36 files changed, 203 insertions, 105 deletions

diff --git a/Documentation/dontdiff b/Documentation/dontdiff
index 881e6dd03aea..27809357da58 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
@@ -5,6 +5,8 @@
 *.css
 *.dvi
 *.eps
+*.fw.gen.S
+*.fw
 *.gif
 *.grep
 *.grp
diff --git a/arch/m68k/atari/atakeyb.c b/arch/m68k/atari/atakeyb.c
index 8a2a53b33616..bb959fbab2dc 100644
--- a/arch/m68k/atari/atakeyb.c
+++ b/arch/m68k/atari/atakeyb.c
@@ -580,13 +580,15 @@ int atari_keyb_init(void)
         do {
                 /* reset IKBD ACIA */
                 acia.key_ctrl = ACIA_RESET |
-                                (atari_switches & ATARI_SWITCH_IKBD) ? ACIA_RHTID : 0;
+                                ((atari_switches & ATARI_SWITCH_IKBD) ?
+                                 ACIA_RHTID : 0);
                 (void)acia.key_ctrl;
                 (void)acia.key_data;
 
                 /* reset MIDI ACIA */
                 acia.mid_ctrl = ACIA_RESET |
-                                (atari_switches & ATARI_SWITCH_MIDI) ? ACIA_RHTID : 0;
+                                ((atari_switches & ATARI_SWITCH_MIDI) ?
+                                 ACIA_RHTID : 0);
                 (void)acia.mid_ctrl;
                 (void)acia.mid_data;
 
@@ -599,7 +601,8 @@ int atari_keyb_init(void)
                                  ACIA_RHTID : ACIA_RLTID);
 
                 acia.mid_ctrl = ACIA_DIV16 | ACIA_D8N1S |
-                                (atari_switches & ATARI_SWITCH_MIDI) ? ACIA_RHTID : 0;
+                                ((atari_switches & ATARI_SWITCH_MIDI) ?
+                                 ACIA_RHTID : 0);
 
         /* make sure the interrupt line is up */
         } while ((mfp.par_dt_reg & 0x10) == 0);
diff --git a/arch/parisc/hpux/fs.c b/arch/parisc/hpux/fs.c
index 69ff671498e5..12c04c5e558b 100644
--- a/arch/parisc/hpux/fs.c
+++ b/arch/parisc/hpux/fs.c
@@ -104,7 +104,7 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
         buf->count -= reclen;
         return 0;
 Efault:
-        buffer->error = -EFAULT;
+        buf->error = -EFAULT;
         return -EFAULT;
 }
 
diff --git a/arch/sparc/include/asm/smp_32.h b/arch/sparc/include/asm/smp_32.h
index 7201752cf934..a8180e546a48 100644
--- a/arch/sparc/include/asm/smp_32.h
+++ b/arch/sparc/include/asm/smp_32.h
@@ -50,27 +50,24 @@ struct seq_file;
 void smp_bogo(struct seq_file *);
 void smp_info(struct seq_file *);
 
-BTFIXUPDEF_CALL(void, smp_cross_call, smpfunc_t, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)
+BTFIXUPDEF_CALL(void, smp_cross_call, smpfunc_t, cpumask_t, unsigned long, unsigned long, unsigned long, unsigned long)
 BTFIXUPDEF_CALL(int, __hard_smp_processor_id, void)
 BTFIXUPDEF_BLACKBOX(hard_smp_processor_id)
 BTFIXUPDEF_BLACKBOX(load_current)
 
-#define smp_cross_call(func,arg1,arg2,arg3,arg4,arg5) BTFIXUP_CALL(smp_cross_call)(func,arg1,arg2,arg3,arg4,arg5)
+#define smp_cross_call(func,mask,arg1,arg2,arg3,arg4) BTFIXUP_CALL(smp_cross_call)(func,mask,arg1,arg2,arg3,arg4)
 
-static inline void xc0(smpfunc_t func) { smp_cross_call(func, 0, 0, 0, 0, 0); }
+static inline void xc0(smpfunc_t func) { smp_cross_call(func, cpu_online_map, 0, 0, 0, 0); }
 static inline void xc1(smpfunc_t func, unsigned long arg1)
-{ smp_cross_call(func, arg1, 0, 0, 0, 0); }
+{ smp_cross_call(func, cpu_online_map, arg1, 0, 0, 0); }
 static inline void xc2(smpfunc_t func, unsigned long arg1, unsigned long arg2)
-{ smp_cross_call(func, arg1, arg2, 0, 0, 0); }
+{ smp_cross_call(func, cpu_online_map, arg1, arg2, 0, 0); }
 static inline void xc3(smpfunc_t func, unsigned long arg1, unsigned long arg2,
                            unsigned long arg3)
-{ smp_cross_call(func, arg1, arg2, arg3, 0, 0); }
+{ smp_cross_call(func, cpu_online_map, arg1, arg2, arg3, 0); }
 static inline void xc4(smpfunc_t func, unsigned long arg1, unsigned long arg2,
                            unsigned long arg3, unsigned long arg4)
-{ smp_cross_call(func, arg1, arg2, arg3, arg4, 0); }
-static inline void xc5(smpfunc_t func, unsigned long arg1, unsigned long arg2,
-                           unsigned long arg3, unsigned long arg4, unsigned long arg5)
-{ smp_cross_call(func, arg1, arg2, arg3, arg4, arg5); }
+{ smp_cross_call(func, cpu_online_map, arg1, arg2, arg3, arg4); }
 
 static inline int smp_call_function(void (*func)(void *info), void *info, int wait)
 {
@@ -78,6 +75,14 @@ static inline int smp_call_function(void (*func)(void *info), void *info, int wa
         return 0;
 }
 
+static inline int smp_call_function_single(int cpuid, void (*func) (void *info),
+                                           void *info, int wait)
+{
+        smp_cross_call((smpfunc_t)func, cpumask_of_cpu(cpuid),
+                       (unsigned long) info, 0, 0, 0);
+        return 0;
+}
+
 static inline int cpu_logical_map(int cpu)
 {
         return cpu;
diff --git a/arch/sparc/kernel/of_device.c b/arch/sparc/kernel/of_device.c
index cc4c235c4f59..c481d45f97b7 100644
--- a/arch/sparc/kernel/of_device.c
+++ b/arch/sparc/kernel/of_device.c
@@ -70,7 +70,7 @@ struct of_bus {
                                        int *addrc, int *sizec);
         int             (*map)(u32 *addr, const u32 *range,
                                int na, int ns, int pna);
-        unsigned int    (*get_flags)(const u32 *addr);
+        unsigned long   (*get_flags)(const u32 *addr, unsigned long);
 };
 
 /*
@@ -130,8 +130,10 @@ static int of_bus_default_map(u32 *addr, const u32 *range,
         return 0;
 }
 
-static unsigned int of_bus_default_get_flags(const u32 *addr)
+static unsigned long of_bus_default_get_flags(const u32 *addr, unsigned long flags)
 {
+        if (flags)
+                return flags;
         return IORESOURCE_MEM;
 }
 
@@ -194,17 +196,21 @@ static int of_bus_pci_map(u32 *addr, const u32 *range,
         return 0;
 }
 
-static unsigned int of_bus_pci_get_flags(const u32 *addr)
+static unsigned long of_bus_pci_get_flags(const u32 *addr, unsigned long flags)
 {
-        unsigned int flags = 0;
         u32 w = addr[0];
 
+        /* For PCI, we override whatever child busses may have used.  */
+        flags = 0;
         switch((w >> 24) & 0x03) {
         case 0x01:
                 flags |= IORESOURCE_IO;
+                break;
+
         case 0x02: /* 32 bits */
         case 0x03: /* 64 bits */
                 flags |= IORESOURCE_MEM;
+                break;
         }
         if (w & 0x40000000)
                 flags |= IORESOURCE_PREFETCH;
@@ -362,10 +368,11 @@ static void __init build_device_resources(struct of_device *op,
                 int pna, pns;
 
                 size = of_read_addr(reg + na, ns);
-                flags = bus->get_flags(reg);
 
                 memcpy(addr, reg, na * 4);
 
+                flags = bus->get_flags(reg, 0);
+
                 /* If the immediate parent has no ranges property to apply,
                  * just use a 1<->1 mapping.
                  */
@@ -393,6 +400,8 @@ static void __init build_device_resources(struct of_device *op,
                                                dna, dns, pna))
                                 break;
 
+                        flags = pbus->get_flags(addr, flags);
+
                         dna = pna;
                         dns = pns;
                         dbus = pbus;
diff --git a/arch/sparc/kernel/sun4d_smp.c b/arch/sparc/kernel/sun4d_smp.c
index dfde77ff0848..69596402a500 100644
--- a/arch/sparc/kernel/sun4d_smp.c
+++ b/arch/sparc/kernel/sun4d_smp.c
@@ -262,8 +262,9 @@ static struct smp_funcall {
 static DEFINE_SPINLOCK(cross_call_lock);
 
 /* Cross calls must be serialized, at least currently. */
-void smp4d_cross_call(smpfunc_t func, unsigned long arg1, unsigned long arg2,
-                    unsigned long arg3, unsigned long arg4, unsigned long arg5)
+static void smp4d_cross_call(smpfunc_t func, cpumask_t mask, unsigned long arg1,
+                             unsigned long arg2, unsigned long arg3,
+                             unsigned long arg4)
 {
         if(smp_processors_ready) {
                 register int high = smp_highest_cpu;
@@ -278,7 +279,7 @@ void smp4d_cross_call(smpfunc_t func, unsigned long arg1, unsigned long arg2,
                         register unsigned long a2 asm("i2") = arg2;
                         register unsigned long a3 asm("i3") = arg3;
                         register unsigned long a4 asm("i4") = arg4;
-                        register unsigned long a5 asm("i5") = arg5;
+                        register unsigned long a5 asm("i5") = 0;
 
                         __asm__ __volatile__(
                                 "std %0, [%6]\n\t"
@@ -290,11 +291,10 @@ void smp4d_cross_call(smpfunc_t func, unsigned long arg1, unsigned long arg2,
 
                 /* Init receive/complete mapping, plus fire the IPI's off. */
                 {
-                        cpumask_t mask;
                         register int i;
 
-                        mask = cpumask_of_cpu(hard_smp4d_processor_id());
-                        cpus_andnot(mask, cpu_online_map, mask);
+                        cpu_clear(smp_processor_id(), mask);
+                        cpus_and(mask, cpu_online_map, mask);
                         for(i = 0; i <= high; i++) {
                                 if (cpu_isset(i, mask)) {
                                         ccall_info.processors_in[i] = 0;
@@ -309,12 +309,16 @@ void smp4d_cross_call(smpfunc_t func, unsigned long arg1, unsigned long arg2,
 
                         i = 0;
                         do {
+                                if (!cpu_isset(i, mask))
+                                        continue;
                                 while(!ccall_info.processors_in[i])
                                         barrier();
                         } while(++i <= high);
 
                         i = 0;
                         do {
+                                if (!cpu_isset(i, mask))
+                                        continue;
                                 while(!ccall_info.processors_out[i])
                                         barrier();
                         } while(++i <= high);
diff --git a/arch/sparc/kernel/sun4m_smp.c b/arch/sparc/kernel/sun4m_smp.c
index 406ac1abc83a..a14a76ac7f36 100644
--- a/arch/sparc/kernel/sun4m_smp.c
+++ b/arch/sparc/kernel/sun4m_smp.c
@@ -244,9 +244,9 @@ static struct smp_funcall {
 static DEFINE_SPINLOCK(cross_call_lock);
 
 /* Cross calls must be serialized, at least currently. */
-static void smp4m_cross_call(smpfunc_t func, unsigned long arg1,
+static void smp4m_cross_call(smpfunc_t func, cpumask_t mask, unsigned long arg1,
                              unsigned long arg2, unsigned long arg3,
-                             unsigned long arg4, unsigned long arg5)
+                             unsigned long arg4)
 {
                 register int ncpus = SUN4M_NCPUS;
                 unsigned long flags;
@@ -259,14 +259,14 @@ static void smp4m_cross_call(smpfunc_t func, unsigned long arg1,
                 ccall_info.arg2 = arg2;
                 ccall_info.arg3 = arg3;
                 ccall_info.arg4 = arg4;
-                ccall_info.arg5 = arg5;
+                ccall_info.arg5 = 0;
 
                 /* Init receive/complete mapping, plus fire the IPI's off. */
                 {
-                        cpumask_t mask = cpu_online_map;
                         register int i;
 
                         cpu_clear(smp_processor_id(), mask);
+                        cpus_and(mask, cpu_online_map, mask);
                         for(i = 0; i < ncpus; i++) {
                                 if (cpu_isset(i, mask)) {
                                         ccall_info.processors_in[i] = 0;
@@ -284,12 +284,16 @@ static void smp4m_cross_call(smpfunc_t func, unsigned long arg1,
 
                         i = 0;
                         do {
+                                if (!cpu_isset(i, mask))
+                                        continue;
                                 while(!ccall_info.processors_in[i])
                                         barrier();
                         } while(++i < ncpus);
 
                         i = 0;
                         do {
+                                if (!cpu_isset(i, mask))
+                                        continue;
                                 while(!ccall_info.processors_out[i])
                                         barrier();
                         } while(++i < ncpus);
diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c
index f8b50cbf4bf7..f845f150f565 100644
--- a/arch/sparc64/kernel/of_device.c
+++ b/arch/sparc64/kernel/of_device.c
@@ -96,7 +96,7 @@ struct of_bus {
                                        int *addrc, int *sizec);
         int             (*map)(u32 *addr, const u32 *range,
                                int na, int ns, int pna);
-        unsigned int    (*get_flags)(const u32 *addr);
+        unsigned long   (*get_flags)(const u32 *addr, unsigned long);
 };
 
 /*
@@ -156,8 +156,10 @@ static int of_bus_default_map(u32 *addr, const u32 *range,
         return 0;
 }
 
-static unsigned int of_bus_default_get_flags(const u32 *addr)
+static unsigned long of_bus_default_get_flags(const u32 *addr, unsigned long flags)
 {
+        if (flags)
+                return flags;
         return IORESOURCE_MEM;
 }
 
@@ -249,17 +251,21 @@ static int of_bus_pci_map(u32 *addr, const u32 *range,
         return 0;
 }
 
-static unsigned int of_bus_pci_get_flags(const u32 *addr)
+static unsigned long of_bus_pci_get_flags(const u32 *addr, unsigned long flags)
 {
-        unsigned int flags = 0;
         u32 w = addr[0];
 
+        /* For PCI, we override whatever child busses may have used.  */
+        flags = 0;
         switch((w >> 24) & 0x03) {
         case 0x01:
                 flags |= IORESOURCE_IO;
+                break;
+
         case 0x02: /* 32 bits */
         case 0x03: /* 64 bits */
                 flags |= IORESOURCE_MEM;
+                break;
         }
         if (w & 0x40000000)
                 flags |= IORESOURCE_PREFETCH;
@@ -478,10 +484,10 @@ static void __init build_device_resources(struct of_device *op,
                 int pna, pns;
 
                 size = of_read_addr(reg + na, ns);
-                flags = bus->get_flags(reg);
-
                 memcpy(addr, reg, na * 4);
 
+                flags = bus->get_flags(addr, 0);
+
                 if (use_1to1_mapping(pp)) {
                         result = of_read_addr(addr, na);
                         goto build_res;
@@ -506,6 +512,8 @@ static void __init build_device_resources(struct of_device *op,
                                                dna, dns, pna))
                                 break;
 
+                        flags = pbus->get_flags(addr, flags);
+
                         dna = pna;
                         dns = pns;
                         dbus = pbus;
diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
index b4aeb0f696dc..a41df7bef035 100644
--- a/arch/sparc64/mm/init.c
+++ b/arch/sparc64/mm/init.c
@@ -1843,7 +1843,7 @@ static int pavail_rescan_ents __initdata;
  * memory list again, and make sure it provides at least as much
  * memory as 'pavail' does.
  */
-static void setup_valid_addr_bitmap_from_pavail(void)
+static void __init setup_valid_addr_bitmap_from_pavail(void)
 {
         int i;
 
diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
index 5807d1bc73f7..8791fc55e715 100644
--- a/arch/x86/pci/i386.c
+++ b/arch/x86/pci/i386.c
@@ -128,8 +128,7 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                 pr = pci_find_parent_resource(dev, r);
                                 if (!r->start || !pr ||
                                     request_resource(pr, r) < 0) {
-                                        dev_err(&dev->dev, "BAR %d: can't "
-                                                "allocate resource\n", idx);
+                                        dev_err(&dev->dev, "BAR %d: can't allocate resource\n", idx);
                                         /*
                                          * Something is wrong with the region.
                                          * Invalidate the resource to prevent
@@ -164,15 +163,13 @@ static void __init pcibios_allocate_resources(int pass)
                         else
                                 disabled = !(command & PCI_COMMAND_MEMORY);
                         if (pass == disabled) {
-                                dev_dbg(&dev->dev, "resource %#08llx-%#08llx "
-                                        "(f=%lx, d=%d, p=%d)\n",
+                                dev_dbg(&dev->dev, "resource %#08llx-%#08llx (f=%lx, d=%d, p=%d)\n",
                                         (unsigned long long) r->start,
                                         (unsigned long long) r->end,
                                         r->flags, disabled, pass);
                                 pr = pci_find_parent_resource(dev, r);
                                 if (!pr || request_resource(pr, r) < 0) {
-                                        dev_err(&dev->dev, "BAR %d: can't "
-                                                "allocate resource\n", idx);
+                                        dev_err(&dev->dev, "BAR %d: can't allocate resource\n", idx);
                                         /* We'll assign a new address later */
                                         r->end -= r->start;
                                         r->start = 0;
diff --git a/block/cmd-filter.c b/block/cmd-filter.c
index 1d4026206ac2..228b6447e89f 100644
--- a/block/cmd-filter.c
+++ b/block/cmd-filter.c
@@ -223,6 +223,7 @@ int blk_register_filter(struct gendisk *disk)
 
         return 0;
 }
+EXPORT_SYMBOL(blk_register_filter);
 
 void blk_unregister_filter(struct gendisk *disk)
 {
@@ -231,4 +232,4 @@ void blk_unregister_filter(struct gendisk *disk)
         kobject_put(&filter->kobj);
         kobject_put(disk->holder_dir->parent);
 }
-
+EXPORT_SYMBOL(blk_unregister_filter);
diff --git a/block/genhd.c b/block/genhd.c
index 656c2c7abf99..e0ce23ac2ece 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -190,7 +190,6 @@ void add_disk(struct gendisk *disk)
                             disk->minors, NULL, exact_match, exact_lock, disk);
         register_disk(disk);
         blk_register_queue(disk);
-        blk_register_filter(disk);
 
         bdi = &disk->queue->backing_dev_info;
         bdi_register_dev(bdi, MKDEV(disk->major, disk->first_minor));
@@ -203,7 +202,6 @@ EXPORT_SYMBOL(del_gendisk);	/* in partitions/check.c */
 
 void unlink_gendisk(struct gendisk *disk)
 {
-        blk_unregister_filter(disk);
         sysfs_remove_link(&disk->dev.kobj, "bdi");
         bdi_unregister(&disk->queue->backing_dev_info);
         blk_unregister_queue(disk);
@@ -309,7 +307,7 @@ static void *part_start(struct seq_file *part, loff_t *pos)
         loff_t k = *pos;
 
         if (!k)
-                seq_puts(part, "major minor  #blocks  name\n\n");
+                part->private = (void *)1LU;    /* tell show to print header */
 
         mutex_lock(&block_class_lock);
         dev = class_find_device(&block_class, NULL, &k, find_start);
@@ -351,6 +349,17 @@ static int show_partition(struct seq_file *part, void *v)
         int n;
         char buf[BDEVNAME_SIZE];
 
+        /*
+         * Print header if start told us to do.  This is to preserve
+         * the original behavior of not printing header if no
+         * partition exists.  This hackery will be removed later with
+         * class iteration clean up.
+         */
+        if (part->private) {
+                seq_puts(part, "major minor  #blocks  name\n\n");
+                part->private = NULL;
+        }
+
         /* Don't show non-partitionable removeable devices or empty devices */
         if (!get_capacity(sgp) ||
                         (sgp->minors == 1 && (sgp->flags & GENHD_FL_REMOVABLE)))
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index d3f0a62efcc1..ee68ac54c0d4 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -138,7 +138,7 @@ static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
         {
         set_no_mwait, "Extensa 5220", {
         DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
-        DMI_MATCH(DMI_SYS_VENDOR, "ACER"),
+        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
         DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
         DMI_MATCH(DMI_BOARD_NAME, "Columbia") }, NULL},
         {},
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 3331f88dcfb6..248ab4a7d39f 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -223,7 +223,7 @@ static int radeon_do_wait_for_fifo(drm_radeon_private_t * dev_priv, int entries)
                         return 0;
                 DRM_UDELAY(1);
         }
-        DRM_INFO("wait for fifo failed status : 0x%08X 0x%08X\n",
+        DRM_DEBUG("wait for fifo failed status : 0x%08X 0x%08X\n",
                  RADEON_READ(RADEON_RBBM_STATUS),
                  RADEON_READ(R300_VAP_CNTL_STATUS));
 
@@ -252,7 +252,7 @@ static int radeon_do_wait_for_idle(drm_radeon_private_t * dev_priv)
                 }
                 DRM_UDELAY(1);
         }
-        DRM_INFO("wait idle failed status : 0x%08X 0x%08X\n",
+        DRM_DEBUG("wait idle failed status : 0x%08X 0x%08X\n",
                  RADEON_READ(RADEON_RBBM_STATUS),
                  RADEON_READ(R300_VAP_CNTL_STATUS));
 
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 49a8c589e346..f1489999cf91 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1933,6 +1933,7 @@ static void ide_cd_remove(ide_drive_t *drive)
 
         ide_proc_unregister_driver(drive, info->driver);
 
+        blk_unregister_filter(info->disk);
         del_gendisk(info->disk);
 
         ide_cd_put(info);
@@ -2158,6 +2159,7 @@ static int ide_cd_probe(ide_drive_t *drive)
         g->fops = &idecd_ops;
         g->flags |= GENHD_FL_REMOVABLE;
         add_disk(g);
+        blk_register_filter(g);
         return 0;
 
 out_free_cd:
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 7e65bad522cb..ac89a5deaca2 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -238,15 +238,47 @@ static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long inde
 
 }
 
+static mdk_rdev_t *next_active_rdev(mdk_rdev_t *rdev, mddev_t *mddev)
+{
+        /* Iterate the disks of an mddev, using rcu to protect access to the
+         * linked list, and raising the refcount of devices we return to ensure
+         * they don't disappear while in use.
+         * As devices are only added or removed when raid_disk is < 0 and
+         * nr_pending is 0 and In_sync is clear, the entries we return will
+         * still be in the same position on the list when we re-enter
+         * list_for_each_continue_rcu.
+         */
+        struct list_head *pos;
+        rcu_read_lock();
+        if (rdev == NULL)
+                /* start at the beginning */
+                pos = &mddev->disks;
+        else {
+                /* release the previous rdev and start from there. */
+                rdev_dec_pending(rdev, mddev);
+                pos = &rdev->same_set;
+        }
+        list_for_each_continue_rcu(pos, &mddev->disks) {
+                rdev = list_entry(pos, mdk_rdev_t, same_set);
+                if (rdev->raid_disk >= 0 &&
+                    test_bit(In_sync, &rdev->flags) &&
+                    !test_bit(Faulty, &rdev->flags)) {
+                        /* this is a usable devices */
+                        atomic_inc(&rdev->nr_pending);
+                        rcu_read_unlock();
+                        return rdev;
+                }
+        }
+        rcu_read_unlock();
+        return NULL;
+}
+
 static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 {
-        mdk_rdev_t *rdev;
+        mdk_rdev_t *rdev = NULL;
         mddev_t *mddev = bitmap->mddev;
 
-        rcu_read_lock();
-        rdev_for_each_rcu(rdev, mddev)
-                if (test_bit(In_sync, &rdev->flags)
-                    && !test_bit(Faulty, &rdev->flags)) {
+        while ((rdev = next_active_rdev(rdev, mddev)) != NULL) {
                         int size = PAGE_SIZE;
                         if (page->index == bitmap->file_pages-1)
                                 size = roundup(bitmap->last_page_size,
@@ -281,8 +313,7 @@ static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
                                        + page->index * (PAGE_SIZE/512),
                                        size,
                                        page);
-                }
-        rcu_read_unlock();
+        }
 
         if (wait)
                 md_super_wait(mddev);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8cfadc5bd2ba..4790c83d78d0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3841,8 +3841,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
 
                 del_timer_sync(&mddev->safemode_timer);
 
-                invalidate_partition(disk, 0);
-
                 switch(mode) {
                 case 1: /* readonly */
                         err  = -ENXIO;
diff --git a/drivers/media/video/dabusb.c b/drivers/media/video/dabusb.c
index 48f4b92a8f8b..79faedf58521 100644
--- a/drivers/media/video/dabusb.c
+++ b/drivers/media/video/dabusb.c
@@ -403,6 +403,7 @@ static int dabusb_fpga_download (pdabusb_t s, const char *fname)
         ret = request_firmware(&fw, "dabusb/bitstream.bin", &s->usbdev->dev);
         if (ret) {
                 err("Failed to load \"dabusb/bitstream.bin\": %d\n", ret);
+                kfree(b);
                 return ret;
         }
 
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index d2f331876e4c..e00d424e6575 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -410,16 +410,20 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
 
         case MEMGETREGIONINFO:
         {
-                struct region_info_user ur;
+                uint32_t ur_idx;
+                struct mtd_erase_region_info *kr;
+                struct region_info_user *ur = (struct region_info_user *) argp;
 
-                if (copy_from_user(&ur, argp, sizeof(struct region_info_user)))
+                if (get_user(ur_idx, &(ur->regionindex)))
                         return -EFAULT;
 
-                if (ur.regionindex >= mtd->numeraseregions)
-                        return -EINVAL;
-                if (copy_to_user(argp, &(mtd->eraseregions[ur.regionindex]),
-                                sizeof(struct mtd_erase_region_info)))
+                kr = &(mtd->eraseregions[ur_idx]);
+
+                if (put_user(kr->offset, &(ur->offset))
+                    || put_user(kr->erasesize, &(ur->erasesize))
+                    || put_user(kr->numblocks, &(ur->numblocks)))
                         return -EFAULT;
+
                 break;
         }
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e5e7d7856454..2a2bc89aba83 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1875,6 +1875,7 @@ static int sd_probe(struct device *dev)
 
         dev_set_drvdata(dev, sdkp);
         add_disk(gd);
+        blk_register_filter(gd);
         sd_dif_config_host(sdkp);
 
         sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
@@ -1908,6 +1909,7 @@ static int sd_remove(struct device *dev)
         struct scsi_disk *sdkp = dev_get_drvdata(dev);
 
         device_del(&sdkp->dev);
+        blk_unregister_filter(sdkp->disk);
         del_gendisk(sdkp->disk);
         sd_shutdown(dev);
 
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 27f5bfd1def3..3292965bfd84 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -656,6 +656,7 @@ static int sr_probe(struct device *dev)
         dev_set_drvdata(dev, cd);
         disk->flags |= GENHD_FL_REMOVABLE;
         add_disk(disk);
+        blk_register_filter(disk);
 
         sdev_printk(KERN_DEBUG, sdev,
                     "Attached scsi CD-ROM %s\n", cd->cdi.name);
@@ -894,6 +895,7 @@ static int sr_remove(struct device *dev)
 {
         struct scsi_cd *cd = dev_get_drvdata(dev);
 
+        blk_unregister_filter(cd->disk);
         del_gendisk(cd->disk);
 
         mutex_lock(&sr_ref_mutex);
diff --git a/firmware/Makefile b/firmware/Makefile
index 9fe86041f86e..da75a6fbc6ba 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -146,15 +146,27 @@ $(patsubst %,$(obj)/%.gen.o, $(fw-external-y)): $(obj)/%.gen.o: $(fwdir)/%
 $(obj)/%: $(obj)/%.ihex | $(objtree)/$(obj)/$$(dir %)
         $(call cmd,ihex)
 
+# Don't depend on ihex2fw if we're installing and it already exists.
+# Putting it after | in the dependencies doesn't seem sufficient when
+# we're installing after a cross-compile, because ihex2fw has dependencies
+# on stuff like /usr/lib/gcc/ppc64-redhat-linux/4.3.0/include/stddef.h and 
+# thus wants to be rebuilt. Which it can't be, if the prebuilt kernel tree
+# is exported read-only for someone to run 'make install'.
+ifeq ($(INSTALL):$(wildcard $(obj)/ihex2fw),install:$(obj)/ihex2fw)
+ihex2fw_dep :=
+else
+ihex2fw_dep := $(obj)/ihex2fw
+endif
+
 # .HEX is also Intel HEX, but where the offset and length in each record
 # is actually meaningful, because the firmware has to be loaded in a certain
 # order rather than as a single binary blob. Thus, we convert them into our
 # more compact binary representation of ihex records (<linux/ihex.h>)
-$(obj)/%.fw: $(obj)/%.HEX $(obj)/ihex2fw | $(objtree)/$(obj)/$$(dir %)
+$(obj)/%.fw: $(obj)/%.HEX $(ihex2fw_dep) | $(objtree)/$(obj)/$$(dir %)
         $(call cmd,ihex2fw)
 
 # .H16 is our own modified form of Intel HEX, with 16-bit length for records.
-$(obj)/%.fw: $(obj)/%.H16 $(obj)/ihex2fw | $(objtree)/$(obj)/$$(dir %)
+$(obj)/%.fw: $(obj)/%.H16 $(ihex2fw_dep) | $(objtree)/$(obj)/$$(dir %)
         $(call cmd,h16tofw)
 
 $(firmware-dirs):
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index f9e4ad97a79e..06e521a945c3 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -9,7 +9,10 @@ files (e.g. "cp -a") to Windows servers.  For mkdir and create honor setgid bit
 on parent directory when server supports Unix Extensions but not POSIX
 create. Update cifs.upcall version to handle new Kerberos sec flags
 (this requires update of cifs.upcall program from Samba).  Fix memory leak
-on dns_upcall (resolving DFS referralls).
+on dns_upcall (resolving DFS referralls).  Fix plain text password
+authentication (requires setting SecurityFlags to 0x30030 to enable
+lanman and plain text though).  Fix writes to be at correct offset when
+file is open with O_APPEND and file is on a directio (forcediretio) mount.
 
 Version 1.53
 ------------
diff --git a/fs/cifs/README b/fs/cifs/README
index 68b5c1169d9d..bd2343d4c6a6 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -542,10 +542,20 @@ SecurityFlags		Flags which control security negotiation and
                         hashing mechanisms (as "must use") on the other hand 
                         does not make much sense. Default flags are 
                                 0x07007 
-                        (NTLM, NTLMv2 and packet signing allowed).  Maximum 
+                        (NTLM, NTLMv2 and packet signing allowed).  The maximum 
                         allowable flags if you want to allow mounts to servers
                         using weaker password hashes is 0x37037 (lanman,
-                        plaintext, ntlm, ntlmv2, signing allowed):
+                        plaintext, ntlm, ntlmv2, signing allowed).  Some
+                        SecurityFlags require the corresponding menuconfig
+                        options to be enabled (lanman and plaintext require
+                        CONFIG_CIFS_WEAK_PW_HASH for example).  Enabling
+                        plaintext authentication currently requires also
+                        enabling lanman authentication in the security flags
+                        because the cifs module only supports sending
+                        laintext passwords using the older lanman dialect
+                        form of the session setup SMB.  (e.g. for authentication
+                        using plain text passwords, set the SecurityFlags
+                        to 0x30030):
  
                         may use packet signing                          0x00001
                         must use packet signing                         0x01001
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 83fd40dc1ef0..bd5f13d38450 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -294,6 +294,7 @@ void calc_lanman_hash(struct cifsSesInfo *ses, char *lnm_session_key)
 
         if ((ses->server->secMode & SECMODE_PW_ENCRYPT) == 0)
                 if (extended_security & CIFSSEC_MAY_PLNTXT) {
+                        memset(lnm_session_key, 0, CIFS_SESS_KEY_SIZE);
                         memcpy(lnm_session_key, password_with_pad,
                                 CIFS_ENCPWD_SIZE);
                         return;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index ff14d14903a0..cbefe1f1f9fe 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -833,6 +833,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
                 return -EBADF;
         open_file = (struct cifsFileInfo *) file->private_data;
 
+        rc = generic_write_checks(file, poffset, &write_size, 0);
+        if (rc)
+                return rc;
+
         xid = GetXid();
 
         if (*poffset > file->f_path.dentry->d_inode->i_size)
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index b537fad3bf50..252fdc0567f1 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -409,6 +409,8 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
                 char lnm_session_key[CIFS_SESS_KEY_SIZE];
 
+                pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
+
                 /* no capabilities flags in old lanman negotiation */
 
                 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index b6ed38380ab8..54b8b4140c8f 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state, int cnt)
          * enough space for either:
          */
         alloc = sizeof(struct posix_ace_state_array)
-                + cnt*sizeof(struct posix_ace_state);
+                + cnt*sizeof(struct posix_user_ace_state);
         state->users = kzalloc(alloc, GFP_KERNEL);
         if (!state->users)
                 return -ENOMEM;
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 2e51adac65de..e5b51ffafc6c 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -867,11 +867,6 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
         int             slack_bytes;
         __be32          status;
 
-        status = nfserr_resource;
-        cstate = cstate_alloc();
-        if (cstate == NULL)
-                goto out;
-
         resp->xbuf = &rqstp->rq_res;
         resp->p = rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len;
         resp->tagp = resp->p;
@@ -890,6 +885,11 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
         if (args->minorversion > NFSD_SUPPORTED_MINOR_VERSION)
                 goto out;
 
+        status = nfserr_resource;
+        cstate = cstate_alloc();
+        if (cstate == NULL)
+                goto out;
+
         status = nfs_ok;
         while (!status && resp->opcnt < args->opcnt) {
                 op = &args->ops[resp->opcnt++];
@@ -957,9 +957,9 @@ encode_op:
                 nfsd4_increment_op_stats(op->opnum);
         }
 
+        cstate_free(cstate);
 out:
         nfsd4_release_compoundargs(args);
-        cstate_free(cstate);
         dprintk("nfsv4 compound returned %d\n", ntohl(status));
         return status;
 }
diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
index ef2e3a20bf3b..dc05b54bd3a3 100644
--- a/include/linux/sunrpc/svc_rdma.h
+++ b/include/linux/sunrpc/svc_rdma.h
@@ -143,7 +143,6 @@ struct svcxprt_rdma {
         unsigned long        sc_flags;
         struct list_head     sc_dto_q;          /* DTO tasklet I/O pending Q */
         struct list_head     sc_read_complete_q;
-        spinlock_t           sc_read_complete_lock;
         struct work_struct   sc_work;
 };
 /* sc_flags */
diff --git a/kernel/resource.c b/kernel/resource.c
index cf0a178c7513..03d796c1b2e9 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -438,7 +438,7 @@ int insert_resource(struct resource *parent, struct resource *new)
 
 /**
  * insert_resource_expand_to_fit - Insert a resource into the resource tree
- * @parent: parent of the new resource
+ * @root: root resource descriptor
  * @new: new resource to insert
  *
  * Insert a resource into the resource tree, possibly expanding it in order
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index 1a07f8ca4b92..cb838ee93a82 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -180,10 +180,6 @@ static void check_hung_task(struct task_struct *t, unsigned long now)
         if (t->flags & PF_FROZEN)
                 return;
 
-        /* Don't check for tasks waiting on network file systems like NFS */
-        if (t->state & TASK_KILLABLE)
-                return;
-
         if (switch_count != t->last_switch_count || !t->last_switch_timestamp) {
                 t->last_switch_count = switch_count;
                 t->last_switch_timestamp = now;
@@ -237,7 +233,8 @@ static void check_hung_uninterruptible_tasks(int this_cpu)
         do_each_thread(g, t) {
                 if (!--max_count)
                         goto unlock;
-                if (t->state & TASK_UNINTERRUPTIBLE)
+                /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
+                if (t->state == TASK_UNINTERRUPTIBLE)
                         check_hung_task(t, now);
         } while_each_thread(g, t);
  unlock:
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index 3444b58033c8..c69f84fe038d 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -2,7 +2,6 @@
  * linux/mm/page_isolation.c
  */
 
-#include <stddef.h>
 #include <linux/mm.h>
 #include <linux/page-isolation.h>
 #include <linux/pageblock-flags.h>
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index 0f8c439b848a..5231f7aaac0e 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file,
                         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char tmpbuf[256];
-        int len;
+        size_t len;
+
         if ((*ppos && !write) || !*lenp) {
                 *lenp = 0;
                 return 0;
         }
-        if (write)
-                return -EINVAL;
-        else {
-                len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
-                if (!access_ok(VERIFY_WRITE, buffer, len))
-                        return -EFAULT;
-
-                if (__copy_to_user(buffer, tmpbuf, len))
-                        return -EFAULT;
-        }
-        *lenp -= len;
-        *ppos += len;
-        return 0;
+        len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
+        return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
 }
 
 static int
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index b4b17f44cb29..74de31a06616 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -443,18 +443,18 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
 
         dprintk("svcrdma: rqstp=%p\n", rqstp);
 
-        spin_lock_bh(&rdma_xprt->sc_read_complete_lock);
+        spin_lock_bh(&rdma_xprt->sc_rq_dto_lock);
         if (!list_empty(&rdma_xprt->sc_read_complete_q)) {
                 ctxt = list_entry(rdma_xprt->sc_read_complete_q.next,
                                   struct svc_rdma_op_ctxt,
                                   dto_q);
                 list_del_init(&ctxt->dto_q);
         }
-        spin_unlock_bh(&rdma_xprt->sc_read_complete_lock);
-        if (ctxt)
+        if (ctxt) {
+                spin_unlock_bh(&rdma_xprt->sc_rq_dto_lock);
                 return rdma_read_complete(rqstp, ctxt);
+        }
 
-        spin_lock_bh(&rdma_xprt->sc_rq_dto_lock);
         if (!list_empty(&rdma_xprt->sc_rq_dto_q)) {
                 ctxt = list_entry(rdma_xprt->sc_rq_dto_q.next,
                                   struct svc_rdma_op_ctxt,
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 19ddc382b777..900cb69728c6 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -359,11 +359,11 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
                         if (test_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags)) {
                                 struct svc_rdma_op_ctxt *read_hdr = ctxt->read_hdr;
                                 BUG_ON(!read_hdr);
+                                spin_lock_bh(&xprt->sc_rq_dto_lock);
                                 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-                                spin_lock_bh(&xprt->sc_read_complete_lock);
                                 list_add_tail(&read_hdr->dto_q,
                                               &xprt->sc_read_complete_q);
-                                spin_unlock_bh(&xprt->sc_read_complete_lock);
+                                spin_unlock_bh(&xprt->sc_rq_dto_lock);
                                 svc_xprt_enqueue(&xprt->sc_xprt);
                         }
                         svc_rdma_put_context(ctxt, 0);
@@ -428,7 +428,6 @@ static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
         init_waitqueue_head(&cma_xprt->sc_send_wait);
 
         spin_lock_init(&cma_xprt->sc_lock);
-        spin_lock_init(&cma_xprt->sc_read_complete_lock);
         spin_lock_init(&cma_xprt->sc_rq_dto_lock);
 
         cma_xprt->sc_ord = svcrdma_ord;