(struct request_queue *q)
 /*
 * Call with queue lock held, interrupts disabled
 */
-void elv_quisce_start(struct request_queue *q)
+void elv_quiesce_start(struct request_queue *q)
 {
        queue_flag_set(QUEUE_FLAG_ELVSWITCH, q);
@@ -607,7 +607,7 @@ void elv_quisce_start(struct request_queue *q)
        }
 }
-void elv_quisce_end(struct request_queue *q)
+void elv_quiesce_end(struct request_queue *q)
 {
        queue_flag_clear(QUEUE_FLAG_ELVSWITCH, q);
 }
@@ -1126,7 +1126,7 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         * Turn on BYPASS and drain all requests w/ elevator private data
         */
        spin_lock_irq(q->queue_lock);
-        elv_quisce_start(q);
+        elv_quiesce_start(q);
        /*
         * Remember old elevator.
@@ -1150,7 +1150,7 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         */
        elevator_exit(old_elevator);
        spin_lock_irq(q->queue_lock);
-        elv_quisce_end(q);
+        elv_quiesce_end(q);
        spin_unlock_irq(q->queue_lock);
        blk_add_trace_msg(q, "elv switch: %s", e->elevator_type->elevator_name);
diff --git a/block/ioctl.c b/block/ioctl.c
index 0f22e629b13c..ad474d4bbcce 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -146,8 +146,6 @@ static int blk_ioctl_discard(struct block_device *bdev, uint64_t start,
                struct bio *bio;
                bio = bio_alloc(GFP_KERNEL, 0);
-                if (!bio)
-                        return -ENOMEM;
                bio->bi_end_io = blk_ioc_discard_endio;
                bio->bi_bdev = bdev;
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 626ee274c5c4..84b7f8709f41 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -217,7 +217,7 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
 static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                                 struct bio *bio)
 {
-        int ret = 0;
+        int r, ret = 0;
        /*
         * fill in all the output members
@@ -242,7 +242,9 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                        ret = -EFAULT;
        }
-        blk_rq_unmap_user(bio);
+        r = blk_rq_unmap_user(bio);
+        if (!ret)
+                ret = r;
        blk_put_request(rq);
        return ret;
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index bdd4f5f45575..5f7e64ba87e5 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -275,8 +275,10 @@ static int brd_do_bvec(struct brd_device *brd, struct page *page,
        if (rw == READ) {
                copy_from_brd(mem + off, brd, sector, len);
                flush_dcache_page(page);
-        } else
+        } else {
+                flush_dcache_page(page);
                copy_to_brd(brd, mem + off, sector, len);
+        }
        kunmap_atomic(mem, KM_USER0);
 out:
@@ -436,6 +438,7 @@ static struct brd_device *brd_alloc(int i)
        if (!brd->brd_queue)
                goto out_free_dev;
        blk_queue_make_request(brd->brd_queue, brd_make_request);
+        blk_queue_ordered(brd->brd_queue, QUEUE_ORDERED_TAG, NULL);
        blk_queue_max_sectors(brd->brd_queue, 1024);
        blk_queue_bounce_limit(brd->brd_queue, BLK_BOUNCE_ANY);
diff --git a/drivers/md/dm-bio-list.h b/drivers/md/dm-bio-list.h
deleted file mode 100644
index 345098b4ca77..000000000000
--- a/drivers/md/dm-bio-list.h
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright (C) 2004 Red Hat UK Ltd.
- *
- * This file is released under the GPL.
- */
-#ifndef DM_BIO_LIST_H
-#define DM_BIO_LIST_H
-#include <linux/bio.h>
-#ifdef CONFIG_BLOCK
-struct bio_list {
-        struct bio *head;
-        struct bio *tail;
-};
-static inline int bio_list_empty(const struct bio_list *bl)
-{
-        return bl->head == NULL;
-}
-static inline void bio_list_init(struct bio_list *bl)
-{
-        bl->head = bl->tail = NULL;
-}
-#define bio_list_for_each(bio, bl) \
-        for (bio = (bl)->head; bio; bio = bio->bi_next)
-static inline unsigned bio_list_size(const struct bio_list *bl)
-{
-        unsigned sz = 0;
-        struct bio *bio;
-        bio_list_for_each(bio, bl)
-                sz++;
-        return sz;
-}
-static inline void bio_list_add(struct bio_list *bl, struct bio *bio)
-{
-        bio->bi_next = NULL;
-        if (bl->tail)
-                bl->tail->bi_next = bio;
-        else
-                bl->head = bio;
-        bl->tail = bio;
-}
-static inline void bio_list_add_head(struct bio_list *bl, struct bio *bio)
-{
-        bio->bi_next = bl->head;
-        bl->head = bio;
-        if (!bl->tail)
-                bl->tail = bio;
-}
-static inline void bio_list_merge(struct bio_list *bl, struct bio_list *bl2)
-{
-        if (!bl2->head)
-                return;
-        if (bl->tail)
-                bl->tail->bi_next = bl2->head;
-        else
-                bl->head = bl2->head;
-        bl->tail = bl2->tail;
-}
-static inline void bio_list_merge_head(struct bio_list *bl,
-                                       struct bio_list *bl2)
-{
-        if (!bl2->head)
-                return;
-        if (bl->head)
-                bl2->tail->bi_next = bl->head;
-        else
-                bl->tail = bl2->tail;
-        bl->head = bl2->head;
-}
-static inline struct bio *bio_list_pop(struct bio_list *bl)
-{
-        struct bio *bio = bl->head;
-        if (bio) {
-                bl->head = bl->head->bi_next;
-                if (!bl->head)
-                        bl->tail = NULL;
-                bio->bi_next = NULL;
-        }
-        return bio;
-}
-static inline struct bio *bio_list_get(struct bio_list *bl)
-{
-        struct bio *bio = bl->head;
-        bl->head = bl->tail = NULL;
-        return bio;
-}
-#endif /* CONFIG_BLOCK */
-#endif
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 59ee1b015d2d..559dbb52bc85 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -15,8 +15,6 @@
 #include <linux/device-mapper.h>
-#include "dm-bio-list.h"
 #define DM_MSG_PREFIX "delay"
 struct delay_c {
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 095f77bf9681..6a386ab4f7eb 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -8,7 +8,6 @@
 #include <linux/device-mapper.h>
 #include "dm-path-selector.h"
-#include "dm-bio-list.h"
 #include "dm-bio-record.h"
 #include "dm-uevent.h"
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 536ef0bef154..076fbb4e967a 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -5,7 +5,6 @@
 * This file is released under the GPL.
 */
-#include "dm-bio-list.h"
 #include "dm-bio-record.h"
 #include <linux/init.h>
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index 59f8d9df9e1a..7b899be0b087 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -14,7 +14,6 @@
 #include <linux/vmalloc.h>
 #include "dm.h"
-#include "dm-bio-list.h"
 #define DM_MSG_PREFIX   "region hash"
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 981a0413068f..d73f17fc7778 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -22,7 +22,6 @@
 #include <linux/workqueue.h>
 #include "dm-exception-store.h"
-#include "dm-bio-list.h"
 #define DM_MSG_PREFIX "snapshots"
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 8a994be035ba..424f7b048c30 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -6,7 +6,6 @@
 */
 #include "dm.h"
-#include "dm-bio-list.h"
 #include "dm-uevent.h"
 #include <linux/init.h>
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 274b491a11c1..36df9109cde1 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -35,7 +35,6 @@
 #include <linux/blkdev.h>
 #include <linux/seq_file.h>
 #include "md.h"
-#include "dm-bio-list.h"
 #include "raid1.h"
 #include "bitmap.h"
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index e293d92641ac..81a54f17417e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -22,7 +22,6 @@
 #include <linux/blkdev.h>
 #include <linux/seq_file.h>
 #include "md.h"
-#include "dm-bio-list.h"
 #include "raid10.h"
 #include "bitmap.h"
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 0570794ccf1c..d1815272c435 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -20,6 +20,7 @@
 #include <linux/slab.h>
 #include <linux/buffer_head.h>
 #include <linux/hdreg.h>
+#include <linux/async.h>
 #include <asm/ccwdev.h>
 #include <asm/ebcdic.h>
@@ -480,8 +481,10 @@ static void dasd_change_state(struct dasd_device *device)
        if (rc && rc != -EAGAIN)
                device->target = device->state;
-        if (device->state == device->target)
+        if (device->state == device->target) {
                wake_up(&dasd_init_waitq);
+                dasd_put_device(device);
+        }
        /* let user-space know that the device status changed */
        kobject_uevent(&device->cdev->dev.kobj, KOBJ_CHANGE);
@@ -513,12 +516,15 @@ void dasd_kick_device(struct dasd_device *device)
 */
 void dasd_set_target_state(struct dasd_device *device, int target)
 {
+        dasd_get_device(device);
        /* If we are in probeonly mode stop at DASD_STATE_READY. */
        if (dasd_probeonly && target > DASD_STATE_READY)
                target = DASD_STATE_READY;
        if (device->target != target) {
-                if (device->state == target)
+                if (device->state == target) {
                        wake_up(&dasd_init_waitq);
+                        dasd_put_device(device);
+                }
                device->target = target;
        }
        if (device->state != device->target)
@@ -2148,6 +2154,22 @@ dasd_exit(void)
 * SECTION: common functions for ccw_driver use
 */
+static void dasd_generic_auto_online(void *data, async_cookie_t cookie)
+{
+        struct ccw_device *cdev = data;
+        int ret;
+        ret = ccw_device_set_online(cdev);
+        if (ret)
+                pr_warning("%s: Setting the DASD online failed with rc=%d\n",
+                           dev_name(&cdev->dev), ret);
+        else {
+                struct dasd_device *device = dasd_device_from_cdev(cdev);
+                wait_event(dasd_init_waitq, _wait_for_device(device));
+                dasd_put_device(device);
+        }
+}
 /*
 * Initial attempt at a probe function. this can be simplified once
 * the other detection code is gone.
@@ -2180,10 +2202,7 @@ int dasd_generic_probe(struct ccw_device *cdev,
         */
        if ((dasd_get_feature(cdev, DASD_FEATURE_INITIAL_ONLINE) > 0 ) ||
            (dasd_autodetect && dasd_busid_known(dev_name(&cdev->dev)) != 0))
-                ret = ccw_device_set_online(cdev);
+                async_schedule(dasd_generic_auto_online, cdev);
-        if (ret)
-                pr_warning("%s: Setting the DASD online failed with rc=%d\n",
-                       dev_name(&cdev->dev), ret);
        return 0;
 }
@@ -2290,13 +2309,7 @@ int dasd_generic_set_online(struct ccw_device *cdev,
        } else
                pr_debug("dasd_generic device %s found\n",
                                dev_name(&cdev->dev));
-        /* FIXME: we have to wait for the root device but we don't want
-         * to wait for each single device but for all at once. */
-        wait_event(dasd_init_waitq, _wait_for_device(device));
        dasd_put_device(device);
        return rc;
 }
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 21254793c604..cb52da033f06 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2019,15 +2019,23 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_cmd_track(
                                ccw++;
                                recid += count;
                                new_track = 0;
+                                /* first idaw for a ccw may start anywhere */
+                                if (!idaw_dst)
+                                        idaw_dst = dst;
                        }
-                        /* If we start a new idaw, everything is fine and the
+                        /* If we start a new idaw, we must make sure that it
-                         * start of the new idaw is the start of this segment.
+                         * starts on an IDA_BLOCK_SIZE boundary.
                         * If we continue an idaw, we must make sure that the
                         * current segment begins where the so far accumulated
                         * idaw ends
                         */
-                        if (!idaw_dst)
+                        if (!idaw_dst) {
-                                idaw_dst = dst;
+                                if (__pa(dst) & (IDA_BLOCK_SIZE-1)) {
+                                        dasd_sfree_request(cqr, startdev);
+                                        return ERR_PTR(-ERANGE);
+                                } else
+                                        idaw_dst = dst;
+                        }
                        if ((idaw_dst + idaw_len) != dst) {
                                dasd_sfree_request(cqr, startdev);
                                return ERR_PTR(-ERANGE);
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 9e8a2914259b..accd957454e7 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -881,42 +881,6 @@ no_handler:
        qdio_set_state(irq_ptr, QDIO_IRQ_STATE_STOPPED);
 }
-static void qdio_call_shutdown(struct work_struct *work)
-{
-        struct ccw_device_private *priv;
-        struct ccw_device *cdev;
-        priv = container_of(work, struct ccw_device_private, kick_work);
-        cdev = priv->cdev;
-        qdio_shutdown(cdev, QDIO_FLAG_CLEANUP_USING_CLEAR);
-        put_device(&cdev->dev);
-}
-static void qdio_int_error(struct ccw_device *cdev)
-{
-        struct qdio_irq *irq_ptr = cdev->private->qdio_data;
-        switch (irq_ptr->state) {
-        case QDIO_IRQ_STATE_INACTIVE:
-        case QDIO_IRQ_STATE_CLEANUP:
-                qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR);
-                break;
-        case QDIO_IRQ_STATE_ESTABLISHED:
-        case QDIO_IRQ_STATE_ACTIVE:
-                qdio_set_state(irq_ptr, QDIO_IRQ_STATE_STOPPED);
-                if (get_device(&cdev->dev)) {
-                        /* Can't call shutdown from interrupt context. */
-                        PREPARE_WORK(&cdev->private->kick_work,
-                                     qdio_call_shutdown);
-                        queue_work(ccw_device_work, &cdev->private->kick_work);
-                }
-                break;
-        default:
-                WARN_ON(1);
-        }
-        wake_up(&cdev->private->wait_q);
-}
 static int qdio_establish_check_errors(struct ccw_device *cdev, int cstat,
                                       int dstat)
 {
@@ -973,10 +937,8 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                switch (PTR_ERR(irb)) {
                case -EIO:
                        DBF_ERROR("%4x IO error", irq_ptr->schid.sch_no);
-                        return;
+                        qdio_set_state(irq_ptr, QDIO_IRQ_STATE_ERR);
-                case -ETIMEDOUT:
+                        wake_up(&cdev->private->wait_q);
-                        DBF_ERROR("%4x IO timeout", irq_ptr->schid.sch_no);
-                        qdio_int_error(cdev);
                        return;
                default:
                        WARN_ON(1);
@@ -1001,7 +963,6 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
        case QDIO_IRQ_STATE_ACTIVE:
                if (cstat & SCHN_STAT_PCI) {
                        qdio_int_handler_pci(irq_ptr);
-                        /* no state change so no need to wake up wait_q */
                        return;
                }
                if ((cstat & ~SCHN_STAT_PCI) || dstat) {
diff --git a/fs/bio.c b/fs/bio.c
index e0c9e545bbfa..cd42bb882f30 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -348,6 +348,24 @@ err:
        return NULL;
 }
+/**
+ * bio_alloc - allocate a bio for I/O
+ * @gfp_mask:   the GFP_ mask given to the slab allocator
+ * @nr_iovecs:  number of iovecs to pre-allocate
+ *
+ * Description:
+ *   bio_alloc will allocate a bio and associated bio_vec array that can hold
+ *   at least @nr_iovecs entries. Allocations will be done from the
+ *   fs_bio_set. Also see @bio_alloc_bioset.
+ *
+ *   If %__GFP_WAIT is set, then bio_alloc will always be able to allocate
+ *   a bio. This is due to the mempool guarantees. To make this work, callers
+ *   must never allocate more than 1 bio at the time from this pool. Callers
+ *   that need to allocate more than 1 bio must always submit the previously
+ *   allocate bio for IO before attempting to allocate a new one. Failure to
+ *   do so can cause livelocks under memory pressure.
+ *
+ **/
 struct bio *bio_alloc(gfp_t gfp_mask, int nr_iovecs)
 {
        struct bio *bio = bio_alloc_bioset(gfp_mask, nr_iovecs, fs_bio_set);
diff --git a/fs/buffer.c b/fs/buffer.c
index 13edf7ad3ff1..ff8bb1f2333a 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -547,7 +547,7 @@ repeat:
        return err;
 }
-void do_thaw_all(unsigned long unused)
+void do_thaw_all(struct work_struct *work)
 {
        struct super_block *sb;
        char b[BDEVNAME_SIZE];
@@ -567,6 +567,7 @@ restart:
                        goto restart;
        }
        spin_unlock(&sb_lock);
+        kfree(work);
        printk(KERN_WARNING "Emergency Thaw complete\n");
 }
@@ -577,7 +578,13 @@ restart:
 */
 void emergency_thaw_all(void)
 {
-        pdflush_operation(do_thaw_all, 0);
+        struct work_struct *work;
+        work = kmalloc(sizeof(*work), GFP_ATOMIC);
+        if (work) {
+                INIT_WORK(work, do_thaw_all);
+                schedule_work(work);
+        }
 }
 /**
diff --git a/fs/direct-io.c b/fs/direct-io.c
index da258e7249cc..05763bbc2050 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -307,8 +307,6 @@ dio_bio_alloc(struct dio *dio, struct block_device *bdev,
        struct bio *bio;
        bio = bio_alloc(GFP_KERNEL, nr_vecs);
-        if (bio == NULL)
-                return -ENOMEM;
        bio->bi_bdev = bdev;
        bio->bi_sector = first_sector;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 6132353dcf62..2a1cb0979768 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2416,8 +2416,6 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
                        len = ee_len;
                bio = bio_alloc(GFP_NOIO, len);
-                if (!bio)
-                        return -ENOMEM;
                bio->bi_sector = ee_pblock;
                bio->bi_bdev   = inode->i_sb->s_bdev;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 3984e47d1d33..1afd9f26bcb1 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -597,7 +597,6 @@ __acquires(&gl->gl_spin)
        GLOCK_BUG_ON(gl, test_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags));
-        down_read(&gfs2_umount_flush_sem);
        if (test_bit(GLF_DEMOTE, &gl->gl_flags) &&
            gl->gl_demote_state != gl->gl_state) {
                if (find_first_holder(gl))
@@ -614,15 +613,14 @@ __acquires(&gl->gl_spin)
                if (ret == 0)
                        goto out_unlock;
                if (ret == 2)
-                        goto out_sem;
+                        goto out;
                gh = find_first_waiter(gl);
                gl->gl_target = gh->gh_state;
                if (!(gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)))
                        do_error(gl, 0); /* Fail queued try locks */
        }
        do_xmote(gl, gh, gl->gl_target);
-out_sem:
+out:
-        up_read(&gfs2_umount_flush_sem);
        return;
 out_sched:
@@ -631,7 +629,7 @@ out_sched:
                gfs2_glock_put(gl);
 out_unlock:
        clear_bit(GLF_LOCK, &gl->gl_flags);
-        goto out_sem;
+        goto out;
 }
 static void glock_work_func(struct work_struct *work)
@@ -641,6 +639,7 @@ static void glock_work_func(struct work_struct *work)
        if (test_and_clear_bit(GLF_REPLY_PENDING, &gl->gl_flags))
                finish_xmote(gl, gl->gl_reply);
+        down_read(&gfs2_umount_flush_sem);
        spin_lock(&gl->gl_spin);
        if (test_and_clear_bit(GLF_PENDING_DEMOTE, &gl->gl_flags) &&
            gl->gl_state != LM_ST_UNLOCKED &&
@@ -653,6 +652,7 @@ static void glock_work_func(struct work_struct *work)
        }
        run_queue(gl, 0);
        spin_unlock(&gl->gl_spin);
+        up_read(&gfs2_umount_flush_sem);
        if (!delay ||
            queue_delayed_work(glock_workqueue, &gl->gl_work, delay) == 0)
                gfs2_glock_put(gl);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 7b277d449155..5a31d426116f 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -137,15 +137,15 @@ void gfs2_set_iop(struct inode *inode)
        if (S_ISREG(mode)) {
                inode->i_op = &gfs2_file_iops;
                if (gfs2_localflocks(sdp))
-                        inode->i_fop = gfs2_file_fops_nolock;
+                        inode->i_fop = &gfs2_file_fops_nolock;
                else
-                        inode->i_fop = gfs2_file_fops;
+                        inode->i_fop = &gfs2_file_fops;
        } else if (S_ISDIR(mode)) {
                inode->i_op = &gfs2_dir_iops;
                if (gfs2_localflocks(sdp))
-                        inode->i_fop = gfs2_dir_fops_nolock;
+                        inode->i_fop = &gfs2_dir_fops_nolock;
                else
-                        inode->i_fop = gfs2_dir_fops;
+                        inode->i_fop = &gfs2_dir_fops;
        } else if (S_ISLNK(mode)) {
                inode->i_op = &gfs2_symlink_iops;
        } else {
diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h
index dca4fee3078b..c30be2b66580 100644
--- a/fs/gfs2/inode.h
+++ b/fs/gfs2/inode.h
@@ -101,21 +101,23 @@ void gfs2_dinode_print(const struct gfs2_inode *ip);
 extern const struct inode_operations gfs2_file_iops;
 extern const struct inode_operations gfs2_dir_iops;
 extern const struct inode_operations gfs2_symlink_iops;
-extern const struct file_operations *gfs2_file_fops_nolock;
+extern const struct file_operations gfs2_file_fops_nolock;
-extern const struct file_operations *gfs2_dir_fops_nolock;
+extern const struct file_operations gfs2_dir_fops_nolock;
 extern void gfs2_set_inode_flags(struct inode *inode);
 
 #ifdef CONFIG_GFS2_FS_LOCKING_DLM
-extern const struct file_operations *gfs2_file_fops;
+extern const struct file_operations gfs2_file_fops;
-extern const struct file_operations *gfs2_dir_fops;
+extern const struct file_operations gfs2_dir_fops;
 static inline int gfs2_localflocks(const struct gfs2_sbd *sdp)
 {
        return sdp->sd_args.ar_localflocks;
 }
 #else /* Single node only */
-#define gfs2_file_fops NULL
+#define gfs2_file_fops gfs2_file_fops_nolock
-#define gfs2_dir_fops NULL
+#define gfs2_dir_fops gfs2_dir_fops_nolock
 static inline int gfs2_localflocks(const struct gfs2_sbd *sdp)
 {
        return 1;
diff --git a/fs/gfs2/ops_file.c b/fs/gfs2/ops_file.c
index 70b9b8548945..101caf3ee861 100644
--- a/fs/gfs2/ops_file.c
+++ b/fs/gfs2/ops_file.c
@@ -705,7 +705,7 @@ static int gfs2_flock(struct file *file, int cmd, struct file_lock *fl)
        }
 }
-const struct file_operations *gfs2_file_fops = &(const struct file_operations){
+const struct file_operations gfs2_file_fops = {
        .llseek         = gfs2_llseek,
        .read           = do_sync_read,
        .aio_read       = generic_file_aio_read,
@@ -723,7 +723,7 @@ const struct file_operations *gfs2_file_fops = &(const struct file_operations){
        .setlease       = gfs2_setlease,
 };
-const struct file_operations *gfs2_dir_fops = &(const struct file_operations){
+const struct file_operations gfs2_dir_fops = {
        .readdir        = gfs2_readdir,
        .unlocked_ioctl = gfs2_ioctl,
        .open           = gfs2_open,
@@ -735,7 +735,7 @@ const struct file_operations *gfs2_dir_fops = &(const struct file_operations){
 #endif /* CONFIG_GFS2_FS_LOCKING_DLM */
-const struct file_operations *gfs2_file_fops_nolock = &(const struct file_operations){
+const struct file_operations gfs2_file_fops_nolock = {
        .llseek         = gfs2_llseek,
        .read           = do_sync_read,
        .aio_read       = generic_file_aio_read,
@@ -751,7 +751,7 @@ const struct file_operations *gfs2_file_fops_nolock = &(const struct file_operat
        .setlease       = generic_setlease,
 };
-const struct file_operations *gfs2_dir_fops_nolock = &(const struct file_operations){
+const struct file_operations gfs2_dir_fops_nolock = {
        .readdir        = gfs2_readdir,
        .unlocked_ioctl = gfs2_ioctl,
        .open           = gfs2_open,
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 51883b3ad89c..650a730707b7 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -272,11 +272,6 @@ static int gfs2_read_super(struct gfs2_sbd *sdp, sector_t sector)
        lock_page(page);
        bio = bio_alloc(GFP_NOFS, 1);
-        if (unlikely(!bio)) {
-                __free_page(page);
-                return -ENOBUFS;
-        }
        bio->bi_sector = sector * (sb->s_blocksize >> 9);
        bio->bi_bdev = sb->s_bdev;
        bio_add_page(bio, page, PAGE_SIZE, 0);
diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
index abd5429ae285..1c70fa5168d6 100644
--- a/fs/gfs2/ops_inode.c
+++ b/fs/gfs2/ops_inode.c
@@ -371,6 +371,7 @@ static int gfs2_symlink(struct inode *dir, struct dentry *dentry,
        ip = ghs[1].gh_gl->gl_object;
        ip->i_disksize = size;
+        i_size_write(inode, size);
        error = gfs2_meta_inode_buffer(ip, &dibh);
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 8d53f66b5bcc..152e6c4a0dca 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -81,7 +81,7 @@ struct gfs2_quota_change_host {
 static LIST_HEAD(qd_lru_list);
 static atomic_t qd_lru_count = ATOMIC_INIT(0);
-static spinlock_t qd_lru_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(qd_lru_lock);
 int gfs2_shrink_qd_memory(int nr, gfp_t gfp_mask)
 {
@@ -1364,7 +1364,7 @@ int gfs2_quotad(void *data)
                        refrigerator();
                t = min(quotad_timeo, statfs_timeo);
-                prepare_to_wait(&sdp->sd_quota_wait, &wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(&sdp->sd_quota_wait, &wait, TASK_INTERRUPTIBLE);
                spin_lock(&sdp->sd_trunc_lock);
                empty = list_empty(&sdp->sd_trunc_list);
                spin_unlock(&sdp->sd_trunc_lock);
diff --git a/fs/inode.c b/fs/inode.c
index d06d6d268de9..6ad14a1cd8c9 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1470,42 +1470,6 @@ static void __wait_on_freeing_inode(struct inode *inode)
        spin_lock(&inode_lock);
 }
-/*
- * We rarely want to lock two inodes that do not have a parent/child
- * relationship (such as directory, child inode) simultaneously. The
- * vast majority of file systems should be able to get along fine
- * without this. Do not use these functions except as a last resort.
- */
-void inode_double_lock(struct inode *inode1, struct inode *inode2)
-{
-        if (inode1 == NULL || inode2 == NULL || inode1 == inode2) {
-                if (inode1)
-                        mutex_lock(&inode1->i_mutex);
-                else if (inode2)
-                        mutex_lock(&inode2->i_mutex);
-                return;
-        }
-        if (inode1 < inode2) {
-                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_CHILD);
-        } else {
-                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_CHILD);
-        }
-}
-EXPORT_SYMBOL(inode_double_lock);
-void inode_double_unlock(struct inode *inode1, struct inode *inode2)
-{
-        if (inode1)
-                mutex_unlock(&inode1->i_mutex);
-        if (inode2 && inode2 != inode1)
-                mutex_unlock(&inode2->i_mutex);
-}
-EXPORT_SYMBOL(inode_double_unlock);
 static __initdata unsigned long ihash_entries;
 static int __init set_ihash_entries(char *str)
 {
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8672b9536039..c2a87c885b73 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1912,6 +1912,22 @@ out_sems:
        return written ? written : ret;
 }
+static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
+                                struct file *out,
+                                struct splice_desc *sd)
+{
+        int ret;
+        ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, &sd->pos,
+                                            sd->total_len, 0, NULL);
+        if (ret < 0) {
+                mlog_errno(ret);
+                return ret;
+        }
+        return splice_from_pipe_feed(pipe, sd, pipe_to_file);
+}
 static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                                       struct file *out,
                                       loff_t *ppos,
@@ -1919,38 +1935,76 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                                       unsigned int flags)
 {
        int ret;
-        struct inode *inode = out->f_path.dentry->d_inode;
+        struct address_space *mapping = out->f_mapping;
+        struct inode *inode = mapping->host;
+        struct splice_desc sd = {
+                .total_len = len,
+                .flags = flags,
+                .pos = *ppos,
+                .u.file = out,
+        };
        mlog_entry("(0x%p, 0x%p, %u, '%.*s')\n", out, pipe,
                   (unsigned int)len,
                   out->f_path.dentry->d_name.len,
                   out->f_path.dentry->d_name.name);
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);
-        ret = ocfs2_rw_lock(inode, 1);
+        splice_from_pipe_begin(&sd);
-        if (ret < 0) {
+        do {
-                mlog_errno(ret);
+                ret = splice_from_pipe_next(pipe, &sd);
-                goto out;
+                if (ret <= 0)
-        }
+                        break;
-        ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, ppos, len, 0,
+                mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
-                                            NULL);
+                ret = ocfs2_rw_lock(inode, 1);
-        if (ret < 0) {
+                if (ret < 0)
-                mlog_errno(ret);
+                        mlog_errno(ret);
-                goto out_unlock;
+                else {
-        }
+                        ret = ocfs2_splice_to_file(pipe, out, &sd);
+                        ocfs2_rw_unlock(inode, 1);
+                }
+                mutex_unlock(&inode->i_mutex);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, &sd);
        if (pipe->inode)
-                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
-        ret = generic_file_splice_write_nolock(pipe, out, ppos, len, flags);
-        if (pipe->inode)
                mutex_unlock(&pipe->inode->i_mutex);
-out_unlock:
+        if (sd.num_spliced)
-        ocfs2_rw_unlock(inode, 1);
+                ret = sd.num_spliced;
-out:
-        mutex_unlock(&inode->i_mutex);
+        if (ret > 0) {
+                unsigned long nr_pages;
+                *ppos += ret;
+                nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+                /*
+                 * If file or inode is SYNC and we actually wrote some data,
+                 * sync it.
+                 */
+                if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
+                        int err;
+                        mutex_lock(&inode->i_mutex);
+                        err = ocfs2_rw_lock(inode, 1);
+                        if (err < 0) {
+                                mlog_errno(err);
+                        } else {
+                                err = generic_osync_inode(inode, mapping,
+                                                  OSYNC_METADATA|OSYNC_DATA);
+                                ocfs2_rw_unlock(inode, 1);
+                        }
+                        mutex_unlock(&inode->i_mutex);
+                        if (err)
+                                ret = err;
+                }
+                balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
+        }
        mlog_exit(ret);
        return ret;
diff --git a/fs/pipe.c b/fs/pipe.c
index 4af7aa521813..13414ec45b8d 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -37,6 +37,42 @@
 * -- Manfred Spraul <manfred@colorfullife.com> 2002-05-09
 */
+static void pipe_lock_nested(struct pipe_inode_info *pipe, int subclass)
+{
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, subclass);
+}
+void pipe_lock(struct pipe_inode_info *pipe)
+{
+        /*
+         * pipe_lock() nests non-pipe inode locks (for writing to a file)
+         */
+        pipe_lock_nested(pipe, I_MUTEX_PARENT);
+}
+EXPORT_SYMBOL(pipe_lock);
+void pipe_unlock(struct pipe_inode_info *pipe)
+{
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
+}
+EXPORT_SYMBOL(pipe_unlock);
+void pipe_double_lock(struct pipe_inode_info *pipe1,
+                      struct pipe_inode_info *pipe2)
+{
+        BUG_ON(pipe1 == pipe2);
+        if (pipe1 < pipe2) {
+                pipe_lock_nested(pipe1, I_MUTEX_PARENT);
+                pipe_lock_nested(pipe2, I_MUTEX_CHILD);
+        } else {
+                pipe_lock_nested(pipe2, I_MUTEX_CHILD);
+                pipe_lock_nested(pipe1, I_MUTEX_PARENT);
+        }
+}
 /* Drop the inode semaphore and wait for a pipe event, atomically */
 void pipe_wait(struct pipe_inode_info *pipe)
 {
@@ -47,12 +83,10 @@ void pipe_wait(struct pipe_inode_info *pipe)
         * is considered a noninteractive wait:
         */
        prepare_to_wait(&pipe->wait, &wait, TASK_INTERRUPTIBLE);
-        if (pipe->inode)
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
        schedule();
        finish_wait(&pipe->wait, &wait);
-        if (pipe->inode)
+        pipe_lock(pipe);
-                mutex_lock(&pipe->inode->i_mutex);
 }
 static int
diff --git a/fs/splice.c b/fs/splice.c
index c18aa7e03e2b..5384a90665d0 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -182,8 +182,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
        do_wakeup = 0;
        page_nr = 0;
-        if (pipe->inode)
+        pipe_lock(pipe);
-                mutex_lock(&pipe->inode->i_mutex);
        for (;;) {
                if (!pipe->readers) {
@@ -245,15 +244,13 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
                pipe->waiting_writers--;
        }
-        if (pipe->inode) {
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
-                if (do_wakeup) {
+        if (do_wakeup) {
-                        smp_mb();
+                smp_mb();
-                        if (waitqueue_active(&pipe->wait))
+                if (waitqueue_active(&pipe->wait))
-                                wake_up_interruptible(&pipe->wait);
+                        wake_up_interruptible(&pipe->wait);
-                        kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+                kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
-                }
        }
        while (page_nr < spd_pages)
@@ -555,8 +552,8 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
 * SPLICE_F_MOVE isn't set, or we cannot move the page, we simply create
 * a new page in the output file page cache and fill/dirty that.
 */
-static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
+int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
-                        struct splice_desc *sd)
+                 struct splice_desc *sd)
 {
        struct file *file = sd->u.file;
        struct address_space *mapping = file->f_mapping;
@@ -600,108 +597,178 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 out:
        return ret;
 }
+EXPORT_SYMBOL(pipe_to_file);
+static void wakeup_pipe_writers(struct pipe_inode_info *pipe)
+{
+        smp_mb();
+        if (waitqueue_active(&pipe->wait))
+                wake_up_interruptible(&pipe->wait);
+        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
+}
 /**
- * __splice_from_pipe - splice data from a pipe to given actor
+ * splice_from_pipe_feed - feed available data from a pipe to a file
 * @pipe:       pipe to splice from
 * @sd:         information to @actor
 * @actor:      handler that splices the data
 *
 * Description:
- *    This function does little more than loop over the pipe and call
- *    @actor to do the actual moving of a single struct pipe_buffer to
+ *    This function loops over the pipe and calls @actor to do the
- *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
+ *    actual moving of a single struct pipe_buffer to the desired
- *    pipe_to_user.
+ *    destination.  It returns when there's no more buffers left in
+ *    the pipe or if the requested number of bytes (@sd->total_len)
+ *    have been copied.  It returns a positive number (one) if the
+ *    pipe needs to be filled with more data, zero if the required
+ *    number of bytes have been copied and -errno on error.
 *
+ *    This, together with splice_from_pipe_{begin,end,next}, may be
+ *    used to implement the functionality of __splice_from_pipe() when
+ *    locking is required around copying the pipe buffers to the
+ *    destination.
 */
-ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
+int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
-                           splice_actor *actor)
+                          splice_actor *actor)
 {
-        int ret, do_wakeup, err;
+        int ret;
-        ret = 0;
-        do_wakeup = 0;
-        for (;;) {
-                if (pipe->nrbufs) {
-                        struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
-                        const struct pipe_buf_operations *ops = buf->ops;
-                        sd->len = buf->len;
+        while (pipe->nrbufs) {
-                        if (sd->len > sd->total_len)
+                struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
-                                sd->len = sd->total_len;
+                const struct pipe_buf_operations *ops = buf->ops;
-                        err = actor(pipe, buf, sd);
+                sd->len = buf->len;
-                        if (err <= 0) {
+                if (sd->len > sd->total_len)
-                                if (!ret && err != -ENODATA)
+                        sd->len = sd->total_len;
-                                        ret = err;
-                                break;
+                ret = actor(pipe, buf, sd);
-                        }
+                if (ret <= 0) {
+                        if (ret == -ENODATA)
+                                ret = 0;
+                        return ret;
+                }
+                buf->offset += ret;
+                buf->len -= ret;
-                        ret += err;
+                sd->num_spliced += ret;
-                        buf->offset += err;
+                sd->len -= ret;
-                        buf->len -= err;
+                sd->pos += ret;
+                sd->total_len -= ret;
-                        sd->len -= err;
+                if (!buf->len) {
-                        sd->pos += err;
+                        buf->ops = NULL;
-                        sd->total_len -= err;
+                        ops->release(pipe, buf);
-                        if (sd->len)
+                        pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
-                                continue;
+                        pipe->nrbufs--;
+                        if (pipe->inode)
+                                sd->need_wakeup = true;
+                }
-                        if (!buf->len) {
+                if (!sd->total_len)
-                                buf->ops = NULL;
+                        return 0;
-                                ops->release(pipe, buf);
+        }
-                                pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
-                                pipe->nrbufs--;
-                                if (pipe->inode)
-                                        do_wakeup = 1;
-                        }
-                        if (!sd->total_len)
+        return 1;
-                                break;
+}
-                }
+EXPORT_SYMBOL(splice_from_pipe_feed);
-                if (pipe->nrbufs)
+/**
-                        continue;
+ * splice_from_pipe_next - wait for some data to splice from
+ * @pipe:       pipe to splice from
+ * @sd:         information about the splice operation
+ *
+ * Description:
+ *    This function will wait for some data and return a positive
+ *    value (one) if pipe buffers are available.  It will return zero
+ *    or -errno if no more data needs to be spliced.
+ */
+int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+{
+        while (!pipe->nrbufs) {
                if (!pipe->writers)
-                        break;
+                        return 0;
-                if (!pipe->waiting_writers) {
-                        if (ret)
-                                break;
-                }
-                if (sd->flags & SPLICE_F_NONBLOCK) {
+                if (!pipe->waiting_writers && sd->num_spliced)
-                        if (!ret)
+                        return 0;
-                                ret = -EAGAIN;
-                        break;
-                }
-                if (signal_pending(current)) {
+                if (sd->flags & SPLICE_F_NONBLOCK)
-                        if (!ret)
+                        return -EAGAIN;
-                                ret = -ERESTARTSYS;
-                        break;
-                }
-                if (do_wakeup) {
+                if (signal_pending(current))
-                        smp_mb();
+                        return -ERESTARTSYS;
-                        if (waitqueue_active(&pipe->wait))
-                                wake_up_interruptible_sync(&pipe->wait);
+                if (sd->need_wakeup) {
-                        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
+                        wakeup_pipe_writers(pipe);
-                        do_wakeup = 0;
+                        sd->need_wakeup = false;
                }
                pipe_wait(pipe);
        }
-        if (do_wakeup) {
+        return 1;
-                smp_mb();
+}
-                if (waitqueue_active(&pipe->wait))
+EXPORT_SYMBOL(splice_from_pipe_next);
-                        wake_up_interruptible(&pipe->wait);
-                kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
-        }
-        return ret;
+/**
+ * splice_from_pipe_begin - start splicing from pipe
+ * @pipe:       pipe to splice from
+ *
+ * Description:
+ *    This function should be called before a loop containing
+ *    splice_from_pipe_next() and splice_from_pipe_feed() to
+ *    initialize the necessary fields of @sd.
+ */
+void splice_from_pipe_begin(struct splice_desc *sd)
+{
+        sd->num_spliced = 0;
+        sd->need_wakeup = false;
+}
+EXPORT_SYMBOL(splice_from_pipe_begin);
+/**
+ * splice_from_pipe_end - finish splicing from pipe
+ * @pipe:       pipe to splice from
+ * @sd:         information about the splice operation
+ *
+ * Description:
+ *    This function will wake up pipe writers if necessary.  It should
+ *    be called after a loop containing splice_from_pipe_next() and
+ *    splice_from_pipe_feed().
+ */
+void splice_from_pipe_end(struct pipe_inode_info *pipe, struct splice_desc *sd)
+{
+        if (sd->need_wakeup)
+                wakeup_pipe_writers(pipe);
+}
+EXPORT_SYMBOL(splice_from_pipe_end);
+/**
+ * __splice_from_pipe - splice data from a pipe to given actor
+ * @pipe:       pipe to splice from
+ * @sd:         information to @actor
+ * @actor:      handler that splices the data
+ *
+ * Description:
+ *    This function does little more than loop over the pipe and call
+ *    @actor to do the actual moving of a single struct pipe_buffer to
+ *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
+ *    pipe_to_user.
+ *
+ */
+ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
+                           splice_actor *actor)
+{
+        int ret;
+        splice_from_pipe_begin(sd);
+        do {
+                ret = splice_from_pipe_next(pipe, sd);
+                if (ret > 0)
+                        ret = splice_from_pipe_feed(pipe, sd, actor);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, sd);
+        return sd->num_spliced ? sd->num_spliced : ret;
 }
 EXPORT_SYMBOL(__splice_from_pipe);
@@ -715,7 +782,7 @@ EXPORT_SYMBOL(__splice_from_pipe);
 * @actor:      handler that splices the data
 *
 * Description:
- *    See __splice_from_pipe. This function locks the input and output inodes,
+ *    See __splice_from_pipe. This function locks the pipe inode,
 *    otherwise it's identical to __splice_from_pipe().
 *
 */
@@ -724,7 +791,6 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                         splice_actor *actor)
 {
        ssize_t ret;
-        struct inode *inode = out->f_mapping->host;
        struct splice_desc sd = {
                .total_len = len,
                .flags = flags,
@@ -732,30 +798,15 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                .u.file = out,
        };
-        /*
+        pipe_lock(pipe);
-         * The actor worker might be calling ->write_begin and
-         * ->write_end. Most of the time, these expect i_mutex to
-         * be held. Since this may result in an ABBA deadlock with
-         * pipe->inode, we have to order lock acquiry here.
-         *
-         * Outer lock must be inode->i_mutex, as pipe_wait() will
-         * release and reacquire pipe->inode->i_mutex, AND inode must
-         * never be a pipe.
-         */
-        WARN_ON(S_ISFIFO(inode->i_mode));
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-        if (pipe->inode)
-                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
        ret = __splice_from_pipe(pipe, &sd, actor);
-        if (pipe->inode)
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
-        mutex_unlock(&inode->i_mutex);
        return ret;
 }
 /**
- * generic_file_splice_write_nolock - generic_file_splice_write without mutexes
+ * generic_file_splice_write - splice data from a pipe to a file
 * @pipe:       pipe info
 * @out:        file to write to
 * @ppos:       position in @out
@@ -764,13 +815,12 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
 *
 * Description:
 *    Will either move or copy pages (determined by @flags options) from
- *    the given pipe inode to the given file. The caller is responsible
+ *    the given pipe inode to the given file.
- *    for acquiring i_mutex on both inodes.
 *
 */
 ssize_t
-generic_file_splice_write_nolock(struct pipe_inode_info *pipe, struct file *out,
+generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
-                                 loff_t *ppos, size_t len, unsigned int flags)
+                          loff_t *ppos, size_t len, unsigned int flags)
 {
        struct address_space *mapping = out->f_mapping;
        struct inode *inode = mapping->host;
@@ -781,76 +831,28 @@ generic_file_splice_write_nolock(struct pipe_inode_info *pipe, struct file *out,
                .u.file = out,
        };
        ssize_t ret;
-        int err;
-        err = file_remove_suid(out);
-        if (unlikely(err))
-                return err;
-        ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
-        if (ret > 0) {
-                unsigned long nr_pages;
-                *ppos += ret;
+        pipe_lock(pipe);
-                nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-                /*
+        splice_from_pipe_begin(&sd);
-                 * If file or inode is SYNC and we actually wrote some data,
+        do {
-                 * sync it.
+                ret = splice_from_pipe_next(pipe, &sd);
-                 */
+                if (ret <= 0)
-                if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
+                        break;
-                        err = generic_osync_inode(inode, mapping,
-                                                  OSYNC_METADATA|OSYNC_DATA);
-                        if (err)
-                                ret = err;
-                }
-                balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
-        }
-        return ret;
+                mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
-}
+                ret = file_remove_suid(out);
+                if (!ret)
+                        ret = splice_from_pipe_feed(pipe, &sd, pipe_to_file);
+                mutex_unlock(&inode->i_mutex);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, &sd);
-EXPORT_SYMBOL(generic_file_splice_write_nolock);
+        pipe_unlock(pipe);
-/**
+        if (sd.num_spliced)
- * generic_file_splice_write - splice data from a pipe to a file
+                ret = sd.num_spliced;
- * @pipe:       pipe info
- * @out:        file to write to
- * @ppos:       position in @out
- * @len:        number of bytes to splice
- * @flags:      splice modifier flags
- *
- * Description:
- *    Will either move or copy pages (determined by @flags options) from
- *    the given pipe inode to the given file.
- *
- */
-ssize_t
-generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
-                          loff_t *ppos, size_t len, unsigned int flags)
-{
-        struct address_space *mapping = out->f_mapping;
-        struct inode *inode = mapping->host;
-        struct splice_desc sd = {
-                .total_len = len,
-                .flags = flags,
-                .pos = *ppos,
-                .u.file = out,
-        };
-        ssize_t ret;
-        WARN_ON(S_ISFIFO(inode->i_mode));
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-        ret = file_remove_suid(out);
-        if (likely(!ret)) {
-                if (pipe->inode)
-                        mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
-                ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
-                if (pipe->inode)
-                        mutex_unlock(&pipe->inode->i_mutex);
-        }
-        mutex_unlock(&inode->i_mutex);
        if (ret > 0) {
                unsigned long nr_pages;
@@ -1339,8 +1341,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
        if (!pipe)
                return -EBADF;
-        if (pipe->inode)
+        pipe_lock(pipe);
-                mutex_lock(&pipe->inode->i_mutex);
        error = ret = 0;
        while (nr_segs) {
@@ -1395,8 +1396,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
                iov++;
        }
-        if (pipe->inode)
+        pipe_unlock(pipe);
-                mutex_unlock(&pipe->inode->i_mutex);
        if (!ret)
                ret = error;
@@ -1524,7 +1524,7 @@ static int link_ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                return 0;
        ret = 0;
-        mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
        while (!pipe->nrbufs) {
                if (signal_pending(current)) {
@@ -1542,7 +1542,7 @@ static int link_ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                pipe_wait(pipe);
        }
-        mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
        return ret;
 }
@@ -1562,7 +1562,7 @@ static int link_opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                return 0;
        ret = 0;
-        mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
        while (pipe->nrbufs >= PIPE_BUFFERS) {
                if (!pipe->readers) {
@@ -1583,7 +1583,7 @@ static int link_opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                pipe->waiting_writers--;
        }
-        mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
        return ret;
 }
@@ -1599,10 +1599,10 @@ static int link_pipe(struct pipe_inode_info *ipipe,
        /*
         * Potential ABBA deadlock, work around it by ordering lock
-         * grabbing by inode address. Otherwise two different processes
+         * grabbing by pipe info address. Otherwise two different processes
         * could deadlock (one doing tee from A -> B, the other from B -> A).
         */
-        inode_double_lock(ipipe->inode, opipe->inode);
+        pipe_double_lock(ipipe, opipe);
        do {
                if (!opipe->readers) {
@@ -1653,7 +1653,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
        if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
                ret = -EAGAIN;
-        inode_double_unlock(ipipe->inode, opipe->inode);
+        pipe_unlock(ipipe);
+        pipe_unlock(opipe);
        /*
         * If we put data in the output pipe, wakeup any potential readers.
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 37b82cb96c89..e727fe0d1451 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -88,7 +88,7 @@ extern void warn_slowpath(const char *file, const int line,
 #else /* !CONFIG_BUG */
 #ifndef HAVE_ARCH_BUG
-#define BUG()
+#define BUG() do {} while(0)
 #endif
 #ifndef HAVE_ARCH_BUG_ON
diff --git a/include/linux/bio.h b/include/linux/bio.h
index b900d2c67d29..b89cf2d82898 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -504,6 +504,115 @@ static inline int bio_has_data(struct bio *bio)
        return bio && bio->bi_io_vec != NULL;
 }
+/*
+ * BIO list managment for use by remapping drivers (e.g. DM or MD).
+ *
+ * A bio_list anchors a singly-linked list of bios chained through the bi_next
+ * member of the bio.  The bio_list also caches the last list member to allow
+ * fast access to the tail.
+ */
+struct bio_list {
+        struct bio *head;
+        struct bio *tail;
+};
+static inline int bio_list_empty(const struct bio_list *bl)
+{
+        return bl->head == NULL;
+}
+static inline void bio_list_init(struct bio_list *bl)
+{
+        bl->head = bl->tail = NULL;
+}
+#define bio_list_for_each(bio, bl) \
+        for (bio = (bl)->head; bio; bio = bio->bi_next)
+static inline unsigned bio_list_size(const struct bio_list *bl)
+{
+        unsigned sz = 0;
+        struct bio *bio;
+        bio_list_for_each(bio, bl)
+                sz++;
+        return sz;
+}
+static inline void bio_list_add(struct bio_list *bl, struct bio *bio)
+{
+        bio->bi_next = NULL;
+        if (bl->tail)
+                bl->tail->bi_next = bio;
+        else
+                bl->head = bio;
+        bl->tail = bio;
+}
+static inline void bio_list_add_head(struct bio_list *bl, struct bio *bio)
+{
+        bio->bi_next = bl->head;
+        bl->head = bio;
+        if (!bl->tail)
+                bl->tail = bio;
+}
+static inline void bio_list_merge(struct bio_list *bl, struct bio_list *bl2)
+{
+        if (!bl2->head)
+                return;
+        if (bl->tail)
+                bl->tail->bi_next = bl2->head;
+        else
+                bl->head = bl2->head;
+        bl->tail = bl2->tail;
+}
+static inline void bio_list_merge_head(struct bio_list *bl,
+                                       struct bio_list *bl2)
+{
+        if (!bl2->head)
+                return;
+        if (bl->head)
+                bl2->tail->bi_next = bl->head;
+        else
+                bl->tail = bl2->tail;
+        bl->head = bl2->head;
+}
+static inline struct bio *bio_list_pop(struct bio_list *bl)
+{
+        struct bio *bio = bl->head;
+        if (bio) {
+                bl->head = bl->head->bi_next;
+                if (!bl->head)
+                        bl->tail = NULL;
+                bio->bi_next = NULL;
+        }
+        return bio;
+}
+static inline struct bio *bio_list_get(struct bio_list *bl)
+{
+        struct bio *bio = bl->head;
+        bl->head = bl->tail = NULL;
+        return bio;
+}
 #if defined(CONFIG_BLK_DEV_INTEGRITY)
 #define bip_vec_idx(bip, idx)   (&(bip->bip_vec[(idx)]))
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 562d2855cf30..e766be0d4329 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -87,6 +87,60 @@ struct inodes_stat_t {
 */
 #define FMODE_NOCMTIME          ((__force fmode_t)2048)
+/*
+ * The below are the various read and write types that we support. Some of
+ * them include behavioral modifiers that send information down to the
+ * block layer and IO scheduler. Terminology:
+ *
+ *      The block layer uses device plugging to defer IO a little bit, in
+ *      the hope that we will see more IO very shortly. This increases
+ *      coalescing of adjacent IO and thus reduces the number of IOs we
+ *      have to send to the device. It also allows for better queuing,
+ *      if the IO isn't mergeable. If the caller is going to be waiting
+ *      for the IO, then he must ensure that the device is unplugged so
+ *      that the IO is dispatched to the driver.
+ *
+ *      All IO is handled async in Linux. This is fine for background
+ *      writes, but for reads or writes that someone waits for completion
+ *      on, we want to notify the block layer and IO scheduler so that they
+ *      know about it. That allows them to make better scheduling
+ *      decisions. So when the below references 'sync' and 'async', it
+ *      is referencing this priority hint.
+ *
+ * With that in mind, the available types are:
+ *
+ * READ                 A normal read operation. Device will be plugged.
+ * READ_SYNC            A synchronous read. Device is not plugged, caller can
+ *                      immediately wait on this read without caring about
+ *                      unplugging.
+ * READA                Used for read-ahead operations. Lower priority, and the
+ *                       block layer could (in theory) choose to ignore this
+ *                      request if it runs into resource problems.
+ * WRITE                A normal async write. Device will be plugged.
+ * SWRITE               Like WRITE, but a special case for ll_rw_block() that
+ *                      tells it to lock the buffer first. Normally a buffer
+ *                      must be locked before doing IO.
+ * WRITE_SYNC_PLUG      Synchronous write. Identical to WRITE, but passes down
+ *                      the hint that someone will be waiting on this IO
+ *                      shortly. The device must still be unplugged explicitly,
+ *                      WRITE_SYNC_PLUG does not do this as we could be
+ *                      submitting more writes before we actually wait on any
+ *                      of them.
+ * WRITE_SYNC           Like WRITE_SYNC_PLUG, but also unplugs the device
+ *                      immediately after submission. The write equivalent
+ *                      of READ_SYNC.
+ * WRITE_ODIRECT        Special case write for O_DIRECT only.
+ * SWRITE_SYNC
+ * SWRITE_SYNC_PLUG     Like WRITE_SYNC/WRITE_SYNC_PLUG, but locks the buffer.
+ *                      See SWRITE.
+ * WRITE_BARRIER        Like WRITE, but tells the block layer that all
+ *                      previously submitted writes must be safely on storage
+ *                      before this one is started. Also guarantees that when
+ *                      this write is complete, it itself is also safely on
+ *                      storage. Prevents reordering of writes on both sides
+ *                      of this IO.
+ *
+ */
 #define RW_MASK         1
 #define RWA_MASK        2
 #define READ 0
@@ -102,6 +156,11 @@ struct inodes_stat_t {
                        (SWRITE | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_NOIDLE))
 #define SWRITE_SYNC     (SWRITE_SYNC_PLUG | (1 << BIO_RW_UNPLUG))
 #define WRITE_BARRIER   (WRITE | (1 << BIO_RW_BARRIER))
+/*
+ * These aren't really reads or writes, they pass down information about
+ * parts of device that are now unused by the file system.
+ */
 #define DISCARD_NOBARRIER (1 << BIO_RW_DISCARD)
 #define DISCARD_BARRIER ((1 << BIO_RW_DISCARD) | (1 << BIO_RW_BARRIER))
@@ -738,9 +797,6 @@ enum inode_i_mutex_lock_class
        I_MUTEX_QUOTA
 };
-extern void inode_double_lock(struct inode *inode1, struct inode *inode2);
-extern void inode_double_unlock(struct inode *inode1, struct inode *inode2);
 /*
 * NOTE: in a 32bit arch with a preemptable kernel and
 * an UP compile the i_size_read/write must be atomic
@@ -2150,8 +2206,6 @@ extern ssize_t generic_file_splice_read(struct file *, loff_t *,
                struct pipe_inode_info *, size_t, unsigned int);
 extern ssize_t generic_file_splice_write(struct pipe_inode_info *,
                struct file *, loff_t *, size_t, unsigned int);
-extern ssize_t generic_file_splice_write_nolock(struct pipe_inode_info *,
-                struct file *, loff_t *, size_t, unsigned int);
 extern ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe,
                struct file *out, loff_t *, size_t len, unsigned int flags);
 extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
diff --git a/include/linux/fsl_devices.h b/include/linux/fsl_devices.h
index f2a78b5e8b55..43fc95d822d5 100644
--- a/include/linux/fsl_devices.h
+++ b/include/linux/fsl_devices.h
@@ -43,10 +43,6 @@
 *
 */
-/* Flags related to I2C device features */
-#define FSL_I2C_DEV_SEPARATE_DFSRR      0x00000001
-#define FSL_I2C_DEV_CLOCK_5200          0x00000002
 enum fsl_usb2_operating_modes {
        FSL_USB2_MPH_HOST,
        FSL_USB2_DR_HOST,
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 8e4120285f72..c8f038554e80 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -134,6 +134,11 @@ struct pipe_buf_operations {
   memory allocation, whereas PIPE_BUF makes atomicity guarantees.  */
 #define PIPE_SIZE               PAGE_SIZE
+/* Pipe lock and unlock operations */
+void pipe_lock(struct pipe_inode_info *);
+void pipe_unlock(struct pipe_inode_info *);
+void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
 /* Drop the inode semaphore and wait for a pipe event, atomically */
 void pipe_wait(struct pipe_inode_info *pipe);
diff --git a/include/linux/splice.h b/include/linux/splice.h
index 528dcb93c2f2..5f3faa9d15ae 100644
--- a/include/linux/splice.h
+++ b/include/linux/splice.h
@@ -36,6 +36,8 @@ struct splice_desc {
                void *data;             /* cookie */
        } u;
        loff_t pos;                     /* file position */
+        size_t num_spliced;             /* number of bytes already spliced */
+        bool need_wakeup;               /* need to wake up writer */
 };
 struct partial_page {
@@ -66,6 +68,16 @@ extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
                                splice_actor *);
 extern ssize_t __splice_from_pipe(struct pipe_inode_info *,
                                  struct splice_desc *, splice_actor *);
+extern int splice_from_pipe_feed(struct pipe_inode_info *, struct splice_desc *,
+                                 splice_actor *);
+extern int splice_from_pipe_next(struct pipe_inode_info *,
+                                 struct splice_desc *);
+extern void splice_from_pipe_begin(struct splice_desc *);
+extern void splice_from_pipe_end(struct pipe_inode_info *,
+                                 struct splice_desc *);
+extern int pipe_to_file(struct pipe_inode_info *, struct pipe_buffer *,
+                        struct splice_desc *);
 extern ssize_t splice_to_pipe(struct pipe_inode_info *,
                              struct splice_pipe_desc *);
 extern ssize_t splice_direct_to_actor(struct file *, struct splice_desc *,
diff --git a/include/sound/jack.h b/include/sound/jack.h
index 6b013c6f6a04..f236e426a706 100644
--- a/include/sound/jack.h
+++ b/include/sound/jack.h
@@ -50,6 +50,8 @@ struct snd_jack {
        int type;
        const char *id;
        char name[100];
+        void *private_data;
+        void (*private_free)(struct snd_jack *);
 };
 #ifdef CONFIG_SND_JACK
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index 8904b1900d7f..c17296891617 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -268,7 +268,8 @@ struct snd_pcm_runtime {
        int overrange;
        snd_pcm_uframes_t avail_max;
        snd_pcm_uframes_t hw_ptr_base;  /* Position at buffer restart */
-        snd_pcm_uframes_t hw_ptr_interrupt; /* Position at interrupt time*/
+        snd_pcm_uframes_t hw_ptr_interrupt; /* Position at interrupt time */
+        unsigned long hw_ptr_jiffies;   /* Time when hw_ptr is updated */
        /* -- HW params -- */
        snd_pcm_access_t access;        /* access mode */
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 505f319e489c..8ba052c86d48 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -64,8 +64,6 @@ static int submit(int rw, pgoff_t page_off, struct page *page,
        struct bio *bio;
        bio = bio_alloc(__GFP_WAIT | __GFP_HIGH, 1);
-        if (!bio)
-                return -ENOMEM;
        bio->bi_sector = page_off * (PAGE_SIZE >> 9);
        bio->bi_bdev = resume_bdev;
        bio->bi_end_io = end_swap_bio_read;
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 2c7b8457d0d2..a967c9feb90a 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -58,6 +58,10 @@ static DEFINE_MUTEX(rcu_barrier_mutex);
 static struct completion rcu_barrier_completion;
 int rcu_scheduler_active __read_mostly;
+static atomic_t rcu_migrate_type_count = ATOMIC_INIT(0);
+static struct rcu_head rcu_migrate_head[3];
+static DECLARE_WAIT_QUEUE_HEAD(rcu_migrate_wq);
 /*
 * Awaken the corresponding synchronize_rcu() instance now that a
 * grace period has elapsed.
@@ -122,7 +126,10 @@ static void rcu_barrier_func(void *type)
        }
 }
-static inline void wait_migrated_callbacks(void);
+static inline void wait_migrated_callbacks(void)
+{
+        wait_event(rcu_migrate_wq, !atomic_read(&rcu_migrate_type_count));
+}
 /*
 * Orchestrate the specified type of RCU barrier, waiting for all
@@ -179,21 +186,12 @@ void rcu_barrier_sched(void)
 }
 EXPORT_SYMBOL_GPL(rcu_barrier_sched);
-static atomic_t rcu_migrate_type_count = ATOMIC_INIT(0);
-static struct rcu_head rcu_migrate_head[3];
-static DECLARE_WAIT_QUEUE_HEAD(rcu_migrate_wq);
 static void rcu_migrate_callback(struct rcu_head *notused)
 {
        if (atomic_dec_and_test(&rcu_migrate_type_count))
                wake_up(&rcu_migrate_wq);
 }
-static inline void wait_migrated_callbacks(void)
-{
-        wait_event(rcu_migrate_wq, !atomic_read(&rcu_migrate_type_count));
-}
 static int __cpuinit rcu_barrier_cpu_hotplug(struct notifier_block *self,
                unsigned long action, void *hcpu)
 {
diff --git a/sound/core/control.c b/sound/core/control.c
index 4b20fa2b7e6d..17b8d47a5cd0 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -723,14 +723,11 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
 {
        struct snd_ctl_elem_value *control;
        int result;
-        
-        control = kmalloc(sizeof(*control), GFP_KERNEL);
+        control = memdup_user(_control, sizeof(*control));
-        if (control == NULL)
+        if (IS_ERR(control))
-                return -ENOMEM; 
+                return PTR_ERR(control);
-        if (copy_from_user(control, _control, sizeof(*control))) {
-                kfree(control);
-                return -EFAULT;
-        }
        snd_power_lock(card);
        result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
        if (result >= 0)
@@ -784,13 +781,10 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
        struct snd_card *card;
        int result;
-        control = kmalloc(sizeof(*control), GFP_KERNEL);
+        control = memdup_user(_control, sizeof(*control));
-        if (control == NULL)
+        if (IS_ERR(control))
-                return -ENOMEM; 
+                return PTR_ERR(control);
-        if (copy_from_user(control, _control, sizeof(*control))) {
-                kfree(control);
-                return -EFAULT;
-        }
        card = file->card;
        snd_power_lock(card);
        result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
@@ -916,13 +910,10 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
        if (op_flag > 0) {
                if (size > 1024 * 128)  /* sane value */
                        return -EINVAL;
-                new_data = kmalloc(size, GFP_KERNEL);
-                if (new_data == NULL)
+                new_data = memdup_user(tlv, size);
-                        return -ENOMEM;
+                if (IS_ERR(new_data))
-                if (copy_from_user(new_data, tlv, size)) {
+                        return PTR_ERR(new_data);
-                        kfree(new_data);
-                        return -EFAULT;
-                }
                change = ue->tlv_data_size != size;
                if (!change)
                        change = memcmp(ue->tlv_data, new_data, size);
diff --git a/sound/core/jack.c b/sound/core/jack.c
index c8254c667c62..d54d1a05fe65 100644
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -35,6 +35,9 @@ static int snd_jack_dev_free(struct snd_device *device)
 {
        struct snd_jack *jack = device->device_data;
+        if (jack->private_free)
+                jack->private_free(jack);
        /* If the input device is registered with the input subsystem
         * then we need to use a different deallocator. */
        if (jack->registered)
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 36d7a5998234..08bfed594a83 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -232,14 +232,11 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
        if (! (runtime = substream->runtime))
                return -ENOTTY;
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (data == NULL)
-                return -ENOMEM;
        /* only fifo_size is different, so just copy all */
-        if (copy_from_user(data, data32, sizeof(*data32))) {
+        data = memdup_user(data32, sizeof(*data32));
-                err = -EFAULT;
+        if (IS_ERR(data))
-                goto error;
+                return PTR_ERR(data);
-        }
        if (refine)
                err = snd_pcm_hw_refine(substream, data);
        else
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index fbb2e391591e..63d088f2265f 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -209,9 +209,11 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
 {
        struct snd_pcm_runtime *runtime = substream->runtime;
        snd_pcm_uframes_t pos;
-        snd_pcm_uframes_t new_hw_ptr, hw_ptr_interrupt, hw_base;
+        snd_pcm_uframes_t old_hw_ptr, new_hw_ptr, hw_ptr_interrupt, hw_base;
-        snd_pcm_sframes_t delta;
+        snd_pcm_sframes_t hdelta, delta;
+        unsigned long jdelta;
+        old_hw_ptr = runtime->status->hw_ptr;
        pos = snd_pcm_update_hw_ptr_pos(substream, runtime);
        if (pos == SNDRV_PCM_POS_XRUN) {
                xrun(substream);
@@ -247,7 +249,30 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                        new_hw_ptr = hw_base + pos;
                }
        }
-        if (delta > runtime->period_size) {
+        hdelta = new_hw_ptr - old_hw_ptr;
+        jdelta = jiffies - runtime->hw_ptr_jiffies;
+        if (((hdelta * HZ) / runtime->rate) > jdelta + HZ/100) {
+                delta = jdelta /
+                        (((runtime->period_size * HZ) / runtime->rate)
+                                                                + HZ/100);
+                hw_ptr_error(substream,
+                             "hw_ptr skipping! [Q] "
+                             "(pos=%ld, delta=%ld, period=%ld, "
+                             "jdelta=%lu/%lu/%lu)\n",
+                             (long)pos, (long)hdelta,
+                             (long)runtime->period_size, jdelta,
+                             ((hdelta * HZ) / runtime->rate), delta);
+                hw_ptr_interrupt = runtime->hw_ptr_interrupt +
+                                   runtime->period_size * delta;
+                if (hw_ptr_interrupt >= runtime->boundary)
+                        hw_ptr_interrupt -= runtime->boundary;
+                /* rebase to interrupt position */
+                hw_base = new_hw_ptr = hw_ptr_interrupt;
+                /* align hw_base to buffer_size */
+                hw_base -= hw_base % runtime->buffer_size;
+                delta = 0;
+        }
+        if (delta > runtime->period_size + runtime->period_size / 2) {
                hw_ptr_error(substream,
                             "Lost interrupts? "
                             "(stream=%i, delta=%ld, intr_ptr=%ld)\n",
@@ -263,6 +288,7 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
        runtime->hw_ptr_base = hw_base;
        runtime->status->hw_ptr = new_hw_ptr;
+        runtime->hw_ptr_jiffies = jiffies;
        runtime->hw_ptr_interrupt = hw_ptr_interrupt;
        return snd_pcm_update_hw_ptr_post(substream, runtime);
@@ -275,6 +301,7 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
        snd_pcm_uframes_t pos;
        snd_pcm_uframes_t old_hw_ptr, new_hw_ptr, hw_base;
        snd_pcm_sframes_t delta;
+        unsigned long jdelta;
        old_hw_ptr = runtime->status->hw_ptr;
        pos = snd_pcm_update_hw_ptr_pos(substream, runtime);
@@ -286,14 +313,15 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
        new_hw_ptr = hw_base + pos;
        delta = new_hw_ptr - old_hw_ptr;
+        jdelta = jiffies - runtime->hw_ptr_jiffies;
        if (delta < 0) {
                delta += runtime->buffer_size;
                if (delta < 0) {
                        hw_ptr_error(substream, 
                                     "Unexpected hw_pointer value [2] "
-                                     "(stream=%i, pos=%ld, old_ptr=%ld)\n",
+                                     "(stream=%i, pos=%ld, old_ptr=%ld, jdelta=%li)\n",
                                     substream->stream, (long)pos,
-                                     (long)old_hw_ptr);
+                                     (long)old_hw_ptr, jdelta);
                        return 0;
                }
                hw_base += runtime->buffer_size;
@@ -301,12 +329,13 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
                        hw_base = 0;
                new_hw_ptr = hw_base + pos;
        }
-        if (delta > runtime->period_size && runtime->periods > 1) {
+        if (((delta * HZ) / runtime->rate) > jdelta + HZ/100) {
                hw_ptr_error(substream,
                             "hw_ptr skipping! "
-                             "(pos=%ld, delta=%ld, period=%ld)\n",
+                             "(pos=%ld, delta=%ld, period=%ld, jdelta=%lu/%lu)\n",
                             (long)pos, (long)delta,
-                             (long)runtime->period_size);
+                             (long)runtime->period_size, jdelta,
+                             ((delta * HZ) / runtime->rate));
                return 0;
        }
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
@@ -315,6 +344,7 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
        runtime->hw_ptr_base = hw_base;
        runtime->status->hw_ptr = new_hw_ptr;
+        runtime->hw_ptr_jiffies = jiffies;
        return snd_pcm_update_hw_ptr_post(substream, runtime);
 }
@@ -1441,6 +1471,7 @@ static int snd_pcm_lib_ioctl_reset(struct snd_pcm_substream *substream,
                runtime->status->hw_ptr %= runtime->buffer_size;
        else
                runtime->status->hw_ptr = 0;
+        runtime->hw_ptr_jiffies = jiffies;
        snd_pcm_stream_unlock_irqrestore(substream, flags);
        return 0;
 }
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index a151fb01ba82..fc6f98e257df 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -327,21 +327,16 @@ static int snd_pcm_hw_refine_user(struct snd_pcm_substream *substream,
        struct snd_pcm_hw_params *params;
        int err;
-        params = kmalloc(sizeof(*params), GFP_KERNEL);
+        params = memdup_user(_params, sizeof(*params));
-        if (!params) {
+        if (IS_ERR(params))
-                err = -ENOMEM;
+                return PTR_ERR(params);
-                goto out;
-        }
-        if (copy_from_user(params, _params, sizeof(*params))) {
-                err = -EFAULT;
-                goto out;
-        }
        err = snd_pcm_hw_refine(substream, params);
        if (copy_to_user(_params, params, sizeof(*params))) {
                if (!err)
                        err = -EFAULT;
        }
-out:
        kfree(params);
        return err;
 }
@@ -465,21 +460,16 @@ static int snd_pcm_hw_params_user(struct snd_pcm_substream *substream,
        struct snd_pcm_hw_params *params;
        int err;
-        params = kmalloc(sizeof(*params), GFP_KERNEL);
+        params = memdup_user(_params, sizeof(*params));
-        if (!params) {
+        if (IS_ERR(params))
-                err = -ENOMEM;
+                return PTR_ERR(params);
-                goto out;
-        }
-        if (copy_from_user(params, _params, sizeof(*params))) {
-                err = -EFAULT;
-                goto out;
-        }
        err = snd_pcm_hw_params(substream, params);
        if (copy_to_user(_params, params, sizeof(*params))) {
                if (!err)
                        err = -EFAULT;
        }
-out:
        kfree(params);
        return err;
 }
@@ -2593,13 +2583,11 @@ static int snd_pcm_playback_ioctl1(struct file *file,
                        return -EFAULT;
                if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
                        return -EFAULT;
-                bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
-                if (bufs == NULL)
+                bufs = memdup_user(xfern.bufs,
-                        return -ENOMEM;
+                                   sizeof(void *) * runtime->channels);
-                if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
+                if (IS_ERR(bufs))
-                        kfree(bufs);
+                        return PTR_ERR(bufs);
-                        return -EFAULT;
-                }
                result = snd_pcm_lib_writev(substream, bufs, xfern.frames);
                kfree(bufs);
                __put_user(result, &_xfern->result);
@@ -2675,13 +2663,11 @@ static int snd_pcm_capture_ioctl1(struct file *file,
                        return -EFAULT;
                if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
                        return -EFAULT;
-                bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
-                if (bufs == NULL)
+                bufs = memdup_user(xfern.bufs,
-                        return -ENOMEM;
+                                   sizeof(void *) * runtime->channels);
-                if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
+                if (IS_ERR(bufs))
-                        kfree(bufs);
+                        return PTR_ERR(bufs);
-                        return -EFAULT;
-                }
                result = snd_pcm_lib_readv(substream, bufs, xfern.frames);
                kfree(bufs);
                __put_user(result, &_xfern->result);
@@ -3312,18 +3298,12 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
        int err;
        params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
+        if (!params)
-                err = -ENOMEM;
+                return -ENOMEM;
-                goto out;
-        }
-        oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
-        if (!oparams) {
-                err = -ENOMEM;
-                goto out;
-        }
-        if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
+        oparams = memdup_user(_oparams, sizeof(*oparams));
-                err = -EFAULT;
+        if (IS_ERR(oparams)) {
+                err = PTR_ERR(oparams);
                goto out;
        }
        snd_pcm_hw_convert_from_old_params(params, oparams);
@@ -3333,9 +3313,10 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
                if (!err)
                        err = -EFAULT;
        }
+        kfree(oparams);
 out:
        kfree(params);
-        kfree(oparams);
        return err;
 }
@@ -3347,17 +3328,12 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
        int err;
        params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
+        if (!params)
-                err = -ENOMEM;
+                return -ENOMEM;
-                goto out;
-        }
+        oparams = memdup_user(_oparams, sizeof(*oparams));
-        oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
+        if (IS_ERR(oparams)) {
-        if (!oparams) {
+                err = PTR_ERR(oparams);
-                err = -ENOMEM;
-                goto out;
-        }
-        if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
-                err = -EFAULT;
                goto out;
        }
        snd_pcm_hw_convert_from_old_params(params, oparams);
@@ -3367,9 +3343,10 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
                if (!err)
                        err = -EFAULT;
        }
+        kfree(oparams);
 out:
        kfree(params);
-        kfree(oparams);
        return err;
 }
 #endif /* CONFIG_SND_SUPPORT_OLD_API */
diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
index 38693f47c262..c956fe462569 100644
--- a/sound/core/seq/seq_compat.c
+++ b/sound/core/seq/seq_compat.c
@@ -48,12 +48,11 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
        struct snd_seq_port_info *data;
        mm_segment_t fs;
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        data = memdup_user(data32, sizeof(*data32));
-        if (! data)
+        if (IS_ERR(data))
-                return -ENOMEM;
+                return PTR_ERR(data);
-        if (copy_from_user(data, data32, sizeof(*data32)) ||
+        if (get_user(data->flags, &data32->flags) ||
-            get_user(data->flags, &data32->flags) ||
            get_user(data->time_queue, &data32->time_queue))
                goto error;
        data->kernel = NULL;
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 3f0050d0b71e..8f8b17ac074d 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1395,13 +1395,10 @@ static int snd_timer_user_ginfo(struct file *file,
        struct list_head *p;
        int err = 0;
-        ginfo = kmalloc(sizeof(*ginfo), GFP_KERNEL);
+        ginfo = memdup_user(_ginfo, sizeof(*ginfo));
-        if (! ginfo)
+        if (IS_ERR(ginfo))
-                return -ENOMEM;
+                return PTR_ERR(ginfo);
-        if (copy_from_user(ginfo, _ginfo, sizeof(*ginfo))) {
-                kfree(ginfo);
-                return -EFAULT;
-        }
        tid = ginfo->tid;
        memset(ginfo, 0, sizeof(*ginfo));
        ginfo->tid = tid;
diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index 49037d074c71..bdc8dde4e4a2 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -684,15 +684,16 @@ static int snd_sb_csp_load(struct snd_sb_csp * p, const unsigned char *buf, int
 
 static int snd_sb_csp_load_user(struct snd_sb_csp * p, const unsigned char __user *buf, int size, int load_flags)
 {
-        int err = -ENOMEM;
+        int err;
-        unsigned char *kbuf = kmalloc(size, GFP_KERNEL);
+        unsigned char *kbuf;
-        if (kbuf) {
-                if (copy_from_user(kbuf, buf, size))
+        kbuf = memdup_user(buf, size);
-                        err = -EFAULT;
+        if (IS_ERR(kbuf))
-                else
+                return PTR_ERR(kbuf);
-                        err = snd_sb_csp_load(p, kbuf, size, load_flags);
-                kfree(kbuf);
+        err = snd_sb_csp_load(p, kbuf, size, load_flags);
-        }
+        kfree(kbuf);
        return err;
 }
diff --git a/sound/isa/wavefront/wavefront_fx.c b/sound/isa/wavefront/wavefront_fx.c
index a4345fc07561..2bb1cee09255 100644
--- a/sound/isa/wavefront/wavefront_fx.c
+++ b/sound/isa/wavefront/wavefront_fx.c
@@ -202,15 +202,11 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file,
                                            "> 512 bytes to FX\n");
                                return -EIO;
                        }
-                        page_data = kmalloc(r.data[2] * sizeof(short), GFP_KERNEL);
+                        page_data = memdup_user((unsigned char __user *)
-                        if (!page_data)
+                                                r.data[3],
-                                return -ENOMEM;
+                                                r.data[2] * sizeof(short));
-                        if (copy_from_user (page_data,
+                        if (IS_ERR(page_data))
-                                            (unsigned char __user *) r.data[3],
+                                return PTR_ERR(page_data);
-                                            r.data[2] * sizeof(short))) {
-                                kfree(page_data);
-                                return -EFAULT;
-                        }
                        pd = page_data;
                }
diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
index beb312cca75b..5d4ff48c4345 100644
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -1664,12 +1664,11 @@ snd_wavefront_synth_ioctl (struct snd_hwdep *hw, struct file *file,
                break;
        case WFCTL_WFCMD:
-                wc = kmalloc(sizeof(*wc), GFP_KERNEL);
+                wc = memdup_user(argp, sizeof(*wc));
-                if (! wc)
+                if (IS_ERR(wc))
-                        return -ENOMEM;
+                        return PTR_ERR(wc);
-                if (copy_from_user (wc, argp, sizeof (*wc)))
-                        err = -EFAULT;
+                if (wavefront_synth_control (acard, wc) < 0)
-                else if (wavefront_synth_control (acard, wc) < 0)
                        err = -EIO;
                else if (copy_to_user (argp, wc, sizeof (*wc)))
                        err = -EFAULT;
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index 191e1cd9997d..4b302d86f5f2 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -2493,24 +2493,17 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
        case SNDRV_EMU10K1_IOCTL_CODE_POKE:
                if (!capable(CAP_SYS_ADMIN))
                        return -EPERM;
-                icode = kmalloc(sizeof(*icode), GFP_KERNEL);
-                if (icode == NULL)
+                icode = memdup_user(argp, sizeof(*icode));
-                        return -ENOMEM;
+                if (IS_ERR(icode))
-                if (copy_from_user(icode, argp, sizeof(*icode))) {
+                        return PTR_ERR(icode);
-                        kfree(icode);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_icode_poke(emu, icode);
                kfree(icode);
                return res;
        case SNDRV_EMU10K1_IOCTL_CODE_PEEK:
-                icode = kmalloc(sizeof(*icode), GFP_KERNEL);
+                icode = memdup_user(argp, sizeof(*icode));
-                if (icode == NULL)
+                if (IS_ERR(icode))
-                        return -ENOMEM;
+                        return PTR_ERR(icode);
-                if (copy_from_user(icode, argp, sizeof(*icode))) {
-                        kfree(icode);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_icode_peek(emu, icode);
                if (res == 0 && copy_to_user(argp, icode, sizeof(*icode))) {
                        kfree(icode);
@@ -2519,24 +2512,16 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
                kfree(icode);
                return res;
        case SNDRV_EMU10K1_IOCTL_PCM_POKE:
-                ipcm = kmalloc(sizeof(*ipcm), GFP_KERNEL);
+                ipcm = memdup_user(argp, sizeof(*ipcm));
-                if (ipcm == NULL)
+                if (IS_ERR(ipcm))
-                        return -ENOMEM;
+                        return PTR_ERR(ipcm);
-                if (copy_from_user(ipcm, argp, sizeof(*ipcm))) {
-                        kfree(ipcm);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_ipcm_poke(emu, ipcm);
                kfree(ipcm);
                return res;
        case SNDRV_EMU10K1_IOCTL_PCM_PEEK:
-                ipcm = kzalloc(sizeof(*ipcm), GFP_KERNEL);
+                ipcm = memdup_user(argp, sizeof(*ipcm));
-                if (ipcm == NULL)
+                if (IS_ERR(ipcm))
-                        return -ENOMEM;
+                        return PTR_ERR(ipcm);
-                if (copy_from_user(ipcm, argp, sizeof(*ipcm))) {
-                        kfree(ipcm);
-                        return -EFAULT;
-                }
                res = snd_emu10k1_ipcm_peek(emu, ipcm);
                if (res == 0 && copy_to_user(argp, ipcm, sizeof(*ipcm))) {
                        kfree(ipcm);
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index a4e5e5952115..fd6e6f337d10 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2250,7 +2250,11 @@ int snd_hda_codec_write_cache(struct hda_codec *codec, hda_nid_t nid,
        err = bus->ops.command(bus, res);
        if (!err) {
                struct hda_cache_head *c;
-                u32 key = build_cmd_cache_key(nid, verb);
+                u32 key;
+                /* parm may contain the verb stuff for get/set amp */
+                verb = verb | (parm >> 8);
+                parm &= 0xff;
+                key = build_cmd_cache_key(nid, verb);
                c = get_alloc_hash(&codec->cmd_cache, key);
                if (c)
                        c->val = parm;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 7ba8db5d4c42..bc882f8f163c 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -312,6 +312,9 @@ struct azx_dev {
        unsigned int period_bytes; /* size of the period in bytes */
        unsigned int frags;     /* number for period in the play buffer */
        unsigned int fifo_size; /* FIFO size */
+        unsigned int start_flag: 1;     /* stream full start flag */
+        unsigned long start_jiffies;    /* start + minimum jiffies */
+        unsigned long min_jiffies;      /* minimum jiffies before position is valid */
        void __iomem *sd_addr;  /* stream descriptor pointer */
@@ -330,7 +333,6 @@ struct azx_dev {
        unsigned int opened :1;
        unsigned int running :1;
        unsigned int irq_pending :1;
-        unsigned int irq_ignore :1;
        /*
         * For VIA:
         *  A flag to ensure DMA position is 0
@@ -975,7 +977,7 @@ static irqreturn_t azx_interrupt(int irq, void *dev_id)
        struct azx *chip = dev_id;
        struct azx_dev *azx_dev;
        u32 status;
-        int i;
+        int i, ok;
        spin_lock(&chip->reg_lock);
@@ -991,18 +993,14 @@ static irqreturn_t azx_interrupt(int irq, void *dev_id)
                        azx_sd_writeb(azx_dev, SD_STS, SD_INT_MASK);
                        if (!azx_dev->substream || !azx_dev->running)
                                continue;
-                        /* ignore the first dummy IRQ (due to pos_adj) */
-                        if (azx_dev->irq_ignore) {
-                                azx_dev->irq_ignore = 0;
-                                continue;
-                        }
                        /* check whether this IRQ is really acceptable */
-                        if (azx_position_ok(chip, azx_dev)) {
+                        ok = azx_position_ok(chip, azx_dev);
+                        if (ok == 1) {
                                azx_dev->irq_pending = 0;
                                spin_unlock(&chip->reg_lock);
                                snd_pcm_period_elapsed(azx_dev->substream);
                                spin_lock(&chip->reg_lock);
-                        } else if (chip->bus && chip->bus->workq) {
+                        } else if (ok == 0 && chip->bus && chip->bus->workq) {
                                /* bogus IRQ, process it later */
                                azx_dev->irq_pending = 1;
                                queue_work(chip->bus->workq,
@@ -1088,7 +1086,6 @@ static int azx_setup_periods(struct azx *chip,
        bdl = (u32 *)azx_dev->bdl.area;
        ofs = 0;
        azx_dev->frags = 0;
-        azx_dev->irq_ignore = 0;
        pos_adj = bdl_pos_adj[chip->dev_index];
        if (pos_adj > 0) {
                struct snd_pcm_runtime *runtime = substream->runtime;
@@ -1109,7 +1106,6 @@ static int azx_setup_periods(struct azx *chip,
                                         &bdl, ofs, pos_adj, 1);
                        if (ofs < 0)
                                goto error;
-                        azx_dev->irq_ignore = 1;
                }
        } else
                pos_adj = 0;
@@ -1155,6 +1151,9 @@ static void azx_stream_reset(struct azx *chip, struct azx_dev *azx_dev)
        while (((val = azx_sd_readb(azx_dev, SD_CTL)) & SD_CTL_STREAM_RESET) &&
               --timeout)
                ;
+        /* reset first position - may not be synced with hw at this time */
+        *azx_dev->posbuf = 0;
 }
 /*
@@ -1409,7 +1408,6 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
        snd_pcm_set_sync(substream);
        mutex_unlock(&chip->open_mutex);
-        azx_stream_reset(chip, azx_dev);
        return 0;
 }
@@ -1474,6 +1472,7 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
        unsigned int bufsize, period_bytes, format_val;
        int err;
+        azx_stream_reset(chip, azx_dev);
        format_val = snd_hda_calc_stream_format(runtime->rate,
                                                runtime->channels,
                                                runtime->format,
@@ -1502,6 +1501,8 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
                        return err;
        }
+        azx_dev->min_jiffies = (runtime->period_size * HZ) /
+                                                (runtime->rate * 2);
        azx_setup_controller(chip, azx_dev);
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                azx_dev->fifo_size = azx_sd_readw(azx_dev, SD_FIFOSIZE) + 1;
@@ -1518,13 +1519,14 @@ static int azx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
        struct azx *chip = apcm->chip;
        struct azx_dev *azx_dev;
        struct snd_pcm_substream *s;
-        int start, nsync = 0, sbits = 0;
+        int rstart = 0, start, nsync = 0, sbits = 0;
        int nwait, timeout;
        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+                rstart = 1;
        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
        case SNDRV_PCM_TRIGGER_RESUME:
-        case SNDRV_PCM_TRIGGER_START:
                start = 1;
                break;
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
@@ -1554,6 +1556,10 @@ static int azx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
                if (s->pcm->card != substream->pcm->card)
                        continue;
                azx_dev = get_azx_dev(s);
+                if (rstart) {
+                        azx_dev->start_flag = 1;
+                        azx_dev->start_jiffies = jiffies + azx_dev->min_jiffies;
+                }
                if (start)
                        azx_stream_start(chip, azx_dev);
                else
@@ -1703,6 +1709,11 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
 {
        unsigned int pos;
+        if (azx_dev->start_flag &&
+            time_before_eq(jiffies, azx_dev->start_jiffies))
+                return -1;      /* bogus (too early) interrupt */
+        azx_dev->start_flag = 0;
        pos = azx_get_position(chip, azx_dev);
        if (chip->position_fix == POS_FIX_AUTO) {
                if (!pos) {
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 1f2ad76ca94b..56ce19e68cb5 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -350,12 +350,20 @@ static int conexant_mux_enum_put(struct snd_kcontrol *kcontrol,
 }
 #ifdef CONFIG_SND_JACK
+static void conexant_free_jack_priv(struct snd_jack *jack)
+{
+        struct conexant_jack *jacks = jack->private_data;
+        jacks->nid = 0;
+        jacks->jack = NULL;
+}
 static int conexant_add_jack(struct hda_codec *codec,
                hda_nid_t nid, int type)
 {
        struct conexant_spec *spec;
        struct conexant_jack *jack;
        const char *name;
+        int err;
        spec = codec->spec;
        snd_array_init(&spec->jacks, sizeof(*jack), 32);
@@ -368,7 +376,12 @@ static int conexant_add_jack(struct hda_codec *codec,
        jack->nid = nid;
        jack->type = type;
-        return snd_jack_new(codec->bus->card, name, type, &jack->jack);
+        err = snd_jack_new(codec->bus->card, name, type, &jack->jack);
+        if (err < 0)
+                return err;
+        jack->jack->private_data = jack;
+        jack->jack->private_free = conexant_free_jack_priv;
+        return 0;
 }
 static void conexant_report_jack(struct hda_codec *codec, hda_nid_t nid)
@@ -455,8 +468,10 @@ static void conexant_free(struct hda_codec *codec)
        if (spec->jacks.list) {
                struct conexant_jack *jacks = spec->jacks.list;
                int i;
-                for (i = 0; i < spec->jacks.used; i++)
+                for (i = 0; i < spec->jacks.used; i++, jacks++) {
-                        snd_device_free(codec->bus->card, &jacks[i].jack);
+                        if (jacks->jack)
+                                snd_device_free(codec->bus->card, jacks->jack);
+                }
                snd_array_free(&spec->jacks);
        }
 #endif
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f35e58a2d921..6ed787eedd06 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8742,10 +8742,9 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
        SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC883_LAPTOP_EAPD),
        SND_PCI_QUIRK(0x15d9, 0x8780, "Supermicro PDSBA", ALC883_3ST_6ch),
        SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_MEDION),
-        SND_PCI_QUIRK(0x1734, 0x1107, "FSC AMILO Xi2550",
+        SND_PCI_QUIRK_MASK(0x1734, 0xfff0, 0x1100, "FSC AMILO Xi/Pi25xx",
                      ALC883_FUJITSU_PI2515),
-        SND_PCI_QUIRK(0x1734, 0x1108, "Fujitsu AMILO Pi2515", ALC883_FUJITSU_PI2515),
+        SND_PCI_QUIRK_MASK(0x1734, 0xfff0, 0x1130, "Fujitsu AMILO Xa35xx",
-        SND_PCI_QUIRK(0x1734, 0x113d, "Fujitsu AMILO Xa3530",
                ALC888_FUJITSU_XA3530),
        SND_PCI_QUIRK(0x17aa, 0x101e, "Lenovo 101e", ALC883_LENOVO_101E_2ch),
        SND_PCI_QUIRK(0x17aa, 0x2085, "Lenovo NB0763", ALC883_LENOVO_NB0763),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 61996a2f45df..ce30b459aee6 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -3851,6 +3851,15 @@ static void stac_gpio_set(struct hda_codec *codec, unsigned int mask,
                           AC_VERB_SET_GPIO_DATA, gpiostate); /* sync */
 }
+#ifdef CONFIG_SND_JACK
+static void stac92xx_free_jack_priv(struct snd_jack *jack)
+{
+        struct sigmatel_jack *jacks = jack->private_data;
+        jacks->nid = 0;
+        jacks->jack = NULL;
+}
+#endif
 static int stac92xx_add_jack(struct hda_codec *codec,
                hda_nid_t nid, int type)
 {
@@ -3860,6 +3869,7 @@ static int stac92xx_add_jack(struct hda_codec *codec,
        int def_conf = snd_hda_codec_get_pincfg(codec, nid);
        int connectivity = get_defcfg_connect(def_conf);
        char name[32];
+        int err;
        if (connectivity && connectivity != AC_JACK_PORT_FIXED)
                return 0;
@@ -3876,10 +3886,15 @@ static int stac92xx_add_jack(struct hda_codec *codec,
                snd_hda_get_jack_connectivity(def_conf),
                snd_hda_get_jack_location(def_conf));
-        return snd_jack_new(codec->bus->card, name, type, &jack->jack);
+        err = snd_jack_new(codec->bus->card, name, type, &jack->jack);
-#else
+        if (err < 0) {
-        return 0;
+                jack->nid = 0;
+                return err;
+        }
+        jack->jack->private_data = jack;
+        jack->jack->private_free = stac92xx_free_jack_priv;
 #endif
+        return 0;
 }
 static int stac_add_event(struct sigmatel_spec *spec, hda_nid_t nid,
@@ -4138,8 +4153,10 @@ static void stac92xx_free_jacks(struct hda_codec *codec)
        if (!codec->bus->shutdown && spec->jacks.list) {
                struct sigmatel_jack *jacks = spec->jacks.list;
                int i;
-                for (i = 0; i < spec->jacks.used; i++)
+                for (i = 0; i < spec->jacks.used; i++, jacks++) {
-                        snd_device_free(codec->bus->card, &jacks[i].jack);
+                        if (jacks->jack)
+                                snd_device_free(codec->bus->card, jacks->jack);
+                }
        }
        snd_array_free(&spec->jacks);
 #endif
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 57648810eaf1..5dced5b79387 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -355,6 +355,9 @@ struct ichdev {
        unsigned int fragsize1;
        unsigned int position;
        unsigned int pos_shift;
+        unsigned int last_pos;
+        unsigned long last_pos_jiffies;
+        unsigned int jiffy_to_bytes;
        int frags;
        int lvi;
        int lvi_frag;
@@ -838,7 +841,10 @@ static int snd_intel8x0_pcm_trigger(struct snd_pcm_substream *substream, int cmd
                ichdev->suspended = 0;
                /* fallthru */
        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
                val = ICH_IOCE | ICH_STARTBM;
+                ichdev->last_pos = ichdev->position;
+                ichdev->last_pos_jiffies = jiffies;
                break;
        case SNDRV_PCM_TRIGGER_SUSPEND:
                ichdev->suspended = 1;
@@ -849,9 +855,6 @@ static int snd_intel8x0_pcm_trigger(struct snd_pcm_substream *substream, int cmd
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                val = ICH_IOCE;
                break;
-        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                val = ICH_IOCE | ICH_STARTBM;
-                break;
        default:
                return -EINVAL;
        }
@@ -1045,6 +1048,7 @@ static int snd_intel8x0_pcm_prepare(struct snd_pcm_substream *substream)
                        ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1;
        }
        snd_intel8x0_setup_periods(chip, ichdev);
+        ichdev->jiffy_to_bytes = (runtime->rate * 4 * ichdev->pos_shift) / HZ;
        return 0;
 }
@@ -1053,7 +1057,7 @@ static snd_pcm_uframes_t snd_intel8x0_pcm_pointer(struct snd_pcm_substream *subs
        struct intel8x0 *chip = snd_pcm_substream_chip(substream);
        struct ichdev *ichdev = get_ichdev(substream);
        size_t ptr1, ptr;
-        int civ, timeout = 100;
+        int civ, timeout = 10;
        unsigned int position;
        spin_lock(&chip->reg_lock);
@@ -1069,9 +1073,19 @@ static snd_pcm_uframes_t snd_intel8x0_pcm_pointer(struct snd_pcm_substream *subs
                    ptr1 == igetword(chip, ichdev->reg_offset + ichdev->roff_picb))
                        break;
        } while (timeout--);
-        ptr1 <<= ichdev->pos_shift;
+        if (ptr1 != 0) {
-        ptr = ichdev->fragsize1 - ptr1;
+                ptr1 <<= ichdev->pos_shift;
-        ptr += position;
+                ptr = ichdev->fragsize1 - ptr1;
+                ptr += position;
+                ichdev->last_pos = ptr;
+                ichdev->last_pos_jiffies = jiffies;
+        } else {
+                ptr1 = jiffies - ichdev->last_pos_jiffies;
+                if (ptr1)
+                        ptr1 -= 1;
+                ptr = ichdev->last_pos + ptr1 * ichdev->jiffy_to_bytes;
+                ptr %= ichdev->size;
+        }
        spin_unlock(&chip->reg_lock);
        if (ptr >= ichdev->size)
                return 0;
@@ -2661,12 +2675,14 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
        struct snd_pcm_substream *subs;
        struct ichdev *ichdev;
        unsigned long port;
-        unsigned long pos, t;
+        unsigned long pos, pos1, t;
-        struct timeval start_time, stop_time;
+        int civ, timeout = 1000, attempt = 1;
+        struct timespec start_time, stop_time;
        if (chip->ac97_bus->clock != 48000)
                return; /* specified in module option */
+      __again:
        subs = chip->pcm[0]->streams[0].substream;
        if (! subs || subs->dma_buffer.bytes < INTEL8X0_TESTBUF_SIZE) {
                snd_printk(KERN_WARNING "no playback buffer allocated - aborting measure ac97 clock\n");
@@ -2674,7 +2690,7 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
        }
        ichdev = &chip->ichd[ICHD_PCMOUT];
        ichdev->physbuf = subs->dma_buffer.addr;
-        ichdev->size = chip->ichd[ICHD_PCMOUT].fragsize = INTEL8X0_TESTBUF_SIZE;
+        ichdev->size = ichdev->fragsize = INTEL8X0_TESTBUF_SIZE;
        ichdev->substream = NULL; /* don't process interrupts */
        /* set rate */
@@ -2693,16 +2709,31 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
                iputbyte(chip, port + ICH_REG_OFF_CR, ICH_IOCE);
                iputdword(chip, ICHREG(ALI_DMACR), 1 << ichdev->ali_slot);
        }
-        do_gettimeofday(&start_time);
+        do_posix_clock_monotonic_gettime(&start_time);
        spin_unlock_irq(&chip->reg_lock);
        msleep(50);
        spin_lock_irq(&chip->reg_lock);
        /* check the position */
-        pos = ichdev->fragsize1;
+        do {
-        pos -= igetword(chip, ichdev->reg_offset + ichdev->roff_picb) << ichdev->pos_shift;
+                civ = igetbyte(chip, ichdev->reg_offset + ICH_REG_OFF_CIV);
-        pos += ichdev->position;
+                pos1 = igetword(chip, ichdev->reg_offset + ichdev->roff_picb);
+                if (pos1 == 0) {
+                        udelay(10);
+                        continue;
+                }
+                if (civ == igetbyte(chip, ichdev->reg_offset + ICH_REG_OFF_CIV) &&
+                    pos1 == igetword(chip, ichdev->reg_offset + ichdev->roff_picb))
+                        break;
+        } while (timeout--);
+        if (pos1 == 0) {        /* oops, this value is not reliable */
+                pos = 0;
+        } else {
+                pos = ichdev->fragsize1;
+                pos -= pos1 << ichdev->pos_shift;
+                pos += ichdev->position;
+        }
        chip->in_measurement = 0;
-        do_gettimeofday(&stop_time);
+        do_posix_clock_monotonic_gettime(&stop_time);
        /* stop */
        if (chip->device_type == DEVICE_ALI) {
                iputdword(chip, ICHREG(ALI_DMACR), 1 << (ichdev->ali_slot + 16));
@@ -2717,19 +2748,37 @@ static void __devinit intel8x0_measure_ac97_clock(struct intel8x0 *chip)
        iputbyte(chip, port + ICH_REG_OFF_CR, ICH_RESETREGS);
        spin_unlock_irq(&chip->reg_lock);
+        if (pos == 0) {
+                snd_printk(KERN_ERR "intel8x0: measure - unreliable DMA position..\n");
+              __retry:
+                if (attempt < 2) {
+                        attempt++;
+                        goto __again;
+                }
+                return;
+        }
+        pos /= 4;
        t = stop_time.tv_sec - start_time.tv_sec;
        t *= 1000000;
-        t += stop_time.tv_usec - start_time.tv_usec;
+        t += (stop_time.tv_nsec - start_time.tv_nsec) / 1000;
-        printk(KERN_INFO "%s: measured %lu usecs\n", __func__, t);
+        printk(KERN_INFO "%s: measured %lu usecs (%lu samples)\n", __func__, t, pos);
        if (t == 0) {
-                snd_printk(KERN_ERR "?? calculation error..\n");
+                snd_printk(KERN_ERR "intel8x0: ?? calculation error..\n");
-                return;
+                goto __retry;
        }
-        pos = (pos / 4) * 1000;
+        pos *= 1000;
        pos = (pos / t) * 1000 + ((pos % t) * 1000) / t;
-        if (pos < 40000 || pos >= 60000) 
+        if (pos < 40000 || pos >= 60000) {
                /* abnormal value. hw problem? */
                printk(KERN_INFO "intel8x0: measured clock %ld rejected\n", pos);
+                goto __retry;
+        } else if (pos > 40500 && pos < 41500)
+                /* first exception - 41000Hz reference clock */
+                chip->ac97_bus->clock = 41000;
+        else if (pos > 43600 && pos < 44600)
+                /* second exception - 44100HZ reference clock */
+                chip->ac97_bus->clock = 44100;
        else if (pos < 47500 || pos > 48500)
                /* not 48000Hz, tuning the clock.. */
                chip->ac97_bus->clock = (chip->ac97_bus->clock * 48000) / pos;
diff --git a/sound/soc/pxa/magician.c b/sound/soc/pxa/magician.c
index f7c4544f7859..0625c342a1c9 100644
--- a/sound/soc/pxa/magician.c
+++ b/sound/soc/pxa/magician.c
@@ -27,8 +27,6 @@
 #include <sound/soc.h>
 #include <sound/soc-dapm.h>
-#include <mach/pxa-regs.h>
-#include <mach/hardware.h>
 #include <mach/magician.h>
 #include <asm/mach-types.h>
 #include "../codecs/uda1380.h"
diff --git a/sound/soc/s3c24xx/Kconfig b/sound/soc/s3c24xx/Kconfig
index 2f3a21eee051..df494d1e346f 100644
--- a/sound/soc/s3c24xx/Kconfig
+++ b/sound/soc/s3c24xx/Kconfig
@@ -1,10 +1,10 @@
 config SND_S3C24XX_SOC
        tristate "SoC Audio for the Samsung S3CXXXX chips"
-        depends on ARCH_S3C2410 || ARCH_S3C64XX
+        depends on ARCH_S3C2410
        help
          Say Y or M if you want to add support for codecs attached to
-          the S3C24XX and S3C64XX AC97, I2S or SSP interface. You will
+          the S3C24XX AC97 or I2S interfaces. You will also need to
-          also need to select the audio interfaces to support below.
+          select the audio interfaces to support below.
 config SND_S3C24XX_SOC_I2S
        tristate
diff --git a/sound/usb/caiaq/Makefile b/sound/usb/caiaq/Makefile
index 23dadd5a11cd..388999653aaa 100644
--- a/sound/usb/caiaq/Makefile
+++ b/sound/usb/caiaq/Makefile
@@ -1,4 +1,4 @@
-snd-usb-caiaq-y := caiaq-device.o caiaq-audio.o caiaq-midi.o caiaq-control.o
+snd-usb-caiaq-y := device.o audio.o midi.o control.o
-snd-usb-caiaq-$(CONFIG_SND_USB_CAIAQ_INPUT) += caiaq-input.o
+snd-usb-caiaq-$(CONFIG_SND_USB_CAIAQ_INPUT) += input.o
 obj-$(CONFIG_SND_USB_CAIAQ) += snd-usb-caiaq.o
diff --git a/sound/usb/caiaq/caiaq-audio.c b/sound/usb/caiaq/audio.c
index 08d51e0c9fea..3f45c0fe61ab 100644
--- a/sound/usb/caiaq/caiaq-audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -16,20 +16,14 @@
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
+#include <linux/spinlock.h>
 #include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/interrupt.h>
 #include <linux/usb.h>
-#include <linux/spinlock.h>
 #include <sound/core.h>
-#include <sound/initval.h>
 #include <sound/pcm.h>
-#include <sound/rawmidi.h>
-#include <linux/input.h>
-#include "caiaq-device.h"
+#include "device.h"
-#include "caiaq-audio.h"
+#include "audio.h"
 #define N_URBS                  32
 #define CLOCK_DRIFT_TOLERANCE   5
diff --git a/sound/usb/caiaq/caiaq-audio.h b/sound/usb/caiaq/audio.h
index 8ab1f8d9529e..8ab1f8d9529e 100644
--- a/sound/usb/caiaq/caiaq-audio.h
+++ b/sound/usb/caiaq/audio.h
diff --git a/sound/usb/caiaq/caiaq-control.c b/sound/usb/caiaq/control.c
index e92c2bbf4fe9..537102ba6b9d 100644
--- a/sound/usb/caiaq/caiaq-control.c
+++ b/sound/usb/caiaq/control.c
@@ -18,17 +18,13 @@
 */
 #include <linux/init.h>
-#include <linux/interrupt.h>
 #include <linux/usb.h>
+#include <sound/control.h>
 #include <sound/core.h>
-#include <sound/initval.h>
 #include <sound/pcm.h>
-#include <sound/rawmidi.h>
-#include <sound/control.h>
-#include <linux/input.h>
-#include "caiaq-device.h"
+#include "device.h"
-#include "caiaq-control.h"
+#include "control.h"
 #define CNT_INTVAL 0x10000
diff --git a/sound/usb/caiaq/caiaq-control.h b/sound/usb/caiaq/control.h
index 2e7ab1aa4fb3..2e7ab1aa4fb3 100644
--- a/sound/usb/caiaq/caiaq-control.h
+++ b/sound/usb/caiaq/control.h
diff --git a/sound/usb/caiaq/caiaq-device.c b/sound/usb/caiaq/device.c
index cf573a982fdc..6d517705da0e 100644
--- a/sound/usb/caiaq/caiaq-device.c
+++ b/sound/usb/caiaq/device.c
@@ -19,27 +19,20 @@
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
-#include <linux/init.h>
-#include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/init.h>
 #include <linux/usb.h>
-#include <linux/input.h>
-#include <linux/spinlock.h>
-#include <sound/core.h>
 #include <sound/initval.h>
+#include <sound/core.h>
 #include <sound/pcm.h>
-#include <sound/rawmidi.h>
-#include <sound/control.h>
-#include "caiaq-device.h"
-#include "caiaq-audio.h"
-#include "caiaq-midi.h"
-#include "caiaq-control.h"
-#ifdef CONFIG_SND_USB_CAIAQ_INPUT
+#include "device.h"
-#include "caiaq-input.h"
+#include "audio.h"
-#endif
+#include "midi.h"
+#include "control.h"
+#include "input.h"
 MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
 MODULE_DESCRIPTION("caiaq USB audio, version 1.3.13");
diff --git a/sound/usb/caiaq/caiaq-device.h b/sound/usb/caiaq/device.h
index 4cce1ad7493d..4cce1ad7493d 100644
--- a/sound/usb/caiaq/caiaq-device.h
+++ b/sound/usb/caiaq/device.h
diff --git a/sound/usb/caiaq/caiaq-input.c b/sound/usb/caiaq/input.c
index f743847a5e5a..a48d309bd94c 100644
--- a/sound/usb/caiaq/caiaq-input.c
+++ b/sound/usb/caiaq/input.c
@@ -17,17 +17,12 @@
 */
 #include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/input.h>
 #include <linux/usb.h>
 #include <linux/usb/input.h>
-#include <linux/spinlock.h>
-#include <sound/core.h>
-#include <sound/rawmidi.h>
 #include <sound/pcm.h>
-#include "caiaq-device.h"
-#include "caiaq-input.h"
+#include "device.h"
+#include "input.h"
 static unsigned short keycode_ak1[] =  { KEY_C, KEY_B, KEY_A };
 static unsigned short keycode_rk2[] =  { KEY_1, KEY_2, KEY_3, KEY_4,
diff --git a/sound/usb/caiaq/caiaq-input.h b/sound/usb/caiaq/input.h
index ced535577864..ced535577864 100644
--- a/sound/usb/caiaq/caiaq-input.h
+++ b/sound/usb/caiaq/input.h
diff --git a/sound/usb/caiaq/caiaq-midi.c b/sound/usb/caiaq/midi.c
index f19fd360c936..8fa8cd88d763 100644
--- a/sound/usb/caiaq/caiaq-midi.c
+++ b/sound/usb/caiaq/midi.c
@@ -16,20 +16,13 @@
 *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/interrupt.h>
 #include <linux/usb.h>
-#include <linux/input.h>
-#include <linux/spinlock.h>
-#include <sound/core.h>
 #include <sound/rawmidi.h>
+#include <sound/core.h>
 #include <sound/pcm.h>
-#include "caiaq-device.h"
+#include "device.h"
-#include "caiaq-midi.h"
+#include "midi.h"
 static int snd_usb_caiaq_midi_input_open(struct snd_rawmidi_substream *substream)
 {
diff --git a/sound/usb/caiaq/caiaq-midi.h b/sound/usb/caiaq/midi.h
index 9d16db027fc3..9d16db027fc3 100644
--- a/sound/usb/caiaq/caiaq-midi.h
+++ b/sound/usb/caiaq/midi.h
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index 98276aafefe6..012ff1f6f8af 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -349,14 +349,10 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
        if (cmd != SNDRV_USB_STREAM_IOCTL_SET_PARAMS)
                return -ENOTTY;
-        cfg = kmalloc(sizeof(*cfg), GFP_KERNEL);
+        cfg = memdup_user((void *)arg, sizeof(*cfg));
-        if (!cfg)
+        if (IS_ERR(cfg))
-                return -ENOMEM;
+                return PTR_ERR(cfg);
-        if (copy_from_user(cfg, (void *)arg, sizeof(*cfg))) {
-                err = -EFAULT;
-                goto free;
-        }
        if (cfg->version != USB_STREAM_INTERFACE_VERSION) {
                err = -ENXIO;
                goto free;
diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
index 4af8740db717..f3d8f71265dd 100644
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -203,13 +203,12 @@ static int snd_usX2Y_hwdep_dsp_load(struct snd_hwdep *hw,
        if (access_ok(VERIFY_READ, dsp->image, dsp->length)) {
                struct usb_device* dev = priv->chip.dev;
-                char *buf = kmalloc(dsp->length, GFP_KERNEL);
+                char *buf;
-                if (!buf)
-                        return -ENOMEM;
+                buf = memdup_user(dsp->image, dsp->length);
-                if (copy_from_user(buf, dsp->image, dsp->length)) {
+                if (IS_ERR(buf))
-                        kfree(buf);
+                        return PTR_ERR(buf);
-                        return -EFAULT;
-                }
                err = usb_set_interface(dev, 0, 1);
                if (err)
                        snd_printk(KERN_ERR "usb_set_interface error \n");