diff --git a/[refs] b/[refs]
index ac323a241b52..73f032511f67 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0b1fc335d2f2c1206ac4048e5f6d8971f2aae6be
+refs/heads/master: 3d6e48f43340343d97839eadb1ab7b6a3ea98797
diff --git a/trunk/Documentation/filesystems/Locking b/trunk/Documentation/filesystems/Locking
index 8362860e21a7..680fb566b928 100644
--- a/trunk/Documentation/filesystems/Locking
+++ b/trunk/Documentation/filesystems/Locking
@@ -144,8 +144,8 @@ prototypes:
 	void (*kill_sb) (struct super_block *);
 locking rules:
 		may block	BKL
-get_sb		yes		no
-kill_sb		yes		no
+get_sb		yes		yes
+kill_sb		yes		yes
 
 ->get_sb() returns error or 0 with locked superblock attached to the vfsmount
 (exclusive on ->s_umount).
@@ -409,12 +409,12 @@ ioctl:			yes	(see below)
 unlocked_ioctl:		no	(see below)
 compat_ioctl:		no
 mmap:			no
-open:			no
+open:			maybe	(see below)
 flush:			no
 release:		no
 fsync:			no	(see below)
 aio_fsync:		no
-fasync:			no
+fasync:			yes	(see below)
 lock:			yes
 readv:			no
 writev:			no
@@ -431,6 +431,13 @@ For many filesystems, it is probably safe to acquire the inode
 semaphore.  Note some filesystems (i.e. remote ones) provide no
 protection for i_size so you will need to use the BKL.
 
+->open() locking is in-transit: big lock partially moved into the methods.
+The only exception is ->open() in the instances of file_operations that never
+end up in ->i_fop/->proc_fops, i.e. ones that belong to character devices
+(chrdev_open() takes lock before replacing ->f_op and calling the secondary
+method. As soon as we fix the handling of module reference counters all
+instances of ->open() will be called without the BKL.
+
 Note: ext2_release() was *the* source of contention on fs-intensive
 loads and dropping BKL on ->release() helps to get rid of that (we still
 grab BKL for cases when we close a file that had been opened r/w, but that
diff --git a/trunk/MAINTAINERS b/trunk/MAINTAINERS
index 186be3ba5069..b3e92fbe336c 100644
--- a/trunk/MAINTAINERS
+++ b/trunk/MAINTAINERS
@@ -750,13 +750,11 @@ P:	Ville Syrjala
 M:	syrjala@sci.fi
 S:	Maintained
 
-ATLX ETHERNET DRIVERS
+ATL1 ETHERNET DRIVER
 P:	Jay Cliburn
 M:	jcliburn@gmail.com
 P:	Chris Snook
 M:	csnook@redhat.com
-P:	Jie Yang
-M:	jie.yang@atheros.com
 L:	atl1-devel@lists.sourceforge.net
 W:	http://sourceforge.net/projects/atl1
 W:	http://atl1.sourceforge.net
diff --git a/trunk/arch/ia64/include/asm/sections.h b/trunk/arch/ia64/include/asm/sections.h
index a7acad2bc2f0..7286e4a9fe84 100644
--- a/trunk/arch/ia64/include/asm/sections.h
+++ b/trunk/arch/ia64/include/asm/sections.h
@@ -21,8 +21,5 @@ extern char __start_gate_brl_fsys_bubble_down_patchlist[], __end_gate_brl_fsys_b
 extern char __start_unwind[], __end_unwind[];
 extern char __start_ivt_text[], __end_ivt_text[];
 
-#undef dereference_function_descriptor
-void *dereference_function_descriptor(void *);
-
 #endif /* _ASM_IA64_SECTIONS_H */
 
diff --git a/trunk/arch/ia64/kernel/module.c b/trunk/arch/ia64/kernel/module.c
index 545626f66a4c..29aad349e0c4 100644
--- a/trunk/arch/ia64/kernel/module.c
+++ b/trunk/arch/ia64/kernel/module.c
@@ -31,11 +31,9 @@
 #include <linux/elf.h>
 #include <linux/moduleloader.h>
 #include <linux/string.h>
-#include <linux/uaccess.h>
 #include <linux/vmalloc.h>
 
 #include <asm/patch.h>
-#include <asm/sections.h>
 #include <asm/unaligned.h>
 
 #define ARCH_MODULE_DEBUG 0
@@ -943,13 +941,3 @@ module_arch_cleanup (struct module *mod)
 	if (mod->arch.core_unw_table)
 		unw_remove_unwind_table(mod->arch.core_unw_table);
 }
-
-void *dereference_function_descriptor(void *ptr)
-{
-	struct fdesc *desc = ptr;
-	void *p;
-
-	if (!probe_kernel_address(&desc->ip, p))
-		ptr = p;
-	return ptr;
-}
diff --git a/trunk/arch/mips/sgi-ip22/ip22-platform.c b/trunk/arch/mips/sgi-ip22/ip22-platform.c
index 52486c4d2b01..60141235ec40 100644
--- a/trunk/arch/mips/sgi-ip22/ip22-platform.c
+++ b/trunk/arch/mips/sgi-ip22/ip22-platform.c
@@ -150,7 +150,7 @@ static int __init sgiseeq_devinit(void)
 		return res;
 
 	/* Second HPC is missing? */
-	if (ip22_is_fullhouse() ||
+	if (!ip22_is_fullhouse() ||
 	    get_dbe(tmp, (unsigned int *)&hpc3c1->pbdma[1]))
 		return 0;
 
diff --git a/trunk/arch/parisc/kernel/module.c b/trunk/arch/parisc/kernel/module.c
index 44138c3e6ea7..fdacdd4341c9 100644
--- a/trunk/arch/parisc/kernel/module.c
+++ b/trunk/arch/parisc/kernel/module.c
@@ -47,9 +47,7 @@
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/bug.h>
-#include <linux/uaccess.h>
 
-#include <asm/sections.h>
 #include <asm/unwind.h>
 
 #if 0
@@ -862,15 +860,3 @@ void module_arch_cleanup(struct module *mod)
 	deregister_unwind_table(mod);
 	module_bug_cleanup(mod);
 }
-
-#ifdef CONFIG_64BIT
-void *dereference_function_descriptor(void *ptr)
-{
-	Elf64_Fdesc *desc = ptr;
-	void *p;
-
-	if (!probe_kernel_address(&desc->addr, p))
-		ptr = p;
-	return ptr;
-}
-#endif
diff --git a/trunk/arch/powerpc/include/asm/sections.h b/trunk/arch/powerpc/include/asm/sections.h
index 7710e9e6660f..916018e425c4 100644
--- a/trunk/arch/powerpc/include/asm/sections.h
+++ b/trunk/arch/powerpc/include/asm/sections.h
@@ -16,9 +16,6 @@ static inline int in_kernel_text(unsigned long addr)
 	return 0;
 }
 
-#undef dereference_function_descriptor
-void *dereference_function_descriptor(void *);
-
 #endif
 
 #endif /* __KERNEL__ */
diff --git a/trunk/arch/powerpc/kernel/module_64.c b/trunk/arch/powerpc/kernel/module_64.c
index ad79de272ff3..ee6a2982d567 100644
--- a/trunk/arch/powerpc/kernel/module_64.c
+++ b/trunk/arch/powerpc/kernel/module_64.c
@@ -21,9 +21,8 @@
 #include <linux/err.h>
 #include <linux/vmalloc.h>
 #include <linux/bug.h>
-#include <linux/uaccess.h>
 #include <asm/module.h>
-#include <asm/sections.h>
+#include <asm/uaccess.h>
 #include <asm/firmware.h>
 #include <asm/code-patching.h>
 #include <linux/sort.h>
@@ -452,13 +451,3 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
 
 	return 0;
 }
-
-void *dereference_function_descriptor(void *ptr)
-{
-	struct ppc64_opd_entry *desc = ptr;
-	void *p;
-
-	if (!probe_kernel_address(&desc->funcaddr, p))
-		ptr = p;
-	return ptr;
-}
diff --git a/trunk/arch/s390/kernel/compat_ptrace.h b/trunk/arch/s390/kernel/compat_ptrace.h
index cde81fa64f89..a2be3a978d5c 100644
--- a/trunk/arch/s390/kernel/compat_ptrace.h
+++ b/trunk/arch/s390/kernel/compat_ptrace.h
@@ -42,6 +42,7 @@ struct user_regs_struct32
 	u32 gprs[NUM_GPRS];
 	u32 acrs[NUM_ACRS];
 	u32 orig_gpr2;
+	/* nb: there's a 4-byte hole here */
 	s390_fp_regs fp_regs;
 	/*
 	 * These per registers are in here so that gdb can modify them
diff --git a/trunk/arch/s390/kernel/ptrace.c b/trunk/arch/s390/kernel/ptrace.c
index 2815bfe348a6..c8b08289eb87 100644
--- a/trunk/arch/s390/kernel/ptrace.c
+++ b/trunk/arch/s390/kernel/ptrace.c
@@ -170,6 +170,13 @@ static unsigned long __peek_user(struct task_struct *child, addr_t addr)
 		 */
 		tmp = (addr_t) task_pt_regs(child)->orig_gpr2;
 
+	} else if (addr < (addr_t) &dummy->regs.fp_regs) {
+		/*
+		 * prevent reads of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		tmp = 0;
+
 	} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
 		/* 
 		 * floating point regs. are stored in the thread structure
@@ -270,6 +277,13 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
 		 */
 		task_pt_regs(child)->orig_gpr2 = data;
 
+	} else if (addr < (addr_t) &dummy->regs.fp_regs) {
+		/*
+		 * prevent writes of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		return 0;
+
 	} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
 		/*
 		 * floating point regs. are stored in the thread structure
@@ -428,6 +442,13 @@ static u32 __peek_user_compat(struct task_struct *child, addr_t addr)
 		 */
 		tmp = *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4);
 
+	} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+		/*
+		 * prevent reads of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		tmp = 0;
+
 	} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
 		/*
 		 * floating point regs. are stored in the thread structure 
@@ -514,6 +535,13 @@ static int __poke_user_compat(struct task_struct *child,
 		 */
 		*(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4) = tmp;
 
+	} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+		/*
+		 * prevent writess of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		return 0;
+
 	} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
 		/*
 		 * floating point regs. are stored in the thread structure 
diff --git a/trunk/fs/ubifs/budget.c b/trunk/fs/ubifs/budget.c
index 73db464cd08b..154098157473 100644
--- a/trunk/fs/ubifs/budget.c
+++ b/trunk/fs/ubifs/budget.c
@@ -302,6 +302,18 @@ long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs)
 	int subtract_lebs;
 	long long available;
 
+	/*
+	 * Force the amount available to the total size reported if the used
+	 * space is zero.
+	 */
+	if (c->lst.total_used <= UBIFS_INO_NODE_SZ &&
+	    c->budg_data_growth + c->budg_dd_growth == 0) {
+		/* Do the same calculation as for c->block_cnt */
+		available = c->main_lebs - 2;
+		available *= c->leb_size - c->dark_wm;
+		return available;
+	}
+
 	available = c->main_bytes - c->lst.total_used;
 
 	/*
@@ -702,106 +714,34 @@ void ubifs_release_dirty_inode_budget(struct ubifs_info *c,
 }
 
 /**
- * ubifs_reported_space - calculate reported free space.
- * @c: the UBIFS file-system description object
- * @free: amount of free space
- *
- * This function calculates amount of free space which will be reported to
- * user-space. User-space application tend to expect that if the file-system
- * (e.g., via the 'statfs()' call) reports that it has N bytes available, they
- * are able to write a file of size N. UBIFS attaches node headers to each data
- * node and it has to write indexind nodes as well. This introduces additional
- * overhead, and UBIFS it has to report sligtly less free space to meet the
- * above expectetion.
- *
- * This function assumes free space is made up of uncompressed data nodes and
- * full index nodes (one per data node, tripled because we always allow enough
- * space to write the index thrice).
- *
- * Note, the calculation is pessimistic, which means that most of the time
- * UBIFS reports less space than it actually has.
- */
-long long ubifs_reported_space(const struct ubifs_info *c, uint64_t free)
-{
-	int divisor, factor, f;
-
-	/*
-	 * Reported space size is @free * X, where X is UBIFS block size
-	 * divided by UBIFS block size + all overhead one data block
-	 * introduces. The overhead is the node header + indexing overhead.
-	 *
-	 * Indexing overhead calculations are based on the following formula:
-	 * I = N/(f - 1) + 1, where I - number of indexing nodes, N - number
-	 * of data nodes, f - fanout. Because effective UBIFS fanout is twice
-	 * as less than maximum fanout, we assume that each data node
-	 * introduces 3 * @c->max_idx_node_sz / (@c->fanout/2 - 1) bytes.
-	 * Note, the multiplier 3 is because UBIFS reseves thrice as more space
-	 * for the index.
-	 */
-	f = c->fanout > 3 ? c->fanout >> 1 : 2;
-	factor = UBIFS_BLOCK_SIZE;
-	divisor = UBIFS_MAX_DATA_NODE_SZ;
-	divisor += (c->max_idx_node_sz * 3) / (f - 1);
-	free *= factor;
-	do_div(free, divisor);
-	return free;
-}
-
-/**
- * ubifs_get_free_space - return amount of free space.
+ * ubifs_budg_get_free_space - return amount of free space.
  * @c: UBIFS file-system description object
  *
- * This function calculates amount of free space to report to user-space.
- *
- * Because UBIFS may introduce substantial overhead (the index, node headers,
- * alighment, wastage at the end of eraseblocks, etc), it cannot report real
- * amount of free flash space it has (well, because not all dirty space is
- * reclamable, UBIFS does not actually know the real amount). If UBIFS did so,
- * it would bread user expectetion about what free space is. Users seem to
- * accustomed to assume that if the file-system reports N bytes of free space,
- * they would be able to fit a file of N bytes to the FS. This almost works for
- * traditional file-systems, because they have way less overhead than UBIFS.
- * So, to keep users happy, UBIFS tries to take the overhead into account.
+ * This function returns amount of free space on the file-system.
  */
-long long ubifs_get_free_space(struct ubifs_info *c)
+long long ubifs_budg_get_free_space(struct ubifs_info *c)
 {
-	int min_idx_lebs, rsvd_idx_lebs, lebs;
+	int min_idx_lebs, rsvd_idx_lebs;
 	long long available, outstanding, free;
 
+	/* Do exactly the same calculations as in 'do_budget_space()' */
 	spin_lock(&c->space_lock);
 	min_idx_lebs = ubifs_calc_min_idx_lebs(c);
-	outstanding = c->budg_data_growth + c->budg_dd_growth;
 
-	/*
-	 * Force the amount available to the total size reported if the used
-	 * space is zero.
-	 */
-	if (c->lst.total_used <= UBIFS_INO_NODE_SZ && !outstanding) {
-		spin_unlock(&c->space_lock);
-		return (long long)c->block_cnt << UBIFS_BLOCK_SHIFT;
-	}
-
-	available = ubifs_calc_available(c, min_idx_lebs);
-
-	/*
-	 * When reporting free space to user-space, UBIFS guarantees that it is
-	 * possible to write a file of free space size. This means that for
-	 * empty LEBs we may use more precise calculations than
-	 * 'ubifs_calc_available()' is using. Namely, we know that in empty
-	 * LEBs we would waste only @c->leb_overhead bytes, not @c->dark_wm.
-	 * Thus, amend the available space.
-	 *
-	 * Note, the calculations below are similar to what we have in
-	 * 'do_budget_space()', so refer there for comments.
-	 */
 	if (min_idx_lebs > c->lst.idx_lebs)
 		rsvd_idx_lebs = min_idx_lebs - c->lst.idx_lebs;
 	else
 		rsvd_idx_lebs = 0;
-	lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
-	       c->lst.taken_empty_lebs;
-	lebs -= rsvd_idx_lebs;
-	available += lebs * (c->dark_wm - c->leb_overhead);
+
+	if (rsvd_idx_lebs > c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt
+				- c->lst.taken_empty_lebs) {
+		spin_unlock(&c->space_lock);
+		return 0;
+	}
+
+	available = ubifs_calc_available(c, min_idx_lebs);
+	outstanding = c->budg_data_growth + c->budg_dd_growth;
+	c->min_idx_lebs = min_idx_lebs;
 	spin_unlock(&c->space_lock);
 
 	if (available > outstanding)
diff --git a/trunk/fs/ubifs/dir.c b/trunk/fs/ubifs/dir.c
index 2b267c9a1806..5c96f1fb7016 100644
--- a/trunk/fs/ubifs/dir.c
+++ b/trunk/fs/ubifs/dir.c
@@ -587,6 +587,7 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
 	if (err) {
 		if (err != -ENOSPC)
 			return err;
+		err = 0;
 		budgeted = 0;
 	}
 
diff --git a/trunk/fs/ubifs/file.c b/trunk/fs/ubifs/file.c
index 3d698e2022b1..4071d1cae29f 100644
--- a/trunk/fs/ubifs/file.c
+++ b/trunk/fs/ubifs/file.c
@@ -793,7 +793,7 @@ static int do_truncation(struct ubifs_info *c, struct inode *inode,
 	int err;
 	struct ubifs_budget_req req;
 	loff_t old_size = inode->i_size, new_size = attr->ia_size;
-	int offset = new_size & (UBIFS_BLOCK_SIZE - 1), budgeted = 1;
+	int offset = new_size & (UBIFS_BLOCK_SIZE - 1);
 	struct ubifs_inode *ui = ubifs_inode(inode);
 
 	dbg_gen("ino %lu, size %lld -> %lld", inode->i_ino, old_size, new_size);
@@ -811,15 +811,8 @@ static int do_truncation(struct ubifs_info *c, struct inode *inode,
 	/* A funny way to budget for truncation node */
 	req.dirtied_ino_d = UBIFS_TRUN_NODE_SZ;
 	err = ubifs_budget_space(c, &req);
-	if (err) {
-		/*
-		 * Treat truncations to zero as deletion and always allow them,
-		 * just like we do for '->unlink()'.
-		 */
-		if (new_size || err != -ENOSPC)
-			return err;
-		budgeted = 0;
-	}
+	if (err)
+		return err;
 
 	err = vmtruncate(inode, new_size);
 	if (err)
@@ -876,12 +869,7 @@ static int do_truncation(struct ubifs_info *c, struct inode *inode,
 	err = ubifs_jnl_truncate(c, inode, old_size, new_size);
 	mutex_unlock(&ui->ui_mutex);
 out_budg:
-	if (budgeted)
-		ubifs_release_budget(c, &req);
-	else {
-		c->nospace = c->nospace_rp = 0;
-		smp_wmb();
-	}
+	ubifs_release_budget(c, &req);
 	return err;
 }
 
diff --git a/trunk/fs/ubifs/find.c b/trunk/fs/ubifs/find.c
index e045c8b55423..adee7b5ddeab 100644
--- a/trunk/fs/ubifs/find.c
+++ b/trunk/fs/ubifs/find.c
@@ -211,8 +211,14 @@ static const struct ubifs_lprops *scan_for_dirty(struct ubifs_info *c,
  * dirty index heap, and it falls-back to LPT scanning if the heaps are empty
  * or do not have an LEB which satisfies the @min_space criteria.
  *
- * Note, LEBs which have less than dead watermark of free + dirty space are
- * never picked by this function.
+ * Note:
+ *   o LEBs which have less than dead watermark of dirty space are never picked
+ *   by this function;
+ *
+ * Returns zero and the LEB properties of
+ * found dirty LEB in case of success, %-ENOSPC if no dirty LEB was found and a
+ * negative error code in case of other failures. The returned LEB is marked as
+ * "taken".
  *
  * The additional @pick_free argument controls if this function has to return a
  * free or freeable LEB if one is present. For example, GC must to set it to %1,
@@ -225,10 +231,6 @@ static const struct ubifs_lprops *scan_for_dirty(struct ubifs_info *c,
  *
  * In addition @pick_free is set to %2 by the recovery process in order to
  * recover gc_lnum in which case an index LEB must not be returned.
- *
- * This function returns zero and the LEB properties of found dirty LEB in case
- * of success, %-ENOSPC if no dirty LEB was found and a negative error code in
- * case of other failures. The returned LEB is marked as "taken".
  */
 int ubifs_find_dirty_leb(struct ubifs_info *c, struct ubifs_lprops *ret_lp,
 			 int min_space, int pick_free)
@@ -243,7 +245,7 @@ int ubifs_find_dirty_leb(struct ubifs_info *c, struct ubifs_lprops *ret_lp,
 		int lebs, rsvd_idx_lebs = 0;
 
 		spin_lock(&c->space_lock);
-		lebs = c->lst.empty_lebs + c->idx_gc_cnt;
+		lebs = c->lst.empty_lebs;
 		lebs += c->freeable_cnt - c->lst.taken_empty_lebs;
 
 		/*
@@ -315,7 +317,7 @@ int ubifs_find_dirty_leb(struct ubifs_info *c, struct ubifs_lprops *ret_lp,
 		lp = idx_lp;
 
 	if (lp) {
-		ubifs_assert(lp->free + lp->dirty >= c->dead_wm);
+		ubifs_assert(lp->dirty >= c->dead_wm);
 		goto found;
 	}
 
diff --git a/trunk/fs/ubifs/gc.c b/trunk/fs/ubifs/gc.c
index 13f1019c859f..d0f3dac29081 100644
--- a/trunk/fs/ubifs/gc.c
+++ b/trunk/fs/ubifs/gc.c
@@ -344,12 +344,6 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
 		if (err)
 			goto out;
 
-		/* Allow for races with TNC */
-		c->gced_lnum = lnum;
-		smp_wmb();
-		c->gc_seq += 1;
-		smp_wmb();
-
 		if (c->gc_lnum == -1) {
 			c->gc_lnum = lnum;
 			err = LEB_RETAINED;
diff --git a/trunk/fs/ubifs/misc.h b/trunk/fs/ubifs/misc.h
index 4c12a9215d7f..87dabf9fe742 100644
--- a/trunk/fs/ubifs/misc.h
+++ b/trunk/fs/ubifs/misc.h
@@ -284,30 +284,45 @@ static inline void *ubifs_idx_key(const struct ubifs_info *c,
 }
 
 /**
- * ubifs_current_time - round current time to time granularity.
- * @inode: inode
+ * ubifs_reported_space - calculate reported free space.
+ * @c: the UBIFS file-system description object
+ * @free: amount of free space
+ *
+ * This function calculates amount of free space which will be reported to
+ * user-space. User-space application tend to expect that if the file-system
+ * (e.g., via the 'statfs()' call) reports that it has N bytes available, they
+ * are able to write a file of size N. UBIFS attaches node headers to each data
+ * node and it has to write indexind nodes as well. This introduces additional
+ * overhead, and UBIFS it has to report sligtly less free space to meet the
+ * above expectetion.
+ *
+ * This function assumes free space is made up of uncompressed data nodes and
+ * full index nodes (one per data node, doubled because we always allow enough
+ * space to write the index twice).
+ *
+ * Note, the calculation is pessimistic, which means that most of the time
+ * UBIFS reports less space than it actually has.
  */
-static inline struct timespec ubifs_current_time(struct inode *inode)
+static inline long long ubifs_reported_space(const struct ubifs_info *c,
+					     uint64_t free)
 {
-	return (inode->i_sb->s_time_gran < NSEC_PER_SEC) ?
-		current_fs_time(inode->i_sb) : CURRENT_TIME_SEC;
+	int divisor, factor;
+
+	divisor = UBIFS_MAX_DATA_NODE_SZ + (c->max_idx_node_sz * 3);
+	factor = UBIFS_MAX_DATA_NODE_SZ - UBIFS_DATA_NODE_SZ;
+	do_div(free, divisor);
+
+	return free * factor;
 }
 
 /**
- * ubifs_tnc_lookup - look up a file-system node.
- * @c: UBIFS file-system description object
- * @key: node key to lookup
- * @node: the node is returned here
- *
- * This function look up and reads node with key @key. The caller has to make
- * sure the @node buffer is large enough to fit the node. Returns zero in case
- * of success, %-ENOENT if the node was not found, and a negative error code in
- * case of failure.
+ * ubifs_current_time - round current time to time granularity.
+ * @inode: inode
  */
-static inline int ubifs_tnc_lookup(struct ubifs_info *c,
-				   const union ubifs_key *key, void *node)
+static inline struct timespec ubifs_current_time(struct inode *inode)
 {
-	return ubifs_tnc_locate(c, key, node, NULL, NULL);
+	return (inode->i_sb->s_time_gran < NSEC_PER_SEC) ?
+		current_fs_time(inode->i_sb) : CURRENT_TIME_SEC;
 }
 
 #endif /* __UBIFS_MISC_H__ */
diff --git a/trunk/fs/ubifs/super.c b/trunk/fs/ubifs/super.c
index 7562464ac83f..f71e6b8822c4 100644
--- a/trunk/fs/ubifs/super.c
+++ b/trunk/fs/ubifs/super.c
@@ -370,9 +370,8 @@ static int ubifs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
 	struct ubifs_info *c = dentry->d_sb->s_fs_info;
 	unsigned long long free;
-	__le32 *uuid = (__le32 *)c->uuid;
 
-	free = ubifs_get_free_space(c);
+	free = ubifs_budg_get_free_space(c);
 	dbg_gen("free space %lld bytes (%lld blocks)",
 		free, free >> UBIFS_BLOCK_SHIFT);
 
@@ -387,8 +386,7 @@ static int ubifs_statfs(struct dentry *dentry, struct kstatfs *buf)
 	buf->f_files = 0;
 	buf->f_ffree = 0;
 	buf->f_namelen = UBIFS_MAX_NLEN;
-	buf->f_fsid.val[0] = le32_to_cpu(uuid[0]) ^ le32_to_cpu(uuid[2]);
-	buf->f_fsid.val[1] = le32_to_cpu(uuid[1]) ^ le32_to_cpu(uuid[3]);
+
 	return 0;
 }
 
@@ -532,12 +530,6 @@ static int init_constants_early(struct ubifs_info *c)
 	c->dead_wm = ALIGN(MIN_WRITE_SZ, c->min_io_size);
 	c->dark_wm = ALIGN(UBIFS_MAX_NODE_SZ, c->min_io_size);
 
-	/*
-	 * Calculate how many bytes would be wasted at the end of LEB if it was
-	 * fully filled with data nodes of maximum size. This is used in
-	 * calculations when reporting free space.
-	 */
-	c->leb_overhead = c->leb_size % UBIFS_MAX_DATA_NODE_SZ;
 	return 0;
 }
 
@@ -655,11 +647,13 @@ static int init_constants_late(struct ubifs_info *c)
 	 * internally because it does not make much sense for UBIFS, but it is
 	 * necessary to report something for the 'statfs()' call.
 	 *
-	 * Subtract the LEB reserved for GC, the LEB which is reserved for
-	 * deletions, and assume only one journal head is available.
+	 * Subtract the LEB reserved for GC and the LEB which is reserved for
+	 * deletions.
+	 *
+	 * Review 'ubifs_calc_available()' if changing this calculation.
 	 */
-	tmp64 = c->main_lebs - 2 - c->jhead_cnt + 1;
-	tmp64 *= (uint64_t)c->leb_size - c->leb_overhead;
+	tmp64 = c->main_lebs - 2;
+	tmp64 *= (uint64_t)c->leb_size - c->dark_wm;
 	tmp64 = ubifs_reported_space(c, tmp64);
 	c->block_cnt = tmp64 >> UBIFS_BLOCK_SHIFT;
 
diff --git a/trunk/fs/ubifs/tnc.c b/trunk/fs/ubifs/tnc.c
index 7da209ab9378..e909f4a96443 100644
--- a/trunk/fs/ubifs/tnc.c
+++ b/trunk/fs/ubifs/tnc.c
@@ -506,7 +506,7 @@ static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
 		if (keys_cmp(c, key, &node_key) != 0)
 			ret = 0;
 	}
-	if (ret == 0 && c->replaying)
+	if (ret == 0)
 		dbg_mnt("dangling branch LEB %d:%d len %d, key %s",
 			zbr->lnum, zbr->offs, zbr->len, DBGKEY(key));
 	return ret;
@@ -1382,39 +1382,50 @@ static int lookup_level0_dirty(struct ubifs_info *c, const union ubifs_key *key,
 }
 
 /**
- * maybe_leb_gced - determine if a LEB may have been garbage collected.
+ * ubifs_tnc_lookup - look up a file-system node.
  * @c: UBIFS file-system description object
- * @lnum: LEB number
- * @gc_seq1: garbage collection sequence number
+ * @key: node key to lookup
+ * @node: the node is returned here
  *
- * This function determines if @lnum may have been garbage collected since
- * sequence number @gc_seq1. If it may have been then %1 is returned, otherwise
- * %0 is returned.
+ * This function look up and reads node with key @key. The caller has to make
+ * sure the @node buffer is large enough to fit the node. Returns zero in case
+ * of success, %-ENOENT if the node was not found, and a negative error code in
+ * case of failure.
  */
-static int maybe_leb_gced(struct ubifs_info *c, int lnum, int gc_seq1)
+int ubifs_tnc_lookup(struct ubifs_info *c, const union ubifs_key *key,
+		     void *node)
 {
-	int gc_seq2, gced_lnum;
+	int found, n, err;
+	struct ubifs_znode *znode;
+	struct ubifs_zbranch zbr, *zt;
 
-	gced_lnum = c->gced_lnum;
-	smp_rmb();
-	gc_seq2 = c->gc_seq;
-	/* Same seq means no GC */
-	if (gc_seq1 == gc_seq2)
-		return 0;
-	/* Different by more than 1 means we don't know */
-	if (gc_seq1 + 1 != gc_seq2)
-		return 1;
-	/*
-	 * We have seen the sequence number has increased by 1. Now we need to
-	 * be sure we read the right LEB number, so read it again.
-	 */
-	smp_rmb();
-	if (gced_lnum != c->gced_lnum)
-		return 1;
-	/* Finally we can check lnum */
-	if (gced_lnum == lnum)
-		return 1;
-	return 0;
+	mutex_lock(&c->tnc_mutex);
+	found = ubifs_lookup_level0(c, key, &znode, &n);
+	if (!found) {
+		err = -ENOENT;
+		goto out;
+	} else if (found < 0) {
+		err = found;
+		goto out;
+	}
+	zt = &znode->zbranch[n];
+	if (is_hash_key(c, key)) {
+		/*
+		 * In this case the leaf node cache gets used, so we pass the
+		 * address of the zbranch and keep the mutex locked
+		 */
+		err = tnc_read_node_nm(c, zt, node);
+		goto out;
+	}
+	zbr = znode->zbranch[n];
+	mutex_unlock(&c->tnc_mutex);
+
+	err = ubifs_tnc_read_node(c, &zbr, node);
+	return err;
+
+out:
+	mutex_unlock(&c->tnc_mutex);
+	return err;
 }
 
 /**
@@ -1425,19 +1436,16 @@ static int maybe_leb_gced(struct ubifs_info *c, int lnum, int gc_seq1)
  * @lnum: LEB number is returned here
  * @offs: offset is returned here
  *
- * This function look up and reads node with key @key. The caller has to make
- * sure the @node buffer is large enough to fit the node. Returns zero in case
- * of success, %-ENOENT if the node was not found, and a negative error code in
- * case of failure. The node location can be returned in @lnum and @offs.
+ * This function is the same as 'ubifs_tnc_lookup()' but it returns the node
+ * location also. See 'ubifs_tnc_lookup()'.
  */
 int ubifs_tnc_locate(struct ubifs_info *c, const union ubifs_key *key,
 		     void *node, int *lnum, int *offs)
 {
-	int found, n, err, safely = 0, gc_seq1;
+	int found, n, err;
 	struct ubifs_znode *znode;
 	struct ubifs_zbranch zbr, *zt;
 
-again:
 	mutex_lock(&c->tnc_mutex);
 	found = ubifs_lookup_level0(c, key, &znode, &n);
 	if (!found) {
@@ -1448,43 +1456,24 @@ int ubifs_tnc_locate(struct ubifs_info *c, const union ubifs_key *key,
 		goto out;
 	}
 	zt = &znode->zbranch[n];
-	if (lnum) {
-		*lnum = zt->lnum;
-		*offs = zt->offs;
-	}
 	if (is_hash_key(c, key)) {
 		/*
 		 * In this case the leaf node cache gets used, so we pass the
 		 * address of the zbranch and keep the mutex locked
 		 */
+		*lnum = zt->lnum;
+		*offs = zt->offs;
 		err = tnc_read_node_nm(c, zt, node);
 		goto out;
 	}
-	if (safely) {
-		err = ubifs_tnc_read_node(c, zt, node);
-		goto out;
-	}
-	/* Drop the TNC mutex prematurely and race with garbage collection */
 	zbr = znode->zbranch[n];
-	gc_seq1 = c->gc_seq;
 	mutex_unlock(&c->tnc_mutex);
 
-	if (ubifs_get_wbuf(c, zbr.lnum)) {
-		/* We do not GC journal heads */
-		err = ubifs_tnc_read_node(c, &zbr, node);
-		return err;
-	}
+	*lnum = zbr.lnum;
+	*offs = zbr.offs;
 
-	err = fallible_read_node(c, key, &zbr, node);
-	if (maybe_leb_gced(c, zbr.lnum, gc_seq1)) {
-		/*
-		 * The node may have been GC'ed out from under us so try again
-		 * while keeping the TNC mutex locked.
-		 */
-		safely = 1;
-		goto again;
-	}
-	return 0;
+	err = ubifs_tnc_read_node(c, &zbr, node);
+	return err;
 
 out:
 	mutex_unlock(&c->tnc_mutex);
@@ -1509,6 +1498,7 @@ static int do_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
 {
 	int found, n, err;
 	struct ubifs_znode *znode;
+	struct ubifs_zbranch zbr;
 
 	dbg_tnc("name '%.*s' key %s", nm->len, nm->name, DBGKEY(key));
 	mutex_lock(&c->tnc_mutex);
@@ -1532,7 +1522,11 @@ static int do_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
 		goto out_unlock;
 	}
 
-	err = tnc_read_node_nm(c, &znode->zbranch[n], node);
+	zbr = znode->zbranch[n];
+	mutex_unlock(&c->tnc_mutex);
+
+	err = tnc_read_node_nm(c, &zbr, node);
+	return err;
 
 out_unlock:
 	mutex_unlock(&c->tnc_mutex);
diff --git a/trunk/fs/ubifs/ubifs-media.h b/trunk/fs/ubifs/ubifs-media.h
index a9ecbd9af20d..bd2121f3426e 100644
--- a/trunk/fs/ubifs/ubifs-media.h
+++ b/trunk/fs/ubifs/ubifs-media.h
@@ -87,7 +87,7 @@
 #define UBIFS_SK_LEN 8
 
 /* Minimum index tree fanout */
-#define UBIFS_MIN_FANOUT 3
+#define UBIFS_MIN_FANOUT 2
 
 /* Maximum number of levels in UBIFS indexing B-tree */
 #define UBIFS_MAX_LEVELS 512
diff --git a/trunk/fs/ubifs/ubifs.h b/trunk/fs/ubifs/ubifs.h
index 17c620b93eec..d7f706f7a302 100644
--- a/trunk/fs/ubifs/ubifs.h
+++ b/trunk/fs/ubifs/ubifs.h
@@ -995,9 +995,6 @@ struct ubifs_mount_opts {
  * @max_idx_node_sz: maximum indexing node aligned on 8-bytes boundary
  * @max_inode_sz: maximum possible inode size in bytes
  * @max_znode_sz: size of znode in bytes
- *
- * @leb_overhead: how many bytes are wasted in an LEB when it is filled with
- *                data nodes of maximum size - used in free space reporting
  * @dead_wm: LEB dead space watermark
  * @dark_wm: LEB dark space watermark
  * @block_cnt: count of 4KiB blocks on the FS
@@ -1031,8 +1028,6 @@ struct ubifs_mount_opts {
  * @sbuf: a buffer of LEB size used by GC and replay for scanning
  * @idx_gc: list of index LEBs that have been garbage collected
  * @idx_gc_cnt: number of elements on the idx_gc list
- * @gc_seq: incremented for every non-index LEB garbage collected
- * @gced_lnum: last non-index LEB that was garbage collected
  *
  * @infos_list: links all 'ubifs_info' objects
  * @umount_mutex: serializes shrinker and un-mount
@@ -1229,8 +1224,6 @@ struct ubifs_info {
 	int max_idx_node_sz;
 	long long max_inode_sz;
 	int max_znode_sz;
-
-	int leb_overhead;
 	int dead_wm;
 	int dark_wm;
 	int block_cnt;
@@ -1264,8 +1257,6 @@ struct ubifs_info {
 	void *sbuf;
 	struct list_head idx_gc;
 	int idx_gc_cnt;
-	volatile int gc_seq;
-	volatile int gced_lnum;
 
 	struct list_head infos_list;
 	struct mutex umount_mutex;
@@ -1443,10 +1434,9 @@ void ubifs_release_ino_dirty(struct ubifs_info *c, struct inode *inode,
 				struct ubifs_budget_req *req);
 void ubifs_cancel_ino_op(struct ubifs_info *c, struct inode *inode,
 			 struct ubifs_budget_req *req);
-long long ubifs_get_free_space(struct ubifs_info *c);
+long long ubifs_budg_get_free_space(struct ubifs_info *c);
 int ubifs_calc_min_idx_lebs(struct ubifs_info *c);
 void ubifs_convert_page_budget(struct ubifs_info *c);
-long long ubifs_reported_space(const struct ubifs_info *c, uint64_t free);
 long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs);
 
 /* find.c */
@@ -1461,6 +1451,8 @@ int ubifs_save_dirty_idx_lnums(struct ubifs_info *c);
 /* tnc.c */
 int ubifs_lookup_level0(struct ubifs_info *c, const union ubifs_key *key,
 			struct ubifs_znode **zn, int *n);
+int ubifs_tnc_lookup(struct ubifs_info *c, const union ubifs_key *key,
+		     void *node);
 int ubifs_tnc_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
 			void *node, const struct qstr *nm);
 int ubifs_tnc_locate(struct ubifs_info *c, const union ubifs_key *key,
diff --git a/trunk/include/asm-generic/sections.h b/trunk/include/asm-generic/sections.h
index 79a7ff925bf8..8feeae1f2369 100644
--- a/trunk/include/asm-generic/sections.h
+++ b/trunk/include/asm-generic/sections.h
@@ -14,10 +14,4 @@ extern char __kprobes_text_start[], __kprobes_text_end[];
 extern char __initdata_begin[], __initdata_end[];
 extern char __start_rodata[], __end_rodata[];
 
-/* function descriptor handling (if any).  Override
- * in asm/sections.h */
-#ifndef dereference_function_descriptor
-#define dereference_function_descriptor(p) (p)
-#endif
-
 #endif /* _ASM_GENERIC_SECTIONS_H_ */
diff --git a/trunk/include/asm-parisc/sections.h b/trunk/include/asm-parisc/sections.h
index 9d13c3507ad6..fdd43ec42ec5 100644
--- a/trunk/include/asm-parisc/sections.h
+++ b/trunk/include/asm-parisc/sections.h
@@ -4,9 +4,4 @@
 /* nothing to see, move along */
 #include <asm-generic/sections.h>
 
-#ifdef CONFIG_64BIT
-#undef dereference_function_descriptor
-void *dereference_function_descriptor(void *);
-#endif
-
 #endif
diff --git a/trunk/lib/vsprintf.c b/trunk/lib/vsprintf.c
index c399bc1093cb..d8d1d1142248 100644
--- a/trunk/lib/vsprintf.c
+++ b/trunk/lib/vsprintf.c
@@ -27,7 +27,6 @@
 
 #include <asm/page.h>		/* for PAGE_SIZE */
 #include <asm/div64.h>
-#include <asm/sections.h>	/* for dereference_function_descriptor() */
 
 /* Works only for digits and letters, but small and fast */
 #define TOLOWER(x) ((x) | 0x20)
@@ -514,6 +513,16 @@ static char *string(char *buf, char *end, char *s, int field_width, int precisio
 	return buf;
 }
 
+static inline void *dereference_function_descriptor(void *ptr)
+{
+#if defined(CONFIG_IA64) || defined(CONFIG_PPC64)
+	void *p;
+	if (!probe_kernel_address(ptr, p))
+		ptr = p;
+#endif
+	return ptr;
+}
+
 static char *symbol_string(char *buf, char *end, void *ptr, int field_width, int precision, int flags)
 {
 	unsigned long value = (unsigned long) ptr;