diff --git a/Documentation/kernel-parameters.txt 
b/Documentation/kernel-parameters.txt
index c1601e5..753d18a 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -557,6 +557,8 @@ bytes respectively. Such letter suffixes can also be 
entirely omitted.
                        UART at the specified I/O port or MMIO address,
                        switching to the matching ttyS device later.  The
                        options are the same as for ttyS, above.
+               hvc<n>  Use the hypervisor console device <n>. This is for
+                       both Xen and PowerPC hypervisors.
 
                 If the device connected to the port is not a TTY but a braille
                 device, prepend "brl," before the device type, for instance
@@ -742,6 +744,7 @@ bytes respectively. Such letter suffixes can also be 
entirely omitted.
 
        earlyprintk=    [X86,SH,BLACKFIN]
                        earlyprintk=vga
+                       earlyprintk=xen
                        earlyprintk=serial[,ttySn[,baudrate]]
                        earlyprintk=ttySn[,baudrate]
                        earlyprintk=dbgp[debugController#]
@@ -759,6 +762,8 @@ bytes respectively. Such letter suffixes can also be 
entirely omitted.
                        The VGA output is eventually overwritten by the real
                        console.
 
+                       The xen output can only be used by Xen PV guests.
+
        ekgdboc=        [X86,KGDB] Allow early kernel console debugging
                        ekgdboc=kbd
 
diff --git a/Makefile b/Makefile
index 250be36..282e8da 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 4
-SUBLEVEL = 34
+SUBLEVEL = 35
 EXTRAVERSION =
 NAME = Saber-toothed Squirrel
 
diff --git a/arch/x86/kernel/head.c b/arch/x86/kernel/head.c
index 48d9d4e..992f442 100644
--- a/arch/x86/kernel/head.c
+++ b/arch/x86/kernel/head.c
@@ -5,8 +5,6 @@
 #include <asm/setup.h>
 #include <asm/bios_ebda.h>
 
-#define BIOS_LOWMEM_KILOBYTES 0x413
-
 /*
  * The BIOS places the EBDA/XBDA at the top of conventional
  * memory, and usually decreases the reported amount of
@@ -16,17 +14,30 @@
  * chipset: reserve a page before VGA to prevent PCI prefetch
  * into it (errata #56). Usually the page is reserved anyways,
  * unless you have no PS/2 mouse plugged in.
+ *
+ * This functions is deliberately very conservative.  Losing
+ * memory in the bottom megabyte is rarely a problem, as long
+ * as we have enough memory to install the trampoline.  Using
+ * memory that is in use by the BIOS or by some DMA device
+ * the BIOS didn't shut down *is* a big problem.
  */
+
+#define BIOS_LOWMEM_KILOBYTES  0x413
+#define LOWMEM_CAP             0x9f000U        /* Absolute maximum */
+#define INSANE_CUTOFF          0x20000U        /* Less than this = insane */
+
 void __init reserve_ebda_region(void)
 {
        unsigned int lowmem, ebda_addr;
 
-       /* To determine the position of the EBDA and the */
-       /* end of conventional memory, we need to look at */
-       /* the BIOS data area. In a paravirtual environment */
-       /* that area is absent. We'll just have to assume */
-       /* that the paravirt case can handle memory setup */
-       /* correctly, without our help. */
+       /*
+        * To determine the position of the EBDA and the
+        * end of conventional memory, we need to look at
+        * the BIOS data area. In a paravirtual environment
+        * that area is absent. We'll just have to assume
+        * that the paravirt case can handle memory setup
+        * correctly, without our help.
+        */
        if (paravirt_enabled())
                return;
 
@@ -37,19 +48,23 @@ void __init reserve_ebda_region(void)
        /* start of EBDA area */
        ebda_addr = get_bios_ebda();
 
-       /* Fixup: bios puts an EBDA in the top 64K segment */
-       /* of conventional memory, but does not adjust lowmem. */
-       if ((lowmem - ebda_addr) <= 0x10000)
-               lowmem = ebda_addr;
+       /*
+        * Note: some old Dells seem to need 4k EBDA without
+        * reporting so, so just consider the memory above 0x9f000
+        * to be off limits (bugzilla 2990).
+        */
+
+       /* If the EBDA address is below 128K, assume it is bogus */
+       if (ebda_addr < INSANE_CUTOFF)
+               ebda_addr = LOWMEM_CAP;
 
-       /* Fixup: bios does not report an EBDA at all. */
-       /* Some old Dells seem to need 4k anyhow (bugzilla 2990) */
-       if ((ebda_addr == 0) && (lowmem >= 0x9f000))
-               lowmem = 0x9f000;
+       /* If lowmem is less than 128K, assume it is bogus */
+       if (lowmem < INSANE_CUTOFF)
+               lowmem = LOWMEM_CAP;
 
-       /* Paranoia: should never happen, but... */
-       if ((lowmem == 0) || (lowmem >= 0x100000))
-               lowmem = 0x9f000;
+       /* Use the lower of the lowmem and EBDA markers as the cutoff */
+       lowmem = min(lowmem, ebda_addr);
+       lowmem = min(lowmem, LOWMEM_CAP); /* Absolute cap */
 
        /* reserve all memory between lowmem and the 1MB mark */
        memblock_reserve(lowmem, 0x100000 - lowmem);
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 3705bb0..1e40637 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -84,9 +84,10 @@ int efi_enabled(int facility)
 }
 EXPORT_SYMBOL(efi_enabled);
 
+static bool disable_runtime = false;
 static int __init setup_noefi(char *arg)
 {
-       clear_bit(EFI_RUNTIME_SERVICES, &x86_efi_facility);
+       disable_runtime = true;
        return 0;
 }
 early_param("noefi", setup_noefi);
@@ -733,7 +734,7 @@ void __init efi_init(void)
        if (!efi_is_native())
                pr_info("No EFI runtime due to 32/64-bit mismatch with 
kernel\n");
        else {
-               if (efi_runtime_init())
+               if (disable_runtime || efi_runtime_init())
                        return;
                set_bit(EFI_RUNTIME_SERVICES, &x86_efi_facility);
        }
diff --git a/block/genhd.c b/block/genhd.c
index 9cf5583..60108d9 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -25,7 +25,7 @@ static DEFINE_MUTEX(block_class_lock);
 struct kobject *block_depr;
 
 /* for extended dynamic devt allocation, currently only one major is used */
-#define MAX_EXT_DEVT           (1 << MINORBITS)
+#define NR_EXT_DEVT            (1 << MINORBITS)
 
 /* For extended devt allocation.  ext_devt_mutex prevents look up
  * results from going away underneath its user.
@@ -420,17 +420,18 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
        do {
                if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
                        return -ENOMEM;
+               mutex_lock(&ext_devt_mutex);
                rc = idr_get_new(&ext_devt_idr, part, &idx);
+               if (!rc && idx >= NR_EXT_DEVT) {
+                       idr_remove(&ext_devt_idr, idx);
+                       rc = -EBUSY;
+               }
+               mutex_unlock(&ext_devt_mutex);
        } while (rc == -EAGAIN);
 
        if (rc)
                return rc;
 
-       if (idx > MAX_EXT_DEVT) {
-               idr_remove(&ext_devt_idr, idx);
-               return -EBUSY;
-       }
-
        *devt = MKDEV(BLOCK_EXT_MAJOR, blk_mangle_minor(idx));
        return 0;
 }
@@ -644,7 +645,6 @@ void del_gendisk(struct gendisk *disk)
        disk_part_iter_exit(&piter);
 
        invalidate_partition(disk, 0);
-       blk_free_devt(disk_to_dev(disk)->devt);
        set_capacity(disk, 0);
        disk->flags &= ~GENHD_FL_UP;
 
@@ -662,6 +662,7 @@ void del_gendisk(struct gendisk *disk)
        if (!sysfs_deprecated)
                sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
        device_del(disk_to_dev(disk));
+       blk_free_devt(disk_to_dev(disk)->devt);
 }
 EXPORT_SYMBOL(del_gendisk);
 
diff --git a/block/partition-generic.c b/block/partition-generic.c
index 6df5d69..7b8b8d1 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -249,11 +249,11 @@ void delete_partition(struct gendisk *disk, int partno)
        if (!part)
                return;
 
-       blk_free_devt(part_devt(part));
        rcu_assign_pointer(ptbl->part[partno], NULL);
        rcu_assign_pointer(ptbl->last_lookup, NULL);
        kobject_put(part->holder_dir);
        device_del(part_to_dev(part));
+       blk_free_devt(part_devt(part));
 
        hd_struct_put(part);
 }
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index aa0a904..189c704 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -186,6 +186,14 @@ static struct dmi_system_id __initdata 
acpisleep_dmi_table[] = {
        },
        {
        .callback = init_nvs_nosave,
+       .ident = "Sony Vaio VGN-FW41E_H",
+       .matches = {
+               DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+               DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW41E_H"),
+               },
+       },
+       {
+       .callback = init_nvs_nosave,
        .ident = "Sony Vaio VGN-FW21E",
        .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 3c809bf..88f6908 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -331,6 +331,23 @@ static const struct pci_device_id piix_pci_tbl[] = {
        { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
        /* SATA Controller IDE (DH89xxCC) */
        { 0x8086, 0x2326, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+       /* SATA Controller IDE (Avoton) */
+       { 0x8086, 0x1f20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+       /* SATA Controller IDE (Avoton) */
+       { 0x8086, 0x1f21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+       /* SATA Controller IDE (Avoton) */
+       { 0x8086, 0x1f30, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+       /* SATA Controller IDE (Avoton) */
+       { 0x8086, 0x1f31, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+       /* SATA Controller IDE (Wellsburg) */
+       { 0x8086, 0x8d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+       /* SATA Controller IDE (Wellsburg) */
+       { 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+       /* SATA Controller IDE (Wellsburg) */
+       { 0x8086, 0x8d60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+       /* SATA Controller IDE (Wellsburg) */
+       { 0x8086, 0x8d68, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+
        { }     /* terminate list */
 };
 
diff --git a/drivers/block/xen-blkback/blkback.c 
b/drivers/block/xen-blkback/blkback.c
index c6decb9..73d8c92 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -623,7 +623,6 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
                goto fail_response;
        }
 
-       preq.dev           = req->u.rw.handle;
        preq.sector_number = req->u.rw.sector_number;
        preq.nr_sects      = 0;
 
diff --git a/drivers/block/xen-blkback/xenbus.c 
b/drivers/block/xen-blkback/xenbus.c
index 4f66171..a155254 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -367,6 +367,7 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
                be->blkif = NULL;
        }
 
+       kfree(be->mode);
        kfree(be);
        dev_set_drvdata(&dev->dev, NULL);
        return 0;
@@ -502,6 +503,7 @@ static void backend_changed(struct xenbus_watch *watch,
                = container_of(watch, struct backend_info, backend_watch);
        struct xenbus_device *dev = be->dev;
        int cdrom = 0;
+       unsigned long handle;
        char *device_type;
 
        DPRINTK("");
@@ -521,10 +523,10 @@ static void backend_changed(struct xenbus_watch *watch,
                return;
        }
 
-       if ((be->major || be->minor) &&
-           ((be->major != major) || (be->minor != minor))) {
-               pr_warn(DRV_PFX "changing physical device (from %x:%x to %x:%x) 
not supported.\n",
-                       be->major, be->minor, major, minor);
+       if (be->major | be->minor) {
+               if (be->major != major || be->minor != minor)
+                       pr_warn(DRV_PFX "changing physical device (from %x:%x 
to %x:%x) not supported.\n",
+                               be->major, be->minor, major, minor);
                return;
        }
 
@@ -542,36 +544,33 @@ static void backend_changed(struct xenbus_watch *watch,
                kfree(device_type);
        }
 
-       if (be->major == 0 && be->minor == 0) {
-               /* Front end dir is a number, which is used as the handle. */
-
-               char *p = strrchr(dev->otherend, '/') + 1;
-               long handle;
-               err = strict_strtoul(p, 0, &handle);
-               if (err)
-                       return;
+       /* Front end dir is a number, which is used as the handle. */
+       err = strict_strtoul(strrchr(dev->otherend, '/') + 1, 0, &handle);
+       if (err)
+               return;
 
-               be->major = major;
-               be->minor = minor;
+       be->major = major;
+       be->minor = minor;
 
-               err = xen_vbd_create(be->blkif, handle, major, minor,
-                                (NULL == strchr(be->mode, 'w')), cdrom);
-               if (err) {
-                       be->major = 0;
-                       be->minor = 0;
-                       xenbus_dev_fatal(dev, err, "creating vbd structure");
-                       return;
-               }
+       err = xen_vbd_create(be->blkif, handle, major, minor,
+                            !strchr(be->mode, 'w'), cdrom);
 
+       if (err)
+               xenbus_dev_fatal(dev, err, "creating vbd structure");
+       else {
                err = xenvbd_sysfs_addif(dev);
                if (err) {
                        xen_vbd_free(&be->blkif->vbd);
-                       be->major = 0;
-                       be->minor = 0;
                        xenbus_dev_fatal(dev, err, "creating sysfs entries");
-                       return;
                }
+       }
 
+       if (err) {
+               kfree(be->mode);
+               be->mode = NULL;
+               be->major = 0;
+               be->minor = 0;
+       } else {
                /* We're potentially connected now */
                xen_update_blkif_status(be->blkif);
        }
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index 68109e9..04ebeaf 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -999,6 +999,10 @@ static void fw_device_init(struct work_struct *work)
        ret = idr_pre_get(&fw_device_idr, GFP_KERNEL) ?
              idr_get_new(&fw_device_idr, device, &minor) :
              -ENOMEM;
+       if (minor >= 1 << MINORBITS) {
+               idr_remove(&fw_device_idr, minor);
+               minor = -ENOSPC;
+       }
        up_write(&fw_device_rwsem);
 
        if (ret < 0)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 1a92a27..ff73d60 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1922,6 +1922,7 @@ static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HYBRID) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HEATCONTROL) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_BEATPAD) 
},
+       { HID_USB_DEVICE(USB_VENDOR_ID_MASTERKIT, 
USB_DEVICE_ID_MASTERKIT_MA901RADIO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1024LS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1208LS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT1) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5583899..02f4664 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -520,6 +520,9 @@
 #define USB_VENDOR_ID_MADCATZ          0x0738
 #define USB_DEVICE_ID_MADCATZ_BEATPAD  0x4540
 
+#define USB_VENDOR_ID_MASTERKIT                        0x16c0
+#define USB_DEVICE_ID_MASTERKIT_MA901RADIO     0x05df
+
 #define USB_VENDOR_ID_MCC              0x09db
 #define USB_DEVICE_ID_MCC_PMD1024LS    0x0076
 #define USB_DEVICE_ID_MCC_PMD1208LS    0x007a
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index ef0ae93..b573f80 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1572,8 +1572,6 @@ int __init amd_iommu_init_hardware(void)
        if (amd_iommu_pd_alloc_bitmap == NULL)
                goto free;
 
-       /* init the device table */
-       init_device_table();
 
        /*
         * let all alias entries point to itself
@@ -1655,6 +1653,7 @@ out:
  */
 static int __init amd_iommu_init(void)
 {
+       struct amd_iommu *iommu;
        int ret = 0;
 
        ret = amd_iommu_init_hardware();
@@ -1673,6 +1672,12 @@ static int __init amd_iommu_init(void)
        if (ret)
                goto free;
 
+       /* init the device table */
+       init_device_table();
+
+       for_each_iommu(iommu)
+               iommu_flush_all_caches(iommu);
+
        amd_iommu_init_api();
 
        x86_platform.iommu_shutdown = disable_iommus;
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index cabc19c..cec1f8c 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -778,8 +778,10 @@ static ssize_t show_protocols(struct device *device,
        } else if (dev->raw) {
                enabled = dev->raw->enabled_protocols;
                allowed = ir_raw_get_allowed_protocols();
-       } else
+       } else {
+               mutex_unlock(&dev->lock);
                return -ENODEV;
+       }
 
        IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
                   (long long)allowed,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c 
b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 63089cc..9284bca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -938,6 +938,8 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                          AR_PHY_CL_TAB_1,
                                          AR_PHY_CL_TAB_2 };
 
+       ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, 
ah->caps.tx_chainmask);
+
        if (rtt) {
                if (!ar9003_hw_rtt_restore(ah, chan))
                        run_rtt_cal = true;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c 
b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 600aca9..f86ee0c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -543,7 +543,7 @@ static void ar9003_hw_init_bb(struct ath_hw *ah,
        udelay(synthDelay + BASE_ACTIVATE_DELAY);
 }
 
-static void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
 {
        switch (rx) {
        case 0x5:
diff --git a/drivers/net/wireless/ath/ath9k/hw.h 
b/drivers/net/wireless/ath/ath9k/hw.h
index f8e1fbb..d5c5dca 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -1014,6 +1014,7 @@ int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int 
chain);
 int ar9003_paprd_init_table(struct ath_hw *ah);
 bool ar9003_paprd_is_done(struct ath_hw *ah);
 void ar9003_hw_set_paprd_txdesc(struct ath_hw *ah, void *ds, u8 chains);
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 
 /* Hardware family op attach helpers */
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
diff --git a/drivers/power/ab8500_btemp.c b/drivers/power/ab8500_btemp.c
index d8bb993..2a6bf76 100644
--- a/drivers/power/ab8500_btemp.c
+++ b/drivers/power/ab8500_btemp.c
@@ -1115,7 +1115,7 @@ static void __exit ab8500_btemp_exit(void)
        platform_driver_unregister(&ab8500_btemp_driver);
 }
 
-subsys_initcall_sync(ab8500_btemp_init);
+device_initcall(ab8500_btemp_init);
 module_exit(ab8500_btemp_exit);
 
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/power/abx500_chargalg.c b/drivers/power/abx500_chargalg.c
index 804b88c..d8cd151 100644
--- a/drivers/power/abx500_chargalg.c
+++ b/drivers/power/abx500_chargalg.c
@@ -1698,7 +1698,7 @@ static ssize_t abx500_chargalg_sysfs_charger(struct 
kobject *kobj,
 static struct attribute abx500_chargalg_en_charger = \
 {
        .name = "chargalg",
-       .mode = S_IWUGO,
+       .mode = S_IWUSR,
 };
 
 static struct attribute *abx500_chargalg_chg[] = {
diff --git a/drivers/staging/comedi/comedi_fops.c 
b/drivers/staging/comedi/comedi_fops.c
index cf67ce5..3799cf1 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1577,7 +1577,7 @@ static unsigned int comedi_poll(struct file *file, 
poll_table * wait)
 
        mask = 0;
        read_subdev = comedi_get_read_subdevice(dev_file_info);
-       if (read_subdev) {
+       if (read_subdev && read_subdev->async) {
                poll_wait(file, &read_subdev->async->wait_head, wait);
                if (!read_subdev->busy
                    || comedi_buf_read_n_available(read_subdev->async) > 0
@@ -1587,7 +1587,7 @@ static unsigned int comedi_poll(struct file *file, 
poll_table * wait)
                }
        }
        write_subdev = comedi_get_write_subdevice(dev_file_info);
-       if (write_subdev) {
+       if (write_subdev && write_subdev->async) {
                poll_wait(file, &write_subdev->async->wait_head, wait);
                comedi_buf_write_alloc(write_subdev->async,
                                       write_subdev->async->prealloc_bufsz);
@@ -1629,7 +1629,7 @@ static ssize_t comedi_write(struct file *file, const char 
__user *buf,
        }
 
        s = comedi_get_write_subdevice(dev_file_info);
-       if (s == NULL) {
+       if (s == NULL || s->async == NULL) {
                retval = -EIO;
                goto done;
        }
@@ -1740,7 +1740,7 @@ static ssize_t comedi_read(struct file *file, char __user 
*buf, size_t nbytes,
        }
 
        s = comedi_get_read_subdevice(dev_file_info);
-       if (s == NULL) {
+       if (s == NULL || s->async == NULL) {
                retval = -EIO;
                goto done;
        }
diff --git a/drivers/staging/comedi/drivers/ni_labpc.c 
b/drivers/staging/comedi/drivers/ni_labpc.c
index 721b2be..0517a23 100644
--- a/drivers/staging/comedi/drivers/ni_labpc.c
+++ b/drivers/staging/comedi/drivers/ni_labpc.c
@@ -1264,7 +1264,9 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct 
comedi_subdevice *s)
        else
                channel = CR_CHAN(cmd->chanlist[0]);
        /* munge channel bits for differential / scan disabled mode */
-       if (labpc_ai_scan_mode(cmd) != MODE_SINGLE_CHAN && aref == AREF_DIFF)
+       if ((labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN ||
+            labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN_INTERVAL) &&
+           aref == AREF_DIFF)
                channel *= 2;
        devpriv->command1_bits |= ADC_CHAN_BITS(channel);
        devpriv->command1_bits |= thisboard->ai_range_code[range];
@@ -1280,21 +1282,6 @@ static int labpc_ai_cmd(struct comedi_device *dev, 
struct comedi_subdevice *s)
                devpriv->write_byte(devpriv->command1_bits,
                                    dev->iobase + COMMAND1_REG);
        }
-       /*  setup any external triggering/pacing (command4 register) */
-       devpriv->command4_bits = 0;
-       if (cmd->convert_src != TRIG_EXT)
-               devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT;
-       /* XXX should discard first scan when using interval scanning
-        * since manual says it is not synced with scan clock */
-       if (labpc_use_continuous_mode(cmd) == 0) {
-               devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT;
-               if (cmd->scan_begin_src == TRIG_EXT)
-                       devpriv->command4_bits |= EXT_SCAN_EN_BIT;
-       }
-       /*  single-ended/differential */
-       if (aref == AREF_DIFF)
-               devpriv->command4_bits |= ADC_DIFF_BIT;
-       devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG);
 
        devpriv->write_byte(cmd->chanlist_len,
                            dev->iobase + INTERVAL_COUNT_REG);
@@ -1374,6 +1361,22 @@ static int labpc_ai_cmd(struct comedi_device *dev, 
struct comedi_subdevice *s)
                devpriv->command3_bits &= ~ADC_FNE_INTR_EN_BIT;
        devpriv->write_byte(devpriv->command3_bits, dev->iobase + COMMAND3_REG);
 
+       /*  setup any external triggering/pacing (command4 register) */
+       devpriv->command4_bits = 0;
+       if (cmd->convert_src != TRIG_EXT)
+               devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT;
+       /* XXX should discard first scan when using interval scanning
+        * since manual says it is not synced with scan clock */
+       if (labpc_use_continuous_mode(cmd) == 0) {
+               devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT;
+               if (cmd->scan_begin_src == TRIG_EXT)
+                       devpriv->command4_bits |= EXT_SCAN_EN_BIT;
+       }
+       /*  single-ended/differential */
+       if (aref == AREF_DIFF)
+               devpriv->command4_bits |= ADC_DIFF_BIT;
+       devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG);
+
        /*  startup acquisition */
 
        /*  command2 reg */
diff --git a/drivers/target/target_core_device.c 
b/drivers/target/target_core_device.c
index 4ecf9d6..79d9865 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1483,24 +1483,18 @@ static struct se_lun *core_dev_get_lun(struct 
se_portal_group *tpg, u32 unpacked
 
 struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
        struct se_portal_group *tpg,
+       struct se_node_acl *nacl,
        u32 mapped_lun,
-       char *initiatorname,
        int *ret)
 {
        struct se_lun_acl *lacl;
-       struct se_node_acl *nacl;
 
-       if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) {
+       if (strlen(nacl->initiatorname) >= TRANSPORT_IQN_LEN) {
                pr_err("%s InitiatorName exceeds maximum size.\n",
                        tpg->se_tpg_tfo->get_fabric_name());
                *ret = -EOVERFLOW;
                return NULL;
        }
-       nacl = core_tpg_get_initiator_node_acl(tpg, initiatorname);
-       if (!nacl) {
-               *ret = -EINVAL;
-               return NULL;
-       }
        lacl = kzalloc(sizeof(struct se_lun_acl), GFP_KERNEL);
        if (!lacl) {
                pr_err("Unable to allocate memory for struct se_lun_acl.\n");
@@ -1511,7 +1505,8 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
        INIT_LIST_HEAD(&lacl->lacl_list);
        lacl->mapped_lun = mapped_lun;
        lacl->se_lun_nacl = nacl;
-       snprintf(lacl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
+       snprintf(lacl->initiatorname, TRANSPORT_IQN_LEN, "%s",
+                nacl->initiatorname);
 
        return lacl;
 }
diff --git a/drivers/target/target_core_fabric_configfs.c 
b/drivers/target/target_core_fabric_configfs.c
index 817ba7c..6b79ee7 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -356,9 +356,17 @@ static struct config_group *target_fabric_make_mappedlun(
                ret = -EINVAL;
                goto out;
        }
+       if (mapped_lun > (TRANSPORT_MAX_LUNS_PER_TPG-1)) {
+               pr_err("Mapped LUN: %lu exceeds TRANSPORT_MAX_LUNS_PER_TPG"
+                       "-1: %u for Target Portal Group: %u\n", mapped_lun,
+                       TRANSPORT_MAX_LUNS_PER_TPG-1,
+                       se_tpg->se_tpg_tfo->tpg_get_tag(se_tpg));
+               ret = -EINVAL;
+               goto out;
+       }
 
-       lacl = core_dev_init_initiator_node_lun_acl(se_tpg, mapped_lun,
-                       config_item_name(acl_ci), &ret);
+       lacl = core_dev_init_initiator_node_lun_acl(se_tpg, se_nacl,
+                       mapped_lun, &ret);
        if (!lacl) {
                ret = -EINVAL;
                goto out;
diff --git a/drivers/target/target_core_internal.h 
b/drivers/target/target_core_internal.h
index 21c0563..17179b1 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -61,7 +61,7 @@ struct se_lun *core_dev_add_lun(struct se_portal_group *, 
struct se_hba *,
 int    core_dev_del_lun(struct se_portal_group *, u32);
 struct se_lun *core_get_lun_from_tpg(struct se_portal_group *, u32);
 struct se_lun_acl *core_dev_init_initiator_node_lun_acl(struct se_portal_group 
*,
-               u32, char *, int *);
+               struct se_node_acl *, u32, int *);
 int    core_dev_add_initiator_node_lun_acl(struct se_portal_group *,
                struct se_lun_acl *, u32, u32);
 int    core_dev_del_initiator_node_lun_acl(struct se_portal_group *,
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index ba537b6..0e17fa3 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -114,16 +114,10 @@ struct se_node_acl *core_tpg_get_initiator_node_acl(
        struct se_node_acl *acl;
 
        spin_lock_irq(&tpg->acl_node_lock);
-       list_for_each_entry(acl, &tpg->acl_node_list, acl_list) {
-               if (!strcmp(acl->initiatorname, initiatorname) &&
-                   !acl->dynamic_node_acl) {
-                       spin_unlock_irq(&tpg->acl_node_lock);
-                       return acl;
-               }
-       }
+       acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname);
        spin_unlock_irq(&tpg->acl_node_lock);
 
-       return NULL;
+       return acl;
 }
 
 /*     core_tpg_add_node_to_devs():
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 51e4c1e..1a9e2a9 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1074,7 +1074,7 @@ static int translate_desc(struct vhost_dev *dev, u64 
addr, u32 len,
                }
                _iov = iov + ret;
                size = reg->memory_size - addr + reg->guest_phys_addr;
-               _iov->iov_len = min((u64)len, size);
+               _iov->iov_len = min((u64)len - s, size);
                _iov->iov_base = (void __user *)(unsigned long)
                        (reg->userspace_addr + addr - reg->guest_phys_addr);
                s += size;
diff --git a/fs/direct-io.c b/fs/direct-io.c
index f4aadd1..29c4fda 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -305,9 +305,9 @@ static ssize_t dio_complete(struct dio *dio, loff_t offset, 
ssize_t ret, bool is
                dio->end_io(dio->iocb, offset, transferred,
                            dio->private, ret, is_async);
        } else {
+               inode_dio_done(dio->inode);
                if (is_async)
                        aio_complete(dio->iocb, ret, 0);
-               inode_dio_done(dio->inode);
        }
 
        return ret;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index df76291..3e1018a 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -326,7 +326,7 @@ err_out:
        return 0;
 }
 /**
- * ext4_read_block_bitmap()
+ * ext4_read_block_bitmap_nowait()
  * @sb:                        super block
  * @block_group:       given block group
  *
@@ -422,6 +422,8 @@ ext4_read_block_bitmap(struct super_block *sb, ext4_group_t 
block_group)
        struct buffer_head *bh;
 
        bh = ext4_read_block_bitmap_nowait(sb, block_group);
+       if (!bh)
+               return NULL;
        if (ext4_wait_block_bitmap(sb, block_group, bh)) {
                put_bh(bh);
                return NULL;
@@ -447,11 +449,16 @@ static int ext4_has_free_clusters(struct ext4_sb_info 
*sbi,
 
        free_clusters  = percpu_counter_read_positive(fcc);
        dirty_clusters = percpu_counter_read_positive(dcc);
-       root_clusters = EXT4_B2C(sbi, ext4_r_blocks_count(sbi->s_es));
+
+       /*
+        * r_blocks_count should always be multiple of the cluster ratio so
+        * we are safe to do a plane bit shift only.
+        */
+       root_clusters = ext4_r_blocks_count(sbi->s_es) >> sbi->s_cluster_bits;
 
        if (free_clusters - (nclusters + root_clusters + dirty_clusters) <
                                        EXT4_FREECLUSTERS_WATERMARK) {
-               free_clusters  = EXT4_C2B(sbi, 
percpu_counter_sum_positive(fcc));
+               free_clusters  = percpu_counter_sum_positive(fcc);
                dirty_clusters = percpu_counter_sum_positive(dcc);
        }
        /* Check whether we have space after accounting for current
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index e77c4fe..3122ece 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4126,7 +4126,7 @@ static void ext4_mb_add_n_trim(struct 
ext4_allocation_context *ac)
                /* The max size of hash table is PREALLOC_TB_SIZE */
                order = PREALLOC_TB_SIZE - 1;
        /* Add the prealloc space to lg */
-       rcu_read_lock();
+       spin_lock(&lg->lg_prealloc_lock);
        list_for_each_entry_rcu(tmp_pa, &lg->lg_prealloc_list[order],
                                                pa_inode_list) {
                spin_lock(&tmp_pa->pa_lock);
@@ -4150,12 +4150,12 @@ static void ext4_mb_add_n_trim(struct 
ext4_allocation_context *ac)
        if (!added)
                list_add_tail_rcu(&pa->pa_inode_list,
                                        &lg->lg_prealloc_list[order]);
-       rcu_read_unlock();
+       spin_unlock(&lg->lg_prealloc_lock);
 
        /* Now trim the list to be not more than 8 elements */
        if (lg_prealloc_count > 8) {
                ext4_mb_discard_lg_preallocations(sb, lg,
-                                               order, lg_prealloc_count);
+                                                 order, lg_prealloc_count);
                return;
        }
        return ;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index e88748e..e712a8c 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -495,7 +495,7 @@ ext4_xattr_release_block(handle_t *handle, struct inode 
*inode,
                error = ext4_handle_dirty_metadata(handle, inode, bh);
                if (IS_SYNC(inode))
                        ext4_handle_sync(handle);
-               dquot_free_block(inode, 1);
+               dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1));
                ea_bdebug(bh, "refcount now=%d; releasing",
                          le32_to_cpu(BHDR(bh)->h_refcount));
        }
@@ -784,7 +784,8 @@ inserted:
                        else {
                                /* The old block is released after updating
                                   the inode. */
-                               error = dquot_alloc_block(inode, 1);
+                               error = dquot_alloc_block(inode,
+                                               EXT4_C2B(EXT4_SB(sb), 1));
                                if (error)
                                        goto cleanup;
                                error = ext4_journal_get_write_access(handle,
@@ -880,7 +881,7 @@ cleanup:
        return error;
 
 cleanup_dquot:
-       dquot_free_block(inode, 1);
+       dquot_free_block(inode, EXT4_C2B(EXT4_SB(sb), 1));
        goto cleanup;
 
 bad_block:
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index bc43832..d48478a 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -645,7 +645,14 @@ static int fuse_unlink(struct inode *dir, struct dentry 
*entry)
 
                spin_lock(&fc->lock);
                fi->attr_version = ++fc->attr_version;
-               drop_nlink(inode);
+               /*
+                * If i_nlink == 0 then unlink doesn't make sense, yet this can
+                * happen if userspace filesystem is careless.  It would be
+                * difficult to enforce correct nlink usage so just ignore this
+                * condition here
+                */
+               if (inode->i_nlink > 0)
+                       drop_nlink(inode);
                spin_unlock(&fc->lock);
                fuse_invalidate_attr(inode);
                fuse_invalidate_attr(dir);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 537731e..abd785e 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1053,6 +1053,8 @@ free_client(struct nfs4_client *clp)
                put_group_info(clp->cl_cred.cr_group_info);
        kfree(clp->cl_principal);
        kfree(clp->cl_name.data);
+       idr_remove_all(&clp->cl_stateids);
+       idr_destroy(&clp->cl_stateids);
        kfree(clp);
 }
 
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 6577432..340bd02 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -593,9 +593,9 @@ static void ocfs2_dio_end_io(struct kiocb *iocb,
        level = ocfs2_iocb_rw_locked_level(iocb);
        ocfs2_rw_unlock(inode, level);
 
+       inode_dio_done(inode);
        if (is_async)
                aio_complete(iocb, ret, 0);
-       inode_dio_done(inode);
 }
 
 /*
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index f169da4..b7e74b5 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -642,7 +642,7 @@ ocfs2_block_group_alloc_discontig(handle_t *handle,
         * cluster groups will be staying in cache for the duration of
         * this operation.
         */
-       ac->ac_allow_chain_relink = 0;
+       ac->ac_disable_chain_relink = 1;
 
        /* Claim the first region */
        status = ocfs2_block_group_claim_bits(osb, handle, ac, min_bits,
@@ -1823,7 +1823,7 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context 
*ac,
         * Do this *after* figuring out how many bits we're taking out
         * of our target group.
         */
-       if (ac->ac_allow_chain_relink &&
+       if (!ac->ac_disable_chain_relink &&
            (prev_group_bh) &&
            (ocfs2_block_group_reasonably_empty(bg, res->sr_bits))) {
                status = ocfs2_relink_block_group(handle, alloc_inode,
@@ -1928,7 +1928,6 @@ static int ocfs2_claim_suballoc_bits(struct 
ocfs2_alloc_context *ac,
 
        victim = ocfs2_find_victim_chain(cl);
        ac->ac_chain = victim;
-       ac->ac_allow_chain_relink = 1;
 
        status = ocfs2_search_chain(ac, handle, bits_wanted, min_bits,
                                    res, &bits_left);
@@ -1947,7 +1946,7 @@ static int ocfs2_claim_suballoc_bits(struct 
ocfs2_alloc_context *ac,
         * searching each chain in order. Don't allow chain relinking
         * because we only calculate enough journal credits for one
         * relink per alloc. */
-       ac->ac_allow_chain_relink = 0;
+       ac->ac_disable_chain_relink = 1;
        for (i = 0; i < le16_to_cpu(cl->cl_next_free_rec); i ++) {
                if (i == victim)
                        continue;
diff --git a/fs/ocfs2/suballoc.h b/fs/ocfs2/suballoc.h
index b8afabf..a36d0aa 100644
--- a/fs/ocfs2/suballoc.h
+++ b/fs/ocfs2/suballoc.h
@@ -49,7 +49,7 @@ struct ocfs2_alloc_context {
 
        /* these are used by the chain search */
        u16    ac_chain;
-       int    ac_allow_chain_relink;
+       int    ac_disable_chain_relink;
        group_search_t *ac_group_search;
 
        u64    ac_last_group;
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 0ba9ea1..2e3ea30 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -7189,7 +7189,7 @@ int ocfs2_init_security_and_acl(struct inode *dir,
        struct buffer_head *dir_bh = NULL;
 
        ret = ocfs2_init_security_get(inode, dir, qstr, NULL);
-       if (!ret) {
+       if (ret) {
                mlog_errno(ret);
                goto leave;
        }
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index 82c585f..4a66a5c 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -88,6 +88,27 @@ static const char *get_reason_str(enum kmsg_dump_reason 
reason)
        }
 }
 
+bool pstore_cannot_block_path(enum kmsg_dump_reason reason)
+{
+       /*
+        * In case of NMI path, pstore shouldn't be blocked
+        * regardless of reason.
+        */
+       if (in_nmi())
+               return true;
+
+       switch (reason) {
+       /* In panic case, other cpus are stopped by smp_send_stop(). */
+       case KMSG_DUMP_PANIC:
+       /* Emergency restart shouldn't be blocked by spin lock. */
+       case KMSG_DUMP_EMERG:
+               return true;
+       default:
+               return false;
+       }
+}
+EXPORT_SYMBOL_GPL(pstore_cannot_block_path);
+
 /*
  * callback from kmsg_dump. (s2,l2) has the most recently
  * written bytes, older bytes are in (s1,l1). Save as much
@@ -111,10 +132,12 @@ static void pstore_dump(struct kmsg_dumper *dumper,
 
        why = get_reason_str(reason);
 
-       if (in_nmi()) {
-               is_locked = spin_trylock(&psinfo->buf_lock);
-               if (!is_locked)
-                       pr_err("pstore dump routine blocked in NMI, may corrupt 
error record\n");
+       if (pstore_cannot_block_path(reason)) {
+               is_locked = spin_trylock_irqsave(&psinfo->buf_lock, flags);
+               if (!is_locked) {
+                       pr_err("pstore dump routine blocked in %s path, may 
corrupt error record\n"
+                                      , in_nmi() ? "NMI" : why);
+               }
        } else
                spin_lock_irqsave(&psinfo->buf_lock, flags);
        oopscount++;
@@ -145,9 +168,9 @@ static void pstore_dump(struct kmsg_dumper *dumper,
                total += l1_cpy + l2_cpy;
                part++;
        }
-       if (in_nmi()) {
+       if (pstore_cannot_block_path(reason)) {
                if (is_locked)
-                       spin_unlock(&psinfo->buf_lock);
+                       spin_unlock_irqrestore(&psinfo->buf_lock, flags);
        } else
                spin_unlock_irqrestore(&psinfo->buf_lock, flags);
 }
diff --git a/include/linux/auto_fs.h b/include/linux/auto_fs.h
index da64e15..6cdabb4 100644
--- a/include/linux/auto_fs.h
+++ b/include/linux/auto_fs.h
@@ -31,25 +31,16 @@
 #define AUTOFS_MIN_PROTO_VERSION       AUTOFS_PROTO_VERSION
 
 /*
- * Architectures where both 32- and 64-bit binaries can be executed
- * on 64-bit kernels need this.  This keeps the structure format
- * uniform, and makes sure the wait_queue_token isn't too big to be
- * passed back down to the kernel.
- *
- * This assumes that on these architectures:
- * mode     32 bit    64 bit
- * -------------------------
- * int      32 bit    32 bit
- * long     32 bit    64 bit
- *
- * If so, 32-bit user-space code should be backwards compatible.
+ * The wait_queue_token (autofs_wqt_t) is part of a structure which is passed
+ * back to the kernel via ioctl from userspace. On architectures where 32- and
+ * 64-bit userspace binaries can be executed it's important that the size of
+ * autofs_wqt_t stays constant between 32- and 64-bit Linux kernels so that we
+ * do not break the binary ABI interface by changing the structure size.
  */
-
-#if defined(__sparc__) || defined(__mips__) || defined(__x86_64__) \
- || defined(__powerpc__) || defined(__s390__)
-typedef unsigned int autofs_wqt_t;
-#else
+#if defined(__ia64__) || defined(__alpha__) /* pure 64bit architectures */
 typedef unsigned long autofs_wqt_t;
+#else
+typedef unsigned int autofs_wqt_t;
 #endif
 
 /* Packet types */
diff --git a/include/linux/pstore.h b/include/linux/pstore.h
index e1461e1..318cca1 100644
--- a/include/linux/pstore.h
+++ b/include/linux/pstore.h
@@ -54,12 +54,18 @@ struct pstore_info {
 
 #ifdef CONFIG_PSTORE
 extern int pstore_register(struct pstore_info *);
+extern bool pstore_cannot_block_path(enum kmsg_dump_reason reason);
 #else
 static inline int
 pstore_register(struct pstore_info *psi)
 {
        return -ENODEV;
 }
+static inline bool
+pstore_cannot_block_path(enum kmsg_dump_reason reason)
+{
+       return false;
+}
 #endif
 
 #endif /*_LINUX_PSTORE_H*/
diff --git a/include/linux/quota.h b/include/linux/quota.h
index c09fa04..ffd8607 100644
--- a/include/linux/quota.h
+++ b/include/linux/quota.h
@@ -417,6 +417,7 @@ struct quota_module_name {
 #define INIT_QUOTA_MODULE_NAMES {\
        {QFMT_VFS_OLD, "quota_v1"},\
        {QFMT_VFS_V0, "quota_v2"},\
+       {QFMT_VFS_V1, "quota_v2"},\
        {0, NULL}}
 
 #endif /* __KERNEL__ */
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index a5dccd4..a4c47d1b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -378,12 +378,20 @@ static void __put_css_set(struct css_set *cg, int 
taskexit)
                struct cgroup *cgrp = link->cgrp;
                list_del(&link->cg_link_list);
                list_del(&link->cgrp_link_list);
+
+               /*
+                * We may not be holding cgroup_mutex, and if cgrp->count is
+                * dropped to 0 the cgroup can be destroyed at any time, hence
+                * rcu_read_lock is used to keep it alive.
+                */
+               rcu_read_lock();
                if (atomic_dec_and_test(&cgrp->count) &&
                    notify_on_release(cgrp)) {
                        if (taskexit)
                                set_bit(CGRP_RELEASABLE, &cgrp->flags);
                        check_for_release(cgrp);
                }
+               rcu_read_unlock();
 
                kfree(link);
        }
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 5fc1570..8fe6f6b6 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -2479,8 +2479,16 @@ void cpuset_print_task_mems_allowed(struct task_struct 
*tsk)
 
        dentry = task_cs(tsk)->css.cgroup->dentry;
        spin_lock(&cpuset_buffer_lock);
-       snprintf(cpuset_name, CPUSET_NAME_LEN,
-                dentry ? (const char *)dentry->d_name.name : "/");
+
+       if (!dentry) {
+               strcpy(cpuset_name, "/");
+       } else {
+               spin_lock(&dentry->d_lock);
+               strlcpy(cpuset_name, (const char *)dentry->d_name.name,
+                       CPUSET_NAME_LEN);
+               spin_unlock(&dentry->d_lock);
+       }
+
        nodelist_scnprintf(cpuset_nodelist, CPUSET_NODELIST_LEN,
                           tsk->mems_allowed);
        printk(KERN_INFO "%s cpuset=%s mems_allowed=%s\n",
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 69185ae..e885be1 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -639,6 +639,13 @@ static struct k_itimer *__lock_timer(timer_t timer_id, 
unsigned long *flags)
 {
        struct k_itimer *timr;
 
+       /*
+        * timer_t could be any type >= int and we want to make sure any
+        * @timer_id outside positive int range fails lookup.
+        */
+       if ((unsigned long long)timer_id > INT_MAX)
+               return NULL;
+
        rcu_read_lock();
        timr = idr_find(&posix_timers_id, (int)timer_id);
        if (timr) {
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index a650694..9f9aa32 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1194,9 +1194,10 @@ static ssize_t bin_dn_node_address(struct file *file,
 
                /* Convert the decnet address to binary */
                result = -EIO;
-               nodep = strchr(buf, '.') + 1;
+               nodep = strchr(buf, '.');
                if (!nodep)
                        goto out;
+               ++nodep;
 
                area = simple_strtoul(buf, NULL, 10);
                node = simple_strtoul(nodep, NULL, 10);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 6b194d8..4a86e64 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3841,37 +3841,51 @@ static void ftrace_init_module(struct module *mod,
        ftrace_process_locs(mod, start, end);
 }
 
-static int ftrace_module_notify(struct notifier_block *self,
-                               unsigned long val, void *data)
+static int ftrace_module_notify_enter(struct notifier_block *self,
+                                     unsigned long val, void *data)
 {
        struct module *mod = data;
 
-       switch (val) {
-       case MODULE_STATE_COMING:
+       if (val == MODULE_STATE_COMING)
                ftrace_init_module(mod, mod->ftrace_callsites,
                                   mod->ftrace_callsites +
                                   mod->num_ftrace_callsites);
-               break;
-       case MODULE_STATE_GOING:
+       return 0;
+}
+
+static int ftrace_module_notify_exit(struct notifier_block *self,
+                                    unsigned long val, void *data)
+{
+       struct module *mod = data;
+
+       if (val == MODULE_STATE_GOING)
                ftrace_release_mod(mod);
-               break;
-       }
 
        return 0;
 }
 #else
-static int ftrace_module_notify(struct notifier_block *self,
-                               unsigned long val, void *data)
+static int ftrace_module_notify_enter(struct notifier_block *self,
+                                     unsigned long val, void *data)
+{
+       return 0;
+}
+static int ftrace_module_notify_exit(struct notifier_block *self,
+                                    unsigned long val, void *data)
 {
        return 0;
 }
 #endif /* CONFIG_MODULES */
 
-struct notifier_block ftrace_module_nb = {
-       .notifier_call = ftrace_module_notify,
+struct notifier_block ftrace_module_enter_nb = {
+       .notifier_call = ftrace_module_notify_enter,
        .priority = INT_MAX,    /* Run before anything that can use kprobes */
 };
 
+struct notifier_block ftrace_module_exit_nb = {
+       .notifier_call = ftrace_module_notify_exit,
+       .priority = INT_MIN,    /* Run after anything that can remove kprobes */
+};
+
 extern unsigned long __start_mcount_loc[];
 extern unsigned long __stop_mcount_loc[];
 
@@ -3903,9 +3917,13 @@ void __init ftrace_init(void)
                                  __start_mcount_loc,
                                  __stop_mcount_loc);
 
-       ret = register_module_notifier(&ftrace_module_nb);
+       ret = register_module_notifier(&ftrace_module_enter_nb);
+       if (ret)
+               pr_warning("Failed to register trace ftrace module enter 
notifier\n");
+
+       ret = register_module_notifier(&ftrace_module_exit_nb);
        if (ret)
-               pr_warning("Failed to register trace ftrace module notifier\n");
+               pr_warning("Failed to register trace ftrace module exit 
notifier\n");
 
        set_ftrace_early_filters();
 
diff --git a/lib/idr.c b/lib/idr.c
index 4046e29..e90d2d0 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -625,7 +625,14 @@ void *idr_get_next(struct idr *idp, int *nextidp)
                        return p;
                }
 
-               id += 1 << n;
+               /*
+                * Proceed to the next layer at the current level.  Unlike
+                * idr_for_each(), @id isn't guaranteed to be aligned to
+                * layer boundary at this point and adding 1 << n may
+                * incorrectly skip IDs.  Make sure we jump to the
+                * beginning of the next layer using round_up().
+                */
+               id = round_up(id + 1, 1 << n);
                while (n < fls(id)) {
                        n += IDR_BITS;
                        p = *--paa;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index fd9b288..aec7dbb 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -817,7 +817,6 @@ static void svc_age_temp_xprts(unsigned long closure)
        struct svc_serv *serv = (struct svc_serv *)closure;
        struct svc_xprt *xprt;
        struct list_head *le, *next;
-       LIST_HEAD(to_be_aged);
 
        dprintk("svc_age_temp_xprts\n");
 
@@ -838,25 +837,15 @@ static void svc_age_temp_xprts(unsigned long closure)
                if (atomic_read(&xprt->xpt_ref.refcount) > 1 ||
                    test_bit(XPT_BUSY, &xprt->xpt_flags))
                        continue;
-               svc_xprt_get(xprt);
-               list_move(le, &to_be_aged);
+               list_del_init(le);
                set_bit(XPT_CLOSE, &xprt->xpt_flags);
                set_bit(XPT_DETACHED, &xprt->xpt_flags);
-       }
-       spin_unlock_bh(&serv->sv_lock);
-
-       while (!list_empty(&to_be_aged)) {
-               le = to_be_aged.next;
-               /* fiddling the xpt_list node is safe 'cos we're XPT_DETACHED */
-               list_del_init(le);
-               xprt = list_entry(le, struct svc_xprt, xpt_list);
-
                dprintk("queuing xprt %p for closing\n", xprt);
 
                /* a thread will dequeue and close it soon */
                svc_xprt_enqueue(xprt);
-               svc_xprt_put(xprt);
        }
+       spin_unlock_bh(&serv->sv_lock);
 
        mod_timer(&serv->sv_temptimer, jiffies + svc_conn_age_period * HZ);
 }
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 02a6e3f..fa2ce0c 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1244,6 +1244,9 @@ static int generic_hdmi_build_jack(struct hda_codec 
*codec, int pin_idx)
 
        if (pcmdev > 0)
                sprintf(hdmi_str + strlen(hdmi_str), ",pcm=%d", pcmdev);
+       if (!is_jack_detectable(codec, per_pin->pin_nid))
+               strncat(hdmi_str, " Phantom",
+                       sizeof(hdmi_str) - strlen(hdmi_str) - 1);
 
        return snd_hda_jack_add_kctl(codec, per_pin->pin_nid, hdmi_str, 0);
 }
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index c3dd3d4..2db7ba0 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -241,13 +241,13 @@ $(OUTPUT)util/parse-events-flex.c: util/parse-events.l
        $(QUIET_FLEX)$(FLEX) --header-file=$(OUTPUT)util/parse-events-flex.h -t 
util/parse-events.l > $(OUTPUT)util/parse-events-flex.c
 
 $(OUTPUT)util/parse-events-bison.c: util/parse-events.y
-       $(QUIET_BISON)$(BISON) -v util/parse-events.y -d -o 
$(OUTPUT)util/parse-events-bison.c
+       $(QUIET_BISON)$(BISON) -v util/parse-events.y -d -o 
$(OUTPUT)util/parse-events-bison.c -p parse_events_
 
 $(OUTPUT)util/pmu-flex.c: util/pmu.l
        $(QUIET_FLEX)$(FLEX) --header-file=$(OUTPUT)util/pmu-flex.h -t 
util/pmu.l > $(OUTPUT)util/pmu-flex.c
 
 $(OUTPUT)util/pmu-bison.c: util/pmu.y
-       $(QUIET_BISON)$(BISON) -v util/pmu.y -d -o $(OUTPUT)util/pmu-bison.c
+       $(QUIET_BISON)$(BISON) -v util/pmu.y -d -o $(OUTPUT)util/pmu-bison.c -p 
perf_pmu_
 
 $(OUTPUT)util/parse-events.o: $(OUTPUT)util/parse-events-flex.c 
$(OUTPUT)util/parse-events-bison.c
 $(OUTPUT)util/pmu.o: $(OUTPUT)util/pmu-flex.c $(OUTPUT)util/pmu-bison.c
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index d9637da..3f35ea3 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -1,5 +1,4 @@
 
-%name-prefix "parse_events_"
 %parse-param {struct list_head *list_all}
 %parse-param {struct list_head *list_event}
 %parse-param {int *idx}
diff --git a/tools/perf/util/pmu.y b/tools/perf/util/pmu.y
index 20ea77e..522943f 100644
--- a/tools/perf/util/pmu.y
+++ b/tools/perf/util/pmu.y
@@ -1,5 +1,4 @@
 
-%name-prefix "perf_pmu_"
 %parse-param {struct list_head *format}
 %parse-param {char *name}
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to