Merge upstream into 'upstream' branch of netdev-2.6.git.

Hand fix merge conflict in drivers/net/tokenring/Kconfig.

125 files changed, 679 insertions, 644 deletions

diff --git a/Makefile b/Makefile
index 2c1486159d8d..300f61f6f6a2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 13
-EXTRAVERSION =-rc6
+EXTRAVERSION =-rc7
 NAME=Woozy Numbat
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 083c5df42d35..189d5eababa8 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -522,7 +522,7 @@ source "mm/Kconfig"
 
 config NUMA
         bool "NUMA Support (EXPERIMENTAL)"
-        depends on DISCONTIGMEM
+        depends on DISCONTIGMEM && BROKEN
         help
           Say Y to compile the kernel to support NUMA (Non-Uniform Memory
           Access).  This option is for configuring high-end multiprocessor
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 8f1e78551b1e..e211aa7404e6 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -1036,7 +1036,7 @@ debug_spin_lock(spinlock_t * lock, const char *base_file, int line_no)
         "       br      1b\n"
         ".previous"
         : "=r" (tmp), "=m" (lock->lock), "=r" (stuck)
-        : "1" (lock->lock), "2" (stuck) : "memory");
+        : "m" (lock->lock), "2" (stuck) : "memory");
 
         if (stuck < 0) {
                 printk(KERN_WARNING
@@ -1115,7 +1115,7 @@ void _raw_write_lock(rwlock_t * lock)
         ".previous"
         : "=m" (*(volatile int *)lock), "=&r" (regx), "=&r" (regy),
           "=&r" (stuck_lock), "=&r" (stuck_reader)
-        : "0" (*(volatile int *)lock), "3" (stuck_lock), "4" (stuck_reader) : "memory");
+        : "m" (*(volatile int *)lock), "3" (stuck_lock), "4" (stuck_reader) : "memory");
 
         if (stuck_lock < 0) {
                 printk(KERN_WARNING "write_lock stuck at %p\n", inline_pc);
@@ -1153,7 +1153,7 @@ void _raw_read_lock(rwlock_t * lock)
         "       br      1b\n"
         ".previous"
         : "=m" (*(volatile int *)lock), "=&r" (regx), "=&r" (stuck_lock)
-        : "0" (*(volatile int *)lock), "2" (stuck_lock) : "memory");
+        : "m" (*(volatile int *)lock), "2" (stuck_lock) : "memory");
 
         if (stuck_lock < 0) {
                 printk(KERN_WARNING "read_lock stuck at %p\n", inline_pc);
diff --git a/arch/alpha/oprofile/common.c b/arch/alpha/oprofile/common.c
index 908eb4af8dec..ba788cfdc3c6 100644
--- a/arch/alpha/oprofile/common.c
+++ b/arch/alpha/oprofile/common.c
@@ -65,7 +65,7 @@ op_axp_setup(void)
         model->reg_setup(&reg, ctr, &sys);
 
         /* Configure the registers on all cpus.  */
-        smp_call_function(model->cpu_setup, &reg, 0, 1);
+        (void)smp_call_function(model->cpu_setup, &reg, 0, 1);
         model->cpu_setup(&reg);
         return 0;
 }
@@ -86,7 +86,7 @@ op_axp_cpu_start(void *dummy)
 static int
 op_axp_start(void)
 {
-        smp_call_function(op_axp_cpu_start, NULL, 0, 1);
+        (void)smp_call_function(op_axp_cpu_start, NULL, 0, 1);
         op_axp_cpu_start(NULL);
         return 0;
 }
@@ -101,7 +101,7 @@ op_axp_cpu_stop(void *dummy)
 static void
 op_axp_stop(void)
 {
-        smp_call_function(op_axp_cpu_stop, NULL, 0, 1);
+        (void)smp_call_function(op_axp_cpu_stop, NULL, 0, 1);
         op_axp_cpu_stop(NULL);
 }
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 7bc4a583f4e1..c65c6eb9810d 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -310,7 +310,7 @@ menu "Kernel Features"
 
 config SMP
         bool "Symmetric Multi-Processing (EXPERIMENTAL)"
-        depends on EXPERIMENTAL #&& n
+        depends on EXPERIMENTAL && BROKEN #&& n
         help
           This enables support for systems with more than one CPU. If you have
           a system with only one CPU, like most personal computers, say N. If
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index d571c37ac30c..4554c961251c 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -617,7 +617,7 @@ baddataabort(int code, unsigned long instr, struct pt_regs *regs)
         notify_die("unknown data abort code", regs, &info, instr, 0);
 }
 
-volatile void __bug(const char *file, int line, void *data)
+void __attribute__((noreturn)) __bug(const char *file, int line, void *data)
 {
         printk(KERN_CRIT"kernel BUG at %s:%d!", file, line);
         if (data)
diff --git a/arch/arm/nwfpe/fpopcode.h b/arch/arm/nwfpe/fpopcode.h
index 8035f4faafbf..1777e92a88e6 100644
--- a/arch/arm/nwfpe/fpopcode.h
+++ b/arch/arm/nwfpe/fpopcode.h
@@ -370,20 +370,20 @@ TABLE 5
 #define getRoundingMode(opcode)         ((opcode & MASK_ROUNDING_MODE) >> 5)
 
 #ifdef CONFIG_FPE_NWFPE_XP
-static inline const floatx80 getExtendedConstant(const unsigned int nIndex)
+static inline __attribute_pure__ floatx80 getExtendedConstant(const unsigned int nIndex)
 {
         extern const floatx80 floatx80Constant[];
         return floatx80Constant[nIndex];
 }
 #endif
 
-static inline const float64 getDoubleConstant(const unsigned int nIndex)
+static inline __attribute_pure__ float64 getDoubleConstant(const unsigned int nIndex)
 {
         extern const float64 float64Constant[];
         return float64Constant[nIndex];
 }
 
-static inline const float32 getSingleConstant(const unsigned int nIndex)
+static inline __attribute_pure__ float32 getSingleConstant(const unsigned int nIndex)
 {
         extern const float32 float32Constant[];
         return float32Constant[nIndex];
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index da6c46d667cb..8c242bb1ef45 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -195,7 +195,7 @@ static void disable_lapic_nmi_watchdog(void)
                         wrmsr(MSR_P6_EVNTSEL0, 0, 0);
                         break;
                 case 15:
-                        if (boot_cpu_data.x86_model > 0x3)
+                        if (boot_cpu_data.x86_model > 0x4)
                                 break;
 
                         wrmsr(MSR_P4_IQ_CCCR0, 0, 0);
@@ -432,7 +432,7 @@ void setup_apic_nmi_watchdog (void)
                         setup_p6_watchdog();
                         break;
                 case 15:
-                        if (boot_cpu_data.x86_model > 0x3)
+                        if (boot_cpu_data.x86_model > 0x4)
                                 return;
 
                         if (!setup_p4_watchdog())
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index a61f33d06ea3..cd2d5d5514fe 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -803,15 +803,17 @@ void math_error(void __user *eip)
          */
         cwd = get_fpu_cwd(task);
         swd = get_fpu_swd(task);
-        switch (((~cwd) & swd & 0x3f) | (swd & 0x240)) {
+        switch (swd & ~cwd & 0x3f) {
                 case 0x000:
                 default:
                         break;
                 case 0x001: /* Invalid Op */
-                case 0x041: /* Stack Fault */
-                case 0x241: /* Stack Fault | Direction */
+                        /*
+                         * swd & 0x240 == 0x040: Stack Underflow
+                         * swd & 0x240 == 0x240: Stack Overflow
+                         * User must clear the SF bit (0x40) if set
+                         */
                         info.si_code = FPE_FLTINV;
-                        /* Should we clear the SF or let user space do it ???? */
                         break;
                 case 0x002: /* Denormalize */
                 case 0x010: /* Underflow */
diff --git a/arch/ia64/hp/sim/boot/boot_head.S b/arch/ia64/hp/sim/boot/boot_head.S
index 9364199e5632..1c8c7e6a9a5e 100644
--- a/arch/ia64/hp/sim/boot/boot_head.S
+++ b/arch/ia64/hp/sim/boot/boot_head.S
@@ -22,7 +22,7 @@ GLOBAL_ENTRY(_start)
         .save rp, r0
         .body
         movl gp = __gp
-        movl sp = stack_mem
+        movl sp = stack_mem+16384-16
         bsw.1
         br.call.sptk.many rp=start_bootloader
 END(_start)
diff --git a/arch/ia64/sn/kernel/io_init.c b/arch/ia64/sn/kernel/io_init.c
index 37e10e010a2f..414cdf2e3c96 100644
--- a/arch/ia64/sn/kernel/io_init.c
+++ b/arch/ia64/sn/kernel/io_init.c
@@ -323,7 +323,7 @@ void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
         struct pci_controller *controller;
         struct pcibus_bussoft *prom_bussoft_ptr;
         struct hubdev_info *hubdev_info;
-        void *provider_soft;
+        void *provider_soft = NULL;
         struct sn_pcibus_provider *provider;
 
         status = sal_get_pcibus_info((u64) segment, (u64) busnum,
@@ -339,7 +339,7 @@ void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
         if (bus == NULL) {
                 bus = pci_scan_bus(busnum, &pci_root_ops, controller);
                 if (bus == NULL)
-                        return; /* error, or bus already scanned */
+                        goto error_return; /* error, or bus already scanned */
                 bus->sysdata = NULL;
         }
 
@@ -352,28 +352,30 @@ void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
          */
 
         if (prom_bussoft_ptr->bs_asic_type >= PCIIO_ASIC_MAX_TYPES)
-                return;         /* unsupported asic type */
+                goto error_return; /* unsupported asic type */
 
         if (prom_bussoft_ptr->bs_asic_type == PCIIO_ASIC_TYPE_PPB)
                 goto error_return; /* no further fixup necessary */
 
         provider = sn_pci_provider[prom_bussoft_ptr->bs_asic_type];
         if (provider == NULL)
-                return;         /* no provider registerd for this asic */
+                goto error_return; /* no provider registerd for this asic */
 
-        provider_soft = NULL;
+        bus->sysdata = controller;
         if (provider->bus_fixup)
                 provider_soft = (*provider->bus_fixup) (prom_bussoft_ptr, controller);
 
-        if (provider_soft == NULL)
-                return;         /* fixup failed or not applicable */
+        if (provider_soft == NULL) {
+                /* fixup failed or not applicable */
+                bus->sysdata = NULL;
+                goto error_return;
+        }
 
         /*
          * Generic bus fixup goes here.  Don't reference prom_bussoft_ptr
          * after this point.
          */
 
-        bus->sysdata = controller;
         PCI_CONTROLLER(bus)->platform_data = provider_soft;
         nasid = NASID_GET(SN_PCIBUS_BUSSOFT(bus)->bs_base);
         cnode = nasid_to_cnodeid(nasid);
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 7772951df313..7622d4ec5f08 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -269,7 +269,7 @@ config NR_CPUS
 # Common NUMA Features
 config NUMA
         bool "Numa Memory Allocation Support"
-        depends on SMP
+        depends on SMP && BROKEN
         default n
 
 # turning this on wastes a bunch of space.
@@ -286,6 +286,7 @@ menu "Bus options (PCI, PCMCIA, EISA, MCA, ISA)"
 
 config PCI
         bool "PCI support"
+        depends on BROKEN
         default n
         help
           Find out whether you have a PCI motherboard. PCI is the name of a
diff --git a/arch/m32r/Kconfig.debug b/arch/m32r/Kconfig.debug
index 31039723804f..bbf711bab69e 100644
--- a/arch/m32r/Kconfig.debug
+++ b/arch/m32r/Kconfig.debug
@@ -20,7 +20,7 @@ config DEBUG_STACK_USAGE
 
 config DEBUG_PAGEALLOC
         bool "Page alloc debugging"
-        depends on DEBUG_KERNEL
+        depends on DEBUG_KERNEL && BROKEN
         help
           Unmap pages from the kernel linear mapping after free_pages().
           This results in a large slowdown, but helps to find certain types
diff --git a/arch/m32r/kernel/setup_m32700ut.c b/arch/m32r/kernel/setup_m32700ut.c
index a146b24a556b..708634b685e4 100644
--- a/arch/m32r/kernel/setup_m32700ut.c
+++ b/arch/m32r/kernel/setup_m32700ut.c
@@ -30,9 +30,11 @@
 typedef struct {
         unsigned long icucr;  /* ICU Control Register */
 } icu_data_t;
+static icu_data_t icu_data[M32700UT_NUM_CPU_IRQ];
+#else
+icu_data_t icu_data[M32700UT_NUM_CPU_IRQ];
 #endif /* CONFIG_SMP */
 
-static icu_data_t icu_data[M32700UT_NUM_CPU_IRQ];
 
 static void disable_m32700ut_irq(unsigned int irq)
 {
diff --git a/arch/m32r/kernel/setup_opsput.c b/arch/m32r/kernel/setup_opsput.c
index f0301f58bcce..d7b7ec6d30f8 100644
--- a/arch/m32r/kernel/setup_opsput.c
+++ b/arch/m32r/kernel/setup_opsput.c
@@ -31,9 +31,11 @@
 typedef struct {
         unsigned long icucr;  /* ICU Control Register */
 } icu_data_t;
+static icu_data_t icu_data[OPSPUT_NUM_CPU_IRQ];
+#else
+icu_data_t icu_data[OPSPUT_NUM_CPU_IRQ];
 #endif /* CONFIG_SMP */
 
-static icu_data_t icu_data[OPSPUT_NUM_CPU_IRQ];
 
 static void disable_opsput_irq(unsigned int irq)
 {
diff --git a/arch/m32r/kernel/smpboot.c b/arch/m32r/kernel/smpboot.c
index f9a0e723478d..640d592ea072 100644
--- a/arch/m32r/kernel/smpboot.c
+++ b/arch/m32r/kernel/smpboot.c
@@ -91,6 +91,7 @@ extern struct {
 
 /* which physical physical ID maps to which logical CPU number */
 static volatile int physid_2_cpu[NR_CPUS];
+#define physid_to_cpu(physid)   physid_2_cpu[physid]
 
 /* which logical CPU number maps to which physical ID */
 volatile int cpu_2_physid[NR_CPUS];
diff --git a/arch/m32r/lib/csum_partial_copy.c b/arch/m32r/lib/csum_partial_copy.c
index c871b4606b07..ddb16a83a8ce 100644
--- a/arch/m32r/lib/csum_partial_copy.c
+++ b/arch/m32r/lib/csum_partial_copy.c
@@ -58,3 +58,4 @@ csum_partial_copy_from_user (const unsigned char __user *src,
         return csum_partial(dst, len-missing, sum);
 }
 EXPORT_SYMBOL(csum_partial_copy_from_user);
+EXPORT_SYMBOL(csum_partial);
diff --git a/arch/m32r/mm/discontig.c b/arch/m32r/mm/discontig.c
index 1d1a01e54b3f..08e727955555 100644
--- a/arch/m32r/mm/discontig.c
+++ b/arch/m32r/mm/discontig.c
@@ -12,12 +12,14 @@
 #include <linux/mmzone.h>
 #include <linux/initrd.h>
 #include <linux/nodemask.h>
+#include <linux/module.h>
 
 #include <asm/setup.h>
 
 extern char _end[];
 
 struct pglist_data *node_data[MAX_NUMNODES];
+EXPORT_SYMBOL(node_data);
 static bootmem_data_t node_bdata[MAX_NUMNODES] __initdata;
 
 pg_data_t m32r_node_data[MAX_NUMNODES];
diff --git a/arch/ppc/Kconfig b/arch/ppc/Kconfig
index f6db3b385fea..e6fa1d1cc03a 100644
--- a/arch/ppc/Kconfig
+++ b/arch/ppc/Kconfig
@@ -911,6 +911,7 @@ config PPCBUG_NVRAM
         default y if PPC_PREP
 
 config SMP
+        depends on PPC_STD_MMU
         bool "Symmetric multi-processing support"
         ---help---
           This enables support for systems with more than one CPU. If you have
@@ -930,7 +931,7 @@ config SMP
 
 config IRQ_ALL_CPUS
         bool "Distribute interrupts on all CPUs by default"
-        depends on SMP
+        depends on SMP && !MV64360
         help
           This option gives the kernel permission to distribute IRQs across
           multiple CPUs.  Saying N here will route all IRQs to the first
@@ -1121,7 +1122,9 @@ config PROC_HARDWARE
 
 source "drivers/zorro/Kconfig"
 
+if !44x || BROKEN
 source kernel/power/Kconfig
+endif
 
 config SECCOMP
         bool "Enable seccomp to safely compute untrusted bytecode"
diff --git a/arch/ppc/platforms/4xx/Kconfig b/arch/ppc/platforms/4xx/Kconfig
index f7c045764e04..805dd98908a3 100644
--- a/arch/ppc/platforms/4xx/Kconfig
+++ b/arch/ppc/platforms/4xx/Kconfig
@@ -3,6 +3,11 @@ config 4xx
         depends on 40x || 44x
         default y
 
+config WANT_EARLY_SERIAL
+        bool
+        select SERIAL_8250
+        default n
+
 menu "IBM 4xx options"
         depends on 4xx
 
@@ -18,6 +23,7 @@ config ASH
 
 config BUBINGA
         bool "Bubinga"
+        select WANT_EARLY_SERIAL
         help
           This option enables support for the IBM 405EP evaluation board.
 
@@ -70,21 +76,25 @@ choice
 
 config BAMBOO
         bool "Bamboo"
+        select WANT_EARLY_SERIAL
         help
           This option enables support for the IBM PPC440EP evaluation board.
 
 config EBONY
         bool "Ebony"
+        select WANT_EARLY_SERIAL
         help
           This option enables support for the IBM PPC440GP evaluation board.
 
 config LUAN
         bool "Luan"
+        select WANT_EARLY_SERIAL
         help
           This option enables support for the IBM PPC440SP evaluation board.
 
 config OCOTEA
         bool "Ocotea"
+        select WANT_EARLY_SERIAL
         help
           This option enables support for the IBM PPC440GX evaluation board.
 
@@ -230,10 +240,6 @@ config PPC_GEN550
         depends on 4xx
         default y
 
-config PM
-        bool "Power Management support (EXPERIMENTAL)"
-        depends on 4xx && EXPERIMENTAL
-
 choice
         prompt "TTYS0 device and default console"
         depends on 40x
diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c
index 20062145e84e..d47fecb42cc5 100644
--- a/arch/s390/kernel/cpcmd.c
+++ b/arch/s390/kernel/cpcmd.c
@@ -46,9 +46,9 @@ int  __cpcmd(const char *cmd, char *response, int rlen, int *response_code)
                                 "lra    3,0(%4)\n"
                                 "lr     5,%5\n"
                                 "diag   2,4,0x8\n"
-                                "brc    8, .Litfits\n"
+                                "brc    8, 1f\n"
                                 "ar     5, %5\n"
-                                ".Litfits: \n"
+                                "1: \n"
                                 "lr     %0,4\n"
                                 "lr     %1,5\n"
                                 : "=d" (return_code), "=d" (return_len)
@@ -64,9 +64,9 @@ int  __cpcmd(const char *cmd, char *response, int rlen, int *response_code)
                                 "sam31\n"
                                 "diag   2,4,0x8\n"
                                 "sam64\n"
-                                "brc    8, .Litfits\n"
+                                "brc    8, 1f\n"
                                 "agr    5, %5\n"
-                                ".Litfits: \n"
+                                "1: \n"
                                 "lgr    %0,4\n"
                                 "lgr    %1,5\n"
                                 : "=d" (return_code), "=d" (return_len)
diff --git a/arch/sparc/kernel/sparc_ksyms.c b/arch/sparc/kernel/sparc_ksyms.c
index 1bd430d0ca06..8faa8dc4de43 100644
--- a/arch/sparc/kernel/sparc_ksyms.c
+++ b/arch/sparc/kernel/sparc_ksyms.c
@@ -98,8 +98,9 @@ extern void ___rw_write_enter(void);
  * The module references will be fixed up by module_frob_arch_sections.
  */
 #define DOT_ALIAS2(__ret, __x, __arg1, __arg2) \
-        extern __ret __x(__arg1, __arg2) \
-                     __attribute__((weak, alias("." # __x)));
+        extern __ret __x(__arg1, __arg2); \
+        asm(".weak " #__x);\
+        asm(#__x "=." #__x);
 
 DOT_ALIAS2(int, div, int, int)
 DOT_ALIAS2(int, mul, int, int)
diff --git a/arch/sparc64/kernel/Makefile b/arch/sparc64/kernel/Makefile
index 093281bdf85f..6f00ab8b9d23 100644
--- a/arch/sparc64/kernel/Makefile
+++ b/arch/sparc64/kernel/Makefile
@@ -8,7 +8,7 @@ EXTRA_CFLAGS := -Werror
 extra-y         := head.o init_task.o vmlinux.lds
 
 obj-y           := process.o setup.o cpu.o idprom.o \
-                   traps.o devices.o auxio.o \
+                   traps.o devices.o auxio.o una_asm.o \
                    irq.o ptrace.o time.o sys_sparc.o signal.o \
                    unaligned.o central.o pci.o starfire.o semaphore.o \
                    power.o sbus.o iommu_common.o sparc64_ksyms.o chmc.o
diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c
index 100b0107c4be..0c9e54b2f0c8 100644
--- a/arch/sparc64/kernel/traps.c
+++ b/arch/sparc64/kernel/traps.c
@@ -2127,6 +2127,9 @@ void __init trap_init(void)
             TI_PRE_COUNT != offsetof(struct thread_info, preempt_count) ||
             TI_NEW_CHILD != offsetof(struct thread_info, new_child) ||
             TI_SYS_NOERROR != offsetof(struct thread_info, syscall_noerror) ||
+            TI_RESTART_BLOCK != offsetof(struct thread_info, restart_block) ||
+            TI_KUNA_REGS != offsetof(struct thread_info, kern_una_regs) ||
+            TI_KUNA_INSN != offsetof(struct thread_info, kern_una_insn) ||
             TI_FPREGS != offsetof(struct thread_info, fpregs) ||
             (TI_FPREGS & (64 - 1)))
                 thread_info_offsets_are_bolixed_dave();
diff --git a/arch/sparc64/kernel/una_asm.S b/arch/sparc64/kernel/una_asm.S
new file mode 100644
index 000000000000..cbb40585253c
--- /dev/null
+++ b/arch/sparc64/kernel/una_asm.S
@@ -0,0 +1,153 @@
+/* una_asm.S: Kernel unaligned trap assembler helpers.
+ *
+ * Copyright (C) 1996,2005 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 1996,1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
+ */
+
+        .text
+
+kernel_unaligned_trap_fault:
+        call    kernel_mna_trap_fault
+         nop
+        retl
+         nop
+        .size   kern_unaligned_trap_fault, .-kern_unaligned_trap_fault
+
+        .globl  __do_int_store
+__do_int_store:
+        rd      %asi, %o4
+        wr      %o3, 0, %asi
+        ldx     [%o2], %g3
+        cmp     %o1, 2
+        be,pn   %icc, 2f
+         cmp    %o1, 4
+        be,pt   %icc, 1f
+         srlx   %g3, 24, %g2
+        srlx    %g3, 56, %g1
+        srlx    %g3, 48, %g7
+4:      stba    %g1, [%o0] %asi
+        srlx    %g3, 40, %g1
+5:      stba    %g7, [%o0 + 1] %asi
+        srlx    %g3, 32, %g7
+6:      stba    %g1, [%o0 + 2] %asi
+7:      stba    %g7, [%o0 + 3] %asi
+        srlx    %g3, 16, %g1
+8:      stba    %g2, [%o0 + 4] %asi
+        srlx    %g3, 8, %g7
+9:      stba    %g1, [%o0 + 5] %asi
+10:     stba    %g7, [%o0 + 6] %asi
+        ba,pt   %xcc, 0f
+11:      stba   %g3, [%o0 + 7] %asi
+1:      srl     %g3, 16, %g7
+12:     stba    %g2, [%o0] %asi
+        srl     %g3, 8, %g2
+13:     stba    %g7, [%o0 + 1] %asi
+14:     stba    %g2, [%o0 + 2] %asi
+        ba,pt   %xcc, 0f
+15:      stba   %g3, [%o0 + 3] %asi
+2:      srl     %g3, 8, %g2
+16:     stba    %g2, [%o0] %asi
+17:     stba    %g3, [%o0 + 1] %asi
+0:
+        wr      %o4, 0x0, %asi
+        retl
+         nop
+        .size   __do_int_store, .-__do_int_store
+
+        .section        __ex_table
+        .word           4b, kernel_unaligned_trap_fault
+        .word           5b, kernel_unaligned_trap_fault
+        .word           6b, kernel_unaligned_trap_fault
+        .word           7b, kernel_unaligned_trap_fault
+        .word           8b, kernel_unaligned_trap_fault
+        .word           9b, kernel_unaligned_trap_fault
+        .word           10b, kernel_unaligned_trap_fault
+        .word           11b, kernel_unaligned_trap_fault
+        .word           12b, kernel_unaligned_trap_fault
+        .word           13b, kernel_unaligned_trap_fault
+        .word           14b, kernel_unaligned_trap_fault
+        .word           15b, kernel_unaligned_trap_fault
+        .word           16b, kernel_unaligned_trap_fault
+        .word           17b, kernel_unaligned_trap_fault
+        .previous
+
+        .globl  do_int_load
+do_int_load:
+        rd      %asi, %o5
+        wr      %o4, 0, %asi
+        cmp     %o1, 8
+        bge,pn  %icc, 9f
+         cmp    %o1, 4
+        be,pt   %icc, 6f
+4:       lduba  [%o2] %asi, %g2
+5:      lduba   [%o2 + 1] %asi, %g3
+        sll     %g2, 8, %g2
+        brz,pt  %o3, 3f
+         add    %g2, %g3, %g2
+        sllx    %g2, 48, %g2
+        srax    %g2, 48, %g2
+3:      ba,pt   %xcc, 0f
+         stx    %g2, [%o0]
+6:      lduba   [%o2 + 1] %asi, %g3
+        sll     %g2, 24, %g2
+7:      lduba   [%o2 + 2] %asi, %g7
+        sll     %g3, 16, %g3
+8:      lduba   [%o2 + 3] %asi, %g1
+        sll     %g7, 8, %g7
+        or      %g2, %g3, %g2
+        or      %g7, %g1, %g7
+        or      %g2, %g7, %g2
+        brnz,a,pt %o3, 3f
+         sra    %g2, 0, %g2
+3:      ba,pt   %xcc, 0f
+         stx    %g2, [%o0]
+9:      lduba   [%o2] %asi, %g2
+10:     lduba   [%o2 + 1] %asi, %g3
+        sllx    %g2, 56, %g2
+11:     lduba   [%o2 + 2] %asi, %g7
+        sllx    %g3, 48, %g3
+12:     lduba   [%o2 + 3] %asi, %g1
+        sllx    %g7, 40, %g7
+        sllx    %g1, 32, %g1
+        or      %g2, %g3, %g2
+        or      %g7, %g1, %g7
+13:     lduba   [%o2 + 4] %asi, %g3
+        or      %g2, %g7, %g7
+14:     lduba   [%o2 + 5] %asi, %g1
+        sllx    %g3, 24, %g3
+15:     lduba   [%o2 + 6] %asi, %g2
+        sllx    %g1, 16, %g1
+        or      %g7, %g3, %g7
+16:     lduba   [%o2 + 7] %asi, %g3
+        sllx    %g2, 8, %g2
+        or      %g7, %g1, %g7
+        or      %g2, %g3, %g2
+        or      %g7, %g2, %g7
+        cmp     %o1, 8
+        be,a,pt %icc, 0f
+         stx    %g7, [%o0]
+        srlx    %g7, 32, %g2
+        sra     %g7, 0, %g7
+        stx     %g2, [%o0]
+        stx     %g7, [%o0 + 8]
+0:
+        wr      %o5, 0x0, %asi
+        retl
+         nop
+        .size   __do_int_load, .-__do_int_load
+
+        .section        __ex_table
+        .word           4b, kernel_unaligned_trap_fault
+        .word           5b, kernel_unaligned_trap_fault
+        .word           6b, kernel_unaligned_trap_fault
+        .word           7b, kernel_unaligned_trap_fault
+        .word           8b, kernel_unaligned_trap_fault
+        .word           9b, kernel_unaligned_trap_fault
+        .word           10b, kernel_unaligned_trap_fault
+        .word           11b, kernel_unaligned_trap_fault
+        .word           12b, kernel_unaligned_trap_fault
+        .word           13b, kernel_unaligned_trap_fault
+        .word           14b, kernel_unaligned_trap_fault
+        .word           15b, kernel_unaligned_trap_fault
+        .word           16b, kernel_unaligned_trap_fault
+        .previous
diff --git a/arch/sparc64/kernel/unaligned.c b/arch/sparc64/kernel/unaligned.c
index 4372bf32ecf6..11c3e88732e4 100644
--- a/arch/sparc64/kernel/unaligned.c
+++ b/arch/sparc64/kernel/unaligned.c
@@ -180,169 +180,28 @@ static void __attribute_used__ unaligned_panic(char *str, struct pt_regs *regs)
         die_if_kernel(str, regs);
 }
 
-#define do_integer_load(dest_reg, size, saddr, is_signed, asi, errh) ({         \
-__asm__ __volatile__ (                                                          \
-        "wr     %4, 0, %%asi\n\t"                                               \
-        "cmp    %1, 8\n\t"                                                      \
-        "bge,pn %%icc, 9f\n\t"                                                  \
-        " cmp   %1, 4\n\t"                                                      \
-        "be,pt  %%icc, 6f\n"                                                    \
-"4:\t"  " lduba [%2] %%asi, %%l1\n"                                             \
-"5:\t"  "lduba  [%2 + 1] %%asi, %%l2\n\t"                                       \
-        "sll    %%l1, 8, %%l1\n\t"                                              \
-        "brz,pt %3, 3f\n\t"                                                     \
-        " add   %%l1, %%l2, %%l1\n\t"                                           \
-        "sllx   %%l1, 48, %%l1\n\t"                                             \
-        "srax   %%l1, 48, %%l1\n"                                               \
-"3:\t"  "ba,pt  %%xcc, 0f\n\t"                                                  \
-        " stx   %%l1, [%0]\n"                                                   \
-"6:\t"  "lduba  [%2 + 1] %%asi, %%l2\n\t"                                       \
-        "sll    %%l1, 24, %%l1\n"                                               \
-"7:\t"  "lduba  [%2 + 2] %%asi, %%g7\n\t"                                       \
-        "sll    %%l2, 16, %%l2\n"                                               \
-"8:\t"  "lduba  [%2 + 3] %%asi, %%g1\n\t"                                       \
-        "sll    %%g7, 8, %%g7\n\t"                                              \
-        "or     %%l1, %%l2, %%l1\n\t"                                           \
-        "or     %%g7, %%g1, %%g7\n\t"                                           \
-        "or     %%l1, %%g7, %%l1\n\t"                                           \
-        "brnz,a,pt %3, 3f\n\t"                                                  \
-        " sra   %%l1, 0, %%l1\n"                                                \
-"3:\t"  "ba,pt  %%xcc, 0f\n\t"                                                  \
-        " stx   %%l1, [%0]\n"                                                   \
-"9:\t"  "lduba  [%2] %%asi, %%l1\n"                                             \
-"10:\t" "lduba  [%2 + 1] %%asi, %%l2\n\t"                                       \
-        "sllx   %%l1, 56, %%l1\n"                                               \
-"11:\t" "lduba  [%2 + 2] %%asi, %%g7\n\t"                                       \
-        "sllx   %%l2, 48, %%l2\n"                                               \
-"12:\t" "lduba  [%2 + 3] %%asi, %%g1\n\t"                                       \
-        "sllx   %%g7, 40, %%g7\n\t"                                             \
-        "sllx   %%g1, 32, %%g1\n\t"                                             \
-        "or     %%l1, %%l2, %%l1\n\t"                                           \
-        "or     %%g7, %%g1, %%g7\n"                                             \
-"13:\t" "lduba  [%2 + 4] %%asi, %%l2\n\t"                                       \
-        "or     %%l1, %%g7, %%g7\n"                                             \
-"14:\t" "lduba  [%2 + 5] %%asi, %%g1\n\t"                                       \
-        "sllx   %%l2, 24, %%l2\n"                                               \
-"15:\t" "lduba  [%2 + 6] %%asi, %%l1\n\t"                                       \
-        "sllx   %%g1, 16, %%g1\n\t"                                             \
-        "or     %%g7, %%l2, %%g7\n"                                             \
-"16:\t" "lduba  [%2 + 7] %%asi, %%l2\n\t"                                       \
-        "sllx   %%l1, 8, %%l1\n\t"                                              \
-        "or     %%g7, %%g1, %%g7\n\t"                                           \
-        "or     %%l1, %%l2, %%l1\n\t"                                           \
-        "or     %%g7, %%l1, %%g7\n\t"                                           \
-        "cmp    %1, 8\n\t"                                                      \
-        "be,a,pt %%icc, 0f\n\t"                                                 \
-        " stx   %%g7, [%0]\n\t"                                                 \
-        "srlx   %%g7, 32, %%l1\n\t"                                             \
-        "sra    %%g7, 0, %%g7\n\t"                                              \
-        "stx    %%l1, [%0]\n\t"                                                 \
-        "stx    %%g7, [%0 + 8]\n"                                               \
-"0:\n\t"                                                                        \
-        "wr     %%g0, %5, %%asi\n\n\t"                                          \
-        ".section __ex_table\n\t"                                               \
-        ".word  4b, " #errh "\n\t"                                              \
-        ".word  5b, " #errh "\n\t"                                              \
-        ".word  6b, " #errh "\n\t"                                              \
-        ".word  7b, " #errh "\n\t"                                              \
-        ".word  8b, " #errh "\n\t"                                              \
-        ".word  9b, " #errh "\n\t"                                              \
-        ".word  10b, " #errh "\n\t"                                             \
-        ".word  11b, " #errh "\n\t"                                             \
-        ".word  12b, " #errh "\n\t"                                             \
-        ".word  13b, " #errh "\n\t"                                             \
-        ".word  14b, " #errh "\n\t"                                             \
-        ".word  15b, " #errh "\n\t"                                             \
-        ".word  16b, " #errh "\n\n\t"                                           \
-        ".previous\n\t"                                                         \
-        : : "r" (dest_reg), "r" (size), "r" (saddr), "r" (is_signed),           \
-          "r" (asi), "i" (ASI_AIUS)                                             \
-        : "l1", "l2", "g7", "g1", "cc");                                        \
-})
+extern void do_int_load(unsigned long *dest_reg, int size,
+                        unsigned long *saddr, int is_signed, int asi);
         
-#define store_common(dst_addr, size, src_val, asi, errh) ({                     \
-__asm__ __volatile__ (                                                          \
-        "wr     %3, 0, %%asi\n\t"                                               \
-        "ldx    [%2], %%l1\n"                                                   \
-        "cmp    %1, 2\n\t"                                                      \
-        "be,pn  %%icc, 2f\n\t"                                                  \
-        " cmp   %1, 4\n\t"                                                      \
-        "be,pt  %%icc, 1f\n\t"                                                  \
-        " srlx  %%l1, 24, %%l2\n\t"                                             \
-        "srlx   %%l1, 56, %%g1\n\t"                                             \
-        "srlx   %%l1, 48, %%g7\n"                                               \
-"4:\t"  "stba   %%g1, [%0] %%asi\n\t"                                           \
-        "srlx   %%l1, 40, %%g1\n"                                               \
-"5:\t"  "stba   %%g7, [%0 + 1] %%asi\n\t"                                       \
-        "srlx   %%l1, 32, %%g7\n"                                               \
-"6:\t"  "stba   %%g1, [%0 + 2] %%asi\n"                                         \
-"7:\t"  "stba   %%g7, [%0 + 3] %%asi\n\t"                                       \
-        "srlx   %%l1, 16, %%g1\n"                                               \
-"8:\t"  "stba   %%l2, [%0 + 4] %%asi\n\t"                                       \
-        "srlx   %%l1, 8, %%g7\n"                                                \
-"9:\t"  "stba   %%g1, [%0 + 5] %%asi\n"                                         \
-"10:\t" "stba   %%g7, [%0 + 6] %%asi\n\t"                                       \
-        "ba,pt  %%xcc, 0f\n"                                                    \
-"11:\t" " stba  %%l1, [%0 + 7] %%asi\n"                                         \
-"1:\t"  "srl    %%l1, 16, %%g7\n"                                               \
-"12:\t" "stba   %%l2, [%0] %%asi\n\t"                                           \
-        "srl    %%l1, 8, %%l2\n"                                                \
-"13:\t" "stba   %%g7, [%0 + 1] %%asi\n"                                         \
-"14:\t" "stba   %%l2, [%0 + 2] %%asi\n\t"                                       \
-        "ba,pt  %%xcc, 0f\n"                                                    \
-"15:\t" " stba  %%l1, [%0 + 3] %%asi\n"                                         \
-"2:\t"  "srl    %%l1, 8, %%l2\n"                                                \
-"16:\t" "stba   %%l2, [%0] %%asi\n"                                             \
-"17:\t" "stba   %%l1, [%0 + 1] %%asi\n"                                         \
-"0:\n\t"                                                                        \
-        "wr     %%g0, %4, %%asi\n\n\t"                                          \
-        ".section __ex_table\n\t"                                               \
-        ".word  4b, " #errh "\n\t"                                              \
-        ".word  5b, " #errh "\n\t"                                              \
-        ".word  6b, " #errh "\n\t"                                              \
-        ".word  7b, " #errh "\n\t"                                              \
-        ".word  8b, " #errh "\n\t"                                              \
-        ".word  9b, " #errh "\n\t"                                              \
-        ".word  10b, " #errh "\n\t"                                             \
-        ".word  11b, " #errh "\n\t"                                             \
-        ".word  12b, " #errh "\n\t"                                             \
-        ".word  13b, " #errh "\n\t"                                             \
-        ".word  14b, " #errh "\n\t"                                             \
-        ".word  15b, " #errh "\n\t"                                             \
-        ".word  16b, " #errh "\n\t"                                             \
-        ".word  17b, " #errh "\n\n\t"                                           \
-        ".previous\n\t"                                                         \
-        : : "r" (dst_addr), "r" (size), "r" (src_val), "r" (asi), "i" (ASI_AIUS)\
-        : "l1", "l2", "g7", "g1", "cc");                                        \
-})
-
-#define do_integer_store(reg_num, size, dst_addr, regs, asi, errh) ({           \
-        unsigned long zero = 0;                                                 \
-        unsigned long *src_val = &zero;                                         \
-                                                                                \
-        if (size == 16) {                                                       \
-                size = 8;                                                       \
-                zero = (((long)(reg_num ?                                       \
-                        (unsigned)fetch_reg(reg_num, regs) : 0)) << 32) |       \
-                        (unsigned)fetch_reg(reg_num + 1, regs);                 \
-        } else if (reg_num) src_val = fetch_reg_addr(reg_num, regs);            \
-        store_common(dst_addr, size, src_val, asi, errh);                       \
-})
-
-extern void smp_capture(void);
-extern void smp_release(void);
-
-#define do_atomic(srcdest_reg, mem, errh) ({                                    \
-        unsigned long flags, tmp;                                               \
-                                                                                \
-        smp_capture();                                                          \
-        local_irq_save(flags);                                                  \
-        tmp = *srcdest_reg;                                                     \
-        do_integer_load(srcdest_reg, 4, mem, 0, errh);                          \
-        store_common(mem, 4, &tmp, errh);                                       \
-        local_irq_restore(flags);                                               \
-        smp_release();                                                          \
-})
+extern void __do_int_store(unsigned long *dst_addr, int size,
+                           unsigned long *src_val, int asi);
+
+static inline void do_int_store(int reg_num, int size, unsigned long *dst_addr,
+                                struct pt_regs *regs, int asi)
+{
+        unsigned long zero = 0;
+        unsigned long *src_val = &zero;
+
+        if (size == 16) {
+                size = 8;
+                zero = (((long)(reg_num ?
+                        (unsigned)fetch_reg(reg_num, regs) : 0)) << 32) |
+                        (unsigned)fetch_reg(reg_num + 1, regs);
+        } else if (reg_num) {
+                src_val = fetch_reg_addr(reg_num, regs);
+        }
+        __do_int_store(dst_addr, size, src_val, asi);
+}
 
 static inline void advance(struct pt_regs *regs)
 {
@@ -364,24 +223,29 @@ static inline int ok_for_kernel(unsigned int insn)
         return !floating_point_load_or_store_p(insn);
 }
 
-void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn) __asm__ ("kernel_mna_trap_fault");
-
-void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
+void kernel_mna_trap_fault(void)
 {
-        unsigned long g2 = regs->u_regs [UREG_G2];
+        struct pt_regs *regs = current_thread_info()->kern_una_regs;
+        unsigned int insn = current_thread_info()->kern_una_insn;
+        unsigned long g2 = regs->u_regs[UREG_G2];
         unsigned long fixup = search_extables_range(regs->tpc, &g2);
 
         if (!fixup) {
-                unsigned long address = compute_effective_address(regs, insn, ((insn >> 25) & 0x1f));
+                unsigned long address;
+
+                address = compute_effective_address(regs, insn,
+                                                    ((insn >> 25) & 0x1f));
                 if (address < PAGE_SIZE) {
-                        printk(KERN_ALERT "Unable to handle kernel NULL pointer dereference in mna handler");
+                        printk(KERN_ALERT "Unable to handle kernel NULL "
+                               "pointer dereference in mna handler");
                 } else
-                        printk(KERN_ALERT "Unable to handle kernel paging request in mna handler");
+                        printk(KERN_ALERT "Unable to handle kernel paging "
+                               "request in mna handler");
                 printk(KERN_ALERT " at virtual address %016lx\n",address);
-                printk(KERN_ALERT "current->{mm,active_mm}->context = %016lx\n",
+                printk(KERN_ALERT "current->{active_,}mm->context = %016lx\n",
                         (current->mm ? CTX_HWBITS(current->mm->context) :
                         CTX_HWBITS(current->active_mm->context)));
-                printk(KERN_ALERT "current->{mm,active_mm}->pgd = %016lx\n",
+                printk(KERN_ALERT "current->{active_,}mm->pgd = %016lx\n",
                         (current->mm ? (unsigned long) current->mm->pgd :
                         (unsigned long) current->active_mm->pgd));
                 die_if_kernel("Oops", regs);
@@ -400,48 +264,41 @@ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn, u
         enum direction dir = decode_direction(insn);
         int size = decode_access_size(insn);
 
+        current_thread_info()->kern_una_regs = regs;
+        current_thread_info()->kern_una_insn = insn;
+
         if (!ok_for_kernel(insn) || dir == both) {
-                printk("Unsupported unaligned load/store trap for kernel at <%016lx>.\n",
-                       regs->tpc);
-                unaligned_panic("Kernel does fpu/atomic unaligned load/store.", regs);
-
-                __asm__ __volatile__ ("\n"
-"kernel_unaligned_trap_fault:\n\t"
-                "mov    %0, %%o0\n\t"
-                "call   kernel_mna_trap_fault\n\t"
-                " mov   %1, %%o1\n\t"
-                :
-                : "r" (regs), "r" (insn)
-                : "o0", "o1", "o2", "o3", "o4", "o5", "o7",
-                  "g1", "g2", "g3", "g4", "g7", "cc");
+                printk("Unsupported unaligned load/store trap for kernel "
+                       "at <%016lx>.\n", regs->tpc);
+                unaligned_panic("Kernel does fpu/atomic "
+                                "unaligned load/store.", regs);
+
+                kernel_mna_trap_fault();
         } else {
-                unsigned long addr = compute_effective_address(regs, insn, ((insn >> 25) & 0x1f));
+                unsigned long addr;
 
+                addr = compute_effective_address(regs, insn,
+                                                 ((insn >> 25) & 0x1f));
 #ifdef DEBUG_MNA
-                printk("KMNA: pc=%016lx [dir=%s addr=%016lx size=%d] retpc[%016lx]\n",
-                       regs->tpc, dirstrings[dir], addr, size, regs->u_regs[UREG_RETPC]);
+                printk("KMNA: pc=%016lx [dir=%s addr=%016lx size=%d] "
+                       "retpc[%016lx]\n",
+                       regs->tpc, dirstrings[dir], addr, size,
+                       regs->u_regs[UREG_RETPC]);
 #endif
                 switch (dir) {
                 case load:
-                        do_integer_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
-                                        size, (unsigned long *) addr,
-                                        decode_signedness(insn), decode_asi(insn, regs),
-                                        kernel_unaligned_trap_fault);
+                        do_int_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
+                                    size, (unsigned long *) addr,
+                                    decode_signedness(insn),
+                                    decode_asi(insn, regs));
                         break;
 
                 case store:
-                        do_integer_store(((insn>>25)&0x1f), size,
-                                         (unsigned long *) addr, regs,
-                                         decode_asi(insn, regs),
-                                         kernel_unaligned_trap_fault);
-                        break;
-#if 0 /* unsupported */
-                case both:
-                        do_atomic(fetch_reg_addr(((insn>>25)&0x1f), regs),
-                                  (unsigned long *) addr,
-                                  kernel_unaligned_trap_fault);
+                        do_int_store(((insn>>25)&0x1f), size,
+                                     (unsigned long *) addr, regs,
+                                     decode_asi(insn, regs));
                         break;
-#endif
+
                 default:
                         panic("Impossible kernel unaligned trap.");
                         /* Not reached... */
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index b15761ff4101..fa25e39fe54d 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -492,6 +492,14 @@ void __cpuinit start_secondary(void)
          */
         set_cpu_sibling_map(smp_processor_id());
 
+        /* 
+         * Wait for TSC sync to not schedule things before.
+         * We still process interrupts, which could see an inconsistent
+         * time in that window unfortunately. 
+         * Do this here because TSC sync has global unprotected state.
+         */
+        tsc_sync_wait();
+
         /*
          * We need to hold call_lock, so there is no inconsistency
          * between the time smp_call_function() determines number of
@@ -509,13 +517,6 @@ void __cpuinit start_secondary(void)
         per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE;
         unlock_ipi_call_lock();
 
-        mb();
-
-        /* Wait for TSC sync to not schedule things before.
-           We still process interrupts, which could see an inconsistent
-           time in that window unfortunately. */
-        tsc_sync_wait();
-
         cpu_idle();
 }
 
diff --git a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
index 493819e543a5..ca914c3bd49c 100644
--- a/arch/x86_64/mm/fault.c
+++ b/arch/x86_64/mm/fault.c
@@ -211,9 +211,7 @@ int unhandled_signal(struct task_struct *tsk, int sig)
 {
         if (tsk->pid == 1)
                 return 1;
-        /* Warn for strace, but not for gdb */
-        if (!test_ti_thread_flag(tsk->thread_info, TIF_SYSCALL_TRACE) &&
-            (tsk->ptrace & PT_PTRACED))
+        if (tsk->ptrace & PT_PTRACED)
                 return 0;
         return (tsk->sighand->action[sig-1].sa.sa_handler == SIG_IGN) ||
                 (tsk->sighand->action[sig-1].sa.sa_handler == SIG_DFL);
diff --git a/arch/x86_64/pci/k8-bus.c b/arch/x86_64/pci/k8-bus.c
index c2c38b579939..d80c323669e0 100644
--- a/arch/x86_64/pci/k8-bus.c
+++ b/arch/x86_64/pci/k8-bus.c
@@ -47,13 +47,22 @@ fill_mp_bus_to_cpumask(void)
                          * if there are no busses hanging off of the current
                          * ldt link then both the secondary and subordinate
                          * bus number fields are set to 0.
+                         * 
+                         * RED-PEN
+                         * This is slightly broken because it assumes
+                         * HT node IDs == Linux node ids, which is not always
+                         * true. However it is probably mostly true.
                          */
                         if (!(SECONDARY_LDT_BUS_NUMBER(ldtbus) == 0
                                 && SUBORDINATE_LDT_BUS_NUMBER(ldtbus) == 0)) {
                                 for (j = SECONDARY_LDT_BUS_NUMBER(ldtbus);
                                      j <= SUBORDINATE_LDT_BUS_NUMBER(ldtbus);
-                                     j++)
-                                        pci_bus_to_node[j] = NODE_ID(nid);
+                                     j++) { 
+                                        int node = NODE_ID(nid);
+                                        if (!node_online(node))
+                                                node = 0;
+                                        pci_bus_to_node[j] = node;
+                                }               
                         }
                 }
         }
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 4f27e5519296..7333b41d4224 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -80,7 +80,7 @@ config SERIAL_NONSTANDARD
 
 config COMPUTONE
         tristate "Computone IntelliPort Plus serial support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP && (BROKEN || !SPARC32)
         ---help---
           This driver supports the entire family of Intelliport II/Plus
           controllers with the exception of the MicroChannel controllers and
@@ -138,7 +138,7 @@ config CYZ_INTR
 
 config DIGIEPCA
         tristate "Digiboard Intelligent Async Support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP && (!64BIT || BROKEN)
         ---help---
           This is a driver for Digi International's Xx, Xeve, and Xem series
           of cards which provide multiple serial ports. You would need
@@ -208,7 +208,7 @@ config SYNCLINK
 
 config SYNCLINKMP
         tristate "SyncLink Multiport support"
-        depends on SERIAL_NONSTANDARD
+        depends on SERIAL_NONSTANDARD && (BROKEN || !SPARC32)
         help
           Enable support for the SyncLink Multiport (2 or 4 ports)
           serial adapter, running asynchronous and HDLC communications up
@@ -735,7 +735,7 @@ config SGI_IP27_RTC
 
 config GEN_RTC
         tristate "Generic /dev/rtc emulation"
-        depends on RTC!=y && !IA64 && !ARM && !PPC64
+        depends on RTC!=y && !IA64 && !ARM && !PPC64 && !M32R && !SPARC32
         ---help---
           If you say Y here and create a character special file /dev/rtc with
           major number 10 and minor number 135 using mknod ("man mknod"), you
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 79c8e2dd9c33..32cdfb30e9b4 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -1,6 +1,7 @@
 menu "InfiniBand support"
 
 config INFINIBAND
+        depends on PCI || BROKEN
         tristate "InfiniBand support"
         ---help---
           Core support for InfiniBand (IB).  Make sure to also select
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index 6c7b8bffc6fd..801c98f30e5c 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -134,6 +134,7 @@ config HISAX_AVM_A1
 
 config HISAX_FRITZPCI
         bool "AVM PnP/PCI (Fritz!PnP/PCI)"
+        depends on BROKEN || !PPC64
         help
           This enables HiSax support for the AVM "Fritz!PnP" and "Fritz!PCI".
           See <file:Documentation/isdn/README.HiSax> on how to configure it.
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index 65ab64c43b3e..bc3e096d84f7 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -103,7 +103,7 @@ config PMAC_MEDIABAY
 # on non-powerbook machines (but only on PMU based ones AFAIK)
 config PMAC_BACKLIGHT
         bool "Backlight control for LCD screens"
-        depends on ADB_PMU
+        depends on ADB_PMU && (BROKEN || !PPC64)
         help
           Say Y here to build in code to manage the LCD backlight on a
           Macintosh PowerBook.  With this code, the backlight will be turned
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d4c275604a3e..486ee50cfdda 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -256,8 +256,7 @@ static inline void mddev_unlock(mddev_t * mddev)
 {
         up(&mddev->reconfig_sem);
 
-        if (mddev->thread)
-                md_wakeup_thread(mddev->thread);
+        md_wakeup_thread(mddev->thread);
 }
 
 mdk_rdev_t * find_rdev_nr(mddev_t *mddev, int nr)
@@ -1714,6 +1713,7 @@ static int do_md_run(mddev_t * mddev)
         mddev->in_sync = 1;
         
         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+        md_wakeup_thread(mddev->thread);
         
         if (mddev->sb_dirty)
                 md_update_sb(mddev);
@@ -2236,8 +2236,7 @@ static int add_new_disk(mddev_t * mddev, mdu_disk_info_t *info)
                         export_rdev(rdev);
 
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
-                if (mddev->thread)
-                        md_wakeup_thread(mddev->thread);
+                md_wakeup_thread(mddev->thread);
                 return err;
         }
 
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index ac81e5e01a9a..3f5742396096 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -356,7 +356,7 @@ config VIDEO_M32R_AR
 
 config VIDEO_M32R_AR_M64278
         tristate "Use Colour AR module M64278(VGA)"
-        depends on VIDEO_M32R_AR
+        depends on VIDEO_M32R_AR && PLAT_M32700UT
         ---help---
           Say Y here to use the Renesas M64278E-800 camera module,
           which supports VGA(640x480 pixcels) size of images.
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 1e50b8e32add..79e8aa6f2b9e 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1147,7 +1147,7 @@ config IBMVETH
           be called ibmveth.
 
 config IBM_EMAC
-        tristate "IBM PPC4xx EMAC driver support"
+        bool "IBM PPC4xx EMAC driver support"
         depends on 4xx
         select CRC32
         ---help---
@@ -1156,7 +1156,7 @@ config IBM_EMAC
 
 config IBM_EMAC_ERRMSG
         bool "Verbose error messages"
-        depends on IBM_EMAC
+        depends on IBM_EMAC && BROKEN
 
 config IBM_EMAC_RXB
         int "Number of receive buffers"
diff --git a/drivers/net/ibm_emac/ibm_emac_core.c b/drivers/net/ibm_emac/ibm_emac_core.c
index 6482d994d489..c7fb3675c09d 100644
--- a/drivers/net/ibm_emac/ibm_emac_core.c
+++ b/drivers/net/ibm_emac/ibm_emac_core.c
@@ -1712,11 +1712,10 @@ struct mal_commac_ops emac_commac_ops = {
 };
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static int emac_netpoll(struct net_device *ndev)
+static void emac_netpoll(struct net_device *ndev)
 {
         emac_rxeob_dev((void *)ndev, 0);
         emac_txeob_dev((void *)ndev, 0);
-        return 0;
 }
 #endif
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 368b8fb14023..01419aff333e 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -66,8 +66,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.35"
-#define DRV_MODULE_RELDATE      "August 6, 2005"
+#define DRV_MODULE_VERSION      "3.36"
+#define DRV_MODULE_RELDATE      "August 19, 2005"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -8970,6 +8970,8 @@ static int __devinit tg3_phy_probe(struct tg3 *tp)
                 tp->phy_id = hw_phy_id;
                 if (hw_phy_id_masked == PHY_ID_BCM8002)
                         tp->tg3_flags2 |= TG3_FLG2_PHY_SERDES;
+                else
+                        tp->tg3_flags2 &= ~TG3_FLG2_PHY_SERDES;
         } else {
                 if (tp->phy_id != PHY_ID_INVALID) {
                         /* Do nothing, phy ID already set up in
diff --git a/drivers/net/tokenring/Kconfig b/drivers/net/tokenring/Kconfig
index 7d5c23e8cdd7..e4cfc80b283b 100644
--- a/drivers/net/tokenring/Kconfig
+++ b/drivers/net/tokenring/Kconfig
@@ -84,7 +84,7 @@ config 3C359
 
 config TMS380TR
         tristate "Generic TMS380 Token Ring ISA/PCI adapter support"
-        depends on TR && (PCI || ISA || MCA)
+        depends on TR && (PCI || ISA && ISA_DMA_API || MCA)
         select FW_LOADER
         ---help---
           This driver provides generic support for token ring adapters
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 1d3231cc471a..ec3f75a030d2 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -270,7 +270,7 @@ config PCMCIA_HERMES
 
 config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
-        depends on NET_RADIO && PCMCIA
+        depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
         ---help---
           This is the standard Linux driver to support Cisco/Aironet PCMCIA
           802.11 wireless cards.  This driver is the same as the Aironet
diff --git a/drivers/parport/Kconfig b/drivers/parport/Kconfig
index 16a2e6ae37f4..725a14119f2a 100644
--- a/drivers/parport/Kconfig
+++ b/drivers/parport/Kconfig
@@ -34,7 +34,7 @@ config PARPORT
 
 config PARPORT_PC
         tristate "PC-style hardware"
-        depends on PARPORT && (!SPARC64 || PCI) && !SPARC32
+        depends on PARPORT && (!SPARC64 || PCI) && !SPARC32 && !M32R
         ---help---
           You should say Y here if you have a PC-style parallel port. All
           IBM PC compatible computers and some Alphas have PC-style
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 6f9fdb276402..599b116d9747 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -41,6 +41,7 @@ module_param(io_speed, int, 0444);
 
 
 #ifdef CONFIG_PCMCIA_PROBE
+#include <asm/irq.h>
 /* mask of IRQs already reserved by other cards, we should avoid using them */
 static u8 pcmcia_used_irq[NR_IRQS];
 #endif
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index d36258d6665f..533f90c05cdf 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -230,7 +230,7 @@ qdio_siga_input(struct qdio_q *q)
 }
 
 /* locked by the locks in qdio_activate and qdio_cleanup */
-static __u32 * volatile 
+static __u32 volatile *
 qdio_get_indicator(void)
 {
         int i;
diff --git a/drivers/s390/crypto/z90crypt.h b/drivers/s390/crypto/z90crypt.h
index 82a1d97001d7..0a3bb5a10dd4 100644
--- a/drivers/s390/crypto/z90crypt.h
+++ b/drivers/s390/crypto/z90crypt.h
@@ -36,15 +36,6 @@
 #define z90crypt_VARIANT 2      // 2 = added PCIXCC MCL3 and CEX2C support
 
 /**
- * If we are not using the sparse checker, __user has no use.
- */
-#ifdef __CHECKER__
-# define __user         __attribute__((noderef, address_space(1)))
-#else
-# define __user
-#endif
-
-/**
  * struct ica_rsa_modexpo
  *
  * Requirements:
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index f1e8c4223ed1..12c208fb18c5 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1696,7 +1696,7 @@ config TT_DMA_EMUL
 
 config MAC_SCSI
         bool "Macintosh NCR5380 SCSI"
-        depends on MAC && SCSI
+        depends on MAC && SCSI=y
         help
           This is the NCR 5380 SCSI controller included on most of the 68030
           based Macintoshes.  If you have one of these say Y and read the
@@ -1717,7 +1717,7 @@ config SCSI_MAC_ESP
 
 config MVME147_SCSI
         bool "WD33C93 SCSI driver for MVME147"
-        depends on MVME147 && SCSI
+        depends on MVME147 && SCSI=y
         help
           Support for the on-board SCSI controller on the Motorola MVME147
           single-board computer.
@@ -1758,7 +1758,7 @@ config SUN3_SCSI
 
 config SUN3X_ESP
         bool "Sun3x ESP SCSI"
-        depends on SUN3X && SCSI
+        depends on SUN3X && SCSI=y
         help
           The ESP was an on-board SCSI controller used on Sun 3/80
           machines.  Say Y here to compile in support for it.
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index c5623694d10f..e3b9692b9688 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -1105,6 +1105,7 @@ MODULE_AUTHOR("Jeff Garzik");
 MODULE_DESCRIPTION("AHCI SATA low-level driver");
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, ahci_pci_tbl);
+MODULE_VERSION(DRV_VERSION);
 
 module_init(ahci_init);
 module_exit(ahci_exit);
diff --git a/drivers/scsi/arm/Kconfig b/drivers/scsi/arm/Kconfig
index 54b32868aaf7..13f23043c8a3 100644
--- a/drivers/scsi/arm/Kconfig
+++ b/drivers/scsi/arm/Kconfig
@@ -3,7 +3,7 @@
 #
 config SCSI_ACORNSCSI_3
         tristate "Acorn SCSI card (aka30) support"
-        depends on ARCH_ACORN && SCSI
+        depends on ARCH_ACORN && SCSI && BROKEN
         help
           This enables support for the Acorn SCSI card (aka30). If you have an
           Acorn system with one of these, say Y. If unsure, say N.
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index a2cfade2c1c6..d96ebf9d2228 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -32,7 +32,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "ata_piix"
-#define DRV_VERSION     "1.03"
+#define DRV_VERSION     "1.04"
 
 enum {
         PIIX_IOCFG              = 0x54, /* IDE I/O configuration register */
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 73b1f72b7e43..f4e7dcb6492b 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -2268,19 +2268,6 @@ void ata_qc_prep(struct ata_queued_cmd *qc)
  *      spin_lock_irqsave(host_set lock)
  */
 
-
-
-/**
- *      ata_sg_init_one - Prepare a one-entry scatter-gather list.
- *      @qc:  Queued command
- *      @buf:  transfer buffer
- *      @buflen:  length of buf
- *
- *      Builds a single-entry scatter-gather list to initiate a
- *      transfer utilizing the specified buffer.
- *
- *      LOCKING:
- */
 void ata_sg_init_one(struct ata_queued_cmd *qc, void *buf, unsigned int buflen)
 {
         struct scatterlist *sg;
@@ -2312,18 +2299,6 @@ void ata_sg_init_one(struct ata_queued_cmd *qc, void *buf, unsigned int buflen)
  *      spin_lock_irqsave(host_set lock)
  */
 
-
-/**
- *      ata_sg_init - Assign a scatter gather list to a queued command
- *      @qc:  Queued command
- *      @sg:  Scatter-gather list
- *      @n_elem:  length of sg list
- *
- *      Attaches a scatter-gather list to a queued command.
- *
- *      LOCKING:
- */
-
 void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
                  unsigned int n_elem)
 {
diff --git a/drivers/scsi/libata.h b/drivers/scsi/libata.h
index d90430bbb0de..3e7f4843020f 100644
--- a/drivers/scsi/libata.h
+++ b/drivers/scsi/libata.h
@@ -26,7 +26,7 @@
 #define __LIBATA_H__
 
 #define DRV_NAME        "libata"
-#define DRV_VERSION     "1.11"  /* must be exactly four chars */
+#define DRV_VERSION     "1.12"  /* must be exactly four chars */
 
 struct ata_scsi_args {
         u16                     *id;
diff --git a/drivers/scsi/sata_promise.c b/drivers/scsi/sata_promise.c
index 5c1d4411457a..919fb314ad10 100644
--- a/drivers/scsi/sata_promise.c
+++ b/drivers/scsi/sata_promise.c
@@ -40,7 +40,7 @@
 #include "sata_promise.h"
 
 #define DRV_NAME        "sata_promise"
-#define DRV_VERSION     "1.01"
+#define DRV_VERSION     "1.02"
 
 
 enum {
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 97034d3937fd..d5797618a3b9 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -211,7 +211,7 @@ comment "Non-8250 serial port support"
 
 config SERIAL_AMBA_PL010
         tristate "ARM AMBA PL010 serial port support"
-        depends on ARM_AMBA
+        depends on ARM_AMBA && (BROKEN || !ARCH_VERSATILE)
         select SERIAL_CORE
         help
           This selects the ARM(R) AMBA(R) PrimeCell PL010 UART.  If you have
@@ -819,7 +819,7 @@ config SERIAL_M32R_SIO_CONSOLE
 
 config SERIAL_M32R_PLDSIO
         bool "M32R SIO I/F on a PLD"
-        depends on SERIAL_M32R_SIO=y
+        depends on SERIAL_M32R_SIO=y && (PLAT_OPSPUT || PALT_USRV || PLAT_M32700UT)
         default n
         help
           Say Y here if you want to use the M32R serial controller
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index 0301feacbde4..9b50560b9d16 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -1123,7 +1123,7 @@ static int __init m32r_sio_console_setup(struct console *co, char *options)
         return uart_set_options(port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver m32r_sio_reg;
+static struct uart_driver m32r_sio_reg;
 static struct console m32r_sio_console = {
         .name           = "ttyS",
         .write          = m32r_sio_console_write,
diff --git a/drivers/usb/net/usbnet.c b/drivers/usb/net/usbnet.c
index 576f3b852fce..4528a00c45b0 100644
--- a/drivers/usb/net/usbnet.c
+++ b/drivers/usb/net/usbnet.c
@@ -1922,7 +1922,7 @@ static int genelink_rx_fixup (struct usbnet *dev, struct sk_buff *skb)
 
                         // copy the packet data to the new skb
                         memcpy(skb_put(gl_skb, size), packet->packet_data, size);
-                        skb_return (dev, skb);
+                        skb_return (dev, gl_skb);
                 }
 
                 // advance to the next packet
diff --git a/drivers/usb/net/zd1201.c b/drivers/usb/net/zd1201.c
index 29cd801eb958..e32a80b39182 100644
--- a/drivers/usb/net/zd1201.c
+++ b/drivers/usb/net/zd1201.c
@@ -346,8 +346,7 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
                         if (datalen<14)
                                 goto resubmit;
                         if ((seq & IEEE802_11_SCTL_FRAG) == 0) {
-                                frag = kmalloc(sizeof(struct zd1201_frag*),
-                                    GFP_ATOMIC);
+                                frag = kmalloc(sizeof(*frag), GFP_ATOMIC);
                                 if (!frag)
                                         goto resubmit;
                                 skb = dev_alloc_skb(IEEE802_11_DATA_LEN +14+2);
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index cbff98337aa6..5fe182d6e4ab 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -6,7 +6,7 @@ menu "Console display driver support"
 
 config VGA_CONSOLE
         bool "VGA text console" if EMBEDDED || !X86
-        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC32 && !SPARC64 && !M68K && !PARISC
+        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC32 && !SPARC64 && !M68K && !PARISC && !ARCH_VERSATILE
         default y
         help
           Saying Y here will allow you to use Linux in text mode through a
diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
index bfc28abe1cb1..31ee06590de5 100644
--- a/fs/afs/mntpt.c
+++ b/fs/afs/mntpt.c
@@ -30,7 +30,7 @@ static struct dentry *afs_mntpt_lookup(struct inode *dir,
                                        struct dentry *dentry,
                                        struct nameidata *nd);
 static int afs_mntpt_open(struct inode *inode, struct file *file);
-static int afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd);
+static void *afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd);
 
 struct file_operations afs_mntpt_file_operations = {
         .open           = afs_mntpt_open,
@@ -233,7 +233,7 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
 /*
  * follow a link from a mountpoint directory, thus causing it to be mounted
  */
-static int afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct vfsmount *newmnt;
         struct dentry *old_dentry;
@@ -249,7 +249,7 @@ static int afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd)
         newmnt = afs_mntpt_do_automount(dentry);
         if (IS_ERR(newmnt)) {
                 path_release(nd);
-                return PTR_ERR(newmnt);
+                return (void *)newmnt;
         }
 
         old_dentry = nd->dentry;
@@ -267,7 +267,7 @@ static int afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd)
         }
 
         kleave(" = %d", err);
-        return err;
+        return ERR_PTR(err);
 } /* end afs_mntpt_follow_link() */
 
 /*****************************************************************************/
diff --git a/fs/autofs/symlink.c b/fs/autofs/symlink.c
index f028396f1383..52e8772b066e 100644
--- a/fs/autofs/symlink.c
+++ b/fs/autofs/symlink.c
@@ -12,11 +12,12 @@
 
 #include "autofs_i.h"
 
-static int autofs_follow_link(struct dentry *dentry, struct nameidata *nd)
+/* Nothing to release.. */
+static void *autofs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         char *s=((struct autofs_symlink *)dentry->d_inode->u.generic_ip)->data;
         nd_set_link(nd, s);
-        return 0;
+        return NULL;
 }
 
 struct inode_operations autofs_symlink_inode_operations = {
diff --git a/fs/autofs4/symlink.c b/fs/autofs4/symlink.c
index c265a66edf0f..2ea2c98fd84b 100644
--- a/fs/autofs4/symlink.c
+++ b/fs/autofs4/symlink.c
@@ -12,11 +12,11 @@
 
 #include "autofs_i.h"
 
-static int autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct autofs_info *ino = autofs4_dentry_ino(dentry);
         nd_set_link(nd, (char *)ino->u.symlink);
-        return 0;
+        return NULL;
 }
 
 struct inode_operations autofs4_symlink_inode_operations = {
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index de5bb280a828..e0a6025f1d06 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -41,8 +41,8 @@ static struct inode *befs_alloc_inode(struct super_block *sb);
 static void befs_destroy_inode(struct inode *inode);
 static int befs_init_inodecache(void);
 static void befs_destroy_inodecache(void);
-static int befs_follow_link(struct dentry *, struct nameidata *);
-static void befs_put_link(struct dentry *, struct nameidata *);
+static void *befs_follow_link(struct dentry *, struct nameidata *);
+static void befs_put_link(struct dentry *, struct nameidata *, void *);
 static int befs_utf2nls(struct super_block *sb, const char *in, int in_len,
                         char **out, int *out_len);
 static int befs_nls2utf(struct super_block *sb, const char *in, int in_len,
@@ -461,7 +461,7 @@ befs_destroy_inodecache(void)
  * The data stream become link name. Unless the LONG_SYMLINK
  * flag is set.
  */
-static int
+static void *
 befs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
@@ -487,10 +487,10 @@ befs_follow_link(struct dentry *dentry, struct nameidata *nd)
         }
 
         nd_set_link(nd, link);
-        return 0;
+        return NULL;
 }
 
-static void befs_put_link(struct dentry *dentry, struct nameidata *nd)
+static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
 {
         befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
         if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 78af5850c558..1fd21f66f243 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -83,8 +83,8 @@ extern int cifs_dir_notify(struct file *, unsigned long arg);
 extern struct dentry_operations cifs_dentry_ops;
 
 /* Functions related to symlinks */
-extern int cifs_follow_link(struct dentry *direntry, struct nameidata *nd);
-extern void cifs_put_link(struct dentry *direntry, struct nameidata *nd);
+extern void *cifs_follow_link(struct dentry *direntry, struct nameidata *nd);
+extern void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *);
 extern int cifs_readlink(struct dentry *direntry, char __user *buffer, 
                          int buflen);
 extern int cifs_symlink(struct inode *inode, struct dentry *direntry,
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index bde0fabfece0..ab925ef4f863 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -92,7 +92,7 @@ cifs_hl_exit:
         return rc;
 }
 
-int
+void *
 cifs_follow_link(struct dentry *direntry, struct nameidata *nd)
 {
         struct inode *inode = direntry->d_inode;
@@ -148,7 +148,7 @@ out:
 out_no_free:
         FreeXid(xid);
         nd_set_link(nd, target_path);
-        return 0;
+        return NULL;    /* No cookie */
 }
 
 int
@@ -330,7 +330,7 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
         return rc;
 }
 
-void cifs_put_link(struct dentry *direntry, struct nameidata *nd)
+void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
 {
         char *p = nd_get_link(nd);
         if (!IS_ERR(p))
diff --git a/fs/devfs/base.c b/fs/devfs/base.c
index 1ecfe1f184d4..8b679b67e5e0 100644
--- a/fs/devfs/base.c
+++ b/fs/devfs/base.c
@@ -2491,11 +2491,11 @@ static int devfs_mknod(struct inode *dir, struct dentry *dentry, int mode,
         return 0;
 }                               /*  End Function devfs_mknod  */
 
-static int devfs_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *devfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct devfs_entry *p = get_devfs_entry_from_vfs_inode(dentry->d_inode);
         nd_set_link(nd, p ? p->u.symlink.linkname : ERR_PTR(-ENODEV));
-        return 0;
+        return NULL;
 }                               /*  End Function devfs_follow_link  */
 
 static struct inode_operations devfs_iops = {
diff --git a/fs/ext2/symlink.c b/fs/ext2/symlink.c
index 9f7bac01d557..1e67d87cfa91 100644
--- a/fs/ext2/symlink.c
+++ b/fs/ext2/symlink.c
@@ -21,11 +21,11 @@
 #include "xattr.h"
 #include <linux/namei.h>
 
-static int ext2_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *ext2_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct ext2_inode_info *ei = EXT2_I(dentry->d_inode);
         nd_set_link(nd, (char *)ei->i_data);
-        return 0;
+        return NULL;
 }
 
 struct inode_operations ext2_symlink_inode_operations = {
diff --git a/fs/ext3/symlink.c b/fs/ext3/symlink.c
index 8c3e72818fb0..4f79122cde67 100644
--- a/fs/ext3/symlink.c
+++ b/fs/ext3/symlink.c
@@ -23,11 +23,11 @@
 #include <linux/namei.h>
 #include "xattr.h"
 
-static int ext3_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void * ext3_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct ext3_inode_info *ei = EXT3_I(dentry->d_inode);
         nd_set_link(nd, (char*)ei->i_data);
-        return 0;
+        return NULL;
 }
 
 struct inode_operations ext3_symlink_inode_operations = {
diff --git a/fs/freevxfs/vxfs_immed.c b/fs/freevxfs/vxfs_immed.c
index ac677ab262b2..d0401dc68d41 100644
--- a/fs/freevxfs/vxfs_immed.c
+++ b/fs/freevxfs/vxfs_immed.c
@@ -38,7 +38,7 @@
 #include "vxfs_inode.h"
 
 
-static int      vxfs_immed_follow_link(struct dentry *, struct nameidata *);
+static void *   vxfs_immed_follow_link(struct dentry *, struct nameidata *);
 
 static int      vxfs_immed_readpage(struct file *, struct page *);
 
@@ -72,12 +72,12 @@ struct address_space_operations vxfs_immed_aops = {
  * Returns:
  *   Zero on success, else a negative error code.
  */
-static int
+static void *
 vxfs_immed_follow_link(struct dentry *dp, struct nameidata *np)
 {
         struct vxfs_inode_info          *vip = VXFS_INO(dp->d_inode);
         nd_set_link(np, vip->vii_immed.vi_immed);
-        return 0;
+        return NULL;
 }
 
 /**
diff --git a/fs/ioprio.c b/fs/ioprio.c
index 97e1f088ba00..d1c1f2b2c9da 100644
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -62,6 +62,8 @@ asmlinkage long sys_ioprio_set(int which, int who, int ioprio)
 
                         break;
                 case IOPRIO_CLASS_IDLE:
+                        if (!capable(CAP_SYS_ADMIN))
+                                return -EPERM;
                         break;
                 default:
                         return -EINVAL;
diff --git a/fs/jffs2/symlink.c b/fs/jffs2/symlink.c
index 65ab6b001dca..82ef484f5e12 100644
--- a/fs/jffs2/symlink.c
+++ b/fs/jffs2/symlink.c
@@ -18,7 +18,7 @@
 #include <linux/namei.h>
 #include "nodelist.h"
 
-static int jffs2_follow_link(struct dentry *dentry, struct nameidata *nd);
+static void *jffs2_follow_link(struct dentry *dentry, struct nameidata *nd);
 
 struct inode_operations jffs2_symlink_inode_operations =
 {       
@@ -27,9 +27,10 @@ struct inode_operations jffs2_symlink_inode_operations =
         .setattr =      jffs2_setattr
 };
 
-static int jffs2_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *jffs2_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct jffs2_inode_info *f = JFFS2_INODE_INFO(dentry->d_inode);
+        char *p = (char *)f->dents;
         
         /*
          * We don't acquire the f->sem mutex here since the only data we
@@ -45,19 +46,20 @@ static int jffs2_follow_link(struct dentry *dentry, struct nameidata *nd)
          * nd_set_link() call.
          */
         
-        if (!f->dents) {
+        if (!p) {
                 printk(KERN_ERR "jffs2_follow_link(): can't find symlink taerget\n");
-                return -EIO;
+                p = ERR_PTR(-EIO);
+        } else {
+                D1(printk(KERN_DEBUG "jffs2_follow_link(): target path is '%s'\n", (char *) f->dents));
         }
-        D1(printk(KERN_DEBUG "jffs2_follow_link(): target path is '%s'\n", (char *) f->dents));
 
-        nd_set_link(nd, (char *)f->dents);
+        nd_set_link(nd, p);
         
         /*
          * We unlock the f->sem mutex but VFS will use the f->dents string. This is safe
          * since the only way that may cause f->dents to be changed is iput() operation.
          * But VFS will not use f->dents after iput() has been called.
          */
-        return 0;
+        return NULL;
 }
 
diff --git a/fs/jfs/symlink.c b/fs/jfs/symlink.c
index 287d8d6c3cfd..16477b3835e1 100644
--- a/fs/jfs/symlink.c
+++ b/fs/jfs/symlink.c
@@ -22,11 +22,11 @@
 #include "jfs_inode.h"
 #include "jfs_xattr.h"
 
-static int jfs_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *jfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         char *s = JFS_IP(dentry->d_inode)->i_inline;
         nd_set_link(nd, s);
-        return 0;
+        return NULL;
 }
 
 struct inode_operations jfs_symlink_inode_operations = {
diff --git a/fs/namei.c b/fs/namei.c
index b85f158aef0c..6ec1f0fefc5b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -501,6 +501,7 @@ struct path {
 static inline int __do_follow_link(struct path *path, struct nameidata *nd)
 {
         int error;
+        void *cookie;
         struct dentry *dentry = path->dentry;
 
         touch_atime(path->mnt, dentry);
@@ -508,13 +509,15 @@ static inline int __do_follow_link(struct path *path, struct nameidata *nd)
 
         if (path->mnt == nd->mnt)
                 mntget(path->mnt);
-        error = dentry->d_inode->i_op->follow_link(dentry, nd);
-        if (!error) {
+        cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
+        error = PTR_ERR(cookie);
+        if (!IS_ERR(cookie)) {
                 char *s = nd_get_link(nd);
+                error = 0;
                 if (s)
                         error = __vfs_follow_link(nd, s);
                 if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, nd);
+                        dentry->d_inode->i_op->put_link(dentry, nd, cookie);
         }
         dput(dentry);
         mntput(path->mnt);
@@ -2344,15 +2347,17 @@ out:
 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
         struct nameidata nd;
-        int res;
+        void *cookie;
+
         nd.depth = 0;
-        res = dentry->d_inode->i_op->follow_link(dentry, &nd);
-        if (!res) {
-                res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
+        cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
+        if (!IS_ERR(cookie)) {
+                int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
                 if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, &nd);
+                        dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
+                cookie = ERR_PTR(res);
         }
-        return res;
+        return PTR_ERR(cookie);
 }
 
 int vfs_follow_link(struct nameidata *nd, const char *link)
@@ -2395,23 +2400,20 @@ int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
         return res;
 }
 
-int page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
+void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
 {
-        struct page *page;
+        struct page *page = NULL;
         nd_set_link(nd, page_getlink(dentry, &page));
-        return 0;
+        return page;
 }
 
-void page_put_link(struct dentry *dentry, struct nameidata *nd)
+void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
-        if (!IS_ERR(nd_get_link(nd))) {
-                struct page *page;
-                page = find_get_page(dentry->d_inode->i_mapping, 0);
-                if (!page)
-                        BUG();
+        struct page *page = cookie;
+
+        if (page) {
                 kunmap(page);
                 page_cache_release(page);
-                page_cache_release(page);
         }
 }
 
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 147cbf9261ce..2df639f143e8 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -939,6 +939,7 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
         error = nfs_revalidate_inode(NFS_SERVER(dir), dir);
         if (error < 0) {
                 res = ERR_PTR(error);
+                unlock_kernel();
                 goto out;
         }
 
diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c
index 35f106599144..18dc95b0b646 100644
--- a/fs/nfs/symlink.c
+++ b/fs/nfs/symlink.c
@@ -27,26 +27,14 @@
 
 /* Symlink caching in the page cache is even more simplistic
  * and straight-forward than readdir caching.
- *
- * At the beginning of the page we store pointer to struct page in question,
- * simplifying nfs_put_link() (if inode got invalidated we can't find the page
- * to be freed via pagecache lookup).
- * The NUL-terminated string follows immediately thereafter.
  */
 
-struct nfs_symlink {
-        struct page *page;
-        char body[0];
-};
-
 static int nfs_symlink_filler(struct inode *inode, struct page *page)
 {
-        const unsigned int pgbase = offsetof(struct nfs_symlink, body);
-        const unsigned int pglen = PAGE_SIZE - pgbase;
         int error;
 
         lock_kernel();
-        error = NFS_PROTO(inode)->readlink(inode, page, pgbase, pglen);
+        error = NFS_PROTO(inode)->readlink(inode, page, 0, PAGE_SIZE);
         unlock_kernel();
         if (error < 0)
                 goto error;
@@ -60,11 +48,10 @@ error:
         return -EIO;
 }
 
-static int nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *inode = dentry->d_inode;
         struct page *page;
-        struct nfs_symlink *p;
         void *err = ERR_PTR(nfs_revalidate_inode(NFS_SERVER(inode), inode));
         if (err)
                 goto read_failed;
@@ -78,28 +65,20 @@ static int nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
                 err = ERR_PTR(-EIO);
                 goto getlink_read_error;
         }
-        p = kmap(page);
-        p->page = page;
-        nd_set_link(nd, p->body);
-        return 0;
+        nd_set_link(nd, kmap(page));
+        return page;
 
 getlink_read_error:
         page_cache_release(page);
 read_failed:
         nd_set_link(nd, err);
-        return 0;
+        return NULL;
 }
 
-static void nfs_put_link(struct dentry *dentry, struct nameidata *nd)
+static void nfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
-        char *s = nd_get_link(nd);
-        if (!IS_ERR(s)) {
-                struct nfs_symlink *p;
-                struct page *page;
-
-                p = container_of(s, struct nfs_symlink, body[0]);
-                page = p->page;
-
+        if (cookie) {
+                struct page *page = cookie;
                 kunmap(page);
                 page_cache_release(page);
         }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index ace151fa4878..491f2d9f89ac 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -890,7 +890,7 @@ static struct file_operations proc_seccomp_operations = {
 };
 #endif /* CONFIG_SECCOMP */
 
-static int proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *inode = dentry->d_inode;
         int error = -EACCES;
@@ -907,7 +907,7 @@ static int proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
         error = PROC_I(inode)->op.proc_get_link(inode, &nd->dentry, &nd->mnt);
         nd->last_type = LAST_BIND;
 out:
-        return error;
+        return ERR_PTR(error);
 }
 
 static int do_proc_readlink(struct dentry *dentry, struct vfsmount *mnt,
@@ -1692,11 +1692,11 @@ static int proc_self_readlink(struct dentry *dentry, char __user *buffer,
         return vfs_readlink(dentry,buffer,buflen,tmp);
 }
 
-static int proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         char tmp[30];
         sprintf(tmp, "%d", current->tgid);
-        return vfs_follow_link(nd,tmp);
+        return ERR_PTR(vfs_follow_link(nd,tmp));
 }       
 
 static struct inode_operations proc_self_inode_operations = {
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 6c6315d04028..abe8920313fb 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -329,10 +329,10 @@ static void release_inode_number(unsigned int inum)
         spin_unlock(&proc_inum_lock);
 }
 
-static int proc_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         nd_set_link(nd, PDE(dentry->d_inode)->data);
-        return 0;
+        return NULL;
 }
 
 static struct inode_operations proc_link_inode_operations = {
diff --git a/fs/smbfs/symlink.c b/fs/smbfs/symlink.c
index 8b069e06433d..0c64bc3a0127 100644
--- a/fs/smbfs/symlink.c
+++ b/fs/smbfs/symlink.c
@@ -34,7 +34,7 @@ int smb_symlink(struct inode *inode, struct dentry *dentry, const char *oldname)
         return smb_proc_symlink(server_from_dentry(dentry), dentry, oldname);
 }
 
-static int smb_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *smb_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         char *link = __getname();
         DEBUG1("followlink of %s/%s\n", DENTRY_PATH(dentry));
@@ -52,10 +52,10 @@ static int smb_follow_link(struct dentry *dentry, struct nameidata *nd)
                 }
         }
         nd_set_link(nd, link);
-        return 0;
+        return NULL;
 }
 
-static void smb_put_link(struct dentry *dentry, struct nameidata *nd)
+static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
 {
         char *s = nd_get_link(nd);
         if (!IS_ERR(s))
diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
index fae57c83a722..de402fa915f2 100644
--- a/fs/sysfs/symlink.c
+++ b/fs/sysfs/symlink.c
@@ -151,17 +151,17 @@ static int sysfs_getlink(struct dentry *dentry, char * path)
 
 }
 
-static int sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         int error = -ENOMEM;
         unsigned long page = get_zeroed_page(GFP_KERNEL);
         if (page)
                 error = sysfs_getlink(dentry, (char *) page); 
         nd_set_link(nd, error ? ERR_PTR(error) : (char *)page);
-        return 0;
+        return NULL;
 }
 
-static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd)
+static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
         char *page = nd_get_link(nd);
         if (!IS_ERR(page))
diff --git a/fs/sysv/symlink.c b/fs/sysv/symlink.c
index ed637db2dcb1..b85ce61d635c 100644
--- a/fs/sysv/symlink.c
+++ b/fs/sysv/symlink.c
@@ -8,10 +8,10 @@
 #include "sysv.h"
 #include <linux/namei.h>
 
-static int sysv_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *sysv_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         nd_set_link(nd, (char *)SYSV_I(dentry->d_inode)->i_data);
-        return 0;
+        return NULL;
 }
 
 struct inode_operations sysv_fast_symlink_inode_operations = {
diff --git a/fs/ufs/symlink.c b/fs/ufs/symlink.c
index a0e49149098f..337512ed5781 100644
--- a/fs/ufs/symlink.c
+++ b/fs/ufs/symlink.c
@@ -29,11 +29,11 @@
 #include <linux/namei.h>
 #include <linux/ufs_fs.h>
 
-static int ufs_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *ufs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct ufs_inode_info *p = UFS_I(dentry->d_inode);
         nd_set_link(nd, (char*)p->i_u1.i_symlink);
-        return 0;
+        return NULL;
 }
 
 struct inode_operations ufs_fast_symlink_inode_operations = {
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index 407e99359391..f252605514eb 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -374,7 +374,7 @@ linvfs_rename(
  * we need to be very careful about how much stack we use.
  * uio is kmalloced for this reason...
  */
-STATIC int
+STATIC void *
 linvfs_follow_link(
         struct dentry           *dentry,
         struct nameidata        *nd)
@@ -391,14 +391,14 @@ linvfs_follow_link(
         link = (char *)kmalloc(MAXNAMELEN+1, GFP_KERNEL);
         if (!link) {
                 nd_set_link(nd, ERR_PTR(-ENOMEM));
-                return 0;
+                return NULL;
         }
 
         uio = (uio_t *)kmalloc(sizeof(uio_t), GFP_KERNEL);
         if (!uio) {
                 kfree(link);
                 nd_set_link(nd, ERR_PTR(-ENOMEM));
-                return 0;
+                return NULL;
         }
 
         vp = LINVFS_GET_VP(dentry->d_inode);
@@ -422,10 +422,10 @@ linvfs_follow_link(
         kfree(uio);
 
         nd_set_link(nd, link);
-        return 0;
+        return NULL;
 }
 
-static void linvfs_put_link(struct dentry *dentry, struct nameidata *nd)
+static void linvfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
 {
         char *s = nd_get_link(nd);
         if (!IS_ERR(s))
diff --git a/include/asm-alpha/system.h b/include/asm-alpha/system.h
index c08ce970ff8c..bdb4d66418f1 100644
--- a/include/asm-alpha/system.h
+++ b/include/asm-alpha/system.h
@@ -443,22 +443,19 @@ __xchg_u64(volatile long *m, unsigned long val)
    if something tries to do an invalid xchg().  */
 extern void __xchg_called_with_bad_pointer(void);
 
-static inline unsigned long
-__xchg(volatile void *ptr, unsigned long x, int size)
-{
-        switch (size) {
-                case 1:
-                        return __xchg_u8(ptr, x);
-                case 2:
-                        return __xchg_u16(ptr, x);
-                case 4:
-                        return __xchg_u32(ptr, x);
-                case 8:
-                        return __xchg_u64(ptr, x);
-        }
-        __xchg_called_with_bad_pointer();
-        return x;
-}
+#define __xchg(ptr, x, size) \
+({ \
+        unsigned long __xchg__res; \
+        volatile void *__xchg__ptr = (ptr); \
+        switch (size) { \
+                case 1: __xchg__res = __xchg_u8(__xchg__ptr, x); break; \
+                case 2: __xchg__res = __xchg_u16(__xchg__ptr, x); break; \
+                case 4: __xchg__res = __xchg_u32(__xchg__ptr, x); break; \
+                case 8: __xchg__res = __xchg_u64(__xchg__ptr, x); break; \
+                default: __xchg_called_with_bad_pointer(); __xchg__res = x; \
+        } \
+        __xchg__res; \
+})
 
 #define xchg(ptr,x)                                                          \
   ({                                                                         \
diff --git a/include/asm-arm/arch-ixp4xx/timex.h b/include/asm-arm/arch-ixp4xx/timex.h
index 38c9d77d3727..3745e35cc030 100644
--- a/include/asm-arm/arch-ixp4xx/timex.h
+++ b/include/asm-arm/arch-ixp4xx/timex.h
@@ -7,7 +7,9 @@
 
 /*
  * We use IXP425 General purpose timer for our timer needs, it runs at 
- * 66.66... MHz
+ * 66.66... MHz. We do a convulted calculation of CLOCK_TICK_RATE b/c the
+ * timer register ignores the bottom 2 bits of the LATCH value.
  */
-#define CLOCK_TICK_RATE (66666666)
+#define FREQ 66666666
+#define CLOCK_TICK_RATE (((FREQ / HZ & ~IXP4XX_OST_RELOAD_MASK) + 1) * HZ)
 
diff --git a/include/asm-arm/bug.h b/include/asm-arm/bug.h
index 24d11672eb60..7fb02138f585 100644
--- a/include/asm-arm/bug.h
+++ b/include/asm-arm/bug.h
@@ -5,7 +5,7 @@
 
 #ifdef CONFIG_BUG
 #ifdef CONFIG_DEBUG_BUGVERBOSE
-extern volatile void __bug(const char *file, int line, void *data);
+extern void __bug(const char *file, int line, void *data) __attribute__((noreturn));
 
 /* give file/line information */
 #define BUG()           __bug(__FILE__, __LINE__, NULL)
diff --git a/include/asm-arm/cpu-multi32.h b/include/asm-arm/cpu-multi32.h
index ff48022e4720..4679f63688e9 100644
--- a/include/asm-arm/cpu-multi32.h
+++ b/include/asm-arm/cpu-multi32.h
@@ -31,7 +31,7 @@ extern struct processor {
         /*
          * Special stuff for a reset
          */
-        volatile void (*reset)(unsigned long addr);
+        void (*reset)(unsigned long addr) __attribute__((noreturn));
         /*
          * Idle the processor
          */
diff --git a/include/asm-arm/cpu-single.h b/include/asm-arm/cpu-single.h
index b5ec5d54665d..6723e67244fa 100644
--- a/include/asm-arm/cpu-single.h
+++ b/include/asm-arm/cpu-single.h
@@ -41,4 +41,4 @@ extern int cpu_do_idle(void);
 extern void cpu_dcache_clean_area(void *, int);
 extern void cpu_do_switch_mm(unsigned long pgd_phys, struct mm_struct *mm);
 extern void cpu_set_pte(pte_t *ptep, pte_t pte);
-extern volatile void cpu_reset(unsigned long addr);
+extern void cpu_reset(unsigned long addr) __attribute__((noreturn));
diff --git a/include/asm-ia64/io.h b/include/asm-ia64/io.h
index 491e9d1fc538..54e7637a326c 100644
--- a/include/asm-ia64/io.h
+++ b/include/asm-ia64/io.h
@@ -120,14 +120,6 @@ static inline void ___ia64_mmiowb(void)
         ia64_mfa();
 }
 
-static inline const unsigned long
-__ia64_get_io_port_base (void)
-{
-        extern unsigned long ia64_iobase;
-
-        return ia64_iobase;
-}
-
 static inline void*
 __ia64_mk_io_addr (unsigned long port)
 {
diff --git a/include/asm-m32r/smp.h b/include/asm-m32r/smp.h
index b9a20cdad65f..7885b7df84a2 100644
--- a/include/asm-m32r/smp.h
+++ b/include/asm-m32r/smp.h
@@ -61,9 +61,7 @@ extern physid_mask_t phys_cpu_present_map;
  * Some lowlevel functions might want to know about
  * the real CPU ID <-> CPU # mapping.
  */
-extern volatile int physid_2_cpu[NR_CPUS];
 extern volatile int cpu_2_physid[NR_CPUS];
-#define physid_to_cpu(physid)   physid_2_cpu[physid]
 #define cpu_to_physid(cpu_id)   cpu_2_physid[cpu_id]
 
 #define raw_smp_processor_id()  (current_thread_info()->cpu)
diff --git a/include/asm-ppc/time.h b/include/asm-ppc/time.h
index ce09b47fa819..321fb75b5f22 100644
--- a/include/asm-ppc/time.h
+++ b/include/asm-ppc/time.h
@@ -58,7 +58,7 @@ static __inline__ void set_dec(unsigned int val)
 /* Accessor functions for the timebase (RTC on 601) registers. */
 /* If one day CONFIG_POWER is added just define __USE_RTC as 1 */
 #ifdef CONFIG_6xx
-extern __inline__ int const __USE_RTC(void) {
+extern __inline__ int __attribute_pure__ __USE_RTC(void) {
         return (mfspr(SPRN_PVR)>>16) == 1;
 }
 #else
diff --git a/include/asm-s390/uaccess.h b/include/asm-s390/uaccess.h
index a7f43a251f81..3e3bfe6a8fa8 100644
--- a/include/asm-s390/uaccess.h
+++ b/include/asm-s390/uaccess.h
@@ -149,11 +149,11 @@ struct exception_table_entry
 })
 #endif
 
-#ifndef __CHECKER__
 #define __put_user(x, ptr) \
 ({                                                              \
         __typeof__(*(ptr)) __x = (x);                           \
         int __pu_err;                                           \
+        __chk_user_ptr(ptr);                                    \
         switch (sizeof (*(ptr))) {                              \
         case 1:                                                 \
         case 2:                                                 \
@@ -167,14 +167,6 @@ struct exception_table_entry
          }                                                      \
         __pu_err;                                               \
 })
-#else
-#define __put_user(x, ptr)                      \
-({                                              \
-        void __user *p;                         \
-        p = (ptr);                              \
-        0;                                      \
-})
-#endif
 
 #define put_user(x, ptr)                                        \
 ({                                                              \
@@ -213,11 +205,11 @@ extern int __put_user_bad(void) __attribute__((noreturn));
 })
 #endif
 
-#ifndef __CHECKER__
 #define __get_user(x, ptr)                                      \
 ({                                                              \
         __typeof__(*(ptr)) __x;                                 \
         int __gu_err;                                           \
+        __chk_user_ptr(ptr);                                    \
         switch (sizeof(*(ptr))) {                               \
         case 1:                                                 \
         case 2:                                                 \
@@ -232,15 +224,6 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         (x) = __x;                                              \
         __gu_err;                                               \
 })
-#else
-#define __get_user(x, ptr)                      \
-({                                              \
-        void __user *p;                         \
-        p = (ptr);                              \
-        0;                                      \
-})
-#endif
-
 
 #define get_user(x, ptr)                                        \
 ({                                                              \
diff --git a/include/asm-sparc64/thread_info.h b/include/asm-sparc64/thread_info.h
index 352d9943661a..c94d8b3991bd 100644
--- a/include/asm-sparc64/thread_info.h
+++ b/include/asm-sparc64/thread_info.h
@@ -68,6 +68,9 @@ struct thread_info {
 
         struct restart_block    restart_block;
 
+        struct pt_regs          *kern_una_regs;
+        unsigned int            kern_una_insn;
+
         unsigned long           fpregs[0] __attribute__ ((aligned(64)));
 };
 
@@ -103,6 +106,8 @@ struct thread_info {
 #define TI_PCR          0x00000490
 #define TI_CEE_STUFF    0x00000498
 #define TI_RESTART_BLOCK 0x000004a0
+#define TI_KUNA_REGS    0x000004c8
+#define TI_KUNA_INSN    0x000004d0
 #define TI_FPREGS       0x00000500
 
 /* We embed this in the uppermost byte of thread_info->flags */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index f9adf75fd9b4..67e6732d4fdc 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -993,8 +993,8 @@ struct inode_operations {
         int (*rename) (struct inode *, struct dentry *,
                         struct inode *, struct dentry *);
         int (*readlink) (struct dentry *, char __user *,int);
-        int (*follow_link) (struct dentry *, struct nameidata *);
-        void (*put_link) (struct dentry *, struct nameidata *);
+        void * (*follow_link) (struct dentry *, struct nameidata *);
+        void (*put_link) (struct dentry *, struct nameidata *, void *);
         void (*truncate) (struct inode *);
         int (*permission) (struct inode *, int, struct nameidata *);
         int (*setattr) (struct dentry *, struct iattr *);
@@ -1602,8 +1602,8 @@ extern struct file_operations generic_ro_fops;
 extern int vfs_readlink(struct dentry *, char __user *, int, const char *);
 extern int vfs_follow_link(struct nameidata *, const char *);
 extern int page_readlink(struct dentry *, char __user *, int);
-extern int page_follow_link_light(struct dentry *, struct nameidata *);
-extern void page_put_link(struct dentry *, struct nameidata *);
+extern void *page_follow_link_light(struct dentry *, struct nameidata *);
+extern void page_put_link(struct dentry *, struct nameidata *, void *);
 extern int page_symlink(struct inode *inode, const char *symname, int len);
 extern struct inode_operations page_symlink_inode_operations;
 extern int generic_readlink(struct dentry *, char __user *, int);
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 828a3a93dda1..3696f988a9f1 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -139,11 +139,25 @@ enum {
 #define AX25_DEF_DS_TIMEOUT     (3 * 60 * HZ)           /* DAMA timeout 3 minutes */
 
 typedef struct ax25_uid_assoc {
-        struct ax25_uid_assoc   *next;
+        struct hlist_node       uid_node;
+        atomic_t                refcount;
         uid_t                   uid;
         ax25_address            call;
 } ax25_uid_assoc;
 
+#define ax25_uid_for_each(__ax25, node, list) \
+        hlist_for_each_entry(__ax25, node, list, uid_node)
+
+#define ax25_uid_hold(ax25) \
+        atomic_inc(&((ax25)->refcount))
+
+static inline void ax25_uid_put(ax25_uid_assoc *assoc)
+{
+        if (atomic_dec_and_test(&assoc->refcount)) {
+                kfree(assoc);
+        }
+}
+
 typedef struct {
         ax25_address            calls[AX25_MAX_DIGIS];
         unsigned char           repeated[AX25_MAX_DIGIS];
@@ -376,7 +390,7 @@ extern unsigned long ax25_display_timer(struct timer_list *);
 
 /* ax25_uid.c */
 extern int  ax25_uid_policy;
-extern ax25_address *ax25_findbyuid(uid_t);
+extern ax25_uid_assoc *ax25_findbyuid(uid_t);
 extern int  ax25_uid_ioctl(int, struct sockaddr_ax25 *);
 extern struct file_operations ax25_uid_fops;
 extern void ax25_uid_free(void);
diff --git a/include/net/sock.h b/include/net/sock.h
index a1042d08becd..e9b1dbab90d0 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -384,6 +384,11 @@ enum sock_flags {
         SOCK_QUEUE_SHRUNK, /* write queue has been shrunk recently */
 };
 
+static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
+{
+        nsk->sk_flags = osk->sk_flags;
+}
+
 static inline void sock_set_flag(struct sock *sk, enum sock_flags flag)
 {
         __set_bit(flag, &sk->sk_flags);
diff --git a/include/sound/core.h b/include/sound/core.h
index 38b357fc8958..f72b3ef515e2 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -360,11 +360,13 @@ int snd_device_free_all(snd_card_t *card, snd_device_cmd_t cmd);
 
 /* isadma.c */
 
+#ifdef CONFIG_ISA_DMA_API
 #define DMA_MODE_NO_ENABLE      0x0100
 
 void snd_dma_program(unsigned long dma, unsigned long addr, unsigned int size, unsigned short mode);
 void snd_dma_disable(unsigned long dma);
 unsigned int snd_dma_pointer(unsigned long dma, unsigned int size);
+#endif
 
 /* misc.c */
 
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 21a4e3b2cbda..e0d296c5b302 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -636,6 +636,23 @@ static void update_cpu_domains(struct cpuset *cur)
                 return;
 
         /*
+         * Hack to avoid 2.6.13 partial node dynamic sched domain bug.
+         * Require the 'cpu_exclusive' cpuset to include all (or none)
+         * of the CPUs on each node, or return w/o changing sched domains.
+         * Remove this hack when dynamic sched domains fixed.
+         */
+        {
+                int i, j;
+
+                for_each_cpu_mask(i, cur->cpus_allowed) {
+                        for_each_cpu_mask(j, node_to_cpumask(cpu_to_node(i))) {
+                                if (!cpu_isset(j, cur->cpus_allowed))
+                                        return;
+                        }
+                }
+        }
+
+        /*
          * Get all cpus from parent's cpus_allowed not part of exclusive
          * children
          */
diff --git a/kernel/timer.c b/kernel/timer.c
index f2a11887a726..5377f40723ff 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1023,7 +1023,7 @@ asmlinkage long sys_getppid(void)
         parent = me->group_leader->real_parent;
         for (;;) {
                 pid = parent->tgid;
-#ifdef CONFIG_SMP
+#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
 {
                 struct task_struct *old = parent;
 
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index a9bda0a361f3..e4e9031dd9c3 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -269,6 +269,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
         int qualifier;          /* 'h', 'l', or 'L' for integer fields */
                                 /* 'z' support added 23/7/1999 S.H.    */
                                 /* 'z' changed to 'Z' --davidm 1/25/99 */
+                                /* 't' added for ptrdiff_t */
 
         /* Reject out-of-range values early */
         if (unlikely((int) size < 0)) {
@@ -339,7 +340,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                 /* get the conversion qualifier */
                 qualifier = -1;
                 if (*fmt == 'h' || *fmt == 'l' || *fmt == 'L' ||
-                    *fmt =='Z' || *fmt == 'z') {
+                    *fmt =='Z' || *fmt == 'z' || *fmt == 't') {
                         qualifier = *fmt;
                         ++fmt;
                         if (qualifier == 'l' && *fmt == 'l') {
@@ -467,6 +468,8 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                                 num = (signed long) num;
                 } else if (qualifier == 'Z' || qualifier == 'z') {
                         num = va_arg(args, size_t);
+                } else if (qualifier == 't') {
+                        num = va_arg(args, ptrdiff_t);
                 } else if (qualifier == 'h') {
                         num = (unsigned short) va_arg(args, int);
                         if (flags & SIGN)
diff --git a/mm/shmem.c b/mm/shmem.c
index e64fa726a790..5a81b1ee4f7a 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1773,32 +1773,27 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
         return 0;
 }
 
-static int shmem_follow_link_inline(struct dentry *dentry, struct nameidata *nd)
+static void *shmem_follow_link_inline(struct dentry *dentry, struct nameidata *nd)
 {
         nd_set_link(nd, (char *)SHMEM_I(dentry->d_inode));
-        return 0;
+        return NULL;
 }
 
-static int shmem_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void *shmem_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct page *page = NULL;
         int res = shmem_getpage(dentry->d_inode, 0, &page, SGP_READ, NULL);
         nd_set_link(nd, res ? ERR_PTR(res) : kmap(page));
-        return 0;
+        return page;
 }
 
-static void shmem_put_link(struct dentry *dentry, struct nameidata *nd)
+static void shmem_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
         if (!IS_ERR(nd_get_link(nd))) {
-                struct page *page;
-
-                page = find_get_page(dentry->d_inode->i_mapping, 0);
-                if (!page)
-                        BUG();
+                struct page *page = cookie;
                 kunmap(page);
                 mark_page_accessed(page);
                 page_cache_release(page);
-                page_cache_release(page);
         }
 }
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 707097deac3d..a5c94f11547c 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -875,12 +875,7 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
         sk->sk_sndbuf   = osk->sk_sndbuf;
         sk->sk_state    = TCP_ESTABLISHED;
         sk->sk_sleep    = osk->sk_sleep;
-
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
-
-        if (sock_flag(osk, SOCK_ZAPPED))
-                sock_set_flag(sk, SOCK_ZAPPED);
+        sock_copy_flags(sk, osk);
 
         oax25 = ax25_sk(osk);
 
@@ -1007,7 +1002,8 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sock *sk = sock->sk;
         struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
         ax25_dev *ax25_dev = NULL;
-        ax25_address *call;
+        ax25_uid_assoc *user;
+        ax25_address call;
         ax25_cb *ax25;
         int err = 0;
 
@@ -1026,9 +1022,15 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr->fsa_ax25.sax25_family != AF_AX25)
                 return -EINVAL;
 
-        call = ax25_findbyuid(current->euid);
-        if (call == NULL && ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
-                return -EACCES;
+        user = ax25_findbyuid(current->euid);
+        if (user) {
+                call = user->call;
+                ax25_uid_put(user);
+        } else {
+                if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                call = addr->fsa_ax25.sax25_call;
         }
 
         lock_sock(sk);
@@ -1039,10 +1041,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         }
 
-        if (call == NULL)
-                ax25->source_addr = addr->fsa_ax25.sax25_call;
-        else
-                ax25->source_addr = *call;
+        ax25->source_addr = call;
 
         /*
          * User already set interface with SO_BINDTODEVICE
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index 44b99b1ff9f8..c288526da4ce 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -422,8 +422,8 @@ static inline void ax25_adjust_path(ax25_address *addr, ax25_digi *digipeat)
  */
 int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
 {
+        ax25_uid_assoc *user;
         ax25_route *ax25_rt;
-        ax25_address *call;
         int err;
 
         if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
@@ -434,16 +434,18 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
                 goto put;
         }
 
-        if ((call = ax25_findbyuid(current->euid)) == NULL) {
+        user = ax25_findbyuid(current->euid);
+        if (user) {
+                ax25->source_addr = user->call;
+                ax25_uid_put(user);
+        } else {
                 if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
                         err = -EPERM;
                         goto put;
                 }
-                call = (ax25_address *)ax25->ax25_dev->dev->dev_addr;
+                ax25->source_addr = *(ax25_address *)ax25->ax25_dev->dev->dev_addr;
         }
 
-        ax25->source_addr = *call;
-
         if (ax25_rt->digipeat != NULL) {
                 if ((ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
                         err = -ENOMEM;
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index cea6b7d19729..a8b3822f3ee4 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -28,6 +28,7 @@
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
+#include <linux/list.h>
 #include <linux/notifier.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -41,38 +42,41 @@
  *      Callsign/UID mapper. This is in kernel space for security on multi-amateur machines.
  */
 
-static ax25_uid_assoc *ax25_uid_list;
+HLIST_HEAD(ax25_uid_list);
 static DEFINE_RWLOCK(ax25_uid_lock);
 
 int ax25_uid_policy = 0;
 
-ax25_address *ax25_findbyuid(uid_t uid)
+ax25_uid_assoc *ax25_findbyuid(uid_t uid)
 {
-        ax25_uid_assoc *ax25_uid;
-        ax25_address *res = NULL;
+        ax25_uid_assoc *ax25_uid, *res = NULL;
+        struct hlist_node *node;
 
         read_lock(&ax25_uid_lock);
-        for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                 if (ax25_uid->uid == uid) {
-                        res = &ax25_uid->call;
+                        ax25_uid_hold(ax25_uid);
+                        res = ax25_uid;
                         break;
                 }
         }
         read_unlock(&ax25_uid_lock);
 
-        return NULL;
+        return res;
 }
 
 int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 {
-        ax25_uid_assoc *s, *ax25_uid;
+        ax25_uid_assoc *ax25_uid;
+        struct hlist_node *node;
+        ax25_uid_assoc *user;
         unsigned long res;
 
         switch (cmd) {
         case SIOCAX25GETUID:
                 res = -ENOENT;
                 read_lock(&ax25_uid_lock);
-                for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                         if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
                                 res = ax25_uid->uid;
                                 break;
@@ -85,19 +89,22 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
         case SIOCAX25ADDUID:
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
-                if (ax25_findbyuid(sax->sax25_uid))
+                user = ax25_findbyuid(sax->sax25_uid);
+                if (user) {
+                        ax25_uid_put(user);
                         return -EEXIST;
+                }
                 if (sax->sax25_uid == 0)
                         return -EINVAL;
                 if ((ax25_uid = kmalloc(sizeof(*ax25_uid), GFP_KERNEL)) == NULL)
                         return -ENOMEM;
 
+                atomic_set(&ax25_uid->refcount, 1);
                 ax25_uid->uid  = sax->sax25_uid;
                 ax25_uid->call = sax->sax25_call;
 
                 write_lock(&ax25_uid_lock);
-                ax25_uid->next = ax25_uid_list;
-                ax25_uid_list  = ax25_uid;
+                hlist_add_head(&ax25_uid->uid_node, &ax25_uid_list);
                 write_unlock(&ax25_uid_lock);
 
                 return 0;
@@ -106,34 +113,21 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
+                ax25_uid = NULL;
                 write_lock(&ax25_uid_lock);
-                for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
-                        if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
+                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+                        if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0)
                                 break;
-                        }
                 }
                 if (ax25_uid == NULL) {
                         write_unlock(&ax25_uid_lock);
                         return -ENOENT;
                 }
-                if ((s = ax25_uid_list) == ax25_uid) {
-                        ax25_uid_list = s->next;
-                        write_unlock(&ax25_uid_lock);
-                        kfree(ax25_uid);
-                        return 0;
-                }
-                while (s != NULL && s->next != NULL) {
-                        if (s->next == ax25_uid) {
-                                s->next = ax25_uid->next;
-                                write_unlock(&ax25_uid_lock);
-                                kfree(ax25_uid);
-                                return 0;
-                        }
-                        s = s->next;
-                }
+                hlist_del_init(&ax25_uid->uid_node);
+                ax25_uid_put(ax25_uid);
                 write_unlock(&ax25_uid_lock);
 
-                return -ENOENT;
+                return 0;
 
         default:
                 return -EINVAL;
@@ -147,13 +141,11 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct ax25_uid_assoc *pt;
-        int i = 1;
+        struct hlist_node *node;
+        int i = 0;
 
         read_lock(&ax25_uid_lock);
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        for (pt = ax25_uid_list; pt != NULL; pt = pt->next) {
+        ax25_uid_for_each(pt, node, &ax25_uid_list) {
                 if (i == *pos)
                         return pt;
                 ++i;
@@ -164,8 +156,9 @@ static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
 static void *ax25_uid_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         ++*pos;
-        return (v == SEQ_START_TOKEN) ? ax25_uid_list : 
-                ((struct ax25_uid_assoc *) v)->next;
+
+        return hlist_entry(((ax25_uid_assoc *)v)->uid_node.next,
+                           ax25_uid_assoc, uid_node);
 }
 
 static void ax25_uid_seq_stop(struct seq_file *seq, void *v)
@@ -179,7 +172,6 @@ static int ax25_uid_seq_show(struct seq_file *seq, void *v)
                 seq_printf(seq, "Policy: %d\n", ax25_uid_policy);
         else {
                 struct ax25_uid_assoc *pt = v;
-                
 
                 seq_printf(seq, "%6d %s\n", pt->uid, ax2asc(&pt->call));
         }
@@ -213,16 +205,13 @@ struct file_operations ax25_uid_fops = {
  */
 void __exit ax25_uid_free(void)
 {
-        ax25_uid_assoc *s, *ax25_uid;
+        ax25_uid_assoc *ax25_uid;
+        struct hlist_node *node;
 
         write_lock(&ax25_uid_lock);
-        ax25_uid = ax25_uid_list;
-        while (ax25_uid != NULL) {
-                s        = ax25_uid;
-                ax25_uid = ax25_uid->next;
-
-                kfree(s);
+        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+                hlist_del_init(&ax25_uid->uid_node);
+                ax25_uid_put(ax25_uid);
         }
-        ax25_uid_list = NULL;
         write_unlock(&ax25_uid_lock);
 }
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 95473953c406..ab18a853d7ce 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -450,10 +450,13 @@ static void peer_check_expire(unsigned long dummy)
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
          * less interval). */
-        peer_periodic_timer.expires = jiffies
-                + inet_peer_gc_maxtime
-                - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-                        peer_total / inet_peer_threshold * HZ;
+        if (peer_total >= inet_peer_threshold)
+                peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
+        else
+                peer_periodic_timer.expires = jiffies
+                        + inet_peer_gc_maxtime
+                        - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
+                                peer_total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
 
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index eda1fba431a4..c6baa8174389 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -214,6 +214,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                 break;
         
         case IPQ_COPY_PACKET:
+                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                    (*errp = skb_checksum_help(entry->skb,
+                                               entry->info->outdev == NULL))) {
+                        read_unlock_bh(&queue_lock);
+                        return NULL;
+                }
                 if (copy_range == 0 || copy_range > entry->skb->len)
                         data_len = entry->skb->len;
                 else
@@ -385,6 +391,7 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (!skb_ip_make_writable(&e->skb, v->data_len))
                 return -ENOMEM;
         memcpy(e->skb->data, v->payload, v->data_len);
+        e->skb->ip_summed = CHECKSUM_NONE;
         e->skb->nfcache |= NFC_ALTERED;
 
         /*
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index ada9911118e9..94a0ce1c1c9d 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -61,16 +61,20 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
         if (!tcph)
                 return 0;
 
-        if (!(einfo->operation & IPT_ECN_OP_SET_ECE
-              || tcph->ece == einfo->proto.tcp.ece)
-            && (!(einfo->operation & IPT_ECN_OP_SET_CWR
-                  || tcph->cwr == einfo->proto.tcp.cwr)))
+        if ((!(einfo->operation & IPT_ECN_OP_SET_ECE) ||
+             tcph->ece == einfo->proto.tcp.ece) &&
+            ((!(einfo->operation & IPT_ECN_OP_SET_CWR) ||
+             tcph->cwr == einfo->proto.tcp.cwr)))
                 return 1;
 
         if (!skb_ip_make_writable(pskb, (*pskb)->nh.iph->ihl*4+sizeof(*tcph)))
                 return 0;
         tcph = (void *)(*pskb)->nh.iph + (*pskb)->nh.iph->ihl*4;
 
+        if ((*pskb)->ip_summed == CHECKSUM_HW &&
+            skb_checksum_help(*pskb, inward))
+                return 0;
+
         diffs[0] = ((u_int16_t *)tcph)[6];
         if (einfo->operation & IPT_ECN_OP_SET_ECE)
                 tcph->ece = einfo->proto.tcp.ece;
@@ -79,13 +83,10 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
         diffs[1] = ((u_int16_t *)tcph)[6];
         diffs[0] = diffs[0] ^ 0xFFFF;
 
-        if ((*pskb)->ip_summed != CHECKSUM_HW)
+        if ((*pskb)->ip_summed != CHECKSUM_UNNECESSARY)
                 tcph->check = csum_fold(csum_partial((char *)diffs,
                                                      sizeof(diffs),
                                                      tcph->check^0xFFFF));
-        else
-                if (skb_checksum_help(*pskb, inward))
-                        return 0;
         (*pskb)->nfcache |= NFC_ALTERED;
         return 1;
 }
diff --git a/net/ipv4/netfilter/ipt_TCPMSS.c b/net/ipv4/netfilter/ipt_TCPMSS.c
index 1049050b2bfb..7b84a254440e 100644
--- a/net/ipv4/netfilter/ipt_TCPMSS.c
+++ b/net/ipv4/netfilter/ipt_TCPMSS.c
@@ -61,6 +61,10 @@ ipt_tcpmss_target(struct sk_buff **pskb,
         if (!skb_ip_make_writable(pskb, (*pskb)->len))
                 return NF_DROP;
 
+        if ((*pskb)->ip_summed == CHECKSUM_HW &&
+            skb_checksum_help(*pskb, out == NULL))
+                return NF_DROP;
+
         iph = (*pskb)->nh.iph;
         tcplen = (*pskb)->len - iph->ihl*4;
 
@@ -186,9 +190,6 @@ ipt_tcpmss_target(struct sk_buff **pskb,
                newmss);
 
  retmodified:
-        /* We never hw checksum SYN packets.  */
-        BUG_ON((*pskb)->ip_summed == CHECKSUM_HW);
-
         (*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
         return IPT_CONTINUE;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ddb6ce4ecff2..69b1fcf70077 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -584,7 +584,7 @@ static inline void skb_entail(struct sock *sk, struct tcp_sock *tp,
         sk_charge_skb(sk, skb);
         if (!sk->sk_send_head)
                 sk->sk_send_head = skb;
-        else if (tp->nonagle&TCP_NAGLE_PUSH)
+        if (tp->nonagle & TCP_NAGLE_PUSH)
                 tp->nonagle &= ~TCP_NAGLE_PUSH; 
 }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5d91213d34c0..67c670886c1f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -242,9 +242,14 @@ static int tcp_v4_get_port(struct sock *sk, unsigned short snum)
                 tcp_port_rover = rover;
                 spin_unlock(&tcp_portalloc_lock);
 
-                /* Exhausted local port range during search? */
+                /* Exhausted local port range during search?  It is not
+                 * possible for us to be holding one of the bind hash
+                 * locks if this test triggers, because if 'remaining'
+                 * drops to zero, we broke out of the do/while loop at
+                 * the top level, not from the 'break;' statement.
+                 */
                 ret = 1;
-                if (remaining <= 0)
+                if (unlikely(remaining <= 0))
                         goto fail;
 
                 /* OK, here is the one we will use.  HEAD is
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 566045e58437..dd30dd137b74 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -925,10 +925,6 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
         limit = min(send_win, cong_win);
 
-        /* If sk_send_head can be sent fully now, just do it.  */
-        if (skb->len <= limit)
-                return 0;
-
         if (sysctl_tcp_tso_win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5493180f0d44..a16df5b27c84 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -211,6 +211,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                 break;
         
         case IPQ_COPY_PACKET:
+                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                    (*errp = skb_checksum_help(entry->skb,
+                                               entry->info->outdev == NULL))) {
+                        read_unlock_bh(&queue_lock);
+                        return NULL;
+                }
                 if (copy_range == 0 || copy_range > entry->skb->len)
                         data_len = entry->skb->len;
                 else
@@ -381,6 +387,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (!skb_ip_make_writable(&e->skb, v->data_len))
                 return -ENOMEM;
         memcpy(e->skb->data, v->payload, v->data_len);
+        e->skb->ip_summed = CHECKSUM_NONE;
         e->skb->nfcache |= NFC_ALTERED;
 
         /*
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6e288dc116e..ef29cfd936d3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -158,9 +158,14 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                 tcp_port_rover = rover;
                 spin_unlock(&tcp_portalloc_lock);
 
-                /* Exhausted local port range during search? */
+                /* Exhausted local port range during search?  It is not
+                 * possible for us to be holding one of the bind hash
+                 * locks if this test triggers, because if 'remaining'
+                 * drops to zero, we broke out of the do/while loop at
+                 * the top level, not from the 'break;' statement.
+                 */
                 ret = 1;
-                if (remaining <= 0)
+                if (unlikely(remaining <= 0))
                         goto fail;
 
                 /* OK, here is the one we will use. */
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 31ed4a9a1d06..162a85fed150 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -459,12 +459,7 @@ static struct sock *nr_make_new(struct sock *osk)
         sk->sk_sndbuf   = osk->sk_sndbuf;
         sk->sk_state    = TCP_ESTABLISHED;
         sk->sk_sleep    = osk->sk_sleep;
-
-        if (sock_flag(osk, SOCK_ZAPPED))
-                sock_set_flag(sk, SOCK_ZAPPED);
-
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
+        sock_copy_flags(sk, osk);
 
         skb_queue_head_init(&nr->ack_queue);
         skb_queue_head_init(&nr->reseq_queue);
@@ -541,7 +536,8 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct nr_sock *nr = nr_sk(sk);
         struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
         struct net_device *dev;
-        ax25_address *user, *source;
+        ax25_uid_assoc *user;
+        ax25_address *source;
 
         lock_sock(sk);
         if (!sock_flag(sk, SOCK_ZAPPED)) {
@@ -580,16 +576,19 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         } else {
                 source = &addr->fsa_ax25.sax25_call;
 
-                if ((user = ax25_findbyuid(current->euid)) == NULL) {
+                user = ax25_findbyuid(current->euid);
+                if (user) {
+                        nr->user_addr   = user->call;
+                        ax25_uid_put(user);
+                } else {
                         if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
                                 release_sock(sk);
                                 dev_put(dev);
                                 return -EPERM;
                         }
-                        user = source;
+                        nr->user_addr   = *source;
                 }
 
-                nr->user_addr   = *user;
                 nr->source_addr = *source;
         }
 
@@ -609,7 +608,8 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct nr_sock *nr = nr_sk(sk);
         struct sockaddr_ax25 *addr = (struct sockaddr_ax25 *)uaddr;
-        ax25_address *user, *source = NULL;
+        ax25_address *source = NULL;
+        ax25_uid_assoc *user;
         struct net_device *dev;
 
         lock_sock(sk);
@@ -650,16 +650,19 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
                 }
                 source = (ax25_address *)dev->dev_addr;
 
-                if ((user = ax25_findbyuid(current->euid)) == NULL) {
+                user = ax25_findbyuid(current->euid);
+                if (user) {
+                        nr->user_addr   = user->call;
+                        ax25_uid_put(user);
+                } else {
                         if (ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
                                 dev_put(dev);
                                 release_sock(sk);
                                 return -EPERM;
                         }
-                        user = source;
+                        nr->user_addr   = *source;
                 }
 
-                nr->user_addr   = *user;
                 nr->source_addr = *source;
                 nr->device      = dev;
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 7eb6a5bf93ea..5480caf8ccc2 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -556,12 +556,7 @@ static struct sock *rose_make_new(struct sock *osk)
         sk->sk_sndbuf   = osk->sk_sndbuf;
         sk->sk_state    = TCP_ESTABLISHED;
         sk->sk_sleep    = osk->sk_sleep;
-
-        if (sock_flag(osk, SOCK_ZAPPED))
-                sock_set_flag(sk, SOCK_ZAPPED);
-
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
+        sock_copy_flags(sk, osk);
 
         init_timer(&rose->timer);
         init_timer(&rose->idletimer);
@@ -631,7 +626,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct rose_sock *rose = rose_sk(sk);
         struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
         struct net_device *dev;
-        ax25_address *user, *source;
+        ax25_address *source;
+        ax25_uid_assoc *user;
         int n;
 
         if (!sock_flag(sk, SOCK_ZAPPED))
@@ -656,14 +652,17 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         source = &addr->srose_call;
 
-        if ((user = ax25_findbyuid(current->euid)) == NULL) {
+        user = ax25_findbyuid(current->euid);
+        if (user) {
+                rose->source_call = user->call;
+                ax25_uid_put(user);
+        } else {
                 if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE))
                         return -EACCES;
-                user = source;
+                rose->source_call   = *source;
         }
 
         rose->source_addr   = addr->srose_addr;
-        rose->source_call   = *user;
         rose->device        = dev;
         rose->source_ndigis = addr->srose_ndigis;
 
@@ -690,8 +689,8 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
         struct rose_sock *rose = rose_sk(sk);
         struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
         unsigned char cause, diagnostic;
-        ax25_address *user;
         struct net_device *dev;
+        ax25_uid_assoc *user;
         int n;
 
         if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
@@ -741,12 +740,14 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
                 if ((dev = rose_dev_first()) == NULL)
                         return -ENETUNREACH;
 
-                if ((user = ax25_findbyuid(current->euid)) == NULL)
+                user = ax25_findbyuid(current->euid);
+                if (!user)
                         return -EINVAL;
 
                 memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
-                rose->source_call = *user;
+                rose->source_call = user->call;
                 rose->device      = dev;
+                ax25_uid_put(user);
 
                 rose_insert_socket(sk);         /* Finish the bind */
         }
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index ff73ebb912b8..25da6f699fd0 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -994,8 +994,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
          *      1. The frame isn't for us,
          *      2. It isn't "owned" by any existing route.
          */
-        if (frametype != ROSE_CALL_REQUEST)     /* XXX */
-                return 0;
+        if (frametype != ROSE_CALL_REQUEST) {   /* XXX */
+                res = 0;
+                goto out;
+        }
 
         len  = (((skb->data[3] >> 4) & 0x0F) + 1) / 2;
         len += (((skb->data[3] >> 0) & 0x0F) + 1) / 2;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 8edefd5d095d..0d066c965342 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -438,6 +438,7 @@ struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops)
         if (!ops->init || ops->init(sch, NULL) == 0)
                 return sch;
 
+        qdisc_destroy(sch);
 errout:
         return NULL;
 }
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 98d49ec9b74b..b74f7772b576 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -57,6 +57,7 @@ static struct snmp_mib sctp_snmp_list[] = {
         SNMP_MIB_ITEM("SctpReasmUsrMsgs", SCTP_MIB_REASMUSRMSGS),
         SNMP_MIB_ITEM("SctpOutSCTPPacks", SCTP_MIB_OUTSCTPPACKS),
         SNMP_MIB_ITEM("SctpInSCTPPacks", SCTP_MIB_INSCTPPACKS),
+        SNMP_MIB_SENTINEL
 };
 
 /* Return the current value of a particular entry in the mib by adding its
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 24c21f2a33a7..5a7265aeaf83 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -185,9 +185,7 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
                         sg->page = body->pages[i];
                         sg->offset = offset;
                         sg->length = thislen;
-                        kmap(sg->page); /* XXX kmap_atomic? */
                         crypto_digest_update(tfm, sg, 1);
-                        kunmap(sg->page);
                         len -= thislen;
                         i++;
                         offset = 0;
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 9b9f94c915d2..09ffca54b373 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -359,11 +359,16 @@ handle_modversions(struct module *mod, struct elf_info *info,
                 /* ignore __this_module, it will be resolved shortly */
                 if (strcmp(symname, MODULE_SYMBOL_PREFIX "__this_module") == 0)
                         break;
-#ifdef STT_REGISTER
+/* cope with newer glibc (2.3.4 or higher) STT_ definition in elf.h */
+#if defined(STT_REGISTER) || defined(STT_SPARC_REGISTER)
+/* add compatibility with older glibc */
+#ifndef STT_SPARC_REGISTER
+#define STT_SPARC_REGISTER STT_REGISTER
+#endif
                 if (info->hdr->e_machine == EM_SPARC ||
                     info->hdr->e_machine == EM_SPARCV9) {
                         /* Ignore register directives. */
-                        if (ELF_ST_TYPE(sym->st_info) == STT_REGISTER)
+                        if (ELF_ST_TYPE(sym->st_info) == STT_SPARC_REGISTER)
                                 break;
                 }
 #endif
diff --git a/sound/Kconfig b/sound/Kconfig
index ee794ae06040..b65ee4701f98 100644
--- a/sound/Kconfig
+++ b/sound/Kconfig
@@ -77,7 +77,7 @@ source "sound/parisc/Kconfig"
 endmenu
 
 menu "Open Sound System"
-        depends on SOUND!=n && (BROKEN || (!SPARC32 && !SPARC64))
+        depends on SOUND!=n
 
 config SOUND_PRIME
         tristate "Open Sound System (DEPRECATED)"
diff --git a/sound/core/Makefile b/sound/core/Makefile
index 764ac184b223..969d75528bde 100644
--- a/sound/core/Makefile
+++ b/sound/core/Makefile
@@ -5,7 +5,7 @@
 
 snd-objs     := sound.o init.o memory.o info.o control.o misc.o \
                 device.o wrappers.o
-ifeq ($(CONFIG_ISA),y)
+ifeq ($(CONFIG_ISA_DMA_API),y)
 snd-objs     += isadma.o
 endif
 ifeq ($(CONFIG_SND_OSSEMUL),y)
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 7612884f530b..3271e9245490 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -432,7 +432,7 @@ EXPORT_SYMBOL(snd_device_new);
 EXPORT_SYMBOL(snd_device_register);
 EXPORT_SYMBOL(snd_device_free);
   /* isadma.c */
-#ifdef CONFIG_ISA
+#ifdef CONFIG_ISA_DMA_API
 EXPORT_SYMBOL(snd_dma_program);
 EXPORT_SYMBOL(snd_dma_disable);
 EXPORT_SYMBOL(snd_dma_pointer);
diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig
index 148a856a43ad..be4ea60a3679 100644
--- a/sound/isa/Kconfig
+++ b/sound/isa/Kconfig
@@ -1,7 +1,7 @@
 # ALSA ISA drivers
 
 menu "ISA devices"
-        depends on SND!=n && ISA
+        depends on SND!=n && ISA && ISA_DMA_API
 
 config SND_AD1848_LIB
         tristate
diff --git a/sound/oss/Kconfig b/sound/oss/Kconfig
index 7bd95ceab7cc..953e5f3ea03d 100644
--- a/sound/oss/Kconfig
+++ b/sound/oss/Kconfig
@@ -6,7 +6,7 @@
 # Prompt user for primary drivers.
 config SOUND_BT878
         tristate "BT878 audio dma"
-        depends on SOUND_PRIME
+        depends on SOUND_PRIME && PCI
         ---help---
           Audio DMA support for bt878 based grabber boards.  As you might have
           already noticed, bt878 is listed with two functions in /proc/pci.
@@ -80,14 +80,14 @@ config SOUND_EMU10K1
 
 config MIDI_EMU10K1
         bool "Creative SBLive! MIDI (EXPERIMENTAL)"
-        depends on SOUND_EMU10K1 && EXPERIMENTAL
+        depends on SOUND_EMU10K1 && EXPERIMENTAL && ISA_DMA_API
         help
           Say Y if you want to be able to use the OSS /dev/sequencer
           interface.  This code is still experimental.
 
 config SOUND_FUSION
         tristate "Crystal SoundFusion (CS4280/461x)"
-        depends on SOUND_PRIME
+        depends on SOUND_PRIME && PCI
         help
           This module drives the Crystal SoundFusion devices (CS4280/46xx
           series) when wired as native sound drivers with AC97 codecs.  If
@@ -95,7 +95,7 @@ config SOUND_FUSION
 
 config SOUND_CS4281
         tristate "Crystal Sound CS4281"
-        depends on SOUND_PRIME
+        depends on SOUND_PRIME && PCI
         help
           Picture and feature list at
           <http://www.pcbroker.com/crystal4281.html>.
@@ -179,7 +179,7 @@ config SOUND_HARMONY
 
 config SOUND_SONICVIBES
         tristate "S3 SonicVibes"
-        depends on SOUND_PRIME
+        depends on SOUND_PRIME && PCI
         help
           Say Y or M if you have a PCI sound card utilizing the S3
           SonicVibes chipset. To find out if your sound card uses a
@@ -226,7 +226,7 @@ config SOUND_AU1550_AC97
 
 config SOUND_TRIDENT
         tristate "Trident 4DWave DX/NX, SiS 7018 or ALi 5451 PCI Audio Core"
-        depends on SOUND_PRIME
+        depends on SOUND_PRIME && PCI
         ---help---
           Say Y or M if you have a PCI sound card utilizing the Trident
           4DWave-DX/NX chipset or your mother board chipset has SiS 7018
@@ -503,7 +503,7 @@ config SOUND_VIA82CXXX
 
 config MIDI_VIA82CXXX
         bool "VIA 82C686 MIDI"
-        depends on SOUND_VIA82CXXX
+        depends on SOUND_VIA82CXXX && ISA_DMA_API
         help
           Answer Y to use the MIDI interface of the Via686. You may need to
           enable this in the BIOS before it will work. This is for connection
@@ -512,7 +512,7 @@ config MIDI_VIA82CXXX
 
 config SOUND_OSS
         tristate "OSS sound modules"
-        depends on SOUND_PRIME
+        depends on SOUND_PRIME && ISA_DMA_API
         help
           OSS is the Open Sound System suite of sound card drivers.  They make
           sound programming easier since they provide a common API.  Say Y or
diff --git a/sound/oss/Makefile b/sound/oss/Makefile
index db9afb61d6ff..9bf3ee544d86 100644
--- a/sound/oss/Makefile
+++ b/sound/oss/Makefile
@@ -80,7 +80,7 @@ obj-$(CONFIG_SOUND_ALI5455)	+= ali5455.o ac97_codec.o
 obj-$(CONFIG_SOUND_IT8172)      += ite8172.o ac97_codec.o
 obj-$(CONFIG_SOUND_FORTE)       += forte.o ac97_codec.o
 
-obj-$(CONFIG_SOUND_AD1980)      += ac97_plugin_ad1980.o
+obj-$(CONFIG_SOUND_AD1980)      += ac97_plugin_ad1980.o ac97_codec.o
 obj-$(CONFIG_SOUND_WM97XX)      += ac97_plugin_wm97xx.o
 
 ifeq ($(CONFIG_MIDI_EMU10K1),y)
diff --git a/sound/oss/i810_audio.c b/sound/oss/i810_audio.c
index 7e9f667cf7a7..b9a640fe48b1 100644
--- a/sound/oss/i810_audio.c
+++ b/sound/oss/i810_audio.c
@@ -3430,9 +3430,9 @@ out_iospace:
                 release_mem_region(card->iobase_mmio_phys, 256);
         }
 out_pio:        
-        release_region(card->iobase, 64);
-out_region2:
         release_region(card->ac97base, 256);
+out_region2:
+        release_region(card->iobase, 64);
 out_region1:
         pci_free_consistent(pci_dev, sizeof(struct i810_channel)*NR_HW_CH,
             card->channel, card->chandma);
diff --git a/sound/oss/vidc.h b/sound/oss/vidc.h
index bab7044572d3..d5b8064dc565 100644
--- a/sound/oss/vidc.h
+++ b/sound/oss/vidc.h
@@ -10,10 +10,6 @@
  *  VIDC sound function prototypes
  */
 
-/* vidc.c */
-
-extern int vidc_busy;
-
 /* vidc_fill.S */
 
 /*
diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
index 6d7a00f34d82..26b42bb20a0a 100644
--- a/sound/pci/Kconfig
+++ b/sound/pci/Kconfig
@@ -314,7 +314,7 @@ config SND_YMFPCI
 
 config SND_ALS4000
         tristate "Avance Logic ALS4000"
-        depends on SND
+        depends on SND && ISA_DMA_API
         select SND_OPL3_LIB
         select SND_MPU401_UART
         select SND_PCM