Merge branch 'master'

34 files changed, 257 insertions, 125 deletions

diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
index d74a7c5e75dd..4b6bf19c39c0 100644
--- a/drivers/atm/ambassador.c
+++ b/drivers/atm/ambassador.c
@@ -795,7 +795,7 @@ static void drain_rx_pools (amb_dev * dev) {
 }
 
 static inline void fill_rx_pool (amb_dev * dev, unsigned char pool,
-                                 unsigned int __nocast priority)
+                                 gfp_t priority)
 {
   rx_in rx;
   amb_rxq * rxq;
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 58219744f5db..7f7ec288824d 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -1374,8 +1374,7 @@ static void reset_chip (struct fs_dev *dev)
         }
 }
 
-static void __devinit *aligned_kmalloc (int size, unsigned int __nocast flags,
-                                        int alignment)
+static void __devinit *aligned_kmalloc (int size, gfp_t flags, int alignment)
 {
         void  *t;
 
@@ -1466,7 +1465,7 @@ static inline int nr_buffers_in_freepool (struct fs_dev *dev, struct freepool *f
    working again after that...  -- REW */
 
 static void top_off_fp (struct fs_dev *dev, struct freepool *fp,
-                        unsigned int __nocast gfp_flags)
+                        gfp_t gfp_flags)
 {
         struct FS_BPENTRY *qe, *ne;
         struct sk_buff *skb;
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index 6f1a83c9d9e0..14f6a6201da3 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -178,7 +178,7 @@ fore200e_irq_itoa(int irq)
 
 
 static void*
-fore200e_kmalloc(int size, unsigned int __nocast flags)
+fore200e_kmalloc(int size, gfp_t flags)
 {
     void *chunk = kzalloc(size, flags);
 
diff --git a/drivers/base/dmapool.c b/drivers/base/dmapool.c
index 60a7ef6a201b..e2f64f91ed05 100644
--- a/drivers/base/dmapool.c
+++ b/drivers/base/dmapool.c
@@ -156,7 +156,7 @@ dma_pool_create (const char *name, struct device *dev,
 
 
 static struct dma_page *
-pool_alloc_page (struct dma_pool *pool, unsigned int __nocast mem_flags)
+pool_alloc_page (struct dma_pool *pool, gfp_t mem_flags)
 {
         struct dma_page *page;
         int             mapsize;
@@ -262,8 +262,7 @@ dma_pool_destroy (struct dma_pool *pool)
  * If such a memory block can't be allocated, null is returned.
  */
 void *
-dma_pool_alloc (struct dma_pool *pool, unsigned int __nocast mem_flags,
-                dma_addr_t *handle)
+dma_pool_alloc (struct dma_pool *pool, gfp_t mem_flags, dma_addr_t *handle)
 {
         unsigned long           flags;
         struct dma_page         *page;
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 7e22a58926b8..a280e679b1ca 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -229,7 +229,7 @@ static int pkt_grow_pktlist(struct pktcdvd_device *pd, int nr_packets)
         return 1;
 }
 
-static void *pkt_rb_alloc(unsigned int __nocast gfp_mask, void *data)
+static void *pkt_rb_alloc(gfp_t gfp_mask, void *data)
 {
         return kmalloc(sizeof(struct pkt_rb_node), gfp_mask);
 }
@@ -2082,7 +2082,7 @@ static int pkt_close(struct inode *inode, struct file *file)
 }
 
 
-static void *psd_pool_alloc(unsigned int __nocast gfp_mask, void *data)
+static void *psd_pool_alloc(gfp_t gfp_mask, void *data)
 {
         return kmalloc(sizeof(struct packet_stacked_data), gfp_mask);
 }
diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
index 079ec344eb47..382dea7b224c 100644
--- a/drivers/block/scsi_ioctl.c
+++ b/drivers/block/scsi_ioctl.c
@@ -201,15 +201,15 @@ static int verify_command(struct file *file, unsigned char *cmd)
                         return 0;
         }
 
+        /* And root can do any command.. */
+        if (capable(CAP_SYS_RAWIO))
+                return 0;
+
         if (!type) {
                 cmd_type[cmd[0]] = CMD_WARNED;
                 printk(KERN_WARNING "scsi: unknown opcode 0x%02x\n", cmd[0]);
         }
 
-        /* And root can do any command.. */
-        if (capable(CAP_SYS_RAWIO))
-                return 0;
-
         /* Otherwise fail it with an "Operation not permitted" */
         return -EPERM;
 }
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index a1bf8f066c88..4fa85234d8b5 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -308,7 +308,7 @@ unlock:
 }
 
 static inline struct urb *bpa10x_alloc_urb(struct usb_device *udev, unsigned int pipe,
-                                        size_t size, unsigned int __nocast flags, void *data)
+                                        size_t size, gfp_t flags, void *data)
 {
         struct urb *urb;
         struct usb_ctrlrequest *cr;
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 57c48bbf6fe6..6756cb20b753 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -132,7 +132,7 @@ static struct usb_device_id blacklist_ids[] = {
         { }     /* Terminating entry */
 };
 
-static struct _urb *_urb_alloc(int isoc, unsigned int __nocast gfp)
+static struct _urb *_urb_alloc(int isoc, gfp_t gfp)
 {
         struct _urb *_urb = kmalloc(sizeof(struct _urb) +
                                 sizeof(struct usb_iso_packet_descriptor) * isoc, gfp);
diff --git a/drivers/char/s3c2410-rtc.c b/drivers/char/s3c2410-rtc.c
index ed867db550a9..e1a90d9a8756 100644
--- a/drivers/char/s3c2410-rtc.c
+++ b/drivers/char/s3c2410-rtc.c
@@ -564,6 +564,7 @@ static int s3c2410_rtc_resume(struct device *dev, u32 level)
 
 static struct device_driver s3c2410_rtcdrv = {
         .name           = "s3c2410-rtc",
+        .owner          = THIS_MODULE,
         .bus            = &platform_bus_type,
         .probe          = s3c2410_rtc_probe,
         .remove         = s3c2410_rtc_remove,
diff --git a/drivers/char/watchdog/pcwd_pci.c b/drivers/char/watchdog/pcwd_pci.c
index 5a80adbf8032..0b8e493be045 100644
--- a/drivers/char/watchdog/pcwd_pci.c
+++ b/drivers/char/watchdog/pcwd_pci.c
@@ -50,8 +50,8 @@
 #include <asm/io.h>             /* For inb/outb/... */
 
 /* Module and version information */
-#define WATCHDOG_VERSION "1.01"
-#define WATCHDOG_DATE "02 Sep 2005"
+#define WATCHDOG_VERSION "1.02"
+#define WATCHDOG_DATE "03 Sep 2005"
 #define WATCHDOG_DRIVER_NAME "PCI-PC Watchdog"
 #define WATCHDOG_NAME "pcwd_pci"
 #define PFX WATCHDOG_NAME ": "
@@ -70,19 +70,30 @@
  * These are the defines that describe the control status bits for the
  * PCI-PC Watchdog card.
  */
-#define WD_PCI_WTRP             0x01    /* Watchdog Trip status */
-#define WD_PCI_HRBT             0x02    /* Watchdog Heartbeat */
-#define WD_PCI_TTRP             0x04    /* Temperature Trip status */
+/* Port 1 : Control Status #1 */
+#define WD_PCI_WTRP             0x01    /* Watchdog Trip status */
+#define WD_PCI_HRBT             0x02    /* Watchdog Heartbeat */
+#define WD_PCI_TTRP             0x04    /* Temperature Trip status */
+#define WD_PCI_RL2A             0x08    /* Relay 2 Active */
+#define WD_PCI_RL1A             0x10    /* Relay 1 Active */
+#define WD_PCI_R2DS             0x40    /* Relay 2 Disable Temperature-trip/reset */
+#define WD_PCI_RLY2             0x80    /* Activate Relay 2 on the board */
+/* Port 2 : Control Status #2 */
+#define WD_PCI_WDIS             0x10    /* Watchdog Disable */
+#define WD_PCI_ENTP             0x20    /* Enable Temperature Trip Reset */
+#define WD_PCI_WRSP             0x40    /* Watchdog wrote response */
+#define WD_PCI_PCMD             0x80    /* PC has sent command */
 
 /* according to documentation max. time to process a command for the pci
  * watchdog card is 100 ms, so we give it 150 ms to do it's job */
 #define PCI_COMMAND_TIMEOUT     150
 
 /* Watchdog's internal commands */
-#define CMD_GET_STATUS                  0x04
-#define CMD_GET_FIRMWARE_VERSION        0x08
-#define CMD_READ_WATCHDOG_TIMEOUT       0x18
-#define CMD_WRITE_WATCHDOG_TIMEOUT      0x19
+#define CMD_GET_STATUS                          0x04
+#define CMD_GET_FIRMWARE_VERSION                0x08
+#define CMD_READ_WATCHDOG_TIMEOUT               0x18
+#define CMD_WRITE_WATCHDOG_TIMEOUT              0x19
+#define CMD_GET_CLEAR_RESET_COUNT               0x84
 
 /* We can only use 1 card due to the /dev/watchdog restriction */
 static int cards_found;
@@ -91,15 +102,22 @@ static int cards_found;
 static int temp_panic;
 static unsigned long is_active;
 static char expect_release;
-static struct {
-        int supports_temp;      /* Wether or not the card has a temperature device */
-        int boot_status;        /* The card's boot status */
-        unsigned long io_addr;  /* The cards I/O address */
-        spinlock_t io_lock;
-        struct pci_dev *pdev;
+static struct {                         /* this is private data for each PCI-PC watchdog card */
+        int supports_temp;              /* Wether or not the card has a temperature device */
+        int boot_status;                /* The card's boot status */
+        unsigned long io_addr;          /* The cards I/O address */
+        spinlock_t io_lock;             /* the lock for io operations */
+        struct pci_dev *pdev;           /* the PCI-device */
 } pcipcwd_private;
 
 /* module parameters */
+#define QUIET   0       /* Default */
+#define VERBOSE 1       /* Verbose */
+#define DEBUG   2       /* print fancy stuff too */
+static int debug = QUIET;
+module_param(debug, int, 0);
+MODULE_PARM_DESC(debug, "Debug level: 0=Quiet, 1=Verbose, 2=Debug (default=0)");
+
 #define WATCHDOG_HEARTBEAT 2    /* 2 sec default heartbeat */
 static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
@@ -117,6 +135,10 @@ static int send_command(int cmd, int *msb, int *lsb)
 {
         int got_response, count;
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "sending following data cmd=0x%02x msb=0x%02x lsb=0x%02x\n",
+                cmd, *msb, *lsb);
+
         spin_lock(&pcipcwd_private.io_lock);
         /* If a command requires data it should be written first.
          * Data for commands with 8 bits of data should be written to port 4.
@@ -131,10 +153,19 @@ static int send_command(int cmd, int *msb, int *lsb)
         /* wait till the pci card processed the command, signaled by
          * the WRSP bit in port 2 and give it a max. timeout of
          * PCI_COMMAND_TIMEOUT to process */
-        got_response = inb_p(pcipcwd_private.io_addr + 2) & 0x40;
+        got_response = inb_p(pcipcwd_private.io_addr + 2) & WD_PCI_WRSP;
         for (count = 0; (count < PCI_COMMAND_TIMEOUT) && (!got_response); count++) {
                 mdelay(1);
-                got_response = inb_p(pcipcwd_private.io_addr + 2) & 0x40;
+                got_response = inb_p(pcipcwd_private.io_addr + 2) & WD_PCI_WRSP;
+        }
+
+        if (debug >= DEBUG) {
+                if (got_response) {
+                        printk(KERN_DEBUG PFX "time to process command was: %d ms\n",
+                                count);
+                } else {
+                        printk(KERN_DEBUG PFX "card did not respond on command!\n");
+                }
         }
 
         if (got_response) {
@@ -144,12 +175,66 @@ static int send_command(int cmd, int *msb, int *lsb)
 
                 /* clear WRSP bit */
                 inb_p(pcipcwd_private.io_addr + 6);
+
+                if (debug >= DEBUG)
+                        printk(KERN_DEBUG PFX "received following data for cmd=0x%02x: msb=0x%02x lsb=0x%02x\n",
+                                cmd, *msb, *lsb);
         }
+
         spin_unlock(&pcipcwd_private.io_lock);
 
         return got_response;
 }
 
+static inline void pcipcwd_check_temperature_support(void)
+{
+        if (inb_p(pcipcwd_private.io_addr) != 0xF0)
+                pcipcwd_private.supports_temp = 1;
+}
+
+static int pcipcwd_get_option_switches(void)
+{
+        int option_switches;
+
+        option_switches = inb_p(pcipcwd_private.io_addr + 3);
+        return option_switches;
+}
+
+static void pcipcwd_show_card_info(void)
+{
+        int got_fw_rev, fw_rev_major, fw_rev_minor;
+        char fw_ver_str[20];            /* The cards firmware version */
+        int option_switches;
+
+        got_fw_rev = send_command(CMD_GET_FIRMWARE_VERSION, &fw_rev_major, &fw_rev_minor);
+        if (got_fw_rev) {
+                sprintf(fw_ver_str, "%u.%02u", fw_rev_major, fw_rev_minor);
+        } else {
+                sprintf(fw_ver_str, "<card no answer>");
+        }
+
+        /* Get switch settings */
+        option_switches = pcipcwd_get_option_switches();
+
+        printk(KERN_INFO PFX "Found card at port 0x%04x (Firmware: %s) %s temp option\n",
+                (int) pcipcwd_private.io_addr, fw_ver_str,
+                (pcipcwd_private.supports_temp ? "with" : "without"));
+
+        printk(KERN_INFO PFX "Option switches (0x%02x): Temperature Reset Enable=%s, Power On Delay=%s\n",
+                option_switches,
+                ((option_switches & 0x10) ? "ON" : "OFF"),
+                ((option_switches & 0x08) ? "ON" : "OFF"));
+
+        if (pcipcwd_private.boot_status & WDIOF_CARDRESET)
+                printk(KERN_INFO PFX "Previous reset was caused by the Watchdog card\n");
+
+        if (pcipcwd_private.boot_status & WDIOF_OVERHEAT)
+                printk(KERN_INFO PFX "Card sensed a CPU Overheat\n");
+
+        if (pcipcwd_private.boot_status == 0)
+                printk(KERN_INFO PFX "No previous trip detected - Cold boot or reset\n");
+}
+
 static int pcipcwd_start(void)
 {
         int stat_reg;
@@ -161,11 +246,14 @@ static int pcipcwd_start(void)
         stat_reg = inb_p(pcipcwd_private.io_addr + 2);
         spin_unlock(&pcipcwd_private.io_lock);
 
-        if (stat_reg & 0x10) {
+        if (stat_reg & WD_PCI_WDIS) {
                 printk(KERN_ERR PFX "Card timer not enabled\n");
                 return -1;
         }
 
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog started\n");
+
         return 0;
 }
 
@@ -183,18 +271,25 @@ static int pcipcwd_stop(void)
         stat_reg = inb_p(pcipcwd_private.io_addr + 2);
         spin_unlock(&pcipcwd_private.io_lock);
 
-        if (!(stat_reg & 0x10)) {
+        if (!(stat_reg & WD_PCI_WDIS)) {
                 printk(KERN_ERR PFX "Card did not acknowledge disable attempt\n");
                 return -1;
         }
 
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog stopped\n");
+
         return 0;
 }
 
 static int pcipcwd_keepalive(void)
 {
         /* Re-trigger watchdog by writing to port 0 */
-        outb_p(0x42, pcipcwd_private.io_addr);
+        outb_p(0x42, pcipcwd_private.io_addr);  /* send out any data */
+
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "Watchdog keepalive signal send\n");
+
         return 0;
 }
 
@@ -210,29 +305,64 @@ static int pcipcwd_set_heartbeat(int t)
         send_command(CMD_WRITE_WATCHDOG_TIMEOUT, &t_msb, &t_lsb);
 
         heartbeat = t;
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "New heartbeat: %d\n",
+                       heartbeat);
+
         return 0;
 }
 
 static int pcipcwd_get_status(int *status)
 {
-        int new_status;
+        int control_status;
 
         *status=0;
-        new_status = inb_p(pcipcwd_private.io_addr + 1);
-        if (new_status & WD_PCI_WTRP)
+        control_status = inb_p(pcipcwd_private.io_addr + 1);
+        if (control_status & WD_PCI_WTRP)
                 *status |= WDIOF_CARDRESET;
-        if (new_status & WD_PCI_TTRP) {
+        if (control_status & WD_PCI_TTRP) {
                 *status |= WDIOF_OVERHEAT;
                 if (temp_panic)
                         panic(PFX "Temperature overheat trip!\n");
         }
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "Control Status #1: 0x%02x\n",
+                       control_status);
+
         return 0;
 }
 
 static int pcipcwd_clear_status(void)
 {
-        outb_p(0x01, pcipcwd_private.io_addr + 1);
+        int control_status;
+        int msb;
+        int reset_counter;
+
+        if (debug >= VERBOSE)
+                printk(KERN_INFO PFX "clearing watchdog trip status & LED\n");
+
+        control_status = inb_p(pcipcwd_private.io_addr + 1);
+
+        if (debug >= DEBUG) {
+                printk(KERN_DEBUG PFX "status was: 0x%02x\n", control_status);
+                printk(KERN_DEBUG PFX "sending: 0x%02x\n",
+                       (control_status & WD_PCI_R2DS) | WD_PCI_WTRP);
+        }
+
+        /* clear trip status & LED and keep mode of relay 2 */
+        outb_p((control_status & WD_PCI_R2DS) | WD_PCI_WTRP, pcipcwd_private.io_addr + 1);
+
+        /* clear reset counter */
+        msb=0;
+        reset_counter=0xff;
+        send_command(CMD_GET_CLEAR_RESET_COUNT, &msb, &reset_counter);
+
+        if (debug >= DEBUG) {
+                printk(KERN_DEBUG PFX "reset count was: 0x%02x\n",
+                       reset_counter);
+        }
+
         return 0;
 }
 
@@ -242,11 +372,18 @@ static int pcipcwd_get_temperature(int *temperature)
         if (!pcipcwd_private.supports_temp)
                 return -ENODEV;
 
+        *temperature = inb_p(pcipcwd_private.io_addr);
+
         /*
          * Convert celsius to fahrenheit, since this was
          * the decided 'standard' for this return value.
          */
-        *temperature = ((inb_p(pcipcwd_private.io_addr)) * 9 / 5) + 32;
+        *temperature = (*temperature * 9 / 5) + 32;
+
+        if (debug >= DEBUG) {
+                printk(KERN_DEBUG PFX "temperature is: %d F\n",
+                       *temperature);
+        }
 
         return 0;
 }
@@ -256,7 +393,7 @@ static int pcipcwd_get_temperature(int *temperature)
  */
 
 static ssize_t pcipcwd_write(struct file *file, const char __user *data,
-                              size_t len, loff_t *ppos)
+                             size_t len, loff_t *ppos)
 {
         /* See if we got the magic character 'V' and reload the timer */
         if (len) {
@@ -381,8 +518,11 @@ static int pcipcwd_ioctl(struct inode *inode, struct file *file,
 static int pcipcwd_open(struct inode *inode, struct file *file)
 {
         /* /dev/watchdog can only be opened once */
-        if (test_and_set_bit(0, &is_active))
+        if (test_and_set_bit(0, &is_active)) {
+                if (debug >= VERBOSE)
+                        printk(KERN_ERR PFX "Attempt to open already opened device.\n");
                 return -EBUSY;
+        }
 
         /* Activate */
         pcipcwd_start();
@@ -492,19 +632,10 @@ static struct notifier_block pcipcwd_notifier = {
  *      Init & exit routines
  */
 
-static inline void check_temperature_support(void)
-{
-        if (inb_p(pcipcwd_private.io_addr) != 0xF0)
-                pcipcwd_private.supports_temp = 1;
-}
-
 static int __devinit pcipcwd_card_init(struct pci_dev *pdev,
                 const struct pci_device_id *ent)
 {
         int ret = -EIO;
-        int got_fw_rev, fw_rev_major, fw_rev_minor;
-        char fw_ver_str[20];
-        char option_switches;
 
         cards_found++;
         if (cards_found == 1)
@@ -546,36 +677,10 @@ static int __devinit pcipcwd_card_init(struct pci_dev *pdev,
         pcipcwd_stop();
 
         /* Check whether or not the card supports the temperature device */
-        check_temperature_support();
-
-        /* Get the Firmware Version */
-        got_fw_rev = send_command(CMD_GET_FIRMWARE_VERSION, &fw_rev_major, &fw_rev_minor);
-        if (got_fw_rev) {
-                sprintf(fw_ver_str, "%u.%02u", fw_rev_major, fw_rev_minor);
-        } else {
-                sprintf(fw_ver_str, "<card no answer>");
-        }
+        pcipcwd_check_temperature_support();
 
-        /* Get switch settings */
-        option_switches = inb_p(pcipcwd_private.io_addr + 3);
-
-        printk(KERN_INFO PFX "Found card at port 0x%04x (Firmware: %s) %s temp option\n",
-                (int) pcipcwd_private.io_addr, fw_ver_str,
-                (pcipcwd_private.supports_temp ? "with" : "without"));
-
-        printk(KERN_INFO PFX "Option switches (0x%02x): Temperature Reset Enable=%s, Power On Delay=%s\n",
-                option_switches,
-                ((option_switches & 0x10) ? "ON" : "OFF"),
-                ((option_switches & 0x08) ? "ON" : "OFF"));
-
-        if (pcipcwd_private.boot_status & WDIOF_CARDRESET)
-                printk(KERN_INFO PFX "Previous reset was caused by the Watchdog card\n");
-
-        if (pcipcwd_private.boot_status & WDIOF_OVERHEAT)
-                printk(KERN_INFO PFX "Card sensed a CPU Overheat\n");
-
-        if (pcipcwd_private.boot_status == 0)
-                printk(KERN_INFO PFX "No previous trip detected - Cold boot or reset\n");
+        /* Show info about the card itself */
+        pcipcwd_show_card_info();
 
         /* Check that the heartbeat value is within it's range ; if not reset to the default */
         if (pcipcwd_set_heartbeat(heartbeat)) {
@@ -656,7 +761,7 @@ static struct pci_driver pcipcwd_driver = {
 
 static int __init pcipcwd_init_module(void)
 {
-        spin_lock_init (&pcipcwd_private.io_lock);
+        spin_lock_init(&pcipcwd_private.io_lock);
 
         return pci_register_driver(&pcipcwd_driver);
 }
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 1422285d537c..505677fb3157 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -69,8 +69,7 @@ int cn_already_initialized = 0;
  * a new message.
  *
  */
-int cn_netlink_send(struct cn_msg *msg, u32 __group,
-                    unsigned int __nocast gfp_mask)
+int cn_netlink_send(struct cn_msg *msg, u32 __group, gfp_t gfp_mask)
 {
         struct cn_callback_entry *__cbq;
         unsigned int size;
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 9e9cf1407311..5275cbb1afe9 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -1101,6 +1101,7 @@ static void ide_do_request (ide_hwgroup_t *hwgroup, int masked_irq)
         ide_hwif_t      *hwif;
         struct request  *rq;
         ide_startstop_t startstop;
+        int             loops = 0;
 
         /* for atari only: POSSIBLY BROKEN HERE(?) */
         ide_get_lock(ide_intr, hwgroup);
@@ -1153,6 +1154,7 @@ static void ide_do_request (ide_hwgroup_t *hwgroup, int masked_irq)
                         /* no more work for this hwgroup (for now) */
                         return;
                 }
+        again:
                 hwif = HWIF(drive);
                 if (hwgroup->hwif->sharing_irq &&
                     hwif != hwgroup->hwif &&
@@ -1192,8 +1194,14 @@ static void ide_do_request (ide_hwgroup_t *hwgroup, int masked_irq)
                  * though. I hope that doesn't happen too much, hopefully not
                  * unless the subdriver triggers such a thing in its own PM
                  * state machine.
+                 *
+                 * We count how many times we loop here to make sure we service
+                 * all drives in the hwgroup without looping for ever
                  */
                 if (drive->blocked && !blk_pm_request(rq) && !(rq->flags & REQ_PREEMPT)) {
+                        drive = drive->next ? drive->next : hwgroup->drive;
+                        if (loops++ < 4 && !blk_queue_plugged(drive->queue))
+                                goto again;
                         /* We clear busy, there should be no pending ATA command at this point. */
                         hwgroup->busy = 0;
                         break;
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index 5fe4f2ba0979..315f5ca8bedb 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -98,7 +98,7 @@ static struct hpsb_address_ops arm_ops = {
 
 static void queue_complete_cb(struct pending_request *req);
 
-static struct pending_request *__alloc_pending_request(unsigned int __nocast flags)
+static struct pending_request *__alloc_pending_request(gfp_t flags)
 {
         struct pending_request *req;
 
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index a4a4d9c1eef3..a14ca87fda18 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -783,7 +783,7 @@ struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
                                             u32 remote_qpn, u16 pkey_index,
                                             struct ib_ah *ah, int rmpp_active,
                                             int hdr_len, int data_len,
-                                            unsigned int __nocast gfp_mask)
+                                            gfp_t gfp_mask)
 {
         struct ib_mad_agent_private *mad_agent_priv;
         struct ib_mad_send_buf *send_buf;
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 78de2dd1a4f2..262618210c1c 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -574,7 +574,7 @@ static void ib_sa_path_rec_release(struct ib_sa_query *sa_query)
 int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
                        struct ib_sa_path_rec *rec,
                        ib_sa_comp_mask comp_mask,
-                       int timeout_ms, unsigned int __nocast gfp_mask,
+                       int timeout_ms, gfp_t gfp_mask,
                        void (*callback)(int status,
                                         struct ib_sa_path_rec *resp,
                                         void *context),
@@ -676,7 +676,7 @@ static void ib_sa_service_rec_release(struct ib_sa_query *sa_query)
 int ib_sa_service_rec_query(struct ib_device *device, u8 port_num, u8 method,
                             struct ib_sa_service_rec *rec,
                             ib_sa_comp_mask comp_mask,
-                            int timeout_ms, unsigned int __nocast gfp_mask,
+                            int timeout_ms, gfp_t gfp_mask,
                             void (*callback)(int status,
                                              struct ib_sa_service_rec *resp,
                                              void *context),
@@ -759,7 +759,7 @@ int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num,
                              u8 method,
                              struct ib_sa_mcmember_rec *rec,
                              ib_sa_comp_mask comp_mask,
-                             int timeout_ms, unsigned int __nocast gfp_mask,
+                             int timeout_ms, gfp_t gfp_mask,
                              void (*callback)(int status,
                                               struct ib_sa_mcmember_rec *resp,
                                               void *context),
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index b82bc3150476..b6148f6f7836 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -96,7 +96,7 @@ static kmem_cache_t *_crypt_io_pool;
 /*
  * Mempool alloc and free functions for the page
  */
-static void *mempool_alloc_page(unsigned int __nocast gfp_mask, void *data)
+static void *mempool_alloc_page(gfp_t gfp_mask, void *data)
 {
         return alloc_page(gfp_mask);
 }
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 9de000131a8a..4809b209fbb1 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -32,7 +32,7 @@ struct io {
 static unsigned _num_ios;
 static mempool_t *_io_pool;
 
-static void *alloc_io(unsigned int __nocast gfp_mask, void *pool_data)
+static void *alloc_io(gfp_t gfp_mask, void *pool_data)
 {
         return kmalloc(sizeof(struct io), gfp_mask);
 }
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 863282513753..2375709a392c 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -122,7 +122,7 @@ static inline sector_t region_to_sector(struct region_hash *rh, region_t region)
 /* FIXME move this */
 static void queue_bio(struct mirror_set *ms, struct bio *bio, int rw);
 
-static void *region_alloc(unsigned int __nocast gfp_mask, void *pool_data)
+static void *region_alloc(gfp_t gfp_mask, void *pool_data)
 {
         return kmalloc(sizeof(struct region), gfp_mask);
 }
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 286342375fb7..1151c3ed3006 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -38,7 +38,7 @@
 static mdk_personality_t multipath_personality;
 
 
-static void *mp_pool_alloc(unsigned int __nocast gfp_flags, void *data)
+static void *mp_pool_alloc(gfp_t gfp_flags, void *data)
 {
         struct multipath_bh *mpb;
         mpb = kmalloc(sizeof(*mpb), gfp_flags);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a93ca478142a..0e1f148dd41d 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -52,7 +52,7 @@ static mdk_personality_t raid1_personality;
 static void unplug_slaves(mddev_t *mddev);
 
 
-static void * r1bio_pool_alloc(unsigned int __nocast gfp_flags, void *data)
+static void * r1bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
         struct pool_info *pi = data;
         r1bio_t *r1_bio;
@@ -79,7 +79,7 @@ static void r1bio_pool_free(void *r1_bio, void *data)
 #define RESYNC_PAGES ((RESYNC_BLOCK_SIZE + PAGE_SIZE-1) / PAGE_SIZE)
 #define RESYNC_WINDOW (2048*1024)
 
-static void * r1buf_pool_alloc(unsigned int __nocast gfp_flags, void *data)
+static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
 {
         struct pool_info *pi = data;
         struct page *page;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 5bd1e9ec899d..28dd028415e4 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -47,7 +47,7 @@
 
 static void unplug_slaves(mddev_t *mddev);
 
-static void * r10bio_pool_alloc(unsigned int __nocast gfp_flags, void *data)
+static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
         conf_t *conf = data;
         r10bio_t *r10_bio;
@@ -81,7 +81,7 @@ static void r10bio_pool_free(void *r10_bio, void *data)
  * one for write (we recover only one drive per r10buf)
  *
  */
-static void * r10buf_pool_alloc(unsigned int __nocast gfp_flags, void *data)
+static void * r10buf_pool_alloc(gfp_t gfp_flags, void *data)
 {
         conf_t *conf = data;
         struct page *page;
diff --git a/drivers/mfd/ucb1x00-core.c b/drivers/mfd/ucb1x00-core.c
index 612564ac6f7b..e335d54c4659 100644
--- a/drivers/mfd/ucb1x00-core.c
+++ b/drivers/mfd/ucb1x00-core.c
@@ -457,6 +457,17 @@ static int ucb1x00_detect_irq(struct ucb1x00 *ucb)
         return probe_irq_off(mask);
 }
 
+static void ucb1x00_release(struct class_device *dev)
+{
+        struct ucb1x00 *ucb = classdev_to_ucb1x00(dev);
+        kfree(ucb);
+}
+
+static struct class ucb1x00_class = {
+        .name           = "ucb1x00",
+        .release        = ucb1x00_release,
+};
+
 static int ucb1x00_probe(struct mcp *mcp)
 {
         struct ucb1x00 *ucb;
@@ -546,17 +557,6 @@ static void ucb1x00_remove(struct mcp *mcp)
         class_device_unregister(&ucb->cdev);
 }
 
-static void ucb1x00_release(struct class_device *dev)
-{
-        struct ucb1x00 *ucb = classdev_to_ucb1x00(dev);
-        kfree(ucb);
-}
-
-static struct class ucb1x00_class = {
-        .name           = "ucb1x00",
-        .release        = ucb1x00_release,
-};
-
 int ucb1x00_register_driver(struct ucb1x00_driver *drv)
 {
         struct ucb1x00 *ucb;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index f0a5b772a386..f264ff162979 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1290,7 +1290,7 @@ static void bond_mc_list_destroy(struct bonding *bond)
  * Copy all the Multicast addresses from src to the bonding device dst
  */
 static int bond_mc_list_copy(struct dev_mc_list *mc_list, struct bonding *bond,
-                             unsigned int __nocast gfp_flag)
+                             gfp_t gfp_flag)
 {
         struct dev_mc_list *dmi, *new_dmi;
 
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 83334db2921c..e4811b42a6b7 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -584,7 +584,7 @@ static inline int ns83820_add_rx_skb(struct ns83820 *dev, struct sk_buff *skb)
         return 0;
 }
 
-static inline int rx_refill(struct net_device *ndev, unsigned int __nocast gfp)
+static inline int rx_refill(struct net_device *ndev, gfp_t gfp)
 {
         struct ns83820 *dev = PRIV(ndev);
         unsigned i;
diff --git a/drivers/net/sungem.h b/drivers/net/sungem.h
index 16edbb1a4a7a..13006d759ad8 100644
--- a/drivers/net/sungem.h
+++ b/drivers/net/sungem.h
@@ -1036,7 +1036,7 @@ struct gem {
 #define ALIGNED_RX_SKB_ADDR(addr) \
         ((((unsigned long)(addr) + (64UL - 1UL)) & ~(64UL - 1UL)) - (unsigned long)(addr))
 static __inline__ struct sk_buff *gem_alloc_skb(int size,
-                                                unsigned int __nocast gfp_flags)
+                                                gfp_t gfp_flags)
 {
         struct sk_buff *skb = alloc_skb(size + 64, gfp_flags);
 
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index fabd3529cebc..d5e76423a0ee 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -689,6 +689,9 @@ static int pccardd(void *__skt)
                 schedule();
                 try_to_freeze();
         }
+        /* make sure we are running before we exit */
+        set_current_state(TASK_RUNNING);
+
         remove_wait_queue(&skt->thread_wait, &wait);
 
         /* remove from the device core */
diff --git a/drivers/pcmcia/ti113x.h b/drivers/pcmcia/ti113x.h
index da0b404561c9..539b5cd1a598 100644
--- a/drivers/pcmcia/ti113x.h
+++ b/drivers/pcmcia/ti113x.h
@@ -873,6 +873,7 @@ static int ti1250_override(struct yenta_socket *socket)
  * Some fixup code to make everybody happy (TM).
  */
 
+#ifdef CONFIG_CARDBUS
 /**
  * set/clear various test bits:
  * Defaults to clear the bit.
@@ -927,7 +928,6 @@ static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
         config_writeb(socket, ENE_TEST_C9, test_c9);
 }
 
-
 static int ene_override(struct yenta_socket *socket)
 {
         /* install tune_bridge() function */
@@ -935,6 +935,9 @@ static int ene_override(struct yenta_socket *socket)
 
         return ti1250_override(socket);
 }
+#else
+#  define ene_override ti1250_override
+#endif
 
 #endif /* _LINUX_TI113X_H */
 
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 0b5087f7cabc..cab098556b44 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -833,7 +833,7 @@ zfcp_unit_dequeue(struct zfcp_unit *unit)
 }
 
 static void *
-zfcp_mempool_alloc(unsigned int __nocast gfp_mask, void *size)
+zfcp_mempool_alloc(gfp_t gfp_mask, void *size)
 {
         return kmalloc((size_t) size, gfp_mask);
 }
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 4e1e80adaf11..53e0323d4b83 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -383,11 +383,11 @@ static int imx_startup(struct uart_port *port)
          */
         retval = request_irq(sport->rxirq, imx_rxint, 0,
                              DRIVER_NAME, sport);
-        if (retval) goto error_out2;
+        if (retval) goto error_out1;
 
         retval = request_irq(sport->txirq, imx_txint, 0,
                              "imx-uart", sport);
-        if (retval) goto error_out1;
+        if (retval) goto error_out2;
 
         /*
          * Finally, clear and enable interrupts
@@ -406,10 +406,9 @@ static int imx_startup(struct uart_port *port)
 
         return 0;
 
-error_out1:
-        free_irq(sport->rxirq, sport);
 error_out2:
-        free_irq(sport->txirq, sport);
+        free_irq(sport->rxirq, sport);
+error_out1:
         return retval;
 }
 
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index 50d7870d92bb..eff2158024c8 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -1235,6 +1235,7 @@ static int s3c2400_serial_probe(struct device *dev)
 
 static struct device_driver s3c2400_serial_drv = {
         .name           = "s3c2400-uart",
+        .owner          = THIS_MODULE,
         .bus            = &platform_bus_type,
         .probe          = s3c2400_serial_probe,
         .remove         = s3c24xx_serial_remove,
@@ -1338,6 +1339,7 @@ static int s3c2410_serial_probe(struct device *dev)
 
 static struct device_driver s3c2410_serial_drv = {
         .name           = "s3c2410-uart",
+        .owner          = THIS_MODULE,
         .bus            = &platform_bus_type,
         .probe          = s3c2410_serial_probe,
         .remove         = s3c24xx_serial_remove,
@@ -1499,6 +1501,7 @@ static int s3c2440_serial_probe(struct device *dev)
 
 static struct device_driver s3c2440_serial_drv = {
         .name           = "s3c2440-uart",
+        .owner          = THIS_MODULE,
         .bus            = &platform_bus_type,
         .probe          = s3c2440_serial_probe,
         .remove         = s3c24xx_serial_remove,
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index b4265aa7d45e..487ff672b104 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -30,6 +30,8 @@
  *  Revision history
  *    22.12.1999   0.1   Initial release (split from proc_usb.c)
  *    04.01.2000   0.2   Turned into its own filesystem
+ *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
+ *                       (CAN-2005-3055)
  */
 
 /*****************************************************************************/
@@ -58,7 +60,8 @@ static struct class *usb_device_class;
 struct async {
         struct list_head asynclist;
         struct dev_state *ps;
-        struct task_struct *task;
+        pid_t pid;
+        uid_t uid, euid;
         unsigned int signr;
         unsigned int ifnum;
         void __user *userbuffer;
@@ -290,7 +293,8 @@ static void async_completed(struct urb *urb, struct pt_regs *regs)
                 sinfo.si_errno = as->urb->status;
                 sinfo.si_code = SI_ASYNCIO;
                 sinfo.si_addr = as->userurb;
-                send_sig_info(as->signr, &sinfo, as->task);
+                kill_proc_info_as_uid(as->signr, &sinfo, as->pid, as->uid, 
+                                      as->euid);
         }
         wake_up(&ps->wait);
 }
@@ -526,7 +530,9 @@ static int usbdev_open(struct inode *inode, struct file *file)
         INIT_LIST_HEAD(&ps->async_completed);
         init_waitqueue_head(&ps->wait);
         ps->discsignr = 0;
-        ps->disctask = current;
+        ps->disc_pid = current->pid;
+        ps->disc_uid = current->uid;
+        ps->disc_euid = current->euid;
         ps->disccontext = NULL;
         ps->ifclaimed = 0;
         wmb();
@@ -988,7 +994,9 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                 as->userbuffer = NULL;
         as->signr = uurb->signr;
         as->ifnum = ifnum;
-        as->task = current;
+        as->pid = current->pid;
+        as->uid = current->uid;
+        as->euid = current->euid;
         if (!(uurb->endpoint & USB_DIR_IN)) {
                 if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, as->urb->transfer_buffer_length)) {
                         free_async(as);
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 640f41e47029..d07bba01995b 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -713,7 +713,7 @@ void usbfs_remove_device(struct usb_device *dev)
                         sinfo.si_errno = EPIPE;
                         sinfo.si_code = SI_ASYNCIO;
                         sinfo.si_addr = ds->disccontext;
-                        send_sig_info(ds->discsignr, &sinfo, ds->disctask);
+                        kill_proc_info_as_uid(ds->discsignr, &sinfo, ds->disc_pid, ds->disc_uid, ds->disc_euid);
                 }
         }
         usbfs_update_special();
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 83d48c8133af..e6504f3370ad 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -52,7 +52,8 @@ struct dev_state {
         struct list_head async_completed;
         wait_queue_head_t wait;     /* wake up if a request completed */
         unsigned int discsignr;
-        struct task_struct *disctask;
+        pid_t disc_pid;
+        uid_t disc_uid, disc_euid;
         void __user *disccontext;
         unsigned long ifclaimed;
 };
diff --git a/drivers/video/p9100.c b/drivers/video/p9100.c
index 7808a01493ad..b76a5a9a125b 100644
--- a/drivers/video/p9100.c
+++ b/drivers/video/p9100.c
@@ -288,6 +288,9 @@ static void p9100_init_one(struct sbus_dev *sdev)
         all->par.physbase = sdev->reg_addrs[2].phys_addr;
 
         sbusfb_fill_var(&all->info.var, sdev->prom_node, 8);
+        all->info.var.red.length = 8;
+        all->info.var.green.length = 8;
+        all->info.var.blue.length = 8;
 
         linebytes = prom_getintdefault(sdev->prom_node, "linebytes",
                                        all->info.var.xres);
@@ -323,6 +326,7 @@ static void p9100_init_one(struct sbus_dev *sdev)
                 kfree(all);
                 return;
         }
+        fb_set_cmap(&all->info.cmap, &all->info);
 
         list_add(&all->list, &p9100_list);