67 files changed, 890 insertions, 635 deletions
diff --git a/Documentation/filesystems/ubifs.txt b/Documentation/filesystems/ubifs.txt
index 84da2a4ba25a..12fedb7834c6 100644
--- a/Documentation/filesystems/ubifs.txt
+++ b/Documentation/filesystems/ubifs.txt
@@ -79,13 +79,6 @@ Mount options
 (*) == default.
-norm_unmount (*)        commit on unmount; the journal is committed
-                        when the file-system is unmounted so that the
-                        next mount does not have to replay the journal
-                        and it becomes very fast;
-fast_unmount            do not commit on unmount; this option makes
-                        unmount faster, but the next mount slower
-                        because of the need to replay the journal.
 bulk_read               read more in one go to take advantage of flash
                        media that read faster sequentially
 no_bulk_read (*)        do not bulk-read
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 77b047475539..85040cfeb5e5 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -650,6 +650,7 @@ ENTRY(fp_enter)
 no_fp:  mov     pc, lr
 __und_usr_unknown:
+        enable_irq
        mov     r0, sp
        adr     lr, ret_from_exception
        b       do_undefinstr
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 06269ea375c5..49a6ba926c2b 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -136,7 +136,7 @@ ENTRY(mcount)
        ldmia sp!, {r0-r3, pc}
 trace:
-        ldr r1, [fp, #-4]
+        ldr r1, [fp, #-4]                       @ lr of instrumented routine
        mov r0, lr
        sub r0, r0, #MCOUNT_INSN_SIZE
        mov lr, pc
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 7141cee1fab7..363db186cb93 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -101,7 +101,7 @@ unlock:
 /* Handle bad interrupts */
 static struct irq_desc bad_irq_desc = {
        .handle_irq = handle_bad_irq,
-        .lock = SPIN_LOCK_UNLOCKED
+        .lock = __SPIN_LOCK_UNLOCKED(bad_irq_desc.lock),
 };
 /*
diff --git a/arch/arm/mach-msm/board-halibut.c b/arch/arm/mach-msm/board-halibut.c
index c2a96e3965a6..e61967dde9a1 100644
--- a/arch/arm/mach-msm/board-halibut.c
+++ b/arch/arm/mach-msm/board-halibut.c
@@ -27,6 +27,7 @@
 #include <asm/mach/map.h>
 #include <asm/mach/flash.h>
+#include <mach/irqs.h>
 #include <mach/board.h>
 #include <mach/msm_iomap.h>
diff --git a/arch/arm/mach-omap1/devices.c b/arch/arm/mach-omap1/devices.c
index 77382d8b6b2f..ba5d7c08dc17 100644
--- a/arch/arm/mach-omap1/devices.c
+++ b/arch/arm/mach-omap1/devices.c
@@ -181,7 +181,7 @@ void __init omap1_init_mmc(struct omap_mmc_platform_data **mmc_data,
                }
                size = OMAP1_MMC_SIZE;
-                omap_mmc_add(i, base, size, irq, mmc_data[i]);
+                omap_mmc_add("mmci-omap", i, base, size, irq, mmc_data[i]);
        };
 }
diff --git a/arch/arm/mach-omap1/mcbsp.c b/arch/arm/mach-omap1/mcbsp.c
index ca7a0cc1707c..575ba31295cf 100644
--- a/arch/arm/mach-omap1/mcbsp.c
+++ b/arch/arm/mach-omap1/mcbsp.c
@@ -28,81 +28,8 @@
 #define DPS_RSTCT2_PER_EN       (1 << 0)
 #define DSP_RSTCT2_WD_PER_EN    (1 << 1)
-struct mcbsp_internal_clk {
-        struct clk clk;
-        struct clk **childs;
-        int n_childs;
-};
 #if defined(CONFIG_ARCH_OMAP15XX) || defined(CONFIG_ARCH_OMAP16XX)
-static void omap_mcbsp_clk_init(struct mcbsp_internal_clk *mclk)
+const char *clk_names[] = { "dsp_ck", "api_ck", "dspxor_ck" };
-{
-        const char *clk_names[] = { "dsp_ck", "api_ck", "dspxor_ck" };
-        int i;
-        mclk->n_childs = ARRAY_SIZE(clk_names);
-        mclk->childs = kzalloc(mclk->n_childs * sizeof(struct clk *),
-                                GFP_KERNEL);
-        for (i = 0; i < mclk->n_childs; i++) {
-                /* We fake a platform device to get correct device id */
-                struct platform_device pdev;
-                pdev.dev.bus = &platform_bus_type;
-                pdev.id = mclk->clk.id;
-                mclk->childs[i] = clk_get(&pdev.dev, clk_names[i]);
-                if (IS_ERR(mclk->childs[i]))
-                        printk(KERN_ERR "Could not get clock %s (%d).\n",
-                                clk_names[i], mclk->clk.id);
-        }
-}
-static int omap_mcbsp_clk_enable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_enable(mclk->childs[i]);
-        return 0;
-}
-static void omap_mcbsp_clk_disable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_disable(mclk->childs[i]);
-}
-static struct mcbsp_internal_clk omap_mcbsp_clks[] = {
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 1,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 3,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-};
-#define omap_mcbsp_clks_size    ARRAY_SIZE(omap_mcbsp_clks)
-#else
-#define omap_mcbsp_clks_size    0
-static struct mcbsp_internal_clk __initdata *omap_mcbsp_clks;
-static inline void omap_mcbsp_clk_init(struct mcbsp_internal_clk *mclk)
-{ }
 #endif
 static void omap1_mcbsp_request(unsigned int id)
@@ -167,8 +94,9 @@ static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
                .rx_irq         = INT_McBSP1RX,
                .tx_irq         = INT_McBSP1TX,
                .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
-                },
+                .num_clks       = 3,
+        },
        {
                .phys_base      = OMAP1510_MCBSP2_BASE,
                .dma_rx_sync    = OMAP_DMA_MCBSP2_RX,
@@ -184,7 +112,8 @@ static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
                .rx_irq         = INT_McBSP3RX,
                .tx_irq         = INT_McBSP3TX,
                .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 3,
        },
 };
 #define OMAP15XX_MCBSP_PDATA_SZ         ARRAY_SIZE(omap15xx_mcbsp_pdata)
@@ -202,7 +131,8 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
                .rx_irq         = INT_McBSP1RX,
                .tx_irq         = INT_McBSP1TX,
                .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 3,
        },
        {
                .phys_base      = OMAP1610_MCBSP2_BASE,
@@ -219,7 +149,8 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
                .rx_irq         = INT_McBSP3RX,
                .tx_irq         = INT_McBSP3TX,
                .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 3,
        },
 };
 #define OMAP16XX_MCBSP_PDATA_SZ         ARRAY_SIZE(omap16xx_mcbsp_pdata)
@@ -230,15 +161,6 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
 int __init omap1_mcbsp_init(void)
 {
-        int i;
-        for (i = 0; i < omap_mcbsp_clks_size; i++) {
-                if (cpu_is_omap15xx() || cpu_is_omap16xx()) {
-                        omap_mcbsp_clk_init(&omap_mcbsp_clks[i]);
-                        clk_register(&omap_mcbsp_clks[i].clk);
-                }
-        }
        if (cpu_is_omap730())
                omap_mcbsp_count = OMAP730_MCBSP_PDATA_SZ;
        if (cpu_is_omap15xx())
diff --git a/arch/arm/mach-omap2/devices.c b/arch/arm/mach-omap2/devices.c
index 9d7216ff6c9f..ce03fa750775 100644
--- a/arch/arm/mach-omap2/devices.c
+++ b/arch/arm/mach-omap2/devices.c
@@ -421,6 +421,7 @@ void __init omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                        int nr_controllers)
 {
        int i;
+        char *name;
        for (i = 0; i < nr_controllers; i++) {
                unsigned long base, size;
@@ -450,12 +451,14 @@ void __init omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                        continue;
                }
-                if (cpu_is_omap2420())
+                if (cpu_is_omap2420()) {
                        size = OMAP2420_MMC_SIZE;
-                else
+                        name = "mmci-omap";
+                } else {
                        size = HSMMC_SIZE;
+                        name = "mmci-omap-hs";
-                omap_mmc_add(i, base, size, irq, mmc_data[i]);
+                }
+                omap_mmc_add(name, i, base, size, irq, mmc_data[i]);
        };
 }
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index b0f8e7d62798..b52a02fc7cd6 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -172,9 +172,13 @@ void __init omap34xx_check_revision(void)
                        omap_revision = OMAP3430_REV_ES3_0;
                        rev_name = "ES3.0";
                        break;
+                case 4:
+                        omap_revision = OMAP3430_REV_ES3_1;
+                        rev_name = "ES3.1";
+                        break;
                default:
                        /* Use the latest known revision as default */
-                        omap_revision = OMAP3430_REV_ES3_0;
+                        omap_revision = OMAP3430_REV_ES3_1;
                        rev_name = "Unknown revision\n";
                }
        }
diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c
index 636e2821af7d..9ba20d985dda 100644
--- a/arch/arm/mach-omap2/irq.c
+++ b/arch/arm/mach-omap2/irq.c
@@ -134,6 +134,7 @@ static struct irq_chip omap_irq_chip = {
        .ack    = omap_mask_ack_irq,
        .mask   = omap_mask_irq,
        .unmask = omap_unmask_irq,
+        .disable = omap_mask_irq,
 };
 static void __init omap_irq_bank_init_one(struct omap_irq_bank *bank)
diff --git a/arch/arm/mach-omap2/mcbsp.c b/arch/arm/mach-omap2/mcbsp.c
index e20023c9d15d..a9e631fc1134 100644
--- a/arch/arm/mach-omap2/mcbsp.c
+++ b/arch/arm/mach-omap2/mcbsp.c
@@ -24,106 +24,7 @@
 #include <mach/cpu.h>
 #include <mach/mcbsp.h>
-struct mcbsp_internal_clk {
+const char *clk_names[] = { "mcbsp_ick", "mcbsp_fck" };
-        struct clk clk;
-        struct clk **childs;
-        int n_childs;
-};
-#if defined(CONFIG_ARCH_OMAP24XX) || defined(CONFIG_ARCH_OMAP34XX)
-static void omap_mcbsp_clk_init(struct mcbsp_internal_clk *mclk)
-{
-        const char *clk_names[] = { "mcbsp_ick", "mcbsp_fck" };
-        int i;
-        mclk->n_childs = ARRAY_SIZE(clk_names);
-        mclk->childs = kzalloc(mclk->n_childs * sizeof(struct clk *),
-                                GFP_KERNEL);
-        for (i = 0; i < mclk->n_childs; i++) {
-                /* We fake a platform device to get correct device id */
-                struct platform_device pdev;
-                pdev.dev.bus = &platform_bus_type;
-                pdev.id = mclk->clk.id;
-                mclk->childs[i] = clk_get(&pdev.dev, clk_names[i]);
-                if (IS_ERR(mclk->childs[i]))
-                        printk(KERN_ERR "Could not get clock %s (%d).\n",
-                                clk_names[i], mclk->clk.id);
-        }
-}
-static int omap_mcbsp_clk_enable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_enable(mclk->childs[i]);
-        return 0;
-}
-static void omap_mcbsp_clk_disable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_disable(mclk->childs[i]);
-}
-static struct mcbsp_internal_clk omap_mcbsp_clks[] = {
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 1,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 2,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 3,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 4,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 5,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-};
-#define omap_mcbsp_clks_size    ARRAY_SIZE(omap_mcbsp_clks)
-#else
-#define omap_mcbsp_clks_size    0
-static struct mcbsp_internal_clk __initdata *omap_mcbsp_clks;
-static inline void omap_mcbsp_clk_init(struct clk *clk)
-{ }
-#endif
 static void omap2_mcbsp2_mux_setup(void)
 {
@@ -156,7 +57,8 @@ static struct omap_mcbsp_platform_data omap2420_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP1_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP1_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP24XX_MCBSP2_BASE,
@@ -165,7 +67,8 @@ static struct omap_mcbsp_platform_data omap2420_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP2_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP2_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
 };
 #define OMAP2420_MCBSP_PDATA_SZ         ARRAY_SIZE(omap2420_mcbsp_pdata)
@@ -183,7 +86,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP1_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP1_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP24XX_MCBSP2_BASE,
@@ -192,7 +96,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP2_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP2_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP2430_MCBSP3_BASE,
@@ -201,7 +106,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP3_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP3_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP2430_MCBSP4_BASE,
@@ -210,7 +116,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP4_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP4_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP2430_MCBSP5_BASE,
@@ -219,7 +126,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP5_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP5_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
 };
 #define OMAP2430_MCBSP_PDATA_SZ         ARRAY_SIZE(omap2430_mcbsp_pdata)
@@ -237,7 +145,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP1_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP1_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP34XX_MCBSP2_BASE,
@@ -246,7 +155,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP2_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP2_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP34XX_MCBSP3_BASE,
@@ -255,7 +165,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP3_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP3_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP34XX_MCBSP4_BASE,
@@ -264,7 +175,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP4_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP4_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
        {
                .phys_base      = OMAP34XX_MCBSP5_BASE,
@@ -273,7 +185,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                .rx_irq         = INT_24XX_MCBSP5_IRQ_RX,
                .tx_irq         = INT_24XX_MCBSP5_IRQ_TX,
                .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
        },
 };
 #define OMAP34XX_MCBSP_PDATA_SZ         ARRAY_SIZE(omap34xx_mcbsp_pdata)
@@ -284,14 +197,6 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
 static int __init omap2_mcbsp_init(void)
 {
-        int i;
-        for (i = 0; i < omap_mcbsp_clks_size; i++) {
-                /* Once we call clk_get inside init, we do not register it */
-                omap_mcbsp_clk_init(&omap_mcbsp_clks[i]);
-                clk_register(&omap_mcbsp_clks[i].clk);
-        }
        if (cpu_is_omap2420())
                omap_mcbsp_count = OMAP2420_MCBSP_PDATA_SZ;
        if (cpu_is_omap2430())
diff --git a/arch/arm/mach-omap2/sleep24xx.S b/arch/arm/mach-omap2/sleep24xx.S
index 43336b93b21c..bf9e96105e11 100644
--- a/arch/arm/mach-omap2/sleep24xx.S
+++ b/arch/arm/mach-omap2/sleep24xx.S
@@ -93,9 +93,8 @@ ENTRY(omap24xx_cpu_suspend)
        orr     r4, r4, #0x40           @ enable self refresh on idle req
        mov     r5, #0x2000             @ set delay (DPLL relock + DLL relock)
        str     r4, [r2]                @ make it so
-        mov     r2, #0
        nop
-        mcr     p15, 0, r2, c7, c0, 4   @ wait for interrupt
+        mcr     p15, 0, r3, c7, c0, 4   @ wait for interrupt
        nop
 loop:
        subs    r5, r5, #0x1            @ awake, wait just a bit
diff --git a/arch/arm/mach-omap2/timer-gp.c b/arch/arm/mach-omap2/timer-gp.c
index ae6036300f60..9fc13a2cc3f4 100644
--- a/arch/arm/mach-omap2/timer-gp.c
+++ b/arch/arm/mach-omap2/timer-gp.c
@@ -118,7 +118,8 @@ static void __init omap2_gp_clockevent_init(void)
        clockevent_gpt.max_delta_ns =
                clockevent_delta2ns(0xffffffff, &clockevent_gpt);
        clockevent_gpt.min_delta_ns =
-                clockevent_delta2ns(1, &clockevent_gpt);
+                clockevent_delta2ns(3, &clockevent_gpt);
+                /* Timer internal resynch latency. */
        clockevent_gpt.cpumask = cpumask_of(0);
        clockevents_register_device(&clockevent_gpt);
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index c1fbd5b5f9c4..23cfdd593954 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -289,7 +289,7 @@ static struct platform_device sa11x0pcmcia_device = {
 };
 static struct platform_device sa11x0mtd_device = {
-        .name           = "flash",
+        .name           = "sa1100-mtd",
        .id             = -1,
 };
diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c
index 81d0b8772de3..bc0099d5ae85 100644
--- a/arch/arm/mm/fault-armv.c
+++ b/arch/arm/mm/fault-armv.c
@@ -66,7 +66,10 @@ static int adjust_pte(struct vm_area_struct *vma, unsigned long address)
         * fault (ie, is old), we can safely ignore any issues.
         */
        if (ret && (pte_val(entry) & L_PTE_MT_MASK) != shared_pte_mask) {
-                flush_cache_page(vma, address, pte_pfn(entry));
+                unsigned long pfn = pte_pfn(entry);
+                flush_cache_page(vma, address, pfn);
+                outer_flush_range((pfn << PAGE_SHIFT),
+                                  (pfn << PAGE_SHIFT) + PAGE_SIZE);
                pte_val(entry) &= ~L_PTE_MT_MASK;
                pte_val(entry) |= shared_pte_mask;
                set_pte_at(vma->vm_mm, address, pte, entry);
diff --git a/arch/arm/plat-omap/devices.c b/arch/arm/plat-omap/devices.c
index ac15c23fd5da..208dbb121f47 100644
--- a/arch/arm/plat-omap/devices.c
+++ b/arch/arm/plat-omap/devices.c
@@ -200,14 +200,15 @@ void omap_mcbsp_register_board_cfg(struct omap_mcbsp_platform_data *config,
 /*
 * Register MMC devices. Called from mach-omap1 and mach-omap2 device init.
 */
-int __init omap_mmc_add(int id, unsigned long base, unsigned long size,
+int __init omap_mmc_add(const char *name, int id, unsigned long base,
-                unsigned int irq, struct omap_mmc_platform_data *data)
+                                unsigned long size, unsigned int irq,
+                                struct omap_mmc_platform_data *data)
 {
        struct platform_device *pdev;
        struct resource res[OMAP_MMC_NR_RES];
        int ret;
-        pdev = platform_device_alloc("mmci-omap", id);
+        pdev = platform_device_alloc(name, id);
        if (!pdev)
                return -ENOMEM;
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index e77373c39f8c..47ec77af4ccb 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -709,6 +709,7 @@ int omap_request_dma(int dev_id, const char *dev_name,
        chan->dev_name = dev_name;
        chan->callback = callback;
        chan->data = data;
+        chan->flags = 0;
 #ifndef CONFIG_ARCH_OMAP1
        if (cpu_class_is_omap2()) {
@@ -1888,11 +1889,11 @@ static int omap2_dma_handle_ch(int ch)
                status = dma_read(CSR(ch));
        }
+        dma_write(status, CSR(ch));
        if (likely(dma_chan[ch].callback != NULL))
                dma_chan[ch].callback(ch, status, dma_chan[ch].data);
-        dma_write(status, CSR(ch));
        return 0;
 }
diff --git a/arch/arm/plat-omap/include/mach/cpu.h b/arch/arm/plat-omap/include/mach/cpu.h
index b2062f1175de..a8e1178a9468 100644
--- a/arch/arm/plat-omap/include/mach/cpu.h
+++ b/arch/arm/plat-omap/include/mach/cpu.h
@@ -339,6 +339,7 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define OMAP3430_REV_ES2_0      0x34301034
 #define OMAP3430_REV_ES2_1      0x34302034
 #define OMAP3430_REV_ES3_0      0x34303034
+#define OMAP3430_REV_ES3_1      0x34304034
 /*
 * omap_chip bits
diff --git a/arch/arm/plat-omap/include/mach/mcbsp.h b/arch/arm/plat-omap/include/mach/mcbsp.h
index eef873db3d48..113c2466c86a 100644
--- a/arch/arm/plat-omap/include/mach/mcbsp.h
+++ b/arch/arm/plat-omap/include/mach/mcbsp.h
@@ -344,7 +344,8 @@ struct omap_mcbsp_platform_data {
        u8 dma_rx_sync, dma_tx_sync;
        u16 rx_irq, tx_irq;
        struct omap_mcbsp_ops *ops;
-        char const *clk_name;
+        char const **clk_names;
+        int num_clks;
 };
 struct omap_mcbsp {
@@ -376,7 +377,8 @@ struct omap_mcbsp {
        /* Protect the field .free, while checking if the mcbsp is in use */
        spinlock_t lock;
        struct omap_mcbsp_platform_data *pdata;
-        struct clk *clk;
+        struct clk **clks;
+        int num_clks;
 };
 extern struct omap_mcbsp **mcbsp_ptr;
 extern int omap_mcbsp_count;
diff --git a/arch/arm/plat-omap/include/mach/mmc.h b/arch/arm/plat-omap/include/mach/mmc.h
index 031250f02805..73a9e15031b1 100644
--- a/arch/arm/plat-omap/include/mach/mmc.h
+++ b/arch/arm/plat-omap/include/mach/mmc.h
@@ -115,8 +115,9 @@ void omap1_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                int nr_controllers);
 void omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                int nr_controllers);
-int omap_mmc_add(int id, unsigned long base, unsigned long size,
+int omap_mmc_add(const char *name, int id, unsigned long base,
-                        unsigned int irq, struct omap_mmc_platform_data *data);
+                                unsigned long size, unsigned int irq,
+                                struct omap_mmc_platform_data *data);
 #else
 static inline void omap1_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                int nr_controllers)
@@ -126,8 +127,9 @@ static inline void omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                int nr_controllers)
 {
 }
-static inline int omap_mmc_add(int id, unsigned long base, unsigned long size,
+static inline int omap_mmc_add(const char *name, int id, unsigned long base,
-                unsigned int irq, struct omap_mmc_platform_data *data)
+                                unsigned long size, unsigned int irq,
+                                struct omap_mmc_platform_data *data)
 {
        return 0;
 }
diff --git a/arch/arm/plat-omap/mcbsp.c b/arch/arm/plat-omap/mcbsp.c
index f2401a831f99..e5842e30e534 100644
--- a/arch/arm/plat-omap/mcbsp.c
+++ b/arch/arm/plat-omap/mcbsp.c
@@ -214,6 +214,7 @@ EXPORT_SYMBOL(omap_mcbsp_set_io_type);
 int omap_mcbsp_request(unsigned int id)
 {
        struct omap_mcbsp *mcbsp;
+        int i;
        int err;
        if (!omap_mcbsp_check_valid_id(id)) {
@@ -225,7 +226,8 @@ int omap_mcbsp_request(unsigned int id)
        if (mcbsp->pdata && mcbsp->pdata->ops && mcbsp->pdata->ops->request)
                mcbsp->pdata->ops->request(id);
-        clk_enable(mcbsp->clk);
+        for (i = 0; i < mcbsp->num_clks; i++)
+                clk_enable(mcbsp->clks[i]);
        spin_lock(&mcbsp->lock);
        if (!mcbsp->free) {
@@ -276,6 +278,7 @@ EXPORT_SYMBOL(omap_mcbsp_request);
 void omap_mcbsp_free(unsigned int id)
 {
        struct omap_mcbsp *mcbsp;
+        int i;
        if (!omap_mcbsp_check_valid_id(id)) {
                printk(KERN_ERR "%s: Invalid id (%d)\n", __func__, id + 1);
@@ -286,7 +289,8 @@ void omap_mcbsp_free(unsigned int id)
        if (mcbsp->pdata && mcbsp->pdata->ops && mcbsp->pdata->ops->free)
                mcbsp->pdata->ops->free(id);
-        clk_disable(mcbsp->clk);
+        for (i = mcbsp->num_clks - 1; i >= 0; i--)
+                clk_disable(mcbsp->clks[i]);
        spin_lock(&mcbsp->lock);
        if (mcbsp->free) {
@@ -872,6 +876,7 @@ static int __devinit omap_mcbsp_probe(struct platform_device *pdev)
        struct omap_mcbsp_platform_data *pdata = pdev->dev.platform_data;
        struct omap_mcbsp *mcbsp;
        int id = pdev->id - 1;
+        int i;
        int ret = 0;
        if (!pdata) {
@@ -916,14 +921,25 @@ static int __devinit omap_mcbsp_probe(struct platform_device *pdev)
        mcbsp->dma_rx_sync = pdata->dma_rx_sync;
        mcbsp->dma_tx_sync = pdata->dma_tx_sync;
-        if (pdata->clk_name)
+        if (pdata->num_clks) {
-                mcbsp->clk = clk_get(&pdev->dev, pdata->clk_name);
+                mcbsp->num_clks = pdata->num_clks;
-        if (IS_ERR(mcbsp->clk)) {
+                mcbsp->clks = kzalloc(mcbsp->num_clks * sizeof(struct clk *),
-                dev_err(&pdev->dev,
+                                        GFP_KERNEL);
-                        "Invalid clock configuration for McBSP%d.\n",
+                if (!mcbsp->clks) {
-                        mcbsp->id);
+                        ret = -ENOMEM;
-                ret = PTR_ERR(mcbsp->clk);
+                        goto exit;
-                goto err_clk;
+                }
+                for (i = 0; i < mcbsp->num_clks; i++) {
+                        mcbsp->clks[i] = clk_get(&pdev->dev, pdata->clk_names[i]);
+                        if (IS_ERR(mcbsp->clks[i])) {
+                                dev_err(&pdev->dev,
+                                        "Invalid %s configuration for McBSP%d.\n",
+                                        pdata->clk_names[i], mcbsp->id);
+                                ret = PTR_ERR(mcbsp->clks[i]);
+                                goto err_clk;
+                        }
+                }
        }
        mcbsp->pdata = pdata;
@@ -932,6 +948,9 @@ static int __devinit omap_mcbsp_probe(struct platform_device *pdev)
        return 0;
 err_clk:
+        while (i--)
+                clk_put(mcbsp->clks[i]);
+        kfree(mcbsp->clks);
        iounmap(mcbsp->io_base);
 err_ioremap:
        mcbsp->free = 0;
@@ -942,6 +961,7 @@ exit:
 static int __devexit omap_mcbsp_remove(struct platform_device *pdev)
 {
        struct omap_mcbsp *mcbsp = platform_get_drvdata(pdev);
+        int i;
        platform_set_drvdata(pdev, NULL);
        if (mcbsp) {
@@ -950,12 +970,18 @@ static int __devexit omap_mcbsp_remove(struct platform_device *pdev)
                                mcbsp->pdata->ops->free)
                        mcbsp->pdata->ops->free(mcbsp->id);
-                clk_disable(mcbsp->clk);
+                for (i = mcbsp->num_clks - 1; i >= 0; i--) {
-                clk_put(mcbsp->clk);
+                        clk_disable(mcbsp->clks[i]);
+                        clk_put(mcbsp->clks[i]);
+                }
                iounmap(mcbsp->io_base);
-                mcbsp->clk = NULL;
+                if (mcbsp->num_clks) {
+                        kfree(mcbsp->clks);
+                        mcbsp->clks = NULL;
+                        mcbsp->num_clks = 0;
+                }
                mcbsp->free = 0;
                mcbsp->dev = NULL;
        }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 77bba4c083cb..a603bbf9b1b7 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -61,9 +61,14 @@
 #define EM_MSG_LED_VALUE_ON           0x00010000
 static int ahci_skip_host_reset;
+static int ahci_ignore_sss;
 module_param_named(skip_host_reset, ahci_skip_host_reset, int, 0444);
 MODULE_PARM_DESC(skip_host_reset, "skip global host reset (0=don't skip, 1=skip)");
+module_param_named(ignore_sss, ahci_ignore_sss, int, 0444);
+MODULE_PARM_DESC(ignore_sss, "Ignore staggered spinup flag (0=don't ignore, 1=ignore)");
 static int ahci_enable_alpm(struct ata_port *ap,
                enum link_pm policy);
 static void ahci_disable_alpm(struct ata_port *ap);
@@ -2692,8 +2697,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        host->iomap = pcim_iomap_table(pdev);
        host->private_data = hpriv;
-        if (!(hpriv->cap & HOST_CAP_SSS))
+        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
+        else
+                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
        if (pi.flags & ATA_FLAG_EM)
                ahci_reset_em(host);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 88c242856dae..9fbf0595f3d4 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -164,6 +164,11 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
+static bool ata_sstatus_online(u32 sstatus)
+{
+        return (sstatus & 0xf) == 0x3;
+}
 /**
 *      ata_link_next - link iteration helper
 *      @link: the previous link, NULL to start
@@ -1015,18 +1020,6 @@ static const char *sata_spd_string(unsigned int spd)
        return spd_str[spd - 1];
 }
-void ata_dev_disable(struct ata_device *dev)
-{
-        if (ata_dev_enabled(dev)) {
-                if (ata_msg_drv(dev->link->ap))
-                        ata_dev_printk(dev, KERN_WARNING, "disabled\n");
-                ata_acpi_on_disable(dev);
-                ata_down_xfermask_limit(dev, ATA_DNXFER_FORCE_PIO0 |
-                                             ATA_DNXFER_QUIET);
-                dev->class++;
-        }
-}
 static int ata_dev_set_dipm(struct ata_device *dev, enum link_pm policy)
 {
        struct ata_link *link = dev->link;
@@ -2239,6 +2232,40 @@ retry:
        return rc;
 }
+static int ata_do_link_spd_horkage(struct ata_device *dev)
+{
+        struct ata_link *plink = ata_dev_phys_link(dev);
+        u32 target, target_limit;
+        if (!sata_scr_valid(plink))
+                return 0;
+        if (dev->horkage & ATA_HORKAGE_1_5_GBPS)
+                target = 1;
+        else
+                return 0;
+        target_limit = (1 << target) - 1;
+        /* if already on stricter limit, no need to push further */
+        if (plink->sata_spd_limit <= target_limit)
+                return 0;
+        plink->sata_spd_limit = target_limit;
+        /* Request another EH round by returning -EAGAIN if link is
+         * going faster than the target speed.  Forward progress is
+         * guaranteed by setting sata_spd_limit to target_limit above.
+         */
+        if (plink->sata_spd > target) {
+                ata_dev_printk(dev, KERN_INFO,
+                               "applying link speed limit horkage to %s\n",
+                               sata_spd_string(target));
+                return -EAGAIN;
+        }
+        return 0;
+}
 static inline u8 ata_dev_knobble(struct ata_device *dev)
 {
        struct ata_port *ap = dev->link->ap;
@@ -2329,6 +2356,10 @@ int ata_dev_configure(struct ata_device *dev)
                return 0;
        }
+        rc = ata_do_link_spd_horkage(dev);
+        if (rc)
+                return rc;
        /* let ACPI work its magic */
        rc = ata_acpi_on_devcfg(dev);
        if (rc)
@@ -2784,7 +2815,7 @@ int ata_bus_probe(struct ata_port *ap)
                        /* This is the last chance, better to slow
                         * down than lose it.
                         */
-                        sata_down_spd_limit(&ap->link);
+                        sata_down_spd_limit(&ap->link, 0);
                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
                }
        }
@@ -2880,21 +2911,27 @@ void ata_port_disable(struct ata_port *ap)
 /**
 *      sata_down_spd_limit - adjust SATA spd limit downward
 *      @link: Link to adjust SATA spd limit for
+ *      @spd_limit: Additional limit
 *
 *      Adjust SATA spd limit of @link downward.  Note that this
 *      function only adjusts the limit.  The change must be applied
 *      using sata_set_spd().
 *
+ *      If @spd_limit is non-zero, the speed is limited to equal to or
+ *      lower than @spd_limit if such speed is supported.  If
+ *      @spd_limit is slower than any supported speed, only the lowest
+ *      supported speed is allowed.
+ *
 *      LOCKING:
 *      Inherited from caller.
 *
 *      RETURNS:
 *      0 on success, negative errno on failure
 */
-int sata_down_spd_limit(struct ata_link *link)
+int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
 {
        u32 sstatus, spd, mask;
-        int rc, highbit;
+        int rc, bit;
        if (!sata_scr_valid(link))
                return -EOPNOTSUPP;
@@ -2903,7 +2940,7 @@ int sata_down_spd_limit(struct ata_link *link)
         * If not, use cached value in link->sata_spd.
         */
        rc = sata_scr_read(link, SCR_STATUS, &sstatus);
-        if (rc == 0)
+        if (rc == 0 && ata_sstatus_online(sstatus))
                spd = (sstatus >> 4) & 0xf;
        else
                spd = link->sata_spd;
@@ -2913,8 +2950,8 @@ int sata_down_spd_limit(struct ata_link *link)
                return -EINVAL;
        /* unconditionally mask off the highest bit */
-        highbit = fls(mask) - 1;
+        bit = fls(mask) - 1;
-        mask &= ~(1 << highbit);
+        mask &= ~(1 << bit);
        /* Mask off all speeds higher than or equal to the current
         * one.  Force 1.5Gbps if current SPD is not available.
@@ -2928,6 +2965,15 @@ int sata_down_spd_limit(struct ata_link *link)
        if (!mask)
                return -EINVAL;
+        if (spd_limit) {
+                if (mask & ((1 << spd_limit) - 1))
+                        mask &= (1 << spd_limit) - 1;
+                else {
+                        bit = ffs(mask) - 1;
+                        mask = 1 << bit;
+                }
+        }
        link->sata_spd_limit = mask;
        ata_link_printk(link, KERN_WARNING, "limiting SATA link speed to %s\n",
@@ -4215,6 +4261,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        /* Devices that do not need bridging limits applied */
        { "MTRON MSP-SATA*",            NULL,   ATA_HORKAGE_BRIDGE_OK, },
+        /* Devices which aren't very happy with higher link speeds */
+        { "WD My Book",                 NULL,   ATA_HORKAGE_1_5_GBPS, },
        /* End Marker */
        { }
 };
@@ -4709,8 +4758,7 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 /**
 *      ata_qc_new - Request an available ATA command, for queueing
- *      @ap: Port associated with device @dev
+ *      @ap: target port
- *      @dev: Device from whom we request an available command structure
 *
 *      LOCKING:
 *      None.
@@ -5175,7 +5223,7 @@ bool ata_phys_link_online(struct ata_link *link)
        u32 sstatus;
        if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
-            (sstatus & 0xf) == 0x3)
+            ata_sstatus_online(sstatus))
                return true;
        return false;
 }
@@ -5199,7 +5247,7 @@ bool ata_phys_link_offline(struct ata_link *link)
        u32 sstatus;
        if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
-            (sstatus & 0xf) != 0x3)
+            !ata_sstatus_online(sstatus))
                return true;
        return false;
 }
@@ -5412,8 +5460,8 @@ void ata_dev_init(struct ata_device *dev)
        dev->horkage = 0;
        spin_unlock_irqrestore(ap->lock, flags);
-        memset((void *)dev + ATA_DEVICE_CLEAR_OFFSET, 0,
+        memset((void *)dev + ATA_DEVICE_CLEAR_BEGIN, 0,
-               sizeof(*dev) - ATA_DEVICE_CLEAR_OFFSET);
+               ATA_DEVICE_CLEAR_END - ATA_DEVICE_CLEAR_BEGIN);
        dev->pio_mask = UINT_MAX;
        dev->mwdma_mask = UINT_MAX;
        dev->udma_mask = UINT_MAX;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 8147a8386370..ce2ef0475339 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -82,6 +82,10 @@ enum {
        ATA_EH_FASTDRAIN_INTERVAL       =  3000,
        ATA_EH_UA_TRIES                 = 5,
+        /* probe speed down parameters, see ata_eh_schedule_probe() */
+        ATA_EH_PROBE_TRIAL_INTERVAL     = 60000,        /* 1 min */
+        ATA_EH_PROBE_TRIALS             = 2,
 };
 /* The following table determines how we sequence resets.  Each entry
@@ -1176,6 +1180,32 @@ void ata_eh_qc_retry(struct ata_queued_cmd *qc)
 }
 /**
+ *      ata_dev_disable - disable ATA device
+ *      @dev: ATA device to disable
+ *
+ *      Disable @dev.
+ *
+ *      Locking:
+ *      EH context.
+ */
+void ata_dev_disable(struct ata_device *dev)
+{
+        if (!ata_dev_enabled(dev))
+                return;
+        if (ata_msg_drv(dev->link->ap))
+                ata_dev_printk(dev, KERN_WARNING, "disabled\n");
+        ata_acpi_on_disable(dev);
+        ata_down_xfermask_limit(dev, ATA_DNXFER_FORCE_PIO0 | ATA_DNXFER_QUIET);
+        dev->class++;
+        /* From now till the next successful probe, ering is used to
+         * track probe failures.  Clear accumulated device error info.
+         */
+        ata_ering_clear(&dev->ering);
+}
+/**
 *      ata_eh_detach_dev - detach ATA device
 *      @dev: ATA device to detach
 *
@@ -1849,7 +1879,7 @@ static unsigned int ata_eh_speed_down(struct ata_device *dev,
        /* speed down? */
        if (verdict & ATA_EH_SPDN_SPEED_DOWN) {
                /* speed down SATA link speed if possible */
-                if (sata_down_spd_limit(link) == 0) {
+                if (sata_down_spd_limit(link, 0) == 0) {
                        action |= ATA_EH_RESET;
                        goto done;
                }
@@ -2601,11 +2631,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
        }
        if (try == max_tries - 1) {
-                sata_down_spd_limit(link);
+                sata_down_spd_limit(link, 0);
                if (slave)
-                        sata_down_spd_limit(slave);
+                        sata_down_spd_limit(slave, 0);
        } else if (rc == -EPIPE)
-                sata_down_spd_limit(failed_link);
+                sata_down_spd_limit(failed_link, 0);
        if (hardreset)
                reset = hardreset;
@@ -2744,6 +2774,8 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                                                     readid_flags, dev->id);
                        switch (rc) {
                        case 0:
+                                /* clear error info accumulated during probe */
+                                ata_ering_clear(&dev->ering);
                                new_mask |= 1 << dev->devno;
                                break;
                        case -ENOENT:
@@ -2947,9 +2979,24 @@ static int ata_eh_skip_recovery(struct ata_link *link)
        return 1;
 }
+static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg)
+{
+        u64 interval = msecs_to_jiffies(ATA_EH_PROBE_TRIAL_INTERVAL);
+        u64 now = get_jiffies_64();
+        int *trials = void_arg;
+        if (ent->timestamp < now - min(now, interval))
+                return -1;
+        (*trials)++;
+        return 0;
+}
 static int ata_eh_schedule_probe(struct ata_device *dev)
 {
        struct ata_eh_context *ehc = &dev->link->eh_context;
+        struct ata_link *link = ata_dev_phys_link(dev);
+        int trials = 0;
        if (!(ehc->i.probe_mask & (1 << dev->devno)) ||
            (ehc->did_probe_mask & (1 << dev->devno)))
@@ -2962,6 +3009,25 @@ static int ata_eh_schedule_probe(struct ata_device *dev)
        ehc->saved_xfer_mode[dev->devno] = 0;
        ehc->saved_ncq_enabled &= ~(1 << dev->devno);
+        /* Record and count probe trials on the ering.  The specific
+         * error mask used is irrelevant.  Because a successful device
+         * detection clears the ering, this count accumulates only if
+         * there are consecutive failed probes.
+         *
+         * If the count is equal to or higher than ATA_EH_PROBE_TRIALS
+         * in the last ATA_EH_PROBE_TRIAL_INTERVAL, link speed is
+         * forced to 1.5Gbps.
+         *
+         * This is to work around cases where failed link speed
+         * negotiation results in device misdetection leading to
+         * infinite DEVXCHG or PHRDY CHG events.
+         */
+        ata_ering_record(&dev->ering, 0, AC_ERR_OTHER);
+        ata_ering_map(&dev->ering, ata_count_probe_trials_cb, &trials);
+        if (trials > ATA_EH_PROBE_TRIALS)
+                sata_down_spd_limit(link, 1);
        return 1;
 }
@@ -2969,7 +3035,11 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
 {
        struct ata_eh_context *ehc = &dev->link->eh_context;
-        ehc->tries[dev->devno]--;
+        /* -EAGAIN from EH routine indicates retry without prejudice.
+         * The requester is responsible for ensuring forward progress.
+         */
+        if (err != -EAGAIN)
+                ehc->tries[dev->devno]--;
        switch (err) {
        case -ENODEV:
@@ -2979,12 +3049,13 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
                /* give it just one more chance */
                ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
        case -EIO:
-                if (ehc->tries[dev->devno] == 1 && dev->pio_mode > XFER_PIO_0) {
+                if (ehc->tries[dev->devno] == 1) {
                        /* This is the last chance, better to slow
                         * down than lose it.
                         */
-                        sata_down_spd_limit(ata_dev_phys_link(dev));
+                        sata_down_spd_limit(ata_dev_phys_link(dev), 0);
-                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
+                        if (dev->pio_mode > XFER_PIO_0)
+                                ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
                }
        }
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 98ca07a2db87..619f2c33950e 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -729,7 +729,7 @@ static int sata_pmp_eh_recover_pmp(struct ata_port *ap,
                if (tries) {
                        /* consecutive revalidation failures? speed down */
                        if (reval_failed)
-                                sata_down_spd_limit(link);
+                                sata_down_spd_limit(link, 0);
                        else
                                reval_failed = 1;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 3c4c5ae277ba..b9747fa59e54 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -415,6 +415,7 @@ int ata_std_bios_param(struct scsi_device *sdev, struct block_device *bdev,
 /**
 *      ata_get_identity - Handler for HDIO_GET_IDENTITY ioctl
+ *      @ap: target port
 *      @sdev: SCSI device to get identify data for
 *      @arg: User buffer area for identify data
 *
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index fe2839e58774..cea8014cd87e 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -79,7 +79,6 @@ extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev,
                           u64 block, u32 n_block, unsigned int tf_flags,
                           unsigned int tag);
 extern u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev);
-extern void ata_dev_disable(struct ata_device *dev);
 extern void ata_pio_queue_task(struct ata_port *ap, void *data,
                               unsigned long delay);
 extern void ata_port_flush_task(struct ata_port *ap);
@@ -100,7 +99,7 @@ extern int ata_dev_reread_id(struct ata_device *dev, unsigned int readid_flags);
 extern int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
                              unsigned int readid_flags);
 extern int ata_dev_configure(struct ata_device *dev);
-extern int sata_down_spd_limit(struct ata_link *link);
+extern int sata_down_spd_limit(struct ata_link *link, u32 spd_limit);
 extern int ata_down_xfermask_limit(struct ata_device *dev, unsigned int sel);
 extern void ata_sg_clean(struct ata_queued_cmd *qc);
 extern void ata_qc_free(struct ata_queued_cmd *qc);
@@ -160,6 +159,7 @@ extern void ata_scsi_error(struct Scsi_Host *host);
 extern void ata_port_wait_eh(struct ata_port *ap);
 extern void ata_eh_fastdrain_timerfn(unsigned long arg);
 extern void ata_qc_schedule_eh(struct ata_queued_cmd *qc);
+extern void ata_dev_disable(struct ata_device *dev);
 extern void ata_eh_detach_dev(struct ata_device *dev);
 extern void ata_eh_about_to_do(struct ata_link *link, struct ata_device *dev,
                               unsigned int action);
diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
index 3080f371222c..f1b26f7c8e4d 100644
--- a/drivers/ata/pata_qdi.c
+++ b/drivers/ata/pata_qdi.c
@@ -12,7 +12,7 @@
 *
 * Probe code based on drivers/ide/legacy/qd65xx.c
 * Rewritten from the work of Colten Edwards <pje120@cs.usask.ca> by
- * Samuel Thibault <samuel.thibault@fnac.net>
+ * Samuel Thibault <samuel.thibault@ens-lyon.org>
 */
 #include <linux/kernel.h>
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index f2d8a020ea53..4ae1a4138b47 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -663,8 +663,8 @@ static const struct pci_device_id mv_pci_tbl[] = {
        { PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
        /* RocketRAID 1720/174x have different identifiers */
        { PCI_VDEVICE(TTI, 0x1720), chip_6042 },
-        { PCI_VDEVICE(TTI, 0x1740), chip_508x },
+        { PCI_VDEVICE(TTI, 0x1740), chip_6042 },
-        { PCI_VDEVICE(TTI, 0x1742), chip_508x },
+        { PCI_VDEVICE(TTI, 0x1742), chip_6042 },
        { PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
        { PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index c49ad0e61b6f..444af0415ca1 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -436,11 +436,16 @@ static struct ata_port_operations nv_nf2_ops = {
        .hardreset              = nv_noclassify_hardreset,
 };
-/* CK804 finally gets hardreset right */
+/* For initial probing after boot and hot plugging, hardreset mostly
+ * works fine on CK804 but curiously, reprobing on the initial port by
+ * rescanning or rmmod/insmod fails to acquire the initial D2H Reg FIS
+ * in somewhat undeterministic way.  Use noclassify hardreset.
+ */
 static struct ata_port_operations nv_ck804_ops = {
        .inherits               = &nv_common_ops,
        .freeze                 = nv_ck804_freeze,
        .thaw                   = nv_ck804_thaw,
+        .hardreset              = nv_noclassify_hardreset,
        .host_stop              = nv_ck804_host_stop,
 };
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 9f029595f454..d0091609e210 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -324,7 +324,7 @@ static void sil_fill_sg(struct ata_queued_cmd *qc)
                prd->addr = cpu_to_le32(addr);
                prd->flags_len = cpu_to_le32(sg_len);
-                VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", pi, addr, sg_len);
+                VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", si, addr, sg_len);
                last_prd = prd;
                prd++;
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index f5be8081cd81..735bbe2be51a 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -761,7 +761,7 @@ source "drivers/char/hw_random/Kconfig"
 config NVRAM
        tristate "/dev/nvram support"
-        depends on ATARI || X86 || ARM || GENERIC_NVRAM
+        depends on ATARI || X86 || (ARM && RTC_DRV_CMOS) || GENERIC_NVRAM
        ---help---
          If you say Y here and create a character special file /dev/nvram
          with major number 10 and minor number 144 using mknod ("man mknod"),
diff --git a/drivers/ide/qd65xx.c b/drivers/ide/qd65xx.c
index 5b2e3af43c4b..08c4fa35e9b1 100644
--- a/drivers/ide/qd65xx.c
+++ b/drivers/ide/qd65xx.c
@@ -16,7 +16,7 @@
 /*
 * Rewritten from the work of Colten Edwards <pje120@cs.usask.ca> by
- * Samuel Thibault <samuel.thibault@fnac.net>
+ * Samuel Thibault <samuel.thibault@ens-lyon.org>
 */
 #include <linux/module.h>
diff --git a/drivers/ide/qd65xx.h b/drivers/ide/qd65xx.h
index 6636f9665d16..d7e67a1a1dcc 100644
--- a/drivers/ide/qd65xx.h
+++ b/drivers/ide/qd65xx.h
@@ -4,7 +4,7 @@
 /*
 * Authors:     Petr Soucek <petr@ryston.cz>
- *              Samuel Thibault <samuel.thibault@fnac.net>
+ *              Samuel Thibault <samuel.thibault@ens-lyon.org>
 */
 /* truncates a in [b,c] */
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index 24508e28e3fb..ea9488e7ad6d 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -626,7 +626,6 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
        }
        if (client->irq) {
-                set_irq_handler(client->irq, handle_level_irq);
                ret = request_irq(client->irq, pcf50633_irq,
                                IRQF_TRIGGER_LOW, "pcf50633", pcf);
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index 7df6bbf0e4d9..6f6a0f6dafd6 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -453,7 +453,7 @@ static struct platform_driver sa1100_mtd_driver = {
        .resume         = sa1100_mtd_resume,
        .shutdown       = sa1100_mtd_shutdown,
        .driver         = {
-                .name   = "flash",
+                .name   = "sa1100-mtd",
                .owner  = THIS_MODULE,
        },
 };
@@ -474,4 +474,4 @@ module_exit(sa1100_mtd_exit);
 MODULE_AUTHOR("Nicolas Pitre");
 MODULE_DESCRIPTION("SA1100 CFI map driver");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:flash");
+MODULE_ALIAS("platform:sa1100-mtd");
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index d15d8b79d8e5..54b52e5b1821 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -646,7 +646,7 @@ static const struct net_device_ops etherh_netdev_ops = {
        .ndo_get_stats          = ei_get_stats,
        .ndo_set_multicast_list = ei_set_multicast_list,
        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_set_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller    = ei_poll,
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 8e93341f3e82..9c2358391147 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -553,12 +553,24 @@ static void detach_groups(struct config_group *group)
                child = sd->s_dentry;
+                /*
+                 * Note: we hide this from lockdep since we have no way
+                 * to teach lockdep about recursive
+                 * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
+                 * in an inode tree, which are valid as soon as
+                 * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
+                 * parent inode to one of its children.
+                 */
+                lockdep_off();
                mutex_lock(&child->d_inode->i_mutex);
+                lockdep_on();
                configfs_detach_group(sd->s_element);
                child->d_inode->i_flags |= S_DEAD;
+                lockdep_off();
                mutex_unlock(&child->d_inode->i_mutex);
+                lockdep_on();
                d_delete(child);
                dput(child);
@@ -748,11 +760,22 @@ static int configfs_attach_item(struct config_item *parent_item,
                         * We are going to remove an inode and its dentry but
                         * the VFS may already have hit and used them. Thus,
                         * we must lock them as rmdir() would.
+                         *
+                         * Note: we hide this from lockdep since we have no way
+                         * to teach lockdep about recursive
+                         * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
+                         * in an inode tree, which are valid as soon as
+                         * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
+                         * parent inode to one of its children.
                         */
+                        lockdep_off();
                        mutex_lock(&dentry->d_inode->i_mutex);
+                        lockdep_on();
                        configfs_remove_dir(item);
                        dentry->d_inode->i_flags |= S_DEAD;
+                        lockdep_off();
                        mutex_unlock(&dentry->d_inode->i_mutex);
+                        lockdep_on();
                        d_delete(dentry);
                }
        }
@@ -787,14 +810,25 @@ static int configfs_attach_group(struct config_item *parent_item,
                 *
                 * We must also lock the inode to remove it safely in case of
                 * error, as rmdir() would.
+                 *
+                 * Note: we hide this from lockdep since we have no way
+                 * to teach lockdep about recursive
+                 * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
+                 * in an inode tree, which are valid as soon as
+                 * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
+                 * parent inode to one of its children.
                 */
+                lockdep_off();
                mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_CHILD);
+                lockdep_on();
                ret = populate_groups(to_config_group(item));
                if (ret) {
                        configfs_detach_item(item);
                        dentry->d_inode->i_flags |= S_DEAD;
                }
+                lockdep_off();
                mutex_unlock(&dentry->d_inode->i_mutex);
+                lockdep_on();
                if (ret)
                        d_delete(dentry);
        }
@@ -956,7 +990,17 @@ static int configfs_depend_prep(struct dentry *origin,
        BUG_ON(!origin || !sd);
        /* Lock this guy on the way down */
+        /*
+         * Note: we hide this from lockdep since we have no way
+         * to teach lockdep about recursive
+         * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
+         * in an inode tree, which are valid as soon as
+         * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
+         * parent inode to one of its children.
+         */
+        lockdep_off();
        mutex_lock(&sd->s_dentry->d_inode->i_mutex);
+        lockdep_on();
        if (sd->s_element == target)  /* Boo-yah */
                goto out;
@@ -970,7 +1014,9 @@ static int configfs_depend_prep(struct dentry *origin,
        }
        /* We looped all our children and didn't find target */
+        lockdep_off();
        mutex_unlock(&sd->s_dentry->d_inode->i_mutex);
+        lockdep_on();
        ret = -ENOENT;
 out:
@@ -990,11 +1036,16 @@ static void configfs_depend_rollback(struct dentry *origin,
        struct dentry *dentry = item->ci_dentry;
        while (dentry != origin) {
+                /* See comments in configfs_depend_prep() */
+                lockdep_off();
                mutex_unlock(&dentry->d_inode->i_mutex);
+                lockdep_on();
                dentry = dentry->d_parent;
        }
+        lockdep_off();
        mutex_unlock(&origin->d_inode->i_mutex);
+        lockdep_on();
 }
 int configfs_depend_item(struct configfs_subsystem *subsys,
@@ -1329,8 +1380,16 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
                        }
                        /* Wait until the racing operation terminates */
+                        /*
+                         * Note: we hide this from lockdep since we are locked
+                         * with subclass I_MUTEX_NORMAL from vfs_rmdir() (why
+                         * not I_MUTEX_CHILD?), and I_MUTEX_XATTR or
+                         * I_MUTEX_QUOTA are not relevant for the locked inode.
+                         */
+                        lockdep_off();
                        mutex_lock(wait_mutex);
                        mutex_unlock(wait_mutex);
+                        lockdep_on();
                }
        } while (ret == -EAGAIN);
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index d861096c9d81..60fe74035db5 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5390,6 +5390,9 @@ int ocfs2_remove_btree_range(struct inode *inode,
                goto out;
        }
+        vfs_dq_free_space_nodirty(inode,
+                                  ocfs2_clusters_to_bytes(inode->i_sb, len));
        ret = ocfs2_remove_extent(inode, et, cpos, len, handle, meta_ac,
                                  dealloc);
        if (ret) {
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index b1cc7c381e88..e9d7c2038c0f 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -38,6 +38,7 @@
 #include "dlmglue.h"
 #include "file.h"
 #include "inode.h"
+#include "super.h"
 static int ocfs2_dentry_revalidate(struct dentry *dentry,
@@ -294,6 +295,34 @@ out_attach:
        return ret;
 }
+static DEFINE_SPINLOCK(dentry_list_lock);
+/* We limit the number of dentry locks to drop in one go. We have
+ * this limit so that we don't starve other users of ocfs2_wq. */
+#define DL_INODE_DROP_COUNT 64
+/* Drop inode references from dentry locks */
+void ocfs2_drop_dl_inodes(struct work_struct *work)
+{
+        struct ocfs2_super *osb = container_of(work, struct ocfs2_super,
+                                               dentry_lock_work);
+        struct ocfs2_dentry_lock *dl;
+        int drop_count = DL_INODE_DROP_COUNT;
+        spin_lock(&dentry_list_lock);
+        while (osb->dentry_lock_list && drop_count--) {
+                dl = osb->dentry_lock_list;
+                osb->dentry_lock_list = dl->dl_next;
+                spin_unlock(&dentry_list_lock);
+                iput(dl->dl_inode);
+                kfree(dl);
+                spin_lock(&dentry_list_lock);
+        }
+        if (osb->dentry_lock_list)
+                queue_work(ocfs2_wq, &osb->dentry_lock_work);
+        spin_unlock(&dentry_list_lock);
+}
 /*
 * ocfs2_dentry_iput() and friends.
 *
@@ -318,16 +347,23 @@ out_attach:
 static void ocfs2_drop_dentry_lock(struct ocfs2_super *osb,
                                   struct ocfs2_dentry_lock *dl)
 {
-        iput(dl->dl_inode);
        ocfs2_simple_drop_lockres(osb, &dl->dl_lockres);
        ocfs2_lock_res_free(&dl->dl_lockres);
-        kfree(dl);
+        /* We leave dropping of inode reference to ocfs2_wq as that can
+         * possibly lead to inode deletion which gets tricky */
+        spin_lock(&dentry_list_lock);
+        if (!osb->dentry_lock_list)
+                queue_work(ocfs2_wq, &osb->dentry_lock_work);
+        dl->dl_next = osb->dentry_lock_list;
+        osb->dentry_lock_list = dl;
+        spin_unlock(&dentry_list_lock);
 }
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                           struct ocfs2_dentry_lock *dl)
 {
-        int unlock = 0;
+        int unlock;
        BUG_ON(dl->dl_count == 0);
diff --git a/fs/ocfs2/dcache.h b/fs/ocfs2/dcache.h
index c091c34d9883..d06e16c06640 100644
--- a/fs/ocfs2/dcache.h
+++ b/fs/ocfs2/dcache.h
@@ -29,8 +29,13 @@
 extern struct dentry_operations ocfs2_dentry_ops;
 struct ocfs2_dentry_lock {
+        /* Use count of dentry lock */
        unsigned int            dl_count;
-        u64                     dl_parent_blkno;
+        union {
+                /* Linked list of dentry locks to release */
+                struct ocfs2_dentry_lock *dl_next;
+                u64                     dl_parent_blkno;
+        };
        /*
         * The ocfs2_dentry_lock keeps an inode reference until
@@ -47,6 +52,8 @@ int ocfs2_dentry_attach_lock(struct dentry *dentry, struct inode *inode,
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                           struct ocfs2_dentry_lock *dl);
+void ocfs2_drop_dl_inodes(struct work_struct *work);
 struct dentry *ocfs2_find_local_alias(struct inode *inode, u64 parent_blkno,
                                      int skip_unhashed);
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index b0c4cadd4c45..206a2370876a 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2860,6 +2860,10 @@ static void ocfs2_unlock_ast(void *opaque, int error)
        case OCFS2_UNLOCK_CANCEL_CONVERT:
                mlog(0, "Cancel convert success for %s\n", lockres->l_name);
                lockres->l_action = OCFS2_AST_INVALID;
+                /* Downconvert thread may have requeued this lock, we
+                 * need to wake it. */
+                if (lockres->l_flags & OCFS2_LOCK_BLOCKED)
+                        ocfs2_wake_downconvert_thread(ocfs2_get_lockres_osb(lockres));
                break;
        case OCFS2_UNLOCK_DROP_LOCK:
                lockres->l_level = DLM_LOCK_IV;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index ad5c24a29edd..077384135f4e 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -210,6 +210,7 @@ struct ocfs2_journal;
 struct ocfs2_slot_info;
 struct ocfs2_recovery_map;
 struct ocfs2_quota_recovery;
+struct ocfs2_dentry_lock;
 struct ocfs2_super
 {
        struct task_struct *commit_task;
@@ -325,6 +326,11 @@ struct ocfs2_super
        struct list_head blocked_lock_list;
        unsigned long blocked_lock_count;
+        /* List of dentry locks to release. Anyone can add locks to
+         * the list, ocfs2_wq processes the list  */
+        struct ocfs2_dentry_lock *dentry_lock_list;
+        struct work_struct dentry_lock_work;
        wait_queue_head_t               osb_mount_event;
        /* Truncate log info */
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index f4efa89baee5..1ed0f7c86869 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -754,7 +754,9 @@ static int ocfs2_mark_dquot_dirty(struct dquot *dquot)
        if (dquot->dq_flags & mask)
                sync = 1;
        spin_unlock(&dq_data_lock);
-        if (!sync) {
+        /* This is a slight hack but we can't afford getting global quota
+         * lock if we already have a transaction started. */
+        if (!sync || journal_current_handle()) {
                status = ocfs2_write_dquot(dquot);
                goto out;
        }
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 43ed11345b59..b1cb38fbe807 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1887,6 +1887,9 @@ static int ocfs2_initialize_super(struct super_block *sb,
        INIT_WORK(&journal->j_recovery_work, ocfs2_complete_recovery);
        journal->j_state = OCFS2_JOURNAL_FREE;
+        INIT_WORK(&osb->dentry_lock_work, ocfs2_drop_dl_inodes);
+        osb->dentry_lock_list = NULL;
        /* get some pseudo constants for clustersize bits */
        osb->s_clustersize_bits =
                le32_to_cpu(di->id2.i_super.s_clustersize_bits);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index e1d638af6ac3..915039fffe6e 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -4729,13 +4729,6 @@ static int ocfs2_xattr_bucket_value_truncate(struct inode *inode,
        vb.vb_xv = (struct ocfs2_xattr_value_root *)
                (vb.vb_bh->b_data + offset % blocksize);
-        ret = ocfs2_xattr_bucket_journal_access(ctxt->handle, bucket,
-                                                OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
        /*
         * From here on out we have to dirty the bucket.  The generic
         * value calls only modify one of the bucket's bhs, but we need
@@ -4748,12 +4741,18 @@ static int ocfs2_xattr_bucket_value_truncate(struct inode *inode,
        ret = ocfs2_xattr_value_truncate(inode, &vb, len, ctxt);
        if (ret) {
                mlog_errno(ret);
-                goto out_dirty;
+                goto out;
+        }
+        ret = ocfs2_xattr_bucket_journal_access(ctxt->handle, bucket,
+                                                OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
        }
        xe->xe_value_size = cpu_to_le64(len);
-out_dirty:
        ocfs2_xattr_bucket_journal_dirty(ctxt->handle, bucket);
 out:
diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
index 175f9c590b77..f393620890ee 100644
--- a/fs/ubifs/budget.c
+++ b/fs/ubifs/budget.c
@@ -689,7 +689,7 @@ long long ubifs_reported_space(const struct ubifs_info *c, long long free)
 }
 /**
- * ubifs_get_free_space - return amount of free space.
+ * ubifs_get_free_space_nolock - return amount of free space.
 * @c: UBIFS file-system description object
 *
 * This function calculates amount of free space to report to user-space.
@@ -704,16 +704,14 @@ long long ubifs_reported_space(const struct ubifs_info *c, long long free)
 * traditional file-systems, because they have way less overhead than UBIFS.
 * So, to keep users happy, UBIFS tries to take the overhead into account.
 */
-long long ubifs_get_free_space(struct ubifs_info *c)
+long long ubifs_get_free_space_nolock(struct ubifs_info *c)
 {
-        int min_idx_lebs, rsvd_idx_lebs, lebs;
+        int rsvd_idx_lebs, lebs;
        long long available, outstanding, free;
-        spin_lock(&c->space_lock);
+        ubifs_assert(c->min_idx_lebs == ubifs_calc_min_idx_lebs(c));
-        min_idx_lebs = c->min_idx_lebs;
-        ubifs_assert(min_idx_lebs == ubifs_calc_min_idx_lebs(c));
        outstanding = c->budg_data_growth + c->budg_dd_growth;
-        available = ubifs_calc_available(c, min_idx_lebs);
+        available = ubifs_calc_available(c, c->min_idx_lebs);
        /*
         * When reporting free space to user-space, UBIFS guarantees that it is
@@ -726,15 +724,14 @@ long long ubifs_get_free_space(struct ubifs_info *c)
         * Note, the calculations below are similar to what we have in
         * 'do_budget_space()', so refer there for comments.
         */
-        if (min_idx_lebs > c->lst.idx_lebs)
+        if (c->min_idx_lebs > c->lst.idx_lebs)
-                rsvd_idx_lebs = min_idx_lebs - c->lst.idx_lebs;
+                rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
        else
                rsvd_idx_lebs = 0;
        lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
               c->lst.taken_empty_lebs;
        lebs -= rsvd_idx_lebs;
        available += lebs * (c->dark_wm - c->leb_overhead);
-        spin_unlock(&c->space_lock);
        if (available > outstanding)
                free = ubifs_reported_space(c, available - outstanding);
@@ -742,3 +739,21 @@ long long ubifs_get_free_space(struct ubifs_info *c)
                free = 0;
        return free;
 }
+/**
+ * ubifs_get_free_space - return amount of free space.
+ * @c: UBIFS file-system description object
+ *
+ * This function calculates and retuns amount of free space to report to
+ * user-space.
+ */
+long long ubifs_get_free_space(struct ubifs_info *c)
+{
+        long long free;
+        spin_lock(&c->space_lock);
+        free = ubifs_get_free_space_nolock(c);
+        spin_unlock(&c->space_lock);
+        return free;
+}
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 792c5a16c182..e975bd82f38b 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -620,9 +620,11 @@ void dbg_dump_budg(struct ubifs_info *c)
               c->dark_wm, c->dead_wm, c->max_idx_node_sz);
        printk(KERN_DEBUG "\tgc_lnum %d, ihead_lnum %d\n",
               c->gc_lnum, c->ihead_lnum);
-        for (i = 0; i < c->jhead_cnt; i++)
+        /* If we are in R/O mode, journal heads do not exist */
-                printk(KERN_DEBUG "\tjhead %d\t LEB %d\n",
+        if (c->jheads)
-                       c->jheads[i].wbuf.jhead, c->jheads[i].wbuf.lnum);
+                for (i = 0; i < c->jhead_cnt; i++)
+                        printk(KERN_DEBUG "\tjhead %d\t LEB %d\n",
+                               c->jheads[i].wbuf.jhead, c->jheads[i].wbuf.lnum);
        for (rb = rb_first(&c->buds); rb; rb = rb_next(rb)) {
                bud = rb_entry(rb, struct ubifs_bud, rb);
                printk(KERN_DEBUG "\tbud LEB %d\n", bud->lnum);
@@ -637,10 +639,7 @@ void dbg_dump_budg(struct ubifs_info *c)
        /* Print budgeting predictions */
        available = ubifs_calc_available(c, c->min_idx_lebs);
        outstanding = c->budg_data_growth + c->budg_dd_growth;
-        if (available > outstanding)
+        free = ubifs_get_free_space_nolock(c);
-                free = ubifs_reported_space(c, available - outstanding);
-        else
-                free = 0;
        printk(KERN_DEBUG "Budgeting predictions:\n");
        printk(KERN_DEBUG "\tavailable: %lld, outstanding %lld, free %lld\n",
               available, outstanding, free);
@@ -861,6 +860,65 @@ void dbg_dump_index(struct ubifs_info *c)
 }
 /**
+ * dbg_save_space_info - save information about flash space.
+ * @c: UBIFS file-system description object
+ *
+ * This function saves information about UBIFS free space, dirty space, etc, in
+ * order to check it later.
+ */
+void dbg_save_space_info(struct ubifs_info *c)
+{
+        struct ubifs_debug_info *d = c->dbg;
+        ubifs_get_lp_stats(c, &d->saved_lst);
+        spin_lock(&c->space_lock);
+        d->saved_free = ubifs_get_free_space_nolock(c);
+        spin_unlock(&c->space_lock);
+}
+/**
+ * dbg_check_space_info - check flash space information.
+ * @c: UBIFS file-system description object
+ *
+ * This function compares current flash space information with the information
+ * which was saved when the 'dbg_save_space_info()' function was called.
+ * Returns zero if the information has not changed, and %-EINVAL it it has
+ * changed.
+ */
+int dbg_check_space_info(struct ubifs_info *c)
+{
+        struct ubifs_debug_info *d = c->dbg;
+        struct ubifs_lp_stats lst;
+        long long avail, free;
+        spin_lock(&c->space_lock);
+        avail = ubifs_calc_available(c, c->min_idx_lebs);
+        spin_unlock(&c->space_lock);
+        free = ubifs_get_free_space(c);
+        if (free != d->saved_free) {
+                ubifs_err("free space changed from %lld to %lld",
+                          d->saved_free, free);
+                goto out;
+        }
+        return 0;
+out:
+        ubifs_msg("saved lprops statistics dump");
+        dbg_dump_lstats(&d->saved_lst);
+        ubifs_get_lp_stats(c, &lst);
+        ubifs_msg("current lprops statistics dump");
+        dbg_dump_lstats(&d->saved_lst);
+        spin_lock(&c->space_lock);
+        dbg_dump_budg(c);
+        spin_unlock(&c->space_lock);
+        dump_stack();
+        return -EINVAL;
+}
+/**
 * dbg_check_synced_i_size - check synchronized inode size.
 * @inode: inode to check
 *
@@ -1349,7 +1407,7 @@ int dbg_check_tnc(struct ubifs_info *c, int extra)
 * @c: UBIFS file-system description object
 * @leaf_cb: called for each leaf node
 * @znode_cb: called for each indexing node
- * @priv: private date which is passed to callbacks
+ * @priv: private data which is passed to callbacks
 *
 * This function walks the UBIFS index and calls the @leaf_cb for each leaf
 * node and @znode_cb for each indexing node. Returns zero in case of success
@@ -2409,7 +2467,7 @@ void ubifs_debugging_exit(struct ubifs_info *c)
 * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
 * contain the stuff specific to particular file-system mounts.
 */
-static struct dentry *debugfs_rootdir;
+static struct dentry *dfs_rootdir;
 /**
 * dbg_debugfs_init - initialize debugfs file-system.
@@ -2421,9 +2479,9 @@ static struct dentry *debugfs_rootdir;
 */
 int dbg_debugfs_init(void)
 {
-        debugfs_rootdir = debugfs_create_dir("ubifs", NULL);
+        dfs_rootdir = debugfs_create_dir("ubifs", NULL);
-        if (IS_ERR(debugfs_rootdir)) {
+        if (IS_ERR(dfs_rootdir)) {
-                int err = PTR_ERR(debugfs_rootdir);
+                int err = PTR_ERR(dfs_rootdir);
                ubifs_err("cannot create \"ubifs\" debugfs directory, "
                          "error %d\n", err);
                return err;
@@ -2437,7 +2495,7 @@ int dbg_debugfs_init(void)
 */
 void dbg_debugfs_exit(void)
 {
-        debugfs_remove(debugfs_rootdir);
+        debugfs_remove(dfs_rootdir);
 }
 static int open_debugfs_file(struct inode *inode, struct file *file)
@@ -2452,13 +2510,13 @@ static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
        struct ubifs_info *c = file->private_data;
        struct ubifs_debug_info *d = c->dbg;
-        if (file->f_path.dentry == d->dump_lprops)
+        if (file->f_path.dentry == d->dfs_dump_lprops)
                dbg_dump_lprops(c);
-        else if (file->f_path.dentry == d->dump_budg) {
+        else if (file->f_path.dentry == d->dfs_dump_budg) {
                spin_lock(&c->space_lock);
                dbg_dump_budg(c);
                spin_unlock(&c->space_lock);
-        } else if (file->f_path.dentry == d->dump_tnc) {
+        } else if (file->f_path.dentry == d->dfs_dump_tnc) {
                mutex_lock(&c->tnc_mutex);
                dbg_dump_tnc(c);
                mutex_unlock(&c->tnc_mutex);
@@ -2469,7 +2527,7 @@ static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
        return count;
 }
-static const struct file_operations debugfs_fops = {
+static const struct file_operations dfs_fops = {
        .open = open_debugfs_file,
        .write = write_debugfs_file,
        .owner = THIS_MODULE,
@@ -2494,36 +2552,32 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
        struct dentry *dent;
        struct ubifs_debug_info *d = c->dbg;
-        sprintf(d->debugfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
+        sprintf(d->dfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
-        d->debugfs_dir = debugfs_create_dir(d->debugfs_dir_name,
+        d->dfs_dir = debugfs_create_dir(d->dfs_dir_name, dfs_rootdir);
-                                              debugfs_rootdir);
+        if (IS_ERR(d->dfs_dir)) {
-        if (IS_ERR(d->debugfs_dir)) {
+                err = PTR_ERR(d->dfs_dir);
-                err = PTR_ERR(d->debugfs_dir);
                ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
-                          d->debugfs_dir_name, err);
+                          d->dfs_dir_name, err);
                goto out;
        }
        fname = "dump_lprops";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-                                   &debugfs_fops);
        if (IS_ERR(dent))
                goto out_remove;
-        d->dump_lprops = dent;
+        d->dfs_dump_lprops = dent;
        fname = "dump_budg";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-                                   &debugfs_fops);
        if (IS_ERR(dent))
                goto out_remove;
-        d->dump_budg = dent;
+        d->dfs_dump_budg = dent;
        fname = "dump_tnc";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-                                   &debugfs_fops);
        if (IS_ERR(dent))
                goto out_remove;
-        d->dump_tnc = dent;
+        d->dfs_dump_tnc = dent;
        return 0;
@@ -2531,7 +2585,7 @@ out_remove:
        err = PTR_ERR(dent);
        ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
                  fname, err);
-        debugfs_remove_recursive(d->debugfs_dir);
+        debugfs_remove_recursive(d->dfs_dir);
 out:
        return err;
 }
@@ -2542,7 +2596,7 @@ out:
 */
 void dbg_debugfs_exit_fs(struct ubifs_info *c)
 {
-        debugfs_remove_recursive(c->dbg->debugfs_dir);
+        debugfs_remove_recursive(c->dbg->dfs_dir);
 }
 #endif /* CONFIG_UBIFS_FS_DEBUG */
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 9820d6999f7e..c1cd73b2e06e 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -41,15 +41,17 @@
 * @chk_lpt_wastage: used by LPT tree size checker
 * @chk_lpt_lebs: used by LPT tree size checker
 * @new_nhead_offs: used by LPT tree size checker
- * @new_ihead_lnum: used by debugging to check ihead_lnum
+ * @new_ihead_lnum: used by debugging to check @c->ihead_lnum
- * @new_ihead_offs: used by debugging to check ihead_offs
+ * @new_ihead_offs: used by debugging to check @c->ihead_offs
 *
- * debugfs_dir_name: name of debugfs directory containing this file-system's
+ * @saved_lst: saved lprops statistics (used by 'dbg_save_space_info()')
- *                   files
+ * @saved_free: saved free space (used by 'dbg_save_space_info()')
- * debugfs_dir: direntry object of the file-system debugfs directory
+ *
- * dump_lprops: "dump lprops" debugfs knob
+ * dfs_dir_name: name of debugfs directory containing this file-system's files
- * dump_budg: "dump budgeting information" debugfs knob
+ * dfs_dir: direntry object of the file-system debugfs directory
- * dump_tnc: "dump TNC" debugfs knob
+ * dfs_dump_lprops: "dump lprops" debugfs knob
+ * dfs_dump_budg: "dump budgeting information" debugfs knob
+ * dfs_dump_tnc: "dump TNC" debugfs knob
 */
 struct ubifs_debug_info {
        void *buf;
@@ -69,11 +71,14 @@ struct ubifs_debug_info {
        int new_ihead_lnum;
        int new_ihead_offs;
-        char debugfs_dir_name[100];
+        struct ubifs_lp_stats saved_lst;
-        struct dentry *debugfs_dir;
+        long long saved_free;
-        struct dentry *dump_lprops;
-        struct dentry *dump_budg;
+        char dfs_dir_name[100];
-        struct dentry *dump_tnc;
+        struct dentry *dfs_dir;
+        struct dentry *dfs_dump_lprops;
+        struct dentry *dfs_dump_budg;
+        struct dentry *dfs_dump_tnc;
 };
 #define ubifs_assert(expr) do {                                                \
@@ -297,7 +302,8 @@ int dbg_walk_index(struct ubifs_info *c, dbg_leaf_callback leaf_cb,
                   dbg_znode_callback znode_cb, void *priv);
 /* Checking functions */
+void dbg_save_space_info(struct ubifs_info *c);
+int dbg_check_space_info(struct ubifs_info *c);
 int dbg_check_lprops(struct ubifs_info *c);
 int dbg_old_index_check_init(struct ubifs_info *c, struct ubifs_zbranch *zroot);
 int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot);
@@ -439,6 +445,8 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
 #define dbg_walk_index(c, leaf_cb, znode_cb, priv) 0
 #define dbg_old_index_check_init(c, zroot)         0
+#define dbg_save_space_info(c)                     ({})
+#define dbg_check_space_info(c)                    0
 #define dbg_check_old_index(c, zroot)              0
 #define dbg_check_cats(c)                          0
 #define dbg_check_ltab(c)                          0
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index f448ab1f9c38..f55d523c52bb 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -482,30 +482,29 @@ static int ubifs_dir_release(struct inode *dir, struct file *file)
 }
 /**
- * lock_2_inodes - lock two UBIFS inodes.
+ * lock_2_inodes - a wrapper for locking two UBIFS inodes.
 * @inode1: first inode
 * @inode2: second inode
+ *
+ * We do not implement any tricks to guarantee strict lock ordering, because
+ * VFS has already done it for us on the @i_mutex. So this is just a simple
+ * wrapper function.
 */
 static void lock_2_inodes(struct inode *inode1, struct inode *inode2)
 {
-        if (inode1->i_ino < inode2->i_ino) {
+        mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_2);
+        mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
-                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_3);
-        } else {
-                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_3);
-        }
 }
 /**
- * unlock_2_inodes - unlock two UBIFS inodes inodes.
+ * unlock_2_inodes - a wrapper for unlocking two UBIFS inodes.
 * @inode1: first inode
 * @inode2: second inode
 */
 static void unlock_2_inodes(struct inode *inode1, struct inode *inode2)
 {
-        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
        mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
+        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
 }
 static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
@@ -527,6 +526,8 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
        dbg_gen("dent '%.*s' to ino %lu (nlink %d) in dir ino %lu",
                dentry->d_name.len, dentry->d_name.name, inode->i_ino,
                inode->i_nlink, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
        err = dbg_check_synced_i_size(inode);
        if (err)
                return err;
@@ -580,6 +581,8 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
        dbg_gen("dent '%.*s' from ino %lu (nlink %d) in dir ino %lu",
                dentry->d_name.len, dentry->d_name.name, inode->i_ino,
                inode->i_nlink, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
        err = dbg_check_synced_i_size(inode);
        if (err)
                return err;
@@ -667,7 +670,8 @@ static int ubifs_rmdir(struct inode *dir, struct dentry *dentry)
        dbg_gen("directory '%.*s', ino %lu in dir ino %lu", dentry->d_name.len,
                dentry->d_name.name, inode->i_ino, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
        err = check_dir_empty(c, dentry->d_inode);
        if (err)
                return err;
@@ -922,59 +926,30 @@ out_budg:
 }
 /**
- * lock_3_inodes - lock three UBIFS inodes for rename.
+ * lock_3_inodes - a wrapper for locking three UBIFS inodes.
 * @inode1: first inode
 * @inode2: second inode
 * @inode3: third inode
 *
- * For 'ubifs_rename()', @inode1 may be the same as @inode2 whereas @inode3 may
+ * This function is used for 'ubifs_rename()' and @inode1 may be the same as
- * be null.
+ * @inode2 whereas @inode3 may be %NULL.
+ *
+ * We do not implement any tricks to guarantee strict lock ordering, because
+ * VFS has already done it for us on the @i_mutex. So this is just a simple
+ * wrapper function.
 */
 static void lock_3_inodes(struct inode *inode1, struct inode *inode2,
                          struct inode *inode3)
 {
-        struct inode *i1, *i2, *i3;
+        mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
+        if (inode2 != inode1)
-        if (!inode3) {
+                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
-                if (inode1 != inode2) {
+        if (inode3)
-                        lock_2_inodes(inode1, inode2);
+                mutex_lock_nested(&ubifs_inode(inode3)->ui_mutex, WB_MUTEX_3);
-                        return;
-                }
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
-                return;
-        }
-        if (inode1 == inode2) {
-                lock_2_inodes(inode1, inode3);
-                return;
-        }
-        /* 3 different inodes */
-        if (inode1 < inode2) {
-                i3 = inode2;
-                if (inode1 < inode3) {
-                        i1 = inode1;
-                        i2 = inode3;
-                } else {
-                        i1 = inode3;
-                        i2 = inode1;
-                }
-        } else {
-                i3 = inode1;
-                if (inode2 < inode3) {
-                        i1 = inode2;
-                        i2 = inode3;
-                } else {
-                        i1 = inode3;
-                        i2 = inode2;
-                }
-        }
-        mutex_lock_nested(&ubifs_inode(i1)->ui_mutex, WB_MUTEX_1);
-        lock_2_inodes(i2, i3);
 }
 /**
- * unlock_3_inodes - unlock three UBIFS inodes for rename.
+ * unlock_3_inodes - a wrapper for unlocking three UBIFS inodes for rename.
 * @inode1: first inode
 * @inode2: second inode
 * @inode3: third inode
@@ -982,11 +957,11 @@ static void lock_3_inodes(struct inode *inode1, struct inode *inode2,
 static void unlock_3_inodes(struct inode *inode1, struct inode *inode2,
                            struct inode *inode3)
 {
-        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
-        if (inode1 != inode2)
-                mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
        if (inode3)
                mutex_unlock(&ubifs_inode(inode3)->ui_mutex);
+        if (inode1 != inode2)
+                mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
+        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
 }
 static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
@@ -1020,6 +995,11 @@ static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
                "dir ino %lu", old_dentry->d_name.len, old_dentry->d_name.name,
                old_inode->i_ino, old_dir->i_ino, new_dentry->d_name.len,
                new_dentry->d_name.name, new_dir->i_ino);
+        ubifs_assert(mutex_is_locked(&old_dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&new_dir->i_mutex));
+        if (unlink)
+                ubifs_assert(mutex_is_locked(&new_inode->i_mutex));
        if (unlink && is_dir) {
                err = check_dir_empty(c, new_inode);
@@ -1199,7 +1179,7 @@ int ubifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
        return 0;
 }
-struct inode_operations ubifs_dir_inode_operations = {
+const struct inode_operations ubifs_dir_inode_operations = {
        .lookup      = ubifs_lookup,
        .create      = ubifs_create,
        .link        = ubifs_link,
@@ -1219,7 +1199,7 @@ struct inode_operations ubifs_dir_inode_operations = {
 #endif
 };
-struct file_operations ubifs_dir_operations = {
+const struct file_operations ubifs_dir_operations = {
        .llseek         = ubifs_dir_llseek,
        .release        = ubifs_dir_release,
        .read           = generic_read_dir,
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index bf37374567fa..93b6de51f261 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -432,7 +432,6 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
        int uninitialized_var(err), appending = !!(pos + len > inode->i_size);
        struct page *page;
        ubifs_assert(ubifs_inode(inode)->ui_size == inode->i_size);
        if (unlikely(c->ro_media))
@@ -1541,7 +1540,7 @@ static int ubifs_file_mmap(struct file *file, struct vm_area_struct *vma)
        return 0;
 }
-struct address_space_operations ubifs_file_address_operations = {
+const struct address_space_operations ubifs_file_address_operations = {
        .readpage       = ubifs_readpage,
        .writepage      = ubifs_writepage,
        .write_begin    = ubifs_write_begin,
@@ -1551,7 +1550,7 @@ struct address_space_operations ubifs_file_address_operations = {
        .releasepage    = ubifs_releasepage,
 };
-struct inode_operations ubifs_file_inode_operations = {
+const struct inode_operations ubifs_file_inode_operations = {
        .setattr     = ubifs_setattr,
        .getattr     = ubifs_getattr,
 #ifdef CONFIG_UBIFS_FS_XATTR
@@ -1562,14 +1561,14 @@ struct inode_operations ubifs_file_inode_operations = {
 #endif
 };
-struct inode_operations ubifs_symlink_inode_operations = {
+const struct inode_operations ubifs_symlink_inode_operations = {
        .readlink    = generic_readlink,
        .follow_link = ubifs_follow_link,
        .setattr     = ubifs_setattr,
        .getattr     = ubifs_getattr,
 };
-struct file_operations ubifs_file_operations = {
+const struct file_operations ubifs_file_operations = {
        .llseek         = generic_file_llseek,
        .read           = do_sync_read,
        .write          = do_sync_write,
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 9832f9abe28e..a711d33b3d3e 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -31,6 +31,26 @@
 * to be reused. Garbage collection will cause the number of dirty index nodes
 * to grow, however sufficient space is reserved for the index to ensure the
 * commit will never run out of space.
+ *
+ * Notes about dead watermark. At current UBIFS implementation we assume that
+ * LEBs which have less than @c->dead_wm bytes of free + dirty space are full
+ * and not worth garbage-collecting. The dead watermark is one min. I/O unit
+ * size, or min. UBIFS node size, depending on what is greater. Indeed, UBIFS
+ * Garbage Collector has to synchronize the GC head's write buffer before
+ * returning, so this is about wasting one min. I/O unit. However, UBIFS GC can
+ * actually reclaim even very small pieces of dirty space by garbage collecting
+ * enough dirty LEBs, but we do not bother doing this at this implementation.
+ *
+ * Notes about dark watermark. The results of GC work depends on how big are
+ * the UBIFS nodes GC deals with. Large nodes make GC waste more space. Indeed,
+ * if GC move data from LEB A to LEB B and nodes in LEB A are large, GC would
+ * have to waste large pieces of free space at the end of LEB B, because nodes
+ * from LEB A would not fit. And the worst situation is when all nodes are of
+ * maximum size. So dark watermark is the amount of free + dirty space in LEB
+ * which are guaranteed to be reclaimable. If LEB has less space, the GC migh
+ * be unable to reclaim it. So, LEBs with free + dirty greater than dark
+ * watermark are "good" LEBs from GC's point of few. The other LEBs are not so
+ * good, and GC takes extra care when moving them.
 */
 #include <linux/pagemap.h>
@@ -381,7 +401,7 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
                /*
                 * Don't release the LEB until after the next commit, because
-                 * it may contain date which is needed for recovery. So
+                 * it may contain data which is needed for recovery. So
                 * although we freed this LEB, it will become usable only after
                 * the commit.
                 */
@@ -810,8 +830,9 @@ out:
 * ubifs_destroy_idx_gc - destroy idx_gc list.
 * @c: UBIFS file-system description object
 *
- * This function destroys the idx_gc list. It is called when unmounting or
+ * This function destroys the @c->idx_gc list. It is called when unmounting
- * remounting read-only so locks are not needed.
+ * so locks are not needed. Returns zero in case of success and a negative
+ * error code in case of failure.
 */
 void ubifs_destroy_idx_gc(struct ubifs_info *c)
 {
@@ -824,7 +845,6 @@ void ubifs_destroy_idx_gc(struct ubifs_info *c)
                list_del(&idx_gc->list);
                kfree(idx_gc);
        }
 }
 /**
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 01682713af69..e8e632a1dcdf 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -29,7 +29,7 @@
 * would have been wasted for padding to the nearest minimal I/O unit boundary.
 * Instead, data first goes to the write-buffer and is flushed when the
 * buffer is full or when it is not used for some time (by timer). This is
- * similarto the mechanism is used by JFFS2.
+ * similar to the mechanism is used by JFFS2.
 *
 * Write-buffers are defined by 'struct ubifs_wbuf' objects and protected by
 * mutexes defined inside these objects. Since sometimes upper-level code
@@ -75,7 +75,7 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
 * @lnum: logical eraseblock number
 * @offs: offset within the logical eraseblock
 * @quiet: print no messages
- * @chk_crc: indicates whether to always check the CRC
+ * @must_chk_crc: indicates whether to always check the CRC
 *
 * This function checks node magic number and CRC checksum. This function also
 * validates node length to prevent UBIFS from becoming crazy when an attacker
@@ -83,11 +83,17 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
 * node length in the common header could cause UBIFS to read memory outside of
 * allocated buffer when checking the CRC checksum.
 *
- * This function returns zero in case of success %-EUCLEAN in case of bad CRC
+ * This function may skip data nodes CRC checking if @c->no_chk_data_crc is
- * or magic.
+ * true, which is controlled by corresponding UBIFS mount option. However, if
+ * @must_chk_crc is true, then @c->no_chk_data_crc is ignored and CRC is
+ * checked. Similarly, if @c->always_chk_crc is true, @c->no_chk_data_crc is
+ * ignored and CRC is checked.
+ *
+ * This function returns zero in case of success and %-EUCLEAN in case of bad
+ * CRC or magic.
 */
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet, int chk_crc)
+                     int offs, int quiet, int must_chk_crc)
 {
        int err = -EINVAL, type, node_len;
        uint32_t crc, node_crc, magic;
@@ -123,9 +129,9 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
                   node_len > c->ranges[type].max_len)
                goto out_len;
-        if (!chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc)
+        if (!must_chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc &&
-                if (c->no_chk_data_crc)
+             c->no_chk_data_crc)
-                        return 0;
+                return 0;
        crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
        node_crc = le32_to_cpu(ch->crc);
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 9b7c54e0cd2a..a11ca0958a23 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -208,7 +208,7 @@ again:
        offs = 0;
 out:
-        err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, UBI_SHORTTERM);
+        err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, wbuf->dtype);
        if (err)
                goto out_unlock;
diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
index dfd2bcece27a..4cdd284dea56 100644
--- a/fs/ubifs/lprops.c
+++ b/fs/ubifs/lprops.c
@@ -635,10 +635,10 @@ const struct ubifs_lprops *ubifs_change_lp(struct ubifs_info *c,
 * @c: UBIFS file-system description object
 * @st: return statistics
 */
-void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *st)
+void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *lst)
 {
        spin_lock(&c->space_lock);
-        memcpy(st, &c->lst, sizeof(struct ubifs_lp_stats));
+        memcpy(lst, &c->lst, sizeof(struct ubifs_lp_stats));
        spin_unlock(&c->space_lock);
 }
@@ -678,6 +678,9 @@ int ubifs_change_one_lp(struct ubifs_info *c, int lnum, int free, int dirty,
 out:
        ubifs_release_lprops(c);
+        if (err)
+                ubifs_err("cannot change properties of LEB %d, error %d",
+                          lnum, err);
        return err;
 }
@@ -714,6 +717,9 @@ int ubifs_update_one_lp(struct ubifs_info *c, int lnum, int free, int dirty,
 out:
        ubifs_release_lprops(c);
+        if (err)
+                ubifs_err("cannot update properties of LEB %d, error %d",
+                          lnum, err);
        return err;
 }
@@ -737,6 +743,8 @@ int ubifs_read_one_lp(struct ubifs_info *c, int lnum, struct ubifs_lprops *lp)
        lpp = ubifs_lpt_lookup(c, lnum);
        if (IS_ERR(lpp)) {
                err = PTR_ERR(lpp);
+                ubifs_err("cannot read properties of LEB %d, error %d",
+                          lnum, err);
                goto out;
        }
diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 96ca95707175..3216a1f277f8 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -556,23 +556,23 @@ no_space:
 }
 /**
- * next_pnode - find next pnode.
+ * next_pnode_to_dirty - find next pnode to dirty.
 * @c: UBIFS file-system description object
 * @pnode: pnode
 *
- * This function returns the next pnode or %NULL if there are no more pnodes.
+ * This function returns the next pnode to dirty or %NULL if there are no more
+ * pnodes.  Note that pnodes that have never been written (lnum == 0) are
+ * skipped.
 */
-static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
+static struct ubifs_pnode *next_pnode_to_dirty(struct ubifs_info *c,
-                                      struct ubifs_pnode *pnode)
+                                               struct ubifs_pnode *pnode)
 {
        struct ubifs_nnode *nnode;
        int iip;
        /* Try to go right */
        nnode = pnode->parent;
-        iip = pnode->iip + 1;
+        for (iip = pnode->iip + 1; iip < UBIFS_LPT_FANOUT; iip++) {
-        if (iip < UBIFS_LPT_FANOUT) {
-                /* We assume here that LEB zero is never an LPT LEB */
                if (nnode->nbranch[iip].lnum)
                        return ubifs_get_pnode(c, nnode, iip);
        }
@@ -583,8 +583,11 @@ static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
                nnode = nnode->parent;
                if (!nnode)
                        return NULL;
-                /* We assume here that LEB zero is never an LPT LEB */
+                for (; iip < UBIFS_LPT_FANOUT; iip++) {
-        } while (iip >= UBIFS_LPT_FANOUT || !nnode->nbranch[iip].lnum);
+                        if (nnode->nbranch[iip].lnum)
+                                break;
+                }
+       } while (iip >= UBIFS_LPT_FANOUT);
        /* Go right */
        nnode = ubifs_get_nnode(c, nnode, iip);
@@ -593,12 +596,29 @@ static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
        /* Go down to level 1 */
        while (nnode->level > 1) {
-                nnode = ubifs_get_nnode(c, nnode, 0);
+                for (iip = 0; iip < UBIFS_LPT_FANOUT; iip++) {
+                        if (nnode->nbranch[iip].lnum)
+                                break;
+                }
+                if (iip >= UBIFS_LPT_FANOUT) {
+                        /*
+                         * Should not happen, but we need to keep going
+                         * if it does.
+                         */
+                        iip = 0;
+                }
+                nnode = ubifs_get_nnode(c, nnode, iip);
                if (IS_ERR(nnode))
                        return (void *)nnode;
        }
-        return ubifs_get_pnode(c, nnode, 0);
+        for (iip = 0; iip < UBIFS_LPT_FANOUT; iip++)
+                if (nnode->nbranch[iip].lnum)
+                        break;
+        if (iip >= UBIFS_LPT_FANOUT)
+                /* Should not happen, but we need to keep going if it does */
+                iip = 0;
+        return ubifs_get_pnode(c, nnode, iip);
 }
 /**
@@ -688,7 +708,7 @@ static int make_tree_dirty(struct ubifs_info *c)
        pnode = pnode_lookup(c, 0);
        while (pnode) {
                do_make_pnode_dirty(c, pnode);
-                pnode = next_pnode(c, pnode);
+                pnode = next_pnode_to_dirty(c, pnode);
                if (IS_ERR(pnode))
                        return PTR_ERR(pnode);
        }
diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
index 71d5493bf565..a88f33801b98 100644
--- a/fs/ubifs/master.c
+++ b/fs/ubifs/master.c
@@ -354,7 +354,7 @@ int ubifs_write_master(struct ubifs_info *c)
        int err, lnum, offs, len;
        if (c->ro_media)
-                return -EINVAL;
+                return -EROFS;
        lnum = UBIFS_MST_LNUM;
        offs = c->mst_offs + c->mst_node_alsz;
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index 9e6f403f170e..152a7b34a141 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -46,7 +46,7 @@
 * Orphans are accumulated in a rb-tree. When an inode's link count drops to
 * zero, the inode number is added to the rb-tree. It is removed from the tree
 * when the inode is deleted.  Any new orphans that are in the orphan tree when
- * the commit is run, are written to the orphan area in 1 or more orph nodes.
+ * the commit is run, are written to the orphan area in 1 or more orphan nodes.
 * If the orphan area is full, it is consolidated to make space.  There is
 * always enough space because validation prevents the user from creating more
 * than the maximum number of orphans allowed.
@@ -231,7 +231,7 @@ static int tot_avail_orphs(struct ubifs_info *c)
 }
 /**
- * do_write_orph_node - write a node
+ * do_write_orph_node - write a node to the orphan head.
 * @c: UBIFS file-system description object
 * @len: length of node
 * @atomic: write atomically
@@ -264,11 +264,11 @@ static int do_write_orph_node(struct ubifs_info *c, int len, int atomic)
 }
 /**
- * write_orph_node - write an orph node
+ * write_orph_node - write an orphan node.
 * @c: UBIFS file-system description object
 * @atomic: write atomically
 *
- * This function builds an orph node from the cnext list and writes it to the
+ * This function builds an orphan node from the cnext list and writes it to the
 * orphan head. On success, %0 is returned, otherwise a negative error code
 * is returned.
 */
@@ -326,11 +326,11 @@ static int write_orph_node(struct ubifs_info *c, int atomic)
 }
 /**
- * write_orph_nodes - write orph nodes until there are no more to commit
+ * write_orph_nodes - write orphan nodes until there are no more to commit.
 * @c: UBIFS file-system description object
 * @atomic: write atomically
 *
- * This function writes orph nodes for all the orphans to commit. On success,
+ * This function writes orphan nodes for all the orphans to commit. On success,
 * %0 is returned, otherwise a negative error code is returned.
 */
 static int write_orph_nodes(struct ubifs_info *c, int atomic)
@@ -478,14 +478,14 @@ int ubifs_orphan_end_commit(struct ubifs_info *c)
 }
 /**
- * clear_orphans - erase all LEBs used for orphans.
+ * ubifs_clear_orphans - erase all LEBs used for orphans.
 * @c: UBIFS file-system description object
 *
 * If recovery is not required, then the orphans from the previous session
 * are not needed. This function locates the LEBs used to record
 * orphans, and un-maps them.
 */
-static int clear_orphans(struct ubifs_info *c)
+int ubifs_clear_orphans(struct ubifs_info *c)
 {
        int lnum, err;
@@ -547,9 +547,9 @@ static int insert_dead_orphan(struct ubifs_info *c, ino_t inum)
 * do_kill_orphans - remove orphan inodes from the index.
 * @c: UBIFS file-system description object
 * @sleb: scanned LEB
- * @last_cmt_no: cmt_no of last orph node read is passed and returned here
+ * @last_cmt_no: cmt_no of last orphan node read is passed and returned here
 * @outofdate: whether the LEB is out of date is returned here
- * @last_flagged: whether the end orph node is encountered
+ * @last_flagged: whether the end orphan node is encountered
 *
 * This function is a helper to the 'kill_orphans()' function. It goes through
 * every orphan node in a LEB and for every inode number recorded, removes
@@ -580,8 +580,8 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
                /*
                 * The commit number on the master node may be less, because
                 * of a failed commit. If there are several failed commits in a
-                 * row, the commit number written on orph nodes will continue to
+                 * row, the commit number written on orphan nodes will continue
-                 * increase (because the commit number is adjusted here) even
+                 * to increase (because the commit number is adjusted here) even
                 * though the commit number on the master node stays the same
                 * because the master node has not been re-written.
                 */
@@ -589,9 +589,9 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
                        c->cmt_no = cmt_no;
                if (cmt_no < *last_cmt_no && *last_flagged) {
                        /*
-                         * The last orph node had a higher commit number and was
+                         * The last orphan node had a higher commit number and
-                         * flagged as the last written for that commit number.
+                         * was flagged as the last written for that commit
-                         * That makes this orph node, out of date.
+                         * number. That makes this orphan node, out of date.
                         */
                        if (!first) {
                                ubifs_err("out of order commit number %llu in "
@@ -658,10 +658,10 @@ static int kill_orphans(struct ubifs_info *c)
        /*
         * Orph nodes always start at c->orph_first and are written to each
         * successive LEB in turn. Generally unused LEBs will have been unmapped
-         * but may contain out of date orph nodes if the unmap didn't go
+         * but may contain out of date orphan nodes if the unmap didn't go
-         * through. In addition, the last orph node written for each commit is
+         * through. In addition, the last orphan node written for each commit is
         * marked (top bit of orph->cmt_no is set to 1). It is possible that
-         * there are orph nodes from the next commit (i.e. the commit did not
+         * there are orphan nodes from the next commit (i.e. the commit did not
         * complete successfully). In that case, no orphans will have been lost
         * due to the way that orphans are written, and any orphans added will
         * be valid orphans anyway and so can be deleted.
@@ -718,7 +718,7 @@ int ubifs_mount_orphans(struct ubifs_info *c, int unclean, int read_only)
        if (unclean)
                err = kill_orphans(c);
        else if (!read_only)
-                err = clear_orphans(c);
+                err = ubifs_clear_orphans(c);
        return err;
 }
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 89556ee72518..1182b66a5491 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -397,6 +397,7 @@ static int ubifs_statfs(struct dentry *dentry, struct kstatfs *buf)
        buf->f_namelen = UBIFS_MAX_NLEN;
        buf->f_fsid.val[0] = le32_to_cpu(uuid[0]) ^ le32_to_cpu(uuid[2]);
        buf->f_fsid.val[1] = le32_to_cpu(uuid[1]) ^ le32_to_cpu(uuid[3]);
+        ubifs_assert(buf->f_bfree <= c->block_cnt);
        return 0;
 }
@@ -432,33 +433,24 @@ static int ubifs_sync_fs(struct super_block *sb, int wait)
        int i, err;
        struct ubifs_info *c = sb->s_fs_info;
        struct writeback_control wbc = {
-                .sync_mode   = wait ? WB_SYNC_ALL : WB_SYNC_NONE,
+                .sync_mode   = WB_SYNC_ALL,
                .range_start = 0,
                .range_end   = LLONG_MAX,
                .nr_to_write = LONG_MAX,
        };
        /*
-         * Note by akpm about WB_SYNC_NONE used above: zero @wait is just an
+         * Zero @wait is just an advisory thing to help the file system shove
-         * advisory thing to help the file system shove lots of data into the
+         * lots of data into the queues, and there will be the second
-         * queues. If some gets missed then it'll be picked up on the second
         * '->sync_fs()' call, with non-zero @wait.
         */
+        if (!wait)
+                return 0;
        if (sb->s_flags & MS_RDONLY)
                return 0;
        /*
-         * Synchronize write buffers, because 'ubifs_run_commit()' does not
-         * do this if it waits for an already running commit.
-         */
-        for (i = 0; i < c->jhead_cnt; i++) {
-                err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
-                if (err)
-                        return err;
-        }
-        /*
         * VFS calls '->sync_fs()' before synchronizing all dirty inodes and
         * pages, so synchronize them first, then commit the journal. Strictly
         * speaking, it is not necessary to commit the journal here,
@@ -469,6 +461,16 @@ static int ubifs_sync_fs(struct super_block *sb, int wait)
         */
        generic_sync_sb_inodes(sb, &wbc);
+        /*
+         * Synchronize write buffers, because 'ubifs_run_commit()' does not
+         * do this if it waits for an already running commit.
+         */
+        for (i = 0; i < c->jhead_cnt; i++) {
+                err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
+                if (err)
+                        return err;
+        }
        err = ubifs_run_commit(c);
        if (err)
                return err;
@@ -572,15 +574,8 @@ static int init_constants_early(struct ubifs_info *c)
        c->ranges[UBIFS_IDX_NODE].max_len = INT_MAX;
        /*
-         * Initialize dead and dark LEB space watermarks.
+         * Initialize dead and dark LEB space watermarks. See gc.c for comments
-         *
+         * about these values.
-         * Dead space is the space which cannot be used. Its watermark is
-         * equivalent to min. I/O unit or minimum node size if it is greater
-         * then min. I/O unit.
-         *
-         * Dark space is the space which might be used, or might not, depending
-         * on which node should be written to the LEB. Its watermark is
-         * equivalent to maximum UBIFS node size.
         */
        c->dead_wm = ALIGN(MIN_WRITE_SZ, c->min_io_size);
        c->dark_wm = ALIGN(UBIFS_MAX_NODE_SZ, c->min_io_size);
@@ -741,12 +736,12 @@ static void init_constants_master(struct ubifs_info *c)
 * take_gc_lnum - reserve GC LEB.
 * @c: UBIFS file-system description object
 *
- * This function ensures that the LEB reserved for garbage collection is
+ * This function ensures that the LEB reserved for garbage collection is marked
- * unmapped and is marked as "taken" in lprops. We also have to set free space
+ * as "taken" in lprops. We also have to set free space to LEB size and dirty
- * to LEB size and dirty space to zero, because lprops may contain out-of-date
+ * space to zero, because lprops may contain out-of-date information if the
- * information if the file-system was un-mounted before it has been committed.
+ * file-system was un-mounted before it has been committed. This function
- * This function returns zero in case of success and a negative error code in
+ * returns zero in case of success and a negative error code in case of
- * case of failure.
+ * failure.
 */
 static int take_gc_lnum(struct ubifs_info *c)
 {
@@ -757,10 +752,6 @@ static int take_gc_lnum(struct ubifs_info *c)
                return -EINVAL;
        }
-        err = ubifs_leb_unmap(c, c->gc_lnum);
-        if (err)
-                return err;
        /* And we have to tell lprops that this LEB is taken */
        err = ubifs_change_one_lp(c, c->gc_lnum, c->leb_size, 0,
                                  LPROPS_TAKEN, 0, 0);
@@ -966,13 +957,16 @@ static int ubifs_parse_options(struct ubifs_info *c, char *options,
                token = match_token(p, tokens, args);
                switch (token) {
+                /*
+                 * %Opt_fast_unmount and %Opt_norm_unmount options are ignored.
+                 * We accepte them in order to be backware-compatible. But this
+                 * should be removed at some point.
+                 */
                case Opt_fast_unmount:
                        c->mount_opts.unmount_mode = 2;
-                        c->fast_unmount = 1;
                        break;
                case Opt_norm_unmount:
                        c->mount_opts.unmount_mode = 1;
-                        c->fast_unmount = 0;
                        break;
                case Opt_bulk_read:
                        c->mount_opts.bulk_read = 2;
@@ -1094,12 +1088,7 @@ static int check_free_space(struct ubifs_info *c)
                ubifs_err("insufficient free space to mount in read/write mode");
                dbg_dump_budg(c);
                dbg_dump_lprops(c);
-                /*
+                return -ENOSPC;
-                 * We return %-EINVAL instead of %-ENOSPC because it seems to
-                 * be the closest error code mentioned in the mount function
-                 * documentation.
-                 */
-                return -EINVAL;
        }
        return 0;
 }
@@ -1286,10 +1275,19 @@ static int mount_ubifs(struct ubifs_info *c)
                        if (err)
                                goto out_orphans;
                        err = ubifs_rcvry_gc_commit(c);
-                } else
+                } else {
                        err = take_gc_lnum(c);
-                if (err)
+                        if (err)
-                        goto out_orphans;
+                                goto out_orphans;
+                        /*
+                         * GC LEB may contain garbage if there was an unclean
+                         * reboot, and it should be un-mapped.
+                         */
+                        err = ubifs_leb_unmap(c, c->gc_lnum);
+                        if (err)
+                                return err;
+                }
                err = dbg_check_lprops(c);
                if (err)
@@ -1298,6 +1296,16 @@ static int mount_ubifs(struct ubifs_info *c)
                err = ubifs_recover_size(c);
                if (err)
                        goto out_orphans;
+        } else {
+                /*
+                 * Even if we mount read-only, we have to set space in GC LEB
+                 * to proper value because this affects UBIFS free space
+                 * reporting. We do not want to have a situation when
+                 * re-mounting from R/O to R/W changes amount of free space.
+                 */
+                err = take_gc_lnum(c);
+                if (err)
+                        goto out_orphans;
        }
        spin_lock(&ubifs_infos_lock);
@@ -1310,14 +1318,17 @@ static int mount_ubifs(struct ubifs_info *c)
                else {
                        c->need_recovery = 0;
                        ubifs_msg("recovery completed");
+                        /* GC LEB has to be empty and taken at this point */
+                        ubifs_assert(c->lst.taken_empty_lebs == 1);
                }
-        }
+        } else
+                ubifs_assert(c->lst.taken_empty_lebs == 1);
-        err = dbg_debugfs_init_fs(c);
+        err = dbg_check_filesystem(c);
        if (err)
                goto out_infos;
-        err = dbg_check_filesystem(c);
+        err = dbg_debugfs_init_fs(c);
        if (err)
                goto out_infos;
@@ -1351,7 +1362,6 @@ static int mount_ubifs(struct ubifs_info *c)
               c->uuid[4], c->uuid[5], c->uuid[6], c->uuid[7],
               c->uuid[8], c->uuid[9], c->uuid[10], c->uuid[11],
               c->uuid[12], c->uuid[13], c->uuid[14], c->uuid[15]);
-        dbg_msg("fast unmount:        %d", c->fast_unmount);
        dbg_msg("big_lpt              %d", c->big_lpt);
        dbg_msg("log LEBs:            %d (%d - %d)",
                c->log_lebs, UBIFS_LOG_LNUM, c->log_last);
@@ -1475,10 +1485,8 @@ static int ubifs_remount_rw(struct ubifs_info *c)
 {
        int err, lnum;
-        if (c->ro_media)
-                return -EINVAL;
        mutex_lock(&c->umount_mutex);
+        dbg_save_space_info(c);
        c->remounting_rw = 1;
        c->always_chk_crc = 1;
@@ -1514,6 +1522,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
                err = ubifs_recover_inl_heads(c, c->sbuf);
                if (err)
                        goto out;
+        } else {
+                /* A readonly mount is not allowed to have orphans */
+                ubifs_assert(c->tot_orphans == 0);
+                err = ubifs_clear_orphans(c);
+                if (err)
+                        goto out;
        }
        if (!(c->mst_node->flags & cpu_to_le32(UBIFS_MST_DIRTY))) {
@@ -1569,7 +1583,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
        if (c->need_recovery)
                err = ubifs_rcvry_gc_commit(c);
        else
-                err = take_gc_lnum(c);
+                err = ubifs_leb_unmap(c, c->gc_lnum);
        if (err)
                goto out;
@@ -1582,8 +1596,9 @@ static int ubifs_remount_rw(struct ubifs_info *c)
        c->vfs_sb->s_flags &= ~MS_RDONLY;
        c->remounting_rw = 0;
        c->always_chk_crc = 0;
+        err = dbg_check_space_info(c);
        mutex_unlock(&c->umount_mutex);
-        return 0;
+        return err;
 out:
        vfree(c->orph_buf);
@@ -1603,43 +1618,18 @@ out:
 }
 /**
- * commit_on_unmount - commit the journal when un-mounting.
- * @c: UBIFS file-system description object
- *
- * This function is called during un-mounting and re-mounting, and it commits
- * the journal unless the "fast unmount" mode is enabled.
- */
-static void commit_on_unmount(struct ubifs_info *c)
-{
-        struct super_block *sb = c->vfs_sb;
-        long long bud_bytes;
-        /*
-         * This function is called before the background thread is stopped, so
-         * we may race with ongoing commit, which means we have to take
-         * @c->bud_lock to access @c->bud_bytes.
-         */
-        spin_lock(&c->buds_lock);
-        bud_bytes = c->bud_bytes;
-        spin_unlock(&c->buds_lock);
-        if (!c->fast_unmount && !(sb->s_flags & MS_RDONLY) && bud_bytes)
-                ubifs_run_commit(c);
-}
-/**
 * ubifs_remount_ro - re-mount in read-only mode.
 * @c: UBIFS file-system description object
 *
- * We rely on VFS to have stopped writing. Possibly the background thread could
+ * We assume VFS has stopped writing. Possibly the background thread could be
- * be running a commit, however kthread_stop will wait in that case.
+ * running a commit, however kthread_stop will wait in that case.
 */
 static void ubifs_remount_ro(struct ubifs_info *c)
 {
        int i, err;
        ubifs_assert(!c->need_recovery);
-        commit_on_unmount(c);
+        ubifs_assert(!(c->vfs_sb->s_flags & MS_RDONLY));
        mutex_lock(&c->umount_mutex);
        if (c->bgt) {
@@ -1647,27 +1637,29 @@ static void ubifs_remount_ro(struct ubifs_info *c)
                c->bgt = NULL;
        }
+        dbg_save_space_info(c);
        for (i = 0; i < c->jhead_cnt; i++) {
                ubifs_wbuf_sync(&c->jheads[i].wbuf);
                del_timer_sync(&c->jheads[i].wbuf.timer);
        }
-        if (!c->ro_media) {
+        c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_DIRTY);
-                c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_DIRTY);
+        c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
-                c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
+        c->mst_node->gc_lnum = cpu_to_le32(c->gc_lnum);
-                c->mst_node->gc_lnum = cpu_to_le32(c->gc_lnum);
+        err = ubifs_write_master(c);
-                err = ubifs_write_master(c);
+        if (err)
-                if (err)
+                ubifs_ro_mode(c, err);
-                        ubifs_ro_mode(c, err);
-        }
-        ubifs_destroy_idx_gc(c);
        free_wbufs(c);
        vfree(c->orph_buf);
        c->orph_buf = NULL;
        vfree(c->ileb_buf);
        c->ileb_buf = NULL;
        ubifs_lpt_free(c, 1);
+        err = dbg_check_space_info(c);
+        if (err)
+                ubifs_ro_mode(c, err);
        mutex_unlock(&c->umount_mutex);
 }
@@ -1760,11 +1752,20 @@ static int ubifs_remount_fs(struct super_block *sb, int *flags, char *data)
        }
        if ((sb->s_flags & MS_RDONLY) && !(*flags & MS_RDONLY)) {
+                if (c->ro_media) {
+                        ubifs_msg("cannot re-mount due to prior errors");
+                        return -EROFS;
+                }
                err = ubifs_remount_rw(c);
                if (err)
                        return err;
-        } else if (!(sb->s_flags & MS_RDONLY) && (*flags & MS_RDONLY))
+        } else if (!(sb->s_flags & MS_RDONLY) && (*flags & MS_RDONLY)) {
+                if (c->ro_media) {
+                        ubifs_msg("cannot re-mount due to prior errors");
+                        return -EROFS;
+                }
                ubifs_remount_ro(c);
+        }
        if (c->bulk_read == 1)
                bu_init(c);
@@ -1774,10 +1775,11 @@ static int ubifs_remount_fs(struct super_block *sb, int *flags, char *data)
                c->bu.buf = NULL;
        }
+        ubifs_assert(c->lst.taken_empty_lebs == 1);
        return 0;
 }
-struct super_operations ubifs_super_operations = {
+const struct super_operations ubifs_super_operations = {
        .alloc_inode   = ubifs_alloc_inode,
        .destroy_inode = ubifs_destroy_inode,
        .put_super     = ubifs_put_super,
@@ -2044,15 +2046,6 @@ out_close:
 static void ubifs_kill_sb(struct super_block *sb)
 {
-        struct ubifs_info *c = sb->s_fs_info;
-        /*
-         * We do 'commit_on_unmount()' here instead of 'ubifs_put_super()'
-         * in order to be outside BKL.
-         */
-        if (sb->s_root)
-                commit_on_unmount(c);
-        /* The un-mount routine is actually done in put_super() */
        generic_shutdown_super(sb);
 }
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index f7e36f545527..fa28a84c6a1b 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -443,6 +443,11 @@ static int tnc_read_node_nm(struct ubifs_info *c, struct ubifs_zbranch *zbr,
 * This function performs that same function as ubifs_read_node except that
 * it does not require that there is actually a node present and instead
 * the return code indicates if a node was read.
+ *
+ * Note, this function does not check CRC of data nodes if @c->no_chk_data_crc
+ * is true (it is controlled by corresponding mount option). However, if
+ * @c->always_chk_crc is true, @c->no_chk_data_crc is ignored and CRC is always
+ * checked.
 */
 static int try_read_node(const struct ubifs_info *c, void *buf, int type,
                         int len, int lnum, int offs)
@@ -470,9 +475,8 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
        if (node_len != len)
                return 0;
-        if (type == UBIFS_DATA_NODE && !c->always_chk_crc)
+        if (type == UBIFS_DATA_NODE && !c->always_chk_crc && c->no_chk_data_crc)
-                if (c->no_chk_data_crc)
+                return 1;
-                        return 0;
        crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
        node_crc = le32_to_cpu(ch->crc);
@@ -1506,7 +1510,7 @@ out:
 *
 * Note, if the bulk-read buffer length (@bu->buf_len) is known, this function
 * makes sure bulk-read nodes fit the buffer. Otherwise, this function prepares
- * maxumum possible amount of nodes for bulk-read.
+ * maximum possible amount of nodes for bulk-read.
 */
 int ubifs_tnc_get_bu_keys(struct ubifs_info *c, struct bu_info *bu)
 {
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index fc2a4cc66d03..039a68bee29a 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -426,9 +426,9 @@ struct ubifs_unclean_leb {
 * LEB properties flags.
 *
 * LPROPS_UNCAT: not categorized
- * LPROPS_DIRTY: dirty > 0, not index
+ * LPROPS_DIRTY: dirty > free, dirty >= @c->dead_wm, not index
 * LPROPS_DIRTY_IDX: dirty + free > @c->min_idx_node_sze and index
- * LPROPS_FREE: free > 0, not empty, not index
+ * LPROPS_FREE: free > 0, dirty < @c->dead_wm, not empty, not index
 * LPROPS_HEAP_CNT: number of heaps used for storing categorized LEBs
 * LPROPS_EMPTY: LEB is empty, not taken
 * LPROPS_FREEABLE: free + dirty == leb_size, not index, not taken
@@ -961,7 +961,6 @@ struct ubifs_debug_info;
 * @cs_lock: commit state lock
 * @cmt_wq: wait queue to sleep on if the log is full and a commit is running
 *
- * @fast_unmount: do not run journal commit before un-mounting
 * @big_lpt: flag that LPT is too big to write whole during commit
 * @no_chk_data_crc: do not check CRCs when reading data nodes (except during
 *                   recovery)
@@ -1202,7 +1201,6 @@ struct ubifs_info {
        spinlock_t cs_lock;
        wait_queue_head_t cmt_wq;
-        unsigned int fast_unmount:1;
        unsigned int big_lpt:1;
        unsigned int no_chk_data_crc:1;
        unsigned int bulk_read:1;
@@ -1405,13 +1403,13 @@ extern struct list_head ubifs_infos;
 extern spinlock_t ubifs_infos_lock;
 extern atomic_long_t ubifs_clean_zn_cnt;
 extern struct kmem_cache *ubifs_inode_slab;
-extern struct super_operations ubifs_super_operations;
+extern const struct super_operations ubifs_super_operations;
-extern struct address_space_operations ubifs_file_address_operations;
+extern const struct address_space_operations ubifs_file_address_operations;
-extern struct file_operations ubifs_file_operations;
+extern const struct file_operations ubifs_file_operations;
-extern struct inode_operations ubifs_file_inode_operations;
+extern const struct inode_operations ubifs_file_inode_operations;
-extern struct file_operations ubifs_dir_operations;
+extern const struct file_operations ubifs_dir_operations;
-extern struct inode_operations ubifs_dir_inode_operations;
+extern const struct inode_operations ubifs_dir_inode_operations;
-extern struct inode_operations ubifs_symlink_inode_operations;
+extern const struct inode_operations ubifs_symlink_inode_operations;
 extern struct backing_dev_info ubifs_backing_dev_info;
 extern struct ubifs_compressor *ubifs_compressors[UBIFS_COMPR_TYPES_CNT];
@@ -1428,7 +1426,7 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
 int ubifs_write_node(struct ubifs_info *c, void *node, int len, int lnum,
                     int offs, int dtype);
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet, int chk_crc);
+                     int offs, int quiet, int must_chk_crc);
 void ubifs_prepare_node(struct ubifs_info *c, void *buf, int len, int pad);
 void ubifs_prep_grp_node(struct ubifs_info *c, void *node, int len, int last);
 int ubifs_io_init(struct ubifs_info *c);
@@ -1495,6 +1493,7 @@ void ubifs_release_ino_dirty(struct ubifs_info *c, struct inode *inode,
 void ubifs_cancel_ino_op(struct ubifs_info *c, struct inode *inode,
                         struct ubifs_budget_req *req);
 long long ubifs_get_free_space(struct ubifs_info *c);
+long long ubifs_get_free_space_nolock(struct ubifs_info *c);
 int ubifs_calc_min_idx_lebs(struct ubifs_info *c);
 void ubifs_convert_page_budget(struct ubifs_info *c);
 long long ubifs_reported_space(const struct ubifs_info *c, long long free);
@@ -1603,6 +1602,7 @@ void ubifs_delete_orphan(struct ubifs_info *c, ino_t inum);
 int ubifs_orphan_start_commit(struct ubifs_info *c);
 int ubifs_orphan_end_commit(struct ubifs_info *c);
 int ubifs_mount_orphans(struct ubifs_info *c, int unclean, int read_only);
+int ubifs_clear_orphans(struct ubifs_info *c);
 /* lpt.c */
 int ubifs_calc_lpt_geom(struct ubifs_info *c);
@@ -1646,7 +1646,7 @@ const struct ubifs_lprops *ubifs_change_lp(struct ubifs_info *c,
                                           const struct ubifs_lprops *lp,
                                           int free, int dirty, int flags,
                                           int idx_gc_cnt);
-void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *stats);
+void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *lst);
 void ubifs_add_to_cat(struct ubifs_info *c, struct ubifs_lprops *lprops,
                      int cat);
 void ubifs_replace_cat(struct ubifs_info *c, struct ubifs_lprops *old_lprops,
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 2ed035354c26..a608e72fa405 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -371,7 +371,11 @@ xfs_quiesce_attr(
        /* flush inodes and push all remaining buffers out to disk */
        xfs_quiesce_fs(mp);
-        ASSERT_ALWAYS(atomic_read(&mp->m_active_trans) == 0);
+        /*
+         * Just warn here till VFS can correctly support
+         * read-only remount without racing.
+         */
+        WARN_ON(atomic_read(&mp->m_active_trans) != 0);
        /* Push the superblock and write an unmount record */
        error = xfs_log_sbcount(mp, 1);
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index b4c1ee713492..f8278cfcc1d3 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -55,17 +55,11 @@ xfs_swapext(
        struct file     *file, *target_file;
        int             error = 0;
-        sxp = kmem_alloc(sizeof(xfs_swapext_t), KM_MAYFAIL);
-        if (!sxp) {
-                error = XFS_ERROR(ENOMEM);
-                goto out;
-        }
        /* Pull information for the target fd */
        file = fget((int)sxp->sx_fdtarget);
        if (!file) {
                error = XFS_ERROR(EINVAL);
-                goto out_free_sxp;
+                goto out;
        }
        if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
@@ -109,8 +103,6 @@ xfs_swapext(
        fput(target_file);
 out_put_file:
        fput(file);
- out_free_sxp:
-        kmem_free(sxp);
 out:
        return error;
 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 35cca98bd94c..b1047de2fffd 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -70,16 +70,21 @@ STATIC void	xlog_recover_check_summary(xlog_t *);
 xfs_buf_t *
 xlog_get_bp(
        xlog_t          *log,
-        int             num_bblks)
+        int             nbblks)
 {
-        ASSERT(num_bblks > 0);
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_get_bp(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return NULL;
+        }
        if (log->l_sectbb_log) {
-                if (num_bblks > 1)
+                if (nbblks > 1)
-                        num_bblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);
+                        nbblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);
-                num_bblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, num_bblks);
+                nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
        }
-        return xfs_buf_get_noaddr(BBTOB(num_bblks), log->l_mp->m_logdev_targp);
+        return xfs_buf_get_noaddr(BBTOB(nbblks), log->l_mp->m_logdev_targp);
 }
 void
@@ -102,6 +107,13 @@ xlog_bread(
 {
        int             error;
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_bread(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return EFSCORRUPTED;
+        }
        if (log->l_sectbb_log) {
                blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);
                nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
@@ -139,6 +151,13 @@ xlog_bwrite(
 {
        int             error;
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_bwrite(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return EFSCORRUPTED;
+        }
        if (log->l_sectbb_log) {
                blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);
                nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
diff --git a/include/linux/ata.h b/include/linux/ata.h
index a53318b8cbd0..08a86d5cdf1b 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -731,12 +731,17 @@ static inline int ata_id_current_chs_valid(const u16 *id)
 static inline int ata_id_is_cfa(const u16 *id)
 {
-        if (id[ATA_ID_CONFIG] == 0x848A)        /* Standard CF */
+        if (id[ATA_ID_CONFIG] == 0x848A)        /* Traditional CF */
                return 1;
-        /* Could be CF hiding as standard ATA */
+        /*
-        if (ata_id_major_version(id) >= 3 &&
+         * CF specs don't require specific value in the word 0 anymore and yet
-            id[ATA_ID_COMMAND_SET_1] != 0xFFFF &&
+         * they forbid to report the ATA version in the word 80 and require the
-           (id[ATA_ID_COMMAND_SET_1] & (1 << 2)))
+         * CFA feature set support to be indicated in the word 83 in this case.
+         * Unfortunately, some cards only follow either of this requirements,
+         * and while those that don't indicate CFA feature support need some
+         * sort of quirk list, it seems impractical for the ones that do...
+         */
+        if ((id[ATA_ID_COMMAND_SET_2] & 0xC004) == 0x4004)
                return 1;
        return 0;
 }
diff --git a/include/linux/libata.h b/include/linux/libata.h
index bca3ba25f52a..5d87bc09a1f5 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -380,6 +380,7 @@ enum {
        ATA_HORKAGE_ATAPI_MOD16_DMA = (1 << 11), /* use ATAPI DMA for commands
                                                    not multiple of 16 bytes */
        ATA_HORKAGE_FIRMWARE_WARN = (1 << 12),  /* firwmare update warning */
+        ATA_HORKAGE_1_5_GBPS    = (1 << 13),    /* force 1.5 Gbps */
         /* DMA mask for user DMA control: User visible values; DO NOT
            renumber */
@@ -580,7 +581,7 @@ struct ata_device {
        acpi_handle             acpi_handle;
        union acpi_object       *gtf_cache;
 #endif
-        /* n_sector is used as CLEAR_OFFSET, read comment above CLEAR_OFFSET */
+        /* n_sector is CLEAR_BEGIN, read comment above CLEAR_BEGIN */
        u64                     n_sectors;      /* size of device, if ATA */
        unsigned int            class;          /* ATA_DEV_xxx */
        unsigned long           unpark_deadline;
@@ -605,20 +606,22 @@ struct ata_device {
        u16                     heads;          /* Number of heads */
        u16                     sectors;        /* Number of sectors per track */
-        /* error history */
-        int                     spdn_cnt;
-        struct ata_ering        ering;
        union {
                u16             id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */
                u32             gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */
        };
+        /* error history */
+        int                     spdn_cnt;
+        /* ering is CLEAR_END, read comment above CLEAR_END */
+        struct ata_ering        ering;
 };
-/* Offset into struct ata_device.  Fields above it are maintained
+/* Fields between ATA_DEVICE_CLEAR_BEGIN and ATA_DEVICE_CLEAR_END are
- * acress device init.  Fields below are zeroed.
+ * cleared to zero on ata_dev_init().
 */
-#define ATA_DEVICE_CLEAR_OFFSET         offsetof(struct ata_device, n_sectors)
+#define ATA_DEVICE_CLEAR_BEGIN          offsetof(struct ata_device, n_sectors)
+#define ATA_DEVICE_CLEAR_END            offsetof(struct ata_device, ering)
 struct ata_eh_info {
        struct ata_device       *dev;           /* offending device */
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index b493db7841dc..dc32dae01e5f 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1051,13 +1051,22 @@ continue_unlock:
                                }
                        }
-                        if (wbc->sync_mode == WB_SYNC_NONE) {
+                        if (nr_to_write > 0)
-                                wbc->nr_to_write--;
+                                nr_to_write--;
-                                if (wbc->nr_to_write <= 0) {
+                        else if (wbc->sync_mode == WB_SYNC_NONE) {
-                                        done = 1;
+                                /*
-                                        break;
+                                 * We stop writing back only if we are not
-                                }
+                                 * doing integrity sync. In case of integrity
+                                 * sync we have to keep going because someone
+                                 * may be concurrently dirtying pages, and we
+                                 * might have synced a lot of newly appeared
+                                 * dirty pages, but have not synced all of the
+                                 * old dirty pages.
+                                 */
+                                done = 1;
+                                break;
                        }
                        if (wbc->nonblocking && bdi_write_congested(bdi)) {
                                wbc->encountered_congestion = 1;
                                done = 1;