51 files changed, 908 insertions, 287 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci
index ceddcff4082a..e638e15a8895 100644
--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@@ -1,3 +1,46 @@
+What:           /sys/bus/pci/drivers/.../bind
+Date:           December 2003
+Contact:        linux-pci@vger.kernel.org
+Description:
+                Writing a device location to this file will cause
+                the driver to attempt to bind to the device found at
+                this location.  This is useful for overriding default
+                bindings.  The format for the location is: DDDD:BB:DD.F.
+                That is Domain:Bus:Device.Function and is the same as
+                found in /sys/bus/pci/devices/.  For example:
+                # echo 0000:00:19.0 > /sys/bus/pci/drivers/foo/bind
+                (Note: kernels before 2.6.28 may require echo -n).
+
+What:           /sys/bus/pci/drivers/.../unbind
+Date:           December 2003
+Contact:        linux-pci@vger.kernel.org
+Description:
+                Writing a device location to this file will cause the
+                driver to attempt to unbind from the device found at
+                this location.  This may be useful when overriding default
+                bindings.  The format for the location is: DDDD:BB:DD.F.
+                That is Domain:Bus:Device.Function and is the same as
+                found in /sys/bus/pci/devices/. For example:
+                # echo 0000:00:19.0 > /sys/bus/pci/drivers/foo/unbind
+                (Note: kernels before 2.6.28 may require echo -n).
+
+What:           /sys/bus/pci/drivers/.../new_id
+Date:           December 2003
+Contact:        linux-pci@vger.kernel.org
+Description:
+                Writing a device ID to this file will attempt to
+                dynamically add a new device ID to a PCI device driver.
+                This may allow the driver to support more hardware than
+                was included in the driver's static device ID support
+                table at compile time.  The format for the device ID is:
+                VVVV DDDD SVVV SDDD CCCC MMMM PPPP.  That is Vendor ID,
+                Device ID, Subsystem Vendor ID, Subsystem Device ID,
+                Class, Class Mask, and Private Driver Data.  The Vendor ID
+                and Device ID fields are required, the rest are optional.
+                Upon successfully adding an ID, the driver will probe
+                for the device and attempt to bind to it.  For example:
+                # echo "8086 10f5" > /sys/bus/pci/drivers/foo/new_id
+
 What:           /sys/bus/pci/devices/.../vpd
 Date:           February 2008
 Contact:        Ben Hutchings <bhutchings@solarflare.com>
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index ada06924a423..73cb6a3229ae 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -367,27 +367,24 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr,
 static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg,
                            unsigned int flags)
 {
-        char *ptr = (char *) &current->thread.TS_FPR(reg);
-        int i, ret;
+        char *ptr0 = (char *) &current->thread.TS_FPR(reg);
+        char *ptr1 = (char *) &current->thread.TS_FPR(reg+1);
+        int i, ret, sw = 0;
 
         if (!(flags & F))
                 return 0;
         if (reg & 1)
                 return 0;       /* invalid form: FRS/FRT must be even */
-        if (!(flags & SW)) {
-                /* not byte-swapped - easy */
-                if (!(flags & ST))
-                        ret = __copy_from_user(ptr, addr, 16);
-                else
-                        ret = __copy_to_user(addr, ptr, 16);
-        } else {
-                /* each FPR value is byte-swapped separately */
-                ret = 0;
-                for (i = 0; i < 16; ++i) {
-                        if (!(flags & ST))
-                                ret |= __get_user(ptr[i^7], addr + i);
-                        else
-                                ret |= __put_user(ptr[i^7], addr + i);
+        if (flags & SW)
+                sw = 7;
+        ret = 0;
+        for (i = 0; i < 8; ++i) {
+                if (!(flags & ST)) {
+                        ret |= __get_user(ptr0[i^sw], addr + i);
+                        ret |= __get_user(ptr1[i^sw], addr + i + 8);
+                } else {
+                        ret |= __put_user(ptr0[i^sw], addr + i);
+                        ret |= __put_user(ptr1[i^sw], addr + i + 8);
                 }
         }
         if (ret)
diff --git a/arch/powerpc/lib/copyuser_64.S b/arch/powerpc/lib/copyuser_64.S
index 70693a5c12a1..693b14a778fa 100644
--- a/arch/powerpc/lib/copyuser_64.S
+++ b/arch/powerpc/lib/copyuser_64.S
@@ -62,18 +62,19 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 72:     std     r8,8(r3)
         beq+    3f
         addi    r3,r3,16
-23:     ld      r9,8(r4)
 .Ldo_tail:
         bf      cr7*4+1,1f
-        rotldi  r9,r9,32
+23:     lwz     r9,8(r4)
+        addi    r4,r4,4
 73:     stw     r9,0(r3)
         addi    r3,r3,4
 1:      bf      cr7*4+2,2f
-        rotldi  r9,r9,16
+44:     lhz     r9,8(r4)
+        addi    r4,r4,2
 74:     sth     r9,0(r3)
         addi    r3,r3,2
 2:      bf      cr7*4+3,3f
-        rotldi  r9,r9,8
+45:     lbz     r9,8(r4)
 75:     stb     r9,0(r3)
 3:      li      r3,0
         blr
@@ -141,11 +142,24 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 6:      cmpwi   cr1,r5,8
         addi    r3,r3,32
         sld     r9,r9,r10
-        ble     cr1,.Ldo_tail
+        ble     cr1,7f
 34:     ld      r0,8(r4)
         srd     r7,r0,r11
         or      r9,r7,r9
-        b       .Ldo_tail
+7:
+        bf      cr7*4+1,1f
+        rotldi  r9,r9,32
+94:     stw     r9,0(r3)
+        addi    r3,r3,4
+1:      bf      cr7*4+2,2f
+        rotldi  r9,r9,16
+95:     sth     r9,0(r3)
+        addi    r3,r3,2
+2:      bf      cr7*4+3,3f
+        rotldi  r9,r9,8
+96:     stb     r9,0(r3)
+3:      li      r3,0
+        blr
 
 .Ldst_unaligned:
         PPC_MTOCRF      0x01,r6         /* put #bytes to 8B bdry into cr7 */
@@ -218,7 +232,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 121:
 132:
         addi    r3,r3,8
-123:
 134:
 135:
 138:
@@ -226,6 +239,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 140:
 141:
 142:
+123:
+144:
+145:
 
 /*
  * here we have had a fault on a load and r3 points to the first
@@ -309,6 +325,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 187:
 188:
 189:    
+194:
+195:
+196:
 1:
         ld      r6,-24(r1)
         ld      r5,-8(r1)
@@ -329,7 +348,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
         .llong  72b,172b
         .llong  23b,123b
         .llong  73b,173b
+        .llong  44b,144b
         .llong  74b,174b
+        .llong  45b,145b
         .llong  75b,175b
         .llong  24b,124b
         .llong  25b,125b
@@ -347,6 +368,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
         .llong  79b,179b
         .llong  80b,180b
         .llong  34b,134b
+        .llong  94b,194b
+        .llong  95b,195b
+        .llong  96b,196b
         .llong  35b,135b
         .llong  81b,181b
         .llong  36b,136b
diff --git a/arch/powerpc/lib/memcpy_64.S b/arch/powerpc/lib/memcpy_64.S
index fe2d34e5332d..e178922b2c21 100644
--- a/arch/powerpc/lib/memcpy_64.S
+++ b/arch/powerpc/lib/memcpy_64.S
@@ -53,18 +53,19 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 3:      std     r8,8(r3)
         beq     3f
         addi    r3,r3,16
-        ld      r9,8(r4)
 .Ldo_tail:
         bf      cr7*4+1,1f
-        rotldi  r9,r9,32
+        lwz     r9,8(r4)
+        addi    r4,r4,4
         stw     r9,0(r3)
         addi    r3,r3,4
 1:      bf      cr7*4+2,2f
-        rotldi  r9,r9,16
+        lhz     r9,8(r4)
+        addi    r4,r4,2
         sth     r9,0(r3)
         addi    r3,r3,2
 2:      bf      cr7*4+3,3f
-        rotldi  r9,r9,8
+        lbz     r9,8(r4)
         stb     r9,0(r3)
 3:      ld      r3,48(r1)       /* return dest pointer */
         blr
@@ -133,11 +134,24 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
         cmpwi   cr1,r5,8
         addi    r3,r3,32
         sld     r9,r9,r10
-        ble     cr1,.Ldo_tail
+        ble     cr1,6f
         ld      r0,8(r4)
         srd     r7,r0,r11
         or      r9,r7,r9
-        b       .Ldo_tail
+6:
+        bf      cr7*4+1,1f
+        rotldi  r9,r9,32
+        stw     r9,0(r3)
+        addi    r3,r3,4
+1:      bf      cr7*4+2,2f
+        rotldi  r9,r9,16
+        sth     r9,0(r3)
+        addi    r3,r3,2
+2:      bf      cr7*4+3,3f
+        rotldi  r9,r9,8
+        stb     r9,0(r3)
+3:      ld      r3,48(r1)       /* return dest pointer */
+        blr
 
 .Ldst_unaligned:
         PPC_MTOCRF      0x01,r6         # put #bytes to 8B bdry into cr7
diff --git a/arch/powerpc/sysdev/ppc4xx_pci.c b/arch/powerpc/sysdev/ppc4xx_pci.c
index 77fae5f64f2e..5558d932b4d5 100644
--- a/arch/powerpc/sysdev/ppc4xx_pci.c
+++ b/arch/powerpc/sysdev/ppc4xx_pci.c
@@ -204,6 +204,23 @@ static int __init ppc4xx_setup_one_pci_PMM(struct pci_controller	*hose,
 {
         u32 ma, pcila, pciha;
 
+        /* Hack warning ! The "old" PCI 2.x cell only let us configure the low
+         * 32-bit of incoming PLB addresses. The top 4 bits of the 36-bit
+         * address are actually hard wired to a value that appears to depend
+         * on the specific SoC. For example, it's 0 on 440EP and 1 on 440EPx.
+         *
+         * The trick here is we just crop those top bits and ignore them when
+         * programming the chip. That means the device-tree has to be right
+         * for the specific part used (we don't print a warning if it's wrong
+         * but on the other hand, you'll crash quickly enough), but at least
+         * this code should work whatever the hard coded value is
+         */
+        plb_addr &= 0xffffffffull;
+
+        /* Note: Due to the above hack, the test below doesn't actually test
+         * if you address is above 4G, but it tests that address and
+         * (address + size) are both contained in the same 4G
+         */
         if ((plb_addr + size) > 0xffffffffull || !is_power_of_2(size) ||
             size < 0x1000 || (plb_addr & (size - 1)) != 0) {
                 printk(KERN_WARNING "%s: Resource out of range\n",
diff --git a/block/blk-merge.c b/block/blk-merge.c
index b92f5b0866b0..a104593e70c3 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -38,72 +38,84 @@ void blk_recalc_rq_sectors(struct request *rq, int nsect)
         }
 }
 
-void blk_recalc_rq_segments(struct request *rq)
+static unsigned int __blk_recalc_rq_segments(struct request_queue *q,
+                                             struct bio *bio,
+                                             unsigned int *seg_size_ptr)
 {
-        int nr_phys_segs;
         unsigned int phys_size;
         struct bio_vec *bv, *bvprv = NULL;
-        int seg_size;
-        int cluster;
-        struct req_iterator iter;
-        int high, highprv = 1;
-        struct request_queue *q = rq->q;
+        int cluster, i, high, highprv = 1;
+        unsigned int seg_size, nr_phys_segs;
+        struct bio *fbio;
 
-        if (!rq->bio)
-                return;
+        if (!bio)
+                return 0;
 
+        fbio = bio;
         cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
         seg_size = 0;
         phys_size = nr_phys_segs = 0;
-        rq_for_each_segment(bv, rq, iter) {
-                /*
-                 * the trick here is making sure that a high page is never
-                 * considered part of another segment, since that might
-                 * change with the bounce page.
-                 */
-                high = page_to_pfn(bv->bv_page) > q->bounce_pfn;
-                if (high || highprv)
-                        goto new_segment;
-                if (cluster) {
-                        if (seg_size + bv->bv_len > q->max_segment_size)
-                                goto new_segment;
-                        if (!BIOVEC_PHYS_MERGEABLE(bvprv, bv))
-                                goto new_segment;
-                        if (!BIOVEC_SEG_BOUNDARY(q, bvprv, bv))
+        for_each_bio(bio) {
+                bio_for_each_segment(bv, bio, i) {
+                        /*
+                         * the trick here is making sure that a high page is
+                         * never considered part of another segment, since that
+                         * might change with the bounce page.
+                         */
+                        high = page_to_pfn(bv->bv_page) > q->bounce_pfn;
+                        if (high || highprv)
                                 goto new_segment;
+                        if (cluster) {
+                                if (seg_size + bv->bv_len > q->max_segment_size)
+                                        goto new_segment;
+                                if (!BIOVEC_PHYS_MERGEABLE(bvprv, bv))
+                                        goto new_segment;
+                                if (!BIOVEC_SEG_BOUNDARY(q, bvprv, bv))
+                                        goto new_segment;
+
+                                seg_size += bv->bv_len;
+                                bvprv = bv;
+                                continue;
+                        }
+new_segment:
+                        if (nr_phys_segs == 1 && seg_size >
+                            fbio->bi_seg_front_size)
+                                fbio->bi_seg_front_size = seg_size;
 
-                        seg_size += bv->bv_len;
+                        nr_phys_segs++;
                         bvprv = bv;
-                        continue;
+                        seg_size = bv->bv_len;
+                        highprv = high;
                 }
-new_segment:
-                if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
-                        rq->bio->bi_seg_front_size = seg_size;
-
-                nr_phys_segs++;
-                bvprv = bv;
-                seg_size = bv->bv_len;
-                highprv = high;
         }
 
-        if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
+        if (seg_size_ptr)
+                *seg_size_ptr = seg_size;
+
+        return nr_phys_segs;
+}
+
+void blk_recalc_rq_segments(struct request *rq)
+{
+        unsigned int seg_size = 0, phys_segs;
+
+        phys_segs = __blk_recalc_rq_segments(rq->q, rq->bio, &seg_size);
+
+        if (phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
                 rq->bio->bi_seg_front_size = seg_size;
         if (seg_size > rq->biotail->bi_seg_back_size)
                 rq->biotail->bi_seg_back_size = seg_size;
 
-        rq->nr_phys_segments = nr_phys_segs;
+        rq->nr_phys_segments = phys_segs;
 }
 
 void blk_recount_segments(struct request_queue *q, struct bio *bio)
 {
-        struct request rq;
         struct bio *nxt = bio->bi_next;
-        rq.q = q;
-        rq.bio = rq.biotail = bio;
+
         bio->bi_next = NULL;
-        blk_recalc_rq_segments(&rq);
+        bio->bi_phys_segments = __blk_recalc_rq_segments(q, bio, NULL);
         bio->bi_next = nxt;
-        bio->bi_phys_segments = rq.nr_phys_segments;
         bio->bi_flags |= (1 << BIO_SEG_VALID);
 }
 EXPORT_SYMBOL(blk_recount_segments);
diff --git a/block/genhd.c b/block/genhd.c
index e1eadcc9546a..a9ec910974c1 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -256,6 +256,22 @@ void blkdev_show(struct seq_file *seqf, off_t offset)
 }
 #endif /* CONFIG_PROC_FS */
 
+/**
+ * register_blkdev - register a new block device
+ *
+ * @major: the requested major device number [1..255]. If @major=0, try to
+ *         allocate any unused major number.
+ * @name: the name of the new block device as a zero terminated string
+ *
+ * The @name must be unique within the system.
+ *
+ * The return value depends on the @major input parameter.
+ *  - if a major device number was requested in range [1..255] then the
+ *    function returns zero on success, or a negative error code
+ *  - if any unused major number was requested with @major=0 parameter
+ *    then the return value is the allocated major number in range
+ *    [1..255] or a negative error code otherwise
+ */
 int register_blkdev(unsigned int major, const char *name)
 {
         struct blk_major_name **n, *p;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index d2cb67b61176..b5a061114630 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -3611,11 +3611,15 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
                 schedule_timeout_uninterruptible(30*HZ);
 
                 /* Now try to get the controller to respond to a no-op */
-                for (i=0; i<12; i++) {
+                for (i=0; i<30; i++) {
                         if (cciss_noop(pdev) == 0)
                                 break;
-                        else
-                                printk("cciss: no-op failed%s\n", (i < 11 ? "; re-trying" : ""));
+
+                        schedule_timeout_uninterruptible(HZ);
+                }
+                if (i == 30) {
+                        printk(KERN_ERR "cciss: controller seems dead\n");
+                        return -EBUSY;
                 }
         }
 
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 918ef725de41..b6c8ce254359 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -40,6 +40,7 @@
 #include <linux/hdreg.h>
 #include <linux/cdrom.h>
 #include <linux/module.h>
+#include <linux/scatterlist.h>
 
 #include <xen/xenbus.h>
 #include <xen/grant_table.h>
@@ -82,6 +83,7 @@ struct blkfront_info
         enum blkif_state connected;
         int ring_ref;
         struct blkif_front_ring ring;
+        struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         unsigned int evtchn, irq;
         struct request_queue *rq;
         struct work_struct work;
@@ -204,12 +206,11 @@ static int blkif_queue_request(struct request *req)
         struct blkfront_info *info = req->rq_disk->private_data;
         unsigned long buffer_mfn;
         struct blkif_request *ring_req;
-        struct req_iterator iter;
-        struct bio_vec *bvec;
         unsigned long id;
         unsigned int fsect, lsect;
-        int ref;
+        int i, ref;
         grant_ref_t gref_head;
+        struct scatterlist *sg;
 
         if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
                 return 1;
@@ -238,12 +239,13 @@ static int blkif_queue_request(struct request *req)
         if (blk_barrier_rq(req))
                 ring_req->operation = BLKIF_OP_WRITE_BARRIER;
 
-        ring_req->nr_segments = 0;
-        rq_for_each_segment(bvec, req, iter) {
-                BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST);
-                buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page));
-                fsect = bvec->bv_offset >> 9;
-                lsect = fsect + (bvec->bv_len >> 9) - 1;
+        ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg);
+        BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
+        for_each_sg(info->sg, sg, ring_req->nr_segments, i) {
+                buffer_mfn = pfn_to_mfn(page_to_pfn(sg_page(sg)));
+                fsect = sg->offset >> 9;
+                lsect = fsect + (sg->length >> 9) - 1;
                 /* install a grant reference. */
                 ref = gnttab_claim_grant_reference(&gref_head);
                 BUG_ON(ref == -ENOSPC);
@@ -254,16 +256,12 @@ static int blkif_queue_request(struct request *req)
                                 buffer_mfn,
                                 rq_data_dir(req) );
 
-                info->shadow[id].frame[ring_req->nr_segments] =
-                                mfn_to_pfn(buffer_mfn);
-
-                ring_req->seg[ring_req->nr_segments] =
+                info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
+                ring_req->seg[i] =
                                 (struct blkif_request_segment) {
                                         .gref       = ref,
                                         .first_sect = fsect,
                                         .last_sect  = lsect };
-
-                ring_req->nr_segments++;
         }
 
         info->ring.req_prod_pvt++;
@@ -622,6 +620,8 @@ static int setup_blkring(struct xenbus_device *dev,
         SHARED_RING_INIT(sring);
         FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE);
 
+        sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
         err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
         if (err < 0) {
                 free_page((unsigned long)sring);
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index 1028e725a27e..872338003721 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -1275,7 +1275,7 @@ static void __exit ieee1394_cleanup(void)
         unregister_chrdev_region(IEEE1394_CORE_DEV, 256);
 }
 
-module_init(ieee1394_init);
+fs_initcall(ieee1394_init);
 module_exit(ieee1394_cleanup);
 
 /* Exported symbols */
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index f26667a7abf7..cf991850f01b 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -710,6 +710,7 @@ out:
 
 static struct pci_device_id ilo_devices[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_COMPAQ, 0xB204) },
+        { PCI_DEVICE(PCI_VENDOR_ID_HP, 0x3307) },
         { }
 };
 MODULE_DEVICE_TABLE(pci, ilo_devices);
@@ -758,7 +759,7 @@ static void __exit ilo_exit(void)
         class_destroy(ilo_class);
 }
 
-MODULE_VERSION("0.06");
+MODULE_VERSION("1.0");
 MODULE_ALIAS(ILO_NAME);
 MODULE_DESCRIPTION(ILO_NAME);
 MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
diff --git a/drivers/mtd/chips/map_rom.c b/drivers/mtd/chips/map_rom.c
index 821d0ed6bae3..c76d6e5f47ee 100644
--- a/drivers/mtd/chips/map_rom.c
+++ b/drivers/mtd/chips/map_rom.c
@@ -19,6 +19,7 @@ static int maprom_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int maprom_write (struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
 static void maprom_nop (struct mtd_info *);
 static struct mtd_info *map_rom_probe(struct map_info *map);
+static int maprom_erase (struct mtd_info *mtd, struct erase_info *info);
 
 static struct mtd_chip_driver maprom_chipdrv = {
         .probe  = map_rom_probe,
@@ -42,6 +43,7 @@ static struct mtd_info *map_rom_probe(struct map_info *map)
         mtd->read = maprom_read;
         mtd->write = maprom_write;
         mtd->sync = maprom_nop;
+        mtd->erase = maprom_erase;
         mtd->flags = MTD_CAP_ROM;
         mtd->erasesize = map->size;
         mtd->writesize = 1;
@@ -71,6 +73,12 @@ static int maprom_write (struct mtd_info *mtd, loff_t to, size_t len, size_t *re
         return -EIO;
 }
 
+static int maprom_erase (struct mtd_info *mtd, struct erase_info *info)
+{
+        /* We do our best 8) */
+        return -EROFS;
+}
+
 static int __init map_rom_init(void)
 {
         register_mtd_chip_driver(&maprom_chipdrv);
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index a425d09f35a0..00248e81ecd5 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -267,22 +267,28 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
         if (*(szlength) != '+') {
                 devlength = simple_strtoul(szlength, &buffer, 0);
                 devlength = handle_unit(devlength, buffer) - devstart;
+                if (devlength < devstart)
+                        goto err_out;
+
+                devlength -= devstart;
         } else {
                 devlength = simple_strtoul(szlength + 1, &buffer, 0);
                 devlength = handle_unit(devlength, buffer);
         }
         T("slram: devname=%s, devstart=0x%lx, devlength=0x%lx\n",
                         devname, devstart, devlength);
-        if ((devstart < 0) || (devlength < 0) || (devlength % SLRAM_BLK_SZ != 0)) {
-                E("slram: Illegal start / length parameter.\n");
-                return(-EINVAL);
-        }
+        if (devlength % SLRAM_BLK_SZ != 0)
+                goto err_out;
 
         if ((devstart = register_device(devname, devstart, devlength))){
                 unregister_devices();
                 return((int)devstart);
         }
         return(0);
+
+err_out:
+        E("slram: Illegal length parameter.\n");
+        return(-EINVAL);
 }
 
 #ifndef MODULE
diff --git a/drivers/mtd/lpddr/Kconfig b/drivers/mtd/lpddr/Kconfig
index acd4ea9b2278..5a401d8047ab 100644
--- a/drivers/mtd/lpddr/Kconfig
+++ b/drivers/mtd/lpddr/Kconfig
@@ -12,6 +12,7 @@ config MTD_LPDDR
           DDR memories, intended for battery-operated systems.
 
 config MTD_QINFO_PROBE
+        depends on MTD_LPDDR
         tristate "Detect flash chips by QINFO probe"
         help
             Device Information for LPDDR chips is offered through the Overlay
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 0225cbbf22de..043d50fb6ef6 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -491,7 +491,7 @@ config MTD_PCMCIA_ANONYMOUS
 
 config MTD_BFIN_ASYNC
         tristate "Blackfin BF533-STAMP Flash Chip Support"
-        depends on BFIN533_STAMP && MTD_CFI
+        depends on BFIN533_STAMP && MTD_CFI && MTD_COMPLEX_MAPPINGS
         select MTD_PARTITIONS
         default y
         help
diff --git a/drivers/mtd/maps/bfin-async-flash.c b/drivers/mtd/maps/bfin-async-flash.c
index 6fec86aaed7e..576611f605db 100644
--- a/drivers/mtd/maps/bfin-async-flash.c
+++ b/drivers/mtd/maps/bfin-async-flash.c
@@ -152,14 +152,18 @@ static int __devinit bfin_flash_probe(struct platform_device *pdev)
 
         if (gpio_request(state->enet_flash_pin, DRIVER_NAME)) {
                 pr_devinit(KERN_ERR DRIVER_NAME ": Failed to request gpio %d\n", state->enet_flash_pin);
+                kfree(state);
                 return -EBUSY;
         }
         gpio_direction_output(state->enet_flash_pin, 1);
 
         pr_devinit(KERN_NOTICE DRIVER_NAME ": probing %d-bit flash bus\n", state->map.bankwidth * 8);
         state->mtd = do_map_probe(memory->name, &state->map);
-        if (!state->mtd)
+        if (!state->mtd) {
+                gpio_free(state->enet_flash_pin);
+                kfree(state);
                 return -ENXIO;
+        }
 
 #ifdef CONFIG_MTD_PARTITIONS
         ret = parse_mtd_partitions(state->mtd, part_probe_types, &pdata->parts, 0);
diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c
index 5f7a245ed132..424f17d6ffd1 100644
--- a/drivers/mtd/maps/ck804xrom.c
+++ b/drivers/mtd/maps/ck804xrom.c
@@ -342,9 +342,9 @@ static struct pci_device_id ck804xrom_pci_tbl[] = {
         { 0, }
 };
 
+#if 0
 MODULE_DEVICE_TABLE(pci, ck804xrom_pci_tbl);
 
-#if 0
 static struct pci_driver ck804xrom_driver = {
         .name =         MOD_NAME,
         .id_table =     ck804xrom_pci_tbl,
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 87743661d48e..4b122e7ab4b3 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -29,6 +29,7 @@ struct physmap_flash_info {
         struct map_info         map[MAX_RESOURCES];
 #ifdef CONFIG_MTD_PARTITIONS
         int                     nr_parts;
+        struct mtd_partition    *parts;
 #endif
 };
 
@@ -45,25 +46,26 @@ static int physmap_flash_remove(struct platform_device *dev)
 
         physmap_data = dev->dev.platform_data;
 
-#ifdef CONFIG_MTD_CONCAT
-        if (info->cmtd != info->mtd[0]) {
+#ifdef CONFIG_MTD_PARTITIONS
+        if (info->nr_parts) {
+                del_mtd_partitions(info->cmtd);
+                kfree(info->parts);
+        } else if (physmap_data->nr_parts)
+                del_mtd_partitions(info->cmtd);
+        else
                 del_mtd_device(info->cmtd);
+#else
+        del_mtd_device(info->cmtd);
+#endif
+
+#ifdef CONFIG_MTD_CONCAT
+        if (info->cmtd != info->mtd[0])
                 mtd_concat_destroy(info->cmtd);
-        }
 #endif
 
         for (i = 0; i < MAX_RESOURCES; i++) {
-                if (info->mtd[i] != NULL) {
-#ifdef CONFIG_MTD_PARTITIONS
-                        if (info->nr_parts || physmap_data->nr_parts)
-                                del_mtd_partitions(info->mtd[i]);
-                        else
-                                del_mtd_device(info->mtd[i]);
-#else
-                        del_mtd_device(info->mtd[i]);
-#endif
+                if (info->mtd[i] != NULL)
                         map_destroy(info->mtd[i]);
-                }
         }
         return 0;
 }
@@ -86,9 +88,6 @@ static int physmap_flash_probe(struct platform_device *dev)
         int err = 0;
         int i;
         int devices_found = 0;
-#ifdef CONFIG_MTD_PARTITIONS
-        struct mtd_partition *parts;
-#endif
 
         physmap_data = dev->dev.platform_data;
         if (physmap_data == NULL)
@@ -167,10 +166,11 @@ static int physmap_flash_probe(struct platform_device *dev)
                 goto err_out;
 
 #ifdef CONFIG_MTD_PARTITIONS
-        err = parse_mtd_partitions(info->cmtd, part_probe_types, &parts, 0);
+        err = parse_mtd_partitions(info->cmtd, part_probe_types,
+                                &info->parts, 0);
         if (err > 0) {
-                add_mtd_partitions(info->cmtd, parts, err);
-                kfree(parts);
+                add_mtd_partitions(info->cmtd, info->parts, err);
+                info->nr_parts = err;
                 return 0;
         }
 
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index db85284ffb62..39ae37589fda 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -111,6 +111,7 @@ struct controller {
         int cmd_busy;
         unsigned int no_cmd_complete:1;
         unsigned int link_active_reporting:1;
+        unsigned int notification_enabled:1;
 };
 
 #define INT_BUTTON_IGNORE               0
@@ -170,6 +171,7 @@ extern int pciehp_configure_device(struct slot *p_slot);
 extern int pciehp_unconfigure_device(struct slot *p_slot);
 extern void pciehp_queue_pushbutton_work(struct work_struct *work);
 struct controller *pcie_init(struct pcie_device *dev);
+int pcie_init_notification(struct controller *ctrl);
 int pciehp_enable_slot(struct slot *p_slot);
 int pciehp_disable_slot(struct slot *p_slot);
 int pcie_enable_notification(struct controller *ctrl);
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index c2485542f543..681e3912b821 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -434,6 +434,13 @@ static int pciehp_probe(struct pcie_device *dev, const struct pcie_port_service_
                 goto err_out_release_ctlr;
         }
 
+        /* Enable events after we have setup the data structures */
+        rc = pcie_init_notification(ctrl);
+        if (rc) {
+                ctrl_err(ctrl, "Notification initialization failed\n");
+                goto err_out_release_ctlr;
+        }
+
         /* Check if slot is occupied */
         t_slot = pciehp_find_slot(ctrl, ctrl->slot_device_offset);
         t_slot->hpc_ops->get_adapter_status(t_slot, &value);
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 71a8012886b0..7a16c6897bb9 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -934,7 +934,7 @@ static void pcie_disable_notification(struct controller *ctrl)
                 ctrl_warn(ctrl, "Cannot disable software notification\n");
 }
 
-static int pcie_init_notification(struct controller *ctrl)
+int pcie_init_notification(struct controller *ctrl)
 {
         if (pciehp_request_irq(ctrl))
                 return -1;
@@ -942,13 +942,17 @@ static int pcie_init_notification(struct controller *ctrl)
                 pciehp_free_irq(ctrl);
                 return -1;
         }
+        ctrl->notification_enabled = 1;
         return 0;
 }
 
 static void pcie_shutdown_notification(struct controller *ctrl)
 {
-        pcie_disable_notification(ctrl);
-        pciehp_free_irq(ctrl);
+        if (ctrl->notification_enabled) {
+                pcie_disable_notification(ctrl);
+                pciehp_free_irq(ctrl);
+                ctrl->notification_enabled = 0;
+        }
 }
 
 static int pcie_init_slot(struct controller *ctrl)
@@ -1110,13 +1114,8 @@ struct controller *pcie_init(struct pcie_device *dev)
         if (pcie_init_slot(ctrl))
                 goto abort_ctrl;
 
-        if (pcie_init_notification(ctrl))
-                goto abort_slot;
-
         return ctrl;
 
-abort_slot:
-        pcie_cleanup_slot(ctrl);
 abort_ctrl:
         kfree(ctrl);
 abort:
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index aac7006949f1..d0c973685868 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -108,6 +108,34 @@ int pci_cleanup_aer_correct_error_status(struct pci_dev *dev)
 }
 #endif  /*  0  */
 
+
+static void set_device_error_reporting(struct pci_dev *dev, void *data)
+{
+        bool enable = *((bool *)data);
+
+        if (dev->pcie_type != PCIE_RC_PORT &&
+            dev->pcie_type != PCIE_SW_UPSTREAM_PORT &&
+            dev->pcie_type != PCIE_SW_DOWNSTREAM_PORT)
+                return;
+
+        if (enable)
+                pci_enable_pcie_error_reporting(dev);
+        else
+                pci_disable_pcie_error_reporting(dev);
+}
+
+/**
+ * set_downstream_devices_error_reporting - enable/disable the error reporting  bits on the root port and its downstream ports.
+ * @dev: pointer to root port's pci_dev data structure
+ * @enable: true = enable error reporting, false = disable error reporting.
+ */
+static void set_downstream_devices_error_reporting(struct pci_dev *dev,
+                                                   bool enable)
+{
+        set_device_error_reporting(dev, &enable);
+        pci_walk_bus(dev->subordinate, set_device_error_reporting, &enable);
+}
+
 static int find_device_iter(struct device *device, void *data)
 {
         struct pci_dev *dev;
@@ -525,15 +553,11 @@ void aer_enable_rootport(struct aer_rpc *rpc)
         pci_read_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, &reg32);
         pci_write_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, reg32);
 
-        /* Enable Root Port device reporting error itself */
-        pci_read_config_word(pdev, pos+PCI_EXP_DEVCTL, &reg16);
-        reg16 = reg16 |
-                PCI_EXP_DEVCTL_CERE |
-                PCI_EXP_DEVCTL_NFERE |
-                PCI_EXP_DEVCTL_FERE |
-                PCI_EXP_DEVCTL_URRE;
-        pci_write_config_word(pdev, pos+PCI_EXP_DEVCTL,
-                reg16);
+        /*
+         * Enable error reporting for the root port device and downstream port
+         * devices.
+         */
+        set_downstream_devices_error_reporting(pdev, true);
 
         /* Enable Root Port's interrupt in response to error messages */
         pci_write_config_dword(pdev,
@@ -553,6 +577,12 @@ static void disable_root_aer(struct aer_rpc *rpc)
         u32 reg32;
         int pos;
 
+        /*
+         * Disable error reporting for the root port device and downstream port
+         * devices.
+         */
+        set_downstream_devices_error_reporting(pdev, false);
+
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
         /* Disable Root's interrupt in response to error messages */
         pci_write_config_dword(pdev, pos + PCI_ERR_ROOT_COMMAND, 0);
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index f9b874eaeb9f..248b4db91552 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -97,8 +97,6 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
 
         pcie_portdrv_save_config(dev);
 
-        pci_enable_pcie_error_reporting(dev);
-
         return 0;
 }
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index baad093aafe3..f20d55368edb 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1584,6 +1584,7 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_
  */
 #define AMD_813X_MISC                   0x40
 #define AMD_813X_NOIOAMODE              (1<<0)
+#define AMD_813X_REV_B2                 0x13
 
 static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 {
@@ -1591,6 +1592,8 @@ static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 
         if (noioapicquirk)
                 return;
+        if (dev->revision == AMD_813X_REV_B2)
+                return;
 
         pci_read_config_dword(dev, AMD_813X_MISC, &pci_config_dword);
         pci_config_dword &= ~AMD_813X_NOIOAMODE;
@@ -1981,7 +1984,6 @@ static void __devinit quirk_msi_ht_cap(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE,
                         quirk_msi_ht_cap);
 
-
 /* The nVidia CK804 chipset may have 2 HT MSI mappings.
  * MSI are supported if the MSI capability set in any of these mappings.
  */
@@ -2032,6 +2034,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS,
                          PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB,
                          ht_enable_msi_mapping);
 
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE,
+                         ht_enable_msi_mapping);
+
 /* The P5N32-SLI Premium motherboard from Asus has a problem with msi
  * for the MCP55 NIC. It is not yet determined whether the msi problem
  * also affects other devices. As for now, turn off msi for this device.
@@ -2048,10 +2053,100 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA,
                         PCI_DEVICE_ID_NVIDIA_NVENET_15,
                         nvenet_msi_disable);
 
-static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
+static void __devinit nv_ht_enable_msi_mapping(struct pci_dev *dev)
 {
         struct pci_dev *host_bridge;
+        int pos;
+        int i, dev_no;
+        int found = 0;
+
+        dev_no = dev->devfn >> 3;
+        for (i = dev_no; i >= 0; i--) {
+                host_bridge = pci_get_slot(dev->bus, PCI_DEVFN(i, 0));
+                if (!host_bridge)
+                        continue;
+
+                pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE);
+                if (pos != 0) {
+                        found = 1;
+                        break;
+                }
+                pci_dev_put(host_bridge);
+        }
+
+        if (!found)
+                return;
+
+        /* root did that ! */
+        if (msi_ht_cap_enabled(host_bridge))
+                goto out;
+
+        ht_enable_msi_mapping(dev);
+
+out:
+        pci_dev_put(host_bridge);
+}
+
+static void __devinit ht_disable_msi_mapping(struct pci_dev *dev)
+{
+        int pos, ttl = 48;
+
+        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
+        while (pos && ttl--) {
+                u8 flags;
+
+                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
+                                         &flags) == 0) {
+                        dev_info(&dev->dev, "Enabling HT MSI Mapping\n");
+
+                        pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
+                                              flags & ~HT_MSI_FLAGS_ENABLE);
+                }
+                pos = pci_find_next_ht_capability(dev, pos,
+                                                  HT_CAPTYPE_MSI_MAPPING);
+        }
+}
+
+static int __devinit ht_check_msi_mapping(struct pci_dev *dev)
+{
         int pos, ttl = 48;
+        int found = 0;
+
+        /* check if there is HT MSI cap or enabled on this device */
+        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
+        while (pos && ttl--) {
+                u8 flags;
+
+                if (found < 1)
+                        found = 1;
+                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
+                                         &flags) == 0) {
+                        if (flags & HT_MSI_FLAGS_ENABLE) {
+                                if (found < 2) {
+                                        found = 2;
+                                        break;
+                                }
+                        }
+                }
+                pos = pci_find_next_ht_capability(dev, pos,
+                                                  HT_CAPTYPE_MSI_MAPPING);
+        }
+
+        return found;
+}
+
+static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
+{
+        struct pci_dev *host_bridge;
+        int pos;
+        int found;
+
+        /* check if there is HT MSI cap or enabled on this device */
+        found = ht_check_msi_mapping(dev);
+
+        /* no HT MSI CAP */
+        if (found == 0)
+                return;
 
         /*
          * HT MSI mapping should be disabled on devices that are below
@@ -2067,24 +2162,19 @@ static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
         pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE);
         if (pos != 0) {
                 /* Host bridge is to HT */
-                ht_enable_msi_mapping(dev);
+                if (found == 1) {
+                        /* it is not enabled, try to enable it */
+                        nv_ht_enable_msi_mapping(dev);
+                }
                 return;
         }
 
-        /* Host bridge is not to HT, disable HT MSI mapping on this device */
-        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
-        while (pos && ttl--) {
-                u8 flags;
+        /* HT MSI is not enabled */
+        if (found == 1)
+                return;
 
-                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
-                                         &flags) == 0) {
-                        dev_info(&dev->dev, "Disabling HT MSI mapping");
-                        pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
-                                              flags & ~HT_MSI_FLAGS_ENABLE);
-                }
-                pos = pci_find_next_ht_capability(dev, pos,
-                                                  HT_CAPTYPE_MSI_MAPPING);
-        }
+        /* Host bridge is not to HT, disable HT MSI mapping on this device */
+        ht_disable_msi_mapping(dev);
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk);
diff --git a/drivers/w1/slaves/Kconfig b/drivers/w1/slaves/Kconfig
index 8d0b1fb1e52e..1f51366417b9 100644
--- a/drivers/w1/slaves/Kconfig
+++ b/drivers/w1/slaves/Kconfig
@@ -16,6 +16,12 @@ config W1_SLAVE_SMEM
           Say Y here if you want to connect 1-wire
           simple 64bit memory rom(ds2401/ds2411/ds1990*) to your wire.
 
+config W1_SLAVE_DS2431
+        tristate "1kb EEPROM family support (DS2431)"
+        help
+          Say Y here if you want to use a 1-wire
+          1kb EEPROM family device (DS2431)
+
 config W1_SLAVE_DS2433
         tristate "4kb EEPROM family support (DS2433)"
         help
diff --git a/drivers/w1/slaves/Makefile b/drivers/w1/slaves/Makefile
index 990f400b6d22..f1f51f19b129 100644
--- a/drivers/w1/slaves/Makefile
+++ b/drivers/w1/slaves/Makefile
@@ -4,6 +4,7 @@
 
 obj-$(CONFIG_W1_SLAVE_THERM)    += w1_therm.o
 obj-$(CONFIG_W1_SLAVE_SMEM)     += w1_smem.o
+obj-$(CONFIG_W1_SLAVE_DS2431)   += w1_ds2431.o
 obj-$(CONFIG_W1_SLAVE_DS2433)   += w1_ds2433.o
 obj-$(CONFIG_W1_SLAVE_DS2760)   += w1_ds2760.o
 obj-$(CONFIG_W1_SLAVE_BQ27000)  += w1_bq27000.o
diff --git a/drivers/w1/slaves/w1_ds2433.c b/drivers/w1/slaves/w1_ds2433.c
index 858c16a544c2..139447148822 100644
--- a/drivers/w1/slaves/w1_ds2433.c
+++ b/drivers/w1/slaves/w1_ds2433.c
@@ -156,6 +156,9 @@ out_up:
  */
 static int w1_f23_write(struct w1_slave *sl, int addr, int len, const u8 *data)
 {
+#ifdef CONFIG_W1_SLAVE_DS2433_CRC
+        struct w1_f23_data *f23 = sl->family_data;
+#endif
         u8 wrbuf[4];
         u8 rdbuf[W1_PAGE_SIZE + 3];
         u8 es = (addr + len - 1) & 0x1f;
@@ -196,7 +199,9 @@ static int w1_f23_write(struct w1_slave *sl, int addr, int len, const u8 *data)
 
         /* Reset the bus to wake up the EEPROM (this may not be needed) */
         w1_reset_bus(sl->master);
-
+#ifdef CONFIG_W1_SLAVE_DS2433_CRC
+        f23->validcrc &= ~(1 << (addr >> W1_PAGE_BITS));
+#endif
         return 0;
 }
 
diff --git a/fs/bio.c b/fs/bio.c
index 72ab251cdb9c..124b95c4d582 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -302,7 +302,7 @@ void bio_init(struct bio *bio)
 struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
 {
         struct bio *bio = NULL;
-        void *p;
+        void *uninitialized_var(p);
 
         if (bs) {
                 p = mempool_alloc(bs->bio_pool, gfp_mask);
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index a8c9693b75ac..72677ce2b74f 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -66,6 +66,9 @@ struct btrfs_inode {
          */
         struct list_head delalloc_inodes;
 
+        /* the space_info for where this inode's data allocations are done */
+        struct btrfs_space_info *space_info;
+
         /* full 64 bit generation number, struct vfs_inode doesn't have a big
          * enough field for this.
          */
@@ -94,6 +97,11 @@ struct btrfs_inode {
          */
         u64 delalloc_bytes;
 
+        /* total number of bytes that may be used for this inode for
+         * delalloc
+         */
+        u64 reserved_bytes;
+
         /*
          * the size of the file stored in the metadata on disk.  data=ordered
          * means the in-memory i_size might be larger than the size on disk
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 766b31ae3186..82491ba8fa40 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -596,13 +596,27 @@ struct btrfs_block_group_item {
 
 struct btrfs_space_info {
         u64 flags;
-        u64 total_bytes;
-        u64 bytes_used;
-        u64 bytes_pinned;
-        u64 bytes_reserved;
-        u64 bytes_readonly;
-        int full;
-        int force_alloc;
+
+        u64 total_bytes;        /* total bytes in the space */
+        u64 bytes_used;         /* total bytes used on disk */
+        u64 bytes_pinned;       /* total bytes pinned, will be freed when the
+                                   transaction finishes */
+        u64 bytes_reserved;     /* total bytes the allocator has reserved for
+                                   current allocations */
+        u64 bytes_readonly;     /* total bytes that are read only */
+
+        /* delalloc accounting */
+        u64 bytes_delalloc;     /* number of bytes reserved for allocation,
+                                   this space is not necessarily reserved yet
+                                   by the allocator */
+        u64 bytes_may_use;      /* number of bytes that may be used for
+                                   delalloc */
+
+        int full;               /* indicates that we cannot allocate any more
+                                   chunks for this space */
+        int force_alloc;        /* set if we need to force a chunk alloc for
+                                   this space */
+
         struct list_head list;
 
         /* for block groups in our same type */
@@ -1782,6 +1796,16 @@ int btrfs_add_dead_reloc_root(struct btrfs_root *root);
 int btrfs_cleanup_reloc_trees(struct btrfs_root *root);
 int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len);
 u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags);
+void btrfs_set_inode_space_info(struct btrfs_root *root, struct inode *ionde);
+int btrfs_check_metadata_free_space(struct btrfs_root *root);
+int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
+                                u64 bytes);
+void btrfs_free_reserved_data_space(struct btrfs_root *root,
+                                    struct inode *inode, u64 bytes);
+void btrfs_delalloc_reserve_space(struct btrfs_root *root, struct inode *inode,
+                                 u64 bytes);
+void btrfs_delalloc_free_space(struct btrfs_root *root, struct inode *inode,
+                              u64 bytes);
 /* ctree.c */
 int btrfs_previous_item(struct btrfs_root *root,
                         struct btrfs_path *path, u64 min_objectid,
@@ -2027,8 +2051,6 @@ int btrfs_merge_bio_hook(struct page *page, unsigned long offset,
 unsigned long btrfs_force_ra(struct address_space *mapping,
                               struct file_ra_state *ra, struct file *file,
                               pgoff_t offset, pgoff_t last_index);
-int btrfs_check_free_space(struct btrfs_root *root, u64 num_required,
-                           int for_del);
 int btrfs_page_mkwrite(struct vm_area_struct *vma, struct page *page);
 int btrfs_readpage(struct file *file, struct page *page);
 void btrfs_delete_inode(struct inode *inode);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 0a5d796c9f7e..6b5966aacf44 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -60,6 +60,10 @@ static int update_block_group(struct btrfs_trans_handle *trans,
                               u64 bytenr, u64 num_bytes, int alloc,
                               int mark_free);
 
+static int do_chunk_alloc(struct btrfs_trans_handle *trans,
+                          struct btrfs_root *extent_root, u64 alloc_bytes,
+                          u64 flags, int force);
+
 static int block_group_bits(struct btrfs_block_group_cache *cache, u64 bits)
 {
         return (cache->flags & bits) == bits;
@@ -1909,6 +1913,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
         found->bytes_pinned = 0;
         found->bytes_reserved = 0;
         found->bytes_readonly = 0;
+        found->bytes_delalloc = 0;
         found->full = 0;
         found->force_alloc = 0;
         *space_info = found;
@@ -1972,6 +1977,233 @@ u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags)
         return flags;
 }
 
+static u64 btrfs_get_alloc_profile(struct btrfs_root *root, u64 data)
+{
+        struct btrfs_fs_info *info = root->fs_info;
+        u64 alloc_profile;
+
+        if (data) {
+                alloc_profile = info->avail_data_alloc_bits &
+                        info->data_alloc_profile;
+                data = BTRFS_BLOCK_GROUP_DATA | alloc_profile;
+        } else if (root == root->fs_info->chunk_root) {
+                alloc_profile = info->avail_system_alloc_bits &
+                        info->system_alloc_profile;
+                data = BTRFS_BLOCK_GROUP_SYSTEM | alloc_profile;
+        } else {
+                alloc_profile = info->avail_metadata_alloc_bits &
+                        info->metadata_alloc_profile;
+                data = BTRFS_BLOCK_GROUP_METADATA | alloc_profile;
+        }
+
+        return btrfs_reduce_alloc_profile(root, data);
+}
+
+void btrfs_set_inode_space_info(struct btrfs_root *root, struct inode *inode)
+{
+        u64 alloc_target;
+
+        alloc_target = btrfs_get_alloc_profile(root, 1);
+        BTRFS_I(inode)->space_info = __find_space_info(root->fs_info,
+                                                       alloc_target);
+}
+
+/*
+ * for now this just makes sure we have at least 5% of our metadata space free
+ * for use.
+ */
+int btrfs_check_metadata_free_space(struct btrfs_root *root)
+{
+        struct btrfs_fs_info *info = root->fs_info;
+        struct btrfs_space_info *meta_sinfo;
+        u64 alloc_target, thresh;
+        int committed = 0, ret;
+
+        /* get the space info for where the metadata will live */
+        alloc_target = btrfs_get_alloc_profile(root, 0);
+        meta_sinfo = __find_space_info(info, alloc_target);
+
+again:
+        spin_lock(&meta_sinfo->lock);
+        if (!meta_sinfo->full)
+                thresh = meta_sinfo->total_bytes * 80;
+        else
+                thresh = meta_sinfo->total_bytes * 95;
+
+        do_div(thresh, 100);
+
+        if (meta_sinfo->bytes_used + meta_sinfo->bytes_reserved +
+            meta_sinfo->bytes_pinned + meta_sinfo->bytes_readonly > thresh) {
+                struct btrfs_trans_handle *trans;
+                if (!meta_sinfo->full) {
+                        meta_sinfo->force_alloc = 1;
+                        spin_unlock(&meta_sinfo->lock);
+
+                        trans = btrfs_start_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+
+                        ret = do_chunk_alloc(trans, root->fs_info->extent_root,
+                                             2 * 1024 * 1024, alloc_target, 0);
+                        btrfs_end_transaction(trans, root);
+                        goto again;
+                }
+                spin_unlock(&meta_sinfo->lock);
+
+                if (!committed) {
+                        committed = 1;
+                        trans = btrfs_join_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+                        ret = btrfs_commit_transaction(trans, root);
+                        if (ret)
+                                return ret;
+                        goto again;
+                }
+                return -ENOSPC;
+        }
+        spin_unlock(&meta_sinfo->lock);
+
+        return 0;
+}
+
+/*
+ * This will check the space that the inode allocates from to make sure we have
+ * enough space for bytes.
+ */
+int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
+                                u64 bytes)
+{
+        struct btrfs_space_info *data_sinfo;
+        int ret = 0, committed = 0;
+
+        /* make sure bytes are sectorsize aligned */
+        bytes = (bytes + root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
+
+        data_sinfo = BTRFS_I(inode)->space_info;
+again:
+        /* make sure we have enough space to handle the data first */
+        spin_lock(&data_sinfo->lock);
+        if (data_sinfo->total_bytes - data_sinfo->bytes_used -
+            data_sinfo->bytes_delalloc - data_sinfo->bytes_reserved -
+            data_sinfo->bytes_pinned - data_sinfo->bytes_readonly -
+            data_sinfo->bytes_may_use < bytes) {
+                struct btrfs_trans_handle *trans;
+
+                /*
+                 * if we don't have enough free bytes in this space then we need
+                 * to alloc a new chunk.
+                 */
+                if (!data_sinfo->full) {
+                        u64 alloc_target;
+
+                        data_sinfo->force_alloc = 1;
+                        spin_unlock(&data_sinfo->lock);
+
+                        alloc_target = btrfs_get_alloc_profile(root, 1);
+                        trans = btrfs_start_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+
+                        ret = do_chunk_alloc(trans, root->fs_info->extent_root,
+                                             bytes + 2 * 1024 * 1024,
+                                             alloc_target, 0);
+                        btrfs_end_transaction(trans, root);
+                        if (ret)
+                                return ret;
+                        goto again;
+                }
+                spin_unlock(&data_sinfo->lock);
+
+                /* commit the current transaction and try again */
+                if (!committed) {
+                        committed = 1;
+                        trans = btrfs_join_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+                        ret = btrfs_commit_transaction(trans, root);
+                        if (ret)
+                                return ret;
+                        goto again;
+                }
+
+                printk(KERN_ERR "no space left, need %llu, %llu delalloc bytes"
+                       ", %llu bytes_used, %llu bytes_reserved, "
+                       "%llu bytes_pinned, %llu bytes_readonly, %llu may use"
+                       "%llu total\n", bytes, data_sinfo->bytes_delalloc,
+                       data_sinfo->bytes_used, data_sinfo->bytes_reserved,
+                       data_sinfo->bytes_pinned, data_sinfo->bytes_readonly,
+                       data_sinfo->bytes_may_use, data_sinfo->total_bytes);
+                return -ENOSPC;
+        }
+        data_sinfo->bytes_may_use += bytes;
+        BTRFS_I(inode)->reserved_bytes += bytes;
+        spin_unlock(&data_sinfo->lock);
+
+        return btrfs_check_metadata_free_space(root);
+}
+
+/*
+ * if there was an error for whatever reason after calling
+ * btrfs_check_data_free_space, call this so we can cleanup the counters.
+ */
+void btrfs_free_reserved_data_space(struct btrfs_root *root,
+                                    struct inode *inode, u64 bytes)
+{
+        struct btrfs_space_info *data_sinfo;
+
+        /* make sure bytes are sectorsize aligned */
+        bytes = (bytes + root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
+
+        data_sinfo = BTRFS_I(inode)->space_info;
+        spin_lock(&data_sinfo->lock);
+        data_sinfo->bytes_may_use -= bytes;
+        BTRFS_I(inode)->reserved_bytes -= bytes;
+        spin_unlock(&data_sinfo->lock);
+}
+
+/* called when we are adding a delalloc extent to the inode's io_tree */
+void btrfs_delalloc_reserve_space(struct btrfs_root *root, struct inode *inode,
+                                  u64 bytes)
+{
+        struct btrfs_space_info *data_sinfo;
+
+        /* get the space info for where this inode will be storing its data */
+        data_sinfo = BTRFS_I(inode)->space_info;
+
+        /* make sure we have enough space to handle the data first */
+        spin_lock(&data_sinfo->lock);
+        data_sinfo->bytes_delalloc += bytes;
+
+        /*
+         * we are adding a delalloc extent without calling
+         * btrfs_check_data_free_space first.  This happens on a weird
+         * writepage condition, but shouldn't hurt our accounting
+         */
+        if (unlikely(bytes > BTRFS_I(inode)->reserved_bytes)) {
+                data_sinfo->bytes_may_use -= BTRFS_I(inode)->reserved_bytes;
+                BTRFS_I(inode)->reserved_bytes = 0;
+        } else {
+                data_sinfo->bytes_may_use -= bytes;
+                BTRFS_I(inode)->reserved_bytes -= bytes;
+        }
+
+        spin_unlock(&data_sinfo->lock);
+}
+
+/* called when we are clearing an delalloc extent from the inode's io_tree */
+void btrfs_delalloc_free_space(struct btrfs_root *root, struct inode *inode,
+                              u64 bytes)
+{
+        struct btrfs_space_info *info;
+
+        info = BTRFS_I(inode)->space_info;
+
+        spin_lock(&info->lock);
+        info->bytes_delalloc -= bytes;
+        spin_unlock(&info->lock);
+}
+
 static int do_chunk_alloc(struct btrfs_trans_handle *trans,
                           struct btrfs_root *extent_root, u64 alloc_bytes,
                           u64 flags, int force)
@@ -3105,6 +3337,10 @@ static void dump_space_info(struct btrfs_space_info *info, u64 bytes)
                (unsigned long long)(info->total_bytes - info->bytes_used -
                                     info->bytes_pinned - info->bytes_reserved),
                (info->full) ? "" : "not ");
+        printk(KERN_INFO "space_info total=%llu, pinned=%llu, delalloc=%llu,"
+               " may_use=%llu, used=%llu\n", info->total_bytes,
+               info->bytes_pinned, info->bytes_delalloc, info->bytes_may_use,
+               info->bytes_used);
 
         down_read(&info->groups_sem);
         list_for_each_entry(cache, &info->block_groups, list) {
@@ -3131,24 +3367,10 @@ static int __btrfs_reserve_extent(struct btrfs_trans_handle *trans,
 {
         int ret;
         u64 search_start = 0;
-        u64 alloc_profile;
         struct btrfs_fs_info *info = root->fs_info;
 
-        if (data) {
-                alloc_profile = info->avail_data_alloc_bits &
-                        info->data_alloc_profile;
-                data = BTRFS_BLOCK_GROUP_DATA | alloc_profile;
-        } else if (root == root->fs_info->chunk_root) {
-                alloc_profile = info->avail_system_alloc_bits &
-                        info->system_alloc_profile;
-                data = BTRFS_BLOCK_GROUP_SYSTEM | alloc_profile;
-        } else {
-                alloc_profile = info->avail_metadata_alloc_bits &
-                        info->metadata_alloc_profile;
-                data = BTRFS_BLOCK_GROUP_METADATA | alloc_profile;
-        }
+        data = btrfs_get_alloc_profile(root, data);
 again:
-        data = btrfs_reduce_alloc_profile(root, data);
         /*
          * the only place that sets empty_size is btrfs_realloc_node, which
          * is not called recursively on allocations
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 872f104576e5..dc78954861b3 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1091,19 +1091,24 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
                 WARN_ON(num_pages > nrptrs);
                 memset(pages, 0, sizeof(struct page *) * nrptrs);
 
-                ret = btrfs_check_free_space(root, write_bytes, 0);
+                ret = btrfs_check_data_free_space(root, inode, write_bytes);
                 if (ret)
                         goto out;
 
                 ret = prepare_pages(root, file, pages, num_pages,
                                     pos, first_index, last_index,
                                     write_bytes);
-                if (ret)
+                if (ret) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       write_bytes);
                         goto out;
+                }
 
                 ret = btrfs_copy_from_user(pos, num_pages,
                                            write_bytes, pages, buf);
                 if (ret) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       write_bytes);
                         btrfs_drop_pages(pages, num_pages);
                         goto out;
                 }
@@ -1111,8 +1116,11 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
                 ret = dirty_and_release_pages(NULL, root, file, pages,
                                               num_pages, pos, write_bytes);
                 btrfs_drop_pages(pages, num_pages);
-                if (ret)
+                if (ret) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       write_bytes);
                         goto out;
+                }
 
                 if (will_write) {
                         btrfs_fdatawrite_range(inode->i_mapping, pos,
@@ -1136,6 +1144,8 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
         }
 out:
         mutex_unlock(&inode->i_mutex);
+        if (ret)
+                err = ret;
 
 out_nolock:
         kfree(pages);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 3cee77ae03c8..7d4f948bc22a 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -102,34 +102,6 @@ static int btrfs_init_inode_security(struct inode *inode,  struct inode *dir)
 }
 
 /*
- * a very lame attempt at stopping writes when the FS is 85% full.  There
- * are countless ways this is incorrect, but it is better than nothing.
- */
-int btrfs_check_free_space(struct btrfs_root *root, u64 num_required,
-                           int for_del)
-{
-        u64 total;
-        u64 used;
-        u64 thresh;
-        int ret = 0;
-
-        spin_lock(&root->fs_info->delalloc_lock);
-        total = btrfs_super_total_bytes(&root->fs_info->super_copy);
-        used = btrfs_super_bytes_used(&root->fs_info->super_copy);
-        if (for_del)
-                thresh = total * 90;
-        else
-                thresh = total * 85;
-
-        do_div(thresh, 100);
-
-        if (used + root->fs_info->delalloc_bytes + num_required > thresh)
-                ret = -ENOSPC;
-        spin_unlock(&root->fs_info->delalloc_lock);
-        return ret;
-}
-
-/*
  * this does all the hard work for inserting an inline extent into
  * the btree.  The caller should have done a btrfs_drop_extents so that
  * no overlapping inline items exist in the btree
@@ -1190,6 +1162,7 @@ static int btrfs_set_bit_hook(struct inode *inode, u64 start, u64 end,
          */
         if (!(old & EXTENT_DELALLOC) && (bits & EXTENT_DELALLOC)) {
                 struct btrfs_root *root = BTRFS_I(inode)->root;
+                btrfs_delalloc_reserve_space(root, inode, end - start + 1);
                 spin_lock(&root->fs_info->delalloc_lock);
                 BTRFS_I(inode)->delalloc_bytes += end - start + 1;
                 root->fs_info->delalloc_bytes += end - start + 1;
@@ -1223,9 +1196,12 @@ static int btrfs_clear_bit_hook(struct inode *inode, u64 start, u64 end,
                                (unsigned long long)end - start + 1,
                                (unsigned long long)
                                root->fs_info->delalloc_bytes);
+                        btrfs_delalloc_free_space(root, inode, (u64)-1);
                         root->fs_info->delalloc_bytes = 0;
                         BTRFS_I(inode)->delalloc_bytes = 0;
                 } else {
+                        btrfs_delalloc_free_space(root, inode,
+                                                  end - start + 1);
                         root->fs_info->delalloc_bytes -= end - start + 1;
                         BTRFS_I(inode)->delalloc_bytes -= end - start + 1;
                 }
@@ -2245,10 +2221,6 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
 
         root = BTRFS_I(dir)->root;
 
-        ret = btrfs_check_free_space(root, 1, 1);
-        if (ret)
-                goto fail;
-
         trans = btrfs_start_transaction(root, 1);
 
         btrfs_set_trans_block_group(trans, dir);
@@ -2261,7 +2233,6 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
         nr = trans->blocks_used;
 
         btrfs_end_transaction_throttle(trans, root);
-fail:
         btrfs_btree_balance_dirty(root, nr);
         return ret;
 }
@@ -2284,10 +2255,6 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
                 return -ENOTEMPTY;
         }
 
-        ret = btrfs_check_free_space(root, 1, 1);
-        if (ret)
-                goto fail;
-
         trans = btrfs_start_transaction(root, 1);
         btrfs_set_trans_block_group(trans, dir);
 
@@ -2304,7 +2271,6 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
 fail_trans:
         nr = trans->blocks_used;
         ret = btrfs_end_transaction_throttle(trans, root);
-fail:
         btrfs_btree_balance_dirty(root, nr);
 
         if (ret && !err)
@@ -2818,7 +2784,7 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
         if (size <= hole_start)
                 return 0;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 return err;
 
@@ -3014,6 +2980,7 @@ static noinline void init_btrfs_i(struct inode *inode)
         bi->last_trans = 0;
         bi->logged_trans = 0;
         bi->delalloc_bytes = 0;
+        bi->reserved_bytes = 0;
         bi->disk_i_size = 0;
         bi->flags = 0;
         bi->index_cnt = (u64)-1;
@@ -3035,6 +3002,7 @@ static int btrfs_init_locked_inode(struct inode *inode, void *p)
         inode->i_ino = args->ino;
         init_btrfs_i(inode);
         BTRFS_I(inode)->root = args->root;
+        btrfs_set_inode_space_info(args->root, inode);
         return 0;
 }
 
@@ -3455,6 +3423,7 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
         BTRFS_I(inode)->index_cnt = 2;
         BTRFS_I(inode)->root = root;
         BTRFS_I(inode)->generation = trans->transid;
+        btrfs_set_inode_space_info(root, inode);
 
         if (mode & S_IFDIR)
                 owner = 0;
@@ -3602,7 +3571,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         if (!new_valid_dev(rdev))
                 return -EINVAL;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto fail;
 
@@ -3665,7 +3634,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         u64 objectid;
         u64 index = 0;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto fail;
         trans = btrfs_start_transaction(root, 1);
@@ -3733,7 +3702,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                 return -ENOENT;
 
         btrfs_inc_nlink(inode);
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto fail;
         err = btrfs_set_inode_index(dir, &index);
@@ -3779,7 +3748,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         u64 index = 0;
         unsigned long nr = 1;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto out_unlock;
 
@@ -4336,7 +4305,7 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct page *page)
         u64 page_start;
         u64 page_end;
 
-        ret = btrfs_check_free_space(root, PAGE_CACHE_SIZE, 0);
+        ret = btrfs_check_data_free_space(root, inode, PAGE_CACHE_SIZE);
         if (ret)
                 goto out;
 
@@ -4349,6 +4318,7 @@ again:
 
         if ((page->mapping != inode->i_mapping) ||
             (page_start >= size)) {
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
                 /* page got truncated out from underneath us */
                 goto out_unlock;
         }
@@ -4631,7 +4601,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (old_inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 return -EXDEV;
 
-        ret = btrfs_check_free_space(root, 1, 0);
+        ret = btrfs_check_metadata_free_space(root);
         if (ret)
                 goto out_unlock;
 
@@ -4749,7 +4719,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
         if (name_len > BTRFS_MAX_INLINE_DATA_SIZE(root))
                 return -ENAMETOOLONG;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto out_fail;
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 988fdc8b49eb..bca729fc80c8 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -70,7 +70,7 @@ static noinline int create_subvol(struct btrfs_root *root,
         u64 index = 0;
         unsigned long nr = 1;
 
-        ret = btrfs_check_free_space(root, 1, 0);
+        ret = btrfs_check_metadata_free_space(root);
         if (ret)
                 goto fail_commit;
 
@@ -203,7 +203,7 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
         if (!root->ref_cows)
                 return -EINVAL;
 
-        ret = btrfs_check_free_space(root, 1, 0);
+        ret = btrfs_check_metadata_free_space(root);
         if (ret)
                 goto fail_unlock;
 
@@ -374,7 +374,7 @@ static int btrfs_defrag_file(struct file *file)
         unsigned long i;
         int ret;
 
-        ret = btrfs_check_free_space(root, inode->i_size, 0);
+        ret = btrfs_check_data_free_space(root, inode, inode->i_size);
         if (ret)
                 return -ENOSPC;
 
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 39bd4d38e889..45e59d3c7f1f 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1913,6 +1913,9 @@ COMPATIBLE_IOCTL(FIONREAD)  /* This is also TIOCINQ */
 /* 0x00 */
 COMPATIBLE_IOCTL(FIBMAP)
 COMPATIBLE_IOCTL(FIGETBSZ)
+/* 'X' - originally XFS but some now in the VFS */
+COMPATIBLE_IOCTL(FIFREEZE)
+COMPATIBLE_IOCTL(FITHAW)
 /* RAID */
 COMPATIBLE_IOCTL(RAID_VERSION)
 COMPATIBLE_IOCTL(GET_ARRAY_INFO)
diff --git a/fs/dcache.c b/fs/dcache.c
index 937df0fb0da5..07e2d4a44bda 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1180,7 +1180,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
         iput(inode);
         return res;
 }
-EXPORT_SYMBOL_GPL(d_obtain_alias);
+EXPORT_SYMBOL(d_obtain_alias);
 
 /**
  * d_splice_alias - splice a disconnected dentry into the tree if one exists
diff --git a/fs/jffs2/background.c b/fs/jffs2/background.c
index 3cceef4ad2b7..e9580104b6ba 100644
--- a/fs/jffs2/background.c
+++ b/fs/jffs2/background.c
@@ -95,13 +95,17 @@ static int jffs2_garbage_collect_thread(void *_c)
                         spin_unlock(&c->erase_completion_lock);
                         
 
-                /* This thread is purely an optimisation. But if it runs when
-                   other things could be running, it actually makes things a
-                   lot worse. Use yield() and put it at the back of the runqueue
-                   every time. Especially during boot, pulling an inode in
-                   with read_inode() is much preferable to having the GC thread
-                   get there first. */
-                yield();
+                /* Problem - immediately after bootup, the GCD spends a lot
+                 * of time in places like jffs2_kill_fragtree(); so much so
+                 * that userspace processes (like gdm and X) are starved
+                 * despite plenty of cond_resched()s and renicing.  Yield()
+                 * doesn't help, either (presumably because userspace and GCD
+                 * are generally competing for a higher latency resource -
+                 * disk).
+                 * This forces the GCD to slow the hell down.   Pulling an
+                 * inode in with read_inode() is much preferable to having
+                 * the GC thread get there first. */
+                schedule_timeout_interruptible(msecs_to_jiffies(50));
 
                 /* Put_super will send a SIGKILL and then wait on the sem.
                  */
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 6ca08ad887c0..1fc1e92356ee 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -220,7 +220,7 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
                                 struct jffs2_tmp_dnode_info *tn)
 {
         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
-        struct jffs2_tmp_dnode_info *this;
+        struct jffs2_tmp_dnode_info *this, *ptn;
 
         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 
@@ -251,11 +251,18 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
         if (this) {
                 /* If the node is coincident with another at a lower address,
                    back up until the other node is found. It may be relevant */
-                while (this->overlapped)
-                        this = tn_prev(this);
-
-                /* First node should never be marked overlapped */
-                BUG_ON(!this);
+                while (this->overlapped) {
+                        ptn = tn_prev(this);
+                        if (!ptn) {
+                                /*
+                                 * We killed a node which set the overlapped
+                                 * flags during the scan. Fix it up.
+                                 */
+                                this->overlapped = 0;
+                                break;
+                        }
+                        this = ptn;
+                }
                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
         }
 
@@ -360,7 +367,17 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
                         }
                         if (!this->overlapped)
                                 break;
-                        this = tn_prev(this);
+
+                        ptn = tn_prev(this);
+                        if (!ptn) {
+                                /*
+                                 * We killed a node which set the overlapped
+                                 * flags during the scan. Fix it up.
+                                 */
+                                this->overlapped = 0;
+                                break;
+                        }
+                        this = ptn;
                 }
         }
 
@@ -456,8 +473,15 @@ static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
                 eat_last(&rii->tn_root, &last->rb);
                 ver_insert(&ver_root, last);
 
-                if (unlikely(last->overlapped))
-                        continue;
+                if (unlikely(last->overlapped)) {
+                        if (pen)
+                                continue;
+                        /*
+                         * We killed a node which set the overlapped
+                         * flags during the scan. Fix it up.
+                         */
+                        last->overlapped = 0;
+                }
 
                 /* Now we have a bunch of nodes in reverse version
                    order, in the tree at ver_root. Most of the time,
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 60fe74035db5..3a9e5deed74d 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -4796,6 +4796,29 @@ out:
         return ret;
 }
 
+static int ocfs2_replace_extent_rec(struct inode *inode,
+                                    handle_t *handle,
+                                    struct ocfs2_path *path,
+                                    struct ocfs2_extent_list *el,
+                                    int split_index,
+                                    struct ocfs2_extent_rec *split_rec)
+{
+        int ret;
+
+        ret = ocfs2_path_bh_journal_access(handle, inode, path,
+                                           path_num_items(path) - 1);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        el->l_recs[split_index] = *split_rec;
+
+        ocfs2_journal_dirty(handle, path_leaf_bh(path));
+out:
+        return ret;
+}
+
 /*
  * Mark part or all of the extent record at split_index in the leaf
  * pointed to by path as written. This removes the unwritten
@@ -4885,7 +4908,9 @@ static int __ocfs2_mark_extent_written(struct inode *inode,
 
         if (ctxt.c_contig_type == CONTIG_NONE) {
                 if (ctxt.c_split_covers_rec)
-                        el->l_recs[split_index] = *split_rec;
+                        ret = ocfs2_replace_extent_rec(inode, handle,
+                                                       path, el,
+                                                       split_index, split_rec);
                 else
                         ret = ocfs2_split_and_insert(inode, handle, path, et,
                                                      &last_eb_bh, split_index,
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 54e182a27caf..0a2813947853 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1849,12 +1849,12 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
                 if (!mle) {
                         if (res->owner != DLM_LOCK_RES_OWNER_UNKNOWN &&
                             res->owner != assert->node_idx) {
-                                mlog(ML_ERROR, "assert_master from "
-                                          "%u, but current owner is "
-                                          "%u! (%.*s)\n",
-                                       assert->node_idx, res->owner,
-                                       namelen, name);
-                                goto kill;
+                                mlog(ML_ERROR, "DIE! Mastery assert from %u, "
+                                     "but current owner is %u! (%.*s)\n",
+                                     assert->node_idx, res->owner, namelen,
+                                     name);
+                                __dlm_print_one_lock_resource(res);
+                                BUG();
                         }
                 } else if (mle->type != DLM_MLE_MIGRATION) {
                         if (res->owner != DLM_LOCK_RES_OWNER_UNKNOWN) {
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index d1295203029f..4060bb328bc8 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -181,8 +181,7 @@ static int dlm_purge_lockres(struct dlm_ctxt *dlm,
 
                 spin_lock(&res->spinlock);
                 /* This ensures that clear refmap is sent after the set */
-                __dlm_wait_on_lockres_flags(res, (DLM_LOCK_RES_SETREF_INPROG |
-                                                  DLM_LOCK_RES_MIGRATING));
+                __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_SETREF_INPROG);
                 spin_unlock(&res->spinlock);
 
                 /* clear our bit from the master's refmap, ignore errors */
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 86ca085ef324..fcf879ed6930 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -117,11 +117,11 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
         else
                 BUG_ON(res->owner == dlm->node_num);
 
-        spin_lock(&dlm->spinlock);
+        spin_lock(&dlm->ast_lock);
         /* We want to be sure that we're not freeing a lock
          * that still has AST's pending... */
         in_use = !list_empty(&lock->ast_list);
-        spin_unlock(&dlm->spinlock);
+        spin_unlock(&dlm->ast_lock);
         if (in_use) {
                mlog(ML_ERROR, "lockres %.*s: Someone is calling dlmunlock "
                     "while waiting for an ast!", res->lockname.len,
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 206a2370876a..7219a86d34cc 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -320,9 +320,14 @@ static void ocfs2_schedule_blocked_lock(struct ocfs2_super *osb,
                                         struct ocfs2_lock_res *lockres);
 static inline void ocfs2_recover_from_dlm_error(struct ocfs2_lock_res *lockres,
                                                 int convert);
-#define ocfs2_log_dlm_error(_func, _err, _lockres) do {                 \
-        mlog(ML_ERROR, "DLM error %d while calling %s on resource %s\n", \
-             _err, _func, _lockres->l_name);                            \
+#define ocfs2_log_dlm_error(_func, _err, _lockres) do {                                 \
+        if ((_lockres)->l_type != OCFS2_LOCK_TYPE_DENTRY)                               \
+                mlog(ML_ERROR, "DLM error %d while calling %s on resource %s\n",        \
+                     _err, _func, _lockres->l_name);                                    \
+        else                                                                            \
+                mlog(ML_ERROR, "DLM error %d while calling %s on resource %.*s%08x\n",  \
+                     _err, _func, OCFS2_DENTRY_LOCK_INO_START - 1, (_lockres)->l_name,  \
+                     (unsigned int)ocfs2_get_dentry_lock_ino(_lockres));                \
 } while (0)
 static int ocfs2_downconvert_thread(void *arg);
 static void ocfs2_downconvert_on_unlock(struct ocfs2_super *osb,
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 077384135f4e..946d3c34b90b 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -341,6 +341,9 @@ struct ocfs2_super
         struct ocfs2_node_map           osb_recovering_orphan_dirs;
         unsigned int                    *osb_orphan_wipes;
         wait_queue_head_t               osb_wipe_event;
+
+        /* used to protect metaecc calculation check of xattr. */
+        spinlock_t osb_xattr_lock;
 };
 
 #define OCFS2_SB(sb)        ((struct ocfs2_super *)(sb)->s_fs_info)
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index b1cb38fbe807..7ac83a81ee55 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1537,6 +1537,13 @@ static int ocfs2_get_sector(struct super_block *sb,
         unlock_buffer(*bh);
         ll_rw_block(READ, 1, bh);
         wait_on_buffer(*bh);
+        if (!buffer_uptodate(*bh)) {
+                mlog_errno(-EIO);
+                brelse(*bh);
+                *bh = NULL;
+                return -EIO;
+        }
+
         return 0;
 }
 
@@ -1747,6 +1754,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
         INIT_LIST_HEAD(&osb->blocked_lock_list);
         osb->blocked_lock_count = 0;
         spin_lock_init(&osb->osb_lock);
+        spin_lock_init(&osb->osb_xattr_lock);
         ocfs2_init_inode_steal_slot(osb);
 
         atomic_set(&osb->alloc_stats.moves, 0);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 915039fffe6e..4ddd788add67 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -82,13 +82,14 @@ struct ocfs2_xattr_set_ctxt {
 
 #define OCFS2_XATTR_ROOT_SIZE   (sizeof(struct ocfs2_xattr_def_value_root))
 #define OCFS2_XATTR_INLINE_SIZE 80
+#define OCFS2_XATTR_HEADER_GAP  4
 #define OCFS2_XATTR_FREE_IN_IBODY       (OCFS2_MIN_XATTR_INLINE_SIZE \
                                          - sizeof(struct ocfs2_xattr_header) \
-                                         - sizeof(__u32))
+                                         - OCFS2_XATTR_HEADER_GAP)
 #define OCFS2_XATTR_FREE_IN_BLOCK(ptr)  ((ptr)->i_sb->s_blocksize \
                                          - sizeof(struct ocfs2_xattr_block) \
                                          - sizeof(struct ocfs2_xattr_header) \
-                                         - sizeof(__u32))
+                                         - OCFS2_XATTR_HEADER_GAP)
 
 static struct ocfs2_xattr_def_value_root def_xv = {
         .xv.xr_list.l_count = cpu_to_le16(1),
@@ -274,10 +275,12 @@ static int ocfs2_read_xattr_bucket(struct ocfs2_xattr_bucket *bucket,
                                bucket->bu_blocks, bucket->bu_bhs, 0,
                                NULL);
         if (!rc) {
+                spin_lock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
                 rc = ocfs2_validate_meta_ecc_bhs(bucket->bu_inode->i_sb,
                                                  bucket->bu_bhs,
                                                  bucket->bu_blocks,
                                                  &bucket_xh(bucket)->xh_check);
+                spin_unlock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
                 if (rc)
                         mlog_errno(rc);
         }
@@ -310,9 +313,11 @@ static void ocfs2_xattr_bucket_journal_dirty(handle_t *handle,
 {
         int i;
 
+        spin_lock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
         ocfs2_compute_meta_ecc_bhs(bucket->bu_inode->i_sb,
                                    bucket->bu_bhs, bucket->bu_blocks,
                                    &bucket_xh(bucket)->xh_check);
+        spin_unlock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
 
         for (i = 0; i < bucket->bu_blocks; i++)
                 ocfs2_journal_dirty(handle, bucket->bu_bhs[i]);
@@ -1507,7 +1512,7 @@ static int ocfs2_xattr_set_entry(struct inode *inode,
                 last += 1;
         }
 
-        free = min_offs - ((void *)last - xs->base) - sizeof(__u32);
+        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
         if (free < 0)
                 return -EIO;
 
@@ -2190,7 +2195,7 @@ static int ocfs2_xattr_can_be_in_inode(struct inode *inode,
                 last += 1;
         }
 
-        free = min_offs - ((void *)last - xs->base) - sizeof(__u32);
+        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
         if (free < 0)
                 return 0;
 
@@ -2592,8 +2597,9 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
 
         if (!ret) {
                 /* Update inode ctime. */
-                ret = ocfs2_journal_access(ctxt->handle, inode, xis->inode_bh,
-                                           OCFS2_JOURNAL_ACCESS_WRITE);
+                ret = ocfs2_journal_access_di(ctxt->handle, inode,
+                                              xis->inode_bh,
+                                              OCFS2_JOURNAL_ACCESS_WRITE);
                 if (ret) {
                         mlog_errno(ret);
                         goto out;
@@ -5060,8 +5066,8 @@ try_again:
         xh_free_start = le16_to_cpu(xh->xh_free_start);
         header_size = sizeof(struct ocfs2_xattr_header) +
                         count * sizeof(struct ocfs2_xattr_entry);
-        max_free = OCFS2_XATTR_BUCKET_SIZE -
-                le16_to_cpu(xh->xh_name_value_len) - header_size;
+        max_free = OCFS2_XATTR_BUCKET_SIZE - header_size -
+                le16_to_cpu(xh->xh_name_value_len) - OCFS2_XATTR_HEADER_GAP;
 
         mlog_bug_on_msg(header_size > blocksize, "bucket %llu has header size "
                         "of %u which exceed block size\n",
@@ -5094,7 +5100,7 @@ try_again:
                         need = 0;
         }
 
-        free = xh_free_start - header_size;
+        free = xh_free_start - header_size - OCFS2_XATTR_HEADER_GAP;
         /*
          * We need to make sure the new name/value pair
          * can exist in the same block.
@@ -5127,7 +5133,8 @@ try_again:
                         }
 
                         xh_free_start = le16_to_cpu(xh->xh_free_start);
-                        free = xh_free_start - header_size;
+                        free = xh_free_start - header_size
+                                - OCFS2_XATTR_HEADER_GAP;
                         if (xh_free_start % blocksize < need)
                                 free -= xh_free_start % blocksize;
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index dcaa0fd84b02..465d6babc847 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -708,6 +708,8 @@ struct req_iterator {
 };
 
 /* This should not be used directly - use rq_for_each_segment */
+#define for_each_bio(_bio)              \
+        for (; _bio; _bio = _bio->bi_next)
 #define __rq_for_each_bio(_bio, rq)     \
         if ((rq->bio))                  \
                 for (_bio = (rq)->bio; _bio; _bio = _bio->bi_next)
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 315bcd375224..cc4f45361dbb 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -13,6 +13,7 @@ struct user_namespace {
         struct kref             kref;
         struct hlist_head       uidhash_table[UIDHASH_SZ];
         struct user_struct      *creator;
+        struct work_struct      destroyer;
 };
 
 extern struct user_namespace init_user_ns;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 79084311ee57..076c7c8215b0 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -60,12 +60,25 @@ int create_user_ns(struct cred *new)
         return 0;
 }
 
-void free_user_ns(struct kref *kref)
+/*
+ * Deferred destructor for a user namespace.  This is required because
+ * free_user_ns() may be called with uidhash_lock held, but we need to call
+ * back to free_uid() which will want to take the lock again.
+ */
+static void free_user_ns_work(struct work_struct *work)
 {
-        struct user_namespace *ns;
-
-        ns = container_of(kref, struct user_namespace, kref);
+        struct user_namespace *ns =
+                container_of(work, struct user_namespace, destroyer);
         free_uid(ns->creator);
         kfree(ns);
 }
+
+void free_user_ns(struct kref *kref)
+{
+        struct user_namespace *ns =
+                container_of(kref, struct user_namespace, kref);
+
+        INIT_WORK(&ns->destroyer, free_user_ns_work);
+        schedule_work(&ns->destroyer);
+}
 EXPORT_SYMBOL(free_user_ns);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 903cad46e796..520a75980269 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -323,6 +323,7 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
         unsigned long addr;
         int purged = 0;
 
+        BUG_ON(!size);
         BUG_ON(size & ~PAGE_MASK);
 
         va = kmalloc_node(sizeof(struct vmap_area),
@@ -334,6 +335,9 @@ retry:
         addr = ALIGN(vstart, align);
 
         spin_lock(&vmap_area_lock);
+        if (addr + size - 1 < addr)
+                goto overflow;
+
         /* XXX: could have a last_hole cache */
         n = vmap_area_root.rb_node;
         if (n) {
@@ -365,6 +369,8 @@ retry:
 
                 while (addr + size > first->va_start && addr + size <= vend) {
                         addr = ALIGN(first->va_end + PAGE_SIZE, align);
+                        if (addr + size - 1 < addr)
+                                goto overflow;
 
                         n = rb_next(&first->rb_node);
                         if (n)
@@ -375,6 +381,7 @@ retry:
         }
 found:
         if (addr + size > vend) {
+overflow:
                 spin_unlock(&vmap_area_lock);
                 if (!purged) {
                         purge_vmap_area_lazy();
@@ -498,6 +505,7 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
         static DEFINE_SPINLOCK(purge_lock);
         LIST_HEAD(valist);
         struct vmap_area *va;
+        struct vmap_area *n_va;
         int nr = 0;
 
         /*
@@ -537,7 +545,7 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
 
         if (nr) {
                 spin_lock(&vmap_area_lock);
-                list_for_each_entry(va, &valist, purge_list)
+                list_for_each_entry_safe(va, n_va, &valist, purge_list)
                         __free_vmap_area(va);
                 spin_unlock(&vmap_area_lock);
         }
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 45eb0ae98eba..2d5ece798c4c 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -10,7 +10,7 @@ use strict;
 my $P = $0;
 $P =~ s@.*/@@g;
 
-my $V = '0.27';
+my $V = '0.28';
 
 use Getopt::Long qw(:config no_auto_abbrev);
 
@@ -110,7 +110,8 @@ our $Sparse	= qr{
                         __iomem|
                         __must_check|
                         __init_refok|
-                        __kprobes
+                        __kprobes|
+                        __ref
                 }x;
 our $Attribute  = qr{
                         const|
@@ -1240,7 +1241,8 @@ sub process {
                         $realfile =~ s@^([^/]*)/@@;
 
                         $p1_prefix = $1;
-                        if ($tree && $p1_prefix ne '' && -e "$root/$p1_prefix") {
+                        if (!$file && $tree && $p1_prefix ne '' &&
+                            -e "$root/$p1_prefix") {
                                 WARN("patch prefix '$p1_prefix' exists, appears to be a -p0 patch\n");
                         }
 
@@ -1583,9 +1585,9 @@ sub process {
                 }
 # TEST: allow direct testing of the attribute matcher.
                 if ($dbg_attr) {
-                        if ($line =~ /^.\s*$Attribute\s*$/) {
+                        if ($line =~ /^.\s*$Modifier\s*$/) {
                                 ERROR("TEST: is attr\n" . $herecurr);
-                        } elsif ($dbg_attr > 1 && $line =~ /^.+($Attribute)/) {
+                        } elsif ($dbg_attr > 1 && $line =~ /^.+($Modifier)/) {
                                 ERROR("TEST: is not attr ($1 is)\n". $herecurr);
                         }
                         next;
@@ -1657,7 +1659,7 @@ sub process {
 
 # * goes on variable not on type
                 # (char*[ const])
-                if ($line =~ m{\($NonptrType(\s*\*[\s\*]*(?:$Modifier\s*)*)\)}) {
+                if ($line =~ m{\($NonptrType(\s*(?:$Modifier\b\s*|\*\s*)+)\)}) {
                         my ($from, $to) = ($1, $1);
 
                         # Should start with a space.
@@ -1672,7 +1674,7 @@ sub process {
                         if ($from ne $to) {
                                 ERROR("\"(foo$from)\" should be \"(foo$to)\"\n" .  $herecurr);
                         }
-                } elsif ($line =~ m{\b$NonptrType(\s*\*[\s\*]*(?:$Modifier\s*)?)($Ident)}) {
+                } elsif ($line =~ m{\b$NonptrType(\s*(?:$Modifier\b\s*|\*\s*)+)($Ident)}) {
                         my ($from, $to, $ident) = ($1, $1, $2);
 
                         # Should start with a space.
@@ -1685,8 +1687,8 @@ sub process {
                         # Modifiers should have spaces.
                         $to =~ s/(\b$Modifier$)/$1 /;
 
-                        #print "from<$from> to<$to>\n";
-                        if ($from ne $to) {
+                        #print "from<$from> to<$to> ident<$ident>\n";
+                        if ($from ne $to && $ident !~ /^$Modifier$/) {
                                 ERROR("\"foo${from}bar\" should be \"foo${to}bar\"\n" .  $herecurr);
                         }
                 }
@@ -1885,11 +1887,11 @@ sub process {
                                         if ($ctx !~ /[WEBC]x./ && $ca !~ /(?:\)|!|~|\*|-|\&|\||\+\+|\-\-|\{)$/) {
                                                 ERROR("space required before that '$op' $at\n" . $hereptr);
                                         }
-                                        if ($op eq '*' && $cc =~/\s*const\b/) {
+                                        if ($op eq '*' && $cc =~/\s*$Modifier\b/) {
                                                 # A unary '*' may be const
 
                                         } elsif ($ctx =~ /.xW/) {
-                                                ERROR("space prohibited after that '$op' $at\n" . $hereptr);
+                                                ERROR("Aspace prohibited after that '$op' $at\n" . $hereptr);
                                         }
 
                                 # unary ++ and unary -- are allowed no space on one side.
@@ -2560,7 +2562,7 @@ sub process {
                 if ($line =~ /\bin_atomic\s*\(/) {
                         if ($realfile =~ m@^drivers/@) {
                                 ERROR("do not use in_atomic in drivers\n" . $herecurr);
-                        } else {
+                        } elsif ($realfile !~ m@^kernel/@) {
                                 WARN("use of in_atomic() is incorrect outside core kernel code\n" . $herecurr);
                         }
                 }