From c45b14011e611aee471981d1502fbb6bcf4b1713 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <randy.dunlap@oracle.com>
Date: Mon, 19 Jul 2010 22:20:27 +0000
Subject: [PATCH] --- yaml --- r: 201099 b: refs/heads/master c:
 9fe41e4197f351bc78547ab2d8808e1aca30d87c h: refs/heads/master i:   201097:
 003480b9d1b158e0d3ba498ea972fe4680ada579   201095:
 d5ebcd0276377dd1a00da02e8c0a145d6bf111ee v: v3

---
 [refs]                                        |   2 +-
 trunk/Documentation/00-INDEX                  |   6 +-
 ...-mapping.txt => bus-virt-phys-mapping.txt} |   0
 trunk/arch/x86/kernel/setup_percpu.c          |  17 ++-
 trunk/arch/x86/kvm/mmu.c                      |   2 +-
 trunk/drivers/clocksource/cs5535-clockevt.c   |   2 +-
 trunk/drivers/edac/Kconfig                    |   2 +-
 trunk/drivers/edac/mpc85xx_edac.c             |   1 -
 trunk/drivers/gpio/cs5535-gpio.c              |   2 +-
 trunk/drivers/gpu/drm/i915/i915_gem.c         |   2 +-
 trunk/drivers/misc/cs5535-mfgpt.c             |   2 +-
 trunk/drivers/mmc/host/sdhci-s3c.c            |  20 ---
 trunk/drivers/net/ibmveth.c                   |   4 +-
 trunk/drivers/net/pcmcia/axnet_cs.c           |   7 +-
 trunk/drivers/net/r8169.c                     |   2 +-
 .../drivers/net/wireless/ath/ath9k/hif_usb.c  |   8 +-
 .../drivers/net/wireless/hostap/hostap_pci.c  |   1 -
 trunk/drivers/net/wireless/iwlwifi/iwl-sta.h  |  11 --
 trunk/drivers/net/wireless/rt2x00/rt2x00dev.c |  10 +-
 trunk/drivers/power/ds2782_battery.c          |   2 +-
 trunk/drivers/vhost/net.c                     |  13 +-
 trunk/fs/btrfs/ctree.c                        | 129 +++--------------
 trunk/fs/btrfs/ioctl.c                        |  20 +--
 trunk/fs/dcache.c                             |   2 +-
 trunk/fs/gfs2/glock.c                         |   2 +-
 trunk/fs/gfs2/quota.c                         |   2 +-
 trunk/fs/gfs2/quota.h                         |   2 +-
 trunk/fs/inode.c                              |   2 +-
 trunk/fs/mbcache.c                            |   5 +-
 trunk/fs/nfs/dir.c                            |   2 +-
 trunk/fs/nfs/internal.h                       |   3 +-
 trunk/fs/quota/dquot.c                        |   2 +-
 trunk/fs/ubifs/shrinker.c                     |   2 +-
 trunk/fs/ubifs/ubifs.h                        |   2 +-
 trunk/fs/xfs/linux-2.6/xfs_buf.c              |   5 +-
 trunk/fs/xfs/linux-2.6/xfs_super.c            |   2 +
 trunk/fs/xfs/linux-2.6/xfs_sync.c             | 130 +++++++-----------
 trunk/fs/xfs/linux-2.6/xfs_sync.h             |   2 +
 trunk/fs/xfs/linux-2.6/xfs_trace.h            |   3 -
 trunk/fs/xfs/quota/xfs_qm.c                   |   7 +-
 trunk/fs/xfs/xfs_mount.h                      |   2 +-
 trunk/include/linux/fdtable.h                 |   3 +-
 trunk/include/linux/mm.h                      |   2 +-
 trunk/include/net/sock.h                      |   7 +-
 trunk/ipc/sem.c                               |  46 +------
 trunk/mm/bootmem.c                            |  24 +---
 trunk/mm/page_alloc.c                         |   3 -
 trunk/mm/vmscan.c                             |  10 +-
 trunk/net/bluetooth/hci_conn.c                |   5 -
 trunk/net/bluetooth/hci_event.c               |   2 -
 trunk/net/bluetooth/l2cap.c                   |  14 +-
 trunk/net/bridge/br_device.c                  |   9 ++
 trunk/net/bridge/br_forward.c                 |  23 +++-
 trunk/net/core/dev.c                          |  20 +--
 trunk/net/core/neighbour.c                    |   5 +-
 trunk/net/dsa/Kconfig                         |   2 +-
 trunk/net/ipv4/ipmr.c                         |   8 +-
 trunk/net/ipv4/tcp.c                          |   1 -
 trunk/net/ipv4/tcp_output.c                   |   3 -
 trunk/net/ipv6/mip6.c                         |   3 +-
 trunk/net/phonet/pep.c                        |   1 -
 trunk/net/sched/act_nat.c                     |   5 +-
 trunk/net/xfrm/xfrm_policy.c                  |  15 +-
 63 files changed, 205 insertions(+), 448 deletions(-)
 rename trunk/Documentation/{IO-mapping.txt => bus-virt-phys-mapping.txt} (100%)

diff --git a/[refs] b/[refs]
index 8f62a0411339..a300700ce842 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 516bd664153d76f5c814633cee6500e2ff8e861b
+refs/heads/master: 9fe41e4197f351bc78547ab2d8808e1aca30d87c
diff --git a/trunk/Documentation/00-INDEX b/trunk/Documentation/00-INDEX
index dd10b51b4e65..5405f7aecefc 100644
--- a/trunk/Documentation/00-INDEX
+++ b/trunk/Documentation/00-INDEX
@@ -32,8 +32,6 @@ DocBook/
 	- directory with DocBook templates etc. for kernel documentation.
 HOWTO
 	- the process and procedures of how to do Linux kernel development.
-IO-mapping.txt
-	- how to access I/O mapped memory from within device drivers.
 IPMI.txt
 	- info on Linux Intelligent Platform Management Interface (IPMI) Driver.
 IRQ-affinity.txt
@@ -84,6 +82,8 @@ blockdev/
 	- info on block devices & drivers
 btmrvl.txt
 	- info on Marvell Bluetooth driver usage.
+bus-virt-phys-mapping.txt
+	- how to access I/O mapped memory from within device drivers.
 cachetlb.txt
 	- describes the cache/TLB flushing interfaces Linux uses.
 cdrom/
@@ -168,6 +168,8 @@ initrd.txt
 	- how to use the RAM disk as an initial/temporary root filesystem.
 input/
 	- info on Linux input device support.
+io-mapping.txt
+	- description of io_mapping functions in linux/io-mapping.h
 io_ordering.txt
 	- info on ordering I/O writes to memory-mapped addresses.
 ioctl/
diff --git a/trunk/Documentation/IO-mapping.txt b/trunk/Documentation/bus-virt-phys-mapping.txt
similarity index 100%
rename from trunk/Documentation/IO-mapping.txt
rename to trunk/Documentation/bus-virt-phys-mapping.txt
diff --git a/trunk/arch/x86/kernel/setup_percpu.c b/trunk/arch/x86/kernel/setup_percpu.c
index 690c2c09faf3..de3b63ae3da2 100644
--- a/trunk/arch/x86/kernel/setup_percpu.c
+++ b/trunk/arch/x86/kernel/setup_percpu.c
@@ -238,15 +238,6 @@ void __init setup_per_cpu_areas(void)
 #ifdef CONFIG_NUMA
 		per_cpu(x86_cpu_to_node_map, cpu) =
 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
-		/*
-		 * Ensure taht the boot cpu numa_node is correct when the boot
-		 * cpu is on a node that doesn't have memory installed.
-		 * Also cpu_up() will call cpu_to_node() for APs when
-		 * MEMORY_HOTPLUG is defined, before per_cpu(numa_node) is set
-		 * up later with c_init aka intel_init/amd_init.
-		 * So set them all (boot cpu and all APs).
-		 */
-		set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
 #endif
 #endif
 		/*
@@ -266,6 +257,14 @@ void __init setup_per_cpu_areas(void)
 	early_per_cpu_ptr(x86_cpu_to_node_map) = NULL;
 #endif
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_NUMA)
+	/*
+	 * make sure boot cpu numa_node is right, when boot cpu is on the
+	 * node that doesn't have mem installed
+	 */
+	set_cpu_numa_node(boot_cpu_id, early_cpu_to_node(boot_cpu_id));
+#endif
+
 	/* Setup node to cpumask map */
 	setup_node_to_cpumask_map();
 
diff --git a/trunk/arch/x86/kvm/mmu.c b/trunk/arch/x86/kvm/mmu.c
index b1ed0a1a5913..3699613e8830 100644
--- a/trunk/arch/x86/kvm/mmu.c
+++ b/trunk/arch/x86/kvm/mmu.c
@@ -2926,7 +2926,7 @@ static int kvm_mmu_remove_some_alloc_mmu_pages(struct kvm *kvm)
 	return kvm_mmu_zap_page(kvm, page) + 1;
 }
 
-static int mmu_shrink(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
+static int mmu_shrink(int nr_to_scan, gfp_t gfp_mask)
 {
 	struct kvm *kvm;
 	struct kvm *kvm_freed = NULL;
diff --git a/trunk/drivers/clocksource/cs5535-clockevt.c b/trunk/drivers/clocksource/cs5535-clockevt.c
index b7dab32ce63c..d7be69f13154 100644
--- a/trunk/drivers/clocksource/cs5535-clockevt.c
+++ b/trunk/drivers/clocksource/cs5535-clockevt.c
@@ -194,6 +194,6 @@ static int __init cs5535_mfgpt_init(void)
 
 module_init(cs5535_mfgpt_init);
 
-MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
+MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
 MODULE_DESCRIPTION("CS5535/CS5536 MFGPT clock event driver");
 MODULE_LICENSE("GPL");
diff --git a/trunk/drivers/edac/Kconfig b/trunk/drivers/edac/Kconfig
index 0d2f9dbb47e4..aedef7941b22 100644
--- a/trunk/drivers/edac/Kconfig
+++ b/trunk/drivers/edac/Kconfig
@@ -209,7 +209,7 @@ config EDAC_I5100
 
 config EDAC_MPC85XX
 	tristate "Freescale MPC83xx / MPC85xx"
-	depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || PPC_85xx)
+	depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || MPC85xx)
 	help
 	  Support for error detection and correction on the Freescale
 	  MPC8349, MPC8560, MPC8540, MPC8548
diff --git a/trunk/drivers/edac/mpc85xx_edac.c b/trunk/drivers/edac/mpc85xx_edac.c
index f39b00a46eda..52ca09bf4726 100644
--- a/trunk/drivers/edac/mpc85xx_edac.c
+++ b/trunk/drivers/edac/mpc85xx_edac.c
@@ -1120,7 +1120,6 @@ static struct of_device_id mpc85xx_mc_err_of_match[] = {
 	{ .compatible = "fsl,mpc8555-memory-controller", },
 	{ .compatible = "fsl,mpc8560-memory-controller", },
 	{ .compatible = "fsl,mpc8568-memory-controller", },
-	{ .compatible = "fsl,mpc8569-memory-controller", },
 	{ .compatible = "fsl,mpc8572-memory-controller", },
 	{ .compatible = "fsl,mpc8349-memory-controller", },
 	{ .compatible = "fsl,p2020-memory-controller", },
diff --git a/trunk/drivers/gpio/cs5535-gpio.c b/trunk/drivers/gpio/cs5535-gpio.c
index e23c06893d19..f73a1555e49d 100644
--- a/trunk/drivers/gpio/cs5535-gpio.c
+++ b/trunk/drivers/gpio/cs5535-gpio.c
@@ -352,6 +352,6 @@ static void __exit cs5535_gpio_exit(void)
 module_init(cs5535_gpio_init);
 module_exit(cs5535_gpio_exit);
 
-MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
+MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
 MODULE_DESCRIPTION("AMD CS5535/CS5536 GPIO driver");
 MODULE_LICENSE("GPL");
diff --git a/trunk/drivers/gpu/drm/i915/i915_gem.c b/trunk/drivers/gpu/drm/i915/i915_gem.c
index e7018708cc31..8757ecf6e96b 100644
--- a/trunk/drivers/gpu/drm/i915/i915_gem.c
+++ b/trunk/drivers/gpu/drm/i915/i915_gem.c
@@ -4978,7 +4978,7 @@ i915_gpu_is_active(struct drm_device *dev)
 }
 
 static int
-i915_gem_shrink(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
+i915_gem_shrink(int nr_to_scan, gfp_t gfp_mask)
 {
 	drm_i915_private_t *dev_priv, *next_dev;
 	struct drm_i915_gem_object *obj_priv, *next_obj;
diff --git a/trunk/drivers/misc/cs5535-mfgpt.c b/trunk/drivers/misc/cs5535-mfgpt.c
index 2d44b3300104..9bec24db4d41 100644
--- a/trunk/drivers/misc/cs5535-mfgpt.c
+++ b/trunk/drivers/misc/cs5535-mfgpt.c
@@ -366,6 +366,6 @@ static int __init cs5535_mfgpt_init(void)
 
 module_init(cs5535_mfgpt_init);
 
-MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
+MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
 MODULE_DESCRIPTION("CS5535/CS5536 MFGPT timer driver");
 MODULE_LICENSE("GPL");
diff --git a/trunk/drivers/mmc/host/sdhci-s3c.c b/trunk/drivers/mmc/host/sdhci-s3c.c
index ad30f074ee15..af217924a76e 100644
--- a/trunk/drivers/mmc/host/sdhci-s3c.c
+++ b/trunk/drivers/mmc/host/sdhci-s3c.c
@@ -365,26 +365,6 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
 
 static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
 {
-	struct sdhci_host *host =  platform_get_drvdata(pdev);
-	struct sdhci_s3c *sc = sdhci_priv(host);
-	int ptr;
-
-	sdhci_remove_host(host, 1);
-
-	for (ptr = 0; ptr < 3; ptr++) {
-		clk_disable(sc->clk_bus[ptr]);
-		clk_put(sc->clk_bus[ptr]);
-	}
-	clk_disable(sc->clk_io);
-	clk_put(sc->clk_io);
-
-	iounmap(host->ioaddr);
-	release_resource(sc->ioarea);
-	kfree(sc->ioarea);
-
-	sdhci_free_host(host);
-	platform_set_drvdata(pdev, NULL);
-
 	return 0;
 }
 
diff --git a/trunk/drivers/net/ibmveth.c b/trunk/drivers/net/ibmveth.c
index 2602852cc55a..7acb3edc47ef 100644
--- a/trunk/drivers/net/ibmveth.c
+++ b/trunk/drivers/net/ibmveth.c
@@ -677,7 +677,7 @@ static int ibmveth_close(struct net_device *netdev)
 	if (!adapter->pool_config)
 		netif_stop_queue(netdev);
 
-	h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
+	free_irq(netdev->irq, netdev);
 
 	do {
 		lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
@@ -689,8 +689,6 @@ static int ibmveth_close(struct net_device *netdev)
 				     lpar_rc);
 	}
 
-	free_irq(netdev->irq, netdev);
-
 	adapter->rx_no_buffer = *(u64*)(((char*)adapter->buffer_list_addr) + 4096 - 8);
 
 	ibmveth_cleanup(adapter);
diff --git a/trunk/drivers/net/pcmcia/axnet_cs.c b/trunk/drivers/net/pcmcia/axnet_cs.c
index 33525bf2a3d3..5b3dfb4ab279 100644
--- a/trunk/drivers/net/pcmcia/axnet_cs.c
+++ b/trunk/drivers/net/pcmcia/axnet_cs.c
@@ -1168,7 +1168,6 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
 	int interrupts, nr_serviced = 0, i;
 	struct ei_device *ei_local;
     	int handled = 0;
-	unsigned long flags;
 
 	e8390_base = dev->base_addr;
 	ei_local = netdev_priv(dev);
@@ -1177,7 +1176,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
 	 *	Protect the irq test too.
 	 */
 	 
-	spin_lock_irqsave(&ei_local->page_lock, flags);
+	spin_lock(&ei_local->page_lock);
 
 	if (ei_local->irqlock) 
 	{
@@ -1189,7 +1188,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
 			   dev->name, inb_p(e8390_base + EN0_ISR),
 			   inb_p(e8390_base + EN0_IMR));
 #endif
-		spin_unlock_irqrestore(&ei_local->page_lock, flags);
+		spin_unlock(&ei_local->page_lock);
 		return IRQ_NONE;
 	}
     
@@ -1262,7 +1261,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
 	ei_local->irqlock = 0;
 	outb_p(ENISR_ALL, e8390_base + EN0_IMR);
 
-	spin_unlock_irqrestore(&ei_local->page_lock, flags);
+	spin_unlock(&ei_local->page_lock);
 	return IRQ_RETVAL(handled);
 }
 
diff --git a/trunk/drivers/net/r8169.c b/trunk/drivers/net/r8169.c
index cdc6a5c2e70d..96b6cfbf0a3a 100644
--- a/trunk/drivers/net/r8169.c
+++ b/trunk/drivers/net/r8169.c
@@ -1316,7 +1316,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
 		{ 0x7c800000, 0x28000000,	RTL_GIGA_MAC_VER_26 },
 
 		/* 8168C family. */
-		{ 0x7cf00000, 0x3cb00000,	RTL_GIGA_MAC_VER_24 },
+		{ 0x7cf00000, 0x3ca00000,	RTL_GIGA_MAC_VER_24 },
 		{ 0x7cf00000, 0x3c900000,	RTL_GIGA_MAC_VER_23 },
 		{ 0x7cf00000, 0x3c800000,	RTL_GIGA_MAC_VER_18 },
 		{ 0x7c800000, 0x3c800000,	RTL_GIGA_MAC_VER_24 },
diff --git a/trunk/drivers/net/wireless/ath/ath9k/hif_usb.c b/trunk/drivers/net/wireless/ath/ath9k/hif_usb.c
index 23c15aa9fbd5..77b359162d6c 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -730,17 +730,13 @@ static int ath9k_hif_usb_alloc_urbs(struct hif_device_usb *hif_dev)
 
 	/* RX */
 	if (ath9k_hif_usb_alloc_rx_urbs(hif_dev) < 0)
-		goto err_rx;
+		goto err;
 
 	/* Register Read */
 	if (ath9k_hif_usb_alloc_reg_in_urb(hif_dev) < 0)
-		goto err_reg;
+		goto err;
 
 	return 0;
-err_reg:
-	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
-err_rx:
-	ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
 err:
 	return -ENOMEM;
 }
diff --git a/trunk/drivers/net/wireless/hostap/hostap_pci.c b/trunk/drivers/net/wireless/hostap/hostap_pci.c
index 972a9c3af39e..d24dc7dc0723 100644
--- a/trunk/drivers/net/wireless/hostap/hostap_pci.c
+++ b/trunk/drivers/net/wireless/hostap/hostap_pci.c
@@ -330,7 +330,6 @@ static int prism2_pci_probe(struct pci_dev *pdev,
 
         dev->irq = pdev->irq;
         hw_priv->mem_start = mem;
-	dev->base_addr = (unsigned long) mem;
 
 	prism2_pci_cor_sreset(local);
 
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-sta.h b/trunk/drivers/net/wireless/iwlwifi/iwl-sta.h
index dc43ebd1f1fd..c2a453a1a991 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -97,17 +97,6 @@ static inline void iwl_clear_driver_stations(struct iwl_priv *priv)
 	spin_lock_irqsave(&priv->sta_lock, flags);
 	memset(priv->stations, 0, sizeof(priv->stations));
 	priv->num_stations = 0;
-
-	/*
-	 * Remove all key information that is not stored as part of station
-	 * information since mac80211 may not have had a
-	 * chance to remove all the keys. When device is reconfigured by
-	 * mac80211 after an error all keys will be reconfigured.
-	 */
-	priv->ucode_key_table = 0;
-	priv->key_mapping_key = 0;
-	memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
-
 	spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 
diff --git a/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c b/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c
index f20d3eeeea7f..3ae468c4d760 100644
--- a/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/trunk/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -853,11 +853,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
 		    BIT(NL80211_IFTYPE_MESH_POINT) |
 		    BIT(NL80211_IFTYPE_WDS);
 
-	/*
-	 * Initialize configuration work.
-	 */
-	INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
-
 	/*
 	 * Let the driver probe the device to detect the capabilities.
 	 */
@@ -867,6 +862,11 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
 		goto exit;
 	}
 
+	/*
+	 * Initialize configuration work.
+	 */
+	INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
+
 	/*
 	 * Allocate queue array.
 	 */
diff --git a/trunk/drivers/power/ds2782_battery.c b/trunk/drivers/power/ds2782_battery.c
index 2afbeec8b791..d762a0cbc6af 100644
--- a/trunk/drivers/power/ds2782_battery.c
+++ b/trunk/drivers/power/ds2782_battery.c
@@ -163,7 +163,7 @@ static int ds2782_get_capacity(struct ds278x_info *info, int *capacity)
 	if (err)
 		return err;
 	*capacity = raw;
-	return 0;
+	return raw;
 }
 
 static int ds2786_get_current(struct ds278x_info *info, int *current_uA)
diff --git a/trunk/drivers/vhost/net.c b/trunk/drivers/vhost/net.c
index d219070fed3d..57a593c58cf4 100644
--- a/trunk/drivers/vhost/net.c
+++ b/trunk/drivers/vhost/net.c
@@ -177,8 +177,8 @@ static void handle_tx(struct vhost_net *net)
 			break;
 		}
 		if (err != len)
-			pr_debug("Truncated TX packet: "
-				 " len %d != %zd\n", err, len);
+			pr_err("Truncated TX packet: "
+			       " len %d != %zd\n", err, len);
 		vhost_add_used_and_signal(&net->dev, vq, head, 0);
 		total_len += len;
 		if (unlikely(total_len >= VHOST_NET_WEIGHT)) {
@@ -275,8 +275,8 @@ static void handle_rx(struct vhost_net *net)
 		}
 		/* TODO: Should check and handle checksum. */
 		if (err > len) {
-			pr_debug("Discarded truncated rx packet: "
-				 " len %d > %zd\n", err, len);
+			pr_err("Discarded truncated rx packet: "
+			       " len %d > %zd\n", err, len);
 			vhost_discard_vq_desc(vq);
 			continue;
 		}
@@ -534,16 +534,11 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
 	rcu_assign_pointer(vq->private_data, sock);
 	vhost_net_enable_vq(n, vq);
 done:
-	mutex_unlock(&vq->mutex);
-
 	if (oldsock) {
 		vhost_net_flush_vq(n, index);
 		fput(oldsock->file);
 	}
 
-	mutex_unlock(&n->dev.mutex);
-	return 0;
-
 err_vq:
 	mutex_unlock(&vq->mutex);
 err:
diff --git a/trunk/fs/btrfs/ctree.c b/trunk/fs/btrfs/ctree.c
index c3df14ce2cc2..0d1d966b0fe4 100644
--- a/trunk/fs/btrfs/ctree.c
+++ b/trunk/fs/btrfs/ctree.c
@@ -2304,17 +2304,12 @@ noinline int btrfs_leaf_free_space(struct btrfs_root *root,
 	return ret;
 }
 
-/*
- * min slot controls the lowest index we're willing to push to the
- * right.  We'll push up to and including min_slot, but no lower
- */
 static noinline int __push_leaf_right(struct btrfs_trans_handle *trans,
 				      struct btrfs_root *root,
 				      struct btrfs_path *path,
 				      int data_size, int empty,
 				      struct extent_buffer *right,
-				      int free_space, u32 left_nritems,
-				      u32 min_slot)
+				      int free_space, u32 left_nritems)
 {
 	struct extent_buffer *left = path->nodes[0];
 	struct extent_buffer *upper = path->nodes[1];
@@ -2332,7 +2327,7 @@ static noinline int __push_leaf_right(struct btrfs_trans_handle *trans,
 	if (empty)
 		nr = 0;
 	else
-		nr = max_t(u32, 1, min_slot);
+		nr = 1;
 
 	if (path->slots[0] >= left_nritems)
 		push_space += data_size;
@@ -2474,14 +2469,10 @@ static noinline int __push_leaf_right(struct btrfs_trans_handle *trans,
  *
  * returns 1 if the push failed because the other node didn't have enough
  * room, 0 if everything worked out and < 0 if there were major errors.
- *
- * this will push starting from min_slot to the end of the leaf.  It won't
- * push any slot lower than min_slot
  */
 static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
-			   *root, struct btrfs_path *path,
-			   int min_data_size, int data_size,
-			   int empty, u32 min_slot)
+			   *root, struct btrfs_path *path, int data_size,
+			   int empty)
 {
 	struct extent_buffer *left = path->nodes[0];
 	struct extent_buffer *right;
@@ -2523,8 +2514,8 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
 	if (left_nritems == 0)
 		goto out_unlock;
 
-	return __push_leaf_right(trans, root, path, min_data_size, empty,
-				right, free_space, left_nritems, min_slot);
+	return __push_leaf_right(trans, root, path, data_size, empty,
+				right, free_space, left_nritems);
 out_unlock:
 	btrfs_tree_unlock(right);
 	free_extent_buffer(right);
@@ -2534,17 +2525,12 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
 /*
  * push some data in the path leaf to the left, trying to free up at
  * least data_size bytes.  returns zero if the push worked, nonzero otherwise
- *
- * max_slot can put a limit on how far into the leaf we'll push items.  The
- * item at 'max_slot' won't be touched.  Use (u32)-1 to make us do all the
- * items
  */
 static noinline int __push_leaf_left(struct btrfs_trans_handle *trans,
 				     struct btrfs_root *root,
 				     struct btrfs_path *path, int data_size,
 				     int empty, struct extent_buffer *left,
-				     int free_space, u32 right_nritems,
-				     u32 max_slot)
+				     int free_space, int right_nritems)
 {
 	struct btrfs_disk_key disk_key;
 	struct extent_buffer *right = path->nodes[0];
@@ -2563,9 +2549,9 @@ static noinline int __push_leaf_left(struct btrfs_trans_handle *trans,
 	slot = path->slots[1];
 
 	if (empty)
-		nr = min(right_nritems, max_slot);
+		nr = right_nritems;
 	else
-		nr = min(right_nritems - 1, max_slot);
+		nr = right_nritems - 1;
 
 	for (i = 0; i < nr; i++) {
 		item = btrfs_item_nr(right, i);
@@ -2726,14 +2712,10 @@ static noinline int __push_leaf_left(struct btrfs_trans_handle *trans,
 /*
  * push some data in the path leaf to the left, trying to free up at
  * least data_size bytes.  returns zero if the push worked, nonzero otherwise
- *
- * max_slot can put a limit on how far into the leaf we'll push items.  The
- * item at 'max_slot' won't be touched.  Use (u32)-1 to make us push all the
- * items
  */
 static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
-			  *root, struct btrfs_path *path, int min_data_size,
-			  int data_size, int empty, u32 max_slot)
+			  *root, struct btrfs_path *path, int data_size,
+			  int empty)
 {
 	struct extent_buffer *right = path->nodes[0];
 	struct extent_buffer *left;
@@ -2779,9 +2761,8 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
 		goto out;
 	}
 
-	return __push_leaf_left(trans, root, path, min_data_size,
-			       empty, left, free_space, right_nritems,
-			       max_slot);
+	return __push_leaf_left(trans, root, path, data_size,
+			       empty, left, free_space, right_nritems);
 out:
 	btrfs_tree_unlock(left);
 	free_extent_buffer(left);
@@ -2873,64 +2854,6 @@ static noinline int copy_for_split(struct btrfs_trans_handle *trans,
 	return ret;
 }
 
-/*
- * double splits happen when we need to insert a big item in the middle
- * of a leaf.  A double split can leave us with 3 mostly empty leaves:
- * leaf: [ slots 0 - N] [ our target ] [ N + 1 - total in leaf ]
- *          A                 B                 C
- *
- * We avoid this by trying to push the items on either side of our target
- * into the adjacent leaves.  If all goes well we can avoid the double split
- * completely.
- */
-static noinline int push_for_double_split(struct btrfs_trans_handle *trans,
-					  struct btrfs_root *root,
-					  struct btrfs_path *path,
-					  int data_size)
-{
-	int ret;
-	int progress = 0;
-	int slot;
-	u32 nritems;
-
-	slot = path->slots[0];
-
-	/*
-	 * try to push all the items after our slot into the
-	 * right leaf
-	 */
-	ret = push_leaf_right(trans, root, path, 1, data_size, 0, slot);
-	if (ret < 0)
-		return ret;
-
-	if (ret == 0)
-		progress++;
-
-	nritems = btrfs_header_nritems(path->nodes[0]);
-	/*
-	 * our goal is to get our slot at the start or end of a leaf.  If
-	 * we've done so we're done
-	 */
-	if (path->slots[0] == 0 || path->slots[0] == nritems)
-		return 0;
-
-	if (btrfs_leaf_free_space(root, path->nodes[0]) >= data_size)
-		return 0;
-
-	/* try to push all the items before our slot into the next leaf */
-	slot = path->slots[0];
-	ret = push_leaf_left(trans, root, path, 1, data_size, 0, slot);
-	if (ret < 0)
-		return ret;
-
-	if (ret == 0)
-		progress++;
-
-	if (progress)
-		return 0;
-	return 1;
-}
-
 /*
  * split the path's leaf in two, making sure there is at least data_size
  * available for the resulting leaf level of the path.
@@ -2953,7 +2876,6 @@ static noinline int split_leaf(struct btrfs_trans_handle *trans,
 	int wret;
 	int split;
 	int num_doubles = 0;
-	int tried_avoid_double = 0;
 
 	l = path->nodes[0];
 	slot = path->slots[0];
@@ -2962,14 +2884,12 @@ static noinline int split_leaf(struct btrfs_trans_handle *trans,
 		return -EOVERFLOW;
 
 	/* first try to make some room by pushing left and right */
-	if (data_size) {
-		wret = push_leaf_right(trans, root, path, data_size,
-				       data_size, 0, 0);
+	if (data_size && ins_key->type != BTRFS_DIR_ITEM_KEY) {
+		wret = push_leaf_right(trans, root, path, data_size, 0);
 		if (wret < 0)
 			return wret;
 		if (wret) {
-			wret = push_leaf_left(trans, root, path, data_size,
-					      data_size, 0, (u32)-1);
+			wret = push_leaf_left(trans, root, path, data_size, 0);
 			if (wret < 0)
 				return wret;
 		}
@@ -3003,8 +2923,6 @@ static noinline int split_leaf(struct btrfs_trans_handle *trans,
 				if (mid != nritems &&
 				    leaf_space_used(l, mid, nritems - mid) +
 				    data_size > BTRFS_LEAF_DATA_SIZE(root)) {
-					if (data_size && !tried_avoid_double)
-						goto push_for_double;
 					split = 2;
 				}
 			}
@@ -3021,8 +2939,6 @@ static noinline int split_leaf(struct btrfs_trans_handle *trans,
 				if (mid != nritems &&
 				    leaf_space_used(l, mid, nritems - mid) +
 				    data_size > BTRFS_LEAF_DATA_SIZE(root)) {
-					if (data_size && !tried_avoid_double)
-						goto push_for_double;
 					split = 2 ;
 				}
 			}
@@ -3103,13 +3019,6 @@ static noinline int split_leaf(struct btrfs_trans_handle *trans,
 	}
 
 	return ret;
-
-push_for_double:
-	push_for_double_split(trans, root, path, data_size);
-	tried_avoid_double = 1;
-	if (btrfs_leaf_free_space(root, path->nodes[0]) >= data_size)
-		return 0;
-	goto again;
 }
 
 static noinline int setup_leaf_for_split(struct btrfs_trans_handle *trans,
@@ -4006,15 +3915,13 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
 			extent_buffer_get(leaf);
 
 			btrfs_set_path_blocking(path);
-			wret = push_leaf_left(trans, root, path, 1, 1,
-					      1, (u32)-1);
+			wret = push_leaf_left(trans, root, path, 1, 1);
 			if (wret < 0 && wret != -ENOSPC)
 				ret = wret;
 
 			if (path->nodes[0] == leaf &&
 			    btrfs_header_nritems(leaf)) {
-				wret = push_leaf_right(trans, root, path, 1,
-						       1, 1, 0);
+				wret = push_leaf_right(trans, root, path, 1, 1);
 				if (wret < 0 && wret != -ENOSPC)
 					ret = wret;
 			}
diff --git a/trunk/fs/btrfs/ioctl.c b/trunk/fs/btrfs/ioctl.c
index 9254b3d58dbe..4dbaf89b1337 100644
--- a/trunk/fs/btrfs/ioctl.c
+++ b/trunk/fs/btrfs/ioctl.c
@@ -1458,7 +1458,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 	 */
 
 	/* the destination must be opened for writing */
-	if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND))
+	if (!(file->f_mode & FMODE_WRITE))
 		return -EINVAL;
 
 	ret = mnt_want_write(file->f_path.mnt);
@@ -1511,7 +1511,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 
 	/* determine range to clone */
 	ret = -EINVAL;
-	if (off + len > src->i_size || off + len < off)
+	if (off >= src->i_size || off + len > src->i_size)
 		goto out_unlock;
 	if (len == 0)
 		olen = len = src->i_size - off;
@@ -1578,7 +1578,6 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 			u64 disko = 0, diskl = 0;
 			u64 datao = 0, datal = 0;
 			u8 comp;
-			u64 endoff;
 
 			size = btrfs_item_size_nr(leaf, slot);
 			read_extent_buffer(leaf, buf,
@@ -1713,18 +1712,9 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 			btrfs_release_path(root, path);
 
 			inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-
-			/*
-			 * we round up to the block size at eof when
-			 * determining which extents to clone above,
-			 * but shouldn't round up the file size
-			 */
-			endoff = new_key.offset + datal;
-			if (endoff > off+olen)
-				endoff = off+olen;
-			if (endoff > inode->i_size)
-				btrfs_i_size_write(inode, endoff);
-
+			if (new_key.offset + datal > inode->i_size)
+				btrfs_i_size_write(inode,
+						   new_key.offset + datal);
 			BTRFS_I(inode)->flags = BTRFS_I(src)->flags;
 			ret = btrfs_update_inode(trans, root, inode);
 			BUG_ON(ret);
diff --git a/trunk/fs/dcache.c b/trunk/fs/dcache.c
index 86d4db15473e..c8c78ba07827 100644
--- a/trunk/fs/dcache.c
+++ b/trunk/fs/dcache.c
@@ -896,7 +896,7 @@ EXPORT_SYMBOL(shrink_dcache_parent);
  *
  * In this case we return -1 to tell the caller that we baled.
  */
-static int shrink_dcache_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+static int shrink_dcache_memory(int nr, gfp_t gfp_mask)
 {
 	if (nr) {
 		if (!(gfp_mask & __GFP_FS))
diff --git a/trunk/fs/gfs2/glock.c b/trunk/fs/gfs2/glock.c
index 0898f3ec8212..dbab3fdc2582 100644
--- a/trunk/fs/gfs2/glock.c
+++ b/trunk/fs/gfs2/glock.c
@@ -1358,7 +1358,7 @@ void gfs2_glock_complete(struct gfs2_glock *gl, int ret)
 }
 
 
-static int gfs2_shrink_glock_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+static int gfs2_shrink_glock_memory(int nr, gfp_t gfp_mask)
 {
 	struct gfs2_glock *gl;
 	int may_demote;
diff --git a/trunk/fs/gfs2/quota.c b/trunk/fs/gfs2/quota.c
index 8f02d3db8f42..b256d6f24288 100644
--- a/trunk/fs/gfs2/quota.c
+++ b/trunk/fs/gfs2/quota.c
@@ -77,7 +77,7 @@ static LIST_HEAD(qd_lru_list);
 static atomic_t qd_lru_count = ATOMIC_INIT(0);
 static DEFINE_SPINLOCK(qd_lru_lock);
 
-int gfs2_shrink_qd_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+int gfs2_shrink_qd_memory(int nr, gfp_t gfp_mask)
 {
 	struct gfs2_quota_data *qd;
 	struct gfs2_sbd *sdp;
diff --git a/trunk/fs/gfs2/quota.h b/trunk/fs/gfs2/quota.h
index e7d236ca48bd..195f60c8bd14 100644
--- a/trunk/fs/gfs2/quota.h
+++ b/trunk/fs/gfs2/quota.h
@@ -51,7 +51,7 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip)
 	return ret;
 }
 
-extern int gfs2_shrink_qd_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask);
+extern int gfs2_shrink_qd_memory(int nr, gfp_t gfp_mask);
 extern const struct quotactl_ops gfs2_quotactl_ops;
 
 #endif /* __QUOTA_DOT_H__ */
diff --git a/trunk/fs/inode.c b/trunk/fs/inode.c
index 722860b323a9..2bee20ae3d65 100644
--- a/trunk/fs/inode.c
+++ b/trunk/fs/inode.c
@@ -512,7 +512,7 @@ static void prune_icache(int nr_to_scan)
  * This function is passed the number of inodes to scan, and it returns the
  * total number of remaining possibly-reclaimable inodes.
  */
-static int shrink_icache_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+static int shrink_icache_memory(int nr, gfp_t gfp_mask)
 {
 	if (nr) {
 		/*
diff --git a/trunk/fs/mbcache.c b/trunk/fs/mbcache.c
index e28f21b95344..ec88ff3d04a9 100644
--- a/trunk/fs/mbcache.c
+++ b/trunk/fs/mbcache.c
@@ -115,7 +115,7 @@ mb_cache_indexes(struct mb_cache *cache)
  * What the mbcache registers as to get shrunk dynamically.
  */
 
-static int mb_cache_shrink_fn(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask);
+static int mb_cache_shrink_fn(int nr_to_scan, gfp_t gfp_mask);
 
 static struct shrinker mb_cache_shrinker = {
 	.shrink = mb_cache_shrink_fn,
@@ -191,14 +191,13 @@ __mb_cache_entry_release_unlock(struct mb_cache_entry *ce)
  * This function is called by the kernel memory management when memory
  * gets low.
  *
- * @shrink: (ignored)
  * @nr_to_scan: Number of objects to scan
  * @gfp_mask: (ignored)
  *
  * Returns the number of objects which are present in the cache.
  */
 static int
-mb_cache_shrink_fn(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
+mb_cache_shrink_fn(int nr_to_scan, gfp_t gfp_mask)
 {
 	LIST_HEAD(free_list);
 	struct list_head *l, *ltmp;
diff --git a/trunk/fs/nfs/dir.c b/trunk/fs/nfs/dir.c
index e60416d3f818..782b431ef91c 100644
--- a/trunk/fs/nfs/dir.c
+++ b/trunk/fs/nfs/dir.c
@@ -1710,7 +1710,7 @@ static void nfs_access_free_list(struct list_head *head)
 	}
 }
 
-int nfs_access_cache_shrinker(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
+int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask)
 {
 	LIST_HEAD(head);
 	struct nfs_inode *nfsi;
diff --git a/trunk/fs/nfs/internal.h b/trunk/fs/nfs/internal.h
index e70f44b9b3f4..d8bd619e386c 100644
--- a/trunk/fs/nfs/internal.h
+++ b/trunk/fs/nfs/internal.h
@@ -205,8 +205,7 @@ extern struct rpc_procinfo nfs4_procedures[];
 void nfs_close_context(struct nfs_open_context *ctx, int is_sync);
 
 /* dir.c */
-extern int nfs_access_cache_shrinker(struct shrinker *shrink,
-					int nr_to_scan, gfp_t gfp_mask);
+extern int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask);
 
 /* inode.c */
 extern struct workqueue_struct *nfsiod_workqueue;
diff --git a/trunk/fs/quota/dquot.c b/trunk/fs/quota/dquot.c
index 437d2ca2de97..12c233da1b6b 100644
--- a/trunk/fs/quota/dquot.c
+++ b/trunk/fs/quota/dquot.c
@@ -676,7 +676,7 @@ static void prune_dqcache(int count)
  * This is called from kswapd when we think we need some
  * more memory
  */
-static int shrink_dqcache_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+static int shrink_dqcache_memory(int nr, gfp_t gfp_mask)
 {
 	if (nr) {
 		spin_lock(&dq_list_lock);
diff --git a/trunk/fs/ubifs/shrinker.c b/trunk/fs/ubifs/shrinker.c
index 0b201114a5ad..02feb59cefca 100644
--- a/trunk/fs/ubifs/shrinker.c
+++ b/trunk/fs/ubifs/shrinker.c
@@ -277,7 +277,7 @@ static int kick_a_thread(void)
 	return 0;
 }
 
-int ubifs_shrinker(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+int ubifs_shrinker(int nr, gfp_t gfp_mask)
 {
 	int freed, contention = 0;
 	long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
diff --git a/trunk/fs/ubifs/ubifs.h b/trunk/fs/ubifs/ubifs.h
index 04310878f449..2eef553d50c8 100644
--- a/trunk/fs/ubifs/ubifs.h
+++ b/trunk/fs/ubifs/ubifs.h
@@ -1575,7 +1575,7 @@ int ubifs_tnc_start_commit(struct ubifs_info *c, struct ubifs_zbranch *zroot);
 int ubifs_tnc_end_commit(struct ubifs_info *c);
 
 /* shrinker.c */
-int ubifs_shrinker(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask);
+int ubifs_shrinker(int nr_to_scan, gfp_t gfp_mask);
 
 /* commit.c */
 int ubifs_bg_thread(void *info);
diff --git a/trunk/fs/xfs/linux-2.6/xfs_buf.c b/trunk/fs/xfs/linux-2.6/xfs_buf.c
index 2ee3f7a60163..649ade8ef598 100644
--- a/trunk/fs/xfs/linux-2.6/xfs_buf.c
+++ b/trunk/fs/xfs/linux-2.6/xfs_buf.c
@@ -45,7 +45,7 @@
 
 static kmem_zone_t *xfs_buf_zone;
 STATIC int xfsbufd(void *);
-STATIC int xfsbufd_wakeup(struct shrinker *, int, gfp_t);
+STATIC int xfsbufd_wakeup(int, gfp_t);
 STATIC void xfs_buf_delwri_queue(xfs_buf_t *, int);
 static struct shrinker xfs_buf_shake = {
 	.shrink = xfsbufd_wakeup,
@@ -340,7 +340,7 @@ _xfs_buf_lookup_pages(
 					__func__, gfp_mask);
 
 			XFS_STATS_INC(xb_page_retries);
-			xfsbufd_wakeup(NULL, 0, gfp_mask);
+			xfsbufd_wakeup(0, gfp_mask);
 			congestion_wait(BLK_RW_ASYNC, HZ/50);
 			goto retry;
 		}
@@ -1762,7 +1762,6 @@ xfs_buf_runall_queues(
 
 STATIC int
 xfsbufd_wakeup(
-	struct shrinker		*shrink,
 	int			priority,
 	gfp_t			mask)
 {
diff --git a/trunk/fs/xfs/linux-2.6/xfs_super.c b/trunk/fs/xfs/linux-2.6/xfs_super.c
index 80938c736c27..f2d1718c9165 100644
--- a/trunk/fs/xfs/linux-2.6/xfs_super.c
+++ b/trunk/fs/xfs/linux-2.6/xfs_super.c
@@ -1883,6 +1883,7 @@ init_xfs_fs(void)
 		goto out_cleanup_procfs;
 
 	vfs_initquota();
+	xfs_inode_shrinker_init();
 
 	error = register_filesystem(&xfs_fs_type);
 	if (error)
@@ -1910,6 +1911,7 @@ exit_xfs_fs(void)
 {
 	vfs_exitquota();
 	unregister_filesystem(&xfs_fs_type);
+	xfs_inode_shrinker_destroy();
 	xfs_sysctl_unregister();
 	xfs_cleanup_procfs();
 	xfs_buf_terminate();
diff --git a/trunk/fs/xfs/linux-2.6/xfs_sync.c b/trunk/fs/xfs/linux-2.6/xfs_sync.c
index a51a07c3a70c..ef7f0218bccb 100644
--- a/trunk/fs/xfs/linux-2.6/xfs_sync.c
+++ b/trunk/fs/xfs/linux-2.6/xfs_sync.c
@@ -144,41 +144,6 @@ xfs_inode_ag_walk(
 	return last_error;
 }
 
-/*
- * Select the next per-ag structure to iterate during the walk. The reclaim
- * walk is optimised only to walk AGs with reclaimable inodes in them.
- */
-static struct xfs_perag *
-xfs_inode_ag_iter_next_pag(
-	struct xfs_mount	*mp,
-	xfs_agnumber_t		*first,
-	int			tag)
-{
-	struct xfs_perag	*pag = NULL;
-
-	if (tag == XFS_ICI_RECLAIM_TAG) {
-		int found;
-		int ref;
-
-		spin_lock(&mp->m_perag_lock);
-		found = radix_tree_gang_lookup_tag(&mp->m_perag_tree,
-				(void **)&pag, *first, 1, tag);
-		if (found <= 0) {
-			spin_unlock(&mp->m_perag_lock);
-			return NULL;
-		}
-		*first = pag->pag_agno + 1;
-		/* open coded pag reference increment */
-		ref = atomic_inc_return(&pag->pag_ref);
-		spin_unlock(&mp->m_perag_lock);
-		trace_xfs_perag_get_reclaim(mp, pag->pag_agno, ref, _RET_IP_);
-	} else {
-		pag = xfs_perag_get(mp, *first);
-		(*first)++;
-	}
-	return pag;
-}
-
 int
 xfs_inode_ag_iterator(
 	struct xfs_mount	*mp,
@@ -189,15 +154,16 @@ xfs_inode_ag_iterator(
 	int			exclusive,
 	int			*nr_to_scan)
 {
-	struct xfs_perag	*pag;
 	int			error = 0;
 	int			last_error = 0;
 	xfs_agnumber_t		ag;
 	int			nr;
 
 	nr = nr_to_scan ? *nr_to_scan : INT_MAX;
-	ag = 0;
-	while ((pag = xfs_inode_ag_iter_next_pag(mp, &ag, tag))) {
+	for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
+		struct xfs_perag	*pag;
+
+		pag = xfs_perag_get(mp, ag);
 		error = xfs_inode_ag_walk(mp, pag, execute, flags, tag,
 						exclusive, &nr);
 		xfs_perag_put(pag);
@@ -674,17 +640,6 @@ __xfs_inode_set_reclaim_tag(
 	radix_tree_tag_set(&pag->pag_ici_root,
 			   XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino),
 			   XFS_ICI_RECLAIM_TAG);
-
-	if (!pag->pag_ici_reclaimable) {
-		/* propagate the reclaim tag up into the perag radix tree */
-		spin_lock(&ip->i_mount->m_perag_lock);
-		radix_tree_tag_set(&ip->i_mount->m_perag_tree,
-				XFS_INO_TO_AGNO(ip->i_mount, ip->i_ino),
-				XFS_ICI_RECLAIM_TAG);
-		spin_unlock(&ip->i_mount->m_perag_lock);
-		trace_xfs_perag_set_reclaim(ip->i_mount, pag->pag_agno,
-							-1, _RET_IP_);
-	}
 	pag->pag_ici_reclaimable++;
 }
 
@@ -719,16 +674,6 @@ __xfs_inode_clear_reclaim_tag(
 	radix_tree_tag_clear(&pag->pag_ici_root,
 			XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
 	pag->pag_ici_reclaimable--;
-	if (!pag->pag_ici_reclaimable) {
-		/* clear the reclaim tag from the perag radix tree */
-		spin_lock(&ip->i_mount->m_perag_lock);
-		radix_tree_tag_clear(&ip->i_mount->m_perag_tree,
-				XFS_INO_TO_AGNO(ip->i_mount, ip->i_ino),
-				XFS_ICI_RECLAIM_TAG);
-		spin_unlock(&ip->i_mount->m_perag_lock);
-		trace_xfs_perag_clear_reclaim(ip->i_mount, pag->pag_agno,
-							-1, _RET_IP_);
-	}
 }
 
 /*
@@ -883,52 +828,83 @@ xfs_reclaim_inodes(
 
 /*
  * Shrinker infrastructure.
+ *
+ * This is all far more complex than it needs to be. It adds a global list of
+ * mounts because the shrinkers can only call a global context. We need to make
+ * the shrinkers pass a context to avoid the need for global state.
  */
+static LIST_HEAD(xfs_mount_list);
+static struct rw_semaphore xfs_mount_list_lock;
+
 static int
 xfs_reclaim_inode_shrink(
-	struct shrinker	*shrink,
 	int		nr_to_scan,
 	gfp_t		gfp_mask)
 {
 	struct xfs_mount *mp;
 	struct xfs_perag *pag;
 	xfs_agnumber_t	ag;
-	int		reclaimable;
+	int		reclaimable = 0;
 
-	mp = container_of(shrink, struct xfs_mount, m_inode_shrink);
 	if (nr_to_scan) {
 		if (!(gfp_mask & __GFP_FS))
 			return -1;
 
-		xfs_inode_ag_iterator(mp, xfs_reclaim_inode, 0,
+		down_read(&xfs_mount_list_lock);
+		list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
+			xfs_inode_ag_iterator(mp, xfs_reclaim_inode, 0,
 					XFS_ICI_RECLAIM_TAG, 1, &nr_to_scan);
-		/* if we don't exhaust the scan, don't bother coming back */
-		if (nr_to_scan > 0)
-			return -1;
-       }
+			if (nr_to_scan <= 0)
+				break;
+		}
+		up_read(&xfs_mount_list_lock);
+	}
 
-	reclaimable = 0;
-	ag = 0;
-	while ((pag = xfs_inode_ag_iter_next_pag(mp, &ag,
-					XFS_ICI_RECLAIM_TAG))) {
-		reclaimable += pag->pag_ici_reclaimable;
-		xfs_perag_put(pag);
+	down_read(&xfs_mount_list_lock);
+	list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
+		for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
+			pag = xfs_perag_get(mp, ag);
+			reclaimable += pag->pag_ici_reclaimable;
+			xfs_perag_put(pag);
+		}
 	}
+	up_read(&xfs_mount_list_lock);
 	return reclaimable;
 }
 
+static struct shrinker xfs_inode_shrinker = {
+	.shrink = xfs_reclaim_inode_shrink,
+	.seeks = DEFAULT_SEEKS,
+};
+
+void __init
+xfs_inode_shrinker_init(void)
+{
+	init_rwsem(&xfs_mount_list_lock);
+	register_shrinker(&xfs_inode_shrinker);
+}
+
+void
+xfs_inode_shrinker_destroy(void)
+{
+	ASSERT(list_empty(&xfs_mount_list));
+	unregister_shrinker(&xfs_inode_shrinker);
+}
+
 void
 xfs_inode_shrinker_register(
 	struct xfs_mount	*mp)
 {
-	mp->m_inode_shrink.shrink = xfs_reclaim_inode_shrink;
-	mp->m_inode_shrink.seeks = DEFAULT_SEEKS;
-	register_shrinker(&mp->m_inode_shrink);
+	down_write(&xfs_mount_list_lock);
+	list_add_tail(&mp->m_mplist, &xfs_mount_list);
+	up_write(&xfs_mount_list_lock);
 }
 
 void
 xfs_inode_shrinker_unregister(
 	struct xfs_mount	*mp)
 {
-	unregister_shrinker(&mp->m_inode_shrink);
+	down_write(&xfs_mount_list_lock);
+	list_del(&mp->m_mplist);
+	up_write(&xfs_mount_list_lock);
 }
diff --git a/trunk/fs/xfs/linux-2.6/xfs_sync.h b/trunk/fs/xfs/linux-2.6/xfs_sync.h
index e28139aaa4aa..cdcbaaca9880 100644
--- a/trunk/fs/xfs/linux-2.6/xfs_sync.h
+++ b/trunk/fs/xfs/linux-2.6/xfs_sync.h
@@ -55,6 +55,8 @@ int xfs_inode_ag_iterator(struct xfs_mount *mp,
 	int (*execute)(struct xfs_inode *ip, struct xfs_perag *pag, int flags),
 	int flags, int tag, int write_lock, int *nr_to_scan);
 
+void xfs_inode_shrinker_init(void);
+void xfs_inode_shrinker_destroy(void);
 void xfs_inode_shrinker_register(struct xfs_mount *mp);
 void xfs_inode_shrinker_unregister(struct xfs_mount *mp);
 
diff --git a/trunk/fs/xfs/linux-2.6/xfs_trace.h b/trunk/fs/xfs/linux-2.6/xfs_trace.h
index 302820690904..73d5aa117384 100644
--- a/trunk/fs/xfs/linux-2.6/xfs_trace.h
+++ b/trunk/fs/xfs/linux-2.6/xfs_trace.h
@@ -124,10 +124,7 @@ DEFINE_EVENT(xfs_perag_class, name,	\
 		 unsigned long caller_ip),					\
 	TP_ARGS(mp, agno, refcount, caller_ip))
 DEFINE_PERAG_REF_EVENT(xfs_perag_get);
-DEFINE_PERAG_REF_EVENT(xfs_perag_get_reclaim);
 DEFINE_PERAG_REF_EVENT(xfs_perag_put);
-DEFINE_PERAG_REF_EVENT(xfs_perag_set_reclaim);
-DEFINE_PERAG_REF_EVENT(xfs_perag_clear_reclaim);
 
 TRACE_EVENT(xfs_attr_list_node_descend,
 	TP_PROTO(struct xfs_attr_list_context *ctx,
diff --git a/trunk/fs/xfs/quota/xfs_qm.c b/trunk/fs/xfs/quota/xfs_qm.c
index 67c018392d62..8c117ff2e3ab 100644
--- a/trunk/fs/xfs/quota/xfs_qm.c
+++ b/trunk/fs/xfs/quota/xfs_qm.c
@@ -69,7 +69,7 @@ STATIC void	xfs_qm_list_destroy(xfs_dqlist_t *);
 
 STATIC int	xfs_qm_init_quotainos(xfs_mount_t *);
 STATIC int	xfs_qm_init_quotainfo(xfs_mount_t *);
-STATIC int	xfs_qm_shake(struct shrinker *, int, gfp_t);
+STATIC int	xfs_qm_shake(int, gfp_t);
 
 static struct shrinker xfs_qm_shaker = {
 	.shrink = xfs_qm_shake,
@@ -2117,10 +2117,7 @@ xfs_qm_shake_freelist(
  */
 /* ARGSUSED */
 STATIC int
-xfs_qm_shake(
-	struct shrinker	*shrink,
-	int		nr_to_scan,
-	gfp_t		gfp_mask)
+xfs_qm_shake(int nr_to_scan, gfp_t gfp_mask)
 {
 	int	ndqused, nfree, n;
 
diff --git a/trunk/fs/xfs/xfs_mount.h b/trunk/fs/xfs/xfs_mount.h
index 5761087ee8ea..1d2c7eed4eda 100644
--- a/trunk/fs/xfs/xfs_mount.h
+++ b/trunk/fs/xfs/xfs_mount.h
@@ -259,7 +259,7 @@ typedef struct xfs_mount {
 	wait_queue_head_t	m_wait_single_sync_task;
 	__int64_t		m_update_flags;	/* sb flags we need to update
 						   on the next remount,rw */
-	struct shrinker		m_inode_shrink;	/* inode reclaim shrinker */
+	struct list_head	m_mplist;	/* inode shrinker mount list */
 } xfs_mount_t;
 
 /*
diff --git a/trunk/include/linux/fdtable.h b/trunk/include/linux/fdtable.h
index d147461bc271..013dc529e95f 100644
--- a/trunk/include/linux/fdtable.h
+++ b/trunk/include/linux/fdtable.h
@@ -61,8 +61,7 @@ struct files_struct {
 	(rcu_dereference_check((fdtfd), \
 			       rcu_read_lock_held() || \
 			       lockdep_is_held(&(files)->file_lock) || \
-			       atomic_read(&(files)->count) == 1 || \
-			       rcu_my_thread_group_empty()))
+			       atomic_read(&(files)->count) == 1))
 
 #define files_fdtable(files) \
 		(rcu_dereference_check_fdtable((files), (files)->fdt))
diff --git a/trunk/include/linux/mm.h b/trunk/include/linux/mm.h
index a2b48041b910..b969efb03787 100644
--- a/trunk/include/linux/mm.h
+++ b/trunk/include/linux/mm.h
@@ -999,7 +999,7 @@ static inline void sync_mm_rss(struct task_struct *task, struct mm_struct *mm)
  * querying the cache size, so a fastpath for that case is appropriate.
  */
 struct shrinker {
-	int (*shrink)(struct shrinker *, int nr_to_scan, gfp_t gfp_mask);
+	int (*shrink)(int nr_to_scan, gfp_t gfp_mask);
 	int seeks;	/* seeks to recreate an obj */
 
 	/* These are for internal use */
diff --git a/trunk/include/net/sock.h b/trunk/include/net/sock.h
index 0a691ea7654a..731150d52799 100644
--- a/trunk/include/net/sock.h
+++ b/trunk/include/net/sock.h
@@ -1224,7 +1224,12 @@ static inline void sk_tx_queue_clear(struct sock *sk)
 
 static inline int sk_tx_queue_get(const struct sock *sk)
 {
-	return sk ? sk->sk_tx_queue_mapping : -1;
+	return sk->sk_tx_queue_mapping;
+}
+
+static inline bool sk_tx_queue_recorded(const struct sock *sk)
+{
+	return (sk && sk->sk_tx_queue_mapping >= 0);
 }
 
 static inline void sk_set_socket(struct sock *sk, struct socket *sock)
diff --git a/trunk/ipc/sem.c b/trunk/ipc/sem.c
index 40a8f462a822..506c8491a8d1 100644
--- a/trunk/ipc/sem.c
+++ b/trunk/ipc/sem.c
@@ -1256,33 +1256,6 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
 	return un;
 }
 
-
-/**
- * get_queue_result - Retrieve the result code from sem_queue
- * @q: Pointer to queue structure
- *
- * Retrieve the return code from the pending queue. If IN_WAKEUP is found in
- * q->status, then we must loop until the value is replaced with the final
- * value: This may happen if a task is woken up by an unrelated event (e.g.
- * signal) and in parallel the task is woken up by another task because it got
- * the requested semaphores.
- *
- * The function can be called with or without holding the semaphore spinlock.
- */
-static int get_queue_result(struct sem_queue *q)
-{
-	int error;
-
-	error = q->status;
-	while (unlikely(error == IN_WAKEUP)) {
-		cpu_relax();
-		error = q->status;
-	}
-
-	return error;
-}
-
-
 SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
 		unsigned, nsops, const struct timespec __user *, timeout)
 {
@@ -1436,18 +1409,15 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
 	else
 		schedule();
 
-	error = get_queue_result(&queue);
+	error = queue.status;
+	while(unlikely(error == IN_WAKEUP)) {
+		cpu_relax();
+		error = queue.status;
+	}
 
 	if (error != -EINTR) {
 		/* fast path: update_queue already obtained all requested
-		 * resources.
-		 * Perform a smp_mb(): User space could assume that semop()
-		 * is a memory barrier: Without the mb(), the cpu could
-		 * speculatively read in user space stale data that was
-		 * overwritten by the previous owner of the semaphore.
-		 */
-		smp_mb();
-
+		 * resources */
 		goto out_free;
 	}
 
@@ -1457,12 +1427,10 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
 		goto out_free;
 	}
 
-	error = get_queue_result(&queue);
-
 	/*
 	 * If queue.status != -EINTR we are woken up by another process
 	 */
-
+	error = queue.status;
 	if (error != -EINTR) {
 		goto out_unlock_free;
 	}
diff --git a/trunk/mm/bootmem.c b/trunk/mm/bootmem.c
index 142c84a54993..58c66cc5056a 100644
--- a/trunk/mm/bootmem.c
+++ b/trunk/mm/bootmem.c
@@ -833,24 +833,15 @@ static void * __init ___alloc_bootmem_node(bootmem_data_t *bdata,
 void * __init __alloc_bootmem_node(pg_data_t *pgdat, unsigned long size,
 				   unsigned long align, unsigned long goal)
 {
-	void *ptr;
-
 	if (WARN_ON_ONCE(slab_is_available()))
 		return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
 
 #ifdef CONFIG_NO_BOOTMEM
-	ptr = __alloc_memory_core_early(pgdat->node_id, size, align,
-					 goal, -1ULL);
-	if (ptr)
-		return ptr;
-
-	ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align,
+	return __alloc_memory_core_early(pgdat->node_id, size, align,
 					 goal, -1ULL);
 #else
-	ptr = ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0);
+	return ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0);
 #endif
-
-	return ptr;
 }
 
 void * __init __alloc_bootmem_node_high(pg_data_t *pgdat, unsigned long size,
@@ -986,21 +977,14 @@ void * __init __alloc_bootmem_low(unsigned long size, unsigned long align,
 void * __init __alloc_bootmem_low_node(pg_data_t *pgdat, unsigned long size,
 				       unsigned long align, unsigned long goal)
 {
-	void *ptr;
-
 	if (WARN_ON_ONCE(slab_is_available()))
 		return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
 
 #ifdef CONFIG_NO_BOOTMEM
-	ptr = __alloc_memory_core_early(pgdat->node_id, size, align,
-				goal, ARCH_LOW_ADDRESS_LIMIT);
-	if (ptr)
-		return ptr;
-	ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align,
+	return __alloc_memory_core_early(pgdat->node_id, size, align,
 				goal, ARCH_LOW_ADDRESS_LIMIT);
 #else
-	ptr = ___alloc_bootmem_node(pgdat->bdata, size, align,
+	return ___alloc_bootmem_node(pgdat->bdata, size, align,
 				goal, ARCH_LOW_ADDRESS_LIMIT);
 #endif
-	return ptr;
 }
diff --git a/trunk/mm/page_alloc.c b/trunk/mm/page_alloc.c
index 9bd339eb04c6..68319dd20bed 100644
--- a/trunk/mm/page_alloc.c
+++ b/trunk/mm/page_alloc.c
@@ -3634,9 +3634,6 @@ void * __init __alloc_memory_core_early(int nid, u64 size, u64 align,
 	int i;
 	void *ptr;
 
-	if (limit > get_max_mapped())
-		limit = get_max_mapped();
-
 	/* need to go over early_node_map to find out good range for node */
 	for_each_active_range_index_in_nid(i, nid) {
 		u64 addr;
diff --git a/trunk/mm/vmscan.c b/trunk/mm/vmscan.c
index b94fe1b3da43..9c7e57cc63a3 100644
--- a/trunk/mm/vmscan.c
+++ b/trunk/mm/vmscan.c
@@ -213,9 +213,8 @@ unsigned long shrink_slab(unsigned long scanned, gfp_t gfp_mask,
 	list_for_each_entry(shrinker, &shrinker_list, list) {
 		unsigned long long delta;
 		unsigned long total_scan;
-		unsigned long max_pass;
+		unsigned long max_pass = (*shrinker->shrink)(0, gfp_mask);
 
-		max_pass = (*shrinker->shrink)(shrinker, 0, gfp_mask);
 		delta = (4 * scanned) / shrinker->seeks;
 		delta *= max_pass;
 		do_div(delta, lru_pages + 1);
@@ -243,9 +242,8 @@ unsigned long shrink_slab(unsigned long scanned, gfp_t gfp_mask,
 			int shrink_ret;
 			int nr_before;
 
-			nr_before = (*shrinker->shrink)(shrinker, 0, gfp_mask);
-			shrink_ret = (*shrinker->shrink)(shrinker, this_scan,
-								gfp_mask);
+			nr_before = (*shrinker->shrink)(0, gfp_mask);
+			shrink_ret = (*shrinker->shrink)(this_scan, gfp_mask);
 			if (shrink_ret == -1)
 				break;
 			if (shrink_ret < nr_before)
@@ -298,7 +296,7 @@ static int may_write_to_queue(struct backing_dev_info *bdi)
 static void handle_write_error(struct address_space *mapping,
 				struct page *page, int error)
 {
-	lock_page_nosync(page);
+	lock_page(page);
 	if (page_mapping(page) == mapping)
 		mapping_set_error(mapping, error);
 	unlock_page(page);
diff --git a/trunk/net/bluetooth/hci_conn.c b/trunk/net/bluetooth/hci_conn.c
index 800b6b9fbbae..b10e3cdb08f8 100644
--- a/trunk/net/bluetooth/hci_conn.c
+++ b/trunk/net/bluetooth/hci_conn.c
@@ -358,11 +358,6 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
 		acl->sec_level = sec_level;
 		acl->auth_type = auth_type;
 		hci_acl_connect(acl);
-	} else {
-		if (acl->sec_level < sec_level)
-			acl->sec_level = sec_level;
-		if (acl->auth_type < auth_type)
-			acl->auth_type = auth_type;
 	}
 
 	if (type == ACL_LINK)
diff --git a/trunk/net/bluetooth/hci_event.c b/trunk/net/bluetooth/hci_event.c
index 786b5de0bac4..6c57fc71c7e2 100644
--- a/trunk/net/bluetooth/hci_event.c
+++ b/trunk/net/bluetooth/hci_event.c
@@ -1049,8 +1049,6 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 	if (conn) {
 		if (!ev->status)
 			conn->link_mode |= HCI_LM_AUTH;
-		else
-			conn->sec_level = BT_SECURITY_LOW;
 
 		clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
 
diff --git a/trunk/net/bluetooth/l2cap.c b/trunk/net/bluetooth/l2cap.c
index cf3c4073a8a6..1b682a5aa061 100644
--- a/trunk/net/bluetooth/l2cap.c
+++ b/trunk/net/bluetooth/l2cap.c
@@ -401,11 +401,6 @@ static inline void l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
 	l2cap_send_sframe(pi, control);
 }
 
-static inline int __l2cap_no_conn_pending(struct sock *sk)
-{
-	return !(l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND);
-}
-
 static void l2cap_do_start(struct sock *sk)
 {
 	struct l2cap_conn *conn = l2cap_pi(sk)->conn;
@@ -414,13 +409,12 @@ static void l2cap_do_start(struct sock *sk)
 		if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
 			return;
 
-		if (l2cap_check_security(sk) && __l2cap_no_conn_pending(sk)) {
+		if (l2cap_check_security(sk)) {
 			struct l2cap_conn_req req;
 			req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 			req.psm  = l2cap_pi(sk)->psm;
 
 			l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-			l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
 			l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 					L2CAP_CONN_REQ, sizeof(req), &req);
@@ -470,14 +464,12 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 		}
 
 		if (sk->sk_state == BT_CONNECT) {
-			if (l2cap_check_security(sk) &&
-					__l2cap_no_conn_pending(sk)) {
+			if (l2cap_check_security(sk)) {
 				struct l2cap_conn_req req;
 				req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 				req.psm  = l2cap_pi(sk)->psm;
 
 				l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-				l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
 				l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 					L2CAP_CONN_REQ, sizeof(req), &req);
@@ -2920,6 +2912,7 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
 		l2cap_pi(sk)->ident = 0;
 		l2cap_pi(sk)->dcid = dcid;
 		l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
+
 		l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
 
 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
@@ -4411,7 +4404,6 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 				req.psm  = l2cap_pi(sk)->psm;
 
 				l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-				l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
 				l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 					L2CAP_CONN_REQ, sizeof(req), &req);
diff --git a/trunk/net/bridge/br_device.c b/trunk/net/bridge/br_device.c
index 753fc4221f3c..eedf2c94820e 100644
--- a/trunk/net/bridge/br_device.c
+++ b/trunk/net/bridge/br_device.c
@@ -217,6 +217,14 @@ static bool br_devices_support_netpoll(struct net_bridge *br)
 	return count != 0 && ret;
 }
 
+static void br_poll_controller(struct net_device *br_dev)
+{
+	struct netpoll *np = br_dev->npinfo->netpoll;
+
+	if (np->real_dev != br_dev)
+		netpoll_poll_dev(np->real_dev);
+}
+
 void br_netpoll_cleanup(struct net_device *dev)
 {
 	struct net_bridge *br = netdev_priv(dev);
@@ -287,6 +295,7 @@ static const struct net_device_ops br_netdev_ops = {
 	.ndo_do_ioctl		 = br_dev_ioctl,
 #ifdef CONFIG_NET_POLL_CONTROLLER
 	.ndo_netpoll_cleanup	 = br_netpoll_cleanup,
+	.ndo_poll_controller	 = br_poll_controller,
 #endif
 };
 
diff --git a/trunk/net/bridge/br_forward.c b/trunk/net/bridge/br_forward.c
index 595da45f9088..a4e72a89e4ff 100644
--- a/trunk/net/bridge/br_forward.c
+++ b/trunk/net/bridge/br_forward.c
@@ -50,7 +50,14 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
 			kfree_skb(skb);
 		else {
 			skb_push(skb, ETH_HLEN);
-			dev_queue_xmit(skb);
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+			if (unlikely(skb->dev->priv_flags & IFF_IN_NETPOLL)) {
+				netpoll_send_skb(skb->dev->npinfo->netpoll, skb);
+				skb->dev->priv_flags &= ~IFF_IN_NETPOLL;
+			} else
+#endif
+				dev_queue_xmit(skb);
 		}
 	}
 
@@ -66,9 +73,23 @@ int br_forward_finish(struct sk_buff *skb)
 
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
+#ifdef CONFIG_NET_POLL_CONTROLLER
+	struct net_bridge *br = to->br;
+	if (unlikely(br->dev->priv_flags & IFF_IN_NETPOLL)) {
+		struct netpoll *np;
+		to->dev->npinfo = skb->dev->npinfo;
+		np = skb->dev->npinfo->netpoll;
+		np->real_dev = np->dev = to->dev;
+		to->dev->priv_flags |= IFF_IN_NETPOLL;
+	}
+#endif
 	skb->dev = to->dev;
 	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
 		br_forward_finish);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+	if (skb->dev->npinfo)
+		skb->dev->npinfo->netpoll->dev = br->dev;
+#endif
 }
 
 static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
diff --git a/trunk/net/core/dev.c b/trunk/net/core/dev.c
index 0ea10f849be8..723a34710ad4 100644
--- a/trunk/net/core/dev.c
+++ b/trunk/net/core/dev.c
@@ -1911,16 +1911,8 @@ static int dev_gso_segment(struct sk_buff *skb)
  */
 static inline void skb_orphan_try(struct sk_buff *skb)
 {
-	struct sock *sk = skb->sk;
-
-	if (sk && !skb_tx(skb)->flags) {
-		/* skb_tx_hash() wont be able to get sk.
-		 * We copy sk_hash into skb->rxhash
-		 */
-		if (!skb->rxhash)
-			skb->rxhash = sk->sk_hash;
+	if (!skb_tx(skb)->flags)
 		skb_orphan(skb);
-	}
 }
 
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
@@ -2006,7 +1998,8 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
 	if (skb->sk && skb->sk->sk_hash)
 		hash = skb->sk->sk_hash;
 	else
-		hash = (__force u16) skb->protocol ^ skb->rxhash;
+		hash = (__force u16) skb->protocol;
+
 	hash = jhash_1word(hash, hashrnd);
 
 	return (u16) (((u64) hash * dev->real_num_tx_queues) >> 32);
@@ -2029,11 +2022,12 @@ static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
 static struct netdev_queue *dev_pick_tx(struct net_device *dev,
 					struct sk_buff *skb)
 {
-	int queue_index;
+	u16 queue_index;
 	struct sock *sk = skb->sk;
 
-	queue_index = sk_tx_queue_get(sk);
-	if (queue_index < 0) {
+	if (sk_tx_queue_recorded(sk)) {
+		queue_index = sk_tx_queue_get(sk);
+	} else {
 		const struct net_device_ops *ops = dev->netdev_ops;
 
 		if (ops->ndo_select_queue) {
diff --git a/trunk/net/core/neighbour.c b/trunk/net/core/neighbour.c
index a4e0a7482c2b..6ba1c0eece03 100644
--- a/trunk/net/core/neighbour.c
+++ b/trunk/net/core/neighbour.c
@@ -949,10 +949,7 @@ static void neigh_update_hhs(struct neighbour *neigh)
 {
 	struct hh_cache *hh;
 	void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
-		= NULL;
-
-	if (neigh->dev->header_ops)
-		update = neigh->dev->header_ops->cache_update;
+		= neigh->dev->header_ops->cache_update;
 
 	if (update) {
 		for (hh = neigh->hh; hh; hh = hh->hh_next) {
diff --git a/trunk/net/dsa/Kconfig b/trunk/net/dsa/Kconfig
index 11201784d29a..c51b55400dc5 100644
--- a/trunk/net/dsa/Kconfig
+++ b/trunk/net/dsa/Kconfig
@@ -1,7 +1,7 @@
 menuconfig NET_DSA
 	bool "Distributed Switch Architecture support"
 	default n
-	depends on EXPERIMENTAL && NET_ETHERNET && !S390
+	depends on EXPERIMENTAL && !S390
 	select PHYLIB
 	---help---
 	  This allows you to use hardware switch chips that use
diff --git a/trunk/net/ipv4/ipmr.c b/trunk/net/ipv4/ipmr.c
index 7f6273506eea..757f25eb9b4b 100644
--- a/trunk/net/ipv4/ipmr.c
+++ b/trunk/net/ipv4/ipmr.c
@@ -442,10 +442,8 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 	int err;
 
 	err = ipmr_fib_lookup(net, &fl, &mrt);
-	if (err < 0) {
-		kfree_skb(skb);
+	if (err < 0)
 		return err;
-	}
 
 	read_lock(&mrt_lock);
 	dev->stats.tx_bytes += skb->len;
@@ -1730,10 +1728,8 @@ int ip_mr_input(struct sk_buff *skb)
 		goto dont_forward;
 
 	err = ipmr_fib_lookup(net, &skb_rtable(skb)->fl, &mrt);
-	if (err < 0) {
-		kfree_skb(skb);
+	if (err < 0)
 		return err;
-	}
 
 	if (!local) {
 		    if (IPCB(skb)->opt.router_alert) {
diff --git a/trunk/net/ipv4/tcp.c b/trunk/net/ipv4/tcp.c
index 65afeaec15b7..6596b4feeddc 100644
--- a/trunk/net/ipv4/tcp.c
+++ b/trunk/net/ipv4/tcp.c
@@ -608,7 +608,6 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
 	ssize_t spliced;
 	int ret;
 
-	sock_rps_record_flow(sk);
 	/*
 	 * We can't seek on a socket input
 	 */
diff --git a/trunk/net/ipv4/tcp_output.c b/trunk/net/ipv4/tcp_output.c
index 7ed9dc1042d1..b4ed957f201a 100644
--- a/trunk/net/ipv4/tcp_output.c
+++ b/trunk/net/ipv4/tcp_output.c
@@ -2208,9 +2208,6 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
 	int mib_idx;
 	int fwd_rexmitting = 0;
 
-	if (!tp->packets_out)
-		return;
-
 	if (!tp->lost_out)
 		tp->retransmit_high = tp->snd_una;
 
diff --git a/trunk/net/ipv6/mip6.c b/trunk/net/ipv6/mip6.c
index d6e9599d0705..2794b6002836 100644
--- a/trunk/net/ipv6/mip6.c
+++ b/trunk/net/ipv6/mip6.c
@@ -347,12 +347,11 @@ static const struct xfrm_type mip6_destopt_type =
 
 static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-	struct ipv6hdr *iph = ipv6_hdr(skb);
 	struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data;
 	int err = rt2->rt_hdr.nexthdr;
 
 	spin_lock(&x->lock);
-	if (!ipv6_addr_equal(&iph->daddr, (struct in6_addr *)x->coaddr) &&
+	if (!ipv6_addr_equal(&rt2->addr, (struct in6_addr *)x->coaddr) &&
 	    !ipv6_addr_any((struct in6_addr *)x->coaddr))
 		err = -ENOENT;
 	spin_unlock(&x->lock);
diff --git a/trunk/net/phonet/pep.c b/trunk/net/phonet/pep.c
index b2a3ae6cad78..94d72e85a475 100644
--- a/trunk/net/phonet/pep.c
+++ b/trunk/net/phonet/pep.c
@@ -698,7 +698,6 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
 		newsk = NULL;
 		goto out;
 	}
-	kfree_skb(oskb);
 
 	sock_hold(sk);
 	pep_sk(newsk)->listener = sk;
diff --git a/trunk/net/sched/act_nat.c b/trunk/net/sched/act_nat.c
index 724553e8ed7b..570949417f38 100644
--- a/trunk/net/sched/act_nat.c
+++ b/trunk/net/sched/act_nat.c
@@ -205,7 +205,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 	{
 		struct icmphdr *icmph;
 
-		if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
+		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
 			goto drop;
 
 		icmph = (void *)(skb_network_header(skb) + ihl);
@@ -215,9 +215,6 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 		    (icmph->type != ICMP_PARAMETERPROB))
 			break;
 
-		if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
-			goto drop;
-
 		iph = (void *)(icmph + 1);
 		if (egress)
 			addr = iph->daddr;
diff --git a/trunk/net/xfrm/xfrm_policy.c b/trunk/net/xfrm/xfrm_policy.c
index a7ec5a8a2380..af1c173be4ad 100644
--- a/trunk/net/xfrm/xfrm_policy.c
+++ b/trunk/net/xfrm/xfrm_policy.c
@@ -1594,8 +1594,8 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
 
 	/* Try to instantiate a bundle */
 	err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
-	if (err <= 0) {
-		if (err != 0 && err != -EAGAIN)
+	if (err < 0) {
+		if (err != -EAGAIN)
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
 		return ERR_PTR(err);
 	}
@@ -1678,13 +1678,6 @@ xfrm_bundle_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir,
 			goto make_dummy_bundle;
 		dst_hold(&xdst->u.dst);
 		return oldflo;
-	} else if (new_xdst == NULL) {
-		num_xfrms = 0;
-		if (oldflo == NULL)
-			goto make_dummy_bundle;
-		xdst->num_xfrms = 0;
-		dst_hold(&xdst->u.dst);
-		return oldflo;
 	}
 
 	/* Kill the previous bundle */
@@ -1767,10 +1760,6 @@ int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
 				xfrm_pols_put(pols, num_pols);
 				err = PTR_ERR(xdst);
 				goto dropdst;
-			} else if (xdst == NULL) {
-				num_xfrms = 0;
-				drop_pols = num_pols;
-				goto no_transform;
 			}
 
 			spin_lock_bh(&xfrm_policy_sk_bundle_lock);