Merge branch 'linux-2.6'

387 files changed, 3091 insertions, 2537 deletions

diff --git a/CREDITS b/CREDITS
index 75c5ce82720c..ae08e4c10ed4 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3279,7 +3279,7 @@ S: Sevilla 41005
 S: Spain
 
 N: Linus Torvalds
-E: torvalds@osdl.org
+E: torvalds@linux-foundation.org
 D: Original kernel hacker
 S: 12725 SW Millikan Way, Suite 400
 S: Beaverton, Oregon 97005
diff --git a/Documentation/SubmitChecklist b/Documentation/SubmitChecklist
index 2270efa10153..bfbb2718a279 100644
--- a/Documentation/SubmitChecklist
+++ b/Documentation/SubmitChecklist
@@ -72,3 +72,7 @@ kernel patches.
 
     If the new code is substantial, addition of subsystem-specific fault
     injection might be appropriate.
+
+22: Newly-added code has been compiled with `gcc -W'.  This will generate
+    lots of noise, but is good for finding bugs like "warning: comparison
+    between signed and unsigned".
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 302d148c2e18..b0d0043f7c46 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -134,9 +134,9 @@ Do not send more than 15 patches at once to the vger mailing lists!!!
 
 
 Linus Torvalds is the final arbiter of all changes accepted into the
-Linux kernel.  His e-mail address is <torvalds@osdl.org>.  He gets
-a lot of e-mail, so typically you should do your best to -avoid- sending
-him e-mail.
+Linux kernel.  His e-mail address is <torvalds@linux-foundation.org>. 
+He gets a lot of e-mail, so typically you should do your best to -avoid-
+sending him e-mail. 
 
 Patches which are bug fixes, are "obvious" changes, or similarly
 require little discussion should be sent or CC'd to Linus.  Patches
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index fc532395d116..0ba6af02cdaf 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -318,3 +318,10 @@ Why:	/proc/acpi/button has been replaced by events to the input layer
 Who:    Len Brown <len.brown@intel.com>
 
 ---------------------------
+
+What:   JFFS (version 1)
+When:   2.6.21
+Why:    Unmaintained for years, superceded by JFFS2 for years.
+Who:    Jeff Garzik <jeff@garzik.org>
+
+---------------------------
diff --git a/Documentation/filesystems/9p.txt b/Documentation/filesystems/9p.txt
index 43b89c214d20..4d075a4558f9 100644
--- a/Documentation/filesystems/9p.txt
+++ b/Documentation/filesystems/9p.txt
@@ -73,8 +73,22 @@ OPTIONS
 RESOURCES
 =========
 
-The Linux version of the 9p server is now maintained under the npfs project
-on sourceforge (http://sourceforge.net/projects/npfs).
+Our current recommendation is to use Inferno (http://www.vitanuova.com/inferno)
+as the 9p server.  You can start a 9p server under Inferno by issuing the
+following command:
+   ; styxlisten -A tcp!*!564 export '#U*'
+
+The -A specifies an unauthenticated export.  The 564 is the port # (you may
+have to choose a higher port number if running as a normal user).  The '#U*'
+specifies exporting the root of the Linux name space.  You may specify a
+subset of the namespace by extending the path: '#U*'/tmp would just export
+/tmp.  For more information, see the Inferno manual pages covering styxlisten
+and export.
+
+A Linux version of the 9p server is now maintained under the npfs project
+on sourceforge (http://sourceforge.net/projects/npfs).  There is also a
+more stable single-threaded version of the server (named spfs) available from
+the same CVS repository.
 
 There are user and developer mailing lists available through the v9fs project
 on sourceforge (http://sourceforge.net/projects/v9fs).
@@ -96,5 +110,5 @@ STATUS
 
 The 2.6 kernel support is working on PPC and x86.
 
-PLEASE USE THE SOURCEFORGE BUG-TRACKER TO REPORT PROBLEMS.
+PLEASE USE THE KERNEL BUGZILLA TO REPORT PROBLEMS. (http://bugzilla.kernel.org)
 
diff --git a/Documentation/i386/boot.txt b/Documentation/i386/boot.txt
index 9575de300a61..38fe1f03fb14 100644
--- a/Documentation/i386/boot.txt
+++ b/Documentation/i386/boot.txt
@@ -2,7 +2,7 @@
                      ----------------------------
 
                     H. Peter Anvin <hpa@zytor.com>
-                        Last update 2006-11-17
+                        Last update 2007-01-26
 
 On the i386 platform, the Linux kernel uses a rather complicated boot
 convention.  This has evolved partially due to historical aspects, as
@@ -186,6 +186,7 @@ filled out, however:
         7  GRuB
         8  U-BOOT
         9  Xen
+        A  Gujin
 
         Please contact <hpa@zytor.com> if you need a bootloader ID
         value assigned.
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 5af6676a88f0..073306818347 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -17,7 +17,7 @@ You can use common Linux commands, such as cp and scp, to copy the
 memory image to a dump file on the local disk, or across the network to
 a remote system.
 
-Kdump and kexec are currently supported on the x86, x86_64, ppc64 and IA64
+Kdump and kexec are currently supported on the x86, x86_64, ppc64 and ia64
 architectures.
 
 When the system kernel boots, it reserves a small section of memory for
@@ -61,7 +61,12 @@ Install kexec-tools
 
 2) Download the kexec-tools user-space package from the following URL:
 
-http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing-20061214.tar.gz
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing.tar.gz
+
+This is a symlink to the latest version, which at the time of writing is
+20061214, the only release of kexec-tools-testing so far. As other versions
+are made released, the older onese will remain available at
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/
 
 Note: Latest kexec-tools-testing git tree is available at
 
@@ -71,11 +76,11 @@ http://www.kernel.org/git/?p=linux/kernel/git/horms/kexec-tools-testing.git;a=su
 
 3) Unpack the tarball with the tar command, as follows:
 
-   tar xvpzf kexec-tools-testing-20061214.tar.gz
+   tar xvpzf kexec-tools-testing.tar.gz
 
-4) Change to the kexec-tools-1.101 directory, as follows:
+4) Change to the kexec-tools directory, as follows:
 
-   cd kexec-tools-testing-20061214
+   cd kexec-tools-testing-VERSION
 
 5) Configure the package, as follows:
 
@@ -224,7 +229,23 @@ Dump-capture kernel config options (Arch Dependent, ppc64)
 
 Dump-capture kernel config options (Arch Dependent, ia64)
 ----------------------------------------------------------
-(To be filled)
+
+- No specific options are required to create a dump-capture kernel
+  for ia64, other than those specified in the arch idependent section
+  above. This means that it is possible to use the system kernel
+  as a dump-capture kernel if desired.
+
+  The crashkernel region can be automatically placed by the system
+  kernel at run time. This is done by specifying the base address as 0,
+  or omitting it all together.
+
+  crashkernel=256M@0
+  or
+  crashkernel=256M
+
+  If the start address is specified, note that the start address of the
+  kernel will be aligned to 64Mb, so if the start address is not then
+  any space below the alignment point will be wasted.
 
 
 Boot into System Kernel
@@ -243,6 +264,10 @@ Boot into System Kernel
 
    On ppc64, use "crashkernel=128M@32M".
 
+   On ia64, 256M@256M is a generous value that typically works.
+   The region may be automatically placed on ia64, see the
+   dump-capture kernel config option notes above.
+
 Load the Dump-capture Kernel
 ============================
 
@@ -261,7 +286,8 @@ For x86_64:
 For ppc64:
         - Use vmlinux
 For ia64:
-        (To be filled)
+        - Use vmlinux or vmlinuz.gz
+
 
 If you are using a uncompressed vmlinux image then use following command
 to load dump-capture kernel.
@@ -277,18 +303,19 @@ to load dump-capture kernel.
    --initrd=<initrd-for-dump-capture-kernel> \
    --append="root=<root-dev> <arch-specific-options>"
 
+Please note, that --args-linux does not need to be specified for ia64.
+It is planned to make this a no-op on that architecture, but for now
+it should be omitted
+
 Following are the arch specific command line options to be used while
 loading dump-capture kernel.
 
-For i386 and x86_64:
+For i386, x86_64 and ia64:
         "init 1 irqpoll maxcpus=1"
 
 For ppc64:
         "init 1 maxcpus=1 noirqdistrib"
 
-For IA64
-        (To be filled)
-
 
 Notes on loading the dump-capture kernel:
 
diff --git a/Documentation/sysrq.txt b/Documentation/sysrq.txt
index e0188a23fd5e..61613166981b 100644
--- a/Documentation/sysrq.txt
+++ b/Documentation/sysrq.txt
@@ -1,6 +1,6 @@
 Linux Magic System Request Key Hacks
-Documentation for sysrq.c version 1.15
-Last update: $Date: 2001/01/28 10:15:59 $
+Documentation for sysrq.c
+Last update: 2007-JAN-06
 
 *  What is the magic SysRq key?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -35,7 +35,7 @@ You can set the value in the file by the following command:
 
 Note that the value of /proc/sys/kernel/sysrq influences only the invocation
 via a keyboard. Invocation of any operation via /proc/sysrq-trigger is always
-allowed.
+allowed (by a user with admin privileges).
 
 *  How do I use the magic SysRq key?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -58,7 +58,7 @@ On PowerPC - Press 'ALT - Print Screen (or F13) - <command key>,
 On other - If you know of the key combos for other architectures, please
            let me know so I can add them to this section.
 
-On all -  write a character to /proc/sysrq-trigger.  eg:
+On all -  write a character to /proc/sysrq-trigger.  e.g.:
 
                 echo t > /proc/sysrq-trigger
 
@@ -74,6 +74,8 @@ On all -  write a character to /proc/sysrq-trigger.  eg:
 
 'c'     - Will perform a kexec reboot in order to take a crashdump.
 
+'d'     - Shows all locks that are held.
+
 'o'     - Will shut your system off (if configured and supported).
 
 's'     - Will attempt to sync all mounted filesystems.
@@ -87,38 +89,43 @@ On all -  write a character to /proc/sysrq-trigger.  eg:
 
 'm'     - Will dump current memory info to your console.
 
+'n'     - Used to make RT tasks nice-able
+
 'v'     - Dumps Voyager SMP processor info to your console.
 
+'w'     - Dumps tasks that are in uninterruptable (blocked) state.
+
+'x'     - Used by xmon interface on ppc/powerpc platforms.
+
 '0'-'9' - Sets the console log level, controlling which kernel messages
           will be printed to your console. ('0', for example would make
           it so that only emergency messages like PANICs or OOPSes would
           make it to your console.)
 
-'f'     - Will call oom_kill to kill a memory hog process
+'f'     - Will call oom_kill to kill a memory hog process.
 
 'e'     - Send a SIGTERM to all processes, except for init.
 
-'i'     - Send a SIGKILL to all processes, except for init.
+'g'     - Used by kgdb on ppc platforms.
 
-'l'     - Send a SIGKILL to all processes, INCLUDING init. (Your system
-          will be non-functional after this.)
+'i'     - Send a SIGKILL to all processes, except for init.
 
-'h'     - Will display help ( actually any other key than those listed
+'h'     - Will display help (actually any other key than those listed
           above will display help. but 'h' is easy to remember :-)
 
 *  Okay, so what can I use them for?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Well, un'R'aw is very handy when your X server or a svgalib program crashes.
 
-sa'K' (Secure Access Key) is useful when you want to be sure there are no
-trojan program is running at console and which could grab your password
-when you would try to login. It will kill all programs on given console
-and thus letting you make sure that the login prompt you see is actually
+sa'K' (Secure Access Key) is useful when you want to be sure there is no
+trojan program running at console which could grab your password
+when you would try to login. It will kill all programs on given console,
+thus letting you make sure that the login prompt you see is actually
 the one from init, not some trojan program.
 IMPORTANT: In its true form it is not a true SAK like the one in a :IMPORTANT
 IMPORTANT: c2 compliant system, and it should not be mistaken as   :IMPORTANT
 IMPORTANT: such.                                                   :IMPORTANT
-       It seems other find it useful as (System Attention Key) which is
+       It seems others find it useful as (System Attention Key) which is
 useful when you want to exit a program that will not let you switch consoles.
 (For example, X or a svgalib program.)
 
@@ -139,8 +146,8 @@ OK or Done message...)
 Again, the unmount (remount read-only) hasn't taken place until you see the
 "OK" and "Done" message appear on the screen.
 
-The loglevel'0'-'9' is useful when your console is being flooded with
-kernel messages you do not want to see. Setting '0' will prevent all but
+The loglevels '0'-'9' are useful when your console is being flooded with
+kernel messages you do not want to see. Selecting '0' will prevent all but
 the most urgent kernel messages from reaching your console. (They will
 still be logged if syslogd/klogd are alive, though.)
 
@@ -152,7 +159,7 @@ processes.
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 That happens to me, also. I've found that tapping shift, alt, and control
 on both sides of the keyboard, and hitting an invalid sysrq sequence again
-will fix the problem. (ie, something like alt-sysrq-z). Switching to another
+will fix the problem. (i.e., something like alt-sysrq-z). Switching to another
 virtual console (ALT+Fn) and then back again should also help.
 
 *  I hit SysRq, but nothing seems to happen, what's wrong?
@@ -174,11 +181,11 @@ handler function you will use, B) a help_msg string, that will print when SysRQ
 prints help, and C) an action_msg string, that will print right before your
 handler is called. Your handler must conform to the prototype in 'sysrq.h'.
 
-After the sysrq_key_op is created, you can call the macro 
-register_sysrq_key(int key, struct sysrq_key_op *op_p) that is defined in
-sysrq.h, this will register the operation pointed to by 'op_p' at table
-key 'key', if that slot in the table is blank. At module unload time, you must
-call the macro unregister_sysrq_key(int key, struct sysrq_key_op *op_p), which
+After the sysrq_key_op is created, you can call the kernel function
+register_sysrq_key(int key, struct sysrq_key_op *op_p); this will
+register the operation pointed to by 'op_p' at table key 'key',
+if that slot in the table is blank. At module unload time, you must call
+the function unregister_sysrq_key(int key, struct sysrq_key_op *op_p), which
 will remove the key op pointed to by 'op_p' from the key 'key', if and only if
 it is currently registered in that slot. This is in case the slot has been
 overwritten since you registered it.
@@ -186,15 +193,12 @@ overwritten since you registered it.
 The Magic SysRQ system works by registering key operations against a key op
 lookup table, which is defined in 'drivers/char/sysrq.c'. This key table has
 a number of operations registered into it at compile time, but is mutable,
-and 4 functions are exported for interface to it: __sysrq_lock_table,
-__sysrq_unlock_table, __sysrq_get_key_op, and __sysrq_put_key_op. The
-functions __sysrq_swap_key_ops and __sysrq_swap_key_ops_nolock are defined
-in the header itself, and the REGISTER and UNREGISTER macros are built from
-these. More complex (and dangerous!) manipulations of the table are possible
-using these functions, but you must be careful to always lock the table before
-you read or write from it, and to unlock it again when you are done. (And of
-course, to never ever leave an invalid pointer in the table). Null pointers in
-the table are always safe :)
+and 2 functions are exported for interface to it:
+        register_sysrq_key and unregister_sysrq_key.
+Of course, never ever leave an invalid pointer in the table. I.e., when
+your module that called register_sysrq_key() exits, it must call
+unregister_sysrq_key() to clean up the sysrq key table entry that it used.
+Null pointers in the table are always safe. :)
 
 If for some reason you feel the need to call the handle_sysrq function from
 within a function called by handle_sysrq, you must be aware that you are in
diff --git a/Documentation/usb/CREDITS b/Documentation/usb/CREDITS
index 01e7f857ef35..27a721635f92 100644
--- a/Documentation/usb/CREDITS
+++ b/Documentation/usb/CREDITS
@@ -21,7 +21,7 @@ difficult to maintain, add yourself with a patch if desired.
   Bill Ryder <bryder@sgi.com>
   Thomas Sailer <sailer@ife.ee.ethz.ch>
   Gregory P. Smith <greg@electricrain.com>
-  Linus Torvalds <torvalds@osdl.org>
+  Linus Torvalds <torvalds@linux-foundation.org>
   Roman Weissgaerber <weissg@vienna.at>
   <Kazuki.Yasumatsu@fujixerox.co.jp>
 
diff --git a/MAINTAINERS b/MAINTAINERS
index b0e33617273d..0ad8803a0c75 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -598,8 +598,6 @@ W:	http://linux-atm.sourceforge.net
 S:      Maintained
 
 ATMEL MACB ETHERNET DRIVER
-P:      Atmel AVR32 Support Team
-M:      avr32@atmel.com
 P:      Haavard Skinnemoen
 M:      hskinnemoen@atmel.com
 S:      Supported
@@ -620,8 +618,6 @@ T:	git kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6.git
 S:      Maintained
 
 AVR32 ARCHITECTURE
-P:      Atmel AVR32 Support Team
-M:      avr32@atmel.com
 P:      Haavard Skinnemoen
 M:      hskinnemoen@atmel.com
 W:      http://www.atmel.com/products/AVR32/
@@ -630,8 +626,6 @@ W:	http://avrfreaks.net/
 S:      Supported
 
 AVR32/AT32AP MACHINE SUPPORT
-P:      Atmel AVR32 Support Team
-M:      avr32@atmel.com
 P:      Haavard Skinnemoen
 M:      hskinnemoen@atmel.com
 S:      Supported
@@ -1137,9 +1131,9 @@ T:	git kernel.org:/pub/scm/linux/kernel/git/airlied/drm-2.6.git
 S:      Maintained
 
 DSCC4 DRIVER
-P:      François Romieu
-M:      romieu@cogenit.fr
-M:      romieu@ensta.fr
+P:      Francois Romieu
+M:      romieu@fr.zoreil.com
+L:      netdev@vger.kernel.org
 S:      Maintained
 
 DVB SUBSYSTEM AND DRIVERS
@@ -1254,7 +1248,7 @@ S:	Maintained
 
 ETHERNET BRIDGE
 P:      Stephen Hemminger
-M:      shemminger@osdl.org
+M:      shemminger@linux-foundation.org
 L:      bridge@osdl.org
 W:      http://bridge.sourceforge.net/
 S:      Maintained
@@ -1598,12 +1592,11 @@ M:	ipslinux@adaptec.com
 W:      http://www.developer.ibm.com/welcome/netfinity/serveraid.html
 S:      Supported 
 
-IDE DRIVER [GENERAL]
+IDE SUBSYSTEM
 P:      Bartlomiej Zolnierkiewicz
-M:      B.Zolnierkiewicz@elka.pw.edu.pl
-L:      linux-kernel@vger.kernel.org
+M:      bzolnier@gmail.com
 L:      linux-ide@vger.kernel.org
-T:      git kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6.git
+T:      quilt kernel.org/pub/linux/kernel/people/bart/pata-2.6/
 S:      Maintained
 
 IDE/ATAPI CDROM DRIVER
@@ -1928,11 +1921,10 @@ S:	Maintained
 
 KERNEL NFSD
 P:      Neil Brown
-M:      neilb@cse.unsw.edu.au
+M:      neilb@suse.de
 L:      nfs@lists.sourceforge.net
 W:      http://nfs.sourceforge.net/
-W:      http://www.cse.unsw.edu.au/~neilb/patches/linux-devel/
-S:      Maintained
+S:      Supported
 
 KERNEL VIRTUAL MACHINE (KVM)
 P:      Avi Kivity
@@ -2277,7 +2269,7 @@ S:	Maintained
 
 NETEM NETWORK EMULATOR
 P:      Stephen Hemminger
-M:      shemminger@osdl.org
+M:      shemminger@linux-foundation.org
 L:      netem@osdl.org
 S:      Maintained
 
@@ -2290,7 +2282,7 @@ P:	Jozsef Kadlecsik
 P:      Patrick McHardy
 M:      kaber@trash.net
 L:      netfilter-devel@lists.netfilter.org
-L:      netfilter@lists.netfilter.org
+L:      netfilter@lists.netfilter.org (subscribers-only)
 L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
@@ -2993,9 +2985,9 @@ SOFTWARE RAID (Multiple Disks) SUPPORT
 P:      Ingo Molnar
 M:      mingo@redhat.com
 P:      Neil Brown
-M:      neilb@cse.unsw.edu.au
+M:      neilb@suse.de
 L:      linux-raid@vger.kernel.org
-S:      Maintained
+S:      Supported
 
 SOFTWARE SUSPEND:
 P:      Pavel Machek
@@ -3081,7 +3073,7 @@ S:	Maintained
 
 SKGE, SKY2 10/100/1000 GIGABIT ETHERNET DRIVERS
 P:      Stephen Hemminger
-M:      shemminger@osdl.org
+M:      shemminger@linux-foundation.org
 L:      netdev@vger.kernel.org
 S:      Maintained
 
@@ -3575,6 +3567,12 @@ M:	khali@linux-fr.org
 L:      i2c@lm-sensors.org
 S:      Maintained
 
+VIA VELOCITY NETWORK DRIVER
+P:      Francois Romieu
+M:      romieu@fr.zoreil.com
+L:      netdev@vger.kernel.org
+S:      Maintained
+
 UCLINUX (AND M68KNOMMU)
 P:      Greg Ungerer
 M:      gerg@uclinux.org
@@ -3595,6 +3593,12 @@ M:	ysato@users.sourceforge.jp
 W:      http://uclinux-h8.sourceforge.jp/
 S:      Supported
 
+UFS FILESYSTEM
+P: Evgeniy Dushistov
+M: dushistov@mail.ru
+L: linux-kernel@vger.kernel.org
+S: Maintained
+
 USB DIAMOND RIO500 DRIVER
 P:      Cesar Miquel
 M:      miquel@df.uba.ar
diff --git a/Makefile b/Makefile
index 477f52e3c7f6..7e2750f4ca70 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 20
-EXTRAVERSION =-rc5
+EXTRAVERSION =
 NAME = Homicidal Dwarf Hamster
 
 # *DOCUMENTATION*
@@ -1116,15 +1116,15 @@ help:
         @echo  '  cscope          - Generate cscope index'
         @echo  '  kernelrelease   - Output the release version string'
         @echo  '  kernelversion   - Output the version stored in Makefile'
-        @if [ -r include/asm-$(ARCH)/Kbuild ]; then \
+        @if [ -r $(srctree)/include/asm-$(ARCH)/Kbuild ]; then \
          echo  '  headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
+         echo  '                    (default: $(INSTALL_HDR_PATH))'; \
          fi
-        @echo  '                    (default: $(INSTALL_HDR_PATH))'
         @echo  ''
         @echo  'Static analysers'
         @echo  '  checkstack      - Generate a list of stack hogs'
         @echo  '  namespacecheck  - Name space analysis on compiled kernel'
-        @if [ -r include/asm-$(ARCH)/Kbuild ]; then \
+        @if [ -r $(srctree)/include/asm-$(ARCH)/Kbuild ]; then \
          echo  '  headers_check   - Sanity check on exported headers'; \
          fi
         @echo  ''
diff --git a/README b/README
index c05561523029..46a66c6e76df 100644
--- a/README
+++ b/README
@@ -278,8 +278,8 @@ IF SOMETHING GOES WRONG:
    the file MAINTAINERS to see if there is a particular person associated
    with the part of the kernel that you are having trouble with. If there
    isn't anyone listed there, then the second best thing is to mail
-   them to me (torvalds@osdl.org), and possibly to any other relevant
-   mailing-list or to the newsgroup.
+   them to me (torvalds@linux-foundation.org), and possibly to any other
+   relevant mailing-list or to the newsgroup.
 
  - In all bug-reports, *please* tell what kernel you are talking about,
    how to duplicate the problem, and what your setup is (use your common
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 3370e6faeae0..c15186390693 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -47,6 +47,7 @@
  * Power off function, if any
  */
 void (*pm_power_off)(void) = machine_power_off;
+EXPORT_SYMBOL(pm_power_off);
 
 void
 cpu_idle(void)
diff --git a/arch/arm/configs/at91sam9260ek_defconfig b/arch/arm/configs/at91sam9260ek_defconfig
index 79049206dfa5..46b0c734aeb9 100644
--- a/arch/arm/configs/at91sam9260ek_defconfig
+++ b/arch/arm/configs/at91sam9260ek_defconfig
@@ -923,7 +923,6 @@ CONFIG_FORCED_INLINING=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
-# CONFIG_DEBUG_WAITQ is not set
 # CONFIG_DEBUG_ERRORS is not set
 CONFIG_DEBUG_LL=y
 # CONFIG_DEBUG_ICEDCC is not set
diff --git a/arch/arm/configs/at91sam9261ek_defconfig b/arch/arm/configs/at91sam9261ek_defconfig
index 784ad7c0186d..fcd8fa091e9d 100644
--- a/arch/arm/configs/at91sam9261ek_defconfig
+++ b/arch/arm/configs/at91sam9261ek_defconfig
@@ -1079,7 +1079,6 @@ CONFIG_FORCED_INLINING=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
-# CONFIG_DEBUG_WAITQ is not set
 # CONFIG_DEBUG_ERRORS is not set
 CONFIG_DEBUG_LL=y
 # CONFIG_DEBUG_ICEDCC is not set
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index d994561816a1..cf495a3084b3 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -22,6 +22,10 @@
 #include <asm/thread_info.h>
 #include <asm/system.h>
 
+#if (PHYS_OFFSET & 0x001fffff)
+#error "PHYS_OFFSET must be at an even 2MiB boundary!"
+#endif
+
 #define KERNEL_RAM_VADDR        (PAGE_OFFSET + TEXT_OFFSET)
 #define KERNEL_RAM_PADDR        (PHYS_OFFSET + TEXT_OFFSET)
 
@@ -251,7 +255,8 @@ __create_page_tables:
          * Then map first 1MB of ram in case it contains our boot params.
          */
         add     r0, r4, #PAGE_OFFSET >> 18
-        orr     r6, r7, #PHYS_OFFSET
+        orr     r6, r7, #(PHYS_OFFSET & 0xff000000)
+        orr     r6, r6, #(PHYS_OFFSET & 0x00e00000)
         str     r6, [r0]
 
 #ifdef CONFIG_XIP_KERNEL
diff --git a/arch/arm/mach-at91rm9200/at91rm9200_devices.c b/arch/arm/mach-at91rm9200/at91rm9200_devices.c
index 4641b99db0ee..57fac7203fe4 100644
--- a/arch/arm/mach-at91rm9200/at91rm9200_devices.c
+++ b/arch/arm/mach-at91rm9200/at91rm9200_devices.c
@@ -272,7 +272,7 @@ void __init at91_add_device_cf(struct at91_cf_data *data)
         at91_set_A_periph(AT91_PIN_PC12, 0);    /* NCS6/CFCE2 */
 
         /* nWAIT is _not_ a default setting */
-        at91_set_A_periph(AT91_PIN_PC6, 1);     /*  nWAIT */
+        at91_set_A_periph(AT91_PIN_PC6, 1);     /* nWAIT */
 
         cf_data = *data;
         platform_device_register(&at91rm9200_cf_device);
diff --git a/arch/arm/mach-at91rm9200/at91sam9260.c b/arch/arm/mach-at91rm9200/at91sam9260.c
index 203f073a53e6..b14871adc300 100644
--- a/arch/arm/mach-at91rm9200/at91sam9260.c
+++ b/arch/arm/mach-at91rm9200/at91sam9260.c
@@ -16,6 +16,7 @@
 #include <asm/mach/map.h>
 #include <asm/arch/at91sam9260.h>
 #include <asm/arch/at91_pmc.h>
+#include <asm/arch/at91_rstc.h>
 
 #include "generic.h"
 #include "clock.h"
@@ -212,7 +213,7 @@ static struct at91_gpio_bank at91sam9260_gpio[] = {
 
 static void at91sam9260_reset(void)
 {
-#warning "Implement CPU reset"
+        at91_sys_write(AT91_RSTC_CR, (0xA5 << 24) | AT91_RSTC_PROCRST | AT91_RSTC_PERRST);
 }
 
 
diff --git a/arch/arm/mach-at91rm9200/at91sam9261.c b/arch/arm/mach-at91rm9200/at91sam9261.c
index 5a82f35da2e9..d242bb885c6d 100644
--- a/arch/arm/mach-at91rm9200/at91sam9261.c
+++ b/arch/arm/mach-at91rm9200/at91sam9261.c
@@ -16,6 +16,7 @@
 #include <asm/mach/map.h>
 #include <asm/arch/at91sam9261.h>
 #include <asm/arch/at91_pmc.h>
+#include <asm/arch/at91_rstc.h>
 
 #include "generic.h"
 #include "clock.h"
@@ -207,7 +208,7 @@ static struct at91_gpio_bank at91sam9261_gpio[] = {
 
 static void at91sam9261_reset(void)
 {
-#warning "Implement CPU reset"
+        at91_sys_write(AT91_RSTC_CR, (0xA5 << 24) | AT91_RSTC_PROCRST | AT91_RSTC_PERRST);
 }
 
 
diff --git a/arch/arm/mach-at91rm9200/gpio.c b/arch/arm/mach-at91rm9200/gpio.c
index 3f188508c391..af22659c8a28 100644
--- a/arch/arm/mach-at91rm9200/gpio.c
+++ b/arch/arm/mach-at91rm9200/gpio.c
@@ -20,7 +20,6 @@
 #include <asm/io.h>
 #include <asm/hardware.h>
 #include <asm/arch/at91_pio.h>
-#include <asm/arch/at91_pmc.h>
 #include <asm/arch/gpio.h>
 
 #include "generic.h"
@@ -224,17 +223,17 @@ static u32 backups[MAX_GPIO_BANKS];
 static int gpio_irq_set_wake(unsigned pin, unsigned state)
 {
         unsigned        mask = pin_to_mask(pin);
+        unsigned        bank = (pin - PIN_BASE) / 32;
 
-        pin -= PIN_BASE;
-        pin /= 32;
-
-        if (unlikely(pin >= MAX_GPIO_BANKS))
+        if (unlikely(bank >= MAX_GPIO_BANKS))
                 return -EINVAL;
 
         if (state)
-                wakeups[pin] |= mask;
+                wakeups[bank] |= mask;
         else
-                wakeups[pin] &= ~mask;
+                wakeups[bank] &= ~mask;
+
+        set_irq_wake(gpio[bank].id, state);
 
         return 0;
 }
@@ -246,29 +245,15 @@ void at91_gpio_suspend(void)
         for (i = 0; i < gpio_banks; i++) {
                 u32 pio = gpio[i].offset;
 
-                /*
-                 * Note: drivers should have disabled GPIO interrupts that
-                 * aren't supposed to be wakeup sources.
-                 * But that is not much good on ARM.....  disable_irq() does
-                 * not update the hardware immediately, so the hardware mask
-                 * (IMR) has the wrong value (not current, too much is
-                 * permitted).
-                 *
-                 * Our workaround is to disable all non-wakeup IRQs ...
-                 * which is exactly what correct drivers asked for in the
-                 * first place!
-                 */
                 backups[i] = at91_sys_read(pio + PIO_IMR);
                 at91_sys_write(pio + PIO_IDR, backups[i]);
                 at91_sys_write(pio + PIO_IER, wakeups[i]);
 
-                if (!wakeups[i]) {
-                        disable_irq_wake(gpio[i].id);
-                        at91_sys_write(AT91_PMC_PCDR, 1 << gpio[i].id);
-                } else {
-                        enable_irq_wake(gpio[i].id);
+                if (!wakeups[i])
+                        clk_disable(gpio[i].clock);
+                else {
 #ifdef CONFIG_PM_DEBUG
-                        printk(KERN_DEBUG "GPIO-%c may wake for %08x\n", "ABCD"[i], wakeups[i]);
+                        printk(KERN_DEBUG "GPIO-%c may wake for %08x\n", 'A'+i, wakeups[i]);
 #endif
                 }
         }
@@ -281,9 +266,11 @@ void at91_gpio_resume(void)
         for (i = 0; i < gpio_banks; i++) {
                 u32 pio = gpio[i].offset;
 
+                if (!wakeups[i])
+                        clk_enable(gpio[i].clock);
+
                 at91_sys_write(pio + PIO_IDR, wakeups[i]);
                 at91_sys_write(pio + PIO_IER, backups[i]);
-                at91_sys_write(AT91_PMC_PCER, 1 << gpio[i].id);
         }
 }
 
diff --git a/arch/arm/mach-imx/cpufreq.c b/arch/arm/mach-imx/cpufreq.c
index ac5f99895660..4f66e90db74f 100644
--- a/arch/arm/mach-imx/cpufreq.c
+++ b/arch/arm/mach-imx/cpufreq.c
@@ -184,6 +184,17 @@ static int imx_set_target(struct cpufreq_policy *policy,
         long sysclk;
         unsigned int bclk_div = 1;
 
+        /*
+         * Some governors do not respects CPU and policy lower limits
+         * which leads to bad things (division by zero etc), ensure
+         * that such things do not happen.
+         */
+        if(target_freq < policy->cpuinfo.min_freq)
+                target_freq = policy->cpuinfo.min_freq;
+
+        if(target_freq < policy->min)
+                target_freq = policy->min;
+
         freq = target_freq * 1000;
 
         pr_debug(KERN_DEBUG "imx: requested frequency %ld Hz, mpctl0 at boot 0x%08x\n",
@@ -258,7 +269,8 @@ static int __init imx_cpufreq_driver_init(struct cpufreq_policy *policy)
         policy->governor = CPUFREQ_DEFAULT_GOVERNOR;
         policy->cpuinfo.min_freq = 8000;
         policy->cpuinfo.max_freq = 200000;
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
+         /* Manual states, that PLL stabilizes in two CLK32 periods */
+        policy->cpuinfo.transition_latency = 4 * 1000000000LL / CLK32;
         return 0;
 }
 
diff --git a/arch/arm/mach-s3c2410/gpio.c b/arch/arm/mach-s3c2410/gpio.c
index ba346546150b..f6fb215bb48c 100644
--- a/arch/arm/mach-s3c2410/gpio.c
+++ b/arch/arm/mach-s3c2410/gpio.c
@@ -57,6 +57,7 @@ void s3c2410_gpio_cfgpin(unsigned int pin, unsigned int function)
         case S3C2410_GPIO_SFN2:
         case S3C2410_GPIO_SFN3:
                 if (pin < S3C2410_GPIO_BANKB) {
+                        function -= 1;
                         function &= 1;
                         function <<= S3C2410_GPIO_OFFSET(pin);
                 } else {
@@ -83,15 +84,18 @@ EXPORT_SYMBOL(s3c2410_gpio_cfgpin);
 unsigned int s3c2410_gpio_getcfg(unsigned int pin)
 {
         void __iomem *base = S3C24XX_GPIO_BASE(pin);
-        unsigned long mask;
+        unsigned long val = __raw_readl(base);
 
         if (pin < S3C2410_GPIO_BANKB) {
-                mask = 1 << S3C2410_GPIO_OFFSET(pin);
+                val >>= S3C2410_GPIO_OFFSET(pin);
+                val &= 1;
+                val += 1;
         } else {
-                mask = 3 << S3C2410_GPIO_OFFSET(pin)*2;
+                val >>= S3C2410_GPIO_OFFSET(pin)*2;
+                val &= 3;
         }
 
-        return __raw_readl(base) & mask;
+        return val | S3C2410_GPIO_INPUT;
 }
 
 EXPORT_SYMBOL(s3c2410_gpio_getcfg);
diff --git a/arch/arm/mach-s3c2410/pm.c b/arch/arm/mach-s3c2410/pm.c
index 00834097eb82..ebf294dd31da 100644
--- a/arch/arm/mach-s3c2410/pm.c
+++ b/arch/arm/mach-s3c2410/pm.c
@@ -451,15 +451,14 @@ static void s3c2410_pm_check_resume_pin(unsigned int pin, unsigned int irqoffs)
                 irqstate = s3c_irqwake_eintmask & (1L<<irqoffs);
 
         pinstate = s3c2410_gpio_getcfg(pin);
-        pinstate >>= S3C2410_GPIO_OFFSET(pin)*2;
 
         if (!irqstate) {
-                if (pinstate == 0x02)
+                if (pinstate == S3C2410_GPIO_IRQ)
                         DBG("Leaving IRQ %d (pin %d) enabled\n", irq, pin);
         } else {
-                if (pinstate == 0x02) {
+                if (pinstate == S3C2410_GPIO_IRQ) {
                         DBG("Disabling IRQ %d (pin %d)\n", irq, pin);
-                        s3c2410_gpio_cfgpin(pin, 0x00);
+                        s3c2410_gpio_cfgpin(pin, S3C2410_GPIO_INPUT);
                 }
         }
 }
diff --git a/arch/arm/mach-s3c2410/s3c2412-dma.c b/arch/arm/mach-s3c2410/s3c2412-dma.c
index fe71a8fdb87c..138f726ac6bf 100644
--- a/arch/arm/mach-s3c2410/s3c2412-dma.c
+++ b/arch/arm/mach-s3c2410/s3c2412-dma.c
@@ -133,8 +133,8 @@ static struct s3c24xx_dma_map __initdata s3c2412_dma_mappings[] = {
 static void s3c2412_dma_select(struct s3c2410_dma_chan *chan,
                                struct s3c24xx_dma_map *map)
 {
-        writel(chan->regs + S3C2412_DMA_DMAREQSEL,
-               map->channels[0] | S3C2412_DMAREQSEL_HW);
+        writel(map->channels[0] | S3C2412_DMAREQSEL_HW,
+               chan->regs + S3C2412_DMA_DMAREQSEL);
 }
 
 static struct s3c24xx_dma_selection __initdata s3c2412_dma_sel = {
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index b5814b4b6f35..7760193e74cc 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -52,15 +52,18 @@ void show_mem(void)
         printk("Free swap:       %6ldkB\n", nr_swap_pages<<(PAGE_SHIFT-10));
 
         for_each_online_node(node) {
+                pg_data_t *n = NODE_DATA(node);
+                struct page *map = n->node_mem_map - n->node_start_pfn;
+
                 for_each_nodebank (i,mi,node) {
                         unsigned int pfn1, pfn2;
                         struct page *page, *end;
 
-                        pfn1 = mi->bank[i].start >> PAGE_SHIFT;
-                        pfn2 = (mi->bank[i].size + mi->bank[i].start) >> PAGE_SHIFT;
+                        pfn1 = __phys_to_pfn(mi->bank[i].start);
+                        pfn2 = __phys_to_pfn(mi->bank[i].size + mi->bank[i].start);
 
-                        page = NODE_MEM_MAP(node) + pfn1;
-                        end  = NODE_MEM_MAP(node) + pfn2;
+                        page = map + pfn1;
+                        end  = map + pfn2;
 
                         do {
                                 total++;
diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
index 251685fe73a8..0ac615c0f798 100644
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -300,7 +300,8 @@ __ioremap_pfn(unsigned long pfn, unsigned long offset, size_t size,
         addr = (unsigned long)area->addr;
 
 #ifndef CONFIG_SMP
-        if ((((cpu_architecture() >= CPU_ARCH_ARMv6) && (get_cr() & CR_XP)) ||
+        if (DOMAIN_IO == 0 &&
+            (((cpu_architecture() >= CPU_ARCH_ARMv6) && (get_cr() & CR_XP)) ||
                cpu_is_xsc3()) &&
                !((__pfn_to_phys(pfn) | size | addr) & ~SUPERSECTION_MASK)) {
                 area->flags |= VM_ARM_SECTION_MAPPING;
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 490e11b34231..d29fe927ee9e 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -708,7 +708,7 @@ __8032x_proc_info:
         .type   __8033x_proc_info,#object
 __8033x_proc_info:
         .long   0x69054010
-        .long   0xffffff30
+        .long   0xfffffd30
         .long   PMD_TYPE_SECT | \
                 PMD_SECT_BUFFERABLE | \
                 PMD_SECT_CACHEABLE | \
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 8bcb838e5444..bd78058b7178 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Thu Dec 7 17:19:20 2006
+# Last update: Tue Jan 16 16:52:56 2007
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -1219,3 +1219,26 @@ zevio_1020		MACH_ZEVIO_1020		ZEVIO_1020		1207
 hitrack                 MACH_HITRACK            HITRACK                 1208
 syme1                   MACH_SYME1              SYME1                   1209
 syhl1                   MACH_SYHL1              SYHL1                   1210
+empca400                MACH_EMPCA400           EMPCA400                1211
+em7210                  MACH_EM7210             EM7210                  1212
+htchermes               MACH_HTCHERMES          HTCHERMES               1213
+eti_c1                  MACH_ETI_C1             ETI_C1                  1214
+mach_dep2410            MACH_MACH_DEP2410       MACH_DEP2410            1215
+ac100                   MACH_AC100              AC100                   1216
+sneetch                 MACH_SNEETCH            SNEETCH                 1217
+studentmate             MACH_STUDENTMATE        STUDENTMATE             1218
+zir2410                 MACH_ZIR2410            ZIR2410                 1219
+zir2413                 MACH_ZIR2413            ZIR2413                 1220
+dlonip3                 MACH_DLONIP3            DLONIP3                 1221
+instream                MACH_INSTREAM           INSTREAM                1222
+ambarella               MACH_AMBARELLA          AMBARELLA               1223
+nevis                   MACH_NEVIS              NEVIS                   1224
+htc_trinity             MACH_HTC_TRINITY        HTC_TRINITY             1225
+ql202b                  MACH_QL202B             QL202B                  1226
+vpac270                 MACH_VPAC270            VPAC270                 1227
+rd129                   MACH_RD129              RD129                   1228
+htcwizard               MACH_HTCWIZARD          HTCWIZARD               1229
+xscale_treo680          MACH_XSCALE_TREO680     XSCALE_TREO680          1230
+tecon_tmezon            MACH_TECON_TMEZON       TECON_TMEZON            1231
+zylonite                MACH_ZYLONITE           ZYLONITE                1233
+gene1270                MACH_GENE1270           GENE1270                1234
diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
index 7b595547c1c8..ca2a5ad19ea6 100644
--- a/arch/arm/vfp/entry.S
+++ b/arch/arm/vfp/entry.S
@@ -25,6 +25,7 @@
 do_vfp:
         enable_irq
         ldr     r4, .LCvfp
+        ldr     r11, [r10, #TI_CPU]     @ CPU number
         add     r10, r10, #TI_VFPSTATE  @ r10 = workspace
         ldr     pc, [r4]                @ call VFP entry point
 
diff --git a/arch/arm/vfp/vfp.h b/arch/arm/vfp/vfp.h
index f2797896e6d5..54a2ad6d9ca2 100644
--- a/arch/arm/vfp/vfp.h
+++ b/arch/arm/vfp/vfp.h
@@ -370,3 +370,7 @@ struct op {
         u32 (* const fn)(int dd, int dn, int dm, u32 fpscr);
         u32 flags;
 };
+
+#ifdef CONFIG_SMP
+extern void vfp_save_state(void *location, u32 fpexc);
+#endif
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index e51e6679c402..d4b7b229631d 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -65,6 +65,7 @@
 @  r2  = faulted PC+4
 @  r9  = successful return
 @  r10 = vfp_state union
+@  r11 = CPU number
 @  lr  = failure return
 
         .globl  vfp_support_entry
@@ -79,7 +80,7 @@ vfp_support_entry:
         DBGSTR1 "enable %x", r10
         ldr     r3, last_VFP_context_address
         orr     r1, r1, #FPEXC_ENABLE   @ user FPEXC has the enable bit set
-        ldr     r4, [r3]                @ last_VFP_context pointer
+        ldr     r4, [r3, r11, lsl #2]   @ last_VFP_context pointer
         bic     r5, r1, #FPEXC_EXCEPTION @ make sure exceptions are disabled
         cmp     r4, r10
         beq     check_for_exception     @ we are returning to the same
@@ -91,7 +92,9 @@ vfp_support_entry:
                                         @ exceptions, so we can get at the
                                         @ rest of it
 
+#ifndef CONFIG_SMP
         @ Save out the current registers to the old thread state
+        @ No need for SMP since this is not done lazily
 
         DBGSTR1 "save old state %p", r4
         cmp     r4, #0
@@ -105,10 +108,11 @@ vfp_support_entry:
         stmia   r4, {r1, r5, r6, r8}    @ save FPEXC, FPSCR, FPINST, FPINST2
                                         @ and point r4 at the word at the
                                         @ start of the register dump
+#endif
 
 no_old_VFP_process:
         DBGSTR1 "load state %p", r10
-        str     r10, [r3]               @ update the last_VFP_context pointer
+        str     r10, [r3, r11, lsl #2]  @ update the last_VFP_context pointer
                                         @ Load the saved state back into the VFP
         VFPFLDMIA r10                   @ reload the working registers while
                                         @ FPEXC is in a safe state
@@ -162,6 +166,24 @@ process_exception:
                                         @ required. If not, the user code will
                                         @ retry the faulted instruction
 
+#ifdef CONFIG_SMP
+        .globl  vfp_save_state
+        .type   vfp_save_state, %function
+vfp_save_state:
+        @ Save the current VFP state
+        @ r0 - save location
+        @ r1 - FPEXC
+        DBGSTR1 "save VFP state %p", r0
+        VFPFMRX r2, FPSCR               @ current status
+        VFPFMRX r3, FPINST              @ FPINST (always there, rev0 onwards)
+        tst     r1, #FPEXC_FPV2         @ is there an FPINST2 to read?
+        VFPFMRX r12, FPINST2, NE        @ FPINST2 if needed - avoids reading
+                                        @ nonexistant reg on rev0
+        VFPFSTMIA r0                    @ save the working registers
+        stmia   r0, {r1, r2, r3, r12}   @ save FPEXC, FPSCR, FPINST, FPINST2
+        mov     pc, lr
+#endif
+
 last_VFP_context_address:
         .word   last_VFP_context
 
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 490d9d18a7d1..f1e5951dc721 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -28,7 +28,7 @@ void vfp_testing_entry(void);
 void vfp_support_entry(void);
 
 void (*vfp_vector)(void) = vfp_testing_entry;
-union vfp_state *last_VFP_context;
+union vfp_state *last_VFP_context[NR_CPUS];
 
 /*
  * Dual-use variable.
@@ -41,13 +41,35 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
 {
         struct thread_info *thread = v;
         union vfp_state *vfp;
+        __u32 cpu = thread->cpu;
 
         if (likely(cmd == THREAD_NOTIFY_SWITCH)) {
+                u32 fpexc = fmrx(FPEXC);
+
+#ifdef CONFIG_SMP
+                /*
+                 * On SMP, if VFP is enabled, save the old state in
+                 * case the thread migrates to a different CPU. The
+                 * restoring is done lazily.
+                 */
+                if ((fpexc & FPEXC_ENABLE) && last_VFP_context[cpu]) {
+                        vfp_save_state(last_VFP_context[cpu], fpexc);
+                        last_VFP_context[cpu]->hard.cpu = cpu;
+                }
+                /*
+                 * Thread migration, just force the reloading of the
+                 * state on the new CPU in case the VFP registers
+                 * contain stale data.
+                 */
+                if (thread->vfpstate.hard.cpu != cpu)
+                        last_VFP_context[cpu] = NULL;
+#endif
+
                 /*
                  * Always disable VFP so we can lazily save/restore the
                  * old state.
                  */
-                fmxr(FPEXC, fmrx(FPEXC) & ~FPEXC_ENABLE);
+                fmxr(FPEXC, fpexc & ~FPEXC_ENABLE);
                 return NOTIFY_DONE;
         }
 
@@ -68,8 +90,8 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
         }
 
         /* flush and release case: Per-thread VFP cleanup. */
-        if (last_VFP_context == vfp)
-                last_VFP_context = NULL;
+        if (last_VFP_context[cpu] == vfp)
+                last_VFP_context[cpu] = NULL;
 
         return NOTIFY_DONE;
 }
diff --git a/arch/avr32/configs/atstk1002_defconfig b/arch/avr32/configs/atstk1002_defconfig
index ae92a14ef9a0..77dace9d54bc 100644
--- a/arch/avr32/configs/atstk1002_defconfig
+++ b/arch/avr32/configs/atstk1002_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.19-rc2
-# Fri Oct 20 11:52:37 2006
+# Linux kernel version: 2.6.20-rc6
+# Fri Jan 26 13:12:59 2007
 #
 CONFIG_AVR32=y
 CONFIG_GENERIC_HARDIRQS=y
@@ -9,6 +9,8 @@ CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_TIME=y
+# CONFIG_ARCH_HAS_ILOG2_U32 is not set
+# CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
@@ -36,6 +38,7 @@ CONFIG_TASK_DELAY_ACCT=y
 # CONFIG_UTS_NS is not set
 CONFIG_AUDIT=y
 # CONFIG_IKCONFIG is not set
+CONFIG_SYSFS_DEPRECATED=y
 CONFIG_RELAY=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -75,7 +78,9 @@ CONFIG_MODULE_UNLOAD=y
 # Block layer
 #
 CONFIG_BLOCK=y
+# CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_LSF is not set
 
 #
 # IO Schedulers
@@ -125,6 +130,7 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_OWNERSHIP_TRACE is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
 CONFIG_CMDLINE=""
@@ -182,6 +188,7 @@ CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
@@ -260,6 +267,7 @@ CONFIG_MTD_CMDLINE_PARTS=y
 # User Modules And Translation Layers
 #
 CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLKDEVS=y
 CONFIG_MTD_BLOCK=y
 # CONFIG_FTL is not set
 # CONFIG_NFTL is not set
@@ -355,7 +363,6 @@ CONFIG_BLK_DEV_INITRD=y
 #
 # Misc devices
 #
-# CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 
 #
@@ -405,11 +412,14 @@ CONFIG_TUN=m
 #
 # PHY device support
 #
+# CONFIG_PHYLIB is not set
 
 #
 # Ethernet (10 or 100Mbit)
 #
-# CONFIG_NET_ETHERNET is not set
+CONFIG_NET_ETHERNET=y
+CONFIG_MII=y
+CONFIG_MACB=y
 
 #
 # Ethernet (1000 Mbit)
@@ -505,10 +515,6 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
-
-#
-# Ftape, the floppy tape device driver
-#
 # CONFIG_RAW_DRIVER is not set
 
 #
@@ -621,6 +627,10 @@ CONFIG_UNIX98_PTYS=y
 #
 
 #
+# Virtualization
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=m
@@ -683,7 +693,6 @@ CONFIG_CONFIGFS_FS=m
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
-# CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
 CONFIG_JFFS2_FS_WRITEBUFFER=y
@@ -763,6 +772,11 @@ CONFIG_NLS_ISO8859_1=m
 CONFIG_NLS_UTF8=m
 
 #
+# Distributed Lock Manager
+#
+# CONFIG_DLM is not set
+
+#
 # Kernel hacking
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
@@ -770,6 +784,8 @@ CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_DETECT_SOFTLOCKUP=y
@@ -785,13 +801,10 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
-CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
 # CONFIG_DEBUG_LIST is not set
 CONFIG_FRAME_POINTER=y
-# CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
-# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_KPROBES is not set
 
@@ -809,6 +822,7 @@ CONFIG_FORCED_INLINING=y
 #
 # Library routines
 #
+CONFIG_BITREVERSE=y
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
@@ -817,3 +831,4 @@ CONFIG_AUDIT_GENERIC=y
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_PLIST=y
+CONFIG_IOMAP_COPY=y
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index 7c4c76114bba..80f55f8dbf1c 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -29,6 +29,7 @@ EXPORT_SYMBOL(__avr32_asr64);
  */
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memcpy);
+EXPORT_SYMBOL(clear_page);
 
 /*
  * Userspace access stuff.
diff --git a/arch/i386/boot/compressed/relocs.c b/arch/i386/boot/compressed/relocs.c
index 468da89153c4..881951ca03e1 100644
--- a/arch/i386/boot/compressed/relocs.c
+++ b/arch/i386/boot/compressed/relocs.c
@@ -43,6 +43,8 @@ static int is_safe_abs_reloc(const char* sym_name)
                         /* Match found */
                         return 1;
         }
+        if (strncmp(sym_name, "__crc_", 6) == 0)
+                return 1;
         return 0;
 }
 
diff --git a/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c b/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
index bec50170b75a..4786fedca6eb 100644
--- a/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
@@ -51,7 +51,6 @@ enum {
 
 
 static int has_N44_O17_errata[NR_CPUS];
-static int has_N60_errata[NR_CPUS];
 static unsigned int stock_freq;
 static struct cpufreq_driver p4clockmod_driver;
 static unsigned int cpufreq_p4_get(unsigned int cpu);
@@ -224,12 +223,6 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy *policy)
         case 0x0f12:
                 has_N44_O17_errata[policy->cpu] = 1;
                 dprintk("has errata -- disabling low frequencies\n");
-                break;
-
-        case 0x0f29:
-                has_N60_errata[policy->cpu] = 1;
-                dprintk("has errata -- disabling frequencies lower than 2ghz\n");
-                break;
         }
 
         /* get max frequency */
@@ -241,8 +234,6 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy *policy)
         for (i=1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) {
                 if ((i<2) && (has_N44_O17_errata[policy->cpu]))
                         p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
-                else if (has_N60_errata[policy->cpu] && ((stock_freq * i)/8) < 2000000)
-                        p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
                 else
                         p4clockmod_table[i].frequency = (stock_freq * i)/8;
         }
diff --git a/arch/i386/kernel/cpu/cyrix.c b/arch/i386/kernel/cpu/cyrix.c
index abcff92f994c..c0c3b59de32c 100644
--- a/arch/i386/kernel/cpu/cyrix.c
+++ b/arch/i386/kernel/cpu/cyrix.c
@@ -173,7 +173,7 @@ static void __cpuinit geode_configure(void)
         ccr4 = getCx86(CX86_CCR4);
         ccr4 |= 0x38;           /* FPU fast, DTE cache, Mem bypass */
         
-        setCx86(CX86_CCR4, ccr4);
+        setCx86(CX86_CCR3, ccr3);
         
         set_cx86_memwb();
         set_cx86_reorder();     
diff --git a/arch/i386/kernel/efi.c b/arch/i386/kernel/efi.c
index b92c7f0a358a..8f9c624ace6f 100644
--- a/arch/i386/kernel/efi.c
+++ b/arch/i386/kernel/efi.c
@@ -473,6 +473,70 @@ static inline void __init check_range_for_systab(efi_memory_desc_t *md)
 }
 
 /*
+ * Wrap all the virtual calls in a way that forces the parameters on the stack.
+ */
+
+#define efi_call_virt(f, args...) \
+     ((efi_##f##_t __attribute__((regparm(0)))*)efi.systab->runtime->f)(args)
+
+static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
+{
+        return efi_call_virt(get_time, tm, tc);
+}
+
+static efi_status_t virt_efi_set_time (efi_time_t *tm)
+{
+        return efi_call_virt(set_time, tm);
+}
+
+static efi_status_t virt_efi_get_wakeup_time (efi_bool_t *enabled,
+                                              efi_bool_t *pending,
+                                              efi_time_t *tm)
+{
+        return efi_call_virt(get_wakeup_time, enabled, pending, tm);
+}
+
+static efi_status_t virt_efi_set_wakeup_time (efi_bool_t enabled,
+                                              efi_time_t *tm)
+{
+        return efi_call_virt(set_wakeup_time, enabled, tm);
+}
+
+static efi_status_t virt_efi_get_variable (efi_char16_t *name,
+                                           efi_guid_t *vendor, u32 *attr,
+                                           unsigned long *data_size, void *data)
+{
+        return efi_call_virt(get_variable, name, vendor, attr, data_size, data);
+}
+
+static efi_status_t virt_efi_get_next_variable (unsigned long *name_size,
+                                                efi_char16_t *name,
+                                                efi_guid_t *vendor)
+{
+        return efi_call_virt(get_next_variable, name_size, name, vendor);
+}
+
+static efi_status_t virt_efi_set_variable (efi_char16_t *name,
+                                           efi_guid_t *vendor,
+                                           unsigned long attr,
+                                           unsigned long data_size, void *data)
+{
+        return efi_call_virt(set_variable, name, vendor, attr, data_size, data);
+}
+
+static efi_status_t virt_efi_get_next_high_mono_count (u32 *count)
+{
+        return efi_call_virt(get_next_high_mono_count, count);
+}
+
+static void virt_efi_reset_system (int reset_type, efi_status_t status,
+                                   unsigned long data_size,
+                                   efi_char16_t *data)
+{
+        efi_call_virt(reset_system, reset_type, status, data_size, data);
+}
+
+/*
  * This function will switch the EFI runtime services to virtual mode.
  * Essentially, look through the EFI memmap and map every region that
  * has the runtime attribute bit set in its memory descriptor and update
@@ -525,22 +589,15 @@ void __init efi_enter_virtual_mode(void)
          * pointers in the runtime service table to the new virtual addresses.
          */
 
-        efi.get_time = (efi_get_time_t *) efi.systab->runtime->get_time;
-        efi.set_time = (efi_set_time_t *) efi.systab->runtime->set_time;
-        efi.get_wakeup_time = (efi_get_wakeup_time_t *)
-                                        efi.systab->runtime->get_wakeup_time;
-        efi.set_wakeup_time = (efi_set_wakeup_time_t *)
-                                        efi.systab->runtime->set_wakeup_time;
-        efi.get_variable = (efi_get_variable_t *)
-                                        efi.systab->runtime->get_variable;
-        efi.get_next_variable = (efi_get_next_variable_t *)
-                                        efi.systab->runtime->get_next_variable;
-        efi.set_variable = (efi_set_variable_t *)
-                                        efi.systab->runtime->set_variable;
-        efi.get_next_high_mono_count = (efi_get_next_high_mono_count_t *)
-                                        efi.systab->runtime->get_next_high_mono_count;
-        efi.reset_system = (efi_reset_system_t *)
-                                        efi.systab->runtime->reset_system;
+        efi.get_time = virt_efi_get_time;
+        efi.set_time = virt_efi_set_time;
+        efi.get_wakeup_time = virt_efi_get_wakeup_time;
+        efi.set_wakeup_time = virt_efi_set_wakeup_time;
+        efi.get_variable = virt_efi_get_variable;
+        efi.get_next_variable = virt_efi_get_next_variable;
+        efi.set_variable = virt_efi_set_variable;
+        efi.get_next_high_mono_count = virt_efi_get_next_high_mono_count;
+        efi.reset_system = virt_efi_reset_system;
 }
 
 void __init
diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index 06461b8b715d..5e47683fc63a 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -302,12 +302,16 @@ sysenter_past_esp:
         pushl $(__USER_CS)
         CFI_ADJUST_CFA_OFFSET 4
         /*CFI_REL_OFFSET cs, 0*/
+#ifndef CONFIG_COMPAT_VDSO
         /*
          * Push current_thread_info()->sysenter_return to the stack.
          * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
          * pushed above; +8 corresponds to copy_thread's esp0 setting.
          */
         pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
+#else
+        pushl $SYSENTER_RETURN
+#endif
         CFI_ADJUST_CFA_OFFSET 4
         CFI_REL_OFFSET eip, 0
 
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index 2424cc9c7b3d..6a3875f81a0a 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -1227,26 +1227,32 @@ static u8 irq_vector[NR_IRQ_VECTORS] __read_mostly = { FIRST_DEVICE_VECTOR , 0 }
 
 static int __assign_irq_vector(int irq)
 {
-        static int current_vector = FIRST_DEVICE_VECTOR, offset = 0;
-        int vector;
+        static int current_vector = FIRST_DEVICE_VECTOR, current_offset = 0;
+        int vector, offset, i;
 
         BUG_ON((unsigned)irq >= NR_IRQ_VECTORS);
 
         if (irq_vector[irq] > 0)
                 return irq_vector[irq];
 
-        current_vector += 8;
-        if (current_vector == SYSCALL_VECTOR)
-                current_vector += 8;
-
-        if (current_vector >= FIRST_SYSTEM_VECTOR) {
-                offset++;
-                if (!(offset % 8))
-                        return -ENOSPC;
-                current_vector = FIRST_DEVICE_VECTOR + offset;
-        }
-
         vector = current_vector;
+        offset = current_offset;
+next:
+        vector += 8;
+        if (vector >= FIRST_SYSTEM_VECTOR) {
+                offset = (offset + 1) % 8;
+                vector = FIRST_DEVICE_VECTOR + offset;
+        }
+        if (vector == current_vector)
+                return -ENOSPC;
+        if (vector == SYSCALL_VECTOR)
+                goto next;
+        for (i = 0; i < NR_IRQ_VECTORS; i++)
+                if (irq_vector[i] == vector)
+                        goto next;
+
+        current_vector = vector;
+        current_offset = offset;
         irq_vector[irq] = vector;
 
         return vector;
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index a5e34d655965..1a6f8bb8881c 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -310,13 +310,7 @@ static int __init setup_nmi_watchdog(char *str)
 
         if ((nmi >= NMI_INVALID) || (nmi < NMI_NONE))
                 return 0;
-        /*
-         * If any other x86 CPU has a local APIC, then
-         * please test the NMI stuff there and send me the
-         * missing bits. Right now Intel P6/P4 and AMD K7 only.
-         */
-        if ((nmi == NMI_LOCAL_APIC) && (nmi_known_cpu() == 0))
-                return 0;  /* no lapic support */
+
         nmi_watchdog = nmi;
         return 1;
 }
diff --git a/arch/i386/kernel/paravirt.c b/arch/i386/kernel/paravirt.c
index 3dceab5828f1..e55fd05da0f5 100644
--- a/arch/i386/kernel/paravirt.c
+++ b/arch/i386/kernel/paravirt.c
@@ -566,4 +566,11 @@ struct paravirt_ops paravirt_ops = {
         .irq_enable_sysexit = native_irq_enable_sysexit,
         .iret = native_iret,
 };
-EXPORT_SYMBOL(paravirt_ops);
+
+/*
+ * NOTE: CONFIG_PARAVIRT is experimental and the paravirt_ops
+ * semantics are subject to change. Hence we only do this
+ * internal-only export of this, until it gets sorted out and
+ * all lowlevel CPU ops used by modules are separately exported.
+ */
+EXPORT_SYMBOL_GPL(paravirt_ops);
diff --git a/arch/i386/kernel/sysenter.c b/arch/i386/kernel/sysenter.c
index 7de9117b5a3a..5da744204d10 100644
--- a/arch/i386/kernel/sysenter.c
+++ b/arch/i386/kernel/sysenter.c
@@ -79,11 +79,6 @@ int __init sysenter_setup(void)
 #ifdef CONFIG_COMPAT_VDSO
         __set_fixmap(FIX_VDSO, __pa(syscall_page), PAGE_READONLY);
         printk("Compat vDSO mapped to %08lx.\n", __fix_to_virt(FIX_VDSO));
-#else
-        /*
-         * In the non-compat case the ELF coredumping code needs the fixmap:
-         */
-        __set_fixmap(FIX_VDSO, __pa(syscall_page), PAGE_KERNEL_RO);
 #endif
 
         if (!boot_cpu_has(X86_FEATURE_SEP)) {
@@ -100,6 +95,7 @@ int __init sysenter_setup(void)
         return 0;
 }
 
+#ifndef CONFIG_COMPAT_VDSO
 static struct page *syscall_nopage(struct vm_area_struct *vma,
                                 unsigned long adr, int *type)
 {
@@ -146,6 +142,13 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int exstack)
         vma->vm_end = addr + PAGE_SIZE;
         /* MAYWRITE to allow gdb to COW and set breakpoints */
         vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYWRITE;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        vma->vm_flags |= VM_ALWAYSDUMP;
         vma->vm_flags |= mm->def_flags;
         vma->vm_page_prot = protection_map[vma->vm_flags & 7];
         vma->vm_ops = &syscall_vm_ops;
@@ -187,3 +190,4 @@ int in_gate_area_no_task(unsigned long addr)
 {
         return 0;
 }
+#endif
diff --git a/arch/i386/mach-default/setup.c b/arch/i386/mach-default/setup.c
index c511705c386c..cc2f519b2f7f 100644
--- a/arch/i386/mach-default/setup.c
+++ b/arch/i386/mach-default/setup.c
@@ -102,7 +102,7 @@ void __init time_init_hook(void)
  *      along the MCA bus.  Use this to hook into that chain if you will need
  *      it.
  **/
-void __init mca_nmi_hook(void)
+void mca_nmi_hook(void)
 {
         /* If I recall correctly, there's a whole bunch of other things that
          * we can do to check for NMI problems, but that's all I know about
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index ef2fe474f107..29f05d4b68cd 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -609,6 +609,9 @@ EXPORT_SYMBOL(acpi_register_gsi);
 
 void acpi_unregister_gsi(u32 gsi)
 {
+        if (acpi_irq_model == ACPI_IRQ_MODEL_PLATFORM)
+                return;
+
         iosapic_unregister_intr(gsi);
 }
 
diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
index 54d55e4d64f7..ce49c85c928f 100644
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -122,6 +122,9 @@ static void migrate_irqs(void)
         for (irq=0; irq < NR_IRQS; irq++) {
                 desc = irq_desc + irq;
 
+                if (desc->status == IRQ_DISABLED)
+                        continue;
+
                 /*
                  * No handling for now.
                  * TBD: Implement a disable function so we can now
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index fd2ff0698a85..bbd386f572d9 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1568,6 +1568,20 @@ config MIPS_MT_FPAFF
         depends on MIPS_MT
         default y
 
+config MIPS_MT_SMTC_INSTANT_REPLAY
+        bool "Low-latency Dispatch of Deferred SMTC IPIs"
+        depends on MIPS_MT_SMTC
+        default y
+        help
+          SMTC pseudo-interrupts between TCs are deferred and queued
+          if the target TC is interrupt-inhibited (IXMT). In the first
+          SMTC prototypes, these queued IPIs were serviced on return
+          to user mode, or on entry into the kernel idle loop. The
+          INSTANT_REPLAY option dispatches them as part of local_irq_restore()
+          processing, which adds runtime overhead (hence the option to turn
+          it off), but ensures that IPIs are handled promptly even under
+          heavy I/O interrupt load.
+
 config MIPS_VPE_LOADER_TOM
         bool "Load VPE program into memory hidden from linux"
         depends on MIPS_VPE_LOADER
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index d1b026a0337d..c68b5d3e5d18 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -623,7 +623,7 @@ LDFLAGS			+= -m $(ld-emul)
 
 ifdef CONFIG_MIPS
 CHECKFLAGS += $(shell $(CC) $(CFLAGS) -dM -E -xc /dev/null | \
-        egrep -vw '__GNUC_(MAJOR|MINOR|PATCHLEVEL)__' | \
+        egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
         sed -e 's/^\#define /-D/' -e "s/ /='/" -e "s/$$/'/")
 ifdef CONFIG_64BIT
 CHECKFLAGS              += -m64
diff --git a/arch/mips/dec/prom/memory.c b/arch/mips/dec/prom/memory.c
index 3027ce782797..3aa01d268f2d 100644
--- a/arch/mips/dec/prom/memory.c
+++ b/arch/mips/dec/prom/memory.c
@@ -122,7 +122,7 @@ unsigned long __init prom_free_prom_memory(void)
                 addr += PAGE_SIZE;
         }
 
-        printk("Freeing unused PROM memory: %ldk freed\n",
+        printk("Freeing unused PROM memory: %ldkb freed\n",
                (end - PAGE_SIZE) >> 10);
 
         return end - PAGE_SIZE;
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index a8b387197d5b..6a857bf030b0 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 
 #include <asm/cpu.h>
 #include <asm/processor.h>
@@ -270,9 +271,12 @@ void smtc_configure_tlb(void)
                  * of their initialization in smtc_cpu_setup().
                  */
 
-                tlbsiz = tlbsiz & 0x3f; /* MIPS32 limits TLB indices to 64 */
-                cpu_data[0].tlbsize = tlbsiz;
+                /* MIPS32 limits TLB indices to 64 */
+                if (tlbsiz > 64)
+                        tlbsiz = 64;
+                cpu_data[0].tlbsize = current_cpu_data.tlbsize = tlbsiz;
                 smtc_status |= SMTC_TLB_SHARED;
+                local_flush_tlb_all();
 
                 printk("TLB of %d entry pairs shared by %d VPEs\n",
                         tlbsiz, vpes);
@@ -1017,6 +1021,35 @@ void setup_cross_vpe_interrupts(void)
  * SMTC-specific hacks invoked from elsewhere in the kernel.
  */
 
+void smtc_ipi_replay(void)
+{
+        /*
+         * To the extent that we've ever turned interrupts off,
+         * we may have accumulated deferred IPIs.  This is subtle.
+         * If we use the smtc_ipi_qdepth() macro, we'll get an
+         * exact number - but we'll also disable interrupts
+         * and create a window of failure where a new IPI gets
+         * queued after we test the depth but before we re-enable
+         * interrupts. So long as IXMT never gets set, however,
+         * we should be OK:  If we pick up something and dispatch
+         * it here, that's great. If we see nothing, but concurrent
+         * with this operation, another TC sends us an IPI, IXMT
+         * is clear, and we'll handle it as a real pseudo-interrupt
+         * and not a pseudo-pseudo interrupt.
+         */
+        if (IPIQ[smp_processor_id()].depth > 0) {
+                struct smtc_ipi *pipi;
+                extern void self_ipi(struct smtc_ipi *);
+
+                while ((pipi = smtc_ipi_dq(&IPIQ[smp_processor_id()]))) {
+                        self_ipi(pipi);
+                        smtc_cpu_stats[smp_processor_id()].selfipis++;
+                }
+        }
+}
+
+EXPORT_SYMBOL(smtc_ipi_replay);
+
 void smtc_idle_loop_hook(void)
 {
 #ifdef SMTC_IDLE_HOOK_DEBUG
@@ -1113,29 +1146,14 @@ void smtc_idle_loop_hook(void)
         if (pdb_msg != &id_ho_db_msg[0])
                 printk("CPU%d: %s", smp_processor_id(), id_ho_db_msg);
 #endif /* SMTC_IDLE_HOOK_DEBUG */
+
         /*
-         * To the extent that we've ever turned interrupts off,
-         * we may have accumulated deferred IPIs.  This is subtle.
-         * If we use the smtc_ipi_qdepth() macro, we'll get an
-         * exact number - but we'll also disable interrupts
-         * and create a window of failure where a new IPI gets
-         * queued after we test the depth but before we re-enable
-         * interrupts. So long as IXMT never gets set, however,
-         * we should be OK:  If we pick up something and dispatch
-         * it here, that's great. If we see nothing, but concurrent
-         * with this operation, another TC sends us an IPI, IXMT
-         * is clear, and we'll handle it as a real pseudo-interrupt
-         * and not a pseudo-pseudo interrupt.
+         * Replay any accumulated deferred IPIs. If "Instant Replay"
+         * is in use, there should never be any.
          */
-        if (IPIQ[smp_processor_id()].depth > 0) {
-                struct smtc_ipi *pipi;
-                extern void self_ipi(struct smtc_ipi *);
-
-                if ((pipi = smtc_ipi_dq(&IPIQ[smp_processor_id()])) != NULL) {
-                        self_ipi(pipi);
-                        smtc_cpu_stats[smp_processor_id()].selfipis++;
-                }
-        }
+#ifndef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
+        smtc_ipi_replay();
+#endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
 }
 
 void smtc_soft_dump(void)
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 666bef484dcb..458fccf87c54 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -139,13 +139,16 @@ struct tc {
         struct list_head list;
 };
 
-struct vpecontrol_ {
+struct {
         /* Virtual processing elements */
         struct list_head vpe_list;
 
         /* Thread contexts */
         struct list_head tc_list;
-} vpecontrol;
+} vpecontrol = {
+        .vpe_list = LIST_HEAD_INIT(vpecontrol.vpe_list),
+        .tc_list = LIST_HEAD_INIT(vpecontrol.tc_list)
+};
 
 static void release_progmem(void *ptr);
 /* static __attribute_used__ void dump_vpe(struct vpe * v); */
@@ -1388,8 +1391,6 @@ static int __init vpe_module_init(void)
 
         /* dump_mtregs(); */
 
-        INIT_LIST_HEAD(&vpecontrol.vpe_list);
-        INIT_LIST_HEAD(&vpecontrol.tc_list);
 
         val = read_c0_mvpconf0();
         for (i = 0; i < ((val & MVPCONF0_PTC) + 1); i++) {
diff --git a/arch/mips/mips-boards/malta/Makefile b/arch/mips/mips-boards/malta/Makefile
index b662c75fb28e..cb7f349b0514 100644
--- a/arch/mips/mips-boards/malta/Makefile
+++ b/arch/mips/mips-boards/malta/Makefile
@@ -19,5 +19,6 @@
 # under Linux.
 #
 
-obj-y := malta_int.o malta_mtd.o malta_setup.o
+obj-y := malta_int.o malta_setup.o
+obj-$(CONFIG_MTD) += malta_mtd.o
 obj-$(CONFIG_SMP) += malta_smp.o
diff --git a/arch/mips/mips-boards/sim/sim_setup.c b/arch/mips/mips-boards/sim/sim_setup.c
index 2659c1c3b78d..ea2066c3a1f7 100644
--- a/arch/mips/mips-boards/sim/sim_setup.c
+++ b/arch/mips/mips-boards/sim/sim_setup.c
@@ -57,7 +57,7 @@ void __init plat_mem_setup(void)
         board_time_init = sim_time_init;
         prom_printf("Linux started...\n");
 
-#ifdef CONFIG_MT_SMP
+#ifdef CONFIG_MIPS_MT_SMP
         sanitize_tlb_entries();
 #endif
 }
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 30245c09d025..49065c133ebf 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -501,7 +501,8 @@ void free_initmem(void)
 
         freed = prom_free_prom_memory();
         if (freed)
-                printk(KERN_INFO "Freeing firmware memory: %ldk freed\n",freed);
+                printk(KERN_INFO "Freeing firmware memory: %ldkb freed\n",
+                       freed >> 10);
 
         free_init_pages("unused kernel memory",
                         __pa_symbol(&__init_begin),
diff --git a/arch/mips/momentum/ocelot_g/prom.c b/arch/mips/momentum/ocelot_g/prom.c
index 6509a9c9863c..2f75c6b91ec5 100644
--- a/arch/mips/momentum/ocelot_g/prom.c
+++ b/arch/mips/momentum/ocelot_g/prom.c
@@ -28,7 +28,7 @@ struct callvectors* debug_vectors;
 extern unsigned long marvell_base;
 extern unsigned long bus_clock;
 
-#ifdef CONFIG_GALILLEO_GT64240_ETH
+#ifdef CONFIG_GALILEO_GT64240_ETH
 extern unsigned char prom_mac_addr_base[6];
 #endif
 
@@ -61,7 +61,7 @@ void __init prom_init(void)
         mips_machgroup = MACH_GROUP_MOMENCO;
         mips_machtype = MACH_MOMENCO_OCELOT_G;
 
-#ifdef CONFIG_GALILLEO_GT64240_ETH
+#ifdef CONFIG_GALILEO_GT64240_ETH
         /* get the base MAC address for on-board ethernet ports */
         memcpy(prom_mac_addr_base, (void*)0xfc807cf2, 6);
 #endif
diff --git a/arch/mips/momentum/ocelot_g/setup.c b/arch/mips/momentum/ocelot_g/setup.c
index d288f7b01842..9db638a7982c 100644
--- a/arch/mips/momentum/ocelot_g/setup.c
+++ b/arch/mips/momentum/ocelot_g/setup.c
@@ -64,7 +64,7 @@
 
 #include "ocelot_pld.h"
 
-#ifdef CONFIG_GALILLEO_GT64240_ETH
+#ifdef CONFIG_GALILEO_GT64240_ETH
 extern unsigned char prom_mac_addr_base[6];
 #endif
 
@@ -185,7 +185,7 @@ void __init plat_mem_setup(void)
         /* do handoff reconfiguration */
         PMON_v2_setup();
 
-#ifdef CONFIG_GALILLEO_GT64240_ETH
+#ifdef CONFIG_GALILEO_GT64240_ETH
         /* get the mac addr */
         memcpy(prom_mac_addr_base, (void*)0xfc807cf2, 6);
 #endif
diff --git a/arch/mips/vr41xx/common/irq.c b/arch/mips/vr41xx/common/irq.c
index 397ba94cd7ec..16decf4ac2f4 100644
--- a/arch/mips/vr41xx/common/irq.c
+++ b/arch/mips/vr41xx/common/irq.c
@@ -1,7 +1,7 @@
 /*
  *  Interrupt handing routines for NEC VR4100 series.
  *
- *  Copyright (C) 2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *  Copyright (C) 2005-2007  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -73,13 +73,19 @@ static void irq_dispatch(unsigned int irq)
         if (cascade->get_irq != NULL) {
                 unsigned int source_irq = irq;
                 desc = irq_desc + source_irq;
-                desc->chip->ack(source_irq);
+                if (desc->chip->mask_ack)
+                        desc->chip->mask_ack(source_irq);
+                else {
+                        desc->chip->mask(source_irq);
+                        desc->chip->ack(source_irq);
+                }
                 irq = cascade->get_irq(irq);
                 if (irq < 0)
                         atomic_inc(&irq_err_count);
                 else
                         irq_dispatch(irq);
-                desc->chip->end(source_irq);
+                if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
+                        desc->chip->unmask(source_irq);
         } else
                 do_IRQ(irq);
 }
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 5f80f0b828f2..aeb53096acf7 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -492,6 +492,7 @@ config PPC_MAPLE
         select PPC_NATIVE
         select PPC_RTAS
         select MMIO_NVRAM
+        select ATA_NONSTANDARD if ATA
         default n
         help
           This option enables support for the Maple 970FX Evaluation Board.
@@ -533,12 +534,15 @@ config PPC_IBM_CELL_BLADE
         select UDBG_RTAS_CONSOLE
 
 config PPC_PS3
-        bool "Sony PS3"
+        bool "Sony PS3 (incomplete)"
         depends on PPC_MULTIPLATFORM && PPC64
         select PPC_CELL
         help
           This option enables support for the Sony PS3 game console
           and other platforms using the PS3 hypervisor.
+          Support for this platform is not yet complete, so
+          enabling this will not result in a bootable kernel on a
+          PS3 system.
 
 config PPC_CELLEB
         bool "Toshiba's Cell Reference Set 'Celleb' Architecture"
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index b6d08738180b..6828df4afd99 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -1429,7 +1429,7 @@ long sys_pciconfig_iobase(long which, unsigned long in_bus,
 
         for (ln = pci_root_buses.next; ln != &pci_root_buses; ln = ln->next) {
                 bus = pci_bus_b(ln);
-                if (in_bus >= bus->number && in_bus < (bus->number + bus->subordinate))
+                if (in_bus >= bus->number && in_bus <= bus->subordinate)
                         break;
                 bus = NULL;
         }
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index a4b28c73bba0..ae0ede19879d 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -284,6 +284,13 @@ int arch_setup_additional_pages(struct linux_binprm *bprm,
          * pages though
          */
         vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        vma->vm_flags |= VM_ALWAYSDUMP;
         vma->vm_flags |= mm->def_flags;
         vma->vm_page_prot = protection_map[vma->vm_flags & 0x7];
         vma->vm_ops = &vdso_vmops;
diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
index 89a28cc018c9..113bd48a89bd 100644
--- a/arch/sparc/kernel/process.c
+++ b/arch/sparc/kernel/process.c
@@ -54,6 +54,7 @@ void (*pm_idle)(void);
  * handler when auxio is not present-- unused for now...
  */
 void (*pm_power_off)(void) = machine_power_off;
+EXPORT_SYMBOL(pm_power_off);
 
 /*
  * sysctl - toggle power-off restriction for serial console 
diff --git a/arch/sparc/kernel/smp.c b/arch/sparc/kernel/smp.c
index 276f22881d0f..6b5f26b0fb75 100644
--- a/arch/sparc/kernel/smp.c
+++ b/arch/sparc/kernel/smp.c
@@ -292,8 +292,8 @@ int setup_profiling_timer(unsigned int multiplier)
 
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
-        extern void smp4m_boot_cpus(void);
-        extern void smp4d_boot_cpus(void);
+        extern void __init smp4m_boot_cpus(void);
+        extern void __init smp4d_boot_cpus(void);
         int i, cpuid, extra;
 
         printk("Entering SMP Mode...\n");
@@ -375,8 +375,8 @@ void __init smp_prepare_boot_cpu(void)
 
 int __cpuinit __cpu_up(unsigned int cpu)
 {
-        extern int smp4m_boot_one_cpu(int);
-        extern int smp4d_boot_one_cpu(int);
+        extern int __cpuinit smp4m_boot_one_cpu(int);
+        extern int __cpuinit smp4d_boot_one_cpu(int);
         int ret=0;
 
         switch(sparc_cpu_model) {
diff --git a/arch/sparc/kernel/sun4d_smp.c b/arch/sparc/kernel/sun4d_smp.c
index c80ea61e8ba0..c69de5d4863d 100644
--- a/arch/sparc/kernel/sun4d_smp.c
+++ b/arch/sparc/kernel/sun4d_smp.c
@@ -164,7 +164,7 @@ void __init smp4d_boot_cpus(void)
         local_flush_cache_all();
 }
 
-int smp4d_boot_one_cpu(int i)
+int __cpuinit smp4d_boot_one_cpu(int i)
 {
                         extern unsigned long sun4d_cpu_startup;
                         unsigned long *entry = &sun4d_cpu_startup;
diff --git a/arch/sparc64/kernel/sun4v_tlb_miss.S b/arch/sparc64/kernel/sun4v_tlb_miss.S
index b731881224e8..9871dbb1ab42 100644
--- a/arch/sparc64/kernel/sun4v_tlb_miss.S
+++ b/arch/sparc64/kernel/sun4v_tlb_miss.S
@@ -142,9 +142,9 @@ sun4v_dtlb_prot:
         rdpr    %tl, %g1
         cmp     %g1, 1
         bgu,pn  %xcc, winfix_trampoline
-         nop
-        ba,pt   %xcc, sparc64_realfault_common
          mov    FAULT_CODE_DTLB | FAULT_CODE_WRITE, %g4
+        ba,pt   %xcc, sparc64_realfault_common
+         nop
 
         /* Called from trap table:
          * %g4: vaddr
diff --git a/arch/um/Kconfig.i386 b/arch/um/Kconfig.i386
index f191a550a079..d6cffb27fff8 100644
--- a/arch/um/Kconfig.i386
+++ b/arch/um/Kconfig.i386
@@ -19,31 +19,31 @@ config SEMAPHORE_SLEEPERS
 choice
         prompt "Host memory split"
         default HOST_VMSPLIT_3G
-        ---help---
-           This is needed when the host kernel on which you run has a non-default
-           (like 2G/2G) memory split, instead of the customary 3G/1G. If you did
-           not recompile your own kernel but use the default distro's one, you can
-           safely accept the "Default split" option.
-
-           It can be enabled on recent (>=2.6.16-rc2) vanilla kernels via
-           CONFIG_VM_SPLIT_*, or on previous kernels with special patches (-ck
-           patchset by Con Kolivas, or other ones) - option names match closely the
-           host CONFIG_VM_SPLIT_* ones.
-
-           A lower setting (where 1G/3G is lowest and 3G/1G is higher) will
-           tolerate even more "normal" host kernels, but an higher setting will be
-           stricter.
-
-           So, if you do not know what to do here, say 'Default split'.
-
-        config HOST_VMSPLIT_3G
-                bool "Default split (3G/1G user/kernel host split)"
-        config HOST_VMSPLIT_3G_OPT
-                bool "3G/1G user/kernel host split (for full 1G low memory)"
-        config HOST_VMSPLIT_2G
-                bool "2G/2G user/kernel host split"
-        config HOST_VMSPLIT_1G
-                bool "1G/3G user/kernel host split"
+        help
+        This is needed when the host kernel on which you run has a non-default
+        (like 2G/2G) memory split, instead of the customary 3G/1G. If you did
+        not recompile your own kernel but use the default distro's one, you can
+        safely accept the "Default split" option.
+
+        It can be enabled on recent (>=2.6.16-rc2) vanilla kernels via
+        CONFIG_VM_SPLIT_*, or on previous kernels with special patches (-ck
+        patchset by Con Kolivas, or other ones) - option names match closely the
+        host CONFIG_VM_SPLIT_* ones.
+
+        A lower setting (where 1G/3G is lowest and 3G/1G is higher) will
+        tolerate even more "normal" host kernels, but an higher setting will be
+        stricter.
+
+        So, if you do not know what to do here, say 'Default split'.
+
+config HOST_VMSPLIT_3G
+        bool "Default split (3G/1G user/kernel host split)"
+config HOST_VMSPLIT_3G_OPT
+        bool "3G/1G user/kernel host split (for full 1G low memory)"
+config HOST_VMSPLIT_2G
+        bool "2G/2G user/kernel host split"
+config HOST_VMSPLIT_1G
+        bool "1G/3G user/kernel host split"
 endchoice
 
 config TOP_ADDR
@@ -67,13 +67,13 @@ config 3_LEVEL_PGTABLES
 
 config STUB_CODE
         hex
-        default 0xbfffe000 if !HOST_2G_2G
-        default 0x7fffe000 if HOST_2G_2G
+        default 0xbfffe000 if !HOST_VMSPLIT_2G
+        default 0x7fffe000 if HOST_VMSPLIT_2G
 
 config STUB_DATA
         hex
-        default 0xbffff000 if !HOST_2G_2G
-        default 0x7ffff000 if HOST_2G_2G
+        default 0xbffff000 if !HOST_VMSPLIT_2G
+        default 0x7ffff000 if HOST_VMSPLIT_2G
 
 config STUB_START
         hex
diff --git a/arch/um/sys-i386/signal.c b/arch/um/sys-i386/signal.c
index 0709fc6670c2..3f6acd667717 100644
--- a/arch/um/sys-i386/signal.c
+++ b/arch/um/sys-i386/signal.c
@@ -219,7 +219,8 @@ int setup_signal_stack_sc(unsigned long stack_top, int sig,
         unsigned long save_sp = PT_REGS_SP(regs);
         int err = 0;
 
-        stack_top &= -8UL;
+        /* This is the same calculation as i386 - ((sp + 4) & 15) == 0 */
+        stack_top = ((stack_top + 4) & -16UL) - 4;
         frame = (struct sigframe __user *) stack_top - 1;
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
                 return 1;
diff --git a/arch/um/sys-x86_64/signal.c b/arch/um/sys-x86_64/signal.c
index 9edf114faf79..af2f017617b4 100644
--- a/arch/um/sys-x86_64/signal.c
+++ b/arch/um/sys-x86_64/signal.c
@@ -191,8 +191,9 @@ int setup_signal_stack_si(unsigned long stack_top, int sig,
         struct task_struct *me = current;
 
         frame = (struct rt_sigframe __user *)
-                round_down(stack_top - sizeof(struct rt_sigframe), 16) - 8;
-        frame = (struct rt_sigframe __user *) ((unsigned long) frame - 128);
+                round_down(stack_top - sizeof(struct rt_sigframe), 16);
+        /* Subtract 128 for a red zone and 8 for proper alignment */
+        frame = (struct rt_sigframe __user *) ((unsigned long) frame - 128 - 8);
 
         if (!access_ok(VERIFY_WRITE, fp, sizeof(struct _fpstate)))
                 goto out;
diff --git a/arch/x86_64/ia32/ia32_binfmt.c b/arch/x86_64/ia32/ia32_binfmt.c
index 543ef4f405e9..5ce0bd486bbf 100644
--- a/arch/x86_64/ia32/ia32_binfmt.c
+++ b/arch/x86_64/ia32/ia32_binfmt.c
@@ -64,55 +64,6 @@ typedef unsigned int elf_greg_t;
 #define ELF_NGREG (sizeof (struct user_regs_struct32) / sizeof(elf_greg_t))
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 
-/*
- * These macros parameterize elf_core_dump in fs/binfmt_elf.c to write out
- * extra segments containing the vsyscall DSO contents.  Dumping its
- * contents makes post-mortem fully interpretable later without matching up
- * the same kernel and hardware config to see what PC values meant.
- * Dumping its extra ELF program headers includes all the other information
- * a debugger needs to easily find how the vsyscall DSO was being used.
- */
-#define ELF_CORE_EXTRA_PHDRS    (find_vma(current->mm, VSYSCALL32_BASE) ?     \
-    (VSYSCALL32_EHDR->e_phnum) : 0)
-#define ELF_CORE_WRITE_EXTRA_PHDRS                                            \
-do {                                                                          \
-        if (find_vma(current->mm, VSYSCALL32_BASE)) {                         \
-                const struct elf32_phdr *const vsyscall_phdrs =               \
-                        (const struct elf32_phdr *) (VSYSCALL32_BASE          \
-                                                   + VSYSCALL32_EHDR->e_phoff);\
-                int i;                                                        \
-                Elf32_Off ofs = 0;                                            \
-                for (i = 0; i < VSYSCALL32_EHDR->e_phnum; ++i) {              \
-                        struct elf32_phdr phdr = vsyscall_phdrs[i];           \
-                        if (phdr.p_type == PT_LOAD) {                         \
-                                BUG_ON(ofs != 0);                             \
-                                ofs = phdr.p_offset = offset;                 \
-                                phdr.p_memsz = PAGE_ALIGN(phdr.p_memsz);      \
-                                phdr.p_filesz = phdr.p_memsz;                 \
-                                offset += phdr.p_filesz;                      \
-                        }                                                     \
-                        else                                                  \
-                                phdr.p_offset += ofs;                         \
-                        phdr.p_paddr = 0; /* match other core phdrs */        \
-                        DUMP_WRITE(&phdr, sizeof(phdr));                      \
-                }                                                             \
-        }                                                                     \
-} while (0)
-#define ELF_CORE_WRITE_EXTRA_DATA                                             \
-do {                                                                          \
-        if (find_vma(current->mm, VSYSCALL32_BASE)) {                         \
-                const struct elf32_phdr *const vsyscall_phdrs =               \
-                        (const struct elf32_phdr *) (VSYSCALL32_BASE          \
-                                                   + VSYSCALL32_EHDR->e_phoff);      \
-                int i;                                                        \
-                for (i = 0; i < VSYSCALL32_EHDR->e_phnum; ++i) {              \
-                        if (vsyscall_phdrs[i].p_type == PT_LOAD)              \
-                                DUMP_WRITE((void *) (u64) vsyscall_phdrs[i].p_vaddr,\
-                                    PAGE_ALIGN(vsyscall_phdrs[i].p_memsz));   \
-                }                                                             \
-        }                                                                     \
-} while (0)
-
 struct elf_siginfo
 {
         int     si_signo;                       /* signal number */
diff --git a/arch/x86_64/ia32/syscall32.c b/arch/x86_64/ia32/syscall32.c
index 3e5ed20cba45..59f1fa155915 100644
--- a/arch/x86_64/ia32/syscall32.c
+++ b/arch/x86_64/ia32/syscall32.c
@@ -59,6 +59,13 @@ int syscall32_setup_pages(struct linux_binprm *bprm, int exstack)
         vma->vm_end = VSYSCALL32_END;
         /* MAYWRITE to allow gdb to COW and set breakpoints */
         vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYWRITE;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        vma->vm_flags |= VM_ALWAYSDUMP;
         vma->vm_flags |= mm->def_flags;
         vma->vm_page_prot = protection_map[vma->vm_flags & 7];
         vma->vm_ops = &syscall32_vm_ops;
@@ -75,6 +82,14 @@ int syscall32_setup_pages(struct linux_binprm *bprm, int exstack)
         return 0;
 }
 
+const char *arch_vma_name(struct vm_area_struct *vma)
+{
+        if (vma->vm_start == VSYSCALL32_BASE &&
+            vma->vm_mm && vma->vm_mm->task_size == IA32_PAGE_OFFSET)
+                return "[vdso]";
+        return NULL;
+}
+
 static int __init init_syscall32(void)
 { 
         syscall32_page = (void *)get_zeroed_page(GFP_KERNEL); 
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 186aebbae32d..9cb42ecb7f89 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -302,8 +302,6 @@ int __init setup_nmi_watchdog(char *str)
         if ((nmi >= NMI_INVALID) || (nmi < NMI_NONE))
                 return 0;
 
-        if ((nmi == NMI_LOCAL_APIC) && (nmi_known_cpu() == 0))
-                return 0;  /* no lapic support */
         nmi_watchdog = nmi;
         return 1;
 }
diff --git a/block/elevator.c b/block/elevator.c
index 536be740ba4e..f6dafa8c7c4d 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -590,6 +590,12 @@ void elv_insert(request_queue_t *q, struct request *rq, int where)
                  */
                 rq->cmd_flags |= REQ_SOFTBARRIER;
 
+                /*
+                 * Most requeues happen because of a busy condition,
+                 * don't force unplug of the queue for that case.
+                 */
+                unplug_it = 0;
+
                 if (q->ordseq == 0) {
                         list_add(&rq->queuelist, &q->queue_head);
                         break;
@@ -604,11 +610,6 @@ void elv_insert(request_queue_t *q, struct request *rq, int where)
                 }
 
                 list_add_tail(&rq->queuelist, pos);
-                /*
-                 * most requeues happen because of a busy condition, don't
-                 * force unplug of the queue for that case.
-                 */
-                unplug_it = 0;
                 break;
 
         default:
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 2528a0c0dec8..65c6a3cba6d6 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -223,7 +223,7 @@ static int verify_command(struct file *file, unsigned char *cmd)
 static int sg_io(struct file *file, request_queue_t *q,
                 struct gendisk *bd_disk, struct sg_io_hdr *hdr)
 {
-        unsigned long start_time;
+        unsigned long start_time, timeout;
         int writing = 0, ret = 0;
         struct request *rq;
         char sense[SCSI_SENSE_BUFFERSIZE];
@@ -271,7 +271,8 @@ static int sg_io(struct file *file, request_queue_t *q,
 
         rq->cmd_type = REQ_TYPE_BLOCK_PC;
 
-        rq->timeout = jiffies_to_msecs(hdr->timeout);
+        timeout = msecs_to_jiffies(hdr->timeout);
+        rq->timeout = (timeout < INT_MAX) ? timeout : INT_MAX;
         if (!rq->timeout)
                 rq->timeout = q->sg_timeout;
         if (!rq->timeout)
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 5207f9e4b443..cbb6f0814ce2 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -322,10 +322,6 @@ static int acpi_processor_get_performance_info(struct acpi_processor *pr)
         if (result)
                 return result;
 
-        result = acpi_processor_get_platform_limit(pr);
-        if (result)
-                return result;
-
         return 0;
 }
 
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 36b37d755dbc..3d54680d0333 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1677,8 +1677,6 @@ static void acpi_video_device_notify(acpi_handle handle, u32 event, void *data)
         struct acpi_video_device *video_device = data;
         struct acpi_device *device = NULL;
 
-
-        printk("video device notify\n");
         if (!video_device)
                 return;
 
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index da21552d2b1c..1c94b43d2c9b 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -19,6 +19,10 @@ config ATA
 
 if ATA
 
+config ATA_NONSTANDARD
+       bool
+       default n
+
 config SATA_AHCI
         tristate "AHCI SATA support"
         depends on PCI
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index b517d2493551..48616c6fee9d 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -75,6 +75,7 @@ enum {
         AHCI_CMD_CLR_BUSY       = (1 << 10),
 
         RX_FIS_D2H_REG          = 0x40, /* offset of D2H Register FIS data */
+        RX_FIS_SDB              = 0x58, /* offset of SDB FIS data */
         RX_FIS_UNK              = 0x60, /* offset of Unknown FIS data */
 
         board_ahci              = 0,
@@ -202,6 +203,10 @@ struct ahci_port_priv {
         dma_addr_t              cmd_tbl_dma;
         void                    *rx_fis;
         dma_addr_t              rx_fis_dma;
+        /* for NCQ spurious interrupt analysis */
+        int                     ncq_saw_spurious_sdb_cnt;
+        unsigned int            ncq_saw_d2h:1;
+        unsigned int            ncq_saw_dmas:1;
 };
 
 static u32 ahci_scr_read (struct ata_port *ap, unsigned int sc_reg);
@@ -361,7 +366,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x27c1), board_ahci }, /* ICH7 */
         { PCI_VDEVICE(INTEL, 0x27c5), board_ahci }, /* ICH7M */
         { PCI_VDEVICE(INTEL, 0x27c3), board_ahci }, /* ICH7R */
-        { PCI_VDEVICE(AL, 0x5288), board_ahci }, /* ULi M5288 */
+        { PCI_VDEVICE(AL, 0x5288), board_ahci_ign_iferr }, /* ULi M5288 */
         { PCI_VDEVICE(INTEL, 0x2681), board_ahci }, /* ESB2 */
         { PCI_VDEVICE(INTEL, 0x2682), board_ahci }, /* ESB2 */
         { PCI_VDEVICE(INTEL, 0x2683), board_ahci }, /* ESB2 */
@@ -586,35 +591,18 @@ static void ahci_power_down(void __iomem *port_mmio, u32 cap)
 {
         u32 cmd, scontrol;
 
-        cmd = readl(port_mmio + PORT_CMD) & ~PORT_CMD_ICC_MASK;
-
-        if (cap & HOST_CAP_SSC) {
-                /* enable transitions to slumber mode */
-                scontrol = readl(port_mmio + PORT_SCR_CTL);
-                if ((scontrol & 0x0f00) > 0x100) {
-                        scontrol &= ~0xf00;
-                        writel(scontrol, port_mmio + PORT_SCR_CTL);
-                }
-
-                /* put device into slumber mode */
-                writel(cmd | PORT_CMD_ICC_SLUMBER, port_mmio + PORT_CMD);
-
-                /* wait for the transition to complete */
-                ata_wait_register(port_mmio + PORT_CMD, PORT_CMD_ICC_SLUMBER,
-                                  PORT_CMD_ICC_SLUMBER, 1, 50);
-        }
+        if (!(cap & HOST_CAP_SSS))
+                return;
 
-        /* put device into listen mode */
-        if (cap & HOST_CAP_SSS) {
-                /* first set PxSCTL.DET to 0 */
-                scontrol = readl(port_mmio + PORT_SCR_CTL);
-                scontrol &= ~0xf;
-                writel(scontrol, port_mmio + PORT_SCR_CTL);
+        /* put device into listen mode, first set PxSCTL.DET to 0 */
+        scontrol = readl(port_mmio + PORT_SCR_CTL);
+        scontrol &= ~0xf;
+        writel(scontrol, port_mmio + PORT_SCR_CTL);
 
-                /* then set PxCMD.SUD to 0 */
-                cmd &= ~PORT_CMD_SPIN_UP;
-                writel(cmd, port_mmio + PORT_CMD);
-        }
+        /* then set PxCMD.SUD to 0 */
+        cmd = readl(port_mmio + PORT_CMD) & ~PORT_CMD_ICC_MASK;
+        cmd &= ~PORT_CMD_SPIN_UP;
+        writel(cmd, port_mmio + PORT_CMD);
 }
 
 static void ahci_init_port(void __iomem *port_mmio, u32 cap,
@@ -915,7 +903,7 @@ static int ahci_hardreset(struct ata_port *ap, unsigned int *class)
 
         /* clear D2H reception area to properly wait for D2H FIS */
         ata_tf_init(ap->device, &tf);
-        tf.command = 0xff;
+        tf.command = 0x80;
         ata_tf_to_fis(&tf, d2h_fis, 0);
 
         rc = sata_std_hardreset(ap, class);
@@ -1126,8 +1114,9 @@ static void ahci_host_intr(struct ata_port *ap)
         void __iomem *mmio = ap->host->mmio_base;
         void __iomem *port_mmio = ahci_port_base(mmio, ap->port_no);
         struct ata_eh_info *ehi = &ap->eh_info;
+        struct ahci_port_priv *pp = ap->private_data;
         u32 status, qc_active;
-        int rc;
+        int rc, known_irq = 0;
 
         status = readl(port_mmio + PORT_IRQ_STAT);
         writel(status, port_mmio + PORT_IRQ_STAT);
@@ -1154,17 +1143,53 @@ static void ahci_host_intr(struct ata_port *ap)
 
         /* hmmm... a spurious interupt */
 
-        /* some devices send D2H reg with I bit set during NCQ command phase */
-        if (ap->sactive && (status & PORT_IRQ_D2H_REG_FIS))
+        /* if !NCQ, ignore.  No modern ATA device has broken HSM
+         * implementation for non-NCQ commands.
+         */
+        if (!ap->sactive)
                 return;
 
-        /* ignore interim PIO setup fis interrupts */
-        if (ata_tag_valid(ap->active_tag) && (status & PORT_IRQ_PIOS_FIS))
-                return;
+        if (status & PORT_IRQ_D2H_REG_FIS) {
+                if (!pp->ncq_saw_d2h)
+                        ata_port_printk(ap, KERN_INFO,
+                                "D2H reg with I during NCQ, "
+                                "this message won't be printed again\n");
+                pp->ncq_saw_d2h = 1;
+                known_irq = 1;
+        }
+
+        if (status & PORT_IRQ_DMAS_FIS) {
+                if (!pp->ncq_saw_dmas)
+                        ata_port_printk(ap, KERN_INFO,
+                                "DMAS FIS during NCQ, "
+                                "this message won't be printed again\n");
+                pp->ncq_saw_dmas = 1;
+                known_irq = 1;
+        }
+
+        if (status & PORT_IRQ_SDB_FIS &&
+                   pp->ncq_saw_spurious_sdb_cnt < 10) {
+                /* SDB FIS containing spurious completions might be
+                 * dangerous, we need to know more about them.  Print
+                 * more of it.
+                 */
+                const u32 *f = pp->rx_fis + RX_FIS_SDB;
+
+                ata_port_printk(ap, KERN_INFO, "Spurious SDB FIS during NCQ "
+                                "issue=0x%x SAct=0x%x FIS=%08x:%08x%s\n",
+                                readl(port_mmio + PORT_CMD_ISSUE),
+                                readl(port_mmio + PORT_SCR_ACT),
+                                le32_to_cpu(f[0]), le32_to_cpu(f[1]),
+                                pp->ncq_saw_spurious_sdb_cnt < 10 ?
+                                "" : ", shutting up");
+
+                pp->ncq_saw_spurious_sdb_cnt++;
+                known_irq = 1;
+        }
 
-        if (ata_ratelimit())
+        if (!known_irq)
                 ata_port_printk(ap, KERN_INFO, "spurious interrupt "
-                                "(irq_stat 0x%x active_tag %d sactive 0x%x)\n",
+                                "(irq_stat 0x%x active_tag 0x%x sactive 0x%x)\n",
                                 status, ap->active_tag, ap->sactive);
 }
 
@@ -1257,7 +1282,7 @@ static void ahci_thaw(struct ata_port *ap)
         /* clear IRQ */
         tmp = readl(port_mmio + PORT_IRQ_STAT);
         writel(tmp, port_mmio + PORT_IRQ_STAT);
-        writel(1 << ap->id, mmio + HOST_IRQ_STAT);
+        writel(1 << ap->port_no, mmio + HOST_IRQ_STAT);
 
         /* turn IRQ back on */
         writel(DEF_PORT_IRQ, port_mmio + PORT_IRQ_MASK);
diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
index 908751d27e76..24af56081b5d 100644
--- a/drivers/ata/ata_generic.c
+++ b/drivers/ata/ata_generic.c
@@ -64,6 +64,7 @@ static void generic_error_handler(struct ata_port *ap)
 /**
  *      generic_set_mode        -       mode setting
  *      @ap: interface to set up
+ *      @unused: returned device on error
  *
  *      Use a non standard set_mode function. We don't want to be tuned.
  *      The BIOS configured everything. Our job is not to fiddle. We
@@ -71,7 +72,7 @@ static void generic_error_handler(struct ata_port *ap)
  *      and respect them.
  */
 
-static void generic_set_mode(struct ata_port *ap)
+static int generic_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
         int dma_enabled = 0;
         int i;
@@ -82,7 +83,7 @@ static void generic_set_mode(struct ata_port *ap)
 
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
                 struct ata_device *dev = &ap->device[i];
-                if (ata_dev_enabled(dev)) {
+                if (ata_dev_ready(dev)) {
                         /* We don't really care */
                         dev->pio_mode = XFER_PIO_0;
                         dev->dma_mode = XFER_MW_DMA_0;
@@ -99,6 +100,7 @@ static void generic_set_mode(struct ata_port *ap)
                         }
                 }
         }
+        return 0;
 }
 
 static struct scsi_host_template generic_sht = {
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 0d51d13b16bf..667acd283364 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1037,7 +1037,7 @@ static unsigned int ata_id_xfermask(const u16 *id)
                  * the PIO timing number for the maximum. Turn it into
                  * a mask.
                  */
-                u8 mode = id[ATA_ID_OLD_PIO_MODES] & 0xFF;
+                u8 mode = (id[ATA_ID_OLD_PIO_MODES] >> 8) & 0xFF;
                 if (mode < 5)   /* Valid PIO range */
                         pio_mask = (2 << mode) - 1;
                 else
@@ -1250,6 +1250,7 @@ unsigned ata_exec_internal_sg(struct ata_device *dev,
 
                 ata_sg_init(qc, sg, n_elem);
                 qc->nsect = buflen / ATA_SECT_SIZE;
+                qc->nbytes = buflen;
         }
 
         qc->private_data = &wait;
@@ -2431,18 +2432,8 @@ int ata_set_mode(struct ata_port *ap, struct ata_device **r_failed_dev)
         int i, rc = 0, used_dma = 0, found = 0;
 
         /* has private set_mode? */
-        if (ap->ops->set_mode) {
-                /* FIXME: make ->set_mode handle no device case and
-                 * return error code and failing device on failure.
-                 */
-                for (i = 0; i < ATA_MAX_DEVICES; i++) {
-                        if (ata_dev_ready(&ap->device[i])) {
-                                ap->ops->set_mode(ap);
-                                break;
-                        }
-                }
-                return 0;
-        }
+        if (ap->ops->set_mode)
+                return ap->ops->set_mode(ap, r_failed_dev);
 
         /* step 1: calculate xfer_mask */
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 56cf59b60ec4..748435807d68 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1796,7 +1796,7 @@ static int ata_eh_suspend(struct ata_port *ap, struct ata_device **r_failed_dev)
                 *r_failed_dev = dev;
 
         DPRINTK("EXIT\n");
-        return 0;
+        return rc;
 }
 
 /**
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 836947da5b14..73902d335767 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -273,8 +273,8 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
 {
         int rc = 0;
         u8 scsi_cmd[MAX_COMMAND_SIZE];
-        u8 args[7];
-        struct scsi_sense_hdr sshdr;
+        u8 args[7], *sensebuf = NULL;
+        int cmd_result;
 
         if (arg == NULL)
                 return -EINVAL;
@@ -282,10 +282,14 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
         if (copy_from_user(args, arg, sizeof(args)))
                 return -EFAULT;
 
+        sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);
+        if (!sensebuf)
+                return -ENOMEM;
+
         memset(scsi_cmd, 0, sizeof(scsi_cmd));
         scsi_cmd[0]  = ATA_16;
         scsi_cmd[1]  = (3 << 1); /* Non-data */
-        /* scsi_cmd[2] is already 0 -- no off.line, cc, or data xfer */
+        scsi_cmd[2]  = 0x20;     /* cc but no off.line or data xfer */
         scsi_cmd[4]  = args[1];
         scsi_cmd[6]  = args[2];
         scsi_cmd[8]  = args[3];
@@ -295,11 +299,46 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
 
         /* Good values for timeout and retries?  Values below
            from scsi_ioctl_send_command() for default case... */
-        if (scsi_execute_req(scsidev, scsi_cmd, DMA_NONE, NULL, 0, &sshdr,
-                             (10*HZ), 5))
+        cmd_result = scsi_execute(scsidev, scsi_cmd, DMA_NONE, NULL, 0,
+                                sensebuf, (10*HZ), 5, 0);
+
+        if (driver_byte(cmd_result) == DRIVER_SENSE) {/* sense data available */
+                u8 *desc = sensebuf + 8;
+                cmd_result &= ~(0xFF<<24); /* DRIVER_SENSE is not an error */
+
+                /* If we set cc then ATA pass-through will cause a
+                 * check condition even if no error. Filter that. */
+                if (cmd_result & SAM_STAT_CHECK_CONDITION) {
+                        struct scsi_sense_hdr sshdr;
+                        scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
+                                                &sshdr);
+                        if (sshdr.sense_key==0 &&
+                                sshdr.asc==0 && sshdr.ascq==0)
+                                cmd_result &= ~SAM_STAT_CHECK_CONDITION;
+                }
+
+                /* Send userspace ATA registers */
+                if (sensebuf[0] == 0x72 &&      /* format is "descriptor" */
+                                desc[0] == 0x09) {/* code is "ATA Descriptor" */
+                        args[0] = desc[13];     /* status */
+                        args[1] = desc[3];      /* error */
+                        args[2] = desc[5];      /* sector count (0:7) */
+                        args[3] = desc[7];      /* lbal */
+                        args[4] = desc[9];      /* lbam */
+                        args[5] = desc[11];     /* lbah */
+                        args[6] = desc[12];     /* select */
+                        if (copy_to_user(arg, args, sizeof(args)))
+                                rc = -EFAULT;
+                }
+        }
+
+        if (cmd_result) {
                 rc = -EIO;
+                goto error;
+        }
 
-        /* Need code to retrieve data from check condition? */
+ error:
+        kfree(sensebuf);
         return rc;
 }
 
@@ -372,7 +411,7 @@ struct ata_queued_cmd *ata_scsi_qc_new(struct ata_device *dev,
                 if (cmd->use_sg) {
                         qc->__sg = (struct scatterlist *) cmd->request_buffer;
                         qc->n_elem = cmd->use_sg;
-                } else {
+                } else if (cmd->request_bufflen) {
                         qc->__sg = &qc->sgent;
                         qc->n_elem = 1;
                 }
@@ -983,11 +1022,10 @@ static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc)
                 }
 
                 tf->command = ATA_CMD_VERIFY;   /* READ VERIFY */
-        } else {
-                tf->nsect = 0;  /* time period value (0 implies now) */
-                tf->command = ATA_CMD_STANDBY;
-                /* Consider: ATA STANDBY IMMEDIATE command */
-        }
+        } else
+                /* Issue ATA STANDBY IMMEDIATE command */
+                tf->command = ATA_CMD_STANDBYNOW1;
+
         /*
          * Standby and Idle condition timers could be implemented but that
          * would require libata to implement the Power condition mode page
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 623cec914c9b..12c88c588039 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -827,7 +827,8 @@ void ata_bmdma_error_handler(struct ata_port *ap)
  */
 void ata_bmdma_post_internal_cmd(struct ata_queued_cmd *qc)
 {
-        ata_bmdma_stop(qc);
+        if (qc->ap->ioaddr.bmdma_addr)
+                ata_bmdma_stop(qc);
 }
 
 #ifdef CONFIG_PCI
@@ -870,7 +871,8 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int
                         pci_resource_start(pdev, 1) | ATA_PCI_CTL_OFS;
                 bmdma = pci_resource_start(pdev, 4);
                 if (bmdma) {
-                        if (inb(bmdma + 2) & 0x80)
+                        if ((!(port[p]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 2) & 0x80))
                                 probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                         probe_ent->port[p].bmdma_addr = bmdma;
                 }
@@ -886,7 +888,8 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int
                 bmdma = pci_resource_start(pdev, 4);
                 if (bmdma) {
                         bmdma += 8;
-                        if(inb(bmdma + 2) & 0x80)
+                        if ((!(port[p]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 2) & 0x80))
                                 probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                         probe_ent->port[p].bmdma_addr = bmdma;
                 }
@@ -914,13 +917,14 @@ static struct ata_probe_ent *ata_pci_init_legacy_port(struct pci_dev *pdev,
         probe_ent->irq_flags = IRQF_SHARED;
 
         if (port_mask & ATA_PORT_PRIMARY) {
-                probe_ent->irq = ATA_PRIMARY_IRQ;
+                probe_ent->irq = ATA_PRIMARY_IRQ(pdev);
                 probe_ent->port[0].cmd_addr = ATA_PRIMARY_CMD;
                 probe_ent->port[0].altstatus_addr =
                 probe_ent->port[0].ctl_addr = ATA_PRIMARY_CTL;
                 if (bmdma) {
                         probe_ent->port[0].bmdma_addr = bmdma;
-                        if (inb(bmdma + 2) & 0x80)
+                        if ((!(port[0]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 2) & 0x80))
                                 probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                 }
                 ata_std_ports(&probe_ent->port[0]);
@@ -929,15 +933,16 @@ static struct ata_probe_ent *ata_pci_init_legacy_port(struct pci_dev *pdev,
 
         if (port_mask & ATA_PORT_SECONDARY) {
                 if (probe_ent->irq)
-                        probe_ent->irq2 = ATA_SECONDARY_IRQ;
+                        probe_ent->irq2 = ATA_SECONDARY_IRQ(pdev);
                 else
-                        probe_ent->irq = ATA_SECONDARY_IRQ;
+                        probe_ent->irq = ATA_SECONDARY_IRQ(pdev);
                 probe_ent->port[1].cmd_addr = ATA_SECONDARY_CMD;
                 probe_ent->port[1].altstatus_addr =
                 probe_ent->port[1].ctl_addr = ATA_SECONDARY_CTL;
                 if (bmdma) {
                         probe_ent->port[1].bmdma_addr = bmdma + 8;
-                        if (inb(bmdma + 10) & 0x80)
+                        if ((!(port[1]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 10) & 0x80))
                                 probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                 }
                 ata_std_ports(&probe_ent->port[1]);
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index 6f6672c55131..504e1dbfffd7 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -36,15 +36,22 @@ enum {
 static int atiixp_pre_reset(struct ata_port *ap)
 {
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
-        static struct pci_bits atiixp_enable_bits[] = {
+        static const struct pci_bits atiixp_enable_bits[] = {
                 { 0x48, 1, 0x01, 0x00 },
                 { 0x48, 1, 0x08, 0x00 }
         };
+        u8 udma;
 
         if (!pci_test_config_bits(pdev, &atiixp_enable_bits[ap->port_no]))
                 return -ENOENT;
 
-        ap->cbl = ATA_CBL_PATA80;
+        /* Hack from drivers/ide/pci. Really we want to know how to do the
+           raw detection not play follow the bios mode guess */
+        pci_read_config_byte(pdev, ATIIXP_IDE_UDMA_MODE + ap->port_no, &udma);
+        if ((udma & 0x07) >= 0x04 || (udma & 0x70) >= 0x40)
+                ap->cbl = ATA_CBL_PATA80;
+        else
+                ap->cbl = ATA_CBL_PATA40;
         return ata_std_prereset(ap);
 }
 
diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c
index 15841a563694..449162cbf93e 100644
--- a/drivers/ata/pata_cmd64x.c
+++ b/drivers/ata/pata_cmd64x.c
@@ -197,7 +197,7 @@ static void cmd64x_set_piomode(struct ata_port *ap, struct ata_device *adev)
 static void cmd64x_set_dmamode(struct ata_port *ap, struct ata_device *adev)
 {
         static const u8 udma_data[] = {
-                0x31, 0x21, 0x11, 0x25, 0x15, 0x05
+                0x30, 0x20, 0x10, 0x20, 0x10, 0x00
         };
         static const u8 mwdma_data[] = {
                 0x30, 0x20, 0x10
@@ -213,12 +213,21 @@ static void cmd64x_set_dmamode(struct ata_port *ap, struct ata_device *adev)
         pci_read_config_byte(pdev, pciD, &regD);
         pci_read_config_byte(pdev, pciU, &regU);
 
-        regD &= ~(0x20 << shift);
-        regU &= ~(0x35 << shift);
+        /* DMA bits off */
+        regD &= ~(0x20 << adev->devno);
+        /* DMA control bits */
+        regU &= ~(0x30 << shift);
+        /* DMA timing bits */
+        regU &= ~(0x05 << adev->devno);
 
-        if (adev->dma_mode >= XFER_UDMA_0)
+        if (adev->dma_mode >= XFER_UDMA_0) {
+                /* Merge thge timing value */
                 regU |= udma_data[adev->dma_mode - XFER_UDMA_0] << shift;
-        else
+                /* Merge the control bits */
+                regU |= 1 << adev->devno; /* UDMA on */
+                if (adev->dma_mode > 2) /* 15nS timing */
+                        regU |= 4 << adev->devno;
+        } else
                 regD |= mwdma_data[adev->dma_mode - XFER_MW_DMA_0] << shift;
 
         regD |= 0x20 << adev->devno;
@@ -239,8 +248,8 @@ static void cmd648_bmdma_stop(struct ata_queued_cmd *qc)
         struct ata_port *ap = qc->ap;
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
         u8 dma_intr;
-        int dma_reg = ap->port_no ? ARTTIM23_INTR_CH1 : CFR_INTR_CH0;
-        int dma_mask = ap->port_no ? ARTTIM2 : CFR;
+        int dma_mask = ap->port_no ? ARTTIM23_INTR_CH1 : CFR_INTR_CH0;
+        int dma_reg = ap->port_no ? ARTTIM2 : CFR;
 
         ata_bmdma_stop(qc);
 
diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
index f6817b4093a4..886fab9aa62c 100644
--- a/drivers/ata/pata_hpt3x2n.c
+++ b/drivers/ata/pata_hpt3x2n.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt3x2n"
-#define DRV_VERSION     "0.3"
+#define DRV_VERSION     "0.3.2"
 
 enum {
         HPT_PCI_FAST    =       (1 << 31),
@@ -297,11 +297,11 @@ static int hpt3x2n_pair_idle(struct ata_port *ap)
         return 0;
 }
 
-static int hpt3x2n_use_dpll(struct ata_port *ap, int reading)
+static int hpt3x2n_use_dpll(struct ata_port *ap, int writing)
 {
         long flags = (long)ap->host->private_data;
         /* See if we should use the DPLL */
-        if (reading == 0)
+        if (writing)
                 return USE_DPLL;        /* Needed for write */
         if (flags & PCI66)
                 return USE_DPLL;        /* Needed at 66Mhz */
diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
index 0b56ff3d1cfe..e8afd486434a 100644
--- a/drivers/ata/pata_it821x.c
+++ b/drivers/ata/pata_it821x.c
@@ -476,6 +476,7 @@ static unsigned int it821x_passthru_qc_issue_prot(struct ata_queued_cmd *qc)
 /**
  *      it821x_smart_set_mode   -       mode setting
  *      @ap: interface to set up
+ *      @unused: device that failed (error only)
  *
  *      Use a non standard set_mode function. We don't want to be tuned.
  *      The BIOS configured everything. Our job is not to fiddle. We
@@ -483,7 +484,7 @@ static unsigned int it821x_passthru_qc_issue_prot(struct ata_queued_cmd *qc)
  *      and respect them.
  */
 
-static void it821x_smart_set_mode(struct ata_port *ap)
+static int it821x_smart_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
         int dma_enabled = 0;
         int i;
@@ -512,6 +513,7 @@ static void it821x_smart_set_mode(struct ata_port *ap)
                         }
                 }
         }
+        return 0;
 }
 
 /**
diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
index cb8924109f59..23b8aab3ebd8 100644
--- a/drivers/ata/pata_ixp4xx_cf.c
+++ b/drivers/ata/pata_ixp4xx_cf.c
@@ -23,9 +23,9 @@
 #include <scsi/scsi_host.h>
 
 #define DRV_NAME        "pata_ixp4xx_cf"
-#define DRV_VERSION     "0.1.1"
+#define DRV_VERSION     "0.1.1ac1"
 
-static void ixp4xx_set_mode(struct ata_port *ap)
+static int ixp4xx_set_mode(struct ata_port *ap, struct ata_device *adev)
 {
         int i;
 
@@ -38,6 +38,7 @@ static void ixp4xx_set_mode(struct ata_port *ap)
                         dev->flags |= ATA_DFLAG_PIO;
                 }
         }
+        return 0;
 }
 
 static void ixp4xx_phy_reset(struct ata_port *ap)
diff --git a/drivers/ata/pata_jmicron.c b/drivers/ata/pata_jmicron.c
index 2d661cb4df3c..d50264af2848 100644
--- a/drivers/ata/pata_jmicron.c
+++ b/drivers/ata/pata_jmicron.c
@@ -204,20 +204,12 @@ static int jmicron_init_one (struct pci_dev *pdev, const struct pci_device_id *i
 
         u32 reg;
 
-        if (id->driver_data != 368) {
-                /* Put the controller into AHCI mode in case the AHCI driver
-                   has not yet been loaded. This can be done with either
-                   function present */
+        /* PATA controller is fn 1, AHCI is fn 0 */
+        if (id->driver_data != 368 && PCI_FUNC(pdev->devfn) != 1)
+                return -ENODEV;
 
-                /* FIXME: We may want a way to override this in future */
-                pci_write_config_byte(pdev, 0x41, 0xa1);
-
-                /* PATA controller is fn 1, AHCI is fn 0 */
-                if (PCI_FUNC(pdev->devfn) != 1)
-                        return -ENODEV;
-        }
-        if ( id->driver_data == 365 || id->driver_data == 366) {
-                /* The 365/66 have two PATA channels, redirect the second */
+        /* The 365/66 have two PATA channels, redirect the second */
+        if (id->driver_data == 365 || id->driver_data == 366) {
                 pci_read_config_dword(pdev, 0x80, &reg);
                 reg |= (1 << 24);       /* IDE1 to PATA IDE secondary */
                 pci_write_config_dword(pdev, 0x80, reg);
diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index e7bf9d89c8ee..581cb33c6f45 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -96,6 +96,7 @@ static int pio_mask = 0x1F;		/* PIO range for autospeed devices */
 /**
  *      legacy_set_mode         -       mode setting
  *      @ap: IDE interface
+ *      @unused: Device that failed when error is returned
  *
  *      Use a non standard set_mode function. We don't want to be tuned.
  *
@@ -105,7 +106,7 @@ static int pio_mask = 0x1F;		/* PIO range for autospeed devices */
  *      expand on this as per hdparm in the base kernel.
  */
 
-static void legacy_set_mode(struct ata_port *ap)
+static int legacy_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
         int i;
 
@@ -118,6 +119,7 @@ static void legacy_set_mode(struct ata_port *ap)
                         dev->flags |= ATA_DFLAG_PIO;
                 }
         }
+        return 0;
 }
 
 static struct scsi_host_template legacy_sht = {
diff --git a/drivers/ata/pata_platform.c b/drivers/ata/pata_platform.c
index 443b1d85c6c4..40ae11cbfda4 100644
--- a/drivers/ata/pata_platform.c
+++ b/drivers/ata/pata_platform.c
@@ -30,7 +30,7 @@ static int pio_mask = 1;
  * Provide our own set_mode() as we don't want to change anything that has
  * already been configured..
  */
-static void pata_platform_set_mode(struct ata_port *ap)
+static int pata_platform_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
         int i;
 
@@ -44,6 +44,7 @@ static void pata_platform_set_mode(struct ata_port *ap)
                         dev->flags |= ATA_DFLAG_PIO;
                 }
         }
+        return 0;
 }
 
 static void pata_platform_host_stop(struct ata_host *host)
diff --git a/drivers/ata/pata_rz1000.c b/drivers/ata/pata_rz1000.c
index adf4cc134f25..cec0729225e1 100644
--- a/drivers/ata/pata_rz1000.c
+++ b/drivers/ata/pata_rz1000.c
@@ -52,19 +52,20 @@ static void rz1000_error_handler(struct ata_port *ap)
 /**
  *      rz1000_set_mode         -       mode setting function
  *      @ap: ATA interface
+ *      @unused: returned device on set_mode failure
  *
  *      Use a non standard set_mode function. We don't want to be tuned. We
  *      would prefer to be BIOS generic but for the fact our hardware is
  *      whacked out.
  */
 
-static void rz1000_set_mode(struct ata_port *ap)
+static int rz1000_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
         int i;
 
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
                 struct ata_device *dev = &ap->device[i];
-                if (ata_dev_enabled(dev)) {
+                if (ata_dev_ready(dev)) {
                         /* We don't really care */
                         dev->pio_mode = XFER_PIO_0;
                         dev->xfer_mode = XFER_PIO_0;
@@ -72,6 +73,7 @@ static void rz1000_set_mode(struct ata_port *ap)
                         dev->flags |= ATA_DFLAG_PIO;
                 }
         }
+        return 0;
 }
 
 
diff --git a/drivers/ata/pata_sil680.c b/drivers/ata/pata_sil680.c
index 32cf0bfa8921..e8dfd8fc3ff7 100644
--- a/drivers/ata/pata_sil680.c
+++ b/drivers/ata/pata_sil680.c
@@ -135,7 +135,7 @@ static void sil680_error_handler(struct ata_port *ap)
 static void sil680_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
         static u16 speed_p[5] = { 0x328A, 0x2283, 0x1104, 0x10C3, 0x10C1 };
-        static u16 speed_t[5] = { 0x328A, 0x1281, 0x1281, 0x10C3, 0x10C1 };
+        static u16 speed_t[5] = { 0x328A, 0x2283, 0x1281, 0x10C3, 0x10C1 };
 
         unsigned long tfaddr = sil680_selreg(ap, 0x02);
         unsigned long addr = sil680_seldev(ap, adev, 0x04);
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index f0d4f7e9ed31..f0b6c3b71429 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -23,6 +23,7 @@
  *      VIA VT8233c     -       UDMA100
  *      VIA VT8235      -       UDMA133
  *      VIA VT8237      -       UDMA133
+ *      VIA VT8237S     -       UDMA133
  *      VIA VT8251      -       UDMA133
  *
  *      Most registers remain compatible across chips. Others start reserved
@@ -61,7 +62,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME "pata_via"
-#define DRV_VERSION "0.2.0"
+#define DRV_VERSION "0.2.1"
 
 /*
  *      The following comes directly from Vojtech Pavlik's ide/pci/via82cxxx
@@ -95,6 +96,7 @@ static const struct via_isa_bridge {
         u8 rev_max;
         u16 flags;
 } via_isa_bridges[] = {
+        { "vt8237s",    PCI_DEVICE_ID_VIA_8237S,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8251",     PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "cx700",      PCI_DEVICE_ID_VIA_CX700,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES},
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index f6d498e1cf80..f7a963eb1f02 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -700,7 +700,6 @@ static void nv_adma_check_cpb(struct ata_port *ap, int cpb_num, int force_err)
 static int nv_host_intr(struct ata_port *ap, u8 irq_stat)
 {
         struct ata_queued_cmd *qc = ata_qc_from_tag(ap, ap->active_tag);
-        int handled;
 
         /* freeze if hotplugged */
         if (unlikely(irq_stat & (NV_INT_ADDED | NV_INT_REMOVED))) {
@@ -719,13 +718,7 @@ static int nv_host_intr(struct ata_port *ap, u8 irq_stat)
         }
 
         /* handle interrupt */
-        handled = ata_host_intr(ap, qc);
-        if (unlikely(!handled)) {
-                /* spurious, clear it */
-                ata_check_status(ap);
-        }
-
-        return 1;
+        return ata_host_intr(ap, qc);
 }
 
 static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
@@ -752,6 +745,11 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
                         if (pp->flags & NV_ADMA_PORT_REGISTER_MODE) {
                                 u8 irq_stat = readb(host->mmio_base + NV_INT_STATUS_CK804)
                                         >> (NV_INT_PORT_SHIFT * i);
+                                if(ata_tag_valid(ap->active_tag))
+                                        /** NV_INT_DEV indication seems unreliable at times
+                                            at least in ADMA mode. Force it on always when a
+                                            command is active, to prevent losing interrupts. */
+                                        irq_stat |= NV_INT_DEV;
                                 handled += nv_host_intr(ap, irq_stat);
                                 continue;
                         }
diff --git a/drivers/ata/sata_uli.c b/drivers/ata/sata_uli.c
index 5c603ca3a50a..a43aec62d505 100644
--- a/drivers/ata/sata_uli.c
+++ b/drivers/ata/sata_uli.c
@@ -128,7 +128,8 @@ static const struct ata_port_operations uli_ops = {
 
 static struct ata_port_info uli_port_info = {
         .sht            = &uli_sht,
-        .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
+        .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                          ATA_FLAG_IGN_SIMPLEX,
         .pio_mask       = 0x1f,         /* pio0-4 */
         .udma_mask      = 0x7f,         /* udma0-6 */
         .port_ops       = &uli_ops,
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 88f0565c8883..d3d5c0d57032 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -74,6 +74,7 @@ enum {
 static int svia_init_one (struct pci_dev *pdev, const struct pci_device_id *ent);
 static u32 svia_scr_read (struct ata_port *ap, unsigned int sc_reg);
 static void svia_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val);
+static void svia_noop_freeze(struct ata_port *ap);
 static void vt6420_error_handler(struct ata_port *ap);
 
 static const struct pci_device_id svia_pci_tbl[] = {
@@ -128,7 +129,7 @@ static const struct ata_port_operations vt6420_sata_ops = {
         .qc_issue               = ata_qc_issue_prot,
         .data_xfer              = ata_pio_data_xfer,
 
-        .freeze                 = ata_bmdma_freeze,
+        .freeze                 = svia_noop_freeze,
         .thaw                   = ata_bmdma_thaw,
         .error_handler          = vt6420_error_handler,
         .post_internal_cmd      = ata_bmdma_post_internal_cmd,
@@ -204,6 +205,15 @@ static void svia_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val)
         outl(val, ap->ioaddr.scr_addr + (4 * sc_reg));
 }
 
+static void svia_noop_freeze(struct ata_port *ap)
+{
+        /* Some VIA controllers choke if ATA_NIEN is manipulated in
+         * certain way.  Leave it alone and just clear pending IRQ.
+         */
+        ata_chk_status(ap);
+        ata_bmdma_irq_clear(ap);
+}
+
 /**
  *      vt6420_prereset - prereset for vt6420
  *      @ap: target ATA port
diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 4dc10105d610..f96446c358ba 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -1845,7 +1845,7 @@ static u16 __devinit read_bia (const hrz_dev * dev, u16 addr)
 
 /********** initialise a card **********/
 
-static int __init hrz_init (hrz_dev * dev) {
+static int __devinit hrz_init (hrz_dev * dev) {
   int onefivefive;
   
   u16 chan;
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index 51d0d562d01e..c85c8cadb6df 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -101,6 +101,11 @@ static int amd_create_gatt_pages(int nr_tables)
         for (i = 0; i < nr_tables; i++) {
                 entry = kzalloc(sizeof(struct amd_page_map), GFP_KERNEL);
                 if (entry == NULL) {
+                        while (i > 0) {
+                                kfree(tables[i-1]);
+                                i--;
+                        }
+                        kfree(tables);
                         retval = -ENOMEM;
                         break;
                 }
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 979300405c0e..93d2209fee4c 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -655,7 +655,7 @@ static struct pci_device_id agp_amd64_pci_table[] = {
         .class          = (PCI_CLASS_BRIDGE_HOST << 8),
         .class_mask     = ~0,
         .vendor         = PCI_VENDOR_ID_VIA,
-        .device         = PCI_DEVICE_ID_VIA_K8M890CE,
+        .device         = PCI_DEVICE_ID_VIA_VT3336,
         .subvendor      = PCI_ANY_ID,
         .subdevice      = PCI_ANY_ID,
         },
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index f244c6682738..9987dc2e0c3f 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -41,18 +41,18 @@ static struct gatt_mask ati_generic_masks[] =
 };
 
 
-typedef struct _ati_page_map {
+struct ati_page_map {
         unsigned long *real;
         unsigned long __iomem *remapped;
-} ati_page_map;
+};
 
 static struct _ati_generic_private {
         volatile u8 __iomem *registers;
-        ati_page_map **gatt_pages;
+        struct ati_page_map **gatt_pages;
         int num_tables;
 } ati_generic_private;
 
-static int ati_create_page_map(ati_page_map *page_map)
+static int ati_create_page_map(struct ati_page_map *page_map)
 {
         int i, err = 0;
 
@@ -82,7 +82,7 @@ static int ati_create_page_map(ati_page_map *page_map)
 }
 
 
-static void ati_free_page_map(ati_page_map *page_map)
+static void ati_free_page_map(struct ati_page_map *page_map)
 {
         unmap_page_from_agp(virt_to_page(page_map->real));
         iounmap(page_map->remapped);
@@ -94,8 +94,8 @@ static void ati_free_page_map(ati_page_map *page_map)
 static void ati_free_gatt_pages(void)
 {
         int i;
-        ati_page_map **tables;
-        ati_page_map *entry;
+        struct ati_page_map **tables;
+        struct ati_page_map *entry;
 
         tables = ati_generic_private.gatt_pages;
         for (i = 0; i < ati_generic_private.num_tables; i++) {
@@ -112,30 +112,30 @@ static void ati_free_gatt_pages(void)
 
 static int ati_create_gatt_pages(int nr_tables)
 {
-        ati_page_map **tables;
-        ati_page_map *entry;
+        struct ati_page_map **tables;
+        struct ati_page_map *entry;
         int retval = 0;
         int i;
 
-        tables = kzalloc((nr_tables + 1) * sizeof(ati_page_map *),GFP_KERNEL);
+        tables = kzalloc((nr_tables + 1) * sizeof(struct ati_page_map *),GFP_KERNEL);
         if (tables == NULL)
                 return -ENOMEM;
 
         for (i = 0; i < nr_tables; i++) {
-                entry = kzalloc(sizeof(ati_page_map), GFP_KERNEL);
+                entry = kzalloc(sizeof(struct ati_page_map), GFP_KERNEL);
                 if (entry == NULL) {
-                        while (i>0) {
-                                kfree (tables[i-1]);
+                        while (i > 0) {
+                                kfree(tables[i-1]);
                                 i--;
                         }
-                        kfree (tables);
-                        tables = NULL;
+                        kfree(tables);
                         retval = -ENOMEM;
                         break;
                 }
                 tables[i] = entry;
                 retval = ati_create_page_map(entry);
-                if (retval != 0) break;
+                if (retval != 0)
+                        break;
         }
         ati_generic_private.num_tables = nr_tables;
         ati_generic_private.gatt_pages = tables;
@@ -340,7 +340,7 @@ static int ati_remove_memory(struct agp_memory * mem, off_t pg_start,
 static int ati_create_gatt_table(struct agp_bridge_data *bridge)
 {
         struct aper_size_info_lvl2 *value;
-        ati_page_map page_dir;
+        struct ati_page_map page_dir;
         unsigned long addr;
         int retval;
         u32 temp;
@@ -400,7 +400,7 @@ static int ati_create_gatt_table(struct agp_bridge_data *bridge)
 
 static int ati_free_gatt_table(struct agp_bridge_data *bridge)
 {
-        ati_page_map page_dir;
+        struct ati_page_map page_dir;
 
         page_dir.real = (unsigned long *)agp_bridge->gatt_table_real;
         page_dir.remapped = (unsigned long __iomem *)agp_bridge->gatt_table;
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index ab0a9c0ad7c0..a3011de51f7c 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -1955,6 +1955,15 @@ static int agp_intel_resume(struct pci_dev *pdev)
 
         pci_restore_state(pdev);
 
+        /* We should restore our graphics device's config space,
+         * as host bridge (00:00) resumes before graphics device (02:00),
+         * then our access to its pci space can work right.
+         */
+        if (intel_i810_private.i810_dev)
+                pci_restore_state(intel_i810_private.i810_dev);
+        if (intel_i830_private.i830_dev)
+                pci_restore_state(intel_i830_private.i830_dev);
+
         if (bridge->driver == &intel_generic_driver)
                 intel_configure();
         else if (bridge->driver == &intel_850_driver)
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index c149ac9ce9a7..2ded7a280d7f 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -380,9 +380,23 @@ static struct agp_device_ids via_agp_device_ids[] __devinitdata =
         /* P4M800CE */
         {
                 .device_id      = PCI_DEVICE_ID_VIA_P4M800CE,
-                .chipset_name   = "P4M800CE",
+                .chipset_name   = "VT3314",
+        },
+        /* CX700 */
+        {
+                .device_id  = PCI_DEVICE_ID_VIA_CX700,
+                .chipset_name   = "CX700",
+        },
+        /* VT3336 */
+        {
+                .device_id  = PCI_DEVICE_ID_VIA_VT3336,
+                .chipset_name   = "VT3336",
+        },
+        /* P4M890 */
+        {
+                .device_id  = PCI_DEVICE_ID_VIA_P4M890,
+                .chipset_name   = "P4M890",
         },
-
         { }, /* dummy final entry, always present */
 };
 
@@ -524,6 +538,9 @@ static const struct pci_device_id agp_via_pci_table[] = {
         ID(PCI_DEVICE_ID_VIA_83_87XX_1),
         ID(PCI_DEVICE_ID_VIA_3296_0),
         ID(PCI_DEVICE_ID_VIA_P4M800CE),
+        ID(PCI_DEVICE_ID_VIA_CX700),
+        ID(PCI_DEVICE_ID_VIA_VT3336),
+        ID(PCI_DEVICE_ID_VIA_P4M890),
         { }
 };
 
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 4e4691a53890..53582b53da95 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3649,8 +3649,6 @@ static void ipmi_timeout_handler(long timeout_period)
         unsigned long        flags;
         int                  i;
 
-        INIT_LIST_HEAD(&timeouts);
-
         rcu_read_lock();
         list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
                 /* See if any waiting messages need to be processed. */
@@ -3671,6 +3669,7 @@ static void ipmi_timeout_handler(long timeout_period)
                 /* Go through the seq table and find any messages that
                    have timed out, putting them in the timeouts
                    list. */
+                INIT_LIST_HEAD(&timeouts);
                 spin_lock_irqsave(&intf->seq_lock, flags);
                 for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
                         check_msg_timeout(intf, &(intf->seq_table[i]),
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 13935235e066..7fd3cd5ddf21 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -215,7 +215,7 @@ static void sysrq_handle_showstate_blocked(int key, struct tty_struct *tty)
 }
 static struct sysrq_key_op sysrq_showstate_blocked_op = {
         .handler        = sysrq_handle_showstate_blocked,
-        .help_msg       = "showBlockedTasks",
+        .help_msg       = "shoW-blocked-tasks",
         .action_msg     = "Show Blocked State",
         .enable_mask    = SYSRQ_ENABLE_DUMP,
 };
@@ -315,15 +315,16 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_loglevel_op,             /* 9 */
 
         /*
-         * Don't use for system provided sysrqs, it is handled specially on
-         * sparc and will never arrive
+         * a: Don't use for system provided sysrqs, it is handled specially on
+         * sparc and will never arrive.
          */
         NULL,                           /* a */
         &sysrq_reboot_op,               /* b */
-        &sysrq_crashdump_op,            /* c */
+        &sysrq_crashdump_op,            /* c & ibm_emac driver debug */
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
+        /* g: May be registered by ppc for kgdb */
         NULL,                           /* g */
         NULL,                           /* h */
         &sysrq_kill_op,                 /* i */
@@ -332,18 +333,19 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         NULL,                           /* l */
         &sysrq_showmem_op,              /* m */
         &sysrq_unrt_op,                 /* n */
-        /* This will often be registered as 'Off' at init time */
+        /* o: This will often be registered as 'Off' at init time */
         NULL,                           /* o */
         &sysrq_showregs_op,             /* p */
         NULL,                           /* q */
-        &sysrq_unraw_op,                        /* r */
+        &sysrq_unraw_op,                /* r */
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
         &sysrq_mountro_op,              /* u */
-        /* May be assigned at init time by SMP VOYAGER */
+        /* v: May be registered at init time by SMP VOYAGER */
         NULL,                           /* v */
-        NULL,                           /* w */
-        &sysrq_showstate_blocked_op,    /* x */
+        &sysrq_showstate_blocked_op,    /* w */
+        /* x: May be registered on ppc/powerpc for xmon */
+        NULL,                           /* x */
         NULL,                           /* y */
         NULL                            /* z */
 };
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 448d5083c381..4fac2bdf6215 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -186,6 +186,7 @@ static int got_event;		/* if events processing have been done */
 static void switchover_timeout(unsigned long data);
 static struct timer_list switchover_timer =
         TIMER_INITIALIZER(switchover_timeout , 0, 0);
+static unsigned long tlclk_timer_data;
 
 static struct tlclk_alarms *alarm_events;
 
@@ -197,10 +198,19 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id);
 
 static DECLARE_WAIT_QUEUE_HEAD(wq);
 
+static unsigned long useflags;
+static DEFINE_MUTEX(tlclk_mutex);
+
 static int tlclk_open(struct inode *inode, struct file *filp)
 {
         int result;
 
+        if (test_and_set_bit(0, &useflags))
+                return -EBUSY;
+                /* this legacy device is always one per system and it doesn't
+                 * know how to handle multiple concurrent clients.
+                 */
+
         /* Make sure there is no interrupt pending while
          * initialising interrupt handler */
         inb(TLCLK_REG6);
@@ -221,6 +231,7 @@ static int tlclk_open(struct inode *inode, struct file *filp)
 static int tlclk_release(struct inode *inode, struct file *filp)
 {
         free_irq(telclk_interrupt, tlclk_interrupt);
+        clear_bit(0, &useflags);
 
         return 0;
 }
@@ -230,26 +241,25 @@ static ssize_t tlclk_read(struct file *filp, char __user *buf, size_t count,
 {
         if (count < sizeof(struct tlclk_alarms))
                 return -EIO;
+        if (mutex_lock_interruptible(&tlclk_mutex))
+                return -EINTR;
+
 
         wait_event_interruptible(wq, got_event);
-        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms)))
+        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms))) {
+                mutex_unlock(&tlclk_mutex);
                 return -EFAULT;
+        }
 
         memset(alarm_events, 0, sizeof(struct tlclk_alarms));
         got_event = 0;
 
+        mutex_unlock(&tlclk_mutex);
         return  sizeof(struct tlclk_alarms);
 }
 
-static ssize_t tlclk_write(struct file *filp, const char __user *buf, size_t count,
-            loff_t *f_pos)
-{
-        return 0;
-}
-
 static const struct file_operations tlclk_fops = {
         .read = tlclk_read,
-        .write = tlclk_write,
         .open = tlclk_open,
         .release = tlclk_release,
 
@@ -540,7 +550,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                         SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
                         switch (val) {
                         case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
                                 break;
                         case CLK_11_184MHz:
                                 SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
@@ -549,7 +559,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                                 SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
                                 break;
                         case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
                                 break;
                         }
                 } else
@@ -839,11 +849,13 @@ static void __exit tlclk_cleanup(void)
 
 static void switchover_timeout(unsigned long data)
 {
-        if ((data & 1)) {
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+        unsigned long flags = *(unsigned long *) data;
+
+        if ((flags & 1)) {
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                         alarm_events->switchover_primary++;
         } else {
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                         alarm_events->switchover_secondary++;
         }
 
@@ -901,8 +913,9 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id)
 
                 /* TIMEOUT in ~10ms */
                 switchover_timer.expires = jiffies + msecs_to_jiffies(10);
-                switchover_timer.data = inb(TLCLK_REG1);
-                add_timer(&switchover_timer);
+                tlclk_timer_data = inb(TLCLK_REG1);
+                switchover_timer.data = (unsigned long) &tlclk_timer_data;
+                mod_timer(&switchover_timer, switchover_timer.expires);
         } else {
                 got_event = 1;
                 wake_up(&wq);
diff --git a/drivers/char/vr41xx_giu.c b/drivers/char/vr41xx_giu.c
index a744dad9cf45..0cea8d4907df 100644
--- a/drivers/char/vr41xx_giu.c
+++ b/drivers/char/vr41xx_giu.c
@@ -3,7 +3,7 @@
  *
  *  Copyright (C) 2002 MontaVista Software Inc.
  *      Author: Yoichi Yuasa <yyuasa@mvista.com or source@mvista.com>
- *  Copyright (C) 2003-2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *  Copyright (C) 2003-2007  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -125,30 +125,17 @@ static inline uint16_t giu_clear(uint16_t offset, uint16_t clear)
         return data;
 }
 
-static unsigned int startup_giuint_low_irq(unsigned int irq)
+static void ack_giuint_low(unsigned int irq)
 {
-        unsigned int pin;
-
-        pin = GPIO_PIN_OF_IRQ(irq);
-        giu_write(GIUINTSTATL, 1 << pin);
-        giu_set(GIUINTENL, 1 << pin);
-
-        return 0;
+        giu_write(GIUINTSTATL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
 
-static void shutdown_giuint_low_irq(unsigned int irq)
+static void mask_giuint_low(unsigned int irq)
 {
         giu_clear(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
 
-static void enable_giuint_low_irq(unsigned int irq)
-{
-        giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
-}
-
-#define disable_giuint_low_irq  shutdown_giuint_low_irq
-
-static void ack_giuint_low_irq(unsigned int irq)
+static void mask_ack_giuint_low(unsigned int irq)
 {
         unsigned int pin;
 
@@ -157,46 +144,30 @@ static void ack_giuint_low_irq(unsigned int irq)
         giu_write(GIUINTSTATL, 1 << pin);
 }
 
-static void end_giuint_low_irq(unsigned int irq)
+static void unmask_giuint_low(unsigned int irq)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
-                giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
+        giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
 
-static struct hw_interrupt_type giuint_low_irq_type = {
-        .typename       = "GIUINTL",
-        .startup        = startup_giuint_low_irq,
-        .shutdown       = shutdown_giuint_low_irq,
-        .enable         = enable_giuint_low_irq,
-        .disable        = disable_giuint_low_irq,
-        .ack            = ack_giuint_low_irq,
-        .end            = end_giuint_low_irq,
+static struct irq_chip giuint_low_irq_chip = {
+        .name           = "GIUINTL",
+        .ack            = ack_giuint_low,
+        .mask           = mask_giuint_low,
+        .mask_ack       = mask_ack_giuint_low,
+        .unmask         = unmask_giuint_low,
 };
 
-static unsigned int startup_giuint_high_irq(unsigned int irq)
+static void ack_giuint_high(unsigned int irq)
 {
-        unsigned int pin;
-
-        pin = GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET;
-        giu_write(GIUINTSTATH, 1 << pin);
-        giu_set(GIUINTENH, 1 << pin);
-
-        return 0;
+        giu_write(GIUINTSTATH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
 
-static void shutdown_giuint_high_irq(unsigned int irq)
+static void mask_giuint_high(unsigned int irq)
 {
         giu_clear(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
 
-static void enable_giuint_high_irq(unsigned int irq)
-{
-        giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
-}
-
-#define disable_giuint_high_irq shutdown_giuint_high_irq
-
-static void ack_giuint_high_irq(unsigned int irq)
+static void mask_ack_giuint_high(unsigned int irq)
 {
         unsigned int pin;
 
@@ -205,20 +176,17 @@ static void ack_giuint_high_irq(unsigned int irq)
         giu_write(GIUINTSTATH, 1 << pin);
 }
 
-static void end_giuint_high_irq(unsigned int irq)
+static void unmask_giuint_high(unsigned int irq)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
-                giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
+        giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
 
-static struct hw_interrupt_type giuint_high_irq_type = {
-        .typename       = "GIUINTH",
-        .startup        = startup_giuint_high_irq,
-        .shutdown       = shutdown_giuint_high_irq,
-        .enable         = enable_giuint_high_irq,
-        .disable        = disable_giuint_high_irq,
-        .ack            = ack_giuint_high_irq,
-        .end            = end_giuint_high_irq,
+static struct irq_chip giuint_high_irq_chip = {
+        .name           = "GIUINTH",
+        .ack            = ack_giuint_high,
+        .mask           = mask_giuint_high,
+        .mask_ack       = mask_ack_giuint_high,
+        .unmask         = unmask_giuint_high,
 };
 
 static int giu_get_irq(unsigned int irq)
@@ -282,9 +250,15 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                         break;
                                 }
                         }
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_low_irq_chip,
+                                                 handle_edge_irq);
                 } else {
                         giu_clear(GIUINTTYPL, mask);
                         giu_clear(GIUINTHTSELL, mask);
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_low_irq_chip,
+                                                 handle_level_irq);
                 }
                 giu_write(GIUINTSTATL, mask);
         } else if (pin < GIUINT_HIGH_MAX) {
@@ -311,9 +285,15 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                         break;
                                 }
                         }
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_high_irq_chip,
+                                                 handle_edge_irq);
                 } else {
                         giu_clear(GIUINTTYPH, mask);
                         giu_clear(GIUINTHTSELH, mask);
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_high_irq_chip,
+                                                 handle_level_irq);
                 }
                 giu_write(GIUINTSTATH, mask);
         }
@@ -617,10 +597,11 @@ static const struct file_operations gpio_fops = {
 static int __devinit giu_probe(struct platform_device *dev)
 {
         unsigned long start, size, flags = 0;
-        unsigned int nr_pins = 0;
+        unsigned int nr_pins = 0, trigger, i, pin;
         struct resource *res1, *res2 = NULL;
         void *base;
-        int retval, i;
+        struct irq_chip *chip;
+        int retval;
 
         switch (current_cpu_data.cputype) {
         case CPU_VR4111:
@@ -688,11 +669,20 @@ static int __devinit giu_probe(struct platform_device *dev)
         giu_write(GIUINTENL, 0);
         giu_write(GIUINTENH, 0);
 
+        trigger = giu_read(GIUINTTYPH) << 16;
+        trigger |= giu_read(GIUINTTYPL);
         for (i = GIU_IRQ_BASE; i <= GIU_IRQ_LAST; i++) {
-                if (i < GIU_IRQ(GIUINT_HIGH_OFFSET))
-                        irq_desc[i].chip = &giuint_low_irq_type;
+                pin = GPIO_PIN_OF_IRQ(i);
+                if (pin < GIUINT_HIGH_OFFSET)
+                        chip = &giuint_low_irq_chip;
                 else
-                        irq_desc[i].chip = &giuint_high_irq_type;
+                        chip = &giuint_high_irq_chip;
+
+                if (trigger & (1 << pin))
+                        set_irq_chip_and_handler(i, chip, handle_edge_irq);
+                else
+                        set_irq_chip_and_handler(i, chip, handle_level_irq);
+
         }
 
         return cascade_irq(GIUINT_IRQ, giu_get_irq);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index d91330432ba2..a45cc89e387a 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -722,8 +722,13 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
                         dprintk("CPU already managed, adding link\n");
-                        sysfs_create_link(&sys_dev->kobj,
-                                          &managed_policy->kobj, "cpufreq");
+                        ret = sysfs_create_link(&sys_dev->kobj,
+                                                &managed_policy->kobj,
+                                                "cpufreq");
+                        if (ret) {
+                                mutex_unlock(&policy->lock);
+                                goto err_out_driver_exit;
+                        }
 
                         cpufreq_debug_enable_ratelimit();
                         mutex_unlock(&policy->lock);
@@ -770,8 +775,12 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                 dprintk("CPU %u already managed, adding link\n", j);
                 cpufreq_cpu_get(cpu);
                 cpu_sys_dev = get_cpu_sysdev(j);
-                sysfs_create_link(&cpu_sys_dev->kobj, &policy->kobj,
-                                  "cpufreq");
+                ret = sysfs_create_link(&cpu_sys_dev->kobj, &policy->kobj,
+                                        "cpufreq");
+                if (ret) {
+                        mutex_unlock(&policy->lock);
+                        goto err_out_unregister;
+                }
         }
 
         policy->governor = NULL; /* to assure that the starting sequence is
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 5ab5e393b882..c6281ccd4fe7 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -122,8 +122,6 @@ struct efivar_entry {
         struct kobject kobj;
 };
 
-#define get_efivar_entry(n) list_entry(n, struct efivar_entry, list)
-
 struct efivar_attribute {
         struct attribute attr;
         ssize_t (*show) (struct efivar_entry *entry, char *buf);
@@ -386,9 +384,6 @@ static struct sysfs_ops efivar_attr_ops = {
 static void efivar_release(struct kobject *kobj)
 {
         struct efivar_entry *var = container_of(kobj, struct efivar_entry, kobj);
-        spin_lock(&efivars_lock);
-        list_del(&var->list);
-        spin_unlock(&efivars_lock);
         kfree(var);
 }
 
@@ -430,9 +425,8 @@ static ssize_t
 efivar_create(struct subsystem *sub, const char *buf, size_t count)
 {
         struct efi_variable *new_var = (struct efi_variable *)buf;
-        struct efivar_entry *search_efivar = NULL;
+        struct efivar_entry *search_efivar, *n;
         unsigned long strsize1, strsize2;
-        struct list_head *pos, *n;
         efi_status_t status = EFI_NOT_FOUND;
         int found = 0;
 
@@ -444,8 +438,7 @@ efivar_create(struct subsystem *sub, const char *buf, size_t count)
         /*
          * Does this variable already exist?
          */
-        list_for_each_safe(pos, n, &efivar_list) {
-                search_efivar = get_efivar_entry(pos);
+        list_for_each_entry_safe(search_efivar, n, &efivar_list, list) {
                 strsize1 = utf8_strsize(search_efivar->var.VariableName, 1024);
                 strsize2 = utf8_strsize(new_var->VariableName, 1024);
                 if (strsize1 == strsize2 &&
@@ -490,9 +483,8 @@ static ssize_t
 efivar_delete(struct subsystem *sub, const char *buf, size_t count)
 {
         struct efi_variable *del_var = (struct efi_variable *)buf;
-        struct efivar_entry *search_efivar = NULL;
+        struct efivar_entry *search_efivar, *n;
         unsigned long strsize1, strsize2;
-        struct list_head *pos, *n;
         efi_status_t status = EFI_NOT_FOUND;
         int found = 0;
 
@@ -504,8 +496,7 @@ efivar_delete(struct subsystem *sub, const char *buf, size_t count)
         /*
          * Does this variable already exist?
          */
-        list_for_each_safe(pos, n, &efivar_list) {
-                search_efivar = get_efivar_entry(pos);
+        list_for_each_entry_safe(search_efivar, n, &efivar_list, list) {
                 strsize1 = utf8_strsize(search_efivar->var.VariableName, 1024);
                 strsize2 = utf8_strsize(del_var->VariableName, 1024);
                 if (strsize1 == strsize2 &&
@@ -537,9 +528,9 @@ efivar_delete(struct subsystem *sub, const char *buf, size_t count)
                 spin_unlock(&efivars_lock);
                 return -EIO;
         }
+        list_del(&search_efivar->list);
         /* We need to release this lock before unregistering. */
         spin_unlock(&efivars_lock);
-
         efivar_unregister(search_efivar);
 
         /* It's dead Jim.... */
@@ -768,10 +759,14 @@ out_free:
 static void __exit
 efivars_exit(void)
 {
-        struct list_head *pos, *n;
+        struct efivar_entry *entry, *n;
 
-        list_for_each_safe(pos, n, &efivar_list)
-                efivar_unregister(get_efivar_entry(pos));
+        list_for_each_entry_safe(entry, n, &efivar_list, list) {
+                spin_lock(&efivars_lock);
+                list_del(&entry->list);
+                spin_unlock(&efivars_lock);
+                efivar_unregister(entry);
+        }
 
         subsystem_unregister(&vars_subsys);
         firmware_unregister(&efi_subsys);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index b8cf50fcd64d..49f18f5b2514 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -543,6 +543,7 @@ void hid_free_device(struct hid_device *device)
         }
 
         kfree(device->rdesc);
+        kfree(device->collection);
         kfree(device);
 }
 EXPORT_SYMBOL_GPL(hid_free_device);
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 9cf591a1bda3..c7a6833f6821 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -35,6 +35,11 @@
 
 #include <linux/hid.h>
 
+static int hid_pb_fnmode = 1;
+module_param_named(pb_fnmode, hid_pb_fnmode, int, 0644);
+MODULE_PARM_DESC(pb_fnmode,
+                "Mode of fn key on PowerBooks (0 = disabled, 1 = fkeyslast, 2 = fkeysfirst)");
+
 #define unk     KEY_UNKNOWN
 
 static const unsigned char hid_keyboard[256] = {
@@ -154,7 +159,7 @@ static int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
                 return 1;
         }
 
-        if (hid->pb_fnmode) {
+        if (hid_pb_fnmode) {
                 int do_translate;
 
                 trans = find_translation(powerbook_fn_keys, usage->code);
@@ -163,8 +168,8 @@ static int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
                                 do_translate = 1;
                         else if (trans->flags & POWERBOOK_FLAG_FKEY)
                                 do_translate =
-                                        (hid->pb_fnmode == 2 &&  (hid->quirks & HID_QUIRK_POWERBOOK_FN_ON)) ||
-                                        (hid->pb_fnmode == 1 && !(hid->quirks & HID_QUIRK_POWERBOOK_FN_ON));
+                                        (hid_pb_fnmode == 2 &&  (hid->quirks & HID_QUIRK_POWERBOOK_FN_ON)) ||
+                                        (hid_pb_fnmode == 1 && !(hid->quirks & HID_QUIRK_POWERBOOK_FN_ON));
                         else
                                 do_translate = (hid->quirks & HID_QUIRK_POWERBOOK_FN_ON);
 
@@ -431,6 +436,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                                 case 0x040: map_key_clear(KEY_MENU);            break;
                                 case 0x045: map_key_clear(KEY_RADIO);           break;
 
+                                case 0x083: map_key_clear(KEY_LAST);            break;
                                 case 0x088: map_key_clear(KEY_PC);              break;
                                 case 0x089: map_key_clear(KEY_TV);              break;
                                 case 0x08a: map_key_clear(KEY_WWW);             break;
@@ -448,6 +454,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                                 case 0x096: map_key_clear(KEY_TAPE);            break;
                                 case 0x097: map_key_clear(KEY_TV2);             break;
                                 case 0x098: map_key_clear(KEY_SAT);             break;
+                                case 0x09a: map_key_clear(KEY_PVR);             break;
 
                                 case 0x09c: map_key_clear(KEY_CHANNELUP);       break;
                                 case 0x09d: map_key_clear(KEY_CHANNELDOWN);     break;
diff --git a/drivers/ide/ide-pnp.c b/drivers/ide/ide-pnp.c
index df7d1504f84e..98410ca044cf 100644
--- a/drivers/ide/ide-pnp.c
+++ b/drivers/ide/ide-pnp.c
@@ -73,3 +73,8 @@ void __init pnpide_init(void)
 {
         pnp_register_driver(&idepnp_driver);
 }
+
+void __exit pnpide_exit(void)
+{
+        pnp_unregister_driver(&idepnp_driver);
+}
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 16890769dca6..6c9bd5165bdb 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -1781,8 +1781,9 @@ done:
         return 1;
 }
 
-extern void pnpide_init(void);
-extern void h8300_ide_init(void);
+extern void __init pnpide_init(void);
+extern void __exit pnpide_exit(void);
+extern void __init h8300_ide_init(void);
 
 /*
  * probe_for_hwifs() finds/initializes "known" IDE interfaces
@@ -2087,13 +2088,17 @@ int __init init_module (void)
         return ide_init();
 }
 
-void cleanup_module (void)
+void __exit cleanup_module (void)
 {
         int index;
 
         for (index = 0; index < MAX_HWIFS; ++index)
                 ide_unregister(index);
 
+#ifdef CONFIG_BLK_DEV_IDEPNP
+        pnpide_exit();
+#endif
+
 #ifdef CONFIG_PROC_FS
         proc_ide_destroy();
 #endif
diff --git a/drivers/ide/pci/aec62xx.c b/drivers/ide/pci/aec62xx.c
index f286079d233f..d261bfbad222 100644
--- a/drivers/ide/pci/aec62xx.c
+++ b/drivers/ide/pci/aec62xx.c
@@ -441,7 +441,7 @@ static struct pci_driver driver = {
         .probe          = aec62xx_init_one,
 };
 
-static int aec62xx_ide_init(void)
+static int __init aec62xx_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/alim15x3.c b/drivers/ide/pci/alim15x3.c
index 89109be5162c..68df77ec502b 100644
--- a/drivers/ide/pci/alim15x3.c
+++ b/drivers/ide/pci/alim15x3.c
@@ -907,7 +907,7 @@ static struct pci_driver driver = {
         .probe          = alim15x3_init_one,
 };
 
-static int ali15x3_ide_init(void)
+static int __init ali15x3_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/amd74xx.c b/drivers/ide/pci/amd74xx.c
index 753fe0e21456..a4336995a410 100644
--- a/drivers/ide/pci/amd74xx.c
+++ b/drivers/ide/pci/amd74xx.c
@@ -544,7 +544,7 @@ static struct pci_driver driver = {
         .probe          = amd74xx_probe,
 };
 
-static int amd74xx_ide_init(void)
+static int __init amd74xx_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/atiixp.c b/drivers/ide/pci/atiixp.c
index 524e65de4398..982ac31fa995 100644
--- a/drivers/ide/pci/atiixp.c
+++ b/drivers/ide/pci/atiixp.c
@@ -291,8 +291,12 @@ fast_ata_pio:
 
 static void __devinit init_hwif_atiixp(ide_hwif_t *hwif)
 {
+        u8 udma_mode = 0;
+        u8 ch = hwif->channel;
+        struct pci_dev *pdev = hwif->pci_dev;
+
         if (!hwif->irq)
-                hwif->irq = hwif->channel ? 15 : 14;
+                hwif->irq = ch ? 15 : 14;
 
         hwif->autodma = 0;
         hwif->tuneproc = &atiixp_tuneproc;
@@ -308,8 +312,12 @@ static void __devinit init_hwif_atiixp(ide_hwif_t *hwif)
         hwif->mwdma_mask = 0x06;
         hwif->swdma_mask = 0x04;
 
-        /* FIXME: proper cable detection needed */
-        hwif->udma_four = 1;
+        pci_read_config_byte(pdev, ATIIXP_IDE_UDMA_MODE + ch, &udma_mode);
+        if ((udma_mode & 0x07) >= 0x04 || (udma_mode & 0x70) >= 0x40)
+                hwif->udma_four = 1;
+        else
+                hwif->udma_four = 0;
+
         hwif->ide_dma_host_on = &atiixp_ide_dma_host_on;
         hwif->ide_dma_host_off = &atiixp_ide_dma_host_off;
         hwif->ide_dma_check = &atiixp_dma_check;
@@ -320,19 +328,6 @@ static void __devinit init_hwif_atiixp(ide_hwif_t *hwif)
         hwif->drives[0].autodma = hwif->autodma;
 }
 
-static void __devinit init_hwif_sb600_legacy(ide_hwif_t *hwif)
-{
-
-        hwif->atapi_dma = 1;
-        hwif->ultra_mask = 0x7f;
-        hwif->mwdma_mask = 0x07;
-        hwif->swdma_mask = 0x07;
-
-        if (!noautodma)
-                hwif->autodma = 1;
-        hwif->drives[0].autodma = hwif->autodma;
-        hwif->drives[1].autodma = hwif->autodma;
-}
 
 static ide_pci_device_t atiixp_pci_info[] __devinitdata = {
         {       /* 0 */
@@ -343,12 +338,13 @@ static ide_pci_device_t atiixp_pci_info[] __devinitdata = {
                 .enablebits     = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
                 .bootable       = ON_BOARD,
         },{     /* 1 */
-                .name           = "ATI SB600 SATA Legacy IDE",
-                .init_hwif      = init_hwif_sb600_legacy,
-                .channels       = 2,
+                .name           = "SB600_PATA",
+                .init_hwif      = init_hwif_atiixp,
+                .channels       = 1,
                 .autodma        = AUTODMA,
-                .bootable       = ON_BOARD,
-        }
+                .enablebits     = {{0x48,0x01,0x00}, {0x00,0x00,0x00}},
+                .bootable       = ON_BOARD,
+        },
 };
 
 /**
@@ -369,7 +365,7 @@ static struct pci_device_id atiixp_pci_tbl[] = {
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP200_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP300_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP600_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP600_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, atiixp_pci_tbl);
@@ -380,7 +376,7 @@ static struct pci_driver driver = {
         .probe          = atiixp_init_one,
 };
 
-static int atiixp_ide_init(void)
+static int __init atiixp_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/cmd64x.c b/drivers/ide/pci/cmd64x.c
index 20c32716bbc4..aee947e8fc38 100644
--- a/drivers/ide/pci/cmd64x.c
+++ b/drivers/ide/pci/cmd64x.c
@@ -793,7 +793,7 @@ static struct pci_driver driver = {
         .probe          = cmd64x_init_one,
 };
 
-static int cmd64x_ide_init(void)
+static int __init cmd64x_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/cs5520.c b/drivers/ide/pci/cs5520.c
index 079f7c86726b..ba6786aabf3b 100644
--- a/drivers/ide/pci/cs5520.c
+++ b/drivers/ide/pci/cs5520.c
@@ -260,7 +260,7 @@ static struct pci_driver driver = {
         .probe          = cs5520_init_one,
 };
 
-static int cs5520_ide_init(void)
+static int __init cs5520_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/cs5530.c b/drivers/ide/pci/cs5530.c
index ae405fa32236..9bf5fdfc5b1f 100644
--- a/drivers/ide/pci/cs5530.c
+++ b/drivers/ide/pci/cs5530.c
@@ -374,7 +374,7 @@ static struct pci_driver driver = {
         .probe          = cs5530_init_one,
 };
 
-static int cs5530_ide_init(void)
+static int __init cs5530_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/cy82c693.c b/drivers/ide/pci/cy82c693.c
index 64330c459bd4..9eafcbf444f4 100644
--- a/drivers/ide/pci/cy82c693.c
+++ b/drivers/ide/pci/cy82c693.c
@@ -519,7 +519,7 @@ static struct pci_driver driver = {
         .probe          = cy82c693_init_one,
 };
 
-static int cy82c693_ide_init(void)
+static int __init cy82c693_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/generic.c b/drivers/ide/pci/generic.c
index 9f306880491a..b408c6c517ea 100644
--- a/drivers/ide/pci/generic.c
+++ b/drivers/ide/pci/generic.c
@@ -185,36 +185,6 @@ static ide_pci_device_t generic_chipsets[] __devinitdata = {
                 .channels       = 2,
                 .autodma        = AUTODMA,
                 .bootable       = OFF_BOARD,
-        },{     /* 15 */
-                .name           = "JMB361",
-                .init_hwif      = init_hwif_generic,
-                .channels       = 2,
-                .autodma        = AUTODMA,
-                .bootable       = OFF_BOARD,
-        },{     /* 16 */
-                .name           = "JMB363",
-                .init_hwif      = init_hwif_generic,
-                .channels       = 2,
-                .autodma        = AUTODMA,
-                .bootable       = OFF_BOARD,
-        },{     /* 17 */
-                .name           = "JMB365",
-                .init_hwif      = init_hwif_generic,
-                .channels       = 2,
-                .autodma        = AUTODMA,
-                .bootable       = OFF_BOARD,
-        },{     /* 18 */
-                .name           = "JMB366",
-                .init_hwif      = init_hwif_generic,
-                .channels       = 2,
-                .autodma        = AUTODMA,
-                .bootable       = OFF_BOARD,
-        },{     /* 19 */
-                .name           = "JMB368",
-                .init_hwif      = init_hwif_generic,
-                .channels       = 2,
-                .autodma        = AUTODMA,
-                .bootable       = OFF_BOARD,
         }
 };
 
@@ -281,11 +251,6 @@ static struct pci_device_id generic_pci_tbl[] = {
         { PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 12},
         { PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2,   PCI_ANY_ID, PCI_ANY_ID, 0, 0, 13},
         { PCI_VENDOR_ID_NETCELL,PCI_DEVICE_ID_REVOLUTION,          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 14},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 15},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 16},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 17},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 18},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 19},
         /* Must come last. If you add entries adjust this table appropriately and the init_one code */
         { PCI_ANY_ID,           PCI_ANY_ID,                        PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 0},
         { 0, },
@@ -298,7 +263,7 @@ static struct pci_driver driver = {
         .probe          = generic_init_one,
 };
 
-static int generic_ide_init(void)
+static int __init generic_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/hpt34x.c b/drivers/ide/pci/hpt34x.c
index b46cb042290a..ce7b08f08a09 100644
--- a/drivers/ide/pci/hpt34x.c
+++ b/drivers/ide/pci/hpt34x.c
@@ -265,7 +265,7 @@ static struct pci_driver driver = {
         .probe          = hpt34x_init_one,
 };
 
-static int hpt34x_ide_init(void)
+static int __init hpt34x_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/hpt366.c b/drivers/ide/pci/hpt366.c
index 08119da06d54..b486442dd5d7 100644
--- a/drivers/ide/pci/hpt366.c
+++ b/drivers/ide/pci/hpt366.c
@@ -1613,7 +1613,7 @@ static struct pci_driver driver = {
         .probe          = hpt366_init_one,
 };
 
-static int hpt366_ide_init(void)
+static int __init hpt366_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/jmicron.c b/drivers/ide/pci/jmicron.c
index c1cec236ecf0..f07bbbed1778 100644
--- a/drivers/ide/pci/jmicron.c
+++ b/drivers/ide/pci/jmicron.c
@@ -86,15 +86,16 @@ static int __devinit ata66_jmicron(ide_hwif_t *hwif)
         {
         case PORT_PATA0:
                 if (control & (1 << 3)) /* 40/80 pin primary */
-                        return 1;
-                return 0;
+                        return 0;
+                return 1;
         case PORT_PATA1:
                 if (control5 & (1 << 19))       /* 40/80 pin secondary */
                         return 0;
                 return 1;
         case PORT_SATA:
-                return 1;
+                break;
         }
+        return 1; /* Avoid bogus "control reaches end of non-void function" */
 }
 
 static void jmicron_tuneproc (ide_drive_t *drive, byte mode_wanted)
@@ -240,11 +241,11 @@ static int __devinit jmicron_init_one(struct pci_dev *dev, const struct pci_devi
 }
 
 static struct pci_device_id jmicron_pci_tbl[] = {
-        { PCI_DEVICE(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361), 0},
-        { PCI_DEVICE(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363), 1},
-        { PCI_DEVICE(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365), 2},
-        { PCI_DEVICE(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366), 3},
-        { PCI_DEVICE(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368), 4},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
         { 0, },
 };
 
diff --git a/drivers/ide/pci/ns87415.c b/drivers/ide/pci/ns87415.c
index d95714bcee4e..8aaea4ea5549 100644
--- a/drivers/ide/pci/ns87415.c
+++ b/drivers/ide/pci/ns87415.c
@@ -302,7 +302,7 @@ static struct pci_driver driver = {
         .probe          = ns87415_init_one,
 };
 
-static int ns87415_ide_init(void)
+static int __init ns87415_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/opti621.c b/drivers/ide/pci/opti621.c
index 7a7c2ef78ac2..22bbf613f948 100644
--- a/drivers/ide/pci/opti621.c
+++ b/drivers/ide/pci/opti621.c
@@ -382,7 +382,7 @@ static struct pci_driver driver = {
         .probe          = opti621_init_one,
 };
 
-static int opti621_ide_init(void)
+static int __init opti621_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/pdc202xx_new.c b/drivers/ide/pci/pdc202xx_new.c
index 7cb48576e479..77a9aaa7dab9 100644
--- a/drivers/ide/pci/pdc202xx_new.c
+++ b/drivers/ide/pci/pdc202xx_new.c
@@ -756,7 +756,7 @@ static struct pci_driver driver = {
         .probe          = pdc202new_init_one,
 };
 
-static int pdc202new_ide_init(void)
+static int __init pdc202new_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/pdc202xx_old.c b/drivers/ide/pci/pdc202xx_old.c
index 184cdacddeb6..143239c093d5 100644
--- a/drivers/ide/pci/pdc202xx_old.c
+++ b/drivers/ide/pci/pdc202xx_old.c
@@ -719,7 +719,7 @@ static struct pci_driver driver = {
         .probe          = pdc202xx_init_one,
 };
 
-static int pdc202xx_ide_init(void)
+static int __init pdc202xx_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/rz1000.c b/drivers/ide/pci/rz1000.c
index 5f6950c2d1d1..c1855311052b 100644
--- a/drivers/ide/pci/rz1000.c
+++ b/drivers/ide/pci/rz1000.c
@@ -77,7 +77,7 @@ static struct pci_driver driver = {
         .probe          = rz1000_init_one,
 };
 
-static int rz1000_ide_init(void)
+static int __init rz1000_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/sc1200.c b/drivers/ide/pci/sc1200.c
index ff80937d94dd..8d762d323f8b 100644
--- a/drivers/ide/pci/sc1200.c
+++ b/drivers/ide/pci/sc1200.c
@@ -507,7 +507,7 @@ static struct pci_driver driver = {
 #endif
 };
 
-static int sc1200_ide_init(void)
+static int __init sc1200_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/serverworks.c b/drivers/ide/pci/serverworks.c
index 057548d07205..ea9a28a45853 100644
--- a/drivers/ide/pci/serverworks.c
+++ b/drivers/ide/pci/serverworks.c
@@ -666,7 +666,7 @@ static struct pci_driver driver = {
         .probe          = svwks_init_one,
 };
 
-static int svwks_ide_init(void)
+static int __init svwks_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index cfad09accf52..b0bf01809279 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -762,8 +762,7 @@ static struct ioc4_submodule ioc4_ide_submodule = {
 /*      .is_remove = ioc4_ide_remove_one,       */
 };
 
-static int __devinit
-ioc4_ide_init(void)
+static int __init ioc4_ide_init(void)
 {
         return ioc4_register_submodule(&ioc4_ide_submodule);
 }
diff --git a/drivers/ide/pci/siimage.c b/drivers/ide/pci/siimage.c
index 697f566fb90a..4ff89c7d990a 100644
--- a/drivers/ide/pci/siimage.c
+++ b/drivers/ide/pci/siimage.c
@@ -1096,7 +1096,7 @@ static struct pci_driver driver = {
         .probe          = siimage_init_one,
 };
 
-static int siimage_ide_init(void)
+static int __init siimage_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/sis5513.c b/drivers/ide/pci/sis5513.c
index 6b313139b5e4..1afff659ab55 100644
--- a/drivers/ide/pci/sis5513.c
+++ b/drivers/ide/pci/sis5513.c
@@ -968,7 +968,7 @@ static struct pci_driver driver = {
         .probe          = sis5513_init_one,
 };
 
-static int sis5513_ide_init(void)
+static int __init sis5513_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/sl82c105.c b/drivers/ide/pci/sl82c105.c
index 5afefe8692fe..170a26199050 100644
--- a/drivers/ide/pci/sl82c105.c
+++ b/drivers/ide/pci/sl82c105.c
@@ -492,7 +492,7 @@ static struct pci_driver driver = {
         .probe          = sl82c105_init_one,
 };
 
-static int sl82c105_ide_init(void)
+static int __init sl82c105_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/slc90e66.c b/drivers/ide/pci/slc90e66.c
index 9be7e49cba0e..90e79c0844d2 100644
--- a/drivers/ide/pci/slc90e66.c
+++ b/drivers/ide/pci/slc90e66.c
@@ -253,7 +253,7 @@ static struct pci_driver driver = {
         .probe          = slc90e66_init_one,
 };
 
-static int slc90e66_ide_init(void)
+static int __init slc90e66_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/triflex.c b/drivers/ide/pci/triflex.c
index 56d84931d6de..b13cce1fd1a6 100644
--- a/drivers/ide/pci/triflex.c
+++ b/drivers/ide/pci/triflex.c
@@ -173,7 +173,7 @@ static struct pci_driver driver = {
         .probe          = triflex_init_one,
 };
 
-static int triflex_ide_init(void)
+static int __init triflex_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/trm290.c b/drivers/ide/pci/trm290.c
index 2a282529bfc1..174b88c4780e 100644
--- a/drivers/ide/pci/trm290.c
+++ b/drivers/ide/pci/trm290.c
@@ -355,7 +355,7 @@ static struct pci_driver driver = {
         .probe          = trm290_init_one,
 };
 
-static int trm290_ide_init(void)
+static int __init trm290_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/ide/pci/via82cxxx.c b/drivers/ide/pci/via82cxxx.c
index 381cc6f101ce..6fb6e50b8231 100644
--- a/drivers/ide/pci/via82cxxx.c
+++ b/drivers/ide/pci/via82cxxx.c
@@ -78,6 +78,8 @@ static struct via_isa_bridge {
         u8 rev_max;
         u16 flags;
 } via_isa_bridges[] = {
+        { "cx700",      PCI_DEVICE_ID_VIA_CX700,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
+        { "vt8237s",    PCI_DEVICE_ID_VIA_8237S,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8251",     PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
         { "vt8237",     PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
@@ -504,6 +506,7 @@ static struct pci_device_id via_pci_tbl[] = {
         { PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C576_1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_6410,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
+        { PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_SATA_EIDE,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, via_pci_tbl);
@@ -514,7 +517,7 @@ static struct pci_driver driver = {
         .probe          = via_init_one,
 };
 
-static int via_ide_init(void)
+static int __init via_ide_init(void)
 {
         return ide_pci_register_driver(&driver);
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 93995b658d94..6074c897f51c 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -344,8 +344,11 @@ int ehca_destroy_cq(struct ib_cq *cq)
         unsigned long flags;
 
         spin_lock_irqsave(&ehca_cq_idr_lock, flags);
-        while (my_cq->nr_callbacks)
+        while (my_cq->nr_callbacks) {
+                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
                 yield();
+                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+        }
 
         idr_remove(&ehca_cq_idr, my_cq->token);
         spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index e7209afb4250..c069be8cbcb2 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -440,7 +440,8 @@ void ehca_tasklet_eq(unsigned long data)
                                         cq = idr_find(&ehca_cq_idr, token);
 
                                         if (cq == NULL) {
-                                                spin_unlock(&ehca_cq_idr_lock);
+                                                spin_unlock_irqrestore(&ehca_cq_idr_lock,
+                                                                       flags);
                                                 break;
                                         }
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index cdecbf5911c8..72611fd15103 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1621,18 +1621,30 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
                 switch (token) {
                 case SRP_OPT_ID_EXT:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->id_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
 
                 case SRP_OPT_IOC_GUID:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->ioc_guid = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
 
                 case SRP_OPT_DGID:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         if (strlen(p) != 32) {
                                 printk(KERN_WARNING PFX "bad dest GID parameter '%s'\n", p);
                                 kfree(p);
@@ -1656,6 +1668,10 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
 
                 case SRP_OPT_SERVICE_ID:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->service_id = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
@@ -1693,6 +1709,10 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
 
                 case SRP_OPT_INITIATOR_EXT:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 95eff3b2917a..4f75cce6fdff 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -356,16 +356,17 @@ static struct cardstate *alloc_cs(struct gigaset_driver *drv)
 {
         unsigned long flags;
         unsigned i;
-        static struct cardstate *ret = NULL;
+        struct cardstate *ret = NULL;
 
         spin_lock_irqsave(&drv->lock, flags);
         for (i = 0; i < drv->minors; ++i) {
                 if (!(drv->flags[i] & VALID_MINOR)) {
-                        drv->flags[i] = VALID_MINOR;
-                        ret = drv->cs + i;
-                }
-                if (ret)
+                        if (try_module_get(drv->owner)) {
+                                drv->flags[i] = VALID_MINOR;
+                                ret = drv->cs + i;
+                        }
                         break;
+                }
         }
         spin_unlock_irqrestore(&drv->lock, flags);
         return ret;
@@ -376,6 +377,8 @@ static void free_cs(struct cardstate *cs)
         unsigned long flags;
         struct gigaset_driver *drv = cs->driver;
         spin_lock_irqsave(&drv->lock, flags);
+        if (drv->flags[cs->minor_index] & VALID_MINOR)
+                module_put(drv->owner);
         drv->flags[cs->minor_index] = 0;
         spin_unlock_irqrestore(&drv->lock, flags);
 }
@@ -579,7 +582,7 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         } else if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                 skb_reserve(bcs->skb, HW_HDR_LEN);
         else {
-                warn("could not allocate skb\n");
+                warn("could not allocate skb");
                 bcs->inputstate |= INS_skip_frame;
         }
 
@@ -632,17 +635,25 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         int i;
 
         gig_dbg(DEBUG_INIT, "allocating cs");
-        cs = alloc_cs(drv);
-        if (!cs)
-                goto error;
+        if (!(cs = alloc_cs(drv))) {
+                err("maximum number of devices exceeded");
+                return NULL;
+        }
+        mutex_init(&cs->mutex);
+        mutex_lock(&cs->mutex);
+
         gig_dbg(DEBUG_INIT, "allocating bcs[0..%d]", channels - 1);
         cs->bcs = kmalloc(channels * sizeof(struct bc_state), GFP_KERNEL);
-        if (!cs->bcs)
+        if (!cs->bcs) {
+                err("out of memory");
                 goto error;
+        }
         gig_dbg(DEBUG_INIT, "allocating inbuf");
         cs->inbuf = kmalloc(sizeof(struct inbuf_t), GFP_KERNEL);
-        if (!cs->inbuf)
+        if (!cs->inbuf) {
+                err("out of memory");
                 goto error;
+        }
 
         cs->cs_init = 0;
         cs->channels = channels;
@@ -654,8 +665,6 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         spin_lock_init(&cs->ev_lock);
         cs->ev_tail = 0;
         cs->ev_head = 0;
-        mutex_init(&cs->mutex);
-        mutex_lock(&cs->mutex);
 
         tasklet_init(&cs->event_tasklet, &gigaset_handle_event,
                      (unsigned long) cs);
@@ -684,8 +693,10 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
 
         for (i = 0; i < channels; ++i) {
                 gig_dbg(DEBUG_INIT, "setting up bcs[%d].read", i);
-                if (!gigaset_initbcs(cs->bcs + i, cs, i))
+                if (!gigaset_initbcs(cs->bcs + i, cs, i)) {
+                        err("could not allocate channel %d data", i);
                         goto error;
+                }
         }
 
         ++cs->cs_init;
@@ -720,8 +731,10 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         make_valid(cs, VALID_ID);
         ++cs->cs_init;
         gig_dbg(DEBUG_INIT, "setting up hw");
-        if (!cs->ops->initcshw(cs))
+        if (!cs->ops->initcshw(cs)) {
+                err("could not allocate device specific data");
                 goto error;
+        }
 
         ++cs->cs_init;
 
@@ -743,8 +756,8 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         mutex_unlock(&cs->mutex);
         return cs;
 
-error:  if (cs)
-                mutex_unlock(&cs->mutex);
+error:
+        mutex_unlock(&cs->mutex);
         gig_dbg(DEBUG_INIT, "failed");
         gigaset_freecs(cs);
         return NULL;
@@ -1040,7 +1053,6 @@ void gigaset_freedriver(struct gigaset_driver *drv)
         spin_unlock_irqrestore(&driver_lock, flags);
 
         gigaset_if_freedriver(drv);
-        module_put(drv->owner);
 
         kfree(drv->cs);
         kfree(drv->flags);
@@ -1072,10 +1084,6 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
         if (!drv)
                 return NULL;
 
-        if (!try_module_get(owner))
-                goto out1;
-
-        drv->cs = NULL;
         drv->have_tty = 0;
         drv->minor = minor;
         drv->minors = minors;
@@ -1087,11 +1095,11 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
 
         drv->cs = kmalloc(minors * sizeof *drv->cs, GFP_KERNEL);
         if (!drv->cs)
-                goto out2;
+                goto error;
 
         drv->flags = kmalloc(minors * sizeof *drv->flags, GFP_KERNEL);
         if (!drv->flags)
-                goto out3;
+                goto error;
 
         for (i = 0; i < minors; ++i) {
                 drv->flags[i] = 0;
@@ -1108,11 +1116,8 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
 
         return drv;
 
-out3:
+error:
         kfree(drv->cs);
-out2:
-        module_put(owner);
-out1:
         kfree(drv);
         return NULL;
 }
diff --git a/drivers/kvm/kvm.h b/drivers/kvm/kvm.h
index 91e0c75aca8f..2db1ca4c6800 100644
--- a/drivers/kvm/kvm.h
+++ b/drivers/kvm/kvm.h
@@ -242,6 +242,7 @@ struct kvm_vcpu {
         u64 pdptrs[4]; /* pae */
         u64 shadow_efer;
         u64 apic_base;
+        u64 ia32_misc_enable_msr;
         int nmsrs;
         struct vmx_msr_entry *guest_msrs;
         struct vmx_msr_entry *host_msrs;
diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index 67c1154960f0..b10972ed0c9f 100644
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -272,7 +272,9 @@ static void kvm_free_physmem(struct kvm *kvm)
 
 static void kvm_free_vcpu(struct kvm_vcpu *vcpu)
 {
+        vcpu_load(vcpu->kvm, vcpu_slot(vcpu));
         kvm_mmu_destroy(vcpu);
+        vcpu_put(vcpu);
         kvm_arch_ops->vcpu_free(vcpu);
 }
 
@@ -1224,6 +1226,9 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
         case MSR_IA32_APICBASE:
                 data = vcpu->apic_base;
                 break;
+        case MSR_IA32_MISC_ENABLE:
+                data = vcpu->ia32_misc_enable_msr;
+                break;
 #ifdef CONFIG_X86_64
         case MSR_EFER:
                 data = vcpu->shadow_efer;
@@ -1295,6 +1300,9 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
         case MSR_IA32_APICBASE:
                 vcpu->apic_base = data;
                 break;
+        case MSR_IA32_MISC_ENABLE:
+                vcpu->ia32_misc_enable_msr = data;
+                break;
         default:
                 printk(KERN_ERR "kvm: unhandled wrmsr: 0x%x\n", msr);
                 return 1;
@@ -1598,6 +1606,10 @@ static u32 msrs_to_save[] = {
 
 static unsigned num_msrs_to_save;
 
+static u32 emulated_msrs[] = {
+        MSR_IA32_MISC_ENABLE,
+};
+
 static __init void kvm_init_msr_list(void)
 {
         u32 dummy[2];
@@ -1923,7 +1935,7 @@ static long kvm_dev_ioctl(struct file *filp,
                 if (copy_from_user(&msr_list, user_msr_list, sizeof msr_list))
                         goto out;
                 n = msr_list.nmsrs;
-                msr_list.nmsrs = num_msrs_to_save;
+                msr_list.nmsrs = num_msrs_to_save + ARRAY_SIZE(emulated_msrs);
                 if (copy_to_user(user_msr_list, &msr_list, sizeof msr_list))
                         goto out;
                 r = -E2BIG;
@@ -1933,6 +1945,11 @@ static long kvm_dev_ioctl(struct file *filp,
                 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
                                  num_msrs_to_save * sizeof(u32)))
                         goto out;
+                if (copy_to_user(user_msr_list->indices
+                                 + num_msrs_to_save * sizeof(u32),
+                                 &emulated_msrs,
+                                 ARRAY_SIZE(emulated_msrs) * sizeof(u32)))
+                        goto out;
                 r = 0;
                 break;
         }
diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index c6f972914f08..22c426cd8cb2 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -143,6 +143,7 @@ static int dbg = 1;
 #define PFERR_PRESENT_MASK (1U << 0)
 #define PFERR_WRITE_MASK (1U << 1)
 #define PFERR_USER_MASK (1U << 2)
+#define PFERR_FETCH_MASK (1U << 4)
 
 #define PT64_ROOT_LEVEL 4
 #define PT32_ROOT_LEVEL 2
@@ -168,6 +169,11 @@ static int is_cpuid_PSE36(void)
         return 1;
 }
 
+static int is_nx(struct kvm_vcpu *vcpu)
+{
+        return vcpu->shadow_efer & EFER_NX;
+}
+
 static int is_present_pte(unsigned long pte)
 {
         return pte & PT_PRESENT_MASK;
@@ -992,16 +998,6 @@ static inline int fix_read_pf(u64 *shadow_ent)
         return 0;
 }
 
-static int may_access(u64 pte, int write, int user)
-{
-
-        if (user && !(pte & PT_USER_MASK))
-                return 0;
-        if (write && !(pte & PT_WRITABLE_MASK))
-                return 0;
-        return 1;
-}
-
 static void paging_free(struct kvm_vcpu *vcpu)
 {
         nonpaging_free(vcpu);
diff --git a/drivers/kvm/paging_tmpl.h b/drivers/kvm/paging_tmpl.h
index 2dbf4307ed9e..149fa45fd9a5 100644
--- a/drivers/kvm/paging_tmpl.h
+++ b/drivers/kvm/paging_tmpl.h
@@ -63,13 +63,15 @@ struct guest_walker {
         pt_element_t *ptep;
         pt_element_t inherited_ar;
         gfn_t gfn;
+        u32 error_code;
 };
 
 /*
  * Fetch a guest pte for a guest virtual address
  */
-static void FNAME(walk_addr)(struct guest_walker *walker,
-                             struct kvm_vcpu *vcpu, gva_t addr)
+static int FNAME(walk_addr)(struct guest_walker *walker,
+                            struct kvm_vcpu *vcpu, gva_t addr,
+                            int write_fault, int user_fault, int fetch_fault)
 {
         hpa_t hpa;
         struct kvm_memory_slot *slot;
@@ -86,7 +88,7 @@ static void FNAME(walk_addr)(struct guest_walker *walker,
                 walker->ptep = &vcpu->pdptrs[(addr >> 30) & 3];
                 root = *walker->ptep;
                 if (!(root & PT_PRESENT_MASK))
-                        return;
+                        goto not_present;
                 --walker->level;
         }
 #endif
@@ -111,11 +113,23 @@ static void FNAME(walk_addr)(struct guest_walker *walker,
                 ASSERT(((unsigned long)walker->table & PAGE_MASK) ==
                        ((unsigned long)ptep & PAGE_MASK));
 
-                if (is_present_pte(*ptep) && !(*ptep &  PT_ACCESSED_MASK))
-                        *ptep |= PT_ACCESSED_MASK;
-
                 if (!is_present_pte(*ptep))
-                        break;
+                        goto not_present;
+
+                if (write_fault && !is_writeble_pte(*ptep))
+                        if (user_fault || is_write_protection(vcpu))
+                                goto access_error;
+
+                if (user_fault && !(*ptep & PT_USER_MASK))
+                        goto access_error;
+
+#if PTTYPE == 64
+                if (fetch_fault && is_nx(vcpu) && (*ptep & PT64_NX_MASK))
+                        goto access_error;
+#endif
+
+                if (!(*ptep & PT_ACCESSED_MASK))
+                        *ptep |= PT_ACCESSED_MASK;      /* avoid rmw */
 
                 if (walker->level == PT_PAGE_TABLE_LEVEL) {
                         walker->gfn = (*ptep & PT_BASE_ADDR_MASK)
@@ -146,6 +160,23 @@ static void FNAME(walk_addr)(struct guest_walker *walker,
         }
         walker->ptep = ptep;
         pgprintk("%s: pte %llx\n", __FUNCTION__, (u64)*ptep);
+        return 1;
+
+not_present:
+        walker->error_code = 0;
+        goto err;
+
+access_error:
+        walker->error_code = PFERR_PRESENT_MASK;
+
+err:
+        if (write_fault)
+                walker->error_code |= PFERR_WRITE_MASK;
+        if (user_fault)
+                walker->error_code |= PFERR_USER_MASK;
+        if (fetch_fault)
+                walker->error_code |= PFERR_FETCH_MASK;
+        return 0;
 }
 
 static void FNAME(release_walker)(struct guest_walker *walker)
@@ -274,7 +305,7 @@ static int FNAME(fix_write_pf)(struct kvm_vcpu *vcpu,
         struct kvm_mmu_page *page;
 
         if (is_writeble_pte(*shadow_ent))
-                return 0;
+                return !user || (*shadow_ent & PT_USER_MASK);
 
         writable_shadow = *shadow_ent & PT_SHADOW_WRITABLE_MASK;
         if (user) {
@@ -347,8 +378,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
                                u32 error_code)
 {
         int write_fault = error_code & PFERR_WRITE_MASK;
-        int pte_present = error_code & PFERR_PRESENT_MASK;
         int user_fault = error_code & PFERR_USER_MASK;
+        int fetch_fault = error_code & PFERR_FETCH_MASK;
         struct guest_walker walker;
         u64 *shadow_pte;
         int fixed;
@@ -365,19 +396,20 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         /*
          * Look up the shadow pte for the faulting address.
          */
-        FNAME(walk_addr)(&walker, vcpu, addr);
-        shadow_pte = FNAME(fetch)(vcpu, addr, &walker);
+        r = FNAME(walk_addr)(&walker, vcpu, addr, write_fault, user_fault,
+                             fetch_fault);
 
         /*
          * The page is not mapped by the guest.  Let the guest handle it.
          */
-        if (!shadow_pte) {
-                pgprintk("%s: not mapped\n", __FUNCTION__);
-                inject_page_fault(vcpu, addr, error_code);
+        if (!r) {
+                pgprintk("%s: guest page fault\n", __FUNCTION__);
+                inject_page_fault(vcpu, addr, walker.error_code);
                 FNAME(release_walker)(&walker);
                 return 0;
         }
 
+        shadow_pte = FNAME(fetch)(vcpu, addr, &walker);
         pgprintk("%s: shadow pte %p %llx\n", __FUNCTION__,
                  shadow_pte, *shadow_pte);
 
@@ -399,22 +431,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
          * mmio: emulate if accessible, otherwise its a guest fault.
          */
         if (is_io_pte(*shadow_pte)) {
-                if (may_access(*shadow_pte, write_fault, user_fault))
-                        return 1;
-                pgprintk("%s: io work, no access\n", __FUNCTION__);
-                inject_page_fault(vcpu, addr,
-                                  error_code | PFERR_PRESENT_MASK);
-                kvm_mmu_audit(vcpu, "post page fault (io)");
-                return 0;
-        }
-
-        /*
-         * pte not present, guest page fault.
-         */
-        if (pte_present && !fixed && !write_pt) {
-                inject_page_fault(vcpu, addr, error_code);
-                kvm_mmu_audit(vcpu, "post page fault (guest)");
-                return 0;
+                return 1;
         }
 
         ++kvm_stat.pf_fixed;
@@ -429,7 +446,7 @@ static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr)
         pt_element_t guest_pte;
         gpa_t gpa;
 
-        FNAME(walk_addr)(&walker, vcpu, vaddr);
+        FNAME(walk_addr)(&walker, vcpu, vaddr, 0, 0, 0);
         guest_pte = *walker.ptep;
         FNAME(release_walker)(&walker);
 
diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
index 714f6a7841cd..c79df79307ed 100644
--- a/drivers/kvm/svm.c
+++ b/drivers/kvm/svm.c
@@ -502,6 +502,7 @@ static void init_vmcb(struct vmcb *vmcb)
                                 (1ULL << INTERCEPT_IOIO_PROT) |
                                 (1ULL << INTERCEPT_MSR_PROT) |
                                 (1ULL << INTERCEPT_TASK_SWITCH) |
+                                (1ULL << INTERCEPT_SHUTDOWN) |
                                 (1ULL << INTERCEPT_VMRUN) |
                                 (1ULL << INTERCEPT_VMMCALL) |
                                 (1ULL << INTERCEPT_VMLOAD) |
@@ -680,14 +681,14 @@ static void svm_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
 
 static void svm_get_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        dt->limit = vcpu->svm->vmcb->save.ldtr.limit;
-        dt->base = vcpu->svm->vmcb->save.ldtr.base;
+        dt->limit = vcpu->svm->vmcb->save.idtr.limit;
+        dt->base = vcpu->svm->vmcb->save.idtr.base;
 }
 
 static void svm_set_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        vcpu->svm->vmcb->save.ldtr.limit = dt->limit;
-        vcpu->svm->vmcb->save.ldtr.base = dt->base ;
+        vcpu->svm->vmcb->save.idtr.limit = dt->limit;
+        vcpu->svm->vmcb->save.idtr.base = dt->base ;
 }
 
 static void svm_get_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
@@ -892,6 +893,19 @@ static int pf_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         return 0;
 }
 
+static int shutdown_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+{
+        /*
+         * VMCB is undefined after a SHUTDOWN intercept
+         * so reinitialize it.
+         */
+        memset(vcpu->svm->vmcb, 0, PAGE_SIZE);
+        init_vmcb(vcpu->svm->vmcb);
+
+        kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
+        return 0;
+}
+
 static int io_get_override(struct kvm_vcpu *vcpu,
                           struct vmcb_seg **seg,
                           int *addr_override)
@@ -1149,7 +1163,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 data)
         case MSR_K6_STAR:
                 vcpu->svm->vmcb->save.star = data;
                 break;
-#ifdef CONFIG_X86_64_
+#ifdef CONFIG_X86_64
         case MSR_LSTAR:
                 vcpu->svm->vmcb->save.lstar = data;
                 break;
@@ -1249,6 +1263,7 @@ static int (*svm_exit_handlers[])(struct kvm_vcpu *vcpu,
         [SVM_EXIT_IOIO]                         = io_interception,
         [SVM_EXIT_MSR]                          = msr_interception,
         [SVM_EXIT_TASK_SWITCH]                  = task_switch_interception,
+        [SVM_EXIT_SHUTDOWN]                     = shutdown_interception,
         [SVM_EXIT_VMRUN]                        = invalid_op_interception,
         [SVM_EXIT_VMMCALL]                      = invalid_op_interception,
         [SVM_EXIT_VMLOAD]                       = invalid_op_interception,
@@ -1407,7 +1422,8 @@ static int svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         int r;
 
 again:
-        do_interrupt_requests(vcpu, kvm_run);
+        if (!vcpu->mmio_read_completed)
+                do_interrupt_requests(vcpu, kvm_run);
 
         clgi();
 
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index 0aa2659f6ae5..54c35c0b3181 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -1116,6 +1116,8 @@ static int vmx_vcpu_setup(struct kvm_vcpu *vcpu)
 
                 if (rdmsr_safe(index, &data_low, &data_high) < 0)
                         continue;
+                if (wrmsr_safe(index, data_low, data_high) < 0)
+                        continue;
                 data = data_low | ((u64)data_high << 32);
                 vcpu->host_msrs[j].index = index;
                 vcpu->host_msrs[j].reserved = 0;
@@ -1717,7 +1719,8 @@ again:
         vmcs_writel(HOST_GS_BASE, segment_base(gs_sel));
 #endif
 
-        do_interrupt_requests(vcpu, kvm_run);
+        if (!vcpu->mmio_read_completed)
+                do_interrupt_requests(vcpu, kvm_run);
 
         if (vcpu->guest_debug.enabled)
                 kvm_guest_debug_pre(vcpu);
diff --git a/drivers/kvm/x86_emulate.c b/drivers/kvm/x86_emulate.c
index be70795b4822..7513cddb929f 100644
--- a/drivers/kvm/x86_emulate.c
+++ b/drivers/kvm/x86_emulate.c
@@ -61,6 +61,7 @@
 #define ModRM       (1<<6)
 /* Destination is only written; never read. */
 #define Mov         (1<<7)
+#define BitOp       (1<<8)
 
 static u8 opcode_table[256] = {
         /* 0x00 - 0x07 */
@@ -148,7 +149,7 @@ static u8 opcode_table[256] = {
         0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
 };
 
-static u8 twobyte_table[256] = {
+static u16 twobyte_table[256] = {
         /* 0x00 - 0x0F */
         0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
         0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
@@ -180,16 +181,16 @@ static u8 twobyte_table[256] = {
         /* 0x90 - 0x9F */
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         /* 0xA0 - 0xA7 */
-        0, 0, 0, DstMem | SrcReg | ModRM, 0, 0, 0, 0,
+        0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
         /* 0xA8 - 0xAF */
-        0, 0, 0, DstMem | SrcReg | ModRM, 0, 0, 0, 0,
+        0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
         /* 0xB0 - 0xB7 */
         ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
-            DstMem | SrcReg | ModRM,
+            DstMem | SrcReg | ModRM | BitOp,
         0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
             DstReg | SrcMem16 | ModRM | Mov,
         /* 0xB8 - 0xBF */
-        0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM,
+        0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
         0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
             DstReg | SrcMem16 | ModRM | Mov,
         /* 0xC0 - 0xCF */
@@ -469,7 +470,8 @@ static int read_descriptor(struct x86_emulate_ctxt *ctxt,
 int
 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
 {
-        u8 b, d, sib, twobyte = 0, rex_prefix = 0;
+        unsigned d;
+        u8 b, sib, twobyte = 0, rex_prefix = 0;
         u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
         unsigned long *override_base = NULL;
         unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
@@ -726,46 +728,6 @@ done_prefixes:
                 ;
         }
 
-        /* Decode and fetch the destination operand: register or memory. */
-        switch (d & DstMask) {
-        case ImplicitOps:
-                /* Special instructions do their own operand decoding. */
-                goto special_insn;
-        case DstReg:
-                dst.type = OP_REG;
-                if ((d & ByteOp)
-                    && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
-                        dst.ptr = decode_register(modrm_reg, _regs,
-                                                  (rex_prefix == 0));
-                        dst.val = *(u8 *) dst.ptr;
-                        dst.bytes = 1;
-                } else {
-                        dst.ptr = decode_register(modrm_reg, _regs, 0);
-                        switch ((dst.bytes = op_bytes)) {
-                        case 2:
-                                dst.val = *(u16 *)dst.ptr;
-                                break;
-                        case 4:
-                                dst.val = *(u32 *)dst.ptr;
-                                break;
-                        case 8:
-                                dst.val = *(u64 *)dst.ptr;
-                                break;
-                        }
-                }
-                break;
-        case DstMem:
-                dst.type = OP_MEM;
-                dst.ptr = (unsigned long *)cr2;
-                dst.bytes = (d & ByteOp) ? 1 : op_bytes;
-                if (!(d & Mov) && /* optimisation - avoid slow emulated read */
-                    ((rc = ops->read_emulated((unsigned long)dst.ptr,
-                                              &dst.val, dst.bytes, ctxt)) != 0))
-                        goto done;
-                break;
-        }
-        dst.orig_val = dst.val;
-
         /*
          * Decode and fetch the source operand: register, memory
          * or immediate.
@@ -838,6 +800,50 @@ done_prefixes:
                 break;
         }
 
+        /* Decode and fetch the destination operand: register or memory. */
+        switch (d & DstMask) {
+        case ImplicitOps:
+                /* Special instructions do their own operand decoding. */
+                goto special_insn;
+        case DstReg:
+                dst.type = OP_REG;
+                if ((d & ByteOp)
+                    && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
+                        dst.ptr = decode_register(modrm_reg, _regs,
+                                                  (rex_prefix == 0));
+                        dst.val = *(u8 *) dst.ptr;
+                        dst.bytes = 1;
+                } else {
+                        dst.ptr = decode_register(modrm_reg, _regs, 0);
+                        switch ((dst.bytes = op_bytes)) {
+                        case 2:
+                                dst.val = *(u16 *)dst.ptr;
+                                break;
+                        case 4:
+                                dst.val = *(u32 *)dst.ptr;
+                                break;
+                        case 8:
+                                dst.val = *(u64 *)dst.ptr;
+                                break;
+                        }
+                }
+                break;
+        case DstMem:
+                dst.type = OP_MEM;
+                dst.ptr = (unsigned long *)cr2;
+                dst.bytes = (d & ByteOp) ? 1 : op_bytes;
+                if (d & BitOp) {
+                        dst.ptr += src.val / BITS_PER_LONG;
+                        dst.bytes = sizeof(long);
+                }
+                if (!(d & Mov) && /* optimisation - avoid slow emulated read */
+                    ((rc = ops->read_emulated((unsigned long)dst.ptr,
+                                              &dst.val, dst.bytes, ctxt)) != 0))
+                        goto done;
+                break;
+        }
+        dst.orig_val = dst.val;
+
         if (twobyte)
                 goto twobyte_insn;
 
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 5432d07c074d..11108165e264 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -479,9 +479,12 @@ static int bitmap_read_sb(struct bitmap *bitmap)
         int err = -EINVAL;
 
         /* page 0 is the superblock, read it... */
-        if (bitmap->file)
-                bitmap->sb_page = read_page(bitmap->file, 0, bitmap, PAGE_SIZE);
-        else {
+        if (bitmap->file) {
+                loff_t isize = i_size_read(bitmap->file->f_mapping->host);
+                int bytes = isize > PAGE_SIZE ? PAGE_SIZE : isize;
+
+                bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes);
+        } else {
                 bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset, 0);
         }
         if (IS_ERR(bitmap->sb_page)) {
@@ -877,7 +880,8 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                         int count;
                         /* unmap the old page, we're done with it */
                         if (index == num_pages-1)
-                                count = bytes - index * PAGE_SIZE;
+                                count = bytes + sizeof(bitmap_super_t)
+                                        - index * PAGE_SIZE;
                         else
                                 count = PAGE_SIZE;
                         if (index == 0) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index fe7c56e10435..3668b170ea68 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1116,7 +1116,8 @@ static int __bind(struct mapped_device *md, struct dm_table *t)
         if (size != get_capacity(md->disk))
                 memset(&md->geometry, 0, sizeof(md->geometry));
 
-        __set_size(md, size);
+        if (md->suspended_bdev)
+                __set_size(md, size);
         if (size == 0)
                 return 0;
 
@@ -1264,6 +1265,11 @@ int dm_swap_table(struct mapped_device *md, struct dm_table *table)
         if (!dm_suspended(md))
                 goto out;
 
+        /* without bdev, the device size cannot be changed */
+        if (!md->suspended_bdev)
+                if (get_capacity(md->disk) != dm_table_get_size(table))
+                        goto out;
+
         __unbind(md);
         r = __bind(md, table);
 
@@ -1341,11 +1347,14 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
         /* This does not get reverted if there's an error later. */
         dm_table_presuspend_targets(map);
 
-        md->suspended_bdev = bdget_disk(md->disk, 0);
-        if (!md->suspended_bdev) {
-                DMWARN("bdget failed in dm_suspend");
-                r = -ENOMEM;
-                goto flush_and_out;
+        /* bdget() can stall if the pending I/Os are not flushed */
+        if (!noflush) {
+                md->suspended_bdev = bdget_disk(md->disk, 0);
+                if (!md->suspended_bdev) {
+                        DMWARN("bdget failed in dm_suspend");
+                        r = -ENOMEM;
+                        goto flush_and_out;
+                }
         }
 
         /*
@@ -1473,8 +1482,10 @@ int dm_resume(struct mapped_device *md)
 
         unlock_fs(md);
 
-        bdput(md->suspended_bdev);
-        md->suspended_bdev = NULL;
+        if (md->suspended_bdev) {
+                bdput(md->suspended_bdev);
+                md->suspended_bdev = NULL;
+        }
 
         clear_bit(DMF_SUSPENDED, &md->flags);
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d1cb45f6d6a9..e8807ea5377d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1633,7 +1633,8 @@ repeat:
          * and 'events' is odd, we can roll back to the previous clean state */
         if (nospares
             && (mddev->in_sync && mddev->recovery_cp == MaxSector)
-            && (mddev->events & 1))
+            && (mddev->events & 1)
+            && mddev->events != 1)
                 mddev->events--;
         else {
                 /* otherwise we have to go forward and ... */
@@ -3563,6 +3564,8 @@ static int get_bitmap_file(mddev_t * mddev, void __user * arg)
         char *ptr, *buf = NULL;
         int err = -ENOMEM;
 
+        md_allow_write(mddev);
+
         file = kmalloc(sizeof(*file), GFP_KERNEL);
         if (!file)
                 goto out;
@@ -5031,6 +5034,33 @@ void md_write_end(mddev_t *mddev)
         }
 }
 
+/* md_allow_write(mddev)
+ * Calling this ensures that the array is marked 'active' so that writes
+ * may proceed without blocking.  It is important to call this before
+ * attempting a GFP_KERNEL allocation while holding the mddev lock.
+ * Must be called with mddev_lock held.
+ */
+void md_allow_write(mddev_t *mddev)
+{
+        if (!mddev->pers)
+                return;
+        if (mddev->ro)
+                return;
+
+        spin_lock_irq(&mddev->write_lock);
+        if (mddev->in_sync) {
+                mddev->in_sync = 0;
+                set_bit(MD_CHANGE_CLEAN, &mddev->flags);
+                if (mddev->safemode_delay &&
+                    mddev->safemode == 0)
+                        mddev->safemode = 1;
+                spin_unlock_irq(&mddev->write_lock);
+                md_update_sb(mddev, 0);
+        } else
+                spin_unlock_irq(&mddev->write_lock);
+}
+EXPORT_SYMBOL_GPL(md_allow_write);
+
 static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
 
 #define SYNC_MARKS      10
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 164b25dca101..97ee870b265d 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1266,6 +1266,11 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
                                         sbio->bi_sector = r1_bio->sector +
                                                 conf->mirrors[i].rdev->data_offset;
                                         sbio->bi_bdev = conf->mirrors[i].rdev->bdev;
+                                        for (j = 0; j < vcnt ; j++)
+                                                memcpy(page_address(sbio->bi_io_vec[j].bv_page),
+                                                       page_address(pbio->bi_io_vec[j].bv_page),
+                                                       PAGE_SIZE);
+
                                 }
                         }
         }
@@ -2099,6 +2104,8 @@ static int raid1_reshape(mddev_t *mddev)
                 return -EINVAL;
         }
 
+        md_allow_write(mddev);
+
         raid_disks = mddev->raid_disks + mddev->delta_disks;
 
         if (raid_disks < conf->raid_disks) {
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index be008f034ada..467c16982d02 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -405,6 +405,8 @@ static int resize_stripes(raid5_conf_t *conf, int newsize)
         if (newsize <= conf->pool_size)
                 return 0; /* never bother to shrink */
 
+        md_allow_write(conf->mddev);
+
         /* Step 1 */
         sc = kmem_cache_create(conf->cache_name[1-conf->active_name],
                                sizeof(struct stripe_head)+(newsize-1)*sizeof(struct r5dev),
@@ -2678,7 +2680,7 @@ static int chunk_aligned_read(request_queue_t *q, struct bio * raid_bio)
         mdk_rdev_t *rdev;
 
         if (!in_chunk_boundary(mddev, raid_bio)) {
-                printk("chunk_aligned_read : non aligned\n");
+                PRINTK("chunk_aligned_read : non aligned\n");
                 return 0;
         }
         /*
@@ -3250,6 +3252,7 @@ raid5_store_stripe_cache_size(mddev_t *mddev, const char *page, size_t len)
                 else
                         break;
         }
+        md_allow_write(mddev);
         while (new > conf->max_nr_stripes) {
                 if (grow_one_stripe(conf))
                         conf->max_nr_stripes++;
diff --git a/drivers/media/video/video-buf.c b/drivers/media/video/video-buf.c
index 635d102c86f0..6504a5866849 100644
--- a/drivers/media/video/video-buf.c
+++ b/drivers/media/video/video-buf.c
@@ -700,6 +700,7 @@ videobuf_qbuf(struct videobuf_queue *q,
                 goto done;
         }
         if (buf->state == STATE_QUEUED ||
+            buf->state == STATE_PREPARED ||
             buf->state == STATE_ACTIVE) {
                 dprintk(1,"qbuf: buffer is already queued or active.\n");
                 goto done;
diff --git a/drivers/mtd/nand/cafe.c b/drivers/mtd/nand/cafe.c
index b8d9b64cccc0..65f9bd3ceebf 100644
--- a/drivers/mtd/nand/cafe.c
+++ b/drivers/mtd/nand/cafe.c
@@ -14,6 +14,7 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/dma-mapping.h>
 #include <asm/io.h>
 
 #define CAFE_NAND_CTRL1         0x00
diff --git a/drivers/net/82596.c b/drivers/net/82596.c
index 8236f26ffd46..640d7ca2ebcf 100644
--- a/drivers/net/82596.c
+++ b/drivers/net/82596.c
@@ -1066,8 +1066,8 @@ static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev)
         short length = skb->len;
         dev->trans_start = jiffies;
 
-        DEB(DEB_STARTTX,printk(KERN_DEBUG "%s: i596_start_xmit(%x,%x) called\n", dev->name,
-                                skb->len, (unsigned int)skb->data));
+        DEB(DEB_STARTTX,printk(KERN_DEBUG "%s: i596_start_xmit(%x,%p) called\n",
+                                dev->name, skb->len, skb->data));
 
         if (skb->len < ETH_ZLEN) {
                 if (skb_padto(skb, ETH_ZLEN))
@@ -1246,7 +1246,8 @@ struct net_device * __init i82596_probe(int unit)
         dev->priv = (void *)(dev->mem_start);
 
         lp = dev->priv;
-        DEB(DEB_INIT,printk(KERN_DEBUG "%s: lp at 0x%08lx (%d bytes), lp->scb at 0x%08lx\n",
+        DEB(DEB_INIT,printk(KERN_DEBUG "%s: lp at 0x%08lx (%zd bytes), "
+                        "lp->scb at 0x%08lx\n",
                         dev->name, (unsigned long)lp,
                         sizeof(struct i596_private), (unsigned long)&lp->scb));
         memset((void *) lp, 0, sizeof(struct i596_private));
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 5eb2ec68393f..303a8d94ad4b 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -110,6 +110,11 @@ MODULE_DEVICE_TABLE(pci, b44_pci_tbl);
 
 static void b44_halt(struct b44 *);
 static void b44_init_rings(struct b44 *);
+
+#define B44_FULL_RESET          1
+#define B44_FULL_RESET_SKIP_PHY 2
+#define B44_PARTIAL_RESET       3
+
 static void b44_init_hw(struct b44 *, int);
 
 static int dma_desc_align_mask;
@@ -752,7 +757,7 @@ static void b44_recycle_rx(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                                              dest_idx * sizeof(dest_desc),
                                              DMA_BIDIRECTIONAL);
 
-        pci_dma_sync_single_for_device(bp->pdev, src_desc->addr,
+        pci_dma_sync_single_for_device(bp->pdev, le32_to_cpu(src_desc->addr),
                                        RX_PKT_BUF_SZ,
                                        PCI_DMA_FROMDEVICE);
 }
@@ -884,7 +889,7 @@ static int b44_poll(struct net_device *netdev, int *budget)
                 spin_lock_irqsave(&bp->lock, flags);
                 b44_halt(bp);
                 b44_init_rings(bp);
-                b44_init_hw(bp, 1);
+                b44_init_hw(bp, B44_FULL_RESET_SKIP_PHY);
                 netif_wake_queue(bp->dev);
                 spin_unlock_irqrestore(&bp->lock, flags);
                 done = 1;
@@ -954,7 +959,7 @@ static void b44_tx_timeout(struct net_device *dev)
 
         b44_halt(bp);
         b44_init_rings(bp);
-        b44_init_hw(bp, 1);
+        b44_init_hw(bp, B44_FULL_RESET);
 
         spin_unlock_irq(&bp->lock);
 
@@ -1071,7 +1076,7 @@ static int b44_change_mtu(struct net_device *dev, int new_mtu)
         b44_halt(bp);
         dev->mtu = new_mtu;
         b44_init_rings(bp);
-        b44_init_hw(bp, 1);
+        b44_init_hw(bp, B44_FULL_RESET);
         spin_unlock_irq(&bp->lock);
 
         b44_enable_ints(bp);
@@ -1368,12 +1373,12 @@ static int b44_set_mac_addr(struct net_device *dev, void *p)
  * packet processing.  Invoked with bp->lock held.
  */
 static void __b44_set_rx_mode(struct net_device *);
-static void b44_init_hw(struct b44 *bp, int full_reset)
+static void b44_init_hw(struct b44 *bp, int reset_kind)
 {
         u32 val;
 
         b44_chip_reset(bp);
-        if (full_reset) {
+        if (reset_kind == B44_FULL_RESET) {
                 b44_phy_reset(bp);
                 b44_setup_phy(bp);
         }
@@ -1390,7 +1395,10 @@ static void b44_init_hw(struct b44 *bp, int full_reset)
         bw32(bp, B44_TXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + RX_HEADER_LEN);
 
         bw32(bp, B44_TX_WMARK, 56); /* XXX magic */
-        if (full_reset) {
+        if (reset_kind == B44_PARTIAL_RESET) {
+                bw32(bp, B44_DMARX_CTRL, (DMARX_CTRL_ENABLE |
+                                      (bp->rx_offset << DMARX_CTRL_ROSHIFT)));
+        } else {
                 bw32(bp, B44_DMATX_CTRL, DMATX_CTRL_ENABLE);
                 bw32(bp, B44_DMATX_ADDR, bp->tx_ring_dma + bp->dma_offset);
                 bw32(bp, B44_DMARX_CTRL, (DMARX_CTRL_ENABLE |
@@ -1401,9 +1409,6 @@ static void b44_init_hw(struct b44 *bp, int full_reset)
                 bp->rx_prod = bp->rx_pending;
 
                 bw32(bp, B44_MIB_CTRL, MIB_CTRL_CLR_ON_READ);
-        } else {
-                bw32(bp, B44_DMARX_CTRL, (DMARX_CTRL_ENABLE |
-                                      (bp->rx_offset << DMARX_CTRL_ROSHIFT)));
         }
 
         val = br32(bp, B44_ENET_CTRL);
@@ -1420,7 +1425,7 @@ static int b44_open(struct net_device *dev)
                 goto out;
 
         b44_init_rings(bp);
-        b44_init_hw(bp, 1);
+        b44_init_hw(bp, B44_FULL_RESET);
 
         b44_check_phy(bp);
 
@@ -1629,7 +1634,7 @@ static int b44_close(struct net_device *dev)
         netif_poll_enable(dev);
 
         if (bp->flags & B44_FLAG_WOL_ENABLE) {
-                b44_init_hw(bp, 0);
+                b44_init_hw(bp, B44_PARTIAL_RESET);
                 b44_setup_wol(bp);
         }
 
@@ -1905,7 +1910,7 @@ static int b44_set_ringparam(struct net_device *dev,
 
         b44_halt(bp);
         b44_init_rings(bp);
-        b44_init_hw(bp, 1);
+        b44_init_hw(bp, B44_FULL_RESET);
         netif_wake_queue(bp->dev);
         spin_unlock_irq(&bp->lock);
 
@@ -1948,7 +1953,7 @@ static int b44_set_pauseparam(struct net_device *dev,
         if (bp->flags & B44_FLAG_PAUSE_AUTO) {
                 b44_halt(bp);
                 b44_init_rings(bp);
-                b44_init_hw(bp, 1);
+                b44_init_hw(bp, B44_FULL_RESET);
         } else {
                 __b44_set_flow_ctrl(bp, bp->flags);
         }
@@ -2304,7 +2309,7 @@ static int b44_suspend(struct pci_dev *pdev, pm_message_t state)
 
         free_irq(dev->irq, dev);
         if (bp->flags & B44_FLAG_WOL_ENABLE) {
-                b44_init_hw(bp, 0);
+                b44_init_hw(bp, B44_PARTIAL_RESET);
                 b44_setup_wol(bp);
         }
         pci_disable_device(pdev);
@@ -2315,21 +2320,32 @@ static int b44_resume(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct b44 *bp = netdev_priv(dev);
+        int rc = 0;
 
         pci_restore_state(pdev);
-        pci_enable_device(pdev);
+        rc = pci_enable_device(pdev);
+        if (rc) {
+                printk(KERN_ERR PFX "%s: pci_enable_device failed\n",
+                        dev->name);
+                return rc;
+        }
+
         pci_set_master(pdev);
 
         if (!netif_running(dev))
                 return 0;
 
-        if (request_irq(dev->irq, b44_interrupt, IRQF_SHARED, dev->name, dev))
+        rc = request_irq(dev->irq, b44_interrupt, IRQF_SHARED, dev->name, dev);
+        if (rc) {
                 printk(KERN_ERR PFX "%s: request_irq failed\n", dev->name);
+                pci_disable_device(pdev);
+                return rc;
+        }
 
         spin_lock_irq(&bp->lock);
 
         b44_init_rings(bp);
-        b44_init_hw(bp, 1);
+        b44_init_hw(bp, B44_FULL_RESET);
         netif_device_attach(bp->dev);
         spin_unlock_irq(&bp->lock);
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index ca5acc4736df..ee7b75b976b5 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -57,8 +57,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.3"
-#define DRV_MODULE_RELDATE      "January 8, 2007"
+#define DRV_MODULE_VERSION      "1.5.5"
+#define DRV_MODULE_RELDATE      "February 1, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -1356,6 +1356,14 @@ bnx2_init_copper_phy(struct bnx2 *bp)
                 bnx2_write_phy(bp, 0x18, 0x0400);
         }
 
+        if (bp->phy_flags & PHY_DIS_EARLY_DAC_FLAG) {
+                bnx2_write_phy(bp, MII_BNX2_DSP_ADDRESS,
+                               MII_BNX2_DSP_EXPAND_REG | 0x8);
+                bnx2_read_phy(bp, MII_BNX2_DSP_RW_PORT, &val);
+                val &= ~(1 << 8);
+                bnx2_write_phy(bp, MII_BNX2_DSP_RW_PORT, val);
+        }
+
         if (bp->dev->mtu > 1500) {
                 /* Set extended packet length bit */
                 bnx2_write_phy(bp, 0x18, 0x7);
@@ -5845,9 +5853,11 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         reg = REG_RD_IND(bp, BNX2_SHM_HDR_SIGNATURE);
 
         if ((reg & BNX2_SHM_HDR_SIGNATURE_SIG_MASK) ==
-            BNX2_SHM_HDR_SIGNATURE_SIG)
-                bp->shmem_base = REG_RD_IND(bp, BNX2_SHM_HDR_ADDR_0);
-        else
+            BNX2_SHM_HDR_SIGNATURE_SIG) {
+                u32 off = PCI_FUNC(pdev->devfn) << 2;
+
+                bp->shmem_base = REG_RD_IND(bp, BNX2_SHM_HDR_ADDR_0 + off);
+        } else
                 bp->shmem_base = HOST_VIEW_SHMEM_BASE;
 
         /* Get the permanent MAC address.  First we need to make sure the
@@ -5916,6 +5926,8 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         } else if (CHIP_NUM(bp) == CHIP_NUM_5706 ||
                    CHIP_NUM(bp) == CHIP_NUM_5708)
                 bp->phy_flags |= PHY_CRC_FIX_FLAG;
+        else if (CHIP_ID(bp) == CHIP_ID_5709_A0)
+                bp->phy_flags |= PHY_DIS_EARLY_DAC_FLAG;
 
         if ((CHIP_ID(bp) == CHIP_ID_5708_A0) ||
             (CHIP_ID(bp) == CHIP_ID_5708_B0) ||
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 13b6f9b11e01..ccbdf81c6599 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6288,6 +6288,10 @@ struct l2_fhdr {
 
 #define BCM5708S_TX_ACTL3                       0x17
 
+#define MII_BNX2_DSP_RW_PORT                    0x15
+#define MII_BNX2_DSP_ADDRESS                    0x17
+#define MII_BNX2_DSP_EXPAND_REG                  0x0f00
+
 #define MIN_ETHERNET_PACKET_SIZE        60
 #define MAX_ETHERNET_PACKET_SIZE        1514
 #define MAX_ETHERNET_JUMBO_PACKET_SIZE  9014
@@ -6489,6 +6493,7 @@ struct bnx2 {
 #define PHY_INT_MODE_MASK_FLAG          0x300
 #define PHY_INT_MODE_AUTO_POLLING_FLAG  0x100
 #define PHY_INT_MODE_LINK_READY_FLAG    0x200
+#define PHY_DIS_EARLY_DAC_FLAG          0x400
 
         u32                     chip_id;
         /* chip num:16-31, rev:12-15, metal:4-11, bond_id:0-3 */
@@ -6512,6 +6517,7 @@ struct bnx2 {
 #define CHIP_ID_5708_A0                 0x57080000
 #define CHIP_ID_5708_B0                 0x57081000
 #define CHIP_ID_5708_B1                 0x57081010
+#define CHIP_ID_5709_A0                 0x57090000
 
 #define CHIP_BOND_ID(bp)                (((bp)->chip_id) & 0xf)
 
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index dc434fb6da85..0978c9ac6d2b 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -151,8 +151,8 @@ struct slave {
         struct slave *next;
         struct slave *prev;
         int    delay;
-        u32    jiffies;
-        u32    last_arp_rx;
+        unsigned long jiffies;
+        unsigned long last_arp_rx;
         s8     link;    /* one of BOND_LINK_XXXX */
         s8     state;   /* one of BOND_STATE_XXXX */
         u32    original_flags;
@@ -242,7 +242,8 @@ extern inline int slave_do_arp_validate(struct bonding *bond, struct slave *slav
         return bond->params.arp_validate & (1 << slave->state);
 }
 
-extern inline u32 slave_last_rx(struct bonding *bond, struct slave *slave)
+extern inline unsigned long slave_last_rx(struct bonding *bond,
+                                        struct slave *slave)
 {
         if (slave_do_arp_validate(bond, slave))
                 return slave->last_arp_rx;
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index c2ae2a24629b..0cefef5e3f06 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2718,12 +2718,11 @@ static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct nic *nic = netdev_priv(netdev);
 
-#ifdef CONFIG_E100_NAPI
         if (netif_running(netdev))
                 netif_poll_disable(nic->netdev);
-#endif
         del_timer_sync(&nic->watchdog);
         netif_carrier_off(nic->netdev);
+        netif_device_detach(netdev);
 
         pci_save_state(pdev);
 
@@ -2736,6 +2735,7 @@ static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
         }
 
         pci_disable_device(pdev);
+        free_irq(pdev->irq, netdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
         return 0;
@@ -2759,16 +2759,13 @@ static int e100_resume(struct pci_dev *pdev)
 }
 #endif /* CONFIG_PM */
 
-
 static void e100_shutdown(struct pci_dev *pdev)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct nic *nic = netdev_priv(netdev);
 
-#ifdef CONFIG_E100_NAPI
         if (netif_running(netdev))
                 netif_poll_disable(nic->netdev);
-#endif
         del_timer_sync(&nic->watchdog);
         netif_carrier_off(nic->netdev);
 
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 39ad9f73d1ec..272e1ec51aa2 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -39,7 +39,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0043"
+#define DRV_VERSION     "EHEA_0045"
 
 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
         | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 83fa32f72398..9de2d38a5321 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -558,12 +558,12 @@ static irqreturn_t ehea_qp_aff_irq_handler(int irq, void *param)
         u32 qp_token;
 
         eqe = ehea_poll_eq(port->qp_eq);
-        ehea_debug("eqe=%p", eqe);
+
         while (eqe) {
-                ehea_debug("*eqe=%lx", *(u64*)eqe);
-                eqe = ehea_poll_eq(port->qp_eq);
                 qp_token = EHEA_BMASK_GET(EHEA_EQE_QP_TOKEN, eqe->entry);
-                ehea_debug("next eqe=%p", eqe);
+                ehea_error("QP aff_err: entry=0x%lx, token=0x%x",
+                           eqe->entry, qp_token);
+                eqe = ehea_poll_eq(port->qp_eq);
         }
 
         return IRQ_HANDLED;
@@ -575,8 +575,9 @@ static struct ehea_port *ehea_get_port(struct ehea_adapter *adapter,
         int i;
 
         for (i = 0; i < adapter->num_ports; i++)
-                if (adapter->port[i]->logical_port_id == logical_port)
-                        return adapter->port[i];
+                if (adapter->port[i])
+                        if (adapter->port[i]->logical_port_id == logical_port)
+                                return adapter->port[i];
         return NULL;
 }
 
@@ -642,6 +643,8 @@ int ehea_sense_port_attr(struct ehea_port *port)
                 break;
         }
 
+        port->autoneg = 1;
+
         /* Number of default QPs */
         port->num_def_qps = cb0->num_default_qps;
 
@@ -728,10 +731,7 @@ int ehea_set_portspeed(struct ehea_port *port, u32 port_speed)
                 }
         } else {
                 if (hret == H_AUTHORITY) {
-                        ehea_info("Hypervisor denied setting port speed. Either"
-                                  " this partition is not authorized to set "
-                                  "port speed or another partition has modified"
-                                  " port speed first.");
+                        ehea_info("Hypervisor denied setting port speed");
                         ret = -EPERM;
                 } else {
                         ret = -EIO;
@@ -998,7 +998,7 @@ static int ehea_configure_port(struct ehea_port *port)
                      | EHEA_BMASK_SET(PXLY_RC_JUMBO_FRAME, 1);
 
         for (i = 0; i < port->num_def_qps; i++)
-                cb0->default_qpn_arr[i] = port->port_res[i].qp->init_attr.qp_nr;
+                cb0->default_qpn_arr[i] = port->port_res[0].qp->init_attr.qp_nr;
 
         if (netif_msg_ifup(port))
                 ehea_dump(cb0, sizeof(*cb0), "ehea_configure_port");
@@ -1485,11 +1485,12 @@ out:
 
 static void ehea_promiscuous_error(u64 hret, int enable)
 {
-        ehea_info("Hypervisor denied %sabling promiscuous mode.%s",
-                  enable == 1 ? "en" : "dis",
-                  hret != H_AUTHORITY ? "" : " Another partition owning a "
-                  "logical port on the same physical port might have altered "
-                  "promiscuous mode first.");
+        if (hret == H_AUTHORITY)
+                ehea_info("Hypervisor denied %sabling promiscuous mode",
+                          enable == 1 ? "en" : "dis");
+        else
+                ehea_error("failed %sabling promiscuous mode",
+                           enable == 1 ? "en" : "dis");
 }
 
 static void ehea_promiscuous(struct net_device *dev, int enable)
@@ -2267,6 +2268,8 @@ static void ehea_tx_watchdog(struct net_device *dev)
 int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
 {
         struct hcp_query_ehea *cb;
+        struct device_node *lhea_dn = NULL;
+        struct device_node *eth_dn = NULL;
         u64 hret;
         int ret;
 
@@ -2283,7 +2286,18 @@ int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
                 goto out_herr;
         }
 
-        adapter->num_ports = cb->num_ports;
+        /* Determine the number of available logical ports
+         * by counting the child nodes of the lhea OFDT entry
+         */
+        adapter->num_ports = 0;
+        lhea_dn = of_find_node_by_name(lhea_dn, "lhea");
+        do {
+                eth_dn = of_get_next_child(lhea_dn, eth_dn);
+                if (eth_dn)
+                        adapter->num_ports++;
+        } while ( eth_dn );
+        of_node_put(lhea_dn);
+
         adapter->max_mc_mac = cb->max_mc_mac - 1;
         ret = 0;
 
@@ -2302,6 +2316,7 @@ static int ehea_setup_single_port(struct ehea_port *port,
         struct ehea_adapter *adapter = port->adapter;
         struct hcp_ehea_port_cb4 *cb4;
         u32 *dn_log_port_id;
+        int jumbo = 0;
 
         sema_init(&port->port_lock, 1);
         port->state = EHEA_PORT_DOWN;
@@ -2334,8 +2349,6 @@ static int ehea_setup_single_port(struct ehea_port *port,
 
         INIT_LIST_HEAD(&port->mc_list->list);
 
-        ehea_set_portspeed(port, EHEA_SPEED_AUTONEG);
-
         ret = ehea_sense_port_attr(port);
         if (ret)
                 goto out;
@@ -2345,13 +2358,25 @@ static int ehea_setup_single_port(struct ehea_port *port,
         if (!cb4) {
                 ehea_error("no mem for cb4");
         } else {
-                cb4->jumbo_frame = 1;
-                hret = ehea_h_modify_ehea_port(adapter->handle,
-                                               port->logical_port_id,
-                                               H_PORT_CB4, H_PORT_CB4_JUMBO,
-                                               cb4);
-                if (hret != H_SUCCESS) {
-                        ehea_info("Jumbo frames not activated");
+                hret = ehea_h_query_ehea_port(adapter->handle,
+                                              port->logical_port_id,
+                                              H_PORT_CB4,
+                                              H_PORT_CB4_JUMBO, cb4);
+
+                if (hret == H_SUCCESS) {
+                        if (cb4->jumbo_frame)
+                                jumbo = 1;
+                        else {
+                                cb4->jumbo_frame = 1;
+                                hret = ehea_h_modify_ehea_port(adapter->handle,
+                                                               port->
+                                                                logical_port_id,
+                                                               H_PORT_CB4,
+                                                               H_PORT_CB4_JUMBO,
+                                                               cb4);
+                                if (hret == H_SUCCESS)
+                                        jumbo = 1;
+                        }
                 }
                 kfree(cb4);
         }
@@ -2390,6 +2415,9 @@ static int ehea_setup_single_port(struct ehea_port *port,
                 goto out_free;
         }
 
+        ehea_info("%s: Jumbo frames are %sabled", dev->name,
+                  jumbo == 1 ? "en" : "dis");
+
         port->netdev = dev;
         ret = 0;
         goto out;
@@ -2471,14 +2499,16 @@ static int __devinit ehea_probe(struct ibmebus_dev *dev,
 
         adapter_handle = (u64*)get_property(dev->ofdev.node, "ibm,hea-handle",
                                             NULL);
-        if (!adapter_handle) {
+        if (adapter_handle)
+                adapter->handle = *adapter_handle;
+
+        if (!adapter->handle) {
                 dev_err(&dev->ofdev.dev, "failed getting handle for adapter"
                         " '%s'\n", dev->ofdev.node->full_name);
                 ret = -ENODEV;
                 goto out_free_ad;
         }
 
-        adapter->handle = *adapter_handle;
         adapter->pd = EHEA_PD_ID;
 
         dev->ofdev.dev.driver_data = adapter;
@@ -2568,6 +2598,7 @@ static int __devexit ehea_remove(struct ibmebus_dev *dev)
         destroy_workqueue(adapter->ehea_wq);
 
         ibmebus_free_irq(NULL, adapter->neq->attr.ist1, adapter);
+        tasklet_kill(&adapter->neq_tasklet);
 
         ehea_destroy_eq(adapter->neq);
 
diff --git a/drivers/net/ehea/ehea_phyp.c b/drivers/net/ehea/ehea_phyp.c
index 0cfc2bc1a27b..37716e05e808 100644
--- a/drivers/net/ehea/ehea_phyp.c
+++ b/drivers/net/ehea/ehea_phyp.c
@@ -94,6 +94,7 @@ static long ehea_plpar_hcall9(unsigned long opcode,
 {
         long ret;
         int i, sleep_msecs;
+        u8 cb_cat;
 
         for (i = 0; i < 5; i++) {
                 ret = plpar_hcall9(opcode, outs,
@@ -106,7 +107,13 @@ static long ehea_plpar_hcall9(unsigned long opcode,
                         continue;
                 }
 
-                if (ret < H_SUCCESS)
+                cb_cat = EHEA_BMASK_GET(H_MEHEAPORT_CAT, arg2);
+
+                if ((ret < H_SUCCESS) && !(((ret == H_AUTHORITY)
+                    && (opcode == H_MODIFY_HEA_PORT))
+                    && (((cb_cat == H_PORT_CB4) && ((arg3 == H_PORT_CB4_JUMBO)
+                    || (arg3 == H_PORT_CB4_SPEED))) || ((cb_cat == H_PORT_CB7)
+                    && (arg3 == H_PORT_CB7_DUCQPN)))))
                         ehea_error("opcode=%lx ret=%lx"
                                    " arg1=%lx arg2=%lx arg3=%lx arg4=%lx"
                                    " arg5=%lx arg6=%lx arg7=%lx arg8=%lx"
@@ -120,7 +127,6 @@ static long ehea_plpar_hcall9(unsigned long opcode,
                                    outs[0], outs[1], outs[2], outs[3],
                                    outs[4], outs[5], outs[6], outs[7],
                                    outs[8]);
-
                 return ret;
         }
 
diff --git a/drivers/net/fs_enet/mac-fec.c b/drivers/net/fs_enet/mac-fec.c
index c2c5fd419bd0..ff6839477306 100644
--- a/drivers/net/fs_enet/mac-fec.c
+++ b/drivers/net/fs_enet/mac-fec.c
@@ -104,9 +104,9 @@ static int do_pd_setup(struct fs_enet_private *fep)
         fep->interrupt = platform_get_irq_byname(pdev,"interrupt");
         if (fep->interrupt < 0)
                 return -EINVAL;
-        
+
         r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs");
-        fep->fec.fecp =(void*)r->start;
+        fep->fec.fecp = ioremap(r->start, r->end - r->start + 1);
 
         if(fep->fec.fecp == NULL)
                 return -EINVAL;
@@ -319,11 +319,14 @@ static void restart(struct net_device *dev)
          * Clear any outstanding interrupt.
          */
         FW(fecp, ievent, 0xffc0);
+#ifndef CONFIG_PPC_MERGE
         FW(fecp, ivec, (fep->interrupt / 2) << 29);
-        
+#else
+        FW(fecp, ivec, (virq_to_hw(fep->interrupt) / 2) << 29);
+#endif
 
         /*
-         * adjust to speed (only for DUET & RMII) 
+         * adjust to speed (only for DUET & RMII)
          */
 #ifdef CONFIG_DUET
         if (fpi->use_rmii) {
@@ -418,6 +421,7 @@ static void stop(struct net_device *dev)
 
 static void pre_request_irq(struct net_device *dev, int irq)
 {
+#ifndef CONFIG_PPC_MERGE
         immap_t *immap = fs_enet_immap;
         u32 siel;
 
@@ -431,6 +435,7 @@ static void pre_request_irq(struct net_device *dev, int irq)
                         siel &= ~(0x80000000 >> (irq & ~1));
                 out_be32(&immap->im_siu_conf.sc_siel, siel);
         }
+#endif
 }
 
 static void post_free_irq(struct net_device *dev, int irq)
diff --git a/drivers/net/fs_enet/mac-scc.c b/drivers/net/fs_enet/mac-scc.c
index 95ec5872c507..afd7fca7c6c4 100644
--- a/drivers/net/fs_enet/mac-scc.c
+++ b/drivers/net/fs_enet/mac-scc.c
@@ -121,13 +121,13 @@ static int do_pd_setup(struct fs_enet_private *fep)
                 return -EINVAL;
 
         r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs");
-        fep->scc.sccp = (void *)r->start;
+        fep->scc.sccp = ioremap(r->start, r->end - r->start + 1);
 
         if (fep->scc.sccp == NULL)
                 return -EINVAL;
 
         r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pram");
-        fep->scc.ep = (void *)r->start;
+        fep->scc.ep = ioremap(r->start, r->end - r->start + 1);
 
         if (fep->scc.ep == NULL)
                 return -EINVAL;
@@ -397,6 +397,7 @@ static void stop(struct net_device *dev)
 
 static void pre_request_irq(struct net_device *dev, int irq)
 {
+#ifndef CONFIG_PPC_MERGE
         immap_t *immap = fs_enet_immap;
         u32 siel;
 
@@ -410,6 +411,7 @@ static void pre_request_irq(struct net_device *dev, int irq)
                         siel &= ~(0x80000000 >> (irq & ~1));
                 out_be32(&immap->im_siu_conf.sc_siel, siel);
         }
+#endif
 }
 
 static void post_free_irq(struct net_device *dev, int irq)
diff --git a/drivers/net/hamradio/Kconfig b/drivers/net/hamradio/Kconfig
index 896aa02000d7..feb0ada7a025 100644
--- a/drivers/net/hamradio/Kconfig
+++ b/drivers/net/hamradio/Kconfig
@@ -113,7 +113,7 @@ config SCC_TRXECHO
 
 config BAYCOM_SER_FDX
         tristate "BAYCOM ser12 fullduplex driver for AX.25"
-        depends on AX25
+        depends on AX25 && !S390
         select CRC_CCITT
         ---help---
           This is one of two drivers for Baycom style simple amateur radio
@@ -133,7 +133,7 @@ config BAYCOM_SER_FDX
 
 config BAYCOM_SER_HDX
         tristate "BAYCOM ser12 halfduplex driver for AX.25"
-        depends on AX25
+        depends on AX25 && !S390
         select CRC_CCITT
         ---help---
           This is one of two drivers for Baycom style simple amateur radio
@@ -181,7 +181,7 @@ config BAYCOM_EPP
 
 config YAM
         tristate "YAM driver for AX.25"
-        depends on AX25
+        depends on AX25 && !S390
         help
           The YAM is a modem for packet radio which connects to the serial
           port and includes some of the functions of a Terminal Node
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 3ca1082ec776..340ee99652eb 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -441,25 +441,13 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
                 goto drop;
         }
 
-        /* Make sure there is room for IrDA-USB header. The actual
-         * allocation will be done lower in skb_push().
-         * Also, we don't use directly skb_cow(), because it require
-         * headroom >= 16, which force unnecessary copies - Jean II */
-        if (skb_headroom(skb) < self->header_length) {
-                IRDA_DEBUG(0, "%s(), Insuficient skb headroom.\n", __FUNCTION__);
-                if (skb_cow(skb, self->header_length)) {
-                        IRDA_WARNING("%s(), failed skb_cow() !!!\n", __FUNCTION__);
-                        goto drop;
-                }
-        }
+        memcpy(self->tx_buff + self->header_length, skb->data, skb->len);
 
         /* Change setting for next frame */
-
         if (self->capability & IUC_STIR421X) {
                 __u8 turnaround_time;
-                __u8* frame;
+                __u8* frame = self->tx_buff;
                 turnaround_time = get_turnaround_time( skb );
-                frame= skb_push(skb, self->header_length);
                 irda_usb_build_header(self, frame, 0);
                 frame[2] = turnaround_time;
                 if ((skb->len != 0) &&
@@ -472,17 +460,17 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
                         frame[1] = 0;
                 }
         } else {
-                irda_usb_build_header(self, skb_push(skb, self->header_length), 0);
+                irda_usb_build_header(self, self->tx_buff, 0);
         }
 
         /* FIXME: Make macro out of this one */
         ((struct irda_skb_cb *)skb->cb)->context = self;
 
-        usb_fill_bulk_urb(urb, self->usbdev, 
+        usb_fill_bulk_urb(urb, self->usbdev,
                       usb_sndbulkpipe(self->usbdev, self->bulk_out_ep),
-                      skb->data, IRDA_SKB_MAX_MTU,
+                      self->tx_buff, skb->len + self->header_length,
                       write_bulk_callback, skb);
-        urb->transfer_buffer_length = skb->len;
+
         /* This flag (URB_ZERO_PACKET) indicates that what we send is not
          * a continuous stream of data but separate packets.
          * In this case, the USB layer will insert an empty USB frame (TD)
@@ -1455,6 +1443,9 @@ static inline void irda_usb_close(struct irda_usb_cb *self)
         /* Remove the speed buffer */
         kfree(self->speed_buff);
         self->speed_buff = NULL;
+
+        kfree(self->tx_buff);
+        self->tx_buff = NULL;
 }
 
 /********************** USB CONFIG SUBROUTINES **********************/
@@ -1524,8 +1515,6 @@ static inline int irda_usb_parse_endpoints(struct irda_usb_cb *self, struct usb_
 
         IRDA_DEBUG(0, "%s(), And our endpoints are : in=%02X, out=%02X (%d), int=%02X\n",
                 __FUNCTION__, self->bulk_in_ep, self->bulk_out_ep, self->bulk_out_mtu, self->bulk_int_ep);
-        /* Should be 8, 16, 32 or 64 bytes */
-        IRDA_ASSERT(self->bulk_out_mtu == 64, ;);
 
         return((self->bulk_in_ep != 0) && (self->bulk_out_ep != 0));
 }
@@ -1753,9 +1742,14 @@ static int irda_usb_probe(struct usb_interface *intf,
 
         memset(self->speed_buff, 0, IRDA_USB_SPEED_MTU);
 
+        self->tx_buff = kzalloc(IRDA_SKB_MAX_MTU + self->header_length,
+                                GFP_KERNEL);
+        if (self->tx_buff == NULL)
+                goto err_out_4;
+
         ret = irda_usb_open(self);
         if (ret) 
-                goto err_out_4;
+                goto err_out_5;
 
         IRDA_MESSAGE("IrDA: Registered device %s\n", net->name);
         usb_set_intfdata(intf, self);
@@ -1766,14 +1760,14 @@ static int irda_usb_probe(struct usb_interface *intf,
                 self->needspatch = (ret < 0);
                 if (self->needspatch) {
                         IRDA_ERROR("STIR421X: Couldn't upload patch\n");
-                        goto err_out_5;
+                        goto err_out_6;
                 }
 
                 /* replace IrDA class descriptor with what patched device is now reporting */
                 irda_desc = irda_usb_find_class_desc (self->usbintf);
                 if (irda_desc == NULL) {
                         ret = -ENODEV;
-                        goto err_out_5;
+                        goto err_out_6;
                 }
                 if (self->irda_desc)
                         kfree (self->irda_desc);
@@ -1782,9 +1776,10 @@ static int irda_usb_probe(struct usb_interface *intf,
         }
 
         return 0;
-
-err_out_5:
+err_out_6:
         unregister_netdev(self->netdev);
+err_out_5:
+        kfree(self->tx_buff);
 err_out_4:
         kfree(self->speed_buff);
 err_out_3:
diff --git a/drivers/net/irda/irda-usb.h b/drivers/net/irda/irda-usb.h
index 6b2271f18e77..e846c38224a3 100644
--- a/drivers/net/irda/irda-usb.h
+++ b/drivers/net/irda/irda-usb.h
@@ -156,6 +156,7 @@ struct irda_usb_cb {
         struct irlap_cb   *irlap;       /* The link layer we are binded to */
         struct qos_info qos;
         char *speed_buff;               /* Buffer for speed changes */
+        char *tx_buff;
 
         struct timeval stamp;
         struct timeval now;
diff --git a/drivers/net/irda/stir4200.c b/drivers/net/irda/stir4200.c
index c14a74634fd5..20d306fea4cb 100644
--- a/drivers/net/irda/stir4200.c
+++ b/drivers/net/irda/stir4200.c
@@ -59,7 +59,7 @@
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
 
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_DESCRIPTION("IrDA-USB Dongle Driver for SigmaTel STIr4200");
 MODULE_LICENSE("GPL");
 
diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c
index 18c68193bf14..e2b1af618450 100644
--- a/drivers/net/irda/vlsi_ir.c
+++ b/drivers/net/irda/vlsi_ir.c
@@ -166,7 +166,7 @@ static void vlsi_proc_pdev(struct seq_file *seq, struct pci_dev *pdev)
         unsigned i;
 
         seq_printf(seq, "\n%s (vid/did: %04x/%04x)\n",
-                   PCIDEV_NAME(pdev), (int)pdev->vendor, (int)pdev->device);
+                   pci_name(pdev), (int)pdev->vendor, (int)pdev->device);
         seq_printf(seq, "pci-power-state: %u\n", (unsigned) pdev->current_state);
         seq_printf(seq, "resources: irq=%u / io=0x%04x / dma_mask=0x%016Lx\n",
                    pdev->irq, (unsigned)pci_resource_start(pdev, 0), (unsigned long long)pdev->dma_mask);
@@ -1401,7 +1401,7 @@ static void vlsi_tx_timeout(struct net_device *ndev)
 
         if (vlsi_start_hw(idev))
                 IRDA_ERROR("%s: failed to restart hw - %s(%s) unusable!\n",
-                           __FUNCTION__, PCIDEV_NAME(idev->pdev), ndev->name);
+                           __FUNCTION__, pci_name(idev->pdev), ndev->name);
         else
                 netif_start_queue(ndev);
 }
@@ -1643,7 +1643,7 @@ vlsi_irda_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 pdev->current_state = 0; /* hw must be running now */
 
         IRDA_MESSAGE("%s: IrDA PCI controller %s detected\n",
-                     drivername, PCIDEV_NAME(pdev));
+                     drivername, pci_name(pdev));
 
         if ( !pci_resource_start(pdev,0)
              || !(pci_resource_flags(pdev,0) & IORESOURCE_IO) ) {
@@ -1728,7 +1728,7 @@ static void __devexit vlsi_irda_remove(struct pci_dev *pdev)
 
         pci_set_drvdata(pdev, NULL);
 
-        IRDA_MESSAGE("%s: %s removed\n", drivername, PCIDEV_NAME(pdev));
+        IRDA_MESSAGE("%s: %s removed\n", drivername, pci_name(pdev));
 }
 
 #ifdef CONFIG_PM
@@ -1748,7 +1748,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
 
         if (!ndev) {
                 IRDA_ERROR("%s - %s: no netdevice \n",
-                           __FUNCTION__, PCIDEV_NAME(pdev));
+                           __FUNCTION__, pci_name(pdev));
                 return 0;
         }
         idev = ndev->priv;      
@@ -1759,7 +1759,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
                         pdev->current_state = state.event;
                 }
                 else
-                        IRDA_ERROR("%s - %s: invalid suspend request %u -> %u\n", __FUNCTION__, PCIDEV_NAME(pdev), pdev->current_state, state.event);
+                        IRDA_ERROR("%s - %s: invalid suspend request %u -> %u\n", __FUNCTION__, pci_name(pdev), pdev->current_state, state.event);
                 up(&idev->sem);
                 return 0;
         }
@@ -1787,7 +1787,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
 
         if (!ndev) {
                 IRDA_ERROR("%s - %s: no netdevice \n",
-                           __FUNCTION__, PCIDEV_NAME(pdev));
+                           __FUNCTION__, pci_name(pdev));
                 return 0;
         }
         idev = ndev->priv;      
@@ -1795,7 +1795,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
         if (pdev->current_state == 0) {
                 up(&idev->sem);
                 IRDA_WARNING("%s - %s: already resumed\n",
-                             __FUNCTION__, PCIDEV_NAME(pdev));
+                             __FUNCTION__, pci_name(pdev));
                 return 0;
         }
         
diff --git a/drivers/net/irda/vlsi_ir.h b/drivers/net/irda/vlsi_ir.h
index c37f0bc4c7f9..2d3b773d8e35 100644
--- a/drivers/net/irda/vlsi_ir.h
+++ b/drivers/net/irda/vlsi_ir.h
@@ -41,39 +41,6 @@
 #define PCI_CLASS_SUBCLASS_MASK         0xffff
 #endif
 
-/* in recent 2.5 interrupt handlers have non-void return value */
-#ifndef IRQ_RETVAL
-typedef void irqreturn_t;
-#define IRQ_NONE
-#define IRQ_HANDLED
-#define IRQ_RETVAL(x)
-#endif
-
-/* some stuff need to check kernelversion. Not all 2.5 stuff was present
- * in early 2.5.x - the test is merely to separate 2.4 from 2.5
- */
-#include <linux/version.h>
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-
-/* PDE() introduced in 2.5.4 */
-#ifdef CONFIG_PROC_FS
-#define PDE(inode) ((inode)->i_private)
-#endif
-
-/* irda crc16 calculation exported in 2.5.42 */
-#define irda_calc_crc16(fcs,buf,len)    (GOOD_FCS)
-
-/* we use this for unified pci device name access */
-#define PCIDEV_NAME(pdev)       ((pdev)->name)
-
-#else /* 2.5 or later */
-
-/* whatever we get from the associated struct device - bus:slot:dev.fn id */
-#define PCIDEV_NAME(pdev)       (pci_name(pdev))
-
-#endif
-
 /* ================================================================ */
 
 /* non-standard PCI registers */
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index c41ae4286eea..b3bf86422734 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -314,6 +314,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
 
         while (mp->tx_desc_count > 0) {
                 spin_lock_irqsave(&mp->lock, flags);
+
+                /* tx_desc_count might have changed before acquiring the lock */
+                if (mp->tx_desc_count <= 0) {
+                        spin_unlock_irqrestore(&mp->lock, flags);
+                        return released;
+                }
+
                 tx_index = mp->tx_used_desc_q;
                 desc = &mp->p_tx_desc_area[tx_index];
                 cmd_sts = desc->cmd_sts;
@@ -332,13 +339,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
                 if (skb)
                         mp->tx_skb[tx_index] = NULL;
 
-                spin_unlock_irqrestore(&mp->lock, flags);
-
                 if (cmd_sts & ETH_ERROR_SUMMARY) {
                         printk("%s: Error in TX\n", dev->name);
                         mp->stats.tx_errors++;
                 }
 
+                spin_unlock_irqrestore(&mp->lock, flags);
+
                 if (cmd_sts & ETH_TX_FIRST_DESC)
                         dma_unmap_single(NULL, addr, count, DMA_TO_DEVICE);
                 else
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 6490acf05305..e8598b809228 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -63,12 +63,11 @@
 
 #include "netxen_nic_hw.h"
 
-#define NETXEN_NIC_BUILD_NO     "4"
+#define NETXEN_NIC_BUILD_NO     "2"
 #define _NETXEN_NIC_LINUX_MAJOR 3
 #define _NETXEN_NIC_LINUX_MINOR 3
-#define _NETXEN_NIC_LINUX_SUBVERSION 2
-#define NETXEN_NIC_LINUX_VERSIONID  "3.3.2" "-" NETXEN_NIC_BUILD_NO
-#define NETXEN_NIC_FW_VERSIONID "3.3.2"
+#define _NETXEN_NIC_LINUX_SUBVERSION 3
+#define NETXEN_NIC_LINUX_VERSIONID  "3.3.3" "-" NETXEN_NIC_BUILD_NO
 
 #define RCV_DESC_RINGSIZE       \
         (sizeof(struct rcv_desc) * adapter->max_rx_desc_count)
@@ -240,49 +239,39 @@ extern unsigned long long netxen_dma_mask;
 
 typedef u32 netxen_ctx_msg;
 
-#define _netxen_set_bits(config_word, start, bits, val) {\
-        unsigned long long mask = (((1ULL << (bits)) - 1) << (start));  \
-        unsigned long long value = (val);       \
-        (config_word) &= ~mask; \
-        (config_word) |= (((value) << (start)) & mask); \
-}
-
 #define netxen_set_msg_peg_id(config_word, val) \
-        _netxen_set_bits(config_word, 0, 2, val)
+        ((config_word) &= ~3, (config_word) |= val & 3)
 #define netxen_set_msg_privid(config_word)      \
-        set_bit(2, (unsigned long*)&config_word)
+        ((config_word) |= 1 << 2)
 #define netxen_set_msg_count(config_word, val)  \
-        _netxen_set_bits(config_word, 3, 15, val)
+        ((config_word) &= ~(0x7fff<<3), (config_word) |= (val & 0x7fff) << 3)
 #define netxen_set_msg_ctxid(config_word, val)  \
-        _netxen_set_bits(config_word, 18, 10, val)
+        ((config_word) &= ~(0x3ff<<18), (config_word) |= (val & 0x3ff) << 18)
 #define netxen_set_msg_opcode(config_word, val) \
-        _netxen_set_bits(config_word, 28, 4, val)
+        ((config_word) &= ~(0xf<<24), (config_word) |= (val & 0xf) << 24)
 
 struct netxen_rcv_context {
-        u32 rcv_ring_addr_lo;
-        u32 rcv_ring_addr_hi;
-        u32 rcv_ring_size;
-        u32 rsrvd;
+        __le64 rcv_ring_addr;
+        __le32 rcv_ring_size;
+        __le32 rsrvd;
 };
 
 struct netxen_ring_ctx {
 
         /* one command ring */
-        u64 cmd_consumer_offset;
-        u32 cmd_ring_addr_lo;
-        u32 cmd_ring_addr_hi;
-        u32 cmd_ring_size;
-        u32 rsrvd;
+        __le64 cmd_consumer_offset;
+        __le64 cmd_ring_addr;
+        __le32 cmd_ring_size;
+        __le32 rsrvd;
 
         /* three receive rings */
         struct netxen_rcv_context rcv_ctx[3];
 
         /* one status ring */
-        u32 sts_ring_addr_lo;
-        u32 sts_ring_addr_hi;
-        u32 sts_ring_size;
+        __le64 sts_ring_addr;
+        __le32 sts_ring_size;
 
-        u32 ctx_id;
+        __le32 ctx_id;
 } __attribute__ ((aligned(64)));
 
 /*
@@ -306,81 +295,85 @@ struct netxen_ring_ctx {
         ((cmd_desc)->port_ctxid |= ((var) & 0x0F))
 
 #define netxen_set_cmd_desc_flags(cmd_desc, val)        \
-        _netxen_set_bits((cmd_desc)->flags_opcode, 0, 7, val)
+        ((cmd_desc)->flags_opcode &= ~cpu_to_le16(0x7f), \
+        (cmd_desc)->flags_opcode |= cpu_to_le16((val) & 0x7f))
 #define netxen_set_cmd_desc_opcode(cmd_desc, val)       \
-        _netxen_set_bits((cmd_desc)->flags_opcode, 7, 6, val)
+        ((cmd_desc)->flags_opcode &= ~cpu_to_le16(0x3f<<7), \
+        (cmd_desc)->flags_opcode |= cpu_to_le16((val) & (0x3f<<7)))
 
 #define netxen_set_cmd_desc_num_of_buff(cmd_desc, val)  \
-        _netxen_set_bits((cmd_desc)->num_of_buffers_total_length, 0, 8, val);
+        ((cmd_desc)->num_of_buffers_total_length &= ~cpu_to_le32(0xff), \
+        (cmd_desc)->num_of_buffers_total_length |= cpu_to_le32((val) & 0xff))
 #define netxen_set_cmd_desc_totallength(cmd_desc, val)  \
-        _netxen_set_bits((cmd_desc)->num_of_buffers_total_length, 8, 24, val);
+        ((cmd_desc)->num_of_buffers_total_length &= cpu_to_le32(0xff), \
+        (cmd_desc)->num_of_buffers_total_length |= cpu_to_le32(val << 24))
 
 #define netxen_get_cmd_desc_opcode(cmd_desc)    \
-        (((cmd_desc)->flags_opcode >> 7) & 0x003F)
+        ((le16_to_cpu((cmd_desc)->flags_opcode) >> 7) & 0x003F)
 #define netxen_get_cmd_desc_totallength(cmd_desc)       \
-        (((cmd_desc)->num_of_buffers_total_length >> 8) & 0x0FFFFFF)
+        (le32_to_cpu((cmd_desc)->num_of_buffers_total_length) >> 8)
 
 struct cmd_desc_type0 {
         u8 tcp_hdr_offset;      /* For LSO only */
         u8 ip_hdr_offset;       /* For LSO only */
         /* Bit pattern: 0-6 flags, 7-12 opcode, 13-15 unused */
-        u16 flags_opcode;
+        __le16 flags_opcode;
         /* Bit pattern: 0-7 total number of segments,
            8-31 Total size of the packet */
-        u32 num_of_buffers_total_length;
+        __le32 num_of_buffers_total_length;
         union {
                 struct {
-                        u32 addr_low_part2;
-                        u32 addr_high_part2;
+                        __le32 addr_low_part2;
+                        __le32 addr_high_part2;
                 };
-                u64 addr_buffer2;
+                __le64 addr_buffer2;
         };
 
-        u16 reference_handle;   /* changed to u16 to add mss */
-        u16 mss;                /* passed by NDIS_PACKET for LSO */
+        __le16 reference_handle;        /* changed to u16 to add mss */
+        __le16 mss;             /* passed by NDIS_PACKET for LSO */
         /* Bit pattern 0-3 port, 0-3 ctx id */
         u8 port_ctxid;
         u8 total_hdr_length;    /* LSO only : MAC+IP+TCP Hdr size */
-        u16 conn_id;            /* IPSec offoad only */
+        __le16 conn_id;         /* IPSec offoad only */
 
         union {
                 struct {
-                        u32 addr_low_part3;
-                        u32 addr_high_part3;
+                        __le32 addr_low_part3;
+                        __le32 addr_high_part3;
                 };
-                u64 addr_buffer3;
+                __le64 addr_buffer3;
         };
         union {
                 struct {
-                        u32 addr_low_part1;
-                        u32 addr_high_part1;
+                        __le32 addr_low_part1;
+                        __le32 addr_high_part1;
                 };
-                u64 addr_buffer1;
+                __le64 addr_buffer1;
         };
 
-        u16 buffer1_length;
-        u16 buffer2_length;
-        u16 buffer3_length;
-        u16 buffer4_length;
+        __le16 buffer1_length;
+        __le16 buffer2_length;
+        __le16 buffer3_length;
+        __le16 buffer4_length;
 
         union {
                 struct {
-                        u32 addr_low_part4;
-                        u32 addr_high_part4;
+                        __le32 addr_low_part4;
+                        __le32 addr_high_part4;
                 };
-                u64 addr_buffer4;
+                __le64 addr_buffer4;
         };
 
-        u64 unused;
+        __le64 unused;
 
 } __attribute__ ((aligned(64)));
 
 /* Note: sizeof(rcv_desc) should always be a mutliple of 2 */
 struct rcv_desc {
-        u16 reference_handle;
-        u16 reserved;
-        u32 buffer_length;      /* allocated buffer length (usually 2K) */
-        u64 addr_buffer;
+        __le16 reference_handle;
+        __le16 reserved;
+        __le32 buffer_length;   /* allocated buffer length (usually 2K) */
+        __le64 addr_buffer;
 };
 
 /* opcode field in status_desc */
@@ -406,36 +399,36 @@ struct rcv_desc {
         (((status_desc)->lro & 0x80) >> 7)
 
 #define netxen_get_sts_port(status_desc)        \
-        ((status_desc)->status_desc_data & 0x0F)
+        (le64_to_cpu((status_desc)->status_desc_data) & 0x0F)
 #define netxen_get_sts_status(status_desc)      \
-        (((status_desc)->status_desc_data >> 4) & 0x0F)
+        ((le64_to_cpu((status_desc)->status_desc_data) >> 4) & 0x0F)
 #define netxen_get_sts_type(status_desc)        \
-        (((status_desc)->status_desc_data >> 8) & 0x0F)
+        ((le64_to_cpu((status_desc)->status_desc_data) >> 8) & 0x0F)
 #define netxen_get_sts_totallength(status_desc) \
-        (((status_desc)->status_desc_data >> 12) & 0xFFFF)
+        ((le64_to_cpu((status_desc)->status_desc_data) >> 12) & 0xFFFF)
 #define netxen_get_sts_refhandle(status_desc)   \
-        (((status_desc)->status_desc_data >> 28) & 0xFFFF)
+        ((le64_to_cpu((status_desc)->status_desc_data) >> 28) & 0xFFFF)
 #define netxen_get_sts_prot(status_desc)        \
-        (((status_desc)->status_desc_data >> 44) & 0x0F)
+        ((le64_to_cpu((status_desc)->status_desc_data) >> 44) & 0x0F)
 #define netxen_get_sts_owner(status_desc)       \
-        (((status_desc)->status_desc_data >> 56) & 0x03)
+        ((le64_to_cpu((status_desc)->status_desc_data) >> 56) & 0x03)
 #define netxen_get_sts_opcode(status_desc)      \
-        (((status_desc)->status_desc_data >> 58) & 0x03F)
+        ((le64_to_cpu((status_desc)->status_desc_data) >> 58) & 0x03F)
 
 #define netxen_clear_sts_owner(status_desc)     \
         ((status_desc)->status_desc_data &=     \
-        ~(((unsigned long long)3) << 56 ))
+        ~cpu_to_le64(((unsigned long long)3) << 56 ))
 #define netxen_set_sts_owner(status_desc, val)  \
         ((status_desc)->status_desc_data |=     \
-        (((unsigned long long)((val) & 0x3)) << 56 ))
+        cpu_to_le64(((unsigned long long)((val) & 0x3)) << 56 ))
 
 struct status_desc {
         /* Bit pattern: 0-3 port, 4-7 status, 8-11 type, 12-27 total_length
            28-43 reference_handle, 44-47 protocol, 48-52 unused
            53-55 desc_cnt, 56-57 owner, 58-63 opcode
          */
-        u64 status_desc_data;
-        u32 hash_value;
+        __le64 status_desc_data;
+        __le32 hash_value;
         u8 hash_type;
         u8 msg_type;
         u8 unused;
@@ -1006,9 +999,9 @@ void netxen_niu_gbe_set_mii_mode(struct netxen_adapter *adapter, int port,
 void netxen_niu_gbe_set_gmii_mode(struct netxen_adapter *adapter, int port,
                                   long enable);
 int netxen_niu_gbe_phy_read(struct netxen_adapter *adapter, long phy, long reg,
-                            __le32 * readval);
+                            __u32 * readval);
 int netxen_niu_gbe_phy_write(struct netxen_adapter *adapter, long phy,
-                             long reg, __le32 val);
+                             long reg, __u32 val);
 
 /* Functions available from netxen_nic_hw.c */
 int netxen_nic_set_mtu_xgb(struct netxen_port *port, int new_mtu);
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index 34044616b3c8..c381d77a7336 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -218,7 +218,7 @@ netxen_nic_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 {
         struct netxen_port *port = netdev_priv(dev);
         struct netxen_adapter *adapter = port->adapter;
-        __le32 status;
+        __u32 status;
 
         /* read which mode */
         if (adapter->ahw.board_type == NETXEN_NIC_GBE) {
@@ -226,7 +226,7 @@ netxen_nic_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
                 if (adapter->phy_write
                     && adapter->phy_write(adapter, port->portnum,
                                           NETXEN_NIU_GB_MII_MGMT_ADDR_AUTONEG,
-                                          (__le32) ecmd->autoneg) != 0)
+                                          ecmd->autoneg) != 0)
                         return -EIO;
                 else
                         port->link_autoneg = ecmd->autoneg;
@@ -279,7 +279,7 @@ static int netxen_nic_get_regs_len(struct net_device *dev)
 }
 
 struct netxen_niu_regs {
-        __le32 reg[NETXEN_NIC_REGS_COUNT];
+        __u32 reg[NETXEN_NIC_REGS_COUNT];
 };
 
 static struct netxen_niu_regs niu_registers[] = {
@@ -372,7 +372,7 @@ netxen_nic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
 {
         struct netxen_port *port = netdev_priv(dev);
         struct netxen_adapter *adapter = port->adapter;
-        __le32 mode, *regs_buff = p;
+        __u32 mode, *regs_buff = p;
         void __iomem *addr;
         int i, window;
 
@@ -415,7 +415,7 @@ static u32 netxen_nic_get_link(struct net_device *dev)
 {
         struct netxen_port *port = netdev_priv(dev);
         struct netxen_adapter *adapter = port->adapter;
-        __le32 status;
+        __u32 status;
 
         /* read which mode */
         if (adapter->ahw.board_type == NETXEN_NIC_GBE) {
@@ -482,13 +482,13 @@ netxen_nic_get_pauseparam(struct net_device *dev,
 {
         struct netxen_port *port = netdev_priv(dev);
         struct netxen_adapter *adapter = port->adapter;
-        __le32 val;
+        __u32 val;
 
         if (adapter->ahw.board_type == NETXEN_NIC_GBE) {
                 /* get flow control settings */
                 netxen_nic_read_w0(adapter,
                                    NETXEN_NIU_GB_MAC_CONFIG_0(port->portnum),
-                                   (u32 *) & val);
+                                   &val);
                 pause->rx_pause = netxen_gb_get_rx_flowctl(val);
                 pause->tx_pause = netxen_gb_get_tx_flowctl(val);
                 /* get autoneg settings */
@@ -502,7 +502,7 @@ netxen_nic_set_pauseparam(struct net_device *dev,
 {
         struct netxen_port *port = netdev_priv(dev);
         struct netxen_adapter *adapter = port->adapter;
-        __le32 val;
+        __u32 val;
         unsigned int autoneg;
 
         /* read mode */
@@ -522,13 +522,13 @@ netxen_nic_set_pauseparam(struct net_device *dev,
 
                 netxen_nic_write_w0(adapter,
                                     NETXEN_NIU_GB_MAC_CONFIG_0(port->portnum),
-                                    *(u32 *) (&val));
+                                    *&val);
                 /* set autoneg */
                 autoneg = pause->autoneg;
                 if (adapter->phy_write
                     && adapter->phy_write(adapter, port->portnum,
                                           NETXEN_NIU_GB_MII_MGMT_ADDR_AUTONEG,
-                                          (__le32) autoneg) != 0)
+                                          autoneg) != 0)
                         return -EIO;
                 else {
                         port->link_autoneg = pause->autoneg;
@@ -543,7 +543,7 @@ static int netxen_nic_reg_test(struct net_device *dev)
         struct netxen_port *port = netdev_priv(dev);
         struct netxen_adapter *adapter = port->adapter;
         u32 data_read, data_written, save;
-        __le32 mode;
+        __u32 mode;
 
         /* 
          * first test the "Read Only" registers by writing which mode
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index c0c31d1914a7..f263232f499f 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -95,7 +95,7 @@ void netxen_nic_set_multi(struct net_device *netdev)
         struct netxen_port *port = netdev_priv(netdev);
         struct netxen_adapter *adapter = port->adapter;
         struct dev_mc_list *mc_ptr;
-        __le32 netxen_mac_addr_cntl_data = 0;
+        __u32 netxen_mac_addr_cntl_data = 0;
 
         mc_ptr = netdev->mc_list;
         if (netdev->flags & IFF_PROMISC) {
@@ -236,8 +236,9 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
         }
         memset(addr, 0, sizeof(struct netxen_ring_ctx));
         adapter->ctx_desc = (struct netxen_ring_ctx *)addr;
-        adapter->ctx_desc->cmd_consumer_offset = adapter->ctx_desc_phys_addr
-            + sizeof(struct netxen_ring_ctx);
+        adapter->ctx_desc->cmd_consumer_offset =
+            cpu_to_le64(adapter->ctx_desc_phys_addr +
+                        sizeof(struct netxen_ring_ctx));
         adapter->cmd_consumer = (uint32_t *) (((char *)addr) +
                                               sizeof(struct netxen_ring_ctx));
 
@@ -253,11 +254,10 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
                 return -ENOMEM;
         }
 
-        adapter->ctx_desc->cmd_ring_addr_lo =
-            hw->cmd_desc_phys_addr & 0xffffffffUL;
-        adapter->ctx_desc->cmd_ring_addr_hi =
-            ((u64) hw->cmd_desc_phys_addr >> 32);
-        adapter->ctx_desc->cmd_ring_size = adapter->max_tx_desc_count;
+        adapter->ctx_desc->cmd_ring_addr =
+                cpu_to_le64(hw->cmd_desc_phys_addr);
+        adapter->ctx_desc->cmd_ring_size =
+                cpu_to_le32(adapter->max_tx_desc_count);
 
         hw->cmd_desc_head = (struct cmd_desc_type0 *)addr;
 
@@ -278,12 +278,10 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
                                 return err;
                         }
                         rcv_desc->desc_head = (struct rcv_desc *)addr;
-                        adapter->ctx_desc->rcv_ctx[ring].rcv_ring_addr_lo =
-                            rcv_desc->phys_addr & 0xffffffffUL;
-                        adapter->ctx_desc->rcv_ctx[ring].rcv_ring_addr_hi =
-                            ((u64) rcv_desc->phys_addr >> 32);
+                        adapter->ctx_desc->rcv_ctx[ring].rcv_ring_addr =
+                            cpu_to_le64(rcv_desc->phys_addr);
                         adapter->ctx_desc->rcv_ctx[ring].rcv_ring_size =
-                            rcv_desc->max_rx_desc_count;
+                            cpu_to_le32(rcv_desc->max_rx_desc_count);
                 }
 
                 addr = netxen_alloc(adapter->ahw.pdev, STATUS_DESC_RINGSIZE,
@@ -297,11 +295,10 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
                         return err;
                 }
                 recv_ctx->rcv_status_desc_head = (struct status_desc *)addr;
-                adapter->ctx_desc->sts_ring_addr_lo =
-                    recv_ctx->rcv_status_desc_phys_addr & 0xffffffffUL;
-                adapter->ctx_desc->sts_ring_addr_hi =
-                    ((u64) recv_ctx->rcv_status_desc_phys_addr >> 32);
-                adapter->ctx_desc->sts_ring_size = adapter->max_rx_desc_count;
+                adapter->ctx_desc->sts_ring_addr =
+                    cpu_to_le64(recv_ctx->rcv_status_desc_phys_addr);
+                adapter->ctx_desc->sts_ring_size =
+                    cpu_to_le32(adapter->max_rx_desc_count);
 
         }
         /* Window = 1 */
@@ -387,10 +384,6 @@ void netxen_tso_check(struct netxen_adapter *adapter,
         }
         adapter->stats.xmitcsummed++;
         desc->tcp_hdr_offset = skb->h.raw - skb->data;
-        netxen_set_cmd_desc_totallength(desc,
-                                        cpu_to_le32
-                                        (netxen_get_cmd_desc_totallength
-                                         (desc)));
         desc->ip_hdr_offset = skb->nh.raw - skb->data;
 }
 
@@ -867,9 +860,9 @@ netxen_crb_writelit_adapter(struct netxen_adapter *adapter, unsigned long off,
 void netxen_nic_set_link_parameters(struct netxen_port *port)
 {
         struct netxen_adapter *adapter = port->adapter;
-        __le32 status;
-        __le32 autoneg;
-        __le32 mode;
+        __u32 status;
+        __u32 autoneg;
+        __u32 mode;
 
         netxen_nic_read_w0(adapter, NETXEN_NIU_MODE, &mode);
         if (netxen_get_niu_enable_ge(mode)) {   /* Gb 10/100/1000 Mbps mode */
@@ -984,7 +977,8 @@ void netxen_nic_flash_print(struct netxen_adapter *adapter)
                        _NETXEN_NIC_LINUX_MAJOR, fw_major);
                 adapter->driver_mismatch = 1;
         }
-        if (fw_minor != _NETXEN_NIC_LINUX_MINOR) {
+        if (fw_minor != _NETXEN_NIC_LINUX_MINOR &&
+                        fw_minor != (_NETXEN_NIC_LINUX_MINOR + 1)) {
                 printk(KERN_ERR "The mismatch in driver version and firmware "
                        "version minor number\n"
                        "Driver version minor number = %d \t"
diff --git a/drivers/net/netxen/netxen_nic_hw.h b/drivers/net/netxen/netxen_nic_hw.h
index 0685633a9c1e..ab1112eb1b0d 100644
--- a/drivers/net/netxen/netxen_nic_hw.h
+++ b/drivers/net/netxen/netxen_nic_hw.h
@@ -124,28 +124,28 @@ typedef enum {
  */
 
 #define netxen_gb_enable_tx(config_word)        \
-        set_bit(0, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 0)
 #define netxen_gb_enable_rx(config_word)        \
-        set_bit(2, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 2)
 #define netxen_gb_tx_flowctl(config_word)       \
-        set_bit(4, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 4)
 #define netxen_gb_rx_flowctl(config_word)       \
-        set_bit(5, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 5)
 #define netxen_gb_tx_reset_pb(config_word)      \
-                set_bit(16, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 16)
 #define netxen_gb_rx_reset_pb(config_word)      \
-                set_bit(17, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 17)
 #define netxen_gb_tx_reset_mac(config_word)     \
-                set_bit(18, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 18)
 #define netxen_gb_rx_reset_mac(config_word)     \
-                set_bit(19, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 19)
 #define netxen_gb_soft_reset(config_word)       \
-                set_bit(31, (unsigned long*)(&config_word))
+        ((config_word) |= 1 << 31)
 
 #define netxen_gb_unset_tx_flowctl(config_word) \
-                clear_bit(4, (unsigned long *)(&config_word))
+        ((config_word) &= ~(1 << 4))
 #define netxen_gb_unset_rx_flowctl(config_word) \
-                clear_bit(5, (unsigned long*)(&config_word))
+        ((config_word) &= ~(1 << 5))
 
 #define netxen_gb_get_tx_synced(config_word)    \
                 _netxen_crb_get_bit((config_word), 1)
@@ -171,15 +171,15 @@ typedef enum {
  */
 
 #define netxen_gb_set_duplex(config_word)       \
-                set_bit(0, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 0)
 #define netxen_gb_set_crc_enable(config_word)   \
-                set_bit(1, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 1)
 #define netxen_gb_set_padshort(config_word)     \
-                set_bit(2, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 2)
 #define netxen_gb_set_checklength(config_word)  \
-                set_bit(4, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 4)
 #define netxen_gb_set_hugeframes(config_word)   \
-                set_bit(5, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 5)
 #define netxen_gb_set_preamblelen(config_word, val)     \
                 ((config_word) |= ((val) << 12) & 0xF000)
 #define netxen_gb_set_intfmode(config_word, val)                \
@@ -190,9 +190,9 @@ typedef enum {
 #define netxen_gb_set_mii_mgmt_clockselect(config_word, val)    \
                 ((config_word) |= ((val) & 0x07))
 #define netxen_gb_mii_mgmt_reset(config_word)   \
-                set_bit(31, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 31)
 #define netxen_gb_mii_mgmt_unset(config_word)   \
-                clear_bit(31, (unsigned long*)&config_word)
+                ((config_word) &= ~(1 << 31))
 
 /*
  * NIU GB MII Mgmt Command Register (applies to GB0, GB1, GB2, GB3)
@@ -201,7 +201,7 @@ typedef enum {
  */
 
 #define netxen_gb_mii_mgmt_set_read_cycle(config_word)  \
-                set_bit(0, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 0)
 #define netxen_gb_mii_mgmt_reg_addr(config_word, val)   \
                 ((config_word) |= ((val) & 0x1F))
 #define netxen_gb_mii_mgmt_phy_addr(config_word, val)   \
@@ -274,9 +274,9 @@ typedef enum {
 #define netxen_set_phy_speed(config_word, val)  \
                 ((config_word) |= ((val & 0x03) << 14))
 #define netxen_set_phy_duplex(config_word)      \
-                set_bit(13, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 13)
 #define netxen_clear_phy_duplex(config_word)    \
-                clear_bit(13, (unsigned long*)&config_word)
+                ((config_word) &= ~(1 << 13))
 
 #define netxen_get_phy_jabber(config_word)      \
                 _netxen_crb_get_bit(config_word, 0)
@@ -350,11 +350,11 @@ typedef enum {
                 _netxen_crb_get_bit(config_word, 15)
 
 #define netxen_set_phy_int_link_status_changed(config_word)     \
-                set_bit(10, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 10)
 #define netxen_set_phy_int_autoneg_completed(config_word)       \
-                set_bit(11, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 11)
 #define netxen_set_phy_int_speed_changed(config_word)   \
-                set_bit(14, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 14)
 
 /*
  * NIU Mode Register.
@@ -382,22 +382,22 @@ typedef enum {
  */
 
 #define netxen_set_gb_drop_gb0(config_word)     \
-                set_bit(0, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 0)
 #define netxen_set_gb_drop_gb1(config_word)     \
-                set_bit(1, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 1)
 #define netxen_set_gb_drop_gb2(config_word)     \
-                set_bit(2, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 2)
 #define netxen_set_gb_drop_gb3(config_word)     \
-                set_bit(3, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 3)
 
 #define netxen_clear_gb_drop_gb0(config_word)   \
-                clear_bit(0, (unsigned long*)&config_word)
+                ((config_word) &= ~(1 << 0))
 #define netxen_clear_gb_drop_gb1(config_word)   \
-                clear_bit(1, (unsigned long*)&config_word)
+                ((config_word) &= ~(1 << 1))
 #define netxen_clear_gb_drop_gb2(config_word)   \
-                clear_bit(2, (unsigned long*)&config_word)
+                ((config_word) &= ~(1 << 2))
 #define netxen_clear_gb_drop_gb3(config_word)   \
-                clear_bit(3, (unsigned long*)&config_word)
+                ((config_word) &= ~(1 << 3))
 
 /*
  * NIU XG MAC Config Register
@@ -413,7 +413,7 @@ typedef enum {
  */
 
 #define netxen_xg_soft_reset(config_word)       \
-                set_bit(4, (unsigned long*)&config_word)
+                ((config_word) |= 1 << 4)
 
 /*
  * MAC Control Register
@@ -433,19 +433,19 @@ typedef enum {
 #define netxen_nic_mcr_set_id_pool0(config, val)        \
                 ((config) |= ((val) &0x03))
 #define netxen_nic_mcr_set_enable_xtnd0(config) \
-                (set_bit(3, (unsigned long *)&(config)))
+                ((config) |= 1 << 3)
 #define netxen_nic_mcr_set_id_pool1(config, val)        \
                 ((config) |= (((val) & 0x03) << 4))
 #define netxen_nic_mcr_set_enable_xtnd1(config) \
-                (set_bit(6, (unsigned long *)&(config)))
+                ((config) |= 1 << 6)
 #define netxen_nic_mcr_set_id_pool2(config, val)        \
                 ((config) |= (((val) & 0x03) << 8))
 #define netxen_nic_mcr_set_enable_xtnd2(config) \
-                (set_bit(10, (unsigned long *)&(config)))
+                ((config) |= 1 << 10)
 #define netxen_nic_mcr_set_id_pool3(config, val)        \
                 ((config) |= (((val) & 0x03) << 12))
 #define netxen_nic_mcr_set_enable_xtnd3(config) \
-                (set_bit(14, (unsigned long *)&(config)))
+                ((config) |= 1 << 14)
 #define netxen_nic_mcr_set_mode_select(config, val)     \
                 ((config) |= (((val) & 0x03) << 24))
 #define netxen_nic_mcr_set_enable_pool(config, val)     \
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index c3e41f368554..973af96337a9 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -690,8 +690,7 @@ int netxen_nic_rx_has_work(struct netxen_adapter *adapter)
                 desc_head = recv_ctx->rcv_status_desc_head;
                 desc = &desc_head[consumer];
 
-                if (((le16_to_cpu(netxen_get_sts_owner(desc)))
-                     & STATUS_OWNER_HOST))
+                if (netxen_get_sts_owner(desc) & STATUS_OWNER_HOST)
                         return 1;
         }
 
@@ -787,11 +786,11 @@ netxen_process_rcv(struct netxen_adapter *adapter, int ctxid,
         struct netxen_port *port = adapter->port[netxen_get_sts_port(desc)];
         struct pci_dev *pdev = port->pdev;
         struct net_device *netdev = port->netdev;
-        int index = le16_to_cpu(netxen_get_sts_refhandle(desc));
+        int index = netxen_get_sts_refhandle(desc);
         struct netxen_recv_context *recv_ctx = &(adapter->recv_ctx[ctxid]);
         struct netxen_rx_buffer *buffer;
         struct sk_buff *skb;
-        u32 length = le16_to_cpu(netxen_get_sts_totallength(desc));
+        u32 length = netxen_get_sts_totallength(desc);
         u32 desc_ctx;
         struct netxen_rcv_desc_ctx *rcv_desc;
         int ret;
@@ -918,16 +917,14 @@ u32 netxen_process_rcv_ring(struct netxen_adapter *adapter, int ctxid, int max)
          */
         while (count < max) {
                 desc = &desc_head[consumer];
-                if (!
-                    (le16_to_cpu(netxen_get_sts_owner(desc)) &
-                     STATUS_OWNER_HOST)) {
+                if (!(netxen_get_sts_owner(desc) & STATUS_OWNER_HOST)) {
                         DPRINTK(ERR, "desc %p ownedby %x\n", desc,
                                 netxen_get_sts_owner(desc));
                         break;
                 }
                 netxen_process_rcv(adapter, ctxid, desc);
                 netxen_clear_sts_owner(desc);
-                netxen_set_sts_owner(desc, cpu_to_le16(STATUS_OWNER_PHANTOM));
+                netxen_set_sts_owner(desc, STATUS_OWNER_PHANTOM);
                 consumer = (consumer + 1) & (adapter->max_rx_desc_count - 1);
                 count++;
         }
@@ -1232,7 +1229,7 @@ void netxen_post_rx_buffers_nodb(struct netxen_adapter *adapter, uint32_t ctx,
 
                 /* make a rcv descriptor  */
                 pdesc->reference_handle = cpu_to_le16(buffer->ref_handle);
-                pdesc->buffer_length = cpu_to_le16(rcv_desc->dma_size);
+                pdesc->buffer_length = cpu_to_le32(rcv_desc->dma_size);
                 pdesc->addr_buffer = cpu_to_le64(buffer->dma);
                 DPRINTK(INFO, "done writing descripter\n");
                 producer =
diff --git a/drivers/net/netxen/netxen_nic_isr.c b/drivers/net/netxen/netxen_nic_isr.c
index 06847d4252c3..be366e48007c 100644
--- a/drivers/net/netxen/netxen_nic_isr.c
+++ b/drivers/net/netxen/netxen_nic_isr.c
@@ -79,7 +79,7 @@ void netxen_indicate_link_status(struct netxen_adapter *adapter, u32 portno,
 void netxen_handle_port_int(struct netxen_adapter *adapter, u32 portno,
                             u32 enable)
 {
-        __le32 int_src;
+        __u32 int_src;
         struct netxen_port *port;
 
         /*  This should clear the interrupt source */
@@ -110,7 +110,7 @@ void netxen_handle_port_int(struct netxen_adapter *adapter, u32 portno,
         /* write it down later.. */
         if ((netxen_get_phy_int_speed_changed(int_src))
             || (netxen_get_phy_int_link_status_changed(int_src))) {
-                __le32 status;
+                __u32 status;
 
                 DPRINTK(INFO, "SPEED CHANGED OR LINK STATUS CHANGED \n");
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 8a5792fea774..69c1b9d23a1a 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -117,7 +117,7 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         void __iomem *mem_ptr1 = NULL;
         void __iomem *mem_ptr2 = NULL;
 
-        u8 *db_ptr = NULL;
+        u8 __iomem *db_ptr = NULL;
         unsigned long mem_base, mem_len, db_base, db_len;
         int pci_using_dac, i, err;
         int ring;
@@ -191,7 +191,7 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 db_len);
 
         db_ptr = ioremap(db_base, NETXEN_DB_MAPSIZE_BYTES);
-        if (db_ptr == 0UL) {
+        if (!db_ptr) {
                 printk(KERN_ERR "%s: Failed to allocate doorbell map.",
                        netxen_nic_driver_name);
                 err = -EIO;
@@ -818,7 +818,7 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         /* Take skb->data itself */
         pbuf = &adapter->cmd_buf_arr[producer];
         if ((netdev->features & NETIF_F_TSO) && skb_shinfo(skb)->gso_size > 0) {
-                pbuf->mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
+                pbuf->mss = skb_shinfo(skb)->gso_size;
                 hwdesc->mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
         } else {
                 pbuf->mss = 0;
@@ -882,7 +882,7 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                         hwdesc->addr_buffer3 = cpu_to_le64(temp_dma);
                         break;
                 case 3:
-                        hwdesc->buffer4_length = temp_len;
+                        hwdesc->buffer4_length = cpu_to_le16(temp_len);
                         hwdesc->addr_buffer4 = cpu_to_le64(temp_dma);
                         break;
                 }
@@ -1144,7 +1144,7 @@ static int __init netxen_init_module(void)
         if ((netxen_workq = create_singlethread_workqueue("netxen")) == 0)
                 return -ENOMEM;
 
-        return pci_module_init(&netxen_driver);
+        return pci_register_driver(&netxen_driver);
 }
 
 module_init(netxen_init_module);
diff --git a/drivers/net/netxen/netxen_nic_niu.c b/drivers/net/netxen/netxen_nic_niu.c
index 4987dc765d99..40d7003a371c 100644
--- a/drivers/net/netxen/netxen_nic_niu.c
+++ b/drivers/net/netxen/netxen_nic_niu.c
@@ -89,15 +89,15 @@ static inline int phy_unlock(struct netxen_adapter *adapter)
  *
  */
 int netxen_niu_gbe_phy_read(struct netxen_adapter *adapter, long phy,
-                            long reg, __le32 * readval)
+                            long reg, __u32 * readval)
 {
         long timeout = 0;
         long result = 0;
         long restore = 0;
-        __le32 address;
-        __le32 command;
-        __le32 status;
-        __le32 mac_cfg0;
+        __u32 address;
+        __u32 command;
+        __u32 status;
+        __u32 mac_cfg0;
 
         if (phy_lock(adapter) != 0) {
                 return -1;
@@ -112,7 +112,7 @@ int netxen_niu_gbe_phy_read(struct netxen_adapter *adapter, long phy,
                                   &mac_cfg0, 4))
                 return -EIO;
         if (netxen_gb_get_soft_reset(mac_cfg0)) {
-                __le32 temp;
+                __u32 temp;
                 temp = 0;
                 netxen_gb_tx_reset_pb(temp);
                 netxen_gb_rx_reset_pb(temp);
@@ -184,15 +184,15 @@ int netxen_niu_gbe_phy_read(struct netxen_adapter *adapter, long phy,
  *
  */
 int netxen_niu_gbe_phy_write(struct netxen_adapter *adapter,
-                             long phy, long reg, __le32 val)
+                             long phy, long reg, __u32 val)
 {
         long timeout = 0;
         long result = 0;
         long restore = 0;
-        __le32 address;
-        __le32 command;
-        __le32 status;
-        __le32 mac_cfg0;
+        __u32 address;
+        __u32 command;
+        __u32 status;
+        __u32 mac_cfg0;
 
         /*
          * MII mgmt all goes through port 0 MAC interface, so it
@@ -203,7 +203,7 @@ int netxen_niu_gbe_phy_write(struct netxen_adapter *adapter,
                                   &mac_cfg0, 4))
                 return -EIO;
         if (netxen_gb_get_soft_reset(mac_cfg0)) {
-                __le32 temp;
+                __u32 temp;
                 temp = 0;
                 netxen_gb_tx_reset_pb(temp);
                 netxen_gb_rx_reset_pb(temp);
@@ -269,7 +269,7 @@ int netxen_niu_gbe_enable_phy_interrupts(struct netxen_adapter *adapter,
                                          int port)
 {
         int result = 0;
-        __le32 enable = 0;
+        __u32 enable = 0;
         netxen_set_phy_int_link_status_changed(enable);
         netxen_set_phy_int_autoneg_completed(enable);
         netxen_set_phy_int_speed_changed(enable);
@@ -402,7 +402,7 @@ void netxen_niu_gbe_set_gmii_mode(struct netxen_adapter *adapter,
 int netxen_niu_gbe_init_port(struct netxen_adapter *adapter, int port)
 {
         int result = 0;
-        __le32 status;
+        __u32 status;
         if (adapter->disable_phy_interrupts)
                 adapter->disable_phy_interrupts(adapter, port);
         mdelay(2);
@@ -410,7 +410,7 @@ int netxen_niu_gbe_init_port(struct netxen_adapter *adapter, int port)
         if (0 ==
             netxen_niu_gbe_phy_read(adapter, port,
                                     NETXEN_NIU_GB_MII_MGMT_ADDR_PHY_STATUS,
-                                    (__le32 *) & status)) {
+                                    &status)) {
                 if (netxen_get_phy_link(status)) {
                         if (netxen_get_phy_speed(status) == 2) {
                                 netxen_niu_gbe_set_gmii_mode(adapter, port, 1);
@@ -489,7 +489,7 @@ int netxen_niu_gbe_handle_phy_interrupt(struct netxen_adapter *adapter,
                                         int port, long enable)
 {
         int result = 0;
-        __le32 int_src;
+        __u32 int_src;
 
         printk(KERN_INFO PFX "NETXEN: Handling PHY interrupt on port %d"
                " (device enable = %d)\n", (int)port, (int)enable);
@@ -530,7 +530,7 @@ int netxen_niu_gbe_handle_phy_interrupt(struct netxen_adapter *adapter,
                         printk(KERN_INFO PFX "autoneg_error ");
                 if ((netxen_get_phy_int_speed_changed(int_src))
                     || (netxen_get_phy_int_link_status_changed(int_src))) {
-                        __le32 status;
+                        __u32 status;
 
                         printk(KERN_INFO PFX
                                "speed_changed or link status changed");
@@ -583,9 +583,9 @@ int netxen_niu_gbe_handle_phy_interrupt(struct netxen_adapter *adapter,
 int netxen_niu_macaddr_get(struct netxen_adapter *adapter,
                            int phy, netxen_ethernet_macaddr_t * addr)
 {
-        u64 result = 0;
-        __le32 stationhigh;
-        __le32 stationlow;
+        u32 stationhigh;
+        u32 stationlow;
+        u8 val[8];
 
         if (addr == NULL)
                 return -EINVAL;
@@ -598,10 +598,10 @@ int netxen_niu_macaddr_get(struct netxen_adapter *adapter,
         if (netxen_nic_hw_read_wx(adapter, NETXEN_NIU_GB_STATION_ADDR_1(phy),
                                   &stationlow, 4))
                 return -EIO;
+        ((__le32 *)val)[1] = cpu_to_le32(stationhigh);
+        ((__le32 *)val)[0] = cpu_to_le32(stationlow);
 
-        result = (u64) netxen_gb_get_stationaddress_low(stationlow);
-        result |= (u64) stationhigh << 16;
-        memcpy(*addr, &result, sizeof(netxen_ethernet_macaddr_t));
+        memcpy(addr, val + 2, 6);
 
         return 0;
 }
@@ -613,24 +613,25 @@ int netxen_niu_macaddr_get(struct netxen_adapter *adapter,
 int netxen_niu_macaddr_set(struct netxen_port *port,
                            netxen_ethernet_macaddr_t addr)
 {
-        __le32 temp = 0;
+        u8 temp[4];
+        u32 val;
         struct netxen_adapter *adapter = port->adapter;
         int phy = port->portnum;
         unsigned char mac_addr[6];
         int i;
 
         for (i = 0; i < 10; i++) {
-                memcpy(&temp, addr, 2);
-                temp <<= 16;
+                temp[0] = temp[1] = 0;
+                memcpy(temp + 2, addr, 2);
+                val = le32_to_cpu(*(__le32 *)temp);
                 if (netxen_nic_hw_write_wx
-                    (adapter, NETXEN_NIU_GB_STATION_ADDR_1(phy), &temp, 4))
+                    (adapter, NETXEN_NIU_GB_STATION_ADDR_1(phy), &val, 4))
                         return -EIO;
 
-                temp = 0;
-
-                memcpy(&temp, ((u8 *) addr) + 2, sizeof(__le32));
+                memcpy(temp, ((u8 *) addr) + 2, sizeof(__le32));
+                val = le32_to_cpu(*(__le32 *)temp);
                 if (netxen_nic_hw_write_wx
-                    (adapter, NETXEN_NIU_GB_STATION_ADDR_0(phy), &temp, 4))
+                    (adapter, NETXEN_NIU_GB_STATION_ADDR_0(phy), &val, 4))
                         return -2;
 
                 netxen_niu_macaddr_get(adapter, phy,
@@ -659,9 +660,9 @@ int netxen_niu_macaddr_set(struct netxen_port *port,
 int netxen_niu_enable_gbe_port(struct netxen_adapter *adapter,
                                int port, netxen_niu_gbe_ifmode_t mode)
 {
-        __le32 mac_cfg0;
-        __le32 mac_cfg1;
-        __le32 mii_cfg;
+        __u32 mac_cfg0;
+        __u32 mac_cfg1;
+        __u32 mii_cfg;
 
         if ((port < 0) || (port > NETXEN_NIU_MAX_GBE_PORTS))
                 return -EINVAL;
@@ -736,7 +737,7 @@ int netxen_niu_enable_gbe_port(struct netxen_adapter *adapter,
 /* Disable a GbE interface */
 int netxen_niu_disable_gbe_port(struct netxen_adapter *adapter, int port)
 {
-        __le32 mac_cfg0;
+        __u32 mac_cfg0;
 
         if ((port < 0) || (port > NETXEN_NIU_MAX_GBE_PORTS))
                 return -EINVAL;
@@ -752,7 +753,7 @@ int netxen_niu_disable_gbe_port(struct netxen_adapter *adapter, int port)
 /* Disable an XG interface */
 int netxen_niu_disable_xg_port(struct netxen_adapter *adapter, int port)
 {
-        __le32 mac_cfg;
+        __u32 mac_cfg;
 
         if (port != 0)
                 return -EINVAL;
@@ -769,7 +770,7 @@ int netxen_niu_disable_xg_port(struct netxen_adapter *adapter, int port)
 int netxen_niu_set_promiscuous_mode(struct netxen_adapter *adapter, int port,
                                     netxen_niu_prom_mode_t mode)
 {
-        __le32 reg;
+        __u32 reg;
 
         if ((port < 0) || (port > NETXEN_NIU_MAX_GBE_PORTS))
                 return -EINVAL;
@@ -826,22 +827,21 @@ int netxen_niu_set_promiscuous_mode(struct netxen_adapter *adapter, int port,
 int netxen_niu_xg_macaddr_set(struct netxen_port *port,
                               netxen_ethernet_macaddr_t addr)
 {
-        __le32 temp = 0;
+        u8 temp[4];
+        u32 val;
         struct netxen_adapter *adapter = port->adapter;
 
-        memcpy(&temp, addr, 2);
-        temp = cpu_to_le32(temp);
-        temp <<= 16;
+        temp[0] = temp[1] = 0;
+        memcpy(temp + 2, addr, 2);
+        val = le32_to_cpu(*(__le32 *)temp);
         if (netxen_nic_hw_write_wx(adapter, NETXEN_NIU_XGE_STATION_ADDR_0_1,
-                                   &temp, 4))
+                                   &val, 4))
                 return -EIO;
 
-        temp = 0;
-
         memcpy(&temp, ((u8 *) addr) + 2, sizeof(__le32));
-        temp = cpu_to_le32(temp);
+        val = le32_to_cpu(*(__le32 *)temp);
         if (netxen_nic_hw_write_wx(adapter, NETXEN_NIU_XGE_STATION_ADDR_0_HI,
-                                   &temp, 4))
+                                   &val, 4))
                 return -EIO;
 
         return 0;
@@ -854,9 +854,9 @@ int netxen_niu_xg_macaddr_set(struct netxen_port *port,
 int netxen_niu_xg_macaddr_get(struct netxen_adapter *adapter, int phy,
                               netxen_ethernet_macaddr_t * addr)
 {
-        __le32 stationhigh;
-        __le32 stationlow;
-        u64 result;
+        u32 stationhigh;
+        u32 stationlow;
+        u8 val[8];
 
         if (addr == NULL)
                 return -EINVAL;
@@ -869,10 +869,10 @@ int netxen_niu_xg_macaddr_get(struct netxen_adapter *adapter, int phy,
         if (netxen_nic_hw_read_wx(adapter, NETXEN_NIU_XGE_STATION_ADDR_0_1,
                                   &stationlow, 4))
                 return -EIO;
+        ((__le32 *)val)[1] = cpu_to_le32(stationhigh);
+        ((__le32 *)val)[0] = cpu_to_le32(stationlow);
 
-        result = ((u64) stationlow) >> 16;
-        result |= (u64) stationhigh << 16;
-        memcpy(*addr, &result, sizeof(netxen_ethernet_macaddr_t));
+        memcpy(addr, val + 2, 6);
 
         return 0;
 }
@@ -880,7 +880,7 @@ int netxen_niu_xg_macaddr_get(struct netxen_adapter *adapter, int phy,
 int netxen_niu_xg_set_promiscuous_mode(struct netxen_adapter *adapter,
                                        int port, netxen_niu_prom_mode_t mode)
 {
-        __le32 reg;
+        __u32 reg;
 
         if ((port < 0) || (port > NETXEN_NIU_MAX_GBE_PORTS))
                 return -EINVAL;
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 342f4062de0b..461e8274ef69 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -606,11 +606,14 @@ static int el3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
     kio_addr_t ioaddr = dev->base_addr;
     struct el3_private *priv = netdev_priv(dev);
+    unsigned long flags;
 
     DEBUG(3, "%s: el3_start_xmit(length = %ld) called, "
           "status %4.4x.\n", dev->name, (long)skb->len,
           inw(ioaddr + EL3_STATUS));
 
+    spin_lock_irqsave(&priv->lock, flags);    
+
     priv->stats.tx_bytes += skb->len;
 
     /* Put out the doubleword header... */
@@ -628,6 +631,7 @@ static int el3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
     dev_kfree_skb(skb);
     pop_tx_status(dev);
+    spin_unlock_irqrestore(&priv->lock, flags);    
     
     return 0;
 }
@@ -729,14 +733,13 @@ static void media_check(unsigned long arg)
 
     if (!netif_device_present(dev)) goto reschedule;
 
-    EL3WINDOW(1);
     /* Check for pending interrupt with expired latency timer: with
        this, we can limp along even if the interrupt is blocked */
     if ((inw(ioaddr + EL3_STATUS) & IntLatch) &&
         (inb(ioaddr + EL3_TIMER) == 0xff)) {
         if (!lp->fast_poll)
             printk(KERN_WARNING "%s: interrupt(s) dropped!\n", dev->name);
-        el3_interrupt(dev->irq, lp);
+        el3_interrupt(dev->irq, dev);
         lp->fast_poll = HZ;
     }
     if (lp->fast_poll) {
diff --git a/drivers/net/phy/fixed.c b/drivers/net/phy/fixed.c
index 096d4a100bf2..86135397f430 100644
--- a/drivers/net/phy/fixed.c
+++ b/drivers/net/phy/fixed.c
@@ -349,7 +349,7 @@ static int __init fixed_init(void)
         fixed_mdio_register_device(0, 100, 1);
 #endif
 
-#ifdef CONFIX_FIXED_MII_10_FDX
+#ifdef CONFIG_FIXED_MII_10_FDX
         fixed_mdio_register_device(0, 10, 1);
 #endif
         return 0;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index e175f3910b18..9765fa661467 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -286,6 +286,7 @@ int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd)
 
         return 0;
 }
+EXPORT_SYMBOL(phy_ethtool_sset);
 
 int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd)
 {
@@ -302,7 +303,7 @@ int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd)
 
         return 0;
 }
-
+EXPORT_SYMBOL(phy_ethtool_gset);
 
 /* Note that this function is currently incompatible with the
  * PHYCONTROL layer.  It changes registers without regard to
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 250cdbeefdfd..1dd66b8ea0fa 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -556,10 +556,9 @@ static int init_shared_mem(struct s2io_nic *nic)
                 }
         }
 
-        nic->ufo_in_band_v = kmalloc((sizeof(u64) * size), GFP_KERNEL);
+        nic->ufo_in_band_v = kcalloc(size, sizeof(u64), GFP_KERNEL);
         if (!nic->ufo_in_band_v)
                 return -ENOMEM;
-        memset(nic->ufo_in_band_v, 0, size);
 
         /* Allocation and initialization of RXDs in Rings */
         size = 0;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index deedfd5f8226..45283f3f95e4 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -60,7 +60,7 @@
 #define LINK_HZ                 (HZ/2)
 
 MODULE_DESCRIPTION("SysKonnect Gigabit Ethernet driver");
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index a6601e8d423c..822dd0b13133 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -3639,29 +3639,6 @@ static int sky2_resume(struct pci_dev *pdev)
 out:
         return err;
 }
-
-/* BIOS resume runs after device (it's a bug in PM)
- * as a temporary workaround on suspend/resume leave MSI disabled
- */
-static int sky2_suspend_late(struct pci_dev *pdev, pm_message_t state)
-{
-        struct sky2_hw *hw = pci_get_drvdata(pdev);
-
-        free_irq(pdev->irq, hw);
-        if (hw->msi) {
-                pci_disable_msi(pdev);
-                hw->msi = 0;
-        }
-        return 0;
-}
-
-static int sky2_resume_early(struct pci_dev *pdev)
-{
-        struct sky2_hw *hw = pci_get_drvdata(pdev);
-        struct net_device *dev = hw->dev[0];
-
-        return request_irq(pdev->irq, sky2_intr, IRQF_SHARED, dev->name, hw);
-}
 #endif
 
 static struct pci_driver sky2_driver = {
@@ -3672,8 +3649,6 @@ static struct pci_driver sky2_driver = {
 #ifdef CONFIG_PM
         .suspend = sky2_suspend,
         .resume = sky2_resume,
-        .suspend_late = sky2_suspend_late,
-        .resume_early = sky2_resume_early,
 #endif
 };
 
@@ -3691,6 +3666,6 @@ module_init(sky2_init_module);
 module_exit(sky2_cleanup_module);
 
 MODULE_DESCRIPTION("Marvell Yukon 2 Gigabit Ethernet driver");
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index 880d9fdd7c67..43af61438449 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -968,11 +968,11 @@ static void smc911x_phy_configure(struct work_struct *work)
          * We should not be called if phy_type is zero.
          */
         if (lp->phy_type == 0)
-                 goto smc911x_phy_configure_exit;
+                 goto smc911x_phy_configure_exit_nolock;
 
         if (smc911x_phy_reset(dev, phyaddr)) {
                 printk("%s: PHY reset timed out\n", dev->name);
-                goto smc911x_phy_configure_exit;
+                goto smc911x_phy_configure_exit_nolock;
         }
         spin_lock_irqsave(&lp->lock, flags);
 
@@ -1041,6 +1041,7 @@ static void smc911x_phy_configure(struct work_struct *work)
 
 smc911x_phy_configure_exit:
         spin_unlock_irqrestore(&lp->lock, flags);
+smc911x_phy_configure_exit_nolock:
         lp->work_pending = 0;
 }
 
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index ebb6aa39f9c7..8ea2fc1b96cb 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -1925,6 +1925,8 @@ spider_net_stop(struct net_device *netdev)
         /* release chains */
         spider_net_release_tx_chain(card, 1);
 
+        spider_net_free_rx_chain_contents(card);
+
         spider_net_free_chain(card, &card->tx_chain);
         spider_net_free_chain(card, &card->rx_chain);
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index ef882a8a094e..c913ea4e545c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -654,19 +654,42 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,	PCI_DEVICE_ID_VIA_82C686_4,	quirk_vi
  *      VIA bridges which have VLink
  */
 
-static const struct pci_device_id via_vlink_fixup_tbl[] = {
-        /* Internal devices need IRQ line routing, pre VLink */
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_82C686), 0 },
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_8231), 17 },
-        /* Devices with VLink */
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_8233_0), 17},
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_8233A), 17 },
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_8233C_0), 17 },
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_8235), 16 },
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_8237), 15 },
-        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_8237A), 15 },
-        { 0, },
-};
+static int via_vlink_dev_lo = -1, via_vlink_dev_hi = 18;
+
+static void quirk_via_bridge(struct pci_dev *dev)
+{
+        /* See what bridge we have and find the device ranges */
+        switch (dev->device) {
+        case PCI_DEVICE_ID_VIA_82C686:
+                /* The VT82C686 is special, it attaches to PCI and can have
+                   any device number. All its subdevices are functions of
+                   that single device. */
+                via_vlink_dev_lo = PCI_SLOT(dev->devfn);
+                via_vlink_dev_hi = PCI_SLOT(dev->devfn);
+                break;
+        case PCI_DEVICE_ID_VIA_8237:
+        case PCI_DEVICE_ID_VIA_8237A:
+                via_vlink_dev_lo = 15;
+                break;
+        case PCI_DEVICE_ID_VIA_8235:
+                via_vlink_dev_lo = 16;
+                break;
+        case PCI_DEVICE_ID_VIA_8231:
+        case PCI_DEVICE_ID_VIA_8233_0:
+        case PCI_DEVICE_ID_VIA_8233A:
+        case PCI_DEVICE_ID_VIA_8233C_0:
+                via_vlink_dev_lo = 17;
+                break;
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_82C686,       quirk_via_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8231,         quirk_via_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8233_0,       quirk_via_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8233A,        quirk_via_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8233C_0,      quirk_via_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8235,         quirk_via_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8237,         quirk_via_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8237A,        quirk_via_bridge);
 
 /**
  *      quirk_via_vlink         -       VIA VLink IRQ number update
@@ -675,35 +698,20 @@ static const struct pci_device_id via_vlink_fixup_tbl[] = {
  *      If the device we are dealing with is on a PIC IRQ we need to
  *      ensure that the IRQ line register which usually is not relevant
  *      for PCI cards, is actually written so that interrupts get sent
- *      to the right place
+ *      to the right place.
+ *      We only do this on systems where a VIA south bridge was detected,
+ *      and only for VIA devices on the motherboard (see quirk_via_bridge
+ *      above).
  */
 
 static void quirk_via_vlink(struct pci_dev *dev)
 {
-        const struct pci_device_id *via_vlink_fixup;
-        static int dev_lo = -1, dev_hi = 18;
         u8 irq, new_irq;
 
-        /* Check if we have VLink and cache the result */
-
-        /* Checked already - no */
-        if (dev_lo == -2)
+        /* Check if we have VLink at all */
+        if (via_vlink_dev_lo == -1)
                 return;
 
-        /* Not checked - see what bridge we have and find the device
-           ranges */
-
-        if (dev_lo == -1) {
-                via_vlink_fixup = pci_find_present(via_vlink_fixup_tbl);
-                if (via_vlink_fixup == NULL) {
-                        dev_lo = -2;
-                        return;
-                }
-                dev_lo = via_vlink_fixup->driver_data;
-                /* 82C686 is special - 0/0 */
-                if (dev_lo == 0)
-                        dev_hi = 0;
-        }
         new_irq = dev->irq;
 
         /* Don't quirk interrupts outside the legacy IRQ range */
@@ -711,8 +719,8 @@ static void quirk_via_vlink(struct pci_dev *dev)
                 return;
 
         /* Internal device ? */
-        if (dev->bus->number != 0 || PCI_SLOT(dev->devfn) > dev_hi ||
-                PCI_SLOT(dev->devfn) < dev_lo)
+        if (dev->bus->number != 0 || PCI_SLOT(dev->devfn) > via_vlink_dev_hi ||
+            PCI_SLOT(dev->devfn) < via_vlink_dev_lo)
                 return;
 
         /* This is an internal VLink device on a PIC interrupt. The BIOS
@@ -1254,8 +1262,8 @@ static void quirk_jmicron_dualfn(struct pci_dev *pdev)
                         pci_read_config_dword(pdev, 0x40, &conf);
                         /* Enable dual function mode, AHCI on fn 0, IDE fn1 */
                         /* Set the class codes correctly and then direct IDE 0 */
-                        conf &= ~0x000F0200;    /* Clear bit 9 and 16-19 */
-                        conf |=  0x00C20002;    /* Set bit 1, 17, 22, 23 */
+                        conf &= ~0x000FF200; /* Clear bit 9 and 12-19 */
+                        conf |=  0x00C2A102; /* Set 1, 8, 13, 15, 17, 22, 23 */
                         pci_write_config_dword(pdev, 0x40, conf);
 
                         /* Reconfigure so that the PCI scanner discovers the
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index fab381ed853c..b2653c4afe9e 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -200,11 +200,8 @@ static struct pci_dev * pci_find_subsys(unsigned int vendor,
          * can cause some machines to crash.  So here we detect and flag that
          * situation and bail out early.
          */
-        if (unlikely(list_empty(&pci_devices))) {
-                printk(KERN_INFO "pci_find_subsys() called while pci_devices "
-                                "is still empty\n");
+        if (unlikely(list_empty(&pci_devices)))
                 return NULL;
-        }
         down_read(&pci_bus_sem);
         n = from ? from->global_list.next : pci_devices.next;
 
@@ -278,11 +275,8 @@ pci_get_subsys(unsigned int vendor, unsigned int device,
          * can cause some machines to crash.  So here we detect and flag that
          * situation and bail out early.
          */
-        if (unlikely(list_empty(&pci_devices))) {
-                printk(KERN_NOTICE "pci_get_subsys() called while pci_devices "
-                                "is still empty\n");
+        if (unlikely(list_empty(&pci_devices)))
                 return NULL;
-        }
         down_read(&pci_bus_sem);
         n = from ? from->global_list.next : pci_devices.next;
 
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index e9e0934380b8..198b9f22fbff 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -492,10 +492,10 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
 
         spin_lock_irq(&rtc->lock);
 
-        /* disable alarm interrupt and clear flag */
+        /* disable alarm interrupt and clear the alarm flag */
         rcr1 = readb(rtc->regbase + RCR1);
-        rcr1 &= ~RCR1_AF;
-        writeb(rcr1 & ~RCR1_AIE, rtc->regbase + RCR1);
+        rcr1 &= ~(RCR1_AF|RCR1_AIE);
+        writeb(rcr1, rtc->regbase + RCR1);
 
         rtc->rearm_aie = 0;
 
@@ -510,8 +510,10 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
                 mon += 1;
         sh_rtc_write_alarm_value(rtc, mon, RMONAR);
 
-        /* Restore interrupt activation status */
-        writeb(rcr1, rtc->regbase + RCR1);
+        if (wkalrm->enabled) {
+                rcr1 |= RCR1_AIE;
+                writeb(rcr1, rtc->regbase + RCR1);
+        }
 
         spin_unlock_irq(&rtc->lock);
 
diff --git a/drivers/rtc/rtc-sysfs.c b/drivers/rtc/rtc-sysfs.c
index 9418a59fb368..2ddd0cf07140 100644
--- a/drivers/rtc/rtc-sysfs.c
+++ b/drivers/rtc/rtc-sysfs.c
@@ -78,7 +78,7 @@ static struct attribute_group rtc_attr_group = {
         .attrs = rtc_attrs,
 };
 
-static int __devinit rtc_sysfs_add_device(struct class_device *class_dev,
+static int rtc_sysfs_add_device(struct class_device *class_dev,
                                         struct class_interface *class_intf)
 {
         int err;
diff --git a/drivers/scsi/pcmcia/sym53c500_cs.c b/drivers/scsi/pcmcia/sym53c500_cs.c
index 9fb0ea5c1fb9..5b458d2478f7 100644
--- a/drivers/scsi/pcmcia/sym53c500_cs.c
+++ b/drivers/scsi/pcmcia/sym53c500_cs.c
@@ -545,8 +545,6 @@ SYM53C500_release(struct pcmcia_device *link)
         */
         if (shost->irq)
                 free_irq(shost->irq, shost);
-        if (shost->dma_channel != 0xff)
-                free_dma(shost->dma_channel);
         if (shost->io_port && shost->n_io_port)
                 release_region(shost->io_port, shost->n_io_port);
 
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index 4249e52a5592..6f4cf2dd2f4a 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -418,7 +418,6 @@ struct scsi_qla_host {
          * concurrently.
          */
         struct mutex  mbox_sem;
-        wait_queue_head_t mailbox_wait_queue;
 
         /* temporary mailbox status registers */
         volatile uint8_t mbox_status_count;
diff --git a/drivers/scsi/qla4xxx/ql4_glbl.h b/drivers/scsi/qla4xxx/ql4_glbl.h
index 2122967bbf0b..e021eb5db2b2 100644
--- a/drivers/scsi/qla4xxx/ql4_glbl.h
+++ b/drivers/scsi/qla4xxx/ql4_glbl.h
@@ -76,4 +76,5 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host * ha,
 extern int ql4xextended_error_logging;
 extern int ql4xdiscoverywait;
 extern int ql4xdontresethba;
+extern int ql4_mod_unload;
 #endif /* _QLA4x_GBL_H */
diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
index cc210f297a78..b907b06d72ab 100644
--- a/drivers/scsi/qla4xxx/ql4_init.c
+++ b/drivers/scsi/qla4xxx/ql4_init.c
@@ -958,25 +958,25 @@ static int qla4xxx_start_firmware_from_flash(struct scsi_qla_host *ha)
         return status;
 }
 
-int ql4xxx_lock_drvr_wait(struct scsi_qla_host *a)
+int ql4xxx_lock_drvr_wait(struct scsi_qla_host *ha)
 {
-#define QL4_LOCK_DRVR_WAIT      300
-#define QL4_LOCK_DRVR_SLEEP     100
+#define QL4_LOCK_DRVR_WAIT      30
+#define QL4_LOCK_DRVR_SLEEP     1
 
         int drvr_wait = QL4_LOCK_DRVR_WAIT;
         while (drvr_wait) {
-                if (ql4xxx_lock_drvr(a) == 0) {
-                        msleep(QL4_LOCK_DRVR_SLEEP);
+                if (ql4xxx_lock_drvr(ha) == 0) {
+                        ssleep(QL4_LOCK_DRVR_SLEEP);
                         if (drvr_wait) {
                                 DEBUG2(printk("scsi%ld: %s: Waiting for "
-                                              "Global Init Semaphore...n",
-                                              a->host_no,
-                                              __func__));
+                                              "Global Init Semaphore(%d)...n",
+                                              ha->host_no,
+                                              __func__, drvr_wait));
                         }
                         drvr_wait -= QL4_LOCK_DRVR_SLEEP;
                 } else {
                         DEBUG2(printk("scsi%ld: %s: Global Init Semaphore "
-                                      "acquired.n", a->host_no, __func__));
+                                      "acquired.n", ha->host_no, __func__));
                         return QLA_SUCCESS;
                 }
         }
diff --git a/drivers/scsi/qla4xxx/ql4_isr.c b/drivers/scsi/qla4xxx/ql4_isr.c
index ef975e0dc87f..35b9e36a0e8d 100644
--- a/drivers/scsi/qla4xxx/ql4_isr.c
+++ b/drivers/scsi/qla4xxx/ql4_isr.c
@@ -433,7 +433,6 @@ static void qla4xxx_isr_decode_mailbox(struct scsi_qla_host * ha,
                                         readl(&ha->reg->mailbox[i]);
 
                         set_bit(AF_MBOX_COMMAND_DONE, &ha->flags);
-                        wake_up(&ha->mailbox_wait_queue);
                 }
         } else if (mbox_status >> 12 == MBOX_ASYNC_EVENT_STATUS) {
                 /* Immediately process the AENs that don't require much work.
@@ -686,7 +685,8 @@ irqreturn_t qla4xxx_intr_handler(int irq, void *dev_id)
                                &ha->reg->ctrl_status);
                         readl(&ha->reg->ctrl_status);
 
-                        set_bit(DPC_RESET_HA_INTR, &ha->dpc_flags);
+                        if (!ql4_mod_unload)
+                                set_bit(DPC_RESET_HA_INTR, &ha->dpc_flags);
 
                         break;
                 } else if (intr_status & INTR_PENDING) {
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index b721dc5dd711..7f28657eef3f 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -29,18 +29,30 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
         u_long wait_count;
         uint32_t intr_status;
         unsigned long flags = 0;
-        DECLARE_WAITQUEUE(wait, current);
-
-        mutex_lock(&ha->mbox_sem);
-
-        /* Mailbox code active */
-        set_bit(AF_MBOX_COMMAND, &ha->flags);
 
         /* Make sure that pointers are valid */
         if (!mbx_cmd || !mbx_sts) {
                 DEBUG2(printk("scsi%ld: %s: Invalid mbx_cmd or mbx_sts "
                               "pointer\n", ha->host_no, __func__));
-                goto mbox_exit;
+                return status;
+        }
+        /* Mailbox code active */
+        wait_count = MBOX_TOV * 100;
+
+        while (wait_count--) {
+                mutex_lock(&ha->mbox_sem);
+                if (!test_bit(AF_MBOX_COMMAND, &ha->flags)) {
+                        set_bit(AF_MBOX_COMMAND, &ha->flags);
+                        mutex_unlock(&ha->mbox_sem);
+                        break;
+                }
+                mutex_unlock(&ha->mbox_sem);
+                if (!wait_count) {
+                        DEBUG2(printk("scsi%ld: %s: mbox_sem failed\n",
+                                ha->host_no, __func__));
+                        return status;
+                }
+                msleep(10);
         }
 
         /* To prevent overwriting mailbox registers for a command that has
@@ -73,8 +85,6 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         /* Wait for completion */
-        set_current_state(TASK_UNINTERRUPTIBLE);
-        add_wait_queue(&ha->mailbox_wait_queue, &wait);
 
         /*
          * If we don't want status, don't wait for the mailbox command to
@@ -83,8 +93,6 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
          */
         if (outCount == 0) {
                 status = QLA_SUCCESS;
-                set_current_state(TASK_RUNNING);
-                remove_wait_queue(&ha->mailbox_wait_queue, &wait);
                 goto mbox_exit;
         }
         /* Wait for command to complete */
@@ -108,8 +116,6 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
                 msleep(10);
         }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(&ha->mailbox_wait_queue, &wait);
 
         /* Check for mailbox timeout. */
         if (!test_bit(AF_MBOX_COMMAND_DONE, &ha->flags)) {
@@ -155,9 +161,10 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
 mbox_exit:
+        mutex_lock(&ha->mbox_sem);
         clear_bit(AF_MBOX_COMMAND, &ha->flags);
-        clear_bit(AF_MBOX_COMMAND_DONE, &ha->flags);
         mutex_unlock(&ha->mbox_sem);
+        clear_bit(AF_MBOX_COMMAND_DONE, &ha->flags);
 
         return status;
 }
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 9ef693c8809a..81fb7bd44f01 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -40,6 +40,8 @@ MODULE_PARM_DESC(ql4xextended_error_logging,
                  "Option to enable extended error logging, "
                  "Default is 0 - no logging, 1 - debug logging");
 
+int ql4_mod_unload = 0;
+
 /*
  * SCSI host template entry points
  */
@@ -422,6 +424,9 @@ static int qla4xxx_queuecommand(struct scsi_cmnd *cmd,
                 goto qc_host_busy;
         }
 
+        if (test_bit(DPC_RESET_HA_INTR, &ha->dpc_flags))
+                goto qc_host_busy;
+
         spin_unlock_irq(ha->host->host_lock);
 
         srb = qla4xxx_get_new_srb(ha, ddb_entry, cmd, done);
@@ -707,16 +712,12 @@ static int qla4xxx_cmd_wait(struct scsi_qla_host *ha)
         return stat;
 }
 
-/**
- * qla4xxx_soft_reset - performs soft reset.
- * @ha: Pointer to host adapter structure.
- **/
-int qla4xxx_soft_reset(struct scsi_qla_host *ha)
+static void qla4xxx_hw_reset(struct scsi_qla_host *ha)
 {
-        uint32_t max_wait_time;
-        unsigned long flags = 0;
-        int status = QLA_ERROR;
         uint32_t ctrl_status;
+        unsigned long flags = 0;
+
+        DEBUG2(printk(KERN_ERR "scsi%ld: %s\n", ha->host_no, __func__));
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
 
@@ -733,6 +734,20 @@ int qla4xxx_soft_reset(struct scsi_qla_host *ha)
         readl(&ha->reg->ctrl_status);
 
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
+}
+
+/**
+ * qla4xxx_soft_reset - performs soft reset.
+ * @ha: Pointer to host adapter structure.
+ **/
+int qla4xxx_soft_reset(struct scsi_qla_host *ha)
+{
+        uint32_t max_wait_time;
+        unsigned long flags = 0;
+        int status = QLA_ERROR;
+        uint32_t ctrl_status;
+
+        qla4xxx_hw_reset(ha);
 
         /* Wait until the Network Reset Intr bit is cleared */
         max_wait_time = RESET_INTR_TOV;
@@ -966,10 +981,12 @@ static void qla4xxx_do_dpc(struct work_struct *work)
         struct scsi_qla_host *ha =
                 container_of(work, struct scsi_qla_host, dpc_work);
         struct ddb_entry *ddb_entry, *dtemp;
+        int status = QLA_ERROR;
 
         DEBUG2(printk("scsi%ld: %s: DPC handler waking up."
-                "flags = 0x%08lx, dpc_flags = 0x%08lx\n",
-                ha->host_no, __func__, ha->flags, ha->dpc_flags));
+                "flags = 0x%08lx, dpc_flags = 0x%08lx ctrl_stat = 0x%08x\n",
+                ha->host_no, __func__, ha->flags, ha->dpc_flags,
+                readw(&ha->reg->ctrl_status)));
 
         /* Initialization not yet finished. Don't do anything yet. */
         if (!test_bit(AF_INIT_DONE, &ha->flags))
@@ -983,31 +1000,28 @@ static void qla4xxx_do_dpc(struct work_struct *work)
                         test_bit(DPC_RESET_HA, &ha->dpc_flags))
                         qla4xxx_recover_adapter(ha, PRESERVE_DDB_LIST);
 
-                if (test_and_clear_bit(DPC_RESET_HA_INTR, &ha->dpc_flags)) {
+                if (test_bit(DPC_RESET_HA_INTR, &ha->dpc_flags)) {
                         uint8_t wait_time = RESET_INTR_TOV;
-                        unsigned long flags = 0;
-
-                        qla4xxx_flush_active_srbs(ha);
 
-                        spin_lock_irqsave(&ha->hardware_lock, flags);
                         while ((readw(&ha->reg->ctrl_status) &
                                 (CSR_SOFT_RESET | CSR_FORCE_SOFT_RESET)) != 0) {
                                 if (--wait_time == 0)
                                         break;
-
-                                spin_unlock_irqrestore(&ha->hardware_lock,
-                                                       flags);
-
                                 msleep(1000);
-
-                                spin_lock_irqsave(&ha->hardware_lock, flags);
                         }
-                        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-
                         if (wait_time == 0)
                                 DEBUG2(printk("scsi%ld: %s: SR|FSR "
                                               "bit not cleared-- resetting\n",
                                               ha->host_no, __func__));
+                        qla4xxx_flush_active_srbs(ha);
+                        if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS) {
+                                qla4xxx_process_aen(ha, FLUSH_DDB_CHANGED_AENS);
+                                status = qla4xxx_initialize_adapter(ha,
+                                                PRESERVE_DDB_LIST);
+                        }
+                        clear_bit(DPC_RESET_HA_INTR, &ha->dpc_flags);
+                        if (status == QLA_SUCCESS)
+                                qla4xxx_enable_intrs(ha);
                 }
         }
 
@@ -1062,7 +1076,7 @@ static void qla4xxx_free_adapter(struct scsi_qla_host *ha)
 
         /* Issue Soft Reset to put firmware in unknown state */
         if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
-                qla4xxx_soft_reset(ha);
+                qla4xxx_hw_reset(ha);
 
         /* Remove timer thread, if present */
         if (ha->timer_active)
@@ -1198,7 +1212,6 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         INIT_LIST_HEAD(&ha->free_srb_q);
 
         mutex_init(&ha->mbox_sem);
-        init_waitqueue_head(&ha->mailbox_wait_queue);
 
         spin_lock_init(&ha->hardware_lock);
 
@@ -1665,6 +1678,7 @@ no_srp_cache:
 
 static void __exit qla4xxx_module_exit(void)
 {
+        ql4_mod_unload = 1;
         pci_unregister_driver(&qla4xxx_pci_driver);
         iscsi_unregister_transport(&qla4xxx_iscsi_transport);
         kmem_cache_destroy(srb_cachep);
diff --git a/drivers/scsi/qla4xxx/ql4_version.h b/drivers/scsi/qla4xxx/ql4_version.h
index 454e19c8ad68..e5183a697d1f 100644
--- a/drivers/scsi/qla4xxx/ql4_version.h
+++ b/drivers/scsi/qla4xxx/ql4_version.h
@@ -5,4 +5,4 @@
  * See LICENSE.qla4xxx for copyright and licensing details.
  */
 
-#define QLA4XXX_DRIVER_VERSION  "5.00.07-k"
+#define QLA4XXX_DRIVER_VERSION  "5.00.07-k1"
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index b83d03c4deef..96b7cbd746a8 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1453,6 +1453,12 @@ struct scsi_device *__scsi_add_device(struct Scsi_Host *shost, uint channel,
         struct device *parent = &shost->shost_gendev;
         struct scsi_target *starget;
 
+        if (strncmp(scsi_scan_type, "none", 4) == 0)
+                return ERR_PTR(-ENODEV);
+
+        if (!shost->async_scan)
+                scsi_complete_async_scans();
+
         starget = scsi_alloc_target(parent, channel, id);
         if (!starget)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 978bfc1e0c6a..b781a90d6699 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1647,16 +1647,6 @@ static int sd_probe(struct device *dev)
         if (error)
                 goto out_put;
 
-        class_device_initialize(&sdkp->cdev);
-        sdkp->cdev.dev = &sdp->sdev_gendev;
-        sdkp->cdev.class = &sd_disk_class;
-        strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
-
-        if (class_device_add(&sdkp->cdev))
-                goto out_put;
-
-        get_device(&sdp->sdev_gendev);
-
         sdkp->device = sdp;
         sdkp->driver = &sd_template;
         sdkp->disk = gd;
@@ -1670,6 +1660,16 @@ static int sd_probe(struct device *dev)
                         sdp->timeout = SD_MOD_TIMEOUT;
         }
 
+        class_device_initialize(&sdkp->cdev);
+        sdkp->cdev.dev = &sdp->sdev_gendev;
+        sdkp->cdev.class = &sd_disk_class;
+        strncpy(sdkp->cdev.class_id, sdp->sdev_gendev.bus_id, BUS_ID_SIZE);
+
+        if (class_device_add(&sdkp->cdev))
+                goto out_put;
+
+        get_device(&sdp->sdev_gendev);
+
         gd->major = sd_major((index & 0xf0) >> 4);
         gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
         gd->minors = 16;
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index e016e0906e1a..488ec7948a57 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -2816,15 +2816,18 @@ static int st_int_ioctl(struct scsi_tape *STp, unsigned int cmd_in, unsigned lon
 
                 if (cmd_in == MTWEOF &&
                     cmdstatp->have_sense &&
-                    (cmdstatp->flags & SENSE_EOM) &&
-                    (cmdstatp->sense_hdr.sense_key == NO_SENSE ||
-                     cmdstatp->sense_hdr.sense_key == RECOVERED_ERROR) &&
-                    undone == 0) {
-                        ioctl_result = 0;       /* EOF written successfully at EOM */
-                        if (fileno >= 0)
-                                fileno++;
+                    (cmdstatp->flags & SENSE_EOM)) {
+                        if (cmdstatp->sense_hdr.sense_key == NO_SENSE ||
+                            cmdstatp->sense_hdr.sense_key == RECOVERED_ERROR) {
+                                ioctl_result = 0;       /* EOF(s) written successfully at EOM */
+                                STps->eof = ST_NOEOF;
+                        } else {  /* Writing EOF(s) failed */
+                                if (fileno >= 0)
+                                        fileno -= undone;
+                                if (undone < arg)
+                                        STps->eof = ST_NOEOF;
+                        }
                         STps->drv_file = fileno;
-                        STps->eof = ST_NOEOF;
                 } else if ((cmd_in == MTFSF) || (cmd_in == MTFSFM)) {
                         if (fileno >= 0)
                                 STps->drv_file = fileno - undone;
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 61db6973755a..f69bd097166e 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -589,6 +589,8 @@ static int __init pl010_console_setup(struct console *co, char *options)
          */
         if (co->index >= UART_NR)
                 co->index = 0;
+        if (!amba_ports[co->index])
+                return -ENODEV;
         port = &amba_ports[co->index]->port;
 
         if (options)
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 9a3b374b2a08..44639e71372a 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -661,6 +661,8 @@ static int __init pl011_console_setup(struct console *co, char *options)
         if (co->index >= UART_NR)
                 co->index = 0;
         uap = amba_ports[co->index];
+        if (!uap)
+                return -ENODEV;
 
         uap->port.uartclk = clk_get_rate(uap->clk);
 
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index ed7f7209ea59..881f886b91c6 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -689,9 +689,9 @@ static void __devinit atmel_init_port(struct atmel_uart_port *atmel_port, struct
         struct atmel_uart_data *data = pdev->dev.platform_data;
 
         port->iotype    = UPIO_MEM;
-        port->flags     = UPF_BOOT_AUTOCONF;
+        port->flags     = UPF_BOOT_AUTOCONF;
         port->ops       = &atmel_pops;
-        port->fifosize  = 1;
+        port->fifosize  = 1;
         port->line      = pdev->id;
         port->dev       = &pdev->dev;
 
@@ -890,7 +890,6 @@ static int atmel_serial_suspend(struct platform_device *pdev, pm_message_t state
         if (device_may_wakeup(&pdev->dev) && !at91_suspend_entering_slow_clock())
                 enable_irq_wake(port->irq);
         else {
-                disable_irq_wake(port->irq);
                 uart_suspend_port(&atmel_uart, port);
                 atmel_port->suspended = 1;
         }
@@ -907,6 +906,8 @@ static int atmel_serial_resume(struct platform_device *pdev)
                 uart_resume_port(&atmel_uart, port);
                 atmel_port->suspended = 0;
         }
+        else
+                disable_irq_wake(port->irq);
 
         return 0;
 }
diff --git a/drivers/serial/atmel_serial.h b/drivers/serial/atmel_serial.h
index fe1763b2a6d5..11b44360e108 100644
--- a/drivers/serial/atmel_serial.h
+++ b/drivers/serial/atmel_serial.h
@@ -106,7 +106,7 @@
 #define ATMEL_US_CSR            0x14                    /* Channel Status Register */
 #define ATMEL_US_RHR            0x18                    /* Receiver Holding Register */
 #define ATMEL_US_THR            0x1c                    /* Transmitter Holding Register */
-#define         ATMEL_US_SYNH           (1 << 15)               /* Transmit/Receive Sync [SAM9 only] */
+#define         ATMEL_US_SYNH           (1 << 15)               /* Transmit/Receive Sync [AT91SAM9261 only] */
 
 #define ATMEL_US_BRGR           0x20                    /* Baud Rate Generator Register */
 #define         ATMEL_US_CD             (0xffff << 0)           /* Clock Divider */
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 6ed3f1da9296..8b41f9cc2560 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1169,8 +1169,9 @@ static int setup(struct spi_device *spi)
                                 spi->bits_per_word - 16 : spi->bits_per_word)
                         | SSCR0_SSE
                         | (spi->bits_per_word > 16 ? SSCR0_EDSS : 0);
-        chip->cr1 |= (((spi->mode & SPI_CPHA) != 0) << 4)
-                        | (((spi->mode & SPI_CPOL) != 0) << 3);
+        chip->cr1 &= ~(SSCR1_SPO | SSCR1_SPH);
+        chip->cr1 |= (((spi->mode & SPI_CPHA) != 0) ? SSCR1_SPH : 0)
+                        | (((spi->mode & SPI_CPOL) != 0) ? SSCR1_SPO : 0);
 
         /* NOTE:  PXA25x_SSP _could_ use external clocking ... */
         if (drv_data->ssp_type != PXA25x_SSP)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 270e6211c2e3..6307428d2c94 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -366,7 +366,6 @@ spi_alloc_master(struct device *dev, unsigned size)
 
         class_device_initialize(&master->cdev);
         master->cdev.class = &spi_master_class;
-        kobj_set_kset_s(&master->cdev, spi_master_class.subsys);
         master->cdev.dev = get_device(dev);
         spi_master_set_devdata(master, &master[1]);
 
@@ -466,14 +465,20 @@ EXPORT_SYMBOL_GPL(spi_unregister_master);
  */
 struct spi_master *spi_busnum_to_master(u16 bus_num)
 {
-        char                    name[9];
-        struct kobject          *bus;
-
-        snprintf(name, sizeof name, "spi%u", bus_num);
-        bus = kset_find_obj(&spi_master_class.subsys.kset, name);
-        if (bus)
-                return container_of(bus, struct spi_master, cdev.kobj);
-        return NULL;
+        struct class_device     *cdev;
+        struct spi_master       *master = NULL;
+        struct spi_master       *m;
+
+        down(&spi_master_class.sem);
+        list_for_each_entry(cdev, &spi_master_class.children, node) {
+                m = container_of(cdev, struct spi_master, cdev);
+                if (m->bus_num == bus_num) {
+                        master = spi_master_get(m);
+                        break;
+                }
+        }
+        up(&spi_master_class.sem);
+        return master;
 }
 EXPORT_SYMBOL_GPL(spi_busnum_to_master);
 
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 8ca08713528e..651379c51ae6 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -10,9 +10,6 @@
  *
 */
 
-
-//#define DEBUG
-
 #include <linux/init.h>
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
@@ -44,6 +41,9 @@ struct s3c24xx_spi {
         int                      len;
         int                      count;
 
+        int                     (*set_cs)(struct s3c2410_spi_info *spi,
+                                          int cs, int pol);
+
         /* data buffers */
         const unsigned char     *tx;
         unsigned char           *rx;
@@ -64,6 +64,11 @@ static inline struct s3c24xx_spi *to_hw(struct spi_device *sdev)
         return spi_master_get_devdata(sdev->master);
 }
 
+static void s3c24xx_spi_gpiocs(struct s3c2410_spi_info *spi, int cs, int pol)
+{
+        s3c2410_gpio_setpin(spi->pin_cs, pol);
+}
+
 static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
 {
         struct s3c24xx_spi *hw = to_hw(spi);
@@ -72,10 +77,7 @@ static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
 
         switch (value) {
         case BITBANG_CS_INACTIVE:
-                if (hw->pdata->set_cs)
-                        hw->pdata->set_cs(hw->pdata, value, cspol);
-                else
-                        s3c2410_gpio_setpin(hw->pdata->pin_cs, cspol ^ 1);
+                hw->pdata->set_cs(hw->pdata, spi->chip_select, cspol^1);
                 break;
 
         case BITBANG_CS_ACTIVE:
@@ -96,14 +98,9 @@ static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
                 /* write new configration */
 
                 writeb(spcon, hw->regs + S3C2410_SPCON);
-
-                if (hw->pdata->set_cs)
-                        hw->pdata->set_cs(hw->pdata, value, cspol);
-                else
-                        s3c2410_gpio_setpin(hw->pdata->pin_cs, cspol);
+                hw->pdata->set_cs(hw->pdata, spi->chip_select, cspol);
 
                 break;
-
         }
 }
 
@@ -330,9 +327,12 @@ static int s3c24xx_spi_probe(struct platform_device *pdev)
         /* setup any gpio we can */
 
         if (!hw->pdata->set_cs) {
+                hw->set_cs = s3c24xx_spi_gpiocs;
+
                 s3c2410_gpio_setpin(hw->pdata->pin_cs, 1);
                 s3c2410_gpio_cfgpin(hw->pdata->pin_cs, S3C2410_GPIO_OUTPUT);
-        }
+        } else
+                hw->set_cs = hw->pdata->set_cs;
 
         /* register our spi controller */
 
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index ea3636d96e1b..c6c9e72e5fd9 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -56,11 +56,6 @@ static unsigned int hid_mousepoll_interval;
 module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
 MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
 
-static int usbhid_pb_fnmode = 1;
-module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644);
-MODULE_PARM_DESC(pb_fnmode,
-                "Mode of fn key on PowerBooks (0 = disabled, 1 = fkeyslast, 2 = fkeysfirst)");
-
 /*
  * Input submission and I/O error handler.
  */
@@ -582,7 +577,6 @@ void usbhid_init_reports(struct hid_device *hid)
 }
 
 #define USB_VENDOR_ID_GTCO              0x078c
-#define USB_VENDOR_ID_GTCO_IPANEL_1     0x08ca
 #define USB_VENDOR_ID_GTCO_IPANEL_2     0x5543
 #define USB_DEVICE_ID_GTCO_90           0x0090
 #define USB_DEVICE_ID_GTCO_100          0x0100
@@ -629,7 +623,6 @@ void usbhid_init_reports(struct hid_device *hid)
 #define USB_DEVICE_ID_GTCO_1004         0x1004
 #define USB_DEVICE_ID_GTCO_1005         0x1005
 #define USB_DEVICE_ID_GTCO_1006         0x1006
-#define USB_DEVICE_ID_GTCO_10           0x0010
 #define USB_DEVICE_ID_GTCO_8            0x0008
 #define USB_DEVICE_ID_GTCO_d            0x000d
 
@@ -883,7 +876,6 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1004, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1005, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1006, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_GTCO_IPANEL_1, USB_DEVICE_ID_GTCO_10, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_GTCO_IPANEL_2, USB_DEVICE_ID_GTCO_8, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_GTCO_IPANEL_2, USB_DEVICE_ID_GTCO_d, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_IMATION, USB_DEVICE_ID_DISC_STAKKA, HID_QUIRK_IGNORE },
@@ -1249,10 +1241,6 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
         hid->hiddev_hid_event = hiddev_hid_event;
         hid->hiddev_report_event = hiddev_report_event;
 #endif
-#ifdef CONFIG_USB_HIDINPUT_POWERBOOK
-        hid->pb_fnmode = usbhid_pb_fnmode;
-#endif
-
         return hid;
 
 fail:
diff --git a/drivers/usb/net/rtl8150.c b/drivers/usb/net/rtl8150.c
index e0eecda78ec1..670262a38a0f 100644
--- a/drivers/usb/net/rtl8150.c
+++ b/drivers/usb/net/rtl8150.c
@@ -284,7 +284,8 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
         u8 data[3], tmp;
 
         data[0] = phy;
-        *(data + 1) = cpu_to_le16p(&reg);
+        data[1] = reg & 0xff;
+        data[2] = (reg >> 8) & 0xff;
         tmp = indx | PHY_WRITE | PHY_GO;
         i = 0;
 
diff --git a/drivers/usb/serial/funsoft.c b/drivers/usb/serial/funsoft.c
index 31501c9361b9..2bebd63d5ed1 100644
--- a/drivers/usb/serial/funsoft.c
+++ b/drivers/usb/serial/funsoft.c
@@ -27,7 +27,7 @@ MODULE_DEVICE_TABLE(usb, id_table);
 static int funsoft_ioctl(struct usb_serial_port *port, struct file *file,
                          unsigned int cmd, unsigned long arg)
 {
-        struct termios t;
+        struct ktermios t;
 
         dbg("%s - port %d, cmd 0x%04x", __FUNCTION__, port->number, cmd);
 
diff --git a/fs/9p/error.c b/fs/9p/error.c
index ae91555c1558..0d7fa4e08812 100644
--- a/fs/9p/error.c
+++ b/fs/9p/error.c
@@ -83,6 +83,7 @@ int v9fs_errstr2errno(char *errstr, int len)
 
         if (errno == 0) {
                 /* TODO: if error isn't found, add it dynamically */
+                errstr[len] = 0;
                 printk(KERN_ERR "%s: errstr :%s: not found\n", __FUNCTION__,
                        errstr);
                 errno = 1;
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 27507201f9e7..a9b6301a04fc 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -25,6 +25,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/idr.h>
+#include <asm/semaphore.h>
 
 #include "debug.h"
 #include "v9fs.h"
@@ -84,6 +85,7 @@ struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *v9ses, int fid)
         new->iounit = 0;
         new->rdir_pos = 0;
         new->rdir_fcall = NULL;
+        init_MUTEX(&new->lock);
         INIT_LIST_HEAD(&new->list);
 
         return new;
@@ -102,11 +104,11 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
 }
 
 /**
- * v9fs_fid_lookup - retrieve the right fid from a  particular dentry
+ * v9fs_fid_lookup - return a locked fid from a dentry
  * @dentry: dentry to look for fid in
- * @type: intent of lookup (operation or traversal)
  *
- * find a fid in the dentry
+ * find a fid in the dentry, obtain its semaphore and return a reference to it.
+ * code calling lookup is responsible for releasing lock
  *
  * TODO: only match fids that have the same uid as current user
  *
@@ -124,7 +126,68 @@ struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry)
 
         if (!return_fid) {
                 dprintk(DEBUG_ERROR, "Couldn't find a fid in dentry\n");
+                return_fid = ERR_PTR(-EBADF);
         }
 
+        if(down_interruptible(&return_fid->lock))
+                return ERR_PTR(-EINTR);
+
         return return_fid;
 }
+
+/**
+ * v9fs_fid_clone - lookup the fid for a dentry, clone a private copy and release it
+ * @dentry: dentry to look for fid in
+ *
+ * find a fid in the dentry and then clone to a new private fid
+ *
+ * TODO: only match fids that have the same uid as current user
+ *
+ */
+
+struct v9fs_fid *v9fs_fid_clone(struct dentry *dentry)
+{
+        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
+        struct v9fs_fid *base_fid, *new_fid = ERR_PTR(-EBADF);
+        struct v9fs_fcall *fcall = NULL;
+        int fid, err;
+
+        base_fid = v9fs_fid_lookup(dentry);
+
+        if(IS_ERR(base_fid))
+                return base_fid;
+
+        if(base_fid) {  /* clone fid */
+                fid = v9fs_get_idpool(&v9ses->fidpool);
+                if (fid < 0) {
+                        eprintk(KERN_WARNING, "newfid fails!\n");
+                        new_fid = ERR_PTR(-ENOSPC);
+                        goto Release_Fid;
+                }
+
+                err = v9fs_t_walk(v9ses, base_fid->fid, fid, NULL, &fcall);
+                if (err < 0) {
+                        dprintk(DEBUG_ERROR, "clone walk didn't work\n");
+                        v9fs_put_idpool(fid, &v9ses->fidpool);
+                        new_fid = ERR_PTR(err);
+                        goto Free_Fcall;
+                }
+                new_fid = v9fs_fid_create(v9ses, fid);
+                if (new_fid == NULL) {
+                        dprintk(DEBUG_ERROR, "out of memory\n");
+                        new_fid = ERR_PTR(-ENOMEM);
+                }
+Free_Fcall:
+                kfree(fcall);
+        }
+
+Release_Fid:
+        up(&base_fid->lock);
+        return new_fid;
+}
+
+void v9fs_fid_clunk(struct v9fs_session_info *v9ses, struct v9fs_fid *fid)
+{
+        v9fs_t_clunk(v9ses, fid->fid);
+        v9fs_fid_destroy(fid);
+}
diff --git a/fs/9p/fid.h b/fs/9p/fid.h
index aa974d6875c3..48fc170c26c8 100644
--- a/fs/9p/fid.h
+++ b/fs/9p/fid.h
@@ -30,6 +30,8 @@ struct v9fs_fid {
         struct list_head list;   /* list of fids associated with a dentry */
         struct list_head active; /* XXX - debug */
 
+        struct semaphore lock;
+
         u32 fid;
         unsigned char fidopen;    /* set when fid is opened */
         unsigned char fidclunked; /* set when fid has already been clunked */
@@ -55,3 +57,6 @@ struct v9fs_fid *v9fs_fid_get_created(struct dentry *);
 void v9fs_fid_destroy(struct v9fs_fid *fid);
 struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *, int fid);
 int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry);
+struct v9fs_fid *v9fs_fid_clone(struct dentry *dentry);
+void v9fs_fid_clunk(struct v9fs_session_info *v9ses, struct v9fs_fid *fid);
+
diff --git a/fs/9p/mux.c b/fs/9p/mux.c
index 944273c3dbff..147ceef8e537 100644
--- a/fs/9p/mux.c
+++ b/fs/9p/mux.c
@@ -132,8 +132,10 @@ int v9fs_mux_global_init(void)
                 v9fs_mux_poll_tasks[i].task = NULL;
 
         v9fs_mux_wq = create_workqueue("v9fs");
-        if (!v9fs_mux_wq)
+        if (!v9fs_mux_wq) {
+                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
                 return -ENOMEM;
+        }
 
         return 0;
 }
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 0b96fae8b479..d9b561ba5e58 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -457,14 +457,19 @@ static int __init init_v9fs(void)
 
         v9fs_error_init();
 
-        printk(KERN_INFO "Installing v9fs 9P2000 file system support\n");
+        printk(KERN_INFO "Installing v9fs 9p2000 file system support\n");
 
         ret = v9fs_mux_global_init();
-        if (!ret)
+        if (ret) {
+                printk(KERN_WARNING "v9fs: starting mux failed\n");
                 return ret;
+        }
         ret = register_filesystem(&v9fs_fs_type);
-        if (!ret)
+        if (ret) {
+                printk(KERN_WARNING "v9fs: registering file system failed\n");
                 v9fs_mux_global_exit();
+        }
+
         return ret;
 }
 
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index e86a07151280..9f17b0cacdd0 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -55,53 +55,22 @@ int v9fs_file_open(struct inode *inode, struct file *file)
         struct v9fs_fid *vfid;
         struct v9fs_fcall *fcall = NULL;
         int omode;
-        int fid = V9FS_NOFID;
         int err;
 
         dprintk(DEBUG_VFS, "inode: %p file: %p \n", inode, file);
 
-        vfid = v9fs_fid_lookup(file->f_path.dentry);
-        if (!vfid) {
-                dprintk(DEBUG_ERROR, "Couldn't resolve fid from dentry\n");
-                return -EBADF;
-        }
-
-        fid = v9fs_get_idpool(&v9ses->fidpool);
-        if (fid < 0) {
-                eprintk(KERN_WARNING, "newfid fails!\n");
-                return -ENOSPC;
-        }
+        vfid = v9fs_fid_clone(file->f_path.dentry);
+        if (IS_ERR(vfid))
+                return PTR_ERR(vfid);
 
-        err = v9fs_t_walk(v9ses, vfid->fid, fid, NULL, &fcall);
-        if (err < 0) {
-                dprintk(DEBUG_ERROR, "rewalk didn't work\n");
-                if (fcall && fcall->id == RWALK)
-                        goto clunk_fid;
-                else {
-                        v9fs_put_idpool(fid, &v9ses->fidpool);
-                        goto free_fcall;
-                }
-        }
-        kfree(fcall);
-
-        /* TODO: do special things for O_EXCL, O_NOFOLLOW, O_SYNC */
-        /* translate open mode appropriately */
         omode = v9fs_uflags2omode(file->f_flags);
-        err = v9fs_t_open(v9ses, fid, omode, &fcall);
+        err = v9fs_t_open(v9ses, vfid->fid, omode, &fcall);
         if (err < 0) {
                 PRINT_FCALL_ERROR("open failed", fcall);
-                goto clunk_fid;
-        }
-
-        vfid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
-        if (vfid == NULL) {
-                dprintk(DEBUG_ERROR, "out of memory\n");
-                err = -ENOMEM;
-                goto clunk_fid;
+                goto Clunk_Fid;
         }
 
         file->private_data = vfid;
-        vfid->fid = fid;
         vfid->fidopen = 1;
         vfid->fidclunked = 0;
         vfid->iounit = fcall->params.ropen.iounit;
@@ -112,10 +81,8 @@ int v9fs_file_open(struct inode *inode, struct file *file)
 
         return 0;
 
-clunk_fid:
-        v9fs_t_clunk(v9ses, fid);
-
-free_fcall:
+Clunk_Fid:
+        v9fs_fid_clunk(v9ses, vfid);
         kfree(fcall);
 
         return err;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 18f26cdfd882..9109ba1d6969 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -416,12 +416,8 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         sb = file_inode->i_sb;
         v9ses = v9fs_inode2v9ses(file_inode);
         v9fid = v9fs_fid_lookup(file);
-
-        if (!v9fid) {
-                dprintk(DEBUG_ERROR,
-                        "no v9fs_fid\n");
-                return -EBADF;
-        }
+        if(IS_ERR(v9fid))
+                return PTR_ERR(v9fid);
 
         fid = v9fid->fid;
         if (fid < 0) {
@@ -433,11 +429,13 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         result = v9fs_t_remove(v9ses, fid, &fcall);
         if (result < 0) {
                 PRINT_FCALL_ERROR("remove fails", fcall);
+                goto Error;
         }
 
         v9fs_put_idpool(fid, &v9ses->fidpool);
         v9fs_fid_destroy(v9fid);
 
+Error:
         kfree(fcall);
         return result;
 }
@@ -473,9 +471,13 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
         inode = NULL;
         vfid = NULL;
         v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
-        perm = unixmode2p9mode(v9ses, mode);
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
 
+        perm = unixmode2p9mode(v9ses, mode);
         if (nd && nd->flags & LOOKUP_OPEN)
                 flags = nd->intent.open.flags - 1;
         else
@@ -485,9 +487,10 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                 perm, v9fs_uflags2omode(flags), NULL, &fid, &qid, &iounit);
 
         if (err)
-                goto error;
+                goto clunk_dfid;
 
         vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
+        v9fs_fid_clunk(v9ses, dfid);
         if (IS_ERR(vfid)) {
                 err = PTR_ERR(vfid);
                 vfid = NULL;
@@ -525,6 +528,9 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
 
         return 0;
 
+clunk_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
+
 error:
         if (vfid)
                 v9fs_fid_destroy(vfid);
@@ -551,7 +557,12 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         inode = NULL;
         vfid = NULL;
         v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
+
         perm = unixmode2p9mode(v9ses, mode | S_IFDIR);
 
         err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
@@ -559,37 +570,36 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
         if (err) {
                 dprintk(DEBUG_ERROR, "create error %d\n", err);
-                goto error;
-        }
-
-        err = v9fs_t_clunk(v9ses, fid);
-        if (err) {
-                dprintk(DEBUG_ERROR, "clunk error %d\n", err);
-                goto error;
+                goto clean_up_dfid;
         }
 
         vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
         if (IS_ERR(vfid)) {
                 err = PTR_ERR(vfid);
                 vfid = NULL;
-                goto error;
+                goto clean_up_dfid;
         }
 
+        v9fs_fid_clunk(v9ses, dfid);
         inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 inode = NULL;
-                goto error;
+                goto clean_up_fids;
         }
 
         dentry->d_op = &v9fs_dentry_operations;
         d_instantiate(dentry, inode);
         return 0;
 
-error:
+clean_up_fids:
         if (vfid)
                 v9fs_fid_destroy(vfid);
 
+clean_up_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
+
+error:
         return err;
 }
 
@@ -622,28 +632,23 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
         dentry->d_op = &v9fs_dentry_operations;
         dirfid = v9fs_fid_lookup(dentry->d_parent);
 
-        if (!dirfid) {
-                dprintk(DEBUG_ERROR, "no dirfid\n");
-                return ERR_PTR(-EINVAL);
-        }
+        if(IS_ERR(dirfid))
+                return ERR_PTR(PTR_ERR(dirfid));
 
         dirfidnum = dirfid->fid;
 
-        if (dirfidnum < 0) {
-                dprintk(DEBUG_ERROR, "no dirfid for inode %p, #%lu\n",
-                        dir, dir->i_ino);
-                return ERR_PTR(-EBADF);
-        }
-
         newfid = v9fs_get_idpool(&v9ses->fidpool);
         if (newfid < 0) {
                 eprintk(KERN_WARNING, "newfid fails!\n");
-                return ERR_PTR(-ENOSPC);
+                result = -ENOSPC;
+                goto Release_Dirfid;
         }
 
         result = v9fs_t_walk(v9ses, dirfidnum, newfid,
                 (char *)dentry->d_name.name, &fcall);
 
+        up(&dirfid->lock);
+
         if (result < 0) {
                 if (fcall && fcall->id == RWALK)
                         v9fs_t_clunk(v9ses, newfid);
@@ -701,8 +706,12 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
         return NULL;
 
-      FreeFcall:
+Release_Dirfid:
+        up(&dirfid->lock);
+
+FreeFcall:
         kfree(fcall);
+
         return ERR_PTR(result);
 }
 
@@ -746,10 +755,8 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct inode *old_inode = old_dentry->d_inode;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(old_inode);
         struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry);
-        struct v9fs_fid *olddirfid =
-            v9fs_fid_lookup(old_dentry->d_parent);
-        struct v9fs_fid *newdirfid =
-            v9fs_fid_lookup(new_dentry->d_parent);
+        struct v9fs_fid *olddirfid;
+        struct v9fs_fid *newdirfid;
         struct v9fs_wstat wstat;
         struct v9fs_fcall *fcall = NULL;
         int fid = -1;
@@ -759,16 +766,26 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         dprintk(DEBUG_VFS, "\n");
 
-        if ((!oldfid) || (!olddirfid) || (!newdirfid)) {
-                dprintk(DEBUG_ERROR, "problem with arguments\n");
-                return -EBADF;
+        if(IS_ERR(oldfid))
+                return PTR_ERR(oldfid);
+
+        olddirfid = v9fs_fid_clone(old_dentry->d_parent);
+        if(IS_ERR(olddirfid)) {
+                retval = PTR_ERR(olddirfid);
+                goto Release_lock;
+        }
+
+        newdirfid = v9fs_fid_clone(new_dentry->d_parent);
+        if(IS_ERR(newdirfid)) {
+                retval = PTR_ERR(newdirfid);
+                goto Clunk_olddir;
         }
 
         /* 9P can only handle file rename in the same directory */
         if (memcmp(&olddirfid->qid, &newdirfid->qid, sizeof(newdirfid->qid))) {
                 dprintk(DEBUG_ERROR, "old dir and new dir are different\n");
-                retval = -EPERM;
-                goto FreeFcallnBail;
+                retval = -EXDEV;
+                goto Clunk_newdir;
         }
 
         fid = oldfid->fid;
@@ -779,7 +796,7 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 dprintk(DEBUG_ERROR, "no fid for old file #%lu\n",
                         old_inode->i_ino);
                 retval = -EBADF;
-                goto FreeFcallnBail;
+                goto Clunk_newdir;
         }
 
         v9fs_blank_wstat(&wstat);
@@ -788,11 +805,20 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         retval = v9fs_t_wstat(v9ses, fid, &wstat, &fcall);
 
-      FreeFcallnBail:
         if (retval < 0)
                 PRINT_FCALL_ERROR("wstat error", fcall);
 
         kfree(fcall);
+
+Clunk_newdir:
+        v9fs_fid_clunk(v9ses, newdirfid);
+
+Clunk_olddir:
+        v9fs_fid_clunk(v9ses, olddirfid);
+
+Release_lock:
+        up(&oldfid->lock);
+
         return retval;
 }
 
@@ -810,15 +836,12 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 {
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
         int err = -EPERM;
 
         dprintk(DEBUG_VFS, "dentry: %p\n", dentry);
-        if (!fid) {
-                dprintk(DEBUG_ERROR,
-                        "couldn't find fid associated with dentry\n");
-                return -EBADF;
-        }
+        if(IS_ERR(fid))
+                return PTR_ERR(fid);
 
         err = v9fs_t_stat(v9ses, fid->fid, &fcall);
 
@@ -831,6 +854,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
         }
 
         kfree(fcall);
+        v9fs_fid_clunk(v9ses, fid);
         return err;
 }
 
@@ -844,18 +868,14 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
 {
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_wstat wstat;
         int res = -EPERM;
 
         dprintk(DEBUG_VFS, "\n");
-
-        if (!fid) {
-                dprintk(DEBUG_ERROR,
-                        "Couldn't find fid associated with dentry\n");
-                return -EBADF;
-        }
+        if(IS_ERR(fid))
+                return PTR_ERR(fid);
 
         v9fs_blank_wstat(&wstat);
         if (iattr->ia_valid & ATTR_MODE)
@@ -887,6 +907,7 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
         if (res >= 0)
                 res = inode_setattr(dentry->d_inode, iattr);
 
+        v9fs_fid_clunk(v9ses, fid);
         return res;
 }
 
@@ -987,18 +1008,15 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
 
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
 
-        if (!fid) {
-                dprintk(DEBUG_ERROR, "could not resolve fid from dentry\n");
-                retval = -EBADF;
-                goto FreeFcall;
-        }
+        if(IS_ERR(fid))
+                return PTR_ERR(fid);
 
         if (!v9ses->extended) {
                 retval = -EBADF;
                 dprintk(DEBUG_ERROR, "not extended\n");
-                goto FreeFcall;
+                goto ClunkFid;
         }
 
         dprintk(DEBUG_VFS, " %s\n", dentry->d_name.name);
@@ -1009,8 +1027,10 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
                 goto FreeFcall;
         }
 
-        if (!fcall)
-                return -EIO;
+        if (!fcall) {
+                retval = -EIO;
+                goto ClunkFid;
+        }
 
         if (!(fcall->params.rstat.stat.mode & V9FS_DMSYMLINK)) {
                 retval = -EINVAL;
@@ -1028,9 +1048,12 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
                 fcall->params.rstat.stat.extension.str, buffer);
         retval = buflen;
 
-      FreeFcall:
+FreeFcall:
         kfree(fcall);
 
+ClunkFid:
+        v9fs_fid_clunk(v9ses, fid);
+
         return retval;
 }
 
@@ -1123,52 +1146,58 @@ static int v9fs_vfs_mkspecial(struct inode *dir, struct dentry *dentry,
         int err;
         u32 fid, perm;
         struct v9fs_session_info *v9ses;
-        struct v9fs_fid *dfid, *vfid;
-        struct inode *inode;
+        struct v9fs_fid *dfid, *vfid = NULL;
+        struct inode *inode = NULL;
 
-        inode = NULL;
-        vfid = NULL;
         v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
-        perm = unixmode2p9mode(v9ses, mode);
-
         if (!v9ses->extended) {
                 dprintk(DEBUG_ERROR, "not extended\n");
                 return -EPERM;
         }
 
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
+
+        perm = unixmode2p9mode(v9ses, mode);
+
         err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
                 perm, V9FS_OREAD, (char *) extension, &fid, NULL, NULL);
 
         if (err)
-                goto error;
+                goto clunk_dfid;
 
         err = v9fs_t_clunk(v9ses, fid);
         if (err)
-                goto error;
+                goto clunk_dfid;
 
         vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
         if (IS_ERR(vfid)) {
                 err = PTR_ERR(vfid);
                 vfid = NULL;
-                goto error;
+                goto clunk_dfid;
         }
 
         inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 inode = NULL;
-                goto error;
+                goto free_vfid;
         }
 
         dentry->d_op = &v9fs_dentry_operations;
         d_instantiate(dentry, inode);
         return 0;
 
-error:
-        if (vfid)
-                v9fs_fid_destroy(vfid);
+free_vfid:
+        v9fs_fid_destroy(vfid);
+
+clunk_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
 
+error:
         return err;
 
 }
@@ -1209,26 +1238,29 @@ v9fs_vfs_link(struct dentry *old_dentry, struct inode *dir,
               struct dentry *dentry)
 {
         int retval;
+        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
         struct v9fs_fid *oldfid;
         char *name;
 
         dprintk(DEBUG_VFS, " %lu,%s,%s\n", dir->i_ino, dentry->d_name.name,
                 old_dentry->d_name.name);
 
-        oldfid = v9fs_fid_lookup(old_dentry);
-        if (!oldfid) {
-                dprintk(DEBUG_ERROR, "can't find oldfid\n");
-                return -EPERM;
-        }
+        oldfid = v9fs_fid_clone(old_dentry);
+        if(IS_ERR(oldfid))
+                return PTR_ERR(oldfid);
 
         name = __getname();
-        if (unlikely(!name))
-                return -ENOMEM;
+        if (unlikely(!name)) {
+                retval = -ENOMEM;
+                goto clunk_fid;
+        }
 
         sprintf(name, "%d\n", oldfid->fid);
         retval = v9fs_vfs_mkspecial(dir, dentry, V9FS_DMLINK, name);
         __putname(name);
 
+clunk_fid:
+        v9fs_fid_clunk(v9ses, oldfid);
         return retval;
 }
 
diff --git a/fs/aio.c b/fs/aio.c
index ee20fc4240e0..55991e4132a7 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -298,17 +298,23 @@ static void wait_for_all_aios(struct kioctx *ctx)
         struct task_struct *tsk = current;
         DECLARE_WAITQUEUE(wait, tsk);
 
+        spin_lock_irq(&ctx->ctx_lock);
         if (!ctx->reqs_active)
-                return;
+                goto out;
 
         add_wait_queue(&ctx->wait, &wait);
         set_task_state(tsk, TASK_UNINTERRUPTIBLE);
         while (ctx->reqs_active) {
+                spin_unlock_irq(&ctx->ctx_lock);
                 schedule();
                 set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+                spin_lock_irq(&ctx->ctx_lock);
         }
         __set_task_state(tsk, TASK_RUNNING);
         remove_wait_queue(&ctx->wait, &wait);
+
+out:
+        spin_unlock_irq(&ctx->ctx_lock);
 }
 
 /* wait_on_sync_kiocb:
@@ -424,7 +430,6 @@ static struct kiocb fastcall *__aio_get_req(struct kioctx *ctx)
         ring = kmap_atomic(ctx->ring_info.ring_pages[0], KM_USER0);
         if (ctx->reqs_active < aio_ring_avail(&ctx->ring_info, ring)) {
                 list_add(&req->ki_list, &ctx->active_reqs);
-                get_ioctx(ctx);
                 ctx->reqs_active++;
                 okay = 1;
         }
@@ -536,8 +541,6 @@ int fastcall aio_put_req(struct kiocb *req)
         spin_lock_irq(&ctx->ctx_lock);
         ret = __aio_put_req(ctx, req);
         spin_unlock_irq(&ctx->ctx_lock);
-        if (ret)
-                put_ioctx(ctx);
         return ret;
 }
 
@@ -779,8 +782,7 @@ static int __aio_run_iocbs(struct kioctx *ctx)
                  */
                 iocb->ki_users++;       /* grab extra reference */
                 aio_run_iocb(iocb);
-                if (__aio_put_req(ctx, iocb))  /* drop extra ref */
-                        put_ioctx(ctx);
+                __aio_put_req(ctx, iocb);
         }
         if (!list_empty(&ctx->run_list))
                 return 1;
@@ -997,14 +999,10 @@ put_rq:
         /* everything turned out well, dispose of the aiocb. */
         ret = __aio_put_req(ctx, iocb);
 
-        spin_unlock_irqrestore(&ctx->ctx_lock, flags);
-
         if (waitqueue_active(&ctx->wait))
                 wake_up(&ctx->wait);
 
-        if (ret)
-                put_ioctx(ctx);
-
+        spin_unlock_irqrestore(&ctx->ctx_lock, flags);
         return ret;
 }
 
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 7cb28720f90e..669dbe5b0317 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -682,6 +682,15 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                         retval = PTR_ERR(interpreter);
                         if (IS_ERR(interpreter))
                                 goto out_free_interp;
+
+                        /*
+                         * If the binary is not readable then enforce
+                         * mm->dumpable = 0 regardless of the interpreter's
+                         * permissions.
+                         */
+                        if (file_permission(interpreter, MAY_READ) < 0)
+                                bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
+
                         retval = kernel_read(interpreter, 0, bprm->buf,
                                              BINPRM_BUF_SIZE);
                         if (retval != BINPRM_BUF_SIZE) {
@@ -1178,6 +1187,10 @@ static int dump_seek(struct file *file, loff_t off)
  */
 static int maydump(struct vm_area_struct *vma)
 {
+        /* The vma can be set up to tell us the answer directly.  */
+        if (vma->vm_flags & VM_ALWAYSDUMP)
+                return 1;
+
         /* Do not dump I/O mapped devices or special mappings */
         if (vma->vm_flags & (VM_IO | VM_RESERVED))
                 return 0;
@@ -1424,6 +1437,32 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
         return sz;
 }
 
+static struct vm_area_struct *first_vma(struct task_struct *tsk,
+                                        struct vm_area_struct *gate_vma)
+{
+        struct vm_area_struct *ret = tsk->mm->mmap;
+
+        if (ret)
+                return ret;
+        return gate_vma;
+}
+/*
+ * Helper function for iterating across a vma list.  It ensures that the caller
+ * will visit `gate_vma' prior to terminating the search.
+ */
+static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
+                                        struct vm_area_struct *gate_vma)
+{
+        struct vm_area_struct *ret;
+
+        ret = this_vma->vm_next;
+        if (ret)
+                return ret;
+        if (this_vma == gate_vma)
+                return NULL;
+        return gate_vma;
+}
+
 /*
  * Actual dumper
  *
@@ -1439,7 +1478,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         int segs;
         size_t size = 0;
         int i;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *gate_vma;
         struct elfhdr *elf = NULL;
         loff_t offset = 0, dataoff, foffset;
         unsigned long limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
@@ -1525,6 +1564,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         segs += ELF_CORE_EXTRA_PHDRS;
 #endif
 
+        gate_vma = get_gate_vma(current);
+        if (gate_vma != NULL)
+                segs++;
+
         /* Set up header */
         fill_elf_header(elf, segs + 1); /* including notes section */
 
@@ -1592,7 +1635,8 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
 
         /* Write program headers for segments dump */
-        for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
+        for (vma = first_vma(current, gate_vma); vma != NULL;
+                        vma = next_vma(vma, gate_vma)) {
                 struct elf_phdr phdr;
                 size_t sz;
 
@@ -1641,7 +1685,8 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         /* Align to page */
         DUMP_SEEK(dataoff - foffset);
 
-        for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
+        for (vma = first_vma(current, gate_vma); vma != NULL;
+                        vma = next_vma(vma, gate_vma)) {
                 unsigned long addr;
 
                 if (!maydump(vma))
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 6e6d4568d548..a4d933a51208 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -234,6 +234,14 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
                                 goto error;
                         }
 
+                        /*
+                         * If the binary is not readable then enforce
+                         * mm->dumpable = 0 regardless of the interpreter's
+                         * permissions.
+                         */
+                        if (file_permission(interpreter, MAY_READ) < 0)
+                                bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
+
                         retval = kernel_read(interpreter, 0, bprm->buf,
                                              BINPRM_BUF_SIZE);
                         if (retval < 0)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 8b18e43b82fe..fc7028b685f2 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -129,6 +129,46 @@ blkdev_get_block(struct inode *inode, sector_t iblock,
         return 0;
 }
 
+static int
+blkdev_get_blocks(struct inode *inode, sector_t iblock,
+                struct buffer_head *bh, int create)
+{
+        sector_t end_block = max_block(I_BDEV(inode));
+        unsigned long max_blocks = bh->b_size >> inode->i_blkbits;
+
+        if ((iblock + max_blocks) > end_block) {
+                max_blocks = end_block - iblock;
+                if ((long)max_blocks <= 0) {
+                        if (create)
+                                return -EIO;    /* write fully beyond EOF */
+                        /*
+                         * It is a read which is fully beyond EOF.  We return
+                         * a !buffer_mapped buffer
+                         */
+                        max_blocks = 0;
+                }
+        }
+
+        bh->b_bdev = I_BDEV(inode);
+        bh->b_blocknr = iblock;
+        bh->b_size = max_blocks << inode->i_blkbits;
+        if (max_blocks)
+                set_buffer_mapped(bh);
+        return 0;
+}
+
+static ssize_t
+blkdev_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
+                        loff_t offset, unsigned long nr_segs)
+{
+        struct file *file = iocb->ki_filp;
+        struct inode *inode = file->f_mapping->host;
+
+        return blockdev_direct_IO_no_locking(rw, iocb, inode, I_BDEV(inode),
+                                iov, offset, nr_segs, blkdev_get_blocks, NULL);
+}
+
+#if 0
 static int blk_end_aio(struct bio *bio, unsigned int bytes_done, int error)
 {
         struct kiocb *iocb = bio->bi_private;
@@ -146,7 +186,7 @@ static int blk_end_aio(struct bio *bio, unsigned int bytes_done, int error)
                 iocb->ki_nbytes = -EIO;
 
         if (atomic_dec_and_test(bio_count)) {
-                if (iocb->ki_nbytes < 0)
+                if ((long)iocb->ki_nbytes < 0)
                         aio_complete(iocb, iocb->ki_nbytes, 0);
                 else
                         aio_complete(iocb, iocb->ki_left, 0);
@@ -190,6 +230,12 @@ static struct page *blk_get_page(unsigned long addr, size_t count, int rw,
         return pvec->page[pvec->idx++];
 }
 
+/* return a page back to pvec array */
+static void blk_unget_page(struct page *page, struct pvec *pvec)
+{
+        pvec->page[--pvec->idx] = page;
+}
+
 static ssize_t
 blkdev_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
                  loff_t pos, unsigned long nr_segs)
@@ -278,6 +324,8 @@ same_bio:
                                 count = min(count, nbytes);
                                 goto same_bio;
                         }
+                } else {
+                        blk_unget_page(page, &pvec);
                 }
 
                 /* bio is ready, submit it */
@@ -315,6 +363,7 @@ backout:
                 return PTR_ERR(page);
         goto completion;
 }
+#endif
 
 static int blkdev_writepage(struct page *page, struct writeback_control *wbc)
 {
diff --git a/fs/buffer.c b/fs/buffer.c
index 3b116078b4c3..1ad674fd348c 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2834,7 +2834,7 @@ int try_to_free_buffers(struct page *page)
         int ret = 0;
 
         BUG_ON(!PageLocked(page));
-        if (PageDirty(page) || PageWriteback(page))
+        if (PageWriteback(page))
                 return 0;
 
         if (mapping == NULL) {          /* can this still happen? */
@@ -2844,6 +2844,23 @@ int try_to_free_buffers(struct page *page)
 
         spin_lock(&mapping->private_lock);
         ret = drop_buffers(page, &buffers_to_free);
+
+        /*
+         * If the filesystem writes its buffers by hand (eg ext3)
+         * then we can have clean buffers against a dirty page.  We
+         * clean the page here; otherwise the VM will never notice
+         * that the filesystem did any IO at all.
+         *
+         * Also, during truncate, discard_buffer will have marked all
+         * the page's buffers clean.  We discover that here and clean
+         * the page also.
+         *
+         * private_lock must be held over this entire operation in order
+         * to synchronise against __set_page_dirty_buffers and prevent the
+         * dirty bit from being lost.
+         */
+        if (ret)
+                cancel_dirty_page(page, PAGE_CACHE_SIZE);
         spin_unlock(&mapping->private_lock);
 out:
         if (buffers_to_free) {
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 3539d6ef9611..d04d2f7448d9 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,7 @@
+Version 1.47
+------------
+Fix oops in list_del during mount caused by unaligned string.
+
 Version 1.46
 ------------
 Support deep tree mounts.  Better support OS/2, Win9x (DOS) time stamps.
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 96abeb738978..6017c465440e 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -143,8 +143,8 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
                 if((ses->serverDomain == NULL) || (ses->serverOS == NULL) ||
                    (ses->serverNOS == NULL)) {
-                        buf += sprintf("\nentry for %s not fully displayed\n\t",
-                                        ses->serverName);
+                        buf += sprintf(buf, "\nentry for %s not fully "
+                                        "displayed\n\t", ses->serverName);
                         
                 } else {
                         length =
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index a243f779b363..8aa66dcf13bd 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -100,5 +100,5 @@ extern ssize_t	cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
 extern int cifs_ioctl (struct inode * inode, struct file * filep,
                        unsigned int command, unsigned long arg);
-#define CIFS_VERSION   "1.46"
+#define CIFS_VERSION   "1.47"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index aedf683f011f..19cc294c7c70 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -71,9 +71,7 @@ sesInfoAlloc(void)
 {
         struct cifsSesInfo *ret_buf;
 
-        ret_buf =
-            (struct cifsSesInfo *) kzalloc(sizeof (struct cifsSesInfo),
-                                           GFP_KERNEL);
+        ret_buf = kzalloc(sizeof (struct cifsSesInfo), GFP_KERNEL);
         if (ret_buf) {
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&sesInfoAllocCount);
@@ -109,9 +107,7 @@ struct cifsTconInfo *
 tconInfoAlloc(void)
 {
         struct cifsTconInfo *ret_buf;
-        ret_buf =
-            (struct cifsTconInfo *) kzalloc(sizeof (struct cifsTconInfo),
-                                            GFP_KERNEL);
+        ret_buf = kzalloc(sizeof (struct cifsTconInfo), GFP_KERNEL);
         if (ret_buf) {
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&tconInfoAllocCount);
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index bbdda99dce61..758464630893 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -182,11 +182,14 @@ static int decode_unicode_ssetup(char ** pbcc_area, int bleft, struct cifsSesInf
         cFYI(1,("bleft %d",bleft));
 
 
-        /* word align, if bytes remaining is not even */
-        if(bleft % 2) {
-                bleft--;
-                data++;
-        }
+        /* SMB header is unaligned, so cifs servers word align start of
+           Unicode strings */
+        data++;
+        bleft--; /* Windows servers do not always double null terminate
+                    their final Unicode string - in which case we
+                    now will not attempt to decode the byte of junk
+                    which follows it */
+                    
         words_left = bleft / 2;
 
         /* save off server operating system */
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index c403b66ec83c..a4b142a6a2c7 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -251,8 +251,19 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                 WARN_ON(inode->i_state & I_WILL_FREE);
 
         if ((wbc->sync_mode != WB_SYNC_ALL) && (inode->i_state & I_LOCK)) {
+                struct address_space *mapping = inode->i_mapping;
+                int ret;
+
                 list_move(&inode->i_list, &inode->i_sb->s_dirty);
-                return 0;
+
+                /*
+                 * Even if we don't actually write the inode itself here,
+                 * we can at least start some of the data writeout..
+                 */
+                spin_unlock(&inode_lock);
+                ret = do_writepages(mapping, wbc);
+                spin_lock(&inode_lock);
+                return ret;
         }
 
         /*
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index 8c58bd453993..1794305f9ed8 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -193,8 +193,12 @@ static int fuse_ctl_get_sb(struct file_system_type *fs_type, int flags,
 
 static void fuse_ctl_kill_sb(struct super_block *sb)
 {
+        struct fuse_conn *fc;
+
         mutex_lock(&fuse_mutex);
         fuse_control_sb = NULL;
+        list_for_each_entry(fc, &fuse_conn_list, entry)
+                fc->ctl_ndents = 0;
         mutex_unlock(&fuse_mutex);
 
         kill_litter_super(sb);
diff --git a/fs/hostfs/hostfs.h b/fs/hostfs/hostfs.h
index cca3fb693f99..70543b17e4c7 100644
--- a/fs/hostfs/hostfs.h
+++ b/fs/hostfs/hostfs.h
@@ -76,7 +76,7 @@ extern int make_symlink(const char *from, const char *to);
 extern int unlink_file(const char *file);
 extern int do_mkdir(const char *file, int mode);
 extern int do_rmdir(const char *file);
-extern int do_mknod(const char *file, int mode, int dev);
+extern int do_mknod(const char *file, int mode, unsigned int major, unsigned int minor);
 extern int link_file(const char *from, const char *to);
 extern int do_readlink(char *file, char *buf, int size);
 extern int rename_file(char *from, char *to);
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 1e6fc3799876..69a376f35a68 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -755,7 +755,7 @@ int hostfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
                 goto out_put;
 
         init_special_inode(inode, mode, dev);
-        err = do_mknod(name, mode, dev);
+        err = do_mknod(name, mode, MAJOR(dev), MINOR(dev));
         if(err)
                 goto out_free;
 
diff --git a/fs/hostfs/hostfs_user.c b/fs/hostfs/hostfs_user.c
index 23b7cee72123..1ed5ea389f15 100644
--- a/fs/hostfs/hostfs_user.c
+++ b/fs/hostfs/hostfs_user.c
@@ -295,11 +295,11 @@ int do_rmdir(const char *file)
         return(0);
 }
 
-int do_mknod(const char *file, int mode, int dev)
+int do_mknod(const char *file, int mode, unsigned int major, unsigned int minor)
 {
         int err;
 
-        err = mknod(file, mode, dev);
+        err = mknod(file, mode, makedev(major, minor));
         if(err) return(-errno);
         return(0);
 }
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 062707745162..f4d45d4d835b 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -176,7 +176,7 @@ reclaimer(void *ptr)
         lock_kernel();
         lockd_up(0); /* note: this cannot fail as lockd is already running */
 
-        dprintk("lockd: reclaiming locks for host %s", host->h_name);
+        dprintk("lockd: reclaiming locks for host %s\n", host->h_name);
 
 restart:
         nsmstate = host->h_nsmstate;
@@ -206,7 +206,7 @@ restart:
 
         host->h_reclaiming = 0;
         up_write(&host->h_rwsem);
-        dprintk("NLM: done reclaiming locks for host %s", host->h_name);
+        dprintk("NLM: done reclaiming locks for host %s\n", host->h_name);
 
         /* Now, wake up all processes that sleep on a blocked lock */
         list_for_each_entry(block, &nlm_blocked, b_list) {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index dee3d6c0f194..d9ba8cb0ee75 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -532,7 +532,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
 
         lock_kernel();
 
-        res = nfs_revalidate_mapping(inode, filp->f_mapping);
+        res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
         if (res < 0) {
                 unlock_kernel();
                 return res;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index fab20d06d936..9e4a2b70995a 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -434,8 +434,9 @@ static int do_vfs_lock(struct file *file, struct file_lock *fl)
                         BUG();
         }
         if (res < 0)
-                printk(KERN_WARNING "%s: VFS is out of sync with lock manager!\n",
-                                __FUNCTION__);
+                dprintk(KERN_WARNING "%s: VFS is out of sync with lock manager"
+                        " - error %d!\n",
+                                __FUNCTION__, res);
         return res;
 }
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 63e470279309..d83498282837 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -665,49 +665,86 @@ int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
         return __nfs_revalidate_inode(server, inode);
 }
 
+static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+        
+        if (mapping->nrpages != 0) {
+                int ret = invalidate_inode_pages2(mapping);
+                if (ret < 0)
+                        return ret;
+        }
+        spin_lock(&inode->i_lock);
+        nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
+        if (S_ISDIR(inode->i_mode)) {
+                memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
+                /* This ensures we revalidate child dentries */
+                nfsi->cache_change_attribute = jiffies;
+        }
+        spin_unlock(&inode->i_lock);
+        nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
+        dfprintk(PAGECACHE, "NFS: (%s/%Ld) data cache invalidated\n",
+                        inode->i_sb->s_id, (long long)NFS_FILEID(inode));
+        return 0;
+}
+
+static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
+{
+        int ret = 0;
+
+        mutex_lock(&inode->i_mutex);
+        if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_DATA) {
+                ret = nfs_sync_mapping(mapping);
+                if (ret == 0)
+                        ret = nfs_invalidate_mapping_nolock(inode, mapping);
+        }
+        mutex_unlock(&inode->i_mutex);
+        return ret;
+}
+
 /**
- * nfs_revalidate_mapping - Revalidate the pagecache
+ * nfs_revalidate_mapping_nolock - Revalidate the pagecache
  * @inode - pointer to host inode
  * @mapping - pointer to mapping
  */
-int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
+int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         int ret = 0;
 
-        if (NFS_STALE(inode))
-                ret = -ESTALE;
         if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                        || nfs_attribute_timeout(inode))
+                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
                 ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-        if (ret < 0)
-                goto out;
+                if (ret < 0)
+                        goto out;
+        }
+        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
+                ret = nfs_invalidate_mapping_nolock(inode, mapping);
+out:
+        return ret;
+}
 
-        if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
-                if (mapping->nrpages != 0) {
-                        if (S_ISREG(inode->i_mode)) {
-                                ret = nfs_sync_mapping(mapping);
-                                if (ret < 0)
-                                        goto out;
-                        }
-                        ret = invalidate_inode_pages2(mapping);
-                        if (ret < 0)
-                                goto out;
-                }
-                spin_lock(&inode->i_lock);
-                nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
-                if (S_ISDIR(inode->i_mode)) {
-                        memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
-                        /* This ensures we revalidate child dentries */
-                        nfsi->cache_change_attribute = jiffies;
-                }
-                spin_unlock(&inode->i_lock);
+/**
+ * nfs_revalidate_mapping - Revalidate the pagecache
+ * @inode - pointer to host inode
+ * @mapping - pointer to mapping
+ *
+ * This version of the function will take the inode->i_mutex and attempt to
+ * flush out all dirty data if it needs to invalidate the page cache.
+ */
+int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+        int ret = 0;
 
-                nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
-                dfprintk(PAGECACHE, "NFS: (%s/%Ld) data cache invalidated\n",
-                                inode->i_sb->s_id,
-                                (long long)NFS_FILEID(inode));
+        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
+                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
+                ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
+                if (ret < 0)
+                        goto out;
         }
+        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
+                ret = nfs_invalidate_mapping(inode, mapping);
 out:
         return ret;
 }
diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c
index 6c686112cc03..525c136c7d8c 100644
--- a/fs/nfs/symlink.c
+++ b/fs/nfs/symlink.c
@@ -50,7 +50,9 @@ static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *inode = dentry->d_inode;
         struct page *page;
-        void *err = ERR_PTR(nfs_revalidate_mapping(inode, inode->i_mapping));
+        void *err;
+
+        err = ERR_PTR(nfs_revalidate_mapping_nolock(inode, inode->i_mapping));
         if (err)
                 goto read_failed;
         page = read_cache_page(&inode->i_data, 0,
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 248dd92e6a56..49c310b84923 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -35,7 +35,6 @@
 #include <linux/lockd/bind.h>
 
 #define NFSDDBG_FACILITY        NFSDDBG_EXPORT
-#define NFSD_PARANOIA 1
 
 typedef struct auth_domain      svc_client;
 typedef struct svc_export       svc_export;
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 277df40f098d..e695660921ec 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -990,15 +990,16 @@ encode_entry(struct readdir_cd *ccd, const char *name,
 }
 
 int
-nfs3svc_encode_entry(struct readdir_cd *cd, const char *name,
-                     int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+nfs3svc_encode_entry(void *cd, const char *name,
+                     int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
         return encode_entry(cd, name, namlen, offset, ino, d_type, 0);
 }
 
 int
-nfs3svc_encode_entry_plus(struct readdir_cd *cd, const char *name,
-                          int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+nfs3svc_encode_entry_plus(void *cd, const char *name,
+                          int namlen, loff_t offset, u64 ino,
+                          unsigned int d_type)
 {
         return encode_entry(cd, name, namlen, offset, ino, d_type, 1);
 }
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index fea46368afb2..18aa9440df14 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1880,9 +1880,10 @@ nfsd4_encode_rdattr_error(__be32 *p, int buflen, __be32 nfserr)
 }
 
 static int
-nfsd4_encode_dirent(struct readdir_cd *ccd, const char *name, int namlen,
-                    loff_t offset, ino_t ino, unsigned int d_type)
+nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
+                    loff_t offset, u64 ino, unsigned int d_type)
 {
+        struct readdir_cd *ccd = ccdv;
         struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
         int buflen;
         __be32 *p = cd->buffer;
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index b06bf9f70efc..c59d6fbb7a6b 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -24,8 +24,6 @@
 #include <linux/nfsd/nfsd.h>
 
 #define NFSDDBG_FACILITY                NFSDDBG_FH
-#define NFSD_PARANOIA 1
-/* #define NFSD_DEBUG_VERBOSE 1 */
 
 
 static int nfsd_nr_verified;
@@ -230,13 +228,12 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                                 error = nfserrno(PTR_ERR(dentry));
                         goto out;
                 }
-#ifdef NFSD_PARANOIA
+
                 if (S_ISDIR(dentry->d_inode->i_mode) &&
                     (dentry->d_flags & DCACHE_DISCONNECTED)) {
                         printk("nfsd: find_fh_dentry returned a DISCONNECTED directory: %s/%s\n",
                                dentry->d_parent->d_name.name, dentry->d_name.name);
                 }
-#endif
 
                 fhp->fh_dentry = dentry;
                 fhp->fh_export = exp;
@@ -267,12 +264,13 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
         /* Finally, check access permissions. */
         error = nfsd_permission(exp, dentry, access);
 
-#ifdef NFSD_PARANOIA_EXTREME
         if (error) {
-                printk("fh_verify: %s/%s permission failure, acc=%x, error=%d\n",
-                       dentry->d_parent->d_name.name, dentry->d_name.name, access, (error >> 24));
+                dprintk("fh_verify: %s/%s permission failure, "
+                        "acc=%x, error=%d\n",
+                        dentry->d_parent->d_name.name,
+                        dentry->d_name.name,
+                        access, ntohl(error));
         }
-#endif
 out:
         if (exp && !IS_ERR(exp))
                 exp_put(exp);
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 0aaccb03bf76..fbf5d51947ea 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -72,7 +72,7 @@ static struct svc_program	nfsd_acl_program = {
         .pg_prog                = NFS_ACL_PROGRAM,
         .pg_nvers               = NFSD_ACL_NRVERS,
         .pg_vers                = nfsd_acl_versions,
-        .pg_name                = "nfsd",
+        .pg_name                = "nfsacl",
         .pg_class               = "nfsd",
         .pg_stats               = &nfsd_acl_svcstats,
         .pg_authenticate        = &svc_set_client,
@@ -118,16 +118,16 @@ int nfsd_vers(int vers, enum vers_op change)
         switch(change) {
         case NFSD_SET:
                 nfsd_versions[vers] = nfsd_version[vers];
-                break;
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
                 if (vers < NFSD_ACL_NRVERS)
-                        nfsd_acl_version[vers] = nfsd_acl_version[vers];
+                        nfsd_acl_versions[vers] = nfsd_acl_version[vers];
 #endif
+                break;
         case NFSD_CLEAR:
                 nfsd_versions[vers] = NULL;
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
                 if (vers < NFSD_ACL_NRVERS)
-                        nfsd_acl_version[vers] = NULL;
+                        nfsd_acl_versions[vers] = NULL;
 #endif
                 break;
         case NFSD_TEST:
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index f5243f943996..6555c50d9006 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -462,9 +462,10 @@ nfssvc_encode_statfsres(struct svc_rqst *rqstp, __be32 *p,
 }
 
 int
-nfssvc_encode_entry(struct readdir_cd *ccd, const char *name,
-                    int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+nfssvc_encode_entry(void *ccdv, const char *name,
+                    int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
+        struct readdir_cd *ccd = ccdv;
         struct nfsd_readdirres *cd = container_of(ccd, struct nfsd_readdirres, common);
         __be32  *p = cd->buffer;
         int     buflen, slen;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7a79c23aa6d4..8283236c6a0f 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -59,7 +59,6 @@
 #include <asm/uaccess.h>
 
 #define NFSDDBG_FACILITY                NFSDDBG_FILEOP
-#define NFSD_PARANOIA
 
 
 /* We must ignore files (but only files) which might have mandatory
@@ -822,7 +821,8 @@ nfsd_read_actor(read_descriptor_t *desc, struct page *page, unsigned long offset
                 rqstp->rq_res.page_len = size;
         } else if (page != pp[-1]) {
                 get_page(page);
-                put_page(*pp);
+                if (*pp)
+                        put_page(*pp);
                 *pp = page;
                 rqstp->rq_resused++;
                 rqstp->rq_res.page_len += size;
@@ -1244,7 +1244,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         __be32          err;
         int             host_err;
         __u32           v_mtime=0, v_atime=0;
-        int             v_mode=0;
 
         err = nfserr_perm;
         if (!flen)
@@ -1281,16 +1280,11 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 goto out;
 
         if (createmode == NFS3_CREATE_EXCLUSIVE) {
-                /* while the verifier would fit in mtime+atime,
-                 * solaris7 gets confused (bugid 4218508) if these have
-                 * the high bit set, so we use the mode as well
+                /* solaris7 gets confused (bugid 4218508) if these have
+                 * the high bit set, so just clear the high bits.
                  */
                 v_mtime = verifier[0]&0x7fffffff;
                 v_atime = verifier[1]&0x7fffffff;
-                v_mode  = S_IFREG
-                        | ((verifier[0]&0x80000000) >> (32-7)) /* u+x */
-                        | ((verifier[1]&0x80000000) >> (32-9)) /* u+r */
-                        ;
         }
         
         if (dchild->d_inode) {
@@ -1318,7 +1312,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 case NFS3_CREATE_EXCLUSIVE:
                         if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
                             && dchild->d_inode->i_atime.tv_sec == v_atime
-                            && dchild->d_inode->i_mode  == v_mode
                             && dchild->d_inode->i_size  == 0 )
                                 break;
                          /* fallthru */
@@ -1340,26 +1333,22 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         }
 
         if (createmode == NFS3_CREATE_EXCLUSIVE) {
-                /* Cram the verifier into atime/mtime/mode */
+                /* Cram the verifier into atime/mtime */
                 iap->ia_valid = ATTR_MTIME|ATTR_ATIME
-                        | ATTR_MTIME_SET|ATTR_ATIME_SET
-                        | ATTR_MODE;
+                        | ATTR_MTIME_SET|ATTR_ATIME_SET;
                 /* XXX someone who knows this better please fix it for nsec */ 
                 iap->ia_mtime.tv_sec = v_mtime;
                 iap->ia_atime.tv_sec = v_atime;
                 iap->ia_mtime.tv_nsec = 0;
                 iap->ia_atime.tv_nsec = 0;
-                iap->ia_mode  = v_mode;
         }
 
         /* Set file attributes.
-         * Mode has already been set but we might need to reset it
-         * for CREATE_EXCLUSIVE
          * Irix appears to send along the gid when it tries to
          * implement setgid directories via NFS. Clear out all that cruft.
          */
  set_attr:
-        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID)) != 0) {
+        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID|ATTR_MODE)) != 0) {
                 __be32 err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
                 if (err2)
                         err = err2;
@@ -1726,7 +1715,7 @@ out:
  */
 __be32
 nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp, 
-             struct readdir_cd *cdp, encode_dent_fn func)
+             struct readdir_cd *cdp, filldir_t func)
 {
         __be32          err;
         int             host_err;
@@ -1751,7 +1740,7 @@ nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp,
 
         do {
                 cdp->err = nfserr_eof; /* will be cleared on successful read */
-                host_err = vfs_readdir(file, (filldir_t) func, cdp);
+                host_err = vfs_readdir(file, func, cdp);
         } while (host_err >=0 && cdp->err == nfs_ok);
         if (host_err)
                 err = nfserrno(host_err);
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index 7b2c8f4f6a6f..629e7abdd840 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -92,10 +92,12 @@ static void ntfs_end_buffer_async_read(struct buffer_head *bh, int uptodate)
                         ofs = 0;
                         if (file_ofs < init_size)
                                 ofs = init_size - file_ofs;
+                        local_irq_save(flags);
                         kaddr = kmap_atomic(page, KM_BIO_SRC_IRQ);
                         memset(kaddr + bh_offset(bh) + ofs, 0,
                                         bh->b_size - ofs);
                         kunmap_atomic(kaddr, KM_BIO_SRC_IRQ);
+                        local_irq_restore(flags);
                         flush_dcache_page(page);
                 }
         } else {
@@ -143,11 +145,13 @@ static void ntfs_end_buffer_async_read(struct buffer_head *bh, int uptodate)
                 recs = PAGE_CACHE_SIZE / rec_size;
                 /* Should have been verified before we got here... */
                 BUG_ON(!recs);
+                local_irq_save(flags);
                 kaddr = kmap_atomic(page, KM_BIO_SRC_IRQ);
                 for (i = 0; i < recs; i++)
                         post_read_mst_fixup((NTFS_RECORD*)(kaddr +
                                         i * rec_size), rec_size);
                 kunmap_atomic(kaddr, KM_BIO_SRC_IRQ);
+                local_irq_restore(flags);
                 flush_dcache_page(page);
                 if (likely(page_uptodate && !PageError(page)))
                         SetPageUptodate(page);
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index c99e9058c198..e61e218f5e0b 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -587,7 +587,7 @@ static inline u64 ocfs2_backup_super_blkno(struct super_block *sb, int index)
 
         if (index >= 0 && index < OCFS2_MAX_BACKUP_SUPERBLOCKS) {
                 offset <<= (2 * index);
-                offset /= sb->s_blocksize;
+                offset >>= sb->s_blocksize_bits;
                 return offset;
         }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 77a57b5799c4..1a979ea3b379 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -371,9 +371,11 @@ static int mounts_open(struct inode *inode, struct file *file)
 
         if (task) {
                 task_lock(task);
-                ns = task->nsproxy->mnt_ns;
-                if (ns)
-                        get_mnt_ns(ns);
+                if (task->nsproxy) {
+                        ns = task->nsproxy->mnt_ns;
+                        if (ns)
+                                get_mnt_ns(ns);
+                }
                 task_unlock(task);
                 put_task_struct(task);
         }
@@ -2326,13 +2328,23 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
 {
         struct dentry *dentry = filp->f_path.dentry;
         struct inode *inode = dentry->d_inode;
-        struct task_struct *leader = get_proc_task(inode);
+        struct task_struct *leader = NULL;
         struct task_struct *task;
         int retval = -ENOENT;
         ino_t ino;
         int tid;
         unsigned long pos = filp->f_pos;  /* avoiding "long long" filp->f_pos */
 
+        task = get_proc_task(inode);
+        if (!task)
+                goto out_no_task;
+        rcu_read_lock();
+        if (pid_alive(task)) {
+                leader = task->group_leader;
+                get_task_struct(leader);
+        }
+        rcu_read_unlock();
+        put_task_struct(task);
         if (!leader)
                 goto out_no_task;
         retval = 0;
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index 99b6f329ba23..5109f1d5e7ff 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -48,6 +48,11 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
         }
 
         mutex_lock(&inode->i_mutex);
+
+        mutex_lock(&(REISERFS_I(inode)->i_mmap));
+        if (REISERFS_I(inode)->i_flags & i_ever_mapped)
+                REISERFS_I(inode)->i_flags &= ~i_pack_on_close_mask;
+
         reiserfs_write_lock(inode->i_sb);
         /* freeing preallocation only involves relogging blocks that
          * are already in the current transaction.  preallocation gets
@@ -100,11 +105,24 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
                 err = reiserfs_truncate_file(inode, 0);
         }
       out:
+        mutex_unlock(&(REISERFS_I(inode)->i_mmap));
         mutex_unlock(&inode->i_mutex);
         reiserfs_write_unlock(inode->i_sb);
         return err;
 }
 
+static int reiserfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        struct inode *inode;
+
+        inode = file->f_path.dentry->d_inode;
+        mutex_lock(&(REISERFS_I(inode)->i_mmap));
+        REISERFS_I(inode)->i_flags |= i_ever_mapped;
+        mutex_unlock(&(REISERFS_I(inode)->i_mmap));
+
+        return generic_file_mmap(file, vma);
+}
+
 static void reiserfs_vfs_truncate_file(struct inode *inode)
 {
         reiserfs_truncate_file(inode, 1);
@@ -1527,7 +1545,7 @@ const struct file_operations reiserfs_file_operations = {
 #ifdef CONFIG_COMPAT
         .compat_ioctl = reiserfs_compat_ioctl,
 #endif
-        .mmap = generic_file_mmap,
+        .mmap = reiserfs_file_mmap,
         .open = generic_file_open,
         .release = reiserfs_file_release,
         .fsync = reiserfs_sync_file,
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index f3d1c4a77979..9fcbfe316977 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1125,6 +1125,7 @@ static void init_inode(struct inode *inode, struct treepath *path)
         REISERFS_I(inode)->i_prealloc_count = 0;
         REISERFS_I(inode)->i_trans_id = 0;
         REISERFS_I(inode)->i_jl = NULL;
+        mutex_init(&(REISERFS_I(inode)->i_mmap));
         reiserfs_init_acl_access(inode);
         reiserfs_init_acl_default(inode);
         reiserfs_init_xattr_rwsem(inode);
@@ -1832,6 +1833,7 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
         REISERFS_I(inode)->i_attrs =
             REISERFS_I(dir)->i_attrs & REISERFS_INHERIT_MASK;
         sd_attrs_to_i_attrs(REISERFS_I(inode)->i_attrs, inode);
+        mutex_init(&(REISERFS_I(inode)->i_mmap));
         reiserfs_init_acl_access(inode);
         reiserfs_init_acl_default(inode);
         reiserfs_init_xattr_rwsem(inode);
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index 2e0021e8f366..638f4c585e89 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -227,24 +227,27 @@ failed:
  * We can come here from ufs_writepage or ufs_prepare_write,
  * locked_page is argument of these functions, so we already lock it.
  */
-static void ufs_change_blocknr(struct inode *inode, unsigned int baseblk,
+static void ufs_change_blocknr(struct inode *inode, unsigned int beg,
                                unsigned int count, unsigned int oldb,
                                unsigned int newb, struct page *locked_page)
 {
-        unsigned int blk_per_page = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
-        struct address_space *mapping = inode->i_mapping;
-        pgoff_t index, cur_index = locked_page->index;
-        unsigned int i, j;
+        const unsigned mask = (1 << (PAGE_CACHE_SHIFT - inode->i_blkbits)) - 1;
+        struct address_space * const mapping = inode->i_mapping;
+        pgoff_t index, cur_index;
+        unsigned end, pos, j;
         struct page *page;
         struct buffer_head *head, *bh;
 
         UFSD("ENTER, ino %lu, count %u, oldb %u, newb %u\n",
               inode->i_ino, count, oldb, newb);
 
+        BUG_ON(!locked_page);
         BUG_ON(!PageLocked(locked_page));
 
-        for (i = 0; i < count; i += blk_per_page) {
-                index = (baseblk+i) >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        cur_index = locked_page->index;
+
+        for (end = count + beg; beg < end; beg = (beg | mask) + 1) {
+                index = beg >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
 
                 if (likely(cur_index != index)) {
                         page = ufs_get_locked_page(mapping, index);
@@ -253,21 +256,32 @@ static void ufs_change_blocknr(struct inode *inode, unsigned int baseblk,
                 } else
                         page = locked_page;
 
-                j = i;
                 head = page_buffers(page);
                 bh = head;
+                pos = beg & mask;
+                for (j = 0; j < pos; ++j)
+                        bh = bh->b_this_page;
+                j = 0;
                 do {
-                        if (likely(bh->b_blocknr == j + oldb && j < count)) {
-                                unmap_underlying_metadata(bh->b_bdev,
-                                                          bh->b_blocknr);
-                                bh->b_blocknr = newb + j++;
-                                mark_buffer_dirty(bh);
+                        if (buffer_mapped(bh)) {
+                                pos = bh->b_blocknr - oldb;
+                                if (pos < count) {
+                                        UFSD(" change from %llu to %llu\n",
+                                             (unsigned long long)pos + oldb,
+                                             (unsigned long long)pos + newb);
+                                        bh->b_blocknr = newb + pos;
+                                        unmap_underlying_metadata(bh->b_bdev,
+                                                                  bh->b_blocknr);
+                                        mark_buffer_dirty(bh);
+                                        ++j;
+                                }
                         }
 
                         bh = bh->b_this_page;
                 } while (bh != head);
 
-                set_page_dirty(page);
+                if (j)
+                        set_page_dirty(page);
 
                 if (likely(cur_index != index))
                         ufs_put_locked_page(page);
@@ -415,14 +429,14 @@ unsigned ufs_new_fragments(struct inode * inode, __fs32 * p, unsigned fragment,
         }
         result = ufs_alloc_fragments (inode, cgno, goal, request, err);
         if (result) {
+                ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
+                                locked_page != NULL);
                 ufs_change_blocknr(inode, fragment - oldcount, oldcount, tmp,
                                    result, locked_page);
 
                 *p = cpu_to_fs32(sb, result);
                 *err = 0;
                 UFS_I(inode)->i_lastfrag = max_t(u32, UFS_I(inode)->i_lastfrag, fragment + count);
-                ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
-                                locked_page != NULL);
                 unlock_super(sb);
                 if (newcount < request)
                         ufs_free_fragments (inode, result + newcount, request - newcount);
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 2fbab0aab688..4295ca91cf85 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -242,7 +242,8 @@ repeat:
                         goal = tmp + uspi->s_fpb;
                 tmp = ufs_new_fragments (inode, p, fragment - blockoff, 
                                          goal, required + blockoff,
-                                         err, locked_page);
+                                         err,
+                                         phys != NULL ? locked_page : NULL);
         }
         /*
          * We will extend last allocated block
@@ -250,7 +251,7 @@ repeat:
         else if (lastblock == block) {
                 tmp = ufs_new_fragments(inode, p, fragment - (blockoff - lastblockoff),
                                         fs32_to_cpu(sb, *p), required +  (blockoff - lastblockoff),
-                                        err, locked_page);
+                                        err, phys != NULL ? locked_page : NULL);
         } else /* (lastblock > block) */ {
         /*
          * We will allocate new block before last allocated block
@@ -261,7 +262,8 @@ repeat:
                                 goal = tmp + uspi->s_fpb;
                 }
                 tmp = ufs_new_fragments(inode, p, fragment - blockoff,
-                                        goal, uspi->s_fpb, err, locked_page);
+                                        goal, uspi->s_fpb, err,
+                                        phys != NULL ? locked_page : NULL);
         }
         if (!tmp) {
                 if ((!blockoff && *p) || 
@@ -438,9 +440,11 @@ int ufs_getfrag_block(struct inode *inode, sector_t fragment, struct buffer_head
          * it much more readable:
          */
 #define GET_INODE_DATABLOCK(x) \
-        ufs_inode_getfrag(inode, x, fragment, 1, &err, &phys, &new, bh_result->b_page)
+        ufs_inode_getfrag(inode, x, fragment, 1, &err, &phys, &new,\
+                          bh_result->b_page)
 #define GET_INODE_PTR(x) \
-        ufs_inode_getfrag(inode, x, fragment, uspi->s_fpb, &err, NULL, NULL, NULL)
+        ufs_inode_getfrag(inode, x, fragment, uspi->s_fpb, &err, NULL, NULL,\
+                          bh_result->b_page)
 #define GET_INDIRECT_DATABLOCK(x) \
         ufs_inode_getblock(inode, bh, x, fragment,      \
                           &err, &phys, &new, bh_result->b_page)
diff --git a/fs/ufs/truncate.c b/fs/ufs/truncate.c
index ea11d04c41a0..0437b0a6fe97 100644
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -109,10 +109,10 @@ static int ufs_trunc_direct (struct inode * inode)
         tmp = fs32_to_cpu(sb, *p);
         if (!tmp )
                 ufs_panic (sb, "ufs_trunc_direct", "internal error");
+        frag2 -= frag1;
         frag1 = ufs_fragnum (frag1);
-        frag2 = ufs_fragnum (frag2);
 
-        ufs_free_fragments (inode, tmp + frag1, frag2 - frag1);
+        ufs_free_fragments(inode, tmp + frag1, frag2);
         mark_inode_dirty(inode);
         frag_to_free = tmp + frag1;
 
diff --git a/include/asm-alpha/dma-mapping.h b/include/asm-alpha/dma-mapping.h
index 57e09f5e3424..75a1aff5b57b 100644
--- a/include/asm-alpha/dma-mapping.h
+++ b/include/asm-alpha/dma-mapping.h
@@ -41,9 +41,9 @@ int dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 #define dma_map_single(dev, va, size, dir)      virt_to_phys(va)
 #define dma_map_page(dev, page, off, size, dir) (page_to_pa(page) + off)
 
-#define dma_unmap_single(dev, addr, size, dir)  do { } while (0)
-#define dma_unmap_page(dev, addr, size, dir)    do { } while (0)
-#define dma_unmap_sg(dev, sg, nents, dir)       do { } while (0)
+#define dma_unmap_single(dev, addr, size, dir)  ((void)0)
+#define dma_unmap_page(dev, addr, size, dir)    ((void)0)
+#define dma_unmap_sg(dev, sg, nents, dir)       ((void)0)
 
 #define dma_mapping_error(addr)  (0)
 
@@ -55,12 +55,14 @@ int dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 
 int dma_set_mask(struct device *dev, u64 mask);
 
-#define dma_sync_single_for_cpu(dev, addr, size, dir)     do { } while (0)
-#define dma_sync_single_for_device(dev, addr, size, dir)  do { } while (0)
-#define dma_sync_single_range(dev, addr, off, size, dir)  do { } while (0)
-#define dma_sync_sg_for_cpu(dev, sg, nents, dir)          do { } while (0)
-#define dma_sync_sg_for_device(dev, sg, nents, dir)       do { } while (0)
-#define dma_cache_sync(dev, va, size, dir)                do { } while (0)
+#define dma_sync_single_for_cpu(dev, addr, size, dir)     ((void)0)
+#define dma_sync_single_for_device(dev, addr, size, dir)  ((void)0)
+#define dma_sync_single_range(dev, addr, off, size, dir)  ((void)0)
+#define dma_sync_sg_for_cpu(dev, sg, nents, dir)          ((void)0)
+#define dma_sync_sg_for_device(dev, sg, nents, dir)       ((void)0)
+#define dma_cache_sync(dev, va, size, dir)                ((void)0)
+#define dma_sync_single_range_for_cpu(dev, addr, offset, size, dir)     ((void)0)
+#define dma_sync_single_range_for_device(dev, addr, offset, size, dir)  ((void)0)
 
 #define dma_get_cache_alignment()                         L1_CACHE_BYTES
 
diff --git a/include/asm-alpha/unistd.h b/include/asm-alpha/unistd.h
index 84313d14e780..e58a427012dd 100644
--- a/include/asm-alpha/unistd.h
+++ b/include/asm-alpha/unistd.h
@@ -342,9 +342,14 @@
 #define __NR_io_cancel                  402
 #define __NR_exit_group                 405
 #define __NR_lookup_dcookie             406
-#define __NR_sys_epoll_create           407
-#define __NR_sys_epoll_ctl              408
-#define __NR_sys_epoll_wait             409
+#define __NR_epoll_create               407
+#define __NR_epoll_ctl                  408
+#define __NR_epoll_wait                 409
+/* Feb 2007: These three sys_epoll defines shouldn't be here but culling
+ * them would break userspace apps ... we'll kill them off in 2010 :) */
+#define __NR_sys_epoll_create           __NR_epoll_create
+#define __NR_sys_epoll_ctl              __NR_epoll_ctl
+#define __NR_sys_epoll_wait             __NR_epoll_wait
 #define __NR_remap_file_pages           410
 #define __NR_set_tid_address            411
 #define __NR_restart_syscall            412
diff --git a/include/asm-arm/arch-at91rm9200/at91_ecc.h b/include/asm-arm/arch-at91rm9200/at91_ecc.h
index fddf256a98d3..5c564ede5c5d 100644
--- a/include/asm-arm/arch-at91rm9200/at91_ecc.h
+++ b/include/asm-arm/arch-at91rm9200/at91_ecc.h
@@ -14,7 +14,7 @@
 #define AT91_ECC_H
 
 #define AT91_ECC_CR             (AT91_ECC + 0x00)       /* Control register */
-#define         AT91_ECC_RST            (1 << 0)                /* Reset parity */
+#define         AT91_ECC_RST            (1 << 0)                /* Reset parity */
 
 #define AT91_ECC_MR             (AT91_ECC + 0x04)       /* Mode register */
 #define         AT91_ECC_PAGESIZE       (3 << 0)                /* Page Size */
@@ -23,16 +23,16 @@
 #define                 AT91_ECC_PAGESIZE_2112          (2)
 #define                 AT91_ECC_PAGESIZE_4224          (3)
 
-#define AT91_ECC_SR             (AT91_ECC + 0x08)       /* Status register */
+#define AT91_ECC_SR             (AT91_ECC + 0x08)       /* Status register */
 #define         AT91_ECC_RECERR         (1 << 0)                /* Recoverable Error */
 #define         AT91_ECC_ECCERR         (1 << 1)                /* ECC Single Bit Error */
 #define         AT91_ECC_MULERR         (1 << 2)                /* Multiple Errors */
 
-#define AT91_ECC_PR             (AT91_ECC + 0x0c)       /* Parity register */
+#define AT91_ECC_PR             (AT91_ECC + 0x0c)       /* Parity register */
 #define         AT91_ECC_BITADDR        (0xf << 0)              /* Bit Error Address */
 #define         AT91_ECC_WORDADDR       (0xfff << 4)            /* Word Error Address */
 
-#define AT91_ECC_NPR            (AT91_ECC + 0x10)       /* NParity register */
+#define AT91_ECC_NPR            (AT91_ECC + 0x10)       /* NParity register */
 #define         AT91_ECC_NPARITY        (0xffff << 0)           /* NParity */
 
 #endif
diff --git a/include/asm-arm/arch-at91rm9200/at91_pmc.h b/include/asm-arm/arch-at91rm9200/at91_pmc.h
index de8c3da74a01..c3b489d09b6c 100644
--- a/include/asm-arm/arch-at91rm9200/at91_pmc.h
+++ b/include/asm-arm/arch-at91rm9200/at91_pmc.h
@@ -61,7 +61,7 @@
 #define                 AT91_PMC_CSS_PLLA               (2 << 0)
 #define                 AT91_PMC_CSS_PLLB               (3 << 0)
 #define         AT91_PMC_PRES           (7 <<  2)               /* Master Clock Prescaler */
-#define                 AT91_PMC_PRES_1                 (0 << 2)
+#define                 AT91_PMC_PRES_1                 (0 << 2)
 #define                 AT91_PMC_PRES_2                 (1 << 2)
 #define                 AT91_PMC_PRES_4                 (2 << 2)
 #define                 AT91_PMC_PRES_8                 (3 << 2)
diff --git a/include/asm-arm/arch-at91rm9200/at91_rstc.h b/include/asm-arm/arch-at91rm9200/at91_rstc.h
index ccdc52da973d..237d3c40b318 100644
--- a/include/asm-arm/arch-at91rm9200/at91_rstc.h
+++ b/include/asm-arm/arch-at91rm9200/at91_rstc.h
@@ -17,7 +17,7 @@
 #define         AT91_RSTC_PROCRST       (1 << 0)                /* Processor Reset */
 #define         AT91_RSTC_PERRST        (1 << 2)                /* Peripheral Reset */
 #define         AT91_RSTC_EXTRST        (1 << 3)                /* External Reset */
-#define         AT01_RSTC_KEY           (0xff << 24)            /* KEY Password */
+#define         AT91_RSTC_KEY           (0xff << 24)            /* KEY Password */
 
 #define AT91_RSTC_SR            (AT91_RSTC + 0x04)      /* Reset Controller Status Register */
 #define         AT91_RSTC_URSTS         (1 << 0)                /* User Reset Status */
diff --git a/include/asm-arm/arch-at91rm9200/at91_rtc.h b/include/asm-arm/arch-at91rm9200/at91_rtc.h
index 6e5065d56260..095fe0883102 100644
--- a/include/asm-arm/arch-at91rm9200/at91_rtc.h
+++ b/include/asm-arm/arch-at91rm9200/at91_rtc.h
@@ -21,21 +21,21 @@
 #define         AT91_RTC_UPDCAL         (1 <<  1)               /* Update Request Calendar Register */
 #define         AT91_RTC_TIMEVSEL       (3 <<  8)               /* Time Event Selection */
 #define                 AT91_RTC_TIMEVSEL_MINUTE        (0 << 8)
-#define                 AT91_RTC_TIMEVSEL_HOUR          (1 << 8)
-#define                 AT91_RTC_TIMEVSEL_DAY24         (2 << 8)
-#define                 AT91_RTC_TIMEVSEL_DAY12         (3 << 8)
+#define                 AT91_RTC_TIMEVSEL_HOUR          (1 << 8)
+#define                 AT91_RTC_TIMEVSEL_DAY24         (2 << 8)
+#define                 AT91_RTC_TIMEVSEL_DAY12         (3 << 8)
 #define         AT91_RTC_CALEVSEL       (3 << 16)               /* Calendar Event Selection */
-#define                 AT91_RTC_CALEVSEL_WEEK          (0 << 16)
-#define                 AT91_RTC_CALEVSEL_MONTH         (1 << 16)
-#define                 AT91_RTC_CALEVSEL_YEAR          (2 << 16)
+#define                 AT91_RTC_CALEVSEL_WEEK          (0 << 16)
+#define                 AT91_RTC_CALEVSEL_MONTH         (1 << 16)
+#define                 AT91_RTC_CALEVSEL_YEAR          (2 << 16)
 
 #define AT91_RTC_MR             (AT91_RTC + 0x04)       /* Mode Register */
-#define         AT91_RTC_HRMOD          (1 <<  0)               /* 12/24 Hour Mode */
+#define                 AT91_RTC_HRMOD          (1 <<  0)               /* 12/24 Hour Mode */
 
 #define AT91_RTC_TIMR           (AT91_RTC + 0x08)       /* Time Register */
 #define         AT91_RTC_SEC            (0x7f <<  0)            /* Current Second */
 #define         AT91_RTC_MIN            (0x7f <<  8)            /* Current Minute */
-#define         AT91_RTC_HOUR           (0x3f << 16)            /* Current Hour */
+#define         AT91_RTC_HOUR           (0x3f << 16)            /* Current Hour */
 #define         AT91_RTC_AMPM           (1    << 22)            /* Ante Meridiem Post Meridiem Indicator */
 
 #define AT91_RTC_CALR           (AT91_RTC + 0x0c)       /* Calendar Register */
diff --git a/include/asm-arm/arch-at91rm9200/at91rm9200.h b/include/asm-arm/arch-at91rm9200/at91rm9200.h
index 4d51177efddd..c569b6a21a42 100644
--- a/include/asm-arm/arch-at91rm9200/at91rm9200.h
+++ b/include/asm-arm/arch-at91rm9200/at91rm9200.h
@@ -274,7 +274,7 @@
 #define AT91_PD19_TPK7          (1 << 19)       /* B: ETM Trace Packet Port 7 */
 #define AT91_PD20_NPCS3         (1 << 20)       /* A: SPI Peripheral Chip Select 3 */
 #define AT91_PD20_TPK8          (1 << 20)       /* B: ETM Trace Packet Port 8 */
-#define AT91_PD21_RTS0          (1 << 21)       /* A: USART Ready To Send 0 */
+#define AT91_PD21_RTS0          (1 << 21)       /* A: USART Ready To Send 0 */
 #define AT91_PD21_TPK9          (1 << 21)       /* B: ETM Trace Packet Port 9 */
 #define AT91_PD22_RTS1          (1 << 22)       /* A: USART Ready To Send 1 */
 #define AT91_PD22_TPK10         (1 << 22)       /* B: ETM Trace Packet Port 10 */
diff --git a/include/asm-arm/arch-at91rm9200/at91sam9260_matrix.h b/include/asm-arm/arch-at91rm9200/at91sam9260_matrix.h
index 746d973705bf..78f6b4917b8b 100644
--- a/include/asm-arm/arch-at91rm9200/at91sam9260_matrix.h
+++ b/include/asm-arm/arch-at91rm9200/at91sam9260_matrix.h
@@ -58,7 +58,7 @@
 #define         AT91_MATRIX_RCB1                (1 << 1)        /* Remap Command for AHB Master 1 (ARM926EJ-S Data Master) */
 
 #define AT91_MATRIX_EBICSA      (AT91_MATRIX + 0x11C)   /* EBI Chip Select Assignment Register */
-#define         AT91_MATRIX_CS1A                (1 << 1)         /* Chip Select 1 Assignment */
+#define         AT91_MATRIX_CS1A                (1 << 1)        /* Chip Select 1 Assignment */
 #define                 AT91_MATRIX_CS1A_SMC            (0 << 1)
 #define                 AT91_MATRIX_CS1A_SDRAMC         (1 << 1)
 #define         AT91_MATRIX_CS3A                (1 << 3)        /* Chip Select 3 Assignment */
diff --git a/include/asm-arm/arch-at91rm9200/at91sam9261_matrix.h b/include/asm-arm/arch-at91rm9200/at91sam9261_matrix.h
index 270a5dcdf1cd..ec88efabbe6c 100644
--- a/include/asm-arm/arch-at91rm9200/at91sam9261_matrix.h
+++ b/include/asm-arm/arch-at91rm9200/at91sam9261_matrix.h
@@ -15,7 +15,7 @@
 
 #define AT91_MATRIX_MCFG        (AT91_MATRIX + 0x00)    /* Master Configuration Register */
 #define         AT91_MATRIX_RCB0        (1 << 0)                /* Remap Command for AHB Master 0 (ARM926EJ-S Instruction Master) */
-#define         AT01_MATRIX_RCB1        (1 << 1)                /* Remap Command for AHB Master 1 (ARM926EJ-S Data Master) */
+#define         AT91_MATRIX_RCB1        (1 << 1)                /* Remap Command for AHB Master 1 (ARM926EJ-S Data Master) */
 
 #define AT91_MATRIX_SCFG0       (AT91_MATRIX + 0x04)    /* Slave Configuration Register 0 */
 #define AT91_MATRIX_SCFG1       (AT91_MATRIX + 0x08)    /* Slave Configuration Register 1 */
@@ -43,8 +43,8 @@
 
 #define AT91_MATRIX_EBICSA      (AT91_MATRIX + 0x30)    /* EBI Chip Select Assignment Register */
 #define         AT91_MATRIX_CS1A                (1 << 1)        /* Chip Select 1 Assignment */
-#define                 AT91_MATRIX_CS1A_SMC            (0 << 1)
-#define                 AT91_MATRIX_CS1A_SDRAMC         (1 << 1)
+#define                 AT91_MATRIX_CS1A_SMC            (0 << 1)
+#define                 AT91_MATRIX_CS1A_SDRAMC         (1 << 1)
 #define         AT91_MATRIX_CS3A                (1 << 3)        /* Chip Select 3 Assignment */
 #define                 AT91_MATRIX_CS3A_SMC            (0 << 3)
 #define                 AT91_MATRIX_CS3A_SMC_SMARTMEDIA (1 << 3)
diff --git a/include/asm-arm/arch-at91rm9200/at91sam926x_mc.h b/include/asm-arm/arch-at91rm9200/at91sam926x_mc.h
index 7d94968b5d57..972e7531c7f4 100644
--- a/include/asm-arm/arch-at91rm9200/at91sam926x_mc.h
+++ b/include/asm-arm/arch-at91rm9200/at91sam926x_mc.h
@@ -33,14 +33,14 @@
 #define                 AT91_SDRAMC_NC_9        (1 << 0)
 #define                 AT91_SDRAMC_NC_10       (2 << 0)
 #define                 AT91_SDRAMC_NC_11       (3 << 0)
-#define         AT91_SDRAMC_NR          (3 << 2)                /* Number of Row Bits */
+#define         AT91_SDRAMC_NR          (3 << 2)                /* Number of Row Bits */
 #define                 AT91_SDRAMC_NR_11       (0 << 2)
 #define                 AT91_SDRAMC_NR_12       (1 << 2)
 #define                 AT91_SDRAMC_NR_13       (2 << 2)
-#define         AT91_SDRAMC_NB          (1 << 4)                /* Number of Banks */
+#define         AT91_SDRAMC_NB          (1 << 4)                /* Number of Banks */
 #define                 AT91_SDRAMC_NB_2        (0 << 4)
-#define                 AT91_SDRAMC_NB_4        (1 << 4)
-#define         AT91_SDRAMC_CAS         (3 << 5)                /* CAS Latency */
+#define                 AT91_SDRAMC_NB_4        (1 << 4)
+#define         AT91_SDRAMC_CAS         (3 << 5)                /* CAS Latency */
 #define                 AT91_SDRAMC_CAS_1       (1 << 5)
 #define                 AT91_SDRAMC_CAS_2       (2 << 5)
 #define                 AT91_SDRAMC_CAS_3       (3 << 5)
@@ -110,10 +110,10 @@
 #define AT91_SMC_MODE(n)        (AT91_SMC + 0x0c + ((n)*0x10))  /* Mode Register for CS n */
 #define         AT91_SMC_READMODE       (1 <<  0)                       /* Read Mode */
 #define         AT91_SMC_WRITEMODE      (1 <<  1)                       /* Write Mode */
-#define         AT91_SMC_EXNWMODE       (3 <<  5)                       /* NWAIT Mode */
-#define                 AT91_SMC_EXNWMODE_DISABLE       (0 << 5)
-#define                 AT91_SMC_EXNWMODE_FROZEN        (2 << 5)
-#define                 AT91_SMC_EXNWMODE_READY         (3 << 5)
+#define         AT91_SMC_EXNWMODE       (3 <<  4)                       /* NWAIT Mode */
+#define                 AT91_SMC_EXNWMODE_DISABLE       (0 << 4)
+#define                 AT91_SMC_EXNWMODE_FROZEN        (2 << 4)
+#define                 AT91_SMC_EXNWMODE_READY         (3 << 4)
 #define         AT91_SMC_BAT            (1 <<  8)                       /* Byte Access Type */
 #define                 AT91_SMC_BAT_SELECT             (0 << 8)
 #define                 AT91_SMC_BAT_WRITE              (1 << 8)
diff --git a/include/asm-arm/arch-s3c2410/regs-gpio.h b/include/asm-arm/arch-s3c2410/regs-gpio.h
index b2893e32a236..eae91694edcd 100644
--- a/include/asm-arm/arch-s3c2410/regs-gpio.h
+++ b/include/asm-arm/arch-s3c2410/regs-gpio.h
@@ -52,10 +52,10 @@
 /* general configuration options */
 
 #define S3C2410_GPIO_LEAVE   (0xFFFFFFFF)
-#define S3C2410_GPIO_INPUT   (0xFFFFFFF0)
+#define S3C2410_GPIO_INPUT   (0xFFFFFFF0)       /* not available on A */
 #define S3C2410_GPIO_OUTPUT  (0xFFFFFFF1)
 #define S3C2410_GPIO_IRQ     (0xFFFFFFF2)       /* not available for all */
-#define S3C2410_GPIO_SFN2    (0xFFFFFFF2)       /* not available on A */
+#define S3C2410_GPIO_SFN2    (0xFFFFFFF2)       /* bank A => addr/cs/nand */
 #define S3C2410_GPIO_SFN3    (0xFFFFFFF3)       /* not available on A */
 
 /* register address for the GPIO registers.
diff --git a/include/asm-arm/arch-s3c2410/regs-mem.h b/include/asm-arm/arch-s3c2410/regs-mem.h
index 375dca50364e..e4d82341f7ba 100644
--- a/include/asm-arm/arch-s3c2410/regs-mem.h
+++ b/include/asm-arm/arch-s3c2410/regs-mem.h
@@ -133,10 +133,10 @@
 #define S3C2410_BANKCON_SDRAM           (0x3 << 15)
 
 /* next bits only for EDO DRAM in 6,7 */
-#define S3C2400_BANKCON_EDO_Trdc1      (0x00 << 4)
-#define S3C2400_BANKCON_EDO_Trdc2      (0x01 << 4)
-#define S3C2400_BANKCON_EDO_Trdc3      (0x02 << 4)
-#define S3C2400_BANKCON_EDO_Trdc4      (0x03 << 4)
+#define S3C2400_BANKCON_EDO_Trcd1      (0x00 << 4)
+#define S3C2400_BANKCON_EDO_Trcd2      (0x01 << 4)
+#define S3C2400_BANKCON_EDO_Trcd3      (0x02 << 4)
+#define S3C2400_BANKCON_EDO_Trcd4      (0x03 << 4)
 
 /* CAS pulse width */
 #define S3C2400_BANKCON_EDO_PULSE1     (0x00 << 3)
@@ -153,9 +153,9 @@
 #define S3C2400_BANKCON_EDO_SCANb11    (0x03 << 0)
 
 /* next bits only for SDRAM in 6,7 */
-#define S3C2410_BANKCON_Trdc2           (0x00 << 2)
-#define S3C2410_BANKCON_Trdc3           (0x01 << 2)
-#define S3C2410_BANKCON_Trdc4           (0x02 << 2)
+#define S3C2410_BANKCON_Trcd2           (0x00 << 2)
+#define S3C2410_BANKCON_Trcd3           (0x01 << 2)
+#define S3C2410_BANKCON_Trcd4           (0x02 << 2)
 
 /* control column address select */
 #define S3C2410_BANKCON_SCANb8          (0x00 << 0)
diff --git a/include/asm-arm/fpstate.h b/include/asm-arm/fpstate.h
index 6af4e6bd1290..f31cda5a55ee 100644
--- a/include/asm-arm/fpstate.h
+++ b/include/asm-arm/fpstate.h
@@ -35,6 +35,9 @@ struct vfp_hard_struct {
          */
         __u32 fpinst;
         __u32 fpinst2;
+#ifdef CONFIG_SMP
+        __u32 cpu;
+#endif
 };
 
 union vfp_state {
diff --git a/include/asm-frv/Kbuild b/include/asm-frv/Kbuild
index c68e1680da01..966a9836d556 100644
--- a/include/asm-frv/Kbuild
+++ b/include/asm-frv/Kbuild
@@ -1 +1,7 @@
 include include/asm-generic/Kbuild.asm
+
+header-y += registers.h
+
+unifdef-y += termios.h
+unifdef-y += ptrace.h
+unifdef-y += page.h
diff --git a/include/asm-frv/page.h b/include/asm-frv/page.h
index 134cc0cdf6c2..213d92fd652a 100644
--- a/include/asm-frv/page.h
+++ b/include/asm-frv/page.h
@@ -76,8 +76,6 @@ extern unsigned long max_pfn;
 
 #endif /* __ASSEMBLY__ */
 
-#endif /* __KERNEL__ */
-
 #ifdef CONFIG_CONTIGUOUS_PAGE_ALLOC
 #define WANT_PAGE_VIRTUAL       1
 #endif
@@ -85,4 +83,6 @@ extern unsigned long max_pfn;
 #include <asm-generic/memory_model.h>
 #include <asm-generic/page.h>
 
+#endif /* __KERNEL__ */
+
 #endif /* _ASM_PAGE_H */
diff --git a/include/asm-frv/ptrace.h b/include/asm-frv/ptrace.h
index 9a2241b8eb1e..cf6934012b64 100644
--- a/include/asm-frv/ptrace.h
+++ b/include/asm-frv/ptrace.h
@@ -12,9 +12,11 @@
 #define _ASM_PTRACE_H
 
 #include <asm/registers.h>
+#ifdef __KERNEL__
 #include <asm/irq_regs.h>
 
 #define in_syscall(regs) (((regs)->tbr & TBR_TT) == TBR_TT_TRAP0)
+#endif
 
 
 #define PT_PSR          0
@@ -60,6 +62,7 @@
 #define PTRACE_GETFDPIC_EXEC    0       /* [addr] request the executable loadmap */
 #define PTRACE_GETFDPIC_INTERP  1       /* [addr] request the interpreter loadmap */
 
+#ifdef __KERNEL__
 #ifndef __ASSEMBLY__
 
 /*
@@ -74,6 +77,7 @@ register struct pt_regs *__frame asm("gr28");
 extern unsigned long user_stack(const struct pt_regs *);
 extern void show_regs(struct pt_regs *);
 #define profile_pc(regs) ((regs)->pc)
+#endif
 
 #endif /* !__ASSEMBLY__ */
 #endif /* _ASM_PTRACE_H */
diff --git a/include/asm-frv/termios.h b/include/asm-frv/termios.h
index b4a664e7f55c..8840cf95e8dd 100644
--- a/include/asm-frv/termios.h
+++ b/include/asm-frv/termios.h
@@ -69,6 +69,8 @@ struct termio {
 #define N_SYNC_PPP      14
 #define N_HCI           15  /* Bluetooth HCI UART */
 
+#ifdef __KERNEL__
 #include <asm-generic/termios.h>
+#endif
 
 #endif /* _ASM_TERMIOS_H */
diff --git a/include/asm-generic/libata-portmap.h b/include/asm-generic/libata-portmap.h
index 9202fd02d5be..62fb3618293d 100644
--- a/include/asm-generic/libata-portmap.h
+++ b/include/asm-generic/libata-portmap.h
@@ -3,10 +3,10 @@
 
 #define ATA_PRIMARY_CMD         0x1F0
 #define ATA_PRIMARY_CTL         0x3F6
-#define ATA_PRIMARY_IRQ         14
+#define ATA_PRIMARY_IRQ(dev)    14
 
 #define ATA_SECONDARY_CMD       0x170
 #define ATA_SECONDARY_CTL       0x376
-#define ATA_SECONDARY_IRQ       15
+#define ATA_SECONDARY_IRQ(dev)  15
 
 #endif
diff --git a/include/asm-i386/elf.h b/include/asm-i386/elf.h
index 45d21a0c95bf..369035dfe4b6 100644
--- a/include/asm-i386/elf.h
+++ b/include/asm-i386/elf.h
@@ -143,11 +143,8 @@ extern int dump_task_extended_fpu (struct task_struct *, struct user_fxsr_struct
 # define VDSO_PRELINK           0
 #endif
 
-#define VDSO_COMPAT_SYM(x) \
-                (VDSO_COMPAT_BASE + (unsigned long)(x) - VDSO_PRELINK)
-
 #define VDSO_SYM(x) \
-                (VDSO_BASE + (unsigned long)(x) - VDSO_PRELINK)
+                (VDSO_COMPAT_BASE + (unsigned long)(x) - VDSO_PRELINK)
 
 #define VDSO_HIGH_EHDR          ((const struct elfhdr *) VDSO_HIGH_BASE)
 #define VDSO_EHDR               ((const struct elfhdr *) VDSO_COMPAT_BASE)
@@ -156,10 +153,12 @@ extern void __kernel_vsyscall;
 
 #define VDSO_ENTRY              VDSO_SYM(&__kernel_vsyscall)
 
+#ifndef CONFIG_COMPAT_VDSO
 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
 struct linux_binprm;
 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
                                        int executable_stack);
+#endif
 
 extern unsigned int vdso_enabled;
 
@@ -169,50 +168,6 @@ do if (vdso_enabled) {						\
                 NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_COMPAT_BASE); \
 } while (0)
 
-/*
- * These macros parameterize elf_core_dump in fs/binfmt_elf.c to write out
- * extra segments containing the vsyscall DSO contents.  Dumping its
- * contents makes post-mortem fully interpretable later without matching up
- * the same kernel and hardware config to see what PC values meant.
- * Dumping its extra ELF program headers includes all the other information
- * a debugger needs to easily find how the vsyscall DSO was being used.
- */
-#define ELF_CORE_EXTRA_PHDRS            (VDSO_HIGH_EHDR->e_phnum)
-#define ELF_CORE_WRITE_EXTRA_PHDRS                                            \
-do {                                                                          \
-        const struct elf_phdr *const vsyscall_phdrs =                         \
-                (const struct elf_phdr *) (VDSO_HIGH_BASE                     \
-                                           + VDSO_HIGH_EHDR->e_phoff);    \
-        int i;                                                                \
-        Elf32_Off ofs = 0;                                                    \
-        for (i = 0; i < VDSO_HIGH_EHDR->e_phnum; ++i) {               \
-                struct elf_phdr phdr = vsyscall_phdrs[i];                     \
-                if (phdr.p_type == PT_LOAD) {                                 \
-                        BUG_ON(ofs != 0);                                     \
-                        ofs = phdr.p_offset = offset;                         \
-                        phdr.p_memsz = PAGE_ALIGN(phdr.p_memsz);              \
-                        phdr.p_filesz = phdr.p_memsz;                         \
-                        offset += phdr.p_filesz;                              \
-                }                                                             \
-                else                                                          \
-                        phdr.p_offset += ofs;                                 \
-                phdr.p_paddr = 0; /* match other core phdrs */                \
-                DUMP_WRITE(&phdr, sizeof(phdr));                              \
-        }                                                                     \
-} while (0)
-#define ELF_CORE_WRITE_EXTRA_DATA                                             \
-do {                                                                          \
-        const struct elf_phdr *const vsyscall_phdrs =                         \
-                (const struct elf_phdr *) (VDSO_HIGH_BASE                     \
-                                           + VDSO_HIGH_EHDR->e_phoff);    \
-        int i;                                                                \
-        for (i = 0; i < VDSO_HIGH_EHDR->e_phnum; ++i) {               \
-                if (vsyscall_phdrs[i].p_type == PT_LOAD)                      \
-                        DUMP_WRITE((void *) vsyscall_phdrs[i].p_vaddr,        \
-                                   PAGE_ALIGN(vsyscall_phdrs[i].p_memsz));    \
-        }                                                                     \
-} while (0)
-
 #endif
 
 #endif
diff --git a/include/asm-i386/fixmap.h b/include/asm-i386/fixmap.h
index 02428cb36621..3e9f610c35df 100644
--- a/include/asm-i386/fixmap.h
+++ b/include/asm-i386/fixmap.h
@@ -23,6 +23,8 @@
 extern unsigned long __FIXADDR_TOP;
 #else
 #define __FIXADDR_TOP  0xfffff000
+#define FIXADDR_USER_START      __fix_to_virt(FIX_VDSO)
+#define FIXADDR_USER_END        __fix_to_virt(FIX_VDSO - 1)
 #endif
 
 #ifndef __ASSEMBLY__
diff --git a/include/asm-i386/page.h b/include/asm-i386/page.h
index fd3f64ace248..7b19f454761d 100644
--- a/include/asm-i386/page.h
+++ b/include/asm-i386/page.h
@@ -143,7 +143,9 @@ extern int page_is_ram(unsigned long pagenr);
 #include <asm-generic/memory_model.h>
 #include <asm-generic/page.h>
 
+#ifndef CONFIG_COMPAT_VDSO
 #define __HAVE_ARCH_GATE_AREA 1
+#endif
 #endif /* __KERNEL__ */
 
 #endif /* _I386_PAGE_H */
diff --git a/include/asm-ia64/checksum.h b/include/asm-ia64/checksum.h
index 2b78582cbd61..97af155057e4 100644
--- a/include/asm-ia64/checksum.h
+++ b/include/asm-ia64/checksum.h
@@ -72,8 +72,8 @@ static inline __sum16 csum_fold(__wsum csum)
 
 #define _HAVE_ARCH_IPV6_CSUM    1
 struct in6_addr;
-extern unsigned short int csum_ipv6_magic(struct in6_addr *saddr,
-        struct in6_addr *daddr, __u32 len, unsigned short proto,
-        unsigned int csum);
+extern __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
+        const struct in6_addr *daddr, __u32 len, unsigned short proto,
+        __wsum csum);
 
 #endif /* _ASM_IA64_CHECKSUM_H */
diff --git a/include/asm-ia64/pci.h b/include/asm-ia64/pci.h
index 556f53fa44cb..5160233bbfac 100644
--- a/include/asm-ia64/pci.h
+++ b/include/asm-ia64/pci.h
@@ -167,4 +167,10 @@ pcibios_select_root(struct pci_dev *pdev, struct resource *res)
 
 #define pcibios_scan_all_fns(a, b)      0
 
+#define HAVE_ARCH_PCI_GET_LEGACY_IDE_IRQ
+static inline int pci_get_legacy_ide_irq(struct pci_dev *dev, int channel)
+{
+        return channel ? 15 : 14;
+}
+
 #endif /* _ASM_IA64_PCI_H */
diff --git a/include/asm-m68k/uaccess.h b/include/asm-m68k/uaccess.h
index e4c9f080ff20..6a4cf2081512 100644
--- a/include/asm-m68k/uaccess.h
+++ b/include/asm-m68k/uaccess.h
@@ -7,6 +7,7 @@
 #include <linux/compiler.h>
 #include <linux/errno.h>
 #include <linux/types.h>
+#include <linux/sched.h>
 #include <asm/segment.h>
 
 #define VERIFY_READ     0
diff --git a/include/asm-mips/checksum.h b/include/asm-mips/checksum.h
index 24cdcc6eaab8..20a81e1548f5 100644
--- a/include/asm-mips/checksum.h
+++ b/include/asm-mips/checksum.h
@@ -159,7 +159,8 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr,
 #endif
         "       .set    pop"
         : "=r" (sum)
-        : "0" (daddr), "r"(saddr),
+        : "0" ((__force unsigned long)daddr),
+          "r" ((__force unsigned long)saddr),
 #ifdef __MIPSEL__
           "r" ((proto + len) << 8),
 #else
diff --git a/include/asm-mips/hazards.h b/include/asm-mips/hazards.h
index 0fe02945feba..50073157a617 100644
--- a/include/asm-mips/hazards.h
+++ b/include/asm-mips/hazards.h
@@ -157,7 +157,7 @@ ASMMACRO(back_to_back_c0_hazard,
  * processors.
  */
 ASMMACRO(mtc0_tlbw_hazard,
-        nop
+        nop; nop
         )
 ASMMACRO(tlbw_use_hazard,
         nop; nop; nop
diff --git a/include/asm-mips/irqflags.h b/include/asm-mips/irqflags.h
index 46bf5de5ac72..af3b07dfad4b 100644
--- a/include/asm-mips/irqflags.h
+++ b/include/asm-mips/irqflags.h
@@ -15,6 +15,27 @@
 
 #include <asm/hazards.h>
 
+/*
+ * CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY does prompt replay of deferred IPIs,
+ * at the cost of branch and call overhead on each local_irq_restore()
+ */
+
+#ifdef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
+
+extern void smtc_ipi_replay(void);
+
+#define irq_restore_epilog(flags)                               \
+do {                                                            \
+        if (!(flags & 0x0400))                                  \
+                smtc_ipi_replay();                              \
+} while (0)
+
+#else
+
+#define irq_restore_epilog(ignore) do { } while (0)
+
+#endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
+
 __asm__ (
         "       .macro  raw_local_irq_enable                            \n"
         "       .set    push                                            \n"
@@ -193,6 +214,7 @@ do {									\
                 : "=r" (__tmp1)                                         \
                 : "0" (flags)                                           \
                 : "memory");                                            \
+        irq_restore_epilog(flags);                                      \
 } while(0)
 
 static inline int raw_irqs_disabled_flags(unsigned long flags)
diff --git a/include/asm-mips/pgtable.h b/include/asm-mips/pgtable.h
index f2e1325fec6c..3fcfd7979de5 100644
--- a/include/asm-mips/pgtable.h
+++ b/include/asm-mips/pgtable.h
@@ -69,16 +69,6 @@ extern unsigned long zero_page_mask;
 #define ZERO_PAGE(vaddr) \
         (virt_to_page((void *)(empty_zero_page + (((unsigned long)(vaddr)) & zero_page_mask))))
 
-#define __HAVE_ARCH_MOVE_PTE
-#define move_pte(pte, prot, old_addr, new_addr)                         \
-({                                                                      \
-        pte_t newpte = (pte);                                           \
-        if (pte_present(pte) && pfn_valid(pte_pfn(pte)) &&              \
-                        pte_page(pte) == ZERO_PAGE(old_addr))           \
-                newpte = mk_pte(ZERO_PAGE(new_addr), (prot));           \
-        newpte;                                                         \
-})
-
 extern void paging_init(void);
 
 /*
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index e475c45ea263..fbcda8204473 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -118,6 +118,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_USEDFPU             16      /* FPU was used by this task this quantum (SMP) */
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
+#define TIF_FREEZE              19
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
 
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
@@ -129,6 +130,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
 #define _TIF_USEDFPU            (1<<TIF_USEDFPU)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
+#define _TIF_FREEZE             (1<<TIF_FREEZE)
 
 /* work to do on interrupt/exception return */
 #define _TIF_WORK_MASK          (0x0000ffef & ~_TIF_SECCOMP)
diff --git a/include/asm-powerpc/dma-mapping.h b/include/asm-powerpc/dma-mapping.h
index 7c7de87bd8ae..a19a6f1a1cf1 100644
--- a/include/asm-powerpc/dma-mapping.h
+++ b/include/asm-powerpc/dma-mapping.h
@@ -37,9 +37,9 @@ extern void __dma_sync_page(struct page *page, unsigned long offset,
  */
 
 #define __dma_alloc_coherent(gfp, size, handle) NULL
-#define __dma_free_coherent(size, addr)         do { } while (0)
-#define __dma_sync(addr, size, rw)              do { } while (0)
-#define __dma_sync_page(pg, off, sz, rw)        do { } while (0)
+#define __dma_free_coherent(size, addr)         ((void)0)
+#define __dma_sync(addr, size, rw)              ((void)0)
+#define __dma_sync_page(pg, off, sz, rw)        ((void)0)
 
 #endif /* ! CONFIG_NOT_COHERENT_CACHE */
 
@@ -251,7 +251,7 @@ dma_map_single(struct device *dev, void *ptr, size_t size,
 }
 
 /* We do nothing. */
-#define dma_unmap_single(dev, addr, size, dir)  do { } while (0)
+#define dma_unmap_single(dev, addr, size, dir)  ((void)0)
 
 static inline dma_addr_t
 dma_map_page(struct device *dev, struct page *page,
@@ -266,7 +266,7 @@ dma_map_page(struct device *dev, struct page *page,
 }
 
 /* We do nothing. */
-#define dma_unmap_page(dev, handle, size, dir)  do { } while (0)
+#define dma_unmap_page(dev, handle, size, dir)  ((void)0)
 
 static inline int
 dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
@@ -286,7 +286,7 @@ dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 }
 
 /* We don't do anything here. */
-#define dma_unmap_sg(dev, sg, nents, dir)       do { } while (0)
+#define dma_unmap_sg(dev, sg, nents, dir)       ((void)0)
 
 #endif /* CONFIG_PPC64 */
 
diff --git a/include/asm-powerpc/libata-portmap.h b/include/asm-powerpc/libata-portmap.h
new file mode 100644
index 000000000000..4d8518049f4d
--- /dev/null
+++ b/include/asm-powerpc/libata-portmap.h
@@ -0,0 +1,12 @@
+#ifndef __ASM_POWERPC_LIBATA_PORTMAP_H
+#define __ASM_POWERPC_LIBATA_PORTMAP_H
+
+#define ATA_PRIMARY_CMD 0x1F0
+#define ATA_PRIMARY_CTL 0x3F6
+#define ATA_PRIMARY_IRQ(dev)    pci_get_legacy_ide_irq(dev, 0)
+
+#define ATA_SECONDARY_CMD       0x170
+#define ATA_SECONDARY_CTL       0x376
+#define ATA_SECONDARY_IRQ(dev)  pci_get_legacy_ide_irq(dev, 1)
+
+#endif
diff --git a/include/asm-sparc/checksum.h b/include/asm-sparc/checksum.h
index 267e631e9bbc..34518ea7bf1b 100644
--- a/include/asm-sparc/checksum.h
+++ b/include/asm-sparc/checksum.h
@@ -151,7 +151,7 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
                              "xnor\t%%g0, %0, %0"
                              : "=r" (sum), "=&r" (iph)
                              : "r" (ihl), "1" (iph)
-                             : "g2", "g3", "g4", "cc");
+                             : "g2", "g3", "g4", "cc", "memory");
         return sum;
 }
 
diff --git a/include/asm-um/pgtable.h b/include/asm-um/pgtable.h
index 188f72621776..e57ff136ee51 100644
--- a/include/asm-um/pgtable.h
+++ b/include/asm-um/pgtable.h
@@ -408,6 +408,15 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 
 #include <asm-generic/pgtable-nopud.h>
 
+#ifdef CONFIG_HIGHMEM
+/* Clear a kernel PTE and flush it from the TLB */
+#define kpte_clear_flush(ptep, vaddr)                                   \
+do {                                                                    \
+        pte_clear(&init_mm, vaddr, ptep);                               \
+        __flush_tlb_one(vaddr);                                         \
+} while (0)
+#endif
+
 #endif
 #endif
 
diff --git a/include/asm-x86_64/dma-mapping.h b/include/asm-x86_64/dma-mapping.h
index be9ec6890723..49dbab09ef2b 100644
--- a/include/asm-x86_64/dma-mapping.h
+++ b/include/asm-x86_64/dma-mapping.h
@@ -63,6 +63,9 @@ static inline int dma_mapping_error(dma_addr_t dma_addr)
         return (dma_addr == bad_dma_address);
 }
 
+#define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
+#define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
+
 extern void *dma_alloc_coherent(struct device *dev, size_t size,
                                 dma_addr_t *dma_handle, gfp_t gfp);
 extern void dma_free_coherent(struct device *dev, size_t size, void *vaddr,
diff --git a/include/asm-x86_64/uaccess.h b/include/asm-x86_64/uaccess.h
index d5dbc87274f8..c0eac519840b 100644
--- a/include/asm-x86_64/uaccess.h
+++ b/include/asm-x86_64/uaccess.h
@@ -157,7 +157,7 @@ do {									\
           case 1: __put_user_asm(x,ptr,retval,"b","b","iq",-EFAULT); break;\
           case 2: __put_user_asm(x,ptr,retval,"w","w","ir",-EFAULT); break;\
           case 4: __put_user_asm(x,ptr,retval,"l","k","ir",-EFAULT); break;\
-          case 8: __put_user_asm(x,ptr,retval,"q","","ir",-EFAULT); break;\
+          case 8: __put_user_asm(x,ptr,retval,"q","","Zr",-EFAULT); break;\
           default: __put_user_bad();                                    \
         }                                                               \
 } while (0)
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 862e483cce8a..157db77a7170 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -69,7 +69,6 @@ header-y += hysdn_if.h
 header-y += i2c-dev.h
 header-y += i8k.h
 header-y += icmp.h
-header-y += if_addr.h
 header-y += if_arcnet.h
 header-y += if_arp.h
 header-y += if_bonding.h
@@ -79,7 +78,6 @@ header-y += if_fddi.h
 header-y += if.h
 header-y += if_hippi.h
 header-y += if_infiniband.h
-header-y += if_link.h
 header-y += if_packet.h
 header-y += if_plip.h
 header-y += if_ppp.h
@@ -129,7 +127,6 @@ header-y += posix_types.h
 header-y += ppdev.h
 header-y += prctl.h
 header-y += ps2esdi.h
-header-y += qic117.h
 header-y += qnxtypes.h
 header-y += quotaio_v1.h
 header-y += quotaio_v2.h
@@ -214,6 +211,7 @@ unifdef-y += hpet.h
 unifdef-y += i2c.h
 unifdef-y += i2o-dev.h
 unifdef-y += icmpv6.h
+unifdef-y += if_addr.h
 unifdef-y += if_bridge.h
 unifdef-y += if_ec.h
 unifdef-y += if_eql.h
@@ -221,6 +219,7 @@ unifdef-y += if_ether.h
 unifdef-y += if_fddi.h
 unifdef-y += if_frad.h
 unifdef-y += if_ltalk.h
+unifdef-y += if_link.h
 unifdef-y += if_pppox.h
 unifdef-y += if_shaper.h
 unifdef-y += if_tr.h
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 5d1eabcde5d5..638165f571da 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -31,9 +31,8 @@ static inline unsigned long hweight_long(unsigned long w)
         return sizeof(w) == 4 ? hweight32(w) : hweight64(w);
 }
 
-/*
+/**
  * rol32 - rotate a 32-bit value left
- *
  * @word: value to rotate
  * @shift: bits to roll
  */
@@ -42,9 +41,8 @@ static inline __u32 rol32(__u32 word, unsigned int shift)
         return (word << shift) | (word >> (32 - shift));
 }
 
-/*
+/**
  * ror32 - rotate a 32-bit value right
- *
  * @word: value to rotate
  * @shift: bits to roll
  */
diff --git a/include/linux/cdev.h b/include/linux/cdev.h
index f309b00e986e..1e29b13d0062 100644
--- a/include/linux/cdev.h
+++ b/include/linux/cdev.h
@@ -6,6 +6,10 @@
 #include <linux/kdev_t.h>
 #include <linux/list.h>
 
+struct file_operations;
+struct inode;
+struct module;
+
 struct cdev {
         struct kobject kobj;
         struct module *owner;
diff --git a/include/linux/efi.h b/include/linux/efi.h
index df1c91855f0e..f8ebd7c1ddb3 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -301,7 +301,7 @@ extern int __init efi_uart_console_only (void);
 extern void efi_initialize_iomem_resources(struct resource *code_resource,
                                         struct resource *data_resource);
 extern unsigned long efi_get_time(void);
-extern int __init efi_set_rtc_mmss(unsigned long nowtime);
+extern int efi_set_rtc_mmss(unsigned long nowtime);
 extern int is_available_memory(efi_memory_desc_t * md);
 extern struct efi_memory_map memmap;
 
diff --git a/include/linux/hdreg.h b/include/linux/hdreg.h
index 2b54eac738ea..818c6afc1091 100644
--- a/include/linux/hdreg.h
+++ b/include/linux/hdreg.h
@@ -60,13 +60,15 @@
 #define TAG_MASK                0xf8
 #endif /* __KERNEL__ */
 
+#include <linux/types.h>
+
 /*
  * Command Header sizes for IOCTL commands
  */
 
-#define HDIO_DRIVE_CMD_HDR_SIZE         (4 * sizeof(u8))
-#define HDIO_DRIVE_HOB_HDR_SIZE         (8 * sizeof(u8))
-#define HDIO_DRIVE_TASK_HDR_SIZE        (8 * sizeof(u8))
+#define HDIO_DRIVE_CMD_HDR_SIZE         (4 * sizeof(__u8))
+#define HDIO_DRIVE_HOB_HDR_SIZE         (8 * sizeof(__u8))
+#define HDIO_DRIVE_TASK_HDR_SIZE        (8 * sizeof(__u8))
 
 #define IDE_DRIVE_TASK_INVALID          -1
 #define IDE_DRIVE_TASK_NO_DATA          0
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 770120add15a..342b4e639acb 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -438,7 +438,6 @@ struct hid_device {							/* device report descriptor */
                                   struct hid_usage *, __s32);
         void (*hiddev_report_event) (struct hid_device *, struct hid_report *);
 #ifdef CONFIG_USB_HIDINPUT_POWERBOOK
-        unsigned int  pb_fnmode;
         unsigned long pb_pressed_fn[NBITS(KEY_MAX)];
         unsigned long pb_pressed_numlock[NBITS(KEY_MAX)];
 #endif
diff --git a/include/linux/i2o-dev.h b/include/linux/i2o-dev.h
index c2519df1b6dc..a0b23dd45239 100644
--- a/include/linux/i2o-dev.h
+++ b/include/linux/i2o-dev.h
@@ -24,12 +24,13 @@
 #define MAX_I2O_CONTROLLERS     32
 
 #include <linux/ioctl.h>
+#include <linux/types.h>
 
 /*
  * I2O Control IOCTLs and structures
  */
 #define I2O_MAGIC_NUMBER        'i'
-#define I2OGETIOPS              _IOR(I2O_MAGIC_NUMBER,0,u8[MAX_I2O_CONTROLLERS])
+#define I2OGETIOPS              _IOR(I2O_MAGIC_NUMBER,0,__u8[MAX_I2O_CONTROLLERS])
 #define I2OHRTGET               _IOWR(I2O_MAGIC_NUMBER,1,struct i2o_cmd_hrtlct)
 #define I2OLCTGET               _IOWR(I2O_MAGIC_NUMBER,2,struct i2o_cmd_hrtlct)
 #define I2OPARMSET              _IOWR(I2O_MAGIC_NUMBER,3,struct i2o_cmd_psetget)
@@ -37,7 +38,7 @@
 #define I2OSWDL                 _IOWR(I2O_MAGIC_NUMBER,5,struct i2o_sw_xfer)
 #define I2OSWUL                 _IOWR(I2O_MAGIC_NUMBER,6,struct i2o_sw_xfer)
 #define I2OSWDEL                _IOWR(I2O_MAGIC_NUMBER,7,struct i2o_sw_xfer)
-#define I2OVALIDATE             _IOR(I2O_MAGIC_NUMBER,8,u32)
+#define I2OVALIDATE             _IOR(I2O_MAGIC_NUMBER,8,__u32)
 #define I2OHTML                 _IOWR(I2O_MAGIC_NUMBER,9,struct i2o_html)
 #define I2OEVTREG               _IOW(I2O_MAGIC_NUMBER,10,struct i2o_evt_id)
 #define I2OEVTGET               _IOR(I2O_MAGIC_NUMBER,11,struct i2o_evt_info)
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 8de079ba1107..660b5010c2d9 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -1,6 +1,8 @@
 #ifndef _IF_TUNNEL_H_
 #define _IF_TUNNEL_H_
 
+#include <linux/types.h>
+
 #define SIOCGETTUNNEL   (SIOCDEVPRIVATE + 0)
 #define SIOCADDTUNNEL   (SIOCDEVPRIVATE + 1)
 #define SIOCDELTUNNEL   (SIOCDEVPRIVATE + 2)
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index bc8b4616bad7..1be148f0fce4 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -46,6 +46,7 @@ enum kvm_exit_reason {
         KVM_EXIT_HLT              = 5,
         KVM_EXIT_MMIO             = 6,
         KVM_EXIT_IRQ_WINDOW_OPEN  = 7,
+        KVM_EXIT_SHUTDOWN         = 8,
 };
 
 /* for KVM_RUN */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index e53a13ba7f78..91bb8ceef0b5 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -177,6 +177,7 @@ enum {
                                               * Register FIS clearing BSY */
         ATA_FLAG_DEBUGMSG       = (1 << 13),
         ATA_FLAG_SETXFER_POLLING= (1 << 14), /* use polling for SETXFER */
+        ATA_FLAG_IGN_SIMPLEX    = (1 << 15), /* ignore SIMPLEX */
 
         /* The following flag belongs to ap->pflags but is kept in
          * ap->flags because it's referenced in many LLDs and will be
@@ -612,11 +613,11 @@ struct ata_port_operations {
         void (*dev_select)(struct ata_port *ap, unsigned int device);
 
         void (*phy_reset) (struct ata_port *ap); /* obsolete */
-        void (*set_mode) (struct ata_port *ap);
+        int  (*set_mode) (struct ata_port *ap, struct ata_device **r_failed_dev);
 
         void (*post_set_mode) (struct ata_port *ap);
 
-        int (*check_atapi_dma) (struct ata_queued_cmd *qc);
+        int  (*check_atapi_dma) (struct ata_queued_cmd *qc);
 
         void (*bmdma_setup) (struct ata_queued_cmd *qc);
         void (*bmdma_start) (struct ata_queued_cmd *qc);
@@ -1053,6 +1054,8 @@ static inline void ata_pause(struct ata_port *ap)
 /**
  *      ata_busy_wait - Wait for a port status register
  *      @ap: Port to wait for.
+ *      @bits: bits that must be clear
+ *      @max: number of 10uS waits to perform
  *
  *      Waits up to max*10 microseconds for the selected bits in the port's
  *      status register to be cleared.
@@ -1149,7 +1152,9 @@ static inline void ata_qc_reinit(struct ata_queued_cmd *qc)
         qc->cursect = qc->cursg = qc->cursg_ofs = 0;
         qc->nsect = 0;
         qc->nbytes = qc->curbytes = 0;
+        qc->n_elem = 0;
         qc->err_mask = 0;
+        qc->pad_len = 0;
 
         ata_tf_init(qc->dev, &qc->tf);
 
diff --git a/include/linux/list.h b/include/linux/list.h
index a9c90287c0ff..611059d633f4 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -227,13 +227,13 @@ static inline void list_replace_init(struct list_head *old,
         INIT_LIST_HEAD(old);
 }
 
-/*
+/**
  * list_replace_rcu - replace old entry by new one
  * @old : the element to be replaced
  * @new : the new element to insert
  *
- * The old entry will be replaced with the new entry atomically.
- * Note: 'old' should not be empty.
+ * The @old entry will be replaced with the @new entry atomically.
+ * Note: @old should not be empty.
  */
 static inline void list_replace_rcu(struct list_head *old,
                                 struct list_head *new)
@@ -680,12 +680,12 @@ static inline void hlist_del_init(struct hlist_node *n)
         }
 }
 
-/*
+/**
  * hlist_replace_rcu - replace old entry by new one
  * @old : the element to be replaced
  * @new : the new element to insert
  *
- * The old entry will be replaced with the new entry atomically.
+ * The @old entry will be replaced with the @new entry atomically.
  */
 static inline void hlist_replace_rcu(struct hlist_node *old,
                                         struct hlist_node *new)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 76912231af41..2d2c08d5f473 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -168,6 +168,7 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_NONLINEAR    0x00800000      /* Is non-linear (remap_file_pages) */
 #define VM_MAPPED_COPY  0x01000000      /* T if mapped copy of data (nommu mmap) */
 #define VM_INSERTPAGE   0x02000000      /* The vma has had "vm_insert_page()" done on it */
+#define VM_ALWAYSDUMP   0x04000000      /* Always include in core dumps */
 
 #ifndef VM_STACK_DEFAULT_FLAGS          /* arch can override this */
 #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
diff --git a/include/linux/mtio.h b/include/linux/mtio.h
index 8c66151821e3..6f8d2d45a8fb 100644
--- a/include/linux/mtio.h
+++ b/include/linux/mtio.h
@@ -10,7 +10,6 @@
 
 #include <linux/types.h>
 #include <linux/ioctl.h>
-#include <linux/qic117.h>
 
 /*
  * Structures and definitions for mag tape io control commands
@@ -116,32 +115,6 @@ struct	mtget {
 #define MT_ISFTAPE_UNKNOWN      0x800000 /* obsolete */
 #define MT_ISFTAPE_FLAG 0x800000
 
-struct mt_tape_info {
-        long t_type;            /* device type id (mt_type) */
-        char *t_name;           /* descriptive name */
-};
-
-#define MT_TAPE_INFO    { \
-        {MT_ISUNKNOWN,          "Unknown type of tape device"}, \
-        {MT_ISQIC02,            "Generic QIC-02 tape streamer"}, \
-        {MT_ISWT5150,           "Wangtek 5150, QIC-150"}, \
-        {MT_ISARCHIVE_5945L2,   "Archive 5945L-2"}, \
-        {MT_ISCMSJ500,          "CMS Jumbo 500"}, \
-        {MT_ISTDC3610,          "Tandberg TDC 3610, QIC-24"}, \
-        {MT_ISARCHIVE_VP60I,    "Archive VP60i, QIC-02"}, \
-        {MT_ISARCHIVE_2150L,    "Archive Viper 2150L"}, \
-        {MT_ISARCHIVE_2060L,    "Archive Viper 2060L"}, \
-        {MT_ISARCHIVESC499,     "Archive SC-499 QIC-36 controller"}, \
-        {MT_ISQIC02_ALL_FEATURES, "Generic QIC-02 tape, all features"}, \
-        {MT_ISWT5099EEN24,      "Wangtek 5099-een24, 60MB"}, \
-        {MT_ISTEAC_MT2ST,       "Teac MT-2ST 155mb data cassette drive"}, \
-        {MT_ISEVEREX_FT40A,     "Everex FT40A, QIC-40"}, \
-        {MT_ISONSTREAM_SC,      "OnStream SC-, DI-, DP-, or USB tape drive"}, \
-        {MT_ISSCSI1,            "Generic SCSI-1 tape"}, \
-        {MT_ISSCSI2,            "Generic SCSI-2 tape"}, \
-        {0, NULL} \
-}
-
 
 /* structure for MTIOCPOS - mag tape get position command */
 
@@ -150,130 +123,11 @@ struct	mtpos {
 };
 
 
-/*  structure for MTIOCVOLINFO, query information about the volume
- *  currently positioned at (zftape)
- */
-struct mtvolinfo {
-        unsigned int mt_volno;   /* vol-number */
-        unsigned int mt_blksz;   /* blocksize used when recording */
-        unsigned int mt_rawsize; /* raw tape space consumed, in kb */
-        unsigned int mt_size;    /* volume size after decompression, in kb */
-        unsigned int mt_cmpr:1;  /* this volume has been compressed */
-};
-
-/* raw access to a floppy drive, read and write an arbitrary segment.
- * For ftape/zftape to support formatting etc.
- */
-#define MT_FT_RD_SINGLE  0
-#define MT_FT_RD_AHEAD   1
-#define MT_FT_WR_ASYNC   0 /* start tape only when all buffers are full     */
-#define MT_FT_WR_MULTI   1 /* start tape, continue until buffers are empty  */
-#define MT_FT_WR_SINGLE  2 /* write a single segment and stop afterwards    */
-#define MT_FT_WR_DELETE  3 /* write deleted data marks, one segment at time */
-
-struct mtftseg
-{            
-        unsigned mt_segno;   /* the segment to read or write */
-        unsigned mt_mode;    /* modes for read/write (sync/async etc.) */
-        int      mt_result;  /* result of r/w request, not of the ioctl */
-        void    __user *mt_data;    /* User space buffer: must be 29kb */
-};
-
-/* get tape capacity (ftape/zftape)
- */
-struct mttapesize {
-        unsigned long mt_capacity; /* entire, uncompressed capacity 
-                                    * of a cartridge
-                                    */
-        unsigned long mt_used;     /* what has been used so far, raw 
-                                    * uncompressed amount
-                                    */
-};
-
-/*  possible values of the ftfmt_op field
- */
-#define FTFMT_SET_PARMS         1 /* set software parms */
-#define FTFMT_GET_PARMS         2 /* get software parms */
-#define FTFMT_FORMAT_TRACK      3 /* start formatting a tape track   */
-#define FTFMT_STATUS            4 /* monitor formatting a tape track */
-#define FTFMT_VERIFY            5 /* verify the given segment        */
-
-struct ftfmtparms {
-        unsigned char  ft_qicstd;   /* QIC-40/QIC-80/QIC-3010/QIC-3020 */
-        unsigned char  ft_fmtcode;  /* Refer to the QIC specs */
-        unsigned char  ft_fhm;      /* floppy head max */
-        unsigned char  ft_ftm;      /* floppy track max */
-        unsigned short ft_spt;      /* segments per track */
-        unsigned short ft_tpc;      /* tracks per cartridge */
-};
-
-struct ftfmttrack {
-        unsigned int  ft_track;   /* track to format */
-        unsigned char ft_gap3;    /* size of gap3, for FORMAT_TRK */
-};
-
-struct ftfmtstatus {
-        unsigned int  ft_segment;  /* segment currently being formatted */
-};
-
-struct ftfmtverify {
-        unsigned int  ft_segment;   /* segment to verify */
-        unsigned long ft_bsm;       /* bsm as result of VERIFY cmd */
-};
-
-struct mtftformat {
-        unsigned int fmt_op;      /* operation to perform */
-        union fmt_arg {
-                struct ftfmtparms  fmt_parms;  /* format parameters */
-                struct ftfmttrack  fmt_track;  /* ctrl while formatting */
-                struct ftfmtstatus fmt_status;
-                struct ftfmtverify fmt_verify; /* for verifying */ 
-        } fmt_arg;
-};
-
-struct mtftcmd {
-        unsigned int ft_wait_before; /* timeout to wait for drive to get ready 
-                                      * before command is sent. Milliseconds
-                                      */
-        qic117_cmd_t ft_cmd;         /* command to send */
-        unsigned char ft_parm_cnt;   /* zero: no parm is sent. */
-        unsigned char ft_parms[3];   /* parameter(s) to send to
-                                      * the drive. The parms are nibbles
-                                      * driver sends cmd + 2 step pulses */
-        unsigned int ft_result_bits; /* if non zero, number of bits
-                                      * returned by the tape drive
-                                      */
-        unsigned int ft_result;      /* the result returned by the tape drive*/
-        unsigned int ft_wait_after;  /* timeout to wait for drive to get ready
-                                      * after command is sent. 0: don't wait */
-        int ft_status;               /* status returned by ready wait
-                                      * undefined if timeout was 0.
-                                      */
-        int ft_error;                /* error code if error status was set by 
-                                      * command
-                                      */
-};
-
 /* mag tape io control commands */
 #define MTIOCTOP        _IOW('m', 1, struct mtop)       /* do a mag tape op */
 #define MTIOCGET        _IOR('m', 2, struct mtget)      /* get tape status */
 #define MTIOCPOS        _IOR('m', 3, struct mtpos)      /* get tape position */
 
-/* The next two are used by the QIC-02 driver for runtime reconfiguration.
- * See tpqic02.h for struct mtconfiginfo.
- */
-#define MTIOCGETCONFIG  _IOR('m', 4, struct mtconfiginfo) /* get tape config */
-#define MTIOCSETCONFIG  _IOW('m', 5, struct mtconfiginfo) /* set tape config */
-
-/* the next six are used by the floppy ftape drivers and its frontends
- * sorry, but MTIOCTOP commands are write only.
- */
-#define MTIOCRDFTSEG    _IOWR('m', 6, struct mtftseg)  /* read a segment */
-#define MTIOCWRFTSEG    _IOWR('m', 7, struct mtftseg)   /* write a segment */
-#define MTIOCVOLINFO    _IOR('m',  8, struct mtvolinfo) /* info about volume */
-#define MTIOCGETSIZE    _IOR('m',  9, struct mttapesize)/* get cartridge size*/
-#define MTIOCFTFORMAT   _IOWR('m', 10, struct mtftformat) /* format ftape */
-#define MTIOCFTCMD      _IOWR('m', 11, struct mtftcmd) /* send QIC-117 cmd */
 
 /* Generic Mag Tape (device independent) status macros for examining
  * mt_gstat -- HP-UX compatible.
diff --git a/include/linux/mutex.h b/include/linux/mutex.h
index a7544afd7582..b81bc2adaeff 100644
--- a/include/linux/mutex.h
+++ b/include/linux/mutex.h
@@ -105,7 +105,7 @@ do {							\
 extern void __mutex_init(struct mutex *lock, const char *name,
                          struct lock_class_key *key);
 
-/***
+/**
  * mutex_is_locked - is the mutex locked
  * @lock: the mutex to be queried
  *
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index 4f06dad0bde9..98d566c5e32a 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -28,7 +28,7 @@
 #include <linux/netfilter/x_tables.h>
 
 #define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
-#define IPT_TABLE_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
+#define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
 #define ipt_match xt_match
 #define ipt_target xt_target
 #define ipt_table xt_table
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 04963063e620..c5d4084773e8 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -308,6 +308,7 @@ extern int nfs_attribute_timeout(struct inode *inode);
 extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
+extern int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
 extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
 extern void nfs_begin_attr_update(struct inode *);
diff --git a/include/linux/nfsd/nfsd.h b/include/linux/nfsd/nfsd.h
index 0727774772ba..4b7c4b568f6d 100644
--- a/include/linux/nfsd/nfsd.h
+++ b/include/linux/nfsd/nfsd.h
@@ -52,8 +52,6 @@
 struct readdir_cd {
         __be32                  err;    /* 0, nfserr, or nfserr_eof */
 };
-typedef int             (*encode_dent_fn)(struct readdir_cd *, const char *,
-                                                int, loff_t, ino_t, unsigned int);
 typedef int (*nfsd_dirop_t)(struct inode *, struct dentry *, int, int);
 
 extern struct svc_program       nfsd_program;
@@ -117,7 +115,7 @@ __be32		nfsd_unlink(struct svc_rqst *, struct svc_fh *, int type,
 int             nfsd_truncate(struct svc_rqst *, struct svc_fh *,
                                 unsigned long size);
 __be32          nfsd_readdir(struct svc_rqst *, struct svc_fh *,
-                             loff_t *, struct readdir_cd *, encode_dent_fn);
+                             loff_t *, struct readdir_cd *, filldir_t);
 __be32          nfsd_statfs(struct svc_rqst *, struct svc_fh *,
                                 struct kstatfs *);
 
diff --git a/include/linux/nfsd/nfsfh.h b/include/linux/nfsd/nfsfh.h
index f3b51d62ec7d..d9c6c382165d 100644
--- a/include/linux/nfsd/nfsfh.h
+++ b/include/linux/nfsd/nfsfh.h
@@ -217,11 +217,7 @@ void	fh_put(struct svc_fh *);
 static __inline__ struct svc_fh *
 fh_copy(struct svc_fh *dst, struct svc_fh *src)
 {
-        if (src->fh_dentry || src->fh_locked) {
-                struct dentry *dentry = src->fh_dentry;
-                printk(KERN_ERR "fh_copy: copying %s/%s, already verified!\n",
-                        dentry->d_parent->d_name.name, dentry->d_name.name);
-        }
+        WARN_ON(src->fh_dentry || src->fh_locked);
                         
         *dst = *src;
         return dst;
@@ -300,10 +296,8 @@ fh_lock_nested(struct svc_fh *fhp, unsigned int subclass)
         dfprintk(FILEOP, "nfsd: fh_lock(%s) locked = %d\n",
                         SVCFH_fmt(fhp), fhp->fh_locked);
 
-        if (!fhp->fh_dentry) {
-                printk(KERN_ERR "fh_lock: fh not verified!\n");
-                return;
-        }
+        BUG_ON(!dentry);
+
         if (fhp->fh_locked) {
                 printk(KERN_WARNING "fh_lock: %s/%s already locked!\n",
                         dentry->d_parent->d_name.name, dentry->d_name.name);
@@ -328,8 +322,7 @@ fh_lock(struct svc_fh *fhp)
 static inline void
 fh_unlock(struct svc_fh *fhp)
 {
-        if (!fhp->fh_dentry)
-                printk(KERN_ERR "fh_unlock: fh not verified!\n");
+        BUG_ON(!fhp->fh_dentry);
 
         if (fhp->fh_locked) {
                 fill_post_wcc(fhp);
diff --git a/include/linux/nfsd/xdr.h b/include/linux/nfsd/xdr.h
index 877192d3ae79..67885d5e6e50 100644
--- a/include/linux/nfsd/xdr.h
+++ b/include/linux/nfsd/xdr.h
@@ -165,8 +165,8 @@ int nfssvc_encode_readres(struct svc_rqst *, __be32 *, struct nfsd_readres *);
 int nfssvc_encode_statfsres(struct svc_rqst *, __be32 *, struct nfsd_statfsres *);
 int nfssvc_encode_readdirres(struct svc_rqst *, __be32 *, struct nfsd_readdirres *);
 
-int nfssvc_encode_entry(struct readdir_cd *, const char *name,
-                                int namlen, loff_t offset, ino_t ino, unsigned int);
+int nfssvc_encode_entry(void *, const char *name,
+                        int namlen, loff_t offset, u64 ino, unsigned int);
 
 int nfssvc_release_fhandle(struct svc_rqst *, __be32 *, struct nfsd_fhandle *);
 
diff --git a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
index 79963867b0d7..89d9d6061a62 100644
--- a/include/linux/nfsd/xdr3.h
+++ b/include/linux/nfsd/xdr3.h
@@ -331,11 +331,11 @@ int nfs3svc_release_fhandle(struct svc_rqst *, __be32 *,
                                 struct nfsd3_attrstat *);
 int nfs3svc_release_fhandle2(struct svc_rqst *, __be32 *,
                                 struct nfsd3_fhandle_pair *);
-int nfs3svc_encode_entry(struct readdir_cd *, const char *name,
-                                int namlen, loff_t offset, ino_t ino,
+int nfs3svc_encode_entry(void *, const char *name,
+                                int namlen, loff_t offset, u64 ino,
                                 unsigned int);
-int nfs3svc_encode_entry_plus(struct readdir_cd *, const char *name,
-                                int namlen, loff_t offset, ino_t ino,
+int nfs3svc_encode_entry_plus(void *, const char *name,
+                                int namlen, loff_t offset, u64 ino,
                                 unsigned int);
 /* Helper functions for NFSv3 ACL code */
 __be32 *nfs3svc_encode_post_op_attr(struct svc_rqst *rqstp, __be32 *p,
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index f7a416c52edc..3d1d21035dec 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1277,13 +1277,13 @@
 #define PCI_DEVICE_ID_VIA_3296_0        0x0296
 #define PCI_DEVICE_ID_VIA_8363_0        0x0305
 #define PCI_DEVICE_ID_VIA_P4M800CE      0x0314
-#define PCI_DEVICE_ID_VIA_K8M890CE      0x0336
+#define PCI_DEVICE_ID_VIA_P4M890        0x0327
+#define PCI_DEVICE_ID_VIA_VT3336        0x0336
 #define PCI_DEVICE_ID_VIA_8371_0        0x0391
 #define PCI_DEVICE_ID_VIA_8501_0        0x0501
 #define PCI_DEVICE_ID_VIA_82C561        0x0561
 #define PCI_DEVICE_ID_VIA_82C586_1      0x0571
 #define PCI_DEVICE_ID_VIA_82C576        0x0576
-#define PCI_DEVICE_ID_VIA_SATA_EIDE     0x0581
 #define PCI_DEVICE_ID_VIA_82C586_0      0x0586
 #define PCI_DEVICE_ID_VIA_82C596        0x0596
 #define PCI_DEVICE_ID_VIA_82C597_0      0x0597
@@ -1326,6 +1326,8 @@
 #define PCI_DEVICE_ID_VIA_8237          0x3227
 #define PCI_DEVICE_ID_VIA_8251          0x3287
 #define PCI_DEVICE_ID_VIA_8237A         0x3337
+#define PCI_DEVICE_ID_VIA_8237S         0x3372
+#define PCI_DEVICE_ID_VIA_SATA_EIDE     0x5324
 #define PCI_DEVICE_ID_VIA_8231          0x8231
 #define PCI_DEVICE_ID_VIA_8231_4        0x8235
 #define PCI_DEVICE_ID_VIA_8365_1        0x8305
diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h
index d2a9d419f01f..2833806d42c6 100644
--- a/include/linux/pid_namespace.h
+++ b/include/linux/pid_namespace.h
@@ -39,7 +39,7 @@ static inline void put_pid_ns(struct pid_namespace *ns)
 
 static inline struct task_struct *child_reaper(struct task_struct *tsk)
 {
-        return tsk->nsproxy->pid_ns->child_reaper;
+        return init_pid_ns.child_reaper;
 }
 
 #endif /* _LINUX_PID_NS_H */
diff --git a/include/linux/qic117.h b/include/linux/qic117.h
deleted file mode 100644
index 07b537e5d359..000000000000
--- a/include/linux/qic117.h
+++ /dev/null
@@ -1,290 +0,0 @@
-#ifndef _QIC117_H
-#define _QIC117_H
-
-/*
- *      Copyright (C) 1993-1996 Bas Laarhoven,
- *                (C) 1997      Claus-Justus Heine.
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2, or (at your option)
- any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; see the file COPYING.  If not, write to
- the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
-
- *
- * $Source: /homes/cvs/ftape-stacked/include/linux/qic117.h,v $
- * $Revision: 1.2 $
- * $Date: 1997/10/05 19:19:32 $
- *
- *      This file contains QIC-117 spec. related definitions for the
- *      QIC-40/80/3010/3020 floppy-tape driver "ftape" for Linux.
- *
- *      These data were taken from the Quarter-Inch Cartridge
- *      Drive Standards, Inc. document titled:
- *      `Common Command Set Interface Specification for Flexible
- *       Disk Controller Based Minicartridge Tape Drives'
- *       document QIC-117 Revision J, 28 Aug 96.
- *      For more information, contact:
- *       Quarter-Inch Cartridge Drive Standards, Inc.
- *       311 East Carrillo Street
- *       Santa Barbara, California 93101
- *       Telephone (805) 963-3853
- *       Fax       (805) 962-1541
- *       WWW       http://www.qic.org
- *
- *      Current QIC standard revisions (of interest) are:
- *       QIC-40-MC,   Rev. M,  2 Sep 92.
- *       QIC-80-MC,   Rev. N, 20 Mar 96.
- *       QIC-80-MC,   Rev. K, 15 Dec 94.
- *       QIC-113,     Rev. G, 15 Jun 95.
- *       QIC-117,     Rev. J, 28 Aug 96.
- *       QIC-122,     Rev. B,  6 Mar 91.
- *       QIC-130,     Rev. C,  2 Sep 92.
- *       QIC-3010-MC, Rev. F, 14 Jun 95.
- *       QIC-3020-MC, Rev. G, 31 Aug 95.
- *       QIC-CRF3,    Rev. B, 15 Jun 95.
- * */
-
-/*
- *      QIC-117 common command set rev. J.
- *      These commands are sent to the tape unit
- *      as number of pulses over the step line.
- */
-
-typedef enum {
-        QIC_NO_COMMAND                  = 0,
-        QIC_RESET                       = 1,
-        QIC_REPORT_NEXT_BIT             = 2,
-        QIC_PAUSE                       = 3,
-        QIC_MICRO_STEP_PAUSE            = 4,
-        QIC_ALTERNATE_TIMEOUT           = 5,
-        QIC_REPORT_DRIVE_STATUS         = 6,
-        QIC_REPORT_ERROR_CODE           = 7,
-        QIC_REPORT_DRIVE_CONFIGURATION  = 8,
-        QIC_REPORT_ROM_VERSION          = 9,
-        QIC_LOGICAL_FORWARD             = 10,
-        QIC_PHYSICAL_REVERSE            = 11,
-        QIC_PHYSICAL_FORWARD            = 12,
-        QIC_SEEK_HEAD_TO_TRACK          = 13,
-        QIC_SEEK_LOAD_POINT             = 14,
-        QIC_ENTER_FORMAT_MODE           = 15,
-        QIC_WRITE_REFERENCE_BURST       = 16,
-        QIC_ENTER_VERIFY_MODE           = 17,
-        QIC_STOP_TAPE                   = 18,
-/* commands 19-20: reserved */
-        QIC_MICRO_STEP_HEAD_UP          = 21,
-        QIC_MICRO_STEP_HEAD_DOWN        = 22,
-        QIC_SOFT_SELECT                 = 23,
-        QIC_SOFT_DESELECT               = 24,
-        QIC_SKIP_REVERSE                = 25,
-        QIC_SKIP_FORWARD                = 26,
-        QIC_SELECT_RATE                 = 27,
-/* command 27, in ccs2: Select Rate or Format */
-        QIC_ENTER_DIAGNOSTIC_1          = 28,
-        QIC_ENTER_DIAGNOSTIC_2          = 29,
-        QIC_ENTER_PRIMARY_MODE          = 30,
-/* command 31: vendor unique */
-        QIC_REPORT_VENDOR_ID            = 32,
-        QIC_REPORT_TAPE_STATUS          = 33,
-        QIC_SKIP_EXTENDED_REVERSE       = 34,
-        QIC_SKIP_EXTENDED_FORWARD       = 35,
-        QIC_CALIBRATE_TAPE_LENGTH       = 36,
-        QIC_REPORT_FORMAT_SEGMENTS      = 37,
-        QIC_SET_FORMAT_SEGMENTS         = 38,
-/* commands 39-45: reserved */
-        QIC_PHANTOM_SELECT              = 46,
-        QIC_PHANTOM_DESELECT            = 47
-} qic117_cmd_t;
-
-typedef enum {
-        discretional = 0, required, ccs1, ccs2
-} qic_compatibility;
-
-typedef enum {
-        unused, mode, motion, report
-} command_types;
-
-struct qic117_command_table {
-        char *name;
-        __u8 mask;
-        __u8 state;
-        __u8 cmd_type;
-        __u8 non_intr;
-        __u8 level;
-};
-
-#define QIC117_COMMANDS {\
-/* command                           mask  state cmd_type           */\
-/* |    name                         |     |     |       non_intr   */\
-/* |    |                            |     |     |       |  level   */\
-/* 0*/ {NULL,                        0x00, 0x00, mode,   0, discretional},\
-/* 1*/ {"soft reset",                0x00, 0x00, motion, 1, required},\
-/* 2*/ {"report next bit",           0x00, 0x00, report, 0, required},\
-/* 3*/ {"pause",                     0x36, 0x24, motion, 1, required},\
-/* 4*/ {"micro step pause",          0x36, 0x24, motion, 1, required},\
-/* 5*/ {"alternate command timeout", 0x00, 0x00, mode,   0, required},\
-/* 6*/ {"report drive status",       0x00, 0x00, report, 0, required},\
-/* 7*/ {"report error code",         0x01, 0x01, report, 0, required},\
-/* 8*/ {"report drive configuration",0x00, 0x00, report, 0, required},\
-/* 9*/ {"report rom version",        0x00, 0x00, report, 0, required},\
-/*10*/ {"logical forward",           0x37, 0x25, motion, 0, required},\
-/*11*/ {"physical reverse",          0x17, 0x05, motion, 0, required},\
-/*12*/ {"physical forward",          0x17, 0x05, motion, 0, required},\
-/*13*/ {"seek head to track",        0x37, 0x25, motion, 0, required},\
-/*14*/ {"seek load point",           0x17, 0x05, motion, 1, required},\
-/*15*/ {"enter format mode",         0x1f, 0x05, mode,   0, required},\
-/*16*/ {"write reference burst",     0x1f, 0x05, motion, 1, required},\
-/*17*/ {"enter verify mode",         0x37, 0x25, mode,   0, required},\
-/*18*/ {"stop tape",                 0x00, 0x00, motion, 1, required},\
-/*19*/ {"reserved (19)",             0x00, 0x00, unused, 0, discretional},\
-/*20*/ {"reserved (20)",             0x00, 0x00, unused, 0, discretional},\
-/*21*/ {"micro step head up",        0x02, 0x00, motion, 0, required},\
-/*22*/ {"micro step head down",      0x02, 0x00, motion, 0, required},\
-/*23*/ {"soft select",               0x00, 0x00, mode,   0, discretional},\
-/*24*/ {"soft deselect",             0x00, 0x00, mode,   0, discretional},\
-/*25*/ {"skip segments reverse",     0x36, 0x24, motion, 1, required},\
-/*26*/ {"skip segments forward",     0x36, 0x24, motion, 1, required},\
-/*27*/ {"select rate or format",     0x03, 0x01, mode,   0, required /* [ccs2] */},\
-/*28*/ {"enter diag mode 1",         0x00, 0x00, mode,   0, discretional},\
-/*29*/ {"enter diag mode 2",         0x00, 0x00, mode,   0, discretional},\
-/*30*/ {"enter primary mode",        0x00, 0x00, mode,   0, required},\
-/*31*/ {"vendor unique (31)",        0x00, 0x00, unused, 0, discretional},\
-/*32*/ {"report vendor id",          0x00, 0x00, report, 0, required},\
-/*33*/ {"report tape status",        0x04, 0x04, report, 0, ccs1},\
-/*34*/ {"skip extended reverse",     0x36, 0x24, motion, 1, ccs1},\
-/*35*/ {"skip extended forward",     0x36, 0x24, motion, 1, ccs1},\
-/*36*/ {"calibrate tape length",     0x17, 0x05, motion, 1, ccs2},\
-/*37*/ {"report format segments",    0x17, 0x05, report, 0, ccs2},\
-/*38*/ {"set format segments",       0x17, 0x05, mode,   0, ccs2},\
-/*39*/ {"reserved (39)",             0x00, 0x00, unused, 0, discretional},\
-/*40*/ {"vendor unique (40)",        0x00, 0x00, unused, 0, discretional},\
-/*41*/ {"vendor unique (41)",        0x00, 0x00, unused, 0, discretional},\
-/*42*/ {"vendor unique (42)",        0x00, 0x00, unused, 0, discretional},\
-/*43*/ {"vendor unique (43)",        0x00, 0x00, unused, 0, discretional},\
-/*44*/ {"vendor unique (44)",        0x00, 0x00, unused, 0, discretional},\
-/*45*/ {"vendor unique (45)",        0x00, 0x00, unused, 0, discretional},\
-/*46*/ {"phantom select",            0x00, 0x00, mode,   0, discretional},\
-/*47*/ {"phantom deselect",          0x00, 0x00, mode,   0, discretional},\
-}
-
-/*
- *      Status bits returned by QIC_REPORT_DRIVE_STATUS
- */
-
-#define QIC_STATUS_READY        0x01    /* Drive is ready or idle. */
-#define QIC_STATUS_ERROR        0x02    /* Error detected, must read
-                                           error code to clear this */
-#define QIC_STATUS_CARTRIDGE_PRESENT 0x04       /* Tape is present */
-#define QIC_STATUS_WRITE_PROTECT 0x08   /* Tape is write protected */
-#define QIC_STATUS_NEW_CARTRIDGE 0x10   /* New cartridge inserted, must
-                                           read error status to clear. */
-#define QIC_STATUS_REFERENCED   0x20    /* Cartridge appears to have been
-                                           formatted. */
-#define QIC_STATUS_AT_BOT       0x40    /* Cartridge is at physical
-                                           beginning of tape. */
-#define QIC_STATUS_AT_EOT       0x80    /* Cartridge is at physical end
-                                           of tape. */
-/*
- *      Status bits returned by QIC_REPORT_DRIVE_CONFIGURATION
- */
-
-#define QIC_CONFIG_RATE_MASK    0x18
-#define QIC_CONFIG_RATE_SHIFT   3
-#define QIC_CONFIG_RATE_250     0
-#define QIC_CONFIG_RATE_500     2
-#define QIC_CONFIG_RATE_1000    3
-#define QIC_CONFIG_RATE_2000    1
-#define QIC_CONFIG_RATE_4000    0       /* since QIC-117 Rev. J */
-
-#define QIC_CONFIG_LONG         0x40    /* Extra Length Tape Detected */
-#define QIC_CONFIG_80           0x80    /* QIC-80 detected. */
-
-/*
- *      Status bits returned by QIC_REPORT_TAPE_STATUS
- */
-
-#define QIC_TAPE_STD_MASK       0x0f
-#define QIC_TAPE_QIC40          0x01
-#define QIC_TAPE_QIC80          0x02
-#define QIC_TAPE_QIC3020        0x03
-#define QIC_TAPE_QIC3010        0x04
-
-#define QIC_TAPE_LEN_MASK       0x70
-#define QIC_TAPE_205FT          0x10
-#define QIC_TAPE_307FT          0x20
-#define QIC_TAPE_VARIABLE       0x30
-#define QIC_TAPE_1100FT         0x40
-#define QIC_TAPE_FLEX           0x60
-
-#define QIC_TAPE_WIDE           0x80
-
-/* Define a value (in feet) slightly higher than 
- * the possible maximum tape length.
- */
-#define QIC_TOP_TAPE_LEN        1500
-
-/*
- *      Errors: List of error codes, and their severity.
- */
-
-typedef struct {
-        char *message;          /* Text describing the error. */
-        unsigned int fatal:1;   /* Non-zero if the error is fatal. */
-} ftape_error;
-
-#define QIC117_ERRORS {\
-  /* 0*/ { "No error", 0, },\
-  /* 1*/ { "Command Received while Drive Not Ready", 0, },\
-  /* 2*/ { "Cartridge Not Present or Removed", 1, },\
-  /* 3*/ { "Motor Speed Error (not within 1%)", 1, },\
-  /* 4*/ { "Motor Speed Fault (jammed, or gross speed error", 1, },\
-  /* 5*/ { "Cartridge Write Protected", 1, },\
-  /* 6*/ { "Undefined or Reserved Command Code", 1, },\
-  /* 7*/ { "Illegal Track Address Specified for Seek", 1, },\
-  /* 8*/ { "Illegal Command in Report Subcontext", 0, },\
-  /* 9*/ { "Illegal Entry into a Diagnostic Mode", 1, },\
-  /*10*/ { "Broken Tape Detected (based on hole sensor)", 1, },\
-  /*11*/ { "Warning--Read Gain Setting Error", 1, },\
-  /*12*/ { "Command Received While Error Status Pending (obs)", 1, },\
-  /*13*/ { "Command Received While New Cartridge Pending", 1, },\
-  /*14*/ { "Command Illegal or Undefined in Primary Mode", 1, },\
-  /*15*/ { "Command Illegal or Undefined in Format Mode", 1, },\
-  /*16*/ { "Command Illegal or Undefined in Verify Mode", 1, },\
-  /*17*/ { "Logical Forward Not at Logical BOT or no Format Segments in Format Mode", 1, },\
-  /*18*/ { "Logical EOT Before All Segments generated", 1, },\
-  /*19*/ { "Command Illegal When Cartridge Not Referenced", 1, },\
-  /*20*/ { "Self-Diagnostic Failed (cannot be cleared)", 1, },\
-  /*21*/ { "Warning EEPROM Not Initialized, Defaults Set", 1, },\
-  /*22*/ { "EEPROM Corrupted or Hardware Failure", 1, },\
-  /*23*/ { "Motion Time-out Error", 1, },\
-  /*24*/ { "Data Segment Too Long -- Logical Forward or Pause", 1, },\
-  /*25*/ { "Transmit Overrun (obs)", 1, },\
-  /*26*/ { "Power On Reset Occurred", 0, },\
-  /*27*/ { "Software Reset Occurred", 0, },\
-  /*28*/ { "Diagnostic Mode 1 Error", 1, },\
-  /*29*/ { "Diagnostic Mode 2 Error", 1, },\
-  /*30*/ { "Command Received During Non-Interruptible Process", 1, },\
-  /*31*/ { "Rate or Format Selection Error", 1, },\
-  /*32*/ { "Illegal Command While in High Speed Mode", 1, },\
-  /*33*/ { "Illegal Seek Segment Value", 1, },\
-  /*34*/ { "Invalid Media", 1, },\
-  /*35*/ { "Head Positioning Failure", 1, },\
-  /*36*/ { "Write Reference Burst Failure", 1, },\
-  /*37*/ { "Prom Code Missing", 1, },\
-  /*38*/ { "Invalid Format", 1, },\
-  /*39*/ { "EOT/BOT System Failure", 1, },\
-  /*40*/ { "Prom A Checksum Error", 1, },\
-  /*41*/ { "Drive Wakeup Reset Occurred", 1, },\
-  /*42*/ { "Prom B Checksum Error", 1, },\
-  /*43*/ { "Illegal Entry into Format Mode", 1, },\
-}
-
-#endif                          /* _QIC117_H */
diff --git a/include/linux/raid/md.h b/include/linux/raid/md.h
index 866a1e2b0ce0..fbaeda79b2e9 100644
--- a/include/linux/raid/md.h
+++ b/include/linux/raid/md.h
@@ -94,7 +94,7 @@ extern int sync_page_io(struct block_device *bdev, sector_t sector, int size,
                         struct page *page, int rw);
 extern void md_do_sync(mddev_t *mddev);
 extern void md_new_event(mddev_t *mddev);
-
+extern void md_allow_write(mddev_t *mddev);
 
 #endif /* CONFIG_MD */
 #endif 
diff --git a/include/linux/reiserfs_fs_i.h b/include/linux/reiserfs_fs_i.h
index 5b3b297aa2c5..ce3663fb0101 100644
--- a/include/linux/reiserfs_fs_i.h
+++ b/include/linux/reiserfs_fs_i.h
@@ -25,6 +25,7 @@ typedef enum {
         i_link_saved_truncate_mask = 0x0020,
         i_has_xattr_dir = 0x0040,
         i_data_log = 0x0080,
+        i_ever_mapped = 0x0100
 } reiserfs_inode_flags;
 
 struct reiserfs_inode_info {
@@ -52,6 +53,7 @@ struct reiserfs_inode_info {
          ** flushed */
         unsigned long i_trans_id;
         struct reiserfs_journal_list *i_jl;
+        struct mutex i_mmap;
 #ifdef CONFIG_REISERFS_FS_POSIX_ACL
         struct posix_acl *i_acl_access;
         struct posix_acl *i_acl_default;
diff --git a/include/linux/rtmutex.h b/include/linux/rtmutex.h
index b0090e9f7884..382bb7951166 100644
--- a/include/linux/rtmutex.h
+++ b/include/linux/rtmutex.h
@@ -16,7 +16,7 @@
 #include <linux/plist.h>
 #include <linux/spinlock_types.h>
 
-/*
+/**
  * The rt_mutex structure
  *
  * @wait_lock:  spinlock to protect the structure
@@ -71,7 +71,7 @@ struct hrtimer_sleeper;
 #define DEFINE_RT_MUTEX(mutexname) \
         struct rt_mutex mutexname = __RT_MUTEX_INITIALIZER(mutexname)
 
-/***
+/**
  * rt_mutex_is_locked - is the mutex locked
  * @lock: the mutex to be queried
  *
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 97c761652581..8b6ce60ea057 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -250,7 +250,6 @@ void		rpc_init_task(struct rpc_task *task, struct rpc_clnt *clnt,
                                 int flags, const struct rpc_call_ops *ops,
                                 void *data);
 void            rpc_put_task(struct rpc_task *);
-void            rpc_release_task(struct rpc_task *);
 void            rpc_exit_task(struct rpc_task *);
 void            rpc_release_calldata(const struct rpc_call_ops *, void *);
 void            rpc_killall_tasks(struct rpc_clnt *);
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 965d6c20086e..64f3d60c72af 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -144,8 +144,11 @@ extern u32 svc_max_payload(const struct svc_rqst *rqstp);
  *
  * Each request/reply pair can have at most one "payload", plus two pages,
  * one for the request, and one for the reply.
+ * We using ->sendfile to return read data, we might need one extra page
+ * if the request is not page-aligned.  So add another '1'.
  */
-#define RPCSVC_MAXPAGES         ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE + 2)
+#define RPCSVC_MAXPAGES         ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE \
+                                + 2 + 1)
 
 static inline u32 svc_getnl(struct kvec *iov)
 {
diff --git a/include/linux/timer.h b/include/linux/timer.h
index eeef6643d4c6..fb5edaaf0ebd 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -41,7 +41,7 @@ static inline void setup_timer(struct timer_list * timer,
         init_timer(timer);
 }
 
-/***
+/**
  * timer_pending - is a timer pending?
  * @timer: the timer in question
  *
@@ -63,7 +63,7 @@ extern int mod_timer(struct timer_list *timer, unsigned long expires);
 
 extern unsigned long next_timer_interrupt(void);
 
-/***
+/**
  * add_timer - start a timer
  * @timer: the timer to be added
  *
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index 16aa96a6a53b..f13ddc2543b1 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -38,5 +38,5 @@ extern void inet6_csk_reqsk_queue_hash_add(struct sock *sk,
 
 extern void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr);
 
-extern int inet6_csk_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok);
+extern int inet6_csk_xmit(struct sk_buff *skb, int ipfragok);
 #endif /* _INET6_CONNECTION_SOCK_H */
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index bf16d98d372c..133cf30d2d79 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -37,8 +37,7 @@ struct tcp_congestion_ops;
  * (i.e. things that depend on the address family)
  */
 struct inet_connection_sock_af_ops {
-        int         (*queue_xmit)(struct sk_buff *skb, struct sock *sk,
-                                  int ipfragok);
+        int         (*queue_xmit)(struct sk_buff *skb, int ipfragok);
         void        (*send_check)(struct sock *sk, int len,
                                   struct sk_buff *skb);
         int         (*rebuild_header)(struct sock *sk);
diff --git a/include/net/ip.h b/include/net/ip.h
index 053f02b5cb89..e79c3e3aa4f6 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -97,7 +97,7 @@ extern int		ip_mc_output(struct sk_buff *skb);
 extern int              ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 extern int              ip_do_nat(struct sk_buff *skb);
 extern void             ip_send_check(struct iphdr *ip);
-extern int              ip_queue_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok);
+extern int              ip_queue_xmit(struct sk_buff *skb, int ipfragok);
 extern void             ip_init(void);
 extern int              ip_append_data(struct sock *sk,
                                        int getfrag(void *from, char *to, int offset, int len,
diff --git a/include/net/netfilter/nf_conntrack_compat.h b/include/net/netfilter/nf_conntrack_compat.h
index b9ce5c80d9d5..6f84c1f7fcd4 100644
--- a/include/net/netfilter/nf_conntrack_compat.h
+++ b/include/net/netfilter/nf_conntrack_compat.h
@@ -6,6 +6,7 @@
 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
 
 #include <linux/netfilter_ipv4/ip_conntrack.h>
+#include <linux/socket.h>
 
 #ifdef CONFIG_IP_NF_CONNTRACK_MARK
 static inline u_int32_t *nf_ct_get_mark(const struct sk_buff *skb,
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 3269ed1cc222..73cb9943c8a8 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -134,6 +134,7 @@ sctp_state_fn_t sctp_sf_violation;
 sctp_state_fn_t sctp_sf_discard_chunk;
 sctp_state_fn_t sctp_sf_do_5_2_1_siminit;
 sctp_state_fn_t sctp_sf_do_5_2_2_dupinit;
+sctp_state_fn_t sctp_sf_do_5_2_3_initack;
 sctp_state_fn_t sctp_sf_do_5_2_4_dupcook;
 sctp_state_fn_t sctp_sf_unk_chunk;
 sctp_state_fn_t sctp_sf_do_8_5_1_E_sa;
diff --git a/include/sound/core.h b/include/sound/core.h
index a994bea09cd6..521f036cce99 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -132,8 +132,10 @@ struct snd_card {
         int shutdown;                   /* this card is going down */
         int free_on_last_close;         /* free in context of file_release */
         wait_queue_head_t shutdown_sleep;
-        struct device *parent;
-        struct device *dev;
+        struct device *dev;             /* device assigned to this card */
+#ifndef CONFIG_SYSFS_DEPRECATED
+        struct device *card_dev;        /* cardX object for sysfs */
+#endif
 
 #ifdef CONFIG_PM
         unsigned int power_state;       /* power state */
@@ -191,6 +193,16 @@ struct snd_minor {
         struct device *dev;             /* device for sysfs */
 };
 
+/* return a device pointer linked to each sound device as a parent */
+static inline struct device *snd_card_get_device_link(struct snd_card *card)
+{
+#ifdef CONFIG_SYSFS_DEPRECATED
+        return card ? card->dev : NULL;
+#else
+        return card ? card->card_dev : NULL;
+#endif
+}
+
 /* sound.c */
 
 extern int snd_major;
@@ -257,7 +269,7 @@ int snd_card_file_add(struct snd_card *card, struct file *file);
 int snd_card_file_remove(struct snd_card *card, struct file *file);
 
 #ifndef snd_card_set_dev
-#define snd_card_set_dev(card,devptr) ((card)->parent = (devptr))
+#define snd_card_set_dev(card,devptr) ((card)->dev = (devptr))
 #endif
 
 /* device.c */
diff --git a/ipc/shm.c b/ipc/shm.c
index 6d16bb6de7d2..f8e10a25ad7d 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -279,7 +279,7 @@ static int newseg (struct ipc_namespace *ns, key_t key, int shmflg, size_t size)
         if (size < SHMMIN || size > ns->shm_ctlmax)
                 return -EINVAL;
 
-        if (ns->shm_tot + numpages >= ns->shm_ctlall)
+        if (ns->shm_tot + numpages > ns->shm_ctlall)
                 return -ENOSPC;
 
         shp = ipc_rcu_alloc(sizeof(*shp));
diff --git a/kernel/exit.c b/kernel/exit.c
index 35401720635b..fec12eb12471 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -938,8 +938,8 @@ fastcall NORET_TYPE void do_exit(long code)
 
         tsk->exit_code = code;
         proc_exit_connector(tsk);
-        exit_notify(tsk);
         exit_task_namespaces(tsk);
+        exit_notify(tsk);
 #ifdef CONFIG_NUMA
         mpol_free(tsk->mempolicy);
         tsk->mempolicy = NULL;
diff --git a/kernel/fork.c b/kernel/fork.c
index fc723e595cd5..d57118da73ff 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1313,7 +1313,7 @@ noinline struct pt_regs * __devinit __attribute__((weak)) idle_regs(struct pt_re
         return regs;
 }
 
-struct task_struct * __devinit fork_idle(int cpu)
+struct task_struct * __cpuinit fork_idle(int cpu)
 {
         struct task_struct *task;
         struct pt_regs regs;
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index b385878c6e80..8b961adc3bd2 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -315,6 +315,9 @@ int setup_irq(unsigned int irq, struct irqaction *new)
                         /* Undo nested disables: */
                         desc->depth = 1;
         }
+        /* Reset broken irq detection when installing new handler */
+        desc->irq_count = 0;
+        desc->irqs_unhandled = 0;
         spin_unlock_irqrestore(&desc->lock, flags);
 
         new->irq = irq;
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 17ec4afb0994..6fcf8dd148d0 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -87,6 +87,12 @@ struct kprobe_insn_page {
         int ngarbage;
 };
 
+enum kprobe_slot_state {
+        SLOT_CLEAN = 0,
+        SLOT_DIRTY = 1,
+        SLOT_USED = 2,
+};
+
 static struct hlist_head kprobe_insn_pages;
 static int kprobe_garbage_slots;
 static int collect_garbage_slots(void);
@@ -130,8 +136,8 @@ kprobe_opcode_t __kprobes *get_insn_slot(void)
                 if (kip->nused < INSNS_PER_PAGE) {
                         int i;
                         for (i = 0; i < INSNS_PER_PAGE; i++) {
-                                if (!kip->slot_used[i]) {
-                                        kip->slot_used[i] = 1;
+                                if (kip->slot_used[i] == SLOT_CLEAN) {
+                                        kip->slot_used[i] = SLOT_USED;
                                         kip->nused++;
                                         return kip->insns + (i * MAX_INSN_SIZE);
                                 }
@@ -163,8 +169,8 @@ kprobe_opcode_t __kprobes *get_insn_slot(void)
         }
         INIT_HLIST_NODE(&kip->hlist);
         hlist_add_head(&kip->hlist, &kprobe_insn_pages);
-        memset(kip->slot_used, 0, INSNS_PER_PAGE);
-        kip->slot_used[0] = 1;
+        memset(kip->slot_used, SLOT_CLEAN, INSNS_PER_PAGE);
+        kip->slot_used[0] = SLOT_USED;
         kip->nused = 1;
         kip->ngarbage = 0;
         return kip->insns;
@@ -173,7 +179,7 @@ kprobe_opcode_t __kprobes *get_insn_slot(void)
 /* Return 1 if all garbages are collected, otherwise 0. */
 static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
 {
-        kip->slot_used[idx] = 0;
+        kip->slot_used[idx] = SLOT_CLEAN;
         kip->nused--;
         if (kip->nused == 0) {
                 /*
@@ -212,7 +218,7 @@ static int __kprobes collect_garbage_slots(void)
                         continue;
                 kip->ngarbage = 0;      /* we will collect all garbages */
                 for (i = 0; i < INSNS_PER_PAGE; i++) {
-                        if (kip->slot_used[i] == -1 &&
+                        if (kip->slot_used[i] == SLOT_DIRTY &&
                             collect_one_slot(kip, i))
                                 break;
                 }
@@ -232,7 +238,7 @@ void __kprobes free_insn_slot(kprobe_opcode_t * slot, int dirty)
                     slot < kip->insns + (INSNS_PER_PAGE * MAX_INSN_SIZE)) {
                         int i = (slot - kip->insns) / MAX_INSN_SIZE;
                         if (dirty) {
-                                kip->slot_used[i] = -1;
+                                kip->slot_used[i] = SLOT_DIRTY;
                                 kip->ngarbage++;
                         } else {
                                 collect_one_slot(kip, i);
diff --git a/kernel/pid.c b/kernel/pid.c
index 2efe9d8d367b..78f2aee90f54 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -197,7 +197,7 @@ fastcall void free_pid(struct pid *pid)
         hlist_del_rcu(&pid->pid_chain);
         spin_unlock_irqrestore(&pidmap_lock, flags);
 
-        free_pidmap(current->nsproxy->pid_ns, pid->nr);
+        free_pidmap(&init_pid_ns, pid->nr);
         call_rcu(&pid->rcu, delayed_put_pid);
 }
 
diff --git a/kernel/profile.c b/kernel/profile.c
index a6574a18514e..d6579d511069 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -331,7 +331,6 @@ out:
         local_irq_restore(flags);
         put_cpu();
 }
-EXPORT_SYMBOL_GPL(profile_hits);
 
 static int __devinit profile_cpu_callback(struct notifier_block *info,
                                         unsigned long action, void *__cpu)
@@ -401,6 +400,8 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
 }
 #endif /* !CONFIG_SMP */
 
+EXPORT_SYMBOL_GPL(profile_hits);
+
 void profile_tick(int type)
 {
         struct pt_regs *regs = get_irq_regs();
diff --git a/kernel/sys.c b/kernel/sys.c
index c7675c1bfdf2..6e2101dec0fc 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -323,11 +323,18 @@ EXPORT_SYMBOL_GPL(blocking_notifier_chain_unregister);
 int blocking_notifier_call_chain(struct blocking_notifier_head *nh,
                 unsigned long val, void *v)
 {
-        int ret;
+        int ret = NOTIFY_DONE;
 
-        down_read(&nh->rwsem);
-        ret = notifier_call_chain(&nh->head, val, v);
-        up_read(&nh->rwsem);
+        /*
+         * We check the head outside the lock, but if this access is
+         * racy then it does not matter what the result of the test
+         * is, we re-check the list after having taken the lock anyway:
+         */
+        if (rcu_dereference(nh->head)) {
+                down_read(&nh->rwsem);
+                ret = notifier_call_chain(&nh->head, val, v);
+                up_read(&nh->rwsem);
+        }
         return ret;
 }
 
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index 45b3553865cf..9dd9fbb75139 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -183,7 +183,7 @@ __xip_unmap (struct address_space * mapping,
                 address = vma->vm_start +
                         ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
                 BUG_ON(address < vma->vm_start || address >= vma->vm_end);
-                page = ZERO_PAGE(address);
+                page = ZERO_PAGE(0);
                 pte = page_check_address(page, mm, address, &ptl);
                 if (pte) {
                         /* Nuke the page table entry. */
@@ -246,7 +246,7 @@ xip_file_nopage(struct vm_area_struct * area,
                 __xip_unmap(mapping, pgoff);
         } else {
                 /* not shared and writable, use ZERO_PAGE() */
-                page = ZERO_PAGE(address);
+                page = ZERO_PAGE(0);
         }
 
 out:
diff --git a/mm/memory.c b/mm/memory.c
index af227d26e104..ef09f0acb1d8 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2606,8 +2606,15 @@ static int __init gate_vma_init(void)
         gate_vma.vm_mm = NULL;
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
-        gate_vma.vm_page_prot = PAGE_READONLY;
-        gate_vma.vm_flags = 0;
+        gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+        gate_vma.vm_page_prot = __P101;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        gate_vma.vm_flags |= VM_ALWAYSDUMP;
         return 0;
 }
 __initcall(gate_vma_init);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index da9463946556..c2aec0e1090d 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -884,6 +884,10 @@ asmlinkage long sys_mbind(unsigned long start, unsigned long len,
         err = get_nodes(&nodes, nmask, maxnode);
         if (err)
                 return err;
+#ifdef CONFIG_CPUSETS
+        /* Restrict the nodes to the allowed nodes in the cpuset */
+        nodes_and(nodes, nodes, current->mems_allowed);
+#endif
         return do_mbind(start, len, mode, &nodes, flags);
 }
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 9717337293c3..cc3a20819457 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1477,6 +1477,7 @@ static int acct_stack_growth(struct vm_area_struct * vma, unsigned long size, un
 {
         struct mm_struct *mm = vma->vm_mm;
         struct rlimit *rlim = current->signal->rlim;
+        unsigned long new_start;
 
         /* address space limit tests */
         if (!may_expand_vm(mm, grow))
@@ -1496,6 +1497,12 @@ static int acct_stack_growth(struct vm_area_struct * vma, unsigned long size, un
                         return -ENOMEM;
         }
 
+        /* Check to ensure the stack will not grow into a hugetlb-only region */
+        new_start = (vma->vm_flags & VM_GROWSUP) ? vma->vm_start :
+                        vma->vm_end - size;
+        if (is_hugepage_only_range(vma->vm_mm, new_start, size))
+                return -EFAULT;
+
         /*
          * Overcommit..  This must be the final test, as it will
          * update security statistics.
diff --git a/mm/mremap.c b/mm/mremap.c
index 9c769fa29f32..5d4bd4f95b8e 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -105,7 +105,6 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
                 if (pte_none(*old_pte))
                         continue;
                 pte = ptep_clear_flush(vma, old_addr, old_pte);
-                /* ZERO_PAGE can be dependant on virtual addr */
                 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
                 set_pte_at(mm, new_addr, new_pte, pte);
         }
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 1d2fc89ca56d..be0efbde4994 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -133,11 +133,9 @@ get_dirty_limits(long *pbackground, long *pdirty,
 
 #ifdef CONFIG_HIGHMEM
         /*
-         * If this mapping can only allocate from low memory,
-         * we exclude high memory from our count.
+         * We always exclude high memory from our count.
          */
-        if (mapping && !(mapping_gfp_mask(mapping) & __GFP_HIGHMEM))
-                available_memory -= totalhigh_pages;
+        available_memory -= totalhigh_pages;
 #endif
 
 
@@ -526,28 +524,25 @@ static struct notifier_block __cpuinitdata ratelimit_nb = {
 };
 
 /*
- * If the machine has a large highmem:lowmem ratio then scale back the default
- * dirty memory thresholds: allowing too much dirty highmem pins an excessive
- * number of buffer_heads.
+ * Called early on to tune the page writeback dirty limits.
+ *
+ * We used to scale dirty pages according to how total memory
+ * related to pages that could be allocated for buffers (by
+ * comparing nr_free_buffer_pages() to vm_total_pages.
+ *
+ * However, that was when we used "dirty_ratio" to scale with
+ * all memory, and we don't do that any more. "dirty_ratio"
+ * is now applied to total non-HIGHPAGE memory (by subtracting
+ * totalhigh_pages from vm_total_pages), and as such we can't
+ * get into the old insane situation any more where we had
+ * large amounts of dirty pages compared to a small amount of
+ * non-HIGHMEM memory.
+ *
+ * But we might still want to scale the dirty_ratio by how
+ * much memory the box has..
  */
 void __init page_writeback_init(void)
 {
-        long buffer_pages = nr_free_buffer_pages();
-        long correction;
-
-        correction = (100 * 4 * buffer_pages) / vm_total_pages;
-
-        if (correction < 100) {
-                dirty_background_ratio *= correction;
-                dirty_background_ratio /= 100;
-                vm_dirty_ratio *= correction;
-                vm_dirty_ratio /= 100;
-
-                if (dirty_background_ratio <= 0)
-                        dirty_background_ratio = 1;
-                if (vm_dirty_ratio <= 0)
-                        vm_dirty_ratio = 1;
-        }
         mod_timer(&wb_timer, jiffies + dirty_writeback_interval);
         writeback_set_ratelimit();
         register_cpu_notifier(&ratelimit_nb);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index fc5b5442e942..2c606cc922a5 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -989,8 +989,7 @@ int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
                       int classzone_idx, int alloc_flags)
 {
         /* free_pages my go negative - that's OK */
-        unsigned long min = mark;
-        long free_pages = z->free_pages - (1 << order) + 1;
+        long min = mark, free_pages = z->free_pages - (1 << order) + 1;
         int o;
 
         if (alloc_flags & ALLOC_HIGH)
diff --git a/mm/truncate.c b/mm/truncate.c
index 6c79ca4a1ca7..5df947de7654 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -51,15 +51,22 @@ static inline void truncate_partial_page(struct page *page, unsigned partial)
                 do_invalidatepage(page, partial);
 }
 
+/*
+ * This cancels just the dirty bit on the kernel page itself, it
+ * does NOT actually remove dirty bits on any mmap's that may be
+ * around. It also leaves the page tagged dirty, so any sync
+ * activity will still find it on the dirty lists, and in particular,
+ * clear_page_dirty_for_io() will still look at the dirty bits in
+ * the VM.
+ *
+ * Doing this should *normally* only ever be done when a page
+ * is truncated, and is not actually mapped anywhere at all. However,
+ * fs/buffer.c does this when it notices that somebody has cleaned
+ * out all the buffers on a page without actually doing it through
+ * the VM. Can you say "ext3 is horribly ugly"? Tought you could.
+ */
 void cancel_dirty_page(struct page *page, unsigned int account_size)
 {
-        /* If we're cancelling the page, it had better not be mapped any more */
-        if (page_mapped(page)) {
-                static unsigned int warncount;
-
-                WARN_ON(++warncount < 5);
-        }
-                
         if (TestClearPageDirty(page)) {
                 struct address_space *mapping = page->mapping;
                 if (mapping && mapping_cap_account_dirty(mapping)) {
@@ -422,7 +429,6 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                 pagevec_release(&pvec);
                 cond_resched();
         }
-        WARN_ON_ONCE(ret);
         return ret;
 }
 EXPORT_SYMBOL_GPL(invalidate_inode_pages2_range);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 29a8fa4d3728..f8c25d500155 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -585,6 +585,12 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_
                 goto done;
         }
 
+        if (la->l2_psm > 0 && btohs(la->l2_psm) < 0x1001 &&
+                                !capable(CAP_NET_BIND_SERVICE)) {
+                err = -EACCES;
+                goto done;
+        }
+                
         write_lock_bh(&l2cap_sk_list.lock);
 
         if (la->l2_psm && __l2cap_get_sock_by_addr(la->l2_psm, &la->l2_bdaddr)) {
@@ -2150,8 +2156,8 @@ static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
 
                 str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d 0x%x\n",
                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state, pi->psm, pi->scid, pi->dcid, pi->imtu,
-                                pi->omtu, pi->link_mode);
+                                sk->sk_state, btohs(pi->psm), pi->scid, pi->dcid,
+                                pi->imtu, pi->omtu, pi->link_mode);
         }
 
         read_unlock_bh(&l2cap_sk_list.lock);
diff --git a/net/core/flow.c b/net/core/flow.c
index d137f971f97d..5d25697920b1 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -231,22 +231,16 @@ nocache:
 
                 err = resolver(key, family, dir, &obj, &obj_ref);
 
-                if (fle) {
-                        if (err) {
-                                /* Force security policy check on next lookup */
-                                *head = fle->next;
-                                flow_entry_kill(cpu, fle);
-                        } else {
-                                fle->genid = atomic_read(&flow_cache_genid);
-
-                                if (fle->object)
-                                        atomic_dec(fle->object_ref);
-
-                                fle->object = obj;
-                                fle->object_ref = obj_ref;
-                                if (obj)
-                                        atomic_inc(fle->object_ref);
-                        }
+                if (fle && !err) {
+                        fle->genid = atomic_read(&flow_cache_genid);
+
+                        if (fle->object)
+                                atomic_dec(fle->object_ref);
+
+                        fle->object = obj;
+                        fle->object_ref = obj_ref;
+                        if (obj)
+                                atomic_inc(fle->object_ref);
                 }
                 local_bh_enable();
 
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 824569659083..3435542e9652 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -124,7 +124,7 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 
                 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-                err = icsk->icsk_af_ops->queue_xmit(skb, sk, 0);
+                err = icsk->icsk_af_ops->queue_xmit(skb, 0);
                 return net_xmit_eval(err);
         }
         return -ENOBUFS;
@@ -396,7 +396,7 @@ int dccp_send_reset(struct sock *sk, enum dccp_reset_codes code)
                                                       code);
                 if (skb != NULL) {
                         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-                        err = inet_csk(sk)->icsk_af_ops->queue_xmit(skb, sk, 0);
+                        err = inet_csk(sk)->icsk_af_ops->queue_xmit(skb, 0);
                         return net_xmit_eval(err);
                 }
         }
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index fc6f3c023a54..ed083ab455b7 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1145,16 +1145,23 @@ struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
         init_timer(&dn_db->timer);
 
         dn_db->uptime = jiffies;
+
+        dn_db->neigh_parms = neigh_parms_alloc(dev, &dn_neigh_table);
+        if (!dn_db->neigh_parms) {
+                dev->dn_ptr = NULL;
+                kfree(dn_db);
+                return NULL;
+        }
+
         if (dn_db->parms.up) {
                 if (dn_db->parms.up(dev) < 0) {
+                        neigh_parms_release(&dn_neigh_table, dn_db->neigh_parms);
                         dev->dn_ptr = NULL;
                         kfree(dn_db);
                         return NULL;
                 }
         }
 
-        dn_db->neigh_parms = neigh_parms_alloc(dev, &dn_neigh_table);
-
         dn_dev_sysctl_register(dev, &dn_db->parms);
 
         dn_dev_set_timer(dev);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index cfb249cc0a58..1e589b91605e 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1989,6 +1989,10 @@ static struct node *fib_trie_get_next(struct fib_trie_iter *iter)
         unsigned cindex = iter->index;
         struct tnode *p;
 
+        /* A single entry routing table */
+        if (!tn)
+                return NULL;
+
         pr_debug("get_next iter={node=%p index=%d depth=%d}\n",
                  iter->tnode, iter->index, iter->depth);
 rescan:
@@ -2037,11 +2041,18 @@ static struct node *fib_trie_get_first(struct fib_trie_iter *iter,
         if(!iter)
                 return NULL;
 
-        if (n && IS_TNODE(n)) {
-                iter->tnode = (struct tnode *) n;
-                iter->trie = t;
-                iter->index = 0;
-                iter->depth = 1;
+        if (n) {
+                if (IS_TNODE(n)) {
+                        iter->tnode = (struct tnode *) n;
+                        iter->trie = t;
+                        iter->index = 0;
+                        iter->depth = 1;
+                } else {
+                        iter->tnode = NULL;
+                        iter->trie  = t;
+                        iter->index = 0;
+                        iter->depth = 0;
+                }
                 return n;
         }
         return NULL;
@@ -2279,16 +2290,17 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 return 0;
 
+        if (!NODE_PARENT(n)) {
+                if (iter->trie == trie_local)
+                        seq_puts(seq, "<local>:\n");
+                else
+                        seq_puts(seq, "<main>:\n");
+        }
+
         if (IS_TNODE(n)) {
                 struct tnode *tn = (struct tnode *) n;
                 __be32 prf = htonl(MASK_PFX(tn->key, tn->pos));
 
-                if (!NODE_PARENT(n)) {
-                        if (iter->trie == trie_local)
-                                seq_puts(seq, "<local>:\n");
-                        else
-                                seq_puts(seq, "<main>:\n");
-                } 
                 seq_indent(seq, iter->depth-1);
                 seq_printf(seq, "  +-- %d.%d.%d.%d/%d %d %d %d\n",
                            NIPQUAD(prf), tn->pos, tn->bits, tn->full_children, 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f071f84808fa..a0f2008584bc 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -281,8 +281,9 @@ int ip_output(struct sk_buff *skb)
                             !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
-int ip_queue_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok)
+int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
 {
+        struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_options *opt = inet->opt;
         struct rtable *rt;
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 15e741aeb291..16d177b71bf8 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -4,6 +4,14 @@
 
 # objects for the standalone - connection tracking / NAT
 ip_conntrack-objs       := ip_conntrack_standalone.o ip_conntrack_core.o ip_conntrack_proto_generic.o ip_conntrack_proto_tcp.o ip_conntrack_proto_udp.o ip_conntrack_proto_icmp.o
+# objects for l3 independent conntrack
+nf_conntrack_ipv4-objs  :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
+ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
+ifeq ($(CONFIG_PROC_FS),y)
+nf_conntrack_ipv4-objs  += nf_conntrack_l3proto_ipv4_compat.o
+endif
+endif
+
 ip_nat-objs     := ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o ip_nat_proto_udp.o ip_nat_proto_icmp.o
 nf_nat-objs     := nf_nat_core.o nf_nat_helper.o nf_nat_proto_unknown.o nf_nat_proto_tcp.o nf_nat_proto_udp.o nf_nat_proto_icmp.o
 ifneq ($(CONFIG_NF_NAT),)
@@ -20,6 +28,8 @@ ip_nat_h323-objs := ip_nat_helper_h323.o
 
 # connection tracking
 obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
+obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
+
 obj-$(CONFIG_IP_NF_NAT) += ip_nat.o
 obj-$(CONFIG_NF_NAT) += nf_nat.o
 
@@ -106,13 +116,3 @@ obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
 
 obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
 
-# objects for l3 independent conntrack
-nf_conntrack_ipv4-objs  :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
-ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
-ifeq ($(CONFIG_PROC_FS),y)
-nf_conntrack_ipv4-objs  += nf_conntrack_l3proto_ipv4_compat.o
-endif
-endif
-
-# l3 independent conntrack
-obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 5fcf91d617cd..7f70b0886b83 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -374,9 +374,11 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
                     && ctnetlink_dump_helpinfo(skb, ct) < 0)
                         goto nfattr_failure;
 
+#ifdef CONFIG_IP_NF_CONNTRACK_MARK
                 if ((events & IPCT_MARK || ct->mark)
                     && ctnetlink_dump_mark(skb, ct) < 0)
                         goto nfattr_failure;
+#endif
 
                 if (events & IPCT_COUNTER_FILLING &&
                     (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
@@ -959,7 +961,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         if (cda[CTA_PROTOINFO-1]) {
                 err = ctnetlink_change_protoinfo(ct, cda);
                 if (err < 0)
-                        return err;
+                        goto err;
         }
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
diff --git a/net/ipv4/netfilter/ip_conntrack_sip.c b/net/ipv4/netfilter/ip_conntrack_sip.c
index 3a26d63eed88..11c588a10e6b 100644
--- a/net/ipv4/netfilter/ip_conntrack_sip.c
+++ b/net/ipv4/netfilter/ip_conntrack_sip.c
@@ -283,10 +283,16 @@ static int skp_epaddr_len(const char *dptr, const char *limit, int *shift)
 {
         int s = *shift;
 
-        for (; dptr <= limit && *dptr != '@'; dptr++)
+        /* Search for @, but stop at the end of the line.
+         * We are inside a sip: URI, so we don't need to worry about
+         * continuation lines. */
+        while (dptr <= limit &&
+               *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
                 (*shift)++;
+                dptr++;
+        }
 
-        if (*dptr == '@') {
+        if (dptr <= limit && *dptr == '@') {
                 dptr++;
                 (*shift)++;
         } else
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 0ae45b79a4eb..5df4fcae3ab6 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -72,9 +72,9 @@ static void pptp_nat_expected(struct nf_conn *ct,
                 DEBUGP("we are PAC->PNS\n");
                 /* build tuple for PNS->PAC */
                 t.src.l3num = AF_INET;
-                t.src.u3.ip = master->tuplehash[exp->dir].tuple.src.u3.ip;
+                t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip;
                 t.src.u.gre.key = nat_pptp_info->pns_call_id;
-                t.dst.u3.ip = master->tuplehash[exp->dir].tuple.dst.u3.ip;
+                t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip;
                 t.dst.u.gre.key = nat_pptp_info->pac_call_id;
                 t.dst.protonum = IPPROTO_GRE;
         }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c701f6abbfc1..c26076fb890e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1011,10 +1011,11 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                         for (j = 0; j < i; j++){
                                 if (after(ntohl(sp[j].start_seq),
                                           ntohl(sp[j+1].start_seq))){
-                                        sp[j].start_seq = htonl(tp->recv_sack_cache[j+1].start_seq);
-                                        sp[j].end_seq = htonl(tp->recv_sack_cache[j+1].end_seq);
-                                        sp[j+1].start_seq = htonl(tp->recv_sack_cache[j].start_seq);
-                                        sp[j+1].end_seq = htonl(tp->recv_sack_cache[j].end_seq);
+                                        struct tcp_sack_block_wire tmp;
+
+                                        tmp = sp[j];
+                                        sp[j] = sp[j+1];
+                                        sp[j+1] = tmp;
                                 }
 
                         }
@@ -4420,9 +4421,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                          * But, this leaves one open to an easy denial of
                          * service attack, and SYN cookies can't defend
                          * against this problem. So, we drop the data
-                         * in the interest of security over speed.
+                         * in the interest of security over speed unless
+                         * it's still in use.
                          */
-                        goto discard;
+                        kfree_skb(skb);
+                        return 0;
                 }
                 goto discard;
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 32c1a972fa31..975f4472af29 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -467,6 +467,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         th = (struct tcphdr *) skb_push(skb, tcp_header_size);
         skb->h.th = th;
+        skb_set_owner_w(skb, sk);
 
         /* Build TCP header and checksum it. */
         th->source              = inet->sport;
@@ -540,7 +541,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
                 TCP_INC_STATS(TCP_MIB_OUTSEGS);
 
-        err = icsk->icsk_af_ops->queue_xmit(skb, sk, 0);
+        err = icsk->icsk_af_ops->queue_xmit(skb, 0);
         if (likely(err <= 0))
                 return err;
 
@@ -1650,7 +1651,8 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
 
                 memcpy(skb_put(skb, next_skb_size), next_skb->data, next_skb_size);
 
-                skb->ip_summed = next_skb->ip_summed;
+                if (next_skb->ip_summed == CHECKSUM_PARTIAL)
+                        skb->ip_summed = CHECKSUM_PARTIAL;
 
                 if (skb->ip_summed != CHECKSUM_PARTIAL)
                         skb->csum = csum_block_add(skb->csum, next_skb->csum, skb_size);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index f230eeecf092..41c157848181 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -30,7 +30,7 @@
 
 #include <net/tcp.h>
 
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_DESCRIPTION("TCP cwnd snooper");
 MODULE_LICENSE("GPL");
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 171e5b55d7d6..e3854696988d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -341,6 +341,7 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
 static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 {
         struct inet6_dev *ndev;
+        struct in6_addr maddr;
 
         ASSERT_RTNL();
 
@@ -425,6 +426,11 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 #endif
         /* protected by rtnl_lock */
         rcu_assign_pointer(dev->ip6_ptr, ndev);
+
+        /* Join all-node multicast group */
+        ipv6_addr_all_nodes(&maddr);
+        ipv6_dev_mc_inc(dev, &maddr);
+
         return ndev;
 }
 
@@ -3387,7 +3393,7 @@ static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
 #ifdef CONFIG_IPV6_ROUTER_PREF
         array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
         array[DEVCONF_RTR_PROBE_INTERVAL] = cnf->rtr_probe_interval;
-#ifdef CONFIV_IPV6_ROUTE_INFO
+#ifdef CONFIG_IPV6_ROUTE_INFO
         array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
 #endif
 #endif
@@ -3892,7 +3898,7 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       &proc_dointvec_jiffies,
                         .strategy       =       &sysctl_jiffies,
                 },
-#ifdef CONFIV_IPV6_ROUTE_INFO
+#ifdef CONFIG_IPV6_ROUTE_INFO
                 {
                         .ctl_name       =       NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN,
                         .procname       =       "accept_ra_rt_info_max_plen",
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index c700302ad51a..116f94a49071 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -139,8 +139,9 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
 
 EXPORT_SYMBOL_GPL(inet6_csk_addr2sockaddr);
 
-int inet6_csk_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok)
+int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
 {
+        struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct flowi fl;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index a1c231a04ac2..882cde4b4047 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2258,8 +2258,6 @@ void ipv6_mc_up(struct inet6_dev *idev)
 
 void ipv6_mc_init_dev(struct inet6_dev *idev)
 {
-        struct in6_addr maddr;
-
         write_lock_bh(&idev->lock);
         rwlock_init(&idev->mc_lock);
         idev->mc_gq_running = 0;
@@ -2275,10 +2273,6 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
         idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
         idev->mc_v1_seen = 0;
         write_unlock_bh(&idev->lock);
-
-        /* Add all-nodes address. */
-        ipv6_addr_all_nodes(&maddr);
-        ipv6_dev_mc_inc(idev->dev, &maddr);
 }
 
 /*
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 6a9f616de37d..39bb658f3c44 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1413,6 +1413,13 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 return;
         }
 
+        if (!ipv6_addr_equal(&skb->nh.ipv6h->daddr, target) &&
+            !(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) {
+                ND_PRINTK2(KERN_WARNING
+                        "ICMPv6 Redirect: target address is not link-local.\n");
+                return;
+        }
+
         ndisc_flow_init(&fl, NDISC_REDIRECT, &saddr_buf, &skb->nh.ipv6h->saddr,
                         dev->ifindex);
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8c3d56871b50..5f0043c30b70 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2017,6 +2017,7 @@ static inline size_t rt6_nlmsg_size(void)
                + nla_total_size(4) /* RTA_IIF */
                + nla_total_size(4) /* RTA_OIF */
                + nla_total_size(4) /* RTA_PRIORITY */
+               + RTAX_MAX * nla_total_size(4) /* RTA_METRICS */
                + nla_total_size(sizeof(struct rta_cacheinfo));
 }
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index cd10e44db015..80107d4909c5 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -165,7 +165,7 @@ config NF_CONNTRACK_FTP
 
 config NF_CONNTRACK_H323
         tristate "H.323 protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        depends on EXPERIMENTAL && NF_CONNTRACK && (IPV6 || IPV6=n)
         help
           H.323 is a VoIP signalling protocol from ITU-T. As one of the most
           important VoIP protocols, it is widely used by voice hardware and
@@ -628,7 +628,7 @@ config NETFILTER_XT_MATCH_TCPMSS
 
 config NETFILTER_XT_MATCH_HASHLIMIT
         tristate '"hashlimit" match support'
-        depends on NETFILTER_XTABLES
+        depends on NETFILTER_XTABLES && (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
         help
           This option adds a `hashlimit' match.
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bd1d2de75e45..c64f029f7052 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -389,9 +389,11 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
                     && ctnetlink_dump_helpinfo(skb, ct) < 0)
                         goto nfattr_failure;
 
+#ifdef CONFIG_NF_CONNTRACK_MARK
                 if ((events & IPCT_MARK || ct->mark)
                     && ctnetlink_dump_mark(skb, ct) < 0)
                         goto nfattr_failure;
+#endif
 
                 if (events & IPCT_COUNTER_FILLING &&
                     (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
@@ -981,7 +983,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         if (cda[CTA_PROTOINFO-1]) {
                 err = ctnetlink_change_protoinfo(ct, cda);
                 if (err < 0)
-                        return err;
+                        goto err;
         }
 
 #if defined(CONFIG_NF_CONNTRACK_MARK)
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index f0ff00e0d052..c59df3bc2bbd 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -113,7 +113,7 @@ static void pptp_expectfn(struct nf_conn *ct,
 
         rcu_read_lock();
         nf_nat_pptp_expectfn = rcu_dereference(nf_nat_pptp_hook_expectfn);
-        if (nf_nat_pptp_expectfn && ct->status & IPS_NAT_MASK)
+        if (nf_nat_pptp_expectfn && ct->master->status & IPS_NAT_MASK)
                 nf_nat_pptp_expectfn(ct, exp);
         else {
                 struct nf_conntrack_tuple inv_t;
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index eb2a2411f97b..9dec11534678 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -303,10 +303,16 @@ static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
 {
         int s = *shift;
 
-        for (; dptr <= limit && *dptr != '@'; dptr++)
+        /* Search for @, but stop at the end of the line.
+         * We are inside a sip: URI, so we don't need to worry about
+         * continuation lines. */
+        while (dptr <= limit &&
+               *dptr != '@' && *dptr != '\r' && *dptr != '\n') {
                 (*shift)++;
+                dptr++;
+        }
 
-        if (*dptr == '@') {
+        if (dptr <= limit && *dptr == '@') {
                 dptr++;
                 (*shift)++;
         } else
diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c
index d93cb096a675..5e32dfa2668b 100644
--- a/net/netfilter/xt_connbytes.c
+++ b/net/netfilter/xt_connbytes.c
@@ -52,6 +52,8 @@ match(const struct sk_buff *skb,
 {
         const struct xt_connbytes_info *sinfo = matchinfo;
         u_int64_t what = 0;     /* initialize to make gcc happy */
+        u_int64_t bytes = 0;
+        u_int64_t pkts = 0;
         const struct ip_conntrack_counter *counters;
 
         if (!(counters = nf_ct_get_counters(skb)))
@@ -89,29 +91,22 @@ match(const struct sk_buff *skb,
         case XT_CONNBYTES_AVGPKT:
                 switch (sinfo->direction) {
                 case XT_CONNBYTES_DIR_ORIGINAL:
-                        what = div64_64(counters[IP_CT_DIR_ORIGINAL].bytes,
-                                        counters[IP_CT_DIR_ORIGINAL].packets);
+                        bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
+                        pkts  = counters[IP_CT_DIR_ORIGINAL].packets;
                         break;
                 case XT_CONNBYTES_DIR_REPLY:
-                        what = div64_64(counters[IP_CT_DIR_REPLY].bytes,
-                                        counters[IP_CT_DIR_REPLY].packets);
+                        bytes = counters[IP_CT_DIR_REPLY].bytes;
+                        pkts  = counters[IP_CT_DIR_REPLY].packets;
                         break;
                 case XT_CONNBYTES_DIR_BOTH:
-                        {
-                                u_int64_t bytes;
-                                u_int64_t pkts;
-                                bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
-                                        counters[IP_CT_DIR_REPLY].bytes;
-                                pkts = counters[IP_CT_DIR_ORIGINAL].packets+
-                                        counters[IP_CT_DIR_REPLY].packets;
-
-                                /* FIXME_THEORETICAL: what to do if sum
-                                 * overflows ? */
-
-                                what = div64_64(bytes, pkts);
-                        }
+                        bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
+                                counters[IP_CT_DIR_REPLY].bytes;
+                        pkts  = counters[IP_CT_DIR_ORIGINAL].packets +
+                                counters[IP_CT_DIR_REPLY].packets;
                         break;
                 }
+                if (pkts != 0)
+                        what = div64_64(bytes, pkts);
                 break;
         }
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index da73e8a8c18d..6dc01bdeb76b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -359,6 +359,10 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         if (dev == NULL)
                 goto out_unlock;
         
+        err = -ENETDOWN;
+        if (!(dev->flags & IFF_UP))
+                goto out_unlock;
+
         /*
          *      You may not queue a frame bigger than the mtu. This is the lowest level
          *      raw protocol and you must do your own fragmentation at this level.
@@ -407,10 +411,6 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         if (err)
                 goto out_free;
 
-        err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
-                goto out_free;
-
         /*
          *      Now send it
          */
@@ -428,24 +428,18 @@ out_unlock:
 }
 #endif
 
-static inline int run_filter(struct sk_buff *skb, struct sock *sk,
-                                                        unsigned *snaplen)
+static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
+                                      unsigned int res)
 {
         struct sk_filter *filter;
-        int err = 0;
 
         rcu_read_lock_bh();
         filter = rcu_dereference(sk->sk_filter);
-        if (filter != NULL) {
-                err = sk_run_filter(skb, filter->insns, filter->len);
-                if (!err)
-                        err = -EPERM;
-                else if (*snaplen > err)
-                        *snaplen = err;
-        }
+        if (filter != NULL)
+                res = sk_run_filter(skb, filter->insns, filter->len);
         rcu_read_unlock_bh();
 
-        return err;
+        return res;
 }
 
 /*
@@ -467,7 +461,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
         struct packet_sock *po;
         u8 * skb_head = skb->data;
         int skb_len = skb->len;
-        unsigned snaplen;
+        unsigned int snaplen, res;
 
         if (skb->pkt_type == PACKET_LOOPBACK)
                 goto drop;
@@ -495,8 +489,11 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
 
         snaplen = skb->len;
 
-        if (run_filter(skb, sk, &snaplen) < 0)
+        res = run_filter(skb, sk, snaplen);
+        if (!res)
                 goto drop_n_restore;
+        if (snaplen > res)
+                snaplen = res;
 
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned)sk->sk_rcvbuf)
@@ -568,7 +565,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
         struct tpacket_hdr *h;
         u8 * skb_head = skb->data;
         int skb_len = skb->len;
-        unsigned snaplen;
+        unsigned int snaplen, res;
         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
         unsigned short macoff, netoff;
         struct sk_buff *copy_skb = NULL;
@@ -592,8 +589,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 
         snaplen = skb->len;
 
-        if (run_filter(skb, sk, &snaplen) < 0)
+        res = run_filter(skb, sk, snaplen);
+        if (!res)
                 goto drop_n_restore;
+        if (snaplen > res)
+                snaplen = res;
 
         if (sk->sk_type == SOCK_DGRAM) {
                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
@@ -738,6 +738,10 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (sock->type == SOCK_RAW)
                 reserve = dev->hard_header_len;
 
+        err = -ENETDOWN;
+        if (!(dev->flags & IFF_UP))
+                goto out_unlock;
+
         err = -EMSGSIZE;
         if (len > dev->mtu+reserve)
                 goto out_unlock;
@@ -770,10 +774,6 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
         skb->dev = dev;
         skb->priority = sk->sk_priority;
 
-        err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
-                goto out_free;
-
         /*
          *      Now send it
          */
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index a9608064a4c3..01e69138578d 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -55,7 +55,8 @@ static int ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int
         struct ipt_target *target;
         int ret = 0;
 
-        target = xt_find_target(AF_INET, t->u.user.name, t->u.user.revision);
+        target = xt_request_find_target(AF_INET, t->u.user.name,
+                                        t->u.user.revision);
         if (!target)
                 return -ENOENT;
 
@@ -63,9 +64,10 @@ static int ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int
 
         ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
                               table, hook, 0, 0);
-        if (ret)
+        if (ret) {
+                module_put(t->u.kernel.target->me);
                 return ret;
-
+        }
         if (t->u.kernel.target->checkentry
             && !t->u.kernel.target->checkentry(table, NULL,
                                                t->u.kernel.target, t->data,
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 225f39b5d595..0ef48126b117 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -804,7 +804,7 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
                           NIPQUAD(((struct rtable *)skb->dst)->rt_dst));
 
         SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
-        return ip_queue_xmit(skb, skb->sk, ipfragok);
+        return ip_queue_xmit(skb, ipfragok);
 }
 
 static struct sctp_af sctp_ipv4_specific;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 167d888d1df2..0b1ddb1005ac 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1562,7 +1562,7 @@ static int sctp_process_missing_param(const struct sctp_association *asoc,
         if (*errp) {
                 report.num_missing = htonl(1);
                 report.type = paramtype;
-                sctp_init_cause(*errp, SCTP_ERROR_INV_PARAM,
+                sctp_init_cause(*errp, SCTP_ERROR_MISS_PARAM,
                                 &report, sizeof(report));
         }
 
@@ -1775,7 +1775,9 @@ int sctp_verify_init(const struct sctp_association *asoc,
 
         /* Verify stream values are non-zero. */
         if ((0 == peer_init->init_hdr.num_outbound_streams) ||
-            (0 == peer_init->init_hdr.num_inbound_streams)) {
+            (0 == peer_init->init_hdr.num_inbound_streams) ||
+            (0 == peer_init->init_hdr.init_tag) ||
+            (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
 
                 sctp_process_inv_mandatory(asoc, chunk, errp);
                 return 0;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 7bbc6156e455..6db77d1329f7 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -217,7 +217,7 @@ static int sctp_gen_sack(struct sctp_association *asoc, int force,
 
                 asoc->peer.sack_needed = 0;
 
-                error = sctp_outq_tail(&asoc->outqueue, sack);
+                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(sack));
 
                 /* Stop the SACK timer.  */
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
@@ -621,7 +621,13 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
         /* The receiver of the HEARTBEAT ACK should also perform an
          * RTT measurement for that destination transport address
          * using the time value carried in the HEARTBEAT ACK chunk.
+         * If the transport's rto_pending variable has been cleared,
+         * it was most likely due to a retransmit.  However, we want
+         * to re-enable it to properly update the rto.
          */
+        if (t->rto_pending == 0)
+                t->rto_pending = 1;
+
         hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
         sctp_transport_update_rto(t, (jiffies - hbinfo->sent_at));
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index aa51d190bfb2..fbbc9e6a3b78 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -440,7 +440,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
 {
         struct sctp_chunk *chunk = arg;
         sctp_init_chunk_t *initchunk;
-        __u32 init_tag;
         struct sctp_chunk *err_chunk;
         struct sctp_packet *packet;
         sctp_error_t error;
@@ -462,24 +461,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
         /* Grab the INIT header.  */
         chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
 
-        init_tag = ntohl(chunk->subh.init_hdr->init_tag);
-
-        /* Verification Tag: 3.3.3
-         *   If the value of the Initiate Tag in a received INIT ACK
-         *   chunk is found to be 0, the receiver MUST treat it as an
-         *   error and close the association by transmitting an ABORT.
-         */
-        if (!init_tag) {
-                struct sctp_chunk *reply = sctp_make_abort(asoc, chunk, 0);
-                if (!reply)
-                        goto nomem;
-
-                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
-                return sctp_stop_t1_and_abort(commands, SCTP_ERROR_INV_PARAM,
-                                              ECONNREFUSED, asoc,
-                                              chunk->transport);
-        }
-
         /* Verify the INIT chunk before processing it. */
         err_chunk = NULL;
         if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
@@ -550,9 +531,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                         SCTP_CHUNK(err_chunk));
 
         return SCTP_DISPOSITION_CONSUME;
-
-nomem:
-        return SCTP_DISPOSITION_NOMEM;
 }
 
 /*
@@ -1553,6 +1531,28 @@ sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
 }
 
 
+/*
+ * Unexpected INIT-ACK handler.
+ *
+ * Section 5.2.3
+ * If an INIT ACK received by an endpoint in any state other than the
+ * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
+ * An unexpected INIT ACK usually indicates the processing of an old or
+ * duplicated INIT chunk.
+*/
+sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
+                                            const struct sctp_association *asoc,
+                                            const sctp_subtype_t type,
+                                            void *arg, sctp_cmd_seq_t *commands)
+{
+        /* Per the above section, we'll discard the chunk if we have an
+         * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
+         */
+        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
+                return sctp_sf_ootb(ep, asoc, type, arg, commands);
+        else
+                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+}
 
 /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
  *
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 733dd87b3a7d..5f6cc7aa661b 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -152,7 +152,7 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
         /* SCTP_STATE_EMPTY */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
-        TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
+        TYPE_SCTP_FUNC(sctp_sf_do_5_2_3_initack), \
         /* SCTP_STATE_COOKIE_WAIT */ \
         TYPE_SCTP_FUNC(sctp_sf_do_5_1C_ack), \
         /* SCTP_STATE_COOKIE_ECHOED */ \
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index aba528b9ae76..16c9fbc1db69 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -490,16 +490,14 @@ int rpc_call_sync(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 
         /* Set up the call info struct and execute the task */
         status = task->tk_status;
-        if (status != 0) {
-                rpc_release_task(task);
+        if (status != 0)
                 goto out;
-        }
         atomic_inc(&task->tk_count);
         status = rpc_execute(task);
         if (status == 0)
                 status = task->tk_status;
-        rpc_put_task(task);
 out:
+        rpc_put_task(task);
         rpc_restore_sigmask(&oldset);
         return status;
 }
@@ -537,7 +535,7 @@ rpc_call_async(struct rpc_clnt *clnt, struct rpc_message *msg, int flags,
         if (status == 0)
                 rpc_execute(task);
         else
-                rpc_release_task(task);
+                rpc_put_task(task);
 
         rpc_restore_sigmask(&oldset);           
         return status;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 79bc4cdf5d48..fc083f0b3544 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -42,6 +42,7 @@ static mempool_t	*rpc_buffer_mempool __read_mostly;
 static void                     __rpc_default_timer(struct rpc_task *task);
 static void                     rpciod_killall(void);
 static void                     rpc_async_schedule(struct work_struct *);
+static void                      rpc_release_task(struct rpc_task *task);
 
 /*
  * RPC tasks sit here while waiting for conditions to improve.
@@ -896,7 +897,7 @@ void rpc_put_task(struct rpc_task *task)
 }
 EXPORT_SYMBOL(rpc_put_task);
 
-void rpc_release_task(struct rpc_task *task)
+static void rpc_release_task(struct rpc_task *task)
 {
 #ifdef RPC_DEBUG
         BUG_ON(task->tk_magic != RPC_TASK_MAGIC_ID);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index f3001f3626f6..4c1611211119 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -26,7 +26,6 @@
 #include <linux/sunrpc/clnt.h>
 
 #define RPCDBG_FACILITY RPCDBG_SVCDSP
-#define RPC_PARANOIA 1
 
 /*
  * Mode for mapping cpus to pools.
@@ -872,15 +871,15 @@ svc_process(struct svc_rqst *rqstp)
         return 0;
 
 err_short_len:
-#ifdef RPC_PARANOIA
-        printk("svc: short len %Zd, dropping request\n", argv->iov_len);
-#endif
+        if (net_ratelimit())
+                printk("svc: short len %Zd, dropping request\n", argv->iov_len);
+
         goto dropit;                    /* drop request */
 
 err_bad_dir:
-#ifdef RPC_PARANOIA
-        printk("svc: bad direction %d, dropping request\n", dir);
-#endif
+        if (net_ratelimit())
+                printk("svc: bad direction %d, dropping request\n", dir);
+
         serv->sv_stats->rpcbadfmt++;
         goto dropit;                    /* drop request */
 
@@ -909,9 +908,10 @@ err_bad_prog:
         goto sendit;
 
 err_bad_vers:
-#ifdef RPC_PARANOIA
-        printk("svc: unknown version (%d)\n", vers);
-#endif
+        if (net_ratelimit())
+                printk("svc: unknown version (%d for prog %d, %s)\n",
+                       vers, prog, progp->pg_name);
+
         serv->sv_stats->rpcbadfmt++;
         svc_putnl(resv, RPC_PROG_MISMATCH);
         svc_putnl(resv, progp->pg_lovers);
@@ -919,17 +919,17 @@ err_bad_vers:
         goto sendit;
 
 err_bad_proc:
-#ifdef RPC_PARANOIA
-        printk("svc: unknown procedure (%d)\n", proc);
-#endif
+        if (net_ratelimit())
+                printk("svc: unknown procedure (%d)\n", proc);
+
         serv->sv_stats->rpcbadfmt++;
         svc_putnl(resv, RPC_PROC_UNAVAIL);
         goto sendit;
 
 err_garbage:
-#ifdef RPC_PARANOIA
-        printk("svc: failed to decode args\n");
-#endif
+        if (net_ratelimit())
+                printk("svc: failed to decode args\n");
+
         rpc_stat = rpc_garbage_args;
 err_bad:
         serv->sv_stats->rpcbadfmt++;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 99f54fb6d669..ff1f8bf680aa 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1062,15 +1062,19 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
                          *  bit set in the fragment length header.
                          *  But apparently no known nfs clients send fragmented
                          *  records. */
-                        printk(KERN_NOTICE "RPC: bad TCP reclen 0x%08lx (non-terminal)\n",
-                               (unsigned long) svsk->sk_reclen);
+                        if (net_ratelimit())
+                                printk(KERN_NOTICE "RPC: bad TCP reclen 0x%08lx"
+                                       " (non-terminal)\n",
+                                       (unsigned long) svsk->sk_reclen);
                         goto err_delete;
                 }
                 svsk->sk_reclen &= 0x7fffffff;
                 dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
                 if (svsk->sk_reclen > serv->sv_max_mesg) {
-                        printk(KERN_NOTICE "RPC: bad TCP reclen 0x%08lx (large)\n",
-                               (unsigned long) svsk->sk_reclen);
+                        if (net_ratelimit())
+                                printk(KERN_NOTICE "RPC: bad TCP reclen 0x%08lx"
+                                       " (large)\n",
+                                       (unsigned long) svsk->sk_reclen);
                         goto err_delete;
                 }
         }
@@ -1278,6 +1282,8 @@ svc_recv(struct svc_rqst *rqstp, long timeout)
                                 schedule_timeout_uninterruptible(msecs_to_jiffies(500));
                         rqstp->rq_pages[i] = p;
                 }
+        rqstp->rq_pages[i++] = NULL; /* this might be seen in nfs_read_actor */
+        BUG_ON(pages >= RPCSVC_MAXPAGES);
 
         /* Make arg->head point to first page and arg->pages point to rest */
         arg = &rqstp->rq_arg;
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 47b68a301677..328d80f000ad 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -56,6 +56,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
                         sk_add_backlog(sk, skb);
                 }
                 bh_unlock_sock(sk);
+                sock_put(sk);
                 return queued;
         }
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index bebd40e5a62e..b7e537fe2d75 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -650,19 +650,18 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct xfrm_policy *pol;
         struct xfrm_policy *delpol;
         struct hlist_head *chain;
-        struct hlist_node *entry, *newpos, *last;
+        struct hlist_node *entry, *newpos;
         struct dst_entry *gc_list;
 
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(&policy->selector, policy->family, dir);
         delpol = NULL;
         newpos = NULL;
-        last = NULL;
         hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (!delpol &&
-                    pol->type == policy->type &&
+                if (pol->type == policy->type &&
                     !selector_cmp(&pol->selector, &policy->selector) &&
-                    xfrm_sec_ctx_match(pol->security, policy->security)) {
+                    xfrm_sec_ctx_match(pol->security, policy->security) &&
+                    !WARN_ON(delpol)) {
                         if (excl) {
                                 write_unlock_bh(&xfrm_policy_lock);
                                 return -EEXIST;
@@ -671,17 +670,12 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                         if (policy->priority > pol->priority)
                                 continue;
                 } else if (policy->priority >= pol->priority) {
-                        last = &pol->bydst;
+                        newpos = &pol->bydst;
                         continue;
                 }
-                if (!newpos)
-                        newpos = &pol->bydst;
                 if (delpol)
                         break;
-                last = &pol->bydst;
         }
-        if (!newpos)
-                newpos = last;
         if (newpos)
                 hlist_add_after(newpos, &policy->bydst);
         else
diff --git a/scripts/Makefile.headersinst b/scripts/Makefile.headersinst
index 4241e0dfeeaf..f7b6705fd6a3 100644
--- a/scripts/Makefile.headersinst
+++ b/scripts/Makefile.headersinst
@@ -109,7 +109,7 @@ quiet_cmd_mkdir		  = MKDIR   $(patsubst $(INSTALL_HDR_PATH)/%,%,$@)
 quiet_cmd_gen             = GEN     $(patsubst $(INSTALL_HDR_PATH)/%,%,$@)
       cmd_gen             = \
 FNAME=$(patsubst $(INSTALL_HDR_PATH)/$(_dst)/%,%,$@)                    \
-STUBDEF=__ASM_STUB_`echo $$FNAME | tr a-z. A-Z_`;                       \
+STUBDEF=__ASM_STUB_`echo $$FNAME | tr a-z.- A-Z__`;                     \
 (echo "/* File autogenerated by 'make headers_install' */" ;            \
 echo "\#ifndef $$STUBDEF" ;                                             \
 echo "\#define $$STUBDEF" ;                                             \
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 161eb571c82d..31929e39f5ca 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -37,6 +37,11 @@ int selinux_xfrm_sock_rcv_skb(u32 sid, struct sk_buff *skb,
 int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
                         struct avc_audit_data *ad, u8 proto);
 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
+
+static inline void selinux_xfrm_notify_policyload(void)
+{
+        atomic_inc(&flow_cache_genid);
+}
 #else
 static inline int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
                         struct avc_audit_data *ad)
@@ -55,6 +60,10 @@ static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int
         *sid = SECSID_NULL;
         return 0;
 }
+
+static inline void selinux_xfrm_notify_policyload(void)
+{
+}
 #endif
 
 static inline void selinux_skb_xfrm_sid(struct sk_buff *skb, u32 *sid)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 3eb1fa9f0de1..ca9154dc5d82 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1299,6 +1299,7 @@ int security_load_policy(void *data, size_t len)
                 avc_ss_reset(seqno);
                 selnl_notify_policyload(seqno);
                 selinux_netlbl_cache_invalidate();
+                selinux_xfrm_notify_policyload();
                 return 0;
         }
 
@@ -1354,6 +1355,7 @@ int security_load_policy(void *data, size_t len)
         avc_ss_reset(seqno);
         selnl_notify_policyload(seqno);
         selinux_netlbl_cache_invalidate();
+        selinux_xfrm_notify_policyload();
 
         return 0;
 
@@ -1853,6 +1855,7 @@ out:
         if (!rc) {
                 avc_ss_reset(seqno);
                 selnl_notify_policyload(seqno);
+                selinux_xfrm_notify_policyload();
         }
         return rc;
 }
diff --git a/sound/core/init.c b/sound/core/init.c
index 6152a7554dfd..a4cc6b155ae9 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -361,8 +361,10 @@ static int snd_card_do_free(struct snd_card *card)
                 snd_printk(KERN_WARNING "unable to free card info\n");
                 /* Not fatal error */
         }
-        if (card->dev)
-                device_unregister(card->dev);
+#ifndef CONFIG_SYSFS_DEPRECATED
+        if (card->card_dev)
+                device_unregister(card->card_dev);
+#endif
         kfree(card);
         return 0;
 }
@@ -497,12 +499,14 @@ int snd_card_register(struct snd_card *card)
         int err;
 
         snd_assert(card != NULL, return -EINVAL);
-        if (!card->dev) {
-                card->dev = device_create(sound_class, card->parent, 0,
-                                          "card%i", card->number);
-                if (IS_ERR(card->dev))
-                        card->dev = NULL;
+#ifndef CONFIG_SYSFS_DEPRECATED
+        if (!card->card_dev) {
+                card->card_dev = device_create(sound_class, card->dev, 0,
+                                               "card%i", card->number);
+                if (IS_ERR(card->card_dev))
+                        card->card_dev = NULL;
         }
+#endif
         if ((err = snd_device_register_all(card)) < 0)
                 return err;
         mutex_lock(&snd_card_mutex);
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 282742022de6..82a61c67cf3a 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -238,7 +238,7 @@ int snd_register_device(int type, struct snd_card *card, int dev,
 {
         int minor;
         struct snd_minor *preg;
-        struct device *device = NULL;
+        struct device *device = snd_card_get_device_link(card);
 
         snd_assert(name, return -EINVAL);
         preg = kmalloc(sizeof *preg, GFP_KERNEL);
@@ -263,8 +263,6 @@ int snd_register_device(int type, struct snd_card *card, int dev,
                 return minor;
         }
         snd_minors[minor] = preg;
-        if (card)
-                device = card->dev;
         preg->dev = device_create(sound_class, device, MKDEV(major, minor),
                                   "%s", name);
         if (preg->dev)
diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c
index b2fc40aa520b..4566df41912a 100644
--- a/sound/core/sound_oss.c
+++ b/sound/core/sound_oss.c
@@ -106,7 +106,7 @@ int snd_register_oss_device(int type, struct snd_card *card, int dev,
         int cidx = SNDRV_MINOR_OSS_CARD(minor);
         int track2 = -1;
         int register1 = -1, register2 = -1;
-        struct device *carddev = NULL;
+        struct device *carddev = snd_card_get_device_link(card);
 
         if (card && card->number >= 8)
                 return 0; /* ignore silently */
@@ -134,8 +134,6 @@ int snd_register_oss_device(int type, struct snd_card *card, int dev,
                 track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_DMMIDI1);
                 break;
         }
-        if (card)
-                carddev = card->dev;
         register1 = register_sound_special_device(f_ops, minor, carddev);
         if (register1 != minor)
                 goto __end;
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 367f8a32a665..0a352e46862f 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -322,7 +322,7 @@ static void i_usX2Y_urb_complete(struct urb *urb)
                 usX2Y_error_urb_status(usX2Y, subs, urb);
                 return;
         }
-        if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
                 subs->completed_urb = urb;
         else {
                 usX2Y_error_sequence(usX2Y, subs, urb);
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index 8f3e35e24e72..a5e7bcd7ca2e 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -243,7 +243,7 @@ static void i_usX2Y_usbpcm_urb_complete(struct urb *urb)
                 usX2Y_error_urb_status(usX2Y, subs, urb);
                 return;
         }
-        if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
                 subs->completed_urb = urb;
         else {
                 usX2Y_error_sequence(usX2Y, subs, urb);