From 22f427b623553f572dfdfa2a7159312fcaba66b8 Mon Sep 17 00:00:00 2001
From: Doug Chapman <doug.chapman@hp.com>
Date: Wed, 13 May 2009 02:56:39 +0100
Subject: [PATCH] --- yaml --- r: 144913 b: refs/heads/master c:
 a37b06d589f2c687a38d07569f4ef97c650fde39 h: refs/heads/master i:   144911:
 f18166359655ab326511d0766b5699c6898634eb v: v3

---
 [refs]                                        |   2 +-
 trunk/arch/alpha/include/asm/percpu.h         |  26 +-
 trunk/arch/x86/kvm/svm.c                      |   8 +-
 trunk/arch/x86/kvm/x86.c                      |   6 +-
 trunk/drivers/dma/dmaengine.c                 |  17 +-
 trunk/drivers/dma/dmatest.c                   |   4 +-
 trunk/drivers/dma/ioat_dma.c                  |  45 ++-
 trunk/drivers/dma/ipu/ipu_idmac.c             |   7 +-
 trunk/drivers/gpu/drm/Kconfig                 |   1 -
 trunk/drivers/hid/hid-ids.h                   |   5 -
 trunk/drivers/hid/usbhid/hid-core.c           |   2 +-
 trunk/drivers/hid/usbhid/hid-quirks.c         |   3 -
 trunk/drivers/i2c/busses/Kconfig              |   2 +-
 trunk/drivers/i2c/busses/i2c-cpm.c            |  16 +-
 trunk/drivers/i2c/busses/i2c-mpc.c            |  34 +--
 trunk/drivers/i2c/busses/i2c-pxa.c            |   6 +-
 trunk/drivers/infiniband/hw/cxgb3/cxio_hal.c  |   1 -
 trunk/drivers/infiniband/hw/mlx4/mlx4_ib.h    |   1 -
 trunk/drivers/infiniband/hw/mlx4/mr.c         |  10 +-
 trunk/drivers/infiniband/hw/mlx4/qp.c         |   2 +-
 trunk/drivers/input/ff-memless.c              |   2 +-
 trunk/drivers/input/joydev.c                  |   8 +-
 trunk/drivers/input/keyboard/atkbd.c          |  16 -
 trunk/drivers/input/touchscreen/tsc2007.c     |   5 +-
 trunk/drivers/net/mlx4/en_rx.c                |   1 +
 trunk/drivers/rtc/rtc-twl4030.c               |   4 +-
 trunk/drivers/spi/pxa2xx_spi.c                |   3 -
 trunk/drivers/video/Kconfig                   |  23 +-
 trunk/drivers/video/via/viafbdev.c            |   6 +-
 trunk/fs/eventpoll.c                          |   2 +-
 trunk/fs/fuse/inode.c                         |   1 -
 trunk/fs/hugetlbfs/inode.c                    |  11 +
 trunk/fs/lockd/svc.c                          |  15 +-
 trunk/fs/nfsd/nfs4recover.c                   |   4 +-
 trunk/fs/nfsd/nfs4state.c                     |   1 +
 trunk/fs/nfsd/nfs4xdr.c                       |  16 +-
 trunk/fs/nilfs2/ioctl.c                       | 281 +++++++++---------
 trunk/fs/nilfs2/mdt.c                         |  15 +-
 trunk/fs/nilfs2/nilfs.h                       |   3 +-
 trunk/fs/nilfs2/page.c                        |   3 +-
 trunk/fs/nilfs2/recovery.c                    |   6 +-
 trunk/fs/nilfs2/segment.c                     |   5 +-
 trunk/fs/nilfs2/segment.h                     |   3 +-
 trunk/fs/squashfs/cache.c                     |   1 +
 trunk/include/linux/dmaengine.h               |   6 -
 trunk/include/linux/syscalls.h                |   1 -
 trunk/mm/madvise.c                            |   8 +
 trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c |   2 +-
 trunk/net/sunrpc/xprtrdma/svc_rdma_sendto.c   |   3 -
 .../net/sunrpc/xprtrdma/svc_rdma_transport.c  |   3 +-
 50 files changed, 277 insertions(+), 379 deletions(-)

diff --git a/[refs] b/[refs]
index 6e43b94752ac..e8c2a109b119 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a6aeeebf5179ea6346249d727bdb9124ce9e2d4c
+refs/heads/master: a37b06d589f2c687a38d07569f4ef97c650fde39
diff --git a/trunk/arch/alpha/include/asm/percpu.h b/trunk/arch/alpha/include/asm/percpu.h
index 06c5c7a4afd3..e9e0bb5a23bf 100644
--- a/trunk/arch/alpha/include/asm/percpu.h
+++ b/trunk/arch/alpha/include/asm/percpu.h
@@ -1,9 +1,7 @@
 #ifndef __ALPHA_PERCPU_H
 #define __ALPHA_PERCPU_H
-
 #include <linux/compiler.h>
 #include <linux/threads.h>
-#include <linux/percpu-defs.h>
 
 /*
  * Determine the real variable name from the name visible in the
@@ -75,28 +73,6 @@ extern unsigned long __per_cpu_offset[NR_CPUS];
 
 #endif /* SMP */
 
-#ifdef CONFIG_SMP
-#define PER_CPU_BASE_SECTION ".data.percpu"
-#else
-#define PER_CPU_BASE_SECTION ".data"
-#endif
-
-#ifdef CONFIG_SMP
-
-#ifdef MODULE
-#define PER_CPU_SHARED_ALIGNED_SECTION ""
-#else
-#define PER_CPU_SHARED_ALIGNED_SECTION ".shared_aligned"
-#endif
-#define PER_CPU_FIRST_SECTION ".first"
-
-#else
-
-#define PER_CPU_SHARED_ALIGNED_SECTION ""
-#define PER_CPU_FIRST_SECTION ""
-
-#endif
-
-#define PER_CPU_ATTRIBUTES
+#include <asm-generic/percpu.h>
 
 #endif /* __ALPHA_PERCPU_H */
diff --git a/trunk/arch/x86/kvm/svm.c b/trunk/arch/x86/kvm/svm.c
index 1f8510c51d6e..1821c2078199 100644
--- a/trunk/arch/x86/kvm/svm.c
+++ b/trunk/arch/x86/kvm/svm.c
@@ -411,6 +411,7 @@ static __init int svm_hardware_setup(void)
 
 	iopm_va = page_address(iopm_pages);
 	memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
+	clear_bit(0x80, iopm_va); /* allow direct access to PC debug port */
 	iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;
 
 	if (boot_cpu_has(X86_FEATURE_NX))
@@ -795,11 +796,6 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
 	var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
 	var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
 
-	/* AMD's VMCB does not have an explicit unusable field, so emulate it
-	 * for cross vendor migration purposes by "not present"
-	 */
-	var->unusable = !var->present || (var->type == 0);
-
 	switch (seg) {
 	case VCPU_SREG_CS:
 		/*
@@ -831,6 +827,8 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
 			var->type |= 0x1;
 		break;
 	}
+
+	var->unusable = !var->present;
 }
 
 static int svm_get_cpl(struct kvm_vcpu *vcpu)
diff --git a/trunk/arch/x86/kvm/x86.c b/trunk/arch/x86/kvm/x86.c
index 49079a46687b..7c1ce5ac6131 100644
--- a/trunk/arch/x86/kvm/x86.c
+++ b/trunk/arch/x86/kvm/x86.c
@@ -1121,9 +1121,9 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 
 static int is_efer_nx(void)
 {
-	unsigned long long efer = 0;
+	u64 efer;
 
-	rdmsrl_safe(MSR_EFER, &efer);
+	rdmsrl(MSR_EFER, efer);
 	return efer & EFER_NX;
 }
 
@@ -1259,7 +1259,7 @@ static void do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
 		bit(X86_FEATURE_CMOV) | bit(X86_FEATURE_PSE36) |
 		bit(X86_FEATURE_MMX) | bit(X86_FEATURE_FXSR) |
 		bit(X86_FEATURE_SYSCALL) |
-		(is_efer_nx() ? bit(X86_FEATURE_NX) : 0) |
+		(bit(X86_FEATURE_NX) && is_efer_nx()) |
 #ifdef CONFIG_X86_64
 		bit(X86_FEATURE_LM) |
 #endif
diff --git a/trunk/drivers/dma/dmaengine.c b/trunk/drivers/dma/dmaengine.c
index 5a87384ea4ff..92438e9dacc3 100644
--- a/trunk/drivers/dma/dmaengine.c
+++ b/trunk/drivers/dma/dmaengine.c
@@ -804,14 +804,11 @@ dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
 	dma_addr_t dma_dest, dma_src;
 	dma_cookie_t cookie;
 	int cpu;
-	unsigned long flags;
 
 	dma_src = dma_map_single(dev->dev, src, len, DMA_TO_DEVICE);
 	dma_dest = dma_map_single(dev->dev, dest, len, DMA_FROM_DEVICE);
-	flags = DMA_CTRL_ACK |
-		DMA_COMPL_SRC_UNMAP_SINGLE |
-		DMA_COMPL_DEST_UNMAP_SINGLE;
-	tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
+	tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
+					 DMA_CTRL_ACK);
 
 	if (!tx) {
 		dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -853,12 +850,11 @@ dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
 	dma_addr_t dma_dest, dma_src;
 	dma_cookie_t cookie;
 	int cpu;
-	unsigned long flags;
 
 	dma_src = dma_map_single(dev->dev, kdata, len, DMA_TO_DEVICE);
 	dma_dest = dma_map_page(dev->dev, page, offset, len, DMA_FROM_DEVICE);
-	flags = DMA_CTRL_ACK | DMA_COMPL_SRC_UNMAP_SINGLE;
-	tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
+	tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
+					 DMA_CTRL_ACK);
 
 	if (!tx) {
 		dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -902,13 +898,12 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
 	dma_addr_t dma_dest, dma_src;
 	dma_cookie_t cookie;
 	int cpu;
-	unsigned long flags;
 
 	dma_src = dma_map_page(dev->dev, src_pg, src_off, len, DMA_TO_DEVICE);
 	dma_dest = dma_map_page(dev->dev, dest_pg, dest_off, len,
 				DMA_FROM_DEVICE);
-	flags = DMA_CTRL_ACK;
-	tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
+	tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
+					 DMA_CTRL_ACK);
 
 	if (!tx) {
 		dma_unmap_page(dev->dev, dma_src, len, DMA_TO_DEVICE);
diff --git a/trunk/drivers/dma/dmatest.c b/trunk/drivers/dma/dmatest.c
index fb7da5141e96..a27c0fb1bc11 100644
--- a/trunk/drivers/dma/dmatest.c
+++ b/trunk/drivers/dma/dmatest.c
@@ -531,7 +531,9 @@ static int __init dmatest_init(void)
 		chan = dma_request_channel(mask, filter, NULL);
 		if (chan) {
 			err = dmatest_add_channel(chan);
-			if (err) {
+			if (err == 0)
+				continue;
+			else {
 				dma_release_channel(chan);
 				break; /* add_channel failed, punt */
 			}
diff --git a/trunk/drivers/dma/ioat_dma.c b/trunk/drivers/dma/ioat_dma.c
index 1955ee8d6d20..e4fc33c1c32f 100644
--- a/trunk/drivers/dma/ioat_dma.c
+++ b/trunk/drivers/dma/ioat_dma.c
@@ -1063,31 +1063,22 @@ static void ioat_dma_cleanup_tasklet(unsigned long data)
 static void
 ioat_dma_unmap(struct ioat_dma_chan *ioat_chan, struct ioat_desc_sw *desc)
 {
-	if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-		if (desc->async_tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-			pci_unmap_single(ioat_chan->device->pdev,
-					 pci_unmap_addr(desc, dst),
-					 pci_unmap_len(desc, len),
-					 PCI_DMA_FROMDEVICE);
-		else
-			pci_unmap_page(ioat_chan->device->pdev,
-				       pci_unmap_addr(desc, dst),
-				       pci_unmap_len(desc, len),
-				       PCI_DMA_FROMDEVICE);
-	}
-
-	if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-		if (desc->async_tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-			pci_unmap_single(ioat_chan->device->pdev,
-					 pci_unmap_addr(desc, src),
-					 pci_unmap_len(desc, len),
-					 PCI_DMA_TODEVICE);
-		else
-			pci_unmap_page(ioat_chan->device->pdev,
-				       pci_unmap_addr(desc, src),
-				       pci_unmap_len(desc, len),
-				       PCI_DMA_TODEVICE);
-	}
+	/*
+	 * yes we are unmapping both _page and _single
+	 * alloc'd regions with unmap_page. Is this
+	 * *really* that bad?
+	 */
+	if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP))
+		pci_unmap_page(ioat_chan->device->pdev,
+				pci_unmap_addr(desc, dst),
+				pci_unmap_len(desc, len),
+				PCI_DMA_FROMDEVICE);
+
+	if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP))
+		pci_unmap_page(ioat_chan->device->pdev,
+				pci_unmap_addr(desc, src),
+				pci_unmap_len(desc, len),
+				PCI_DMA_TODEVICE);
 }
 
 /**
@@ -1372,7 +1363,6 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
 	int err = 0;
 	struct completion cmp;
 	unsigned long tmo;
-	unsigned long flags;
 
 	src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
 	if (!src)
@@ -1402,9 +1392,8 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
 				 DMA_TO_DEVICE);
 	dma_dest = dma_map_single(dma_chan->device->dev, dest, IOAT_TEST_SIZE,
 				  DMA_FROM_DEVICE);
-	flags = DMA_COMPL_SRC_UNMAP_SINGLE | DMA_COMPL_DEST_UNMAP_SINGLE;
 	tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
-						   IOAT_TEST_SIZE, flags);
+						   IOAT_TEST_SIZE, 0);
 	if (!tx) {
 		dev_err(&device->pdev->dev,
 			"Self-test prep failed, disabling\n");
diff --git a/trunk/drivers/dma/ipu/ipu_idmac.c b/trunk/drivers/dma/ipu/ipu_idmac.c
index 9a5bc1a7389e..e202a6ce5573 100644
--- a/trunk/drivers/dma/ipu/ipu_idmac.c
+++ b/trunk/drivers/dma/ipu/ipu_idmac.c
@@ -1272,8 +1272,7 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
 	/* Other interrupts do not interfere with this channel */
 	spin_lock(&ichan->lock);
 	if (unlikely(chan_id != IDMAC_SDC_0 && chan_id != IDMAC_SDC_1 &&
-		     ((curbuf >> chan_id) & 1) == ichan->active_buffer &&
-		     !list_is_last(ichan->queue.next, &ichan->queue))) {
+		     ((curbuf >> chan_id) & 1) == ichan->active_buffer)) {
 		int i = 100;
 
 		/* This doesn't help. See comment in ipu_disable_channel() */
@@ -1548,7 +1547,7 @@ static irqreturn_t ic_sof_irq(int irq, void *dev_id)
 	struct idmac_channel *ichan = dev_id;
 	printk(KERN_DEBUG "Got SOF IRQ %d on Channel %d\n",
 	       irq, ichan->dma_chan.chan_id);
-	disable_irq_nosync(irq);
+	disable_irq(irq);
 	return IRQ_HANDLED;
 }
 
@@ -1557,7 +1556,7 @@ static irqreturn_t ic_eof_irq(int irq, void *dev_id)
 	struct idmac_channel *ichan = dev_id;
 	printk(KERN_DEBUG "Got EOF IRQ %d on Channel %d\n",
 	       irq, ichan->dma_chan.chan_id);
-	disable_irq_nosync(irq);
+	disable_irq(irq);
 	return IRQ_HANDLED;
 }
 
diff --git a/trunk/drivers/gpu/drm/Kconfig b/trunk/drivers/gpu/drm/Kconfig
index 17b24c580c09..3a22eb9be378 100644
--- a/trunk/drivers/gpu/drm/Kconfig
+++ b/trunk/drivers/gpu/drm/Kconfig
@@ -71,7 +71,6 @@ config DRM_I915
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
 	select FB
-	select FRAMEBUFFER_CONSOLE if !EMBEDDED
 	tristate "i915 driver"
 	help
 	  Choose this option if you have a system that has Intel 830M, 845G,
diff --git a/trunk/drivers/hid/hid-ids.h b/trunk/drivers/hid/hid-ids.h
index 4d5ee2bbc62b..aa1b995dd033 100644
--- a/trunk/drivers/hid/hid-ids.h
+++ b/trunk/drivers/hid/hid-ids.h
@@ -113,11 +113,6 @@
 #define USB_VENDOR_ID_BERKSHIRE		0x0c98
 #define USB_DEVICE_ID_BERKSHIRE_PCWD	0x1140
 
-#define USB_VENDOR_ID_CH		0x068e
-#define USB_DEVICE_ID_CH_PRO_PEDALS	0x00f2
-#define USB_DEVICE_ID_CH_COMBATSTICK	0x00f4
-#define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE	0x00ff
-
 #define USB_VENDOR_ID_CHERRY		0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION	0x0023
 
diff --git a/trunk/drivers/hid/usbhid/hid-core.c b/trunk/drivers/hid/usbhid/hid-core.c
index ac8049b5f1e9..900ce18dd549 100644
--- a/trunk/drivers/hid/usbhid/hid-core.c
+++ b/trunk/drivers/hid/usbhid/hid-core.c
@@ -898,7 +898,7 @@ static int usbhid_parse(struct hid_device *hid)
 		goto err;
 	}
 
-	hid->quirks |= quirks;
+	hid->quirks = quirks;
 
 	return 0;
 err:
diff --git a/trunk/drivers/hid/usbhid/hid-quirks.c b/trunk/drivers/hid/usbhid/hid-quirks.c
index d8f7423f363e..4391717d2519 100644
--- a/trunk/drivers/hid/usbhid/hid-quirks.c
+++ b/trunk/drivers/hid/usbhid/hid-quirks.c
@@ -50,9 +50,6 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/trunk/drivers/i2c/busses/Kconfig b/trunk/drivers/i2c/busses/Kconfig
index f1c6ca7e2852..a48c8aee0218 100644
--- a/trunk/drivers/i2c/busses/Kconfig
+++ b/trunk/drivers/i2c/busses/Kconfig
@@ -467,7 +467,7 @@ config I2C_PXA_SLAVE
 
 config I2C_S3C2410
 	tristate "S3C2410 I2C Driver"
-	depends on ARCH_S3C2410 || ARCH_S3C64XX
+	depends on ARCH_S3C2410
 	help
 	  Say Y here to include support for I2C controller in the
 	  Samsung S3C2410 based System-on-Chip devices.
diff --git a/trunk/drivers/i2c/busses/i2c-cpm.c b/trunk/drivers/i2c/busses/i2c-cpm.c
index b5db8b883615..3fcf78e906db 100644
--- a/trunk/drivers/i2c/busses/i2c-cpm.c
+++ b/trunk/drivers/i2c/busses/i2c-cpm.c
@@ -531,16 +531,16 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
 	rbdf = cpm->rbase;
 
 	for (i = 0; i < CPM_MAXBD; i++) {
-		cpm->rxbuf[i] = dma_alloc_coherent(&cpm->ofdev->dev,
-						   CPM_MAX_READ + 1,
-						   &cpm->rxdma[i], GFP_KERNEL);
+		cpm->rxbuf[i] = dma_alloc_coherent(
+			NULL, CPM_MAX_READ + 1, &cpm->rxdma[i], GFP_KERNEL);
 		if (!cpm->rxbuf[i]) {
 			ret = -ENOMEM;
 			goto out_muram;
 		}
 		out_be32(&rbdf[i].cbd_bufaddr, ((cpm->rxdma[i] + 1) & ~1));
 
-		cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
+		cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(
+			NULL, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
 		if (!cpm->txbuf[i]) {
 			ret = -ENOMEM;
 			goto out_muram;
@@ -585,10 +585,10 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
 out_muram:
 	for (i = 0; i < CPM_MAXBD; i++) {
 		if (cpm->rxbuf[i])
-			dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
+			dma_free_coherent(NULL, CPM_MAX_READ + 1,
 				cpm->rxbuf[i], cpm->rxdma[i]);
 		if (cpm->txbuf[i])
-			dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
+			dma_free_coherent(NULL, CPM_MAX_READ + 1,
 				cpm->txbuf[i], cpm->txdma[i]);
 	}
 	cpm_muram_free(cpm->dp_addr);
@@ -619,9 +619,9 @@ static void cpm_i2c_shutdown(struct cpm_i2c *cpm)
 
 	/* Free all memory */
 	for (i = 0; i < CPM_MAXBD; i++) {
-		dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
+		dma_free_coherent(NULL, CPM_MAX_READ + 1,
 			cpm->rxbuf[i], cpm->rxdma[i]);
-		dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
+		dma_free_coherent(NULL, CPM_MAX_READ + 1,
 			cpm->txbuf[i], cpm->txdma[i]);
 	}
 
diff --git a/trunk/drivers/i2c/busses/i2c-mpc.c b/trunk/drivers/i2c/busses/i2c-mpc.c
index dd778d7ae047..4af5c09f0e8f 100644
--- a/trunk/drivers/i2c/busses/i2c-mpc.c
+++ b/trunk/drivers/i2c/busses/i2c-mpc.c
@@ -164,7 +164,7 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
 	return 0;
 }
 
-#ifdef CONFIG_PPC_MPC52xx
+#ifdef CONFIG_PPC_52xx
 static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
 	{20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
 	{28, 0x24}, {30, 0x01}, {32, 0x25}, {34, 0x02},
@@ -188,7 +188,7 @@ static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
 
 int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
 {
-	const struct mpc_i2c_divider *div = NULL;
+	const struct mpc52xx_i2c_divider *div = NULL;
 	unsigned int pvr = mfspr(SPRN_PVR);
 	u32 divider;
 	int i;
@@ -203,7 +203,7 @@ int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
 	 * We want to choose an FDR/DFSR that generates an I2C bus speed that
 	 * is equal to or lower than the requested speed.
 	 */
-	for (i = 0; i < ARRAY_SIZE(mpc_i2c_dividers_52xx); i++) {
+	for (i = 0; i < ARRAY_SIZE(mpc52xx_i2c_dividers); i++) {
 		div = &mpc_i2c_dividers_52xx[i];
 		/* Old MPC5200 rev A CPUs do not support the high bits */
 		if (div->fdr & 0xc0 && pvr == 0x80822011)
@@ -219,23 +219,20 @@ static void mpc_i2c_setclock_52xx(struct device_node *node,
 				  struct mpc_i2c *i2c,
 				  u32 clock, u32 prescaler)
 {
-	int ret, fdr;
-
-	ret = mpc_i2c_get_fdr_52xx(node, clock, prescaler);
-	fdr = (ret >= 0) ? ret : 0x3f; /* backward compatibility */
+	int fdr = mpc52xx_i2c_get_fdr(node, clock, prescaler);
 
+	if (fdr < 0)
+		fdr = 0x3f; /* backward compatibility */
 	writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
-
-	if (ret >= 0)
-		dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
+	dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
 }
-#else /* !CONFIG_PPC_MPC52xx */
+#else /* !CONFIG_PPC_52xx */
 static void mpc_i2c_setclock_52xx(struct device_node *node,
 				  struct mpc_i2c *i2c,
 				  u32 clock, u32 prescaler)
 {
 }
-#endif /* CONFIG_PPC_MPC52xx*/
+#endif /* CONFIG_PPC_52xx*/
 
 #ifdef CONFIG_FSL_SOC
 static const struct mpc_i2c_divider mpc_i2c_dividers_8xxx[] = {
@@ -324,17 +321,14 @@ static void mpc_i2c_setclock_8xxx(struct device_node *node,
 				  struct mpc_i2c *i2c,
 				  u32 clock, u32 prescaler)
 {
-	int ret, fdr;
-
-	ret = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
-	fdr = (ret >= 0) ? ret : 0x1031; /* backward compatibility */
+	int fdr = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
 
+	if (fdr < 0)
+		fdr = 0x1031; /* backward compatibility */
 	writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
 	writeb((fdr >> 8) & 0xff, i2c->base + MPC_I2C_DFSRR);
-
-	if (ret >= 0)
-		dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
-			 clock, fdr >> 8, fdr & 0xff);
+	dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
+		 clock, fdr >> 8, fdr & 0xff);
 }
 
 #else /* !CONFIG_FSL_SOC */
diff --git a/trunk/drivers/i2c/busses/i2c-pxa.c b/trunk/drivers/i2c/busses/i2c-pxa.c
index acc7143d9655..c1405c8f6ba5 100644
--- a/trunk/drivers/i2c/busses/i2c-pxa.c
+++ b/trunk/drivers/i2c/busses/i2c-pxa.c
@@ -265,10 +265,10 @@ static int i2c_pxa_wait_bus_not_busy(struct pxa_i2c *i2c)
 		show_state(i2c);
 	}
 
-	if (timeout < 0)
+	if (timeout <= 0)
 		show_state(i2c);
 
-	return timeout < 0 ? I2C_RETRY : 0;
+	return timeout <= 0 ? I2C_RETRY : 0;
 }
 
 static int i2c_pxa_wait_master(struct pxa_i2c *i2c)
@@ -612,7 +612,7 @@ static int i2c_pxa_pio_set_master(struct pxa_i2c *i2c)
 		show_state(i2c);
 	}
 
-	if (timeout < 0) {
+	if (timeout <= 0) {
 		show_state(i2c);
 		dev_err(&i2c->adap.dev,
 			"i2c_pxa: timeout waiting for bus free\n");
diff --git a/trunk/drivers/infiniband/hw/cxgb3/cxio_hal.c b/trunk/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 62f9cf2f94ec..8d71086f5a1c 100644
--- a/trunk/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/trunk/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -410,7 +410,6 @@ int cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
 	ptr = wq->sq_rptr + count;
 	sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
 	while (ptr != wq->sq_wptr) {
-		sqp->signaled = 0;
 		insert_sq_cqe(wq, cq, sqp);
 		ptr++;
 		sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
diff --git a/trunk/drivers/infiniband/hw/mlx4/mlx4_ib.h b/trunk/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 8a7dd6795fa0..9974e886b8de 100644
--- a/trunk/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/trunk/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -86,7 +86,6 @@ struct mlx4_ib_mr {
 
 struct mlx4_ib_fast_reg_page_list {
 	struct ib_fast_reg_page_list	ibfrpl;
-	__be64			       *mapped_page_list;
 	dma_addr_t			map;
 };
 
diff --git a/trunk/drivers/infiniband/hw/mlx4/mr.c b/trunk/drivers/infiniband/hw/mlx4/mr.c
index 8f3666b20ea4..8e4d26d56a95 100644
--- a/trunk/drivers/infiniband/hw/mlx4/mr.c
+++ b/trunk/drivers/infiniband/hw/mlx4/mr.c
@@ -231,11 +231,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
 	if (!mfrpl)
 		return ERR_PTR(-ENOMEM);
 
-	mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
-	if (!mfrpl->ibfrpl.page_list)
-		goto err_free;
-
-	mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
+	mfrpl->ibfrpl.page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
 						     size, &mfrpl->map,
 						     GFP_KERNEL);
 	if (!mfrpl->ibfrpl.page_list)
@@ -246,7 +242,6 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
 	return &mfrpl->ibfrpl;
 
 err_free:
-	kfree(mfrpl->ibfrpl.page_list);
 	kfree(mfrpl);
 	return ERR_PTR(-ENOMEM);
 }
@@ -257,9 +252,8 @@ void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
 	struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
 	int size = page_list->max_page_list_len * sizeof (u64);
 
-	dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
+	dma_free_coherent(&dev->dev->pdev->dev, size, page_list->page_list,
 			  mfrpl->map);
-	kfree(mfrpl->ibfrpl.page_list);
 	kfree(mfrpl);
 }
 
diff --git a/trunk/drivers/infiniband/hw/mlx4/qp.c b/trunk/drivers/infiniband/hw/mlx4/qp.c
index 20724aee76f4..f385a24d31d2 100644
--- a/trunk/drivers/infiniband/hw/mlx4/qp.c
+++ b/trunk/drivers/infiniband/hw/mlx4/qp.c
@@ -1365,7 +1365,7 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
 	int i;
 
 	for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
-		mfrpl->mapped_page_list[i] =
+		wr->wr.fast_reg.page_list->page_list[i] =
 			cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
 				    MLX4_MTT_FLAG_PRESENT);
 
diff --git a/trunk/drivers/input/ff-memless.c b/trunk/drivers/input/ff-memless.c
index 2d1415e16834..bc4e40f3ede7 100644
--- a/trunk/drivers/input/ff-memless.c
+++ b/trunk/drivers/input/ff-memless.c
@@ -226,7 +226,7 @@ static int get_compatible_type(struct ff_device *ff, int effect_type)
  */
 static void ml_combine_effects(struct ff_effect *effect,
 			       struct ml_effect_state *state,
-			       unsigned int gain)
+			       int gain)
 {
 	struct ff_effect *new = state->effect;
 	unsigned int strong, weak, i;
diff --git a/trunk/drivers/input/joydev.c b/trunk/drivers/input/joydev.c
index 012a5e753991..4224f0112849 100644
--- a/trunk/drivers/input/joydev.c
+++ b/trunk/drivers/input/joydev.c
@@ -843,13 +843,7 @@ static const struct input_device_id joydev_blacklist[] = {
 				INPUT_DEVICE_ID_MATCH_KEYBIT,
 		.evbit = { BIT_MASK(EV_KEY) },
 		.keybit = { [BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH) },
-	},	/* Avoid itouchpads and touchscreens */
-	{
-		.flags = INPUT_DEVICE_ID_MATCH_EVBIT |
-				INPUT_DEVICE_ID_MATCH_KEYBIT,
-		.evbit = { BIT_MASK(EV_KEY) },
-		.keybit = { [BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_DIGI) },
-	},	/* Avoid tablets, digitisers and similar devices */
+	},	/* Avoid itouchpads, touchscreens and tablets */
 	{ }	/* Terminating entry */
 };
 
diff --git a/trunk/drivers/input/keyboard/atkbd.c b/trunk/drivers/input/keyboard/atkbd.c
index df3f8aa68115..444dec07e5d8 100644
--- a/trunk/drivers/input/keyboard/atkbd.c
+++ b/trunk/drivers/input/keyboard/atkbd.c
@@ -894,13 +894,6 @@ static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
 	0xb0, 0xae, -1U
 };
 
-/*
- * Amilo Xi 3650 key release for light touch bar not working
- */
-static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
-	0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U
-};
-
 /*
  * atkbd_set_keycode_table() initializes keyboard's keycode table
  * according to the selected scancode set
@@ -1567,15 +1560,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.callback = atkbd_setup_forced_release,
 		.driver_data = atkbd_amilo_pa1510_forced_release_keys,
 	},
-	{
-		.ident = "Fujitsu Amilo Xi 3650",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
-		},
-		.callback = atkbd_setup_forced_release,
-		.driver_data = atkbd_amilo_xi3650_forced_release_keys,
-	},
 	{ }
 };
 
diff --git a/trunk/drivers/input/touchscreen/tsc2007.c b/trunk/drivers/input/touchscreen/tsc2007.c
index 948e167557f1..536668fbda22 100644
--- a/trunk/drivers/input/touchscreen/tsc2007.c
+++ b/trunk/drivers/input/touchscreen/tsc2007.c
@@ -200,9 +200,8 @@ static int tsc2007_read_values(struct tsc2007 *tsc)
 static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
 {
 	struct tsc2007 *ts = container_of(handle, struct tsc2007, timer);
-	unsigned long flags;
 
-	spin_lock_irqsave(&ts->lock, flags);
+	spin_lock_irq(&ts->lock);
 
 	if (unlikely(!ts->get_pendown_state() && ts->pendown)) {
 		struct input_dev *input = ts->input;
@@ -223,7 +222,7 @@ static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
 		tsc2007_send_event(ts);
 	}
 
-	spin_unlock_irqrestore(&ts->lock, flags);
+	spin_unlock_irq(&ts->lock);
 
 	return HRTIMER_NORESTART;
 }
diff --git a/trunk/drivers/net/mlx4/en_rx.c b/trunk/drivers/net/mlx4/en_rx.c
index 9ee873e872b3..7942c4d3cd88 100644
--- a/trunk/drivers/net/mlx4/en_rx.c
+++ b/trunk/drivers/net/mlx4/en_rx.c
@@ -951,6 +951,7 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
 	if (err) {
 		mlx4_err(mdev, "Failed to allocate qp #%d\n", qpn);
 		goto out;
+		return err;
 	}
 	qp->event = mlx4_en_sqp_event;
 
diff --git a/trunk/drivers/rtc/rtc-twl4030.c b/trunk/drivers/rtc/rtc-twl4030.c
index 9c8c70c497dc..a6341e4f9a0f 100644
--- a/trunk/drivers/rtc/rtc-twl4030.c
+++ b/trunk/drivers/rtc/rtc-twl4030.c
@@ -495,7 +495,9 @@ static int twl4030_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 {
 	irqstat = rtc_irq_bits;
 
-	mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M);
+	/* REVISIT alarm may need to wake us from sleep */
+	mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M |
+			 BIT_RTC_INTERRUPTS_REG_IT_ALARM_M);
 	return 0;
 }
 
diff --git a/trunk/drivers/spi/pxa2xx_spi.c b/trunk/drivers/spi/pxa2xx_spi.c
index 3f3c08c6ba4e..885194a07418 100644
--- a/trunk/drivers/spi/pxa2xx_spi.c
+++ b/trunk/drivers/spi/pxa2xx_spi.c
@@ -1373,9 +1373,6 @@ static void cleanup(struct spi_device *spi)
 {
 	struct chip_data *chip = spi_get_ctldata(spi);
 
-	if (!chip)
-		return;
-
 	if (gpio_is_valid(chip->gpio_cs))
 		gpio_free(chip->gpio_cs);
 
diff --git a/trunk/drivers/video/Kconfig b/trunk/drivers/video/Kconfig
index 0048f1185a60..7826bdce4bbe 100644
--- a/trunk/drivers/video/Kconfig
+++ b/trunk/drivers/video/Kconfig
@@ -1128,6 +1128,13 @@ config FB_INTEL
           830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
           Say Y if you have and plan to use such a board.
 
+	  If you say Y here and want DDC/I2C support you must first say Y to
+	  "I2C support" and "I2C bit-banging support" in the character devices
+	  section.
+
+	  If you say M here then "I2C support" and "I2C bit-banging support"
+	  can be build either as modules or built-in.
+
 	  To compile this driver as a module, choose M here: the
 	  module will be called intelfb.
 
@@ -1200,10 +1207,11 @@ config FB_MATROX_G
 	  pixel and 32 bpp packed pixel. You can also use font widths
 	  different from 8.
 
-	  If you need support for G400 secondary head, you must say Y to
-	  "Matrox I2C support" and "G400 second head support" right below.
-	  G450/G550 secondary head and digital output are supported without
-	  additional modules.
+	  If you need support for G400 secondary head, you must first say Y to
+	  "I2C support" in the character devices section, and then to
+	  "Matrox I2C support" and "G400 second head support" here in the
+	  framebuffer section. G450/G550 secondary head and digital output
+	  are supported without additional modules.
 
 	  The driver starts in monitor mode. You must use the matroxset tool 
 	  (available at <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to 
@@ -1302,6 +1310,13 @@ config FB_RADEON
 	  a framebuffer device.  There are both PCI and AGP versions.  You
 	  don't need to choose this to run the Radeon in plain VGA mode.
 
+	  If you say Y here and want DDC/I2C support you must first say Y to
+	  "I2C support" and "I2C bit-banging support" in the character devices
+	  section.
+
+	  If you say M here then "I2C support" and "I2C bit-banging support" 
+	  can be build either as modules or built-in.
+
 	  There is a product page at
 	  http://apps.ati.com/ATIcompare/
 
diff --git a/trunk/drivers/video/via/viafbdev.c b/trunk/drivers/video/via/viafbdev.c
index a0fec298216e..e327b84820d2 100644
--- a/trunk/drivers/video/via/viafbdev.c
+++ b/trunk/drivers/video/via/viafbdev.c
@@ -2103,7 +2103,7 @@ static void viafb_remove_proc(struct proc_dir_entry *viafb_entry)
 
 static int __devinit via_pci_probe(void)
 {
-	unsigned long default_xres, default_yres;
+	unsigned int default_xres, default_yres;
 	char *tmpc, *tmpm;
 	char *tmpc_sec, *tmpm_sec;
 	int vmode_index;
@@ -2196,8 +2196,8 @@ static int __devinit via_pci_probe(void)
 	viafb_FB_MM = viaparinfo->fbmem_virt;
 	tmpm = viafb_mode;
 	tmpc = strsep(&tmpm, "x");
-	strict_strtoul(tmpc, 0, &default_xres);
-	strict_strtoul(tmpm, 0, &default_yres);
+	strict_strtoul(tmpc, 0, (unsigned long *)&default_xres);
+	strict_strtoul(tmpm, 0, (unsigned long *)&default_yres);
 
 	vmode_index = viafb_get_mode_index(default_xres, default_yres, 0);
 	DEBUG_MSG(KERN_INFO "0->index=%d\n", vmode_index);
diff --git a/trunk/fs/eventpoll.c b/trunk/fs/eventpoll.c
index 5458e80fc558..a89f370fadb5 100644
--- a/trunk/fs/eventpoll.c
+++ b/trunk/fs/eventpoll.c
@@ -1212,7 +1212,7 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
 
 SYSCALL_DEFINE1(epoll_create, int, size)
 {
-	if (size <= 0)
+	if (size < 0)
 		return -EINVAL;
 
 	return sys_epoll_create1(0);
diff --git a/trunk/fs/fuse/inode.c b/trunk/fs/fuse/inode.c
index 91f7c85f1ffd..d1bc4d33ccbc 100644
--- a/trunk/fs/fuse/inode.c
+++ b/trunk/fs/fuse/inode.c
@@ -911,7 +911,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
  err_put_root:
 	dput(root_dentry);
  err_put_conn:
-	bdi_destroy(&fc->bdi);
 	fuse_conn_put(fc);
  err_fput:
 	fput(file);
diff --git a/trunk/fs/hugetlbfs/inode.c b/trunk/fs/hugetlbfs/inode.c
index c1462d43e721..153d9681192b 100644
--- a/trunk/fs/hugetlbfs/inode.c
+++ b/trunk/fs/hugetlbfs/inode.c
@@ -312,6 +312,16 @@ static ssize_t hugetlbfs_read(struct file *filp, char __user *buf,
 	return retval;
 }
 
+/*
+ * Read a page. Again trivial. If it didn't already exist
+ * in the page cache, it is zero-filled.
+ */
+static int hugetlbfs_readpage(struct file *file, struct page * page)
+{
+	unlock_page(page);
+	return -EINVAL;
+}
+
 static int hugetlbfs_write_begin(struct file *file,
 			struct address_space *mapping,
 			loff_t pos, unsigned len, unsigned flags,
@@ -691,6 +701,7 @@ static void hugetlbfs_destroy_inode(struct inode *inode)
 }
 
 static const struct address_space_operations hugetlbfs_aops = {
+	.readpage	= hugetlbfs_readpage,
 	.write_begin	= hugetlbfs_write_begin,
 	.write_end	= hugetlbfs_write_end,
 	.set_page_dirty	= hugetlbfs_set_page_dirty,
diff --git a/trunk/fs/lockd/svc.c b/trunk/fs/lockd/svc.c
index 1a54ae14a192..abf83881f68a 100644
--- a/trunk/fs/lockd/svc.c
+++ b/trunk/fs/lockd/svc.c
@@ -104,16 +104,6 @@ static void set_grace_period(void)
 	schedule_delayed_work(&grace_period_end, grace_period);
 }
 
-static void restart_grace(void)
-{
-	if (nlmsvc_ops) {
-		cancel_delayed_work_sync(&grace_period_end);
-		locks_end_grace(&lockd_manager);
-		nlmsvc_invalidate_all();
-		set_grace_period();
-	}
-}
-
 /*
  * This is the lockd kernel thread
  */
@@ -159,7 +149,10 @@ lockd(void *vrqstp)
 
 		if (signalled()) {
 			flush_signals(current);
-			restart_grace();
+			if (nlmsvc_ops) {
+				nlmsvc_invalidate_all();
+				set_grace_period();
+			}
 			continue;
 		}
 
diff --git a/trunk/fs/nfsd/nfs4recover.c b/trunk/fs/nfsd/nfs4recover.c
index b5348405046b..5275097a7565 100644
--- a/trunk/fs/nfsd/nfs4recover.c
+++ b/trunk/fs/nfsd/nfs4recover.c
@@ -229,7 +229,7 @@ nfsd4_list_rec_dir(struct dentry *dir, recdir_func *f)
 		goto out;
 	status = vfs_readdir(filp, nfsd4_build_namelist, &names);
 	fput(filp);
-	mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
+	mutex_lock(&dir->d_inode->i_mutex);
 	while (!list_empty(&names)) {
 		entry = list_entry(names.next, struct name_list, list);
 
@@ -264,7 +264,7 @@ nfsd4_unlink_clid_dir(char *name, int namlen)
 
 	dprintk("NFSD: nfsd4_unlink_clid_dir. name %.*s\n", namlen, name);
 
-	mutex_lock_nested(&rec_dir.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
+	mutex_lock(&rec_dir.dentry->d_inode->i_mutex);
 	dentry = lookup_one_len(name, rec_dir.dentry, namlen);
 	if (IS_ERR(dentry)) {
 		status = PTR_ERR(dentry);
diff --git a/trunk/fs/nfsd/nfs4state.c b/trunk/fs/nfsd/nfs4state.c
index 3b711f5147a7..c65a27b76a9d 100644
--- a/trunk/fs/nfsd/nfs4state.c
+++ b/trunk/fs/nfsd/nfs4state.c
@@ -580,6 +580,7 @@ free_session(struct kref *kref)
 		struct nfsd4_cache_entry *e = &ses->se_slots[i].sl_cache_entry;
 		nfsd4_release_respages(e->ce_respages, e->ce_resused);
 	}
+	kfree(ses->se_slots);
 	kfree(ses);
 }
 
diff --git a/trunk/fs/nfsd/nfs4xdr.c b/trunk/fs/nfsd/nfs4xdr.c
index b73549d293be..b820c311931c 100644
--- a/trunk/fs/nfsd/nfs4xdr.c
+++ b/trunk/fs/nfsd/nfs4xdr.c
@@ -2214,15 +2214,6 @@ nfsd4_encode_dirent_fattr(struct nfsd4_readdir *cd,
 	dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
 	if (IS_ERR(dentry))
 		return nfserrno(PTR_ERR(dentry));
-	if (!dentry->d_inode) {
-		/*
-		 * nfsd_buffered_readdir drops the i_mutex between
-		 * readdir and calling this callback, leaving a window
-		 * where this directory entry could have gone away.
-		 */
-		dput(dentry);
-		return nfserr_noent;
-	}
 
 	exp_get(exp);
 	/*
@@ -2285,7 +2276,6 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
 	struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
 	int buflen;
 	__be32 *p = cd->buffer;
-	__be32 *cookiep;
 	__be32 nfserr = nfserr_toosmall;
 
 	/* In nfsv4, "." and ".." never make it onto the wire.. */
@@ -2302,7 +2292,7 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
 		goto fail;
 
 	*p++ = xdr_one;                             /* mark entry present */
-	cookiep = p;
+	cd->offset = p;                             /* remember pointer */
 	p = xdr_encode_hyper(p, NFS_OFFSET_MAX);    /* offset of next entry */
 	p = xdr_encode_array(p, name, namlen);      /* name length & name */
 
@@ -2316,8 +2306,6 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
 		goto fail;
 	case nfserr_dropit:
 		goto fail;
-	case nfserr_noent:
-		goto skip_entry;
 	default:
 		/*
 		 * If the client requested the RDATTR_ERROR attribute,
@@ -2336,8 +2324,6 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
 	}
 	cd->buflen -= (p - cd->buffer);
 	cd->buffer = p;
-	cd->offset = cookiep;
-skip_entry:
 	cd->common.err = nfs_ok;
 	return 0;
 fail:
diff --git a/trunk/fs/nilfs2/ioctl.c b/trunk/fs/nilfs2/ioctl.c
index 50ff3f2cdf24..108d281ebca5 100644
--- a/trunk/fs/nilfs2/ioctl.c
+++ b/trunk/fs/nilfs2/ioctl.c
@@ -25,7 +25,6 @@
 #include <linux/smp_lock.h>	/* lock_kernel(), unlock_kernel() */
 #include <linux/capability.h>	/* capable() */
 #include <linux/uaccess.h>	/* copy_from_user(), copy_to_user() */
-#include <linux/vmalloc.h>
 #include <linux/nilfs2_fs.h>
 #include "nilfs.h"
 #include "segment.h"
@@ -148,12 +147,29 @@ static ssize_t
 nilfs_ioctl_do_get_cpinfo(struct the_nilfs *nilfs, __u64 *posp, int flags,
 			  void *buf, size_t size, size_t nmembs)
 {
+	return nilfs_cpfile_get_cpinfo(nilfs->ns_cpfile, posp, flags, buf,
+				       nmembs);
+}
+
+static int nilfs_ioctl_get_cpinfo(struct inode *inode, struct file *filp,
+				  unsigned int cmd, void __user *argp)
+{
+	struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+	struct nilfs_argv argv;
 	int ret;
 
+	if (copy_from_user(&argv, argp, sizeof(argv)))
+		return -EFAULT;
+
 	down_read(&nilfs->ns_segctor_sem);
-	ret = nilfs_cpfile_get_cpinfo(nilfs->ns_cpfile, posp, flags, buf,
-				      nmembs);
+	ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
+				    nilfs_ioctl_do_get_cpinfo);
 	up_read(&nilfs->ns_segctor_sem);
+	if (ret < 0)
+		return ret;
+
+	if (copy_to_user(argp, &argv, sizeof(argv)))
+		ret = -EFAULT;
 	return ret;
 }
 
@@ -179,11 +195,28 @@ static ssize_t
 nilfs_ioctl_do_get_suinfo(struct the_nilfs *nilfs, __u64 *posp, int flags,
 			  void *buf, size_t size, size_t nmembs)
 {
+	return nilfs_sufile_get_suinfo(nilfs->ns_sufile, *posp, buf, nmembs);
+}
+
+static int nilfs_ioctl_get_suinfo(struct inode *inode, struct file *filp,
+				  unsigned int cmd, void __user *argp)
+{
+	struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+	struct nilfs_argv argv;
 	int ret;
 
+	if (copy_from_user(&argv, argp, sizeof(argv)))
+		return -EFAULT;
+
 	down_read(&nilfs->ns_segctor_sem);
-	ret = nilfs_sufile_get_suinfo(nilfs->ns_sufile, *posp, buf, nmembs);
+	ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
+				    nilfs_ioctl_do_get_suinfo);
 	up_read(&nilfs->ns_segctor_sem);
+	if (ret < 0)
+		return ret;
+
+	if (copy_to_user(argp, &argv, sizeof(argv)))
+		ret = -EFAULT;
 	return ret;
 }
 
@@ -209,11 +242,28 @@ static ssize_t
 nilfs_ioctl_do_get_vinfo(struct the_nilfs *nilfs, __u64 *posp, int flags,
 			 void *buf, size_t size, size_t nmembs)
 {
+	return nilfs_dat_get_vinfo(nilfs_dat_inode(nilfs), buf, nmembs);
+}
+
+static int nilfs_ioctl_get_vinfo(struct inode *inode, struct file *filp,
+				 unsigned int cmd, void __user *argp)
+{
+	struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+	struct nilfs_argv argv;
 	int ret;
 
+	if (copy_from_user(&argv, argp, sizeof(argv)))
+		return -EFAULT;
+
 	down_read(&nilfs->ns_segctor_sem);
-	ret = nilfs_dat_get_vinfo(nilfs_dat_inode(nilfs), buf, nmembs);
+	ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
+				    nilfs_ioctl_do_get_vinfo);
 	up_read(&nilfs->ns_segctor_sem);
+	if (ret < 0)
+		return ret;
+
+	if (copy_to_user(argp, &argv, sizeof(argv)))
+		ret = -EFAULT;
 	return ret;
 }
 
@@ -226,21 +276,17 @@ nilfs_ioctl_do_get_bdescs(struct the_nilfs *nilfs, __u64 *posp, int flags,
 	struct nilfs_bdesc *bdescs = buf;
 	int ret, i;
 
-	down_read(&nilfs->ns_segctor_sem);
 	for (i = 0; i < nmembs; i++) {
 		ret = nilfs_bmap_lookup_at_level(bmap,
 						 bdescs[i].bd_offset,
 						 bdescs[i].bd_level + 1,
 						 &bdescs[i].bd_blocknr);
 		if (ret < 0) {
-			if (ret != -ENOENT) {
-				up_read(&nilfs->ns_segctor_sem);
+			if (ret != -ENOENT)
 				return ret;
-			}
 			bdescs[i].bd_blocknr = 0;
 		}
 	}
-	up_read(&nilfs->ns_segctor_sem);
 	return nmembs;
 }
 
@@ -254,11 +300,10 @@ static int nilfs_ioctl_get_bdescs(struct inode *inode, struct file *filp,
 	if (copy_from_user(&argv, argp, sizeof(argv)))
 		return -EFAULT;
 
-	if (argv.v_size != sizeof(struct nilfs_bdesc))
-		return -EINVAL;
-
+	down_read(&nilfs->ns_segctor_sem);
 	ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd),
 				    nilfs_ioctl_do_get_bdescs);
+	up_read(&nilfs->ns_segctor_sem);
 	if (ret < 0)
 		return ret;
 
@@ -301,10 +346,10 @@ static int nilfs_ioctl_move_inode_block(struct inode *inode,
 	return 0;
 }
 
-static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
-				   struct nilfs_argv *argv, void *buf)
+static ssize_t
+nilfs_ioctl_do_move_blocks(struct the_nilfs *nilfs, __u64 *posp, int flags,
+			   void *buf, size_t size, size_t nmembs)
 {
-	size_t nmembs = argv->v_nmembs;
 	struct inode *inode;
 	struct nilfs_vdesc *vdesc;
 	struct buffer_head *bh, *n;
@@ -365,10 +410,19 @@ static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
 	return ret;
 }
 
-static int nilfs_ioctl_delete_checkpoints(struct the_nilfs *nilfs,
-					  struct nilfs_argv *argv, void *buf)
+static inline int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
+					  struct nilfs_argv *argv,
+					  int dir)
+{
+	return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
+				     nilfs_ioctl_do_move_blocks);
+}
+
+static ssize_t
+nilfs_ioctl_do_delete_checkpoints(struct the_nilfs *nilfs, __u64 *posp,
+				  int flags, void *buf, size_t size,
+				  size_t nmembs)
 {
-	size_t nmembs = argv->v_nmembs;
 	struct inode *cpfile = nilfs->ns_cpfile;
 	struct nilfs_period *periods = buf;
 	int ret, i;
@@ -382,21 +436,36 @@ static int nilfs_ioctl_delete_checkpoints(struct the_nilfs *nilfs,
 	return nmembs;
 }
 
-static int nilfs_ioctl_free_vblocknrs(struct the_nilfs *nilfs,
-				      struct nilfs_argv *argv, void *buf)
+static inline int nilfs_ioctl_delete_checkpoints(struct the_nilfs *nilfs,
+						 struct nilfs_argv *argv,
+						 int dir)
 {
-	size_t nmembs = argv->v_nmembs;
-	int ret;
+	return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
+				     nilfs_ioctl_do_delete_checkpoints);
+}
 
-	ret = nilfs_dat_freev(nilfs_dat_inode(nilfs), buf, nmembs);
+static ssize_t
+nilfs_ioctl_do_free_vblocknrs(struct the_nilfs *nilfs, __u64 *posp, int flags,
+			      void *buf, size_t size, size_t nmembs)
+{
+	int ret = nilfs_dat_freev(nilfs_dat_inode(nilfs), buf, nmembs);
 
 	return (ret < 0) ? ret : nmembs;
 }
 
-static int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
-					 struct nilfs_argv *argv, void *buf)
+static inline int nilfs_ioctl_free_vblocknrs(struct the_nilfs *nilfs,
+					     struct nilfs_argv *argv,
+					     int dir)
+{
+	return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
+				     nilfs_ioctl_do_free_vblocknrs);
+}
+
+static ssize_t
+nilfs_ioctl_do_mark_blocks_dirty(struct the_nilfs *nilfs, __u64 *posp,
+				 int flags, void *buf, size_t size,
+				 size_t nmembs)
 {
-	size_t nmembs = argv->v_nmembs;
 	struct inode *dat = nilfs_dat_inode(nilfs);
 	struct nilfs_bmap *bmap = NILFS_I(dat)->i_bmap;
 	struct nilfs_bdesc *bdescs = buf;
@@ -435,37 +504,55 @@ static int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
 	return nmembs;
 }
 
-static int nilfs_ioctl_free_segments(struct the_nilfs *nilfs,
-				     struct nilfs_argv *argv, void *buf)
+static inline int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
+						struct nilfs_argv *argv,
+						int dir)
 {
-	size_t nmembs = argv->v_nmembs;
-	struct nilfs_sb_info *sbi = nilfs->ns_writer;
+	return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
+				     nilfs_ioctl_do_mark_blocks_dirty);
+}
+
+static ssize_t
+nilfs_ioctl_do_free_segments(struct the_nilfs *nilfs, __u64 *posp, int flags,
+			     void *buf, size_t size, size_t nmembs)
+{
+	struct nilfs_sb_info *sbi = nilfs_get_writer(nilfs);
 	int ret;
 
-	if (unlikely(!sbi)) {
-		/* never happens because called for a writable mount */
-		WARN_ON(1);
+	if (unlikely(!sbi))
 		return -EROFS;
-	}
 	ret = nilfs_segctor_add_segments_to_be_freed(
 		NILFS_SC(sbi), buf, nmembs);
+	nilfs_put_writer(nilfs);
 
 	return (ret < 0) ? ret : nmembs;
 }
 
+static inline int nilfs_ioctl_free_segments(struct the_nilfs *nilfs,
+					     struct nilfs_argv *argv,
+					     int dir)
+{
+	return nilfs_ioctl_wrap_copy(nilfs, argv, dir,
+				     nilfs_ioctl_do_free_segments);
+}
+
 int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
-				       struct nilfs_argv *argv, void **kbufs)
+				       void __user *argp)
 {
+	struct nilfs_argv argv[5];
 	const char *msg;
-	int ret;
+	int dir, ret;
 
-	ret = nilfs_ioctl_move_blocks(nilfs, &argv[0], kbufs[0]);
+	if (copy_from_user(argv, argp, sizeof(argv)))
+		return -EFAULT;
+
+	dir = _IOC_WRITE;
+	ret = nilfs_ioctl_move_blocks(nilfs, &argv[0], dir);
 	if (ret < 0) {
 		msg = "cannot read source blocks";
 		goto failed;
 	}
-
-	ret = nilfs_ioctl_delete_checkpoints(nilfs, &argv[1], kbufs[1]);
+	ret = nilfs_ioctl_delete_checkpoints(nilfs, &argv[1], dir);
 	if (ret < 0) {
 		/*
 		 * can safely abort because checkpoints can be removed
@@ -474,7 +561,7 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
 		msg = "cannot delete checkpoints";
 		goto failed;
 	}
-	ret = nilfs_ioctl_free_vblocknrs(nilfs, &argv[2], kbufs[2]);
+	ret = nilfs_ioctl_free_vblocknrs(nilfs, &argv[2], dir);
 	if (ret < 0) {
 		/*
 		 * can safely abort because DAT file is updated atomically
@@ -483,7 +570,7 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
 		msg = "cannot delete virtual blocks from DAT file";
 		goto failed;
 	}
-	ret = nilfs_ioctl_mark_blocks_dirty(nilfs, &argv[3], kbufs[3]);
+	ret = nilfs_ioctl_mark_blocks_dirty(nilfs, &argv[3], dir);
 	if (ret < 0) {
 		/*
 		 * can safely abort because the operation is nondestructive.
@@ -491,7 +578,7 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
 		msg = "cannot mark copying blocks dirty";
 		goto failed;
 	}
-	ret = nilfs_ioctl_free_segments(nilfs, &argv[4], kbufs[4]);
+	ret = nilfs_ioctl_free_segments(nilfs, &argv[4], dir);
 	if (ret < 0) {
 		/*
 		 * can safely abort because this operation is atomic.
@@ -511,75 +598,9 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
 static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
 				      unsigned int cmd, void __user *argp)
 {
-	struct nilfs_argv argv[5];
-	const static size_t argsz[5] = {
-		sizeof(struct nilfs_vdesc),
-		sizeof(struct nilfs_period),
-		sizeof(__u64),
-		sizeof(struct nilfs_bdesc),
-		sizeof(__u64),
-	};
-	void __user *base;
-	void *kbufs[5];
-	struct the_nilfs *nilfs;
-	size_t len, nsegs;
-	int n, ret;
-
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
-
-	if (copy_from_user(argv, argp, sizeof(argv)))
-		return -EFAULT;
-
-	nsegs = argv[4].v_nmembs;
-	if (argv[4].v_size != argsz[4])
-		return -EINVAL;
-	/*
-	 * argv[4] points to segment numbers this ioctl cleans.  We
-	 * use kmalloc() for its buffer because memory used for the
-	 * segment numbers is enough small.
-	 */
-	kbufs[4] = memdup_user((void __user *)(unsigned long)argv[4].v_base,
-			       nsegs * sizeof(__u64));
-	if (IS_ERR(kbufs[4]))
-		return PTR_ERR(kbufs[4]);
-
-	nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
-
-	for (n = 0; n < 4; n++) {
-		ret = -EINVAL;
-		if (argv[n].v_size != argsz[n])
-			goto out_free;
-
-		if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
-			goto out_free;
-
-		len = argv[n].v_size * argv[n].v_nmembs;
-		base = (void __user *)(unsigned long)argv[n].v_base;
-		if (len == 0) {
-			kbufs[n] = NULL;
-			continue;
-		}
-
-		kbufs[n] = vmalloc(len);
-		if (!kbufs[n]) {
-			ret = -ENOMEM;
-			goto out_free;
-		}
-		if (copy_from_user(kbufs[n], base, len)) {
-			ret = -EFAULT;
-			vfree(kbufs[n]);
-			goto out_free;
-		}
-	}
-
-	ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
-
- out_free:
-	while (--n > 0)
-		vfree(kbufs[n]);
-	kfree(kbufs[4]);
-	return ret;
+	return nilfs_clean_segments(inode->i_sb, argp);
 }
 
 static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
@@ -600,33 +621,6 @@ static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
 	return 0;
 }
 
-static int nilfs_ioctl_get_info(struct inode *inode, struct file *filp,
-				unsigned int cmd, void __user *argp,
-				size_t membsz,
-				ssize_t (*dofunc)(struct the_nilfs *,
-						  __u64 *, int,
-						  void *, size_t, size_t))
-
-{
-	struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
-	struct nilfs_argv argv;
-	int ret;
-
-	if (copy_from_user(&argv, argp, sizeof(argv)))
-		return -EFAULT;
-
-	if (argv.v_size != membsz)
-		return -EINVAL;
-
-	ret = nilfs_ioctl_wrap_copy(nilfs, &argv, _IOC_DIR(cmd), dofunc);
-	if (ret < 0)
-		return ret;
-
-	if (copy_to_user(argp, &argv, sizeof(argv)))
-		ret = -EFAULT;
-	return ret;
-}
-
 long nilfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct inode *inode = filp->f_dentry->d_inode;
@@ -638,21 +632,16 @@ long nilfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	case NILFS_IOCTL_DELETE_CHECKPOINT:
 		return nilfs_ioctl_delete_checkpoint(inode, filp, cmd, argp);
 	case NILFS_IOCTL_GET_CPINFO:
-		return nilfs_ioctl_get_info(inode, filp, cmd, argp,
-					    sizeof(struct nilfs_cpinfo),
-					    nilfs_ioctl_do_get_cpinfo);
+		return nilfs_ioctl_get_cpinfo(inode, filp, cmd, argp);
 	case NILFS_IOCTL_GET_CPSTAT:
 		return nilfs_ioctl_get_cpstat(inode, filp, cmd, argp);
 	case NILFS_IOCTL_GET_SUINFO:
-		return nilfs_ioctl_get_info(inode, filp, cmd, argp,
-					    sizeof(struct nilfs_suinfo),
-					    nilfs_ioctl_do_get_suinfo);
+		return nilfs_ioctl_get_suinfo(inode, filp, cmd, argp);
 	case NILFS_IOCTL_GET_SUSTAT:
 		return nilfs_ioctl_get_sustat(inode, filp, cmd, argp);
 	case NILFS_IOCTL_GET_VINFO:
-		return nilfs_ioctl_get_info(inode, filp, cmd, argp,
-					    sizeof(struct nilfs_vinfo),
-					    nilfs_ioctl_do_get_vinfo);
+		/* XXX: rename to ??? */
+		return nilfs_ioctl_get_vinfo(inode, filp, cmd, argp);
 	case NILFS_IOCTL_GET_BDESCS:
 		return nilfs_ioctl_get_bdescs(inode, filp, cmd, argp);
 	case NILFS_IOCTL_CLEAN_SEGMENTS:
diff --git a/trunk/fs/nilfs2/mdt.c b/trunk/fs/nilfs2/mdt.c
index bb78745a0e30..47dd815433fd 100644
--- a/trunk/fs/nilfs2/mdt.c
+++ b/trunk/fs/nilfs2/mdt.c
@@ -77,22 +77,19 @@ static int nilfs_mdt_create_block(struct inode *inode, unsigned long block,
 						     void *))
 {
 	struct the_nilfs *nilfs = NILFS_MDT(inode)->mi_nilfs;
+	struct nilfs_sb_info *writer = NULL;
 	struct super_block *sb = inode->i_sb;
 	struct nilfs_transaction_info ti;
 	struct buffer_head *bh;
 	int err;
 
 	if (!sb) {
-		/*
-		 * Make sure this function is not called from any
-		 * read-only context.
-		 */
-		if (!nilfs->ns_writer) {
-			WARN_ON(1);
+		writer = nilfs_get_writer(nilfs);
+		if (!writer) {
 			err = -EROFS;
 			goto out;
 		}
-		sb = nilfs->ns_writer->s_super;
+		sb = writer->s_super;
 	}
 
 	nilfs_transaction_begin(sb, &ti, 0);
@@ -130,6 +127,8 @@ static int nilfs_mdt_create_block(struct inode *inode, unsigned long block,
 		err = nilfs_transaction_commit(sb);
 	else
 		nilfs_transaction_abort(sb);
+	if (writer)
+		nilfs_put_writer(nilfs);
  out:
 	return err;
 }
@@ -300,7 +299,7 @@ int nilfs_mdt_delete_block(struct inode *inode, unsigned long block)
 	int err;
 
 	err = nilfs_bmap_delete(ii->i_bmap, block);
-	if (!err || err == -ENOENT) {
+	if (likely(!err)) {
 		nilfs_mdt_mark_dirty(inode);
 		nilfs_mdt_forget_block(inode, block);
 	}
diff --git a/trunk/fs/nilfs2/nilfs.h b/trunk/fs/nilfs2/nilfs.h
index da6fc0bba2e5..3d0c18a16db1 100644
--- a/trunk/fs/nilfs2/nilfs.h
+++ b/trunk/fs/nilfs2/nilfs.h
@@ -236,8 +236,7 @@ extern int nilfs_sync_file(struct file *, struct dentry *, int);
 
 /* ioctl.c */
 long nilfs_ioctl(struct file *, unsigned int, unsigned long);
-int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *, struct nilfs_argv *,
-				       void **);
+int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *, void __user *);
 
 /* inode.c */
 extern struct inode *nilfs_new_inode(struct inode *, int);
diff --git a/trunk/fs/nilfs2/page.c b/trunk/fs/nilfs2/page.c
index a2692bbc7b50..1bfbba9c0e9a 100644
--- a/trunk/fs/nilfs2/page.c
+++ b/trunk/fs/nilfs2/page.c
@@ -128,8 +128,7 @@ void nilfs_forget_buffer(struct buffer_head *bh)
 
 	lock_buffer(bh);
 	clear_buffer_nilfs_volatile(bh);
-	clear_buffer_dirty(bh);
-	if (nilfs_page_buffers_clean(page))
+	if (test_clear_buffer_dirty(bh) && nilfs_page_buffers_clean(page))
 		__nilfs_clear_page_dirty(page);
 
 	clear_buffer_uptodate(bh);
diff --git a/trunk/fs/nilfs2/recovery.c b/trunk/fs/nilfs2/recovery.c
index 57afa9d24061..4fc081e47d70 100644
--- a/trunk/fs/nilfs2/recovery.c
+++ b/trunk/fs/nilfs2/recovery.c
@@ -407,7 +407,6 @@ void nilfs_dispose_segment_list(struct list_head *head)
 }
 
 static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
-					      struct nilfs_sb_info *sbi,
 					      struct nilfs_recovery_info *ri)
 {
 	struct list_head *head = &ri->ri_used_segments;
@@ -422,7 +421,6 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
 	segnum[2] = ri->ri_segnum;
 	segnum[3] = ri->ri_nextnum;
 
-	nilfs_attach_writer(nilfs, sbi);
 	/*
 	 * Releasing the next segment of the latest super root.
 	 * The next segment is invalidated by this recovery.
@@ -461,10 +459,10 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
 	nilfs->ns_pseg_offset = 0;
 	nilfs->ns_seg_seq = ri->ri_seq + 2;
 	nilfs->ns_nextnum = nilfs->ns_segnum = segnum[0];
+	return 0;
 
  failed:
 	/* No need to recover sufile because it will be destroyed on error */
-	nilfs_detach_writer(nilfs, sbi);
 	return err;
 }
 
@@ -730,7 +728,7 @@ int nilfs_recover_logical_segments(struct the_nilfs *nilfs,
 		goto failed;
 
 	if (ri->ri_need_recovery == NILFS_RECOVERY_ROLLFORWARD_DONE) {
-		err = nilfs_prepare_segment_for_recovery(nilfs, sbi, ri);
+		err = nilfs_prepare_segment_for_recovery(nilfs, ri);
 		if (unlikely(err)) {
 			printk(KERN_ERR "NILFS: Error preparing segments for "
 			       "recovery.\n");
diff --git a/trunk/fs/nilfs2/segment.c b/trunk/fs/nilfs2/segment.c
index 22c7f65c2403..fb70ec3be20e 100644
--- a/trunk/fs/nilfs2/segment.c
+++ b/trunk/fs/nilfs2/segment.c
@@ -2589,8 +2589,7 @@ nilfs_remove_written_gcinodes(struct the_nilfs *nilfs, struct list_head *head)
 	}
 }
 
-int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
-			 void **kbufs)
+int nilfs_clean_segments(struct super_block *sb, void __user *argp)
 {
 	struct nilfs_sb_info *sbi = NILFS_SB(sb);
 	struct nilfs_sc_info *sci = NILFS_SC(sbi);
@@ -2607,7 +2606,7 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
 	err = nilfs_init_gcdat_inode(nilfs);
 	if (unlikely(err))
 		goto out_unlock;
-	err = nilfs_ioctl_prepare_clean_segments(nilfs, argv, kbufs);
+	err = nilfs_ioctl_prepare_clean_segments(nilfs, argp);
 	if (unlikely(err))
 		goto out_unlock;
 
diff --git a/trunk/fs/nilfs2/segment.h b/trunk/fs/nilfs2/segment.h
index 476bdd5df5be..a98fc1ed0bbb 100644
--- a/trunk/fs/nilfs2/segment.h
+++ b/trunk/fs/nilfs2/segment.h
@@ -222,8 +222,7 @@ extern int nilfs_construct_segment(struct super_block *);
 extern int nilfs_construct_dsync_segment(struct super_block *, struct inode *,
 					 loff_t, loff_t);
 extern void nilfs_flush_segment(struct super_block *, ino_t);
-extern int nilfs_clean_segments(struct super_block *, struct nilfs_argv *,
-				void **);
+extern int nilfs_clean_segments(struct super_block *, void __user *);
 
 extern int nilfs_segctor_add_segments_to_be_freed(struct nilfs_sc_info *,
 						  __u64 *, size_t);
diff --git a/trunk/fs/squashfs/cache.c b/trunk/fs/squashfs/cache.c
index 1c4739e33af6..40c98fa6b5d6 100644
--- a/trunk/fs/squashfs/cache.c
+++ b/trunk/fs/squashfs/cache.c
@@ -252,6 +252,7 @@ struct squashfs_cache *squashfs_cache_init(char *name, int entries,
 	cache->entries = entries;
 	cache->block_size = block_size;
 	cache->pages = block_size >> PAGE_CACHE_SHIFT;
+	cache->pages = cache->pages ? cache->pages : 1;
 	cache->name = name;
 	cache->num_waiters = 0;
 	spin_lock_init(&cache->lock);
diff --git a/trunk/include/linux/dmaengine.h b/trunk/include/linux/dmaengine.h
index ffefba81c818..2e2aa3df170c 100644
--- a/trunk/include/linux/dmaengine.h
+++ b/trunk/include/linux/dmaengine.h
@@ -78,18 +78,12 @@ enum dma_transaction_type {
  * 	dependency chains
  * @DMA_COMPL_SKIP_SRC_UNMAP - set to disable dma-unmapping the source buffer(s)
  * @DMA_COMPL_SKIP_DEST_UNMAP - set to disable dma-unmapping the destination(s)
- * @DMA_COMPL_SRC_UNMAP_SINGLE - set to do the source dma-unmapping as single
- * 	(if not set, do the source dma-unmapping as page)
- * @DMA_COMPL_DEST_UNMAP_SINGLE - set to do the destination dma-unmapping as single
- * 	(if not set, do the destination dma-unmapping as page)
  */
 enum dma_ctrl_flags {
 	DMA_PREP_INTERRUPT = (1 << 0),
 	DMA_CTRL_ACK = (1 << 1),
 	DMA_COMPL_SKIP_SRC_UNMAP = (1 << 2),
 	DMA_COMPL_SKIP_DEST_UNMAP = (1 << 3),
-	DMA_COMPL_SRC_UNMAP_SINGLE = (1 << 4),
-	DMA_COMPL_DEST_UNMAP_SINGLE = (1 << 5),
 };
 
 /**
diff --git a/trunk/include/linux/syscalls.h b/trunk/include/linux/syscalls.h
index 30520844b8da..40617c1d8976 100644
--- a/trunk/include/linux/syscalls.h
+++ b/trunk/include/linux/syscalls.h
@@ -433,7 +433,6 @@ asmlinkage long sys_fcntl(unsigned int fd, unsigned int cmd, unsigned long arg);
 asmlinkage long sys_fcntl64(unsigned int fd,
 				unsigned int cmd, unsigned long arg);
 #endif
-asmlinkage long sys_pipe2(int __user *fildes, int flags);
 asmlinkage long sys_dup(unsigned int fildes);
 asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd);
 asmlinkage long sys_dup3(unsigned int oldfd, unsigned int newfd, int flags);
diff --git a/trunk/mm/madvise.c b/trunk/mm/madvise.c
index b9ce574827c8..36d6ea2b6340 100644
--- a/trunk/mm/madvise.c
+++ b/trunk/mm/madvise.c
@@ -112,6 +112,14 @@ static long madvise_willneed(struct vm_area_struct * vma,
 	if (!file)
 		return -EBADF;
 
+	/*
+	 * Page cache readahead assumes page cache pages are order-0 which
+	 * is not the case for hugetlbfs. Do not give a bad return value
+	 * but ignore the advice.
+	 */
+	if (vma->vm_flags & VM_HUGETLB)
+		return 0;
+
 	if (file->f_mapping->a_ops->get_xip_mem) {
 		/* no bad return value, but ignore advice */
 		return 0;
diff --git a/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 42a6f9f20285..629a28764da9 100644
--- a/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/trunk/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -265,7 +265,7 @@ static int fast_reg_read_chunks(struct svcxprt_rdma *xprt,
 		frmr->page_list->page_list[page_no] =
 			ib_dma_map_single(xprt->sc_cm_id->device,
 					  page_address(rqstp->rq_arg.pages[page_no]),
-					  PAGE_SIZE, DMA_FROM_DEVICE);
+					  PAGE_SIZE, DMA_TO_DEVICE);
 		if (ib_dma_mapping_error(xprt->sc_cm_id->device,
 					 frmr->page_list->page_list[page_no]))
 			goto fatal_err;
diff --git a/trunk/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/trunk/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 8b510c5e8777..6c26a675435a 100644
--- a/trunk/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/trunk/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -183,7 +183,6 @@ static int fast_reg_xdr(struct svcxprt_rdma *xprt,
 
  fatal_err:
 	printk("svcrdma: Error fast registering memory for xprt %p\n", xprt);
-	vec->frmr = NULL;
 	svc_rdma_put_frmr(xprt, frmr);
 	return -EIO;
 }
@@ -517,7 +516,6 @@ static int send_reply(struct svcxprt_rdma *rdma,
 		       "svcrdma: could not post a receive buffer, err=%d."
 		       "Closing transport %p.\n", ret, rdma);
 		set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
-		svc_rdma_put_frmr(rdma, vec->frmr);
 		svc_rdma_put_context(ctxt, 0);
 		return -ENOTCONN;
 	}
@@ -608,7 +606,6 @@ static int send_reply(struct svcxprt_rdma *rdma,
 	return 0;
 
  err:
-	svc_rdma_unmap_dma(ctxt);
 	svc_rdma_put_frmr(rdma, vec->frmr);
 	svc_rdma_put_context(ctxt, 1);
 	return -EIO;
diff --git a/trunk/net/sunrpc/xprtrdma/svc_rdma_transport.c b/trunk/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 4b0c2fa15e0b..3d810e7df3fb 100644
--- a/trunk/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/trunk/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -520,9 +520,8 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
 	svc_xprt_get(&xprt->sc_xprt);
 	ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
 	if (ret) {
-		svc_rdma_unmap_dma(ctxt);
-		svc_rdma_put_context(ctxt, 1);
 		svc_xprt_put(&xprt->sc_xprt);
+		svc_rdma_put_context(ctxt, 1);
 	}
 	return ret;