20 files changed, 190 insertions, 129 deletions

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 5526faabfc21..4c9f402295dd 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -881,11 +881,15 @@ config NO_IOPORT
 config GENERIC_ISA_DMA
         bool
         select ZONE_DMA if GENERIC_ISA_DMA_SUPPORT_BROKEN=n
+        select ISA_DMA_API
 
 config GENERIC_ISA_DMA_SUPPORT_BROKEN
         bool
         select GENERIC_ISA_DMA
 
+config ISA_DMA_API
+        bool
+
 config GENERIC_GPIO
         bool
 
diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
index 5fd7f7a58b7e..5042d51b0512 100644
--- a/arch/mips/boot/compressed/Makefile
+++ b/arch/mips/boot/compressed/Makefile
@@ -105,4 +105,4 @@ OBJCOPYFLAGS_vmlinuz.srec := $(OBJCOPYFLAGS) -S -O srec
 vmlinuz.srec: vmlinuz
         $(call cmd,objcopy)
 
-clean-files := $(objtree)/vmlinuz.*
+clean-files := $(objtree)/vmlinuz $(objtree)/vmlinuz.{32,ecoff,bin,srec}
diff --git a/arch/mips/include/asm/fcntl.h b/arch/mips/include/asm/fcntl.h
index e482fe90fe88..75eddedcfc3e 100644
--- a/arch/mips/include/asm/fcntl.h
+++ b/arch/mips/include/asm/fcntl.h
@@ -56,6 +56,7 @@
  */
 
 #ifdef CONFIG_32BIT
+#include <linux/types.h>
 
 struct flock {
         short   l_type;
diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index 0176ed015c89..32103cc2a257 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -40,7 +40,6 @@ int __compute_return_epc(struct pt_regs *regs)
                 return -EFAULT;
         }
 
-        regs->regs[0] = 0;
         switch (insn.i_format.opcode) {
         /*
          * jr and jalr are in r_format format.
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index c51b95ff8644..c8777333e198 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -536,7 +536,7 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)
 {
         /* do the secure computing check first */
         if (!entryexit)
-                secure_computing(regs->regs[0]);
+                secure_computing(regs->regs[2]);
 
         if (unlikely(current->audit_context) && entryexit)
                 audit_syscall_exit(AUDITSC_RESULT(regs->regs[2]),
@@ -565,7 +565,7 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)
 
 out:
         if (unlikely(current->audit_context) && !entryexit)
-                audit_syscall_entry(audit_arch(), regs->regs[0],
+                audit_syscall_entry(audit_arch(), regs->regs[2],
                                     regs->regs[4], regs->regs[5],
                                     regs->regs[6], regs->regs[7]);
 }
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 584415eef8c9..fbaabad0e6e2 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -63,9 +63,9 @@ stack_done:
         sw      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        lw      t1, PT_R2(sp)           # syscall number
         negu    v0                      # error
-        sw      v0, PT_R0(sp)           # set flag for syscall
-                                        # restarting
+        sw      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sw      v0, PT_R2(sp)           # result
 
 o32_syscall_exit:
@@ -104,9 +104,9 @@ syscall_trace_entry:
         sw      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        lw      t1, PT_R2(sp)           # syscall number
         negu    v0                      # error
-        sw      v0, PT_R0(sp)           # set flag for syscall
-                                        # restarting
+        sw      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sw      v0, PT_R2(sp)           # result
 
         j       syscall_exit
@@ -169,8 +169,7 @@ stackargs:
          * We probably should handle this case a bit more drastic.
          */
 bad_stack:
-        negu    v0                              # error
-        sw      v0, PT_R0(sp)
+        li      v0, EFAULT
         sw      v0, PT_R2(sp)
         li      t0, 1                           # set error flag
         sw      t0, PT_R7(sp)
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 5573f8e4e326..3f4179283207 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -66,9 +66,9 @@ NESTED(handle_sys64, PT_SIZE, sp)
         sd      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        ld      t1, PT_R2(sp)           # syscall number
         dnegu   v0                      # error
-        sd      v0, PT_R0(sp)           # set flag for syscall
-                                        # restarting
+        sd      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sd      v0, PT_R2(sp)           # result
 
 n64_syscall_exit:
@@ -109,8 +109,9 @@ syscall_trace_entry:
         sd      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        ld      t1, PT_R2(sp)           # syscall number
         dnegu   v0                      # error
-        sd      v0, PT_R0(sp)           # set flag for syscall restarting
+        sd      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sd      v0, PT_R2(sp)           # result
 
         j       syscall_exit
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 1e38ec97672e..38b226938db3 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -65,8 +65,9 @@ NESTED(handle_sysn32, PT_SIZE, sp)
         sd      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        ld      t1, PT_R2(sp)           # syscall number
         dnegu   v0                      # error
-        sd      v0, PT_R0(sp)           # set flag for syscall restarting
+        sd      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sd      v0, PT_R2(sp)           # result
 
         local_irq_disable               # make sure need_resched and
@@ -106,8 +107,9 @@ n32_syscall_trace_entry:
         sd      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        ld      t1, PT_R2(sp)           # syscall number
         dnegu   v0                      # error
-        sd      v0, PT_R0(sp)           # set flag for syscall restarting
+        sd      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sd      v0, PT_R2(sp)           # result
 
         j       syscall_exit
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 171979fc98e5..42fe14b52a33 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -93,8 +93,9 @@ NESTED(handle_sys, PT_SIZE, sp)
         sd      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        ld      t1, PT_R2(sp)           # syscall number
         dnegu   v0                      # error
-        sd      v0, PT_R0(sp)           # flag for syscall restarting
+        sd      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sd      v0, PT_R2(sp)           # result
 
 o32_syscall_exit:
@@ -142,8 +143,9 @@ trace_a_syscall:
         sd      t0, PT_R7(sp)           # set error flag
         beqz    t0, 1f
 
+        ld      t1, PT_R2(sp)           # syscall number
         dnegu   v0                      # error
-        sd      v0, PT_R0(sp)           # set flag for syscall restarting
+        sd      t1, PT_R0(sp)           # save it for syscall restarting
 1:      sd      v0, PT_R2(sp)           # result
 
         j       syscall_exit
@@ -154,8 +156,7 @@ trace_a_syscall:
          * The stackpointer for a call with more than 4 arguments is bad.
          */
 bad_stack:
-        dnegu   v0                      # error
-        sd      v0, PT_R0(sp)
+        li      v0, EFAULT
         sd      v0, PT_R2(sp)
         li      t0, 1                   # set error flag
         sd      t0, PT_R7(sp)
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 2099d5a4c4b7..5922342bca39 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -390,7 +390,6 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct rt_sigframe __user *frame;
         sigset_t set;
-        stack_t st;
         int sig;
 
         frame = (struct rt_sigframe __user *) regs.regs[29];
@@ -411,11 +410,9 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         else if (sig)
                 force_sig(sig, current);
 
-        if (__copy_from_user(&st, &frame->rs_uc.uc_stack, sizeof(st)))
-                goto badframe;
         /* It is more difficult to avoid calling this function than to
            call it and ignore errors.  */
-        do_sigaltstack((stack_t __user *)&st, NULL, regs.regs[29]);
+        do_sigaltstack(&frame->rs_uc.uc_stack, NULL, regs.regs[29]);
 
         /*
          * Don't let your children do this ...
@@ -550,23 +547,26 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
         struct mips_abi *abi = current->thread.abi;
         void *vdso = current->mm->context.vdso;
 
-        switch(regs->regs[0]) {
-        case ERESTART_RESTARTBLOCK:
-        case ERESTARTNOHAND:
-                regs->regs[2] = EINTR;
-                break;
-        case ERESTARTSYS:
-                if (!(ka->sa.sa_flags & SA_RESTART)) {
+        if (regs->regs[0]) {
+                switch(regs->regs[2]) {
+                case ERESTART_RESTARTBLOCK:
+                case ERESTARTNOHAND:
                         regs->regs[2] = EINTR;
                         break;
+                case ERESTARTSYS:
+                        if (!(ka->sa.sa_flags & SA_RESTART)) {
+                                regs->regs[2] = EINTR;
+                                break;
+                        }
+                /* fallthrough */
+                case ERESTARTNOINTR:
+                        regs->regs[7] = regs->regs[26];
+                        regs->regs[2] = regs->regs[0];
+                        regs->cp0_epc -= 4;
                 }
-        /* fallthrough */
-        case ERESTARTNOINTR:            /* Userland will reload $v0.  */
-                regs->regs[7] = regs->regs[26];
-                regs->cp0_epc -= 8;
-        }
 
-        regs->regs[0] = 0;              /* Don't deal with this again.  */
+                regs->regs[0] = 0;              /* Don't deal with this again.  */
+        }
 
         if (sig_uses_siginfo(ka))
                 ret = abi->setup_rt_frame(vdso + abi->rt_signal_return_offset,
@@ -575,6 +575,9 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
                 ret = abi->setup_frame(vdso + abi->signal_return_offset,
                                        ka, regs, sig, oldset);
 
+        if (ret)
+                return ret;
+
         spin_lock_irq(&current->sighand->siglock);
         sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
         if (!(ka->sa.sa_flags & SA_NODEFER))
@@ -622,17 +625,13 @@ static void do_signal(struct pt_regs *regs)
                 return;
         }
 
-        /*
-         * Who's code doesn't conform to the restartable syscall convention
-         * dies here!!!  The li instruction, a single machine instruction,
-         * must directly be followed by the syscall instruction.
-         */
         if (regs->regs[0]) {
                 if (regs->regs[2] == ERESTARTNOHAND ||
                     regs->regs[2] == ERESTARTSYS ||
                     regs->regs[2] == ERESTARTNOINTR) {
+                        regs->regs[2] = regs->regs[0];
                         regs->regs[7] = regs->regs[26];
-                        regs->cp0_epc -= 8;
+                        regs->cp0_epc -= 4;
                 }
                 if (regs->regs[2] == ERESTART_RESTARTBLOCK) {
                         regs->regs[2] = current->thread.abi->restart;
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index 2c5df818c65a..ee24d814d5b9 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -109,6 +109,7 @@ asmlinkage int sysn32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
 asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct rt_sigframe_n32 __user *frame;
+        mm_segment_t old_fs;
         sigset_t set;
         stack_t st;
         s32 sp;
@@ -143,7 +144,11 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
 
         /* It is more difficult to avoid calling this function than to
            call it and ignore errors.  */
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
         do_sigaltstack((stack_t __user *)&st, NULL, regs.regs[29]);
+        set_fs(old_fs);
+
 
         /*
          * Don't let your children do this ...
diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c
index 69b039ca8d83..33d5a5ce4a29 100644
--- a/arch/mips/kernel/unaligned.c
+++ b/arch/mips/kernel/unaligned.c
@@ -109,8 +109,6 @@ static void emulate_load_store_insn(struct pt_regs *regs,
         unsigned long value;
         unsigned int res;
 
-        regs->regs[0] = 0;
-
         /*
          * This load never faults.
          */
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 1b05896648bc..9dcb17d51aee 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2840,7 +2840,7 @@ static int __devinit pci_probe(struct pci_dev *dev,
                                const struct pci_device_id *ent)
 {
         struct fw_ohci *ohci;
-        u32 bus_options, max_receive, link_speed, version, link_enh;
+        u32 bus_options, max_receive, link_speed, version;
         u64 guid;
         int i, err, n_ir, n_it;
         size_t size;
@@ -2894,23 +2894,6 @@ static int __devinit pci_probe(struct pci_dev *dev,
         if (param_quirks)
                 ohci->quirks = param_quirks;
 
-        /* TI OHCI-Lynx and compatible: set recommended configuration bits. */
-        if (dev->vendor == PCI_VENDOR_ID_TI) {
-                pci_read_config_dword(dev, PCI_CFG_TI_LinkEnh, &link_enh);
-
-                /* adjust latency of ATx FIFO: use 1.7 KB threshold */
-                link_enh &= ~TI_LinkEnh_atx_thresh_mask;
-                link_enh |= TI_LinkEnh_atx_thresh_1_7K;
-
-                /* use priority arbitration for asynchronous responses */
-                link_enh |= TI_LinkEnh_enab_unfair;
-
-                /* required for aPhyEnhanceEnable to work */
-                link_enh |= TI_LinkEnh_enab_accel;
-
-                pci_write_config_dword(dev, PCI_CFG_TI_LinkEnh, link_enh);
-        }
-
         ar_context_init(&ohci->ar_request_ctx, ohci,
                         OHCI1394_AsReqRcvContextControlSet);
 
diff --git a/drivers/firewire/ohci.h b/drivers/firewire/ohci.h
index 0e6c5a466908..ef5e7336da68 100644
--- a/drivers/firewire/ohci.h
+++ b/drivers/firewire/ohci.h
@@ -155,12 +155,4 @@
 
 #define OHCI1394_phy_tcode              0xe
 
-/* TI extensions */
-
-#define PCI_CFG_TI_LinkEnh              0xf4
-#define  TI_LinkEnh_enab_accel          0x00000002
-#define  TI_LinkEnh_enab_unfair         0x00000080
-#define  TI_LinkEnh_atx_thresh_mask     0x00003000
-#define  TI_LinkEnh_atx_thresh_1_7K     0x00001000
-
 #endif /* _FIREWIRE_OHCI_H */
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index b8feac5f2ef4..5795c8398c7c 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -331,21 +331,16 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
         INIT_COMPLETION(dev->cmd_complete);
         dev->cmd_err = 0;
 
-        /* Take I2C out of reset, configure it as master and set the
-         * start bit */
-        flag = DAVINCI_I2C_MDR_IRS | DAVINCI_I2C_MDR_MST | DAVINCI_I2C_MDR_STT;
+        /* Take I2C out of reset and configure it as master */
+        flag = DAVINCI_I2C_MDR_IRS | DAVINCI_I2C_MDR_MST;
 
         /* if the slave address is ten bit address, enable XA bit */
         if (msg->flags & I2C_M_TEN)
                 flag |= DAVINCI_I2C_MDR_XA;
         if (!(msg->flags & I2C_M_RD))
                 flag |= DAVINCI_I2C_MDR_TRX;
-        if (stop)
-                flag |= DAVINCI_I2C_MDR_STP;
-        if (msg->len == 0) {
+        if (msg->len == 0)
                 flag |= DAVINCI_I2C_MDR_RM;
-                flag &= ~DAVINCI_I2C_MDR_STP;
-        }
 
         /* Enable receive or transmit interrupts */
         w = davinci_i2c_read_reg(dev, DAVINCI_I2C_IMR_REG);
@@ -358,17 +353,28 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
         dev->terminate = 0;
 
         /*
+         * Write mode register first as needed for correct behaviour
+         * on OMAP-L138, but don't set STT yet to avoid a race with XRDY
+         * occuring before we have loaded DXR
+         */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
+
+        /*
          * First byte should be set here, not after interrupt,
          * because transmit-data-ready interrupt can come before
          * NACK-interrupt during sending of previous message and
          * ICDXR may have wrong data
+         * It also saves us one interrupt, slightly faster
          */
         if ((!(msg->flags & I2C_M_RD)) && dev->buf_len) {
                 davinci_i2c_write_reg(dev, DAVINCI_I2C_DXR_REG, *dev->buf++);
                 dev->buf_len--;
         }
 
-        /* write the data into mode register; start transmitting */
+        /* Set STT to begin transmit now DXR is loaded */
+        flag |= DAVINCI_I2C_MDR_STT;
+        if (stop && msg->len != 0)
+                flag |= DAVINCI_I2C_MDR_STP;
         davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
 
         r = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index d1ff9408dc1f..4c2a62b75b5c 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -159,15 +159,9 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
 
 static int i2c_imx_trx_complete(struct imx_i2c_struct *i2c_imx)
 {
-        int result;
-
-        result = wait_event_interruptible_timeout(i2c_imx->queue,
-                i2c_imx->i2csr & I2SR_IIF, HZ / 10);
+        wait_event_timeout(i2c_imx->queue, i2c_imx->i2csr & I2SR_IIF, HZ / 10);
 
-        if (unlikely(result < 0)) {
-                dev_dbg(&i2c_imx->adapter.dev, "<%s> result < 0\n", __func__);
-                return result;
-        } else if (unlikely(!(i2c_imx->i2csr & I2SR_IIF))) {
+        if (unlikely(!(i2c_imx->i2csr & I2SR_IIF))) {
                 dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
                 return -ETIMEDOUT;
         }
@@ -295,7 +289,7 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
                 i2c_imx->i2csr = temp;
                 temp &= ~I2SR_IIF;
                 writeb(temp, i2c_imx->base + IMX_I2C_I2SR);
-                wake_up_interruptible(&i2c_imx->queue);
+                wake_up(&i2c_imx->queue);
                 return IRQ_HANDLED;
         }
 
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index c908c5f83645..9ddafc30f432 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -669,6 +669,9 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 
                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
 
+                        if (!dev->absinfo)
+                                return -EINVAL;
+
                         t = _IOC_NR(cmd) & ABS_MAX;
                         abs = dev->absinfo[t];
 
@@ -680,10 +683,13 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                 }
         }
 
-        if (_IOC_DIR(cmd) == _IOC_READ) {
+        if (_IOC_DIR(cmd) == _IOC_WRITE) {
 
                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
 
+                        if (!dev->absinfo)
+                                return -EINVAL;
+
                         t = _IOC_NR(cmd) & ABS_MAX;
 
                         if (copy_from_user(&abs, p, min_t(size_t,
diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
index 073f01390cdd..86294ed35c9b 100644
--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -193,17 +193,24 @@ static int put_video_window32(struct video_window *kp, struct video_window32 __u
 struct video_code32 {
         char            loadwhat[16];   /* name or tag of file being passed */
         compat_int_t    datasize;
-        unsigned char   *data;
+        compat_uptr_t   data;
 };
 
-static int get_microcode32(struct video_code *kp, struct video_code32 __user *up)
+static struct video_code __user *get_microcode32(struct video_code32 *kp)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
-                copy_from_user(kp->loadwhat, up->loadwhat, sizeof(up->loadwhat)) ||
-                get_user(kp->datasize, &up->datasize) ||
-                copy_from_user(kp->data, up->data, up->datasize))
-                        return -EFAULT;
-        return 0;
+        struct video_code __user *up;
+
+        up = compat_alloc_user_space(sizeof(*up));
+
+        /*
+         * NOTE! We don't actually care if these fail. If the
+         * user address is invalid, the native ioctl will do
+         * the error handling for us
+         */
+        (void) copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat));
+        (void) put_user(kp->datasize, &up->datasize);
+        (void) put_user(compat_ptr(kp->data), &up->data);
+        return up;
 }
 
 #define VIDIOCGTUNER32          _IOWR('v', 4, struct video_tuner32)
@@ -739,7 +746,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
                 struct video_tuner vt;
                 struct video_buffer vb;
                 struct video_window vw;
-                struct video_code vc;
+                struct video_code32 vc;
                 struct video_audio va;
 #endif
                 struct v4l2_format v2f;
@@ -818,8 +825,11 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
                 break;
 
         case VIDIOCSMICROCODE:
-                err = get_microcode32(&karg.vc, up);
-                compatible_arg = 0;
+                /* Copy the 32-bit "video_code32" to kernel space */
+                if (copy_from_user(&karg.vc, up, sizeof(karg.vc)))
+                        return -EFAULT;
+                /* Convert the 32-bit version to a 64-bit version in user space */
+                up = get_microcode32(&karg.vc);
                 break;
 
         case VIDIOCSFREQ:
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index b2828e84d243..214b03afdd48 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -30,6 +30,8 @@
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/completion.h>
 
 #include <asm/mach/flash.h>
 #include <mach/mxc_nand.h>
@@ -151,7 +153,7 @@ struct mxc_nand_host {
         int                     irq;
         int                     eccsize;
 
-        wait_queue_head_t       irq_waitq;
+        struct completion       op_completion;
 
         uint8_t                 *data_buf;
         unsigned int            buf_start;
@@ -164,6 +166,7 @@ struct mxc_nand_host {
         void                    (*send_read_id)(struct mxc_nand_host *);
         uint16_t                (*get_dev_status)(struct mxc_nand_host *);
         int                     (*check_int)(struct mxc_nand_host *);
+        void                    (*irq_control)(struct mxc_nand_host *, int);
 };
 
 /* OOB placement block for use with hardware ecc generation */
@@ -216,9 +219,12 @@ static irqreturn_t mxc_nfc_irq(int irq, void *dev_id)
 {
         struct mxc_nand_host *host = dev_id;
 
-        disable_irq_nosync(irq);
+        if (!host->check_int(host))
+                return IRQ_NONE;
 
-        wake_up(&host->irq_waitq);
+        host->irq_control(host, 0);
+
+        complete(&host->op_completion);
 
         return IRQ_HANDLED;
 }
@@ -245,11 +251,54 @@ static int check_int_v1_v2(struct mxc_nand_host *host)
         if (!(tmp & NFC_V1_V2_CONFIG2_INT))
                 return 0;
 
-        writew(tmp & ~NFC_V1_V2_CONFIG2_INT, NFC_V1_V2_CONFIG2);
+        if (!cpu_is_mx21())
+                writew(tmp & ~NFC_V1_V2_CONFIG2_INT, NFC_V1_V2_CONFIG2);
 
         return 1;
 }
 
+/*
+ * It has been observed that the i.MX21 cannot read the CONFIG2:INT bit
+ * if interrupts are masked (CONFIG1:INT_MSK is set). To handle this, the
+ * driver can enable/disable the irq line rather than simply masking the
+ * interrupts.
+ */
+static void irq_control_mx21(struct mxc_nand_host *host, int activate)
+{
+        if (activate)
+                enable_irq(host->irq);
+        else
+                disable_irq_nosync(host->irq);
+}
+
+static void irq_control_v1_v2(struct mxc_nand_host *host, int activate)
+{
+        uint16_t tmp;
+
+        tmp = readw(NFC_V1_V2_CONFIG1);
+
+        if (activate)
+                tmp &= ~NFC_V1_V2_CONFIG1_INT_MSK;
+        else
+                tmp |= NFC_V1_V2_CONFIG1_INT_MSK;
+
+        writew(tmp, NFC_V1_V2_CONFIG1);
+}
+
+static void irq_control_v3(struct mxc_nand_host *host, int activate)
+{
+        uint32_t tmp;
+
+        tmp = readl(NFC_V3_CONFIG2);
+
+        if (activate)
+                tmp &= ~NFC_V3_CONFIG2_INT_MSK;
+        else
+                tmp |= NFC_V3_CONFIG2_INT_MSK;
+
+        writel(tmp, NFC_V3_CONFIG2);
+}
+
 /* This function polls the NANDFC to wait for the basic operation to
  * complete by checking the INT bit of config2 register.
  */
@@ -259,10 +308,9 @@ static void wait_op_done(struct mxc_nand_host *host, int useirq)
 
         if (useirq) {
                 if (!host->check_int(host)) {
-
-                        enable_irq(host->irq);
-
-                        wait_event(host->irq_waitq, host->check_int(host));
+                        INIT_COMPLETION(host->op_completion);
+                        host->irq_control(host, 1);
+                        wait_for_completion(&host->op_completion);
                 }
         } else {
                 while (max_retries-- > 0) {
@@ -799,6 +847,7 @@ static void preset_v3(struct mtd_info *mtd)
                 NFC_V3_CONFIG2_2CMD_PHASES |
                 NFC_V3_CONFIG2_SPAS(mtd->oobsize >> 1) |
                 NFC_V3_CONFIG2_ST_CMD(0x70) |
+                NFC_V3_CONFIG2_INT_MSK |
                 NFC_V3_CONFIG2_NUM_ADDR_PHASE0;
 
         if (chip->ecc.mode == NAND_ECC_HW)
@@ -1024,6 +1073,10 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                 host->send_read_id = send_read_id_v1_v2;
                 host->get_dev_status = get_dev_status_v1_v2;
                 host->check_int = check_int_v1_v2;
+                if (cpu_is_mx21())
+                        host->irq_control = irq_control_mx21;
+                else
+                        host->irq_control = irq_control_v1_v2;
         }
 
         if (nfc_is_v21()) {
@@ -1062,6 +1115,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                 host->send_read_id = send_read_id_v3;
                 host->check_int = check_int_v3;
                 host->get_dev_status = get_dev_status_v3;
+                host->irq_control = irq_control_v3;
                 oob_smallpage = &nandv2_hw_eccoob_smallpage;
                 oob_largepage = &nandv2_hw_eccoob_largepage;
         } else
@@ -1093,14 +1147,34 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                 this->options |= NAND_USE_FLASH_BBT;
         }
 
-        init_waitqueue_head(&host->irq_waitq);
+        init_completion(&host->op_completion);
 
         host->irq = platform_get_irq(pdev, 0);
 
+        /*
+         * mask the interrupt. For i.MX21 explicitely call
+         * irq_control_v1_v2 to use the mask bit. We can't call
+         * disable_irq_nosync() for an interrupt we do not own yet.
+         */
+        if (cpu_is_mx21())
+                irq_control_v1_v2(host, 0);
+        else
+                host->irq_control(host, 0);
+
         err = request_irq(host->irq, mxc_nfc_irq, IRQF_DISABLED, DRIVER_NAME, host);
         if (err)
                 goto eirq;
 
+        host->irq_control(host, 0);
+
+        /*
+         * Now that the interrupt is disabled make sure the interrupt
+         * mask bit is cleared on i.MX21. Otherwise we can't read
+         * the interrupt status bit on this machine.
+         */
+        if (cpu_is_mx21())
+                irq_control_v1_v2(host, 1);
+
         /* first scan to find the device and get the page size */
         if (nand_scan_ident(mtd, 1, NULL)) {
                 err = -ENXIO;
diff --git a/net/rds/page.c b/net/rds/page.c
index 595a952d4b17..1dfbfea12e9b 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -57,30 +57,17 @@ int rds_page_copy_user(struct page *page, unsigned long offset,
         unsigned long ret;
         void *addr;
 
-        if (to_user)
+        addr = kmap(page);
+        if (to_user) {
                 rds_stats_add(s_copy_to_user, bytes);
-        else
+                ret = copy_to_user(ptr, addr + offset, bytes);
+        } else {
                 rds_stats_add(s_copy_from_user, bytes);
-
-        addr = kmap_atomic(page, KM_USER0);
-        if (to_user)
-                ret = __copy_to_user_inatomic(ptr, addr + offset, bytes);
-        else
-                ret = __copy_from_user_inatomic(addr + offset, ptr, bytes);
-        kunmap_atomic(addr, KM_USER0);
-
-        if (ret) {
-                addr = kmap(page);
-                if (to_user)
-                        ret = copy_to_user(ptr, addr + offset, bytes);
-                else
-                        ret = copy_from_user(addr + offset, ptr, bytes);
-                kunmap(page);
-                if (ret)
-                        return -EFAULT;
+                ret = copy_from_user(addr + offset, ptr, bytes);
         }
+        kunmap(page);
 
-        return 0;
+        return ret ? -EFAULT : 0;
 }
 EXPORT_SYMBOL_GPL(rds_page_copy_user);