82 files changed, 709 insertions, 440 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 6c73b3bc7f34..7642365ed6d2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -896,11 +896,13 @@ S:	Maintained
 ARM/SAMSUNG ARM ARCHITECTURES
 M:      Ben Dooks <ben-linux@fluff.org>
+M:      Kukjin Kim <kgene.kim@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.fluff.org/ben/linux/
 S:      Maintained
-F:      arch/arm/plat-s3c/
+F:      arch/arm/plat-samsung/
 F:      arch/arm/plat-s3c24xx/
+F:      arch/arm/plat-s5p/
 ARM/S3C2410 ARM ARCHITECTURE
 M:      Ben Dooks <ben-linux@fluff.org>
@@ -1148,7 +1150,7 @@ F:	drivers/mmc/host/atmel-mci.c
 F:      drivers/mmc/host/atmel-mci-regs.h
 ATMEL AT91 / AT32 SERIAL DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/serial/atmel_serial.c
@@ -1160,18 +1162,18 @@ F:	drivers/video/atmel_lcdfb.c
 F:      include/video/atmel_lcdc.h
 ATMEL MACB ETHERNET DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/net/macb.*
 ATMEL SPI DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/spi/atmel_spi.*
 ATMEL USBA UDC DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
-L:      kernel@avr32linux.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://avr32linux.org/twiki/bin/view/Main/AtmelUsbDeviceDriver
 S:      Supported
 F:      drivers/usb/gadget/atmel_usba_udc.*
@@ -3380,7 +3382,7 @@ KPROBES
 M:      Ananth N Mavinakayanahalli <ananth@in.ibm.com>
 M:      Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
 M:      "David S. Miller" <davem@davemloft.net>
-M:      Masami Hiramatsu <mhiramat@redhat.com>
+M:      Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
 S:      Maintained
 F:      Documentation/kprobes.txt
 F:      include/linux/kprobes.h
@@ -4628,6 +4630,12 @@ M:	Robert Jarzmik <robert.jarzmik@free.fr>
 L:      rtc-linux@googlegroups.com
 S:      Maintained
+QLOGIC QLA1280 SCSI DRIVER
+M:      Michael Reed <mdr@sgi.com>
+L:      linux-scsi@vger.kernel.org
+S:      Maintained
+F:      drivers/scsi/qla1280.[ch]
 QLOGIC QLA2XXX FC-SCSI DRIVER
 M:      Andrew Vasquez <andrew.vasquez@qlogic.com>
 M:      linux-driver@qlogic.com
diff --git a/arch/arm/mach-omap2/board-omap3stalker.c b/arch/arm/mach-omap2/board-omap3stalker.c
index f848ba8dbc16..a04cffd691c5 100644
--- a/arch/arm/mach-omap2/board-omap3stalker.c
+++ b/arch/arm/mach-omap2/board-omap3stalker.c
@@ -538,9 +538,7 @@ static void ads7846_dev_init(void)
                printk(KERN_ERR "can't get ads7846 pen down GPIO\n");
        gpio_direction_input(OMAP3_STALKER_TS_GPIO);
+        gpio_set_debounce(OMAP3_STALKER_TS_GPIO, 310);
-        omap_set_gpio_debounce(OMAP3_STALKER_TS_GPIO, 1);
-        omap_set_gpio_debounce_time(OMAP3_STALKER_TS_GPIO, 0xa);
 }
 static int ads7846_get_pendown_state(void)
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index 02804224517b..e10db7a90cb2 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -1369,6 +1369,7 @@ static struct clk emif1_ick = {
        .ops            = &clkops_omap2_dflt,
        .enable_reg     = OMAP4430_CM_MEMIF_EMIF_1_CLKCTRL,
        .enable_bit     = OMAP4430_MODULEMODE_HWCTRL,
+        .flags          = ENABLE_ON_INIT,
        .clkdm_name     = "l3_emif_clkdm",
        .parent         = &ddrphy_ck,
        .recalc         = &followparent_recalc,
@@ -1379,6 +1380,7 @@ static struct clk emif2_ick = {
        .ops            = &clkops_omap2_dflt,
        .enable_reg     = OMAP4430_CM_MEMIF_EMIF_2_CLKCTRL,
        .enable_bit     = OMAP4430_MODULEMODE_HWCTRL,
+        .flags          = ENABLE_ON_INIT,
        .clkdm_name     = "l3_emif_clkdm",
        .parent         = &ddrphy_ck,
        .recalc         = &followparent_recalc,
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 95c9a5f774e1..b7a4133267d8 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -409,10 +409,11 @@ static int _init_main_clk(struct omap_hwmod *oh)
                return 0;
        oh->_clk = omap_clk_get_by_name(oh->main_clk);
-        if (!oh->_clk)
+        if (!oh->_clk) {
                pr_warning("omap_hwmod: %s: cannot clk_get main_clk %s\n",
                           oh->name, oh->main_clk);
                return -EINVAL;
+        }
        if (!oh->_clk->clkdm)
                pr_warning("omap_hwmod: %s: missing clockdomain for %s.\n",
@@ -444,10 +445,11 @@ static int _init_interface_clks(struct omap_hwmod *oh)
                        continue;
                c = omap_clk_get_by_name(os->clk);
-                if (!c)
+                if (!c) {
                        pr_warning("omap_hwmod: %s: cannot clk_get interface_clk %s\n",
                                   oh->name, os->clk);
                        ret = -EINVAL;
+                }
                os->_clk = c;
        }
@@ -470,10 +472,11 @@ static int _init_opt_clks(struct omap_hwmod *oh)
        for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++) {
                c = omap_clk_get_by_name(oc->clk);
-                if (!c)
+                if (!c) {
                        pr_warning("omap_hwmod: %s: cannot clk_get opt_clk %s\n",
                                   oh->name, oc->clk);
                        ret = -EINVAL;
+                }
                oc->_clk = c;
        }
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 2e967716cc3f..b88737fd6cfe 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -99,7 +99,7 @@ static void omap3_enable_io_chain(void)
                /* Do a readback to assure write has been done */
                prm_read_mod_reg(WKUP_MOD, PM_WKEN);
-                while (!(prm_read_mod_reg(WKUP_MOD, PM_WKST) &
+                while (!(prm_read_mod_reg(WKUP_MOD, PM_WKEN) &
                         OMAP3430_ST_IO_CHAIN_MASK)) {
                        timeout++;
                        if (timeout > 1000) {
@@ -108,7 +108,7 @@ static void omap3_enable_io_chain(void)
                                return;
                        }
                        prm_set_mod_reg_bits(OMAP3430_ST_IO_CHAIN_MASK,
-                                             WKUP_MOD, PM_WKST);
+                                             WKUP_MOD, PM_WKEN);
                }
        }
 }
diff --git a/arch/arm/mach-omap2/usb-ehci.c b/arch/arm/mach-omap2/usb-ehci.c
index c68f799e83c5..d72d1ac30333 100644
--- a/arch/arm/mach-omap2/usb-ehci.c
+++ b/arch/arm/mach-omap2/usb-ehci.c
@@ -20,6 +20,8 @@
 #include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
 #include <asm/io.h>
 #include <plat/mux.h>
diff --git a/arch/arm/mach-vexpress/ct-ca9x4.c b/arch/arm/mach-vexpress/ct-ca9x4.c
index e6f73030d5f0..9b11eedba65f 100644
--- a/arch/arm/mach-vexpress/ct-ca9x4.c
+++ b/arch/arm/mach-vexpress/ct-ca9x4.c
@@ -2,6 +2,7 @@
 * Versatile Express Core Tile Cortex A9x4 Support
 */
 #include <linux/init.h>
+#include <linux/gfp.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index c64875f11fac..44bafdab2dce 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -541,11 +541,11 @@ void omap_dm_timer_stop(struct omap_dm_timer *timer)
                  * timer is stopped
                  */
                udelay(3500000 / clk_get_rate(timer->fclk) + 1);
-                /* Ack possibly pending interrupt */
-                omap_dm_timer_write_reg(timer, OMAP_TIMER_STAT_REG,
-                                OMAP_TIMER_INT_OVERFLOW);
 #endif
        }
+        /* Ack possibly pending interrupt */
+        omap_dm_timer_write_reg(timer, OMAP_TIMER_STAT_REG,
+                        OMAP_TIMER_INT_OVERFLOW);
 }
 EXPORT_SYMBOL_GPL(omap_dm_timer_stop);
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index 393e9219a5b6..9b7e3545f325 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -673,6 +673,7 @@ static void _set_gpio_debounce(struct gpio_bank *bank, unsigned gpio,
                if (cpu_is_omap34xx() || cpu_is_omap44xx())
                        clk_disable(bank->dbck);
        }
+        bank->dbck_enable_mask = val;
        __raw_writel(val, reg);
 }
diff --git a/arch/arm/plat-omap/iovmm.c b/arch/arm/plat-omap/iovmm.c
index e43983ba59c5..8ce0de247c71 100644
--- a/arch/arm/plat-omap/iovmm.c
+++ b/arch/arm/plat-omap/iovmm.c
@@ -140,8 +140,10 @@ static struct sg_table *sgtable_alloc(const size_t bytes, u32 flags)
                return ERR_PTR(-ENOMEM);
        err = sg_alloc_table(sgt, nr_entries, GFP_KERNEL);
-        if (err)
+        if (err) {
+                kfree(sgt);
                return ERR_PTR(err);
+        }
        pr_debug("%s: sgt:%p(%d entries)\n", __func__, sgt, nr_entries);
diff --git a/arch/um/include/asm/arch_hweight.h b/arch/um/include/asm/arch_hweight.h
new file mode 100644
index 000000000000..c656cf443f4a
--- /dev/null
+++ b/arch/um/include/asm/arch_hweight.h
@@ -0,0 +1,6 @@
+#ifndef _ASM_UM_HWEIGHT_H
+#define _ASM_UM_HWEIGHT_H
+#include <asm-generic/bitops/arch_hweight.h>
+#endif
diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c
index 93a11d7edfa0..e696144d2be3 100644
--- a/arch/um/os-Linux/mem.c
+++ b/arch/um/os-Linux/mem.c
@@ -10,6 +10,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <sys/mman.h>
 #include <sys/param.h>
 #include "init.h"
diff --git a/arch/x86/boot/video-vga.c b/arch/x86/boot/video-vga.c
index ed7aeff786b2..45bc9402aa49 100644
--- a/arch/x86/boot/video-vga.c
+++ b/arch/x86/boot/video-vga.c
@@ -41,13 +41,12 @@ static __videocard video_vga;
 static u8 vga_set_basic_mode(void)
 {
        struct biosregs ireg, oreg;
-        u16 ax;
        u8 mode;
        initregs(&ireg);
        /* Query current mode */
-        ax = 0x0f00;
+        ireg.ax = 0x0f00;
        intcall(0x10, &ireg, &oreg);
        mode = oreg.al;
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index 63cb4096c3dc..9cb2edb87c2f 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -183,7 +183,7 @@ struct mp_ioapic_gsi{
        u32 gsi_end;
 };
 extern struct mp_ioapic_gsi  mp_gsi_routing[];
-extern u32 gsi_end;
+extern u32 gsi_top;
 int mp_find_ioapic(u32 gsi);
 int mp_find_ioapic_pin(int ioapic, u32 gsi);
 void __init mp_register_ioapic(int id, u32 address, u32 gsi_base);
@@ -197,7 +197,7 @@ static const int timer_through_8259 = 0;
 static inline void ioapic_init_mappings(void)   { }
 static inline void ioapic_insert_resources(void) { }
 static inline void probe_nr_irqs_gsi(void)      { }
-#define gsi_end (NR_IRQS_LEGACY - 1)
+#define gsi_top (NR_IRQS_LEGACY)
 static inline int mp_find_ioapic(u32 gsi) { return 0; }
 struct io_apic_irq_attr;
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 0797e748d280..cd28f9ad910d 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -77,6 +77,7 @@ do {							\
        if (0) {                                        \
                pto_T__ pto_tmp__;                      \
                pto_tmp__ = (val);                      \
+                (void)pto_tmp__;                        \
        }                                               \
        switch (sizeof(var)) {                          \
        case 1:                                         \
@@ -115,6 +116,7 @@ do {									\
        if (0) {                                                        \
                pao_T__ pao_tmp__;                                      \
                pao_tmp__ = (val);                                      \
+                (void)pao_tmp__;                                        \
        }                                                               \
        switch (sizeof(var)) {                                          \
        case 1:                                                         \
diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
index 5e67c1532314..ed5903be26fe 100644
--- a/arch/x86/include/asm/pgtable_32_types.h
+++ b/arch/x86/include/asm/pgtable_32_types.h
@@ -26,7 +26,7 @@
 */
 #define VMALLOC_OFFSET  (8 * 1024 * 1024)
-#ifndef __ASSEMBLER__
+#ifndef __ASSEMBLY__
 extern bool __vmalloc_start_set; /* set once high_memory is set */
 #endif
diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
index b8fe48ee2ed9..e7f4d33c55ed 100644
--- a/arch/x86/include/asm/system.h
+++ b/arch/x86/include/asm/system.h
@@ -451,7 +451,7 @@ void stop_this_cpu(void *dummy);
 *
 * (Could use an alternative three way for this if there was one.)
 */
-static inline void rdtsc_barrier(void)
+static __always_inline void rdtsc_barrier(void)
 {
        alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
        alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 60cc4058ed5f..c05872aa3ce0 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -118,7 +118,7 @@ static unsigned int gsi_to_irq(unsigned int gsi)
        if (gsi >= NR_IRQS_LEGACY)
                irq = gsi;
        else
-                irq = gsi_end + 1 + gsi;
+                irq = gsi_top + gsi;
        return irq;
 }
@@ -129,10 +129,10 @@ static u32 irq_to_gsi(int irq)
        if (irq < NR_IRQS_LEGACY)
                gsi = isa_irq_to_gsi[irq];
-        else if (irq <= gsi_end)
+        else if (irq < gsi_top)
                gsi = irq;
-        else if (irq <= (gsi_end + NR_IRQS_LEGACY))
+        else if (irq < (gsi_top + NR_IRQS_LEGACY))
-                gsi = irq - gsi_end;
+                gsi = irq - gsi_top;
        else
                gsi = 0xffffffff;
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 33f3563a2a52..e41ed24ab26d 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -89,8 +89,8 @@ int nr_ioapics;
 /* IO APIC gsi routing info */
 struct mp_ioapic_gsi  mp_gsi_routing[MAX_IO_APICS];
-/* The last gsi number used */
+/* The one past the highest gsi number used */
-u32 gsi_end;
+u32 gsi_top;
 /* MP IRQ source entries */
 struct mpc_intsrc mp_irqs[MAX_IRQ_SOURCES];
@@ -1035,7 +1035,7 @@ static int pin_2_irq(int idx, int apic, int pin)
                if (gsi >= NR_IRQS_LEGACY)
                        irq = gsi;
                else
-                        irq = gsi_end + 1 + gsi;
+                        irq = gsi_top + gsi;
        }
 #ifdef CONFIG_X86_32
@@ -3853,7 +3853,7 @@ void __init probe_nr_irqs_gsi(void)
 {
        int nr;
-        nr = gsi_end + 1 + NR_IRQS_LEGACY;
+        nr = gsi_top + NR_IRQS_LEGACY;
        if (nr > nr_irqs_gsi)
                nr_irqs_gsi = nr;
@@ -4294,8 +4294,8 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
         */
        nr_ioapic_registers[idx] = entries;
-        if (mp_gsi_routing[idx].gsi_end > gsi_end)
+        if (mp_gsi_routing[idx].gsi_end >= gsi_top)
-                gsi_end = mp_gsi_routing[idx].gsi_end;
+                gsi_top = mp_gsi_routing[idx].gsi_end + 1;
        printk(KERN_INFO "IOAPIC[%d]: apic_id %d, version %d, address 0x%x, "
               "GSI %d-%d\n", idx, mp_ioapics[idx].apicid,
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index fdbc652d3feb..214ac860ebe0 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -72,6 +72,7 @@ static struct event_constraint intel_westmere_event_constraints[] =
        INTEL_EVENT_CONSTRAINT(0x51, 0x3), /* L1D */
        INTEL_EVENT_CONSTRAINT(0x60, 0x1), /* OFFCORE_REQUESTS_OUTSTANDING */
        INTEL_EVENT_CONSTRAINT(0x63, 0x3), /* CACHE_LOCK_CYCLES */
+        INTEL_EVENT_CONSTRAINT(0xb3, 0x1), /* SNOOPQ_REQUEST_OUTSTANDING */
        EVENT_CONSTRAINT_END
 };
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 5ae5d2426edf..d86dbf7e54be 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -123,7 +123,7 @@ static void __init MP_ioapic_info(struct mpc_ioapic *m)
        printk(KERN_INFO "I/O APIC #%d Version %d at 0x%X.\n",
               m->apicid, m->apicver, m->apicaddr);
-        mp_register_ioapic(m->apicid, m->apicaddr, gsi_end + 1);
+        mp_register_ioapic(m->apicid, m->apicaddr, gsi_top);
 }
 static void print_MP_intsrc_info(struct mpc_intsrc *m)
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index fb99f7edb341..0b96b5589f08 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -103,11 +103,16 @@ int use_calgary __read_mostly = 0;
 #define PMR_SOFTSTOPFAULT       0x40000000
 #define PMR_HARDSTOP            0x20000000
-#define MAX_NUM_OF_PHBS         8 /* how many PHBs in total? */
+/*
-#define MAX_NUM_CHASSIS         8 /* max number of chassis */
+ * The maximum PHB bus number.
-/* MAX_PHB_BUS_NUM is the maximal possible dev->bus->number */
+ * x3950M2 (rare): 8 chassis, 48 PHBs per chassis = 384
-#define MAX_PHB_BUS_NUM         (MAX_NUM_OF_PHBS * MAX_NUM_CHASSIS * 2)
+ * x3950M2: 4 chassis, 48 PHBs per chassis        = 192
-#define PHBS_PER_CALGARY        4
+ * x3950 (PCIE): 8 chassis, 32 PHBs per chassis   = 256
+ * x3950 (PCIX): 8 chassis, 16 PHBs per chassis   = 128
+ */
+#define MAX_PHB_BUS_NUM         384
+#define PHBS_PER_CALGARY          4
 /* register offsets in Calgary's internal register space */
 static const unsigned long tar_offsets[] = {
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 8e1aac86b50c..e3af342fe83a 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -228,6 +228,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Precision WorkStation T5400"),
                },
        },
+        {       /* Handle problems with rebooting on Dell T7400's */
+                .callback = set_bios_reboot,
+                .ident = "Dell Precision T7400",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Precision WorkStation T7400"),
+                },
+        },
        {       /* Handle problems with rebooting on HP laptops */
                .callback = set_bios_reboot,
                .ident = "HP Compaq Laptop",
diff --git a/arch/x86/kernel/sfi.c b/arch/x86/kernel/sfi.c
index 7ded57896c0a..cb22acf3ed09 100644
--- a/arch/x86/kernel/sfi.c
+++ b/arch/x86/kernel/sfi.c
@@ -93,7 +93,7 @@ static int __init sfi_parse_ioapic(struct sfi_table_header *table)
        pentry = (struct sfi_apic_table_entry *)sb->pentry;
        for (i = 0; i < num; i++) {
-                mp_register_ioapic(i, pentry->phys_addr, gsi_end + 1);
+                mp_register_ioapic(i, pentry->phys_addr, gsi_top);
                pentry++;
        }
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index acc15b23b743..64121a18b8cb 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -302,7 +302,7 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
                return -EINVAL;
        }
-        new  = kmalloc(sizeof(struct memtype), GFP_KERNEL);
+        new  = kzalloc(sizeof(struct memtype), GFP_KERNEL);
        if (!new)
                return -ENOMEM;
diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
index f537087bb740..f20eeec85a86 100644
--- a/arch/x86/mm/pat_rbtree.c
+++ b/arch/x86/mm/pat_rbtree.c
@@ -226,6 +226,7 @@ int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
                if (ret_type)
                        new->type = *ret_type;
+                new->subtree_max_end = new->end;
                memtype_rb_insert(&memtype_rbroot, new);
        }
        return err;
diff --git a/block/blk-core.c b/block/blk-core.c
index f84cce42fc58..f0640d7f800f 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1149,13 +1149,10 @@ void init_request_from_bio(struct request *req, struct bio *bio)
        else
                req->cmd_flags |= bio->bi_rw & REQ_FAILFAST_MASK;
-        if (unlikely(bio_rw_flagged(bio, BIO_RW_DISCARD))) {
+        if (bio_rw_flagged(bio, BIO_RW_DISCARD))
                req->cmd_flags |= REQ_DISCARD;
-                if (bio_rw_flagged(bio, BIO_RW_BARRIER))
+        if (bio_rw_flagged(bio, BIO_RW_BARRIER))
-                        req->cmd_flags |= REQ_SOFTBARRIER;
-        } else if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER)))
                req->cmd_flags |= REQ_HARDBARRIER;
        if (bio_rw_flagged(bio, BIO_RW_SYNCIO))
                req->cmd_flags |= REQ_RW_SYNC;
        if (bio_rw_flagged(bio, BIO_RW_META))
@@ -1586,7 +1583,7 @@ void submit_bio(int rw, struct bio *bio)
         * If it's a regular read/write or a barrier with data attached,
         * go through the normal accounting stuff before submission.
         */
-        if (bio_has_data(bio)) {
+        if (bio_has_data(bio) && !(rw & (1 << BIO_RW_DISCARD))) {
                if (rw & WRITE) {
                        count_vm_events(PGPGOUT, count);
                } else {
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 5ff4f4850e71..7982b830db58 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -14,7 +14,7 @@
 #include <linux/rbtree.h>
 #include <linux/ioprio.h>
 #include <linux/blktrace_api.h>
-#include "blk-cgroup.h"
+#include "cfq.h"
 /*
 * tunables
@@ -879,7 +879,7 @@ cfq_group_service_tree_del(struct cfq_data *cfqd, struct cfq_group *cfqg)
        if (!RB_EMPTY_NODE(&cfqg->rb_node))
                cfq_rb_erase(&cfqg->rb_node, st);
        cfqg->saved_workload_slice = 0;
-        blkiocg_update_dequeue_stats(&cfqg->blkg, 1);
+        cfq_blkiocg_update_dequeue_stats(&cfqg->blkg, 1);
 }
 static inline unsigned int cfq_cfqq_slice_usage(struct cfq_queue *cfqq)
@@ -939,8 +939,8 @@ static void cfq_group_served(struct cfq_data *cfqd, struct cfq_group *cfqg,
        cfq_log_cfqg(cfqd, cfqg, "served: vt=%llu min_vt=%llu", cfqg->vdisktime,
                                        st->min_vdisktime);
-        blkiocg_update_timeslice_used(&cfqg->blkg, used_sl);
+        cfq_blkiocg_update_timeslice_used(&cfqg->blkg, used_sl);
-        blkiocg_set_start_empty_time(&cfqg->blkg);
+        cfq_blkiocg_set_start_empty_time(&cfqg->blkg);
 }
 #ifdef CONFIG_CFQ_GROUP_IOSCHED
@@ -995,7 +995,7 @@ cfq_find_alloc_cfqg(struct cfq_data *cfqd, struct cgroup *cgroup, int create)
        /* Add group onto cgroup list */
        sscanf(dev_name(bdi->dev), "%u:%u", &major, &minor);
-        blkiocg_add_blkio_group(blkcg, &cfqg->blkg, (void *)cfqd,
+        cfq_blkiocg_add_blkio_group(blkcg, &cfqg->blkg, (void *)cfqd,
                                        MKDEV(major, minor));
        cfqg->weight = blkcg_get_weight(blkcg, cfqg->blkg.dev);
@@ -1079,7 +1079,7 @@ static void cfq_release_cfq_groups(struct cfq_data *cfqd)
                 * it from cgroup list, then it will take care of destroying
                 * cfqg also.
                 */
-                if (!blkiocg_del_blkio_group(&cfqg->blkg))
+                if (!cfq_blkiocg_del_blkio_group(&cfqg->blkg))
                        cfq_destroy_cfqg(cfqd, cfqg);
        }
 }
@@ -1421,10 +1421,10 @@ static void cfq_reposition_rq_rb(struct cfq_queue *cfqq, struct request *rq)
 {
        elv_rb_del(&cfqq->sort_list, rq);
        cfqq->queued[rq_is_sync(rq)]--;
-        blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg, rq_data_dir(rq),
+        cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
-                                                rq_is_sync(rq));
+                                        rq_data_dir(rq), rq_is_sync(rq));
        cfq_add_rq_rb(rq);
-        blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
+        cfq_blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
                        &cfqq->cfqd->serving_group->blkg, rq_data_dir(rq),
                        rq_is_sync(rq));
 }
@@ -1482,8 +1482,8 @@ static void cfq_remove_request(struct request *rq)
        cfq_del_rq_rb(rq);
        cfqq->cfqd->rq_queued--;
-        blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg, rq_data_dir(rq),
+        cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
-                                                rq_is_sync(rq));
+                                        rq_data_dir(rq), rq_is_sync(rq));
        if (rq_is_meta(rq)) {
                WARN_ON(!cfqq->meta_pending);
                cfqq->meta_pending--;
@@ -1518,8 +1518,8 @@ static void cfq_merged_request(struct request_queue *q, struct request *req,
 static void cfq_bio_merged(struct request_queue *q, struct request *req,
                                struct bio *bio)
 {
-        blkiocg_update_io_merged_stats(&(RQ_CFQG(req))->blkg, bio_data_dir(bio),
+        cfq_blkiocg_update_io_merged_stats(&(RQ_CFQG(req))->blkg,
-                                        cfq_bio_sync(bio));
+                                        bio_data_dir(bio), cfq_bio_sync(bio));
 }
 static void
@@ -1539,8 +1539,8 @@ cfq_merged_requests(struct request_queue *q, struct request *rq,
        if (cfqq->next_rq == next)
                cfqq->next_rq = rq;
        cfq_remove_request(next);
-        blkiocg_update_io_merged_stats(&(RQ_CFQG(rq))->blkg, rq_data_dir(next),
+        cfq_blkiocg_update_io_merged_stats(&(RQ_CFQG(rq))->blkg,
-                                        rq_is_sync(next));
+                                        rq_data_dir(next), rq_is_sync(next));
 }
 static int cfq_allow_merge(struct request_queue *q, struct request *rq,
@@ -1571,7 +1571,7 @@ static int cfq_allow_merge(struct request_queue *q, struct request *rq,
 static inline void cfq_del_timer(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 {
        del_timer(&cfqd->idle_slice_timer);
-        blkiocg_update_idle_time_stats(&cfqq->cfqg->blkg);
+        cfq_blkiocg_update_idle_time_stats(&cfqq->cfqg->blkg);
 }
 static void __cfq_set_active_queue(struct cfq_data *cfqd,
@@ -1580,7 +1580,7 @@ static void __cfq_set_active_queue(struct cfq_data *cfqd,
        if (cfqq) {
                cfq_log_cfqq(cfqd, cfqq, "set_active wl_prio:%d wl_type:%d",
                                cfqd->serving_prio, cfqd->serving_type);
-                blkiocg_update_avg_queue_size_stats(&cfqq->cfqg->blkg);
+                cfq_blkiocg_update_avg_queue_size_stats(&cfqq->cfqg->blkg);
                cfqq->slice_start = 0;
                cfqq->dispatch_start = jiffies;
                cfqq->allocated_slice = 0;
@@ -1911,7 +1911,7 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
        sl = cfqd->cfq_slice_idle;
        mod_timer(&cfqd->idle_slice_timer, jiffies + sl);
-        blkiocg_update_set_idle_time_stats(&cfqq->cfqg->blkg);
+        cfq_blkiocg_update_set_idle_time_stats(&cfqq->cfqg->blkg);
        cfq_log_cfqq(cfqd, cfqq, "arm_idle: %lu", sl);
 }
@@ -1931,7 +1931,7 @@ static void cfq_dispatch_insert(struct request_queue *q, struct request *rq)
        elv_dispatch_sort(q, rq);
        cfqd->rq_in_flight[cfq_cfqq_sync(cfqq)]++;
-        blkiocg_update_dispatch_stats(&cfqq->cfqg->blkg, blk_rq_bytes(rq),
+        cfq_blkiocg_update_dispatch_stats(&cfqq->cfqg->blkg, blk_rq_bytes(rq),
                                        rq_data_dir(rq), rq_is_sync(rq));
 }
@@ -1986,6 +1986,15 @@ static void cfq_setup_merge(struct cfq_queue *cfqq, struct cfq_queue *new_cfqq)
        int process_refs, new_process_refs;
        struct cfq_queue *__cfqq;
+        /*
+         * If there are no process references on the new_cfqq, then it is
+         * unsafe to follow the ->new_cfqq chain as other cfqq's in the
+         * chain may have dropped their last reference (not just their
+         * last process reference).
+         */
+        if (!cfqq_process_refs(new_cfqq))
+                return;
        /* Avoid a circular list and skip interim queue merges */
        while ((__cfqq = new_cfqq->new_cfqq)) {
                if (__cfqq == cfqq)
@@ -1994,17 +2003,17 @@ static void cfq_setup_merge(struct cfq_queue *cfqq, struct cfq_queue *new_cfqq)
        }
        process_refs = cfqq_process_refs(cfqq);
+        new_process_refs = cfqq_process_refs(new_cfqq);
        /*
         * If the process for the cfqq has gone away, there is no
         * sense in merging the queues.
         */
-        if (process_refs == 0)
+        if (process_refs == 0 || new_process_refs == 0)
                return;
        /*
         * Merge in the direction of the lesser amount of work.
         */
-        new_process_refs = cfqq_process_refs(new_cfqq);
        if (new_process_refs >= process_refs) {
                cfqq->new_cfqq = new_cfqq;
                atomic_add(process_refs, &new_cfqq->ref);
@@ -3248,7 +3257,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                                cfq_clear_cfqq_wait_request(cfqq);
                                __blk_run_queue(cfqd->queue);
                        } else {
-                                blkiocg_update_idle_time_stats(
+                                cfq_blkiocg_update_idle_time_stats(
                                                &cfqq->cfqg->blkg);
                                cfq_mark_cfqq_must_dispatch(cfqq);
                        }
@@ -3276,7 +3285,7 @@ static void cfq_insert_request(struct request_queue *q, struct request *rq)
        rq_set_fifo_time(rq, jiffies + cfqd->cfq_fifo_expire[rq_is_sync(rq)]);
        list_add_tail(&rq->queuelist, &cfqq->fifo);
        cfq_add_rq_rb(rq);
-        blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
+        cfq_blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
                        &cfqd->serving_group->blkg, rq_data_dir(rq),
                        rq_is_sync(rq));
        cfq_rq_enqueued(cfqd, cfqq, rq);
@@ -3364,9 +3373,9 @@ static void cfq_completed_request(struct request_queue *q, struct request *rq)
        WARN_ON(!cfqq->dispatched);
        cfqd->rq_in_driver--;
        cfqq->dispatched--;
-        blkiocg_update_completion_stats(&cfqq->cfqg->blkg, rq_start_time_ns(rq),
+        cfq_blkiocg_update_completion_stats(&cfqq->cfqg->blkg,
-                        rq_io_start_time_ns(rq), rq_data_dir(rq),
+                        rq_start_time_ns(rq), rq_io_start_time_ns(rq),
-                        rq_is_sync(rq));
+                        rq_data_dir(rq), rq_is_sync(rq));
        cfqd->rq_in_flight[cfq_cfqq_sync(cfqq)]--;
@@ -3730,7 +3739,7 @@ static void cfq_exit_queue(struct elevator_queue *e)
        cfq_put_async_queues(cfqd);
        cfq_release_cfq_groups(cfqd);
-        blkiocg_del_blkio_group(&cfqd->root_group.blkg);
+        cfq_blkiocg_del_blkio_group(&cfqd->root_group.blkg);
        spin_unlock_irq(q->queue_lock);
@@ -3798,8 +3807,8 @@ static void *cfq_init_queue(struct request_queue *q)
         */
        atomic_set(&cfqg->ref, 1);
        rcu_read_lock();
-        blkiocg_add_blkio_group(&blkio_root_cgroup, &cfqg->blkg, (void *)cfqd,
+        cfq_blkiocg_add_blkio_group(&blkio_root_cgroup, &cfqg->blkg,
-                                        0);
+                                        (void *)cfqd, 0);
        rcu_read_unlock();
 #endif
        /*
diff --git a/block/cfq.h b/block/cfq.h
new file mode 100644
index 000000000000..93448e5a2e41
--- /dev/null
+++ b/block/cfq.h
@@ -0,0 +1,115 @@
+#ifndef _CFQ_H
+#define _CFQ_H
+#include "blk-cgroup.h"
+#ifdef CONFIG_CFQ_GROUP_IOSCHED
+static inline void cfq_blkiocg_update_io_add_stats(struct blkio_group *blkg,
+        struct blkio_group *curr_blkg, bool direction, bool sync)
+{
+        blkiocg_update_io_add_stats(blkg, curr_blkg, direction, sync);
+}
+static inline void cfq_blkiocg_update_dequeue_stats(struct blkio_group *blkg,
+                        unsigned long dequeue)
+{
+        blkiocg_update_dequeue_stats(blkg, dequeue);
+}
+static inline void cfq_blkiocg_update_timeslice_used(struct blkio_group *blkg,
+                        unsigned long time)
+{
+        blkiocg_update_timeslice_used(blkg, time);
+}
+static inline void cfq_blkiocg_set_start_empty_time(struct blkio_group *blkg)
+{
+        blkiocg_set_start_empty_time(blkg);
+}
+static inline void cfq_blkiocg_update_io_remove_stats(struct blkio_group *blkg,
+                                bool direction, bool sync)
+{
+        blkiocg_update_io_remove_stats(blkg, direction, sync);
+}
+static inline void cfq_blkiocg_update_io_merged_stats(struct blkio_group *blkg,
+                bool direction, bool sync)
+{
+        blkiocg_update_io_merged_stats(blkg, direction, sync);
+}
+static inline void cfq_blkiocg_update_idle_time_stats(struct blkio_group *blkg)
+{
+        blkiocg_update_idle_time_stats(blkg);
+}
+static inline void
+cfq_blkiocg_update_avg_queue_size_stats(struct blkio_group *blkg)
+{
+        blkiocg_update_avg_queue_size_stats(blkg);
+}
+static inline void
+cfq_blkiocg_update_set_idle_time_stats(struct blkio_group *blkg)
+{
+        blkiocg_update_set_idle_time_stats(blkg);
+}
+static inline void cfq_blkiocg_update_dispatch_stats(struct blkio_group *blkg,
+                                uint64_t bytes, bool direction, bool sync)
+{
+        blkiocg_update_dispatch_stats(blkg, bytes, direction, sync);
+}
+static inline void cfq_blkiocg_update_completion_stats(struct blkio_group *blkg, uint64_t start_time, uint64_t io_start_time, bool direction, bool sync)
+{
+        blkiocg_update_completion_stats(blkg, start_time, io_start_time,
+                                direction, sync);
+}
+static inline void cfq_blkiocg_add_blkio_group(struct blkio_cgroup *blkcg,
+                        struct blkio_group *blkg, void *key, dev_t dev) {
+        blkiocg_add_blkio_group(blkcg, blkg, key, dev);
+}
+static inline int cfq_blkiocg_del_blkio_group(struct blkio_group *blkg)
+{
+        return blkiocg_del_blkio_group(blkg);
+}
+#else /* CFQ_GROUP_IOSCHED */
+static inline void cfq_blkiocg_update_io_add_stats(struct blkio_group *blkg,
+        struct blkio_group *curr_blkg, bool direction, bool sync) {}
+static inline void cfq_blkiocg_update_dequeue_stats(struct blkio_group *blkg,
+                        unsigned long dequeue) {}
+static inline void cfq_blkiocg_update_timeslice_used(struct blkio_group *blkg,
+                        unsigned long time) {}
+static inline void cfq_blkiocg_set_start_empty_time(struct blkio_group *blkg) {}
+static inline void cfq_blkiocg_update_io_remove_stats(struct blkio_group *blkg,
+                                bool direction, bool sync) {}
+static inline void cfq_blkiocg_update_io_merged_stats(struct blkio_group *blkg,
+                bool direction, bool sync) {}
+static inline void cfq_blkiocg_update_idle_time_stats(struct blkio_group *blkg)
+{
+}
+static inline void
+cfq_blkiocg_update_avg_queue_size_stats(struct blkio_group *blkg) {}
+static inline void
+cfq_blkiocg_update_set_idle_time_stats(struct blkio_group *blkg) {}
+static inline void cfq_blkiocg_update_dispatch_stats(struct blkio_group *blkg,
+                                uint64_t bytes, bool direction, bool sync) {}
+static inline void cfq_blkiocg_update_completion_stats(struct blkio_group *blkg, uint64_t start_time, uint64_t io_start_time, bool direction, bool sync) {}
+static inline void cfq_blkiocg_add_blkio_group(struct blkio_cgroup *blkcg,
+                        struct blkio_group *blkg, void *key, dev_t dev) {}
+static inline int cfq_blkiocg_del_blkio_group(struct blkio_group *blkg)
+{
+        return 0;
+}
+#endif /* CFQ_GROUP_IOSCHED */
+#endif
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index db3946e9c66b..216e1e948ff6 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -34,6 +34,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/acpi.h>
+#include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/kref.h>
 #include <linux/rculist.h>
diff --git a/drivers/acpi/atomicio.c b/drivers/acpi/atomicio.c
index 814b19249616..8f8bd736d4ff 100644
--- a/drivers/acpi/atomicio.c
+++ b/drivers/acpi/atomicio.c
@@ -31,6 +31,7 @@
 #include <linux/kref.h>
 #include <linux/rculist.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <acpi/atomicio.h>
 #define ACPI_PFX "ACPI: "
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 3381505c8a6c..72dae92f3cab 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -861,6 +861,7 @@ cciss_scsi_detect(int ctlr)
        sh->n_io_port = 0;      // I don't think we use these two...
        sh->this_id = SELF_SCSI_ID;  
        sh->sg_tablesize = hba[ctlr]->maxsgentries;
+        sh->max_cmd_len = MAX_COMMAND_SIZE;
        ((struct cciss_scsi_adapter_data_t *) 
                hba[ctlr]->scsi_ctlr)->scsi_host = sh;
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 91d11631cec9..abb4ec6690fc 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -386,7 +386,7 @@ static void __devexit cpqarray_remove_one_eisa (int i)
 }
 /* pdev is NULL for eisa */
-static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
+static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
 {
        struct request_queue *q;
        int j;
@@ -503,7 +503,7 @@ Enomem4:
        return -1;
 }
-static int __init cpqarray_init_one( struct pci_dev *pdev,
+static int __devinit cpqarray_init_one( struct pci_dev *pdev,
        const struct pci_device_id *ent)
 {
        int i;
@@ -740,7 +740,7 @@ __setup("smart2=", cpqarray_setup);
 /*
 * Find an EISA controller's signature.  Set up an hba if we find it.
 */
-static int __init cpqarray_eisa_detect(void)
+static int __devinit cpqarray_eisa_detect(void)
 {
        int i=0, j;
        __u32 board_id;
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 6b077f93acc6..7258c95e895e 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1236,8 +1236,6 @@ static void after_state_ch(struct drbd_conf *mdev, union drbd_state os,
        /* Last part of the attaching process ... */
        if (ns.conn >= C_CONNECTED &&
            os.disk == D_ATTACHING && ns.disk == D_NEGOTIATING) {
-                kfree(mdev->p_uuid); /* We expect to receive up-to-date UUIDs soon. */
-                mdev->p_uuid = NULL; /* ...to not use the old ones in the mean time */
                drbd_send_sizes(mdev, 0, 0);  /* to start sync... */
                drbd_send_uuids(mdev);
                drbd_send_state(mdev);
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 632e3245d1bb..2151f18b21de 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -1114,6 +1114,12 @@ static int drbd_nl_disk_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp
                mdev->new_state_tmp.i = ns.i;
                ns.i = os.i;
                ns.disk = D_NEGOTIATING;
+                /* We expect to receive up-to-date UUIDs soon.
+                   To avoid a race in receive_state, free p_uuid while
+                   holding req_lock. I.e. atomic with the state change */
+                kfree(mdev->p_uuid);
+                mdev->p_uuid = NULL;
        }
        rv = _drbd_set_state(mdev, ns, CS_VERBOSE, NULL);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 35603dd4e6c5..094bdc355b1f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -302,6 +302,12 @@ struct smi_info {
 static int force_kipmid[SI_MAX_PARMS];
 static int num_force_kipmid;
+#ifdef CONFIG_PCI
+static int pci_registered;
+#endif
+#ifdef CONFIG_PPC_OF
+static int of_registered;
+#endif
 static unsigned int kipmid_max_busy_us[SI_MAX_PARMS];
 static int num_max_busy_us;
@@ -1018,7 +1024,7 @@ static int ipmi_thread(void *data)
                else if (smi_result == SI_SM_IDLE)
                        schedule_timeout_interruptible(100);
                else
-                        schedule_timeout_interruptible(0);
+                        schedule_timeout_interruptible(1);
        }
        return 0;
 }
@@ -3314,6 +3320,8 @@ static __devinit int init_ipmi_si(void)
        rv = pci_register_driver(&ipmi_pci_driver);
        if (rv)
                printk(KERN_ERR PFX "Unable to register PCI driver: %d\n", rv);
+        else
+                pci_registered = 1;
 #endif
 #ifdef CONFIG_ACPI
@@ -3330,6 +3338,7 @@ static __devinit int init_ipmi_si(void)
 #ifdef CONFIG_PPC_OF
        of_register_platform_driver(&ipmi_of_platform_driver);
+        of_registered = 1;
 #endif
        /* We prefer devices with interrupts, but in the case of a machine
@@ -3383,11 +3392,13 @@ static __devinit int init_ipmi_si(void)
        if (unload_when_empty && list_empty(&smi_infos)) {
                mutex_unlock(&smi_infos_lock);
 #ifdef CONFIG_PCI
-                pci_unregister_driver(&ipmi_pci_driver);
+                if (pci_registered)
+                        pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_PPC_OF
-                of_unregister_platform_driver(&ipmi_of_platform_driver);
+                if (of_registered)
+                        of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
                driver_unregister(&ipmi_driver.driver);
                printk(KERN_WARNING PFX
@@ -3478,14 +3489,16 @@ static __exit void cleanup_ipmi_si(void)
                return;
 #ifdef CONFIG_PCI
-        pci_unregister_driver(&ipmi_pci_driver);
+        if (pci_registered)
+                pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
        pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 #ifdef CONFIG_PPC_OF
-        of_unregister_platform_driver(&ipmi_of_platform_driver);
+        if (of_registered)
+                of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
        mutex_lock(&smi_infos_lock);
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 724038dab4ca..7face915b963 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1,5 +1,5 @@
 #
-# GPIO infrastructure and expanders
+# platform-neutral GPIO infrastructure and expanders
 #
 config ARCH_WANT_OPTIONAL_GPIOLIB
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index 51c3cdd41b5a..e53dcff49b4f 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -1,4 +1,8 @@
-# gpio support: dedicated expander chips, etc
+# generic gpio support: dedicated expander chips, etc
+#
+# NOTE: platform-specific GPIO drivers don't belong in the
+# drivers/gpio directory; put them with other platform setup
+# code, IRQ controllers, board init, etc.
 ccflags-$(CONFIG_DEBUG_GPIO)    += -DDEBUG
diff --git a/drivers/rtc/rtc-davinci.c b/drivers/rtc/rtc-davinci.c
index 92a8f6cacda9..34647fc1ee98 100644
--- a/drivers/rtc/rtc-davinci.c
+++ b/drivers/rtc/rtc-davinci.c
@@ -29,6 +29,7 @@
 #include <linux/bcd.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
+#include <linux/slab.h>
 /*
 * The DaVinci RTC is a simple RTC with the following
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index de033b7ac21f..d827ce570a8c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -777,7 +777,7 @@ static int __devinit ds1307_probe(struct i2c_client *client,
 read_rtc:
        /* read RTC registers */
-        tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf);
+        tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf);
        if (tmp != 8) {
                pr_debug("read error %d\n", tmp);
                err = -EIO;
@@ -862,7 +862,7 @@ read_rtc:
                if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM)
                        tmp += 12;
                i2c_smbus_write_byte_data(client,
-                                DS1307_REG_HOUR,
+                                ds1307->offset + DS1307_REG_HOUR,
                                bin2bcd(tmp));
        }
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 9eb62a256e9a..cd6cf575902e 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct uart_port *port, int flags)
        }
 }
+#if defined(CONFIG_CONSOLE_POLL) || defined(CONFIG_SERIAL_CPM_CONSOLE)
+/*
+ * Write a string to the serial port
+ * Note that this is called with interrupts already disabled
+ */
+static void cpm_uart_early_write(struct uart_cpm_port *pinfo,
+                const char *string, u_int count)
+{
+        unsigned int i;
+        cbd_t __iomem *bdp, *bdbase;
+        unsigned char *cpm_outp_addr;
+        /* Get the address of the host memory buffer.
+         */
+        bdp = pinfo->tx_cur;
+        bdbase = pinfo->tx_bd_base;
+        /*
+         * Now, do each character.  This is not as bad as it looks
+         * since this is a holding FIFO and not a transmitting FIFO.
+         * We could add the complexity of filling the entire transmit
+         * buffer, but we would just wait longer between accesses......
+         */
+        for (i = 0; i < count; i++, string++) {
+                /* Wait for transmitter fifo to empty.
+                 * Ready indicates output is ready, and xmt is doing
+                 * that, not that it is ready for us to send.
+                 */
+                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                        ;
+                /* Send the character out.
+                 * If the buffer address is in the CPM DPRAM, don't
+                 * convert it.
+                 */
+                cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                        pinfo);
+                *cpm_outp_addr = *string;
+                out_be16(&bdp->cbd_datlen, 1);
+                setbits16(&bdp->cbd_sc, BD_SC_READY);
+                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                        bdp = bdbase;
+                else
+                        bdp++;
+                /* if a LF, also do CR... */
+                if (*string == 10) {
+                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                                ;
+                        cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                                pinfo);
+                        *cpm_outp_addr = 13;
+                        out_be16(&bdp->cbd_datlen, 1);
+                        setbits16(&bdp->cbd_sc, BD_SC_READY);
+                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                                bdp = bdbase;
+                        else
+                                bdp++;
+                }
+        }
+        /*
+         * Finally, Wait for transmitter & holding register to empty
+         *  and restore the IER
+         */
+        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                ;
+        pinfo->tx_cur = bdp;
+}
+#endif
 #ifdef CONFIG_CONSOLE_POLL
 /* Serial polling routines for writing and reading from the uart while
 * in an interrupt or debug context.
@@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uart_port *port,
        static char ch[2];
        ch[0] = (char)c;
-        cpm_uart_early_write(pinfo->port.line, ch, 1);
+        cpm_uart_early_write(pinfo, ch, 1);
 }
 #endif /* CONFIG_CONSOLE_POLL */
@@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                                   u_int count)
 {
        struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
-        unsigned int i;
-        cbd_t __iomem *bdp, *bdbase;
-        unsigned char *cp;
        unsigned long flags;
        int nolock = oops_in_progress;
@@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                spin_lock_irqsave(&pinfo->port.lock, flags);
        }
-        /* Get the address of the host memory buffer.
+        cpm_uart_early_write(pinfo, s, count);
-         */
-        bdp = pinfo->tx_cur;
-        bdbase = pinfo->tx_bd_base;
-        /*
-         * Now, do each character.  This is not as bad as it looks
-         * since this is a holding FIFO and not a transmitting FIFO.
-         * We could add the complexity of filling the entire transmit
-         * buffer, but we would just wait longer between accesses......
-         */
-        for (i = 0; i < count; i++, s++) {
-                /* Wait for transmitter fifo to empty.
-                 * Ready indicates output is ready, and xmt is doing
-                 * that, not that it is ready for us to send.
-                 */
-                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                        ;
-                /* Send the character out.
-                 * If the buffer address is in the CPM DPRAM, don't
-                 * convert it.
-                 */
-                cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                *cp = *s;
-                out_be16(&bdp->cbd_datlen, 1);
-                setbits16(&bdp->cbd_sc, BD_SC_READY);
-                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                        bdp = bdbase;
-                else
-                        bdp++;
-                /* if a LF, also do CR... */
-                if (*s == 10) {
-                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                                ;
-                        cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                        *cp = 13;
-                        out_be16(&bdp->cbd_datlen, 1);
-                        setbits16(&bdp->cbd_sc, BD_SC_READY);
-                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                                bdp = bdbase;
-                        else
-                                bdp++;
-                }
-        }
-        /*
-         * Finally, Wait for transmitter & holding register to empty
-         *  and restore the IER
-         */
-        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                ;
-        pinfo->tx_cur = bdp;
        if (unlikely(nolock)) {
                local_irq_restore(flags);
diff --git a/drivers/staging/tm6000/tm6000-alsa.c b/drivers/staging/tm6000/tm6000-alsa.c
index ce081cd44ad4..273e26ede650 100644
--- a/drivers/staging/tm6000/tm6000-alsa.c
+++ b/drivers/staging/tm6000/tm6000-alsa.c
@@ -15,6 +15,7 @@
 #include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/usb.h>
+#include <linux/slab.h>
 #include <asm/delay.h>
 #include <sound/core.h>
diff --git a/drivers/staging/tm6000/tm6000-cards.c b/drivers/staging/tm6000/tm6000-cards.c
index cedd9044022f..6a9ae40c7c6d 100644
--- a/drivers/staging/tm6000/tm6000-cards.c
+++ b/drivers/staging/tm6000/tm6000-cards.c
@@ -24,6 +24,7 @@
 #include <linux/i2c.h>
 #include <linux/usb.h>
 #include <linux/version.h>
+#include <linux/slab.h>
 #include <media/v4l2-common.h>
 #include <media/tuner.h>
 #include <media/tvaudio.h>
diff --git a/drivers/staging/tm6000/tm6000-core.c b/drivers/staging/tm6000/tm6000-core.c
index 27f3f551b545..c3690e3580da 100644
--- a/drivers/staging/tm6000/tm6000-core.c
+++ b/drivers/staging/tm6000/tm6000-core.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/i2c.h>
 #include "tm6000.h"
diff --git a/drivers/staging/tm6000/tm6000-dvb.c b/drivers/staging/tm6000/tm6000-dvb.c
index 261e66acbe46..86c1c8b5f25a 100644
--- a/drivers/staging/tm6000/tm6000-dvb.c
+++ b/drivers/staging/tm6000/tm6000-dvb.c
@@ -18,6 +18,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include "tm6000.h"
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 76e7dac6f259..70b1d9d51c96 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -40,7 +40,7 @@ static int vram;
 static int vt_switch;
 /* Modes relevant to the GX (taken from modedb.c) */
-static struct fb_videomode gx_modedb[] __initdata = {
+static struct fb_videomode gx_modedb[] __devinitdata = {
        /* 640x480-60 VESA */
        { NULL, 60, 640, 480, 39682,  48, 16, 33, 10, 96, 2,
          0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
@@ -110,14 +110,15 @@ static struct fb_videomode gx_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
-static struct fb_videomode gx_dcon_modedb[] __initdata = {
+static struct fb_videomode gx_dcon_modedb[] __devinitdata = {
        /* The only mode the DCON has is 1200x900 */
        { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
          FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
          FB_VMODE_NONINTERLACED, 0 }
 };
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        if (olpc_has_dcon()) {
                *modedb = (struct fb_videomode *) gx_dcon_modedb;
@@ -129,7 +130,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        *modedb = (struct fb_videomode *) gx_modedb;
        *size = ARRAY_SIZE(gx_modedb);
@@ -226,7 +228,8 @@ static int gxfb_blank(int blank_mode, struct fb_info *info)
        return gx_blank_display(info, blank_mode);
 }
-static int __init gxfb_map_video_memory(struct fb_info *info, struct pci_dev *dev)
+static int __devinit gxfb_map_video_memory(struct fb_info *info,
+                struct pci_dev *dev)
 {
        struct gxfb_par *par = info->par;
        int ret;
@@ -290,7 +293,7 @@ static struct fb_ops gxfb_ops = {
        .fb_imageblit   = cfb_imageblit,
 };
-static struct fb_info * __init gxfb_init_fbinfo(struct device *dev)
+static struct fb_info *__devinit gxfb_init_fbinfo(struct device *dev)
 {
        struct gxfb_par *par;
        struct fb_info *info;
@@ -371,7 +374,8 @@ static int gxfb_resume(struct pci_dev *pdev)
 }
 #endif
-static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+static int __devinit gxfb_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
 {
        struct gxfb_par *par;
        struct fb_info *info;
@@ -451,7 +455,7 @@ static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *i
        return ret;
 }
-static void gxfb_remove(struct pci_dev *pdev)
+static void __devexit gxfb_remove(struct pci_dev *pdev)
 {
        struct fb_info *info = pci_get_drvdata(pdev);
        struct gxfb_par *par = info->par;
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index 1a18da86d3fa..39bdbedf43b4 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -35,7 +35,7 @@ static int vt_switch;
 * we try to make it something sane - 640x480-60 is sane
 */
-static struct fb_videomode geode_modedb[] __initdata = {
+static struct fb_videomode geode_modedb[] __devinitdata = {
        /* 640x480-60 */
        { NULL, 60, 640, 480, 39682, 48, 8, 25, 2, 88, 2,
          FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
@@ -219,14 +219,15 @@ static struct fb_videomode geode_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
-static struct fb_videomode olpc_dcon_modedb[] __initdata = {
+static struct fb_videomode olpc_dcon_modedb[] __devinitdata = {
        /* The only mode the DCON has is 1200x900 */
        { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
          FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
          FB_VMODE_NONINTERLACED, 0 }
 };
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        if (olpc_has_dcon()) {
                *modedb = (struct fb_videomode *) olpc_dcon_modedb;
@@ -238,7 +239,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        *modedb = (struct fb_videomode *) geode_modedb;
        *size = ARRAY_SIZE(geode_modedb);
@@ -334,7 +336,7 @@ static int lxfb_blank(int blank_mode, struct fb_info *info)
 }
-static int __init lxfb_map_video_memory(struct fb_info *info,
+static int __devinit lxfb_map_video_memory(struct fb_info *info,
                                        struct pci_dev *dev)
 {
        struct lxfb_par *par = info->par;
@@ -412,7 +414,7 @@ static struct fb_ops lxfb_ops = {
        .fb_imageblit   = cfb_imageblit,
 };
-static struct fb_info * __init lxfb_init_fbinfo(struct device *dev)
+static struct fb_info * __devinit lxfb_init_fbinfo(struct device *dev)
 {
        struct lxfb_par *par;
        struct fb_info *info;
@@ -496,7 +498,7 @@ static int lxfb_resume(struct pci_dev *pdev)
 #define lxfb_resume NULL
 #endif
-static int __init lxfb_probe(struct pci_dev *pdev,
+static int __devinit lxfb_probe(struct pci_dev *pdev,
                             const struct pci_device_id *id)
 {
        struct lxfb_par *par;
@@ -588,7 +590,7 @@ err:
        return ret;
 }
-static void lxfb_remove(struct pci_dev *pdev)
+static void __devexit lxfb_remove(struct pci_dev *pdev)
 {
        struct fb_info *info = pci_get_drvdata(pdev);
        struct lxfb_par *par = info->par;
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index d4cde79ea15e..81687ed26ba9 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -596,8 +596,6 @@ static int __devinit nuc900fb_probe(struct platform_device *pdev)
                goto release_regs;
        }
-        nuc900_driver_clksrc_div(&pdev->dev, "ext", 0x2);
        fbi->clk = clk_get(&pdev->dev, NULL);
        if (!fbi->clk || IS_ERR(fbi->clk)) {
                printk(KERN_ERR "nuc900-lcd:failed to get lcd clock source\n");
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index b6ab27ccf214..811384bec8de 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -68,11 +68,7 @@
 * Here we can be a bit looser than the data sections since this
 * needs to only meet arch ABI requirements.
 */
-#ifdef ARCH_SLAB_MINALIGN
+#define FLAT_STACK_ALIGN        max_t(unsigned long, sizeof(void *), ARCH_SLAB_MINALIGN)
-#define FLAT_STACK_ALIGN        (ARCH_SLAB_MINALIGN)
-#else
-#define FLAT_STACK_ALIGN        (sizeof(void *))
-#endif
 #define RELOC_FAILED 0xff00ff01         /* Relocation incorrect somewhere */
 #define UNLOADED_LIB 0x7ff000ff         /* Placeholder for unused library */
diff --git a/fs/dcache.c b/fs/dcache.c
index d96047b4a633..c8c78ba07827 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -590,6 +590,8 @@ static void prune_dcache(int count)
                        up_read(&sb->s_umount);
                }
                spin_lock(&sb_lock);
+                /* lock was dropped, must reset next */
+                list_safe_reset_next(sb, n, s_list);
                count -= pruned;
                __put_super(sb);
                /* more work left to do? */
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 51e11bf5708f..9d175d623aab 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -733,12 +733,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
 {
        while (fa) {
                struct fown_struct *fown;
+                unsigned long flags;
                if (fa->magic != FASYNC_MAGIC) {
                        printk(KERN_ERR "kill_fasync: bad magic number in "
                               "fasync_struct!\n");
                        return;
                }
-                spin_lock(&fa->fa_lock);
+                spin_lock_irqsave(&fa->fa_lock, flags);
                if (fa->fa_file) {
                        fown = &fa->fa_file->f_owner;
                        /* Don't send SIGURG to processes which have not set a
@@ -747,7 +749,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
                        if (!(sig == SIGURG && fown->signum == 0))
                                send_sigio(fown, fa->fa_fd, band);
                }
-                spin_unlock(&fa->fa_lock);
+                spin_unlock_irqrestore(&fa->fa_lock, flags);
                fa = rcu_dereference(fa->fa_next);
        }
 }
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 1d1088f48bc2..0609607d3955 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -63,24 +63,16 @@ struct bdi_work {
 };
 enum {
-        WS_USED_B = 0,
+        WS_INPROGRESS = 0,
-        WS_ONSTACK_B,
+        WS_ONSTACK,
 };
-#define WS_USED (1 << WS_USED_B)
-#define WS_ONSTACK (1 << WS_ONSTACK_B)
-static inline bool bdi_work_on_stack(struct bdi_work *work)
-{
-        return test_bit(WS_ONSTACK_B, &work->state);
-}
 static inline void bdi_work_init(struct bdi_work *work,
                                 struct wb_writeback_args *args)
 {
        INIT_RCU_HEAD(&work->rcu_head);
        work->args = *args;
-        work->state = WS_USED;
+        __set_bit(WS_INPROGRESS, &work->state);
 }
 /**
@@ -95,43 +87,16 @@ int writeback_in_progress(struct backing_dev_info *bdi)
        return !list_empty(&bdi->work_list);
 }
-static void bdi_work_clear(struct bdi_work *work)
-{
-        clear_bit(WS_USED_B, &work->state);
-        smp_mb__after_clear_bit();
-        /*
-         * work can have disappeared at this point. bit waitq functions
-         * should be able to tolerate this, provided bdi_sched_wait does
-         * not dereference it's pointer argument.
-        */
-        wake_up_bit(&work->state, WS_USED_B);
-}
 static void bdi_work_free(struct rcu_head *head)
 {
        struct bdi_work *work = container_of(head, struct bdi_work, rcu_head);
-        if (!bdi_work_on_stack(work))
+        clear_bit(WS_INPROGRESS, &work->state);
-                kfree(work);
+        smp_mb__after_clear_bit();
-        else
+        wake_up_bit(&work->state, WS_INPROGRESS);
-                bdi_work_clear(work);
-}
-static void wb_work_complete(struct bdi_work *work)
-{
-        const enum writeback_sync_modes sync_mode = work->args.sync_mode;
-        int onstack = bdi_work_on_stack(work);
-        /*
+        if (!test_bit(WS_ONSTACK, &work->state))
-         * For allocated work, we can clear the done/seen bit right here.
+                kfree(work);
-         * For on-stack work, we need to postpone both the clear and free
-         * to after the RCU grace period, since the stack could be invalidated
-         * as soon as bdi_work_clear() has done the wakeup.
-         */
-        if (!onstack)
-                bdi_work_clear(work);
-        if (sync_mode == WB_SYNC_NONE || onstack)
-                call_rcu(&work->rcu_head, bdi_work_free);
 }
 static void wb_clear_pending(struct bdi_writeback *wb, struct bdi_work *work)
@@ -147,7 +112,7 @@ static void wb_clear_pending(struct bdi_writeback *wb, struct bdi_work *work)
                list_del_rcu(&work->list);
                spin_unlock(&bdi->wb_lock);
-                wb_work_complete(work);
+                call_rcu(&work->rcu_head, bdi_work_free);
        }
 }
@@ -185,9 +150,9 @@ static void bdi_queue_work(struct backing_dev_info *bdi, struct bdi_work *work)
 * Used for on-stack allocated work items. The caller needs to wait until
 * the wb threads have acked the work before it's safe to continue.
 */
-static void bdi_wait_on_work_clear(struct bdi_work *work)
+static void bdi_wait_on_work_done(struct bdi_work *work)
 {
-        wait_on_bit(&work->state, WS_USED_B, bdi_sched_wait,
+        wait_on_bit(&work->state, WS_INPROGRESS, bdi_sched_wait,
                    TASK_UNINTERRUPTIBLE);
 }
@@ -213,37 +178,28 @@ static void bdi_alloc_queue_work(struct backing_dev_info *bdi,
 }
 /**
- * bdi_sync_writeback - start and wait for writeback
+ * bdi_queue_work_onstack - start and wait for writeback
- * @bdi: the backing device to write from
 * @sb: write inodes from this super_block
 *
 * Description:
- *   This does WB_SYNC_ALL data integrity writeback and waits for the
+ *   This function initiates writeback and waits for the operation to
- *   IO to complete. Callers must hold the sb s_umount semaphore for
+ *   complete. Callers must hold the sb s_umount semaphore for
 *   reading, to avoid having the super disappear before we are done.
 */
-static void bdi_sync_writeback(struct backing_dev_info *bdi,
+static void bdi_queue_work_onstack(struct wb_writeback_args *args)
-                               struct super_block *sb)
 {
-        struct wb_writeback_args args = {
-                .sb             = sb,
-                .sync_mode      = WB_SYNC_ALL,
-                .nr_pages       = LONG_MAX,
-                .range_cyclic   = 0,
-        };
        struct bdi_work work;
-        bdi_work_init(&work, &args);
+        bdi_work_init(&work, args);
-        work.state |= WS_ONSTACK;
+        __set_bit(WS_ONSTACK, &work.state);
-        bdi_queue_work(bdi, &work);
+        bdi_queue_work(args->sb->s_bdi, &work);
-        bdi_wait_on_work_clear(&work);
+        bdi_wait_on_work_done(&work);
 }
 /**
 * bdi_start_writeback - start writeback
 * @bdi: the backing device to write from
- * @sb: write inodes from this super_block
 * @nr_pages: the number of pages to write
 *
 * Description:
@@ -252,25 +208,34 @@ static void bdi_sync_writeback(struct backing_dev_info *bdi,
 *   completion. Caller need not hold sb s_umount semaphore.
 *
 */
-void bdi_start_writeback(struct backing_dev_info *bdi, struct super_block *sb,
+void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages)
-                         long nr_pages)
 {
        struct wb_writeback_args args = {
-                .sb             = sb,
                .sync_mode      = WB_SYNC_NONE,
                .nr_pages       = nr_pages,
                .range_cyclic   = 1,
        };
-        /*
+        bdi_alloc_queue_work(bdi, &args);
-         * We treat @nr_pages=0 as the special case to do background writeback,
+}
-         * ie. to sync pages until the background dirty threshold is reached.
-         */
-        if (!nr_pages) {
-                args.nr_pages = LONG_MAX;
-                args.for_background = 1;
-        }
+/**
+ * bdi_start_background_writeback - start background writeback
+ * @bdi: the backing device to write from
+ *
+ * Description:
+ *   This does WB_SYNC_NONE background writeback. The IO is only
+ *   started when this function returns, we make no guarentees on
+ *   completion. Caller need not hold sb s_umount semaphore.
+ */
+void bdi_start_background_writeback(struct backing_dev_info *bdi)
+{
+        struct wb_writeback_args args = {
+                .sync_mode      = WB_SYNC_NONE,
+                .nr_pages       = LONG_MAX,
+                .for_background = 1,
+                .range_cyclic   = 1,
+        };
        bdi_alloc_queue_work(bdi, &args);
 }
@@ -561,48 +526,30 @@ select_queue:
        return ret;
 }
-static void unpin_sb_for_writeback(struct super_block *sb)
-{
-        up_read(&sb->s_umount);
-        put_super(sb);
-}
-enum sb_pin_state {
-        SB_PINNED,
-        SB_NOT_PINNED,
-        SB_PIN_FAILED
-};
 /*
- * For WB_SYNC_NONE writeback, the caller does not have the sb pinned
+ * For background writeback the caller does not have the sb pinned
 * before calling writeback. So make sure that we do pin it, so it doesn't
 * go away while we are writing inodes from it.
 */
-static enum sb_pin_state pin_sb_for_writeback(struct writeback_control *wbc,
+static bool pin_sb_for_writeback(struct super_block *sb)
-                                              struct super_block *sb)
 {
-        /*
-         * Caller must already hold the ref for this
-         */
-        if (wbc->sync_mode == WB_SYNC_ALL) {
-                WARN_ON(!rwsem_is_locked(&sb->s_umount));
-                return SB_NOT_PINNED;
-        }
        spin_lock(&sb_lock);
+        if (list_empty(&sb->s_instances)) {
+                spin_unlock(&sb_lock);
+                return false;
+        }
        sb->s_count++;
+        spin_unlock(&sb_lock);
        if (down_read_trylock(&sb->s_umount)) {
-                if (sb->s_root) {
+                if (sb->s_root)
-                        spin_unlock(&sb_lock);
+                        return true;
-                        return SB_PINNED;
-                }
-                /*
-                 * umounted, drop rwsem again and fall through to failure
-                 */
                up_read(&sb->s_umount);
        }
-        sb->s_count--;
-        spin_unlock(&sb_lock);
+        put_super(sb);
-        return SB_PIN_FAILED;
+        return false;
 }
 /*
@@ -681,24 +628,31 @@ static void writeback_inodes_wb(struct bdi_writeback *wb,
                struct inode *inode = list_entry(wb->b_io.prev,
                                                 struct inode, i_list);
                struct super_block *sb = inode->i_sb;
-                enum sb_pin_state state;
-                if (wbc->sb && sb != wbc->sb) {
+                if (wbc->sb) {
-                        /* super block given and doesn't
+                        /*
-                           match, skip this inode */
+                         * We are requested to write out inodes for a specific
-                        redirty_tail(inode);
+                         * superblock.  This means we already have s_umount
-                        continue;
+                         * taken by the caller which also waits for us to
-                }
+                         * complete the writeout.
-                state = pin_sb_for_writeback(wbc, sb);
+                         */
+                        if (sb != wbc->sb) {
+                                redirty_tail(inode);
+                                continue;
+                        }
-                if (state == SB_PIN_FAILED) {
+                        WARN_ON(!rwsem_is_locked(&sb->s_umount));
-                        requeue_io(inode);
-                        continue;
+                        ret = writeback_sb_inodes(sb, wb, wbc);
+                } else {
+                        if (!pin_sb_for_writeback(sb)) {
+                                requeue_io(inode);
+                                continue;
+                        }
+                        ret = writeback_sb_inodes(sb, wb, wbc);
+                        drop_super(sb);
                }
-                ret = writeback_sb_inodes(sb, wb, wbc);
-                if (state == SB_PINNED)
-                        unpin_sb_for_writeback(sb);
                if (ret)
                        break;
        }
@@ -911,7 +865,7 @@ long wb_do_writeback(struct bdi_writeback *wb, int force_wait)
                 * If this isn't a data integrity operation, just notify
                 * that we have seen this work and we are now starting it.
                 */
-                if (args.sync_mode == WB_SYNC_NONE)
+                if (!test_bit(WS_ONSTACK, &work->state))
                        wb_clear_pending(wb, work);
                wrote += wb_writeback(wb, &args);
@@ -920,7 +874,7 @@ long wb_do_writeback(struct bdi_writeback *wb, int force_wait)
                 * This is a data integrity writeback, so only do the
                 * notification when we have completed the work.
                 */
-                if (args.sync_mode == WB_SYNC_ALL)
+                if (test_bit(WS_ONSTACK, &work->state))
                        wb_clear_pending(wb, work);
        }
@@ -978,42 +932,32 @@ int bdi_writeback_task(struct bdi_writeback *wb)
 }
 /*
- * Schedule writeback for all backing devices. This does WB_SYNC_NONE
+ * Start writeback of `nr_pages' pages.  If `nr_pages' is zero, write back
- * writeback, for integrity writeback see bdi_sync_writeback().
+ * the whole world.
 */
-static void bdi_writeback_all(struct super_block *sb, long nr_pages)
+void wakeup_flusher_threads(long nr_pages)
 {
+        struct backing_dev_info *bdi;
        struct wb_writeback_args args = {
-                .sb             = sb,
-                .nr_pages       = nr_pages,
                .sync_mode      = WB_SYNC_NONE,
        };
-        struct backing_dev_info *bdi;
-        rcu_read_lock();
+        if (nr_pages) {
+                args.nr_pages = nr_pages;
+        } else {
+                args.nr_pages = global_page_state(NR_FILE_DIRTY) +
+                                global_page_state(NR_UNSTABLE_NFS);
+        }
+        rcu_read_lock();
        list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
                if (!bdi_has_dirty_io(bdi))
                        continue;
                bdi_alloc_queue_work(bdi, &args);
        }
        rcu_read_unlock();
 }
-/*
- * Start writeback of `nr_pages' pages.  If `nr_pages' is zero, write back
- * the whole world.
- */
-void wakeup_flusher_threads(long nr_pages)
-{
-        if (nr_pages == 0)
-                nr_pages = global_page_state(NR_FILE_DIRTY) +
-                                global_page_state(NR_UNSTABLE_NFS);
-        bdi_writeback_all(NULL, nr_pages);
-}
 static noinline void block_dump___mark_inode_dirty(struct inode *inode)
 {
        if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev")) {
@@ -1218,12 +1162,17 @@ void writeback_inodes_sb(struct super_block *sb)
 {
        unsigned long nr_dirty = global_page_state(NR_FILE_DIRTY);
        unsigned long nr_unstable = global_page_state(NR_UNSTABLE_NFS);
-        long nr_to_write;
+        struct wb_writeback_args args = {
+                .sb             = sb,
+                .sync_mode      = WB_SYNC_NONE,
+        };
+        WARN_ON(!rwsem_is_locked(&sb->s_umount));
-        nr_to_write = nr_dirty + nr_unstable +
+        args.nr_pages = nr_dirty + nr_unstable +
                        (inodes_stat.nr_inodes - inodes_stat.nr_unused);
-        bdi_start_writeback(sb->s_bdi, sb, nr_to_write);
+        bdi_queue_work_onstack(&args);
 }
 EXPORT_SYMBOL(writeback_inodes_sb);
@@ -1237,7 +1186,9 @@ EXPORT_SYMBOL(writeback_inodes_sb);
 int writeback_inodes_sb_if_idle(struct super_block *sb)
 {
        if (!writeback_in_progress(sb->s_bdi)) {
+                down_read(&sb->s_umount);
                writeback_inodes_sb(sb);
+                up_read(&sb->s_umount);
                return 1;
        } else
                return 0;
@@ -1253,7 +1204,16 @@ EXPORT_SYMBOL(writeback_inodes_sb_if_idle);
 */
 void sync_inodes_sb(struct super_block *sb)
 {
-        bdi_sync_writeback(sb->s_bdi, sb);
+        struct wb_writeback_args args = {
+                .sb             = sb,
+                .sync_mode      = WB_SYNC_ALL,
+                .nr_pages       = LONG_MAX,
+                .range_cyclic   = 0,
+        };
+        WARN_ON(!rwsem_is_locked(&sb->s_umount));
+        bdi_queue_work_onstack(&args);
        wait_sb_inodes(sb);
 }
 EXPORT_SYMBOL(sync_inodes_sb);
diff --git a/fs/ocfs2/reservations.c b/fs/ocfs2/reservations.c
index 40650021fc24..d8b6e4259b80 100644
--- a/fs/ocfs2/reservations.c
+++ b/fs/ocfs2/reservations.c
@@ -26,7 +26,6 @@
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/bitops.h>
 #include <linux/list.h>
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 46d4b5d72bd3..cb6306e63843 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -122,11 +122,20 @@ int task_statm(struct mm_struct *mm, int *shared, int *text,
        return size;
 }
+static void pad_len_spaces(struct seq_file *m, int len)
+{
+        len = 25 + sizeof(void*) * 6 - len;
+        if (len < 1)
+                len = 1;
+        seq_printf(m, "%*c", len, ' ');
+}
 /*
 * display a single VMA to a sequenced file
 */
 static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
 {
+        struct mm_struct *mm = vma->vm_mm;
        unsigned long ino = 0;
        struct file *file;
        dev_t dev = 0;
@@ -155,11 +164,14 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
                   MAJOR(dev), MINOR(dev), ino, &len);
        if (file) {
-                len = 25 + sizeof(void *) * 6 - len;
+                pad_len_spaces(m, len);
-                if (len < 1)
-                        len = 1;
-                seq_printf(m, "%*c", len, ' ');
                seq_path(m, &file->f_path, "");
+        } else if (mm) {
+                if (vma->vm_start <= mm->start_stack &&
+                        vma->vm_end >= mm->start_stack) {
+                        pad_len_spaces(m, len);
+                        seq_puts(m, "[stack]");
+                }
        }
        seq_putc(m, '\n');
diff --git a/fs/super.c b/fs/super.c
index 5c35bc7a499e..938119ab8dcb 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -374,6 +374,8 @@ void sync_supers(void)
                        up_read(&sb->s_umount);
                        spin_lock(&sb_lock);
+                        /* lock was dropped, must reset next */
+                        list_safe_reset_next(sb, n, s_list);
                        __put_super(sb);
                }
        }
@@ -405,6 +407,8 @@ void iterate_supers(void (*f)(struct super_block *, void *), void *arg)
                up_read(&sb->s_umount);
                spin_lock(&sb_lock);
+                /* lock was dropped, must reset next */
+                list_safe_reset_next(sb, n, s_list);
                __put_super(sb);
        }
        spin_unlock(&sb_lock);
@@ -585,6 +589,8 @@ static void do_emergency_remount(struct work_struct *work)
                }
                up_write(&sb->s_umount);
                spin_lock(&sb_lock);
+                /* lock was dropped, must reset next */
+                list_safe_reset_next(sb, n, s_list);
                __put_super(sb);
        }
        spin_unlock(&sb_lock);
diff --git a/fs/sysv/ialloc.c b/fs/sysv/ialloc.c
index bbd69bdb0fa8..fcc498ec9b33 100644
--- a/fs/sysv/ialloc.c
+++ b/fs/sysv/ialloc.c
@@ -25,6 +25,7 @@
 #include <linux/stat.h>
 #include <linux/string.h>
 #include <linux/buffer_head.h>
+#include <linux/writeback.h>
 #include "sysv.h"
 /* We don't trust the value of
@@ -139,6 +140,9 @@ struct inode * sysv_new_inode(const struct inode * dir, mode_t mode)
        struct inode *inode;
        sysv_ino_t ino;
        unsigned count;
+        struct writeback_control wbc = {
+                .sync_mode = WB_SYNC_NONE
+        };
        inode = new_inode(sb);
        if (!inode)
@@ -168,7 +172,7 @@ struct inode * sysv_new_inode(const struct inode * dir, mode_t mode)
        insert_inode_hash(inode);
        mark_inode_dirty(inode);
-        sysv_write_inode(inode, 0);     /* ensure inode not allocated again */
+        sysv_write_inode(inode, &wbc);  /* ensure inode not allocated again */
        mark_inode_dirty(inode);        /* cleared by sysv_write_inode() */
        /* That's it. */
        unlock_super(sb);
diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
index 076ca50e9933..c8ff0d1ae5d3 100644
--- a/fs/ubifs/budget.c
+++ b/fs/ubifs/budget.c
@@ -62,7 +62,9 @@
 */
 static void shrink_liability(struct ubifs_info *c, int nr_to_write)
 {
+        down_read(&c->vfs_sb->s_umount);
        writeback_inodes_sb(c->vfs_sb);
+        up_read(&c->vfs_sb->s_umount);
 }
 /**
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index aee5f6ce166e..9ae2889096b6 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -105,8 +105,8 @@ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
 int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
 void bdi_unregister(struct backing_dev_info *bdi);
 int bdi_setup_and_register(struct backing_dev_info *, char *, unsigned int);
-void bdi_start_writeback(struct backing_dev_info *bdi, struct super_block *sb,
+void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages);
-                                long nr_pages);
+void bdi_start_background_writeback(struct backing_dev_info *bdi);
 int bdi_writeback_task(struct bdi_writeback *wb);
 int bdi_has_dirty_io(struct backing_dev_info *bdi);
 void bdi_arm_supers_timer(void);
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 0c621604baa1..e3d00fdb858d 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -525,13 +525,21 @@ static inline struct cgroup_subsys_state *cgroup_subsys_state(
        return cgrp->subsys[subsys_id];
 }
-static inline struct cgroup_subsys_state *task_subsys_state(
+/*
-        struct task_struct *task, int subsys_id)
+ * function to get the cgroup_subsys_state which allows for extra
+ * rcu_dereference_check() conditions, such as locks used during the
+ * cgroup_subsys::attach() methods.
+ */
+#define task_subsys_state_check(task, subsys_id, __c)                   \
+        rcu_dereference_check(task->cgroups->subsys[subsys_id],         \
+                              rcu_read_lock_held() ||                   \
+                              lockdep_is_held(&task->alloc_lock) ||     \
+                              cgroup_lock_is_held() || (__c))
+static inline struct cgroup_subsys_state *
+task_subsys_state(struct task_struct *task, int subsys_id)
 {
-        return rcu_dereference_check(task->cgroups->subsys[subsys_id],
+        return task_subsys_state_check(task, subsys_id, false);
-                                     rcu_read_lock_held() ||
-                                     lockdep_is_held(&task->alloc_lock) ||
-                                     cgroup_lock_is_held());
 }
 static inline struct cgroup* task_cgroup(struct task_struct *task,
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 73dcf804bc94..0da5b187f124 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -58,8 +58,12 @@
 * naked functions because then mcount is called without stack and frame pointer
 * being set up and there is no chance to restore the lr register to the value
 * before mcount was called.
+ *
+ * The asm() bodies of naked functions often depend on standard calling conventions,
+ * therefore they must be noinline and noclone.  GCC 4.[56] currently fail to enforce
+ * this, so we must do so ourselves.  See GCC PR44290.
 */
-#define __naked                         __attribute__((naked)) notrace
+#define __naked                         __attribute__((naked)) noinline __noclone notrace
 #define __noreturn                      __attribute__((noreturn))
@@ -85,3 +89,7 @@
 #define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h)
 #define gcc_header(x) _gcc_header(x)
 #include gcc_header(__GNUC__)
+#if !defined(__noclone)
+#define __noclone       /* not needed */
+#endif
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 94dea3ffbfa1..fcfa5b9a4317 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -48,6 +48,10 @@
 * unreleased.  Really, we need to have autoconf for the kernel.
 */
 #define unreachable() __builtin_unreachable()
+/* Mark a function definition as prohibited from being cloned. */
+#define __noclone       __attribute__((__noclone__))
 #endif
 #endif
diff --git a/include/linux/drbd.h b/include/linux/drbd.h
index 30da4ae48972..b8d2516668aa 100644
--- a/include/linux/drbd.h
+++ b/include/linux/drbd.h
@@ -53,7 +53,7 @@
 extern const char *drbd_buildtag(void);
-#define REL_VERSION "8.3.8rc2"
+#define REL_VERSION "8.3.8"
 #define API_VERSION 88
 #define PRO_VERSION_MIN 86
 #define PRO_VERSION_MAX 94
diff --git a/include/linux/list.h b/include/linux/list.h
index 8392884a2977..5d57a3a1fa1b 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -544,6 +544,21 @@ static inline void list_splice_tail_init(struct list_head *list,
             &pos->member != (head);                                    \
             pos = n, n = list_entry(n->member.prev, typeof(*n), member))
+/**
+ * list_safe_reset_next - reset a stale list_for_each_entry_safe loop
+ * @pos:        the loop cursor used in the list_for_each_entry_safe loop
+ * @n:          temporary storage used in list_for_each_entry_safe
+ * @member:     the name of the list_struct within the struct.
+ *
+ * list_safe_reset_next is not safe to use in general if the list may be
+ * modified concurrently (eg. the lock is dropped in the loop body). An
+ * exception to this is if the cursor element (pos) is pinned in the list,
+ * and list_safe_reset_next is called after re-taking the lock and before
+ * completing the current iteration of the loop body.
+ */
+#define list_safe_reset_next(pos, n, member)                            \
+        n = list_entry(pos->member.next, typeof(*pos), member)
 /*
 * Double linked lists with a single pointer list head.
 * Mostly useful for hash tables where the two pointer list head is
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 9a59d1f98cd4..103d1b61aacb 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -14,6 +14,7 @@
 * See the file COPYING for more details.
 */
+#include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/rcupdate.h>
diff --git a/kernel/futex.c b/kernel/futex.c
index e7a35f1039e7..6a3a5fa1526d 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -429,20 +429,11 @@ static void free_pi_state(struct futex_pi_state *pi_state)
 static struct task_struct * futex_find_get_task(pid_t pid)
 {
        struct task_struct *p;
-        const struct cred *cred = current_cred(), *pcred;
        rcu_read_lock();
        p = find_task_by_vpid(pid);
-        if (!p) {
+        if (p)
-                p = ERR_PTR(-ESRCH);
+                get_task_struct(p);
-        } else {
-                pcred = __task_cred(p);
-                if (cred->euid != pcred->euid &&
-                    cred->euid != pcred->uid)
-                        p = ERR_PTR(-ESRCH);
-                else
-                        get_task_struct(p);
-        }
        rcu_read_unlock();
@@ -564,8 +555,8 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
        if (!pid)
                return -ESRCH;
        p = futex_find_get_task(pid);
-        if (IS_ERR(p))
+        if (!p)
-                return PTR_ERR(p);
+                return -ESRCH;
        /*
         * We need to look at the task state flags to figure out,
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 3164ba7ce151..e1497481fe8a 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -456,6 +456,9 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
                /* note that IRQF_TRIGGER_MASK == IRQ_TYPE_SENSE_MASK */
                desc->status &= ~(IRQ_LEVEL | IRQ_TYPE_SENSE_MASK);
                desc->status |= flags;
+                if (chip != desc->chip)
+                        irq_chip_set_defaults(desc->chip);
        }
        return ret;
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 474a84715eac..131b1703936f 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1089,9 +1089,10 @@ void crash_kexec(struct pt_regs *regs)
 size_t crash_get_memory_size(void)
 {
-        size_t size;
+        size_t size = 0;
        mutex_lock(&kexec_mutex);
-        size = crashk_res.end - crashk_res.start + 1;
+        if (crashk_res.end != crashk_res.start)
+                size = crashk_res.end - crashk_res.start + 1;
        mutex_unlock(&kexec_mutex);
        return size;
 }
@@ -1134,7 +1135,7 @@ int crash_shrink_memory(unsigned long new_size)
        free_reserved_phys_range(end, crashk_res.end);
-        if (start == end)
+        if ((start == end) && (crashk_res.parent != NULL))
                release_resource(&crashk_res);
        crashk_res.end = end - 1;
diff --git a/kernel/sched.c b/kernel/sched.c
index f8b8996228dd..cb816e36cc8b 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -306,52 +306,6 @@ static int init_task_group_load = INIT_TASK_GROUP_LOAD;
 */
 struct task_group init_task_group;
-/* return group to which a task belongs */
-static inline struct task_group *task_group(struct task_struct *p)
-{
-        struct task_group *tg;
-#ifdef CONFIG_CGROUP_SCHED
-        tg = container_of(task_subsys_state(p, cpu_cgroup_subsys_id),
-                                struct task_group, css);
-#else
-        tg = &init_task_group;
-#endif
-        return tg;
-}
-/* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
-static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
-{
-        /*
-         * Strictly speaking this rcu_read_lock() is not needed since the
-         * task_group is tied to the cgroup, which in turn can never go away
-         * as long as there are tasks attached to it.
-         *
-         * However since task_group() uses task_subsys_state() which is an
-         * rcu_dereference() user, this quiets CONFIG_PROVE_RCU.
-         */
-        rcu_read_lock();
-#ifdef CONFIG_FAIR_GROUP_SCHED
-        p->se.cfs_rq = task_group(p)->cfs_rq[cpu];
-        p->se.parent = task_group(p)->se[cpu];
-#endif
-#ifdef CONFIG_RT_GROUP_SCHED
-        p->rt.rt_rq  = task_group(p)->rt_rq[cpu];
-        p->rt.parent = task_group(p)->rt_se[cpu];
-#endif
-        rcu_read_unlock();
-}
-#else
-static inline void set_task_rq(struct task_struct *p, unsigned int cpu) { }
-static inline struct task_group *task_group(struct task_struct *p)
-{
-        return NULL;
-}
 #endif  /* CONFIG_CGROUP_SCHED */
 /* CFS-related fields in a runqueue */
@@ -644,6 +598,49 @@ static inline int cpu_of(struct rq *rq)
 #define cpu_curr(cpu)           (cpu_rq(cpu)->curr)
 #define raw_rq()                (&__raw_get_cpu_var(runqueues))
+#ifdef CONFIG_CGROUP_SCHED
+/*
+ * Return the group to which this tasks belongs.
+ *
+ * We use task_subsys_state_check() and extend the RCU verification
+ * with lockdep_is_held(&task_rq(p)->lock) because cpu_cgroup_attach()
+ * holds that lock for each task it moves into the cgroup. Therefore
+ * by holding that lock, we pin the task to the current cgroup.
+ */
+static inline struct task_group *task_group(struct task_struct *p)
+{
+        struct cgroup_subsys_state *css;
+        css = task_subsys_state_check(p, cpu_cgroup_subsys_id,
+                        lockdep_is_held(&task_rq(p)->lock));
+        return container_of(css, struct task_group, css);
+}
+/* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
+static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
+{
+#ifdef CONFIG_FAIR_GROUP_SCHED
+        p->se.cfs_rq = task_group(p)->cfs_rq[cpu];
+        p->se.parent = task_group(p)->se[cpu];
+#endif
+#ifdef CONFIG_RT_GROUP_SCHED
+        p->rt.rt_rq  = task_group(p)->rt_rq[cpu];
+        p->rt.parent = task_group(p)->rt_se[cpu];
+#endif
+}
+#else /* CONFIG_CGROUP_SCHED */
+static inline void set_task_rq(struct task_struct *p, unsigned int cpu) { }
+static inline struct task_group *task_group(struct task_struct *p)
+{
+        return NULL;
+}
+#endif /* CONFIG_CGROUP_SCHED */
 inline void update_rq_clock(struct rq *rq)
 {
        if (!rq->skip_clock_update)
@@ -1257,6 +1254,12 @@ static void sched_avg_update(struct rq *rq)
        s64 period = sched_avg_period();
        while ((s64)(rq->clock - rq->age_stamp) > period) {
+                /*
+                 * Inline assembly required to prevent the compiler
+                 * optimising this loop into a divmod call.
+                 * See __iter_div_u64_rem() for another example of this.
+                 */
+                asm("" : "+rm" (rq->age_stamp));
                rq->age_stamp += period;
                rq->rt_avg /= 2;
        }
@@ -1660,9 +1663,6 @@ static void update_shares(struct sched_domain *sd)
 static void update_h_load(long cpu)
 {
-        if (root_task_group_empty())
-                return;
        walk_tg_tree(tg_load_down, tg_nop, (void *)cpu);
 }
@@ -2494,7 +2494,16 @@ void sched_fork(struct task_struct *p, int clone_flags)
        if (p->sched_class->task_fork)
                p->sched_class->task_fork(p);
+        /*
+         * The child is not yet in the pid-hash so no cgroup attach races,
+         * and the cgroup is pinned to this child due to cgroup_fork()
+         * is ran before sched_fork().
+         *
+         * Silence PROVE_RCU.
+         */
+        rcu_read_lock();
        set_task_cpu(p, cpu);
+        rcu_read_unlock();
 #if defined(CONFIG_SCHEDSTATS) || defined(CONFIG_TASK_DELAY_ACCT)
        if (likely(sched_info_on()))
@@ -4465,16 +4474,6 @@ recheck:
        }
        if (user) {
-#ifdef CONFIG_RT_GROUP_SCHED
-                /*
-                 * Do not allow realtime tasks into groups that have no runtime
-                 * assigned.
-                 */
-                if (rt_bandwidth_enabled() && rt_policy(policy) &&
-                                task_group(p)->rt_bandwidth.rt_runtime == 0)
-                        return -EPERM;
-#endif
                retval = security_task_setscheduler(p, policy, param);
                if (retval)
                        return retval;
@@ -4490,6 +4489,22 @@ recheck:
         * runqueue lock must be held.
         */
        rq = __task_rq_lock(p);
+#ifdef CONFIG_RT_GROUP_SCHED
+        if (user) {
+                /*
+                 * Do not allow realtime tasks into groups that have no runtime
+                 * assigned.
+                 */
+                if (rt_bandwidth_enabled() && rt_policy(policy) &&
+                                task_group(p)->rt_bandwidth.rt_runtime == 0) {
+                        __task_rq_unlock(rq);
+                        raw_spin_unlock_irqrestore(&p->pi_lock, flags);
+                        return -EPERM;
+                }
+        }
+#endif
        /* recheck policy now with rq lock held */
        if (unlikely(oldpolicy != -1 && oldpolicy != p->policy)) {
                policy = oldpolicy = -1;
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index eed35eded602..a878b5332daa 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -1240,6 +1240,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
         * effect of the currently running task from the load
         * of the current CPU:
         */
+        rcu_read_lock();
        if (sync) {
                tg = task_group(current);
                weight = current->se.load.weight;
@@ -1275,6 +1276,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
                balanced = this_eff_load <= prev_eff_load;
        } else
                balanced = true;
+        rcu_read_unlock();
        /*
         * If the currently running task will sleep within
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 1d7b9bc1c034..783fbadf2202 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -315,9 +315,6 @@ void tick_nohz_stop_sched_tick(int inidle)
                goto end;
        }
-        if (nohz_ratelimit(cpu))
-                goto end;
        ts->idle_calls++;
        /* Read jiffies and the time when jiffies were updated last */
        do {
@@ -328,7 +325,7 @@ void tick_nohz_stop_sched_tick(int inidle)
        } while (read_seqretry(&xtime_lock, seq));
        if (rcu_needs_cpu(cpu) || printk_needs_cpu(cpu) ||
-            arch_needs_cpu(cpu)) {
+            arch_needs_cpu(cpu) || nohz_ratelimit(cpu)) {
                next_jiffies = last_jiffies + 1;
                delta_jiffies = 1;
        } else {
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index e6f65887842c..8a2b73f7c068 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -96,7 +96,9 @@ int perf_trace_init(struct perf_event *p_event)
        mutex_lock(&event_mutex);
        list_for_each_entry(tp_event, &ftrace_events, list) {
                if (tp_event->event.type == event_id &&
-                    tp_event->class && tp_event->class->perf_probe &&
+                    tp_event->class &&
+                    (tp_event->class->perf_probe ||
+                     tp_event->class->reg) &&
                    try_module_get(tp_event->mod)) {
                        ret = perf_trace_event_init(tp_event, p_event);
                        break;
diff --git a/lib/genalloc.c b/lib/genalloc.c
index 736c3b06398e..1923f1490e72 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -128,7 +128,6 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
                chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
                end_bit = (chunk->end_addr - chunk->start_addr) >> order;
-                end_bit -= nbits + 1;
                spin_lock_irqsave(&chunk->lock, flags);
                start_bit = bitmap_find_next_zero_area(chunk->bits, end_bit, 0,
diff --git a/lib/idr.c b/lib/idr.c
index c1a206901761..7f1a4f0acf50 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -602,7 +602,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
        /* find first ent */
        n = idp->layers * IDR_BITS;
        max = 1 << n;
-        p = rcu_dereference(idp->top);
+        p = rcu_dereference_raw(idp->top);
        if (!p)
                return NULL;
@@ -610,7 +610,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
                while (n > 0 && p) {
                        n -= IDR_BITS;
                        *paa++ = p;
-                        p = rcu_dereference(p->ary[(id >> n) & IDR_MASK]);
+                        p = rcu_dereference_raw(p->ary[(id >> n) & IDR_MASK]);
                }
                if (p) {
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c6ece0a57595..20a8193a7af8 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1370,7 +1370,7 @@ static void memcg_wakeup_oom(struct mem_cgroup *mem)
 static void memcg_oom_recover(struct mem_cgroup *mem)
 {
-        if (mem->oom_kill_disable && atomic_read(&mem->oom_lock))
+        if (atomic_read(&mem->oom_lock))
                memcg_wakeup_oom(mem);
 }
@@ -3781,6 +3781,8 @@ static int mem_cgroup_oom_control_write(struct cgroup *cgrp,
                return -EINVAL;
        }
        mem->oom_kill_disable = val;
+        if (!val)
+                memcg_oom_recover(mem);
        cgroup_unlock();
        return 0;
 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 5d6fb339de03..5bc0a96beb51 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2094,7 +2094,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                NODEMASK_SCRATCH(scratch);
                if (!scratch)
-                        return;
+                        goto put_mpol;
                /* contextualize the tmpfs mount point mempolicy */
                new = mpol_new(mpol->mode, mpol->flags, &mpol->w.user_nodemask);
                if (IS_ERR(new))
@@ -2103,19 +2103,20 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                task_lock(current);
                ret = mpol_set_nodemask(new, &mpol->w.user_nodemask, scratch);
                task_unlock(current);
-                mpol_put(mpol); /* drop our ref on sb mpol */
                if (ret)
-                        goto put_free;
+                        goto put_new;
                /* Create pseudo-vma that contains just the policy */
                memset(&pvma, 0, sizeof(struct vm_area_struct));
                pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
-put_free:
+put_new:
                mpol_put(new);                  /* drop initial ref */
 free_scratch:
                NODEMASK_SCRATCH_FREE(scratch);
+put_mpol:
+                mpol_put(mpol); /* drop our incoming ref on sb mpol */
        }
 }
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index bbd396ac9546..54f28bd493d3 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -597,7 +597,7 @@ static void balance_dirty_pages(struct address_space *mapping,
            (!laptop_mode && ((global_page_state(NR_FILE_DIRTY)
                               + global_page_state(NR_UNSTABLE_NFS))
                                          > background_thresh)))
-                bdi_start_writeback(bdi, NULL, 0);
+                bdi_start_background_writeback(bdi);
 }
 void set_page_dirty_balance(struct page *page, int page_mkwrite)
@@ -705,9 +705,8 @@ void laptop_mode_timer_fn(unsigned long data)
         * We want to write everything out, not just down to the dirty
         * threshold
         */
        if (bdi_has_dirty_io(&q->backing_dev_info))
-                bdi_start_writeback(&q->backing_dev_info, NULL, nr_pages);
+                bdi_start_writeback(&q->backing_dev_info, nr_pages);
 }
 /*
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index dc3435e18bde..711745f56bba 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -193,7 +193,7 @@ static void sig_handler(int sig)
 static void sig_atexit(void)
 {
-        if (child_pid != -1)
+        if (child_pid > 0)
                kill(child_pid, SIGTERM);
        if (signr == -1)
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 1f08f008d289..2fbf6a463c81 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -538,8 +538,10 @@ int event__process_task(event_t *self, struct perf_session *session)
        dump_printf("(%d:%d):(%d:%d)\n", self->fork.pid, self->fork.tid,
                    self->fork.ppid, self->fork.ptid);
-        if (self->header.type == PERF_RECORD_EXIT)
+        if (self->header.type == PERF_RECORD_EXIT) {
+                perf_session__remove_thread(session, thread);
                return 0;
+        }
        if (thread == NULL || parent == NULL ||
            thread__fork(thread, parent) < 0) {
diff --git a/tools/perf/util/newt.c b/tools/perf/util/newt.c
index cf182ca132fe..7537ca15900b 100644
--- a/tools/perf/util/newt.c
+++ b/tools/perf/util/newt.c
@@ -43,6 +43,9 @@ struct ui_progress *ui_progress__new(const char *title, u64 total)
        if (self != NULL) {
                int cols;
+                if (use_browser <= 0)   
+                        return self;
                newtGetScreenSize(&cols, NULL);
                cols -= 4;
                newtCenteredWindow(cols, 1, title);
@@ -67,14 +70,22 @@ out_free_self:
 void ui_progress__update(struct ui_progress *self, u64 curr)
 {
+        /*
+         * FIXME: We should have a per UI backend way of showing progress,
+         * stdio will just show a percentage as NN%, etc.
+         */
+        if (use_browser <= 0)
+                return;
        newtScaleSet(self->scale, curr);
        newtRefresh();
 }
 void ui_progress__delete(struct ui_progress *self)
 {
-        newtFormDestroy(self->form);
+        if (use_browser > 0) {
-        newtPopWindow();
+                newtFormDestroy(self->form);
+                newtPopWindow();
+        }
        free(self);
 }
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 8f83a1835766..c422cd676313 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -90,6 +90,7 @@ struct perf_session *perf_session__new(const char *filename, int mode, bool forc
        memcpy(self->filename, filename, len);
        self->threads = RB_ROOT;
+        INIT_LIST_HEAD(&self->dead_threads);
        self->hists_tree = RB_ROOT;
        self->last_match = NULL;
        self->mmap_window = 32;
@@ -131,6 +132,16 @@ void perf_session__delete(struct perf_session *self)
        free(self);
 }
+void perf_session__remove_thread(struct perf_session *self, struct thread *th)
+{
+        rb_erase(&th->rb_node, &self->threads);
+        /*
+         * We may have references to this thread, for instance in some hist_entry
+         * instances, so just move them to a separate list.
+         */
+        list_add_tail(&th->node, &self->dead_threads);
+}
 static bool symbol__match_parent_regex(struct symbol *sym)
 {
        if (sym->name && !regexec(&parent_regex, sym->name, 0, NULL, 0))
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 55c6881b218d..9fa0fc2a863f 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -26,6 +26,7 @@ struct perf_session {
        unsigned long           size;
        unsigned long           mmap_window;
        struct rb_root          threads;
+        struct list_head        dead_threads;
        struct thread           *last_match;
        struct machine          host_machine;
        struct rb_root          machines;
@@ -99,6 +100,7 @@ int perf_session__create_kernel_maps(struct perf_session *self);
 int do_read(int fd, void *buf, size_t size);
 void perf_session__update_sample_type(struct perf_session *self);
+void perf_session__remove_thread(struct perf_session *self, struct thread *th);
 static inline
 struct machine *perf_session__find_host_machine(struct perf_session *self)
diff --git a/tools/perf/util/thread.h b/tools/perf/util/thread.h
index 1dfd9ff8bdcd..ee6bbcf277ca 100644
--- a/tools/perf/util/thread.h
+++ b/tools/perf/util/thread.h
@@ -6,7 +6,10 @@
 #include "symbol.h"
 struct thread {
-        struct rb_node          rb_node;
+        union {
+                struct rb_node   rb_node;
+                struct list_head node;
+        };
        struct map_groups       mg;
        pid_t                   pid;
        char                    shortname[3];