260 files changed, 2644 insertions, 1817 deletions

diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index f48178024067..db3b1aba32a3 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -843,6 +843,7 @@ Provides counts of softirq handlers serviced since boot time, for each cpu.
  TASKLET:          0          0          0        290
    SCHED:      27035      26983      26971      26746
  HRTIMER:          0          0          0          0
+     RCU:       1678       1769       2178       2250
 
 
 1.3 IDE devices in /proc/ide
diff --git a/Documentation/power/devices.txt b/Documentation/power/devices.txt
index 88880839ece4..64565aac6e40 100644
--- a/Documentation/power/devices.txt
+++ b/Documentation/power/devices.txt
@@ -520,59 +520,20 @@ Support for power domains is provided through the pwr_domain field of struct
 device.  This field is a pointer to an object of type struct dev_power_domain,
 defined in include/linux/pm.h, providing a set of power management callbacks
 analogous to the subsystem-level and device driver callbacks that are executed
-for the given device during all power transitions, in addition to the respective
-subsystem-level callbacks.  Specifically, the power domain "suspend" callbacks
-(i.e. ->runtime_suspend(), ->suspend(), ->freeze(), ->poweroff(), etc.) are
-executed after the analogous subsystem-level callbacks, while the power domain
-"resume" callbacks (i.e. ->runtime_resume(), ->resume(), ->thaw(), ->restore,
-etc.) are executed before the analogous subsystem-level callbacks.  Error codes
-returned by the "suspend" and "resume" power domain callbacks are ignored.
-
-Power domain ->runtime_idle() callback is executed before the subsystem-level
-->runtime_idle() callback and the result returned by it is not ignored.  Namely,
-if it returns error code, the subsystem-level ->runtime_idle() callback will not
-be called and the helper function rpm_idle() executing it will return error
-code.  This mechanism is intended to help platforms where saving device state
-is a time consuming operation and should only be carried out if all devices
-in the power domain are idle, before turning off the shared power resource(s).
-Namely, the power domain ->runtime_idle() callback may return error code until
-the pm_runtime_idle() helper (or its asychronous version) has been called for
-all devices in the power domain (it is recommended that the returned error code
-be -EBUSY in those cases), preventing the subsystem-level ->runtime_idle()
-callback from being run prematurely.
-
-The support for device power domains is only relevant to platforms needing to
-use the same subsystem-level (e.g. platform bus type) and device driver power
-management callbacks in many different power domain configurations and wanting
-to avoid incorporating the support for power domains into the subsystem-level
-callbacks.  The other platforms need not implement it or take it into account
-in any way.
-
-
-System Devices
---------------
-System devices (sysdevs) follow a slightly different API, which can be found in
-
-        include/linux/sysdev.h
-        drivers/base/sys.c
-
-System devices will be suspended with interrupts disabled, and after all other
-devices have been suspended.  On resume, they will be resumed before any other
-devices, and also with interrupts disabled.  These things occur in special
-"sysdev_driver" phases, which affect only system devices.
-
-Thus, after the suspend_noirq (or freeze_noirq or poweroff_noirq) phase, when
-the non-boot CPUs are all offline and IRQs are disabled on the remaining online
-CPU, then a sysdev_driver.suspend phase is carried out, and the system enters a
-sleep state (or a system image is created).  During resume (or after the image
-has been created or loaded) a sysdev_driver.resume phase is carried out, IRQs
-are enabled on the only online CPU, the non-boot CPUs are enabled, and the
-resume_noirq (or thaw_noirq or restore_noirq) phase begins.
-
-Code to actually enter and exit the system-wide low power state sometimes
-involves hardware details that are only known to the boot firmware, and
-may leave a CPU running software (from SRAM or flash memory) that monitors
-the system and manages its wakeup sequence.
+for the given device during all power transitions, instead of the respective
+subsystem-level callbacks.  Specifically, if a device's pm_domain pointer is
+not NULL, the ->suspend() callback from the object pointed to by it will be
+executed instead of its subsystem's (e.g. bus type's) ->suspend() callback and
+anlogously for all of the remaining callbacks.  In other words, power management
+domain callbacks, if defined for the given device, always take precedence over
+the callbacks provided by the device's subsystem (e.g. bus type).
+
+The support for device power management domains is only relevant to platforms
+needing to use the same device driver power management callbacks in many
+different power domain configurations and wanting to avoid incorporating the
+support for power domains into subsystem-level callbacks, for example by
+modifying the platform bus type.  Other platforms need not implement it or take
+it into account in any way.
 
 
 Device Low Power (suspend) States
diff --git a/Documentation/power/runtime_pm.txt b/Documentation/power/runtime_pm.txt
index 654097b130b4..22accb3eb40e 100644
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -566,11 +566,6 @@ to do this is:
         pm_runtime_set_active(dev);
         pm_runtime_enable(dev);
 
-The PM core always increments the run-time usage counter before calling the
-->prepare() callback and decrements it after calling the ->complete() callback.
-Hence disabling run-time PM temporarily like this will not cause any run-time
-suspend callbacks to be lost.
-
 7. Generic subsystem callbacks
 
 Subsystems may wish to conserve code space by using the set of generic power
diff --git a/MAINTAINERS b/MAINTAINERS
index 502f2dd761eb..f0358cd91de3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2291,8 +2291,7 @@ F:	drivers/scsi/eata_pio.*
 
 EBTABLES
 M:      Bart De Schuymer <bart.de.schuymer@pandora.be>
-L:      ebtables-user@lists.sourceforge.net
-L:      ebtables-devel@lists.sourceforge.net
+L:      netfilter-devel@vger.kernel.org
 W:      http://ebtables.sourceforge.net/
 S:      Maintained
 F:      include/linux/netfilter_bridge/ebt_*.h
@@ -7007,6 +7006,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.
 S:      Maintained
 F:      drivers/platform/x86
 
+X86 MCE INFRASTRUCTURE
+M:      Tony Luck <tony.luck@intel.com>
+M:      Borislav Petkov <bp@amd64.org>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      arch/x86/kernel/cpu/mcheck/*
+
 XEN HYPERVISOR INTERFACE
 M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
 M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
diff --git a/Makefile b/Makefile
index 0499c2ee8541..41330a06e4ec 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Sneaky Weasel
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/mmzone.h b/arch/alpha/include/asm/mmzone.h
index 8af56ce346ad..445dc42e0334 100644
--- a/arch/alpha/include/asm/mmzone.h
+++ b/arch/alpha/include/asm/mmzone.h
@@ -56,7 +56,6 @@ PLAT_NODE_DATA_LOCALNR(unsigned long p, int n)
  * Given a kernel address, find the home node of the underlying memory.
  */
 #define kvaddr_to_nid(kaddr)    pa_to_nid(__pa(kaddr))
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
 
 /*
  * Given a kaddr, LOCAL_BASE_ADDR finds the owning node of the memory
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 942fad97e447..940b20178107 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -597,6 +597,8 @@ __common_mmu_cache_on:
                 sub     pc, lr, r0, lsr #32     @ properly flush pipeline
 #endif
 
+#define PROC_ENTRY_SIZE (4*5)
+
 /*
  * Here follow the relocatable cache support functions for the
  * various processors.  This is a generic hook for locating an
@@ -624,7 +626,7 @@ call_cache_fn:	adr	r12, proc_types
  ARM(           addeq   pc, r12, r3             ) @ call cache function
  THUMB(         addeq   r12, r3                 )
  THUMB(         moveq   pc, r12                 ) @ call cache function
-                add     r12, r12, #4*5
+                add     r12, r12, #PROC_ENTRY_SIZE
                 b       1b
 
 /*
@@ -794,6 +796,16 @@ proc_types:
 
                 .size   proc_types, . - proc_types
 
+                /*
+                 * If you get a "non-constant expression in ".if" statement"
+                 * error from the assembler on this line, check that you have
+                 * not accidentally written a "b" instruction where you should
+                 * have written W(b).
+                 */
+                .if (. - proc_types) % PROC_ENTRY_SIZE != 0
+                .error "The size of one or more proc_types entries is wrong."
+                .endif
+
 /*
  * Turn off the Cache and MMU.  ARMv3 does not support
  * reading the control register, but ARMv4 does.
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index bc2d2d75f706..65c3f2474f5e 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -13,6 +13,9 @@
  *  Do not include any C declarations in this file - it is included by
  *  assembler source.
  */
+#ifndef __ASM_ASSEMBLER_H__
+#define __ASM_ASSEMBLER_H__
+
 #ifndef __ASSEMBLY__
 #error "Only include this from assembly code"
 #endif
@@ -290,3 +293,4 @@
         .macro  ldrusr, reg, ptr, inc, cond=al, rept=1, abort=9001f
         usracc  ldr, \reg, \ptr, \inc, \cond, \rept, \abort
         .endm
+#endif /* __ASM_ASSEMBLER_H__ */
diff --git a/arch/arm/include/asm/entry-macro-multi.S b/arch/arm/include/asm/entry-macro-multi.S
index ec0bbf79c71f..2da8547de6d6 100644
--- a/arch/arm/include/asm/entry-macro-multi.S
+++ b/arch/arm/include/asm/entry-macro-multi.S
@@ -1,3 +1,5 @@
+#include <asm/assembler.h>
+
 /*
  * Interrupt handling.  Preserves r7, r8, r9
  */
diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
index fee7c36349eb..016d6a0830a3 100644
--- a/arch/arm/kernel/module.c
+++ b/arch/arm/kernel/module.c
@@ -193,8 +193,17 @@ apply_relocate(Elf32_Shdr *sechdrs, const char *strtab, unsigned int symindex,
                                 offset -= 0x02000000;
                         offset += sym->st_value - loc;
 
-                        /* only Thumb addresses allowed (no interworking) */
-                        if (!(offset & 1) ||
+                        /*
+                         * For function symbols, only Thumb addresses are
+                         * allowed (no interworking).
+                         *
+                         * For non-function symbols, the destination
+                         * has no specific ARM/Thumb disposition, so
+                         * the branch is resolved under the assumption
+                         * that interworking is not required.
+                         */
+                        if ((ELF32_ST_TYPE(sym->st_info) == STT_FUNC &&
+                                !(offset & 1)) ||
                             offset <= (s32)0xff000000 ||
                             offset >= (s32)0x01000000) {
                                 pr_err("%s: section %u reloc %u sym '%s': relocation %u out of range (%#lx -> %#x)\n",
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 344e52b16c8c..e7f92a4321f3 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -318,9 +318,13 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
         smp_store_cpu_info(cpu);
 
         /*
-         * OK, now it's safe to let the boot CPU continue
+         * OK, now it's safe to let the boot CPU continue.  Wait for
+         * the CPU migration code to notice that the CPU is online
+         * before we continue.
          */
         set_cpu_online(cpu, true);
+        while (!cpu_active(cpu))
+                cpu_relax();
 
         /*
          * OK, it's off to the idle thread for us
diff --git a/arch/arm/mach-h720x/Kconfig b/arch/arm/mach-h720x/Kconfig
index 9b6982efbd22..abf356c02343 100644
--- a/arch/arm/mach-h720x/Kconfig
+++ b/arch/arm/mach-h720x/Kconfig
@@ -6,12 +6,14 @@ config ARCH_H7201
         bool "gms30c7201"
         depends on ARCH_H720X
         select CPU_H7201
+        select ZONE_DMA
         help
           Say Y here if you are using the Hynix GMS30C7201 Reference Board
 
 config ARCH_H7202
         bool "hms30c7202"
         select CPU_H7202
+        select ZONE_DMA
         depends on ARCH_H720X
         help
           Say Y here if you are using the Hynix HMS30C7202 Reference Board
diff --git a/arch/arm/mach-msm/timer.c b/arch/arm/mach-msm/timer.c
index 38b95e949d13..63621f152c98 100644
--- a/arch/arm/mach-msm/timer.c
+++ b/arch/arm/mach-msm/timer.c
@@ -23,6 +23,8 @@
 #include <linux/io.h>
 
 #include <asm/mach/time.h>
+#include <asm/hardware/gic.h>
+
 #include <mach/msm_iomap.h>
 #include <mach/cpu.h>
 
@@ -55,10 +57,12 @@ enum timer_location {
 #if defined(CONFIG_ARCH_QSD8X50)
 #define DGT_HZ (19200000 / 4) /* 19.2 MHz / 4 by default */
 #define MSM_DGT_SHIFT (0)
-#elif defined(CONFIG_ARCH_MSM7X30) || defined(CONFIG_ARCH_MSM8X60) || \
-                                      defined(CONFIG_ARCH_MSM8960)
+#elif defined(CONFIG_ARCH_MSM7X30)
 #define DGT_HZ (24576000 / 4) /* 24.576 MHz (LPXO) / 4 by default */
 #define MSM_DGT_SHIFT (0)
+#elif defined(CONFIG_ARCH_MSM8X60) || defined(CONFIG_ARCH_MSM8960)
+#define DGT_HZ (27000000 / 4) /* 27 MHz (PXO) / 4 by default */
+#define MSM_DGT_SHIFT (0)
 #else
 #define DGT_HZ 19200000 /* 19.2 MHz or 600 KHz after shift */
 #define MSM_DGT_SHIFT (5)
@@ -100,7 +104,11 @@ static cycle_t msm_read_timer_count(struct clocksource *cs)
 {
         struct msm_clock *clk = container_of(cs, struct msm_clock, clocksource);
 
-        return readl(clk->global_counter);
+        /*
+         * Shift timer count down by a constant due to unreliable lower bits
+         * on some targets.
+         */
+        return readl(clk->global_counter) >> clk->shift;
 }
 
 static struct msm_clock *clockevent_to_clock(struct clock_event_device *evt)
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 3c3867850a30..089c0b5e454f 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -210,19 +210,21 @@ cpu_v7_name:
 
 /* Suspend/resume support: derived from arch/arm/mach-s5pv210/sleep.S */
 .globl  cpu_v7_suspend_size
-.equ    cpu_v7_suspend_size, 4 * 8
+.equ    cpu_v7_suspend_size, 4 * 9
 #ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_v7_do_suspend)
         stmfd   sp!, {r4 - r11, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ FCSE/PID
         mrc     p15, 0, r5, c13, c0, 1  @ Context ID
+        mrc     p15, 0, r6, c13, c0, 3  @ User r/o thread ID
+        stmia   r0!, {r4 - r6}
         mrc     p15, 0, r6, c3, c0, 0   @ Domain ID
         mrc     p15, 0, r7, c2, c0, 0   @ TTB 0
         mrc     p15, 0, r8, c2, c0, 1   @ TTB 1
         mrc     p15, 0, r9, c1, c0, 0   @ Control register
         mrc     p15, 0, r10, c1, c0, 1  @ Auxiliary control register
         mrc     p15, 0, r11, c1, c0, 2  @ Co-processor access control
-        stmia   r0, {r4 - r11}
+        stmia   r0, {r6 - r11}
         ldmfd   sp!, {r4 - r11, pc}
 ENDPROC(cpu_v7_do_suspend)
 
@@ -230,9 +232,11 @@ ENTRY(cpu_v7_do_resume)
         mov     ip, #0
         mcr     p15, 0, ip, c8, c7, 0   @ invalidate TLBs
         mcr     p15, 0, ip, c7, c5, 0   @ invalidate I cache
-        ldmia   r0, {r4 - r11}
+        ldmia   r0!, {r4 - r6}
         mcr     p15, 0, r4, c13, c0, 0  @ FCSE/PID
         mcr     p15, 0, r5, c13, c0, 1  @ Context ID
+        mcr     p15, 0, r6, c13, c0, 3  @ User r/o thread ID
+        ldmia   r0, {r6 - r11}
         mcr     p15, 0, r6, c3, c0, 0   @ Domain ID
         mcr     p15, 0, r7, c2, c0, 0   @ TTB 0
         mcr     p15, 0, r8, c2, c0, 1   @ TTB 1
@@ -418,9 +422,9 @@ ENTRY(v7_processor_functions)
         .word   cpu_v7_dcache_clean_area
         .word   cpu_v7_switch_mm
         .word   cpu_v7_set_pte_ext
-        .word   0
-        .word   0
-        .word   0
+        .word   cpu_v7_suspend_size
+        .word   cpu_v7_do_suspend
+        .word   cpu_v7_do_resume
         .size   v7_processor_functions, . - v7_processor_functions
 
         .section ".rodata"
diff --git a/arch/arm/plat-iop/cp6.c b/arch/arm/plat-iop/cp6.c
index 9612a87e2a88..bab73e2c79db 100644
--- a/arch/arm/plat-iop/cp6.c
+++ b/arch/arm/plat-iop/cp6.c
@@ -18,6 +18,7 @@
  */
 #include <linux/init.h>
 #include <asm/traps.h>
+#include <asm/ptrace.h>
 
 static int cp6_trap(struct pt_regs *regs, unsigned int instr)
 {
diff --git a/arch/m32r/include/asm/mmzone.h b/arch/m32r/include/asm/mmzone.h
index 9f3b5accda88..115ced33febd 100644
--- a/arch/m32r/include/asm/mmzone.h
+++ b/arch/m32r/include/asm/mmzone.h
@@ -14,12 +14,6 @@ extern struct pglist_data *node_data[];
 #define NODE_DATA(nid)          (node_data[nid])
 
 #define node_localnr(pfn, nid)  ((pfn) - NODE_DATA(nid)->node_start_pfn)
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)                                               \
-({                                                                      \
-        pg_data_t *__pgdat = NODE_DATA(nid);                            \
-        __pgdat->node_start_pfn + __pgdat->node_spanned_pages - 1;      \
-})
 
 #define pmd_page(pmd)           (pfn_to_page(pmd_val(pmd) >> PAGE_SHIFT))
 /*
@@ -44,7 +38,7 @@ static __inline__ int pfn_to_nid(unsigned long pfn)
         int node;
 
         for (node = 0 ; node < MAX_NUMNODES ; node++)
-                if (pfn >= node_start_pfn(node) && pfn <= node_end_pfn(node))
+                if (pfn >= node_start_pfn(node) && pfn < node_end_pfn(node))
                         break;
 
         return node;
diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
index 3d6e60dad9d9..780560b330d9 100644
--- a/arch/mn10300/include/asm/uaccess.h
+++ b/arch/mn10300/include/asm/uaccess.h
@@ -15,6 +15,7 @@
  * User space memory access functions
  */
 #include <linux/thread_info.h>
+#include <linux/kernel.h>
 #include <asm/page.h>
 #include <asm/errno.h>
 
diff --git a/arch/parisc/include/asm/mmzone.h b/arch/parisc/include/asm/mmzone.h
index 9608d2cf214a..e67eb9c3d1bf 100644
--- a/arch/parisc/include/asm/mmzone.h
+++ b/arch/parisc/include/asm/mmzone.h
@@ -14,13 +14,6 @@ extern struct node_map_data node_data[];
 
 #define NODE_DATA(nid)          (&node_data[nid].pg_data)
 
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)                                               \
-({                                                                      \
-        pg_data_t *__pgdat = NODE_DATA(nid);                            \
-        __pgdat->node_start_pfn + __pgdat->node_spanned_pages;          \
-})
-
 /* We have these possible memory map layouts:
  * Astro: 0-3.75, 67.75-68, 4-64
  * zx1: 0-1, 257-260, 4-256
diff --git a/arch/powerpc/include/asm/mmzone.h b/arch/powerpc/include/asm/mmzone.h
index fd3fd58bad84..7b589178be46 100644
--- a/arch/powerpc/include/asm/mmzone.h
+++ b/arch/powerpc/include/asm/mmzone.h
@@ -38,13 +38,6 @@ u64 memory_hotplug_max(void);
 #define memory_hotplug_max() memblock_end_of_DRAM()
 #endif
 
-/*
- * Following are macros that each numa implmentation must define.
- */
-
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)       (NODE_DATA(nid)->node_end_pfn)
-
 #else
 #define memory_hotplug_max() memblock_end_of_DRAM()
 #endif /* CONFIG_NEED_MULTIPLE_NODES */
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 90d77bd078f5..c03fef7a9c22 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -579,6 +579,7 @@ config S390_GUEST
         def_bool y
         prompt "s390 guest support for KVM (EXPERIMENTAL)"
         depends on 64BIT && EXPERIMENTAL
+        select VIRTUALIZATION
         select VIRTIO
         select VIRTIO_RING
         select VIRTIO_CONSOLE
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 52420d2785b3..1d55c95f617c 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -262,7 +262,7 @@ void smp_ctl_set_bit(int cr, int bit)
 
         memset(&parms.orvals, 0, sizeof(parms.orvals));
         memset(&parms.andvals, 0xff, sizeof(parms.andvals));
-        parms.orvals[cr] = 1 << bit;
+        parms.orvals[cr] = 1UL << bit;
         on_each_cpu(smp_ctl_bit_callback, &parms, 1);
 }
 EXPORT_SYMBOL(smp_ctl_set_bit);
@@ -276,7 +276,7 @@ void smp_ctl_clear_bit(int cr, int bit)
 
         memset(&parms.orvals, 0, sizeof(parms.orvals));
         memset(&parms.andvals, 0xff, sizeof(parms.andvals));
-        parms.andvals[cr] = ~(1L << bit);
+        parms.andvals[cr] = ~(1UL << bit);
         on_each_cpu(smp_ctl_bit_callback, &parms, 1);
 }
 EXPORT_SYMBOL(smp_ctl_clear_bit);
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index 5995e9bc72d9..0e358c2cffeb 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -25,7 +25,7 @@ extern void s390_backtrace(struct pt_regs * const regs, unsigned int depth);
 
 #include "hwsampler.h"
 
-#define DEFAULT_INTERVAL        4096
+#define DEFAULT_INTERVAL        4127518
 
 #define DEFAULT_SDBT_BLOCKS     1
 #define DEFAULT_SDB_BLOCKS      511
@@ -151,6 +151,12 @@ static int oprofile_hwsampler_init(struct oprofile_operations *ops)
         if (oprofile_max_interval == 0)
                 return -ENODEV;
 
+        /* The initial value should be sane */
+        if (oprofile_hw_interval < oprofile_min_interval)
+                oprofile_hw_interval = oprofile_min_interval;
+        if (oprofile_hw_interval > oprofile_max_interval)
+                oprofile_hw_interval = oprofile_max_interval;
+
         if (oprofile_timer_init(ops))
                 return -ENODEV;
 
diff --git a/arch/sh/include/asm/mmzone.h b/arch/sh/include/asm/mmzone.h
index 8887baff5eff..15a8496960e6 100644
--- a/arch/sh/include/asm/mmzone.h
+++ b/arch/sh/include/asm/mmzone.h
@@ -9,10 +9,6 @@
 extern struct pglist_data *node_data[];
 #define NODE_DATA(nid)          (node_data[nid])
 
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)       (NODE_DATA(nid)->node_start_pfn + \
-                                 NODE_DATA(nid)->node_spanned_pages)
-
 static inline int pfn_to_nid(unsigned long pfn)
 {
         int nid;
diff --git a/arch/sparc/include/asm/mmzone.h b/arch/sparc/include/asm/mmzone.h
index e8c648741ed4..99d9b9f577bf 100644
--- a/arch/sparc/include/asm/mmzone.h
+++ b/arch/sparc/include/asm/mmzone.h
@@ -8,8 +8,6 @@
 extern struct pglist_data *node_data[];
 
 #define NODE_DATA(nid)          (node_data[nid])
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)       (NODE_DATA(nid)->node_end_pfn)
 
 extern int numa_cpu_lookup_table[];
 extern cpumask_t numa_cpumask_lookup_table[];
diff --git a/arch/tile/include/asm/mmzone.h b/arch/tile/include/asm/mmzone.h
index c6344c4f32ac..9d3dbce8f953 100644
--- a/arch/tile/include/asm/mmzone.h
+++ b/arch/tile/include/asm/mmzone.h
@@ -40,17 +40,6 @@ static inline int pfn_to_nid(unsigned long pfn)
         return highbits_to_node[__pfn_to_highbits(pfn)];
 }
 
-/*
- * Following are macros that each numa implmentation must define.
- */
-
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)                                               \
-({                                                                      \
-        pg_data_t *__pgdat = NODE_DATA(nid);                            \
-        __pgdat->node_start_pfn + __pgdat->node_spanned_pages;          \
-})
-
 #define kern_addr_valid(kaddr)  virt_addr_valid((void *)kaddr)
 
 static inline int pfn_valid(int pfn)
diff --git a/arch/x86/include/asm/memblock.h b/arch/x86/include/asm/memblock.h
index 19ae14ba6978..0cd3800f33b9 100644
--- a/arch/x86/include/asm/memblock.h
+++ b/arch/x86/include/asm/memblock.h
@@ -4,7 +4,6 @@
 #define ARCH_DISCARD_MEMBLOCK
 
 u64 memblock_x86_find_in_range_size(u64 start, u64 *sizep, u64 align);
-void memblock_x86_to_bootmem(u64 start, u64 end);
 
 void memblock_x86_reserve_range(u64 start, u64 end, char *name);
 void memblock_x86_free_range(u64 start, u64 end);
@@ -19,5 +18,6 @@ u64 memblock_x86_hole_size(u64 start, u64 end);
 u64 memblock_x86_find_in_range_node(int nid, u64 start, u64 end, u64 size, u64 align);
 u64 memblock_x86_free_memory_in_range(u64 addr, u64 limit);
 u64 memblock_x86_memory_in_range(u64 addr, u64 limit);
+bool memblock_x86_check_reserved_size(u64 *addrp, u64 *sizep, u64 align);
 
 #endif
diff --git a/arch/x86/include/asm/mmzone_32.h b/arch/x86/include/asm/mmzone_32.h
index 5e83a416eca8..224e8c5eb307 100644
--- a/arch/x86/include/asm/mmzone_32.h
+++ b/arch/x86/include/asm/mmzone_32.h
@@ -48,17 +48,6 @@ static inline int pfn_to_nid(unsigned long pfn)
 #endif
 }
 
-/*
- * Following are macros that each numa implmentation must define.
- */
-
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)                                               \
-({                                                                      \
-        pg_data_t *__pgdat = NODE_DATA(nid);                            \
-        __pgdat->node_start_pfn + __pgdat->node_spanned_pages;          \
-})
-
 static inline int pfn_valid(int pfn)
 {
         int nid = pfn_to_nid(pfn);
diff --git a/arch/x86/include/asm/mmzone_64.h b/arch/x86/include/asm/mmzone_64.h
index b3f88d7867c7..129d9aa3ceb3 100644
--- a/arch/x86/include/asm/mmzone_64.h
+++ b/arch/x86/include/asm/mmzone_64.h
@@ -13,8 +13,5 @@ extern struct pglist_data *node_data[];
 
 #define NODE_DATA(nid)          (node_data[nid])
 
-#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
-#define node_end_pfn(nid)       (NODE_DATA(nid)->node_start_pfn +       \
-                                 NODE_DATA(nid)->node_spanned_pages)
 #endif
 #endif /* _ASM_X86_MMZONE_64_H */
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index 31d84acc1512..a518c0a45044 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -22,6 +22,8 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
         u64 product;
 #ifdef __i386__
         u32 tmp1, tmp2;
+#else
+        ulong tmp;
 #endif
 
         if (shift < 0)
@@ -42,8 +44,11 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
                 : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
 #elif defined(__x86_64__)
         __asm__ (
-                "mul %%rdx ; shrd $32,%%rdx,%%rax"
-                : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
+                "mul %[mul_frac] ; shrd $32, %[hi], %[lo]"
+                : [lo]"=a"(product),
+                  [hi]"=d"(tmp)
+                : "0"(delta),
+                  [mul_frac]"rm"((u64)mul_frac));
 #else
 #error implement me!
 #endif
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index bd14bb4c8594..aee38623b768 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -565,7 +565,7 @@ gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t gfn,
 
 static bool mapping_level_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t large_gfn)
 {
-        return gfn_to_memslot_dirty_bitmap(vcpu, large_gfn, true);
+        return !gfn_to_memslot_dirty_bitmap(vcpu, large_gfn, true);
 }
 
 static int mapping_level(struct kvm_vcpu *vcpu, gfn_t large_gfn)
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 6c4dc010c4cb..9d03ad4dd5ec 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -121,7 +121,7 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
                                     gva_t addr, u32 access)
 {
         pt_element_t pte;
-        pt_element_t __user *ptep_user;
+        pt_element_t __user *uninitialized_var(ptep_user);
         gfn_t table_gfn;
         unsigned index, pt_access, uninitialized_var(pte_access);
         gpa_t pte_gpa;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4c3fa0f67469..d48ec60ea421 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2047,7 +2047,8 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
                                         unsigned long cr0,
                                         struct kvm_vcpu *vcpu)
 {
-        vmx_decache_cr3(vcpu);
+        if (!test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
+                vmx_decache_cr3(vcpu);
         if (!(cr0 & X86_CR0_PG)) {
                 /* From paging/starting to nonpaging */
                 vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
diff --git a/arch/x86/mm/memblock.c b/arch/x86/mm/memblock.c
index aa1169392b83..992da5ec5a64 100644
--- a/arch/x86/mm/memblock.c
+++ b/arch/x86/mm/memblock.c
@@ -8,7 +8,7 @@
 #include <linux/range.h>
 
 /* Check for already reserved areas */
-static bool __init check_with_memblock_reserved_size(u64 *addrp, u64 *sizep, u64 align)
+bool __init memblock_x86_check_reserved_size(u64 *addrp, u64 *sizep, u64 align)
 {
         struct memblock_region *r;
         u64 addr = *addrp, last;
@@ -59,7 +59,7 @@ u64 __init memblock_x86_find_in_range_size(u64 start, u64 *sizep, u64 align)
                 if (addr >= ei_last)
                         continue;
                 *sizep = ei_last - addr;
-                while (check_with_memblock_reserved_size(&addr, sizep, align))
+                while (memblock_x86_check_reserved_size(&addr, sizep, align))
                         ;
 
                 if (*sizep)
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 0972315c3860..68c3c1395202 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -188,7 +188,7 @@ static bool resource_contains(struct resource *res, resource_size_t point)
         return false;
 }
 
-static void coalesce_windows(struct pci_root_info *info, int type)
+static void coalesce_windows(struct pci_root_info *info, unsigned long type)
 {
         int i, j;
         struct resource *res1, *res2;
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 0d3a4fa34560..474356b98ede 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -310,14 +310,31 @@ void __init efi_reserve_boot_services(void)
 
         for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
                 efi_memory_desc_t *md = p;
-                unsigned long long start = md->phys_addr;
-                unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
+                u64 start = md->phys_addr;
+                u64 size = md->num_pages << EFI_PAGE_SHIFT;
 
                 if (md->type != EFI_BOOT_SERVICES_CODE &&
                     md->type != EFI_BOOT_SERVICES_DATA)
                         continue;
-
-                memblock_x86_reserve_range(start, start + size, "EFI Boot");
+                /* Only reserve where possible:
+                 * - Not within any already allocated areas
+                 * - Not over any memory area (really needed, if above?)
+                 * - Not within any part of the kernel
+                 * - Not the bios reserved area
+                */
+                if ((start+size >= virt_to_phys(_text)
+                                && start <= virt_to_phys(_end)) ||
+                        !e820_all_mapped(start, start+size, E820_RAM) ||
+                        memblock_x86_check_reserved_size(&start, &size,
+                                                        1<<EFI_PAGE_SHIFT)) {
+                        /* Could not reserve, skip it */
+                        md->num_pages = 0;
+                        memblock_dbg(PFX "Could not reserve boot range "
+                                        "[0x%010llx-0x%010llx]\n",
+                                                start, start+size-1);
+                } else
+                        memblock_x86_reserve_range(start, start+size,
+                                                        "EFI Boot");
         }
 }
 
@@ -334,6 +351,10 @@ static void __init efi_free_boot_services(void)
                     md->type != EFI_BOOT_SERVICES_DATA)
                         continue;
 
+                /* Could not reserve boot area */
+                if (!size)
+                        continue;
+
                 free_bootmem_late(start, size);
         }
 }
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index dd7b88f2ec7a..5525163a0398 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1033,6 +1033,13 @@ static void xen_machine_halt(void)
         xen_reboot(SHUTDOWN_poweroff);
 }
 
+static void xen_machine_power_off(void)
+{
+        if (pm_power_off)
+                pm_power_off();
+        xen_reboot(SHUTDOWN_poweroff);
+}
+
 static void xen_crash_shutdown(struct pt_regs *regs)
 {
         xen_reboot(SHUTDOWN_crash);
@@ -1058,7 +1065,7 @@ int xen_panic_handler_init(void)
 static const struct machine_ops xen_machine_ops __initconst = {
         .restart = xen_restart,
         .halt = xen_machine_halt,
-        .power_off = xen_machine_halt,
+        .power_off = xen_machine_power_off,
         .shutdown = xen_machine_halt,
         .crash_shutdown = xen_crash_shutdown,
         .emergency_restart = xen_emergency_restart,
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index dc708dcc62f1..673e968df3cf 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -59,6 +59,7 @@
 #include <asm/page.h>
 #include <asm/init.h>
 #include <asm/pat.h>
+#include <asm/smp.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -1231,7 +1232,7 @@ static void xen_flush_tlb_others(const struct cpumask *cpus,
 {
         struct {
                 struct mmuext_op op;
-                DECLARE_BITMAP(mask, NR_CPUS);
+                DECLARE_BITMAP(mask, num_processors);
         } *args;
         struct multicall_space mcs;
 
@@ -1599,6 +1600,11 @@ static void __init xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
                 for (pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
                         pte_t pte;
 
+#ifdef CONFIG_X86_32
+                        if (pfn > max_pfn_mapped)
+                                max_pfn_mapped = pfn;
+#endif
+
                         if (!pte_none(pte_page[pteidx]))
                                 continue;
 
@@ -1766,7 +1772,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
         initial_kernel_pmd =
                 extend_brk(sizeof(pmd_t) * PTRS_PER_PMD, PAGE_SIZE);
 
-        max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->mfn_list));
+        max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->pt_base) +
+                                  xen_start_info->nr_pt_frames * PAGE_SIZE +
+                                  512*1024);
 
         kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
         memcpy(initial_kernel_pmd, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index be1a464f6d66..60aeeb56948f 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -227,11 +227,7 @@ char * __init xen_memory_setup(void)
 
         memcpy(map_raw, map, sizeof(map));
         e820.nr_map = 0;
-#ifdef CONFIG_X86_32
         xen_extra_mem_start = mem_end;
-#else
-        xen_extra_mem_start = max((1ULL << 32), mem_end);
-#endif
         for (i = 0; i < memmap.nr_entries; i++) {
                 unsigned long long end;
 
@@ -266,6 +262,12 @@ char * __init xen_memory_setup(void)
                 if (map[i].size > 0)
                         e820_add_region(map[i].addr, map[i].size, map[i].type);
         }
+        /* Align the balloon area so that max_low_pfn does not get set
+         * to be at the _end_ of the PCI gap at the far end (fee01000).
+         * Note that xen_extra_mem_start gets set in the loop above to be
+         * past the last E820 region. */
+        if (xen_initial_domain() && (xen_extra_mem_start < (1ULL<<32)))
+                xen_extra_mem_start = (1ULL<<32);
 
         /*
          * In domU, the ISA region is normal, usable memory, but we
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 41038c01de40..b4533a86d7e4 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -205,11 +205,18 @@ static void __init xen_smp_prepare_boot_cpu(void)
 static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned cpu;
+        unsigned int i;
 
         xen_init_lock_cpu(0);
 
         smp_store_cpu_info(0);
         cpu_data(0).x86_max_cores = 1;
+
+        for_each_possible_cpu(i) {
+                zalloc_cpumask_var(&per_cpu(cpu_sibling_map, i), GFP_KERNEL);
+                zalloc_cpumask_var(&per_cpu(cpu_core_map, i), GFP_KERNEL);
+                zalloc_cpumask_var(&per_cpu(cpu_llc_shared_map, i), GFP_KERNEL);
+        }
         set_cpu_sibling_map(0);
 
         if (xen_smp_intr_init(0))
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index a62be8d0dc1b..3689f833afdc 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -927,7 +927,7 @@ static int throtl_dispatch(struct request_queue *q)
 
         bio_list_init(&bio_list_on_stack);
 
-        throtl_log(td, "dispatch nr_queued=%lu read=%u write=%u",
+        throtl_log(td, "dispatch nr_queued=%d read=%u write=%u",
                         total_nr_queued(td), td->nr_queued[READ],
                         td->nr_queued[WRITE]);
 
@@ -1204,7 +1204,7 @@ int blk_throtl_bio(struct request_queue *q, struct bio **biop)
         }
 
 queue_bio:
-        throtl_log_tg(td, tg, "[%c] bio. bdisp=%u sz=%u bps=%llu"
+        throtl_log_tg(td, tg, "[%c] bio. bdisp=%llu sz=%u bps=%llu"
                         " iodisp=%u iops=%u queued=%d/%d",
                         rw == READ ? 'R' : 'W',
                         tg->bytes_disp[rw], bio->bi_size, tg->bps[rw],
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 3c7b537bf908..f3799432676d 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -988,9 +988,10 @@ static void cfq_group_served(struct cfq_data *cfqd, struct cfq_group *cfqg,
 
         cfq_log_cfqg(cfqd, cfqg, "served: vt=%llu min_vt=%llu", cfqg->vdisktime,
                                         st->min_vdisktime);
-        cfq_log_cfqq(cfqq->cfqd, cfqq, "sl_used=%u disp=%u charge=%u iops=%u"
-                        " sect=%u", used_sl, cfqq->slice_dispatch, charge,
-                        iops_mode(cfqd), cfqq->nr_sectors);
+        cfq_log_cfqq(cfqq->cfqd, cfqq,
+                     "sl_used=%u disp=%u charge=%u iops=%u sect=%lu",
+                     used_sl, cfqq->slice_dispatch, charge,
+                     iops_mode(cfqd), cfqq->nr_sectors);
         cfq_blkiocg_update_timeslice_used(&cfqg->blkg, used_sl,
                                           unaccounted_sl);
         cfq_blkiocg_set_start_empty_time(&cfqg->blkg);
@@ -2023,8 +2024,8 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
          */
         if (sample_valid(cic->ttime_samples) &&
             (cfqq->slice_end - jiffies < cic->ttime_mean)) {
-                cfq_log_cfqq(cfqd, cfqq, "Not idling. think_time:%d",
-                                cic->ttime_mean);
+                cfq_log_cfqq(cfqd, cfqq, "Not idling. think_time:%lu",
+                             cic->ttime_mean);
                 return;
         }
 
@@ -2772,8 +2773,11 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
         smp_wmb();
         cic->key = cfqd_dead_key(cfqd);
 
-        if (ioc->ioc_data == cic)
+        if (rcu_dereference(ioc->ioc_data) == cic) {
+                spin_lock(&ioc->lock);
                 rcu_assign_pointer(ioc->ioc_data, NULL);
+                spin_unlock(&ioc->lock);
+        }
 
         if (cic->cfqq[BLK_RW_ASYNC]) {
                 cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
diff --git a/block/genhd.c b/block/genhd.c
index 95822ae25cfe..3608289c8ecd 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -1371,6 +1371,7 @@ struct disk_events {
         struct gendisk          *disk;          /* the associated disk */
         spinlock_t              lock;
 
+        struct mutex            block_mutex;    /* protects blocking */
         int                     block;          /* event blocking depth */
         unsigned int            pending;        /* events already sent out */
         unsigned int            clearing;       /* events being cleared */
@@ -1414,22 +1415,44 @@ static unsigned long disk_events_poll_jiffies(struct gendisk *disk)
         return msecs_to_jiffies(intv_msecs);
 }
 
-static void __disk_block_events(struct gendisk *disk, bool sync)
+/**
+ * disk_block_events - block and flush disk event checking
+ * @disk: disk to block events for
+ *
+ * On return from this function, it is guaranteed that event checking
+ * isn't in progress and won't happen until unblocked by
+ * disk_unblock_events().  Events blocking is counted and the actual
+ * unblocking happens after the matching number of unblocks are done.
+ *
+ * Note that this intentionally does not block event checking from
+ * disk_clear_events().
+ *
+ * CONTEXT:
+ * Might sleep.
+ */
+void disk_block_events(struct gendisk *disk)
 {
         struct disk_events *ev = disk->ev;
         unsigned long flags;
         bool cancel;
 
+        if (!ev)
+                return;
+
+        /*
+         * Outer mutex ensures that the first blocker completes canceling
+         * the event work before further blockers are allowed to finish.
+         */
+        mutex_lock(&ev->block_mutex);
+
         spin_lock_irqsave(&ev->lock, flags);
         cancel = !ev->block++;
         spin_unlock_irqrestore(&ev->lock, flags);
 
-        if (cancel) {
-                if (sync)
-                        cancel_delayed_work_sync(&disk->ev->dwork);
-                else
-                        cancel_delayed_work(&disk->ev->dwork);
-        }
+        if (cancel)
+                cancel_delayed_work_sync(&disk->ev->dwork);
+
+        mutex_unlock(&ev->block_mutex);
 }
 
 static void __disk_unblock_events(struct gendisk *disk, bool check_now)
@@ -1461,27 +1484,6 @@ out_unlock:
 }
 
 /**
- * disk_block_events - block and flush disk event checking
- * @disk: disk to block events for
- *
- * On return from this function, it is guaranteed that event checking
- * isn't in progress and won't happen until unblocked by
- * disk_unblock_events().  Events blocking is counted and the actual
- * unblocking happens after the matching number of unblocks are done.
- *
- * Note that this intentionally does not block event checking from
- * disk_clear_events().
- *
- * CONTEXT:
- * Might sleep.
- */
-void disk_block_events(struct gendisk *disk)
-{
-        if (disk->ev)
-                __disk_block_events(disk, true);
-}
-
-/**
  * disk_unblock_events - unblock disk event checking
  * @disk: disk to unblock events for
  *
@@ -1508,10 +1510,18 @@ void disk_unblock_events(struct gendisk *disk)
  */
 void disk_check_events(struct gendisk *disk)
 {
-        if (disk->ev) {
-                __disk_block_events(disk, false);
-                __disk_unblock_events(disk, true);
+        struct disk_events *ev = disk->ev;
+        unsigned long flags;
+
+        if (!ev)
+                return;
+
+        spin_lock_irqsave(&ev->lock, flags);
+        if (!ev->block) {
+                cancel_delayed_work(&ev->dwork);
+                queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
         }
+        spin_unlock_irqrestore(&ev->lock, flags);
 }
 EXPORT_SYMBOL_GPL(disk_check_events);
 
@@ -1546,7 +1556,7 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask)
         spin_unlock_irq(&ev->lock);
 
         /* uncondtionally schedule event check and wait for it to finish */
-        __disk_block_events(disk, true);
+        disk_block_events(disk);
         queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
         flush_delayed_work(&ev->dwork);
         __disk_unblock_events(disk, false);
@@ -1664,7 +1674,7 @@ static ssize_t disk_events_poll_msecs_store(struct device *dev,
         if (intv < 0 && intv != -1)
                 return -EINVAL;
 
-        __disk_block_events(disk, true);
+        disk_block_events(disk);
         disk->ev->poll_msecs = intv;
         __disk_unblock_events(disk, true);
 
@@ -1750,6 +1760,7 @@ static void disk_add_events(struct gendisk *disk)
         INIT_LIST_HEAD(&ev->node);
         ev->disk = disk;
         spin_lock_init(&ev->lock);
+        mutex_init(&ev->block_mutex);
         ev->block = 1;
         ev->poll_msecs = -1;
         INIT_DELAYED_WORK(&ev->dwork, disk_events_workfn);
@@ -1770,7 +1781,7 @@ static void disk_del_events(struct gendisk *disk)
         if (!disk->ev)
                 return;
 
-        __disk_block_events(disk, true);
+        disk_block_events(disk);
 
         mutex_lock(&disk_events_mutex);
         list_del_init(&disk->ev->node);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 736bee5dafeb..000d03ae6653 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4143,9 +4143,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          * Devices which choke on SETXFER.  Applies only if both the
          * device and controller are SATA.
          */
-        { "PIONEER DVD-RW  DVRTD08",    "1.00", ATA_HORKAGE_NOSETXFER },
-        { "PIONEER DVD-RW  DVR-212D",   "1.28", ATA_HORKAGE_NOSETXFER },
-        { "PIONEER DVD-RW  DVR-216D",   "1.08", ATA_HORKAGE_NOSETXFER },
+        { "PIONEER DVD-RW  DVRTD08",    NULL,   ATA_HORKAGE_NOSETXFER },
+        { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
+        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
 
         /* End Marker */
         { }
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index d51f9795c064..927f968e99d9 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3797,6 +3797,12 @@ EXPORT_SYMBOL_GPL(ata_sas_port_alloc);
  */
 int ata_sas_port_start(struct ata_port *ap)
 {
+        /*
+         * the port is marked as frozen at allocation time, but if we don't
+         * have new eh, we won't thaw it
+         */
+        if (!ap->ops->error_handler)
+                ap->pflags &= ~ATA_PFLAG_FROZEN;
         return 0;
 }
 EXPORT_SYMBOL_GPL(ata_sas_port_start);
diff --git a/drivers/ata/pata_marvell.c b/drivers/ata/pata_marvell.c
index 75a6a0c0094f..5d7f58a7e34d 100644
--- a/drivers/ata/pata_marvell.c
+++ b/drivers/ata/pata_marvell.c
@@ -161,6 +161,9 @@ static const struct pci_device_id marvell_pci_tbl[] = {
         { PCI_DEVICE(0x11AB, 0x6121), },
         { PCI_DEVICE(0x11AB, 0x6123), },
         { PCI_DEVICE(0x11AB, 0x6145), },
+        { PCI_DEVICE(0x1B4B, 0x91A0), },
+        { PCI_DEVICE(0x1B4B, 0x91A4), },
+
         { }     /* terminate list */
 };
 
diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
index 1c4b3aa4c7c4..dc88a39e7db8 100644
--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
@@ -389,7 +389,7 @@ static void sata_dwc_tf_dump(struct ata_taskfile *tf)
 /*
  * Function: get_burst_length_encode
  * arguments: datalength: length in bytes of data
- * returns value to be programmed in register corrresponding to data length
+ * returns value to be programmed in register corresponding to data length
  * This value is effectively the log(base 2) of the length
  */
 static  int get_burst_length_encode(int datalength)
diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
index eaa8a854af03..ad367c4139b1 100644
--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -387,7 +387,7 @@ static int pm_runtime_clk_notify(struct notifier_block *nb,
         clknb = container_of(nb, struct pm_clk_notifier_block, nb);
 
         switch (action) {
-        case BUS_NOTIFY_ADD_DEVICE:
+        case BUS_NOTIFY_BIND_DRIVER:
                 if (clknb->con_ids[0]) {
                         for (con_id = clknb->con_ids; *con_id; con_id++)
                                 enable_clock(dev, *con_id);
@@ -395,7 +395,7 @@ static int pm_runtime_clk_notify(struct notifier_block *nb,
                         enable_clock(dev, NULL);
                 }
                 break;
-        case BUS_NOTIFY_DEL_DEVICE:
+        case BUS_NOTIFY_UNBOUND_DRIVER:
                 if (clknb->con_ids[0]) {
                         for (con_id = clknb->con_ids; *con_id; con_id++)
                                 disable_clock(dev, *con_id);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index aa6320207745..06f09bf89cb2 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -57,7 +57,8 @@ static int async_error;
  */
 void device_pm_init(struct device *dev)
 {
-        dev->power.in_suspend = false;
+        dev->power.is_prepared = false;
+        dev->power.is_suspended = false;
         init_completion(&dev->power.completion);
         complete_all(&dev->power.completion);
         dev->power.wakeup = NULL;
@@ -91,7 +92,7 @@ void device_pm_add(struct device *dev)
         pr_debug("PM: Adding info for %s:%s\n",
                  dev->bus ? dev->bus->name : "No Bus", dev_name(dev));
         mutex_lock(&dpm_list_mtx);
-        if (dev->parent && dev->parent->power.in_suspend)
+        if (dev->parent && dev->parent->power.is_prepared)
                 dev_warn(dev, "parent %s should not be sleeping\n",
                         dev_name(dev->parent));
         list_add_tail(&dev->power.entry, &dpm_list);
@@ -511,7 +512,14 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
         dpm_wait(dev->parent, async);
         device_lock(dev);
 
-        dev->power.in_suspend = false;
+        /*
+         * This is a fib.  But we'll allow new children to be added below
+         * a resumed device, even if the device hasn't been completed yet.
+         */
+        dev->power.is_prepared = false;
+
+        if (!dev->power.is_suspended)
+                goto Unlock;
 
         if (dev->pwr_domain) {
                 pm_dev_dbg(dev, state, "power domain ");
@@ -548,6 +556,9 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
         }
 
  End:
+        dev->power.is_suspended = false;
+
+ Unlock:
         device_unlock(dev);
         complete_all(&dev->power.completion);
 
@@ -670,7 +681,7 @@ void dpm_complete(pm_message_t state)
                 struct device *dev = to_device(dpm_prepared_list.prev);
 
                 get_device(dev);
-                dev->power.in_suspend = false;
+                dev->power.is_prepared = false;
                 list_move(&dev->power.entry, &list);
                 mutex_unlock(&dpm_list_mtx);
 
@@ -835,11 +846,11 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
         device_lock(dev);
 
         if (async_error)
-                goto End;
+                goto Unlock;
 
         if (pm_wakeup_pending()) {
                 async_error = -EBUSY;
-                goto End;
+                goto Unlock;
         }
 
         if (dev->pwr_domain) {
@@ -877,6 +888,9 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
         }
 
  End:
+        dev->power.is_suspended = !error;
+
+ Unlock:
         device_unlock(dev);
         complete_all(&dev->power.completion);
 
@@ -1042,7 +1056,7 @@ int dpm_prepare(pm_message_t state)
                         put_device(dev);
                         break;
                 }
-                dev->power.in_suspend = true;
+                dev->power.is_prepared = true;
                 if (!list_empty(&dev->power.entry))
                         list_move_tail(&dev->power.entry, &dpm_prepared_list);
                 put_device(dev);
diff --git a/drivers/bluetooth/btmrvl_debugfs.c b/drivers/bluetooth/btmrvl_debugfs.c
index fd6305bf953e..8ecf4c6c2874 100644
--- a/drivers/bluetooth/btmrvl_debugfs.c
+++ b/drivers/bluetooth/btmrvl_debugfs.c
@@ -64,6 +64,8 @@ static ssize_t btmrvl_hscfgcmd_write(struct file *file,
                 return -EFAULT;
 
         ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
 
         priv->btmrvl_dev.hscfgcmd = result;
 
@@ -108,6 +110,8 @@ static ssize_t btmrvl_psmode_write(struct file *file, const char __user *ubuf,
                 return -EFAULT;
 
         ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
 
         priv->btmrvl_dev.psmode = result;
 
@@ -147,6 +151,8 @@ static ssize_t btmrvl_pscmd_write(struct file *file, const char __user *ubuf,
                 return -EFAULT;
 
         ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
 
         priv->btmrvl_dev.pscmd = result;
 
@@ -191,6 +197,8 @@ static ssize_t btmrvl_gpiogap_write(struct file *file, const char __user *ubuf,
                 return -EFAULT;
 
         ret = strict_strtol(buf, 16, &result);
+        if (ret)
+                return ret;
 
         priv->btmrvl_dev.gpio_gap = result;
 
@@ -230,6 +238,8 @@ static ssize_t btmrvl_hscmd_write(struct file *file, const char __user *ubuf,
                 return -EFAULT;
 
         ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
 
         priv->btmrvl_dev.hscmd = result;
         if (priv->btmrvl_dev.hscmd) {
@@ -272,6 +282,8 @@ static ssize_t btmrvl_hsmode_write(struct file *file, const char __user *ubuf,
                 return -EFAULT;
 
         ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
 
         priv->btmrvl_dev.hsmode = result;
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 94c84d744100..c6389de53161 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1219,11 +1219,11 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                 ret = i915_gem_object_bind_to_gtt(obj, 0, true);
                 if (ret)
                         goto unlock;
-        }
 
-        ret = i915_gem_object_set_to_gtt_domain(obj, write);
-        if (ret)
-                goto unlock;
+                ret = i915_gem_object_set_to_gtt_domain(obj, write);
+                if (ret)
+                        goto unlock;
+        }
 
         if (obj->tiling_mode == I915_TILING_NONE)
                 ret = i915_gem_object_put_fence(obj);
@@ -2926,8 +2926,6 @@ i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj)
          */
         wmb();
 
-        i915_gem_release_mmap(obj);
-
         old_write_domain = obj->base.write_domain;
         obj->base.write_domain = 0;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 20a4cc5b818f..4934cf84c320 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -187,10 +187,6 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
         if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_CPU)
                 i915_gem_clflush_object(obj);
 
-        /* blow away mappings if mapped through GTT */
-        if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_GTT)
-                i915_gem_release_mmap(obj);
-
         if (obj->base.pending_write_domain)
                 cd->flips |= atomic_read(&obj->pending_flip);
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 9e34a1abeb61..ae2b49969b99 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1749,6 +1749,7 @@ void ironlake_irq_preinstall(struct drm_device *dev)
                  * happens.
                  */
                 I915_WRITE(GEN6_BLITTER_HWSTAM, ~GEN6_BLITTER_USER_INTERRUPT);
+                I915_WRITE(GEN6_BSD_HWSTAM, ~GEN6_BSD_USER_INTERRUPT);
         }
 
         /* XXX hotplug from PCH */
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 2f967af8e62e..5d5def756c9e 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -531,6 +531,7 @@
 #define   GEN6_BSD_SLEEP_PSMI_CONTROL_RC_ILDL_MESSAGE_ENABLE            0
 #define   GEN6_BSD_SLEEP_PSMI_CONTROL_IDLE_INDICATOR                    (1 << 3)
 
+#define GEN6_BSD_HWSTAM                 0x12098
 #define GEN6_BSD_IMR                    0x120a8
 #define   GEN6_BSD_USER_INTERRUPT       (1 << 12)
 
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 60a94d2b5264..e8152d23d5b6 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -678,6 +678,7 @@ void i915_save_display(struct drm_device *dev)
         }
 
         /* VGA state */
+        mutex_lock(&dev->struct_mutex);
         dev_priv->saveVGA0 = I915_READ(VGA0);
         dev_priv->saveVGA1 = I915_READ(VGA1);
         dev_priv->saveVGA_PD = I915_READ(VGA_PD);
@@ -687,6 +688,7 @@ void i915_save_display(struct drm_device *dev)
                 dev_priv->saveVGACNTRL = I915_READ(VGACNTRL);
 
         i915_save_vga(dev);
+        mutex_unlock(&dev->struct_mutex);
 }
 
 void i915_restore_display(struct drm_device *dev)
@@ -780,6 +782,8 @@ void i915_restore_display(struct drm_device *dev)
                 I915_WRITE(CPU_VGACNTRL, dev_priv->saveVGACNTRL);
         else
                 I915_WRITE(VGACNTRL, dev_priv->saveVGACNTRL);
+
+        mutex_lock(&dev->struct_mutex);
         I915_WRITE(VGA0, dev_priv->saveVGA0);
         I915_WRITE(VGA1, dev_priv->saveVGA1);
         I915_WRITE(VGA_PD, dev_priv->saveVGA_PD);
@@ -787,6 +791,7 @@ void i915_restore_display(struct drm_device *dev)
         udelay(150);
 
         i915_restore_vga(dev);
+        mutex_unlock(&dev->struct_mutex);
 }
 
 int i915_save_state(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 81a9059b6a94..aa43e7be6053 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4687,6 +4687,7 @@ static int i9xx_crtc_mode_set(struct drm_crtc *crtc,
 
         I915_WRITE(DSPCNTR(plane), dspcntr);
         POSTING_READ(DSPCNTR(plane));
+        intel_enable_plane(dev_priv, plane, pipe);
 
         ret = intel_pipe_set_base(crtc, x, y, old_fb);
 
@@ -5217,8 +5218,6 @@ static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
 
         I915_WRITE(DSPCNTR(plane), dspcntr);
         POSTING_READ(DSPCNTR(plane));
-        if (!HAS_PCH_SPLIT(dev))
-                intel_enable_plane(dev_priv, plane, pipe);
 
         ret = intel_pipe_set_base(crtc, x, y, old_fb);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index f0d459bb46e4..525744d593c1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -262,7 +262,6 @@ static bool nouveau_dsm_detect(void)
                 vga_count++;
 
                 retval = nouveau_dsm_pci_probe(pdev);
-                printk("ret val is %d\n", retval);
                 if (retval & NOUVEAU_DSM_HAS_MUX)
                         has_dsm |= 1;
                 if (retval & NOUVEAU_DSM_HAS_OPT)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 4b9f4493c9f9..7347075ca5b8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -339,11 +339,12 @@ semaphore_acquire(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
         int ret;
 
         if (dev_priv->chipset < 0x84) {
-                ret = RING_SPACE(chan, 3);
+                ret = RING_SPACE(chan, 4);
                 if (ret)
                         return ret;
 
-                BEGIN_RING(chan, NvSubSw, NV_SW_SEMAPHORE_OFFSET, 2);
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 3);
+                OUT_RING  (chan, NvSema);
                 OUT_RING  (chan, sema->mem->start);
                 OUT_RING  (chan, 1);
         } else
@@ -351,10 +352,12 @@ semaphore_acquire(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
                 struct nouveau_vma *vma = &dev_priv->fence.bo->vma;
                 u64 offset = vma->offset + sema->mem->start;
 
-                ret = RING_SPACE(chan, 5);
+                ret = RING_SPACE(chan, 7);
                 if (ret)
                         return ret;
 
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
+                OUT_RING  (chan, chan->vram_handle);
                 BEGIN_RING(chan, NvSubSw, 0x0010, 4);
                 OUT_RING  (chan, upper_32_bits(offset));
                 OUT_RING  (chan, lower_32_bits(offset));
@@ -394,11 +397,12 @@ semaphore_release(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
         int ret;
 
         if (dev_priv->chipset < 0x84) {
-                ret = RING_SPACE(chan, 4);
+                ret = RING_SPACE(chan, 5);
                 if (ret)
                         return ret;
 
-                BEGIN_RING(chan, NvSubSw, NV_SW_SEMAPHORE_OFFSET, 1);
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 2);
+                OUT_RING  (chan, NvSema);
                 OUT_RING  (chan, sema->mem->start);
                 BEGIN_RING(chan, NvSubSw, NV_SW_SEMAPHORE_RELEASE, 1);
                 OUT_RING  (chan, 1);
@@ -407,10 +411,12 @@ semaphore_release(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
                 struct nouveau_vma *vma = &dev_priv->fence.bo->vma;
                 u64 offset = vma->offset + sema->mem->start;
 
-                ret = RING_SPACE(chan, 5);
+                ret = RING_SPACE(chan, 7);
                 if (ret)
                         return ret;
 
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
+                OUT_RING  (chan, chan->vram_handle);
                 BEGIN_RING(chan, NvSubSw, 0x0010, 4);
                 OUT_RING  (chan, upper_32_bits(offset));
                 OUT_RING  (chan, lower_32_bits(offset));
@@ -504,22 +510,22 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
         struct nouveau_gpuobj *obj = NULL;
         int ret;
 
-        if (dev_priv->card_type >= NV_C0)
-                goto out_initialised;
+        if (dev_priv->card_type < NV_C0) {
+                /* Create an NV_SW object for various sync purposes */
+                ret = nouveau_gpuobj_gr_new(chan, NvSw, NV_SW);
+                if (ret)
+                        return ret;
 
-        /* Create an NV_SW object for various sync purposes */
-        ret = nouveau_gpuobj_gr_new(chan, NvSw, NV_SW);
-        if (ret)
-                return ret;
+                ret = RING_SPACE(chan, 2);
+                if (ret)
+                        return ret;
 
-        /* we leave subchannel empty for nvc0 */
-        ret = RING_SPACE(chan, 2);
-        if (ret)
-                return ret;
-        BEGIN_RING(chan, NvSubSw, 0, 1);
-        OUT_RING(chan, NvSw);
+                BEGIN_RING(chan, NvSubSw, 0, 1);
+                OUT_RING  (chan, NvSw);
+                FIRE_RING (chan);
+        }
 
-        /* Create a DMA object for the shared cross-channel sync area. */
+        /* Setup area of memory shared between all channels for x-chan sync */
         if (USE_SEMA(dev) && dev_priv->chipset < 0x84) {
                 struct ttm_mem_reg *mem = &dev_priv->fence.bo->bo.mem;
 
@@ -534,23 +540,8 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
                 nouveau_gpuobj_ref(NULL, &obj);
                 if (ret)
                         return ret;
-
-                ret = RING_SPACE(chan, 2);
-                if (ret)
-                        return ret;
-                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
-                OUT_RING(chan, NvSema);
-        } else {
-                ret = RING_SPACE(chan, 2);
-                if (ret)
-                        return ret;
-                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
-                OUT_RING  (chan, chan->vram_handle); /* whole VM */
         }
 
-        FIRE_RING(chan);
-
-out_initialised:
         INIT_LIST_HEAD(&chan->fence.pending);
         spin_lock_init(&chan->fence.lock);
         atomic_set(&chan->fence.last_sequence_irq, 0);
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index 922fb6b664ed..ef9dec0e6f8b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev)
                 entries   = perf[2];
         }
 
+        if (entries > NOUVEAU_PM_MAX_LEVEL) {
+                NV_DEBUG(dev, "perf table has too many entries - buggy vbios?\n");
+                entries = NOUVEAU_PM_MAX_LEVEL;
+        }
+
         entry = perf + headerlen;
         for (i = 0; i < entries; i++) {
                 struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl];
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 80218887e0a0..144f79a350ae 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -881,8 +881,8 @@ int nouveau_load(struct drm_device *dev, unsigned long flags)
 
 #ifdef __BIG_ENDIAN
         /* Put the card in BE mode if it's not */
-        if (nv_rd32(dev, NV03_PMC_BOOT_1))
-                nv_wr32(dev, NV03_PMC_BOOT_1, 0x00000001);
+        if (nv_rd32(dev, NV03_PMC_BOOT_1) != 0x01000001)
+                nv_wr32(dev, NV03_PMC_BOOT_1, 0x01000001);
 
         DRM_MEMORYBARRIER();
 #endif
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 74a3f6872701..08da478ba544 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -409,7 +409,7 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
         struct nouveau_channel *evo = dispc->sync;
         int ret;
 
-        ret = RING_SPACE(evo, 24);
+        ret = RING_SPACE(evo, chan ? 25 : 27);
         if (unlikely(ret))
                 return ret;
 
@@ -458,8 +458,19 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
         /* queue the flip on the crtc's "display sync" channel */
         BEGIN_RING(evo, 0, 0x0100, 1);
         OUT_RING  (evo, 0xfffe0000);
-        BEGIN_RING(evo, 0, 0x0084, 5);
-        OUT_RING  (evo, chan ? 0x00000100 : 0x00000010);
+        if (chan) {
+                BEGIN_RING(evo, 0, 0x0084, 1);
+                OUT_RING  (evo, 0x00000100);
+        } else {
+                BEGIN_RING(evo, 0, 0x0084, 1);
+                OUT_RING  (evo, 0x00000010);
+                /* allows gamma somehow, PDISP will bitch at you if
+                 * you don't wait for vblank before changing this..
+                 */
+                BEGIN_RING(evo, 0, 0x00e0, 1);
+                OUT_RING  (evo, 0x40000000);
+        }
+        BEGIN_RING(evo, 0, 0x0088, 4);
         OUT_RING  (evo, dispc->sem.offset);
         OUT_RING  (evo, 0xf00d0000 | dispc->sem.value);
         OUT_RING  (evo, 0x74b1e000);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 7e3d96e7ac04..12d2fdc52414 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -140,11 +140,17 @@ void evergreen_pm_misc(struct radeon_device *rdev)
         struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
 
         if (voltage->type == VOLTAGE_SW) {
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->voltage == 0xff01)
+                        return;
                 if (voltage->voltage && (voltage->voltage != rdev->pm.current_vddc)) {
                         radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
                         DRM_DEBUG("Setting: vddc: %d\n", voltage->voltage);
                 }
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->vddci == 0xff01)
+                        return;
                 if (voltage->vddci && (voltage->vddci != rdev->pm.current_vddci)) {
                         radeon_atom_set_voltage(rdev, voltage->vddci, SET_VOLTAGE_TYPE_ASIC_VDDCI);
                         rdev->pm.current_vddci = voltage->vddci;
@@ -2007,9 +2013,9 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                 rdev->config.evergreen.tile_config |= (3 << 0);
                 break;
         }
-        /* num banks is 8 on all fusion asics */
+        /* num banks is 8 on all fusion asics. 0 = 4, 1 = 8, 2 = 16 */
         if (rdev->flags & RADEON_IS_IGP)
-                rdev->config.evergreen.tile_config |= 8 << 4;
+                rdev->config.evergreen.tile_config |= 1 << 4;
         else
                 rdev->config.evergreen.tile_config |=
                         ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
@@ -2695,28 +2701,25 @@ static inline u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
 
 int evergreen_irq_process(struct radeon_device *rdev)
 {
-        u32 wptr = evergreen_get_ih_wptr(rdev);
-        u32 rptr = rdev->ih.rptr;
+        u32 wptr;
+        u32 rptr;
         u32 src_id, src_data;
         u32 ring_index;
         unsigned long flags;
         bool queue_hotplug = false;
 
-        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
-        if (!rdev->ih.enabled)
+        if (!rdev->ih.enabled || rdev->shutdown)
                 return IRQ_NONE;
 
-        spin_lock_irqsave(&rdev->ih.lock, flags);
+        wptr = evergreen_get_ih_wptr(rdev);
+        rptr = rdev->ih.rptr;
+        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
 
+        spin_lock_irqsave(&rdev->ih.lock, flags);
         if (rptr == wptr) {
                 spin_unlock_irqrestore(&rdev->ih.lock, flags);
                 return IRQ_NONE;
         }
-        if (rdev->shutdown) {
-                spin_unlock_irqrestore(&rdev->ih.lock, flags);
-                return IRQ_NONE;
-        }
-
 restart_ih:
         /* display interrupts */
         evergreen_irq_ack(rdev);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 7dd45ca64e29..f79d2ccb6755 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -590,6 +590,9 @@ void r600_pm_misc(struct radeon_device *rdev)
         struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
 
         if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->voltage == 0xff01)
+                        return;
                 if (voltage->voltage != rdev->pm.current_vddc) {
                         radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
@@ -3294,27 +3297,26 @@ static inline u32 r600_get_ih_wptr(struct radeon_device *rdev)
 
 int r600_irq_process(struct radeon_device *rdev)
 {
-        u32 wptr = r600_get_ih_wptr(rdev);
-        u32 rptr = rdev->ih.rptr;
+        u32 wptr;
+        u32 rptr;
         u32 src_id, src_data;
         u32 ring_index;
         unsigned long flags;
         bool queue_hotplug = false;
 
-        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
-        if (!rdev->ih.enabled)
+        if (!rdev->ih.enabled || rdev->shutdown)
                 return IRQ_NONE;
 
+        wptr = r600_get_ih_wptr(rdev);
+        rptr = rdev->ih.rptr;
+        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
+
         spin_lock_irqsave(&rdev->ih.lock, flags);
 
         if (rptr == wptr) {
                 spin_unlock_irqrestore(&rdev->ih.lock, flags);
                 return IRQ_NONE;
         }
-        if (rdev->shutdown) {
-                spin_unlock_irqrestore(&rdev->ih.lock, flags);
-                return IRQ_NONE;
-        }
 
 restart_ih:
         /* display interrupts */
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 27f45579e64b..ef0e0e016914 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -179,6 +179,7 @@ void radeon_pm_resume(struct radeon_device *rdev);
 void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
 void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 voltage_type);
+int radeon_atom_get_max_vddc(struct radeon_device *rdev, u16 *voltage);
 void rs690_pm_info(struct radeon_device *rdev);
 extern int rv6xx_get_temp(struct radeon_device *rdev);
 extern int rv770_get_temp(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index fa62a503ae70..bf2b61584cdb 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2320,6 +2320,14 @@ static bool radeon_atombios_parse_pplib_clock_info(struct radeon_device *rdev,
                         le16_to_cpu(clock_info->r600.usVDDC);
         }
 
+        /* patch up vddc if necessary */
+        if (rdev->pm.power_state[state_index].clock_info[mode_index].voltage.voltage == 0xff01) {
+                u16 vddc;
+
+                if (radeon_atom_get_max_vddc(rdev, &vddc) == 0)
+                        rdev->pm.power_state[state_index].clock_info[mode_index].voltage.voltage = vddc;
+        }
+
         if (rdev->flags & RADEON_IS_IGP) {
                 /* skip invalid modes */
                 if (rdev->pm.power_state[state_index].clock_info[mode_index].sclk == 0)
@@ -2607,6 +2615,10 @@ void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 v
         if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
                 return;
 
+        /* 0xff01 is a flag rather then an actual voltage */
+        if (voltage_level == 0xff01)
+                return;
+
         switch (crev) {
         case 1:
                 args.v1.ucVoltageType = voltage_type;
@@ -2626,7 +2638,35 @@ void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 v
         atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 }
 
+int radeon_atom_get_max_vddc(struct radeon_device *rdev,
+                             u16 *voltage)
+{
+        union set_voltage args;
+        int index = GetIndexIntoMasterTable(COMMAND, SetVoltage);
+        u8 frev, crev;
+
+        if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
+                return -EINVAL;
+
+        switch (crev) {
+        case 1:
+                return -EINVAL;
+        case 2:
+                args.v2.ucVoltageType = SET_VOLTAGE_GET_MAX_VOLTAGE;
+                args.v2.ucVoltageMode = 0;
+                args.v2.usVoltageLevel = 0;
+
+                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
+                *voltage = le16_to_cpu(args.v2.usVoltageLevel);
+                break;
+        default:
+                DRM_ERROR("Unknown table version %d, %d\n", frev, crev);
+                return -EINVAL;
+        }
+
+        return 0;
+}
 
 void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
 {
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index f55b64cb59d1..b293487e5aa3 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1090,9 +1090,10 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                         break;
                 }
 
-                if (is_dp)
+                if (is_dp) {
                         args.v2.acConfig.fCoherentMode = 1;
-                else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
+                        args.v2.acConfig.fDPConnector = 1;
+                } else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
                         if (dig->coherent_mode)
                                 args.v2.acConfig.fCoherentMode = 1;
                         if (radeon_encoder->pixel_clock > 165000)
@@ -1431,7 +1432,11 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
         if (is_dig) {
                 switch (mode) {
                 case DRM_MODE_DPMS_ON:
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+                        /* some early dce3.2 boards have a bug in their transmitter control table */
+                        if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730))
+                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+                        else
+                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                         if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_DP) {
                                 struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
 
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index ef8a5babe9f7..6f508ffd1035 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -105,6 +105,9 @@ void rv770_pm_misc(struct radeon_device *rdev)
         struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
 
         if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->voltage == 0xff01)
+                        return;
                 if (voltage->voltage != rdev->pm.current_vddc) {
                         radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f7440e8ce3e7..6f3289a57888 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1423,6 +1423,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACETRAVELLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LUMIO, USB_DEVICE_ID_CRYSTALTOUCH) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LUMIO, USB_DEVICE_ID_CRYSTALTOUCH_DUAL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index aecb5a4b8d6d..a756ee6c7df5 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -449,6 +449,7 @@
 
 #define USB_VENDOR_ID_LUMIO             0x202e
 #define USB_DEVICE_ID_CRYSTALTOUCH      0x0006
+#define USB_DEVICE_ID_CRYSTALTOUCH_DUAL 0x0007
 
 #define USB_VENDOR_ID_MCC               0x09db
 #define USB_DEVICE_ID_MCC_PMD1024LS     0x0076
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 0b2dcd0ee591..62cac4dc3b62 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -271,6 +271,8 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         }
                         return 1;
                 case HID_DG_CONTACTID:
+                        if (!td->maxcontacts)
+                                td->maxcontacts = MT_DEFAULT_MAXCONTACT;
                         input_mt_init_slots(hi->input, td->maxcontacts);
                         td->last_slot_field = usage->hid;
                         td->last_field_index = field->index;
@@ -547,9 +549,6 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
         if (ret)
                 goto fail;
 
-        if (!td->maxcontacts)
-                td->maxcontacts = MT_DEFAULT_MAXCONTACT;
-
         td->slots = kzalloc(td->maxcontacts * sizeof(struct mt_slot),
                                 GFP_KERNEL);
         if (!td->slots) {
@@ -677,6 +676,9 @@ static const struct hid_device_id mt_devices[] = {
         { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE,
                 HID_USB_DEVICE(USB_VENDOR_ID_LUMIO,
                         USB_DEVICE_ID_CRYSTALTOUCH) },
+        { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE,
+                HID_USB_DEVICE(USB_VENDOR_ID_LUMIO,
+                        USB_DEVICE_ID_CRYSTALTOUCH_DUAL) },
 
         /* MosArt panels */
         { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE,
@@ -707,10 +709,10 @@ static const struct hid_device_id mt_devices[] = {
                 HID_USB_DEVICE(USB_VENDOR_ID_STANTUM,
                         USB_DEVICE_ID_MTP)},
         { .driver_data = MT_CLS_CONFIDENCE,
-                HID_USB_DEVICE(USB_VENDOR_ID_STANTUM,
+                HID_USB_DEVICE(USB_VENDOR_ID_STANTUM_STM,
                         USB_DEVICE_ID_MTP_STM)},
         { .driver_data = MT_CLS_CONFIDENCE,
-                HID_USB_DEVICE(USB_VENDOR_ID_STANTUM,
+                HID_USB_DEVICE(USB_VENDOR_ID_STANTUM_SITRONIX,
                         USB_DEVICE_ID_MTP_SITRONIX)},
 
         /* Touch International panels */
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index b5e892017e0c..dcb78a7a8047 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -268,6 +268,7 @@ static struct device_attribute atk_name_attr =
 static void atk_init_attribute(struct device_attribute *attr, char *name,
                 sysfs_show_func show)
 {
+        sysfs_attr_init(&attr->attr);
         attr->attr.name = name;
         attr->attr.mode = 0444;
         attr->show = show;
@@ -1188,19 +1189,15 @@ static int atk_create_files(struct atk_data *data)
         int err;
 
         list_for_each_entry(s, &data->sensor_list, list) {
-                sysfs_attr_init(&s->input_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->input_attr);
                 if (err)
                         return err;
-                sysfs_attr_init(&s->label_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->label_attr);
                 if (err)
                         return err;
-                sysfs_attr_init(&s->limit1_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->limit1_attr);
                 if (err)
                         return err;
-                sysfs_attr_init(&s->limit2_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->limit2_attr);
                 if (err)
                         return err;
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 85e937984ff7..0070d5476dd0 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -97,9 +97,7 @@ struct platform_data {
 struct pdev_entry {
         struct list_head list;
         struct platform_device *pdev;
-        unsigned int cpu;
         u16 phys_proc_id;
-        u16 cpu_core_id;
 };
 
 static LIST_HEAD(pdev_list);
@@ -653,9 +651,7 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
         }
 
         pdev_entry->pdev = pdev;
-        pdev_entry->cpu = cpu;
         pdev_entry->phys_proc_id = TO_PHYS_ID(cpu);
-        pdev_entry->cpu_core_id = TO_CORE_ID(cpu);
 
         list_add_tail(&pdev_entry->list, &pdev_list);
         mutex_unlock(&pdev_list_mutex);
diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
index 537409d07ee7..1a409c5bc9bc 100644
--- a/drivers/hwmon/ibmaem.c
+++ b/drivers/hwmon/ibmaem.c
@@ -947,6 +947,7 @@ static int aem_register_sensors(struct aem_data *data,
 
         /* Set up read-only sensors */
         while (ro->label) {
+                sysfs_attr_init(&sensors->dev_attr.attr);
                 sensors->dev_attr.attr.name = ro->label;
                 sensors->dev_attr.attr.mode = S_IRUGO;
                 sensors->dev_attr.show = ro->show;
@@ -963,6 +964,7 @@ static int aem_register_sensors(struct aem_data *data,
 
         /* Set up read-write sensors */
         while (rw->label) {
+                sysfs_attr_init(&sensors->dev_attr.attr);
                 sensors->dev_attr.attr.name = rw->label;
                 sensors->dev_attr.attr.mode = S_IRUGO | S_IWUSR;
                 sensors->dev_attr.show = rw->show;
diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c
index 06d4eafcf76b..41dbf8161ed7 100644
--- a/drivers/hwmon/ibmpex.c
+++ b/drivers/hwmon/ibmpex.c
@@ -358,6 +358,7 @@ static int create_sensor(struct ibmpex_bmc_data *data, int type,
         else if (type == POWER_SENSOR)
                 sprintf(n, power_sensor_name_templates[func], "power", counter);
 
+        sysfs_attr_init(&data->sensors[sensor].attr[func].dev_attr.attr);
         data->sensors[sensor].attr[func].dev_attr.attr.name = n;
         data->sensors[sensor].attr[func].dev_attr.attr.mode = S_IRUGO;
         data->sensors[sensor].attr[func].dev_attr.show = ibmpex_show_sensor;
diff --git a/drivers/hwmon/s3c-hwmon.c b/drivers/hwmon/s3c-hwmon.c
index 92b42db43bcf..b39f52e2752a 100644
--- a/drivers/hwmon/s3c-hwmon.c
+++ b/drivers/hwmon/s3c-hwmon.c
@@ -232,6 +232,7 @@ static int s3c_hwmon_create_attr(struct device *dev,
 
         attr = &attrs->in;
         attr->index = channel;
+        sysfs_attr_init(&attr->dev_attr.attr);
         attr->dev_attr.attr.name  = attrs->in_name;
         attr->dev_attr.attr.mode  = S_IRUGO;
         attr->dev_attr.show = s3c_hwmon_ch_show;
@@ -249,6 +250,7 @@ static int s3c_hwmon_create_attr(struct device *dev,
 
                 attr = &attrs->label;
                 attr->index = channel;
+                sysfs_attr_init(&attr->dev_attr.attr);
                 attr->dev_attr.attr.name  = attrs->label_name;
                 attr->dev_attr.attr.mode  = S_IRUGO;
                 attr->dev_attr.show = s3c_hwmon_label_show;
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index f660cd04ec2f..31fb44085c9b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1463,9 +1463,9 @@ static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
         struct c4iw_qp_attributes attrs;
         int disconnect = 1;
         int release = 0;
-        int abort = 0;
         struct tid_info *t = dev->rdev.lldi.tids;
         unsigned int tid = GET_TID(hdr);
+        int ret;
 
         ep = lookup_tid(t, tid);
         PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
@@ -1501,10 +1501,12 @@ static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
                 start_ep_timer(ep);
                 __state_set(&ep->com, CLOSING);
                 attrs.next_state = C4IW_QP_STATE_CLOSING;
-                abort = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                ret = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
                                        C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
-                peer_close_upcall(ep);
-                disconnect = 1;
+                if (ret != -ECONNRESET) {
+                        peer_close_upcall(ep);
+                        disconnect = 1;
+                }
                 break;
         case ABORTING:
                 disconnect = 0;
@@ -2109,15 +2111,16 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
                 break;
         }
 
-        mutex_unlock(&ep->com.mutex);
         if (close) {
-                if (abrupt)
-                        ret = abort_connection(ep, NULL, gfp);
-                else
+                if (abrupt) {
+                        close_complete_upcall(ep);
+                        ret = send_abort(ep, NULL, gfp);
+                } else
                         ret = send_halfclose(ep, gfp);
                 if (ret)
                         fatal = 1;
         }
+        mutex_unlock(&ep->com.mutex);
         if (fatal)
                 release_ep_resources(ep);
         return ret;
@@ -2301,6 +2304,31 @@ static int fw6_msg(struct c4iw_dev *dev, struct sk_buff *skb)
         return 0;
 }
 
+static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_abort_req_rss *req = cplhdr(skb);
+        struct c4iw_ep *ep;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(req);
+
+        ep = lookup_tid(t, tid);
+        if (is_neg_adv_abort(req->status)) {
+                PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+                     ep->hwtid);
+                kfree_skb(skb);
+                return 0;
+        }
+        PDBG("%s ep %p tid %u state %u\n", __func__, ep, ep->hwtid,
+             ep->com.state);
+
+        /*
+         * Wake up any threads in rdma_init() or rdma_fini().
+         */
+        c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+        sched(dev, skb);
+        return 0;
+}
+
 /*
  * Most upcalls from the T4 Core go to sched() to
  * schedule the processing on a work queue.
@@ -2317,7 +2345,7 @@ c4iw_handler_func c4iw_handlers[NUM_CPL_CMDS] = {
         [CPL_PASS_ESTABLISH] = sched,
         [CPL_PEER_CLOSE] = sched,
         [CPL_CLOSE_CON_RPL] = sched,
-        [CPL_ABORT_REQ_RSS] = sched,
+        [CPL_ABORT_REQ_RSS] = peer_abort_intr,
         [CPL_RDMA_TERMINATE] = sched,
         [CPL_FW4_ACK] = sched,
         [CPL_SET_TCB_RPL] = set_tcb_rpl,
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 8d8f8add6fcd..1720dc790d13 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -801,6 +801,10 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
         if (ucontext) {
                 memsize = roundup(memsize, PAGE_SIZE);
                 hwentries = memsize / sizeof *chp->cq.queue;
+                while (hwentries > T4_MAX_IQ_SIZE) {
+                        memsize -= PAGE_SIZE;
+                        hwentries = memsize / sizeof *chp->cq.queue;
+                }
         }
         chp->cq.size = hwentries;
         chp->cq.memsize = memsize;
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 273ffe49525a..0347eed4a167 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -625,7 +625,7 @@ pbl_done:
         mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
         mhp->attr.va_fbo = virt;
         mhp->attr.page_size = shift - 12;
-        mhp->attr.len = (u32) length;
+        mhp->attr.len = length;
 
         err = register_mem(rhp, php, mhp, shift);
         if (err)
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 3b773b05a898..a41578e48c7b 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1207,11 +1207,8 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                                 c4iw_get_ep(&qhp->ep->com);
                         }
                         ret = rdma_fini(rhp, qhp, ep);
-                        if (ret) {
-                                if (internal)
-                                        c4iw_get_ep(&qhp->ep->com);
+                        if (ret)
                                 goto err;
-                        }
                         break;
                 case C4IW_QP_STATE_TERMINATE:
                         set_state(qhp, C4IW_QP_STATE_TERMINATE);
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 9f53e68a096a..8ec5237031a0 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -469,6 +469,8 @@ static u8 ib_rate_to_delay[IB_RATE_120_GBPS + 1] = {
 #define IB_7322_LT_STATE_RECOVERIDLE     0x0f
 #define IB_7322_LT_STATE_CFGENH          0x10
 #define IB_7322_LT_STATE_CFGTEST         0x11
+#define IB_7322_LT_STATE_CFGWAITRMTTEST  0x12
+#define IB_7322_LT_STATE_CFGWAITENH      0x13
 
 /* link state machine states from IBC */
 #define IB_7322_L_STATE_DOWN             0x0
@@ -498,8 +500,10 @@ static const u8 qib_7322_physportstate[0x20] = {
                 IB_PHYSPORTSTATE_LINK_ERR_RECOVER,
         [IB_7322_LT_STATE_CFGENH] = IB_PHYSPORTSTATE_CFG_ENH,
         [IB_7322_LT_STATE_CFGTEST] = IB_PHYSPORTSTATE_CFG_TRAIN,
-        [0x12] = IB_PHYSPORTSTATE_CFG_TRAIN,
-        [0x13] = IB_PHYSPORTSTATE_CFG_WAIT_ENH,
+        [IB_7322_LT_STATE_CFGWAITRMTTEST] =
+                IB_PHYSPORTSTATE_CFG_TRAIN,
+        [IB_7322_LT_STATE_CFGWAITENH] =
+                IB_PHYSPORTSTATE_CFG_WAIT_ENH,
         [0x14] = IB_PHYSPORTSTATE_CFG_TRAIN,
         [0x15] = IB_PHYSPORTSTATE_CFG_TRAIN,
         [0x16] = IB_PHYSPORTSTATE_CFG_TRAIN,
@@ -1692,7 +1696,9 @@ static void handle_serdes_issues(struct qib_pportdata *ppd, u64 ibcst)
                 break;
         }
 
-        if (ibclt == IB_7322_LT_STATE_CFGTEST &&
+        if (((ibclt >= IB_7322_LT_STATE_CFGTEST &&
+              ibclt <= IB_7322_LT_STATE_CFGWAITENH) ||
+             ibclt == IB_7322_LT_STATE_LINKUP) &&
             (ibcst & SYM_MASK(IBCStatusA_0, LinkSpeedQDR))) {
                 force_h1(ppd);
                 ppd->cpspec->qdr_reforce = 1;
@@ -7301,12 +7307,17 @@ static void ibsd_wr_allchans(struct qib_pportdata *ppd, int addr, unsigned data,
 static void serdes_7322_los_enable(struct qib_pportdata *ppd, int enable)
 {
         u64 data = qib_read_kreg_port(ppd, krp_serdesctrl);
-        printk(KERN_INFO QIB_DRV_NAME " IB%u:%u Turning LOS %s\n",
-                ppd->dd->unit, ppd->port, (enable ? "on" : "off"));
-        if (enable)
+        u8 state = SYM_FIELD(data, IBSerdesCtrl_0, RXLOSEN);
+
+        if (enable && !state) {
+                printk(KERN_INFO QIB_DRV_NAME " IB%u:%u Turning LOS on\n",
+                        ppd->dd->unit, ppd->port);
                 data |= SYM_MASK(IBSerdesCtrl_0, RXLOSEN);
-        else
+        } else if (!enable && state) {
+                printk(KERN_INFO QIB_DRV_NAME " IB%u:%u Turning LOS off\n",
+                        ppd->dd->unit, ppd->port);
                 data &= ~SYM_MASK(IBSerdesCtrl_0, RXLOSEN);
+        }
         qib_write_kreg_port(ppd, krp_serdesctrl, data);
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_intr.c b/drivers/infiniband/hw/qib/qib_intr.c
index a693c56ec8a6..6ae57d23004a 100644
--- a/drivers/infiniband/hw/qib/qib_intr.c
+++ b/drivers/infiniband/hw/qib/qib_intr.c
@@ -96,8 +96,12 @@ void qib_handle_e_ibstatuschanged(struct qib_pportdata *ppd, u64 ibcs)
          * states, or if it transitions from any of the up (INIT or better)
          * states into any of the down states (except link recovery), then
          * call the chip-specific code to take appropriate actions.
+         *
+         * ppd->lflags could be 0 if this is the first time the interrupt
+         * handlers has been called but the link is already up.
          */
-        if (lstate >= IB_PORT_INIT && (ppd->lflags & QIBL_LINKDOWN) &&
+        if (lstate >= IB_PORT_INIT &&
+            (!ppd->lflags || (ppd->lflags & QIBL_LINKDOWN)) &&
             ltstate == IB_PHYSPORTSTATE_LINKUP) {
                 /* transitioned to UP */
                 if (dd->f_ib_updown(ppd, 1, ibcs))
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index be0921ef6b52..4cf25347b015 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -111,7 +111,8 @@ static void evdev_event(struct input_handle *handle,
 
         rcu_read_unlock();
 
-        wake_up_interruptible(&evdev->wait);
+        if (type == EV_SYN && code == SYN_REPORT)
+                wake_up_interruptible(&evdev->wait);
 }
 
 static int evdev_fasync(int fd, struct file *file, int on)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 75e11c7b70fd..da38d97a51b1 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1756,7 +1756,7 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
         } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
                 mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
                            dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
-                clamp(mt_slots, 2, 32);
+                mt_slots = clamp(mt_slots, 2, 32);
         } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
                 mt_slots = 2;
         } else {
diff --git a/drivers/input/keyboard/omap-keypad.c b/drivers/input/keyboard/omap-keypad.c
index f23a743817db..33d0bdc837c0 100644
--- a/drivers/input/keyboard/omap-keypad.c
+++ b/drivers/input/keyboard/omap-keypad.c
@@ -209,6 +209,7 @@ static void omap_kp_tasklet(unsigned long data)
 #endif
                 }
         }
+        input_sync(omap_kp_data->input);
         memcpy(keypad_state, new_state, sizeof(keypad_state));
 
         if (key_down) {
diff --git a/drivers/input/keyboard/sh_keysc.c b/drivers/input/keyboard/sh_keysc.c
index 834cf98e7efb..6876700a4469 100644
--- a/drivers/input/keyboard/sh_keysc.c
+++ b/drivers/input/keyboard/sh_keysc.c
@@ -32,7 +32,7 @@ static const struct {
         [SH_KEYSC_MODE_3] = { 2, 4, 7 },
         [SH_KEYSC_MODE_4] = { 3, 6, 6 },
         [SH_KEYSC_MODE_5] = { 4, 6, 7 },
-        [SH_KEYSC_MODE_6] = { 5, 7, 7 },
+        [SH_KEYSC_MODE_6] = { 5, 8, 8 },
 };
 
 struct sh_keysc_priv {
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index 257e033986e4..0110b5a3a167 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -187,7 +187,7 @@ static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
                 if (size == 0)
                         size = xres ? : 1;
 
-                clamp(value, min, max);
+                value = clamp(value, min, max);
 
                 mousedev->packet.x = ((value - min) * xres) / size;
                 mousedev->packet.abs_event = 1;
@@ -201,7 +201,7 @@ static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
                 if (size == 0)
                         size = yres ? : 1;
 
-                clamp(value, min, max);
+                value = clamp(value, min, max);
 
                 mousedev->packet.y = yres - ((value - min) * yres) / size;
                 mousedev->packet.abs_event = 1;
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 59de638225fe..e35058bcd7b9 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -156,8 +156,10 @@ static int if_open(struct tty_struct *tty, struct file *filp)
         if (!cs || !try_module_get(cs->driver->owner))
                 return -ENODEV;
 
-        if (mutex_lock_interruptible(&cs->mutex))
+        if (mutex_lock_interruptible(&cs->mutex)) {
+                module_put(cs->driver->owner);
                 return -ERESTARTSYS;
+        }
         tty->driver_data = cs;
 
         ++cs->open_count;
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index ee5109a3cd98..42f067347bc7 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
+
         if (atomic_dec_return(&queued_msg->use_count) == 0) {
                 dev_kfree_skb(skb);
                 kfree(queued_msg);
         }
 
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
-
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/3c503.c b/drivers/net/3c503.c
index d84f6e8903a5..5b732988d493 100644
--- a/drivers/net/3c503.c
+++ b/drivers/net/3c503.c
@@ -412,7 +412,7 @@ el2_open(struct net_device *dev)
                 outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR);
                 outb_p(0x00, E33G_IDCFR);
                 msleep(1);
-                free_irq(*irqp, el2_probe_interrupt);
+                free_irq(*irqp, &seen);
                 if (!seen)
                         continue;
 
@@ -422,6 +422,7 @@ el2_open(struct net_device *dev)
                         continue;
                 if (retval < 0)
                         goto err_disable;
+                break;
         } while (*++irqp);
 
         if (*irqp == 0) {
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 68d45ba2d9b9..6c019e148546 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -52,13 +52,13 @@ MODULE_DESCRIPTION(DRV_DESC);
 MODULE_ALIAS("platform:bfin_mac");
 
 #if defined(CONFIG_BFIN_MAC_USE_L1)
-# define bfin_mac_alloc(dma_handle, size)  l1_data_sram_zalloc(size)
-# define bfin_mac_free(dma_handle, ptr)    l1_data_sram_free(ptr)
+# define bfin_mac_alloc(dma_handle, size, num)  l1_data_sram_zalloc(size*num)
+# define bfin_mac_free(dma_handle, ptr, num)    l1_data_sram_free(ptr)
 #else
-# define bfin_mac_alloc(dma_handle, size) \
-        dma_alloc_coherent(NULL, size, dma_handle, GFP_KERNEL)
-# define bfin_mac_free(dma_handle, ptr) \
-        dma_free_coherent(NULL, sizeof(*ptr), ptr, dma_handle)
+# define bfin_mac_alloc(dma_handle, size, num) \
+        dma_alloc_coherent(NULL, size*num, dma_handle, GFP_KERNEL)
+# define bfin_mac_free(dma_handle, ptr, num) \
+        dma_free_coherent(NULL, sizeof(*ptr)*num, ptr, dma_handle)
 #endif
 
 #define PKT_BUF_SZ 1580
@@ -95,7 +95,7 @@ static void desc_list_free(void)
                                 t = t->next;
                         }
                 }
-                bfin_mac_free(dma_handle, tx_desc);
+                bfin_mac_free(dma_handle, tx_desc, CONFIG_BFIN_TX_DESC_NUM);
         }
 
         if (rx_desc) {
@@ -109,7 +109,7 @@ static void desc_list_free(void)
                                 r = r->next;
                         }
                 }
-                bfin_mac_free(dma_handle, rx_desc);
+                bfin_mac_free(dma_handle, rx_desc, CONFIG_BFIN_RX_DESC_NUM);
         }
 }
 
@@ -126,13 +126,13 @@ static int desc_list_init(void)
 #endif
 
         tx_desc = bfin_mac_alloc(&dma_handle,
-                                sizeof(struct net_dma_desc_tx) *
+                                sizeof(struct net_dma_desc_tx),
                                 CONFIG_BFIN_TX_DESC_NUM);
         if (tx_desc == NULL)
                 goto init_error;
 
         rx_desc = bfin_mac_alloc(&dma_handle,
-                                sizeof(struct net_dma_desc_rx) *
+                                sizeof(struct net_dma_desc_rx),
                                 CONFIG_BFIN_RX_DESC_NUM);
         if (rx_desc == NULL)
                 goto init_error;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 652b30e525d0..eafe44a528ac 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1297,6 +1297,7 @@ static inline int slave_enable_netpoll(struct slave *slave)
                 goto out;
 
         np->dev = slave->dev;
+        strlcpy(np->dev_name, slave->dev->name, IFNAMSIZ);
         err = __netpoll_setup(np);
         if (err) {
                 kfree(np);
diff --git a/drivers/net/fs_enet/mac-fcc.c b/drivers/net/fs_enet/mac-fcc.c
index 7a84e45487e8..7583a9572bcc 100644
--- a/drivers/net/fs_enet/mac-fcc.c
+++ b/drivers/net/fs_enet/mac-fcc.c
@@ -105,7 +105,7 @@ static int do_pd_setup(struct fs_enet_private *fep)
                 goto out_ep;
 
         fep->fcc.mem = (void __iomem *)cpm2_immr;
-        fpi->dpram_offset = cpm_dpalloc(128, 8);
+        fpi->dpram_offset = cpm_dpalloc(128, 32);
         if (IS_ERR_VALUE(fpi->dpram_offset)) {
                 ret = fpi->dpram_offset;
                 goto out_fcccp;
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index 8e10d2f6a5ad..c3ecb118c1df 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -1580,12 +1580,12 @@ static netdev_tx_t hp100_start_xmit_bm(struct sk_buff *skb,
         hp100_outl(ringptr->pdl_paddr, TX_PDA_L);       /* Low Prio. Queue */
 
         lp->txrcommit++;
-        spin_unlock_irqrestore(&lp->lock, flags);
 
-        /* Update statistics */
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
 
+        spin_unlock_irqrestore(&lp->lock, flags);
+
         return NETDEV_TX_OK;
 
 drop:
diff --git a/drivers/net/hplance.c b/drivers/net/hplance.c
index b6060f7538df..a900d5bf2948 100644
--- a/drivers/net/hplance.c
+++ b/drivers/net/hplance.c
@@ -135,7 +135,7 @@ static void __devexit hplance_remove_one(struct dio_dev *d)
 }
 
 /* Initialise a single lance board at the given DIO device */
-static void __init hplance_init(struct net_device *dev, struct dio_dev *d)
+static void __devinit hplance_init(struct net_device *dev, struct dio_dev *d)
 {
         unsigned long va = (d->resource.start + DIO_VIRADDRBASE);
         struct hplance_private *lp;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index b644383017f9..c0788a31ff0f 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1965,11 +1965,11 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         netxen_tso_check(netdev, tx_ring, first_desc, skb);
 
-        netxen_nic_update_cmd_producer(adapter, tx_ring);
-
         adapter->stats.txbytes += skb->len;
         adapter->stats.xmitcalled++;
 
+        netxen_nic_update_cmd_producer(adapter, tx_ring);
+
         return NETDEV_TX_OK;
 
 drop_packet:
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 392a6c4b72e5..a70244306c94 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -58,6 +58,7 @@ config BROADCOM_PHY
 
 config BCM63XX_PHY
         tristate "Drivers for Broadcom 63xx SOCs internal PHY"
+        depends on BCM63XX
         ---help---
           Currently supports the 6348 and 6358 PHYs.
 
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index b0c9522bb535..2cd8dc5847b4 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -543,11 +543,20 @@ static void recalibrate(struct dp83640_clock *clock)
 
 /* time stamping methods */
 
-static void decode_evnt(struct dp83640_private *dp83640,
-                        struct phy_txts *phy_txts, u16 ests)
+static int decode_evnt(struct dp83640_private *dp83640,
+                       void *data, u16 ests)
 {
+        struct phy_txts *phy_txts;
         struct ptp_clock_event event;
         int words = (ests >> EVNT_TS_LEN_SHIFT) & EVNT_TS_LEN_MASK;
+        u16 ext_status = 0;
+
+        if (ests & MULT_EVNT) {
+                ext_status = *(u16 *) data;
+                data += sizeof(ext_status);
+        }
+
+        phy_txts = data;
 
         switch (words) { /* fall through in every case */
         case 3:
@@ -565,6 +574,9 @@ static void decode_evnt(struct dp83640_private *dp83640,
         event.timestamp = phy2txts(&dp83640->edata);
 
         ptp_clock_event(dp83640->clock->ptp_clock, &event);
+
+        words = ext_status ? words + 2 : words + 1;
+        return words * sizeof(u16);
 }
 
 static void decode_rxts(struct dp83640_private *dp83640,
@@ -643,9 +655,7 @@ static void decode_status_frame(struct dp83640_private *dp83640,
 
                 } else if (PSF_EVNT == type && len >= sizeof(*phy_txts)) {
 
-                        phy_txts = (struct phy_txts *) ptr;
-                        decode_evnt(dp83640, phy_txts, ests);
-                        size = sizeof(*phy_txts);
+                        size = decode_evnt(dp83640, ptr, ests);
 
                 } else {
                         size = 0;
@@ -1034,8 +1044,8 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
 
         if (is_status_frame(skb, type)) {
                 decode_status_frame(dp83640, skb);
-                /* Let the stack drop this frame. */
-                return false;
+                kfree_skb(skb);
+                return true;
         }
 
         SKB_PTP_TYPE(skb) = type;
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index a1b82c9c67d2..c554a397e558 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -523,7 +523,7 @@ static void ppp_async_process(unsigned long arg)
 #define PUT_BYTE(ap, buf, c, islcp)     do {            \
         if ((islcp && c < 0x20) || (ap->xaccm[c >> 5] & (1 << (c & 0x1f)))) {\
                 *buf++ = PPP_ESCAPE;                    \
-                *buf++ = c ^ 0x20;                      \
+                *buf++ = c ^ PPP_TRANS;                 \
         } else                                          \
                 *buf++ = c;                             \
 } while (0)
@@ -896,7 +896,7 @@ ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
                                 sp = skb_put(skb, n);
                                 memcpy(sp, buf, n);
                                 if (ap->state & SC_ESCAPE) {
-                                        sp[0] ^= 0x20;
+                                        sp[0] ^= PPP_TRANS;
                                         ap->state &= ~SC_ESCAPE;
                                 }
                         }
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 89f7540d90f9..5f597ca592bb 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -1273,7 +1273,7 @@ static int pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         wmb();
         wrl(pep, SDMA_CMD, SDMA_CMD_TXDH | SDMA_CMD_ERD);
 
-        stats->tx_bytes += skb->len;
+        stats->tx_bytes += length;
         stats->tx_packets++;
         dev->trans_start = jiffies;
         if (pep->tx_ring_size - pep->tx_desc_count <= 1) {
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index ef1ce2ebeb4a..05d81780d1fd 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1621,7 +1621,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
          *
          * (RTL_R32(TxConfig) & 0x700000) == 0x200000 ? 8101Eb : 8101Ec
          */
-        static const struct {
+        static const struct rtl_mac_info {
                 u32 mask;
                 u32 val;
                 int mac_version;
@@ -1689,7 +1689,8 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
 
                 /* Catch-all */
                 { 0x00000000, 0x00000000,       RTL_GIGA_MAC_NONE   }
-        }, *p = mac_info;
+        };
+        const struct rtl_mac_info *p = mac_info;
         u32 reg;
 
         reg = RTL_R32(TxConfig);
@@ -3681,7 +3682,7 @@ static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
 
 static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
 {
-        static const struct {
+        static const struct rtl_cfg2_info {
                 u32 mac_version;
                 u32 clk;
                 u32 val;
@@ -3690,7 +3691,8 @@ static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
                 { RTL_GIGA_MAC_VER_05, PCI_Clock_66MHz, 0x000fffff },
                 { RTL_GIGA_MAC_VER_06, PCI_Clock_33MHz, 0x00ffff00 }, // 8110SCe
                 { RTL_GIGA_MAC_VER_06, PCI_Clock_66MHz, 0x00ffffff }
-        }, *p = cfg2_info;
+        };
+        const struct rtl_cfg2_info *p = cfg2_info;
         unsigned int i;
         u32 clk;
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 74e94054ab1a..5235f48be1be 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -460,7 +460,23 @@ static u32 tun_net_fix_features(struct net_device *dev, u32 features)
 
         return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
 }
-
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void tun_poll_controller(struct net_device *dev)
+{
+        /*
+         * Tun only receives frames when:
+         * 1) the char device endpoint gets data from user space
+         * 2) the tun socket gets a sendmsg call from user space
+         * Since both of those are syncronous operations, we are guaranteed
+         * never to have pending data when we poll for it
+         * so theres nothing to do here but return.
+         * We need this though so netpoll recognizes us as an interface that
+         * supports polling, which enables bridge devices in virt setups to
+         * still use netconsole
+         */
+        return;
+}
+#endif
 static const struct net_device_ops tun_netdev_ops = {
         .ndo_uninit             = tun_net_uninit,
         .ndo_open               = tun_net_open,
@@ -468,6 +484,9 @@ static const struct net_device_ops tun_netdev_ops = {
         .ndo_start_xmit         = tun_net_xmit,
         .ndo_change_mtu         = tun_net_change_mtu,
         .ndo_fix_features       = tun_net_fix_features,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = tun_poll_controller,
+#endif
 };
 
 static const struct net_device_ops tap_netdev_ops = {
@@ -480,6 +499,9 @@ static const struct net_device_ops tap_netdev_ops = {
         .ndo_set_multicast_list = tun_net_mclist,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = tun_poll_controller,
+#endif
 };
 
 /* Initialize net device. */
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 9d4f9117260f..84d4608153c9 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,6 +385,16 @@ config USB_NET_CX82310_ETH
           router with USB ethernet port. This driver is for routers only,
           it will not work with ADSL modems (use cxacru driver instead).
 
+config USB_NET_KALMIA
+        tristate "Samsung Kalmia based LTE USB modem"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Samsung Kalmia based USB modem
+          as Samsung GT-B3730.
+
+          To compile this driver as a module, choose M here: the
+          module will be called kalmia.
+
 config USB_HSO
         tristate "Option USB High Speed Mobile Devices"
         depends on USB && RFKILL
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index c7ec8a5f0a90..c203fa21f6b1 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_NET_KALMIA)    += kalmia.o
 obj-$(CONFIG_USB_IPHETH)        += ipheth.o
 obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 obj-$(CONFIG_USB_NET_CX82310_ETH)       += cx82310_eth.o
diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c
new file mode 100644
index 000000000000..d965fb1e013e
--- /dev/null
+++ b/drivers/net/usb/kalmia.c
@@ -0,0 +1,384 @@
+/*
+ * USB network interface driver for Samsung Kalmia based LTE USB modem like the
+ * Samsung GT-B3730 and GT-B3710.
+ *
+ * Copyright (C) 2011 Marius Bjoernstad Kotsbak <marius@kotsbak.com>
+ *
+ * Sponsored by Quicklink Video Distribution Services Ltd.
+ *
+ * Based on the cdc_eem module.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+#include <linux/gfp.h>
+
+/*
+ * The Samsung Kalmia based LTE USB modems have a CDC ACM port for modem control
+ * handled by the "option" module and an ethernet data port handled by this
+ * module.
+ *
+ * The stick must first be switched into modem mode by usb_modeswitch
+ * or similar tool. Then the modem gets sent two initialization packets by
+ * this module, which gives the MAC address of the device. User space can then
+ * connect the modem using AT commands through the ACM port and then use
+ * DHCP on the network interface exposed by this module. Network packets are
+ * sent to and from the modem in a proprietary format discovered after watching
+ * the behavior of the windows driver for the modem.
+ *
+ * More information about the use of the modem is available in usb_modeswitch
+ * forum and the project page:
+ *
+ * http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?t=465
+ * https://github.com/mkotsbak/Samsung-GT-B3730-linux-driver
+ */
+
+/* #define      DEBUG */
+/* #define      VERBOSE */
+
+#define KALMIA_HEADER_LENGTH 6
+#define KALMIA_ALIGN_SIZE 4
+#define KALMIA_USB_TIMEOUT 10000
+
+/*-------------------------------------------------------------------------*/
+
+static int
+kalmia_send_init_packet(struct usbnet *dev, u8 *init_msg, u8 init_msg_len,
+        u8 *buffer, u8 expected_len)
+{
+        int act_len;
+        int status;
+
+        netdev_dbg(dev->net, "Sending init packet");
+
+        status = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 0x02),
+                init_msg, init_msg_len, &act_len, KALMIA_USB_TIMEOUT);
+        if (status != 0) {
+                netdev_err(dev->net,
+                        "Error sending init packet. Status %i, length %i\n",
+                        status, act_len);
+                return status;
+        }
+        else if (act_len != init_msg_len) {
+                netdev_err(dev->net,
+                        "Did not send all of init packet. Bytes sent: %i",
+                        act_len);
+        }
+        else {
+                netdev_dbg(dev->net, "Successfully sent init packet.");
+        }
+
+        status = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, 0x81),
+                buffer, expected_len, &act_len, KALMIA_USB_TIMEOUT);
+
+        if (status != 0)
+                netdev_err(dev->net,
+                        "Error receiving init result. Status %i, length %i\n",
+                        status, act_len);
+        else if (act_len != expected_len)
+                netdev_err(dev->net, "Unexpected init result length: %i\n",
+                        act_len);
+
+        return status;
+}
+
+static int
+kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr)
+{
+        char init_msg_1[] =
+                { 0x57, 0x50, 0x04, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00,
+                0x00, 0x00 };
+        char init_msg_2[] =
+                { 0x57, 0x50, 0x04, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0xf4,
+                0x00, 0x00 };
+        char receive_buf[28];
+        int status;
+
+        status = kalmia_send_init_packet(dev, init_msg_1, sizeof(init_msg_1)
+                / sizeof(init_msg_1[0]), receive_buf, 24);
+        if (status != 0)
+                return status;
+
+        status = kalmia_send_init_packet(dev, init_msg_2, sizeof(init_msg_2)
+                / sizeof(init_msg_2[0]), receive_buf, 28);
+        if (status != 0)
+                return status;
+
+        memcpy(ethernet_addr, receive_buf + 10, ETH_ALEN);
+
+        return status;
+}
+
+static int
+kalmia_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8 status;
+        u8 ethernet_addr[ETH_ALEN];
+
+        /* Don't bind to AT command interface */
+        if (intf->cur_altsetting->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)
+                return -EINVAL;
+
+        dev->in = usb_rcvbulkpipe(dev->udev, 0x81 & USB_ENDPOINT_NUMBER_MASK);
+        dev->out = usb_sndbulkpipe(dev->udev, 0x02 & USB_ENDPOINT_NUMBER_MASK);
+        dev->status = NULL;
+
+        dev->net->hard_header_len += KALMIA_HEADER_LENGTH;
+        dev->hard_mtu = 1400;
+        dev->rx_urb_size = dev->hard_mtu * 10; // Found as optimal after testing
+
+        status = kalmia_init_and_get_ethernet_addr(dev, ethernet_addr);
+
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+
+        memcpy(dev->net->dev_addr, ethernet_addr, ETH_ALEN);
+        memcpy(dev->net->perm_addr, ethernet_addr, ETH_ALEN);
+
+        return status;
+}
+
+static struct sk_buff *
+kalmia_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+{
+        struct sk_buff *skb2 = NULL;
+        u16 content_len;
+        unsigned char *header_start;
+        unsigned char ether_type_1, ether_type_2;
+        u8 remainder, padlen = 0;
+
+        if (!skb_cloned(skb)) {
+                int headroom = skb_headroom(skb);
+                int tailroom = skb_tailroom(skb);
+
+                if ((tailroom >= KALMIA_ALIGN_SIZE) && (headroom
+                        >= KALMIA_HEADER_LENGTH))
+                        goto done;
+
+                if ((headroom + tailroom) > (KALMIA_HEADER_LENGTH
+                        + KALMIA_ALIGN_SIZE)) {
+                        skb->data = memmove(skb->head + KALMIA_HEADER_LENGTH,
+                                skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                        goto done;
+                }
+        }
+
+        skb2 = skb_copy_expand(skb, KALMIA_HEADER_LENGTH,
+                KALMIA_ALIGN_SIZE, flags);
+        if (!skb2)
+                return NULL;
+
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+
+        done: header_start = skb_push(skb, KALMIA_HEADER_LENGTH);
+        ether_type_1 = header_start[KALMIA_HEADER_LENGTH + 12];
+        ether_type_2 = header_start[KALMIA_HEADER_LENGTH + 13];
+
+        netdev_dbg(dev->net, "Sending etherType: %02x%02x", ether_type_1,
+                ether_type_2);
+
+        /* According to empiric data for data packages */
+        header_start[0] = 0x57;
+        header_start[1] = 0x44;
+        content_len = skb->len - KALMIA_HEADER_LENGTH;
+        header_start[2] = (content_len & 0xff); /* low byte */
+        header_start[3] = (content_len >> 8); /* high byte */
+
+        header_start[4] = ether_type_1;
+        header_start[5] = ether_type_2;
+
+        /* Align to 4 bytes by padding with zeros */
+        remainder = skb->len % KALMIA_ALIGN_SIZE;
+        if (remainder > 0) {
+                padlen = KALMIA_ALIGN_SIZE - remainder;
+                memset(skb_put(skb, padlen), 0, padlen);
+        }
+
+        netdev_dbg(
+                dev->net,
+                "Sending package with length %i and padding %i. Header: %02x:%02x:%02x:%02x:%02x:%02x.",
+                content_len, padlen, header_start[0], header_start[1],
+                header_start[2], header_start[3], header_start[4],
+                header_start[5]);
+
+        return skb;
+}
+
+static int
+kalmia_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.
+         */
+        const u8 HEADER_END_OF_USB_PACKET[] =
+                { 0x57, 0x5a, 0x00, 0x00, 0x08, 0x00 };
+        const u8 EXPECTED_UNKNOWN_HEADER_1[] =
+                { 0x57, 0x43, 0x1e, 0x00, 0x15, 0x02 };
+        const u8 EXPECTED_UNKNOWN_HEADER_2[] =
+                { 0x57, 0x50, 0x0e, 0x00, 0x00, 0x00 };
+        u8 i = 0;
+
+        /* incomplete header? */
+        if (skb->len < KALMIA_HEADER_LENGTH)
+                return 0;
+
+        do {
+                struct sk_buff *skb2 = NULL;
+                u8 *header_start;
+                u16 usb_packet_length, ether_packet_length;
+                int is_last;
+
+                header_start = skb->data;
+
+                if (unlikely(header_start[0] != 0x57 || header_start[1] != 0x44)) {
+                        if (!memcmp(header_start, EXPECTED_UNKNOWN_HEADER_1,
+                                sizeof(EXPECTED_UNKNOWN_HEADER_1)) || !memcmp(
+                                header_start, EXPECTED_UNKNOWN_HEADER_2,
+                                sizeof(EXPECTED_UNKNOWN_HEADER_2))) {
+                                netdev_dbg(
+                                        dev->net,
+                                        "Received expected unknown frame header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                        }
+                        else {
+                                netdev_err(
+                                        dev->net,
+                                        "Received unknown frame header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                                return 0;
+                        }
+                }
+                else
+                        netdev_dbg(
+                                dev->net,
+                                "Received header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                header_start[0], header_start[1], header_start[2],
+                                header_start[3], header_start[4], header_start[5],
+                                skb->len - KALMIA_HEADER_LENGTH);
+
+                /* subtract start header and end header */
+                usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH);
+                ether_packet_length = header_start[2] + (header_start[3] << 8);
+                skb_pull(skb, KALMIA_HEADER_LENGTH);
+
+                /* Some small packets misses end marker */
+                if (usb_packet_length < ether_packet_length) {
+                        ether_packet_length = usb_packet_length
+                                + KALMIA_HEADER_LENGTH;
+                        is_last = true;
+                }
+                else {
+                        netdev_dbg(dev->net, "Correct package length #%i", i
+                                + 1);
+
+                        is_last = (memcmp(skb->data + ether_packet_length,
+                                HEADER_END_OF_USB_PACKET,
+                                sizeof(HEADER_END_OF_USB_PACKET)) == 0);
+                        if (!is_last) {
+                                header_start = skb->data + ether_packet_length;
+                                netdev_dbg(
+                                        dev->net,
+                                        "End header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                        }
+                }
+
+                if (is_last) {
+                        skb2 = skb;
+                }
+                else {
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (unlikely(!skb2))
+                                return 0;
+                }
+
+                skb_trim(skb2, ether_packet_length);
+
+                if (is_last) {
+                        return 1;
+                }
+                else {
+                        usbnet_skb_return(dev, skb2);
+                        skb_pull(skb, ether_packet_length);
+                }
+
+                i++;
+        }
+        while (skb->len);
+
+        return 1;
+}
+
+static const struct driver_info kalmia_info = {
+        .description = "Samsung Kalmia LTE USB dongle",
+        .flags = FLAG_WWAN,
+        .bind = kalmia_bind,
+        .rx_fixup = kalmia_rx_fixup,
+        .tx_fixup = kalmia_tx_fixup
+};
+
+/*-------------------------------------------------------------------------*/
+
+static const struct usb_device_id products[] = {
+        /* The unswitched USB ID, to get the module auto loaded: */
+        { USB_DEVICE(0x04e8, 0x689a) },
+        /* The stick swithed into modem (by e.g. usb_modeswitch): */
+        { USB_DEVICE(0x04e8, 0x6889),
+                .driver_info = (unsigned long) &kalmia_info, },
+        { /* EMPTY == end of list */} };
+MODULE_DEVICE_TABLE( usb, products);
+
+static struct usb_driver kalmia_driver = {
+        .name = "kalmia",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume
+};
+
+static int __init kalmia_init(void)
+{
+        return usb_register(&kalmia_driver);
+}
+module_init( kalmia_init);
+
+static void __exit kalmia_exit(void)
+{
+        usb_deregister(&kalmia_driver);
+}
+module_exit( kalmia_exit);
+
+MODULE_AUTHOR("Marius Bjoernstad Kotsbak <marius@kotsbak.com>");
+MODULE_DESCRIPTION("Samsung Kalmia USB network driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index e050bd65e037..777d1a4e81b2 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2203,8 +2203,10 @@ fst_open(struct net_device *dev)
 
         if (port->mode != FST_RAW) {
                 err = hdlc_open(dev);
-                if (err)
+                if (err) {
+                        module_put(THIS_MODULE);
                         return err;
+                }
         }
 
         fst_openport(port);
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 660831ce293c..687c1f223497 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1288,6 +1288,8 @@ int mwifiex_register_cfg80211(struct net_device *dev, u8 *mac,
 
         *(unsigned long *) wdev_priv = (unsigned long) priv;
 
+        set_wiphy_dev(wdev->wiphy, (struct device *) priv->adapter->dev);
+
         ret = wiphy_register(wdev->wiphy);
         if (ret < 0) {
                 dev_err(priv->adapter->dev, "%s: registering cfg80211 device\n",
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 32261189bcef..aeac3cc4dbe4 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -2474,6 +2474,7 @@ struct mwl8k_cmd_set_hw_spec {
  * faster client.
  */
 #define MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY  0x00000400
+#define MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR        0x00000200
 #define MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT           0x00000080
 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP       0x00000020
 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON          0x00000010
@@ -2510,7 +2511,8 @@ static int mwl8k_cmd_set_hw_spec(struct ieee80211_hw *hw)
         cmd->flags = cpu_to_le32(MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT |
                                  MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP |
                                  MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON |
-                                 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY);
+                                 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY |
+                                 MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR);
         cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
         cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
 
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 135df164a4c1..46767c53917a 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -624,7 +624,7 @@ static int pci_pm_prepare(struct device *dev)
          * system from the sleep state, we'll have to prevent it from signaling
          * wake-up.
          */
-        pm_runtime_resume(dev);
+        pm_runtime_get_sync(dev);
 
         if (drv && drv->pm && drv->pm->prepare)
                 error = drv->pm->prepare(dev);
@@ -638,6 +638,8 @@ static void pci_pm_complete(struct device *dev)
 
         if (drv && drv->pm && drv->pm->complete)
                 drv->pm->complete(dev);
+
+        pm_runtime_put_sync(dev);
 }
 
 #else /* !CONFIG_PM_SLEEP */
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 5f10c23dff94..2c5b9b991279 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3284,7 +3284,7 @@ static int pci_set_vga_state_arch(struct pci_dev *dev, bool decode,
  * @dev: the PCI device
  * @decode: true = enable decoding, false = disable decoding
  * @command_bits: PCI_COMMAND_IO and/or PCI_COMMAND_MEMORY
- * @change_bridge_flags: traverse ancestors and change bridges
+ * @flags: traverse ancestors and change bridges
  * CHANGE_BRIDGE_ONLY / CHANGE_BRIDGE
  */
 int pci_set_vga_state(struct pci_dev *dev, bool decode,
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 48849ffdd672..bafb3c3d4a89 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -168,7 +168,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                 res->flags |= pci_calc_resource_flags(l) | IORESOURCE_SIZEALIGN;
                 if (type == pci_bar_io) {
                         l &= PCI_BASE_ADDRESS_IO_MASK;
-                        mask = PCI_BASE_ADDRESS_IO_MASK & IO_SPACE_LIMIT;
+                        mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT;
                 } else {
                         l &= PCI_BASE_ADDRESS_MEM_MASK;
                         mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
diff --git a/drivers/rtc/rtc-vt8500.c b/drivers/rtc/rtc-vt8500.c
index b8bc862903ae..efd6066b5cd2 100644
--- a/drivers/rtc/rtc-vt8500.c
+++ b/drivers/rtc/rtc-vt8500.c
@@ -78,7 +78,6 @@ struct vt8500_rtc {
         void __iomem            *regbase;
         struct resource         *res;
         int                     irq_alarm;
-        int                     irq_hz;
         struct rtc_device       *rtc;
         spinlock_t              lock;           /* Protects this structure */
 };
@@ -100,10 +99,6 @@ static irqreturn_t vt8500_rtc_irq(int irq, void *dev_id)
         if (isr & 1)
                 events |= RTC_AF | RTC_IRQF;
 
-        /* Only second/minute interrupts are supported */
-        if (isr & 2)
-                events |= RTC_UF | RTC_IRQF;
-
         rtc_update_irq(vt8500_rtc->rtc, 1, events);
 
         return IRQ_HANDLED;
@@ -199,27 +194,12 @@ static int vt8500_alarm_irq_enable(struct device *dev, unsigned int enabled)
         return 0;
 }
 
-static int vt8500_update_irq_enable(struct device *dev, unsigned int enabled)
-{
-        struct vt8500_rtc *vt8500_rtc = dev_get_drvdata(dev);
-        unsigned long tmp = readl(vt8500_rtc->regbase + VT8500_RTC_CR);
-
-        if (enabled)
-                tmp |= VT8500_RTC_CR_SM_SEC | VT8500_RTC_CR_SM_ENABLE;
-        else
-                tmp &= ~VT8500_RTC_CR_SM_ENABLE;
-
-        writel(tmp, vt8500_rtc->regbase + VT8500_RTC_CR);
-        return 0;
-}
-
 static const struct rtc_class_ops vt8500_rtc_ops = {
         .read_time = vt8500_rtc_read_time,
         .set_time = vt8500_rtc_set_time,
         .read_alarm = vt8500_rtc_read_alarm,
         .set_alarm = vt8500_rtc_set_alarm,
         .alarm_irq_enable = vt8500_alarm_irq_enable,
-        .update_irq_enable = vt8500_update_irq_enable,
 };
 
 static int __devinit vt8500_rtc_probe(struct platform_device *pdev)
@@ -248,13 +228,6 @@ static int __devinit vt8500_rtc_probe(struct platform_device *pdev)
                 goto err_free;
         }
 
-        vt8500_rtc->irq_hz = platform_get_irq(pdev, 1);
-        if (vt8500_rtc->irq_hz < 0) {
-                dev_err(&pdev->dev, "No 1Hz IRQ resource defined\n");
-                ret = -ENXIO;
-                goto err_free;
-        }
-
         vt8500_rtc->res = request_mem_region(vt8500_rtc->res->start,
                                              resource_size(vt8500_rtc->res),
                                              "vt8500-rtc");
@@ -272,9 +245,8 @@ static int __devinit vt8500_rtc_probe(struct platform_device *pdev)
                 goto err_release;
         }
 
-        /* Enable the second/minute interrupt generation and enable RTC */
-        writel(VT8500_RTC_CR_ENABLE | VT8500_RTC_CR_24H
-                | VT8500_RTC_CR_SM_ENABLE | VT8500_RTC_CR_SM_SEC,
+        /* Enable RTC and set it to 24-hour mode */
+        writel(VT8500_RTC_CR_ENABLE | VT8500_RTC_CR_24H,
                vt8500_rtc->regbase + VT8500_RTC_CR);
 
         vt8500_rtc->rtc = rtc_device_register("vt8500-rtc", &pdev->dev,
@@ -286,26 +258,16 @@ static int __devinit vt8500_rtc_probe(struct platform_device *pdev)
                 goto err_unmap;
         }
 
-        ret = request_irq(vt8500_rtc->irq_hz, vt8500_rtc_irq, 0,
-                          "rtc 1Hz", vt8500_rtc);
-        if (ret < 0) {
-                dev_err(&pdev->dev, "can't get irq %i, err %d\n",
-                        vt8500_rtc->irq_hz, ret);
-                goto err_unreg;
-        }
-
         ret = request_irq(vt8500_rtc->irq_alarm, vt8500_rtc_irq, 0,
                           "rtc alarm", vt8500_rtc);
         if (ret < 0) {
                 dev_err(&pdev->dev, "can't get irq %i, err %d\n",
                         vt8500_rtc->irq_alarm, ret);
-                goto err_free_hz;
+                goto err_unreg;
         }
 
         return 0;
 
-err_free_hz:
-        free_irq(vt8500_rtc->irq_hz, vt8500_rtc);
 err_unreg:
         rtc_device_unregister(vt8500_rtc->rtc);
 err_unmap:
@@ -323,7 +285,6 @@ static int __devexit vt8500_rtc_remove(struct platform_device *pdev)
         struct vt8500_rtc *vt8500_rtc = platform_get_drvdata(pdev);
 
         free_irq(vt8500_rtc->irq_alarm, vt8500_rtc);
-        free_irq(vt8500_rtc->irq_hz, vt8500_rtc);
 
         rtc_device_unregister(vt8500_rtc->rtc);
 
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index dee2a2c909f5..70c2e7fa6664 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -386,7 +386,7 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
          */
         se_cmd->se_tmr_req = core_tmr_alloc_req(se_cmd, (void *)tl_tmr,
                                 TMR_LUN_RESET);
-        if (!se_cmd->se_tmr_req)
+        if (IS_ERR(se_cmd->se_tmr_req))
                 goto release;
         /*
          * Locate the underlying TCM struct se_lun from sc->device->lun
@@ -1017,6 +1017,7 @@ static int tcm_loop_make_nexus(
         struct se_portal_group *se_tpg;
         struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;
         struct tcm_loop_nexus *tl_nexus;
+        int ret = -ENOMEM;
 
         if (tl_tpg->tl_hba->tl_nexus) {
                 printk(KERN_INFO "tl_tpg->tl_hba->tl_nexus already exists\n");
@@ -1033,8 +1034,10 @@ static int tcm_loop_make_nexus(
          * Initialize the struct se_session pointer
          */
         tl_nexus->se_sess = transport_init_session();
-        if (!tl_nexus->se_sess)
+        if (IS_ERR(tl_nexus->se_sess)) {
+                ret = PTR_ERR(tl_nexus->se_sess);
                 goto out;
+        }
         /*
          * Since we are running in 'demo mode' this call with generate a
          * struct se_node_acl for the tcm_loop struct se_portal_group with the SCSI
@@ -1060,7 +1063,7 @@ static int tcm_loop_make_nexus(
 
 out:
         kfree(tl_nexus);
-        return -ENOMEM;
+        return ret;
 }
 
 static int tcm_loop_drop_nexus(
@@ -1140,7 +1143,7 @@ static ssize_t tcm_loop_tpg_store_nexus(
          * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call
          * tcm_loop_make_nexus()
          */
-        if (strlen(page) > TL_WWN_ADDR_LEN) {
+        if (strlen(page) >= TL_WWN_ADDR_LEN) {
                 printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds"
                                 " max: %d\n", page, TL_WWN_ADDR_LEN);
                 return -EINVAL;
@@ -1321,7 +1324,7 @@ struct se_wwn *tcm_loop_make_scsi_hba(
         return ERR_PTR(-EINVAL);
 
 check_len:
-        if (strlen(name) > TL_WWN_ADDR_LEN) {
+        if (strlen(name) >= TL_WWN_ADDR_LEN) {
                 printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds"
                         " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba),
                         TL_WWN_ADDR_LEN);
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index ee6fad979b50..25c1f49a7d8b 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -304,7 +304,7 @@ struct target_fabric_configfs *target_fabric_configfs_init(
                 printk(KERN_ERR "Unable to locate passed fabric name\n");
                 return NULL;
         }
-        if (strlen(name) > TARGET_FABRIC_NAME_SIZE) {
+        if (strlen(name) >= TARGET_FABRIC_NAME_SIZE) {
                 printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC"
                         "_NAME_SIZE\n", name);
                 return NULL;
@@ -312,7 +312,7 @@ struct target_fabric_configfs *target_fabric_configfs_init(
 
         tf = kzalloc(sizeof(struct target_fabric_configfs), GFP_KERNEL);
         if (!(tf))
-                return ERR_PTR(-ENOMEM);
+                return NULL;
 
         INIT_LIST_HEAD(&tf->tf_list);
         atomic_set(&tf->tf_access_cnt, 0);
@@ -851,7 +851,7 @@ static ssize_t target_core_dev_wwn_store_attr_vpd_unit_serial(
                 return -EOPNOTSUPP;
         }
 
-        if ((strlen(page) + 1) > INQUIRY_VPD_SERIAL_LEN) {
+        if (strlen(page) >= INQUIRY_VPD_SERIAL_LEN) {
                 printk(KERN_ERR "Emulated VPD Unit Serial exceeds"
                 " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN);
                 return -EOVERFLOW;
@@ -917,7 +917,7 @@ static ssize_t target_core_dev_wwn_show_attr_vpd_protocol_identifier(
 
                 transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE);
 
-                if ((len + strlen(buf) > PAGE_SIZE))
+                if ((len + strlen(buf) >= PAGE_SIZE))
                         break;
 
                 len += sprintf(page+len, "%s", buf);
@@ -962,19 +962,19 @@ static ssize_t target_core_dev_wwn_show_attr_##_name(			\
                                                                         \
                 memset(buf, 0, VPD_TMP_BUF_SIZE);                       \
                 transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE);   \
-                if ((len + strlen(buf) > PAGE_SIZE))                    \
+                if ((len + strlen(buf) >= PAGE_SIZE))                   \
                         break;                                          \
                 len += sprintf(page+len, "%s", buf);                    \
                                                                         \
                 memset(buf, 0, VPD_TMP_BUF_SIZE);                       \
                 transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \
-                if ((len + strlen(buf) > PAGE_SIZE))                    \
+                if ((len + strlen(buf) >= PAGE_SIZE))                   \
                         break;                                          \
                 len += sprintf(page+len, "%s", buf);                    \
                                                                         \
                 memset(buf, 0, VPD_TMP_BUF_SIZE);                       \
                 transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \
-                if ((len + strlen(buf) > PAGE_SIZE))                    \
+                if ((len + strlen(buf) >= PAGE_SIZE))                   \
                         break;                                          \
                 len += sprintf(page+len, "%s", buf);                    \
         }                                                               \
@@ -1299,7 +1299,7 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts(
                         &i_buf[0] : "", pr_reg->pr_res_key,
                         pr_reg->pr_res_generation);
 
-                if ((len + strlen(buf) > PAGE_SIZE))
+                if ((len + strlen(buf) >= PAGE_SIZE))
                         break;
 
                 len += sprintf(page+len, "%s", buf);
@@ -1496,7 +1496,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                                 ret = -ENOMEM;
                                 goto out;
                         }
-                        if (strlen(i_port) > PR_APTPL_MAX_IPORT_LEN) {
+                        if (strlen(i_port) >= PR_APTPL_MAX_IPORT_LEN) {
                                 printk(KERN_ERR "APTPL metadata initiator_node="
                                         " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n",
                                         PR_APTPL_MAX_IPORT_LEN);
@@ -1510,7 +1510,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                                 ret = -ENOMEM;
                                 goto out;
                         }
-                        if (strlen(isid) > PR_REG_ISID_LEN) {
+                        if (strlen(isid) >= PR_REG_ISID_LEN) {
                                 printk(KERN_ERR "APTPL metadata initiator_isid"
                                         "= exceeds PR_REG_ISID_LEN: %d\n",
                                         PR_REG_ISID_LEN);
@@ -1571,7 +1571,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                                 ret = -ENOMEM;
                                 goto out;
                         }
-                        if (strlen(t_port) > PR_APTPL_MAX_TPORT_LEN) {
+                        if (strlen(t_port) >= PR_APTPL_MAX_TPORT_LEN) {
                                 printk(KERN_ERR "APTPL metadata target_node="
                                         " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n",
                                         PR_APTPL_MAX_TPORT_LEN);
@@ -3052,7 +3052,7 @@ static struct config_group *target_core_call_addhbatotarget(
         int ret;
 
         memset(buf, 0, TARGET_CORE_NAME_MAX_LEN);
-        if (strlen(name) > TARGET_CORE_NAME_MAX_LEN) {
+        if (strlen(name) >= TARGET_CORE_NAME_MAX_LEN) {
                 printk(KERN_ERR "Passed *name strlen(): %d exceeds"
                         " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name),
                         TARGET_CORE_NAME_MAX_LEN);
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 8407f9ca2b31..ba698ea62bb2 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -192,7 +192,7 @@ int transport_get_lun_for_tmr(
                         &SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
         if (deve->lun_flags & TRANSPORT_LUNFLAGS_INITIATOR_ACCESS) {
                 se_lun = se_cmd->se_lun = se_tmr->tmr_lun = deve->se_lun;
-                dev = se_tmr->tmr_dev = se_lun->lun_se_dev;
+                dev = se_lun->lun_se_dev;
                 se_cmd->pr_res_key = deve->pr_res_key;
                 se_cmd->orig_fe_lun = unpacked_lun;
                 se_cmd->se_orig_obj_ptr = SE_LUN(se_cmd)->lun_se_dev;
@@ -216,6 +216,7 @@ int transport_get_lun_for_tmr(
                 se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                 return -1;
         }
+        se_tmr->tmr_dev = dev;
 
         spin_lock(&dev->se_tmr_lock);
         list_add_tail(&se_tmr->tmr_list, &dev->dev_tmr_list);
@@ -1430,7 +1431,7 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
         struct se_lun_acl *lacl;
         struct se_node_acl *nacl;
 
-        if (strlen(initiatorname) > TRANSPORT_IQN_LEN) {
+        if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) {
                 printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n",
                         TPG_TFO(tpg)->get_fabric_name());
                 *ret = -EOVERFLOW;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index a79f518ca6e2..b662db3a320b 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1916,7 +1916,7 @@ static int __core_scsi3_update_aptpl_buf(
                                 pr_reg->pr_res_mapped_lun);
                 }
 
-                if ((len + strlen(tmp) > pr_aptpl_buf_len)) {
+                if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
                         printk(KERN_ERR "Unable to update renaming"
                                 " APTPL metadata\n");
                         spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1934,7 +1934,7 @@ static int __core_scsi3_update_aptpl_buf(
                         TPG_TFO(tpg)->tpg_get_tag(tpg),
                         lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count);
 
-                if ((len + strlen(tmp) > pr_aptpl_buf_len)) {
+                if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
                         printk(KERN_ERR "Unable to update renaming"
                                 " APTPL metadata\n");
                         spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1986,7 +1986,7 @@ static int __core_scsi3_write_aptpl_to_file(
         memset(iov, 0, sizeof(struct iovec));
         memset(path, 0, 512);
 
-        if (strlen(&wwn->unit_serial[0]) > 512) {
+        if (strlen(&wwn->unit_serial[0]) >= 512) {
                 printk(KERN_ERR "WWN value for struct se_device does not fit"
                         " into path buffer\n");
                 return -1;
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 59b8b9c5ad72..179063d81cdd 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -75,10 +75,16 @@ void core_tmr_release_req(
 {
         struct se_device *dev = tmr->tmr_dev;
 
+        if (!dev) {
+                kmem_cache_free(se_tmr_req_cache, tmr);
+                return;
+        }
+
         spin_lock(&dev->se_tmr_lock);
         list_del(&tmr->tmr_list);
-        kmem_cache_free(se_tmr_req_cache, tmr);
         spin_unlock(&dev->se_tmr_lock);
+
+        kmem_cache_free(se_tmr_req_cache, tmr);
 }
 
 static void core_tmr_handle_tas_abort(
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 4dafeb8b5638..4b9b7169bdd9 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -536,13 +536,13 @@ EXPORT_SYMBOL(transport_register_session);
 void transport_deregister_session_configfs(struct se_session *se_sess)
 {
         struct se_node_acl *se_nacl;
-
+        unsigned long flags;
         /*
          * Used by struct se_node_acl's under ConfigFS to locate active struct se_session
          */
         se_nacl = se_sess->se_node_acl;
         if ((se_nacl)) {
-                spin_lock_irq(&se_nacl->nacl_sess_lock);
+                spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
                 list_del(&se_sess->sess_acl_list);
                 /*
                  * If the session list is empty, then clear the pointer.
@@ -556,7 +556,7 @@ void transport_deregister_session_configfs(struct se_session *se_sess)
                                         se_nacl->acl_sess_list.prev,
                                         struct se_session, sess_acl_list);
                 }
-                spin_unlock_irq(&se_nacl->nacl_sess_lock);
+                spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
         }
 }
 EXPORT_SYMBOL(transport_deregister_session_configfs);
diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index defff32b7880..7b82f1b7fef8 100644
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -144,7 +144,7 @@ enum ft_cmd_state {
  */
 struct ft_cmd {
         enum ft_cmd_state state;
-        u16 lun;                        /* LUN from request */
+        u32 lun;                        /* LUN from request */
         struct ft_sess *sess;           /* session held for cmd */
         struct fc_seq *seq;             /* sequence in exchange mgr */
         struct se_cmd se_cmd;           /* Local TCM I/O descriptor */
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index c056a1132ae1..b2a106729d49 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -94,29 +94,6 @@ void ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
                 16, 4, cmd->cdb, MAX_COMMAND_SIZE, 0);
 }
 
-/*
- * Get LUN from CDB.
- */
-static int ft_get_lun_for_cmd(struct ft_cmd *cmd, u8 *lunp)
-{
-        u64 lun;
-
-        lun = lunp[1];
-        switch (lunp[0] >> 6) {
-        case 0:
-                break;
-        case 1:
-                lun |= (lunp[0] & 0x3f) << 8;
-                break;
-        default:
-                return -1;
-        }
-        if (lun >= TRANSPORT_MAX_LUNS_PER_TPG)
-                return -1;
-        cmd->lun = lun;
-        return transport_get_lun_for_cmd(&cmd->se_cmd, NULL, lun);
-}
-
 static void ft_queue_cmd(struct ft_sess *sess, struct ft_cmd *cmd)
 {
         struct se_queue_obj *qobj;
@@ -418,6 +395,7 @@ static void ft_send_tm(struct ft_cmd *cmd)
 {
         struct se_tmr_req *tmr;
         struct fcp_cmnd *fcp;
+        struct ft_sess *sess;
         u8 tm_func;
 
         fcp = fc_frame_payload_get(cmd->req_frame, sizeof(*fcp));
@@ -425,13 +403,6 @@ static void ft_send_tm(struct ft_cmd *cmd)
         switch (fcp->fc_tm_flags) {
         case FCP_TMF_LUN_RESET:
                 tm_func = TMR_LUN_RESET;
-                if (ft_get_lun_for_cmd(cmd, fcp->fc_lun) < 0) {
-                        ft_dump_cmd(cmd, __func__);
-                        transport_send_check_condition_and_sense(&cmd->se_cmd,
-                                cmd->se_cmd.scsi_sense_reason, 0);
-                        ft_sess_put(cmd->sess);
-                        return;
-                }
                 break;
         case FCP_TMF_TGT_RESET:
                 tm_func = TMR_TARGET_WARM_RESET;
@@ -463,6 +434,36 @@ static void ft_send_tm(struct ft_cmd *cmd)
                 return;
         }
         cmd->se_cmd.se_tmr_req = tmr;
+
+        switch (fcp->fc_tm_flags) {
+        case FCP_TMF_LUN_RESET:
+                cmd->lun = scsilun_to_int((struct scsi_lun *)fcp->fc_lun);
+                if (transport_get_lun_for_tmr(&cmd->se_cmd, cmd->lun) < 0) {
+                        /*
+                         * Make sure to clean up newly allocated TMR request
+                         * since "unable to  handle TMR request because failed
+                         * to get to LUN"
+                         */
+                        FT_TM_DBG("Failed to get LUN for TMR func %d, "
+                                  "se_cmd %p, unpacked_lun %d\n",
+                                  tm_func, &cmd->se_cmd, cmd->lun);
+                        ft_dump_cmd(cmd, __func__);
+                        sess = cmd->sess;
+                        transport_send_check_condition_and_sense(&cmd->se_cmd,
+                                cmd->se_cmd.scsi_sense_reason, 0);
+                        transport_generic_free_cmd(&cmd->se_cmd, 0, 1, 0);
+                        ft_sess_put(sess);
+                        return;
+                }
+                break;
+        case FCP_TMF_TGT_RESET:
+        case FCP_TMF_CLR_TASK_SET:
+        case FCP_TMF_ABT_TASK_SET:
+        case FCP_TMF_CLR_ACA:
+                break;
+        default:
+                return;
+        }
         transport_generic_handle_tmr(&cmd->se_cmd);
 }
 
@@ -635,7 +636,8 @@ static void ft_send_cmd(struct ft_cmd *cmd)
 
         fc_seq_exch(cmd->seq)->lp->tt.seq_set_resp(cmd->seq, ft_recv_seq, cmd);
 
-        ret = ft_get_lun_for_cmd(cmd, fcp->fc_lun);
+        cmd->lun = scsilun_to_int((struct scsi_lun *)fcp->fc_lun);
+        ret = transport_get_lun_for_cmd(&cmd->se_cmd, NULL, cmd->lun);
         if (ret < 0) {
                 ft_dump_cmd(cmd, __func__);
                 transport_send_check_condition_and_sense(&cmd->se_cmd,
diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index 4c3c0efbe13f..8c4a24077d9d 100644
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -203,7 +203,7 @@ int ft_queue_data_in(struct se_cmd *se_cmd)
                         /* XXX For now, initiator will retry */
                         if (printk_ratelimit())
                                 printk(KERN_ERR "%s: Failed to send frame %p, "
-                                                "xid <0x%x>, remaining <0x%x>, "
+                                                "xid <0x%x>, remaining %zu, "
                                                 "lso_max <0x%x>\n",
                                                 __func__, fp, ep->xid,
                                                 remaining, lport->lso_max);
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index a3bd57f2ea32..7491e21cc6ae 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -229,7 +229,7 @@ static struct ft_sess *ft_sess_create(struct ft_tport *tport, u32 port_id,
                 return NULL;
 
         sess->se_sess = transport_init_session();
-        if (!sess->se_sess) {
+        if (IS_ERR(sess->se_sess)) {
                 kfree(sess);
                 return NULL;
         }
@@ -332,7 +332,7 @@ void ft_sess_close(struct se_session *se_sess)
         lport = sess->tport->lport;
         port_id = sess->port_id;
         if (port_id == -1) {
-                mutex_lock(&ft_lport_lock);
+                mutex_unlock(&ft_lport_lock);
                 return;
         }
         FT_SESS_DBG("port_id %x\n", port_id);
diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
index 1bd28450ca40..a764bf99743b 100644
--- a/drivers/tty/serial/mrst_max3110.c
+++ b/drivers/tty/serial/mrst_max3110.c
@@ -421,7 +421,6 @@ static int max3110_main_thread(void *_max)
         int ret = 0;
         struct circ_buf *xmit = &max->con_xmit;
 
-        init_waitqueue_head(wq);
         pr_info(PR_FMT "start main thread\n");
 
         do {
@@ -823,7 +822,7 @@ static int __devinit serial_m3110_probe(struct spi_device *spi)
         res = RC_TAG;
         ret = max3110_write_then_read(max, (u8 *)&res, (u8 *)&res, 2, 0);
         if (ret < 0 || res == 0 || res == 0xffff) {
-                printk(KERN_ERR "MAX3111 deemed not present (conf reg %04x)",
+                dev_dbg(&spi->dev, "MAX3111 deemed not present (conf reg %04x)",
                                                                         res);
                 ret = -ENODEV;
                 goto err_get_page;
@@ -838,6 +837,8 @@ static int __devinit serial_m3110_probe(struct spi_device *spi)
         max->con_xmit.head = 0;
         max->con_xmit.tail = 0;
 
+        init_waitqueue_head(&max->wq);
+
         max->main_thread = kthread_run(max3110_main_thread,
                                         max, "max3110_main");
         if (IS_ERR(max->main_thread)) {
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index e35a17687c05..aa3cc465a601 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -375,7 +375,7 @@ static int usb_unbind_interface(struct device *dev)
                  * Just re-enable it without affecting the endpoint toggles.
                  */
                 usb_enable_interface(udev, intf, false);
-        } else if (!error && !intf->dev.power.in_suspend) {
+        } else if (!error && !intf->dev.power.is_prepared) {
                 r = usb_set_interface(udev, intf->altsetting[0].
                                 desc.bInterfaceNumber, 0);
                 if (r < 0)
@@ -960,7 +960,7 @@ void usb_rebind_intf(struct usb_interface *intf)
         }
 
         /* Try to rebind the interface */
-        if (!intf->dev.power.in_suspend) {
+        if (!intf->dev.power.is_prepared) {
                 intf->needs_binding = 0;
                 rc = device_attach(&intf->dev);
                 if (rc < 0)
@@ -1107,7 +1107,7 @@ static int usb_resume_interface(struct usb_device *udev,
         if (intf->condition == USB_INTERFACE_UNBOUND) {
 
                 /* Carry out a deferred switch to altsetting 0 */
-                if (intf->needs_altsetting0 && !intf->dev.power.in_suspend) {
+                if (intf->needs_altsetting0 && !intf->dev.power.is_prepared) {
                         usb_set_interface(udev, intf->altsetting[0].
                                         desc.bInterfaceNumber, 0);
                         intf->needs_altsetting0 = 0;
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 553da68bd510..30df85d8fca8 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -395,9 +395,9 @@ static void unmask_evtchn(int port)
 static void xen_irq_init(unsigned irq)
 {
         struct irq_info *info;
+#ifdef CONFIG_SMP
         struct irq_desc *desc = irq_to_desc(irq);
 
-#ifdef CONFIG_SMP
         /* By default all event channels notify CPU#0. */
         cpumask_copy(desc->irq_data.affinity, cpumask_of(0));
 #endif
diff --git a/fs/bad_inode.c b/fs/bad_inode.c
index 9ad2369d9e35..bfcb18feb1df 100644
--- a/fs/bad_inode.c
+++ b/fs/bad_inode.c
@@ -231,9 +231,6 @@ static int bad_inode_readlink(struct dentry *dentry, char __user *buffer,
 
 static int bad_inode_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-
         return -EIO;
 }
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 1a2421f908f0..610e8e0b04b8 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -762,7 +762,19 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
         if (!disk)
                 return ERR_PTR(-ENXIO);
 
-        whole = bdget_disk(disk, 0);
+        /*
+         * Normally, @bdev should equal what's returned from bdget_disk()
+         * if partno is 0; however, some drivers (floppy) use multiple
+         * bdev's for the same physical device and @bdev may be one of the
+         * aliases.  Keep @bdev if partno is 0.  This means claimer
+         * tracking is broken for those devices but it has always been that
+         * way.
+         */
+        if (partno)
+                whole = bdget_disk(disk, 0);
+        else
+                whole = bdgrab(bdev);
+
         module_put(disk->fops->owner);
         put_disk(disk);
         if (!whole)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 378b5b4443f3..f30ac05dbda7 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -19,7 +19,6 @@
 #ifndef __BTRFS_CTREE__
 #define __BTRFS_CTREE__
 
-#include <linux/version.h>
 #include <linux/mm.h>
 #include <linux/highmem.h>
 #include <linux/fs.h>
@@ -967,6 +966,12 @@ struct btrfs_fs_info {
         struct srcu_struct subvol_srcu;
 
         spinlock_t trans_lock;
+        /*
+         * the reloc mutex goes with the trans lock, it is taken
+         * during commit to protect us from the relocation code
+         */
+        struct mutex reloc_mutex;
+
         struct list_head trans_list;
         struct list_head hashers;
         struct list_head dead_roots;
@@ -1172,6 +1177,14 @@ struct btrfs_root {
         u32 type;
 
         u64 highest_objectid;
+
+        /* btrfs_record_root_in_trans is a multi-step process,
+         * and it can race with the balancing code.   But the
+         * race is very small, and only the first time the root
+         * is added to each transaction.  So in_trans_setup
+         * is used to tell us when more checks are required
+         */
+        unsigned long in_trans_setup;
         int ref_cows;
         int track_dirty;
         int in_radix;
@@ -1181,7 +1194,6 @@ struct btrfs_root {
         struct btrfs_key defrag_max;
         int defrag_running;
         char *name;
-        int in_sysfs;
 
         /* the dirty list is only used by non-reference counted roots */
         struct list_head dirty_list;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 6462c29d2d37..98c68e658a9b 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -82,19 +82,16 @@ static inline struct btrfs_delayed_root *btrfs_get_delayed_root(
         return root->fs_info->delayed_root;
 }
 
-static struct btrfs_delayed_node *btrfs_get_or_create_delayed_node(
-                                                        struct inode *inode)
+static struct btrfs_delayed_node *btrfs_get_delayed_node(struct inode *inode)
 {
-        struct btrfs_delayed_node *node;
         struct btrfs_inode *btrfs_inode = BTRFS_I(inode);
         struct btrfs_root *root = btrfs_inode->root;
         u64 ino = btrfs_ino(inode);
-        int ret;
+        struct btrfs_delayed_node *node;
 
-again:
         node = ACCESS_ONCE(btrfs_inode->delayed_node);
         if (node) {
-                atomic_inc(&node->refs);        /* can be accessed */
+                atomic_inc(&node->refs);
                 return node;
         }
 
@@ -102,8 +99,10 @@ again:
         node = radix_tree_lookup(&root->delayed_nodes_tree, ino);
         if (node) {
                 if (btrfs_inode->delayed_node) {
+                        atomic_inc(&node->refs);        /* can be accessed */
+                        BUG_ON(btrfs_inode->delayed_node != node);
                         spin_unlock(&root->inode_lock);
-                        goto again;
+                        return node;
                 }
                 btrfs_inode->delayed_node = node;
                 atomic_inc(&node->refs);        /* can be accessed */
@@ -113,6 +112,23 @@ again:
         }
         spin_unlock(&root->inode_lock);
 
+        return NULL;
+}
+
+static struct btrfs_delayed_node *btrfs_get_or_create_delayed_node(
+                                                        struct inode *inode)
+{
+        struct btrfs_delayed_node *node;
+        struct btrfs_inode *btrfs_inode = BTRFS_I(inode);
+        struct btrfs_root *root = btrfs_inode->root;
+        u64 ino = btrfs_ino(inode);
+        int ret;
+
+again:
+        node = btrfs_get_delayed_node(inode);
+        if (node)
+                return node;
+
         node = kmem_cache_alloc(delayed_node_cache, GFP_NOFS);
         if (!node)
                 return ERR_PTR(-ENOMEM);
@@ -297,7 +313,6 @@ struct btrfs_delayed_item *btrfs_alloc_delayed_item(u32 data_len)
                 item->data_len = data_len;
                 item->ins_or_del = 0;
                 item->bytes_reserved = 0;
-                item->block_rsv = NULL;
                 item->delayed_node = NULL;
                 atomic_set(&item->refs, 1);
         }
@@ -549,19 +564,6 @@ struct btrfs_delayed_item *__btrfs_next_delayed_item(
         return next;
 }
 
-static inline struct btrfs_delayed_node *btrfs_get_delayed_node(
-                                                        struct inode *inode)
-{
-        struct btrfs_inode *btrfs_inode = BTRFS_I(inode);
-        struct btrfs_delayed_node *delayed_node;
-
-        delayed_node = btrfs_inode->delayed_node;
-        if (delayed_node)
-                atomic_inc(&delayed_node->refs);
-
-        return delayed_node;
-}
-
 static inline struct btrfs_root *btrfs_get_fs_root(struct btrfs_root *root,
                                                    u64 root_id)
 {
@@ -593,10 +595,8 @@ static int btrfs_delayed_item_reserve_metadata(struct btrfs_trans_handle *trans,
 
         num_bytes = btrfs_calc_trans_metadata_size(root, 1);
         ret = btrfs_block_rsv_migrate(src_rsv, dst_rsv, num_bytes);
-        if (!ret) {
+        if (!ret)
                 item->bytes_reserved = num_bytes;
-                item->block_rsv = dst_rsv;
-        }
 
         return ret;
 }
@@ -604,10 +604,13 @@ static int btrfs_delayed_item_reserve_metadata(struct btrfs_trans_handle *trans,
 static void btrfs_delayed_item_release_metadata(struct btrfs_root *root,
                                                 struct btrfs_delayed_item *item)
 {
+        struct btrfs_block_rsv *rsv;
+
         if (!item->bytes_reserved)
                 return;
 
-        btrfs_block_rsv_release(root, item->block_rsv,
+        rsv = &root->fs_info->global_block_rsv;
+        btrfs_block_rsv_release(root, rsv,
                                 item->bytes_reserved);
 }
 
@@ -1014,6 +1017,7 @@ int btrfs_run_delayed_items(struct btrfs_trans_handle *trans,
         struct btrfs_delayed_root *delayed_root;
         struct btrfs_delayed_node *curr_node, *prev_node;
         struct btrfs_path *path;
+        struct btrfs_block_rsv *block_rsv;
         int ret = 0;
 
         path = btrfs_alloc_path();
@@ -1021,6 +1025,9 @@ int btrfs_run_delayed_items(struct btrfs_trans_handle *trans,
                 return -ENOMEM;
         path->leave_spinning = 1;
 
+        block_rsv = trans->block_rsv;
+        trans->block_rsv = &root->fs_info->global_block_rsv;
+
         delayed_root = btrfs_get_delayed_root(root);
 
         curr_node = btrfs_first_delayed_node(delayed_root);
@@ -1045,6 +1052,7 @@ int btrfs_run_delayed_items(struct btrfs_trans_handle *trans,
         }
 
         btrfs_free_path(path);
+        trans->block_rsv = block_rsv;
         return ret;
 }
 
@@ -1052,6 +1060,7 @@ static int __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,
                                               struct btrfs_delayed_node *node)
 {
         struct btrfs_path *path;
+        struct btrfs_block_rsv *block_rsv;
         int ret;
 
         path = btrfs_alloc_path();
@@ -1059,6 +1068,9 @@ static int __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,
                 return -ENOMEM;
         path->leave_spinning = 1;
 
+        block_rsv = trans->block_rsv;
+        trans->block_rsv = &node->root->fs_info->global_block_rsv;
+
         ret = btrfs_insert_delayed_items(trans, path, node->root, node);
         if (!ret)
                 ret = btrfs_delete_delayed_items(trans, path, node->root, node);
@@ -1066,6 +1078,7 @@ static int __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,
                 ret = btrfs_update_delayed_inode(trans, node->root, path, node);
         btrfs_free_path(path);
 
+        trans->block_rsv = block_rsv;
         return ret;
 }
 
@@ -1116,6 +1129,7 @@ static void btrfs_async_run_delayed_node_done(struct btrfs_work *work)
         struct btrfs_path *path;
         struct btrfs_delayed_node *delayed_node = NULL;
         struct btrfs_root *root;
+        struct btrfs_block_rsv *block_rsv;
         unsigned long nr = 0;
         int need_requeue = 0;
         int ret;
@@ -1134,6 +1148,9 @@ static void btrfs_async_run_delayed_node_done(struct btrfs_work *work)
         if (IS_ERR(trans))
                 goto free_path;
 
+        block_rsv = trans->block_rsv;
+        trans->block_rsv = &root->fs_info->global_block_rsv;
+
         ret = btrfs_insert_delayed_items(trans, path, root, delayed_node);
         if (!ret)
                 ret = btrfs_delete_delayed_items(trans, path, root,
@@ -1176,6 +1193,7 @@ static void btrfs_async_run_delayed_node_done(struct btrfs_work *work)
 
         nr = trans->blocks_used;
 
+        trans->block_rsv = block_rsv;
         btrfs_end_transaction_dmeta(trans, root);
         __btrfs_btree_balance_dirty(root, nr);
 free_path:
@@ -1222,6 +1240,13 @@ again:
         return 0;
 }
 
+void btrfs_assert_delayed_root_empty(struct btrfs_root *root)
+{
+        struct btrfs_delayed_root *delayed_root;
+        delayed_root = btrfs_get_delayed_root(root);
+        WARN_ON(btrfs_first_delayed_node(delayed_root));
+}
+
 void btrfs_balance_delayed_items(struct btrfs_root *root)
 {
         struct btrfs_delayed_root *delayed_root;
@@ -1382,8 +1407,7 @@ end:
 
 int btrfs_inode_delayed_dir_index_count(struct inode *inode)
 {
-        struct btrfs_delayed_node *delayed_node = BTRFS_I(inode)->delayed_node;
-        int ret = 0;
+        struct btrfs_delayed_node *delayed_node = btrfs_get_delayed_node(inode);
 
         if (!delayed_node)
                 return -ENOENT;
@@ -1393,11 +1417,14 @@ int btrfs_inode_delayed_dir_index_count(struct inode *inode)
          * a new directory index is added into the delayed node and index_cnt
          * is updated now. So we needn't lock the delayed node.
          */
-        if (!delayed_node->index_cnt)
+        if (!delayed_node->index_cnt) {
+                btrfs_release_delayed_node(delayed_node);
                 return -EINVAL;
+        }
 
         BTRFS_I(inode)->index_cnt = delayed_node->index_cnt;
-        return ret;
+        btrfs_release_delayed_node(delayed_node);
+        return 0;
 }
 
 void btrfs_get_delayed_items(struct inode *inode, struct list_head *ins_list,
@@ -1591,6 +1618,57 @@ static void fill_stack_inode_item(struct btrfs_trans_handle *trans,
                                       inode->i_ctime.tv_nsec);
 }
 
+int btrfs_fill_inode(struct inode *inode, u32 *rdev)
+{
+        struct btrfs_delayed_node *delayed_node;
+        struct btrfs_inode_item *inode_item;
+        struct btrfs_timespec *tspec;
+
+        delayed_node = btrfs_get_delayed_node(inode);
+        if (!delayed_node)
+                return -ENOENT;
+
+        mutex_lock(&delayed_node->mutex);
+        if (!delayed_node->inode_dirty) {
+                mutex_unlock(&delayed_node->mutex);
+                btrfs_release_delayed_node(delayed_node);
+                return -ENOENT;
+        }
+
+        inode_item = &delayed_node->inode_item;
+
+        inode->i_uid = btrfs_stack_inode_uid(inode_item);
+        inode->i_gid = btrfs_stack_inode_gid(inode_item);
+        btrfs_i_size_write(inode, btrfs_stack_inode_size(inode_item));
+        inode->i_mode = btrfs_stack_inode_mode(inode_item);
+        inode->i_nlink = btrfs_stack_inode_nlink(inode_item);
+        inode_set_bytes(inode, btrfs_stack_inode_nbytes(inode_item));
+        BTRFS_I(inode)->generation = btrfs_stack_inode_generation(inode_item);
+        BTRFS_I(inode)->sequence = btrfs_stack_inode_sequence(inode_item);
+        inode->i_rdev = 0;
+        *rdev = btrfs_stack_inode_rdev(inode_item);
+        BTRFS_I(inode)->flags = btrfs_stack_inode_flags(inode_item);
+
+        tspec = btrfs_inode_atime(inode_item);
+        inode->i_atime.tv_sec = btrfs_stack_timespec_sec(tspec);
+        inode->i_atime.tv_nsec = btrfs_stack_timespec_nsec(tspec);
+
+        tspec = btrfs_inode_mtime(inode_item);
+        inode->i_mtime.tv_sec = btrfs_stack_timespec_sec(tspec);
+        inode->i_mtime.tv_nsec = btrfs_stack_timespec_nsec(tspec);
+
+        tspec = btrfs_inode_ctime(inode_item);
+        inode->i_ctime.tv_sec = btrfs_stack_timespec_sec(tspec);
+        inode->i_ctime.tv_nsec = btrfs_stack_timespec_nsec(tspec);
+
+        inode->i_generation = BTRFS_I(inode)->generation;
+        BTRFS_I(inode)->index_cnt = (u64)-1;
+
+        mutex_unlock(&delayed_node->mutex);
+        btrfs_release_delayed_node(delayed_node);
+        return 0;
+}
+
 int btrfs_delayed_update_inode(struct btrfs_trans_handle *trans,
                                struct btrfs_root *root, struct inode *inode)
 {
diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
index eb7d240aa648..8d27af4bd8b9 100644
--- a/fs/btrfs/delayed-inode.h
+++ b/fs/btrfs/delayed-inode.h
@@ -75,7 +75,6 @@ struct btrfs_delayed_item {
         struct list_head tree_list;     /* used for batch insert/delete items */
         struct list_head readdir_list;  /* used for readdir items */
         u64 bytes_reserved;
-        struct btrfs_block_rsv *block_rsv;
         struct btrfs_delayed_node *delayed_node;
         atomic_t refs;
         int ins_or_del;
@@ -120,6 +119,7 @@ void btrfs_kill_delayed_inode_items(struct inode *inode);
 
 int btrfs_delayed_update_inode(struct btrfs_trans_handle *trans,
                                struct btrfs_root *root, struct inode *inode);
+int btrfs_fill_inode(struct inode *inode, u32 *rdev);
 
 /* Used for drop dead root */
 void btrfs_kill_all_delayed_nodes(struct btrfs_root *root);
@@ -138,4 +138,8 @@ int btrfs_readdir_delayed_dir_index(struct file *filp, void *dirent,
 /* for init */
 int __init btrfs_delayed_inode_init(void);
 void btrfs_delayed_inode_exit(void);
+
+/* for debugging */
+void btrfs_assert_delayed_root_empty(struct btrfs_root *root);
+
 #endif
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 9f68c6898653..1ac8db5dc0a3 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1044,7 +1044,6 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         root->last_trans = 0;
         root->highest_objectid = 0;
         root->name = NULL;
-        root->in_sysfs = 0;
         root->inode_tree = RB_ROOT;
         INIT_RADIX_TREE(&root->delayed_nodes_tree, GFP_ATOMIC);
         root->block_rsv = NULL;
@@ -1300,19 +1299,21 @@ again:
                 return root;
 
         root->free_ino_ctl = kzalloc(sizeof(*root->free_ino_ctl), GFP_NOFS);
-        if (!root->free_ino_ctl)
-                goto fail;
         root->free_ino_pinned = kzalloc(sizeof(*root->free_ino_pinned),
                                         GFP_NOFS);
-        if (!root->free_ino_pinned)
+        if (!root->free_ino_pinned || !root->free_ino_ctl) {
+                ret = -ENOMEM;
                 goto fail;
+        }
 
         btrfs_init_free_ino_ctl(root);
         mutex_init(&root->fs_commit_mutex);
         spin_lock_init(&root->cache_lock);
         init_waitqueue_head(&root->cache_wait);
 
-        set_anon_super(&root->anon_super, NULL);
+        ret = set_anon_super(&root->anon_super, NULL);
+        if (ret)
+                goto fail;
 
         if (btrfs_root_refs(&root->root_item) == 0) {
                 ret = -ENOENT;
@@ -1618,6 +1619,7 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         spin_lock_init(&fs_info->fs_roots_radix_lock);
         spin_lock_init(&fs_info->delayed_iput_lock);
         spin_lock_init(&fs_info->defrag_inodes_lock);
+        mutex_init(&fs_info->reloc_mutex);
 
         init_completion(&fs_info->kobj_unregister);
         fs_info->tree_root = tree_root;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b42efc2ded51..71cd456fdb60 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3314,10 +3314,6 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
         if (reserved == 0)
                 return 0;
 
-        /* nothing to shrink - nothing to reclaim */
-        if (root->fs_info->delalloc_bytes == 0)
-                return 0;
-
         max_reclaim = min(reserved, to_reclaim);
 
         while (loops < 1024) {
@@ -4846,7 +4842,7 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                                      u64 num_bytes, u64 empty_size,
                                      u64 search_start, u64 search_end,
                                      u64 hint_byte, struct btrfs_key *ins,
-                                     int data)
+                                     u64 data)
 {
         int ret = 0;
         struct btrfs_root *root = orig_root->fs_info->extent_root;
@@ -4873,7 +4869,7 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
 
         space_info = __find_space_info(root->fs_info, data);
         if (!space_info) {
-                printk(KERN_ERR "No space info for %d\n", data);
+                printk(KERN_ERR "No space info for %llu\n", data);
                 return -ENOSPC;
         }
 
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 9f985a429877..bf0d61567f3d 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1893,9 +1893,12 @@ void __btrfs_remove_free_space_cache_locked(struct btrfs_free_space_ctl *ctl)
 
         while ((node = rb_last(&ctl->free_space_offset)) != NULL) {
                 info = rb_entry(node, struct btrfs_free_space, offset_index);
-                unlink_free_space(ctl, info);
-                kfree(info->bitmap);
-                kmem_cache_free(btrfs_free_space_cachep, info);
+                if (!info->bitmap) {
+                        unlink_free_space(ctl, info);
+                        kmem_cache_free(btrfs_free_space_cachep, info);
+                } else {
+                        free_bitmap(ctl, info);
+                }
                 if (need_resched()) {
                         spin_unlock(&ctl->tree_lock);
                         cond_resched();
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 751ddf8fc58a..d340f63d8f07 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2509,6 +2509,11 @@ static void btrfs_read_locked_inode(struct inode *inode)
         int maybe_acls;
         u32 rdev;
         int ret;
+        bool filled = false;
+
+        ret = btrfs_fill_inode(inode, &rdev);
+        if (!ret)
+                filled = true;
 
         path = btrfs_alloc_path();
         BUG_ON(!path);
@@ -2520,6 +2525,10 @@ static void btrfs_read_locked_inode(struct inode *inode)
                 goto make_bad;
 
         leaf = path->nodes[0];
+
+        if (filled)
+                goto cache_acl;
+
         inode_item = btrfs_item_ptr(leaf, path->slots[0],
                                     struct btrfs_inode_item);
         if (!leaf->map_token)
@@ -2556,7 +2565,7 @@ static void btrfs_read_locked_inode(struct inode *inode)
 
         BTRFS_I(inode)->index_cnt = (u64)-1;
         BTRFS_I(inode)->flags = btrfs_inode_flags(leaf, inode_item);
-
+cache_acl:
         /*
          * try to precache a NULL acl entry for files that don't have
          * any xattrs or acls
@@ -2572,7 +2581,6 @@ static void btrfs_read_locked_inode(struct inode *inode)
         }
 
         btrfs_free_path(path);
-        inode_item = NULL;
 
         switch (inode->i_mode & S_IFMT) {
         case S_IFREG:
@@ -3076,6 +3084,7 @@ int btrfs_unlink_subvol(struct btrfs_trans_handle *trans,
         ret = btrfs_update_inode(trans, root, dir);
         BUG_ON(ret);
 
+        btrfs_free_path(path);
         return 0;
 }
 
@@ -4519,6 +4528,7 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
         inode_tree_add(inode);
 
         trace_btrfs_inode_new(inode);
+        btrfs_set_inode_last_trans(trans, inode);
 
         return inode;
 fail:
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index b793d112d1f6..a3c4751e07db 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -482,8 +482,10 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
         ret = btrfs_snap_reserve_metadata(trans, pending_snapshot);
         BUG_ON(ret);
 
+        spin_lock(&root->fs_info->trans_lock);
         list_add(&pending_snapshot->list,
                  &trans->transaction->pending_snapshots);
+        spin_unlock(&root->fs_info->trans_lock);
         if (async_transid) {
                 *async_transid = trans->transid;
                 ret = btrfs_commit_transaction_async(trans,
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index b1ef27cc673b..5e0a3dc79a45 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1368,7 +1368,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
         int ret;
 
         if (!root->reloc_root)
-                return 0;
+                goto out;
 
         reloc_root = root->reloc_root;
         root_item = &reloc_root->root_item;
@@ -1390,6 +1390,8 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
         ret = btrfs_update_root(trans, root->fs_info->tree_root,
                                 &reloc_root->root_key, root_item);
         BUG_ON(ret);
+
+out:
         return 0;
 }
 
@@ -2142,10 +2144,11 @@ int prepare_to_merge(struct reloc_control *rc, int err)
         u64 num_bytes = 0;
         int ret;
 
-        spin_lock(&root->fs_info->trans_lock);
+        mutex_lock(&root->fs_info->reloc_mutex);
         rc->merging_rsv_size += root->nodesize * (BTRFS_MAX_LEVEL - 1) * 2;
         rc->merging_rsv_size += rc->nodes_relocated * 2;
-        spin_unlock(&root->fs_info->trans_lock);
+        mutex_unlock(&root->fs_info->reloc_mutex);
+
 again:
         if (!err) {
                 num_bytes = rc->merging_rsv_size;
@@ -2214,9 +2217,16 @@ int merge_reloc_roots(struct reloc_control *rc)
         int ret;
 again:
         root = rc->extent_root;
-        spin_lock(&root->fs_info->trans_lock);
+
+        /*
+         * this serializes us with btrfs_record_root_in_transaction,
+         * we have to make sure nobody is in the middle of
+         * adding their roots to the list while we are
+         * doing this splice
+         */
+        mutex_lock(&root->fs_info->reloc_mutex);
         list_splice_init(&rc->reloc_roots, &reloc_roots);
-        spin_unlock(&root->fs_info->trans_lock);
+        mutex_unlock(&root->fs_info->reloc_mutex);
 
         while (!list_empty(&reloc_roots)) {
                 found = 1;
@@ -3590,17 +3600,19 @@ next:
 static void set_reloc_control(struct reloc_control *rc)
 {
         struct btrfs_fs_info *fs_info = rc->extent_root->fs_info;
-        spin_lock(&fs_info->trans_lock);
+
+        mutex_lock(&fs_info->reloc_mutex);
         fs_info->reloc_ctl = rc;
-        spin_unlock(&fs_info->trans_lock);
+        mutex_unlock(&fs_info->reloc_mutex);
 }
 
 static void unset_reloc_control(struct reloc_control *rc)
 {
         struct btrfs_fs_info *fs_info = rc->extent_root->fs_info;
-        spin_lock(&fs_info->trans_lock);
+
+        mutex_lock(&fs_info->reloc_mutex);
         fs_info->reloc_ctl = NULL;
-        spin_unlock(&fs_info->trans_lock);
+        mutex_unlock(&fs_info->reloc_mutex);
 }
 
 static int check_extent_flags(u64 flags)
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index c3c223ae6691..daac9ae6d731 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -28,152 +28,6 @@
 #include "disk-io.h"
 #include "transaction.h"
 
-static ssize_t root_blocks_used_show(struct btrfs_root *root, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_root_used(&root->root_item));
-}
-
-static ssize_t root_block_limit_show(struct btrfs_root *root, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_root_limit(&root->root_item));
-}
-
-static ssize_t super_blocks_used_show(struct btrfs_fs_info *fs, char *buf)
-{
-
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_super_bytes_used(&fs->super_copy));
-}
-
-static ssize_t super_total_blocks_show(struct btrfs_fs_info *fs, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_super_total_bytes(&fs->super_copy));
-}
-
-static ssize_t super_blocksize_show(struct btrfs_fs_info *fs, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_super_sectorsize(&fs->super_copy));
-}
-
-/* this is for root attrs (subvols/snapshots) */
-struct btrfs_root_attr {
-        struct attribute attr;
-        ssize_t (*show)(struct btrfs_root *, char *);
-        ssize_t (*store)(struct btrfs_root *, const char *, size_t);
-};
-
-#define ROOT_ATTR(name, mode, show, store) \
-static struct btrfs_root_attr btrfs_root_attr_##name = __ATTR(name, mode, \
-                                                              show, store)
-
-ROOT_ATTR(blocks_used,  0444,   root_blocks_used_show,  NULL);
-ROOT_ATTR(block_limit,  0644,   root_block_limit_show,  NULL);
-
-static struct attribute *btrfs_root_attrs[] = {
-        &btrfs_root_attr_blocks_used.attr,
-        &btrfs_root_attr_block_limit.attr,
-        NULL,
-};
-
-/* this is for super attrs (actual full fs) */
-struct btrfs_super_attr {
-        struct attribute attr;
-        ssize_t (*show)(struct btrfs_fs_info *, char *);
-        ssize_t (*store)(struct btrfs_fs_info *, const char *, size_t);
-};
-
-#define SUPER_ATTR(name, mode, show, store) \
-static struct btrfs_super_attr btrfs_super_attr_##name = __ATTR(name, mode, \
-                                                                show, store)
-
-SUPER_ATTR(blocks_used,         0444,   super_blocks_used_show,         NULL);
-SUPER_ATTR(total_blocks,        0444,   super_total_blocks_show,        NULL);
-SUPER_ATTR(blocksize,           0444,   super_blocksize_show,           NULL);
-
-static struct attribute *btrfs_super_attrs[] = {
-        &btrfs_super_attr_blocks_used.attr,
-        &btrfs_super_attr_total_blocks.attr,
-        &btrfs_super_attr_blocksize.attr,
-        NULL,
-};
-
-static ssize_t btrfs_super_attr_show(struct kobject *kobj,
-                                    struct attribute *attr, char *buf)
-{
-        struct btrfs_fs_info *fs = container_of(kobj, struct btrfs_fs_info,
-                                                super_kobj);
-        struct btrfs_super_attr *a = container_of(attr,
-                                                  struct btrfs_super_attr,
-                                                  attr);
-
-        return a->show ? a->show(fs, buf) : 0;
-}
-
-static ssize_t btrfs_super_attr_store(struct kobject *kobj,
-                                     struct attribute *attr,
-                                     const char *buf, size_t len)
-{
-        struct btrfs_fs_info *fs = container_of(kobj, struct btrfs_fs_info,
-                                                super_kobj);
-        struct btrfs_super_attr *a = container_of(attr,
-                                                  struct btrfs_super_attr,
-                                                  attr);
-
-        return a->store ? a->store(fs, buf, len) : 0;
-}
-
-static ssize_t btrfs_root_attr_show(struct kobject *kobj,
-                                    struct attribute *attr, char *buf)
-{
-        struct btrfs_root *root = container_of(kobj, struct btrfs_root,
-                                                root_kobj);
-        struct btrfs_root_attr *a = container_of(attr,
-                                                 struct btrfs_root_attr,
-                                                 attr);
-
-        return a->show ? a->show(root, buf) : 0;
-}
-
-static ssize_t btrfs_root_attr_store(struct kobject *kobj,
-                                     struct attribute *attr,
-                                     const char *buf, size_t len)
-{
-        struct btrfs_root *root = container_of(kobj, struct btrfs_root,
-                                                root_kobj);
-        struct btrfs_root_attr *a = container_of(attr,
-                                                 struct btrfs_root_attr,
-                                                 attr);
-        return a->store ? a->store(root, buf, len) : 0;
-}
-
-static void btrfs_super_release(struct kobject *kobj)
-{
-        struct btrfs_fs_info *fs = container_of(kobj, struct btrfs_fs_info,
-                                                super_kobj);
-        complete(&fs->kobj_unregister);
-}
-
-static void btrfs_root_release(struct kobject *kobj)
-{
-        struct btrfs_root *root = container_of(kobj, struct btrfs_root,
-                                                root_kobj);
-        complete(&root->kobj_unregister);
-}
-
-static const struct sysfs_ops btrfs_super_attr_ops = {
-        .show   = btrfs_super_attr_show,
-        .store  = btrfs_super_attr_store,
-};
-
-static const struct sysfs_ops btrfs_root_attr_ops = {
-        .show   = btrfs_root_attr_show,
-        .store  = btrfs_root_attr_store,
-};
-
 /* /sys/fs/btrfs/ entry */
 static struct kset *btrfs_kset;
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 2b3590b9fe98..51dcec86757f 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -126,28 +126,85 @@ static noinline int join_transaction(struct btrfs_root *root, int nofail)
  * to make sure the old root from before we joined the transaction is deleted
  * when the transaction commits
  */
-int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans,
+static int record_root_in_trans(struct btrfs_trans_handle *trans,
                                struct btrfs_root *root)
 {
         if (root->ref_cows && root->last_trans < trans->transid) {
                 WARN_ON(root == root->fs_info->extent_root);
                 WARN_ON(root->commit_root != root->node);
 
+                /*
+                 * see below for in_trans_setup usage rules
+                 * we have the reloc mutex held now, so there
+                 * is only one writer in this function
+                 */
+                root->in_trans_setup = 1;
+
+                /* make sure readers find in_trans_setup before
+                 * they find our root->last_trans update
+                 */
+                smp_wmb();
+
                 spin_lock(&root->fs_info->fs_roots_radix_lock);
                 if (root->last_trans == trans->transid) {
                         spin_unlock(&root->fs_info->fs_roots_radix_lock);
                         return 0;
                 }
-                root->last_trans = trans->transid;
                 radix_tree_tag_set(&root->fs_info->fs_roots_radix,
                            (unsigned long)root->root_key.objectid,
                            BTRFS_ROOT_TRANS_TAG);
                 spin_unlock(&root->fs_info->fs_roots_radix_lock);
+                root->last_trans = trans->transid;
+
+                /* this is pretty tricky.  We don't want to
+                 * take the relocation lock in btrfs_record_root_in_trans
+                 * unless we're really doing the first setup for this root in
+                 * this transaction.
+                 *
+                 * Normally we'd use root->last_trans as a flag to decide
+                 * if we want to take the expensive mutex.
+                 *
+                 * But, we have to set root->last_trans before we
+                 * init the relocation root, otherwise, we trip over warnings
+                 * in ctree.c.  The solution used here is to flag ourselves
+                 * with root->in_trans_setup.  When this is 1, we're still
+                 * fixing up the reloc trees and everyone must wait.
+                 *
+                 * When this is zero, they can trust root->last_trans and fly
+                 * through btrfs_record_root_in_trans without having to take the
+                 * lock.  smp_wmb() makes sure that all the writes above are
+                 * done before we pop in the zero below
+                 */
                 btrfs_init_reloc_root(trans, root);
+                smp_wmb();
+                root->in_trans_setup = 0;
         }
         return 0;
 }
 
+
+int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans,
+                               struct btrfs_root *root)
+{
+        if (!root->ref_cows)
+                return 0;
+
+        /*
+         * see record_root_in_trans for comments about in_trans_setup usage
+         * and barriers
+         */
+        smp_rmb();
+        if (root->last_trans == trans->transid &&
+            !root->in_trans_setup)
+                return 0;
+
+        mutex_lock(&root->fs_info->reloc_mutex);
+        record_root_in_trans(trans, root);
+        mutex_unlock(&root->fs_info->reloc_mutex);
+
+        return 0;
+}
+
 /* wait for commit against the current transaction to become unblocked
  * when this is done, it is safe to start a new transaction, but the current
  * transaction might not be fully on disk.
@@ -882,7 +939,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
         parent = dget_parent(dentry);
         parent_inode = parent->d_inode;
         parent_root = BTRFS_I(parent_inode)->root;
-        btrfs_record_root_in_trans(trans, parent_root);
+        record_root_in_trans(trans, parent_root);
 
         /*
          * insert the directory item
@@ -900,7 +957,16 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
         ret = btrfs_update_inode(trans, parent_root, parent_inode);
         BUG_ON(ret);
 
-        btrfs_record_root_in_trans(trans, root);
+        /*
+         * pull in the delayed directory update
+         * and the delayed inode item
+         * otherwise we corrupt the FS during
+         * snapshot
+         */
+        ret = btrfs_run_delayed_items(trans, root);
+        BUG_ON(ret);
+
+        record_root_in_trans(trans, root);
         btrfs_set_root_last_snapshot(&root->root_item, trans->transid);
         memcpy(new_root_item, &root->root_item, sizeof(*new_root_item));
         btrfs_check_and_init_root_item(new_root_item);
@@ -961,14 +1027,6 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
         int ret;
 
         list_for_each_entry(pending, head, list) {
-                /*
-                 * We must deal with the delayed items before creating
-                 * snapshots, or we will create a snapthot with inconsistent
-                 * information.
-                */
-                ret = btrfs_run_delayed_items(trans, fs_info->fs_root);
-                BUG_ON(ret);
-
                 ret = create_pending_snapshot(trans, fs_info, pending);
                 BUG_ON(ret);
         }
@@ -1241,21 +1299,42 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
                         schedule_timeout(1);
 
                 finish_wait(&cur_trans->writer_wait, &wait);
-                spin_lock(&root->fs_info->trans_lock);
-                root->fs_info->trans_no_join = 1;
-                spin_unlock(&root->fs_info->trans_lock);
         } while (atomic_read(&cur_trans->num_writers) > 1 ||
                  (should_grow && cur_trans->num_joined != joined));
 
-        ret = create_pending_snapshots(trans, root->fs_info);
-        BUG_ON(ret);
+        /*
+         * Ok now we need to make sure to block out any other joins while we
+         * commit the transaction.  We could have started a join before setting
+         * no_join so make sure to wait for num_writers to == 1 again.
+         */
+        spin_lock(&root->fs_info->trans_lock);
+        root->fs_info->trans_no_join = 1;
+        spin_unlock(&root->fs_info->trans_lock);
+        wait_event(cur_trans->writer_wait,
+                   atomic_read(&cur_trans->num_writers) == 1);
+
+        /*
+         * the reloc mutex makes sure that we stop
+         * the balancing code from coming in and moving
+         * extents around in the middle of the commit
+         */
+        mutex_lock(&root->fs_info->reloc_mutex);
 
         ret = btrfs_run_delayed_items(trans, root);
         BUG_ON(ret);
 
+        ret = create_pending_snapshots(trans, root->fs_info);
+        BUG_ON(ret);
+
         ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
         BUG_ON(ret);
 
+        /*
+         * make sure none of the code above managed to slip in a
+         * delayed item
+         */
+        btrfs_assert_delayed_root_empty(root);
+
         WARN_ON(cur_trans != trans->transaction);
 
         btrfs_scrub_pause(root);
@@ -1312,6 +1391,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         root->fs_info->running_transaction = NULL;
         root->fs_info->trans_no_join = 0;
         spin_unlock(&root->fs_info->trans_lock);
+        mutex_unlock(&root->fs_info->reloc_mutex);
 
         wake_up(&root->fs_info->transaction_wait);
 
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 592396c6dc47..4ce8a9f41d1e 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3177,7 +3177,7 @@ again:
                 tmp_key.offset = (u64)-1;
 
                 wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key);
-                BUG_ON(!wc.replay_dest);
+                BUG_ON(IS_ERR_OR_NULL(wc.replay_dest));
 
                 wc.replay_dest->log_root = log;
                 btrfs_record_root_in_trans(trans, wc.replay_dest);
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 53ed1ad2c112..f66cc1625150 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -156,6 +156,6 @@ config CIFS_ACL
 
 config CIFS_NFSD_EXPORT
           bool "Allow nfsd to export CIFS file system (EXPERIMENTAL)"
-          depends on CIFS && EXPERIMENTAL
+          depends on CIFS && EXPERIMENTAL && BROKEN
           help
            Allows NFS server to export a CIFS mounted share (nfsd over cifs)
diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
index ffb1459dc6ec..7260e11e21f8 100644
--- a/fs/cifs/cifs_fs_sb.h
+++ b/fs/cifs/cifs_fs_sb.h
@@ -42,6 +42,7 @@
 #define CIFS_MOUNT_MULTIUSER    0x20000 /* multiuser mount */
 #define CIFS_MOUNT_STRICT_IO    0x40000 /* strict cache mode */
 #define CIFS_MOUNT_RWPIDFORWARD 0x80000 /* use pid forwarding for rw */
+#define CIFS_MOUNT_POSIXACL     0x100000 /* mirror of MS_POSIXACL in mnt_cifs_flags */
 
 struct cifs_sb_info {
         struct rb_root tlink_tree;
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index e9def996e383..35f9154615fa 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -104,8 +104,7 @@ cifs_sb_deactive(struct super_block *sb)
 }
 
 static int
-cifs_read_super(struct super_block *sb, struct smb_vol *volume_info,
-                const char *devname, int silent)
+cifs_read_super(struct super_block *sb)
 {
         struct inode *inode;
         struct cifs_sb_info *cifs_sb;
@@ -113,22 +112,16 @@ cifs_read_super(struct super_block *sb, struct smb_vol *volume_info,
 
         cifs_sb = CIFS_SB(sb);
 
-        spin_lock_init(&cifs_sb->tlink_tree_lock);
-        cifs_sb->tlink_tree = RB_ROOT;
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIXACL)
+                sb->s_flags |= MS_POSIXACL;
 
-        rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
-        if (rc)
-                return rc;
-
-        cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
+        if (cifs_sb_master_tcon(cifs_sb)->ses->capabilities & CAP_LARGE_FILES)
+                sb->s_maxbytes = MAX_LFS_FILESIZE;
+        else
+                sb->s_maxbytes = MAX_NON_LFS;
 
-        rc = cifs_mount(sb, cifs_sb, volume_info, devname);
-
-        if (rc) {
-                if (!silent)
-                        cERROR(1, "cifs_mount failed w/return code = %d", rc);
-                goto out_mount_failed;
-        }
+        /* BB FIXME fix time_gran to be larger for LANMAN sessions */
+        sb->s_time_gran = 100;
 
         sb->s_magic = CIFS_MAGIC_NUMBER;
         sb->s_op = &cifs_super_ops;
@@ -170,37 +163,14 @@ out_no_root:
         if (inode)
                 iput(inode);
 
-        cifs_umount(sb, cifs_sb);
-
-out_mount_failed:
-        bdi_destroy(&cifs_sb->bdi);
         return rc;
 }
 
-static void
-cifs_put_super(struct super_block *sb)
+static void cifs_kill_sb(struct super_block *sb)
 {
-        int rc = 0;
-        struct cifs_sb_info *cifs_sb;
-
-        cFYI(1, "In cifs_put_super");
-        cifs_sb = CIFS_SB(sb);
-        if (cifs_sb == NULL) {
-                cFYI(1, "Empty cifs superblock info passed to unmount");
-                return;
-        }
-
-        rc = cifs_umount(sb, cifs_sb);
-        if (rc)
-                cERROR(1, "cifs_umount failed with return code %d", rc);
-        if (cifs_sb->mountdata) {
-                kfree(cifs_sb->mountdata);
-                cifs_sb->mountdata = NULL;
-        }
-
-        unload_nls(cifs_sb->local_nls);
-        bdi_destroy(&cifs_sb->bdi);
-        kfree(cifs_sb);
+        struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+        kill_anon_super(sb);
+        cifs_umount(cifs_sb);
 }
 
 static int
@@ -257,9 +227,6 @@ static int cifs_permission(struct inode *inode, int mask, unsigned int flags)
 {
         struct cifs_sb_info *cifs_sb;
 
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-
         cifs_sb = CIFS_SB(inode->i_sb);
 
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM) {
@@ -551,7 +518,6 @@ static int cifs_drop_inode(struct inode *inode)
 }
 
 static const struct super_operations cifs_super_ops = {
-        .put_super = cifs_put_super,
         .statfs = cifs_statfs,
         .alloc_inode = cifs_alloc_inode,
         .destroy_inode = cifs_destroy_inode,
@@ -588,7 +554,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
         full_path = cifs_build_path_to_root(vol, cifs_sb,
                                             cifs_sb_master_tcon(cifs_sb));
         if (full_path == NULL)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         cFYI(1, "Get root dentry for %s", full_path);
 
@@ -617,7 +583,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                         dchild = d_alloc(dparent, &name);
                         if (dchild == NULL) {
                                 dput(dparent);
-                                dparent = NULL;
+                                dparent = ERR_PTR(-ENOMEM);
                                 goto out;
                         }
                 }
@@ -635,7 +601,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                         if (rc) {
                                 dput(dchild);
                                 dput(dparent);
-                                dparent = NULL;
+                                dparent = ERR_PTR(rc);
                                 goto out;
                         }
                         alias = d_materialise_unique(dchild, inode);
@@ -643,7 +609,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                                 dput(dchild);
                                 if (IS_ERR(alias)) {
                                         dput(dparent);
-                                        dparent = NULL;
+                                        dparent = ERR_PTR(-EINVAL); /* XXX */
                                         goto out;
                                 }
                                 dchild = alias;
@@ -663,6 +629,13 @@ out:
         return dparent;
 }
 
+static int cifs_set_super(struct super_block *sb, void *data)
+{
+        struct cifs_mnt_data *mnt_data = data;
+        sb->s_fs_info = mnt_data->cifs_sb;
+        return set_anon_super(sb, NULL);
+}
+
 static struct dentry *
 cifs_do_mount(struct file_system_type *fs_type,
               int flags, const char *dev_name, void *data)
@@ -683,75 +656,73 @@ cifs_do_mount(struct file_system_type *fs_type,
         cifs_sb = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL);
         if (cifs_sb == NULL) {
                 root = ERR_PTR(-ENOMEM);
-                goto out;
+                goto out_nls;
+        }
+
+        cifs_sb->mountdata = kstrndup(data, PAGE_SIZE, GFP_KERNEL);
+        if (cifs_sb->mountdata == NULL) {
+                root = ERR_PTR(-ENOMEM);
+                goto out_cifs_sb;
         }
 
         cifs_setup_cifs_sb(volume_info, cifs_sb);
 
+        rc = cifs_mount(cifs_sb, volume_info);
+        if (rc) {
+                if (!(flags & MS_SILENT))
+                        cERROR(1, "cifs_mount failed w/return code = %d", rc);
+                root = ERR_PTR(rc);
+                goto out_mountdata;
+        }
+
         mnt_data.vol = volume_info;
         mnt_data.cifs_sb = cifs_sb;
         mnt_data.flags = flags;
 
-        sb = sget(fs_type, cifs_match_super, set_anon_super, &mnt_data);
+        sb = sget(fs_type, cifs_match_super, cifs_set_super, &mnt_data);
         if (IS_ERR(sb)) {
                 root = ERR_CAST(sb);
-                goto out_cifs_sb;
+                cifs_umount(cifs_sb);
+                goto out;
         }
 
-        if (sb->s_fs_info) {
+        if (sb->s_root) {
                 cFYI(1, "Use existing superblock");
-                goto out_shared;
-        }
+                cifs_umount(cifs_sb);
+        } else {
+                sb->s_flags = flags;
+                /* BB should we make this contingent on mount parm? */
+                sb->s_flags |= MS_NODIRATIME | MS_NOATIME;
+
+                rc = cifs_read_super(sb);
+                if (rc) {
+                        root = ERR_PTR(rc);
+                        goto out_super;
+                }
 
-        /*
-         * Copy mount params for use in submounts. Better to do
-         * the copy here and deal with the error before cleanup gets
-         * complicated post-mount.
-         */
-        cifs_sb->mountdata = kstrndup(data, PAGE_SIZE, GFP_KERNEL);
-        if (cifs_sb->mountdata == NULL) {
-                root = ERR_PTR(-ENOMEM);
-                goto out_super;
+                sb->s_flags |= MS_ACTIVE;
         }
 
-        sb->s_flags = flags;
-        /* BB should we make this contingent on mount parm? */
-        sb->s_flags |= MS_NODIRATIME | MS_NOATIME;
-        sb->s_fs_info = cifs_sb;
-
-        rc = cifs_read_super(sb, volume_info, dev_name,
-                             flags & MS_SILENT ? 1 : 0);
-        if (rc) {
-                root = ERR_PTR(rc);
-                goto out_super;
-        }
-
-        sb->s_flags |= MS_ACTIVE;
-
         root = cifs_get_root(volume_info, sb);
-        if (root == NULL)
+        if (IS_ERR(root))
                 goto out_super;
 
         cFYI(1, "dentry root is: %p", root);
         goto out;
 
-out_shared:
-        root = cifs_get_root(volume_info, sb);
-        if (root)
-                cFYI(1, "dentry root is: %p", root);
-        goto out;
-
 out_super:
-        kfree(cifs_sb->mountdata);
         deactivate_locked_super(sb);
-
-out_cifs_sb:
-        unload_nls(cifs_sb->local_nls);
-        kfree(cifs_sb);
-
 out:
         cifs_cleanup_volume_info(&volume_info);
         return root;
+
+out_mountdata:
+        kfree(cifs_sb->mountdata);
+out_cifs_sb:
+        kfree(cifs_sb);
+out_nls:
+        unload_nls(volume_info->local_nls);
+        goto out;
 }
 
 static ssize_t cifs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
@@ -840,7 +811,7 @@ struct file_system_type cifs_fs_type = {
         .owner = THIS_MODULE,
         .name = "cifs",
         .mount = cifs_do_mount,
-        .kill_sb = kill_anon_super,
+        .kill_sb = cifs_kill_sb,
         /*  .fs_flags */
 };
 const struct inode_operations cifs_dir_inode_ops = {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 953f84413c77..257f312ede42 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -157,9 +157,8 @@ extern int cifs_match_super(struct super_block *, void *);
 extern void cifs_cleanup_volume_info(struct smb_vol **pvolume_info);
 extern int cifs_setup_volume_info(struct smb_vol **pvolume_info,
                                   char *mount_data, const char *devname);
-extern int cifs_mount(struct super_block *, struct cifs_sb_info *,
-                      struct smb_vol *, const char *);
-extern int cifs_umount(struct super_block *, struct cifs_sb_info *);
+extern int cifs_mount(struct cifs_sb_info *, struct smb_vol *);
+extern void cifs_umount(struct cifs_sb_info *);
 extern void cifs_dfs_release_automount_timer(void);
 void cifs_proc_init(void);
 void cifs_proc_clean(void);
@@ -218,7 +217,8 @@ extern int get_dfs_path(int xid, struct cifs_ses *pSesInfo,
                         struct dfs_info3_param **preferrals,
                         int remap);
 extern void reset_cifs_unix_caps(int xid, struct cifs_tcon *tcon,
-                                 struct super_block *sb, struct smb_vol *vol);
+                                 struct cifs_sb_info *cifs_sb,
+                                 struct smb_vol *vol);
 extern int CIFSSMBQFSInfo(const int xid, struct cifs_tcon *tcon,
                         struct kstatfs *FSData);
 extern int SMBOldQFSInfo(const int xid, struct cifs_tcon *tcon,
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 12cf72dd0c42..7f540df52527 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2546,7 +2546,7 @@ ip_connect(struct TCP_Server_Info *server)
 }
 
 void reset_cifs_unix_caps(int xid, struct cifs_tcon *tcon,
-                          struct super_block *sb, struct smb_vol *vol_info)
+                          struct cifs_sb_info *cifs_sb, struct smb_vol *vol_info)
 {
         /* if we are reconnecting then should we check to see if
          * any requested capabilities changed locally e.g. via
@@ -2600,22 +2600,23 @@ void reset_cifs_unix_caps(int xid, struct cifs_tcon *tcon,
                         cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
                 else if (CIFS_UNIX_POSIX_ACL_CAP & cap) {
                         cFYI(1, "negotiated posix acl support");
-                        if (sb)
-                                sb->s_flags |= MS_POSIXACL;
+                        if (cifs_sb)
+                                cifs_sb->mnt_cifs_flags |=
+                                        CIFS_MOUNT_POSIXACL;
                 }
 
                 if (vol_info && vol_info->posix_paths == 0)
                         cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
                 else if (cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
                         cFYI(1, "negotiate posix pathnames");
-                        if (sb)
-                                CIFS_SB(sb)->mnt_cifs_flags |=
+                        if (cifs_sb)
+                                cifs_sb->mnt_cifs_flags |=
                                         CIFS_MOUNT_POSIX_PATHS;
                 }
 
-                if (sb && (CIFS_SB(sb)->rsize > 127 * 1024)) {
+                if (cifs_sb && (cifs_sb->rsize > 127 * 1024)) {
                         if ((cap & CIFS_UNIX_LARGE_READ_CAP) == 0) {
-                                CIFS_SB(sb)->rsize = 127 * 1024;
+                                cifs_sb->rsize = 127 * 1024;
                                 cFYI(DBG2, "larger reads not supported by srv");
                         }
                 }
@@ -2662,6 +2663,9 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 {
         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
 
+        spin_lock_init(&cifs_sb->tlink_tree_lock);
+        cifs_sb->tlink_tree = RB_ROOT;
+
         if (pvolume_info->rsize > CIFSMaxBufSize) {
                 cERROR(1, "rsize %d too large, using MaxBufSize",
                         pvolume_info->rsize);
@@ -2750,21 +2754,21 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 
 /*
  * When the server supports very large writes via POSIX extensions, we can
- * allow up to 2^24 - PAGE_CACHE_SIZE.
+ * allow up to 2^24-1, minus the size of a WRITE_AND_X header, not including
+ * the RFC1001 length.
  *
  * Note that this might make for "interesting" allocation problems during
- * writeback however (as we have to allocate an array of pointers for the
- * pages). A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
+ * writeback however as we have to allocate an array of pointers for the
+ * pages. A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
  */
-#define CIFS_MAX_WSIZE ((1<<24) - PAGE_CACHE_SIZE)
+#define CIFS_MAX_WSIZE ((1<<24) - 1 - sizeof(WRITE_REQ) + 4)
 
 /*
- * When the server doesn't allow large posix writes, default to a wsize of
- * 128k - PAGE_CACHE_SIZE -- one page less than the largest frame size
- * described in RFC1001. This allows space for the header without going over
- * that by default.
+ * When the server doesn't allow large posix writes, only allow a wsize of
+ * 128k minus the size of the WRITE_AND_X header. That allows for a write up
+ * to the maximum size described by RFC1002.
  */
-#define CIFS_MAX_RFC1001_WSIZE (128 * 1024 - PAGE_CACHE_SIZE)
+#define CIFS_MAX_RFC1002_WSIZE (128 * 1024 - sizeof(WRITE_REQ) + 4)
 
 /*
  * The default wsize is 1M. find_get_pages seems to return a maximum of 256
@@ -2783,11 +2787,18 @@ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
 
         /* can server support 24-bit write sizes? (via UNIX extensions) */
         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
-                wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1001_WSIZE);
+                wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1002_WSIZE);
 
-        /* no CAP_LARGE_WRITE_X? Limit it to 16 bits */
-        if (!(server->capabilities & CAP_LARGE_WRITE_X))
-                wsize = min_t(unsigned int, wsize, USHRT_MAX);
+        /*
+         * no CAP_LARGE_WRITE_X or is signing enabled without CAP_UNIX set?
+         * Limit it to max buffer offered by the server, minus the size of the
+         * WRITEX header, not including the 4 byte RFC1001 length.
+         */
+        if (!(server->capabilities & CAP_LARGE_WRITE_X) ||
+            (!(server->capabilities & CAP_UNIX) &&
+             (server->sec_mode & (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED))))
+                wsize = min_t(unsigned int, wsize,
+                                server->maxBuf - sizeof(WRITE_REQ) + 4);
 
         /* hard limit of CIFS_MAX_WSIZE */
         wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
@@ -2937,7 +2948,11 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
 
         if (volume_info->nullauth) {
                 cFYI(1, "null user");
-                volume_info->username = "";
+                volume_info->username = kzalloc(1, GFP_KERNEL);
+                if (volume_info->username == NULL) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
         } else if (volume_info->username) {
                 /* BB fixme parse for domain name here */
                 cFYI(1, "Username: %s", volume_info->username);
@@ -2971,8 +2986,7 @@ out:
 }
 
 int
-cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
-           struct smb_vol *volume_info, const char *devname)
+cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 {
         int rc = 0;
         int xid;
@@ -2983,6 +2997,13 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         struct tcon_link *tlink;
 #ifdef CONFIG_CIFS_DFS_UPCALL
         int referral_walks_count = 0;
+
+        rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
+        if (rc)
+                return rc;
+
+        cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
+
 try_mount_again:
         /* cleanup activities if we're chasing a referral */
         if (referral_walks_count) {
@@ -3007,6 +3028,7 @@ try_mount_again:
         srvTcp = cifs_get_tcp_session(volume_info);
         if (IS_ERR(srvTcp)) {
                 rc = PTR_ERR(srvTcp);
+                bdi_destroy(&cifs_sb->bdi);
                 goto out;
         }
 
@@ -3018,14 +3040,6 @@ try_mount_again:
                 goto mount_fail_check;
         }
 
-        if (pSesInfo->capabilities & CAP_LARGE_FILES)
-                sb->s_maxbytes = MAX_LFS_FILESIZE;
-        else
-                sb->s_maxbytes = MAX_NON_LFS;
-
-        /* BB FIXME fix time_gran to be larger for LANMAN sessions */
-        sb->s_time_gran = 100;
-
         /* search for existing tcon to this server share */
         tcon = cifs_get_tcon(pSesInfo, volume_info);
         if (IS_ERR(tcon)) {
@@ -3038,7 +3052,7 @@ try_mount_again:
         if (tcon->ses->capabilities & CAP_UNIX) {
                 /* reset of caps checks mount to see if unix extensions
                    disabled for just this mount */
-                reset_cifs_unix_caps(xid, tcon, sb, volume_info);
+                reset_cifs_unix_caps(xid, tcon, cifs_sb, volume_info);
                 if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
                     (le64_to_cpu(tcon->fsUnixInfo.Capability) &
                      CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
@@ -3161,6 +3175,7 @@ mount_fail_check:
                         cifs_put_smb_ses(pSesInfo);
                 else
                         cifs_put_tcp_session(srvTcp);
+                bdi_destroy(&cifs_sb->bdi);
                 goto out;
         }
 
@@ -3335,8 +3350,8 @@ CIFSTCon(unsigned int xid, struct cifs_ses *ses,
         return rc;
 }
 
-int
-cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
+void
+cifs_umount(struct cifs_sb_info *cifs_sb)
 {
         struct rb_root *root = &cifs_sb->tlink_tree;
         struct rb_node *node;
@@ -3357,7 +3372,10 @@ cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
         }
         spin_unlock(&cifs_sb->tlink_tree_lock);
 
-        return 0;
+        bdi_destroy(&cifs_sb->bdi);
+        kfree(cifs_sb->mountdata);
+        unload_nls(cifs_sb->local_nls);
+        kfree(cifs_sb);
 }
 
 int cifs_negotiate_protocol(unsigned int xid, struct cifs_ses *ses)
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 1525d5e662b6..1c5b770c3141 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -90,12 +90,10 @@ smbhash(unsigned char *out, const unsigned char *in, unsigned char *key)
         sg_init_one(&sgout, out, 8);
 
         rc = crypto_blkcipher_encrypt(&desc, &sgout, &sgin, 8);
-        if (rc) {
+        if (rc)
                 cERROR(1, "could not encrypt crypt key rc: %d\n", rc);
-                crypto_free_blkcipher(tfm_des);
-                goto smbhash_err;
-        }
 
+        crypto_free_blkcipher(tfm_des);
 smbhash_err:
         return rc;
 }
diff --git a/fs/coda/pioctl.c b/fs/coda/pioctl.c
index 6cbb3afb36dc..cb140ef293e4 100644
--- a/fs/coda/pioctl.c
+++ b/fs/coda/pioctl.c
@@ -43,8 +43,6 @@ const struct file_operations coda_ioctl_operations = {
 /* the coda pioctl inode ops */
 static int coda_ioctl_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
         return (mask & MAY_EXEC) ? -EACCES : 0;
 }
 
diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
index 2e29abb30f76..095c36f3b612 100644
--- a/fs/ext4/ext4_extents.h
+++ b/fs/ext4/ext4_extents.h
@@ -125,7 +125,7 @@ struct ext4_ext_path {
  * positive retcode - signal for ext4_ext_walk_space(), see below
  * callback must return valid extent (passed or newly created)
  */
-typedef int (*ext_prepare_callback)(struct inode *, struct ext4_ext_path *,
+typedef int (*ext_prepare_callback)(struct inode *, ext4_lblk_t,
                                         struct ext4_ext_cache *,
                                         struct ext4_extent *, void *);
 
@@ -133,8 +133,11 @@ typedef int (*ext_prepare_callback)(struct inode *, struct ext4_ext_path *,
 #define EXT_BREAK      1
 #define EXT_REPEAT     2
 
-/* Maximum logical block in a file; ext4_extent's ee_block is __le32 */
-#define EXT_MAX_BLOCK   0xffffffff
+/*
+ * Maximum number of logical blocks in a file; ext4_extent's ee_block is
+ * __le32.
+ */
+#define EXT_MAX_BLOCKS  0xffffffff
 
 /*
  * EXT_INIT_MAX_LEN is the maximum number of blocks we can have in an
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 5199bac7fc62..f815cc81e7a2 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1408,7 +1408,7 @@ got_index:
 
 /*
  * ext4_ext_next_allocated_block:
- * returns allocated block in subsequent extent or EXT_MAX_BLOCK.
+ * returns allocated block in subsequent extent or EXT_MAX_BLOCKS.
  * NOTE: it considers block number from index entry as
  * allocated block. Thus, index entries have to be consistent
  * with leaves.
@@ -1422,7 +1422,7 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
         depth = path->p_depth;
 
         if (depth == 0 && path->p_ext == NULL)
-                return EXT_MAX_BLOCK;
+                return EXT_MAX_BLOCKS;
 
         while (depth >= 0) {
                 if (depth == path->p_depth) {
@@ -1439,12 +1439,12 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
                 depth--;
         }
 
-        return EXT_MAX_BLOCK;
+        return EXT_MAX_BLOCKS;
 }
 
 /*
  * ext4_ext_next_leaf_block:
- * returns first allocated block from next leaf or EXT_MAX_BLOCK
+ * returns first allocated block from next leaf or EXT_MAX_BLOCKS
  */
 static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
                                         struct ext4_ext_path *path)
@@ -1456,7 +1456,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
 
         /* zero-tree has no leaf blocks at all */
         if (depth == 0)
-                return EXT_MAX_BLOCK;
+                return EXT_MAX_BLOCKS;
 
         /* go to index block */
         depth--;
@@ -1469,7 +1469,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
                 depth--;
         }
 
-        return EXT_MAX_BLOCK;
+        return EXT_MAX_BLOCKS;
 }
 
 /*
@@ -1677,13 +1677,13 @@ static unsigned int ext4_ext_check_overlap(struct inode *inode,
          */
         if (b2 < b1) {
                 b2 = ext4_ext_next_allocated_block(path);
-                if (b2 == EXT_MAX_BLOCK)
+                if (b2 == EXT_MAX_BLOCKS)
                         goto out;
         }
 
         /* check for wrap through zero on extent logical start block*/
         if (b1 + len1 < b1) {
-                len1 = EXT_MAX_BLOCK - b1;
+                len1 = EXT_MAX_BLOCKS - b1;
                 newext->ee_len = cpu_to_le16(len1);
                 ret = 1;
         }
@@ -1767,7 +1767,7 @@ repeat:
         fex = EXT_LAST_EXTENT(eh);
         next = ext4_ext_next_leaf_block(inode, path);
         if (le32_to_cpu(newext->ee_block) > le32_to_cpu(fex->ee_block)
-            && next != EXT_MAX_BLOCK) {
+            && next != EXT_MAX_BLOCKS) {
                 ext_debug("next leaf block - %d\n", next);
                 BUG_ON(npath != NULL);
                 npath = ext4_ext_find_extent(inode, next, NULL);
@@ -1887,7 +1887,7 @@ static int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
         BUG_ON(func == NULL);
         BUG_ON(inode == NULL);
 
-        while (block < last && block != EXT_MAX_BLOCK) {
+        while (block < last && block != EXT_MAX_BLOCKS) {
                 num = last - block;
                 /* find extent for this block */
                 down_read(&EXT4_I(inode)->i_data_sem);
@@ -1958,7 +1958,7 @@ static int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
                         err = -EIO;
                         break;
                 }
-                err = func(inode, path, &cbex, ex, cbdata);
+                err = func(inode, next, &cbex, ex, cbdata);
                 ext4_ext_drop_refs(path);
 
                 if (err < 0)
@@ -2020,7 +2020,7 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
         if (ex == NULL) {
                 /* there is no extent yet, so gap is [0;-] */
                 lblock = 0;
-                len = EXT_MAX_BLOCK;
+                len = EXT_MAX_BLOCKS;
                 ext_debug("cache gap(whole file):");
         } else if (block < le32_to_cpu(ex->ee_block)) {
                 lblock = block;
@@ -2350,7 +2350,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                          * never happen because at least one of the end points
                          * needs to be on the edge of the extent.
                          */
-                        if (end == EXT_MAX_BLOCK) {
+                        if (end == EXT_MAX_BLOCKS - 1) {
                                 ext_debug("  bad truncate %u:%u\n",
                                                 start, end);
                                 block = 0;
@@ -2398,7 +2398,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                          * If this is a truncate, this condition
                          * should never happen
                          */
-                        if (end == EXT_MAX_BLOCK) {
+                        if (end == EXT_MAX_BLOCKS - 1) {
                                 ext_debug("  bad truncate %u:%u\n",
                                         start, end);
                                 err = -EIO;
@@ -2478,7 +2478,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                  * we need to remove it from the leaf
                  */
                 if (num == 0) {
-                        if (end != EXT_MAX_BLOCK) {
+                        if (end != EXT_MAX_BLOCKS - 1) {
                                 /*
                                  * For hole punching, we need to scoot all the
                                  * extents up when an extent is removed so that
@@ -3699,7 +3699,7 @@ void ext4_ext_truncate(struct inode *inode)
 
         last_block = (inode->i_size + sb->s_blocksize - 1)
                         >> EXT4_BLOCK_SIZE_BITS(sb);
-        err = ext4_ext_remove_space(inode, last_block, EXT_MAX_BLOCK);
+        err = ext4_ext_remove_space(inode, last_block, EXT_MAX_BLOCKS - 1);
 
         /* In a multi-transaction truncate, we only make the final
          * transaction synchronous.
@@ -3914,14 +3914,13 @@ int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
 /*
  * Callback function called for each extent to gather FIEMAP information.
  */
-static int ext4_ext_fiemap_cb(struct inode *inode, struct ext4_ext_path *path,
+static int ext4_ext_fiemap_cb(struct inode *inode, ext4_lblk_t next,
                        struct ext4_ext_cache *newex, struct ext4_extent *ex,
                        void *data)
 {
         __u64   logical;
         __u64   physical;
         __u64   length;
-        loff_t  size;
         __u32   flags = 0;
         int             ret = 0;
         struct fiemap_extent_info *fieinfo = data;
@@ -4103,8 +4102,7 @@ found_delayed_extent:
         if (ex && ext4_ext_is_uninitialized(ex))
                 flags |= FIEMAP_EXTENT_UNWRITTEN;
 
-        size = i_size_read(inode);
-        if (logical + length >= size)
+        if (next == EXT_MAX_BLOCKS)
                 flags |= FIEMAP_EXTENT_LAST;
 
         ret = fiemap_fill_next_extent(fieinfo, logical, physical,
@@ -4347,8 +4345,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 
                 start_blk = start >> inode->i_sb->s_blocksize_bits;
                 last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
-                if (last_blk >= EXT_MAX_BLOCK)
-                        last_blk = EXT_MAX_BLOCK-1;
+                if (last_blk >= EXT_MAX_BLOCKS)
+                        last_blk = EXT_MAX_BLOCKS-1;
                 len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
 
                 /*
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index a5763e3505ba..e3126c051006 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2634,7 +2634,7 @@ static int ext4_writepage(struct page *page,
         struct buffer_head *page_bufs = NULL;
         struct inode *inode = page->mapping->host;
 
-        trace_ext4_writepage(inode, page);
+        trace_ext4_writepage(page);
         size = i_size_read(inode);
         if (page->index == size >> PAGE_CACHE_SHIFT)
                 len = size & ~PAGE_CACHE_MASK;
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 859f2ae8864e..6ed859d56850 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3578,8 +3578,8 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
                 free += next - bit;
 
                 trace_ext4_mballoc_discard(sb, NULL, group, bit, next - bit);
-                trace_ext4_mb_release_inode_pa(sb, pa->pa_inode, pa,
-                                               grp_blk_start + bit, next - bit);
+                trace_ext4_mb_release_inode_pa(pa, grp_blk_start + bit,
+                                               next - bit);
                 mb_free_blocks(pa->pa_inode, e4b, bit, next - bit);
                 bit = next + 1;
         }
@@ -3608,7 +3608,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
         ext4_group_t group;
         ext4_grpblk_t bit;
 
-        trace_ext4_mb_release_group_pa(sb, pa);
+        trace_ext4_mb_release_group_pa(pa);
         BUG_ON(pa->pa_deleted == 0);
         ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
         BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
@@ -4448,7 +4448,7 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
  * @inode:              inode
  * @block:              start physical block to free
  * @count:              number of blocks to count
- * @metadata:           Are these metadata blocks
+ * @flags:              flags used by ext4_free_blocks
  */
 void ext4_free_blocks(handle_t *handle, struct inode *inode,
                       struct buffer_head *bh, ext4_fsblk_t block,
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 2b8304bf3c50..f57455a1b1b2 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -1002,12 +1002,12 @@ mext_check_arguments(struct inode *orig_inode,
                 return -EINVAL;
         }
 
-        if ((orig_start > EXT_MAX_BLOCK) ||
-            (donor_start > EXT_MAX_BLOCK) ||
-            (*len > EXT_MAX_BLOCK) ||
-            (orig_start + *len > EXT_MAX_BLOCK))  {
+        if ((orig_start >= EXT_MAX_BLOCKS) ||
+            (donor_start >= EXT_MAX_BLOCKS) ||
+            (*len > EXT_MAX_BLOCKS) ||
+            (orig_start + *len >= EXT_MAX_BLOCKS))  {
                 ext4_debug("ext4 move extent: Can't handle over [%u] blocks "
-                        "[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCK,
+                        "[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCKS,
                         orig_inode->i_ino, donor_inode->i_ino);
                 return -EINVAL;
         }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cc5c157aa11d..9ea71aa864b3 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2243,6 +2243,12 @@ static void ext4_orphan_cleanup(struct super_block *sb,
  * in the vfs.  ext4 inode has 48 bits of i_block in fsblock units,
  * so that won't be a limiting factor.
  *
+ * However there is other limiting factor. We do store extents in the form
+ * of starting block and length, hence the resulting length of the extent
+ * covering maximum file size must fit into on-disk format containers as
+ * well. Given that length is always by 1 unit bigger than max unit (because
+ * we count 0 as well) we have to lower the s_maxbytes by one fs block.
+ *
  * Note, this does *not* consider any metadata overhead for vfs i_blocks.
  */
 static loff_t ext4_max_size(int blkbits, int has_huge_files)
@@ -2264,10 +2270,13 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files)
                 upper_limit <<= blkbits;
         }
 
-        /* 32-bit extent-start container, ee_block */
-        res = 1LL << 32;
+        /*
+         * 32-bit extent-start container, ee_block. We lower the maxbytes
+         * by one fs block, so ee_len can cover the extent of maximum file
+         * size
+         */
+        res = (1LL << 32) - 1;
         res <<= blkbits;
-        res -= 1;
 
         /* Sanity check against vm- & vfs- imposed limits */
         if (res > upper_limit)
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index 6a79fd0a1a32..2c62c5aae82f 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -97,10 +97,14 @@ static int __try_to_free_cp_buf(struct journal_head *jh)
 
         if (jh->b_jlist == BJ_None && !buffer_locked(bh) &&
             !buffer_dirty(bh) && !buffer_write_io_error(bh)) {
+                /*
+                 * Get our reference so that bh cannot be freed before
+                 * we unlock it
+                 */
+                get_bh(bh);
                 JBUFFER_TRACE(jh, "remove from checkpoint list");
                 ret = __jbd2_journal_remove_checkpoint(jh) + 1;
                 jbd_unlock_bh_state(bh);
-                jbd2_journal_remove_journal_head(bh);
                 BUFFER_TRACE(bh, "release");
                 __brelse(bh);
         } else {
@@ -223,8 +227,8 @@ restart:
                         spin_lock(&journal->j_list_lock);
                         goto restart;
                 }
+                get_bh(bh);
                 if (buffer_locked(bh)) {
-                        atomic_inc(&bh->b_count);
                         spin_unlock(&journal->j_list_lock);
                         jbd_unlock_bh_state(bh);
                         wait_on_buffer(bh);
@@ -243,7 +247,6 @@ restart:
                  */
                 released = __jbd2_journal_remove_checkpoint(jh);
                 jbd_unlock_bh_state(bh);
-                jbd2_journal_remove_journal_head(bh);
                 __brelse(bh);
         }
 
@@ -284,7 +287,7 @@ static int __process_buffer(journal_t *journal, struct journal_head *jh,
         int ret = 0;
 
         if (buffer_locked(bh)) {
-                atomic_inc(&bh->b_count);
+                get_bh(bh);
                 spin_unlock(&journal->j_list_lock);
                 jbd_unlock_bh_state(bh);
                 wait_on_buffer(bh);
@@ -316,12 +319,12 @@ static int __process_buffer(journal_t *journal, struct journal_head *jh,
                 ret = 1;
                 if (unlikely(buffer_write_io_error(bh)))
                         ret = -EIO;
+                get_bh(bh);
                 J_ASSERT_JH(jh, !buffer_jbddirty(bh));
                 BUFFER_TRACE(bh, "remove from checkpoint");
                 __jbd2_journal_remove_checkpoint(jh);
                 spin_unlock(&journal->j_list_lock);
                 jbd_unlock_bh_state(bh);
-                jbd2_journal_remove_journal_head(bh);
                 __brelse(bh);
         } else {
                 /*
@@ -554,7 +557,8 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
 /*
  * journal_clean_one_cp_list
  *
- * Find all the written-back checkpoint buffers in the given list and release them.
+ * Find all the written-back checkpoint buffers in the given list and
+ * release them.
  *
  * Called with the journal locked.
  * Called with j_list_lock held.
@@ -663,8 +667,8 @@ out:
  * checkpoint lists.
  *
  * The function returns 1 if it frees the transaction, 0 otherwise.
+ * The function can free jh and bh.
  *
- * This function is called with the journal locked.
  * This function is called with j_list_lock held.
  * This function is called with jbd_lock_bh_state(jh2bh(jh))
  */
@@ -684,13 +688,14 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh)
         }
         journal = transaction->t_journal;
 
+        JBUFFER_TRACE(jh, "removing from transaction");
         __buffer_unlink(jh);
         jh->b_cp_transaction = NULL;
+        jbd2_journal_put_journal_head(jh);
 
         if (transaction->t_checkpoint_list != NULL ||
             transaction->t_checkpoint_io_list != NULL)
                 goto out;
-        JBUFFER_TRACE(jh, "transaction has no more buffers");
 
         /*
          * There is one special case to worry about: if we have just pulled the
@@ -701,10 +706,8 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh)
          * The locking here around t_state is a bit sleazy.
          * See the comment at the end of jbd2_journal_commit_transaction().
          */
-        if (transaction->t_state != T_FINISHED) {
-                JBUFFER_TRACE(jh, "belongs to running/committing transaction");
+        if (transaction->t_state != T_FINISHED)
                 goto out;
-        }
 
         /* OK, that was the last buffer for the transaction: we can now
            safely remove this transaction from the log */
@@ -723,7 +726,6 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh)
         wake_up(&journal->j_wait_logspace);
         ret = 1;
 out:
-        JBUFFER_TRACE(jh, "exit");
         return ret;
 }
 
@@ -742,6 +744,8 @@ void __jbd2_journal_insert_checkpoint(struct journal_head *jh,
         J_ASSERT_JH(jh, buffer_dirty(jh2bh(jh)) || buffer_jbddirty(jh2bh(jh)));
         J_ASSERT_JH(jh, jh->b_cp_transaction == NULL);
 
+        /* Get reference for checkpointing transaction */
+        jbd2_journal_grab_journal_head(jh2bh(jh));
         jh->b_cp_transaction = transaction;
 
         if (!transaction->t_checkpoint_list) {
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 7f21cf3aaf92..eef6979821a4 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -848,10 +848,16 @@ restart_loop:
         while (commit_transaction->t_forget) {
                 transaction_t *cp_transaction;
                 struct buffer_head *bh;
+                int try_to_free = 0;
 
                 jh = commit_transaction->t_forget;
                 spin_unlock(&journal->j_list_lock);
                 bh = jh2bh(jh);
+                /*
+                 * Get a reference so that bh cannot be freed before we are
+                 * done with it.
+                 */
+                get_bh(bh);
                 jbd_lock_bh_state(bh);
                 J_ASSERT_JH(jh, jh->b_transaction == commit_transaction);
 
@@ -914,28 +920,27 @@ restart_loop:
                         __jbd2_journal_insert_checkpoint(jh, commit_transaction);
                         if (is_journal_aborted(journal))
                                 clear_buffer_jbddirty(bh);
-                        JBUFFER_TRACE(jh, "refile for checkpoint writeback");
-                        __jbd2_journal_refile_buffer(jh);
-                        jbd_unlock_bh_state(bh);
                 } else {
                         J_ASSERT_BH(bh, !buffer_dirty(bh));
-                        /* The buffer on BJ_Forget list and not jbddirty means
+                        /*
+                         * The buffer on BJ_Forget list and not jbddirty means
                          * it has been freed by this transaction and hence it
                          * could not have been reallocated until this
                          * transaction has committed. *BUT* it could be
                          * reallocated once we have written all the data to
                          * disk and before we process the buffer on BJ_Forget
-                         * list. */
-                        JBUFFER_TRACE(jh, "refile or unfile freed buffer");
-                        __jbd2_journal_refile_buffer(jh);
-                        if (!jh->b_transaction) {
-                                jbd_unlock_bh_state(bh);
-                                 /* needs a brelse */
-                                jbd2_journal_remove_journal_head(bh);
-                                release_buffer_page(bh);
-                        } else
-                                jbd_unlock_bh_state(bh);
+                         * list.
+                         */
+                        if (!jh->b_next_transaction)
+                                try_to_free = 1;
                 }
+                JBUFFER_TRACE(jh, "refile or unfile buffer");
+                __jbd2_journal_refile_buffer(jh);
+                jbd_unlock_bh_state(bh);
+                if (try_to_free)
+                        release_buffer_page(bh);        /* Drops bh reference */
+                else
+                        __brelse(bh);
                 cond_resched_lock(&journal->j_list_lock);
         }
         spin_unlock(&journal->j_list_lock);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 9a7826990304..0dfa5b598e68 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2078,10 +2078,9 @@ static void journal_free_journal_head(struct journal_head *jh)
  * When a buffer has its BH_JBD bit set it is immune from being released by
  * core kernel code, mainly via ->b_count.
  *
- * A journal_head may be detached from its buffer_head when the journal_head's
- * b_transaction, b_cp_transaction and b_next_transaction pointers are NULL.
- * Various places in JBD call jbd2_journal_remove_journal_head() to indicate that the
- * journal_head can be dropped if needed.
+ * A journal_head is detached from its buffer_head when the journal_head's
+ * b_jcount reaches zero. Running transaction (b_transaction) and checkpoint
+ * transaction (b_cp_transaction) hold their references to b_jcount.
  *
  * Various places in the kernel want to attach a journal_head to a buffer_head
  * _before_ attaching the journal_head to a transaction.  To protect the
@@ -2094,17 +2093,16 @@ static void journal_free_journal_head(struct journal_head *jh)
  *      (Attach a journal_head if needed.  Increments b_jcount)
  *      struct journal_head *jh = jbd2_journal_add_journal_head(bh);
  *      ...
+ *      (Get another reference for transaction)
+ *      jbd2_journal_grab_journal_head(bh);
  *      jh->b_transaction = xxx;
+ *      (Put original reference)
  *      jbd2_journal_put_journal_head(jh);
- *
- * Now, the journal_head's b_jcount is zero, but it is safe from being released
- * because it has a non-zero b_transaction.
  */
 
 /*
  * Give a buffer_head a journal_head.
  *
- * Doesn't need the journal lock.
  * May sleep.
  */
 struct journal_head *jbd2_journal_add_journal_head(struct buffer_head *bh)
@@ -2168,61 +2166,29 @@ static void __journal_remove_journal_head(struct buffer_head *bh)
         struct journal_head *jh = bh2jh(bh);
 
         J_ASSERT_JH(jh, jh->b_jcount >= 0);
-
-        get_bh(bh);
-        if (jh->b_jcount == 0) {
-                if (jh->b_transaction == NULL &&
-                                jh->b_next_transaction == NULL &&
-                                jh->b_cp_transaction == NULL) {
-                        J_ASSERT_JH(jh, jh->b_jlist == BJ_None);
-                        J_ASSERT_BH(bh, buffer_jbd(bh));
-                        J_ASSERT_BH(bh, jh2bh(jh) == bh);
-                        BUFFER_TRACE(bh, "remove journal_head");
-                        if (jh->b_frozen_data) {
-                                printk(KERN_WARNING "%s: freeing "
-                                                "b_frozen_data\n",
-                                                __func__);
-                                jbd2_free(jh->b_frozen_data, bh->b_size);
-                        }
-                        if (jh->b_committed_data) {
-                                printk(KERN_WARNING "%s: freeing "
-                                                "b_committed_data\n",
-                                                __func__);
-                                jbd2_free(jh->b_committed_data, bh->b_size);
-                        }
-                        bh->b_private = NULL;
-                        jh->b_bh = NULL;        /* debug, really */
-                        clear_buffer_jbd(bh);
-                        __brelse(bh);
-                        journal_free_journal_head(jh);
-                } else {
-                        BUFFER_TRACE(bh, "journal_head was locked");
-                }
+        J_ASSERT_JH(jh, jh->b_transaction == NULL);
+        J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+        J_ASSERT_JH(jh, jh->b_cp_transaction == NULL);
+        J_ASSERT_JH(jh, jh->b_jlist == BJ_None);
+        J_ASSERT_BH(bh, buffer_jbd(bh));
+        J_ASSERT_BH(bh, jh2bh(jh) == bh);
+        BUFFER_TRACE(bh, "remove journal_head");
+        if (jh->b_frozen_data) {
+                printk(KERN_WARNING "%s: freeing b_frozen_data\n", __func__);
+                jbd2_free(jh->b_frozen_data, bh->b_size);
         }
+        if (jh->b_committed_data) {
+                printk(KERN_WARNING "%s: freeing b_committed_data\n", __func__);
+                jbd2_free(jh->b_committed_data, bh->b_size);
+        }
+        bh->b_private = NULL;
+        jh->b_bh = NULL;        /* debug, really */
+        clear_buffer_jbd(bh);
+        journal_free_journal_head(jh);
 }
 
 /*
- * jbd2_journal_remove_journal_head(): if the buffer isn't attached to a transaction
- * and has a zero b_jcount then remove and release its journal_head.   If we did
- * see that the buffer is not used by any transaction we also "logically"
- * decrement ->b_count.
- *
- * We in fact take an additional increment on ->b_count as a convenience,
- * because the caller usually wants to do additional things with the bh
- * after calling here.
- * The caller of jbd2_journal_remove_journal_head() *must* run __brelse(bh) at some
- * time.  Once the caller has run __brelse(), the buffer is eligible for
- * reaping by try_to_free_buffers().
- */
-void jbd2_journal_remove_journal_head(struct buffer_head *bh)
-{
-        jbd_lock_bh_journal_head(bh);
-        __journal_remove_journal_head(bh);
-        jbd_unlock_bh_journal_head(bh);
-}
-
-/*
- * Drop a reference on the passed journal_head.  If it fell to zero then try to
+ * Drop a reference on the passed journal_head.  If it fell to zero then
  * release the journal_head from the buffer_head.
  */
 void jbd2_journal_put_journal_head(struct journal_head *jh)
@@ -2232,11 +2198,12 @@ void jbd2_journal_put_journal_head(struct journal_head *jh)
         jbd_lock_bh_journal_head(bh);
         J_ASSERT_JH(jh, jh->b_jcount > 0);
         --jh->b_jcount;
-        if (!jh->b_jcount && !jh->b_transaction) {
+        if (!jh->b_jcount) {
                 __journal_remove_journal_head(bh);
+                jbd_unlock_bh_journal_head(bh);
                 __brelse(bh);
-        }
-        jbd_unlock_bh_journal_head(bh);
+        } else
+                jbd_unlock_bh_journal_head(bh);
 }
 
 /*
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 3eec82d32fd4..2d7109414cdd 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 
 static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh);
+static void __jbd2_journal_unfile_buffer(struct journal_head *jh);
 
 /*
  * jbd2_get_transaction: obtain a new transaction_t object.
@@ -764,7 +765,6 @@ repeat:
         if (!jh->b_transaction) {
                 JBUFFER_TRACE(jh, "no transaction");
                 J_ASSERT_JH(jh, !jh->b_next_transaction);
-                jh->b_transaction = transaction;
                 JBUFFER_TRACE(jh, "file as BJ_Reserved");
                 spin_lock(&journal->j_list_lock);
                 __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved);
@@ -814,7 +814,6 @@ out:
  * int jbd2_journal_get_write_access() - notify intent to modify a buffer for metadata (not data) update.
  * @handle: transaction to add buffer modifications to
  * @bh:     bh to be used for metadata writes
- * @credits: variable that will receive credits for the buffer
  *
  * Returns an error code or 0 on success.
  *
@@ -896,8 +895,6 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
                  * committed and so it's safe to clear the dirty bit.
                  */
                 clear_buffer_dirty(jh2bh(jh));
-                jh->b_transaction = transaction;
-
                 /* first access by this transaction */
                 jh->b_modified = 0;
 
@@ -932,7 +929,6 @@ out:
  *     non-rewindable consequences
  * @handle: transaction
  * @bh: buffer to undo
- * @credits: store the number of taken credits here (if not NULL)
  *
  * Sometimes there is a need to distinguish between metadata which has
  * been committed to disk and that which has not.  The ext3fs code uses
@@ -1232,8 +1228,6 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh)
                         __jbd2_journal_file_buffer(jh, transaction, BJ_Forget);
                 } else {
                         __jbd2_journal_unfile_buffer(jh);
-                        jbd2_journal_remove_journal_head(bh);
-                        __brelse(bh);
                         if (!buffer_jbd(bh)) {
                                 spin_unlock(&journal->j_list_lock);
                                 jbd_unlock_bh_state(bh);
@@ -1556,19 +1550,32 @@ void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
                 mark_buffer_dirty(bh);  /* Expose it to the VM */
 }
 
-void __jbd2_journal_unfile_buffer(struct journal_head *jh)
+/*
+ * Remove buffer from all transactions.
+ *
+ * Called with bh_state lock and j_list_lock
+ *
+ * jh and bh may be already freed when this function returns.
+ */
+static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
 {
         __jbd2_journal_temp_unlink_buffer(jh);
         jh->b_transaction = NULL;
+        jbd2_journal_put_journal_head(jh);
 }
 
 void jbd2_journal_unfile_buffer(journal_t *journal, struct journal_head *jh)
 {
-        jbd_lock_bh_state(jh2bh(jh));
+        struct buffer_head *bh = jh2bh(jh);
+
+        /* Get reference so that buffer cannot be freed before we unlock it */
+        get_bh(bh);
+        jbd_lock_bh_state(bh);
         spin_lock(&journal->j_list_lock);
         __jbd2_journal_unfile_buffer(jh);
         spin_unlock(&journal->j_list_lock);
-        jbd_unlock_bh_state(jh2bh(jh));
+        jbd_unlock_bh_state(bh);
+        __brelse(bh);
 }
 
 /*
@@ -1595,8 +1602,6 @@ __journal_try_to_free_buffer(journal_t *journal, struct buffer_head *bh)
                 if (jh->b_jlist == BJ_None) {
                         JBUFFER_TRACE(jh, "remove from checkpoint list");
                         __jbd2_journal_remove_checkpoint(jh);
-                        jbd2_journal_remove_journal_head(bh);
-                        __brelse(bh);
                 }
         }
         spin_unlock(&journal->j_list_lock);
@@ -1659,7 +1664,6 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
                 /*
                  * We take our own ref against the journal_head here to avoid
                  * having to add tons of locking around each instance of
-                 * jbd2_journal_remove_journal_head() and
                  * jbd2_journal_put_journal_head().
                  */
                 jh = jbd2_journal_grab_journal_head(bh);
@@ -1697,10 +1701,9 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
         int may_free = 1;
         struct buffer_head *bh = jh2bh(jh);
 
-        __jbd2_journal_unfile_buffer(jh);
-
         if (jh->b_cp_transaction) {
                 JBUFFER_TRACE(jh, "on running+cp transaction");
+                __jbd2_journal_temp_unlink_buffer(jh);
                 /*
                  * We don't want to write the buffer anymore, clear the
                  * bit so that we don't confuse checks in
@@ -1711,8 +1714,7 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
                 may_free = 0;
         } else {
                 JBUFFER_TRACE(jh, "on running transaction");
-                jbd2_journal_remove_journal_head(bh);
-                __brelse(bh);
+                __jbd2_journal_unfile_buffer(jh);
         }
         return may_free;
 }
@@ -1990,6 +1992,8 @@ void __jbd2_journal_file_buffer(struct journal_head *jh,
 
         if (jh->b_transaction)
                 __jbd2_journal_temp_unlink_buffer(jh);
+        else
+                jbd2_journal_grab_journal_head(bh);
         jh->b_transaction = transaction;
 
         switch (jlist) {
@@ -2041,9 +2045,10 @@ void jbd2_journal_file_buffer(struct journal_head *jh,
  * already started to be used by a subsequent transaction, refile the
  * buffer on that transaction's metadata list.
  *
- * Called under journal->j_list_lock
- *
+ * Called under j_list_lock
  * Called under jbd_lock_bh_state(jh2bh(jh))
+ *
+ * jh and bh may be already free when this function returns
  */
 void __jbd2_journal_refile_buffer(struct journal_head *jh)
 {
@@ -2067,6 +2072,11 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
 
         was_dirty = test_clear_buffer_jbddirty(bh);
         __jbd2_journal_temp_unlink_buffer(jh);
+        /*
+         * We set b_transaction here because b_next_transaction will inherit
+         * our jh reference and thus __jbd2_journal_file_buffer() must not
+         * take a new one.
+         */
         jh->b_transaction = jh->b_next_transaction;
         jh->b_next_transaction = NULL;
         if (buffer_freed(bh))
@@ -2083,30 +2093,21 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
 }
 
 /*
- * For the unlocked version of this call, also make sure that any
- * hanging journal_head is cleaned up if necessary.
- *
- * __jbd2_journal_refile_buffer is usually called as part of a single locked
- * operation on a buffer_head, in which the caller is probably going to
- * be hooking the journal_head onto other lists.  In that case it is up
- * to the caller to remove the journal_head if necessary.  For the
- * unlocked jbd2_journal_refile_buffer call, the caller isn't going to be
- * doing anything else to the buffer so we need to do the cleanup
- * ourselves to avoid a jh leak.
- *
- * *** The journal_head may be freed by this call! ***
+ * __jbd2_journal_refile_buffer() with necessary locking added. We take our
+ * bh reference so that we can safely unlock bh.
+ *
+ * The jh and bh may be freed by this call.
  */
 void jbd2_journal_refile_buffer(journal_t *journal, struct journal_head *jh)
 {
         struct buffer_head *bh = jh2bh(jh);
 
+        /* Get reference so that buffer cannot be freed before we unlock it */
+        get_bh(bh);
         jbd_lock_bh_state(bh);
         spin_lock(&journal->j_list_lock);
-
         __jbd2_journal_refile_buffer(jh);
         jbd_unlock_bh_state(bh);
-        jbd2_journal_remove_journal_head(bh);
-
         spin_unlock(&journal->j_list_lock);
         __brelse(bh);
 }
diff --git a/fs/jfs/file.c b/fs/jfs/file.c
index c5ce6c1d1ff4..2f3f531f3606 100644
--- a/fs/jfs/file.c
+++ b/fs/jfs/file.c
@@ -66,9 +66,9 @@ static int jfs_open(struct inode *inode, struct file *file)
                 struct jfs_inode_info *ji = JFS_IP(inode);
                 spin_lock_irq(&ji->ag_lock);
                 if (ji->active_ag == -1) {
-                        ji->active_ag = ji->agno;
-                        atomic_inc(
-                            &JFS_SBI(inode->i_sb)->bmap->db_active[ji->agno]);
+                        struct jfs_sb_info *jfs_sb = JFS_SBI(inode->i_sb);
+                        ji->active_ag = BLKTOAG(addressPXD(&ji->ixpxd), jfs_sb);
+                        atomic_inc( &jfs_sb->bmap->db_active[ji->active_ag]);
                 }
                 spin_unlock_irq(&ji->ag_lock);
         }
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index ed53a4740168..b78b2f978f04 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -397,7 +397,7 @@ int diRead(struct inode *ip)
         release_metapage(mp);
 
         /* set the ag for the inode */
-        JFS_IP(ip)->agno = BLKTOAG(agstart, sbi);
+        JFS_IP(ip)->agstart = agstart;
         JFS_IP(ip)->active_ag = -1;
 
         return (rc);
@@ -901,7 +901,7 @@ int diFree(struct inode *ip)
 
         /* get the allocation group for this ino.
          */
-        agno = JFS_IP(ip)->agno;
+        agno = BLKTOAG(JFS_IP(ip)->agstart, JFS_SBI(ip->i_sb));
 
         /* Lock the AG specific inode map information
          */
@@ -1315,12 +1315,11 @@ int diFree(struct inode *ip)
 static inline void
 diInitInode(struct inode *ip, int iagno, int ino, int extno, struct iag * iagp)
 {
-        struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb);
         struct jfs_inode_info *jfs_ip = JFS_IP(ip);
 
         ip->i_ino = (iagno << L2INOSPERIAG) + ino;
         jfs_ip->ixpxd = iagp->inoext[extno];
-        jfs_ip->agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi);
+        jfs_ip->agstart = le64_to_cpu(iagp->agstart);
         jfs_ip->active_ag = -1;
 }
 
@@ -1379,7 +1378,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
          */
 
         /* get the ag number of this iag */
-        agno = JFS_IP(pip)->agno;
+        agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
 
         if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
                 /*
@@ -2921,10 +2920,9 @@ int diExtendFS(struct inode *ipimap, struct inode *ipbmap)
                         continue;
                 }
 
-                /* agstart that computes to the same ag is treated as same; */
                 agstart = le64_to_cpu(iagp->agstart);
-                /* iagp->agstart = agstart & ~(mp->db_agsize - 1); */
                 n = agstart >> mp->db_agl2size;
+                iagp->agstart = cpu_to_le64((s64)n << mp->db_agl2size);
 
                 /* compute backed inodes */
                 numinos = (EXTSPERIAG - le32_to_cpu(iagp->nfreeexts))
diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
index 1439f119ec83..584a4a1a6e81 100644
--- a/fs/jfs/jfs_incore.h
+++ b/fs/jfs/jfs_incore.h
@@ -50,8 +50,9 @@ struct jfs_inode_info {
         short   btindex;        /* btpage entry index*/
         struct inode *ipimap;   /* inode map                    */
         unsigned long cflag;    /* commit flags         */
+        u64     agstart;        /* agstart of the containing IAG */
         u16     bxflag;         /* xflag of pseudo buffer?      */
-        unchar  agno;           /* ag number                    */
+        unchar  pad;
         signed char active_ag;  /* ag currently allocating from */
         lid_t   blid;           /* lid of pseudo buffer?        */
         lid_t   atlhead;        /* anonymous tlock list head    */
diff --git a/fs/jfs/resize.c b/fs/jfs/resize.c
index 8ea5efb5a34e..8d0c1c7c0820 100644
--- a/fs/jfs/resize.c
+++ b/fs/jfs/resize.c
@@ -80,7 +80,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
         int log_formatted = 0;
         struct inode *iplist[1];
         struct jfs_superblock *j_sb, *j_sb2;
-        uint old_agsize;
+        s64 old_agsize;
         int agsizechanged = 0;
         struct buffer_head *bh, *bh2;
 
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index adb45ec9038c..e374050a911c 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -708,7 +708,13 @@ static void nlmclnt_unlock_callback(struct rpc_task *task, void *data)
 
         if (task->tk_status < 0) {
                 dprintk("lockd: unlock failed (err = %d)\n", -task->tk_status);
-                goto retry_rebind;
+                switch (task->tk_status) {
+                case -EACCES:
+                case -EIO:
+                        goto die;
+                default:
+                        goto retry_rebind;
+                }
         }
         if (status == NLM_LCK_DENIED_GRACE_PERIOD) {
                 rpc_delay(task, NLMCLNT_GRACE_WAIT);
diff --git a/fs/logfs/dir.c b/fs/logfs/dir.c
index 9ed89d1663f8..1afae26cf236 100644
--- a/fs/logfs/dir.c
+++ b/fs/logfs/dir.c
@@ -555,13 +555,6 @@ static int logfs_symlink(struct inode *dir, struct dentry *dentry,
         return __logfs_create(dir, dentry, inode, target, destlen);
 }
 
-static int logfs_permission(struct inode *inode, int mask, unsigned int flags)
-{
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-        return generic_permission(inode, mask, flags, NULL);
-}
-
 static int logfs_link(struct dentry *old_dentry, struct inode *dir,
                 struct dentry *dentry)
 {
@@ -820,7 +813,6 @@ const struct inode_operations logfs_dir_iops = {
         .mknod          = logfs_mknod,
         .rename         = logfs_rename,
         .rmdir          = logfs_rmdir,
-        .permission     = logfs_permission,
         .symlink        = logfs_symlink,
         .unlink         = logfs_unlink,
 };
diff --git a/fs/namei.c b/fs/namei.c
index 9e425e7e6c8f..0223c41fb114 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -238,7 +238,8 @@ int generic_permission(struct inode *inode, int mask, unsigned int flags,
 
         /*
          * Read/write DACs are always overridable.
-         * Executable DACs are overridable if at least one exec bit is set.
+         * Executable DACs are overridable for all directories and
+         * for non-directories that have least one exec bit set.
          */
         if (!(mask & MAY_EXEC) || execute_ok(inode))
                 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
@@ -1011,9 +1012,6 @@ failed:
  * Follow down to the covering mount currently visible to userspace.  At each
  * point, the filesystem owning that dentry may be queried as to whether the
  * caller is permitted to proceed or not.
- *
- * Care must be taken as namespace_sem may be held (indicated by mounting_here
- * being true).
  */
 int follow_down(struct path *path)
 {
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 144f2a3c7185..6f4850deb272 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -256,7 +256,8 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr)
 
         nfs_attr_check_mountpoint(sb, fattr);
 
-        if ((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0 && (fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0)
+        if (((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0) &&
+            !nfs_attr_use_mounted_on_fileid(fattr))
                 goto out_no_inode;
         if ((fattr->valid & NFS_ATTR_FATTR_TYPE) == 0)
                 goto out_no_inode;
@@ -1294,7 +1295,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 if (new_isize != cur_isize) {
                         /* Do we perhaps have any outstanding writes, or has
                          * the file grown beyond our last write? */
-                        if (nfsi->npages == 0 || new_isize > cur_isize) {
+                        if ((nfsi->npages == 0 && !test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) ||
+                             new_isize > cur_isize) {
                                 i_size_write(inode, new_isize);
                                 invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
                         }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index b9056cbe68d6..2a55347a2daa 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -45,6 +45,17 @@ static inline void nfs_attr_check_mountpoint(struct super_block *parent, struct
                 fattr->valid |= NFS_ATTR_FATTR_MOUNTPOINT;
 }
 
+static inline int nfs_attr_use_mounted_on_fileid(struct nfs_fattr *fattr)
+{
+        if (((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) == 0) ||
+            (((fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) &&
+             ((fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) == 0)))
+                return 0;
+
+        fattr->fileid = fattr->mounted_on_fileid;
+        return 1;
+}
+
 struct nfs_clone_mount {
         const struct super_block *sb;
         const struct dentry *dentry;
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 426908809c97..0bafcc91c27f 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -30,6 +30,7 @@
  */
 
 #include <linux/nfs_fs.h>
+#include <linux/nfs_page.h>
 
 #include "internal.h"
 #include "nfs4filelayout.h"
@@ -552,13 +553,18 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                 __func__, nfl_util, fl->num_fh, fl->first_stripe_index,
                 fl->pattern_offset);
 
-        if (!fl->num_fh)
+        /* Note that a zero value for num_fh is legal for STRIPE_SPARSE.
+         * Futher checking is done in filelayout_check_layout */
+        if (fl->num_fh < 0 || fl->num_fh >
+            max(NFS4_PNFS_MAX_STRIPE_CNT, NFS4_PNFS_MAX_MULTI_CNT))
                 goto out_err;
 
-        fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
-                               gfp_flags);
-        if (!fl->fh_array)
-                goto out_err;
+        if (fl->num_fh > 0) {
+                fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+                                       gfp_flags);
+                if (!fl->fh_array)
+                        goto out_err;
+        }
 
         for (i = 0; i < fl->num_fh; i++) {
                 /* Do we want to use a mempool here? */
@@ -661,8 +667,9 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
         u64 p_stripe, r_stripe;
         u32 stripe_unit;
 
-        if (!pnfs_generic_pg_test(pgio, prev, req))
-                return 0;
+        if (!pnfs_generic_pg_test(pgio, prev, req) ||
+            !nfs_generic_pg_test(pgio, prev, req))
+                return false;
 
         if (!pgio->pg_lseg)
                 return 1;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index d2c4b59c896d..5879b23e0c99 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2265,12 +2265,14 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
         return nfs4_map_errors(status);
 }
 
+static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr);
 /*
  * Get locations and (maybe) other attributes of a referral.
  * Note that we'll actually follow the referral later when
  * we detect fsid mismatch in inode revalidation
  */
-static int nfs4_get_referral(struct inode *dir, const struct qstr *name, struct nfs_fattr *fattr, struct nfs_fh *fhandle)
+static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
+                             struct nfs_fattr *fattr, struct nfs_fh *fhandle)
 {
         int status = -ENOMEM;
         struct page *page = NULL;
@@ -2288,15 +2290,16 @@ static int nfs4_get_referral(struct inode *dir, const struct qstr *name, struct
                 goto out;
         /* Make sure server returned a different fsid for the referral */
         if (nfs_fsid_equal(&NFS_SERVER(dir)->fsid, &locations->fattr.fsid)) {
-                dprintk("%s: server did not return a different fsid for a referral at %s\n", __func__, name->name);
+                dprintk("%s: server did not return a different fsid for"
+                        " a referral at %s\n", __func__, name->name);
                 status = -EIO;
                 goto out;
         }
+        /* Fixup attributes for the nfs_lookup() call to nfs_fhget() */
+        nfs_fixup_referral_attributes(&locations->fattr);
 
+        /* replace the lookup nfs_fattr with the locations nfs_fattr */
         memcpy(fattr, &locations->fattr, sizeof(struct nfs_fattr));
-        fattr->valid |= NFS_ATTR_FATTR_V4_REFERRAL;
-        if (!fattr->mode)
-                fattr->mode = S_IFDIR;
         memset(fhandle, 0, sizeof(struct nfs_fh));
 out:
         if (page)
@@ -4667,11 +4670,15 @@ static size_t nfs4_xattr_list_nfs4_acl(struct dentry *dentry, char *list,
         return len;
 }
 
+/*
+ * nfs_fhget will use either the mounted_on_fileid or the fileid
+ */
 static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr)
 {
-        if (!((fattr->valid & NFS_ATTR_FATTR_FILEID) &&
-                (fattr->valid & NFS_ATTR_FATTR_FSID) &&
-                (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
+        if (!(((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) ||
+               (fattr->valid & NFS_ATTR_FATTR_FILEID)) &&
+              (fattr->valid & NFS_ATTR_FATTR_FSID) &&
+              (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
                 return;
 
         fattr->valid |= NFS_ATTR_FATTR_TYPE | NFS_ATTR_FATTR_MODE |
@@ -4686,7 +4693,6 @@ int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
         struct nfs_server *server = NFS_SERVER(dir);
         u32 bitmask[2] = {
                 [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS,
-                [1] = FATTR4_WORD1_MOUNTED_ON_FILEID,
         };
         struct nfs4_fs_locations_arg args = {
                 .dir_fh = NFS_FH(dir),
@@ -4705,11 +4711,18 @@ int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
         int status;
 
         dprintk("%s: start\n", __func__);
+
+        /* Ask for the fileid of the absent filesystem if mounted_on_fileid
+         * is not supported */
+        if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
+                bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
+        else
+                bitmask[0] |= FATTR4_WORD0_FILEID;
+
         nfs_fattr_init(&fs_locations->fattr);
         fs_locations->server = server;
         fs_locations->nlocations = 0;
         status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 0);
-        nfs_fixup_referral_attributes(&fs_locations->fattr);
         dprintk("%s: returned status = %d\n", __func__, status);
         return status;
 }
@@ -5098,7 +5111,6 @@ static void nfs4_init_channel_attrs(struct nfs41_create_session_args *args)
         if (mxresp_sz == 0)
                 mxresp_sz = NFS_MAX_FILE_IO_SIZE;
         /* Fore channel attributes */
-        args->fc_attrs.headerpadsz = 0;
         args->fc_attrs.max_rqst_sz = mxrqst_sz;
         args->fc_attrs.max_resp_sz = mxresp_sz;
         args->fc_attrs.max_ops = NFS4_MAX_OPS;
@@ -5111,7 +5123,6 @@ static void nfs4_init_channel_attrs(struct nfs41_create_session_args *args)
                 args->fc_attrs.max_ops, args->fc_attrs.max_reqs);
 
         /* Back channel attributes */
-        args->bc_attrs.headerpadsz = 0;
         args->bc_attrs.max_rqst_sz = PAGE_SIZE;
         args->bc_attrs.max_resp_sz = PAGE_SIZE;
         args->bc_attrs.max_resp_sz_cached = 0;
@@ -5131,8 +5142,6 @@ static int nfs4_verify_fore_channel_attrs(struct nfs41_create_session_args *args
         struct nfs4_channel_attrs *sent = &args->fc_attrs;
         struct nfs4_channel_attrs *rcvd = &session->fc_attrs;
 
-        if (rcvd->headerpadsz > sent->headerpadsz)
-                return -EINVAL;
         if (rcvd->max_resp_sz > sent->max_resp_sz)
                 return -EINVAL;
         /*
@@ -5697,6 +5706,7 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
 {
         struct nfs4_layoutreturn *lrp = calldata;
         struct nfs_server *server;
+        struct pnfs_layout_hdr *lo = NFS_I(lrp->args.inode)->layout;
 
         dprintk("--> %s\n", __func__);
 
@@ -5708,16 +5718,15 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
                 nfs_restart_rpc(task, lrp->clp);
                 return;
         }
+        spin_lock(&lo->plh_inode->i_lock);
         if (task->tk_status == 0) {
-                struct pnfs_layout_hdr *lo = NFS_I(lrp->args.inode)->layout;
-
                 if (lrp->res.lrs_present) {
-                        spin_lock(&lo->plh_inode->i_lock);
                         pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
-                        spin_unlock(&lo->plh_inode->i_lock);
                 } else
                         BUG_ON(!list_empty(&lo->plh_segs));
         }
+        lo->plh_block_lgets--;
+        spin_unlock(&lo->plh_inode->i_lock);
         dprintk("<-- %s\n", __func__);
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index d869a5e5464b..6870bc61ceec 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -255,7 +255,7 @@ static int nfs4_stat_to_errno(int);
 #define decode_fs_locations_maxsz \
                                 (0)
 #define encode_secinfo_maxsz    (op_encode_hdr_maxsz + nfs4_name_maxsz)
-#define decode_secinfo_maxsz    (op_decode_hdr_maxsz + 4 + (NFS_MAX_SECFLAVORS * (16 + GSS_OID_MAX_LEN)))
+#define decode_secinfo_maxsz    (op_decode_hdr_maxsz + 1 + ((NFS_MAX_SECFLAVORS * (16 + GSS_OID_MAX_LEN)) / 4))
 
 #if defined(CONFIG_NFS_V4_1)
 #define NFS4_MAX_MACHINE_NAME_LEN (64)
@@ -1725,7 +1725,7 @@ static void encode_create_session(struct xdr_stream *xdr,
         *p++ = cpu_to_be32(args->flags);                        /*flags */
 
         /* Fore Channel */
-        *p++ = cpu_to_be32(args->fc_attrs.headerpadsz); /* header padding size */
+        *p++ = cpu_to_be32(0);                          /* header padding size */
         *p++ = cpu_to_be32(args->fc_attrs.max_rqst_sz); /* max req size */
         *p++ = cpu_to_be32(args->fc_attrs.max_resp_sz); /* max resp size */
         *p++ = cpu_to_be32(max_resp_sz_cached);         /* Max resp sz cached */
@@ -1734,7 +1734,7 @@ static void encode_create_session(struct xdr_stream *xdr,
         *p++ = cpu_to_be32(0);                          /* rdmachannel_attrs */
 
         /* Back Channel */
-        *p++ = cpu_to_be32(args->fc_attrs.headerpadsz); /* header padding size */
+        *p++ = cpu_to_be32(0);                          /* header padding size */
         *p++ = cpu_to_be32(args->bc_attrs.max_rqst_sz); /* max req size */
         *p++ = cpu_to_be32(args->bc_attrs.max_resp_sz); /* max resp size */
         *p++ = cpu_to_be32(args->bc_attrs.max_resp_sz_cached);  /* Max resp sz cached */
@@ -3098,7 +3098,7 @@ out_overflow:
         return -EIO;
 }
 
-static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap)
+static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap, int32_t *res)
 {
         __be32 *p;
 
@@ -3109,7 +3109,7 @@ static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap)
                 if (unlikely(!p))
                         goto out_overflow;
                 bitmap[0] &= ~FATTR4_WORD0_RDATTR_ERROR;
-                return -be32_to_cpup(p);
+                *res = -be32_to_cpup(p);
         }
         return 0;
 out_overflow:
@@ -4070,6 +4070,7 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
         int status;
         umode_t fmode = 0;
         uint32_t type;
+        int32_t err;
 
         status = decode_attr_type(xdr, bitmap, &type);
         if (status < 0)
@@ -4095,13 +4096,12 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
                 goto xdr_error;
         fattr->valid |= status;
 
-        status = decode_attr_error(xdr, bitmap);
-        if (status == -NFS4ERR_WRONGSEC) {
-                nfs_fixup_secinfo_attributes(fattr, fh);
-                status = 0;
-        }
+        err = 0;
+        status = decode_attr_error(xdr, bitmap, &err);
         if (status < 0)
                 goto xdr_error;
+        if (err == -NFS4ERR_WRONGSEC)
+                nfs_fixup_secinfo_attributes(fattr, fh);
 
         status = decode_attr_filehandle(xdr, bitmap, fh);
         if (status < 0)
@@ -4997,12 +4997,14 @@ static int decode_chan_attrs(struct xdr_stream *xdr,
                              struct nfs4_channel_attrs *attrs)
 {
         __be32 *p;
-        u32 nr_attrs;
+        u32 nr_attrs, val;
 
         p = xdr_inline_decode(xdr, 28);
         if (unlikely(!p))
                 goto out_overflow;
-        attrs->headerpadsz = be32_to_cpup(p++);
+        val = be32_to_cpup(p++);        /* headerpadsz */
+        if (val)
+                return -EINVAL;         /* no support for header padding yet */
         attrs->max_rqst_sz = be32_to_cpup(p++);
         attrs->max_resp_sz = be32_to_cpup(p++);
         attrs->max_resp_sz_cached = be32_to_cpup(p++);
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index 9cf208df1f25..8ff2ea3f10ef 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -108,7 +108,6 @@ _dev_list_add(const struct nfs_server *nfss,
                 de = n;
         }
 
-        atomic_inc(&de->id_node.ref);
         return de;
 }
 
@@ -1001,6 +1000,9 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
         if (!pnfs_generic_pg_test(pgio, prev, req))
                 return false;
 
+        if (pgio->pg_lseg == NULL)
+                return true;
+
         return pgio->pg_count + req->wb_bytes <=
                         OBJIO_LSEG(pgio->pg_lseg)->max_io_size;
 }
diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
index dc3956c0de80..1d06f8e2adea 100644
--- a/fs/nfs/objlayout/objlayout.c
+++ b/fs/nfs/objlayout/objlayout.c
@@ -291,7 +291,7 @@ objlayout_read_done(struct objlayout_io_state *state, ssize_t status, bool sync)
         struct nfs_read_data *rdata;
 
         state->status = status;
-        dprintk("%s: Begin status=%ld eof=%d\n", __func__, status, eof);
+        dprintk("%s: Begin status=%zd eof=%d\n", __func__, status, eof);
         rdata = state->rpcdata;
         rdata->task.tk_status = status;
         if (status >= 0) {
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 7913961aff22..009855716286 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -204,7 +204,7 @@ nfs_wait_on_request(struct nfs_page *req)
                         TASK_UNINTERRUPTIBLE);
 }
 
-static bool nfs_generic_pg_test(struct nfs_pageio_descriptor *desc, struct nfs_page *prev, struct nfs_page *req)
+bool nfs_generic_pg_test(struct nfs_pageio_descriptor *desc, struct nfs_page *prev, struct nfs_page *req)
 {
         /*
          * FIXME: ideally we should be able to coalesce all requests
@@ -218,6 +218,7 @@ static bool nfs_generic_pg_test(struct nfs_pageio_descriptor *desc, struct nfs_p
 
         return desc->pg_count + req->wb_bytes <= desc->pg_bsize;
 }
+EXPORT_SYMBOL_GPL(nfs_generic_pg_test);
 
 /**
  * nfs_pageio_init - initialise a page io descriptor
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 8c1309d852a6..29c0ca7fc347 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -634,14 +634,16 @@ _pnfs_return_layout(struct inode *ino)
 
         spin_lock(&ino->i_lock);
         lo = nfsi->layout;
-        if (!lo || !mark_matching_lsegs_invalid(lo, &tmp_list, NULL)) {
+        if (!lo) {
                 spin_unlock(&ino->i_lock);
-                dprintk("%s: no layout segments to return\n", __func__);
-                goto out;
+                dprintk("%s: no layout to return\n", __func__);
+                return status;
         }
         stateid = nfsi->layout->plh_stateid;
         /* Reference matched in nfs4_layoutreturn_release */
         get_layout_hdr(lo);
+        mark_matching_lsegs_invalid(lo, &tmp_list, NULL);
+        lo->plh_block_lgets++;
         spin_unlock(&ino->i_lock);
         pnfs_free_lseg_list(&tmp_list);
 
@@ -650,6 +652,9 @@ _pnfs_return_layout(struct inode *ino)
         lrp = kzalloc(sizeof(*lrp), GFP_KERNEL);
         if (unlikely(lrp == NULL)) {
                 status = -ENOMEM;
+                set_bit(NFS_LAYOUT_RW_FAILED, &lo->plh_flags);
+                set_bit(NFS_LAYOUT_RO_FAILED, &lo->plh_flags);
+                put_layout_hdr(lo);
                 goto out;
         }
 
@@ -887,7 +892,7 @@ pnfs_find_lseg(struct pnfs_layout_hdr *lo,
                         ret = get_lseg(lseg);
                         break;
                 }
-                if (cmp_layout(range, &lseg->pls_range) > 0)
+                if (lseg->pls_range.offset > range->offset)
                         break;
         }
 
@@ -1059,23 +1064,36 @@ pnfs_generic_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
                 gfp_flags = GFP_NOFS;
         }
 
-        if (pgio->pg_count == prev->wb_bytes) {
+        if (pgio->pg_lseg == NULL) {
+                if (pgio->pg_count != prev->wb_bytes)
+                        return true;
                 /* This is first coelesce call for a series of nfs_pages */
                 pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
                                                    prev->wb_context,
-                                                   req_offset(req),
+                                                   req_offset(prev),
                                                    pgio->pg_count,
                                                    access_type,
                                                    gfp_flags);
-                return true;
+                if (pgio->pg_lseg == NULL)
+                        return true;
         }
 
-        if (pgio->pg_lseg &&
-            req_offset(req) > end_offset(pgio->pg_lseg->pls_range.offset,
-                                         pgio->pg_lseg->pls_range.length))
-                return false;
-
-        return true;
+        /*
+         * Test if a nfs_page is fully contained in the pnfs_layout_range.
+         * Note that this test makes several assumptions:
+         * - that the previous nfs_page in the struct nfs_pageio_descriptor
+         *   is known to lie within the range.
+         *   - that the nfs_page being tested is known to be contiguous with the
+         *   previous nfs_page.
+         *   - Layout ranges are page aligned, so we only have to test the
+         *   start offset of the request.
+         *
+         * Please also note that 'end_offset' is actually the offset of the
+         * first byte that lies outside the pnfs_layout_range. FIXME?
+         *
+         */
+        return req_offset(req) < end_offset(pgio->pg_lseg->pls_range.offset,
+                                         pgio->pg_lseg->pls_range.length);
 }
 EXPORT_SYMBOL_GPL(pnfs_generic_pg_test);
 
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 48d0a8e4d062..96bf4e6f45be 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -186,6 +186,7 @@ int pnfs_ld_read_done(struct nfs_read_data *);
 /* pnfs_dev.c */
 struct nfs4_deviceid_node {
         struct hlist_node               node;
+        struct hlist_node               tmpnode;
         const struct pnfs_layoutdriver_type *ld;
         const struct nfs_client         *nfs_client;
         struct nfs4_deviceid            deviceid;
diff --git a/fs/nfs/pnfs_dev.c b/fs/nfs/pnfs_dev.c
index c65e133ce9c0..f0f8e1e22f6c 100644
--- a/fs/nfs/pnfs_dev.c
+++ b/fs/nfs/pnfs_dev.c
@@ -174,6 +174,7 @@ nfs4_init_deviceid_node(struct nfs4_deviceid_node *d,
                         const struct nfs4_deviceid *id)
 {
         INIT_HLIST_NODE(&d->node);
+        INIT_HLIST_NODE(&d->tmpnode);
         d->ld = ld;
         d->nfs_client = nfs_client;
         d->deviceid = *id;
@@ -208,6 +209,7 @@ nfs4_insert_deviceid_node(struct nfs4_deviceid_node *new)
 
         hlist_add_head_rcu(&new->node, &nfs4_deviceid_cache[hash]);
         spin_unlock(&nfs4_deviceid_lock);
+        atomic_inc(&new->ref);
 
         return new;
 }
@@ -238,24 +240,29 @@ static void
 _deviceid_purge_client(const struct nfs_client *clp, long hash)
 {
         struct nfs4_deviceid_node *d;
-        struct hlist_node *n, *next;
+        struct hlist_node *n;
         HLIST_HEAD(tmp);
 
+        spin_lock(&nfs4_deviceid_lock);
         rcu_read_lock();
         hlist_for_each_entry_rcu(d, n, &nfs4_deviceid_cache[hash], node)
                 if (d->nfs_client == clp && atomic_read(&d->ref)) {
                         hlist_del_init_rcu(&d->node);
-                        hlist_add_head(&d->node, &tmp);
+                        hlist_add_head(&d->tmpnode, &tmp);
                 }
         rcu_read_unlock();
+        spin_unlock(&nfs4_deviceid_lock);
 
         if (hlist_empty(&tmp))
                 return;
 
         synchronize_rcu();
-        hlist_for_each_entry_safe(d, n, next, &tmp, node)
+        while (!hlist_empty(&tmp)) {
+                d = hlist_entry(tmp.first, struct nfs4_deviceid_node, tmpnode);
+                hlist_del(&d->tmpnode);
                 if (atomic_dec_and_test(&d->ref))
                         d->ld->free_deviceid_node(d);
+        }
 }
 
 void
@@ -263,8 +270,8 @@ nfs4_deviceid_purge_client(const struct nfs_client *clp)
 {
         long h;
 
-        spin_lock(&nfs4_deviceid_lock);
+        if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_USE_PNFS_MDS))
+                return;
         for (h = 0; h < NFS4_DEVICE_ID_HASH_SIZE; h++)
                 _deviceid_purge_client(clp, h);
-        spin_unlock(&nfs4_deviceid_lock);
 }
diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
index 18b3e8975fe0..fbb2a5ef5817 100644
--- a/fs/nfsd/Kconfig
+++ b/fs/nfsd/Kconfig
@@ -82,6 +82,7 @@ config NFSD_V4
         select NFSD_V3
         select FS_POSIX_ACL
         select SUNRPC_GSS
+        select CRYPTO
         help
           This option enables support in your system's NFS server for
           version 4 of the NFS protocol (RFC 3530).
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 1f5eae40f34e..2b1449dd2f49 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -13,6 +13,7 @@
 #include <linux/lockd/lockd.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/gss_api.h>
+#include <linux/sunrpc/gss_krb5_enctypes.h>
 
 #include "idmap.h"
 #include "nfsd.h"
@@ -189,18 +190,10 @@ static struct file_operations export_features_operations = {
         .release        = single_release,
 };
 
-#ifdef CONFIG_SUNRPC_GSS
+#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
 static int supported_enctypes_show(struct seq_file *m, void *v)
 {
-        struct gss_api_mech *k5mech;
-
-        k5mech = gss_mech_get_by_name("krb5");
-        if (k5mech == NULL)
-                goto out;
-        if (k5mech->gm_upcall_enctypes != NULL)
-                seq_printf(m, k5mech->gm_upcall_enctypes);
-        gss_mech_put(k5mech);
-out:
+        seq_printf(m, KRB5_SUPPORTED_ENCTYPES);
         return 0;
 }
 
@@ -215,7 +208,7 @@ static struct file_operations supported_enctypes_ops = {
         .llseek         = seq_lseek,
         .release        = single_release,
 };
-#endif /* CONFIG_SUNRPC_GSS */
+#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
 
 extern int nfsd_pool_stats_open(struct inode *inode, struct file *file);
 extern int nfsd_pool_stats_release(struct inode *inode, struct file *file);
@@ -1427,9 +1420,9 @@ static int nfsd_fill_super(struct super_block * sb, void * data, int silent)
                 [NFSD_Versions] = {"versions", &transaction_ops, S_IWUSR|S_IRUSR},
                 [NFSD_Ports] = {"portlist", &transaction_ops, S_IWUSR|S_IRUGO},
                 [NFSD_MaxBlkSize] = {"max_block_size", &transaction_ops, S_IWUSR|S_IRUGO},
-#ifdef CONFIG_SUNRPC_GSS
+#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
                 [NFSD_SupportedEnctypes] = {"supported_krb5_enctypes", &supported_enctypes_ops, S_IRUGO},
-#endif /* CONFIG_SUNRPC_GSS */
+#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
 #ifdef CONFIG_NFSD_V4
                 [NFSD_Leasetime] = {"nfsv4leasetime", &transaction_ops, S_IWUSR|S_IRUSR},
                 [NFSD_Gracetime] = {"nfsv4gracetime", &transaction_ops, S_IWUSR|S_IRUSR},
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index d5718273bb32..fd0acca5370a 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -696,7 +696,15 @@ nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *suppor
 }
 #endif /* CONFIG_NFSD_V3 */
 
+static int nfsd_open_break_lease(struct inode *inode, int access)
+{
+        unsigned int mode;
 
+        if (access & NFSD_MAY_NOT_BREAK_LEASE)
+                return 0;
+        mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
+        return break_lease(inode, mode | O_NONBLOCK);
+}
 
 /*
  * Open an existing file or directory.
@@ -744,12 +752,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
         if (!inode->i_fop)
                 goto out;
 
-        /*
-         * Check to see if there are any leases on this file.
-         * This may block while leases are broken.
-         */
-        if (!(access & NFSD_MAY_NOT_BREAK_LEASE))
-                host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0));
+        host_err = nfsd_open_break_lease(inode, access);
         if (host_err) /* NOMEM or WOULDBLOCK */
                 goto out_nfserr;
 
@@ -1660,8 +1663,10 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
         if (!dold->d_inode)
                 goto out_drop_write;
         host_err = nfsd_break_lease(dold->d_inode);
-        if (host_err)
+        if (host_err) {
+                err = nfserrno(host_err);
                 goto out_drop_write;
+        }
         host_err = vfs_link(dold, dirp, dnew);
         if (!host_err) {
                 err = nfserrno(commit_metadata(ffhp));
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index b954878ad6ce..b9b45fc2903e 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -801,12 +801,7 @@ out_err:
 
 int nilfs_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        struct nilfs_root *root;
-
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-
-        root = NILFS_I(inode)->i_root;
+        struct nilfs_root *root = NILFS_I(inode)->i_root;
         if ((mask & MAY_WRITE) && root &&
             root->cno != NILFS_CPTREE_CURRENT_CNO)
                 return -EROFS; /* snapshot is not writable */
diff --git a/fs/omfs/file.c b/fs/omfs/file.c
index d738a7e493dd..2c6d95257a4d 100644
--- a/fs/omfs/file.c
+++ b/fs/omfs/file.c
@@ -4,7 +4,6 @@
  * Released under GPL v2.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 14def991d9dd..8a84210ca080 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2169,11 +2169,7 @@ static const struct file_operations proc_fd_operations = {
  */
 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        int rv;
-
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-        rv = generic_permission(inode, mask, flags, NULL);
+        int rv = generic_permission(inode, mask, flags, NULL);
         if (rv == 0)
                 return 0;
         if (task_pid(current) == proc_pid(inode))
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index f50133c11c24..d167de365a8d 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -304,9 +304,6 @@ static int proc_sys_permission(struct inode *inode, int mask,unsigned int flags)
         struct ctl_table *table;
         int error;
 
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-
         /* Executable files are not allowed under /proc/sys/ */
         if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))
                 return -EACCES;
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index e8a62f41b458..d78089690965 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -954,8 +954,6 @@ static int xattr_mount_check(struct super_block *s)
 
 int reiserfs_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
         /*
          * We don't do permission checks on the internal objects.
          * Permissions are determined by the "owning" object.
diff --git a/fs/timerfd.c b/fs/timerfd.c
index f67acbdda5e8..dffeb3795af1 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -61,7 +61,9 @@ static enum hrtimer_restart timerfd_tmrproc(struct hrtimer *htmr)
 
 /*
  * Called when the clock was set to cancel the timers in the cancel
- * list.
+ * list. This will wake up processes waiting on these timers. The
+ * wake-up requires ctx->ticks to be non zero, therefore we increment
+ * it before calling wake_up_locked().
  */
 void timerfd_clock_was_set(void)
 {
@@ -76,6 +78,7 @@ void timerfd_clock_was_set(void)
                 spin_lock_irqsave(&ctx->wqh.lock, flags);
                 if (ctx->moffs.tv64 != moffs.tv64) {
                         ctx->moffs.tv64 = KTIME_MAX;
+                        ctx->ticks++;
                         wake_up_locked(&ctx->wqh);
                 }
                 spin_unlock_irqrestore(&ctx->wqh.lock, flags);
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 8c892c2d5300..529be0582029 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -2146,6 +2146,7 @@ static struct dentry *ubifs_mount(struct file_system_type *fs_type, int flags,
         if (IS_ERR(sb)) {
                 err = PTR_ERR(sb);
                 kfree(c);
+                goto out_close;
         }
 
         if (sb->s_root) {
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index c86375378810..01d2072fb6d4 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -490,6 +490,13 @@ xfs_attr_remove_int(xfs_inode_t *dp, struct xfs_name *name, int flags)
         args.whichfork = XFS_ATTR_FORK;
 
         /*
+         * we have no control over the attribute names that userspace passes us
+         * to remove, so we have to allow the name lookup prior to attribute
+         * removal to fail.
+         */
+        args.op_flags = XFS_DA_OP_OKNOENT;
+
+        /*
          * Attach the dquots to the inode.
          */
         error = xfs_qm_dqattach(dp, 0);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index cb9b6d1469f7..3631783b2b53 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -253,16 +253,21 @@ xfs_iget_cache_hit(
                         rcu_read_lock();
                         spin_lock(&ip->i_flags_lock);
 
-                        ip->i_flags &= ~XFS_INEW;
-                        ip->i_flags |= XFS_IRECLAIMABLE;
-                        __xfs_inode_set_reclaim_tag(pag, ip);
+                        ip->i_flags &= ~(XFS_INEW | XFS_IRECLAIM);
+                        ASSERT(ip->i_flags & XFS_IRECLAIMABLE);
                         trace_xfs_iget_reclaim_fail(ip);
                         goto out_error;
                 }
 
                 spin_lock(&pag->pag_ici_lock);
                 spin_lock(&ip->i_flags_lock);
-                ip->i_flags &= ~(XFS_IRECLAIMABLE | XFS_IRECLAIM);
+
+                /*
+                 * Clear the per-lifetime state in the inode as we are now
+                 * effectively a new inode and need to return to the initial
+                 * state before reuse occurs.
+                 */
+                ip->i_flags &= ~XFS_IRECLAIM_RESET_FLAGS;
                 ip->i_flags |= XFS_INEW;
                 __xfs_inode_clear_reclaim_tag(mp, pag, ip);
                 inode->i_state = I_NEW;
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 3ae6d58e5473..964cfea77686 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -384,6 +384,16 @@ static inline void xfs_ifunlock(xfs_inode_t *ip)
 #define XFS_IDIRTY_RELEASE      0x0040  /* dirty release already seen */
 
 /*
+ * Per-lifetime flags need to be reset when re-using a reclaimable inode during
+ * inode lookup. Thi prevents unintended behaviour on the new inode from
+ * ocurring.
+ */
+#define XFS_IRECLAIM_RESET_FLAGS        \
+        (XFS_IRECLAIMABLE | XFS_IRECLAIM | \
+         XFS_IDIRTY_RELEASE | XFS_ITRUNCATED | \
+         XFS_IFILESTREAM);
+
+/*
  * Flags for inode locking.
  * Bit ranges:  1<<1  - 1<<16-1 -- iolock/ilock modes (bitfield)
  *              1<<16 - 1<<32-1 -- lockdep annotation (integers)
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index b7a5fe7c52c8..619720705bc6 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -960,8 +960,11 @@ xfs_release(
                  * be exposed to that problem.
                  */
                 truncated = xfs_iflags_test_and_clear(ip, XFS_ITRUNCATED);
-                if (truncated && VN_DIRTY(VFS_I(ip)) && ip->i_delayed_blks > 0)
-                        xfs_flush_pages(ip, 0, -1, XBF_ASYNC, FI_NONE);
+                if (truncated) {
+                        xfs_iflags_clear(ip, XFS_IDIRTY_RELEASE);
+                        if (VN_DIRTY(VFS_I(ip)) && ip->i_delayed_blks > 0)
+                                xfs_flush_pages(ip, 0, -1, XBF_ASYNC, FI_NONE);
+                }
         }
 
         if (ip->i_d.di_nlink == 0)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 2a7cea53ca0d..6395692b2e7a 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -167,7 +167,7 @@ enum rq_flag_bits {
         (REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT | REQ_FAILFAST_DRIVER)
 #define REQ_COMMON_MASK \
         (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_DISCARD | \
-         REQ_NOIDLE | REQ_FLUSH | REQ_FUA)
+         REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
 #define REQ_CLONE_MASK          REQ_COMMON_MASK
 
 #define REQ_RAHEAD              (1 << __REQ_RAHEAD)
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index b22fb0d3db0f..8c7c2de7631a 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -169,7 +169,8 @@ extern void blk_trace_shutdown(struct request_queue *);
 extern int do_blk_trace_setup(struct request_queue *q, char *name,
                               dev_t dev, struct block_device *bdev,
                               struct blk_user_trace_setup *buts);
-extern void __trace_note_message(struct blk_trace *, const char *fmt, ...);
+extern __attribute__((format(printf, 2, 3)))
+void __trace_note_message(struct blk_trace *, const char *fmt, ...);
 
 /**
  * blk_add_trace_msg - Add a (simple) message to the blktrace stream
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index d4646b48dc4a..18a1baf31f2d 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -188,6 +188,7 @@ struct clocksource {
 #ifdef CONFIG_CLOCKSOURCE_WATCHDOG
         /* Watchdog related data, used by the framework */
         struct list_head wd_list;
+        cycle_t cs_last;
         cycle_t wd_last;
 #endif
 } ____cacheline_aligned;
diff --git a/include/linux/device.h b/include/linux/device.h
index c66111affca9..553fd37b173b 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -654,13 +654,13 @@ static inline int device_is_registered(struct device *dev)
 
 static inline void device_enable_async_suspend(struct device *dev)
 {
-        if (!dev->power.in_suspend)
+        if (!dev->power.is_prepared)
                 dev->power.async_suspend = true;
 }
 
 static inline void device_disable_async_suspend(struct device *dev)
 {
-        if (!dev->power.in_suspend)
+        if (!dev->power.is_prepared)
                 dev->power.async_suspend = false;
 }
 
diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h
index 0b0d9c39ed67..7aad1f440867 100644
--- a/include/linux/device_cgroup.h
+++ b/include/linux/device_cgroup.h
@@ -2,8 +2,16 @@
 #include <linux/fs.h>
 
 #ifdef CONFIG_CGROUP_DEVICE
-extern int devcgroup_inode_permission(struct inode *inode, int mask);
+extern int __devcgroup_inode_permission(struct inode *inode, int mask);
 extern int devcgroup_inode_mknod(int mode, dev_t dev);
+static inline int devcgroup_inode_permission(struct inode *inode, int mask)
+{
+        if (likely(!inode->i_rdev))
+                return 0;
+        if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
+                return 0;
+        return __devcgroup_inode_permission(inode, mask);
+}
 #else
 static inline int devcgroup_inode_permission(struct inode *inode, int mask)
 { return 0; }
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 1c777878f1ea..6e73e2e9ae33 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -744,7 +744,7 @@ struct inode {
 
         spinlock_t              i_lock; /* i_blocks, i_bytes, maybe i_size */
         unsigned int            i_flags;
-        unsigned int            i_state;
+        unsigned long           i_state;
 #ifdef CONFIG_SECURITY
         void                    *i_security;
 #endif
diff --git a/include/linux/input/sh_keysc.h b/include/linux/input/sh_keysc.h
index 649dc7f12925..5d253cd93691 100644
--- a/include/linux/input/sh_keysc.h
+++ b/include/linux/input/sh_keysc.h
@@ -1,7 +1,7 @@
 #ifndef __SH_KEYSC_H__
 #define __SH_KEYSC_H__
 
-#define SH_KEYSC_MAXKEYS 49
+#define SH_KEYSC_MAXKEYS 64
 
 struct sh_keysc_info {
         enum { SH_KEYSC_MODE_1, SH_KEYSC_MODE_2, SH_KEYSC_MODE_3,
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 6c12989839d9..f6efed0039ed 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -414,6 +414,7 @@ enum
         TASKLET_SOFTIRQ,
         SCHED_SOFTIRQ,
         HRTIMER_SOFTIRQ,
+        RCU_SOFTIRQ,    /* Preferable RCU should always be the last softirq */
 
         NR_SOFTIRQS
 };
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 4ecb7b16b278..d087c2e7b2aa 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1024,7 +1024,6 @@ struct journal_s
 
 /* Filing buffers */
 extern void jbd2_journal_unfile_buffer(journal_t *, struct journal_head *);
-extern void __jbd2_journal_unfile_buffer(struct journal_head *);
 extern void __jbd2_journal_refile_buffer(struct journal_head *);
 extern void jbd2_journal_refile_buffer(journal_t *, struct journal_head *);
 extern void __jbd2_journal_file_buffer(struct journal_head *, transaction_t *, int);
@@ -1165,7 +1164,6 @@ extern void	   jbd2_journal_release_jbd_inode(journal_t *journal, struct jbd2_in
  */
 struct journal_head *jbd2_journal_add_journal_head(struct buffer_head *bh);
 struct journal_head *jbd2_journal_grab_journal_head(struct buffer_head *bh);
-void jbd2_journal_remove_journal_head(struct buffer_head *bh);
 void jbd2_journal_put_journal_head(struct journal_head *jh);
 
 /*
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index c928dac6cad0..9f7c3ebcbbad 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -647,6 +647,13 @@ typedef struct pglist_data {
 #endif
 #define nid_page_nr(nid, pagenr)        pgdat_page_nr(NODE_DATA(nid),(pagenr))
 
+#define node_start_pfn(nid)     (NODE_DATA(nid)->node_start_pfn)
+
+#define node_end_pfn(nid) ({\
+        pg_data_t *__pgdat = NODE_DATA(nid);\
+        __pgdat->node_start_pfn + __pgdat->node_spanned_pages;\
+})
+
 #include <linux/memory_hotplug.h>
 
 extern struct mutex zonelists_mutex;
diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
index 3a34e80ae92f..25311b3bedf8 100644
--- a/include/linux/nfs_page.h
+++ b/include/linux/nfs_page.h
@@ -92,6 +92,9 @@ extern	int nfs_pageio_add_request(struct nfs_pageio_descriptor *,
                                    struct nfs_page *);
 extern  void nfs_pageio_complete(struct nfs_pageio_descriptor *desc);
 extern  void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *, pgoff_t);
+extern bool nfs_generic_pg_test(struct nfs_pageio_descriptor *desc,
+                                struct nfs_page *prev,
+                                struct nfs_page *req);
 extern  int nfs_wait_on_request(struct nfs_page *);
 extern  void nfs_unlock_request(struct nfs_page *req);
 extern  int nfs_set_page_tag_locked(struct nfs_page *req);
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 5e8444a11adf..00848d86ffb2 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -158,7 +158,6 @@ struct nfs_seqid;
 
 /* nfs41 sessions channel attributes */
 struct nfs4_channel_attrs {
-        u32                     headerpadsz;
         u32                     max_rqst_sz;
         u32                     max_resp_sz;
         u32                     max_resp_sz_cached;
diff --git a/include/linux/pm.h b/include/linux/pm.h
index 3160648ccdda..411e4f4be52b 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -425,7 +425,8 @@ struct dev_pm_info {
         pm_message_t            power_state;
         unsigned int            can_wakeup:1;
         unsigned int            async_suspend:1;
-        unsigned int            in_suspend:1;   /* Owned by the PM core */
+        bool                    is_prepared:1;  /* Owned by the PM core */
+        bool                    is_suspended:1; /* Ditto */
         spinlock_t              lock;
 #ifdef CONFIG_PM_SLEEP
         struct list_head        entry;
diff --git a/include/linux/smp.h b/include/linux/smp.h
index 7ad824d510a2..8cc38d3bab0c 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -85,12 +85,15 @@ int smp_call_function_any(const struct cpumask *mask,
  * Generic and arch helpers
  */
 #ifdef CONFIG_USE_GENERIC_SMP_HELPERS
+void __init call_function_init(void);
 void generic_smp_call_function_single_interrupt(void);
 void generic_smp_call_function_interrupt(void);
 void ipi_call_lock(void);
 void ipi_call_unlock(void);
 void ipi_call_lock_irq(void);
 void ipi_call_unlock_irq(void);
+#else
+static inline void call_function_init(void) { }
 #endif
 
 /*
@@ -134,7 +137,7 @@ static inline void smp_send_reschedule(int cpu) { }
 #define smp_prepare_boot_cpu()                  do {} while (0)
 #define smp_call_function_many(mask, func, info, wait) \
                         (up_smp_call_function(func, info))
-static inline void init_call_single_data(void) { }
+static inline void call_function_init(void) { }
 
 static inline int
 smp_call_function_any(const struct cpumask *mask, smp_call_func_t func,
diff --git a/include/linux/sunrpc/gss_krb5_enctypes.h b/include/linux/sunrpc/gss_krb5_enctypes.h
new file mode 100644
index 000000000000..ec6234eee89c
--- /dev/null
+++ b/include/linux/sunrpc/gss_krb5_enctypes.h
@@ -0,0 +1,4 @@
+/*
+ * Dumb way to share this static piece of information with nfsd
+ */
+#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23,3,1,2"
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index f73c482ec9c6..fe2d8e6b923b 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -84,7 +84,8 @@ struct rpc_task {
 #endif
         unsigned char           tk_priority : 2,/* Task priority */
                                 tk_garb_retry : 2,
-                                tk_cred_retry : 2;
+                                tk_cred_retry : 2,
+                                tk_rebind_retry : 2;
 };
 #define tk_xprt                 tk_client->cl_xprt
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index c7c42e7acc31..5d4f8e586e32 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -307,6 +307,12 @@ static inline int nf_ct_is_untracked(const struct nf_conn *ct)
         return test_bit(IPS_UNTRACKED_BIT, &ct->status);
 }
 
+/* Packet is received from loopback */
+static inline bool nf_is_loopback_packet(const struct sk_buff *skb)
+{
+        return skb->dev && skb->skb_iif && skb->dev->flags & IFF_LOOPBACK;
+}
+
 extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
 extern unsigned int nf_conntrack_htable_size;
 extern unsigned int nf_conntrack_max;
diff --git a/include/sound/soc.h b/include/sound/soc.h
index f1de3e0c75bc..3a4bd3a3c68d 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -248,8 +248,7 @@ typedef int (*hw_write_t)(void *,const char* ,int);
 extern struct snd_ac97_bus_ops soc_ac97_ops;
 
 enum snd_soc_control_type {
-        SND_SOC_CUSTOM = 1,
-        SND_SOC_I2C,
+        SND_SOC_I2C = 1,
         SND_SOC_SPI,
 };
 
diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
index e09592d2f916..5ce2b2f5f524 100644
--- a/include/trace/events/ext4.h
+++ b/include/trace/events/ext4.h
@@ -26,7 +26,7 @@ TRACE_EVENT(ext4_free_inode,
                 __field(        umode_t, mode                   )
                 __field(        uid_t,  uid                     )
                 __field(        gid_t,  gid                     )
-                __field(        blkcnt_t, blocks                )
+                __field(        __u64, blocks                   )
         ),
 
         TP_fast_assign(
@@ -40,9 +40,8 @@ TRACE_EVENT(ext4_free_inode,
 
         TP_printk("dev %d,%d ino %lu mode 0%o uid %u gid %u blocks %llu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
-                  (unsigned long) __entry->ino,
-                  __entry->mode, __entry->uid, __entry->gid,
-                  (unsigned long long) __entry->blocks)
+                  (unsigned long) __entry->ino, __entry->mode,
+                  __entry->uid, __entry->gid, __entry->blocks)
 );
 
 TRACE_EVENT(ext4_request_inode,
@@ -178,7 +177,7 @@ TRACE_EVENT(ext4_begin_ordered_truncate,
         TP_printk("dev %d,%d ino %lu new_size %lld",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  (long long) __entry->new_size)
+                  __entry->new_size)
 );
 
 DECLARE_EVENT_CLASS(ext4__write_begin,
@@ -204,7 +203,7 @@ DECLARE_EVENT_CLASS(ext4__write_begin,
                 __entry->flags  = flags;
         ),
 
-        TP_printk("dev %d,%d ino %lu pos %llu len %u flags %u",
+        TP_printk("dev %d,%d ino %lu pos %lld len %u flags %u",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
                   __entry->pos, __entry->len, __entry->flags)
@@ -248,7 +247,7 @@ DECLARE_EVENT_CLASS(ext4__write_end,
                 __entry->copied = copied;
         ),
 
-        TP_printk("dev %d,%d ino %lu pos %llu len %u copied %u",
+        TP_printk("dev %d,%d ino %lu pos %lld len %u copied %u",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
                   __entry->pos, __entry->len, __entry->copied)
@@ -286,29 +285,6 @@ DEFINE_EVENT(ext4__write_end, ext4_da_write_end,
         TP_ARGS(inode, pos, len, copied)
 );
 
-TRACE_EVENT(ext4_writepage,
-        TP_PROTO(struct inode *inode, struct page *page),
-
-        TP_ARGS(inode, page),
-
-        TP_STRUCT__entry(
-                __field(        dev_t,  dev                     )
-                __field(        ino_t,  ino                     )
-                __field(        pgoff_t, index                  )
-
-        ),
-
-        TP_fast_assign(
-                __entry->dev    = inode->i_sb->s_dev;
-                __entry->ino    = inode->i_ino;
-                __entry->index  = page->index;
-        ),
-
-        TP_printk("dev %d,%d ino %lu page_index %lu",
-                  MAJOR(__entry->dev), MINOR(__entry->dev),
-                  (unsigned long) __entry->ino, __entry->index)
-);
-
 TRACE_EVENT(ext4_da_writepages,
         TP_PROTO(struct inode *inode, struct writeback_control *wbc),
 
@@ -341,7 +317,7 @@ TRACE_EVENT(ext4_da_writepages,
         ),
 
         TP_printk("dev %d,%d ino %lu nr_to_write %ld pages_skipped %ld "
-                  "range_start %llu range_end %llu sync_mode %d"
+                  "range_start %lld range_end %lld sync_mode %d"
                   "for_kupdate %d range_cyclic %d writeback_index %lu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino, __entry->nr_to_write,
@@ -449,7 +425,14 @@ DECLARE_EVENT_CLASS(ext4__page_op,
         TP_printk("dev %d,%d ino %lu page_index %lu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  __entry->index)
+                  (unsigned long) __entry->index)
+);
+
+DEFINE_EVENT(ext4__page_op, ext4_writepage,
+
+        TP_PROTO(struct page *page),
+
+        TP_ARGS(page)
 );
 
 DEFINE_EVENT(ext4__page_op, ext4_readpage,
@@ -489,7 +472,7 @@ TRACE_EVENT(ext4_invalidatepage,
         TP_printk("dev %d,%d ino %lu page_index %lu offset %lu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  __entry->index, __entry->offset)
+                  (unsigned long) __entry->index, __entry->offset)
 );
 
 TRACE_EVENT(ext4_discard_blocks,
@@ -562,12 +545,10 @@ DEFINE_EVENT(ext4__mb_new_pa, ext4_mb_new_group_pa,
 );
 
 TRACE_EVENT(ext4_mb_release_inode_pa,
-        TP_PROTO(struct super_block *sb,
-                 struct inode *inode,
-                 struct ext4_prealloc_space *pa,
+        TP_PROTO(struct ext4_prealloc_space *pa,
                  unsigned long long block, unsigned int count),
 
-        TP_ARGS(sb, inode, pa, block, count),
+        TP_ARGS(pa, block, count),
 
         TP_STRUCT__entry(
                 __field(        dev_t,  dev                     )
@@ -578,8 +559,8 @@ TRACE_EVENT(ext4_mb_release_inode_pa,
         ),
 
         TP_fast_assign(
-                __entry->dev            = sb->s_dev;
-                __entry->ino            = inode->i_ino;
+                __entry->dev            = pa->pa_inode->i_sb->s_dev;
+                __entry->ino            = pa->pa_inode->i_ino;
                 __entry->block          = block;
                 __entry->count          = count;
         ),
@@ -591,10 +572,9 @@ TRACE_EVENT(ext4_mb_release_inode_pa,
 );
 
 TRACE_EVENT(ext4_mb_release_group_pa,
-        TP_PROTO(struct super_block *sb,
-                 struct ext4_prealloc_space *pa),
+        TP_PROTO(struct ext4_prealloc_space *pa),
 
-        TP_ARGS(sb, pa),
+        TP_ARGS(pa),
 
         TP_STRUCT__entry(
                 __field(        dev_t,  dev                     )
@@ -604,7 +584,7 @@ TRACE_EVENT(ext4_mb_release_group_pa,
         ),
 
         TP_fast_assign(
-                __entry->dev            = sb->s_dev;
+                __entry->dev            = pa->pa_inode->i_sb->s_dev;
                 __entry->pa_pstart      = pa->pa_pstart;
                 __entry->pa_len         = pa->pa_len;
         ),
@@ -666,10 +646,10 @@ TRACE_EVENT(ext4_request_blocks,
                 __field(        ino_t,  ino                     )
                 __field(        unsigned int, flags             )
                 __field(        unsigned int, len               )
-                __field(        __u64,  logical                 )
+                __field(        __u32,  logical                 )
+                __field(        __u32,  lleft                   )
+                __field(        __u32,  lright                  )
                 __field(        __u64,  goal                    )
-                __field(        __u64,  lleft                   )
-                __field(        __u64,  lright                  )
                 __field(        __u64,  pleft                   )
                 __field(        __u64,  pright                  )
         ),
@@ -687,17 +667,13 @@ TRACE_EVENT(ext4_request_blocks,
                 __entry->pright = ar->pright;
         ),
 
-        TP_printk("dev %d,%d ino %lu flags %u len %u lblk %llu goal %llu "
-                  "lleft %llu lright %llu pleft %llu pright %llu ",
+        TP_printk("dev %d,%d ino %lu flags %u len %u lblk %u goal %llu "
+                  "lleft %u lright %u pleft %llu pright %llu ",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
-                  (unsigned long) __entry->ino,
-                  __entry->flags, __entry->len,
-                  (unsigned long long) __entry->logical,
-                  (unsigned long long) __entry->goal,
-                  (unsigned long long) __entry->lleft,
-                  (unsigned long long) __entry->lright,
-                  (unsigned long long) __entry->pleft,
-                  (unsigned long long) __entry->pright)
+                  (unsigned long) __entry->ino, __entry->flags,
+                  __entry->len, __entry->logical, __entry->goal,
+                  __entry->lleft, __entry->lright, __entry->pleft,
+                  __entry->pright)
 );
 
 TRACE_EVENT(ext4_allocate_blocks,
@@ -711,10 +687,10 @@ TRACE_EVENT(ext4_allocate_blocks,
                 __field(        __u64,  block                   )
                 __field(        unsigned int, flags             )
                 __field(        unsigned int, len               )
-                __field(        __u64,  logical                 )
+                __field(        __u32,  logical                 )
+                __field(        __u32,  lleft                   )
+                __field(        __u32,  lright                  )
                 __field(        __u64,  goal                    )
-                __field(        __u64,  lleft                   )
-                __field(        __u64,  lright                  )
                 __field(        __u64,  pleft                   )
                 __field(        __u64,  pright                  )
         ),
@@ -733,17 +709,13 @@ TRACE_EVENT(ext4_allocate_blocks,
                 __entry->pright = ar->pright;
         ),
 
-        TP_printk("dev %d,%d ino %lu flags %u len %u block %llu lblk %llu "
-                  "goal %llu lleft %llu lright %llu pleft %llu pright %llu",
+        TP_printk("dev %d,%d ino %lu flags %u len %u block %llu lblk %u "
+                  "goal %llu lleft %u lright %u pleft %llu pright %llu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
-                  (unsigned long) __entry->ino,
-                  __entry->flags, __entry->len, __entry->block,
-                  (unsigned long long) __entry->logical,
-                  (unsigned long long) __entry->goal,
-                  (unsigned long long) __entry->lleft,
-                  (unsigned long long) __entry->lright,
-                  (unsigned long long) __entry->pleft,
-                  (unsigned long long) __entry->pright)
+                  (unsigned long) __entry->ino, __entry->flags,
+                  __entry->len, __entry->block, __entry->logical,
+                  __entry->goal,  __entry->lleft, __entry->lright,
+                  __entry->pleft, __entry->pright)
 );
 
 TRACE_EVENT(ext4_free_blocks,
@@ -755,10 +727,10 @@ TRACE_EVENT(ext4_free_blocks,
         TP_STRUCT__entry(
                 __field(        dev_t,  dev                     )
                 __field(        ino_t,  ino                     )
-                __field(      umode_t, mode                     )
+                __field(        umode_t, mode                   )
                 __field(        __u64,  block                   )
                 __field(        unsigned long,  count           )
-                __field(         int,   flags                   )
+                __field(        int,    flags                   )
         ),
 
         TP_fast_assign(
@@ -798,7 +770,7 @@ TRACE_EVENT(ext4_sync_file_enter,
                 __entry->parent         = dentry->d_parent->d_inode->i_ino;
         ),
 
-        TP_printk("dev %d,%d ino %ld parent %ld datasync %d ",
+        TP_printk("dev %d,%d ino %lu parent %lu datasync %d ",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
                   (unsigned long) __entry->parent, __entry->datasync)
@@ -821,7 +793,7 @@ TRACE_EVENT(ext4_sync_file_exit,
                 __entry->dev            = inode->i_sb->s_dev;
         ),
 
-        TP_printk("dev %d,%d ino %ld ret %d",
+        TP_printk("dev %d,%d ino %lu ret %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
                   __entry->ret)
@@ -1005,7 +977,7 @@ DECLARE_EVENT_CLASS(ext4__mballoc,
                 __entry->result_len     = len;
         ),
 
-        TP_printk("dev %d,%d inode %lu extent %u/%d/%u ",
+        TP_printk("dev %d,%d inode %lu extent %u/%d/%d ",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
                   __entry->result_group, __entry->result_start,
@@ -1093,7 +1065,7 @@ TRACE_EVENT(ext4_da_update_reserve_space,
                   "allocated_meta_blocks %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  __entry->mode,  (unsigned long long) __entry->i_blocks,
+                  __entry->mode, __entry->i_blocks,
                   __entry->used_blocks, __entry->reserved_data_blocks,
                   __entry->reserved_meta_blocks, __entry->allocated_meta_blocks)
 );
@@ -1127,7 +1099,7 @@ TRACE_EVENT(ext4_da_reserve_space,
                   "reserved_data_blocks %d reserved_meta_blocks %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  __entry->mode, (unsigned long long) __entry->i_blocks,
+                  __entry->mode, __entry->i_blocks,
                   __entry->md_needed, __entry->reserved_data_blocks,
                   __entry->reserved_meta_blocks)
 );
@@ -1164,7 +1136,7 @@ TRACE_EVENT(ext4_da_release_space,
                   "allocated_meta_blocks %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  __entry->mode, (unsigned long long) __entry->i_blocks,
+                  __entry->mode, __entry->i_blocks,
                   __entry->freed_blocks, __entry->reserved_data_blocks,
                   __entry->reserved_meta_blocks, __entry->allocated_meta_blocks)
 );
@@ -1239,14 +1211,15 @@ TRACE_EVENT(ext4_direct_IO_enter,
                 __entry->rw     = rw;
         ),
 
-        TP_printk("dev %d,%d ino %lu pos %llu len %lu rw %d",
+        TP_printk("dev %d,%d ino %lu pos %lld len %lu rw %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  (unsigned long long) __entry->pos, __entry->len, __entry->rw)
+                  __entry->pos, __entry->len, __entry->rw)
 );
 
 TRACE_EVENT(ext4_direct_IO_exit,
-        TP_PROTO(struct inode *inode, loff_t offset, unsigned long len, int rw, int ret),
+        TP_PROTO(struct inode *inode, loff_t offset, unsigned long len,
+                 int rw, int ret),
 
         TP_ARGS(inode, offset, len, rw, ret),
 
@@ -1268,10 +1241,10 @@ TRACE_EVENT(ext4_direct_IO_exit,
                 __entry->ret    = ret;
         ),
 
-        TP_printk("dev %d,%d ino %lu pos %llu len %lu rw %d ret %d",
+        TP_printk("dev %d,%d ino %lu pos %lld len %lu rw %d ret %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  (unsigned long long) __entry->pos, __entry->len,
+                  __entry->pos, __entry->len,
                   __entry->rw, __entry->ret)
 );
 
@@ -1296,15 +1269,15 @@ TRACE_EVENT(ext4_fallocate_enter,
                 __entry->mode   = mode;
         ),
 
-        TP_printk("dev %d,%d ino %ld pos %llu len %llu mode %d",
+        TP_printk("dev %d,%d ino %lu pos %lld len %lld mode %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
-                  (unsigned long) __entry->ino,
-                  (unsigned long long) __entry->pos,
-                  (unsigned long long) __entry->len, __entry->mode)
+                  (unsigned long) __entry->ino, __entry->pos,
+                  __entry->len, __entry->mode)
 );
 
 TRACE_EVENT(ext4_fallocate_exit,
-        TP_PROTO(struct inode *inode, loff_t offset, unsigned int max_blocks, int ret),
+        TP_PROTO(struct inode *inode, loff_t offset,
+                 unsigned int max_blocks, int ret),
 
         TP_ARGS(inode, offset, max_blocks, ret),
 
@@ -1312,7 +1285,7 @@ TRACE_EVENT(ext4_fallocate_exit,
                 __field(        ino_t,  ino                     )
                 __field(        dev_t,  dev                     )
                 __field(        loff_t, pos                     )
-                __field(        unsigned,       blocks          )
+                __field(        unsigned int,   blocks          )
                 __field(        int,    ret                     )
         ),
 
@@ -1324,10 +1297,10 @@ TRACE_EVENT(ext4_fallocate_exit,
                 __entry->ret    = ret;
         ),
 
-        TP_printk("dev %d,%d ino %ld pos %llu blocks %d ret %d",
+        TP_printk("dev %d,%d ino %lu pos %lld blocks %u ret %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  (unsigned long long) __entry->pos, __entry->blocks,
+                  __entry->pos, __entry->blocks,
                   __entry->ret)
 );
 
@@ -1350,7 +1323,7 @@ TRACE_EVENT(ext4_unlink_enter,
                 __entry->dev            = dentry->d_inode->i_sb->s_dev;
         ),
 
-        TP_printk("dev %d,%d ino %ld size %lld parent %ld",
+        TP_printk("dev %d,%d ino %lu size %lld parent %lu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino, __entry->size,
                   (unsigned long) __entry->parent)
@@ -1373,7 +1346,7 @@ TRACE_EVENT(ext4_unlink_exit,
                 __entry->ret            = ret;
         ),
 
-        TP_printk("dev %d,%d ino %ld ret %d",
+        TP_printk("dev %d,%d ino %lu ret %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
                   __entry->ret)
@@ -1387,7 +1360,7 @@ DECLARE_EVENT_CLASS(ext4__truncate,
         TP_STRUCT__entry(
                 __field(        ino_t,          ino             )
                 __field(        dev_t,          dev             )
-                __field(        blkcnt_t,       blocks          )
+                __field(        __u64,          blocks          )
         ),
 
         TP_fast_assign(
@@ -1396,9 +1369,9 @@ DECLARE_EVENT_CLASS(ext4__truncate,
                 __entry->blocks = inode->i_blocks;
         ),
 
-        TP_printk("dev %d,%d ino %lu blocks %lu",
+        TP_printk("dev %d,%d ino %lu blocks %llu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
-                  (unsigned long) __entry->ino, (unsigned long) __entry->blocks)
+                  (unsigned long) __entry->ino, __entry->blocks)
 );
 
 DEFINE_EVENT(ext4__truncate, ext4_truncate_enter,
@@ -1417,7 +1390,7 @@ DEFINE_EVENT(ext4__truncate, ext4_truncate_exit,
 
 DECLARE_EVENT_CLASS(ext4__map_blocks_enter,
         TP_PROTO(struct inode *inode, ext4_lblk_t lblk,
-                 unsigned len, unsigned flags),
+                 unsigned int len, unsigned int flags),
 
         TP_ARGS(inode, lblk, len, flags),
 
@@ -1425,8 +1398,8 @@ DECLARE_EVENT_CLASS(ext4__map_blocks_enter,
                 __field(        ino_t,          ino             )
                 __field(        dev_t,          dev             )
                 __field(        ext4_lblk_t,    lblk            )
-                __field(        unsigned,       len             )
-                __field(        unsigned,       flags           )
+                __field(        unsigned int,   len             )
+                __field(        unsigned int,   flags           )
         ),
 
         TP_fast_assign(
@@ -1440,7 +1413,7 @@ DECLARE_EVENT_CLASS(ext4__map_blocks_enter,
         TP_printk("dev %d,%d ino %lu lblk %u len %u flags %u",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  (unsigned) __entry->lblk, __entry->len, __entry->flags)
+                  __entry->lblk, __entry->len, __entry->flags)
 );
 
 DEFINE_EVENT(ext4__map_blocks_enter, ext4_ext_map_blocks_enter,
@@ -1459,7 +1432,7 @@ DEFINE_EVENT(ext4__map_blocks_enter, ext4_ind_map_blocks_enter,
 
 DECLARE_EVENT_CLASS(ext4__map_blocks_exit,
         TP_PROTO(struct inode *inode, ext4_lblk_t lblk,
-                 ext4_fsblk_t pblk, unsigned len, int ret),
+                 ext4_fsblk_t pblk, unsigned int len, int ret),
 
         TP_ARGS(inode, lblk, pblk, len, ret),
 
@@ -1468,7 +1441,7 @@ DECLARE_EVENT_CLASS(ext4__map_blocks_exit,
                 __field(        dev_t,          dev             )
                 __field(        ext4_lblk_t,    lblk            )
                 __field(        ext4_fsblk_t,   pblk            )
-                __field(        unsigned,       len             )
+                __field(        unsigned int,   len             )
                 __field(        int,            ret             )
         ),
 
@@ -1484,7 +1457,7 @@ DECLARE_EVENT_CLASS(ext4__map_blocks_exit,
         TP_printk("dev %d,%d ino %lu lblk %u pblk %llu len %u ret %d",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  (unsigned) __entry->lblk, (unsigned long long) __entry->pblk,
+                  __entry->lblk, __entry->pblk,
                   __entry->len, __entry->ret)
 );
 
@@ -1524,7 +1497,7 @@ TRACE_EVENT(ext4_ext_load_extent,
         TP_printk("dev %d,%d ino %lu lblk %u pblk %llu",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   (unsigned long) __entry->ino,
-                  (unsigned) __entry->lblk, (unsigned long long) __entry->pblk)
+                  __entry->lblk, __entry->pblk)
 );
 
 TRACE_EVENT(ext4_load_inode,
diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
index ae045ca7d356..1c09820df585 100644
--- a/include/trace/events/irq.h
+++ b/include/trace/events/irq.h
@@ -20,7 +20,8 @@ struct softirq_action;
                          softirq_name(BLOCK_IOPOLL),    \
                          softirq_name(TASKLET),         \
                          softirq_name(SCHED),           \
-                         softirq_name(HRTIMER))
+                         softirq_name(HRTIMER),         \
+                         softirq_name(RCU))
 
 /**
  * irq_handler_entry - called immediately before the irq action handler
diff --git a/init/calibrate.c b/init/calibrate.c
index 2568d22a304e..aae2f40fea4c 100644
--- a/init/calibrate.c
+++ b/init/calibrate.c
@@ -245,30 +245,32 @@ recalibrate:
 
 void __cpuinit calibrate_delay(void)
 {
+        unsigned long lpj;
         static bool printed;
 
         if (preset_lpj) {
-                loops_per_jiffy = preset_lpj;
+                lpj = preset_lpj;
                 if (!printed)
                         pr_info("Calibrating delay loop (skipped) "
                                 "preset value.. ");
         } else if ((!printed) && lpj_fine) {
-                loops_per_jiffy = lpj_fine;
+                lpj = lpj_fine;
                 pr_info("Calibrating delay loop (skipped), "
                         "value calculated using timer frequency.. ");
-        } else if ((loops_per_jiffy = calibrate_delay_direct()) != 0) {
+        } else if ((lpj = calibrate_delay_direct()) != 0) {
                 if (!printed)
                         pr_info("Calibrating delay using timer "
                                 "specific routine.. ");
         } else {
                 if (!printed)
                         pr_info("Calibrating delay loop... ");
-                loops_per_jiffy = calibrate_delay_converge();
+                lpj = calibrate_delay_converge();
         }
         if (!printed)
                 pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n",
-                        loops_per_jiffy/(500000/HZ),
-                        (loops_per_jiffy/(5000/HZ)) % 100, loops_per_jiffy);
+                        lpj/(500000/HZ),
+                        (lpj/(5000/HZ)) % 100, lpj);
 
+        loops_per_jiffy = lpj;
         printed = true;
 }
diff --git a/init/main.c b/init/main.c
index cafba67c13bf..d7211faed2ad 100644
--- a/init/main.c
+++ b/init/main.c
@@ -542,6 +542,7 @@ asmlinkage void __init start_kernel(void)
         timekeeping_init();
         time_init();
         profile_init();
+        call_function_init();
         if (!irqs_disabled())
                 printk(KERN_CRIT "start_kernel(): bug: interrupts were "
                                  "enabled early\n");
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 7d02d33be699..42ddbc6f0de6 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -113,8 +113,10 @@ static int snapshot_open(struct inode *inode, struct file *filp)
                 if (error)
                         pm_notifier_call_chain(PM_POST_RESTORE);
         }
-        if (error)
+        if (error) {
+                free_basic_memory_bitmaps();
                 atomic_inc(&snapshot_device_available);
+        }
         data->frozen = 0;
         data->ready = 0;
         data->platform_support = 0;
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 89419ff92e99..7e59ffb3d0ba 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -87,6 +87,8 @@ static struct rcu_state *rcu_state;
 int rcu_scheduler_active __read_mostly;
 EXPORT_SYMBOL_GPL(rcu_scheduler_active);
 
+#ifdef CONFIG_RCU_BOOST
+
 /*
  * Control variables for per-CPU and per-rcu_node kthreads.  These
  * handle all flavors of RCU.
@@ -98,8 +100,11 @@ DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_loops);
 DEFINE_PER_CPU(char, rcu_cpu_has_work);
 static char rcu_kthreads_spawnable;
 
+#endif /* #ifdef CONFIG_RCU_BOOST */
+
 static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu);
-static void invoke_rcu_cpu_kthread(void);
+static void invoke_rcu_core(void);
+static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp);
 
 #define RCU_KTHREAD_PRIO 1      /* RT priority for per-CPU kthreads. */
 
@@ -1088,14 +1093,8 @@ static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
         int need_report = 0;
         struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
         struct rcu_node *rnp;
-        struct task_struct *t;
 
-        /* Stop the CPU's kthread. */
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t != NULL) {
-                per_cpu(rcu_cpu_kthread_task, cpu) = NULL;
-                kthread_stop(t);
-        }
+        rcu_stop_cpu_kthread(cpu);
 
         /* Exclude any attempts to start a new grace period. */
         raw_spin_lock_irqsave(&rsp->onofflock, flags);
@@ -1231,7 +1230,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
 
         /* Re-raise the RCU softirq if there are callbacks remaining. */
         if (cpu_has_callbacks_ready_to_invoke(rdp))
-                invoke_rcu_cpu_kthread();
+                invoke_rcu_core();
 }
 
 /*
@@ -1277,7 +1276,7 @@ void rcu_check_callbacks(int cpu, int user)
         }
         rcu_preempt_check_callbacks(cpu);
         if (rcu_pending(cpu))
-                invoke_rcu_cpu_kthread();
+                invoke_rcu_core();
 }
 
 #ifdef CONFIG_SMP
@@ -1442,13 +1441,14 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
         }
 
         /* If there are callbacks ready, invoke them. */
-        rcu_do_batch(rsp, rdp);
+        if (cpu_has_callbacks_ready_to_invoke(rdp))
+                invoke_rcu_callbacks(rsp, rdp);
 }
 
 /*
  * Do softirq processing for the current CPU.
  */
-static void rcu_process_callbacks(void)
+static void rcu_process_callbacks(struct softirq_action *unused)
 {
         __rcu_process_callbacks(&rcu_sched_state,
                                 &__get_cpu_var(rcu_sched_data));
@@ -1465,342 +1465,20 @@ static void rcu_process_callbacks(void)
  * the current CPU with interrupts disabled, the rcu_cpu_kthread_task
  * cannot disappear out from under us.
  */
-static void invoke_rcu_cpu_kthread(void)
-{
-        unsigned long flags;
-
-        local_irq_save(flags);
-        __this_cpu_write(rcu_cpu_has_work, 1);
-        if (__this_cpu_read(rcu_cpu_kthread_task) == NULL) {
-                local_irq_restore(flags);
-                return;
-        }
-        wake_up_process(__this_cpu_read(rcu_cpu_kthread_task));
-        local_irq_restore(flags);
-}
-
-/*
- * Wake up the specified per-rcu_node-structure kthread.
- * Because the per-rcu_node kthreads are immortal, we don't need
- * to do anything to keep them alive.
- */
-static void invoke_rcu_node_kthread(struct rcu_node *rnp)
-{
-        struct task_struct *t;
-
-        t = rnp->node_kthread_task;
-        if (t != NULL)
-                wake_up_process(t);
-}
-
-/*
- * Set the specified CPU's kthread to run RT or not, as specified by
- * the to_rt argument.  The CPU-hotplug locks are held, so the task
- * is not going away.
- */
-static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
-{
-        int policy;
-        struct sched_param sp;
-        struct task_struct *t;
-
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t == NULL)
-                return;
-        if (to_rt) {
-                policy = SCHED_FIFO;
-                sp.sched_priority = RCU_KTHREAD_PRIO;
-        } else {
-                policy = SCHED_NORMAL;
-                sp.sched_priority = 0;
-        }
-        sched_setscheduler_nocheck(t, policy, &sp);
-}
-
-/*
- * Timer handler to initiate the waking up of per-CPU kthreads that
- * have yielded the CPU due to excess numbers of RCU callbacks.
- * We wake up the per-rcu_node kthread, which in turn will wake up
- * the booster kthread.
- */
-static void rcu_cpu_kthread_timer(unsigned long arg)
-{
-        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, arg);
-        struct rcu_node *rnp = rdp->mynode;
-
-        atomic_or(rdp->grpmask, &rnp->wakemask);
-        invoke_rcu_node_kthread(rnp);
-}
-
-/*
- * Drop to non-real-time priority and yield, but only after posting a
- * timer that will cause us to regain our real-time priority if we
- * remain preempted.  Either way, we restore our real-time priority
- * before returning.
- */
-static void rcu_yield(void (*f)(unsigned long), unsigned long arg)
-{
-        struct sched_param sp;
-        struct timer_list yield_timer;
-
-        setup_timer_on_stack(&yield_timer, f, arg);
-        mod_timer(&yield_timer, jiffies + 2);
-        sp.sched_priority = 0;
-        sched_setscheduler_nocheck(current, SCHED_NORMAL, &sp);
-        set_user_nice(current, 19);
-        schedule();
-        sp.sched_priority = RCU_KTHREAD_PRIO;
-        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
-        del_timer(&yield_timer);
-}
-
-/*
- * Handle cases where the rcu_cpu_kthread() ends up on the wrong CPU.
- * This can happen while the corresponding CPU is either coming online
- * or going offline.  We cannot wait until the CPU is fully online
- * before starting the kthread, because the various notifier functions
- * can wait for RCU grace periods.  So we park rcu_cpu_kthread() until
- * the corresponding CPU is online.
- *
- * Return 1 if the kthread needs to stop, 0 otherwise.
- *
- * Caller must disable bh.  This function can momentarily enable it.
- */
-static int rcu_cpu_kthread_should_stop(int cpu)
-{
-        while (cpu_is_offline(cpu) ||
-               !cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)) ||
-               smp_processor_id() != cpu) {
-                if (kthread_should_stop())
-                        return 1;
-                per_cpu(rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
-                per_cpu(rcu_cpu_kthread_cpu, cpu) = raw_smp_processor_id();
-                local_bh_enable();
-                schedule_timeout_uninterruptible(1);
-                if (!cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)))
-                        set_cpus_allowed_ptr(current, cpumask_of(cpu));
-                local_bh_disable();
-        }
-        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
-        return 0;
-}
-
-/*
- * Per-CPU kernel thread that invokes RCU callbacks.  This replaces the
- * earlier RCU softirq.
- */
-static int rcu_cpu_kthread(void *arg)
-{
-        int cpu = (int)(long)arg;
-        unsigned long flags;
-        int spincnt = 0;
-        unsigned int *statusp = &per_cpu(rcu_cpu_kthread_status, cpu);
-        char work;
-        char *workp = &per_cpu(rcu_cpu_has_work, cpu);
-
-        for (;;) {
-                *statusp = RCU_KTHREAD_WAITING;
-                rcu_wait(*workp != 0 || kthread_should_stop());
-                local_bh_disable();
-                if (rcu_cpu_kthread_should_stop(cpu)) {
-                        local_bh_enable();
-                        break;
-                }
-                *statusp = RCU_KTHREAD_RUNNING;
-                per_cpu(rcu_cpu_kthread_loops, cpu)++;
-                local_irq_save(flags);
-                work = *workp;
-                *workp = 0;
-                local_irq_restore(flags);
-                if (work)
-                        rcu_process_callbacks();
-                local_bh_enable();
-                if (*workp != 0)
-                        spincnt++;
-                else
-                        spincnt = 0;
-                if (spincnt > 10) {
-                        *statusp = RCU_KTHREAD_YIELDING;
-                        rcu_yield(rcu_cpu_kthread_timer, (unsigned long)cpu);
-                        spincnt = 0;
-                }
-        }
-        *statusp = RCU_KTHREAD_STOPPED;
-        return 0;
-}
-
-/*
- * Spawn a per-CPU kthread, setting up affinity and priority.
- * Because the CPU hotplug lock is held, no other CPU will be attempting
- * to manipulate rcu_cpu_kthread_task.  There might be another CPU
- * attempting to access it during boot, but the locking in kthread_bind()
- * will enforce sufficient ordering.
- */
-static int __cpuinit rcu_spawn_one_cpu_kthread(int cpu)
+static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
 {
-        struct sched_param sp;
-        struct task_struct *t;
-
-        if (!rcu_kthreads_spawnable ||
-            per_cpu(rcu_cpu_kthread_task, cpu) != NULL)
-                return 0;
-        t = kthread_create(rcu_cpu_kthread, (void *)(long)cpu, "rcuc%d", cpu);
-        if (IS_ERR(t))
-                return PTR_ERR(t);
-        kthread_bind(t, cpu);
-        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
-        WARN_ON_ONCE(per_cpu(rcu_cpu_kthread_task, cpu) != NULL);
-        per_cpu(rcu_cpu_kthread_task, cpu) = t;
-        sp.sched_priority = RCU_KTHREAD_PRIO;
-        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-        return 0;
-}
-
-/*
- * Per-rcu_node kthread, which is in charge of waking up the per-CPU
- * kthreads when needed.  We ignore requests to wake up kthreads
- * for offline CPUs, which is OK because force_quiescent_state()
- * takes care of this case.
- */
-static int rcu_node_kthread(void *arg)
-{
-        int cpu;
-        unsigned long flags;
-        unsigned long mask;
-        struct rcu_node *rnp = (struct rcu_node *)arg;
-        struct sched_param sp;
-        struct task_struct *t;
-
-        for (;;) {
-                rnp->node_kthread_status = RCU_KTHREAD_WAITING;
-                rcu_wait(atomic_read(&rnp->wakemask) != 0);
-                rnp->node_kthread_status = RCU_KTHREAD_RUNNING;
-                raw_spin_lock_irqsave(&rnp->lock, flags);
-                mask = atomic_xchg(&rnp->wakemask, 0);
-                rcu_initiate_boost(rnp, flags); /* releases rnp->lock. */
-                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1) {
-                        if ((mask & 0x1) == 0)
-                                continue;
-                        preempt_disable();
-                        t = per_cpu(rcu_cpu_kthread_task, cpu);
-                        if (!cpu_online(cpu) || t == NULL) {
-                                preempt_enable();
-                                continue;
-                        }
-                        per_cpu(rcu_cpu_has_work, cpu) = 1;
-                        sp.sched_priority = RCU_KTHREAD_PRIO;
-                        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-                        preempt_enable();
-                }
-        }
-        /* NOTREACHED */
-        rnp->node_kthread_status = RCU_KTHREAD_STOPPED;
-        return 0;
-}
-
-/*
- * Set the per-rcu_node kthread's affinity to cover all CPUs that are
- * served by the rcu_node in question.  The CPU hotplug lock is still
- * held, so the value of rnp->qsmaskinit will be stable.
- *
- * We don't include outgoingcpu in the affinity set, use -1 if there is
- * no outgoing CPU.  If there are no CPUs left in the affinity set,
- * this function allows the kthread to execute on any CPU.
- */
-static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
-{
-        cpumask_var_t cm;
-        int cpu;
-        unsigned long mask = rnp->qsmaskinit;
-
-        if (rnp->node_kthread_task == NULL)
-                return;
-        if (!alloc_cpumask_var(&cm, GFP_KERNEL))
+        if (likely(!rsp->boost)) {
+                rcu_do_batch(rsp, rdp);
                 return;
-        cpumask_clear(cm);
-        for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1)
-                if ((mask & 0x1) && cpu != outgoingcpu)
-                        cpumask_set_cpu(cpu, cm);
-        if (cpumask_weight(cm) == 0) {
-                cpumask_setall(cm);
-                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++)
-                        cpumask_clear_cpu(cpu, cm);
-                WARN_ON_ONCE(cpumask_weight(cm) == 0);
         }
-        set_cpus_allowed_ptr(rnp->node_kthread_task, cm);
-        rcu_boost_kthread_setaffinity(rnp, cm);
-        free_cpumask_var(cm);
+        invoke_rcu_callbacks_kthread();
 }
 
-/*
- * Spawn a per-rcu_node kthread, setting priority and affinity.
- * Called during boot before online/offline can happen, or, if
- * during runtime, with the main CPU-hotplug locks held.  So only
- * one of these can be executing at a time.
- */
-static int __cpuinit rcu_spawn_one_node_kthread(struct rcu_state *rsp,
-                                                struct rcu_node *rnp)
+static void invoke_rcu_core(void)
 {
-        unsigned long flags;
-        int rnp_index = rnp - &rsp->node[0];
-        struct sched_param sp;
-        struct task_struct *t;
-
-        if (!rcu_kthreads_spawnable ||
-            rnp->qsmaskinit == 0)
-                return 0;
-        if (rnp->node_kthread_task == NULL) {
-                t = kthread_create(rcu_node_kthread, (void *)rnp,
-                                   "rcun%d", rnp_index);
-                if (IS_ERR(t))
-                        return PTR_ERR(t);
-                raw_spin_lock_irqsave(&rnp->lock, flags);
-                rnp->node_kthread_task = t;
-                raw_spin_unlock_irqrestore(&rnp->lock, flags);
-                sp.sched_priority = 99;
-                sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-        }
-        return rcu_spawn_one_boost_kthread(rsp, rnp, rnp_index);
+        raise_softirq(RCU_SOFTIRQ);
 }
 
-static void rcu_wake_one_boost_kthread(struct rcu_node *rnp);
-
-/*
- * Spawn all kthreads -- called as soon as the scheduler is running.
- */
-static int __init rcu_spawn_kthreads(void)
-{
-        int cpu;
-        struct rcu_node *rnp;
-        struct task_struct *t;
-
-        rcu_kthreads_spawnable = 1;
-        for_each_possible_cpu(cpu) {
-                per_cpu(rcu_cpu_has_work, cpu) = 0;
-                if (cpu_online(cpu)) {
-                        (void)rcu_spawn_one_cpu_kthread(cpu);
-                        t = per_cpu(rcu_cpu_kthread_task, cpu);
-                        if (t)
-                                wake_up_process(t);
-                }
-        }
-        rnp = rcu_get_root(rcu_state);
-        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
-        if (rnp->node_kthread_task)
-                wake_up_process(rnp->node_kthread_task);
-        if (NUM_RCU_NODES > 1) {
-                rcu_for_each_leaf_node(rcu_state, rnp) {
-                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
-                        t = rnp->node_kthread_task;
-                        if (t)
-                                wake_up_process(t);
-                        rcu_wake_one_boost_kthread(rnp);
-                }
-        }
-        return 0;
-}
-early_initcall(rcu_spawn_kthreads);
-
 static void
 __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
            struct rcu_state *rsp)
@@ -2207,44 +1885,6 @@ static void __cpuinit rcu_prepare_cpu(int cpu)
         rcu_preempt_init_percpu_data(cpu);
 }
 
-static void __cpuinit rcu_prepare_kthreads(int cpu)
-{
-        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, cpu);
-        struct rcu_node *rnp = rdp->mynode;
-
-        /* Fire up the incoming CPU's kthread and leaf rcu_node kthread. */
-        if (rcu_kthreads_spawnable) {
-                (void)rcu_spawn_one_cpu_kthread(cpu);
-                if (rnp->node_kthread_task == NULL)
-                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
-        }
-}
-
-/*
- * kthread_create() creates threads in TASK_UNINTERRUPTIBLE state,
- * but the RCU threads are woken on demand, and if demand is low this
- * could be a while triggering the hung task watchdog.
- *
- * In order to avoid this, poke all tasks once the CPU is fully
- * up and running.
- */
-static void __cpuinit rcu_online_kthreads(int cpu)
-{
-        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, cpu);
-        struct rcu_node *rnp = rdp->mynode;
-        struct task_struct *t;
-
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t)
-                wake_up_process(t);
-
-        t = rnp->node_kthread_task;
-        if (t)
-                wake_up_process(t);
-
-        rcu_wake_one_boost_kthread(rnp);
-}
-
 /*
  * Handle CPU online/offline notification events.
  */
@@ -2262,7 +1902,6 @@ static int __cpuinit rcu_cpu_notify(struct notifier_block *self,
                 rcu_prepare_kthreads(cpu);
                 break;
         case CPU_ONLINE:
-                rcu_online_kthreads(cpu);
         case CPU_DOWN_FAILED:
                 rcu_node_kthread_setaffinity(rnp, -1);
                 rcu_cpu_kthread_setrt(cpu, 1);
@@ -2410,6 +2049,7 @@ void __init rcu_init(void)
         rcu_init_one(&rcu_sched_state, &rcu_sched_data);
         rcu_init_one(&rcu_bh_state, &rcu_bh_data);
         __rcu_init_preempt();
+         open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
 
         /*
          * We don't need protection against CPU-hotplug here because
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 7b9a08b4aaea..01b2ccda26fb 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -369,6 +369,7 @@ struct rcu_state {
                                                 /*  period because */
                                                 /*  force_quiescent_state() */
                                                 /*  was running. */
+        u8      boost;                          /* Subject to priority boost. */
         unsigned long gpnum;                    /* Current gp number. */
         unsigned long completed;                /* # of last completed gp. */
 
@@ -426,6 +427,7 @@ static int rcu_preempt_blocked_readers_cgp(struct rcu_node *rnp);
 #ifdef CONFIG_HOTPLUG_CPU
 static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp,
                                       unsigned long flags);
+static void rcu_stop_cpu_kthread(int cpu);
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
 static void rcu_print_detail_task_stall(struct rcu_state *rsp);
 static void rcu_print_task_stall(struct rcu_node *rnp);
@@ -450,11 +452,19 @@ static void rcu_preempt_send_cbs_to_online(void);
 static void __init __rcu_init_preempt(void);
 static void rcu_needs_cpu_flush(void);
 static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags);
+static void rcu_preempt_boost_start_gp(struct rcu_node *rnp);
+static void invoke_rcu_callbacks_kthread(void);
+#ifdef CONFIG_RCU_BOOST
+static void rcu_preempt_do_callbacks(void);
 static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp,
                                           cpumask_var_t cm);
-static void rcu_preempt_boost_start_gp(struct rcu_node *rnp);
 static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
                                                  struct rcu_node *rnp,
                                                  int rnp_index);
+static void invoke_rcu_node_kthread(struct rcu_node *rnp);
+static void rcu_yield(void (*f)(unsigned long), unsigned long arg);
+#endif /* #ifdef CONFIG_RCU_BOOST */
+static void rcu_cpu_kthread_setrt(int cpu, int to_rt);
+static void __cpuinit rcu_prepare_kthreads(int cpu);
 
 #endif /* #ifndef RCU_TREE_NONCORE */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index c8bff3099a89..14dc7dd00902 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -602,6 +602,15 @@ static void rcu_preempt_process_callbacks(void)
                                 &__get_cpu_var(rcu_preempt_data));
 }
 
+#ifdef CONFIG_RCU_BOOST
+
+static void rcu_preempt_do_callbacks(void)
+{
+        rcu_do_batch(&rcu_preempt_state, &__get_cpu_var(rcu_preempt_data));
+}
+
+#endif /* #ifdef CONFIG_RCU_BOOST */
+
 /*
  * Queue a preemptible-RCU callback for invocation after a grace period.
  */
@@ -1249,6 +1258,23 @@ static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
 }
 
 /*
+ * Wake up the per-CPU kthread to invoke RCU callbacks.
+ */
+static void invoke_rcu_callbacks_kthread(void)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        __this_cpu_write(rcu_cpu_has_work, 1);
+        if (__this_cpu_read(rcu_cpu_kthread_task) == NULL) {
+                local_irq_restore(flags);
+                return;
+        }
+        wake_up_process(__this_cpu_read(rcu_cpu_kthread_task));
+        local_irq_restore(flags);
+}
+
+/*
  * Set the affinity of the boost kthread.  The CPU-hotplug locks are
  * held, so no one should be messing with the existence of the boost
  * kthread.
@@ -1288,6 +1314,7 @@ static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
 
         if (&rcu_preempt_state != rsp)
                 return 0;
+        rsp->boost = 1;
         if (rnp->boost_kthread_task != NULL)
                 return 0;
         t = kthread_create(rcu_boost_kthread, (void *)rnp,
@@ -1299,13 +1326,372 @@ static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
         raw_spin_unlock_irqrestore(&rnp->lock, flags);
         sp.sched_priority = RCU_KTHREAD_PRIO;
         sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+        wake_up_process(t); /* get to TASK_INTERRUPTIBLE quickly. */
         return 0;
 }
 
-static void __cpuinit rcu_wake_one_boost_kthread(struct rcu_node *rnp)
+#ifdef CONFIG_HOTPLUG_CPU
+
+/*
+ * Stop the RCU's per-CPU kthread when its CPU goes offline,.
+ */
+static void rcu_stop_cpu_kthread(int cpu)
 {
-        if (rnp->boost_kthread_task)
-                wake_up_process(rnp->boost_kthread_task);
+        struct task_struct *t;
+
+        /* Stop the CPU's kthread. */
+        t = per_cpu(rcu_cpu_kthread_task, cpu);
+        if (t != NULL) {
+                per_cpu(rcu_cpu_kthread_task, cpu) = NULL;
+                kthread_stop(t);
+        }
+}
+
+#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+
+static void rcu_kthread_do_work(void)
+{
+        rcu_do_batch(&rcu_sched_state, &__get_cpu_var(rcu_sched_data));
+        rcu_do_batch(&rcu_bh_state, &__get_cpu_var(rcu_bh_data));
+        rcu_preempt_do_callbacks();
+}
+
+/*
+ * Wake up the specified per-rcu_node-structure kthread.
+ * Because the per-rcu_node kthreads are immortal, we don't need
+ * to do anything to keep them alive.
+ */
+static void invoke_rcu_node_kthread(struct rcu_node *rnp)
+{
+        struct task_struct *t;
+
+        t = rnp->node_kthread_task;
+        if (t != NULL)
+                wake_up_process(t);
+}
+
+/*
+ * Set the specified CPU's kthread to run RT or not, as specified by
+ * the to_rt argument.  The CPU-hotplug locks are held, so the task
+ * is not going away.
+ */
+static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
+{
+        int policy;
+        struct sched_param sp;
+        struct task_struct *t;
+
+        t = per_cpu(rcu_cpu_kthread_task, cpu);
+        if (t == NULL)
+                return;
+        if (to_rt) {
+                policy = SCHED_FIFO;
+                sp.sched_priority = RCU_KTHREAD_PRIO;
+        } else {
+                policy = SCHED_NORMAL;
+                sp.sched_priority = 0;
+        }
+        sched_setscheduler_nocheck(t, policy, &sp);
+}
+
+/*
+ * Timer handler to initiate the waking up of per-CPU kthreads that
+ * have yielded the CPU due to excess numbers of RCU callbacks.
+ * We wake up the per-rcu_node kthread, which in turn will wake up
+ * the booster kthread.
+ */
+static void rcu_cpu_kthread_timer(unsigned long arg)
+{
+        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, arg);
+        struct rcu_node *rnp = rdp->mynode;
+
+        atomic_or(rdp->grpmask, &rnp->wakemask);
+        invoke_rcu_node_kthread(rnp);
+}
+
+/*
+ * Drop to non-real-time priority and yield, but only after posting a
+ * timer that will cause us to regain our real-time priority if we
+ * remain preempted.  Either way, we restore our real-time priority
+ * before returning.
+ */
+static void rcu_yield(void (*f)(unsigned long), unsigned long arg)
+{
+        struct sched_param sp;
+        struct timer_list yield_timer;
+
+        setup_timer_on_stack(&yield_timer, f, arg);
+        mod_timer(&yield_timer, jiffies + 2);
+        sp.sched_priority = 0;
+        sched_setscheduler_nocheck(current, SCHED_NORMAL, &sp);
+        set_user_nice(current, 19);
+        schedule();
+        sp.sched_priority = RCU_KTHREAD_PRIO;
+        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
+        del_timer(&yield_timer);
+}
+
+/*
+ * Handle cases where the rcu_cpu_kthread() ends up on the wrong CPU.
+ * This can happen while the corresponding CPU is either coming online
+ * or going offline.  We cannot wait until the CPU is fully online
+ * before starting the kthread, because the various notifier functions
+ * can wait for RCU grace periods.  So we park rcu_cpu_kthread() until
+ * the corresponding CPU is online.
+ *
+ * Return 1 if the kthread needs to stop, 0 otherwise.
+ *
+ * Caller must disable bh.  This function can momentarily enable it.
+ */
+static int rcu_cpu_kthread_should_stop(int cpu)
+{
+        while (cpu_is_offline(cpu) ||
+               !cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)) ||
+               smp_processor_id() != cpu) {
+                if (kthread_should_stop())
+                        return 1;
+                per_cpu(rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
+                per_cpu(rcu_cpu_kthread_cpu, cpu) = raw_smp_processor_id();
+                local_bh_enable();
+                schedule_timeout_uninterruptible(1);
+                if (!cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)))
+                        set_cpus_allowed_ptr(current, cpumask_of(cpu));
+                local_bh_disable();
+        }
+        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
+        return 0;
+}
+
+/*
+ * Per-CPU kernel thread that invokes RCU callbacks.  This replaces the
+ * earlier RCU softirq.
+ */
+static int rcu_cpu_kthread(void *arg)
+{
+        int cpu = (int)(long)arg;
+        unsigned long flags;
+        int spincnt = 0;
+        unsigned int *statusp = &per_cpu(rcu_cpu_kthread_status, cpu);
+        char work;
+        char *workp = &per_cpu(rcu_cpu_has_work, cpu);
+
+        for (;;) {
+                *statusp = RCU_KTHREAD_WAITING;
+                rcu_wait(*workp != 0 || kthread_should_stop());
+                local_bh_disable();
+                if (rcu_cpu_kthread_should_stop(cpu)) {
+                        local_bh_enable();
+                        break;
+                }
+                *statusp = RCU_KTHREAD_RUNNING;
+                per_cpu(rcu_cpu_kthread_loops, cpu)++;
+                local_irq_save(flags);
+                work = *workp;
+                *workp = 0;
+                local_irq_restore(flags);
+                if (work)
+                        rcu_kthread_do_work();
+                local_bh_enable();
+                if (*workp != 0)
+                        spincnt++;
+                else
+                        spincnt = 0;
+                if (spincnt > 10) {
+                        *statusp = RCU_KTHREAD_YIELDING;
+                        rcu_yield(rcu_cpu_kthread_timer, (unsigned long)cpu);
+                        spincnt = 0;
+                }
+        }
+        *statusp = RCU_KTHREAD_STOPPED;
+        return 0;
+}
+
+/*
+ * Spawn a per-CPU kthread, setting up affinity and priority.
+ * Because the CPU hotplug lock is held, no other CPU will be attempting
+ * to manipulate rcu_cpu_kthread_task.  There might be another CPU
+ * attempting to access it during boot, but the locking in kthread_bind()
+ * will enforce sufficient ordering.
+ *
+ * Please note that we cannot simply refuse to wake up the per-CPU
+ * kthread because kthreads are created in TASK_UNINTERRUPTIBLE state,
+ * which can result in softlockup complaints if the task ends up being
+ * idle for more than a couple of minutes.
+ *
+ * However, please note also that we cannot bind the per-CPU kthread to its
+ * CPU until that CPU is fully online.  We also cannot wait until the
+ * CPU is fully online before we create its per-CPU kthread, as this would
+ * deadlock the system when CPU notifiers tried waiting for grace
+ * periods.  So we bind the per-CPU kthread to its CPU only if the CPU
+ * is online.  If its CPU is not yet fully online, then the code in
+ * rcu_cpu_kthread() will wait until it is fully online, and then do
+ * the binding.
+ */
+static int __cpuinit rcu_spawn_one_cpu_kthread(int cpu)
+{
+        struct sched_param sp;
+        struct task_struct *t;
+
+        if (!rcu_kthreads_spawnable ||
+            per_cpu(rcu_cpu_kthread_task, cpu) != NULL)
+                return 0;
+        t = kthread_create(rcu_cpu_kthread, (void *)(long)cpu, "rcuc%d", cpu);
+        if (IS_ERR(t))
+                return PTR_ERR(t);
+        if (cpu_online(cpu))
+                kthread_bind(t, cpu);
+        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
+        WARN_ON_ONCE(per_cpu(rcu_cpu_kthread_task, cpu) != NULL);
+        sp.sched_priority = RCU_KTHREAD_PRIO;
+        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+        per_cpu(rcu_cpu_kthread_task, cpu) = t;
+        wake_up_process(t); /* Get to TASK_INTERRUPTIBLE quickly. */
+        return 0;
+}
+
+/*
+ * Per-rcu_node kthread, which is in charge of waking up the per-CPU
+ * kthreads when needed.  We ignore requests to wake up kthreads
+ * for offline CPUs, which is OK because force_quiescent_state()
+ * takes care of this case.
+ */
+static int rcu_node_kthread(void *arg)
+{
+        int cpu;
+        unsigned long flags;
+        unsigned long mask;
+        struct rcu_node *rnp = (struct rcu_node *)arg;
+        struct sched_param sp;
+        struct task_struct *t;
+
+        for (;;) {
+                rnp->node_kthread_status = RCU_KTHREAD_WAITING;
+                rcu_wait(atomic_read(&rnp->wakemask) != 0);
+                rnp->node_kthread_status = RCU_KTHREAD_RUNNING;
+                raw_spin_lock_irqsave(&rnp->lock, flags);
+                mask = atomic_xchg(&rnp->wakemask, 0);
+                rcu_initiate_boost(rnp, flags); /* releases rnp->lock. */
+                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1) {
+                        if ((mask & 0x1) == 0)
+                                continue;
+                        preempt_disable();
+                        t = per_cpu(rcu_cpu_kthread_task, cpu);
+                        if (!cpu_online(cpu) || t == NULL) {
+                                preempt_enable();
+                                continue;
+                        }
+                        per_cpu(rcu_cpu_has_work, cpu) = 1;
+                        sp.sched_priority = RCU_KTHREAD_PRIO;
+                        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+                        preempt_enable();
+                }
+        }
+        /* NOTREACHED */
+        rnp->node_kthread_status = RCU_KTHREAD_STOPPED;
+        return 0;
+}
+
+/*
+ * Set the per-rcu_node kthread's affinity to cover all CPUs that are
+ * served by the rcu_node in question.  The CPU hotplug lock is still
+ * held, so the value of rnp->qsmaskinit will be stable.
+ *
+ * We don't include outgoingcpu in the affinity set, use -1 if there is
+ * no outgoing CPU.  If there are no CPUs left in the affinity set,
+ * this function allows the kthread to execute on any CPU.
+ */
+static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
+{
+        cpumask_var_t cm;
+        int cpu;
+        unsigned long mask = rnp->qsmaskinit;
+
+        if (rnp->node_kthread_task == NULL)
+                return;
+        if (!alloc_cpumask_var(&cm, GFP_KERNEL))
+                return;
+        cpumask_clear(cm);
+        for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1)
+                if ((mask & 0x1) && cpu != outgoingcpu)
+                        cpumask_set_cpu(cpu, cm);
+        if (cpumask_weight(cm) == 0) {
+                cpumask_setall(cm);
+                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++)
+                        cpumask_clear_cpu(cpu, cm);
+                WARN_ON_ONCE(cpumask_weight(cm) == 0);
+        }
+        set_cpus_allowed_ptr(rnp->node_kthread_task, cm);
+        rcu_boost_kthread_setaffinity(rnp, cm);
+        free_cpumask_var(cm);
+}
+
+/*
+ * Spawn a per-rcu_node kthread, setting priority and affinity.
+ * Called during boot before online/offline can happen, or, if
+ * during runtime, with the main CPU-hotplug locks held.  So only
+ * one of these can be executing at a time.
+ */
+static int __cpuinit rcu_spawn_one_node_kthread(struct rcu_state *rsp,
+                                                struct rcu_node *rnp)
+{
+        unsigned long flags;
+        int rnp_index = rnp - &rsp->node[0];
+        struct sched_param sp;
+        struct task_struct *t;
+
+        if (!rcu_kthreads_spawnable ||
+            rnp->qsmaskinit == 0)
+                return 0;
+        if (rnp->node_kthread_task == NULL) {
+                t = kthread_create(rcu_node_kthread, (void *)rnp,
+                                   "rcun%d", rnp_index);
+                if (IS_ERR(t))
+                        return PTR_ERR(t);
+                raw_spin_lock_irqsave(&rnp->lock, flags);
+                rnp->node_kthread_task = t;
+                raw_spin_unlock_irqrestore(&rnp->lock, flags);
+                sp.sched_priority = 99;
+                sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+                wake_up_process(t); /* get to TASK_INTERRUPTIBLE quickly. */
+        }
+        return rcu_spawn_one_boost_kthread(rsp, rnp, rnp_index);
+}
+
+/*
+ * Spawn all kthreads -- called as soon as the scheduler is running.
+ */
+static int __init rcu_spawn_kthreads(void)
+{
+        int cpu;
+        struct rcu_node *rnp;
+
+        rcu_kthreads_spawnable = 1;
+        for_each_possible_cpu(cpu) {
+                per_cpu(rcu_cpu_has_work, cpu) = 0;
+                if (cpu_online(cpu))
+                        (void)rcu_spawn_one_cpu_kthread(cpu);
+        }
+        rnp = rcu_get_root(rcu_state);
+        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+        if (NUM_RCU_NODES > 1) {
+                rcu_for_each_leaf_node(rcu_state, rnp)
+                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+        }
+        return 0;
+}
+early_initcall(rcu_spawn_kthreads);
+
+static void __cpuinit rcu_prepare_kthreads(int cpu)
+{
+        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, cpu);
+        struct rcu_node *rnp = rdp->mynode;
+
+        /* Fire up the incoming CPU's kthread and leaf rcu_node kthread. */
+        if (rcu_kthreads_spawnable) {
+                (void)rcu_spawn_one_cpu_kthread(cpu);
+                if (rnp->node_kthread_task == NULL)
+                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+        }
 }
 
 #else /* #ifdef CONFIG_RCU_BOOST */
@@ -1315,23 +1701,32 @@ static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
         raw_spin_unlock_irqrestore(&rnp->lock, flags);
 }
 
-static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp,
-                                          cpumask_var_t cm)
+static void invoke_rcu_callbacks_kthread(void)
 {
+        WARN_ON_ONCE(1);
 }
 
 static void rcu_preempt_boost_start_gp(struct rcu_node *rnp)
 {
 }
 
-static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
-                                                 struct rcu_node *rnp,
-                                                 int rnp_index)
+#ifdef CONFIG_HOTPLUG_CPU
+
+static void rcu_stop_cpu_kthread(int cpu)
+{
+}
+
+#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+
+static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
+{
+}
+
+static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
 {
-        return 0;
 }
 
-static void __cpuinit rcu_wake_one_boost_kthread(struct rcu_node *rnp)
+static void __cpuinit rcu_prepare_kthreads(int cpu)
 {
 }
 
@@ -1509,7 +1904,7 @@ static DEFINE_PER_CPU(unsigned long, rcu_dyntick_holdoff);
  *
  * Because it is not legal to invoke rcu_process_callbacks() with irqs
  * disabled, we do one pass of force_quiescent_state(), then do a
- * invoke_rcu_cpu_kthread() to cause rcu_process_callbacks() to be invoked
+ * invoke_rcu_core() to cause rcu_process_callbacks() to be invoked
  * later.  The per-cpu rcu_dyntick_drain variable controls the sequencing.
  */
 int rcu_needs_cpu(int cpu)
@@ -1560,7 +1955,7 @@ int rcu_needs_cpu(int cpu)
 
         /* If RCU callbacks are still pending, RCU still needs this CPU. */
         if (c)
-                invoke_rcu_cpu_kthread();
+                invoke_rcu_core();
         return c;
 }
 
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index 9678cc3650f5..4e144876dc68 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -46,6 +46,8 @@
 #define RCU_TREE_NONCORE
 #include "rcutree.h"
 
+#ifdef CONFIG_RCU_BOOST
+
 DECLARE_PER_CPU(unsigned int, rcu_cpu_kthread_status);
 DECLARE_PER_CPU(unsigned int, rcu_cpu_kthread_cpu);
 DECLARE_PER_CPU(unsigned int, rcu_cpu_kthread_loops);
@@ -58,6 +60,8 @@ static char convert_kthread_status(unsigned int kthread_status)
         return "SRWOY"[kthread_status];
 }
 
+#endif /* #ifdef CONFIG_RCU_BOOST */
+
 static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
 {
         if (!rdp->beenonline)
@@ -76,7 +80,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
                    rdp->dynticks_fqs);
 #endif /* #ifdef CONFIG_NO_HZ */
         seq_printf(m, " of=%lu ri=%lu", rdp->offline_fqs, rdp->resched_ipi);
-        seq_printf(m, " ql=%ld qs=%c%c%c%c kt=%d/%c/%d ktl=%x b=%ld",
+        seq_printf(m, " ql=%ld qs=%c%c%c%c",
                    rdp->qlen,
                    ".N"[rdp->nxttail[RCU_NEXT_READY_TAIL] !=
                         rdp->nxttail[RCU_NEXT_TAIL]],
@@ -84,13 +88,16 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
                         rdp->nxttail[RCU_NEXT_READY_TAIL]],
                    ".W"[rdp->nxttail[RCU_DONE_TAIL] !=
                         rdp->nxttail[RCU_WAIT_TAIL]],
-                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]],
+                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]]);
+#ifdef CONFIG_RCU_BOOST
+        seq_printf(m, " kt=%d/%c/%d ktl=%x",
                    per_cpu(rcu_cpu_has_work, rdp->cpu),
                    convert_kthread_status(per_cpu(rcu_cpu_kthread_status,
                                           rdp->cpu)),
                    per_cpu(rcu_cpu_kthread_cpu, rdp->cpu),
-                   per_cpu(rcu_cpu_kthread_loops, rdp->cpu) & 0xffff,
-                   rdp->blimit);
+                   per_cpu(rcu_cpu_kthread_loops, rdp->cpu) & 0xffff);
+#endif /* #ifdef CONFIG_RCU_BOOST */
+        seq_printf(m, " b=%ld", rdp->blimit);
         seq_printf(m, " ci=%lu co=%lu ca=%lu\n",
                    rdp->n_cbs_invoked, rdp->n_cbs_orphaned, rdp->n_cbs_adopted);
 }
@@ -147,18 +154,21 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
                    rdp->dynticks_fqs);
 #endif /* #ifdef CONFIG_NO_HZ */
         seq_printf(m, ",%lu,%lu", rdp->offline_fqs, rdp->resched_ipi);
-        seq_printf(m, ",%ld,\"%c%c%c%c\",%d,\"%c\",%ld", rdp->qlen,
+        seq_printf(m, ",%ld,\"%c%c%c%c\"", rdp->qlen,
                    ".N"[rdp->nxttail[RCU_NEXT_READY_TAIL] !=
                         rdp->nxttail[RCU_NEXT_TAIL]],
                    ".R"[rdp->nxttail[RCU_WAIT_TAIL] !=
                         rdp->nxttail[RCU_NEXT_READY_TAIL]],
                    ".W"[rdp->nxttail[RCU_DONE_TAIL] !=
                         rdp->nxttail[RCU_WAIT_TAIL]],
-                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]],
+                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]]);
+#ifdef CONFIG_RCU_BOOST
+        seq_printf(m, ",%d,\"%c\"",
                    per_cpu(rcu_cpu_has_work, rdp->cpu),
                    convert_kthread_status(per_cpu(rcu_cpu_kthread_status,
-                                          rdp->cpu)),
-                   rdp->blimit);
+                                          rdp->cpu)));
+#endif /* #ifdef CONFIG_RCU_BOOST */
+        seq_printf(m, ",%ld", rdp->blimit);
         seq_printf(m, ",%lu,%lu,%lu\n",
                    rdp->n_cbs_invoked, rdp->n_cbs_orphaned, rdp->n_cbs_adopted);
 }
@@ -169,7 +179,11 @@ static int show_rcudata_csv(struct seq_file *m, void *unused)
 #ifdef CONFIG_NO_HZ
         seq_puts(m, "\"dt\",\"dt nesting\",\"dt NMI nesting\",\"df\",");
 #endif /* #ifdef CONFIG_NO_HZ */
-        seq_puts(m, "\"of\",\"ri\",\"ql\",\"b\",\"ci\",\"co\",\"ca\"\n");
+        seq_puts(m, "\"of\",\"ri\",\"ql\",\"qs\"");
+#ifdef CONFIG_RCU_BOOST
+        seq_puts(m, "\"kt\",\"ktl\"");
+#endif /* #ifdef CONFIG_RCU_BOOST */
+        seq_puts(m, ",\"b\",\"ci\",\"co\",\"ca\"\n");
 #ifdef CONFIG_TREE_PREEMPT_RCU
         seq_puts(m, "\"rcu_preempt:\"\n");
         PRINT_RCU_DATA(rcu_preempt_data, print_one_rcu_data_csv, m);
diff --git a/kernel/smp.c b/kernel/smp.c
index 73a195193558..fb67dfa8394e 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -74,7 +74,7 @@ static struct notifier_block __cpuinitdata hotplug_cfd_notifier = {
         .notifier_call          = hotplug_cfd,
 };
 
-static int __cpuinit init_call_single_data(void)
+void __init call_function_init(void)
 {
         void *cpu = (void *)(long)smp_processor_id();
         int i;
@@ -88,10 +88,7 @@ static int __cpuinit init_call_single_data(void)
 
         hotplug_cfd(&hotplug_cfd_notifier, CPU_UP_PREPARE, cpu);
         register_cpu_notifier(&hotplug_cfd_notifier);
-
-        return 0;
 }
-early_initcall(init_call_single_data);
 
 /*
  * csd_lock/csd_unlock used to serialize access to per-cpu csd resources
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 13960170cad4..40cf63ddd4b3 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -58,7 +58,7 @@ DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
 
 char *softirq_to_name[NR_SOFTIRQS] = {
         "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
-        "TASKLET", "SCHED", "HRTIMER"
+        "TASKLET", "SCHED", "HRTIMER", "RCU"
 };
 
 /*
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 2d966244ea60..59f369f98a04 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -42,15 +42,75 @@ static struct alarm_base {
         clockid_t               base_clockid;
 } alarm_bases[ALARM_NUMTYPE];
 
+/* freezer delta & lock used to handle clock_nanosleep triggered wakeups */
+static ktime_t freezer_delta;
+static DEFINE_SPINLOCK(freezer_delta_lock);
+
 #ifdef CONFIG_RTC_CLASS
 /* rtc timer and device for setting alarm wakeups at suspend */
 static struct rtc_timer         rtctimer;
 static struct rtc_device        *rtcdev;
-#endif
+static DEFINE_SPINLOCK(rtcdev_lock);
 
-/* freezer delta & lock used to handle clock_nanosleep triggered wakeups */
-static ktime_t freezer_delta;
-static DEFINE_SPINLOCK(freezer_delta_lock);
+/**
+ * has_wakealarm - check rtc device has wakealarm ability
+ * @dev: current device
+ * @name_ptr: name to be returned
+ *
+ * This helper function checks to see if the rtc device can wake
+ * from suspend.
+ */
+static int has_wakealarm(struct device *dev, void *name_ptr)
+{
+        struct rtc_device *candidate = to_rtc_device(dev);
+
+        if (!candidate->ops->set_alarm)
+                return 0;
+        if (!device_may_wakeup(candidate->dev.parent))
+                return 0;
+
+        *(const char **)name_ptr = dev_name(dev);
+        return 1;
+}
+
+/**
+ * alarmtimer_get_rtcdev - Return selected rtcdevice
+ *
+ * This function returns the rtc device to use for wakealarms.
+ * If one has not already been chosen, it checks to see if a
+ * functional rtc device is available.
+ */
+static struct rtc_device *alarmtimer_get_rtcdev(void)
+{
+        struct device *dev;
+        char *str;
+        unsigned long flags;
+        struct rtc_device *ret;
+
+        spin_lock_irqsave(&rtcdev_lock, flags);
+        if (!rtcdev) {
+                /* Find an rtc device and init the rtc_timer */
+                dev = class_find_device(rtc_class, NULL, &str, has_wakealarm);
+                /* If we have a device then str is valid. See has_wakealarm() */
+                if (dev) {
+                        rtcdev = rtc_class_open(str);
+                        /*
+                         * Drop the reference we got in class_find_device,
+                         * rtc_open takes its own.
+                         */
+                        put_device(dev);
+                        rtc_timer_init(&rtctimer, NULL, NULL);
+                }
+        }
+        ret = rtcdev;
+        spin_unlock_irqrestore(&rtcdev_lock, flags);
+
+        return ret;
+}
+#else
+#define alarmtimer_get_rtcdev() (0)
+#define rtcdev (0)
+#endif
 
 
 /**
@@ -166,6 +226,7 @@ static int alarmtimer_suspend(struct device *dev)
         struct rtc_time tm;
         ktime_t min, now;
         unsigned long flags;
+        struct rtc_device *rtc;
         int i;
 
         spin_lock_irqsave(&freezer_delta_lock, flags);
@@ -173,8 +234,9 @@ static int alarmtimer_suspend(struct device *dev)
         freezer_delta = ktime_set(0, 0);
         spin_unlock_irqrestore(&freezer_delta_lock, flags);
 
+        rtc = rtcdev;
         /* If we have no rtcdev, just return */
-        if (!rtcdev)
+        if (!rtc)
                 return 0;
 
         /* Find the soonest timer to expire*/
@@ -199,12 +261,12 @@ static int alarmtimer_suspend(struct device *dev)
         WARN_ON(min.tv64 < NSEC_PER_SEC);
 
         /* Setup an rtc timer to fire that far in the future */
-        rtc_timer_cancel(rtcdev, &rtctimer);
-        rtc_read_time(rtcdev, &tm);
+        rtc_timer_cancel(rtc, &rtctimer);
+        rtc_read_time(rtc, &tm);
         now = rtc_tm_to_ktime(tm);
         now = ktime_add(now, min);
 
-        rtc_timer_start(rtcdev, &rtctimer, now, ktime_set(0, 0));
+        rtc_timer_start(rtc, &rtctimer, now, ktime_set(0, 0));
 
         return 0;
 }
@@ -322,6 +384,9 @@ static int alarm_clock_getres(const clockid_t which_clock, struct timespec *tp)
 {
         clockid_t baseid = alarm_bases[clock2alarm(which_clock)].base_clockid;
 
+        if (!alarmtimer_get_rtcdev())
+                return -ENOTSUPP;
+
         return hrtimer_get_res(baseid, tp);
 }
 
@@ -336,6 +401,9 @@ static int alarm_clock_get(clockid_t which_clock, struct timespec *tp)
 {
         struct alarm_base *base = &alarm_bases[clock2alarm(which_clock)];
 
+        if (!alarmtimer_get_rtcdev())
+                return -ENOTSUPP;
+
         *tp = ktime_to_timespec(base->gettime());
         return 0;
 }
@@ -351,6 +419,9 @@ static int alarm_timer_create(struct k_itimer *new_timer)
         enum  alarmtimer_type type;
         struct alarm_base *base;
 
+        if (!alarmtimer_get_rtcdev())
+                return -ENOTSUPP;
+
         if (!capable(CAP_WAKE_ALARM))
                 return -EPERM;
 
@@ -385,6 +456,9 @@ static void alarm_timer_get(struct k_itimer *timr,
  */
 static int alarm_timer_del(struct k_itimer *timr)
 {
+        if (!rtcdev)
+                return -ENOTSUPP;
+
         alarm_cancel(&timr->it.alarmtimer);
         return 0;
 }
@@ -402,6 +476,9 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
                                 struct itimerspec *new_setting,
                                 struct itimerspec *old_setting)
 {
+        if (!rtcdev)
+                return -ENOTSUPP;
+
         /* Save old values */
         old_setting->it_interval =
                         ktime_to_timespec(timr->it.alarmtimer.period);
@@ -541,6 +618,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
         int ret = 0;
         struct restart_block *restart;
 
+        if (!alarmtimer_get_rtcdev())
+                return -ENOTSUPP;
+
         if (!capable(CAP_WAKE_ALARM))
                 return -EPERM;
 
@@ -638,65 +718,3 @@ static int __init alarmtimer_init(void)
 }
 device_initcall(alarmtimer_init);
 
-#ifdef CONFIG_RTC_CLASS
-/**
- * has_wakealarm - check rtc device has wakealarm ability
- * @dev: current device
- * @name_ptr: name to be returned
- *
- * This helper function checks to see if the rtc device can wake
- * from suspend.
- */
-static int __init has_wakealarm(struct device *dev, void *name_ptr)
-{
-        struct rtc_device *candidate = to_rtc_device(dev);
-
-        if (!candidate->ops->set_alarm)
-                return 0;
-        if (!device_may_wakeup(candidate->dev.parent))
-                return 0;
-
-        *(const char **)name_ptr = dev_name(dev);
-        return 1;
-}
-
-/**
- * alarmtimer_init_late - Late initializing of alarmtimer code
- *
- * This function locates a rtc device to use for wakealarms.
- * Run as late_initcall to make sure rtc devices have been
- * registered.
- */
-static int __init alarmtimer_init_late(void)
-{
-        struct device *dev;
-        char *str;
-
-        /* Find an rtc device and init the rtc_timer */
-        dev = class_find_device(rtc_class, NULL, &str, has_wakealarm);
-        /* If we have a device then str is valid. See has_wakealarm() */
-        if (dev) {
-                rtcdev = rtc_class_open(str);
-                /*
-                 * Drop the reference we got in class_find_device,
-                 * rtc_open takes its own.
-                 */
-                put_device(dev);
-        }
-        if (!rtcdev) {
-                printk(KERN_WARNING "No RTC device found, ALARM timers will"
-                        " not wake from suspend");
-        }
-        rtc_timer_init(&rtctimer, NULL, NULL);
-
-        return 0;
-}
-#else
-static int __init alarmtimer_init_late(void)
-{
-        printk(KERN_WARNING "Kernel not built with RTC support, ALARM timers"
-                " will not wake from suspend");
-        return 0;
-}
-#endif
-late_initcall(alarmtimer_init_late);
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 1c95fd677328..e0980f0d9a0a 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -185,7 +185,6 @@ static struct clocksource *watchdog;
 static struct timer_list watchdog_timer;
 static DECLARE_WORK(watchdog_work, clocksource_watchdog_work);
 static DEFINE_SPINLOCK(watchdog_lock);
-static cycle_t watchdog_last;
 static int watchdog_running;
 
 static int clocksource_watchdog_kthread(void *data);
@@ -254,11 +253,6 @@ static void clocksource_watchdog(unsigned long data)
         if (!watchdog_running)
                 goto out;
 
-        wdnow = watchdog->read(watchdog);
-        wd_nsec = clocksource_cyc2ns((wdnow - watchdog_last) & watchdog->mask,
-                                     watchdog->mult, watchdog->shift);
-        watchdog_last = wdnow;
-
         list_for_each_entry(cs, &watchdog_list, wd_list) {
 
                 /* Clocksource already marked unstable? */
@@ -268,19 +262,28 @@ static void clocksource_watchdog(unsigned long data)
                         continue;
                 }
 
+                local_irq_disable();
                 csnow = cs->read(cs);
+                wdnow = watchdog->read(watchdog);
+                local_irq_enable();
 
                 /* Clocksource initialized ? */
                 if (!(cs->flags & CLOCK_SOURCE_WATCHDOG)) {
                         cs->flags |= CLOCK_SOURCE_WATCHDOG;
-                        cs->wd_last = csnow;
+                        cs->wd_last = wdnow;
+                        cs->cs_last = csnow;
                         continue;
                 }
 
-                /* Check the deviation from the watchdog clocksource. */
-                cs_nsec = clocksource_cyc2ns((csnow - cs->wd_last) &
+                wd_nsec = clocksource_cyc2ns((wdnow - cs->wd_last) & watchdog->mask,
+                                             watchdog->mult, watchdog->shift);
+
+                cs_nsec = clocksource_cyc2ns((csnow - cs->cs_last) &
                                              cs->mask, cs->mult, cs->shift);
-                cs->wd_last = csnow;
+                cs->cs_last = csnow;
+                cs->wd_last = wdnow;
+
+                /* Check the deviation from the watchdog clocksource. */
                 if (abs(cs_nsec - wd_nsec) > WATCHDOG_THRESHOLD) {
                         clocksource_unstable(cs, cs_nsec - wd_nsec);
                         continue;
@@ -318,7 +321,6 @@ static inline void clocksource_start_watchdog(void)
                 return;
         init_timer(&watchdog_timer);
         watchdog_timer.function = clocksource_watchdog;
-        watchdog_last = watchdog->read(watchdog);
         watchdog_timer.expires = jiffies + WATCHDOG_INTERVAL;
         add_timer_on(&watchdog_timer, cpumask_first(cpu_online_mask));
         watchdog_running = 1;
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index dff763b7baf1..1f06468a10d7 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -240,13 +240,10 @@ static const char **find_next(void *v, loff_t *pos)
         const char **fmt = v;
         int start_index;
 
-        if (!fmt)
-                fmt = __start___trace_bprintk_fmt + *pos;
-
         start_index = __stop___trace_bprintk_fmt - __start___trace_bprintk_fmt;
 
         if (*pos < start_index)
-                return fmt;
+                return __start___trace_bprintk_fmt + *pos;
 
         return find_next_mod_format(start_index, v, fmt, pos);
 }
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 02159c755136..c46887b5a11e 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -498,7 +498,9 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
          * The node we allocated has no zone fallback lists. For avoiding
          * to access not-initialized zonelist, build here.
          */
+        mutex_lock(&zonelists_mutex);
         build_all_zonelists(NULL);
+        mutex_unlock(&zonelists_mutex);
 
         return pgdat;
 }
@@ -521,7 +523,7 @@ int mem_online_node(int nid)
 
         lock_memory_hotplug();
         pgdat = hotadd_new_pgdat(nid, 0);
-        if (pgdat) {
+        if (!pgdat) {
                 ret = -ENOMEM;
                 goto out;
         }
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index c7a581a96894..917ecb93ea28 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -205,7 +205,7 @@ int register_vlan_dev(struct net_device *dev)
         grp->nr_vlans++;
 
         if (ngrp) {
-                if (ops->ndo_vlan_rx_register)
+                if (ops->ndo_vlan_rx_register && (real_dev->features & NETIF_F_HW_VLAN_RX))
                         ops->ndo_vlan_rx_register(real_dev, ngrp);
                 rcu_assign_pointer(real_dev->vlgrp, ngrp);
         }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index f13ddbf858ba..77930aa522e3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -477,14 +477,16 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
          * command otherwise */
         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 
-        /* Events for 1.2 and newer controllers */
-        if (hdev->lmp_ver > 1) {
-                events[4] |= 0x01; /* Flow Specification Complete */
-                events[4] |= 0x02; /* Inquiry Result with RSSI */
-                events[4] |= 0x04; /* Read Remote Extended Features Complete */
-                events[5] |= 0x08; /* Synchronous Connection Complete */
-                events[5] |= 0x10; /* Synchronous Connection Changed */
-        }
+        /* CSR 1.1 dongles does not accept any bitfield so don't try to set
+         * any event mask for pre 1.2 devices */
+        if (hdev->lmp_ver <= 1)
+                return;
+
+        events[4] |= 0x01; /* Flow Specification Complete */
+        events[4] |= 0x02; /* Inquiry Result with RSSI */
+        events[4] |= 0x04; /* Read Remote Extended Features Complete */
+        events[5] |= 0x08; /* Synchronous Connection Complete */
+        events[5] |= 0x10; /* Synchronous Connection Changed */
 
         if (hdev->features[3] & LMP_RSSI_INQ)
                 events[4] |= 0x04; /* Inquiry Result with RSSI */
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 18dc9888d8c2..8248303f44e8 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -413,6 +413,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
+                memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = chan->conn->hcon->handle;
                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 386cfaffd4b7..1b10727ce523 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -788,6 +788,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
 
                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 
+                memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 42fdffd1d76c..cb4fb7837e5c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -369,6 +369,15 @@ static void __sco_sock_close(struct sock *sk)
 
         case BT_CONNECTED:
         case BT_CONFIG:
+                if (sco_pi(sk)->conn) {
+                        sk->sk_state = BT_DISCONN;
+                        sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
+                        hci_conn_put(sco_pi(sk)->conn->hcon);
+                        sco_pi(sk)->conn->hcon = NULL;
+                } else
+                        sco_chan_del(sk, ECONNRESET);
+                break;
+
         case BT_CONNECT:
         case BT_DISCONN:
                 sco_chan_del(sk, ECONNRESET);
@@ -819,7 +828,9 @@ static void sco_chan_del(struct sock *sk, int err)
                 conn->sk = NULL;
                 sco_pi(sk)->conn = NULL;
                 sco_conn_unlock(conn);
-                hci_conn_put(conn->hcon);
+
+                if (conn->hcon)
+                        hci_conn_put(conn->hcon);
         }
 
         sk->sk_state = BT_CLOSED;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index a6b2f86378c7..c188c803c09c 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -243,6 +243,7 @@ int br_netpoll_enable(struct net_bridge_port *p)
                 goto out;
 
         np->dev = p->dev;
+        strlcpy(np->dev_name, p->dev->name, IFNAMSIZ);
 
         err = __netpoll_setup(np);
         if (err) {
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2f14eafdeeab..29b9812c8da0 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1424,7 +1424,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         switch (ih->type) {
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
-                BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+                BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
                 err = br_ip4_multicast_add_group(br, port, ih->group);
                 break;
         case IGMPV3_HOST_MEMBERSHIP_REPORT:
@@ -1543,7 +1543,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                         goto out;
                 }
                 mld = (struct mld_msg *)skb_transport_header(skb2);
-                BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+                BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
                 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
                 break;
             }
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index 3a66b8c10e09..c23979e79dfa 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -255,7 +255,7 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 
                 if (cfsrvl_phyid_match(layer, phyid) && layer->ctrlcmd) {
 
-                        if ((ctrl == _CAIF_CTRLCMD_PHYIF_FLOW_OFF_IND ||
+                        if ((ctrl == _CAIF_CTRLCMD_PHYIF_DOWN_IND ||
                                 ctrl == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND) &&
                                         layer->id != 0) {
 
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index ed0eab39f531..02548b292b53 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -44,7 +44,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
         pr_debug("%s\n", __func__);
 
         if (!buf)
-                goto out;
+                return -EMSGSIZE;
 
         hdr = genlmsg_put(msg, 0, seq, &nl802154_family, flags,
                 IEEE802154_LIST_PHY);
@@ -65,6 +65,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
                                 pages * sizeof(uint32_t), buf);
 
         mutex_unlock(&phy->pib_lock);
+        kfree(buf);
         return genlmsg_end(msg, hdr);
 
 nla_put_failure:
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 9c1926027a26..eae1f676f870 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -676,6 +676,7 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
 
         lock_sock(sk2);
 
+        sock_rps_record_flow(sk2);
         WARN_ON(!((1 << sk2->sk_state) &
                   (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE)));
 
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 6ffe94ca5bc9..3267d3898437 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -437,7 +437,7 @@ static int valid_cc(const void *bc, int len, int cc)
                         return 0;
                 if (cc == len)
                         return 1;
-                if (op->yes < 4)
+                if (op->yes < 4 || op->yes & 3)
                         return 0;
                 len -= op->yes;
                 bc  += op->yes;
@@ -447,11 +447,11 @@ static int valid_cc(const void *bc, int len, int cc)
 
 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
 {
-        const unsigned char *bc = bytecode;
+        const void *bc = bytecode;
         int  len = bytecode_len;
 
         while (len > 0) {
-                struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
+                const struct inet_diag_bc_op *op = bc;
 
 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
                 switch (op->code) {
@@ -462,22 +462,20 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
                 case INET_DIAG_BC_S_LE:
                 case INET_DIAG_BC_D_GE:
                 case INET_DIAG_BC_D_LE:
-                        if (op->yes < 4 || op->yes > len + 4)
-                                return -EINVAL;
                 case INET_DIAG_BC_JMP:
-                        if (op->no < 4 || op->no > len + 4)
+                        if (op->no < 4 || op->no > len + 4 || op->no & 3)
                                 return -EINVAL;
                         if (op->no < len &&
                             !valid_cc(bytecode, bytecode_len, len - op->no))
                                 return -EINVAL;
                         break;
                 case INET_DIAG_BC_NOP:
-                        if (op->yes < 4 || op->yes > len + 4)
-                                return -EINVAL;
                         break;
                 default:
                         return -EINVAL;
                 }
+                if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
+                        return -EINVAL;
                 bc  += op->yes;
                 len -= op->yes;
         }
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index f7f9bd7ba12d..5c9b9d963918 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -203,7 +203,8 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
         else
                 pmsg->outdev_name[0] = '\0';
 
-        if (entry->indev && entry->skb->dev) {
+        if (entry->indev && entry->skb->dev &&
+            entry->skb->mac_header != entry->skb->network_header) {
                 pmsg->hw_type = entry->skb->dev->type;
                 pmsg->hw_addrlen = dev_parse_header(entry->skb,
                                                     pmsg->hw_addr);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 764743843503..24e556e83a3b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -566,7 +566,7 @@ check_entry(const struct ipt_entry *e, const char *name)
         const struct xt_entry_target *t;
 
         if (!ip_checkentry(&e->ip)) {
-                duprintf("ip check failed %p %s.\n", e, par->match->name);
+                duprintf("ip check failed %p %s.\n", e, name);
                 return -EINVAL;
         }
 
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c
index af6e9c778345..2b57e52c746c 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/ipv4/netfilter/ipt_ecn.c
@@ -25,7 +25,8 @@ MODULE_LICENSE("GPL");
 static inline bool match_ip(const struct sk_buff *skb,
                             const struct ipt_ecn_info *einfo)
 {
-        return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
+        return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^
+               !!(einfo->invert & IPT_ECN_OP_MATCH_IP);
 }
 
 static inline bool match_tcp(const struct sk_buff *skb,
@@ -76,8 +77,6 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par)
                         return false;
 
         if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
-                if (ip_hdr(skb)->protocol != IPPROTO_TCP)
-                        return false;
                 if (!match_tcp(skb, info, &par->hotdrop))
                         return false;
         }
@@ -97,7 +96,7 @@ static int ecn_mt_check(const struct xt_mtchk_param *par)
                 return -EINVAL;
 
         if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) &&
-            ip->proto != IPPROTO_TCP) {
+            (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
                 pr_info("cannot match TCP bits in rule for non-tcp packets\n");
                 return -EINVAL;
         }
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index db10075dd88e..de9da21113a1 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -121,7 +121,9 @@ static unsigned int ipv4_confirm(unsigned int hooknum,
                 return ret;
         }
 
-        if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
+        /* adjust seqs for loopback traffic only in outgoing direction */
+        if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
+            !nf_is_loopback_packet(skb)) {
                 typeof(nf_nat_seq_adjust_hook) seq_adjust;
 
                 seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 9aaa67165f42..39b403f854c6 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -41,7 +41,6 @@
 #include <linux/proc_fs.h>
 #include <net/sock.h>
 #include <net/ping.h>
-#include <net/icmp.h>
 #include <net/udp.h>
 #include <net/route.h>
 #include <net/inet_common.h>
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 045f0ec6a4a0..aa13ef105110 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1902,9 +1902,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
         hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
         rth = rt_intern_hash(hash, rth, skb, dev->ifindex);
-        err = 0;
-        if (IS_ERR(rth))
-                err = PTR_ERR(rth);
+        return IS_ERR(rth) ? PTR_ERR(rth) : 0;
 
 e_nobufs:
         return -ENOBUFS;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a7d6671e33b8..708dc203b034 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1589,6 +1589,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                         goto discard;
 
                 if (nsk != sk) {
+                        sock_rps_save_rxhash(nsk, skb->rxhash);
                         if (tcp_child_process(sk, nsk, skb)) {
                                 rsk = nsk;
                                 goto reset;
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 065fe405fb58..249394863284 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -204,7 +204,8 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
         else
                 pmsg->outdev_name[0] = '\0';
 
-        if (entry->indev && entry->skb->dev) {
+        if (entry->indev && entry->skb->dev &&
+            entry->skb->mac_header != entry->skb->network_header) {
                 pmsg->hw_type = entry->skb->dev->type;
                 pmsg->hw_addrlen = dev_parse_header(entry->skb, pmsg->hw_addr);
         }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index d1fd28711ba5..87551ca568cd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1644,6 +1644,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                  * the new socket..
                  */
                 if(nsk != sk) {
+                        sock_rps_save_rxhash(nsk, skb->rxhash);
                         if (tcp_child_process(sk, nsk, skb))
                                 goto reset;
                         if (opt_skb)
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index bf28ac2fc99b..782db275ac53 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -776,8 +776,16 @@ static void ip_vs_conn_expire(unsigned long data)
                 if (cp->control)
                         ip_vs_control_del(cp);
 
-                if (cp->flags & IP_VS_CONN_F_NFCT)
+                if (cp->flags & IP_VS_CONN_F_NFCT) {
                         ip_vs_conn_drop_conntrack(cp);
+                        /* Do not access conntracks during subsys cleanup
+                         * because nf_conntrack_find_get can not be used after
+                         * conntrack cleanup for the net.
+                         */
+                        smp_rmb();
+                        if (ipvs->enable)
+                                ip_vs_conn_drop_conntrack(cp);
+                }
 
                 ip_vs_pe_put(cp->pe);
                 kfree(cp->pe_data);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 55af2242bccd..24c28d238dcb 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1945,6 +1945,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
 {
         EnterFunction(2);
         net_ipvs(net)->enable = 0;      /* Disable packet reception */
+        smp_wmb();
         __ip_vs_sync_cleanup(net);
         LeaveFunction(2);
 }
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index e0ee010935e7..2e7ccbb43ddb 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -456,7 +456,8 @@ __build_packet_message(struct nfulnl_instance *inst,
         if (skb->mark)
                 NLA_PUT_BE32(inst->skb, NFULA_MARK, htonl(skb->mark));
 
-        if (indev && skb->dev) {
+        if (indev && skb->dev &&
+            skb->mac_header != skb->network_header) {
                 struct nfulnl_msg_packet_hw phw;
                 int len = dev_parse_header(skb, phw.hw_addr);
                 if (len > 0) {
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index b83123f12b42..fdd2fafe0a14 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -335,7 +335,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         if (entskb->mark)
                 NLA_PUT_BE32(skb, NFQA_MARK, htonl(entskb->mark));
 
-        if (indev && entskb->dev) {
+        if (indev && entskb->dev &&
+            entskb->mac_header != entskb->network_header) {
                 struct nfqnl_msg_packet_hw phw;
                 int len = dev_parse_header(entskb, phw.hw_addr);
                 if (len) {
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 339ba64cce1e..5daf6cc4faea 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -577,13 +577,13 @@ retry:
         }
         inode = &gss_msg->inode->vfs_inode;
         for (;;) {
-                prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
                 spin_lock(&inode->i_lock);
                 if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
                         break;
                 }
                 spin_unlock(&inode->i_lock);
-                if (signalled()) {
+                if (fatal_signal_pending(current)) {
                         err = -ERESTARTSYS;
                         goto out_intr;
                 }
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 0a9a2ec2e469..c3b75333b821 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -43,6 +43,7 @@
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/sunrpc/xdr.h>
 #include <linux/crypto.h>
+#include <linux/sunrpc/gss_krb5_enctypes.h>
 
 #ifdef RPC_DEBUG
 # define RPCDBG_FACILITY        RPCDBG_AUTH
@@ -750,7 +751,7 @@ static struct gss_api_mech gss_kerberos_mech = {
         .gm_ops         = &gss_kerberos_ops,
         .gm_pf_num      = ARRAY_SIZE(gss_kerberos_pfs),
         .gm_pfs         = gss_kerberos_pfs,
-        .gm_upcall_enctypes = "18,17,16,23,3,1,2",
+        .gm_upcall_enctypes = KRB5_SUPPORTED_ENCTYPES,
 };
 
 static int __init init_kerberos_module(void)
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index b84d7395535e..8c9141583d6f 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1061,7 +1061,7 @@ call_allocate(struct rpc_task *task)
 
         dprintk("RPC: %5u rpc_buffer allocation failed\n", task->tk_pid);
 
-        if (RPC_IS_ASYNC(task) || !signalled()) {
+        if (RPC_IS_ASYNC(task) || !fatal_signal_pending(current)) {
                 task->tk_action = call_allocate;
                 rpc_delay(task, HZ>>4);
                 return;
@@ -1175,6 +1175,9 @@ call_bind_status(struct rpc_task *task)
                         status = -EOPNOTSUPP;
                         break;
                 }
+                if (task->tk_rebind_retry == 0)
+                        break;
+                task->tk_rebind_retry--;
                 rpc_delay(task, 3*HZ);
                 goto retry_timeout;
         case -ETIMEDOUT:
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 6b43ee7221d5..a27406b1654f 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -792,6 +792,7 @@ static void rpc_init_task(struct rpc_task *task, const struct rpc_task_setup *ta
         /* Initialize retry counters */
         task->tk_garb_retry = 2;
         task->tk_cred_retry = 2;
+        task->tk_rebind_retry = 2;
 
         task->tk_priority = task_setup_data->priority - RPC_PRIORITY_LOW;
         task->tk_owner = current->tgid;
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index cd1f779fa51d..1be68269e1c2 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -474,17 +474,11 @@ struct cgroup_subsys devices_subsys = {
         .subsys_id = devices_subsys_id,
 };
 
-int devcgroup_inode_permission(struct inode *inode, int mask)
+int __devcgroup_inode_permission(struct inode *inode, int mask)
 {
         struct dev_cgroup *dev_cgroup;
         struct dev_whitelist_item *wh;
 
-        dev_t device = inode->i_rdev;
-        if (!device)
-                return 0;
-        if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
-                return 0;
-
         rcu_read_lock();
 
         dev_cgroup = task_devcgroup(current);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 8e319a416eec..82465328c39b 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -469,7 +469,7 @@ static struct key *construct_key_and_link(struct key_type *type,
         } else if (ret == -EINPROGRESS) {
                 ret = 0;
         } else {
-                key = ERR_PTR(ret);
+                goto couldnt_alloc_key;
         }
 
         key_put(dest_keyring);
@@ -479,6 +479,7 @@ static struct key *construct_key_and_link(struct key_type *type,
 construction_failed:
         key_negate_and_link(key, key_negative_timeout, NULL, NULL);
         key_put(key);
+couldnt_alloc_key:
         key_put(dest_keyring);
         kleave(" = %d", ret);
         return ERR_PTR(ret);
diff --git a/sound/pci/asihpi/asihpi.c b/sound/pci/asihpi/asihpi.c
index 2ca6f4f85b41..e3569bdd3b64 100644
--- a/sound/pci/asihpi/asihpi.c
+++ b/sound/pci/asihpi/asihpi.c
@@ -27,7 +27,6 @@
 #include "hpioctl.h"
 
 #include <linux/pci.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/jiffies.h>
 #include <linux/slab.h>
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 61a774b3d3cb..d21191dcfe88 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4883,7 +4883,6 @@ static const struct snd_pci_quirk alc880_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0xe309, "ULI", ALC880_3ST_DIG),
         SND_PCI_QUIRK(0x1025, 0xe310, "ULI", ALC880_3ST),
         SND_PCI_QUIRK(0x1039, 0x1234, NULL, ALC880_6ST_DIG),
-        SND_PCI_QUIRK(0x103c, 0x2a09, "HP", ALC880_5ST),
         SND_PCI_QUIRK(0x1043, 0x10b3, "ASUS W1V", ALC880_ASUS_W1V),
         SND_PCI_QUIRK(0x1043, 0x10c2, "ASUS W6A", ALC880_ASUS_DIG),
         SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS Wxx", ALC880_ASUS_DIG),
@@ -12600,6 +12599,7 @@ static const struct hda_verb alc262_toshiba_rx1_unsol_verbs[] = {
  */
 enum {
         PINFIX_FSC_H270,
+        PINFIX_HP_Z200,
 };
 
 static const struct alc_fixup alc262_fixups[] = {
@@ -12612,9 +12612,17 @@ static const struct alc_fixup alc262_fixups[] = {
                         { }
                 }
         },
+        [PINFIX_HP_Z200] = {
+                .type = ALC_FIXUP_PINS,
+                .v.pins = (const struct alc_pincfg[]) {
+                        { 0x16, 0x99130120 }, /* internal speaker */
+                        { }
+                }
+        },
 };
 
 static const struct snd_pci_quirk alc262_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x103c, 0x170b, "HP Z200", PINFIX_HP_Z200),
         SND_PCI_QUIRK(0x1734, 0x1147, "FSC Celsius H270", PINFIX_FSC_H270),
         {}
 };
@@ -12731,6 +12739,8 @@ static const struct snd_pci_quirk alc262_cfg_tbl[] = {
                            ALC262_HP_BPC),
         SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x1500, "HP z series",
                            ALC262_HP_BPC),
+        SND_PCI_QUIRK(0x103c, 0x170b, "HP Z200",
+                           ALC262_AUTO),
         SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x1700, "HP xw series",
                            ALC262_HP_BPC),
         SND_PCI_QUIRK(0x103c, 0x2800, "HP D7000", ALC262_HP_BPC_D7000_WL),
@@ -13872,7 +13882,6 @@ static const struct snd_pci_quirk alc268_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x1205, "ASUS W7J", ALC268_3ST),
         SND_PCI_QUIRK(0x1170, 0x0040, "ZEPTO", ALC268_ZEPTO),
         SND_PCI_QUIRK(0x14c0, 0x0025, "COMPAL IFL90/JFL-92", ALC268_TOSHIBA),
-        SND_PCI_QUIRK(0x152d, 0x0763, "Diverse (CPR2000)", ALC268_ACER),
         SND_PCI_QUIRK(0x152d, 0x0771, "Quanta IL1", ALC267_QUANTA_IL1),
         {}
 };
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index c952582fb218..f43bb0eaed8b 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -745,12 +745,23 @@ static int via_independent_hp_put(struct snd_kcontrol *kcontrol,
         struct via_spec *spec = codec->spec;
         hda_nid_t nid = kcontrol->private_value;
         unsigned int pinsel = ucontrol->value.enumerated.item[0];
+        unsigned int parm0, parm1;
         /* Get Independent Mode index of headphone pin widget */
         spec->hp_independent_mode = spec->hp_independent_mode_index == pinsel
                 ? 1 : 0;
-        if (spec->codec_type == VT1718S)
+        if (spec->codec_type == VT1718S) {
                 snd_hda_codec_write(codec, nid, 0,
                                     AC_VERB_SET_CONNECT_SEL, pinsel ? 2 : 0);
+                /* Set correct mute switch for MW3 */
+                parm0 = spec->hp_independent_mode ?
+                               AMP_IN_UNMUTE(0) : AMP_IN_MUTE(0);
+                parm1 = spec->hp_independent_mode ?
+                               AMP_IN_MUTE(1) : AMP_IN_UNMUTE(1);
+                snd_hda_codec_write(codec, 0x1b, 0,
+                                    AC_VERB_SET_AMP_GAIN_MUTE, parm0);
+                snd_hda_codec_write(codec, 0x1b, 0,
+                                    AC_VERB_SET_AMP_GAIN_MUTE, parm1);
+        }
         else
                 snd_hda_codec_write(codec, nid, 0,
                                     AC_VERB_SET_CONNECT_SEL, pinsel);
@@ -4283,9 +4294,6 @@ static const struct hda_verb vt1718S_volume_init_verbs[] = {
         {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)},
         {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)},
         {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(5)},
-
-        /* Setup default input of Front HP to MW9 */
-        {0x28, AC_VERB_SET_CONNECT_SEL, 0x1},
         /* PW9 PW10 Output enable */
         {0x2d, AC_VERB_SET_PIN_WIDGET_CONTROL, AC_PINCTL_OUT_EN},
         {0x2e, AC_VERB_SET_PIN_WIDGET_CONTROL, AC_PINCTL_OUT_EN},
@@ -4294,10 +4302,10 @@ static const struct hda_verb vt1718S_volume_init_verbs[] = {
         /* Enable Boost Volume backdoor */
         {0x1, 0xf88, 0x8},
         /* MW0/1/2/3/4: un-mute index 0 (AOWx), mute index 1 (MW9) */
-        {0x18, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+        {0x18, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
         {0x19, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
         {0x1a, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
-        {0x1b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+        {0x1b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
         {0x1c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
         {0x18, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(1)},
         {0x19, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
@@ -4307,8 +4315,6 @@ static const struct hda_verb vt1718S_volume_init_verbs[] = {
         /* set MUX1 = 2 (AOW4), MUX2 = 1 (AOW3) */
         {0x34, AC_VERB_SET_CONNECT_SEL, 0x2},
         {0x35, AC_VERB_SET_CONNECT_SEL, 0x1},
-        /* Unmute MW4's index 0 */
-        {0x1c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
         { }
 };
 
@@ -4456,6 +4462,19 @@ static int vt1718S_auto_create_multi_out_ctls(struct via_spec *spec,
                         if (err < 0)
                                 return err;
                 } else if (i == AUTO_SEQ_FRONT) {
+                        /* add control to mixer index 0 */
+                        err = via_add_control(spec, VIA_CTL_WIDGET_VOL,
+                                              "Master Front Playback Volume",
+                                              HDA_COMPOSE_AMP_VAL(0x21, 3, 5,
+                                                                  HDA_INPUT));
+                        if (err < 0)
+                                return err;
+                        err = via_add_control(spec, VIA_CTL_WIDGET_MUTE,
+                                              "Master Front Playback Switch",
+                                              HDA_COMPOSE_AMP_VAL(0x21, 3, 5,
+                                                                  HDA_INPUT));
+                        if (err < 0)
+                                return err;
                         /* Front */
                         sprintf(name, "%s Playback Volume", chname[i]);
                         err = via_add_control(
diff --git a/sound/soc/codecs/wm8991.c b/sound/soc/codecs/wm8991.c
index 3c2ee1bb73cd..6af23d06870f 100644
--- a/sound/soc/codecs/wm8991.c
+++ b/sound/soc/codecs/wm8991.c
@@ -13,7 +13,6 @@
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/delay.h>
diff --git a/sound/soc/imx/Kconfig b/sound/soc/imx/Kconfig
index d8f130d39dd9..bb699bb55a50 100644
--- a/sound/soc/imx/Kconfig
+++ b/sound/soc/imx/Kconfig
@@ -11,9 +11,6 @@ menuconfig SND_IMX_SOC
 
 if SND_IMX_SOC
 
-config SND_MXC_SOC_SSI
-        tristate
-
 config SND_MXC_SOC_FIQ
         tristate
 
@@ -24,7 +21,6 @@ config SND_MXC_SOC_WM1133_EV1
         tristate "Audio on the the i.MX31ADS with WM1133-EV1 fitted"
         depends on MACH_MX31ADS_WM1133_EV1 && EXPERIMENTAL
         select SND_SOC_WM8350
-        select SND_MXC_SOC_SSI
         select SND_MXC_SOC_FIQ
         help
           Enable support for audio on the i.MX31ADS with the WM1133-EV1
@@ -34,7 +30,6 @@ config SND_SOC_MX27VIS_AIC32X4
         tristate "SoC audio support for Visstrim M10 boards"
         depends on MACH_IMX27_VISSTRIM_M10
         select SND_SOC_TVL320AIC32X4
-        select SND_MXC_SOC_SSI
         select SND_MXC_SOC_MX2
         help
           Say Y if you want to add support for SoC audio on Visstrim SM10
@@ -44,7 +39,6 @@ config SND_SOC_PHYCORE_AC97
         tristate "SoC Audio support for Phytec phyCORE (and phyCARD) boards"
         depends on MACH_PCM043 || MACH_PCA100
         select SND_SOC_WM9712
-        select SND_MXC_SOC_SSI
         select SND_MXC_SOC_FIQ
         help
           Say Y if you want to add support for SoC audio on Phytec phyCORE
@@ -57,7 +51,6 @@ config SND_SOC_EUKREA_TLV320
                 || MACH_EUKREA_MBIMXSD35_BASEBOARD \
                 || MACH_EUKREA_MBIMXSD51_BASEBOARD
         select SND_SOC_TLV320AIC23
-        select SND_MXC_SOC_SSI
         select SND_MXC_SOC_FIQ
         help
           Enable I2S based access to the TLV320AIC23B codec attached
diff --git a/sound/soc/imx/imx-pcm-dma-mx2.c b/sound/soc/imx/imx-pcm-dma-mx2.c
index aab7765f401a..4173b3d87f97 100644
--- a/sound/soc/imx/imx-pcm-dma-mx2.c
+++ b/sound/soc/imx/imx-pcm-dma-mx2.c
@@ -337,3 +337,5 @@ static void __exit snd_imx_pcm_exit(void)
         platform_driver_unregister(&imx_pcm_driver);
 }
 module_exit(snd_imx_pcm_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:imx-pcm-audio");
diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
index 5b13feca7537..61fceb09cdb5 100644
--- a/sound/soc/imx/imx-ssi.c
+++ b/sound/soc/imx/imx-ssi.c
@@ -774,4 +774,4 @@ module_exit(imx_ssi_exit);
 MODULE_AUTHOR("Sascha Hauer, <s.hauer@pengutronix.de>");
 MODULE_DESCRIPTION("i.MX I2S/ac97 SoC Interface");
 MODULE_LICENSE("GPL");
-
+MODULE_ALIAS("platform:imx-ssi");
diff --git a/sound/soc/pxa/pxa2xx-pcm.c b/sound/soc/pxa/pxa2xx-pcm.c
index 2ce0b2d891d5..fab20a54e863 100644
--- a/sound/soc/pxa/pxa2xx-pcm.c
+++ b/sound/soc/pxa/pxa2xx-pcm.c
@@ -95,14 +95,14 @@ static int pxa2xx_soc_pcm_new(struct snd_card *card, struct snd_soc_dai *dai,
         if (!card->dev->coherent_dma_mask)
                 card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
 
-        if (dai->driver->playback.channels_min) {
+        if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
                 ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
                         SNDRV_PCM_STREAM_PLAYBACK);
                 if (ret)
                         goto out;
         }
 
-        if (dai->driver->capture.channels_min) {
+        if (pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) {
                 ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
                         SNDRV_PCM_STREAM_CAPTURE);
                 if (ret)
diff --git a/sound/soc/soc-cache.c b/sound/soc/soc-cache.c
index c005ceb70c9d..039b9532b270 100644
--- a/sound/soc/soc-cache.c
+++ b/sound/soc/soc-cache.c
@@ -409,9 +409,6 @@ int snd_soc_codec_set_cache_io(struct snd_soc_codec *codec,
         codec->bulk_write_raw = snd_soc_hw_bulk_write_raw;
 
         switch (control) {
-        case SND_SOC_CUSTOM:
-                break;
-
         case SND_SOC_I2C:
 #if defined(CONFIG_I2C) || (defined(CONFIG_I2C_MODULE) && defined(MODULE))
                 codec->hw_write = (hw_write_t)i2c_master_send;
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 032ba6398a5c..940257b5774e 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -633,7 +633,7 @@ prefix_SQ = $(subst ','\'',$(prefix))
 
 SHELL_PATH_SQ = $(subst ','\'',$(SHELL_PATH))
 
-LIBS = -Wl,--whole-archive $(PERFLIBS) -Wl,--no-whole-archive $(EXTLIBS)
+LIBS = -Wl,--whole-archive $(PERFLIBS) -Wl,--no-whole-archive -Wl,--start-group $(EXTLIBS) -Wl,--end-group
 
 ALL_CFLAGS += $(BASIC_CFLAGS)
 ALL_CFLAGS += $(ARCH_CFLAGS)
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 1e88485c16a0..0a7ed5b5e281 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -2187,6 +2187,7 @@ static const struct flag flags[] = {
         { "TASKLET_SOFTIRQ", 6 },
         { "SCHED_SOFTIRQ", 7 },
         { "HRTIMER_SOFTIRQ", 8 },
+        { "RCU_SOFTIRQ", 9 },
 
         { "HRTIMER_NORESTART", 0 },
         { "HRTIMER_RESTART", 1 },