51 files changed, 307 insertions, 204 deletions

diff --git a/Makefile b/Makefile
index 300f61f6f6a2..5acd1fc68d17 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 13
-EXTRAVERSION =-rc7
+EXTRAVERSION =
 NAME=Woozy Numbat
 
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-ixp4xx/coyote-setup.c b/arch/arm/mach-ixp4xx/coyote-setup.c
index 7f58afb27e71..411ea9996190 100644
--- a/arch/arm/mach-ixp4xx/coyote-setup.c
+++ b/arch/arm/mach-ixp4xx/coyote-setup.c
@@ -36,7 +36,7 @@ static struct flash_platform_data coyote_flash_data = {
 
 static struct resource coyote_flash_resource = {
         .start          = COYOTE_FLASH_BASE,
-        .end            = COYOTE_FLASH_BASE + COYOTE_FLASH_SIZE,
+        .end            = COYOTE_FLASH_BASE + COYOTE_FLASH_SIZE - 1,
         .flags          = IORESOURCE_MEM,
 };
 
diff --git a/arch/arm/mach-ixp4xx/gtwx5715-setup.c b/arch/arm/mach-ixp4xx/gtwx5715-setup.c
index 65e356bd10d6..333459d6aa46 100644
--- a/arch/arm/mach-ixp4xx/gtwx5715-setup.c
+++ b/arch/arm/mach-ixp4xx/gtwx5715-setup.c
@@ -114,7 +114,7 @@ static struct flash_platform_data gtwx5715_flash_data = {
 
 static struct resource gtwx5715_flash_resource = {
         .start          = GTWX5715_FLASH_BASE,
-        .end            = GTWX5715_FLASH_BASE + GTWX5715_FLASH_SIZE,
+        .end            = GTWX5715_FLASH_BASE + GTWX5715_FLASH_SIZE - 1,
         .flags          = IORESOURCE_MEM,
 };
 
diff --git a/arch/arm/mach-ixp4xx/ixdp425-setup.c b/arch/arm/mach-ixp4xx/ixdp425-setup.c
index 4633470a6a37..fa0646c8693b 100644
--- a/arch/arm/mach-ixp4xx/ixdp425-setup.c
+++ b/arch/arm/mach-ixp4xx/ixdp425-setup.c
@@ -36,7 +36,7 @@ static struct flash_platform_data ixdp425_flash_data = {
 
 static struct resource ixdp425_flash_resource = {
         .start          = IXDP425_FLASH_BASE,
-        .end            = IXDP425_FLASH_BASE + IXDP425_FLASH_SIZE,
+        .end            = IXDP425_FLASH_BASE + IXDP425_FLASH_SIZE - 1,
         .flags          = IORESOURCE_MEM,
 };
 
diff --git a/arch/ia64/ia32/ia32_signal.c b/arch/ia64/ia32/ia32_signal.c
index ebb89be2aa2d..aa891c9bc9b6 100644
--- a/arch/ia64/ia32/ia32_signal.c
+++ b/arch/ia64/ia32/ia32_signal.c
@@ -29,7 +29,6 @@
 #include <asm/uaccess.h>
 #include <asm/rse.h>
 #include <asm/sigcontext.h>
-#include <asm/segment.h>
 
 #include "ia32priv.h"
 
diff --git a/arch/ia64/lib/swiotlb.c b/arch/ia64/lib/swiotlb.c
index ab7b3ad99a7f..dbc0b3e449c5 100644
--- a/arch/ia64/lib/swiotlb.c
+++ b/arch/ia64/lib/swiotlb.c
@@ -93,8 +93,7 @@ static int __init
 setup_io_tlb_npages(char *str)
 {
         if (isdigit(*str)) {
-                io_tlb_nslabs = simple_strtoul(str, &str, 0) <<
-                        (PAGE_SHIFT - IO_TLB_SHIFT);
+                io_tlb_nslabs = simple_strtoul(str, &str, 0);
                 /* avoid tail segment of size < IO_TLB_SEGSIZE */
                 io_tlb_nslabs = ALIGN(io_tlb_nslabs, IO_TLB_SEGSIZE);
         }
@@ -117,7 +116,7 @@ swiotlb_init_with_default_size (size_t default_size)
         unsigned long i;
 
         if (!io_tlb_nslabs) {
-                io_tlb_nslabs = (default_size >> PAGE_SHIFT);
+                io_tlb_nslabs = (default_size >> IO_TLB_SHIFT);
                 io_tlb_nslabs = ALIGN(io_tlb_nslabs, IO_TLB_SEGSIZE);
         }
 
diff --git a/arch/ia64/pci/pci.c b/arch/ia64/pci/pci.c
index f9472c50ab42..9977c122e9fa 100644
--- a/arch/ia64/pci/pci.c
+++ b/arch/ia64/pci/pci.c
@@ -24,7 +24,6 @@
 
 #include <asm/machvec.h>
 #include <asm/page.h>
-#include <asm/segment.h>
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/sal.h>
diff --git a/arch/ia64/sn/kernel/sn2/sn_hwperf.c b/arch/ia64/sn/kernel/sn2/sn_hwperf.c
index 833e700fdac9..e28214216fee 100644
--- a/arch/ia64/sn/kernel/sn2/sn_hwperf.c
+++ b/arch/ia64/sn/kernel/sn2/sn_hwperf.c
@@ -36,7 +36,6 @@
 #include <asm/topology.h>
 #include <asm/smp.h>
 #include <asm/semaphore.h>
-#include <asm/segment.h>
 #include <asm/uaccess.h>
 #include <asm/sal.h>
 #include <asm/sn/io.h>
diff --git a/arch/ppc/syslib/m8xx_setup.c b/arch/ppc/syslib/m8xx_setup.c
index 55a381af4e37..a3702cfe8f7c 100644
--- a/arch/ppc/syslib/m8xx_setup.c
+++ b/arch/ppc/syslib/m8xx_setup.c
@@ -423,7 +423,7 @@ platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
         ppc_md.find_end_of_memory       = m8xx_find_end_of_memory;
         ppc_md.setup_io_mappings        = m8xx_map_io;
 
-#if defined(CONFIG_BLK_DEV_IDE) || defined(CONFIG_BLK_DEV_IDE_MODULE)
+#if defined(CONFIG_BLK_DEV_MPC8xx_IDE)
         m8xx_ide_init();
 #endif
 }
diff --git a/arch/um/drivers/mmapper_kern.c b/arch/um/drivers/mmapper_kern.c
index a37a5ac13c22..022f67bb6873 100644
--- a/arch/um/drivers/mmapper_kern.c
+++ b/arch/um/drivers/mmapper_kern.c
@@ -9,19 +9,11 @@
  *
  */
 
-#include <linux/types.h>
-#include <linux/kdev_t.h>
-#include <linux/time.h>
-#include <linux/devfs_fs_kernel.h>
+#include <linux/init.h> 
 #include <linux/module.h>
 #include <linux/mm.h> 
-#include <linux/slab.h>
-#include <linux/init.h> 
-#include <linux/smp_lock.h>
 #include <linux/miscdevice.h>
 #include <asm/uaccess.h>
-#include <asm/irq.h>
-#include <asm/pgtable.h>
 #include "mem_user.h"
 #include "user_util.h"
  
@@ -31,35 +23,22 @@ static unsigned long p_buf = 0;
 static char *v_buf = NULL;
 
 static ssize_t
-mmapper_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+mmapper_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
-        if(*ppos > mmapper_size)
-                return -EINVAL;
-
-        if(count + *ppos > mmapper_size)
-                count = count + *ppos - mmapper_size;
-
-        if(count < 0)
-                return -EINVAL;
- 
-        copy_to_user(buf,&v_buf[*ppos],count);
-        
-        return count;
+        return simple_read_from_buffer(buf, count, ppos, v_buf, mmapper_size);
 }
 
 static ssize_t
-mmapper_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
+mmapper_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
-        if(*ppos > mmapper_size)
+        if (*ppos > mmapper_size)
                 return -EINVAL;
 
-        if(count + *ppos > mmapper_size)
-                count = count + *ppos - mmapper_size;
-
-        if(count < 0)
-                return -EINVAL;
+        if (count > mmapper_size - *ppos)
+                count = mmapper_size - *ppos;
 
-        copy_from_user(&v_buf[*ppos],buf,count);
+        if (copy_from_user(&v_buf[*ppos], buf, count))
+                return -EFAULT;
         
         return count;
 }
@@ -77,7 +56,6 @@ mmapper_mmap(struct file *file, struct vm_area_struct * vma)
         int ret = -EINVAL;
         int size;
 
-        lock_kernel();
         if (vma->vm_pgoff != 0)
                 goto out;
         
@@ -92,7 +70,6 @@ mmapper_mmap(struct file *file, struct vm_area_struct * vma)
                 goto out;
         ret = 0;
 out:
-        unlock_kernel();
         return ret;
 }
 
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index 6ded3a50dfe6..b548dea4e5b9 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -185,6 +185,40 @@ unsigned long __init e820_end_of_ram(void)
 }
 
 /* 
+ * Compute how much memory is missing in a range.
+ * Unlike the other functions in this file the arguments are in page numbers.
+ */
+unsigned long __init
+e820_hole_size(unsigned long start_pfn, unsigned long end_pfn)
+{
+        unsigned long ram = 0;
+        unsigned long start = start_pfn << PAGE_SHIFT;
+        unsigned long end = end_pfn << PAGE_SHIFT;
+        int i;
+        for (i = 0; i < e820.nr_map; i++) {
+                struct e820entry *ei = &e820.map[i];
+                unsigned long last, addr;
+
+                if (ei->type != E820_RAM ||
+                    ei->addr+ei->size <= start ||
+                    ei->addr >= end)
+                        continue;
+
+                addr = round_up(ei->addr, PAGE_SIZE);
+                if (addr < start)
+                        addr = start;
+
+                last = round_down(ei->addr + ei->size, PAGE_SIZE);
+                if (last >= end)
+                        last = end;
+
+                if (last > addr)
+                        ram += last - addr;
+        }
+        return ((end - start) - ram) >> PAGE_SHIFT;
+}
+
+/*
  * Mark e820 reserved areas as busy for the resource manager.
  */
 void __init e820_reserve_resources(void)
diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index 72e4b364ed73..aa4a5189ecee 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -322,18 +322,26 @@ void zap_low_mappings(void)
 void __init paging_init(void)
 {
         {
-                unsigned long zones_size[MAX_NR_ZONES] = {0, 0, 0};
+                unsigned long zones_size[MAX_NR_ZONES];
+                unsigned long holes[MAX_NR_ZONES];
                 unsigned int max_dma;
 
+                memset(zones_size, 0, sizeof(zones_size));
+                memset(holes, 0, sizeof(holes));
+
                 max_dma = virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT;
 
-                if (end_pfn < max_dma)
+                if (end_pfn < max_dma) {
                         zones_size[ZONE_DMA] = end_pfn;
-                else {
+                        holes[ZONE_DMA] = e820_hole_size(0, end_pfn);
+                } else {
                         zones_size[ZONE_DMA] = max_dma;
+                        holes[ZONE_DMA] = e820_hole_size(0, max_dma);
                         zones_size[ZONE_NORMAL] = end_pfn - max_dma;
+                        holes[ZONE_NORMAL] = e820_hole_size(max_dma, end_pfn);
                 }
-                free_area_init(zones_size);
+                free_area_init_node(0, NODE_DATA(0), zones_size,
+                        __pa(PAGE_OFFSET) >> PAGE_SHIFT, holes);
         }
         return;
 }
diff --git a/arch/x86_64/mm/numa.c b/arch/x86_64/mm/numa.c
index 70cb2904a90f..6a156f5692ae 100644
--- a/arch/x86_64/mm/numa.c
+++ b/arch/x86_64/mm/numa.c
@@ -126,9 +126,11 @@ void __init setup_node_zones(int nodeid)
 { 
         unsigned long start_pfn, end_pfn; 
         unsigned long zones[MAX_NR_ZONES];
+        unsigned long holes[MAX_NR_ZONES];
         unsigned long dma_end_pfn;
 
         memset(zones, 0, sizeof(unsigned long) * MAX_NR_ZONES); 
+        memset(holes, 0, sizeof(unsigned long) * MAX_NR_ZONES);
 
         start_pfn = node_start_pfn(nodeid);
         end_pfn = node_end_pfn(nodeid);
@@ -139,13 +141,17 @@ void __init setup_node_zones(int nodeid)
         dma_end_pfn = __pa(MAX_DMA_ADDRESS) >> PAGE_SHIFT; 
         if (start_pfn < dma_end_pfn) { 
                 zones[ZONE_DMA] = dma_end_pfn - start_pfn;
+                holes[ZONE_DMA] = e820_hole_size(start_pfn, dma_end_pfn);
                 zones[ZONE_NORMAL] = end_pfn - dma_end_pfn; 
+                holes[ZONE_NORMAL] = e820_hole_size(dma_end_pfn, end_pfn);
+
         } else { 
                 zones[ZONE_NORMAL] = end_pfn - start_pfn; 
+                holes[ZONE_NORMAL] = e820_hole_size(start_pfn, end_pfn);
         } 
     
         free_area_init_node(nodeid, NODE_DATA(nodeid), zones,
-                            start_pfn, NULL); 
+                            start_pfn, holes);
 } 
 
 void __init numa_init_array(void)
diff --git a/drivers/acpi/sleep/poweroff.c b/drivers/acpi/sleep/poweroff.c
index 186b182c5825..f93d2ee54800 100644
--- a/drivers/acpi/sleep/poweroff.c
+++ b/drivers/acpi/sleep/poweroff.c
@@ -55,7 +55,11 @@ void acpi_power_off(void)
 
 static int acpi_shutdown(struct sys_device *x)
 {
-        return acpi_sleep_prepare(ACPI_STATE_S5);
+        if (system_state == SYSTEM_POWER_OFF) {
+                /* Prepare if we are going to power off the system */
+                return acpi_sleep_prepare(ACPI_STATE_S5);
+        }
+        return 0;
 }
 
 static struct sysdev_class acpi_sysclass = {
diff --git a/drivers/char/snsc_event.c b/drivers/char/snsc_event.c
index d692af57213a..baaa365285fa 100644
--- a/drivers/char/snsc_event.c
+++ b/drivers/char/snsc_event.c
@@ -19,6 +19,7 @@
 #include <linux/sched.h>
 #include <linux/byteorder/generic.h>
 #include <asm/sn/sn_sal.h>
+#include <asm/unaligned.h>
 #include "snsc.h"
 
 static struct subch_data_s *event_sd;
@@ -62,13 +63,16 @@ static int
 scdrv_parse_event(char *event, int *src, int *code, int *esp_code, char *desc)
 {
         char *desc_end;
+        __be32 from_buf;
 
         /* record event source address */
-        *src = be32_to_cpup((__be32 *)event);
+        from_buf = get_unaligned((__be32 *)event);
+        *src = be32_to_cpup(&from_buf);
         event += 4;                     /* move on to event code */
 
         /* record the system controller's event code */
-        *code = be32_to_cpup((__be32 *)event);
+        from_buf = get_unaligned((__be32 *)event);
+        *code = be32_to_cpup(&from_buf);
         event += 4;                     /* move on to event arguments */
 
         /* how many arguments are in the packet? */
@@ -82,7 +86,8 @@ scdrv_parse_event(char *event, int *src, int *code, int *esp_code, char *desc)
                 /* not an integer argument, so give up */
                 return -1;
         }
-        *esp_code = be32_to_cpup((__be32 *)event);
+        from_buf = get_unaligned((__be32 *)event);
+        *esp_code = be32_to_cpup(&from_buf);
         event += 4;
 
         /* parse out the event description */
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 30d96739fb23..665103ccaee8 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2433,7 +2433,7 @@ static int con_open(struct tty_struct *tty, struct file *filp)
         int ret = 0;
 
         acquire_console_sem();
-        if (tty->count == 1) {
+        if (tty->driver_data == NULL) {
                 ret = vc_allocate(currcons);
                 if (ret == 0) {
                         struct vc_data *vc = vc_cons[currcons].d;
diff --git a/drivers/hwmon/adm1026.c b/drivers/hwmon/adm1026.c
index 4fa17c76eea2..c8a7f47911f9 100644
--- a/drivers/hwmon/adm1026.c
+++ b/drivers/hwmon/adm1026.c
@@ -325,7 +325,7 @@ int adm1026_attach_adapter(struct i2c_adapter *adapter)
 int adm1026_detach_client(struct i2c_client *client)
 {
         i2c_detach_client(client);
-        kfree(client);
+        kfree(i2c_get_clientdata(client));
         return 0;
 }
 
@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address,
 
         /* Error out and cleanup code */
 exitfree:
-        kfree(new_client);
+        kfree(data);
 exit:
         return err;
 }
diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c
index 9168e983ca1d..936250957270 100644
--- a/drivers/hwmon/adm1031.c
+++ b/drivers/hwmon/adm1031.c
@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind)
         return 0;
 
 exit_free:
-        kfree(new_client);
+        kfree(data);
 exit:
         return err;
 }
@@ -845,7 +845,7 @@ static int adm1031_detach_client(struct i2c_client *client)
         if ((ret = i2c_detach_client(client)) != 0) {
                 return ret;
         }
-        kfree(client);
+        kfree(i2c_get_clientdata(client));
         return 0;
 }
 
diff --git a/drivers/hwmon/adm9240.c b/drivers/hwmon/adm9240.c
index 5c68e9c311aa..ce2a6eb93f6e 100644
--- a/drivers/hwmon/adm9240.c
+++ b/drivers/hwmon/adm9240.c
@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind)
 
         return 0;
 exit_free:
-        kfree(new_client);
+        kfree(data);
 exit:
         return err;
 }
diff --git a/drivers/hwmon/fscpos.c b/drivers/hwmon/fscpos.c
index 270015b626ad..301ae98bd0ad 100644
--- a/drivers/hwmon/fscpos.c
+++ b/drivers/hwmon/fscpos.c
@@ -167,7 +167,7 @@ static ssize_t set_temp_reset(struct i2c_client *client, struct fscpos_data
                                 "experience to the module author.\n");
 
         /* Supported value: 2 (clears the status) */
-        fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr], 2);
+        fscpos_write_value(client, FSCPOS_REG_TEMP_STATE[nr - 1], 2);
         return count;
 }
 
diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c
index 251ac2659554..fdeeb3ab6f2f 100644
--- a/drivers/hwmon/smsc47b397.c
+++ b/drivers/hwmon/smsc47b397.c
@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind)
         return 0;
 
 error_free:
-        kfree(new_client);
+        kfree(data);
 error_release:
         release_region(addr, SMSC_EXTENT);
         return err;
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index 897117a7213f..7166ad0b2fda 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind)
         return 0;
 
 error_free:
-        kfree(new_client);
+        kfree(data);
 error_release:
         release_region(address, SMSC_EXTENT);
         return err;
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index b12a970cc9a3..27018c8efc24 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -478,7 +478,6 @@ static void ohci_initialize(struct ti_ohci *ohci)
         int num_ports, i;
 
         spin_lock_init(&ohci->phy_reg_lock);
-        spin_lock_init(&ohci->event_lock);
 
         /* Put some defaults to these undefined bus options */
         buf = reg_read(ohci, OHCI1394_BusOptions);
@@ -3402,7 +3401,14 @@ static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
         /* We hopefully don't have to pre-allocate IT DMA like we did
          * for IR DMA above. Allocate it on-demand and mark inactive. */
         ohci->it_legacy_context.ohci = NULL;
+        spin_lock_init(&ohci->event_lock);
 
+        /*
+         * interrupts are disabled, all right, but... due to SA_SHIRQ we
+         * might get called anyway.  We'll see no event, of course, but
+         * we need to get to that "no event", so enough should be initialized
+         * by that point.
+         */
         if (request_irq(dev->irq, ohci_irq_handler, SA_SHIRQ,
                          OHCI1394_DRIVER_NAME, ohci))
                 FAIL(-ENOMEM, "Failed to allocate shared interrupt %d", dev->irq);
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index eb99e693dec2..5f6e9ea29cd7 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib_ucontext *context)
 
         list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
                 struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
+                struct ib_device *mrdev = mr->device;
                 struct ib_umem_object *memobj;
 
                 idr_remove(&ib_uverbs_mr_idr, uobj->id);
                 ib_dereg_mr(mr);
 
                 memobj = container_of(uobj, struct ib_umem_object, uobject);
-                ib_umem_release_on_close(mr->device, &memobj->umem);
+                ib_umem_release_on_close(mrdev, &memobj->umem);
 
                 list_del(&uobj->list);
                 kfree(memobj);
diff --git a/drivers/isdn/capi/capifs.c b/drivers/isdn/capi/capifs.c
index f8570fd9d2ab..3abd7fc6e5ef 100644
--- a/drivers/isdn/capi/capifs.c
+++ b/drivers/isdn/capi/capifs.c
@@ -191,8 +191,10 @@ static int __init capifs_init(void)
         err = register_filesystem(&capifs_fs_type);
         if (!err) {
                 capifs_mnt = kern_mount(&capifs_fs_type);
-                if (IS_ERR(capifs_mnt))
+                if (IS_ERR(capifs_mnt)) {
                         err = PTR_ERR(capifs_mnt);
+                        unregister_filesystem(&capifs_fs_type);
+                }
         }
         if (!err)
                 printk(KERN_NOTICE "capifs: Rev %s\n", rev);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 486ee50cfdda..20ca80b7dc20 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1689,6 +1689,7 @@ static int do_md_run(mddev_t * mddev)
         mddev->pers = pers[pnum];
         spin_unlock(&pers_lock);
 
+        mddev->recovery = 0;
         mddev->resync_max_sectors = mddev->size << 1; /* may be over-ridden by personality */
 
         /* before we start the array running, initialise the bitmap */
@@ -4011,3 +4012,4 @@ EXPORT_SYMBOL(md_print_devices);
 EXPORT_SYMBOL(md_check_recovery);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("md");
+MODULE_ALIAS_BLOCKDEV_MAJOR(MD_MAJOR);
diff --git a/drivers/media/dvb/dvb-usb/dibusb-common.c b/drivers/media/dvb/dvb-usb/dibusb-common.c
index 63b626f70c81..9b9d6f8ee74e 100644
--- a/drivers/media/dvb/dvb-usb/dibusb-common.c
+++ b/drivers/media/dvb/dvb-usb/dibusb-common.c
@@ -70,13 +70,22 @@ EXPORT_SYMBOL(dibusb_power_ctrl);
 
 int dibusb2_0_streaming_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        u8 b[2];
-        b[0] = DIBUSB_REQ_SET_IOCTL;
-        b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM;
+        u8 b[3] = { 0 };
+        int ret;
+
+        if ((ret = dibusb_streaming_ctrl(d,onoff)) < 0)
+                return ret;
 
-        dvb_usb_generic_write(d,b,3);
+        if (onoff) {
+                b[0] = DIBUSB_REQ_SET_STREAMING_MODE;
+                b[1] = 0x00;
+                if ((ret = dvb_usb_generic_write(d,b,2)) < 0)
+                        return ret;
+        }
 
-        return dibusb_streaming_ctrl(d,onoff);
+        b[0] = DIBUSB_REQ_SET_IOCTL;
+        b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM;
+        return dvb_usb_generic_write(d,b,3);
 }
 EXPORT_SYMBOL(dibusb2_0_streaming_ctrl);
 
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c b/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
index 3491ff40885c..6fa92100248b 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
@@ -23,12 +23,12 @@ static int dvb_usb_ctrl_feed(struct dvb_demux_feed *dvbdmxfeed, int onoff)
          */
         if (newfeedcount == 0) {
                 deb_ts("stop feeding\n");
+                dvb_usb_urb_kill(d);
 
                 if (d->props.streaming_ctrl != NULL)
                         if ((ret = d->props.streaming_ctrl(d,0)))
                                 err("error while stopping stream.");
 
-                dvb_usb_urb_kill(d);
         }
 
         d->feedcount = newfeedcount;
@@ -44,6 +44,8 @@ static int dvb_usb_ctrl_feed(struct dvb_demux_feed *dvbdmxfeed, int onoff)
          * for reception.
          */
         if (d->feedcount == onoff && d->feedcount > 0) {
+                deb_ts("submitting all URBs\n");
+                dvb_usb_urb_submit(d);
 
                 deb_ts("controlling pid parser\n");
                 if (d->props.caps & DVB_USB_HAS_PID_FILTER &&
@@ -59,7 +61,6 @@ static int dvb_usb_ctrl_feed(struct dvb_demux_feed *dvbdmxfeed, int onoff)
                                 return -ENODEV;
                         }
 
-                dvb_usb_urb_submit(d);
         }
         return 0;
 }
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index f9e3be96963c..0b230222bfea 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -308,12 +308,6 @@ static int sp_set_mac_address(struct net_device *dev, void *addr)
 {
         struct sockaddr_ax25 *sa = addr;
 
-        if (sa->sax25_family != AF_AX25)
-                return -EINVAL;
-
-        if (!sa->sax25_ndigis)
-                return -EINVAL;
-
         spin_lock_irq(&dev->xmit_lock);
         memcpy(dev->dev_addr, &sa->sax25_call, AX25_ADDR_LEN);
         spin_unlock_irq(&dev->xmit_lock);
@@ -668,6 +662,9 @@ static int sixpack_open(struct tty_struct *tty)
         netif_start_queue(dev);
 
         init_timer(&sp->tx_t);
+        sp->tx_t.function = sp_xmit_on_air;
+        sp->tx_t.data = (unsigned long) sp;
+
         init_timer(&sp->resync_t);
 
         spin_unlock_bh(&sp->lock);
diff --git a/drivers/net/ibm_emac/ibm_emac_core.c b/drivers/net/ibm_emac/ibm_emac_core.c
index c7fb3675c09d..0de3bb906174 100644
--- a/drivers/net/ibm_emac/ibm_emac_core.c
+++ b/drivers/net/ibm_emac/ibm_emac_core.c
@@ -1253,7 +1253,7 @@ static int emac_init_tah(struct ocp_enet_private *fep)
                  TAH_MR_CVR | TAH_MR_ST_768 | TAH_MR_TFS_10KB | TAH_MR_DTFP |
                  TAH_MR_DIG);
 
-        iounmap(&tahp);
+        iounmap(tahp);
 
         return 0;
 }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 01419aff333e..6d4ab1e333b5 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -66,8 +66,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.36"
-#define DRV_MODULE_RELDATE      "August 19, 2005"
+#define DRV_MODULE_VERSION      "3.37"
+#define DRV_MODULE_RELDATE      "August 25, 2005"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -7865,8 +7865,6 @@ static int tg3_test_loopback(struct tg3 *tp)
 
         err = -EIO;
 
-        tg3_abort_hw(tp, 1);
-
         tg3_reset_hw(tp);
 
         mac_mode = (tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK) |
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index 533f90c05cdf..381f339e3200 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -112,7 +112,7 @@ qdio_min(int a,int b)
 
 /***************** SCRUBBER HELPER ROUTINES **********************/
 
-static inline volatile __u64 
+static inline __u64 
 qdio_get_micros(void)
 {
         return (get_clock() >> 10); /* time>>12 is microseconds */
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index e17b4d58a9f6..bfe3ba73bc0f 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -1299,13 +1299,10 @@ struct zfcp_port *
 zfcp_port_enqueue(struct zfcp_adapter *adapter, wwn_t wwpn, u32 status,
                   u32 d_id)
 {
-        struct zfcp_port *port, *tmp_port;
+        struct zfcp_port *port;
         int check_wwpn;
-        scsi_id_t scsi_id;
-        int found;
 
         check_wwpn = !(status & ZFCP_STATUS_PORT_NO_WWPN);
-
         /*
          * check that there is no port with this WWPN already in list
          */
@@ -1368,7 +1365,7 @@ zfcp_port_enqueue(struct zfcp_adapter *adapter, wwn_t wwpn, u32 status,
         } else {
                 snprintf(port->sysfs_device.bus_id,
                          BUS_ID_SIZE, "0x%016llx", wwpn);
-        port->sysfs_device.parent = &adapter->ccw_device->dev;
+                port->sysfs_device.parent = &adapter->ccw_device->dev;
         }
         port->sysfs_device.release = zfcp_sysfs_port_release;
         dev_set_drvdata(&port->sysfs_device, port);
@@ -1388,24 +1385,8 @@ zfcp_port_enqueue(struct zfcp_adapter *adapter, wwn_t wwpn, u32 status,
 
         zfcp_port_get(port);
 
-        scsi_id = 1;
-        found = 0;
         write_lock_irq(&zfcp_data.config_lock);
-        list_for_each_entry(tmp_port, &adapter->port_list_head, list) {
-                if (atomic_test_mask(ZFCP_STATUS_PORT_NO_SCSI_ID,
-                                     &tmp_port->status))
-                        continue;
-                if (tmp_port->scsi_id != scsi_id) {
-                        found = 1;
-                        break;
-                }
-                scsi_id++;
-        }
-        port->scsi_id = scsi_id;
-        if (found)
-                list_add_tail(&port->list, &tmp_port->list);
-        else
-                list_add_tail(&port->list, &adapter->port_list_head);
+        list_add_tail(&port->list, &adapter->port_list_head);
         atomic_clear_mask(ZFCP_STATUS_COMMON_REMOVE, &port->status);
         atomic_set_mask(ZFCP_STATUS_COMMON_RUNNING, &port->status);
         if (d_id == ZFCP_DID_DIRECTORY_SERVICE)
@@ -1427,6 +1408,9 @@ zfcp_port_dequeue(struct zfcp_port *port)
         list_del(&port->list);
         port->adapter->ports--;
         write_unlock_irq(&zfcp_data.config_lock);
+        if (port->rport)
+                fc_remote_port_delete(port->rport);
+        port->rport = NULL;
         zfcp_adapter_put(port->adapter);
         zfcp_sysfs_port_remove_files(&port->sysfs_device,
                                      atomic_read(&port->status));
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index 0fc46381fc22..b30abab77da3 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -202,9 +202,19 @@ static int
 zfcp_ccw_set_offline(struct ccw_device *ccw_device)
 {
         struct zfcp_adapter *adapter;
+        struct zfcp_port *port;
+        struct fc_rport *rport;
 
         down(&zfcp_data.config_sema);
         adapter = dev_get_drvdata(&ccw_device->dev);
+        /* might be racy, but we cannot take config_lock due to the fact that
+           fc_remote_port_delete might sleep */
+        list_for_each_entry(port, &adapter->port_list_head, list)
+                if (port->rport) {
+                        rport = port->rport;
+                        port->rport = NULL;
+                        fc_remote_port_delete(rport);
+                }
         zfcp_erp_adapter_shutdown(adapter, 0);
         zfcp_erp_wait(adapter);
         zfcp_adapter_scsi_unregister(adapter);
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 4103b5be7683..455e902533a9 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -906,6 +906,7 @@ struct zfcp_adapter {
  */
 struct zfcp_port {
         struct device          sysfs_device;   /* sysfs device */
+        struct fc_rport        *rport;         /* rport of fc transport class */
         struct list_head       list;           /* list of remote ports */
         atomic_t               refcount;       /* reference count */
         wait_queue_head_t      remove_wq;      /* can be used to wait for
@@ -916,7 +917,6 @@ struct zfcp_port {
                                                   list */
         u32                    units;          /* # of logical units in list */
         atomic_t               status;         /* status of this remote port */
-        scsi_id_t              scsi_id;        /* own SCSI ID */
         wwn_t                  wwnn;           /* WWNN if known */
         wwn_t                  wwpn;           /* WWPN */
         fc_id_t                d_id;           /* D_ID */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 0cf31f7d1c0f..cb4f612550ba 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -3360,13 +3360,32 @@ zfcp_erp_action_cleanup(int action, struct zfcp_adapter *adapter,
                 if ((result == ZFCP_ERP_SUCCEEDED)
                     && (!atomic_test_mask(ZFCP_STATUS_UNIT_TEMPORARY,
                                           &unit->status))
-                    && (!unit->device))
-                        scsi_add_device(unit->port->adapter->scsi_host, 0,
-                                        unit->port->scsi_id, unit->scsi_lun);
+                    && !unit->device
+                    && port->rport)
+                        scsi_add_device(port->adapter->scsi_host, 0,
+                                        port->rport->scsi_target_id,
+                                        unit->scsi_lun);
                 zfcp_unit_put(unit);
                 break;
         case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
         case ZFCP_ERP_ACTION_REOPEN_PORT:
+                if ((result == ZFCP_ERP_SUCCEEDED)
+                    && !atomic_test_mask(ZFCP_STATUS_PORT_NO_WWPN,
+                                         &port->status)
+                    && !port->rport) {
+                        struct fc_rport_identifiers ids;
+                        ids.node_name = port->wwnn;
+                        ids.port_name = port->wwpn;
+                        ids.port_id = port->d_id;
+                        ids.roles = FC_RPORT_ROLE_FCP_TARGET;
+                        port->rport =
+                                fc_remote_port_add(adapter->scsi_host, 0, &ids);
+                        if (!port->rport)
+                                ZFCP_LOG_NORMAL("failed registration of rport"
+                                                "(adapter %s, wwpn=0x%016Lx)\n",
+                                                zfcp_get_busid_by_port(port),
+                                                port->wwpn);
+                }
                 zfcp_port_put(port);
                 break;
         case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 42df7e57eeae..cd98a2de9f8f 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -143,6 +143,8 @@ extern int zfcp_scsi_command_async(struct zfcp_adapter *,struct zfcp_unit *,
                                    struct scsi_cmnd *, struct timer_list *);
 extern int zfcp_scsi_command_sync(struct zfcp_unit *, struct scsi_cmnd *,
                                   struct timer_list *);
+extern void zfcp_set_fc_host_attrs(struct zfcp_adapter *);
+extern void zfcp_set_fc_rport_attrs(struct zfcp_port *);
 extern struct scsi_transport_template *zfcp_transport_template;
 extern struct fc_function_template zfcp_transport_functions;
 
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 0d9f20edc490..c007b6424e74 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -2062,6 +2062,7 @@ zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *fsf_req, int xchg_ok)
                 zfcp_erp_adapter_shutdown(adapter, 0);
                 return -EIO;
         }
+        zfcp_set_fc_host_attrs(adapter);
         return 0;
 }
 
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index b61d309352c3..31a76065cf28 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -389,7 +389,7 @@ zfcp_unit_lookup(struct zfcp_adapter *adapter, int channel, scsi_id_t id,
         struct zfcp_unit *unit, *retval = NULL;
 
         list_for_each_entry(port, &adapter->port_list_head, list) {
-                if (id != port->scsi_id)
+                if (!port->rport || (id != port->rport->scsi_target_id))
                         continue;
                 list_for_each_entry(unit, &port->unit_list_head, list) {
                         if (lun == unit->scsi_lun) {
@@ -408,7 +408,7 @@ zfcp_port_lookup(struct zfcp_adapter *adapter, int channel, scsi_id_t id)
         struct zfcp_port *port;
 
         list_for_each_entry(port, &adapter->port_list_head, list) {
-                if (id == port->scsi_id)
+                if (port->rport && (id == port->rport->scsi_target_id))
                         return port;
         }
         return (struct zfcp_port *) NULL;
@@ -634,7 +634,6 @@ zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *scpnt)
 {
         int retval;
         struct zfcp_unit *unit = (struct zfcp_unit *) scpnt->device->hostdata;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
 
         if (!unit) {
                 ZFCP_LOG_NORMAL("bug: Tried reset for nonexistent unit\n");
@@ -729,7 +728,6 @@ zfcp_scsi_eh_bus_reset_handler(struct scsi_cmnd *scpnt)
 {
         int retval = 0;
         struct zfcp_unit *unit;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
 
         unit = (struct zfcp_unit *) scpnt->device->hostdata;
         ZFCP_LOG_NORMAL("bus reset because of problems with "
@@ -753,7 +751,6 @@ zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
 {
         int retval = 0;
         struct zfcp_unit *unit;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
 
         unit = (struct zfcp_unit *) scpnt->device->hostdata;
         ZFCP_LOG_NORMAL("host reset because of problems with "
@@ -833,6 +830,7 @@ zfcp_adapter_scsi_unregister(struct zfcp_adapter *adapter)
         shost = adapter->scsi_host;
         if (!shost)
                 return;
+        fc_remove_host(shost);
         scsi_remove_host(shost);
         scsi_host_put(shost);
         adapter->scsi_host = NULL;
@@ -906,6 +904,18 @@ zfcp_get_node_name(struct scsi_target *starget)
         read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 }
 
+void
+zfcp_set_fc_host_attrs(struct zfcp_adapter *adapter)
+{
+        struct Scsi_Host *shost = adapter->scsi_host;
+
+        fc_host_node_name(shost) = adapter->wwnn;
+        fc_host_port_name(shost) = adapter->wwpn;
+        strncpy(fc_host_serial_number(shost), adapter->serial_number,
+                min(FC_SERIAL_NUMBER_SIZE, 32));
+        fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
+}
+
 struct fc_function_template zfcp_transport_functions = {
         .get_starget_port_id = zfcp_get_port_id,
         .get_starget_port_name = zfcp_get_port_name,
@@ -913,6 +923,11 @@ struct fc_function_template zfcp_transport_functions = {
         .show_starget_port_id = 1,
         .show_starget_port_name = 1,
         .show_starget_node_name = 1,
+        .show_rport_supported_classes = 1,
+        .show_host_node_name = 1,
+        .show_host_port_name = 1,
+        .show_host_supported_classes = 1,
+        .show_host_serial_number = 1,
 };
 
 /**
diff --git a/drivers/s390/scsi/zfcp_sysfs_port.c b/drivers/s390/scsi/zfcp_sysfs_port.c
index 7a84c7d474d9..c55e82d91deb 100644
--- a/drivers/s390/scsi/zfcp_sysfs_port.c
+++ b/drivers/s390/scsi/zfcp_sysfs_port.c
@@ -67,7 +67,6 @@ static DEVICE_ATTR(_name, S_IRUGO, zfcp_sysfs_port_##_name##_show, NULL);
 ZFCP_DEFINE_PORT_ATTR(status, "0x%08x\n", atomic_read(&port->status));
 ZFCP_DEFINE_PORT_ATTR(wwnn, "0x%016llx\n", port->wwnn);
 ZFCP_DEFINE_PORT_ATTR(d_id, "0x%06x\n", port->d_id);
-ZFCP_DEFINE_PORT_ATTR(scsi_id, "0x%x\n", port->scsi_id);
 ZFCP_DEFINE_PORT_ATTR(in_recovery, "%d\n", atomic_test_mask
                       (ZFCP_STATUS_COMMON_ERP_INUSE, &port->status));
 ZFCP_DEFINE_PORT_ATTR(access_denied, "%d\n", atomic_test_mask
@@ -263,7 +262,6 @@ static struct attribute_group zfcp_port_common_attr_group = {
 static struct attribute *zfcp_port_no_ns_attrs[] = {
         &dev_attr_unit_add.attr,
         &dev_attr_unit_remove.attr,
-        &dev_attr_scsi_id.attr,
         NULL
 };
 
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 51292f269ce5..e822ca0e97cf 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2971,23 +2971,22 @@ static void * dev_seq_start(struct seq_file *s, loff_t *pos)
 {
         struct sg_proc_deviter * it = kmalloc(sizeof(*it), GFP_KERNEL);
 
+        s->private = it;
         if (! it)
                 return NULL;
+
         if (NULL == sg_dev_arr)
-                goto err1;
+                return NULL;
         it->index = *pos;
         it->max = sg_last_dev();
         if (it->index >= it->max)
-                goto err1;
+                return NULL;
         return it;
-err1:
-        kfree(it);
-        return NULL;
 }
 
 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
+        struct sg_proc_deviter * it = s->private;
 
         *pos = ++it->index;
         return (it->index < it->max) ? it : NULL;
@@ -2995,7 +2994,7 @@ static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
 
 static void dev_seq_stop(struct seq_file *s, void *v)
 {
-        kfree (v);
+        kfree(s->private);
 }
 
 static int sg_proc_open_dev(struct inode *inode, struct file *file)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 30ab70ce5547..3497125189df 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -643,7 +643,7 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                          netfid, length,
                          pfLock->fl_start, numUnlock, numLock, lockType,
                          wait_flag);
-        if (rc == 0 && (pfLock->fl_flags & FL_POSIX))
+        if (pfLock->fl_flags & FL_POSIX)
                 posix_lock_file_wait(file, pfLock);
         FreeXid(xid);
         return rc;
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index d727dc960634..970a33f03299 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -228,6 +228,10 @@ void sysfs_hash_and_remove(struct dentry * dir, const char * name)
         struct sysfs_dirent * sd;
         struct sysfs_dirent * parent_sd = dir->d_fsdata;
 
+        if (dir->d_inode == NULL)
+                /* no inode means this hasn't been made visible yet */
+                return;
+
         down(&dir->d_inode->i_sem);
         list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
                 if (!sd->s_element)
diff --git a/include/asm-ia64/mmu.h b/include/asm-ia64/mmu.h
index ae1525352a25..611432ba579c 100644
--- a/include/asm-ia64/mmu.h
+++ b/include/asm-ia64/mmu.h
@@ -2,10 +2,12 @@
 #define __MMU_H
 
 /*
- * Type for a context number.  We declare it volatile to ensure proper ordering when it's
- * accessed outside of spinlock'd critical sections (e.g., as done in activate_mm() and
- * init_new_context()).
+ * Type for a context number.  We declare it volatile to ensure proper
+ * ordering when it's accessed outside of spinlock'd critical sections
+ * (e.g., as done in activate_mm() and init_new_context()).
  */
 typedef volatile unsigned long mm_context_t;
 
+typedef unsigned long nv_mm_context_t;
+
 #endif
diff --git a/include/asm-ia64/mmu_context.h b/include/asm-ia64/mmu_context.h
index e3e5fededb04..0680d163be97 100644
--- a/include/asm-ia64/mmu_context.h
+++ b/include/asm-ia64/mmu_context.h
@@ -55,34 +55,46 @@ static inline void
 delayed_tlb_flush (void)
 {
         extern void local_flush_tlb_all (void);
+        unsigned long flags;
 
         if (unlikely(__ia64_per_cpu_var(ia64_need_tlb_flush))) {
-                local_flush_tlb_all();
-                __ia64_per_cpu_var(ia64_need_tlb_flush) = 0;
+                spin_lock_irqsave(&ia64_ctx.lock, flags);
+                {
+                        if (__ia64_per_cpu_var(ia64_need_tlb_flush)) {
+                                local_flush_tlb_all();
+                                __ia64_per_cpu_var(ia64_need_tlb_flush) = 0;
+                        }
+                }
+                spin_unlock_irqrestore(&ia64_ctx.lock, flags);
         }
 }
 
-static inline mm_context_t
+static inline nv_mm_context_t
 get_mmu_context (struct mm_struct *mm)
 {
         unsigned long flags;
-        mm_context_t context = mm->context;
-
-        if (context)
-                return context;
-
-        spin_lock_irqsave(&ia64_ctx.lock, flags);
-        {
-                /* re-check, now that we've got the lock: */
-                context = mm->context;
-                if (context == 0) {
-                        cpus_clear(mm->cpu_vm_mask);
-                        if (ia64_ctx.next >= ia64_ctx.limit)
-                                wrap_mmu_context(mm);
-                        mm->context = context = ia64_ctx.next++;
+        nv_mm_context_t context = mm->context;
+
+        if (unlikely(!context)) {
+                spin_lock_irqsave(&ia64_ctx.lock, flags);
+                {
+                        /* re-check, now that we've got the lock: */
+                        context = mm->context;
+                        if (context == 0) {
+                                cpus_clear(mm->cpu_vm_mask);
+                                if (ia64_ctx.next >= ia64_ctx.limit)
+                                        wrap_mmu_context(mm);
+                                mm->context = context = ia64_ctx.next++;
+                        }
                 }
+                spin_unlock_irqrestore(&ia64_ctx.lock, flags);
         }
-        spin_unlock_irqrestore(&ia64_ctx.lock, flags);
+        /*
+         * Ensure we're not starting to use "context" before any old
+         * uses of it are gone from our TLB.
+         */
+        delayed_tlb_flush();
+
         return context;
 }
 
@@ -104,7 +116,7 @@ destroy_context (struct mm_struct *mm)
 }
 
 static inline void
-reload_context (mm_context_t context)
+reload_context (nv_mm_context_t context)
 {
         unsigned long rid;
         unsigned long rid_incr = 0;
@@ -138,7 +150,7 @@ reload_context (mm_context_t context)
 static inline void
 activate_context (struct mm_struct *mm)
 {
-        mm_context_t context;
+        nv_mm_context_t context;
 
         do {
                 context = get_mmu_context(mm);
@@ -157,8 +169,6 @@ activate_context (struct mm_struct *mm)
 static inline void
 activate_mm (struct mm_struct *prev, struct mm_struct *next)
 {
-        delayed_tlb_flush();
-
         /*
          * We may get interrupts here, but that's OK because interrupt handlers cannot
          * touch user-space.
diff --git a/include/asm-ia64/rwsem.h b/include/asm-ia64/rwsem.h
index 6ece5061dc19..e18b5ab0cb75 100644
--- a/include/asm-ia64/rwsem.h
+++ b/include/asm-ia64/rwsem.h
@@ -3,6 +3,7 @@
  *
  * Copyright (C) 2003 Ken Chen <kenneth.w.chen@intel.com>
  * Copyright (C) 2003 Asit Mallick <asit.k.mallick@intel.com>
+ * Copyright (C) 2005 Christoph Lameter <clameter@sgi.com>
  *
  * Based on asm-i386/rwsem.h and other architecture implementation.
  *
@@ -11,9 +12,9 @@
  *
  * The lock count is initialized to 0 (no active and no waiting lockers).
  *
- * When a writer subtracts WRITE_BIAS, it'll get 0xffff0001 for the case
- * of an uncontended lock. Readers increment by 1 and see a positive value
- * when uncontended, negative if there are writers (and maybe) readers
+ * When a writer subtracts WRITE_BIAS, it'll get 0xffffffff00000001 for
+ * the case of an uncontended lock. Readers increment by 1 and see a positive
+ * value when uncontended, negative if there are writers (and maybe) readers
  * waiting (in which case it goes to sleep).
  */
 
@@ -29,7 +30,7 @@
  * the semaphore definition
  */
 struct rw_semaphore {
-        signed int              count;
+        signed long             count;
         spinlock_t              wait_lock;
         struct list_head        wait_list;
 #if RWSEM_DEBUG
@@ -37,10 +38,10 @@ struct rw_semaphore {
 #endif
 };
 
-#define RWSEM_UNLOCKED_VALUE            0x00000000
-#define RWSEM_ACTIVE_BIAS               0x00000001
-#define RWSEM_ACTIVE_MASK               0x0000ffff
-#define RWSEM_WAITING_BIAS              (-0x00010000)
+#define RWSEM_UNLOCKED_VALUE            __IA64_UL_CONST(0x0000000000000000)
+#define RWSEM_ACTIVE_BIAS               __IA64_UL_CONST(0x0000000000000001)
+#define RWSEM_ACTIVE_MASK               __IA64_UL_CONST(0x00000000ffffffff)
+#define RWSEM_WAITING_BIAS              -__IA64_UL_CONST(0x0000000100000000)
 #define RWSEM_ACTIVE_READ_BIAS          RWSEM_ACTIVE_BIAS
 #define RWSEM_ACTIVE_WRITE_BIAS         (RWSEM_WAITING_BIAS + RWSEM_ACTIVE_BIAS)
 
@@ -83,7 +84,7 @@ init_rwsem (struct rw_semaphore *sem)
 static inline void
 __down_read (struct rw_semaphore *sem)
 {
-        int result = ia64_fetchadd4_acq((unsigned int *)&sem->count, 1);
+        long result = ia64_fetchadd8_acq((unsigned long *)&sem->count, 1);
 
         if (result < 0)
                 rwsem_down_read_failed(sem);
@@ -95,7 +96,7 @@ __down_read (struct rw_semaphore *sem)
 static inline void
 __down_write (struct rw_semaphore *sem)
 {
-        int old, new;
+        long old, new;
 
         do {
                 old = sem->count;
@@ -112,7 +113,7 @@ __down_write (struct rw_semaphore *sem)
 static inline void
 __up_read (struct rw_semaphore *sem)
 {
-        int result = ia64_fetchadd4_rel((unsigned int *)&sem->count, -1);
+        long result = ia64_fetchadd8_rel((unsigned long *)&sem->count, -1);
 
         if (result < 0 && (--result & RWSEM_ACTIVE_MASK) == 0)
                 rwsem_wake(sem);
@@ -124,7 +125,7 @@ __up_read (struct rw_semaphore *sem)
 static inline void
 __up_write (struct rw_semaphore *sem)
 {
-        int old, new;
+        long old, new;
 
         do {
                 old = sem->count;
@@ -141,7 +142,7 @@ __up_write (struct rw_semaphore *sem)
 static inline int
 __down_read_trylock (struct rw_semaphore *sem)
 {
-        int tmp;
+        long tmp;
         while ((tmp = sem->count) >= 0) {
                 if (tmp == cmpxchg_acq(&sem->count, tmp, tmp+1)) {
                         return 1;
@@ -156,7 +157,7 @@ __down_read_trylock (struct rw_semaphore *sem)
 static inline int
 __down_write_trylock (struct rw_semaphore *sem)
 {
-        int tmp = cmpxchg_acq(&sem->count, RWSEM_UNLOCKED_VALUE,
+        long tmp = cmpxchg_acq(&sem->count, RWSEM_UNLOCKED_VALUE,
                               RWSEM_ACTIVE_WRITE_BIAS);
         return tmp == RWSEM_UNLOCKED_VALUE;
 }
@@ -167,7 +168,7 @@ __down_write_trylock (struct rw_semaphore *sem)
 static inline void
 __downgrade_write (struct rw_semaphore *sem)
 {
-        int old, new;
+        long old, new;
 
         do {
                 old = sem->count;
@@ -182,7 +183,7 @@ __downgrade_write (struct rw_semaphore *sem)
  * Implement atomic add functionality.  These used to be "inline" functions, but GCC v3.1
  * doesn't quite optimize this stuff right and ends up with bad calls to fetchandadd.
  */
-#define rwsem_atomic_add(delta, sem)    atomic_add(delta, (atomic_t *)(&(sem)->count))
-#define rwsem_atomic_update(delta, sem) atomic_add_return(delta, (atomic_t *)(&(sem)->count))
+#define rwsem_atomic_add(delta, sem)    atomic64_add(delta, (atomic64_t *)(&(sem)->count))
+#define rwsem_atomic_update(delta, sem) atomic64_add_return(delta, (atomic64_t *)(&(sem)->count))
 
 #endif /* _ASM_IA64_RWSEM_H */
diff --git a/include/asm-ia64/spinlock.h b/include/asm-ia64/spinlock.h
index 909936f25512..d2430aa0d49d 100644
--- a/include/asm-ia64/spinlock.h
+++ b/include/asm-ia64/spinlock.h
@@ -93,7 +93,15 @@ _raw_spin_lock_flags (spinlock_t *lock, unsigned long flags)
 # endif /* CONFIG_MCKINLEY */
 #endif
 }
+
 #define _raw_spin_lock(lock) _raw_spin_lock_flags(lock, 0)
+
+/* Unlock by doing an ordered store and releasing the cacheline with nta */
+static inline void _raw_spin_unlock(spinlock_t *x) {
+        barrier();
+        asm volatile ("st4.rel.nta [%0] = r0\n\t" :: "r"(x));
+}
+
 #else /* !ASM_SUPPORTED */
 #define _raw_spin_lock_flags(lock, flags) _raw_spin_lock(lock)
 # define _raw_spin_lock(x)                                                              \
@@ -109,16 +117,16 @@ do {											\
                 } while (ia64_spinlock_val);                                            \
         }                                                                               \
 } while (0)
+#define _raw_spin_unlock(x)     do { barrier(); ((spinlock_t *) x)->lock = 0; } while (0)
 #endif /* !ASM_SUPPORTED */
 
 #define spin_is_locked(x)       ((x)->lock != 0)
-#define _raw_spin_unlock(x)     do { barrier(); ((spinlock_t *) x)->lock = 0; } while (0)
 #define _raw_spin_trylock(x)    (cmpxchg_acq(&(x)->lock, 0, 1) == 0)
 #define spin_unlock_wait(x)     do { barrier(); } while ((x)->lock)
 
 typedef struct {
-        volatile unsigned int read_counter      : 31;
-        volatile unsigned int write_lock        :  1;
+        volatile unsigned int read_counter      : 24;
+        volatile unsigned int write_lock        :  8;
 #ifdef CONFIG_PREEMPT
         unsigned int break_lock;
 #endif
@@ -174,6 +182,13 @@ do {										\
         (result == 0);                                                          \
 })
 
+static inline void _raw_write_unlock(rwlock_t *x)
+{
+        u8 *y = (u8 *)x;
+        barrier();
+        asm volatile ("st1.rel.nta [%0] = r0\n\t" :: "r"(y+3) : "memory" );
+}
+
 #else /* !ASM_SUPPORTED */
 
 #define _raw_write_lock(l)                                                              \
@@ -195,14 +210,14 @@ do {										\
         (ia64_val == 0);                                                \
 })
 
+static inline void _raw_write_unlock(rwlock_t *x)
+{
+        barrier();
+        x->write_lock = 0;
+}
+
 #endif /* !ASM_SUPPORTED */
 
 #define _raw_read_trylock(lock) generic_raw_read_trylock(lock)
 
-#define _raw_write_unlock(x)                                                            \
-({                                                                                      \
-        smp_mb__before_clear_bit();     /* need barrier before releasing lock... */     \
-        clear_bit(31, (x));                                                             \
-})
-
 #endif /*  _ASM_IA64_SPINLOCK_H */
diff --git a/include/asm-ppc64/bug.h b/include/asm-ppc64/bug.h
index 169868fa307d..160178278861 100644
--- a/include/asm-ppc64/bug.h
+++ b/include/asm-ppc64/bug.h
@@ -43,8 +43,8 @@ struct bug_entry *find_bug(unsigned long bugaddr);
                 ".section __bug_table,\"a\"\n\t"                \
                 "       .llong 1b,%1,%2,%3\n"                   \
                 ".previous"                                     \
-                : : "r" (x), "i" (__LINE__), "i" (__FILE__),    \
-                    "i" (__FUNCTION__));                        \
+                : : "r" ((long long)(x)), "i" (__LINE__),       \
+                    "i" (__FILE__), "i" (__FUNCTION__));        \
 } while (0)
 
 #define WARN_ON(x) do {                                         \
@@ -53,7 +53,8 @@ struct bug_entry *find_bug(unsigned long bugaddr);
                 ".section __bug_table,\"a\"\n\t"                \
                 "       .llong 1b,%1,%2,%3\n"                   \
                 ".previous"                                     \
-                : : "r" (x), "i" (__LINE__ + BUG_WARNING_TRAP), \
+                : : "r" ((long long)(x)),                       \
+                    "i" (__LINE__ + BUG_WARNING_TRAP),          \
                     "i" (__FILE__), "i" (__FUNCTION__));        \
 } while (0)
 
diff --git a/include/asm-x86_64/e820.h b/include/asm-x86_64/e820.h
index 8e94edf0b984..e682edc24a68 100644
--- a/include/asm-x86_64/e820.h
+++ b/include/asm-x86_64/e820.h
@@ -51,6 +51,8 @@ extern int e820_mapped(unsigned long start, unsigned long end, unsigned type);
 
 extern void e820_bootmem_free(pg_data_t *pgdat, unsigned long start,unsigned long end);
 extern void e820_setup_gap(void);
+extern unsigned long e820_hole_size(unsigned long start_pfn,
+                                    unsigned long end_pfn);
 
 extern void __init parse_memopt(char *p, char **end);
 
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index d7f4d0c95737..8ab1b4e518b8 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -627,6 +627,14 @@ static int validate_change(const struct cpuset *cur, const struct cpuset *trial)
  * Call with cpuset_sem held.  May nest a call to the
  * lock_cpu_hotplug()/unlock_cpu_hotplug() pair.
  */
+
+/*
+ * Hack to avoid 2.6.13 partial node dynamic sched domain bug.
+ * Disable letting 'cpu_exclusive' cpusets define dynamic sched
+ * domains, until the sched domain can handle partial nodes.
+ * Remove this #if hackery when sched domains fixed.
+ */
+#if 0
 static void update_cpu_domains(struct cpuset *cur)
 {
         struct cpuset *c, *par = cur->parent;
@@ -636,25 +644,6 @@ static void update_cpu_domains(struct cpuset *cur)
                 return;
 
         /*
-         * Hack to avoid 2.6.13 partial node dynamic sched domain bug.
-         * Require the 'cpu_exclusive' cpuset to include all (or none)
-         * of the CPUs on each node, or return w/o changing sched domains.
-         * Remove this hack when dynamic sched domains fixed.
-         */
-        {
-                int i, j;
-
-                for_each_cpu_mask(i, cur->cpus_allowed) {
-                        cpumask_t mask = node_to_cpumask(cpu_to_node(i));
-
-                        for_each_cpu_mask(j, mask) {
-                                if (!cpu_isset(j, cur->cpus_allowed))
-                                        return;
-                        }
-                }
-        }
-
-        /*
          * Get all cpus from parent's cpus_allowed not part of exclusive
          * children
          */
@@ -686,6 +675,11 @@ static void update_cpu_domains(struct cpuset *cur)
         partition_sched_domains(&pspan, &cspan);
         unlock_cpu_hotplug();
 }
+#else
+static void update_cpu_domains(struct cpuset *cur)
+{
+}
+#endif
 
 static int update_cpumask(struct cpuset *cs, char *buf)
 {
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index a701405fab0b..45efd5f4741b 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1333,9 +1333,9 @@ err:;
 }
 
 static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *plen, const struct flowi *flp,
-                             struct fib_result *res, int *err)
+                             struct fib_result *res)
 {
-        int i;
+        int err, i;
         t_key mask;
         struct leaf_info *li;
         struct hlist_head *hhead = &l->list;
@@ -1348,18 +1348,18 @@ static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *pl
                 if (l->key != (key & mask))
                         continue;
 
-                if (((*err) = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) == 0) {
+                if ((err = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) <= 0) {
                         *plen = i;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                         t->stats.semantic_match_passed++;
 #endif
-                        return 1;
+                        return err;
                 }
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                 t->stats.semantic_match_miss++;
 #endif
         }
-        return 0;
+        return 1;
 }
 
 static int
@@ -1386,7 +1386,7 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 
         /* Just a leaf? */
         if (IS_LEAF(n)) {
-                if (check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret))
+                if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
                         goto found;
                 goto failed;
         }
@@ -1508,7 +1508,7 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                        continue;
                 }
                 if (IS_LEAF(n)) {
-                        if (check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret))
+                        if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
                                 goto found;
                }
 backtrace: