52 files changed, 407 insertions, 298 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 16a5c5f2c6a6..69f19f10314a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2813,38 +2813,19 @@ F:	Documentation/gpio.txt
 F:      drivers/gpio/
 F:      include/linux/gpio*
 
+GRE DEMULTIPLEXER DRIVER
+M:      Dmitry Kozlov <xeb@mail.ru>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      net/ipv4/gre.c
+F:      include/net/gre.h
+
 GRETH 10/100/1G Ethernet MAC device driver
 M:      Kristoffer Glembo <kristoffer@gaisler.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/greth*
 
-HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
-M:      Frank Seidel <frank@f-seidel.de>
-L:      platform-driver-x86@vger.kernel.org
-W:      http://www.kernel.org/pub/linux/kernel/people/fseidel/hdaps/
-S:      Maintained
-F:      drivers/platform/x86/hdaps.c
-
-HWPOISON MEMORY FAILURE HANDLING
-M:      Andi Kleen <andi@firstfloor.org>
-L:      linux-mm@kvack.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6.git hwpoison
-S:      Maintained
-F:      mm/memory-failure.c
-F:      mm/hwpoison-inject.c
-
-HYPERVISOR VIRTUAL CONSOLE DRIVER
-L:      linuxppc-dev@lists.ozlabs.org
-S:      Odd Fixes
-F:      drivers/tty/hvc/
-
-iSCSI BOOT FIRMWARE TABLE (iBFT) DRIVER
-M:      Peter Jones <pjones@redhat.com>
-M:      Konrad Rzeszutek Wilk <konrad@kernel.org>
-S:      Maintained
-F:      drivers/firmware/iscsi_ibft*
-
 GSPCA FINEPIX SUBDRIVER
 M:      Frank Zago <frank@zago.net>
 L:      linux-media@vger.kernel.org
@@ -2895,6 +2876,26 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 S:      Maintained
 F:      drivers/media/video/gspca/
 
+HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
+M:      Frank Seidel <frank@f-seidel.de>
+L:      platform-driver-x86@vger.kernel.org
+W:      http://www.kernel.org/pub/linux/kernel/people/fseidel/hdaps/
+S:      Maintained
+F:      drivers/platform/x86/hdaps.c
+
+HWPOISON MEMORY FAILURE HANDLING
+M:      Andi Kleen <andi@firstfloor.org>
+L:      linux-mm@kvack.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6.git hwpoison
+S:      Maintained
+F:      mm/memory-failure.c
+F:      mm/hwpoison-inject.c
+
+HYPERVISOR VIRTUAL CONSOLE DRIVER
+L:      linuxppc-dev@lists.ozlabs.org
+S:      Odd Fixes
+F:      drivers/tty/hvc/
+
 HARDWARE MONITORING
 M:      Jean Delvare <khali@linux-fr.org>
 M:      Guenter Roeck <guenter.roeck@ericsson.com>
@@ -3478,6 +3479,12 @@ F:	Documentation/isapnp.txt
 F:      drivers/pnp/isapnp/
 F:      include/linux/isapnp.h
 
+iSCSI BOOT FIRMWARE TABLE (iBFT) DRIVER
+M:      Peter Jones <pjones@redhat.com>
+M:      Konrad Rzeszutek Wilk <konrad@kernel.org>
+S:      Maintained
+F:      drivers/firmware/iscsi_ibft*
+
 ISCSI
 M:      Mike Christie <michaelc@cs.wisc.edu>
 L:      open-iscsi@googlegroups.com
@@ -4989,6 +4996,13 @@ F:	Documentation/pps/
 F:      drivers/pps/
 F:      include/linux/pps*.h
 
+PPTP DRIVER
+M:      Dmitry Kozlov <xeb@mail.ru>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/pptp.c
+W:      http://sourceforge.net/projects/accel-pptp
+
 PREEMPTIBLE KERNEL
 M:      Robert Love <rml@tech9.net>
 L:      kpreempt-tech@lists.sourceforge.net
@@ -7024,20 +7038,6 @@ M:	"Maciej W. Rozycki" <macro@linux-mips.org>
 S:      Maintained
 F:      drivers/tty/serial/zs.*
 
-GRE DEMULTIPLEXER DRIVER
-M:      Dmitry Kozlov <xeb@mail.ru>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      net/ipv4/gre.c
-F:      include/net/gre.h
-
-PPTP DRIVER
-M:      Dmitry Kozlov <xeb@mail.ru>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/pptp.c
-W:      http://sourceforge.net/projects/accel-pptp
-
 THE REST
 M:      Linus Torvalds <torvalds@linux-foundation.org>
 L:      linux-kernel@vger.kernel.org
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 8ebbb511c783..0c6852d93506 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -74,7 +74,7 @@ ZTEXTADDR	:= $(CONFIG_ZBOOT_ROM_TEXT)
 ZBSSADDR        := $(CONFIG_ZBOOT_ROM_BSS)
 else
 ZTEXTADDR       := 0
-ZBSSADDR        := ALIGN(4)
+ZBSSADDR        := ALIGN(8)
 endif
 
 SEDFLAGS        = s/TEXT_START/$(ZTEXTADDR)/;s/BSS_START/$(ZBSSADDR)/
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index adf583cd0c35..49f5b2eaaa87 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -179,15 +179,14 @@ not_angel:
                 bl      cache_on
 
 restart:        adr     r0, LC0
-                ldmia   r0, {r1, r2, r3, r5, r6, r9, r11, r12}
-                ldr     sp, [r0, #32]
+                ldmia   r0, {r1, r2, r3, r6, r9, r11, r12}
+                ldr     sp, [r0, #28]
 
                 /*
                  * We might be running at a different address.  We need
                  * to fix up various pointers.
                  */
                 sub     r0, r0, r1              @ calculate the delta offset
-                add     r5, r5, r0              @ _start
                 add     r6, r6, r0              @ _edata
 
 #ifndef CONFIG_ZBOOT_ROM
@@ -206,31 +205,40 @@ restart:	adr	r0, LC0
 /*
  * Check to see if we will overwrite ourselves.
  *   r4  = final kernel address
- *   r5  = start of this image
  *   r9  = size of decompressed image
  *   r10 = end of this image, including  bss/stack/malloc space if non XIP
  * We basically want:
- *   r4 >= r10 -> OK
- *   r4 + image length <= r5 -> OK
+ *   r4 - 16k page directory >= r10 -> OK
+ *   r4 + image length <= current position (pc) -> OK
  */
+                add     r10, r10, #16384
                 cmp     r4, r10
                 bhs     wont_overwrite
                 add     r10, r4, r9
-                cmp     r10, r5
+   ARM(         cmp     r10, pc         )
+ THUMB(         mov     lr, pc          )
+ THUMB(         cmp     r10, lr         )
                 bls     wont_overwrite
 
 /*
  * Relocate ourselves past the end of the decompressed kernel.
- *   r5  = start of this image
  *   r6  = _edata
  *   r10 = end of the decompressed kernel
  * Because we always copy ahead, we need to do it from the end and go
  * backward in case the source and destination overlap.
  */
-                /* Round up to next 256-byte boundary. */
-                add     r10, r10, #256
+                /*
+                 * Bump to the next 256-byte boundary with the size of
+                 * the relocation code added. This avoids overwriting
+                 * ourself when the offset is small.
+                 */
+                add     r10, r10, #((reloc_code_end - restart + 256) & ~255)
                 bic     r10, r10, #255
 
+                /* Get start of code we want to copy and align it down. */
+                adr     r5, restart
+                bic     r5, r5, #31
+
                 sub     r9, r6, r5              @ size to copy
                 add     r9, r9, #31             @ rounded up to a multiple
                 bic     r9, r9, #31             @ ... of 32 bytes
@@ -245,6 +253,11 @@ restart:	adr	r0, LC0
                 /* Preserve offset to relocated code. */
                 sub     r6, r9, r6
 
+#ifndef CONFIG_ZBOOT_ROM
+                /* cache_clean_flush may use the stack, so relocate it */
+                add     sp, sp, r6
+#endif
+
                 bl      cache_clean_flush
 
                 adr     r0, BSYM(restart)
@@ -333,7 +346,6 @@ not_relocated:	mov	r0, #0
 LC0:            .word   LC0                     @ r1
                 .word   __bss_start             @ r2
                 .word   _end                    @ r3
-                .word   _start                  @ r5
                 .word   _edata                  @ r6
                 .word   _image_size             @ r9
                 .word   _got_start              @ r11
@@ -1062,6 +1074,7 @@ memdump:	mov	r12, r0
 #endif
 
                 .ltorg
+reloc_code_end:
 
                 .align
                 .section ".stack", "aw", %nobits
diff --git a/arch/arm/boot/compressed/vmlinux.lds.in b/arch/arm/boot/compressed/vmlinux.lds.in
index 5309909d7282..ea80abe78844 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.in
+++ b/arch/arm/boot/compressed/vmlinux.lds.in
@@ -54,6 +54,7 @@ SECTIONS
   .bss                  : { *(.bss) }
   _end = .;
 
+  . = ALIGN(8);         /* the stack must be 64-bit aligned */
   .stack                : { *(.stack) }
 
   .stab 0               : { *(.stab) }
diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
index 885be097769d..832888d0c20c 100644
--- a/arch/arm/include/asm/system.h
+++ b/arch/arm/include/asm/system.h
@@ -159,7 +159,7 @@ extern unsigned int user_debug;
 #include <mach/barriers.h>
 #elif defined(CONFIG_ARM_DMA_MEM_BUFFERABLE) || defined(CONFIG_SMP)
 #define mb()            do { dsb(); outer_sync(); } while (0)
-#define rmb()           dmb()
+#define rmb()           dsb()
 #define wmb()           mb()
 #else
 #include <asm/memory.h>
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index cb8398317644..0340224cf73c 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -597,19 +597,13 @@ setup_rt_frame(int usig, struct k_sigaction *ka, siginfo_t *info,
         return err;
 }
 
-static inline void setup_syscall_restart(struct pt_regs *regs)
-{
-        regs->ARM_r0 = regs->ARM_ORIG_r0;
-        regs->ARM_pc -= thumb_mode(regs) ? 2 : 4;
-}
-
 /*
  * OK, we're invoking a handler
  */     
 static int
 handle_signal(unsigned long sig, struct k_sigaction *ka,
               siginfo_t *info, sigset_t *oldset,
-              struct pt_regs * regs, int syscall)
+              struct pt_regs * regs)
 {
         struct thread_info *thread = current_thread_info();
         struct task_struct *tsk = current;
@@ -617,26 +611,6 @@ handle_signal(unsigned long sig, struct k_sigaction *ka,
         int ret;
 
         /*
-         * If we were from a system call, check for system call restarting...
-         */
-        if (syscall) {
-                switch (regs->ARM_r0) {
-                case -ERESTART_RESTARTBLOCK:
-                case -ERESTARTNOHAND:
-                        regs->ARM_r0 = -EINTR;
-                        break;
-                case -ERESTARTSYS:
-                        if (!(ka->sa.sa_flags & SA_RESTART)) {
-                                regs->ARM_r0 = -EINTR;
-                                break;
-                        }
-                        /* fallthrough */
-                case -ERESTARTNOINTR:
-                        setup_syscall_restart(regs);
-                }
-        }
-
-        /*
          * translate the signal
          */
         if (usig < 32 && thread->exec_domain && thread->exec_domain->signal_invmap)
@@ -685,6 +659,7 @@ handle_signal(unsigned long sig, struct k_sigaction *ka,
  */
 static void do_signal(struct pt_regs *regs, int syscall)
 {
+        unsigned int retval = 0, continue_addr = 0, restart_addr = 0;
         struct k_sigaction ka;
         siginfo_t info;
         int signr;
@@ -698,18 +673,61 @@ static void do_signal(struct pt_regs *regs, int syscall)
         if (!user_mode(regs))
                 return;
 
+        /*
+         * If we were from a system call, check for system call restarting...
+         */
+        if (syscall) {
+                continue_addr = regs->ARM_pc;
+                restart_addr = continue_addr - (thumb_mode(regs) ? 2 : 4);
+                retval = regs->ARM_r0;
+
+                /*
+                 * Prepare for system call restart.  We do this here so that a
+                 * debugger will see the already changed PSW.
+                 */
+                switch (retval) {
+                case -ERESTARTNOHAND:
+                case -ERESTARTSYS:
+                case -ERESTARTNOINTR:
+                        regs->ARM_r0 = regs->ARM_ORIG_r0;
+                        regs->ARM_pc = restart_addr;
+                        break;
+                case -ERESTART_RESTARTBLOCK:
+                        regs->ARM_r0 = -EINTR;
+                        break;
+                }
+        }
+
         if (try_to_freeze())
                 goto no_signal;
 
+        /*
+         * Get the signal to deliver.  When running under ptrace, at this
+         * point the debugger may change all our registers ...
+         */
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
         if (signr > 0) {
                 sigset_t *oldset;
 
+                /*
+                 * Depending on the signal settings we may need to revert the
+                 * decision to restart the system call.  But skip this if a
+                 * debugger has chosen to restart at a different PC.
+                 */
+                if (regs->ARM_pc == restart_addr) {
+                        if (retval == -ERESTARTNOHAND
+                            || (retval == -ERESTARTSYS
+                                && !(ka.sa.sa_flags & SA_RESTART))) {
+                                regs->ARM_r0 = -EINTR;
+                                regs->ARM_pc = continue_addr;
+                        }
+                }
+
                 if (test_thread_flag(TIF_RESTORE_SIGMASK))
                         oldset = &current->saved_sigmask;
                 else
                         oldset = &current->blocked;
-                if (handle_signal(signr, &ka, &info, oldset, regs, syscall) == 0) {
+                if (handle_signal(signr, &ka, &info, oldset, regs) == 0) {
                         /*
                          * A signal was successfully delivered; the saved
                          * sigmask will have been stored in the signal frame,
@@ -723,11 +741,14 @@ static void do_signal(struct pt_regs *regs, int syscall)
         }
 
  no_signal:
-        /*
-         * No signal to deliver to the process - restart the syscall.
-         */
         if (syscall) {
-                if (regs->ARM_r0 == -ERESTART_RESTARTBLOCK) {
+                /*
+                 * Handle restarting a different system call.  As above,
+                 * if a debugger has chosen to restart at a different PC,
+                 * ignore the restart.
+                 */
+                if (retval == -ERESTART_RESTARTBLOCK
+                    && regs->ARM_pc == continue_addr) {
                         if (thumb_mode(regs)) {
                                 regs->ARM_r7 = __NR_restart_syscall - __NR_SYSCALL_BASE;
                                 regs->ARM_pc -= 2;
@@ -750,11 +771,6 @@ static void do_signal(struct pt_regs *regs, int syscall)
 #endif
                         }
                 }
-                if (regs->ARM_r0 == -ERESTARTNOHAND ||
-                    regs->ARM_r0 == -ERESTARTSYS ||
-                    regs->ARM_r0 == -ERESTARTNOINTR) {
-                        setup_syscall_restart(regs);
-                }
 
                 /* If there's no signal to deliver, we just put the saved sigmask
                  * back.
diff --git a/arch/arm/mach-realview/include/mach/barriers.h b/arch/arm/mach-realview/include/mach/barriers.h
index 0c5d749d7b5f..9a732195aa1c 100644
--- a/arch/arm/mach-realview/include/mach/barriers.h
+++ b/arch/arm/mach-realview/include/mach/barriers.h
@@ -4,5 +4,5 @@
  * operation to deadlock the system.
  */
 #define mb()            dsb()
-#define rmb()           dmb()
+#define rmb()           dsb()
 #define wmb()           mb()
diff --git a/arch/arm/mach-tegra/include/mach/barriers.h b/arch/arm/mach-tegra/include/mach/barriers.h
index cc115174899b..425b42e91ef6 100644
--- a/arch/arm/mach-tegra/include/mach/barriers.h
+++ b/arch/arm/mach-tegra/include/mach/barriers.h
@@ -23,7 +23,7 @@
 
 #include <asm/outercache.h>
 
-#define rmb()           dmb()
+#define rmb()           dsb()
 #define wmb()           do { dsb(); outer_sync(); } while (0)
 #define mb()            wmb()
 
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index e5f6fc428348..e591513bb53e 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -392,7 +392,7 @@ free_memmap(unsigned long start_pfn, unsigned long end_pfn)
          * Convert start_pfn/end_pfn to a struct page pointer.
          */
         start_pg = pfn_to_page(start_pfn - 1) + 1;
-        end_pg = pfn_to_page(end_pfn);
+        end_pg = pfn_to_page(end_pfn - 1) + 1;
 
         /*
          * Convert to physical addresses, and
@@ -426,6 +426,14 @@ static void __init free_unused_memmap(struct meminfo *mi)
 
                 bank_start = bank_pfn_start(bank);
 
+#ifdef CONFIG_SPARSEMEM
+                /*
+                 * Take care not to free memmap entries that don't exist
+                 * due to SPARSEMEM sections which aren't present.
+                 */
+                bank_start = min(bank_start,
+                                 ALIGN(prev_bank_end, PAGES_PER_SECTION));
+#endif
                 /*
                  * If we had a previous bank, and there is a space
                  * between the current bank and the previous, free it.
@@ -440,6 +448,12 @@ static void __init free_unused_memmap(struct meminfo *mi)
                  */
                 prev_bank_end = ALIGN(bank_pfn_end(bank), MAX_ORDER_NR_PAGES);
         }
+
+#ifdef CONFIG_SPARSEMEM
+        if (!IS_ALIGNED(prev_bank_end, PAGES_PER_SECTION))
+                free_memmap(prev_bank_end,
+                            ALIGN(prev_bank_end, PAGES_PER_SECTION));
+#endif
 }
 
 static void __init free_highpages(void)
diff --git a/arch/s390/include/asm/diag.h b/arch/s390/include/asm/diag.h
index 72b2e2f2d32d..7e91c58072e2 100644
--- a/arch/s390/include/asm/diag.h
+++ b/arch/s390/include/asm/diag.h
@@ -9,9 +9,22 @@
 #define _ASM_S390_DIAG_H
 
 /*
- * Diagnose 10: Release pages
+ * Diagnose 10: Release page range
  */
-extern void diag10(unsigned long addr);
+static inline void diag10_range(unsigned long start_pfn, unsigned long num_pfn)
+{
+        unsigned long start_addr, end_addr;
+
+        start_addr = start_pfn << PAGE_SHIFT;
+        end_addr = (start_pfn + num_pfn - 1) << PAGE_SHIFT;
+
+        asm volatile(
+                "0:     diag    %0,%1,0x10\n"
+                "1:\n"
+                EX_TABLE(0b, 1b)
+                EX_TABLE(1b, 1b)
+                : : "a" (start_addr), "a" (end_addr));
+}
 
 /*
  * Diagnose 14: Input spool file manipulation
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index a6f0e7cc9cde..8c277caa8d3a 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -23,7 +23,7 @@ static inline int init_new_context(struct task_struct *tsk,
 #ifdef CONFIG_64BIT
         mm->context.asce_bits |= _ASCE_TYPE_REGION3;
 #endif
-        if (current->mm->context.alloc_pgste) {
+        if (current->mm && current->mm->context.alloc_pgste) {
                 /*
                  * alloc_pgste indicates, that any NEW context will be created
                  * with extended page tables. The old context is unchanged. The
diff --git a/arch/s390/kernel/diag.c b/arch/s390/kernel/diag.c
index c032d11da8a1..8237fc07ac79 100644
--- a/arch/s390/kernel/diag.c
+++ b/arch/s390/kernel/diag.c
@@ -9,27 +9,6 @@
 #include <asm/diag.h>
 
 /*
- * Diagnose 10: Release pages
- */
-void diag10(unsigned long addr)
-{
-        if (addr >= 0x7ff00000)
-                return;
-        asm volatile(
-#ifdef CONFIG_64BIT
-                "       sam31\n"
-                "       diag    %0,%0,0x10\n"
-                "0:     sam64\n"
-#else
-                "       diag    %0,%0,0x10\n"
-                "0:\n"
-#endif
-                EX_TABLE(0b, 0b)
-                : : "a" (addr));
-}
-EXPORT_SYMBOL(diag10);
-
-/*
  * Diagnose 14: Input spool file manipulation
  */
 int diag14(unsigned long rx, unsigned long ry1, unsigned long subcode)
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index c83726c9fe03..3d4a78fc1adc 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -672,6 +672,7 @@ static struct insn opcode_b2[] = {
         { "rp", 0x77, INSTR_S_RD },
         { "stcke", 0x78, INSTR_S_RD },
         { "sacf", 0x79, INSTR_S_RD },
+        { "spp", 0x80, INSTR_S_RD },
         { "stsi", 0x7d, INSTR_S_RD },
         { "srnm", 0x99, INSTR_S_RD },
         { "stfpc", 0x9c, INSTR_S_RD },
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 648f64239a9d..1b67fc6ebdc2 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -836,7 +836,7 @@ restart_base:
         stosm   __SF_EMPTY(%r15),0x04   # now we can turn dat on
         basr    %r14,0
         l       %r14,restart_addr-.(%r14)
-        br      %r14                    # branch to start_secondary
+        basr    %r14,%r14               # branch to start_secondary
 restart_addr:
         .long   start_secondary
         .align  8
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 9d3603d6c511..9fd864563499 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -841,7 +841,7 @@ restart_base:
         mvc     __LC_SYSTEM_TIMER(8),__TI_system_timer(%r1)
         xc      __LC_STEAL_TIMER(8),__LC_STEAL_TIMER
         stosm   __SF_EMPTY(%r15),0x04   # now we can turn dat on
-        jg      start_secondary
+        brasl   %r14,start_secondary
         .align  8
 restart_vtime:
         .long   0x7fffffff,0xffffffff
diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c
index c66ffd8dbbb7..1f1dba9dcf58 100644
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -91,7 +91,7 @@ static long cmm_alloc_pages(long nr, long *counter,
                         } else
                                 free_page((unsigned long) npa);
                 }
-                diag10(addr);
+                diag10_range(addr >> PAGE_SHIFT, 1);
                 pa->pages[pa->index++] = addr;
                 (*counter)++;
                 spin_unlock(&cmm_lock);
diff --git a/arch/s390/oprofile/hwsampler.c b/arch/s390/oprofile/hwsampler.c
index 4952872d6f0a..33cbd373cce4 100644
--- a/arch/s390/oprofile/hwsampler.c
+++ b/arch/s390/oprofile/hwsampler.c
@@ -1021,20 +1021,14 @@ deallocate_exit:
         return rc;
 }
 
-long hwsampler_query_min_interval(void)
+unsigned long hwsampler_query_min_interval(void)
 {
-        if (min_sampler_rate)
-                return min_sampler_rate;
-        else
-                return -EINVAL;
+        return min_sampler_rate;
 }
 
-long hwsampler_query_max_interval(void)
+unsigned long hwsampler_query_max_interval(void)
 {
-        if (max_sampler_rate)
-                return max_sampler_rate;
-        else
-                return -EINVAL;
+        return max_sampler_rate;
 }
 
 unsigned long hwsampler_get_sample_overflow_count(unsigned int cpu)
diff --git a/arch/s390/oprofile/hwsampler.h b/arch/s390/oprofile/hwsampler.h
index 8c72b59316b5..1912f3bb190c 100644
--- a/arch/s390/oprofile/hwsampler.h
+++ b/arch/s390/oprofile/hwsampler.h
@@ -102,8 +102,8 @@ int hwsampler_setup(void);
 int hwsampler_shutdown(void);
 int hwsampler_allocate(unsigned long sdbt, unsigned long sdb);
 int hwsampler_deallocate(void);
-long hwsampler_query_min_interval(void);
-long hwsampler_query_max_interval(void);
+unsigned long hwsampler_query_min_interval(void);
+unsigned long hwsampler_query_max_interval(void);
 int hwsampler_start_all(unsigned long interval);
 int hwsampler_stop_all(void);
 int hwsampler_deactivate(unsigned int cpu);
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index c63d7e58352b..5995e9bc72d9 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -145,15 +145,11 @@ static int oprofile_hwsampler_init(struct oprofile_operations *ops)
          * create hwsampler files only if hwsampler_setup() succeeds.
          */
         oprofile_min_interval = hwsampler_query_min_interval();
-        if (oprofile_min_interval < 0) {
-                oprofile_min_interval = 0;
+        if (oprofile_min_interval == 0)
                 return -ENODEV;
-        }
         oprofile_max_interval = hwsampler_query_max_interval();
-        if (oprofile_max_interval < 0) {
-                oprofile_max_interval = 0;
+        if (oprofile_max_interval == 0)
                 return -ENODEV;
-        }
 
         if (oprofile_timer_init(ops))
                 return -ENODEV;
diff --git a/arch/sparc/kernel/apc.c b/arch/sparc/kernel/apc.c
index f679c57644d5..1e34f29e58bb 100644
--- a/arch/sparc/kernel/apc.c
+++ b/arch/sparc/kernel/apc.c
@@ -165,7 +165,7 @@ static int __devinit apc_probe(struct platform_device *op)
         return 0;
 }
 
-static struct of_device_id __initdata apc_match[] = {
+static struct of_device_id apc_match[] = {
         {
                 .name = APC_OBPNAME,
         },
diff --git a/arch/sparc/kernel/pmc.c b/arch/sparc/kernel/pmc.c
index 93d7b4465f8d..6a585d393580 100644
--- a/arch/sparc/kernel/pmc.c
+++ b/arch/sparc/kernel/pmc.c
@@ -69,7 +69,7 @@ static int __devinit pmc_probe(struct platform_device *op)
         return 0;
 }
 
-static struct of_device_id __initdata pmc_match[] = {
+static struct of_device_id pmc_match[] = {
         {
                 .name = PMC_OBPNAME,
         },
diff --git a/arch/sparc/kernel/smp_32.c b/arch/sparc/kernel/smp_32.c
index 91c10fb70858..850a1360c0d6 100644
--- a/arch/sparc/kernel/smp_32.c
+++ b/arch/sparc/kernel/smp_32.c
@@ -53,6 +53,7 @@ cpumask_t smp_commenced_mask = CPU_MASK_NONE;
 void __cpuinit smp_store_cpu_info(int id)
 {
         int cpu_node;
+        int mid;
 
         cpu_data(id).udelay_val = loops_per_jiffy;
 
@@ -60,10 +61,13 @@ void __cpuinit smp_store_cpu_info(int id)
         cpu_data(id).clock_tick = prom_getintdefault(cpu_node,
                                                      "clock-frequency", 0);
         cpu_data(id).prom_node = cpu_node;
-        cpu_data(id).mid = cpu_get_hwmid(cpu_node);
+        mid = cpu_get_hwmid(cpu_node);
 
-        if (cpu_data(id).mid < 0)
-                panic("No MID found for CPU%d at node 0x%08d", id, cpu_node);
+        if (mid < 0) {
+                printk(KERN_NOTICE "No MID found for CPU%d at node 0x%08d", id, cpu_node);
+                mid = 0;
+        }
+        cpu_data(id).mid = mid;
 }
 
 void __init smp_cpus_done(unsigned int max_cpus)
diff --git a/arch/sparc/kernel/time_32.c b/arch/sparc/kernel/time_32.c
index 4e236391b635..96046a4024c2 100644
--- a/arch/sparc/kernel/time_32.c
+++ b/arch/sparc/kernel/time_32.c
@@ -168,7 +168,7 @@ static int __devinit clock_probe(struct platform_device *op)
         return 0;
 }
 
-static struct of_device_id __initdata clock_match[] = {
+static struct of_device_id clock_match[] = {
         {
                 .name = "eeprom",
         },
diff --git a/arch/sparc/lib/checksum_32.S b/arch/sparc/lib/checksum_32.S
index 3632cb34e914..0084c3361e15 100644
--- a/arch/sparc/lib/checksum_32.S
+++ b/arch/sparc/lib/checksum_32.S
@@ -289,10 +289,16 @@ cc_end_cruft:
 
         /* Also, handle the alignment code out of band. */
 cc_dword_align:
-        cmp     %g1, 6
-        bl,a    ccte
+        cmp     %g1, 16
+        bge     1f
+         srl    %g1, 1, %o3
+2:      cmp     %o3, 0
+        be,a    ccte
          andcc  %g1, 0xf, %o3
-        andcc   %o0, 0x1, %g0
+        andcc   %o3, %o0, %g0   ! Check %o0 only (%o1 has the same last 2 bits)
+        be,a    2b
+         srl    %o3, 1, %o3
+1:      andcc   %o0, 0x1, %g0
         bne     ccslow
          andcc  %o0, 0x2, %g0
         be      1f
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index 4bce801bc588..c77111eca6ac 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -42,7 +42,8 @@ nouveau_sgdma_populate(struct ttm_backend *be, unsigned long num_pages,
 
         nvbe->nr_pages = 0;
         while (num_pages--) {
-                if (dma_addrs[nvbe->nr_pages] != DMA_ERROR_CODE) {
+                /* this code path isn't called and is incorrect anyways */
+                if (0) { /*dma_addrs[nvbe->nr_pages] != DMA_ERROR_CODE)*/
                         nvbe->pages[nvbe->nr_pages] =
                                         dma_addrs[nvbe->nr_pages];
                         nvbe->ttm_alloced[nvbe->nr_pages] = true;
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 7aade20f63a8..3d8a7634bbe9 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -674,7 +674,7 @@ static void cayman_gpu_init(struct radeon_device *rdev)
 
         cc_rb_backend_disable = RREG32(CC_RB_BACKEND_DISABLE);
         cc_gc_shader_pipe_config = RREG32(CC_GC_SHADER_PIPE_CONFIG);
-        cgts_tcc_disable = RREG32(CGTS_TCC_DISABLE);
+        cgts_tcc_disable = 0xff000000;
         gc_user_rb_backend_disable = RREG32(GC_USER_RB_BACKEND_DISABLE);
         gc_user_shader_pipe_config = RREG32(GC_USER_SHADER_PIPE_CONFIG);
         cgts_user_tcc_disable = RREG32(CGTS_USER_TCC_DISABLE);
@@ -871,7 +871,7 @@ static void cayman_gpu_init(struct radeon_device *rdev)
 
         smx_dc_ctl0 = RREG32(SMX_DC_CTL0);
         smx_dc_ctl0 &= ~NUMBER_OF_SETS(0x1ff);
-        smx_dc_ctl0 |= NUMBER_OF_SETS(rdev->config.evergreen.sx_num_of_sets);
+        smx_dc_ctl0 |= NUMBER_OF_SETS(rdev->config.cayman.sx_num_of_sets);
         WREG32(SMX_DC_CTL0, smx_dc_ctl0);
 
         WREG32(SPI_CONFIG_CNTL_1, VTX_DONE_DELAY(4) | CRC_SIMD_ID_WADDR_DISABLE);
@@ -887,20 +887,20 @@ static void cayman_gpu_init(struct radeon_device *rdev)
 
         WREG32(TA_CNTL_AUX, DISABLE_CUBE_ANISO);
 
-        WREG32(SX_EXPORT_BUFFER_SIZES, (COLOR_BUFFER_SIZE((rdev->config.evergreen.sx_max_export_size / 4) - 1) |
-                                        POSITION_BUFFER_SIZE((rdev->config.evergreen.sx_max_export_pos_size / 4) - 1) |
-                                        SMX_BUFFER_SIZE((rdev->config.evergreen.sx_max_export_smx_size / 4) - 1)));
+        WREG32(SX_EXPORT_BUFFER_SIZES, (COLOR_BUFFER_SIZE((rdev->config.cayman.sx_max_export_size / 4) - 1) |
+                                        POSITION_BUFFER_SIZE((rdev->config.cayman.sx_max_export_pos_size / 4) - 1) |
+                                        SMX_BUFFER_SIZE((rdev->config.cayman.sx_max_export_smx_size / 4) - 1)));
 
-        WREG32(PA_SC_FIFO_SIZE, (SC_PRIM_FIFO_SIZE(rdev->config.evergreen.sc_prim_fifo_size) |
-                                 SC_HIZ_TILE_FIFO_SIZE(rdev->config.evergreen.sc_hiz_tile_fifo_size) |
-                                 SC_EARLYZ_TILE_FIFO_SIZE(rdev->config.evergreen.sc_earlyz_tile_fifo_size)));
+        WREG32(PA_SC_FIFO_SIZE, (SC_PRIM_FIFO_SIZE(rdev->config.cayman.sc_prim_fifo_size) |
+                                 SC_HIZ_TILE_FIFO_SIZE(rdev->config.cayman.sc_hiz_tile_fifo_size) |
+                                 SC_EARLYZ_TILE_FIFO_SIZE(rdev->config.cayman.sc_earlyz_tile_fifo_size)));
 
 
         WREG32(VGT_NUM_INSTANCES, 1);
 
         WREG32(CP_PERFMON_CNTL, 0);
 
-        WREG32(SQ_MS_FIFO_SIZES, (CACHE_FIFO_SIZE(16 * rdev->config.evergreen.sq_num_cf_insts) |
+        WREG32(SQ_MS_FIFO_SIZES, (CACHE_FIFO_SIZE(16 * rdev->config.cayman.sq_num_cf_insts) |
                                   FETCH_FIFO_HIWATER(0x4) |
                                   DONE_FIFO_HIWATER(0xe0) |
                                   ALU_UPDATE_FIFO_HIWATER(0x8)));
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 8a955bbdb608..a533f52fd163 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -181,9 +181,9 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
         p = t / (PAGE_SIZE / RADEON_GPU_PAGE_SIZE);
 
         for (i = 0; i < pages; i++, p++) {
-                /* On TTM path, we only use the DMA API if TTM_PAGE_FLAG_DMA32
-                 * is requested. */
-                if (dma_addr[i] != DMA_ERROR_CODE) {
+                /* we reverted the patch using dma_addr in TTM for now but this
+                 * code stops building on alpha so just comment it out for now */
+                if (0) { /*dma_addr[i] != DMA_ERROR_CODE) */
                         rdev->gart.ttm_alloced[p] = true;
                         rdev->gart.pages_addr[p] = dma_addr[i];
                 } else {
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index c24946f51256..1de1c19dad30 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -281,17 +281,24 @@ struct ser_req {
         u8                      command;
         u8                      ref_off;
         u16                     scratch;
-        __be16                  sample;
         struct spi_message      msg;
         struct spi_transfer     xfer[6];
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        __be16 sample ____cacheline_aligned;
 };
 
 struct ads7845_ser_req {
         u8                      command[3];
-        u8                      pwrdown[3];
-        u8                      sample[3];
         struct spi_message      msg;
         struct spi_transfer     xfer[2];
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u8 sample[3] ____cacheline_aligned;
 };
 
 static int ads7846_read12_ser(struct device *dev, unsigned command)
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index d4a851c6b5bf..0b4d5b23bec9 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -144,7 +144,7 @@ static void asic3_irq_demux(unsigned int irq, struct irq_desc *desc)
         int iter, i;
         unsigned long flags;
 
-        data->chip->irq_ack(irq_data);
+        data->chip->irq_ack(data);
 
         for (iter = 0 ; iter < MAX_ASIC_ISR_LOOPS; iter++) {
                 u32 status;
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 2e165117457b..3ab9ffa00aad 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -717,14 +717,14 @@ static int usbhs_enable(struct device *dev)
                         gpio_request(pdata->ehci_data->reset_gpio_port[0],
                                                 "USB1 PHY reset");
                         gpio_direction_output
-                                (pdata->ehci_data->reset_gpio_port[0], 1);
+                                (pdata->ehci_data->reset_gpio_port[0], 0);
                 }
 
                 if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1])) {
                         gpio_request(pdata->ehci_data->reset_gpio_port[1],
                                                 "USB2 PHY reset");
                         gpio_direction_output
-                                (pdata->ehci_data->reset_gpio_port[1], 1);
+                                (pdata->ehci_data->reset_gpio_port[1], 0);
                 }
 
                 /* Hold the PHY in RESET for enough time till DIR is high */
@@ -904,11 +904,11 @@ static int usbhs_enable(struct device *dev)
 
                 if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0]))
                         gpio_set_value
-                                (pdata->ehci_data->reset_gpio_port[0], 0);
+                                (pdata->ehci_data->reset_gpio_port[0], 1);
 
                 if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1]))
                         gpio_set_value
-                                (pdata->ehci_data->reset_gpio_port[1], 0);
+                                (pdata->ehci_data->reset_gpio_port[1], 1);
         }
 
 end_count:
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index 16422de0823a..2c0d4d16491a 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -447,12 +447,13 @@ static int __init load_twl4030_script(struct twl4030_script *tscript,
                 if (err)
                         goto out;
         }
-        if (tscript->flags & TWL4030_SLEEP_SCRIPT)
+        if (tscript->flags & TWL4030_SLEEP_SCRIPT) {
                 if (order)
                         pr_warning("TWL4030: Bad order of scripts (sleep "\
                                         "script before wakeup) Leads to boot"\
                                         "failure on some boards\n");
                 err = twl4030_config_sleep_sequence(address);
+        }
 out:
         return err;
 }
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index 4af235d41fda..fbfb5b47c506 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -527,7 +527,7 @@ static void __init etherh_banner(void)
  * Read the ethernet address string from the on board rom.
  * This is an ascii string...
  */
-static int __init etherh_addr(char *addr, struct expansion_card *ec)
+static int __devinit etherh_addr(char *addr, struct expansion_card *ec)
 {
         struct in_chunk_dir cd;
         char *s;
@@ -655,7 +655,7 @@ static const struct net_device_ops etherh_netdev_ops = {
 static u32 etherh_regoffsets[16];
 static u32 etherm_regoffsets[16];
 
-static int __init
+static int __devinit
 etherh_probe(struct expansion_card *ec, const struct ecard_id *id)
 {
         const struct etherh_data *data = id->data;
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index b3466c491cd3..16512ecae31a 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -46,6 +46,7 @@ static struct clk *rtc_clk;
 static void __iomem *s3c_rtc_base;
 static int s3c_rtc_alarmno = NO_IRQ;
 static int s3c_rtc_tickno  = NO_IRQ;
+static bool wake_en;
 static enum s3c_cpu_type s3c_rtc_cpu_type;
 
 static DEFINE_SPINLOCK(s3c_rtc_pie_lock);
@@ -562,8 +563,12 @@ static int s3c_rtc_suspend(struct platform_device *pdev, pm_message_t state)
         }
         s3c_rtc_enable(pdev, 0);
 
-        if (device_may_wakeup(&pdev->dev))
-                enable_irq_wake(s3c_rtc_alarmno);
+        if (device_may_wakeup(&pdev->dev) && !wake_en) {
+                if (enable_irq_wake(s3c_rtc_alarmno) == 0)
+                        wake_en = true;
+                else
+                        dev_err(&pdev->dev, "enable_irq_wake failed\n");
+        }
 
         return 0;
 }
@@ -579,8 +584,10 @@ static int s3c_rtc_resume(struct platform_device *pdev)
                 writew(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
         }
 
-        if (device_may_wakeup(&pdev->dev))
+        if (device_may_wakeup(&pdev->dev) && wake_en) {
                 disable_irq_wake(s3c_rtc_alarmno);
+                wake_en = false;
+        }
 
         return 0;
 }
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 475e603fc584..86b6f1cc1b10 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1742,11 +1742,20 @@ int dasd_sleep_on_interruptible(struct dasd_ccw_req *cqr)
 static inline int _dasd_term_running_cqr(struct dasd_device *device)
 {
         struct dasd_ccw_req *cqr;
+        int rc;
 
         if (list_empty(&device->ccw_queue))
                 return 0;
         cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, devlist);
-        return device->discipline->term_IO(cqr);
+        rc = device->discipline->term_IO(cqr);
+        if (!rc)
+                /*
+                 * CQR terminated because a more important request is pending.
+                 * Undo decreasing of retry counter because this is
+                 * not an error case.
+                 */
+                cqr->retries++;
+        return rc;
 }
 
 int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 4b60ede07f0e..be55fb2b1b1c 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -518,6 +518,8 @@ static void __init insert_increment(u16 rn, int standby, int assigned)
                 return;
         new_incr->rn = rn;
         new_incr->standby = standby;
+        if (!standby)
+                new_incr->usecount = 1;
         last_rn = 0;
         prev = &sclp_mem_list;
         list_for_each_entry(incr, &sclp_mem_list, list) {
diff --git a/drivers/video/acornfb.c b/drivers/video/acornfb.c
index 82acb8dc4aa1..6183a57eb69d 100644
--- a/drivers/video/acornfb.c
+++ b/drivers/video/acornfb.c
@@ -66,7 +66,7 @@
  * have.  Allow 1% either way on the nominal for TVs.
  */
 #define NR_MONTYPES     6
-static struct fb_monspecs monspecs[NR_MONTYPES] __initdata = {
+static struct fb_monspecs monspecs[NR_MONTYPES] __devinitdata = {
         {       /* TV           */
                 .hfmin  = 15469,
                 .hfmax  = 15781,
@@ -873,7 +873,7 @@ static struct fb_ops acornfb_ops = {
 /*
  * Everything after here is initialisation!!!
  */
-static struct fb_videomode modedb[] __initdata = {
+static struct fb_videomode modedb[] __devinitdata = {
         {       /* 320x256 @ 50Hz */
                 NULL, 50,  320,  256, 125000,  92,  62,  35, 19,  38, 2,
                 FB_SYNC_COMP_HIGH_ACT,
@@ -925,8 +925,7 @@ static struct fb_videomode modedb[] __initdata = {
         }
 };
 
-static struct fb_videomode __initdata
-acornfb_default_mode = {
+static struct fb_videomode acornfb_default_mode __devinitdata = {
         .name =         NULL,
         .refresh =      60,
         .xres =         640,
@@ -942,7 +941,7 @@ acornfb_default_mode = {
         .vmode =        FB_VMODE_NONINTERLACED
 };
 
-static void __init acornfb_init_fbinfo(void)
+static void __devinit acornfb_init_fbinfo(void)
 {
         static int first = 1;
 
@@ -1018,8 +1017,7 @@ static void __init acornfb_init_fbinfo(void)
  *      size can optionally be followed by 'M' or 'K' for
  *      MB or KB respectively.
  */
-static void __init
-acornfb_parse_mon(char *opt)
+static void __devinit acornfb_parse_mon(char *opt)
 {
         char *p = opt;
 
@@ -1066,8 +1064,7 @@ bad:
         current_par.montype = -1;
 }
 
-static void __init
-acornfb_parse_montype(char *opt)
+static void __devinit acornfb_parse_montype(char *opt)
 {
         current_par.montype = -2;
 
@@ -1108,8 +1105,7 @@ acornfb_parse_montype(char *opt)
         }
 }
 
-static void __init
-acornfb_parse_dram(char *opt)
+static void __devinit acornfb_parse_dram(char *opt)
 {
         unsigned int size;
 
@@ -1134,15 +1130,14 @@ acornfb_parse_dram(char *opt)
 static struct options {
         char *name;
         void (*parse)(char *opt);
-} opt_table[] __initdata = {
+} opt_table[] __devinitdata = {
         { "mon",     acornfb_parse_mon     },
         { "montype", acornfb_parse_montype },
         { "dram",    acornfb_parse_dram    },
         { NULL, NULL }
 };
 
-int __init
-acornfb_setup(char *options)
+static int __devinit acornfb_setup(char *options)
 {
         struct options *optp;
         char *opt;
@@ -1179,8 +1174,7 @@ acornfb_setup(char *options)
  * Detect type of monitor connected
  *  For now, we just assume SVGA
  */
-static int __init
-acornfb_detect_monitortype(void)
+static int __devinit acornfb_detect_monitortype(void)
 {
         return 4;
 }
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 9fa08662a88d..2a5404c1c42f 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -819,7 +819,7 @@ int __ceph_caps_used(struct ceph_inode_info *ci)
                 used |= CEPH_CAP_FILE_CACHE;
         if (ci->i_wr_ref)
                 used |= CEPH_CAP_FILE_WR;
-        if (ci->i_wrbuffer_ref)
+        if (ci->i_wb_ref || ci->i_wrbuffer_ref)
                 used |= CEPH_CAP_FILE_BUFFER;
         return used;
 }
@@ -1990,11 +1990,11 @@ static void __take_cap_refs(struct ceph_inode_info *ci, int got)
         if (got & CEPH_CAP_FILE_WR)
                 ci->i_wr_ref++;
         if (got & CEPH_CAP_FILE_BUFFER) {
-                if (ci->i_wrbuffer_ref == 0)
+                if (ci->i_wb_ref == 0)
                         ihold(&ci->vfs_inode);
-                ci->i_wrbuffer_ref++;
-                dout("__take_cap_refs %p wrbuffer %d -> %d (?)\n",
-                     &ci->vfs_inode, ci->i_wrbuffer_ref-1, ci->i_wrbuffer_ref);
+                ci->i_wb_ref++;
+                dout("__take_cap_refs %p wb %d -> %d (?)\n",
+                     &ci->vfs_inode, ci->i_wb_ref-1, ci->i_wb_ref);
         }
 }
 
@@ -2169,12 +2169,12 @@ void ceph_put_cap_refs(struct ceph_inode_info *ci, int had)
                 if (--ci->i_rdcache_ref == 0)
                         last++;
         if (had & CEPH_CAP_FILE_BUFFER) {
-                if (--ci->i_wrbuffer_ref == 0) {
+                if (--ci->i_wb_ref == 0) {
                         last++;
                         put++;
                 }
-                dout("put_cap_refs %p wrbuffer %d -> %d (?)\n",
-                     inode, ci->i_wrbuffer_ref+1, ci->i_wrbuffer_ref);
+                dout("put_cap_refs %p wb %d -> %d (?)\n",
+                     inode, ci->i_wb_ref+1, ci->i_wb_ref);
         }
         if (had & CEPH_CAP_FILE_WR)
                 if (--ci->i_wr_ref == 0) {
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 03d6dafda61f..70b6a4839c38 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -355,6 +355,7 @@ struct inode *ceph_alloc_inode(struct super_block *sb)
         ci->i_rd_ref = 0;
         ci->i_rdcache_ref = 0;
         ci->i_wr_ref = 0;
+        ci->i_wb_ref = 0;
         ci->i_wrbuffer_ref = 0;
         ci->i_wrbuffer_ref_head = 0;
         ci->i_shared_gen = 0;
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index f60b07b0feb0..d0fae4ce9ba5 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3304,8 +3304,8 @@ static void con_put(struct ceph_connection *con)
 {
         struct ceph_mds_session *s = con->private;
 
+        dout("mdsc con_put %p (%d)\n", s, atomic_read(&s->s_ref) - 1);
         ceph_put_mds_session(s);
-        dout("mdsc con_put %p (%d)\n", s, atomic_read(&s->s_ref));
 }
 
 /*
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index e86ec1155f8f..24067d68a554 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -206,7 +206,7 @@ void ceph_put_snap_realm(struct ceph_mds_client *mdsc,
                 up_write(&mdsc->snap_rwsem);
         } else {
                 spin_lock(&mdsc->snap_empty_lock);
-                list_add(&mdsc->snap_empty, &realm->empty_item);
+                list_add(&realm->empty_item, &mdsc->snap_empty);
                 spin_unlock(&mdsc->snap_empty_lock);
         }
 }
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index b1f1b8bb1271..f5cabefa98dc 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -293,7 +293,7 @@ struct ceph_inode_info {
 
         /* held references to caps */
         int i_pin_ref;
-        int i_rd_ref, i_rdcache_ref, i_wr_ref;
+        int i_rd_ref, i_rdcache_ref, i_wr_ref, i_wb_ref;
         int i_wrbuffer_ref, i_wrbuffer_ref_head;
         u32 i_shared_gen;       /* increment each time we get FILE_SHARED */
         u32 i_rdcache_gen;      /* incremented each time we get FILE_CACHE. */
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index c6ba49bd95b3..b32eb29a4e6f 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -174,7 +174,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 if (!inode)
                         return 0;
 
-                if (nd->flags & LOOKUP_RCU)
+                if (nd && (nd->flags & LOOKUP_RCU))
                         return -ECHILD;
 
                 fc = get_fuse_conn(inode);
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index b8613e806aa9..01eca1794e14 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -111,6 +111,8 @@ extern void *__alloc_bootmem_low_node(pg_data_t *pgdat,
         __alloc_bootmem_nopanic(x, PAGE_SIZE, __pa(MAX_DMA_ADDRESS))
 #define alloc_bootmem_node(pgdat, x) \
         __alloc_bootmem_node(pgdat, x, SMP_CACHE_BYTES, __pa(MAX_DMA_ADDRESS))
+#define alloc_bootmem_node_nopanic(pgdat, x) \
+        __alloc_bootmem_node_nopanic(pgdat, x, SMP_CACHE_BYTES, __pa(MAX_DMA_ADDRESS))
 #define alloc_bootmem_pages_node(pgdat, x) \
         __alloc_bootmem_node(pgdat, x, PAGE_SIZE, __pa(MAX_DMA_ADDRESS))
 #define alloc_bootmem_pages_node_nopanic(pgdat, x) \
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index bfb8f934521e..56d8fc87fbbc 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -353,6 +353,8 @@ extern unsigned long get_zeroed_page(gfp_t gfp_mask);
 
 void *alloc_pages_exact(size_t size, gfp_t gfp_mask);
 void free_pages_exact(void *virt, size_t size);
+/* This is different from alloc_pages_exact_node !!! */
+void *alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask);
 
 #define __get_free_page(gfp_mask) \
                 __get_free_pages((gfp_mask), 0)
diff --git a/include/trace/events/gfpflags.h b/include/trace/events/gfpflags.h
index e3615c093741..9fe3a36646e9 100644
--- a/include/trace/events/gfpflags.h
+++ b/include/trace/events/gfpflags.h
@@ -10,6 +10,7 @@
  */
 #define show_gfp_flags(flags)                                           \
         (flags) ? __print_flags(flags, "|",                             \
+        {(unsigned long)GFP_TRANSHUGE,          "GFP_TRANSHUGE"},       \
         {(unsigned long)GFP_HIGHUSER_MOVABLE,   "GFP_HIGHUSER_MOVABLE"}, \
         {(unsigned long)GFP_HIGHUSER,           "GFP_HIGHUSER"},        \
         {(unsigned long)GFP_USER,               "GFP_USER"},            \
@@ -32,6 +33,9 @@
         {(unsigned long)__GFP_HARDWALL,         "GFP_HARDWALL"},        \
         {(unsigned long)__GFP_THISNODE,         "GFP_THISNODE"},        \
         {(unsigned long)__GFP_RECLAIMABLE,      "GFP_RECLAIMABLE"},     \
-        {(unsigned long)__GFP_MOVABLE,          "GFP_MOVABLE"}          \
+        {(unsigned long)__GFP_MOVABLE,          "GFP_MOVABLE"},         \
+        {(unsigned long)__GFP_NOTRACK,          "GFP_NOTRACK"},         \
+        {(unsigned long)__GFP_NO_KSWAPD,        "GFP_NO_KSWAPD"},       \
+        {(unsigned long)__GFP_OTHER_NODE,       "GFP_OTHER_NODE"}       \
         ) : "GFP_NOWAIT"
 
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 8935369d503a..6275970b2189 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -216,7 +216,6 @@ int suspend_devices_and_enter(suspend_state_t state)
                         goto Close;
         }
         suspend_console();
-        pm_restrict_gfp_mask();
         suspend_test_start();
         error = dpm_suspend_start(PMSG_SUSPEND);
         if (error) {
@@ -233,7 +232,6 @@ int suspend_devices_and_enter(suspend_state_t state)
         suspend_test_start();
         dpm_resume_end(PMSG_RESUME);
         suspend_test_finish("resume devices");
-        pm_restore_gfp_mask();
         resume_console();
  Close:
         if (suspend_ops->end)
@@ -294,7 +292,9 @@ int enter_state(suspend_state_t state)
                 goto Finish;
 
         pr_debug("PM: Entering %s sleep\n", pm_states[state]);
+        pm_restrict_gfp_mask();
         error = suspend_devices_and_enter(state);
+        pm_restore_gfp_mask();
 
  Finish:
         pr_debug("PM: Finishing wakeup.\n");
diff --git a/kernel/power/user.c b/kernel/power/user.c
index c36c3b9e8a84..7d02d33be699 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -135,8 +135,10 @@ static int snapshot_release(struct inode *inode, struct file *filp)
         free_basic_memory_bitmaps();
         data = filp->private_data;
         free_all_swap_pages(data->swap);
-        if (data->frozen)
+        if (data->frozen) {
+                pm_restore_gfp_mask();
                 thaw_processes();
+        }
         pm_notifier_call_chain(data->mode == O_RDONLY ?
                         PM_POST_HIBERNATION : PM_POST_RESTORE);
         atomic_inc(&snapshot_device_available);
@@ -379,6 +381,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                  * PM_HIBERNATION_PREPARE
                  */
                 error = suspend_devices_and_enter(PM_SUSPEND_MEM);
+                data->ready = 0;
                 break;
 
         case SNAPSHOT_PLATFORM_SUPPORT:
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 9f8a97b9a350..570d944daeb5 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2317,6 +2317,21 @@ void free_pages(unsigned long addr, unsigned int order)
 
 EXPORT_SYMBOL(free_pages);
 
+static void *make_alloc_exact(unsigned long addr, unsigned order, size_t size)
+{
+        if (addr) {
+                unsigned long alloc_end = addr + (PAGE_SIZE << order);
+                unsigned long used = addr + PAGE_ALIGN(size);
+
+                split_page(virt_to_page((void *)addr), order);
+                while (used < alloc_end) {
+                        free_page(used);
+                        used += PAGE_SIZE;
+                }
+        }
+        return (void *)addr;
+}
+
 /**
  * alloc_pages_exact - allocate an exact number physically-contiguous pages.
  * @size: the number of bytes to allocate
@@ -2336,22 +2351,32 @@ void *alloc_pages_exact(size_t size, gfp_t gfp_mask)
         unsigned long addr;
 
         addr = __get_free_pages(gfp_mask, order);
-        if (addr) {
-                unsigned long alloc_end = addr + (PAGE_SIZE << order);
-                unsigned long used = addr + PAGE_ALIGN(size);
-
-                split_page(virt_to_page((void *)addr), order);
-                while (used < alloc_end) {
-                        free_page(used);
-                        used += PAGE_SIZE;
-                }
-        }
-
-        return (void *)addr;
+        return make_alloc_exact(addr, order, size);
 }
 EXPORT_SYMBOL(alloc_pages_exact);
 
 /**
+ * alloc_pages_exact_nid - allocate an exact number of physically-contiguous
+ *                         pages on a node.
+ * @size: the number of bytes to allocate
+ * @gfp_mask: GFP flags for the allocation
+ *
+ * Like alloc_pages_exact(), but try to allocate on node nid first before falling
+ * back.
+ * Note this is not alloc_pages_exact_node() which allocates on a specific node,
+ * but is not exact.
+ */
+void *alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask)
+{
+        unsigned order = get_order(size);
+        struct page *p = alloc_pages_node(nid, gfp_mask, order);
+        if (!p)
+                return NULL;
+        return make_alloc_exact((unsigned long)page_address(p), order, size);
+}
+EXPORT_SYMBOL(alloc_pages_exact_nid);
+
+/**
  * free_pages_exact - release memory allocated via alloc_pages_exact()
  * @virt: the value returned by alloc_pages_exact.
  * @size: size of allocation, same value as passed to alloc_pages_exact().
@@ -3564,7 +3589,7 @@ int zone_wait_table_init(struct zone *zone, unsigned long zone_size_pages)
 
         if (!slab_is_available()) {
                 zone->wait_table = (wait_queue_head_t *)
-                        alloc_bootmem_node(pgdat, alloc_size);
+                        alloc_bootmem_node_nopanic(pgdat, alloc_size);
         } else {
                 /*
                  * This case means that a zone whose size was 0 gets new memory
@@ -4141,7 +4166,8 @@ static void __init setup_usemap(struct pglist_data *pgdat,
         unsigned long usemapsize = usemap_size(zonesize);
         zone->pageblock_flags = NULL;
         if (usemapsize)
-                zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
+                zone->pageblock_flags = alloc_bootmem_node_nopanic(pgdat,
+                                                                   usemapsize);
 }
 #else
 static inline void setup_usemap(struct pglist_data *pgdat,
@@ -4307,7 +4333,7 @@ static void __init_refok alloc_node_mem_map(struct pglist_data *pgdat)
                 size =  (end - start) * sizeof(struct page);
                 map = alloc_remap(pgdat->node_id, size);
                 if (!map)
-                        map = alloc_bootmem_node(pgdat, size);
+                        map = alloc_bootmem_node_nopanic(pgdat, size);
                 pgdat->node_mem_map = map + (pgdat->node_start_pfn - start);
         }
 #ifndef CONFIG_NEED_MULTIPLE_NODES
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index 99055010cece..2daadc322ba6 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -134,7 +134,7 @@ static void *__init_refok alloc_page_cgroup(size_t size, int nid)
 {
         void *addr = NULL;
 
-        addr = alloc_pages_exact(size, GFP_KERNEL | __GFP_NOWARN);
+        addr = alloc_pages_exact_nid(nid, size, GFP_KERNEL | __GFP_NOWARN);
         if (addr)
                 return addr;
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 8fa27e4e582a..9e755c166cc5 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -852,7 +852,7 @@ static inline int shmem_find_swp(swp_entry_t entry, swp_entry_t *dir, swp_entry_
 
 static int shmem_unuse_inode(struct shmem_inode_info *info, swp_entry_t entry, struct page *page)
 {
-        struct inode *inode;
+        struct address_space *mapping;
         unsigned long idx;
         unsigned long size;
         unsigned long limit;
@@ -875,8 +875,10 @@ static int shmem_unuse_inode(struct shmem_inode_info *info, swp_entry_t entry, s
         if (size > SHMEM_NR_DIRECT)
                 size = SHMEM_NR_DIRECT;
         offset = shmem_find_swp(entry, ptr, ptr+size);
-        if (offset >= 0)
+        if (offset >= 0) {
+                shmem_swp_balance_unmap();
                 goto found;
+        }
         if (!info->i_indirect)
                 goto lost2;
 
@@ -914,11 +916,11 @@ static int shmem_unuse_inode(struct shmem_inode_info *info, swp_entry_t entry, s
                         if (size > ENTRIES_PER_PAGE)
                                 size = ENTRIES_PER_PAGE;
                         offset = shmem_find_swp(entry, ptr, ptr+size);
-                        shmem_swp_unmap(ptr);
                         if (offset >= 0) {
                                 shmem_dir_unmap(dir);
                                 goto found;
                         }
+                        shmem_swp_unmap(ptr);
                 }
         }
 lost1:
@@ -928,8 +930,7 @@ lost2:
         return 0;
 found:
         idx += offset;
-        inode = igrab(&info->vfs_inode);
-        spin_unlock(&info->lock);
+        ptr += offset;
 
         /*
          * Move _head_ to start search for next from here.
@@ -940,37 +941,18 @@ found:
          */
         if (shmem_swaplist.next != &info->swaplist)
                 list_move_tail(&shmem_swaplist, &info->swaplist);
-        mutex_unlock(&shmem_swaplist_mutex);
 
-        error = 1;
-        if (!inode)
-                goto out;
         /*
-         * Charge page using GFP_KERNEL while we can wait.
-         * Charged back to the user(not to caller) when swap account is used.
-         * add_to_page_cache() will be called with GFP_NOWAIT.
+         * We rely on shmem_swaplist_mutex, not only to protect the swaplist,
+         * but also to hold up shmem_evict_inode(): so inode cannot be freed
+         * beneath us (pagelock doesn't help until the page is in pagecache).
          */
-        error = mem_cgroup_cache_charge(page, current->mm, GFP_KERNEL);
-        if (error)
-                goto out;
-        error = radix_tree_preload(GFP_KERNEL);
-        if (error) {
-                mem_cgroup_uncharge_cache_page(page);
-                goto out;
-        }
-        error = 1;
-
-        spin_lock(&info->lock);
-        ptr = shmem_swp_entry(info, idx, NULL);
-        if (ptr && ptr->val == entry.val) {
-                error = add_to_page_cache_locked(page, inode->i_mapping,
-                                                idx, GFP_NOWAIT);
-                /* does mem_cgroup_uncharge_cache_page on error */
-        } else  /* we must compensate for our precharge above */
-                mem_cgroup_uncharge_cache_page(page);
+        mapping = info->vfs_inode.i_mapping;
+        error = add_to_page_cache_locked(page, mapping, idx, GFP_NOWAIT);
+        /* which does mem_cgroup_uncharge_cache_page on error */
 
         if (error == -EEXIST) {
-                struct page *filepage = find_get_page(inode->i_mapping, idx);
+                struct page *filepage = find_get_page(mapping, idx);
                 error = 1;
                 if (filepage) {
                         /*
@@ -990,14 +972,8 @@ found:
                 swap_free(entry);
                 error = 1;      /* not an error, but entry was found */
         }
-        if (ptr)
-                shmem_swp_unmap(ptr);
+        shmem_swp_unmap(ptr);
         spin_unlock(&info->lock);
-        radix_tree_preload_end();
-out:
-        unlock_page(page);
-        page_cache_release(page);
-        iput(inode);            /* allows for NULL */
         return error;
 }
 
@@ -1009,6 +985,26 @@ int shmem_unuse(swp_entry_t entry, struct page *page)
         struct list_head *p, *next;
         struct shmem_inode_info *info;
         int found = 0;
+        int error;
+
+        /*
+         * Charge page using GFP_KERNEL while we can wait, before taking
+         * the shmem_swaplist_mutex which might hold up shmem_writepage().
+         * Charged back to the user (not to caller) when swap account is used.
+         * add_to_page_cache() will be called with GFP_NOWAIT.
+         */
+        error = mem_cgroup_cache_charge(page, current->mm, GFP_KERNEL);
+        if (error)
+                goto out;
+        /*
+         * Try to preload while we can wait, to not make a habit of
+         * draining atomic reserves; but don't latch on to this cpu,
+         * it's okay if sometimes we get rescheduled after this.
+         */
+        error = radix_tree_preload(GFP_KERNEL);
+        if (error)
+                goto uncharge;
+        radix_tree_preload_end();
 
         mutex_lock(&shmem_swaplist_mutex);
         list_for_each_safe(p, next, &shmem_swaplist) {
@@ -1016,17 +1012,19 @@ int shmem_unuse(swp_entry_t entry, struct page *page)
                 found = shmem_unuse_inode(info, entry, page);
                 cond_resched();
                 if (found)
-                        goto out;
+                        break;
         }
         mutex_unlock(&shmem_swaplist_mutex);
-        /*
-         * Can some race bring us here?  We've been holding page lock,
-         * so I think not; but would rather try again later than BUG()
-         */
+
+uncharge:
+        if (!found)
+                mem_cgroup_uncharge_cache_page(page);
+        if (found < 0)
+                error = found;
+out:
         unlock_page(page);
         page_cache_release(page);
-out:
-        return (found < 0) ? found : 0;
+        return error;
 }
 
 /*
@@ -1039,6 +1037,7 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
         struct address_space *mapping;
         unsigned long index;
         struct inode *inode;
+        bool unlock_mutex = false;
 
         BUG_ON(!PageLocked(page));
         mapping = page->mapping;
@@ -1064,7 +1063,26 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
         else
                 swap.val = 0;
 
+        /*
+         * Add inode to shmem_unuse()'s list of swapped-out inodes,
+         * if it's not already there.  Do it now because we cannot take
+         * mutex while holding spinlock, and must do so before the page
+         * is moved to swap cache, when its pagelock no longer protects
+         * the inode from eviction.  But don't unlock the mutex until
+         * we've taken the spinlock, because shmem_unuse_inode() will
+         * prune a !swapped inode from the swaplist under both locks.
+         */
+        if (swap.val && list_empty(&info->swaplist)) {
+                mutex_lock(&shmem_swaplist_mutex);
+                /* move instead of add in case we're racing */
+                list_move_tail(&info->swaplist, &shmem_swaplist);
+                unlock_mutex = true;
+        }
+
         spin_lock(&info->lock);
+        if (unlock_mutex)
+                mutex_unlock(&shmem_swaplist_mutex);
+
         if (index >= info->next_index) {
                 BUG_ON(!(info->flags & SHMEM_TRUNCATE));
                 goto unlock;
@@ -1084,21 +1102,10 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
                 delete_from_page_cache(page);
                 shmem_swp_set(info, entry, swap.val);
                 shmem_swp_unmap(entry);
-                if (list_empty(&info->swaplist))
-                        inode = igrab(inode);
-                else
-                        inode = NULL;
                 spin_unlock(&info->lock);
                 swap_shmem_alloc(swap);
                 BUG_ON(page_mapped(page));
                 swap_writepage(page, wbc);
-                if (inode) {
-                        mutex_lock(&shmem_swaplist_mutex);
-                        /* move instead of add in case we're racing */
-                        list_move_tail(&info->swaplist, &shmem_swaplist);
-                        mutex_unlock(&shmem_swaplist_mutex);
-                        iput(inode);
-                }
                 return 0;
         }
 
@@ -1400,20 +1407,14 @@ repeat:
                 if (sbinfo->max_blocks) {
                         if (percpu_counter_compare(&sbinfo->used_blocks,
                                                 sbinfo->max_blocks) >= 0 ||
-                            shmem_acct_block(info->flags)) {
-                                spin_unlock(&info->lock);
-                                error = -ENOSPC;
-                                goto failed;
-                        }
+                            shmem_acct_block(info->flags))
+                                goto nospace;
                         percpu_counter_inc(&sbinfo->used_blocks);
                         spin_lock(&inode->i_lock);
                         inode->i_blocks += BLOCKS_PER_PAGE;
                         spin_unlock(&inode->i_lock);
-                } else if (shmem_acct_block(info->flags)) {
-                        spin_unlock(&info->lock);
-                        error = -ENOSPC;
-                        goto failed;
-                }
+                } else if (shmem_acct_block(info->flags))
+                        goto nospace;
 
                 if (!filepage) {
                         int ret;
@@ -1493,6 +1494,24 @@ done:
         error = 0;
         goto out;
 
+nospace:
+        /*
+         * Perhaps the page was brought in from swap between find_lock_page
+         * and taking info->lock?  We allow for that at add_to_page_cache_lru,
+         * but must also avoid reporting a spurious ENOSPC while working on a
+         * full tmpfs.  (When filepage has been passed in to shmem_getpage, it
+         * is already in page cache, which prevents this race from occurring.)
+         */
+        if (!filepage) {
+                struct page *page = find_get_page(mapping, idx);
+                if (page) {
+                        spin_unlock(&info->lock);
+                        page_cache_release(page);
+                        goto repeat;
+                }
+        }
+        spin_unlock(&info->lock);
+        error = -ENOSPC;
 failed:
         if (*pagep != filepage) {
                 unlock_page(filepage);
diff --git a/mm/swap.c b/mm/swap.c
index a448db377cb0..5602f1a1b1e7 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -396,6 +396,9 @@ static void lru_deactivate_fn(struct page *page, void *arg)
         if (!PageLRU(page))
                 return;
 
+        if (PageUnevictable(page))
+                return;
+
         /* Some processes are using the page */
         if (page_mapped(page))
                 return;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 94954c74f6ae..42fdffd1d76c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -369,15 +369,6 @@ static void __sco_sock_close(struct sock *sk)
 
         case BT_CONNECTED:
         case BT_CONFIG:
-                if (sco_pi(sk)->conn) {
-                        sk->sk_state = BT_DISCONN;
-                        sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
-                        hci_conn_put(sco_pi(sk)->conn->hcon);
-                        sco_pi(sk)->conn = NULL;
-                } else
-                        sco_chan_del(sk, ECONNRESET);
-                break;
-
         case BT_CONNECT:
         case BT_DISCONN:
                 sco_chan_del(sk, ECONNRESET);