34 files changed, 268 insertions, 130 deletions

diff --git a/Documentation/credentials.txt b/Documentation/credentials.txt
index a2db35287003..995baf379c07 100644
--- a/Documentation/credentials.txt
+++ b/Documentation/credentials.txt
@@ -417,6 +417,9 @@ reference on them using:
 This does all the RCU magic inside of it.  The caller must call put_cred() on
 the credentials so obtained when they're finished with.
 
+ [*] Note: The result of __task_cred() should not be passed directly to
+     get_cred() as this may race with commit_cred().
+
 There are a couple of convenience functions to access bits of another task's
 credentials, hiding the RCU magic from the caller:
 
diff --git a/MAINTAINERS b/MAINTAINERS
index db3d0f5061f9..02f75fccac20 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6243,6 +6243,8 @@ F:	drivers/mmc/host/wbsd.*
 
 WATCHDOG DEVICE DRIVERS
 M:      Wim Van Sebroeck <wim@iguana.be>
+L:      linux-watchdog@vger.kernel.org
+W:      http://www.linux-watchdog.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog.git
 S:      Maintained
 F:      Documentation/watchdog/
diff --git a/Makefile b/Makefile
index 886bf04931d4..141da26fda4b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 35
-EXTRAVERSION = -rc6
+EXTRAVERSION =
 NAME = Sheep on Meth
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index c2225fea3535..7636c9b3f9a7 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -68,6 +68,9 @@ targets       := vmlinux vmlinux.lds \
                  piggy.$(suffix_y) piggy.$(suffix_y).o \
                  font.o font.c head.o misc.o $(OBJS)
 
+# Make sure files are removed during clean
+extra-y       += piggy.gzip piggy.lzo piggy.lzma lib1funcs.S
+
 ifeq ($(CONFIG_FUNCTION_TRACER),y)
 ORIG_CFLAGS := $(KBUILD_CFLAGS)
 KBUILD_CFLAGS = $(subst -pg, , $(ORIG_CFLAGS))
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index ac2fd440652e..517d50ddbeb3 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -1025,13 +1025,12 @@ static int sa1111_remove(struct platform_device *pdev)
         struct sa1111 *sachip = platform_get_drvdata(pdev);
 
         if (sachip) {
-                __sa1111_remove(sachip);
-                platform_set_drvdata(pdev, NULL);
-
 #ifdef CONFIG_PM
                 kfree(sachip->saved_state);
                 sachip->saved_state = NULL;
 #endif
+                __sa1111_remove(sachip);
+                platform_set_drvdata(pdev, NULL);
         }
 
         return 0;
diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h
index c980156f3263..1261b1f928d9 100644
--- a/arch/arm/include/asm/io.h
+++ b/arch/arm/include/asm/io.h
@@ -26,6 +26,7 @@
 #include <linux/types.h>
 #include <asm/byteorder.h>
 #include <asm/memory.h>
+#include <asm/system.h>
 
 /*
  * ISA I/O bus memory addresses are 1:1 with the physical address.
@@ -179,25 +180,38 @@ extern void _memset_io(volatile void __iomem *, int, size_t);
  * IO port primitives for more information.
  */
 #ifdef __mem_pci
-#define readb(c) ({ __u8  __v = __raw_readb(__mem_pci(c)); __v; })
-#define readw(c) ({ __u16 __v = le16_to_cpu((__force __le16) \
+#define readb_relaxed(c) ({ u8  __v = __raw_readb(__mem_pci(c)); __v; })
+#define readw_relaxed(c) ({ u16 __v = le16_to_cpu((__force __le16) \
                                         __raw_readw(__mem_pci(c))); __v; })
-#define readl(c) ({ __u32 __v = le32_to_cpu((__force __le32) \
+#define readl_relaxed(c) ({ u32 __v = le32_to_cpu((__force __le32) \
                                         __raw_readl(__mem_pci(c))); __v; })
-#define readb_relaxed(addr) readb(addr)
-#define readw_relaxed(addr) readw(addr)
-#define readl_relaxed(addr) readl(addr)
+
+#define writeb_relaxed(v,c)     ((void)__raw_writeb(v,__mem_pci(c)))
+#define writew_relaxed(v,c)     ((void)__raw_writew((__force u16) \
+                                        cpu_to_le16(v),__mem_pci(c)))
+#define writel_relaxed(v,c)     ((void)__raw_writel((__force u32) \
+                                        cpu_to_le32(v),__mem_pci(c)))
+
+#ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
+#define __iormb()               rmb()
+#define __iowmb()               wmb()
+#else
+#define __iormb()               do { } while (0)
+#define __iowmb()               do { } while (0)
+#endif
+
+#define readb(c)                ({ u8  __v = readb_relaxed(c); __iormb(); __v; })
+#define readw(c)                ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
+#define readl(c)                ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
+
+#define writeb(v,c)             ({ __iowmb(); writeb_relaxed(v,c); })
+#define writew(v,c)             ({ __iowmb(); writew_relaxed(v,c); })
+#define writel(v,c)             ({ __iowmb(); writel_relaxed(v,c); })
 
 #define readsb(p,d,l)           __raw_readsb(__mem_pci(p),d,l)
 #define readsw(p,d,l)           __raw_readsw(__mem_pci(p),d,l)
 #define readsl(p,d,l)           __raw_readsl(__mem_pci(p),d,l)
 
-#define writeb(v,c)             __raw_writeb(v,__mem_pci(c))
-#define writew(v,c)             __raw_writew((__force __u16) \
-                                        cpu_to_le16(v),__mem_pci(c))
-#define writel(v,c)             __raw_writel((__force __u32) \
-                                        cpu_to_le32(v),__mem_pci(c))
-
 #define writesb(p,d,l)          __raw_writesb(__mem_pci(p),d,l)
 #define writesw(p,d,l)          __raw_writesw(__mem_pci(p),d,l)
 #define writesl(p,d,l)          __raw_writesl(__mem_pci(p),d,l)
@@ -244,13 +258,13 @@ extern void _memset_io(volatile void __iomem *, int, size_t);
  * io{read,write}{8,16,32} macros
  */
 #ifndef ioread8
-#define ioread8(p)      ({ unsigned int __v = __raw_readb(p); __v; })
-#define ioread16(p)     ({ unsigned int __v = le16_to_cpu((__force __le16)__raw_readw(p)); __v; })
-#define ioread32(p)     ({ unsigned int __v = le32_to_cpu((__force __le32)__raw_readl(p)); __v; })
+#define ioread8(p)      ({ unsigned int __v = __raw_readb(p); __iormb(); __v; })
+#define ioread16(p)     ({ unsigned int __v = le16_to_cpu((__force __le16)__raw_readw(p)); __iormb(); __v; })
+#define ioread32(p)     ({ unsigned int __v = le32_to_cpu((__force __le32)__raw_readl(p)); __iormb(); __v; })
 
-#define iowrite8(v,p)   __raw_writeb(v, p)
-#define iowrite16(v,p)  __raw_writew((__force __u16)cpu_to_le16(v), p)
-#define iowrite32(v,p)  __raw_writel((__force __u32)cpu_to_le32(v), p)
+#define iowrite8(v,p)   ({ __iowmb(); (void)__raw_writeb(v, p); })
+#define iowrite16(v,p)  ({ __iowmb(); (void)__raw_writew((__force __u16)cpu_to_le16(v), p); })
+#define iowrite32(v,p)  ({ __iowmb(); (void)__raw_writel((__force __u32)cpu_to_le32(v), p); })
 
 #define ioread8_rep(p,d,c)      __raw_readsb(p,d,c)
 #define ioread16_rep(p,d,c)     __raw_readsw(p,d,c)
diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
index 59ff6fdc1e63..7d08b43d2c0e 100644
--- a/arch/arm/lib/csumpartialcopyuser.S
+++ b/arch/arm/lib/csumpartialcopyuser.S
@@ -71,7 +71,7 @@
                 .pushsection .fixup,"ax"
                 .align  4
 9001:           mov     r4, #-EFAULT
-                ldr     r5, [fp, #4]            @ *err_ptr
+                ldr     r5, [sp, #8*4]          @ *err_ptr
                 str     r4, [r5]
                 ldmia   sp, {r1, r2}            @ retrieve dst, len
                 add     r2, r2, r1
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index a54fbda77e45..2fa38df28414 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -251,7 +251,7 @@ static unsigned int realview_mmc_status(struct device *dev)
         else
                 mask = 2;
 
-        return !(readl(REALVIEW_SYSMCI) & mask);
+        return readl(REALVIEW_SYSMCI) & mask;
 }
 
 struct mmci_platform_data realview_mmc0_plat_data = {
diff --git a/arch/arm/mach-ux500/include/mach/uncompress.h b/arch/arm/mach-ux500/include/mach/uncompress.h
index 8552eb188b50..0271ca0a83df 100644
--- a/arch/arm/mach-ux500/include/mach/uncompress.h
+++ b/arch/arm/mach-ux500/include/mach/uncompress.h
@@ -30,22 +30,22 @@
 static void putc(const char c)
 {
         /* Do nothing if the UART is not enabled. */
-        if (!(readb(U8500_UART_CR) & 0x1))
+        if (!(__raw_readb(U8500_UART_CR) & 0x1))
                 return;
 
         if (c == '\n')
                 putc('\r');
 
-        while (readb(U8500_UART_FR) & (1 << 5))
+        while (__raw_readb(U8500_UART_FR) & (1 << 5))
                 barrier();
-        writeb(c, U8500_UART_DR);
+        __raw_writeb(c, U8500_UART_DR);
 }
 
 static void flush(void)
 {
-        if (!(readb(U8500_UART_CR) & 0x1))
+        if (!(__raw_readb(U8500_UART_CR) & 0x1))
                 return;
-        while (readb(U8500_UART_FR) & (1 << 3))
+        while (__raw_readb(U8500_UART_FR) & (1 << 3))
                 barrier();
 }
 
diff --git a/arch/arm/mach-vexpress/v2m.c b/arch/arm/mach-vexpress/v2m.c
index d6db3453908b..817f0ad38a0b 100644
--- a/arch/arm/mach-vexpress/v2m.c
+++ b/arch/arm/mach-vexpress/v2m.c
@@ -241,7 +241,7 @@ static struct platform_device v2m_flash_device = {
 
 static unsigned int v2m_mmci_status(struct device *dev)
 {
-        return !(readl(MMIO_P2V(V2M_SYS_MCI)) & (1 << 0));
+        return readl(MMIO_P2V(V2M_SYS_MCI)) & (1 << 0);
 }
 
 static struct mmci_platform_data v2m_mmci_data = {
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index df4955885b21..9982eb385c0f 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -32,14 +32,14 @@ static uint32_t l2x0_way_mask;	/* Bitmask of active ways */
 static inline void cache_wait(void __iomem *reg, unsigned long mask)
 {
         /* wait for the operation to complete */
-        while (readl(reg) & mask)
+        while (readl_relaxed(reg) & mask)
                 ;
 }
 
 static inline void cache_sync(void)
 {
         void __iomem *base = l2x0_base;
-        writel(0, base + L2X0_CACHE_SYNC);
+        writel_relaxed(0, base + L2X0_CACHE_SYNC);
         cache_wait(base + L2X0_CACHE_SYNC, 1);
 }
 
@@ -47,14 +47,14 @@ static inline void l2x0_clean_line(unsigned long addr)
 {
         void __iomem *base = l2x0_base;
         cache_wait(base + L2X0_CLEAN_LINE_PA, 1);
-        writel(addr, base + L2X0_CLEAN_LINE_PA);
+        writel_relaxed(addr, base + L2X0_CLEAN_LINE_PA);
 }
 
 static inline void l2x0_inv_line(unsigned long addr)
 {
         void __iomem *base = l2x0_base;
         cache_wait(base + L2X0_INV_LINE_PA, 1);
-        writel(addr, base + L2X0_INV_LINE_PA);
+        writel_relaxed(addr, base + L2X0_INV_LINE_PA);
 }
 
 #ifdef CONFIG_PL310_ERRATA_588369
@@ -75,9 +75,9 @@ static inline void l2x0_flush_line(unsigned long addr)
 
         /* Clean by PA followed by Invalidate by PA */
         cache_wait(base + L2X0_CLEAN_LINE_PA, 1);
-        writel(addr, base + L2X0_CLEAN_LINE_PA);
+        writel_relaxed(addr, base + L2X0_CLEAN_LINE_PA);
         cache_wait(base + L2X0_INV_LINE_PA, 1);
-        writel(addr, base + L2X0_INV_LINE_PA);
+        writel_relaxed(addr, base + L2X0_INV_LINE_PA);
 }
 #else
 
@@ -90,7 +90,7 @@ static inline void l2x0_flush_line(unsigned long addr)
 {
         void __iomem *base = l2x0_base;
         cache_wait(base + L2X0_CLEAN_INV_LINE_PA, 1);
-        writel(addr, base + L2X0_CLEAN_INV_LINE_PA);
+        writel_relaxed(addr, base + L2X0_CLEAN_INV_LINE_PA);
 }
 #endif
 
@@ -109,7 +109,7 @@ static inline void l2x0_inv_all(void)
 
         /* invalidate all ways */
         spin_lock_irqsave(&l2x0_lock, flags);
-        writel(l2x0_way_mask, l2x0_base + L2X0_INV_WAY);
+        writel_relaxed(l2x0_way_mask, l2x0_base + L2X0_INV_WAY);
         cache_wait(l2x0_base + L2X0_INV_WAY, l2x0_way_mask);
         cache_sync();
         spin_unlock_irqrestore(&l2x0_lock, flags);
@@ -215,8 +215,8 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
 
         l2x0_base = base;
 
-        cache_id = readl(l2x0_base + L2X0_CACHE_ID);
-        aux = readl(l2x0_base + L2X0_AUX_CTRL);
+        cache_id = readl_relaxed(l2x0_base + L2X0_CACHE_ID);
+        aux = readl_relaxed(l2x0_base + L2X0_AUX_CTRL);
 
         aux &= aux_mask;
         aux |= aux_val;
@@ -248,15 +248,15 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
          * If you are booting from non-secure mode
          * accessing the below registers will fault.
          */
-        if (!(readl(l2x0_base + L2X0_CTRL) & 1)) {
+        if (!(readl_relaxed(l2x0_base + L2X0_CTRL) & 1)) {
 
                 /* l2x0 controller is disabled */
-                writel(aux, l2x0_base + L2X0_AUX_CTRL);
+                writel_relaxed(aux, l2x0_base + L2X0_AUX_CTRL);
 
                 l2x0_inv_all();
 
                 /* enable L2X0 */
-                writel(1, l2x0_base + L2X0_CTRL);
+                writel_relaxed(1, l2x0_base + L2X0_CTRL);
         }
 
         outer_cache.inv_range = l2x0_inv_range;
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index 086816b205b8..6ab244062b4a 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -163,19 +163,22 @@ static DEFINE_PER_CPU(int, kmap_high_l1_vipt_depth);
 
 void *kmap_high_l1_vipt(struct page *page, pte_t *saved_pte)
 {
-        unsigned int idx, cpu = smp_processor_id();
-        int *depth = &per_cpu(kmap_high_l1_vipt_depth, cpu);
+        unsigned int idx, cpu;
+        int *depth;
         unsigned long vaddr, flags;
         pte_t pte, *ptep;
 
+        if (!in_interrupt())
+                preempt_disable();
+
+        cpu = smp_processor_id();
+        depth = &per_cpu(kmap_high_l1_vipt_depth, cpu);
+
         idx = KM_L1_CACHE + KM_TYPE_NR * cpu;
         vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
         ptep = TOP_PTE(vaddr);
         pte = mk_pte(page, kmap_prot);
 
-        if (!in_interrupt())
-                preempt_disable();
-
         raw_local_irq_save(flags);
         (*depth)++;
         if (pte_val(*ptep) == pte_val(pte)) {
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index d5e3e6007447..bea9ee37ac9d 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -535,8 +535,16 @@ pgm_no_vtime2:
         l       %r3,__LC_PGM_ILC        # load program interruption code
         la      %r8,0x7f
         nr      %r8,%r3                 # clear per-event-bit and ilc
-        be      BASED(pgm_exit)         # only per or per+check ?
-        b       BASED(pgm_do_call)
+        be      BASED(pgm_exit2)        # only per or per+check ?
+        l       %r7,BASED(.Ljump_table)
+        sll     %r8,2
+        l       %r7,0(%r8,%r7)          # load address of handler routine
+        la      %r2,SP_PTREGS(%r15)     # address of register-save area
+        basr    %r14,%r7                # branch to interrupt-handler
+pgm_exit2:
+        TRACE_IRQS_ON
+        stosm   __SF_EMPTY(%r15),0x03   # reenable interrupts
+        b       BASED(sysc_return)
 
 #
 # it was a single stepped SVC that is causing all the trouble
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index e7192e1cb678..8bccec15ea90 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -544,8 +544,16 @@ pgm_no_vtime2:
         lgf     %r3,__LC_PGM_ILC        # load program interruption code
         lghi    %r8,0x7f
         ngr     %r8,%r3                 # clear per-event-bit and ilc
-        je      pgm_exit
-        j       pgm_do_call
+        je      pgm_exit2
+        sll     %r8,3
+        larl    %r1,pgm_check_table
+        lg      %r1,0(%r8,%r1)          # load address of handler routine
+        la      %r2,SP_PTREGS(%r15)     # address of register-save area
+        basr    %r14,%r1                # branch to interrupt-handler
+pgm_exit2:
+        TRACE_IRQS_ON
+        stosm   __SF_EMPTY(%r15),0x03   # reenable interrupts
+        j       sysc_return
 
 #
 # it was a single stepped SVC that is causing all the trouble
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index a2163c95eb98..15a7536452d5 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -524,8 +524,11 @@ void etr_switch_to_local(void)
         if (!etr_eacr.sl)
                 return;
         disable_sync_clock(NULL);
-        set_bit(ETR_EVENT_SWITCH_LOCAL, &etr_events);
-        queue_work(time_sync_wq, &etr_work);
+        if (!test_and_set_bit(ETR_EVENT_SWITCH_LOCAL, &etr_events)) {
+                etr_eacr.es = etr_eacr.sl = 0;
+                etr_setr(&etr_eacr);
+                queue_work(time_sync_wq, &etr_work);
+        }
 }
 
 /*
@@ -539,8 +542,11 @@ void etr_sync_check(void)
         if (!etr_eacr.es)
                 return;
         disable_sync_clock(NULL);
-        set_bit(ETR_EVENT_SYNC_CHECK, &etr_events);
-        queue_work(time_sync_wq, &etr_work);
+        if (!test_and_set_bit(ETR_EVENT_SYNC_CHECK, &etr_events)) {
+                etr_eacr.es = 0;
+                etr_setr(&etr_eacr);
+                queue_work(time_sync_wq, &etr_work);
+        }
 }
 
 /*
@@ -902,7 +908,7 @@ static struct etr_eacr etr_handle_update(struct etr_aib *aib,
          * Do not try to get the alternate port aib if the clock
          * is not in sync yet.
          */
-        if (!check_sync_clock())
+        if (!eacr.es || !check_sync_clock())
                 return eacr;
 
         /*
@@ -1064,7 +1070,7 @@ static void etr_work_fn(struct work_struct *work)
          * If the clock is in sync just update the eacr and return.
          * If there is no valid sync port wait for a port update.
          */
-        if (check_sync_clock() || sync_port < 0) {
+        if ((eacr.es && check_sync_clock()) || sync_port < 0) {
                 etr_update_eacr(eacr);
                 etr_set_tolec_timeout(now);
                 goto out_unlock;
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c1981861bbbd..f87bf104df7a 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -864,8 +864,8 @@ drm_mode_std(struct drm_connector *connector, struct edid *edid,
                 mode = drm_cvt_mode(dev, 1366, 768, vrefresh_rate, 0, 0,
                                     false);
                 mode->hdisplay = 1366;
-                mode->vsync_start = mode->vsync_start - 1;
-                mode->vsync_end = mode->vsync_end - 1;
+                mode->hsync_start = mode->hsync_start - 1;
+                mode->hsync_end = mode->hsync_end - 1;
                 return mode;
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 115d26b762cc..3fa6984d9896 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -333,6 +333,7 @@ static ssize_t radeon_get_pm_profile(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         (cp == PM_PROFILE_AUTO) ? "auto" :
                         (cp == PM_PROFILE_LOW) ? "low" :
+                        (cp == PM_PROFILE_MID) ? "mid" :
                         (cp == PM_PROFILE_HIGH) ? "high" : "default");
 }
 
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 7edae83603dd..840b301b5671 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -575,9 +575,13 @@ static int mmci_get_cd(struct mmc_host *mmc)
         if (host->gpio_cd == -ENOSYS)
                 status = host->plat->status(mmc_dev(host->mmc));
         else
-                status = gpio_get_value(host->gpio_cd);
+                status = !gpio_get_value(host->gpio_cd);
 
-        return !status;
+        /*
+         * Use positive logic throughout - status is zero for no card,
+         * non-zero for card inserted.
+         */
+        return status;
 }
 
 static const struct mmc_host_ops mmci_ops = {
diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index 188bc8496a26..d02be78a4138 100644
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -176,16 +176,18 @@ static ssize_t led_proc_write(struct file *file, const char *buf,
         size_t count, loff_t *pos)
 {
         void *data = PDE(file->f_path.dentry->d_inode)->data;
-        char *cur, lbuf[count + 1];
+        char *cur, lbuf[32];
         int d;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
-        memset(lbuf, 0, count + 1);
+        if (count >= sizeof(lbuf))
+                count = sizeof(lbuf)-1;
 
         if (copy_from_user(lbuf, buf, count))
                 return -EFAULT;
+        lbuf[count] = 0;
 
         cur = lbuf;
 
diff --git a/drivers/video/cyber2000fb.c b/drivers/video/cyber2000fb.c
index 3a561df2e8a2..0c1afd13ddd3 100644
--- a/drivers/video/cyber2000fb.c
+++ b/drivers/video/cyber2000fb.c
@@ -388,6 +388,7 @@ cyber2000fb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                 pseudo_val |= convert_bitfield(red, &var->red);
                 pseudo_val |= convert_bitfield(green, &var->green);
                 pseudo_val |= convert_bitfield(blue, &var->blue);
+                ret = 0;
                 break;
         }
 
@@ -436,6 +437,8 @@ static void cyber2000fb_write_ramdac_ctrl(struct cfb_info *cfb)
         cyber2000fb_writeb(i | 4, 0x3cf, cfb);
         cyber2000fb_writeb(val, 0x3c6, cfb);
         cyber2000fb_writeb(i, 0x3cf, cfb);
+        /* prevent card lock-up observed on x86 with CyberPro 2000 */
+        cyber2000fb_readb(0x3cf, cfb);
 }
 
 static void cyber2000fb_set_timing(struct cfb_info *cfb, struct par_info *hw)
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 49315cbf742d..853a968e82d7 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -227,7 +227,7 @@ failed_put_cred:
         return ret;
 }
 
-void __exit cifs_exit_dns_resolver(void)
+void cifs_exit_dns_resolver(void)
 {
         key_revoke(dns_resolver_cache->thread_keyring);
         unregister_key_type(&key_type_dns_resolver);
diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h
index 26b9eaa9f5ee..5d7f291df162 100644
--- a/fs/cifs/dns_resolve.h
+++ b/fs/cifs/dns_resolve.h
@@ -25,7 +25,7 @@
 
 #ifdef __KERNEL__
 extern int __init cifs_init_dns_resolver(void);
-extern void __exit cifs_exit_dns_resolver(void);
+extern void cifs_exit_dns_resolver(void);
 extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
 #endif /* KERNEL */
 
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 36a5e74f51b4..f036153d9f50 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -27,6 +27,7 @@
 #include <linux/pagemap.h>
 #include <linux/aio.h>
 #include <linux/gfp.h>
+#include <linux/swap.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -493,11 +494,19 @@ static void nfs_invalidate_page(struct page *page, unsigned long offset)
  */
 static int nfs_release_page(struct page *page, gfp_t gfp)
 {
+        struct address_space *mapping = page->mapping;
+
         dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
 
         /* Only do I/O if gfp is a superset of GFP_KERNEL */
-        if ((gfp & GFP_KERNEL) == GFP_KERNEL)
-                nfs_wb_page(page->mapping->host, page);
+        if (mapping && (gfp & GFP_KERNEL) == GFP_KERNEL) {
+                int how = FLUSH_SYNC;
+
+                /* Don't let kswapd deadlock waiting for OOM RPC calls */
+                if (current_is_kswapd())
+                        how = 0;
+                nfs_commit_inode(mapping->host, how);
+        }
         /* If PagePrivate() is set, then the page is not freeable */
         if (PagePrivate(page))
                 return 0;
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index 6bd19d843af7..df101d9f546a 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -105,7 +105,7 @@ static char nfs_root_name[256] __initdata = "";
 static __be32 servaddr __initdata = 0;
 
 /* Name of directory to mount */
-static char nfs_export_path[NFS_MAXPATHLEN] __initdata = { 0, };
+static char nfs_export_path[NFS_MAXPATHLEN + 1] __initdata = { 0, };
 
 /* NFS-related data */
 static struct nfs_mount_data nfs_data __initdata = { 0, };/* NFS mount info */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 91679e2631ee..9f81bdd91c55 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -222,7 +222,7 @@ static void nfs_end_page_writeback(struct page *page)
                 clear_bdi_congested(&nfss->backing_dev_info, BLK_RW_ASYNC);
 }
 
-static struct nfs_page *nfs_find_and_lock_request(struct page *page)
+static struct nfs_page *nfs_find_and_lock_request(struct page *page, bool nonblock)
 {
         struct inode *inode = page->mapping->host;
         struct nfs_page *req;
@@ -241,7 +241,10 @@ static struct nfs_page *nfs_find_and_lock_request(struct page *page)
                  *       request as dirty (in which case we don't care).
                  */
                 spin_unlock(&inode->i_lock);
-                ret = nfs_wait_on_request(req);
+                if (!nonblock)
+                        ret = nfs_wait_on_request(req);
+                else
+                        ret = -EAGAIN;
                 nfs_release_request(req);
                 if (ret != 0)
                         return ERR_PTR(ret);
@@ -256,12 +259,12 @@ static struct nfs_page *nfs_find_and_lock_request(struct page *page)
  * May return an error if the user signalled nfs_wait_on_request().
  */
 static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
-                                struct page *page)
+                                struct page *page, bool nonblock)
 {
         struct nfs_page *req;
         int ret = 0;
 
-        req = nfs_find_and_lock_request(page);
+        req = nfs_find_and_lock_request(page, nonblock);
         if (!req)
                 goto out;
         ret = PTR_ERR(req);
@@ -283,12 +286,20 @@ out:
 static int nfs_do_writepage(struct page *page, struct writeback_control *wbc, struct nfs_pageio_descriptor *pgio)
 {
         struct inode *inode = page->mapping->host;
+        int ret;
 
         nfs_inc_stats(inode, NFSIOS_VFSWRITEPAGE);
         nfs_add_stats(inode, NFSIOS_WRITEPAGES, 1);
 
         nfs_pageio_cond_complete(pgio, page->index);
-        return nfs_page_async_flush(pgio, page);
+        ret = nfs_page_async_flush(pgio, page,
+                        wbc->sync_mode == WB_SYNC_NONE ||
+                        wbc->nonblocking != 0);
+        if (ret == -EAGAIN) {
+                redirty_page_for_writepage(wbc, page);
+                ret = 0;
+        }
+        return ret;
 }
 
 /*
@@ -1379,7 +1390,7 @@ static const struct rpc_call_ops nfs_commit_ops = {
         .rpc_release = nfs_commit_release,
 };
 
-static int nfs_commit_inode(struct inode *inode, int how)
+int nfs_commit_inode(struct inode *inode, int how)
 {
         LIST_HEAD(head);
         int may_wait = how & FLUSH_SYNC;
@@ -1443,11 +1454,6 @@ out_mark_dirty:
         return ret;
 }
 #else
-static int nfs_commit_inode(struct inode *inode, int how)
-{
-        return 0;
-}
-
 static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_control *wbc)
 {
         return 0;
@@ -1546,7 +1552,7 @@ int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
 
         nfs_fscache_release_page(page, GFP_KERNEL);
 
-        req = nfs_find_and_lock_request(page);
+        req = nfs_find_and_lock_request(page, false);
         ret = PTR_ERR(req);
         if (IS_ERR(req))
                 goto out;
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 9b58d38bc911..fff6572676ae 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -176,7 +176,7 @@ static inline void task_state(struct seq_file *m, struct pid_namespace *ns,
                 if (tracer)
                         tpid = task_pid_nr_ns(tracer, ns);
         }
-        cred = get_cred((struct cred *) __task_cred(p));
+        cred = get_task_cred(p);
         seq_printf(m,
                 "State:\t%s\n"
                 "Tgid:\t%d\n"
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 75c0fa881308..4d2c39573f36 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -153,6 +153,7 @@ struct cred {
 extern void __put_cred(struct cred *);
 extern void exit_creds(struct task_struct *);
 extern int copy_creds(struct task_struct *, unsigned long);
+extern const struct cred *get_task_cred(struct task_struct *);
 extern struct cred *cred_alloc_blank(void);
 extern struct cred *prepare_creds(void);
 extern struct cred *prepare_exec_creds(void);
@@ -273,33 +274,18 @@ static inline void put_cred(const struct cred *_cred)
  * @task: The task to query
  *
  * Access the objective credentials of a task.  The caller must hold the RCU
- * readlock.
+ * readlock or the task must be dead and unable to change its own credentials.
  *
- * The caller must make sure task doesn't go away, either by holding a ref on
- * task or by holding tasklist_lock to prevent it from being unlinked.
+ * The result of this function should not be passed directly to get_cred();
+ * rather get_task_cred() should be used instead.
  */
-#define __task_cred(task) \
-        ((const struct cred *)(rcu_dereference_check((task)->real_cred, rcu_read_lock_held() || lockdep_tasklist_lock_is_held())))
-
-/**
- * get_task_cred - Get another task's objective credentials
- * @task: The task to query
- *
- * Get the objective credentials of a task, pinning them so that they can't go
- * away.  Accessing a task's credentials directly is not permitted.
- *
- * The caller must make sure task doesn't go away, either by holding a ref on
- * task or by holding tasklist_lock to prevent it from being unlinked.
- */
-#define get_task_cred(task)                             \
-({                                                      \
-        struct cred *__cred;                            \
-        rcu_read_lock();                                \
-        __cred = (struct cred *) __task_cred((task));   \
-        get_cred(__cred);                               \
-        rcu_read_unlock();                              \
-        __cred;                                         \
-})
+#define __task_cred(task)                                               \
+        ({                                                              \
+                const struct task_struct *__t = (task);                 \
+                rcu_dereference_check(__t->real_cred,                   \
+                                      rcu_read_lock_held() ||           \
+                                      task_is_dead(__t));               \
+        })
 
 /**
  * get_current_cred - Get the current task's subjective credentials
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 77c2ae53431c..bad4d121b16e 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -493,8 +493,15 @@ extern int nfs_wb_all(struct inode *inode);
 extern int nfs_wb_page(struct inode *inode, struct page* page);
 extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
+extern int  nfs_commit_inode(struct inode *, int);
 extern struct nfs_write_data *nfs_commitdata_alloc(void);
 extern void nfs_commit_free(struct nfs_write_data *wdata);
+#else
+static inline int
+nfs_commit_inode(struct inode *inode, int how)
+{
+        return 0;
+}
 #endif
 
 static inline int
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 747fcaedddb7..0478888c6899 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -214,6 +214,7 @@ extern char ___assert_task_state[1 - 2*!!(
 
 #define task_is_traced(task)    ((task->state & __TASK_TRACED) != 0)
 #define task_is_stopped(task)   ((task->state & __TASK_STOPPED) != 0)
+#define task_is_dead(task)      ((task)->exit_state != 0)
 #define task_is_stopped_or_traced(task) \
                         ((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0)
 #define task_contributes_to_load(task)  \
diff --git a/kernel/cred.c b/kernel/cred.c
index a2d5504fbcc2..60bc8b1e32e6 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -209,6 +209,31 @@ void exit_creds(struct task_struct *tsk)
         }
 }
 
+/**
+ * get_task_cred - Get another task's objective credentials
+ * @task: The task to query
+ *
+ * Get the objective credentials of a task, pinning them so that they can't go
+ * away.  Accessing a task's credentials directly is not permitted.
+ *
+ * The caller must also make sure task doesn't get deleted, either by holding a
+ * ref on task or by holding tasklist_lock to prevent it from being unlinked.
+ */
+const struct cred *get_task_cred(struct task_struct *task)
+{
+        const struct cred *cred;
+
+        rcu_read_lock();
+
+        do {
+                cred = __task_cred((task));
+                BUG_ON(!cred);
+        } while (!atomic_inc_not_zero(&((struct cred *)cred)->usage));
+
+        rcu_read_unlock();
+        return cred;
+}
+
 /*
  * Allocate blank credentials, such that the credentials can be filled in at a
  * later date without risk of ENOMEM.
diff --git a/mm/memory.c b/mm/memory.c
index 119b7ccdf39b..bde42c6d3633 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1394,10 +1394,20 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 return i ? : -EFAULT;
                         }
                         if (pages) {
-                                struct page *page = vm_normal_page(gate_vma, start, *pte);
+                                struct page *page;
+
+                                page = vm_normal_page(gate_vma, start, *pte);
+                                if (!page) {
+                                        if (!(gup_flags & FOLL_DUMP) &&
+                                             is_zero_pfn(pte_pfn(*pte)))
+                                                page = pte_page(*pte);
+                                        else {
+                                                pte_unmap(pte);
+                                                return i ? : -EFAULT;
+                                        }
+                                }
                                 pages[i] = page;
-                                if (page)
-                                        get_page(page);
+                                get_page(page);
                         }
                         pte_unmap(pte);
                         if (vmas)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 86067ee78632..2fc53961054e 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -52,6 +52,10 @@ struct hdmi_spec {
          */
         struct hda_multi_out multiout;
         unsigned int codec_type;
+
+        /* misc flags */
+        /* PD bit indicates only the update, not the current state */
+        unsigned int old_pin_detect:1;
 };
 
 
@@ -616,6 +620,9 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec, hda_nid_t nid,
  * Unsolicited events
  */
 
+static void hdmi_present_sense(struct hda_codec *codec, hda_nid_t pin_nid,
+                               struct hdmi_eld *eld);
+
 static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
 {
         struct hdmi_spec *spec = codec->spec;
@@ -632,6 +639,12 @@ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
         if (index < 0)
                 return;
 
+        if (spec->old_pin_detect) {
+                if (pind)
+                        hdmi_present_sense(codec, tag, &spec->sink_eld[index]);
+                pind = spec->sink_eld[index].monitor_present;
+        }
+
         spec->sink_eld[index].monitor_present = pind;
         spec->sink_eld[index].eld_valid = eldv;
 
diff --git a/sound/pci/hda/patch_nvhdmi.c b/sound/pci/hda/patch_nvhdmi.c
index 3c10c0b149f4..b0652acee9b2 100644
--- a/sound/pci/hda/patch_nvhdmi.c
+++ b/sound/pci/hda/patch_nvhdmi.c
@@ -478,6 +478,7 @@ static int patch_nvhdmi_8ch_89(struct hda_codec *codec)
 
         codec->spec = spec;
         spec->codec_type = HDA_CODEC_NVIDIA_MCP89;
+        spec->old_pin_detect = 1;
 
         if (hdmi_parse_codec(codec) < 0) {
                 codec->spec = NULL;
@@ -508,6 +509,7 @@ static int patch_nvhdmi_8ch_7x(struct hda_codec *codec)
         spec->multiout.max_channels = 8;
         spec->multiout.dig_out_nid = nvhdmi_master_con_nid_7x;
         spec->codec_type = HDA_CODEC_NVIDIA_MCP7X;
+        spec->old_pin_detect = 1;
 
         codec->patch_ops = nvhdmi_patch_ops_8ch_7x;
 
@@ -528,6 +530,7 @@ static int patch_nvhdmi_2ch(struct hda_codec *codec)
         spec->multiout.max_channels = 2;
         spec->multiout.dig_out_nid = nvhdmi_master_con_nid_7x;
         spec->codec_type = HDA_CODEC_NVIDIA_MCP7X;
+        spec->old_pin_detect = 1;
 
         codec->patch_ops = nvhdmi_patch_ops_2ch;
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ff614dd824c1..596ea2f12cf6 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1267,11 +1267,11 @@ static int alc_auto_parse_customize_define(struct hda_codec *codec)
         unsigned nid = 0;
         struct alc_spec *spec = codec->spec;
 
+        spec->cdefine.enable_pcbeep = 1; /* assume always enabled */
+
         ass = codec->subsystem_id & 0xffff;
-        if (ass != codec->bus->pci->subsystem_device && (ass & 1)) {
-                spec->cdefine.enable_pcbeep = 1; /* assume always enabled */
+        if (ass != codec->bus->pci->subsystem_device && (ass & 1))
                 goto do_sku;
-        }
 
         nid = 0x1d;
         if (codec->vendor_id == 0x10ec0260)
@@ -5180,8 +5180,24 @@ static void fillup_priv_adc_nids(struct hda_codec *codec, hda_nid_t *nids,
 #ifdef CONFIG_SND_HDA_INPUT_BEEP
 #define set_beep_amp(spec, nid, idx, dir) \
         ((spec)->beep_amp = HDA_COMPOSE_AMP_VAL(nid, 3, idx, dir))
+
+static struct snd_pci_quirk beep_white_list[] = {
+        SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
+        {}
+};
+
+static inline int has_cdefine_beep(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        const struct snd_pci_quirk *q;
+        q = snd_pci_quirk_lookup(codec->bus->pci, beep_white_list);
+        if (q)
+                return q->value;
+        return spec->cdefine.enable_pcbeep;
+}
 #else
 #define set_beep_amp(spec, nid, idx, dir) /* NOP */
+#define has_cdefine_beep(codec)         0
 #endif
 
 /*
@@ -10566,10 +10582,12 @@ static int patch_alc882(struct hda_codec *codec)
                 }
         }
 
-        err = snd_hda_attach_beep_device(codec, 0x1);
-        if (err < 0) {
-                alc_free(codec);
-                return err;
+        if (has_cdefine_beep(codec)) {
+                err = snd_hda_attach_beep_device(codec, 0x1);
+                if (err < 0) {
+                        alc_free(codec);
+                        return err;
+                }
         }
 
         if (board_config != ALC882_AUTO)
@@ -10619,7 +10637,7 @@ static int patch_alc882(struct hda_codec *codec)
 
         set_capture_mixer(codec);
 
-        if (spec->cdefine.enable_pcbeep)
+        if (has_cdefine_beep(codec))
                 set_beep_amp(spec, 0x0b, 0x05, HDA_INPUT);
 
         if (board_config == ALC882_AUTO)
@@ -12435,7 +12453,7 @@ static int patch_alc262(struct hda_codec *codec)
                 }
         }
 
-        if (!spec->no_analog) {
+        if (!spec->no_analog && has_cdefine_beep(codec)) {
                 err = snd_hda_attach_beep_device(codec, 0x1);
                 if (err < 0) {
                         alc_free(codec);
@@ -12486,7 +12504,7 @@ static int patch_alc262(struct hda_codec *codec)
         }
         if (!spec->cap_mixer && !spec->no_analog)
                 set_capture_mixer(codec);
-        if (!spec->no_analog && spec->cdefine.enable_pcbeep)
+        if (!spec->no_analog && has_cdefine_beep(codec))
                 set_beep_amp(spec, 0x0b, 0x05, HDA_INPUT);
 
         spec->vmaster_nid = 0x0c;
@@ -14458,10 +14476,12 @@ static int patch_alc269(struct hda_codec *codec)
                 }
         }
 
-        err = snd_hda_attach_beep_device(codec, 0x1);
-        if (err < 0) {
-                alc_free(codec);
-                return err;
+        if (has_cdefine_beep(codec)) {
+                err = snd_hda_attach_beep_device(codec, 0x1);
+                if (err < 0) {
+                        alc_free(codec);
+                        return err;
+                }
         }
 
         if (board_config != ALC269_AUTO)
@@ -14494,7 +14514,7 @@ static int patch_alc269(struct hda_codec *codec)
 
         if (!spec->cap_mixer)
                 set_capture_mixer(codec);
-        if (spec->cdefine.enable_pcbeep)
+        if (has_cdefine_beep(codec))
                 set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
 
         if (board_config == ALC269_AUTO)
@@ -18691,10 +18711,12 @@ static int patch_alc662(struct hda_codec *codec)
                 }
         }
 
-        err = snd_hda_attach_beep_device(codec, 0x1);
-        if (err < 0) {
-                alc_free(codec);
-                return err;
+        if (has_cdefine_beep(codec)) {
+                err = snd_hda_attach_beep_device(codec, 0x1);
+                if (err < 0) {
+                        alc_free(codec);
+                        return err;
+                }
         }
 
         if (board_config != ALC662_AUTO)
@@ -18716,7 +18738,7 @@ static int patch_alc662(struct hda_codec *codec)
         if (!spec->cap_mixer)
                 set_capture_mixer(codec);
 
-        if (spec->cdefine.enable_pcbeep) {
+        if (has_cdefine_beep(codec)) {
                 switch (codec->vendor_id) {
                 case 0x10ec0662:
                         set_beep_amp(spec, 0x0b, 0x05, HDA_INPUT);