43 files changed, 299 insertions, 586 deletions

diff --git a/Documentation/SubmitChecklist b/Documentation/SubmitChecklist
index 2270efa10153..bfbb2718a279 100644
--- a/Documentation/SubmitChecklist
+++ b/Documentation/SubmitChecklist
@@ -72,3 +72,7 @@ kernel patches.
 
     If the new code is substantial, addition of subsystem-specific fault
     injection might be appropriate.
+
+22: Newly-added code has been compiled with `gcc -W'.  This will generate
+    lots of noise, but is good for finding bugs like "warning: comparison
+    between signed and unsigned".
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index fc532395d116..0ba6af02cdaf 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -318,3 +318,10 @@ Why:	/proc/acpi/button has been replaced by events to the input layer
 Who:    Len Brown <len.brown@intel.com>
 
 ---------------------------
+
+What:   JFFS (version 1)
+When:   2.6.21
+Why:    Unmaintained for years, superceded by JFFS2 for years.
+Who:    Jeff Garzik <jeff@garzik.org>
+
+---------------------------
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 5af6676a88f0..073306818347 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -17,7 +17,7 @@ You can use common Linux commands, such as cp and scp, to copy the
 memory image to a dump file on the local disk, or across the network to
 a remote system.
 
-Kdump and kexec are currently supported on the x86, x86_64, ppc64 and IA64
+Kdump and kexec are currently supported on the x86, x86_64, ppc64 and ia64
 architectures.
 
 When the system kernel boots, it reserves a small section of memory for
@@ -61,7 +61,12 @@ Install kexec-tools
 
 2) Download the kexec-tools user-space package from the following URL:
 
-http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing-20061214.tar.gz
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing.tar.gz
+
+This is a symlink to the latest version, which at the time of writing is
+20061214, the only release of kexec-tools-testing so far. As other versions
+are made released, the older onese will remain available at
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/
 
 Note: Latest kexec-tools-testing git tree is available at
 
@@ -71,11 +76,11 @@ http://www.kernel.org/git/?p=linux/kernel/git/horms/kexec-tools-testing.git;a=su
 
 3) Unpack the tarball with the tar command, as follows:
 
-   tar xvpzf kexec-tools-testing-20061214.tar.gz
+   tar xvpzf kexec-tools-testing.tar.gz
 
-4) Change to the kexec-tools-1.101 directory, as follows:
+4) Change to the kexec-tools directory, as follows:
 
-   cd kexec-tools-testing-20061214
+   cd kexec-tools-testing-VERSION
 
 5) Configure the package, as follows:
 
@@ -224,7 +229,23 @@ Dump-capture kernel config options (Arch Dependent, ppc64)
 
 Dump-capture kernel config options (Arch Dependent, ia64)
 ----------------------------------------------------------
-(To be filled)
+
+- No specific options are required to create a dump-capture kernel
+  for ia64, other than those specified in the arch idependent section
+  above. This means that it is possible to use the system kernel
+  as a dump-capture kernel if desired.
+
+  The crashkernel region can be automatically placed by the system
+  kernel at run time. This is done by specifying the base address as 0,
+  or omitting it all together.
+
+  crashkernel=256M@0
+  or
+  crashkernel=256M
+
+  If the start address is specified, note that the start address of the
+  kernel will be aligned to 64Mb, so if the start address is not then
+  any space below the alignment point will be wasted.
 
 
 Boot into System Kernel
@@ -243,6 +264,10 @@ Boot into System Kernel
 
    On ppc64, use "crashkernel=128M@32M".
 
+   On ia64, 256M@256M is a generous value that typically works.
+   The region may be automatically placed on ia64, see the
+   dump-capture kernel config option notes above.
+
 Load the Dump-capture Kernel
 ============================
 
@@ -261,7 +286,8 @@ For x86_64:
 For ppc64:
         - Use vmlinux
 For ia64:
-        (To be filled)
+        - Use vmlinux or vmlinuz.gz
+
 
 If you are using a uncompressed vmlinux image then use following command
 to load dump-capture kernel.
@@ -277,18 +303,19 @@ to load dump-capture kernel.
    --initrd=<initrd-for-dump-capture-kernel> \
    --append="root=<root-dev> <arch-specific-options>"
 
+Please note, that --args-linux does not need to be specified for ia64.
+It is planned to make this a no-op on that architecture, but for now
+it should be omitted
+
 Following are the arch specific command line options to be used while
 loading dump-capture kernel.
 
-For i386 and x86_64:
+For i386, x86_64 and ia64:
         "init 1 irqpoll maxcpus=1"
 
 For ppc64:
         "init 1 maxcpus=1 noirqdistrib"
 
-For IA64
-        (To be filled)
-
 
 Notes on loading the dump-capture kernel:
 
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index a5e34d655965..1a6f8bb8881c 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -310,13 +310,7 @@ static int __init setup_nmi_watchdog(char *str)
 
         if ((nmi >= NMI_INVALID) || (nmi < NMI_NONE))
                 return 0;
-        /*
-         * If any other x86 CPU has a local APIC, then
-         * please test the NMI stuff there and send me the
-         * missing bits. Right now Intel P6/P4 and AMD K7 only.
-         */
-        if ((nmi == NMI_LOCAL_APIC) && (nmi_known_cpu() == 0))
-                return 0;  /* no lapic support */
+
         nmi_watchdog = nmi;
         return 1;
 }
diff --git a/arch/i386/kernel/paravirt.c b/arch/i386/kernel/paravirt.c
index 3dceab5828f1..e55fd05da0f5 100644
--- a/arch/i386/kernel/paravirt.c
+++ b/arch/i386/kernel/paravirt.c
@@ -566,4 +566,11 @@ struct paravirt_ops paravirt_ops = {
         .irq_enable_sysexit = native_irq_enable_sysexit,
         .iret = native_iret,
 };
-EXPORT_SYMBOL(paravirt_ops);
+
+/*
+ * NOTE: CONFIG_PARAVIRT is experimental and the paravirt_ops
+ * semantics are subject to change. Hence we only do this
+ * internal-only export of this, until it gets sorted out and
+ * all lowlevel CPU ops used by modules are separately exported.
+ */
+EXPORT_SYMBOL_GPL(paravirt_ops);
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 186aebbae32d..9cb42ecb7f89 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -302,8 +302,6 @@ int __init setup_nmi_watchdog(char *str)
         if ((nmi >= NMI_INVALID) || (nmi < NMI_NONE))
                 return 0;
 
-        if ((nmi == NMI_LOCAL_APIC) && (nmi_known_cpu() == 0))
-                return 0;  /* no lapic support */
         nmi_watchdog = nmi;
         return 1;
 }
diff --git a/block/elevator.c b/block/elevator.c
index 536be740ba4e..f6dafa8c7c4d 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -590,6 +590,12 @@ void elv_insert(request_queue_t *q, struct request *rq, int where)
                  */
                 rq->cmd_flags |= REQ_SOFTBARRIER;
 
+                /*
+                 * Most requeues happen because of a busy condition,
+                 * don't force unplug of the queue for that case.
+                 */
+                unplug_it = 0;
+
                 if (q->ordseq == 0) {
                         list_add(&rq->queuelist, &q->queue_head);
                         break;
@@ -604,11 +610,6 @@ void elv_insert(request_queue_t *q, struct request *rq, int where)
                 }
 
                 list_add_tail(&rq->queuelist, pos);
-                /*
-                 * most requeues happen because of a busy condition, don't
-                 * force unplug of the queue for that case.
-                 */
-                unplug_it = 0;
                 break;
 
         default:
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 36b37d755dbc..3d54680d0333 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1677,8 +1677,6 @@ static void acpi_video_device_notify(acpi_handle handle, u32 event, void *data)
         struct acpi_video_device *video_device = data;
         struct acpi_device *device = NULL;
 
-
-        printk("video device notify\n");
         if (!video_device)
                 return;
 
diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 4dc10105d610..f96446c358ba 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -1845,7 +1845,7 @@ static u16 __devinit read_bia (const hrz_dev * dev, u16 addr)
 
 /********** initialise a card **********/
 
-static int __init hrz_init (hrz_dev * dev) {
+static int __devinit hrz_init (hrz_dev * dev) {
   int onefivefive;
   
   u16 chan;
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 448d5083c381..4fac2bdf6215 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -186,6 +186,7 @@ static int got_event;		/* if events processing have been done */
 static void switchover_timeout(unsigned long data);
 static struct timer_list switchover_timer =
         TIMER_INITIALIZER(switchover_timeout , 0, 0);
+static unsigned long tlclk_timer_data;
 
 static struct tlclk_alarms *alarm_events;
 
@@ -197,10 +198,19 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id);
 
 static DECLARE_WAIT_QUEUE_HEAD(wq);
 
+static unsigned long useflags;
+static DEFINE_MUTEX(tlclk_mutex);
+
 static int tlclk_open(struct inode *inode, struct file *filp)
 {
         int result;
 
+        if (test_and_set_bit(0, &useflags))
+                return -EBUSY;
+                /* this legacy device is always one per system and it doesn't
+                 * know how to handle multiple concurrent clients.
+                 */
+
         /* Make sure there is no interrupt pending while
          * initialising interrupt handler */
         inb(TLCLK_REG6);
@@ -221,6 +231,7 @@ static int tlclk_open(struct inode *inode, struct file *filp)
 static int tlclk_release(struct inode *inode, struct file *filp)
 {
         free_irq(telclk_interrupt, tlclk_interrupt);
+        clear_bit(0, &useflags);
 
         return 0;
 }
@@ -230,26 +241,25 @@ static ssize_t tlclk_read(struct file *filp, char __user *buf, size_t count,
 {
         if (count < sizeof(struct tlclk_alarms))
                 return -EIO;
+        if (mutex_lock_interruptible(&tlclk_mutex))
+                return -EINTR;
+
 
         wait_event_interruptible(wq, got_event);
-        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms)))
+        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms))) {
+                mutex_unlock(&tlclk_mutex);
                 return -EFAULT;
+        }
 
         memset(alarm_events, 0, sizeof(struct tlclk_alarms));
         got_event = 0;
 
+        mutex_unlock(&tlclk_mutex);
         return  sizeof(struct tlclk_alarms);
 }
 
-static ssize_t tlclk_write(struct file *filp, const char __user *buf, size_t count,
-            loff_t *f_pos)
-{
-        return 0;
-}
-
 static const struct file_operations tlclk_fops = {
         .read = tlclk_read,
-        .write = tlclk_write,
         .open = tlclk_open,
         .release = tlclk_release,
 
@@ -540,7 +550,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                         SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
                         switch (val) {
                         case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
                                 break;
                         case CLK_11_184MHz:
                                 SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
@@ -549,7 +559,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                                 SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
                                 break;
                         case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
                                 break;
                         }
                 } else
@@ -839,11 +849,13 @@ static void __exit tlclk_cleanup(void)
 
 static void switchover_timeout(unsigned long data)
 {
-        if ((data & 1)) {
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+        unsigned long flags = *(unsigned long *) data;
+
+        if ((flags & 1)) {
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                         alarm_events->switchover_primary++;
         } else {
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                         alarm_events->switchover_secondary++;
         }
 
@@ -901,8 +913,9 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id)
 
                 /* TIMEOUT in ~10ms */
                 switchover_timer.expires = jiffies + msecs_to_jiffies(10);
-                switchover_timer.data = inb(TLCLK_REG1);
-                add_timer(&switchover_timer);
+                tlclk_timer_data = inb(TLCLK_REG1);
+                switchover_timer.data = (unsigned long) &tlclk_timer_data;
+                mod_timer(&switchover_timer, switchover_timer.expires);
         } else {
                 got_event = 1;
                 wake_up(&wq);
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 93995b658d94..6074c897f51c 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -344,8 +344,11 @@ int ehca_destroy_cq(struct ib_cq *cq)
         unsigned long flags;
 
         spin_lock_irqsave(&ehca_cq_idr_lock, flags);
-        while (my_cq->nr_callbacks)
+        while (my_cq->nr_callbacks) {
+                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
                 yield();
+                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+        }
 
         idr_remove(&ehca_cq_idr, my_cq->token);
         spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index e7209afb4250..c069be8cbcb2 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -440,7 +440,8 @@ void ehca_tasklet_eq(unsigned long data)
                                         cq = idr_find(&ehca_cq_idr, token);
 
                                         if (cq == NULL) {
-                                                spin_unlock(&ehca_cq_idr_lock);
+                                                spin_unlock_irqrestore(&ehca_cq_idr_lock,
+                                                                       flags);
                                                 break;
                                         }
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index cdecbf5911c8..72611fd15103 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1621,18 +1621,30 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
                 switch (token) {
                 case SRP_OPT_ID_EXT:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->id_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
 
                 case SRP_OPT_IOC_GUID:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->ioc_guid = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
 
                 case SRP_OPT_DGID:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         if (strlen(p) != 32) {
                                 printk(KERN_WARNING PFX "bad dest GID parameter '%s'\n", p);
                                 kfree(p);
@@ -1656,6 +1668,10 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
 
                 case SRP_OPT_SERVICE_ID:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->service_id = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
@@ -1693,6 +1709,10 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
 
                 case SRP_OPT_INITIATOR_EXT:
                         p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                         target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
                         kfree(p);
                         break;
diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index 67c1154960f0..be4651abe72c 100644
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -272,7 +272,9 @@ static void kvm_free_physmem(struct kvm *kvm)
 
 static void kvm_free_vcpu(struct kvm_vcpu *vcpu)
 {
+        vcpu_load(vcpu->kvm, vcpu_slot(vcpu));
         kvm_mmu_destroy(vcpu);
+        vcpu_put(vcpu);
         kvm_arch_ops->vcpu_free(vcpu);
 }
 
diff --git a/drivers/kvm/paging_tmpl.h b/drivers/kvm/paging_tmpl.h
index 2dbf4307ed9e..6bc41950fbb3 100644
--- a/drivers/kvm/paging_tmpl.h
+++ b/drivers/kvm/paging_tmpl.h
@@ -274,7 +274,7 @@ static int FNAME(fix_write_pf)(struct kvm_vcpu *vcpu,
         struct kvm_mmu_page *page;
 
         if (is_writeble_pte(*shadow_ent))
-                return 0;
+                return !user || (*shadow_ent & PT_USER_MASK);
 
         writable_shadow = *shadow_ent & PT_SHADOW_WRITABLE_MASK;
         if (user) {
diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
index 714f6a7841cd..7397bfbbcb1c 100644
--- a/drivers/kvm/svm.c
+++ b/drivers/kvm/svm.c
@@ -1407,7 +1407,8 @@ static int svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         int r;
 
 again:
-        do_interrupt_requests(vcpu, kvm_run);
+        if (!vcpu->mmio_read_completed)
+                do_interrupt_requests(vcpu, kvm_run);
 
         clgi();
 
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index 0aa2659f6ae5..27f2751c3baa 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -1717,7 +1717,8 @@ again:
         vmcs_writel(HOST_GS_BASE, segment_base(gs_sel));
 #endif
 
-        do_interrupt_requests(vcpu, kvm_run);
+        if (!vcpu->mmio_read_completed)
+                do_interrupt_requests(vcpu, kvm_run);
 
         if (vcpu->guest_debug.enabled)
                 kvm_guest_debug_pre(vcpu);
diff --git a/drivers/kvm/x86_emulate.c b/drivers/kvm/x86_emulate.c
index be70795b4822..7513cddb929f 100644
--- a/drivers/kvm/x86_emulate.c
+++ b/drivers/kvm/x86_emulate.c
@@ -61,6 +61,7 @@
 #define ModRM       (1<<6)
 /* Destination is only written; never read. */
 #define Mov         (1<<7)
+#define BitOp       (1<<8)
 
 static u8 opcode_table[256] = {
         /* 0x00 - 0x07 */
@@ -148,7 +149,7 @@ static u8 opcode_table[256] = {
         0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
 };
 
-static u8 twobyte_table[256] = {
+static u16 twobyte_table[256] = {
         /* 0x00 - 0x0F */
         0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
         0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
@@ -180,16 +181,16 @@ static u8 twobyte_table[256] = {
         /* 0x90 - 0x9F */
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         /* 0xA0 - 0xA7 */
-        0, 0, 0, DstMem | SrcReg | ModRM, 0, 0, 0, 0,
+        0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
         /* 0xA8 - 0xAF */
-        0, 0, 0, DstMem | SrcReg | ModRM, 0, 0, 0, 0,
+        0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
         /* 0xB0 - 0xB7 */
         ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
-            DstMem | SrcReg | ModRM,
+            DstMem | SrcReg | ModRM | BitOp,
         0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
             DstReg | SrcMem16 | ModRM | Mov,
         /* 0xB8 - 0xBF */
-        0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM,
+        0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
         0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
             DstReg | SrcMem16 | ModRM | Mov,
         /* 0xC0 - 0xCF */
@@ -469,7 +470,8 @@ static int read_descriptor(struct x86_emulate_ctxt *ctxt,
 int
 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
 {
-        u8 b, d, sib, twobyte = 0, rex_prefix = 0;
+        unsigned d;
+        u8 b, sib, twobyte = 0, rex_prefix = 0;
         u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
         unsigned long *override_base = NULL;
         unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
@@ -726,46 +728,6 @@ done_prefixes:
                 ;
         }
 
-        /* Decode and fetch the destination operand: register or memory. */
-        switch (d & DstMask) {
-        case ImplicitOps:
-                /* Special instructions do their own operand decoding. */
-                goto special_insn;
-        case DstReg:
-                dst.type = OP_REG;
-                if ((d & ByteOp)
-                    && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
-                        dst.ptr = decode_register(modrm_reg, _regs,
-                                                  (rex_prefix == 0));
-                        dst.val = *(u8 *) dst.ptr;
-                        dst.bytes = 1;
-                } else {
-                        dst.ptr = decode_register(modrm_reg, _regs, 0);
-                        switch ((dst.bytes = op_bytes)) {
-                        case 2:
-                                dst.val = *(u16 *)dst.ptr;
-                                break;
-                        case 4:
-                                dst.val = *(u32 *)dst.ptr;
-                                break;
-                        case 8:
-                                dst.val = *(u64 *)dst.ptr;
-                                break;
-                        }
-                }
-                break;
-        case DstMem:
-                dst.type = OP_MEM;
-                dst.ptr = (unsigned long *)cr2;
-                dst.bytes = (d & ByteOp) ? 1 : op_bytes;
-                if (!(d & Mov) && /* optimisation - avoid slow emulated read */
-                    ((rc = ops->read_emulated((unsigned long)dst.ptr,
-                                              &dst.val, dst.bytes, ctxt)) != 0))
-                        goto done;
-                break;
-        }
-        dst.orig_val = dst.val;
-
         /*
          * Decode and fetch the source operand: register, memory
          * or immediate.
@@ -838,6 +800,50 @@ done_prefixes:
                 break;
         }
 
+        /* Decode and fetch the destination operand: register or memory. */
+        switch (d & DstMask) {
+        case ImplicitOps:
+                /* Special instructions do their own operand decoding. */
+                goto special_insn;
+        case DstReg:
+                dst.type = OP_REG;
+                if ((d & ByteOp)
+                    && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
+                        dst.ptr = decode_register(modrm_reg, _regs,
+                                                  (rex_prefix == 0));
+                        dst.val = *(u8 *) dst.ptr;
+                        dst.bytes = 1;
+                } else {
+                        dst.ptr = decode_register(modrm_reg, _regs, 0);
+                        switch ((dst.bytes = op_bytes)) {
+                        case 2:
+                                dst.val = *(u16 *)dst.ptr;
+                                break;
+                        case 4:
+                                dst.val = *(u32 *)dst.ptr;
+                                break;
+                        case 8:
+                                dst.val = *(u64 *)dst.ptr;
+                                break;
+                        }
+                }
+                break;
+        case DstMem:
+                dst.type = OP_MEM;
+                dst.ptr = (unsigned long *)cr2;
+                dst.bytes = (d & ByteOp) ? 1 : op_bytes;
+                if (d & BitOp) {
+                        dst.ptr += src.val / BITS_PER_LONG;
+                        dst.bytes = sizeof(long);
+                }
+                if (!(d & Mov) && /* optimisation - avoid slow emulated read */
+                    ((rc = ops->read_emulated((unsigned long)dst.ptr,
+                                              &dst.val, dst.bytes, ctxt)) != 0))
+                        goto done;
+                break;
+        }
+        dst.orig_val = dst.val;
+
         if (twobyte)
                 goto twobyte_insn;
 
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 39ad9f73d1ec..be10a3a26b5b 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -39,7 +39,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0043"
+#define DRV_VERSION     "EHEA_0044"
 
 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
         | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 83fa32f72398..1072e69ef85d 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -558,12 +558,12 @@ static irqreturn_t ehea_qp_aff_irq_handler(int irq, void *param)
         u32 qp_token;
 
         eqe = ehea_poll_eq(port->qp_eq);
-        ehea_debug("eqe=%p", eqe);
+
         while (eqe) {
-                ehea_debug("*eqe=%lx", *(u64*)eqe);
-                eqe = ehea_poll_eq(port->qp_eq);
                 qp_token = EHEA_BMASK_GET(EHEA_EQE_QP_TOKEN, eqe->entry);
-                ehea_debug("next eqe=%p", eqe);
+                ehea_error("QP aff_err: entry=0x%lx, token=0x%x",
+                           eqe->entry, qp_token);
+                eqe = ehea_poll_eq(port->qp_eq);
         }
 
         return IRQ_HANDLED;
@@ -575,8 +575,9 @@ static struct ehea_port *ehea_get_port(struct ehea_adapter *adapter,
         int i;
 
         for (i = 0; i < adapter->num_ports; i++)
-                if (adapter->port[i]->logical_port_id == logical_port)
-                        return adapter->port[i];
+                if (adapter->port[i])
+                        if (adapter->port[i]->logical_port_id == logical_port)
+                                return adapter->port[i];
         return NULL;
 }
 
@@ -642,6 +643,8 @@ int ehea_sense_port_attr(struct ehea_port *port)
                 break;
         }
 
+        port->autoneg = 1;
+
         /* Number of default QPs */
         port->num_def_qps = cb0->num_default_qps;
 
@@ -728,10 +731,7 @@ int ehea_set_portspeed(struct ehea_port *port, u32 port_speed)
                 }
         } else {
                 if (hret == H_AUTHORITY) {
-                        ehea_info("Hypervisor denied setting port speed. Either"
-                                  " this partition is not authorized to set "
-                                  "port speed or another partition has modified"
-                                  " port speed first.");
+                        ehea_info("Hypervisor denied setting port speed");
                         ret = -EPERM;
                 } else {
                         ret = -EIO;
@@ -998,7 +998,7 @@ static int ehea_configure_port(struct ehea_port *port)
                      | EHEA_BMASK_SET(PXLY_RC_JUMBO_FRAME, 1);
 
         for (i = 0; i < port->num_def_qps; i++)
-                cb0->default_qpn_arr[i] = port->port_res[i].qp->init_attr.qp_nr;
+                cb0->default_qpn_arr[i] = port->port_res[0].qp->init_attr.qp_nr;
 
         if (netif_msg_ifup(port))
                 ehea_dump(cb0, sizeof(*cb0), "ehea_configure_port");
@@ -1485,11 +1485,12 @@ out:
 
 static void ehea_promiscuous_error(u64 hret, int enable)
 {
-        ehea_info("Hypervisor denied %sabling promiscuous mode.%s",
-                  enable == 1 ? "en" : "dis",
-                  hret != H_AUTHORITY ? "" : " Another partition owning a "
-                  "logical port on the same physical port might have altered "
-                  "promiscuous mode first.");
+        if (hret == H_AUTHORITY)
+                ehea_info("Hypervisor denied %sabling promiscuous mode",
+                          enable == 1 ? "en" : "dis");
+        else
+                ehea_error("failed %sabling promiscuous mode",
+                           enable == 1 ? "en" : "dis");
 }
 
 static void ehea_promiscuous(struct net_device *dev, int enable)
@@ -2267,6 +2268,8 @@ static void ehea_tx_watchdog(struct net_device *dev)
 int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
 {
         struct hcp_query_ehea *cb;
+        struct device_node *lhea_dn = NULL;
+        struct device_node *eth_dn = NULL;
         u64 hret;
         int ret;
 
@@ -2283,7 +2286,18 @@ int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
                 goto out_herr;
         }
 
-        adapter->num_ports = cb->num_ports;
+        /* Determine the number of available logical ports
+         * by counting the child nodes of the lhea OFDT entry
+         */
+        adapter->num_ports = 0;
+        lhea_dn = of_find_node_by_name(lhea_dn, "lhea");
+        do {
+                eth_dn = of_get_next_child(lhea_dn, eth_dn);
+                if (eth_dn)
+                        adapter->num_ports++;
+        } while ( eth_dn );
+        of_node_put(lhea_dn);
+
         adapter->max_mc_mac = cb->max_mc_mac - 1;
         ret = 0;
 
@@ -2334,8 +2348,6 @@ static int ehea_setup_single_port(struct ehea_port *port,
 
         INIT_LIST_HEAD(&port->mc_list->list);
 
-        ehea_set_portspeed(port, EHEA_SPEED_AUTONEG);
-
         ret = ehea_sense_port_attr(port);
         if (ret)
                 goto out;
@@ -2471,14 +2483,16 @@ static int __devinit ehea_probe(struct ibmebus_dev *dev,
 
         adapter_handle = (u64*)get_property(dev->ofdev.node, "ibm,hea-handle",
                                             NULL);
-        if (!adapter_handle) {
+        if (adapter_handle)
+                adapter->handle = *adapter_handle;
+
+        if (!adapter->handle) {
                 dev_err(&dev->ofdev.dev, "failed getting handle for adapter"
                         " '%s'\n", dev->ofdev.node->full_name);
                 ret = -ENODEV;
                 goto out_free_ad;
         }
 
-        adapter->handle = *adapter_handle;
         adapter->pd = EHEA_PD_ID;
 
         dev->ofdev.dev.driver_data = adapter;
diff --git a/drivers/net/ehea/ehea_phyp.c b/drivers/net/ehea/ehea_phyp.c
index 0cfc2bc1a27b..37716e05e808 100644
--- a/drivers/net/ehea/ehea_phyp.c
+++ b/drivers/net/ehea/ehea_phyp.c
@@ -94,6 +94,7 @@ static long ehea_plpar_hcall9(unsigned long opcode,
 {
         long ret;
         int i, sleep_msecs;
+        u8 cb_cat;
 
         for (i = 0; i < 5; i++) {
                 ret = plpar_hcall9(opcode, outs,
@@ -106,7 +107,13 @@ static long ehea_plpar_hcall9(unsigned long opcode,
                         continue;
                 }
 
-                if (ret < H_SUCCESS)
+                cb_cat = EHEA_BMASK_GET(H_MEHEAPORT_CAT, arg2);
+
+                if ((ret < H_SUCCESS) && !(((ret == H_AUTHORITY)
+                    && (opcode == H_MODIFY_HEA_PORT))
+                    && (((cb_cat == H_PORT_CB4) && ((arg3 == H_PORT_CB4_JUMBO)
+                    || (arg3 == H_PORT_CB4_SPEED))) || ((cb_cat == H_PORT_CB7)
+                    && (arg3 == H_PORT_CB7_DUCQPN)))))
                         ehea_error("opcode=%lx ret=%lx"
                                    " arg1=%lx arg2=%lx arg3=%lx arg4=%lx"
                                    " arg5=%lx arg6=%lx arg7=%lx arg8=%lx"
@@ -120,7 +127,6 @@ static long ehea_plpar_hcall9(unsigned long opcode,
                                    outs[0], outs[1], outs[2], outs[3],
                                    outs[4], outs[5], outs[6], outs[7],
                                    outs[8]);
-
                 return ret;
         }
 
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 6490acf05305..59324b1693d6 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -63,12 +63,11 @@
 
 #include "netxen_nic_hw.h"
 
-#define NETXEN_NIC_BUILD_NO     "4"
+#define NETXEN_NIC_BUILD_NO     "2"
 #define _NETXEN_NIC_LINUX_MAJOR 3
 #define _NETXEN_NIC_LINUX_MINOR 3
-#define _NETXEN_NIC_LINUX_SUBVERSION 2
-#define NETXEN_NIC_LINUX_VERSIONID  "3.3.2" "-" NETXEN_NIC_BUILD_NO
-#define NETXEN_NIC_FW_VERSIONID "3.3.2"
+#define _NETXEN_NIC_LINUX_SUBVERSION 3
+#define NETXEN_NIC_LINUX_VERSIONID  "3.3.3" "-" NETXEN_NIC_BUILD_NO
 
 #define RCV_DESC_RINGSIZE       \
         (sizeof(struct rcv_desc) * adapter->max_rx_desc_count)
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index c0c31d1914a7..191e2336e323 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -984,7 +984,8 @@ void netxen_nic_flash_print(struct netxen_adapter *adapter)
                        _NETXEN_NIC_LINUX_MAJOR, fw_major);
                 adapter->driver_mismatch = 1;
         }
-        if (fw_minor != _NETXEN_NIC_LINUX_MINOR) {
+        if (fw_minor != _NETXEN_NIC_LINUX_MINOR &&
+                        fw_minor != (_NETXEN_NIC_LINUX_MINOR + 1)) {
                 printk(KERN_ERR "The mismatch in driver version and firmware "
                        "version minor number\n"
                        "Driver version minor number = %d \t"
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 8a5792fea774..96e1bee19ba0 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1144,7 +1144,7 @@ static int __init netxen_init_module(void)
         if ((netxen_workq = create_singlethread_workqueue("netxen")) == 0)
                 return -ENOMEM;
 
-        return pci_module_init(&netxen_driver);
+        return pci_register_driver(&netxen_driver);
 }
 
 module_init(netxen_init_module);
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 342f4062de0b..461e8274ef69 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -606,11 +606,14 @@ static int el3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
     kio_addr_t ioaddr = dev->base_addr;
     struct el3_private *priv = netdev_priv(dev);
+    unsigned long flags;
 
     DEBUG(3, "%s: el3_start_xmit(length = %ld) called, "
           "status %4.4x.\n", dev->name, (long)skb->len,
           inw(ioaddr + EL3_STATUS));
 
+    spin_lock_irqsave(&priv->lock, flags);    
+
     priv->stats.tx_bytes += skb->len;
 
     /* Put out the doubleword header... */
@@ -628,6 +631,7 @@ static int el3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
     dev_kfree_skb(skb);
     pop_tx_status(dev);
+    spin_unlock_irqrestore(&priv->lock, flags);    
     
     return 0;
 }
@@ -729,14 +733,13 @@ static void media_check(unsigned long arg)
 
     if (!netif_device_present(dev)) goto reschedule;
 
-    EL3WINDOW(1);
     /* Check for pending interrupt with expired latency timer: with
        this, we can limp along even if the interrupt is blocked */
     if ((inw(ioaddr + EL3_STATUS) & IntLatch) &&
         (inb(ioaddr + EL3_TIMER) == 0xff)) {
         if (!lp->fast_poll)
             printk(KERN_WARNING "%s: interrupt(s) dropped!\n", dev->name);
-        el3_interrupt(dev->irq, lp);
+        el3_interrupt(dev->irq, dev);
         lp->fast_poll = HZ;
     }
     if (lp->fast_poll) {
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index e175f3910b18..9765fa661467 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -286,6 +286,7 @@ int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd)
 
         return 0;
 }
+EXPORT_SYMBOL(phy_ethtool_sset);
 
 int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd)
 {
@@ -302,7 +303,7 @@ int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd)
 
         return 0;
 }
-
+EXPORT_SYMBOL(phy_ethtool_gset);
 
 /* Note that this function is currently incompatible with the
  * PHYCONTROL layer.  It changes registers without regard to
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 250cdbeefdfd..1dd66b8ea0fa 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -556,10 +556,9 @@ static int init_shared_mem(struct s2io_nic *nic)
                 }
         }
 
-        nic->ufo_in_band_v = kmalloc((sizeof(u64) * size), GFP_KERNEL);
+        nic->ufo_in_band_v = kcalloc(size, sizeof(u64), GFP_KERNEL);
         if (!nic->ufo_in_band_v)
                 return -ENOMEM;
-        memset(nic->ufo_in_band_v, 0, size);
 
         /* Allocation and initialization of RXDs in Rings */
         size = 0;
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index e9e0934380b8..198b9f22fbff 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -492,10 +492,10 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
 
         spin_lock_irq(&rtc->lock);
 
-        /* disable alarm interrupt and clear flag */
+        /* disable alarm interrupt and clear the alarm flag */
         rcr1 = readb(rtc->regbase + RCR1);
-        rcr1 &= ~RCR1_AF;
-        writeb(rcr1 & ~RCR1_AIE, rtc->regbase + RCR1);
+        rcr1 &= ~(RCR1_AF|RCR1_AIE);
+        writeb(rcr1, rtc->regbase + RCR1);
 
         rtc->rearm_aie = 0;
 
@@ -510,8 +510,10 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
                 mon += 1;
         sh_rtc_write_alarm_value(rtc, mon, RMONAR);
 
-        /* Restore interrupt activation status */
-        writeb(rcr1, rtc->regbase + RCR1);
+        if (wkalrm->enabled) {
+                rcr1 |= RCR1_AIE;
+                writeb(rcr1, rtc->regbase + RCR1);
+        }
 
         spin_unlock_irq(&rtc->lock);
 
diff --git a/drivers/usb/serial/funsoft.c b/drivers/usb/serial/funsoft.c
index 31501c9361b9..2bebd63d5ed1 100644
--- a/drivers/usb/serial/funsoft.c
+++ b/drivers/usb/serial/funsoft.c
@@ -27,7 +27,7 @@ MODULE_DEVICE_TABLE(usb, id_table);
 static int funsoft_ioctl(struct usb_serial_port *port, struct file *file,
                          unsigned int cmd, unsigned long arg)
 {
-        struct termios t;
+        struct ktermios t;
 
         dbg("%s - port %d, cmd 0x%04x", __FUNCTION__, port->number, cmd);
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 8b18e43b82fe..d9bdf2b3ade2 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -146,7 +146,7 @@ static int blk_end_aio(struct bio *bio, unsigned int bytes_done, int error)
                 iocb->ki_nbytes = -EIO;
 
         if (atomic_dec_and_test(bio_count)) {
-                if (iocb->ki_nbytes < 0)
+                if ((long)iocb->ki_nbytes < 0)
                         aio_complete(iocb, iocb->ki_nbytes, 0);
                 else
                         aio_complete(iocb, iocb->ki_left, 0);
@@ -190,6 +190,12 @@ static struct page *blk_get_page(unsigned long addr, size_t count, int rw,
         return pvec->page[pvec->idx++];
 }
 
+/* return a page back to pvec array */
+static void blk_unget_page(struct page *page, struct pvec *pvec)
+{
+        pvec->page[--pvec->idx] = page;
+}
+
 static ssize_t
 blkdev_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
                  loff_t pos, unsigned long nr_segs)
@@ -278,6 +284,8 @@ same_bio:
                                 count = min(count, nbytes);
                                 goto same_bio;
                         }
+                } else {
+                        blk_unget_page(page, &pvec);
                 }
 
                 /* bio is ready, submit it */
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index 99b6f329ba23..5109f1d5e7ff 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -48,6 +48,11 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
         }
 
         mutex_lock(&inode->i_mutex);
+
+        mutex_lock(&(REISERFS_I(inode)->i_mmap));
+        if (REISERFS_I(inode)->i_flags & i_ever_mapped)
+                REISERFS_I(inode)->i_flags &= ~i_pack_on_close_mask;
+
         reiserfs_write_lock(inode->i_sb);
         /* freeing preallocation only involves relogging blocks that
          * are already in the current transaction.  preallocation gets
@@ -100,11 +105,24 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
                 err = reiserfs_truncate_file(inode, 0);
         }
       out:
+        mutex_unlock(&(REISERFS_I(inode)->i_mmap));
         mutex_unlock(&inode->i_mutex);
         reiserfs_write_unlock(inode->i_sb);
         return err;
 }
 
+static int reiserfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        struct inode *inode;
+
+        inode = file->f_path.dentry->d_inode;
+        mutex_lock(&(REISERFS_I(inode)->i_mmap));
+        REISERFS_I(inode)->i_flags |= i_ever_mapped;
+        mutex_unlock(&(REISERFS_I(inode)->i_mmap));
+
+        return generic_file_mmap(file, vma);
+}
+
 static void reiserfs_vfs_truncate_file(struct inode *inode)
 {
         reiserfs_truncate_file(inode, 1);
@@ -1527,7 +1545,7 @@ const struct file_operations reiserfs_file_operations = {
 #ifdef CONFIG_COMPAT
         .compat_ioctl = reiserfs_compat_ioctl,
 #endif
-        .mmap = generic_file_mmap,
+        .mmap = reiserfs_file_mmap,
         .open = generic_file_open,
         .release = reiserfs_file_release,
         .fsync = reiserfs_sync_file,
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index f3d1c4a77979..9fcbfe316977 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1125,6 +1125,7 @@ static void init_inode(struct inode *inode, struct treepath *path)
         REISERFS_I(inode)->i_prealloc_count = 0;
         REISERFS_I(inode)->i_trans_id = 0;
         REISERFS_I(inode)->i_jl = NULL;
+        mutex_init(&(REISERFS_I(inode)->i_mmap));
         reiserfs_init_acl_access(inode);
         reiserfs_init_acl_default(inode);
         reiserfs_init_xattr_rwsem(inode);
@@ -1832,6 +1833,7 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
         REISERFS_I(inode)->i_attrs =
             REISERFS_I(dir)->i_attrs & REISERFS_INHERIT_MASK;
         sd_attrs_to_i_attrs(REISERFS_I(inode)->i_attrs, inode);
+        mutex_init(&(REISERFS_I(inode)->i_mmap));
         reiserfs_init_acl_access(inode);
         reiserfs_init_acl_default(inode);
         reiserfs_init_xattr_rwsem(inode);
diff --git a/include/asm-ia64/checksum.h b/include/asm-ia64/checksum.h
index 2b78582cbd61..97af155057e4 100644
--- a/include/asm-ia64/checksum.h
+++ b/include/asm-ia64/checksum.h
@@ -72,8 +72,8 @@ static inline __sum16 csum_fold(__wsum csum)
 
 #define _HAVE_ARCH_IPV6_CSUM    1
 struct in6_addr;
-extern unsigned short int csum_ipv6_magic(struct in6_addr *saddr,
-        struct in6_addr *daddr, __u32 len, unsigned short proto,
-        unsigned int csum);
+extern __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
+        const struct in6_addr *daddr, __u32 len, unsigned short proto,
+        __wsum csum);
 
 #endif /* _ASM_IA64_CHECKSUM_H */
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 862e483cce8a..8c634f9df39f 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -129,7 +129,6 @@ header-y += posix_types.h
 header-y += ppdev.h
 header-y += prctl.h
 header-y += ps2esdi.h
-header-y += qic117.h
 header-y += qnxtypes.h
 header-y += quotaio_v1.h
 header-y += quotaio_v2.h
diff --git a/include/linux/mtio.h b/include/linux/mtio.h
index 8c66151821e3..6f8d2d45a8fb 100644
--- a/include/linux/mtio.h
+++ b/include/linux/mtio.h
@@ -10,7 +10,6 @@
 
 #include <linux/types.h>
 #include <linux/ioctl.h>
-#include <linux/qic117.h>
 
 /*
  * Structures and definitions for mag tape io control commands
@@ -116,32 +115,6 @@ struct	mtget {
 #define MT_ISFTAPE_UNKNOWN      0x800000 /* obsolete */
 #define MT_ISFTAPE_FLAG 0x800000
 
-struct mt_tape_info {
-        long t_type;            /* device type id (mt_type) */
-        char *t_name;           /* descriptive name */
-};
-
-#define MT_TAPE_INFO    { \
-        {MT_ISUNKNOWN,          "Unknown type of tape device"}, \
-        {MT_ISQIC02,            "Generic QIC-02 tape streamer"}, \
-        {MT_ISWT5150,           "Wangtek 5150, QIC-150"}, \
-        {MT_ISARCHIVE_5945L2,   "Archive 5945L-2"}, \
-        {MT_ISCMSJ500,          "CMS Jumbo 500"}, \
-        {MT_ISTDC3610,          "Tandberg TDC 3610, QIC-24"}, \
-        {MT_ISARCHIVE_VP60I,    "Archive VP60i, QIC-02"}, \
-        {MT_ISARCHIVE_2150L,    "Archive Viper 2150L"}, \
-        {MT_ISARCHIVE_2060L,    "Archive Viper 2060L"}, \
-        {MT_ISARCHIVESC499,     "Archive SC-499 QIC-36 controller"}, \
-        {MT_ISQIC02_ALL_FEATURES, "Generic QIC-02 tape, all features"}, \
-        {MT_ISWT5099EEN24,      "Wangtek 5099-een24, 60MB"}, \
-        {MT_ISTEAC_MT2ST,       "Teac MT-2ST 155mb data cassette drive"}, \
-        {MT_ISEVEREX_FT40A,     "Everex FT40A, QIC-40"}, \
-        {MT_ISONSTREAM_SC,      "OnStream SC-, DI-, DP-, or USB tape drive"}, \
-        {MT_ISSCSI1,            "Generic SCSI-1 tape"}, \
-        {MT_ISSCSI2,            "Generic SCSI-2 tape"}, \
-        {0, NULL} \
-}
-
 
 /* structure for MTIOCPOS - mag tape get position command */
 
@@ -150,130 +123,11 @@ struct	mtpos {
 };
 
 
-/*  structure for MTIOCVOLINFO, query information about the volume
- *  currently positioned at (zftape)
- */
-struct mtvolinfo {
-        unsigned int mt_volno;   /* vol-number */
-        unsigned int mt_blksz;   /* blocksize used when recording */
-        unsigned int mt_rawsize; /* raw tape space consumed, in kb */
-        unsigned int mt_size;    /* volume size after decompression, in kb */
-        unsigned int mt_cmpr:1;  /* this volume has been compressed */
-};
-
-/* raw access to a floppy drive, read and write an arbitrary segment.
- * For ftape/zftape to support formatting etc.
- */
-#define MT_FT_RD_SINGLE  0
-#define MT_FT_RD_AHEAD   1
-#define MT_FT_WR_ASYNC   0 /* start tape only when all buffers are full     */
-#define MT_FT_WR_MULTI   1 /* start tape, continue until buffers are empty  */
-#define MT_FT_WR_SINGLE  2 /* write a single segment and stop afterwards    */
-#define MT_FT_WR_DELETE  3 /* write deleted data marks, one segment at time */
-
-struct mtftseg
-{            
-        unsigned mt_segno;   /* the segment to read or write */
-        unsigned mt_mode;    /* modes for read/write (sync/async etc.) */
-        int      mt_result;  /* result of r/w request, not of the ioctl */
-        void    __user *mt_data;    /* User space buffer: must be 29kb */
-};
-
-/* get tape capacity (ftape/zftape)
- */
-struct mttapesize {
-        unsigned long mt_capacity; /* entire, uncompressed capacity 
-                                    * of a cartridge
-                                    */
-        unsigned long mt_used;     /* what has been used so far, raw 
-                                    * uncompressed amount
-                                    */
-};
-
-/*  possible values of the ftfmt_op field
- */
-#define FTFMT_SET_PARMS         1 /* set software parms */
-#define FTFMT_GET_PARMS         2 /* get software parms */
-#define FTFMT_FORMAT_TRACK      3 /* start formatting a tape track   */
-#define FTFMT_STATUS            4 /* monitor formatting a tape track */
-#define FTFMT_VERIFY            5 /* verify the given segment        */
-
-struct ftfmtparms {
-        unsigned char  ft_qicstd;   /* QIC-40/QIC-80/QIC-3010/QIC-3020 */
-        unsigned char  ft_fmtcode;  /* Refer to the QIC specs */
-        unsigned char  ft_fhm;      /* floppy head max */
-        unsigned char  ft_ftm;      /* floppy track max */
-        unsigned short ft_spt;      /* segments per track */
-        unsigned short ft_tpc;      /* tracks per cartridge */
-};
-
-struct ftfmttrack {
-        unsigned int  ft_track;   /* track to format */
-        unsigned char ft_gap3;    /* size of gap3, for FORMAT_TRK */
-};
-
-struct ftfmtstatus {
-        unsigned int  ft_segment;  /* segment currently being formatted */
-};
-
-struct ftfmtverify {
-        unsigned int  ft_segment;   /* segment to verify */
-        unsigned long ft_bsm;       /* bsm as result of VERIFY cmd */
-};
-
-struct mtftformat {
-        unsigned int fmt_op;      /* operation to perform */
-        union fmt_arg {
-                struct ftfmtparms  fmt_parms;  /* format parameters */
-                struct ftfmttrack  fmt_track;  /* ctrl while formatting */
-                struct ftfmtstatus fmt_status;
-                struct ftfmtverify fmt_verify; /* for verifying */ 
-        } fmt_arg;
-};
-
-struct mtftcmd {
-        unsigned int ft_wait_before; /* timeout to wait for drive to get ready 
-                                      * before command is sent. Milliseconds
-                                      */
-        qic117_cmd_t ft_cmd;         /* command to send */
-        unsigned char ft_parm_cnt;   /* zero: no parm is sent. */
-        unsigned char ft_parms[3];   /* parameter(s) to send to
-                                      * the drive. The parms are nibbles
-                                      * driver sends cmd + 2 step pulses */
-        unsigned int ft_result_bits; /* if non zero, number of bits
-                                      * returned by the tape drive
-                                      */
-        unsigned int ft_result;      /* the result returned by the tape drive*/
-        unsigned int ft_wait_after;  /* timeout to wait for drive to get ready
-                                      * after command is sent. 0: don't wait */
-        int ft_status;               /* status returned by ready wait
-                                      * undefined if timeout was 0.
-                                      */
-        int ft_error;                /* error code if error status was set by 
-                                      * command
-                                      */
-};
-
 /* mag tape io control commands */
 #define MTIOCTOP        _IOW('m', 1, struct mtop)       /* do a mag tape op */
 #define MTIOCGET        _IOR('m', 2, struct mtget)      /* get tape status */
 #define MTIOCPOS        _IOR('m', 3, struct mtpos)      /* get tape position */
 
-/* The next two are used by the QIC-02 driver for runtime reconfiguration.
- * See tpqic02.h for struct mtconfiginfo.
- */
-#define MTIOCGETCONFIG  _IOR('m', 4, struct mtconfiginfo) /* get tape config */
-#define MTIOCSETCONFIG  _IOW('m', 5, struct mtconfiginfo) /* set tape config */
-
-/* the next six are used by the floppy ftape drivers and its frontends
- * sorry, but MTIOCTOP commands are write only.
- */
-#define MTIOCRDFTSEG    _IOWR('m', 6, struct mtftseg)  /* read a segment */
-#define MTIOCWRFTSEG    _IOWR('m', 7, struct mtftseg)   /* write a segment */
-#define MTIOCVOLINFO    _IOR('m',  8, struct mtvolinfo) /* info about volume */
-#define MTIOCGETSIZE    _IOR('m',  9, struct mttapesize)/* get cartridge size*/
-#define MTIOCFTFORMAT   _IOWR('m', 10, struct mtftformat) /* format ftape */
-#define MTIOCFTCMD      _IOWR('m', 11, struct mtftcmd) /* send QIC-117 cmd */
 
 /* Generic Mag Tape (device independent) status macros for examining
  * mt_gstat -- HP-UX compatible.
diff --git a/include/linux/qic117.h b/include/linux/qic117.h
deleted file mode 100644
index 07b537e5d359..000000000000
--- a/include/linux/qic117.h
+++ /dev/null
@@ -1,290 +0,0 @@
-#ifndef _QIC117_H
-#define _QIC117_H
-
-/*
- *      Copyright (C) 1993-1996 Bas Laarhoven,
- *                (C) 1997      Claus-Justus Heine.
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2, or (at your option)
- any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; see the file COPYING.  If not, write to
- the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
-
- *
- * $Source: /homes/cvs/ftape-stacked/include/linux/qic117.h,v $
- * $Revision: 1.2 $
- * $Date: 1997/10/05 19:19:32 $
- *
- *      This file contains QIC-117 spec. related definitions for the
- *      QIC-40/80/3010/3020 floppy-tape driver "ftape" for Linux.
- *
- *      These data were taken from the Quarter-Inch Cartridge
- *      Drive Standards, Inc. document titled:
- *      `Common Command Set Interface Specification for Flexible
- *       Disk Controller Based Minicartridge Tape Drives'
- *       document QIC-117 Revision J, 28 Aug 96.
- *      For more information, contact:
- *       Quarter-Inch Cartridge Drive Standards, Inc.
- *       311 East Carrillo Street
- *       Santa Barbara, California 93101
- *       Telephone (805) 963-3853
- *       Fax       (805) 962-1541
- *       WWW       http://www.qic.org
- *
- *      Current QIC standard revisions (of interest) are:
- *       QIC-40-MC,   Rev. M,  2 Sep 92.
- *       QIC-80-MC,   Rev. N, 20 Mar 96.
- *       QIC-80-MC,   Rev. K, 15 Dec 94.
- *       QIC-113,     Rev. G, 15 Jun 95.
- *       QIC-117,     Rev. J, 28 Aug 96.
- *       QIC-122,     Rev. B,  6 Mar 91.
- *       QIC-130,     Rev. C,  2 Sep 92.
- *       QIC-3010-MC, Rev. F, 14 Jun 95.
- *       QIC-3020-MC, Rev. G, 31 Aug 95.
- *       QIC-CRF3,    Rev. B, 15 Jun 95.
- * */
-
-/*
- *      QIC-117 common command set rev. J.
- *      These commands are sent to the tape unit
- *      as number of pulses over the step line.
- */
-
-typedef enum {
-        QIC_NO_COMMAND                  = 0,
-        QIC_RESET                       = 1,
-        QIC_REPORT_NEXT_BIT             = 2,
-        QIC_PAUSE                       = 3,
-        QIC_MICRO_STEP_PAUSE            = 4,
-        QIC_ALTERNATE_TIMEOUT           = 5,
-        QIC_REPORT_DRIVE_STATUS         = 6,
-        QIC_REPORT_ERROR_CODE           = 7,
-        QIC_REPORT_DRIVE_CONFIGURATION  = 8,
-        QIC_REPORT_ROM_VERSION          = 9,
-        QIC_LOGICAL_FORWARD             = 10,
-        QIC_PHYSICAL_REVERSE            = 11,
-        QIC_PHYSICAL_FORWARD            = 12,
-        QIC_SEEK_HEAD_TO_TRACK          = 13,
-        QIC_SEEK_LOAD_POINT             = 14,
-        QIC_ENTER_FORMAT_MODE           = 15,
-        QIC_WRITE_REFERENCE_BURST       = 16,
-        QIC_ENTER_VERIFY_MODE           = 17,
-        QIC_STOP_TAPE                   = 18,
-/* commands 19-20: reserved */
-        QIC_MICRO_STEP_HEAD_UP          = 21,
-        QIC_MICRO_STEP_HEAD_DOWN        = 22,
-        QIC_SOFT_SELECT                 = 23,
-        QIC_SOFT_DESELECT               = 24,
-        QIC_SKIP_REVERSE                = 25,
-        QIC_SKIP_FORWARD                = 26,
-        QIC_SELECT_RATE                 = 27,
-/* command 27, in ccs2: Select Rate or Format */
-        QIC_ENTER_DIAGNOSTIC_1          = 28,
-        QIC_ENTER_DIAGNOSTIC_2          = 29,
-        QIC_ENTER_PRIMARY_MODE          = 30,
-/* command 31: vendor unique */
-        QIC_REPORT_VENDOR_ID            = 32,
-        QIC_REPORT_TAPE_STATUS          = 33,
-        QIC_SKIP_EXTENDED_REVERSE       = 34,
-        QIC_SKIP_EXTENDED_FORWARD       = 35,
-        QIC_CALIBRATE_TAPE_LENGTH       = 36,
-        QIC_REPORT_FORMAT_SEGMENTS      = 37,
-        QIC_SET_FORMAT_SEGMENTS         = 38,
-/* commands 39-45: reserved */
-        QIC_PHANTOM_SELECT              = 46,
-        QIC_PHANTOM_DESELECT            = 47
-} qic117_cmd_t;
-
-typedef enum {
-        discretional = 0, required, ccs1, ccs2
-} qic_compatibility;
-
-typedef enum {
-        unused, mode, motion, report
-} command_types;
-
-struct qic117_command_table {
-        char *name;
-        __u8 mask;
-        __u8 state;
-        __u8 cmd_type;
-        __u8 non_intr;
-        __u8 level;
-};
-
-#define QIC117_COMMANDS {\
-/* command                           mask  state cmd_type           */\
-/* |    name                         |     |     |       non_intr   */\
-/* |    |                            |     |     |       |  level   */\
-/* 0*/ {NULL,                        0x00, 0x00, mode,   0, discretional},\
-/* 1*/ {"soft reset",                0x00, 0x00, motion, 1, required},\
-/* 2*/ {"report next bit",           0x00, 0x00, report, 0, required},\
-/* 3*/ {"pause",                     0x36, 0x24, motion, 1, required},\
-/* 4*/ {"micro step pause",          0x36, 0x24, motion, 1, required},\
-/* 5*/ {"alternate command timeout", 0x00, 0x00, mode,   0, required},\
-/* 6*/ {"report drive status",       0x00, 0x00, report, 0, required},\
-/* 7*/ {"report error code",         0x01, 0x01, report, 0, required},\
-/* 8*/ {"report drive configuration",0x00, 0x00, report, 0, required},\
-/* 9*/ {"report rom version",        0x00, 0x00, report, 0, required},\
-/*10*/ {"logical forward",           0x37, 0x25, motion, 0, required},\
-/*11*/ {"physical reverse",          0x17, 0x05, motion, 0, required},\
-/*12*/ {"physical forward",          0x17, 0x05, motion, 0, required},\
-/*13*/ {"seek head to track",        0x37, 0x25, motion, 0, required},\
-/*14*/ {"seek load point",           0x17, 0x05, motion, 1, required},\
-/*15*/ {"enter format mode",         0x1f, 0x05, mode,   0, required},\
-/*16*/ {"write reference burst",     0x1f, 0x05, motion, 1, required},\
-/*17*/ {"enter verify mode",         0x37, 0x25, mode,   0, required},\
-/*18*/ {"stop tape",                 0x00, 0x00, motion, 1, required},\
-/*19*/ {"reserved (19)",             0x00, 0x00, unused, 0, discretional},\
-/*20*/ {"reserved (20)",             0x00, 0x00, unused, 0, discretional},\
-/*21*/ {"micro step head up",        0x02, 0x00, motion, 0, required},\
-/*22*/ {"micro step head down",      0x02, 0x00, motion, 0, required},\
-/*23*/ {"soft select",               0x00, 0x00, mode,   0, discretional},\
-/*24*/ {"soft deselect",             0x00, 0x00, mode,   0, discretional},\
-/*25*/ {"skip segments reverse",     0x36, 0x24, motion, 1, required},\
-/*26*/ {"skip segments forward",     0x36, 0x24, motion, 1, required},\
-/*27*/ {"select rate or format",     0x03, 0x01, mode,   0, required /* [ccs2] */},\
-/*28*/ {"enter diag mode 1",         0x00, 0x00, mode,   0, discretional},\
-/*29*/ {"enter diag mode 2",         0x00, 0x00, mode,   0, discretional},\
-/*30*/ {"enter primary mode",        0x00, 0x00, mode,   0, required},\
-/*31*/ {"vendor unique (31)",        0x00, 0x00, unused, 0, discretional},\
-/*32*/ {"report vendor id",          0x00, 0x00, report, 0, required},\
-/*33*/ {"report tape status",        0x04, 0x04, report, 0, ccs1},\
-/*34*/ {"skip extended reverse",     0x36, 0x24, motion, 1, ccs1},\
-/*35*/ {"skip extended forward",     0x36, 0x24, motion, 1, ccs1},\
-/*36*/ {"calibrate tape length",     0x17, 0x05, motion, 1, ccs2},\
-/*37*/ {"report format segments",    0x17, 0x05, report, 0, ccs2},\
-/*38*/ {"set format segments",       0x17, 0x05, mode,   0, ccs2},\
-/*39*/ {"reserved (39)",             0x00, 0x00, unused, 0, discretional},\
-/*40*/ {"vendor unique (40)",        0x00, 0x00, unused, 0, discretional},\
-/*41*/ {"vendor unique (41)",        0x00, 0x00, unused, 0, discretional},\
-/*42*/ {"vendor unique (42)",        0x00, 0x00, unused, 0, discretional},\
-/*43*/ {"vendor unique (43)",        0x00, 0x00, unused, 0, discretional},\
-/*44*/ {"vendor unique (44)",        0x00, 0x00, unused, 0, discretional},\
-/*45*/ {"vendor unique (45)",        0x00, 0x00, unused, 0, discretional},\
-/*46*/ {"phantom select",            0x00, 0x00, mode,   0, discretional},\
-/*47*/ {"phantom deselect",          0x00, 0x00, mode,   0, discretional},\
-}
-
-/*
- *      Status bits returned by QIC_REPORT_DRIVE_STATUS
- */
-
-#define QIC_STATUS_READY        0x01    /* Drive is ready or idle. */
-#define QIC_STATUS_ERROR        0x02    /* Error detected, must read
-                                           error code to clear this */
-#define QIC_STATUS_CARTRIDGE_PRESENT 0x04       /* Tape is present */
-#define QIC_STATUS_WRITE_PROTECT 0x08   /* Tape is write protected */
-#define QIC_STATUS_NEW_CARTRIDGE 0x10   /* New cartridge inserted, must
-                                           read error status to clear. */
-#define QIC_STATUS_REFERENCED   0x20    /* Cartridge appears to have been
-                                           formatted. */
-#define QIC_STATUS_AT_BOT       0x40    /* Cartridge is at physical
-                                           beginning of tape. */
-#define QIC_STATUS_AT_EOT       0x80    /* Cartridge is at physical end
-                                           of tape. */
-/*
- *      Status bits returned by QIC_REPORT_DRIVE_CONFIGURATION
- */
-
-#define QIC_CONFIG_RATE_MASK    0x18
-#define QIC_CONFIG_RATE_SHIFT   3
-#define QIC_CONFIG_RATE_250     0
-#define QIC_CONFIG_RATE_500     2
-#define QIC_CONFIG_RATE_1000    3
-#define QIC_CONFIG_RATE_2000    1
-#define QIC_CONFIG_RATE_4000    0       /* since QIC-117 Rev. J */
-
-#define QIC_CONFIG_LONG         0x40    /* Extra Length Tape Detected */
-#define QIC_CONFIG_80           0x80    /* QIC-80 detected. */
-
-/*
- *      Status bits returned by QIC_REPORT_TAPE_STATUS
- */
-
-#define QIC_TAPE_STD_MASK       0x0f
-#define QIC_TAPE_QIC40          0x01
-#define QIC_TAPE_QIC80          0x02
-#define QIC_TAPE_QIC3020        0x03
-#define QIC_TAPE_QIC3010        0x04
-
-#define QIC_TAPE_LEN_MASK       0x70
-#define QIC_TAPE_205FT          0x10
-#define QIC_TAPE_307FT          0x20
-#define QIC_TAPE_VARIABLE       0x30
-#define QIC_TAPE_1100FT         0x40
-#define QIC_TAPE_FLEX           0x60
-
-#define QIC_TAPE_WIDE           0x80
-
-/* Define a value (in feet) slightly higher than 
- * the possible maximum tape length.
- */
-#define QIC_TOP_TAPE_LEN        1500
-
-/*
- *      Errors: List of error codes, and their severity.
- */
-
-typedef struct {
-        char *message;          /* Text describing the error. */
-        unsigned int fatal:1;   /* Non-zero if the error is fatal. */
-} ftape_error;
-
-#define QIC117_ERRORS {\
-  /* 0*/ { "No error", 0, },\
-  /* 1*/ { "Command Received while Drive Not Ready", 0, },\
-  /* 2*/ { "Cartridge Not Present or Removed", 1, },\
-  /* 3*/ { "Motor Speed Error (not within 1%)", 1, },\
-  /* 4*/ { "Motor Speed Fault (jammed, or gross speed error", 1, },\
-  /* 5*/ { "Cartridge Write Protected", 1, },\
-  /* 6*/ { "Undefined or Reserved Command Code", 1, },\
-  /* 7*/ { "Illegal Track Address Specified for Seek", 1, },\
-  /* 8*/ { "Illegal Command in Report Subcontext", 0, },\
-  /* 9*/ { "Illegal Entry into a Diagnostic Mode", 1, },\
-  /*10*/ { "Broken Tape Detected (based on hole sensor)", 1, },\
-  /*11*/ { "Warning--Read Gain Setting Error", 1, },\
-  /*12*/ { "Command Received While Error Status Pending (obs)", 1, },\
-  /*13*/ { "Command Received While New Cartridge Pending", 1, },\
-  /*14*/ { "Command Illegal or Undefined in Primary Mode", 1, },\
-  /*15*/ { "Command Illegal or Undefined in Format Mode", 1, },\
-  /*16*/ { "Command Illegal or Undefined in Verify Mode", 1, },\
-  /*17*/ { "Logical Forward Not at Logical BOT or no Format Segments in Format Mode", 1, },\
-  /*18*/ { "Logical EOT Before All Segments generated", 1, },\
-  /*19*/ { "Command Illegal When Cartridge Not Referenced", 1, },\
-  /*20*/ { "Self-Diagnostic Failed (cannot be cleared)", 1, },\
-  /*21*/ { "Warning EEPROM Not Initialized, Defaults Set", 1, },\
-  /*22*/ { "EEPROM Corrupted or Hardware Failure", 1, },\
-  /*23*/ { "Motion Time-out Error", 1, },\
-  /*24*/ { "Data Segment Too Long -- Logical Forward or Pause", 1, },\
-  /*25*/ { "Transmit Overrun (obs)", 1, },\
-  /*26*/ { "Power On Reset Occurred", 0, },\
-  /*27*/ { "Software Reset Occurred", 0, },\
-  /*28*/ { "Diagnostic Mode 1 Error", 1, },\
-  /*29*/ { "Diagnostic Mode 2 Error", 1, },\
-  /*30*/ { "Command Received During Non-Interruptible Process", 1, },\
-  /*31*/ { "Rate or Format Selection Error", 1, },\
-  /*32*/ { "Illegal Command While in High Speed Mode", 1, },\
-  /*33*/ { "Illegal Seek Segment Value", 1, },\
-  /*34*/ { "Invalid Media", 1, },\
-  /*35*/ { "Head Positioning Failure", 1, },\
-  /*36*/ { "Write Reference Burst Failure", 1, },\
-  /*37*/ { "Prom Code Missing", 1, },\
-  /*38*/ { "Invalid Format", 1, },\
-  /*39*/ { "EOT/BOT System Failure", 1, },\
-  /*40*/ { "Prom A Checksum Error", 1, },\
-  /*41*/ { "Drive Wakeup Reset Occurred", 1, },\
-  /*42*/ { "Prom B Checksum Error", 1, },\
-  /*43*/ { "Illegal Entry into Format Mode", 1, },\
-}
-
-#endif                          /* _QIC117_H */
diff --git a/include/linux/reiserfs_fs_i.h b/include/linux/reiserfs_fs_i.h
index 5b3b297aa2c5..ce3663fb0101 100644
--- a/include/linux/reiserfs_fs_i.h
+++ b/include/linux/reiserfs_fs_i.h
@@ -25,6 +25,7 @@ typedef enum {
         i_link_saved_truncate_mask = 0x0020,
         i_has_xattr_dir = 0x0040,
         i_data_log = 0x0080,
+        i_ever_mapped = 0x0100
 } reiserfs_inode_flags;
 
 struct reiserfs_inode_info {
@@ -52,6 +53,7 @@ struct reiserfs_inode_info {
          ** flushed */
         unsigned long i_trans_id;
         struct reiserfs_journal_list *i_jl;
+        struct mutex i_mmap;
 #ifdef CONFIG_REISERFS_FS_POSIX_ACL
         struct posix_acl *i_acl_access;
         struct posix_acl *i_acl_default;
diff --git a/ipc/shm.c b/ipc/shm.c
index 6d16bb6de7d2..f8e10a25ad7d 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -279,7 +279,7 @@ static int newseg (struct ipc_namespace *ns, key_t key, int shmflg, size_t size)
         if (size < SHMMIN || size > ns->shm_ctlmax)
                 return -EINVAL;
 
-        if (ns->shm_tot + numpages >= ns->shm_ctlall)
+        if (ns->shm_tot + numpages > ns->shm_ctlall)
                 return -ENOSPC;
 
         shp = ipc_rcu_alloc(sizeof(*shp));
diff --git a/kernel/profile.c b/kernel/profile.c
index a6574a18514e..d6579d511069 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -331,7 +331,6 @@ out:
         local_irq_restore(flags);
         put_cpu();
 }
-EXPORT_SYMBOL_GPL(profile_hits);
 
 static int __devinit profile_cpu_callback(struct notifier_block *info,
                                         unsigned long action, void *__cpu)
@@ -401,6 +400,8 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
 }
 #endif /* !CONFIG_SMP */
 
+EXPORT_SYMBOL_GPL(profile_hits);
+
 void profile_tick(int type)
 {
         struct pt_regs *regs = get_irq_regs();
diff --git a/kernel/sys.c b/kernel/sys.c
index c7675c1bfdf2..6e2101dec0fc 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -323,11 +323,18 @@ EXPORT_SYMBOL_GPL(blocking_notifier_chain_unregister);
 int blocking_notifier_call_chain(struct blocking_notifier_head *nh,
                 unsigned long val, void *v)
 {
-        int ret;
+        int ret = NOTIFY_DONE;
 
-        down_read(&nh->rwsem);
-        ret = notifier_call_chain(&nh->head, val, v);
-        up_read(&nh->rwsem);
+        /*
+         * We check the head outside the lock, but if this access is
+         * racy then it does not matter what the result of the test
+         * is, we re-check the list after having taken the lock anyway:
+         */
+        if (rcu_dereference(nh->head)) {
+                down_read(&nh->rwsem);
+                ret = notifier_call_chain(&nh->head, val, v);
+                up_read(&nh->rwsem);
+        }
         return ret;
 }
 
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index da9463946556..c2aec0e1090d 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -884,6 +884,10 @@ asmlinkage long sys_mbind(unsigned long start, unsigned long len,
         err = get_nodes(&nodes, nmask, maxnode);
         if (err)
                 return err;
+#ifdef CONFIG_CPUSETS
+        /* Restrict the nodes to the allowed nodes in the cpuset */
+        nodes_and(nodes, nodes, current->mems_allowed);
+#endif
         return do_mbind(start, len, mode, &nodes, flags);
 }
 
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 367f8a32a665..0a352e46862f 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -322,7 +322,7 @@ static void i_usX2Y_urb_complete(struct urb *urb)
                 usX2Y_error_urb_status(usX2Y, subs, urb);
                 return;
         }
-        if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
                 subs->completed_urb = urb;
         else {
                 usX2Y_error_sequence(usX2Y, subs, urb);
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index 8f3e35e24e72..a5e7bcd7ca2e 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -243,7 +243,7 @@ static void i_usX2Y_usbpcm_urb_complete(struct urb *urb)
                 usX2Y_error_urb_status(usX2Y, subs, urb);
                 return;
         }
-        if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
                 subs->completed_urb = urb;
         else {
                 usX2Y_error_sequence(usX2Y, subs, urb);