202 files changed, 1672 insertions, 1547 deletions
diff --git a/CREDITS b/CREDITS
index 75c5ce82720c..ae08e4c10ed4 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3279,7 +3279,7 @@ S: Sevilla 41005
 S: Spain
 N: Linus Torvalds
-E: torvalds@osdl.org
+E: torvalds@linux-foundation.org
 D: Original kernel hacker
 S: 12725 SW Millikan Way, Suite 400
 S: Beaverton, Oregon 97005
diff --git a/Documentation/SubmitChecklist b/Documentation/SubmitChecklist
index 2270efa10153..bfbb2718a279 100644
--- a/Documentation/SubmitChecklist
+++ b/Documentation/SubmitChecklist
@@ -72,3 +72,7 @@ kernel patches.
    If the new code is substantial, addition of subsystem-specific fault
    injection might be appropriate.
+22: Newly-added code has been compiled with `gcc -W'.  This will generate
+    lots of noise, but is good for finding bugs like "warning: comparison
+    between signed and unsigned".
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 302d148c2e18..b0d0043f7c46 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -134,9 +134,9 @@ Do not send more than 15 patches at once to the vger mailing lists!!!
 Linus Torvalds is the final arbiter of all changes accepted into the
-Linux kernel.  His e-mail address is <torvalds@osdl.org>.  He gets
+Linux kernel.  His e-mail address is <torvalds@linux-foundation.org>. 
-a lot of e-mail, so typically you should do your best to -avoid- sending
+He gets a lot of e-mail, so typically you should do your best to -avoid-
-him e-mail.
+sending him e-mail. 
 Patches which are bug fixes, are "obvious" changes, or similarly
 require little discussion should be sent or CC'd to Linus.  Patches
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index fc532395d116..0ba6af02cdaf 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -318,3 +318,10 @@ Why:	/proc/acpi/button has been replaced by events to the input layer
 Who:    Len Brown <len.brown@intel.com>
 ---------------------------
+What:   JFFS (version 1)
+When:   2.6.21
+Why:    Unmaintained for years, superceded by JFFS2 for years.
+Who:    Jeff Garzik <jeff@garzik.org>
+---------------------------
diff --git a/Documentation/filesystems/9p.txt b/Documentation/filesystems/9p.txt
index 43b89c214d20..4d075a4558f9 100644
--- a/Documentation/filesystems/9p.txt
+++ b/Documentation/filesystems/9p.txt
@@ -73,8 +73,22 @@ OPTIONS
 RESOURCES
 =========
-The Linux version of the 9p server is now maintained under the npfs project
+Our current recommendation is to use Inferno (http://www.vitanuova.com/inferno)
-on sourceforge (http://sourceforge.net/projects/npfs).
+as the 9p server.  You can start a 9p server under Inferno by issuing the
+following command:
+   ; styxlisten -A tcp!*!564 export '#U*'
+The -A specifies an unauthenticated export.  The 564 is the port # (you may
+have to choose a higher port number if running as a normal user).  The '#U*'
+specifies exporting the root of the Linux name space.  You may specify a
+subset of the namespace by extending the path: '#U*'/tmp would just export
+/tmp.  For more information, see the Inferno manual pages covering styxlisten
+and export.
+A Linux version of the 9p server is now maintained under the npfs project
+on sourceforge (http://sourceforge.net/projects/npfs).  There is also a
+more stable single-threaded version of the server (named spfs) available from
+the same CVS repository.
 There are user and developer mailing lists available through the v9fs project
 on sourceforge (http://sourceforge.net/projects/v9fs).
@@ -96,5 +110,5 @@ STATUS
 The 2.6 kernel support is working on PPC and x86.
-PLEASE USE THE SOURCEFORGE BUG-TRACKER TO REPORT PROBLEMS.
+PLEASE USE THE KERNEL BUGZILLA TO REPORT PROBLEMS. (http://bugzilla.kernel.org)
diff --git a/Documentation/i386/boot.txt b/Documentation/i386/boot.txt
index 9575de300a61..38fe1f03fb14 100644
--- a/Documentation/i386/boot.txt
+++ b/Documentation/i386/boot.txt
@@ -2,7 +2,7 @@
                     ----------------------------
                    H. Peter Anvin <hpa@zytor.com>
-                        Last update 2006-11-17
+                        Last update 2007-01-26
 On the i386 platform, the Linux kernel uses a rather complicated boot
 convention.  This has evolved partially due to historical aspects, as
@@ -186,6 +186,7 @@ filled out, however:
        7  GRuB
        8  U-BOOT
        9  Xen
+        A  Gujin
        Please contact <hpa@zytor.com> if you need a bootloader ID
        value assigned.
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 5af6676a88f0..073306818347 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -17,7 +17,7 @@ You can use common Linux commands, such as cp and scp, to copy the
 memory image to a dump file on the local disk, or across the network to
 a remote system.
-Kdump and kexec are currently supported on the x86, x86_64, ppc64 and IA64
+Kdump and kexec are currently supported on the x86, x86_64, ppc64 and ia64
 architectures.
 When the system kernel boots, it reserves a small section of memory for
@@ -61,7 +61,12 @@ Install kexec-tools
 2) Download the kexec-tools user-space package from the following URL:
-http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing-20061214.tar.gz
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing.tar.gz
+This is a symlink to the latest version, which at the time of writing is
+20061214, the only release of kexec-tools-testing so far. As other versions
+are made released, the older onese will remain available at
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/
 Note: Latest kexec-tools-testing git tree is available at
@@ -71,11 +76,11 @@ http://www.kernel.org/git/?p=linux/kernel/git/horms/kexec-tools-testing.git;a=su
 3) Unpack the tarball with the tar command, as follows:
-   tar xvpzf kexec-tools-testing-20061214.tar.gz
+   tar xvpzf kexec-tools-testing.tar.gz
-4) Change to the kexec-tools-1.101 directory, as follows:
+4) Change to the kexec-tools directory, as follows:
-   cd kexec-tools-testing-20061214
+   cd kexec-tools-testing-VERSION
 5) Configure the package, as follows:
@@ -224,7 +229,23 @@ Dump-capture kernel config options (Arch Dependent, ppc64)
 Dump-capture kernel config options (Arch Dependent, ia64)
 ----------------------------------------------------------
-(To be filled)
+- No specific options are required to create a dump-capture kernel
+  for ia64, other than those specified in the arch idependent section
+  above. This means that it is possible to use the system kernel
+  as a dump-capture kernel if desired.
+  The crashkernel region can be automatically placed by the system
+  kernel at run time. This is done by specifying the base address as 0,
+  or omitting it all together.
+  crashkernel=256M@0
+  or
+  crashkernel=256M
+  If the start address is specified, note that the start address of the
+  kernel will be aligned to 64Mb, so if the start address is not then
+  any space below the alignment point will be wasted.
 Boot into System Kernel
@@ -243,6 +264,10 @@ Boot into System Kernel
   On ppc64, use "crashkernel=128M@32M".
+   On ia64, 256M@256M is a generous value that typically works.
+   The region may be automatically placed on ia64, see the
+   dump-capture kernel config option notes above.
 Load the Dump-capture Kernel
 ============================
@@ -261,7 +286,8 @@ For x86_64:
 For ppc64:
        - Use vmlinux
 For ia64:
-        (To be filled)
+        - Use vmlinux or vmlinuz.gz
 If you are using a uncompressed vmlinux image then use following command
 to load dump-capture kernel.
@@ -277,18 +303,19 @@ to load dump-capture kernel.
   --initrd=<initrd-for-dump-capture-kernel> \
   --append="root=<root-dev> <arch-specific-options>"
+Please note, that --args-linux does not need to be specified for ia64.
+It is planned to make this a no-op on that architecture, but for now
+it should be omitted
 Following are the arch specific command line options to be used while
 loading dump-capture kernel.
-For i386 and x86_64:
+For i386, x86_64 and ia64:
        "init 1 irqpoll maxcpus=1"
 For ppc64:
        "init 1 maxcpus=1 noirqdistrib"
-For IA64
-        (To be filled)
 Notes on loading the dump-capture kernel:
diff --git a/Documentation/usb/CREDITS b/Documentation/usb/CREDITS
index 01e7f857ef35..27a721635f92 100644
--- a/Documentation/usb/CREDITS
+++ b/Documentation/usb/CREDITS
@@ -21,7 +21,7 @@ difficult to maintain, add yourself with a patch if desired.
  Bill Ryder <bryder@sgi.com>
  Thomas Sailer <sailer@ife.ee.ethz.ch>
  Gregory P. Smith <greg@electricrain.com>
-  Linus Torvalds <torvalds@osdl.org>
+  Linus Torvalds <torvalds@linux-foundation.org>
  Roman Weissgaerber <weissg@vienna.at>
  <Kazuki.Yasumatsu@fujixerox.co.jp>
diff --git a/MAINTAINERS b/MAINTAINERS
index b0e33617273d..f0596e452c5c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1137,9 +1137,9 @@ T:	git kernel.org:/pub/scm/linux/kernel/git/airlied/drm-2.6.git
 S:      Maintained
 DSCC4 DRIVER
-P:      Fran�ois Romieu
+P:      Francois Romieu
-M:      romieu@cogenit.fr
+M:      romieu@fr.zoreil.com
-M:      romieu@ensta.fr
+L:      netdev@vger.kernel.org
 S:      Maintained
 DVB SUBSYSTEM AND DRIVERS
@@ -1254,7 +1254,7 @@ S:	Maintained
 ETHERNET BRIDGE
 P:      Stephen Hemminger
-M:      shemminger@osdl.org
+M:      shemminger@linux-foundation.org
 L:      bridge@osdl.org
 W:      http://bridge.sourceforge.net/
 S:      Maintained
@@ -1928,11 +1928,10 @@ S:	Maintained
 KERNEL NFSD
 P:      Neil Brown
-M:      neilb@cse.unsw.edu.au
+M:      neilb@suse.de
 L:      nfs@lists.sourceforge.net
 W:      http://nfs.sourceforge.net/
-W:      http://www.cse.unsw.edu.au/~neilb/patches/linux-devel/
+S:      Supported
-S:      Maintained
 KERNEL VIRTUAL MACHINE (KVM)
 P:      Avi Kivity
@@ -2277,7 +2276,7 @@ S:	Maintained
 NETEM NETWORK EMULATOR
 P:      Stephen Hemminger
-M:      shemminger@osdl.org
+M:      shemminger@linux-foundation.org
 L:      netem@osdl.org
 S:      Maintained
@@ -2993,9 +2992,9 @@ SOFTWARE RAID (Multiple Disks) SUPPORT
 P:      Ingo Molnar
 M:      mingo@redhat.com
 P:      Neil Brown
-M:      neilb@cse.unsw.edu.au
+M:      neilb@suse.de
 L:      linux-raid@vger.kernel.org
-S:      Maintained
+S:      Supported
 SOFTWARE SUSPEND:
 P:      Pavel Machek
@@ -3081,7 +3080,7 @@ S:	Maintained
 SKGE, SKY2 10/100/1000 GIGABIT ETHERNET DRIVERS
 P:      Stephen Hemminger
-M:      shemminger@osdl.org
+M:      shemminger@linux-foundation.org
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -3575,6 +3574,12 @@ M:	khali@linux-fr.org
 L:      i2c@lm-sensors.org
 S:      Maintained
+VIA VELOCITY NETWORK DRIVER
+P:      Francois Romieu
+M:      romieu@fr.zoreil.com
+L:      netdev@vger.kernel.org
+S:      Maintained
 UCLINUX (AND M68KNOMMU)
 P:      Greg Ungerer
 M:      gerg@uclinux.org
diff --git a/Makefile b/Makefile
index 477f52e3c7f6..9e1adac8aa28 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 20
-EXTRAVERSION =-rc5
+EXTRAVERSION =-rc6
 NAME = Homicidal Dwarf Hamster
 # *DOCUMENTATION*
diff --git a/README b/README
index c05561523029..46a66c6e76df 100644
--- a/README
+++ b/README
@@ -278,8 +278,8 @@ IF SOMETHING GOES WRONG:
   the file MAINTAINERS to see if there is a particular person associated
   with the part of the kernel that you are having trouble with. If there
   isn't anyone listed there, then the second best thing is to mail
-   them to me (torvalds@osdl.org), and possibly to any other relevant
+   them to me (torvalds@linux-foundation.org), and possibly to any other
-   mailing-list or to the newsgroup.
+   relevant mailing-list or to the newsgroup.
 - In all bug-reports, *please* tell what kernel you are talking about,
   how to duplicate the problem, and what your setup is (use your common
diff --git a/arch/avr32/configs/atstk1002_defconfig b/arch/avr32/configs/atstk1002_defconfig
index ae92a14ef9a0..77dace9d54bc 100644
--- a/arch/avr32/configs/atstk1002_defconfig
+++ b/arch/avr32/configs/atstk1002_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.19-rc2
+# Linux kernel version: 2.6.20-rc6
-# Fri Oct 20 11:52:37 2006
+# Fri Jan 26 13:12:59 2007
 #
 CONFIG_AVR32=y
 CONFIG_GENERIC_HARDIRQS=y
@@ -9,6 +9,8 @@ CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_TIME=y
+# CONFIG_ARCH_HAS_ILOG2_U32 is not set
+# CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
@@ -36,6 +38,7 @@ CONFIG_TASK_DELAY_ACCT=y
 # CONFIG_UTS_NS is not set
 CONFIG_AUDIT=y
 # CONFIG_IKCONFIG is not set
+CONFIG_SYSFS_DEPRECATED=y
 CONFIG_RELAY=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -75,7 +78,9 @@ CONFIG_MODULE_UNLOAD=y
 # Block layer
 #
 CONFIG_BLOCK=y
+# CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_LSF is not set
 #
 # IO Schedulers
@@ -125,6 +130,7 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_OWNERSHIP_TRACE is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
 CONFIG_CMDLINE=""
@@ -182,6 +188,7 @@ CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
@@ -260,6 +267,7 @@ CONFIG_MTD_CMDLINE_PARTS=y
 # User Modules And Translation Layers
 #
 CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLKDEVS=y
 CONFIG_MTD_BLOCK=y
 # CONFIG_FTL is not set
 # CONFIG_NFTL is not set
@@ -355,7 +363,6 @@ CONFIG_BLK_DEV_INITRD=y
 #
 # Misc devices
 #
-# CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 #
@@ -405,11 +412,14 @@ CONFIG_TUN=m
 #
 # PHY device support
 #
+# CONFIG_PHYLIB is not set
 #
 # Ethernet (10 or 100Mbit)
 #
-# CONFIG_NET_ETHERNET is not set
+CONFIG_NET_ETHERNET=y
+CONFIG_MII=y
+CONFIG_MACB=y
 #
 # Ethernet (1000 Mbit)
@@ -505,10 +515,6 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
-#
-# Ftape, the floppy tape device driver
-#
 # CONFIG_RAW_DRIVER is not set
 #
@@ -621,6 +627,10 @@ CONFIG_UNIX98_PTYS=y
 #
 #
+# Virtualization
+#
+#
 # File systems
 #
 CONFIG_EXT2_FS=m
@@ -683,7 +693,6 @@ CONFIG_CONFIGFS_FS=m
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
-# CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
 CONFIG_JFFS2_FS_WRITEBUFFER=y
@@ -763,6 +772,11 @@ CONFIG_NLS_ISO8859_1=m
 CONFIG_NLS_UTF8=m
 #
+# Distributed Lock Manager
+#
+# CONFIG_DLM is not set
+#
 # Kernel hacking
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
@@ -770,6 +784,8 @@ CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_DETECT_SOFTLOCKUP=y
@@ -785,13 +801,10 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
-CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
 # CONFIG_DEBUG_LIST is not set
 CONFIG_FRAME_POINTER=y
-# CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
-# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_KPROBES is not set
@@ -809,6 +822,7 @@ CONFIG_FORCED_INLINING=y
 #
 # Library routines
 #
+CONFIG_BITREVERSE=y
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
@@ -817,3 +831,4 @@ CONFIG_AUDIT_GENERIC=y
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=y
 CONFIG_PLIST=y
+CONFIG_IOMAP_COPY=y
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index 7c4c76114bba..80f55f8dbf1c 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -29,6 +29,7 @@ EXPORT_SYMBOL(__avr32_asr64);
 */
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memcpy);
+EXPORT_SYMBOL(clear_page);
 /*
 * Userspace access stuff.
diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index 06461b8b715d..5e47683fc63a 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -302,12 +302,16 @@ sysenter_past_esp:
        pushl $(__USER_CS)
        CFI_ADJUST_CFA_OFFSET 4
        /*CFI_REL_OFFSET cs, 0*/
+#ifndef CONFIG_COMPAT_VDSO
        /*
         * Push current_thread_info()->sysenter_return to the stack.
         * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
         * pushed above; +8 corresponds to copy_thread's esp0 setting.
         */
        pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
+#else
+        pushl $SYSENTER_RETURN
+#endif
        CFI_ADJUST_CFA_OFFSET 4
        CFI_REL_OFFSET eip, 0
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index a5e34d655965..1a6f8bb8881c 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -310,13 +310,7 @@ static int __init setup_nmi_watchdog(char *str)
        if ((nmi >= NMI_INVALID) || (nmi < NMI_NONE))
                return 0;
-        /*
-         * If any other x86 CPU has a local APIC, then
-         * please test the NMI stuff there and send me the
-         * missing bits. Right now Intel P6/P4 and AMD K7 only.
-         */
-        if ((nmi == NMI_LOCAL_APIC) && (nmi_known_cpu() == 0))
-                return 0;  /* no lapic support */
        nmi_watchdog = nmi;
        return 1;
 }
diff --git a/arch/i386/kernel/paravirt.c b/arch/i386/kernel/paravirt.c
index 3dceab5828f1..e55fd05da0f5 100644
--- a/arch/i386/kernel/paravirt.c
+++ b/arch/i386/kernel/paravirt.c
@@ -566,4 +566,11 @@ struct paravirt_ops paravirt_ops = {
        .irq_enable_sysexit = native_irq_enable_sysexit,
        .iret = native_iret,
 };
-EXPORT_SYMBOL(paravirt_ops);
+/*
+ * NOTE: CONFIG_PARAVIRT is experimental and the paravirt_ops
+ * semantics are subject to change. Hence we only do this
+ * internal-only export of this, until it gets sorted out and
+ * all lowlevel CPU ops used by modules are separately exported.
+ */
+EXPORT_SYMBOL_GPL(paravirt_ops);
diff --git a/arch/i386/kernel/sysenter.c b/arch/i386/kernel/sysenter.c
index 7de9117b5a3a..5da744204d10 100644
--- a/arch/i386/kernel/sysenter.c
+++ b/arch/i386/kernel/sysenter.c
@@ -79,11 +79,6 @@ int __init sysenter_setup(void)
 #ifdef CONFIG_COMPAT_VDSO
        __set_fixmap(FIX_VDSO, __pa(syscall_page), PAGE_READONLY);
        printk("Compat vDSO mapped to %08lx.\n", __fix_to_virt(FIX_VDSO));
-#else
-        /*
-         * In the non-compat case the ELF coredumping code needs the fixmap:
-         */
-        __set_fixmap(FIX_VDSO, __pa(syscall_page), PAGE_KERNEL_RO);
 #endif
        if (!boot_cpu_has(X86_FEATURE_SEP)) {
@@ -100,6 +95,7 @@ int __init sysenter_setup(void)
        return 0;
 }
+#ifndef CONFIG_COMPAT_VDSO
 static struct page *syscall_nopage(struct vm_area_struct *vma,
                                unsigned long adr, int *type)
 {
@@ -146,6 +142,13 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int exstack)
        vma->vm_end = addr + PAGE_SIZE;
        /* MAYWRITE to allow gdb to COW and set breakpoints */
        vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYWRITE;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        vma->vm_flags |= VM_ALWAYSDUMP;
        vma->vm_flags |= mm->def_flags;
        vma->vm_page_prot = protection_map[vma->vm_flags & 7];
        vma->vm_ops = &syscall_vm_ops;
@@ -187,3 +190,4 @@ int in_gate_area_no_task(unsigned long addr)
 {
        return 0;
 }
+#endif
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index fd2ff0698a85..bbd386f572d9 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1568,6 +1568,20 @@ config MIPS_MT_FPAFF
        depends on MIPS_MT
        default y
+config MIPS_MT_SMTC_INSTANT_REPLAY
+        bool "Low-latency Dispatch of Deferred SMTC IPIs"
+        depends on MIPS_MT_SMTC
+        default y
+        help
+          SMTC pseudo-interrupts between TCs are deferred and queued
+          if the target TC is interrupt-inhibited (IXMT). In the first
+          SMTC prototypes, these queued IPIs were serviced on return
+          to user mode, or on entry into the kernel idle loop. The
+          INSTANT_REPLAY option dispatches them as part of local_irq_restore()
+          processing, which adds runtime overhead (hence the option to turn
+          it off), but ensures that IPIs are handled promptly even under
+          heavy I/O interrupt load.
 config MIPS_VPE_LOADER_TOM
        bool "Load VPE program into memory hidden from linux"
        depends on MIPS_VPE_LOADER
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index d1b026a0337d..c68b5d3e5d18 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -623,7 +623,7 @@ LDFLAGS			+= -m $(ld-emul)
 ifdef CONFIG_MIPS
 CHECKFLAGS += $(shell $(CC) $(CFLAGS) -dM -E -xc /dev/null | \
-        egrep -vw '__GNUC_(MAJOR|MINOR|PATCHLEVEL)__' | \
+        egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
        sed -e 's/^\#define /-D/' -e "s/ /='/" -e "s/$$/'/")
 ifdef CONFIG_64BIT
 CHECKFLAGS              += -m64
diff --git a/arch/mips/dec/prom/memory.c b/arch/mips/dec/prom/memory.c
index 3027ce782797..3aa01d268f2d 100644
--- a/arch/mips/dec/prom/memory.c
+++ b/arch/mips/dec/prom/memory.c
@@ -122,7 +122,7 @@ unsigned long __init prom_free_prom_memory(void)
                addr += PAGE_SIZE;
        }
-        printk("Freeing unused PROM memory: %ldk freed\n",
+        printk("Freeing unused PROM memory: %ldkb freed\n",
               (end - PAGE_SIZE) >> 10);
        return end - PAGE_SIZE;
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index a8b387197d5b..6a857bf030b0 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 #include <asm/cpu.h>
 #include <asm/processor.h>
@@ -270,9 +271,12 @@ void smtc_configure_tlb(void)
                 * of their initialization in smtc_cpu_setup().
                 */
-                tlbsiz = tlbsiz & 0x3f; /* MIPS32 limits TLB indices to 64 */
+                /* MIPS32 limits TLB indices to 64 */
-                cpu_data[0].tlbsize = tlbsiz;
+                if (tlbsiz > 64)
+                        tlbsiz = 64;
+                cpu_data[0].tlbsize = current_cpu_data.tlbsize = tlbsiz;
                smtc_status |= SMTC_TLB_SHARED;
+                local_flush_tlb_all();
                printk("TLB of %d entry pairs shared by %d VPEs\n",
                        tlbsiz, vpes);
@@ -1017,6 +1021,35 @@ void setup_cross_vpe_interrupts(void)
 * SMTC-specific hacks invoked from elsewhere in the kernel.
 */
+void smtc_ipi_replay(void)
+{
+        /*
+         * To the extent that we've ever turned interrupts off,
+         * we may have accumulated deferred IPIs.  This is subtle.
+         * If we use the smtc_ipi_qdepth() macro, we'll get an
+         * exact number - but we'll also disable interrupts
+         * and create a window of failure where a new IPI gets
+         * queued after we test the depth but before we re-enable
+         * interrupts. So long as IXMT never gets set, however,
+         * we should be OK:  If we pick up something and dispatch
+         * it here, that's great. If we see nothing, but concurrent
+         * with this operation, another TC sends us an IPI, IXMT
+         * is clear, and we'll handle it as a real pseudo-interrupt
+         * and not a pseudo-pseudo interrupt.
+         */
+        if (IPIQ[smp_processor_id()].depth > 0) {
+                struct smtc_ipi *pipi;
+                extern void self_ipi(struct smtc_ipi *);
+                while ((pipi = smtc_ipi_dq(&IPIQ[smp_processor_id()]))) {
+                        self_ipi(pipi);
+                        smtc_cpu_stats[smp_processor_id()].selfipis++;
+                }
+        }
+}
+EXPORT_SYMBOL(smtc_ipi_replay);
 void smtc_idle_loop_hook(void)
 {
 #ifdef SMTC_IDLE_HOOK_DEBUG
@@ -1113,29 +1146,14 @@ void smtc_idle_loop_hook(void)
        if (pdb_msg != &id_ho_db_msg[0])
                printk("CPU%d: %s", smp_processor_id(), id_ho_db_msg);
 #endif /* SMTC_IDLE_HOOK_DEBUG */
        /*
-         * To the extent that we've ever turned interrupts off,
+         * Replay any accumulated deferred IPIs. If "Instant Replay"
-         * we may have accumulated deferred IPIs.  This is subtle.
+         * is in use, there should never be any.
-         * If we use the smtc_ipi_qdepth() macro, we'll get an
-         * exact number - but we'll also disable interrupts
-         * and create a window of failure where a new IPI gets
-         * queued after we test the depth but before we re-enable
-         * interrupts. So long as IXMT never gets set, however,
-         * we should be OK:  If we pick up something and dispatch
-         * it here, that's great. If we see nothing, but concurrent
-         * with this operation, another TC sends us an IPI, IXMT
-         * is clear, and we'll handle it as a real pseudo-interrupt
-         * and not a pseudo-pseudo interrupt.
         */
-        if (IPIQ[smp_processor_id()].depth > 0) {
+#ifndef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
-                struct smtc_ipi *pipi;
+        smtc_ipi_replay();
-                extern void self_ipi(struct smtc_ipi *);
+#endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
-                if ((pipi = smtc_ipi_dq(&IPIQ[smp_processor_id()])) != NULL) {
-                        self_ipi(pipi);
-                        smtc_cpu_stats[smp_processor_id()].selfipis++;
-                }
-        }
 }
 void smtc_soft_dump(void)
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 666bef484dcb..458fccf87c54 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -139,13 +139,16 @@ struct tc {
        struct list_head list;
 };
-struct vpecontrol_ {
+struct {
        /* Virtual processing elements */
        struct list_head vpe_list;
        /* Thread contexts */
        struct list_head tc_list;
-} vpecontrol;
+} vpecontrol = {
+        .vpe_list = LIST_HEAD_INIT(vpecontrol.vpe_list),
+        .tc_list = LIST_HEAD_INIT(vpecontrol.tc_list)
+};
 static void release_progmem(void *ptr);
 /* static __attribute_used__ void dump_vpe(struct vpe * v); */
@@ -1388,8 +1391,6 @@ static int __init vpe_module_init(void)
        /* dump_mtregs(); */
-        INIT_LIST_HEAD(&vpecontrol.vpe_list);
-        INIT_LIST_HEAD(&vpecontrol.tc_list);
        val = read_c0_mvpconf0();
        for (i = 0; i < ((val & MVPCONF0_PTC) + 1); i++) {
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 30245c09d025..49065c133ebf 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -501,7 +501,8 @@ void free_initmem(void)
        freed = prom_free_prom_memory();
        if (freed)
-                printk(KERN_INFO "Freeing firmware memory: %ldk freed\n",freed);
+                printk(KERN_INFO "Freeing firmware memory: %ldkb freed\n",
+                       freed >> 10);
        free_init_pages("unused kernel memory",
                        __pa_symbol(&__init_begin),
diff --git a/arch/mips/vr41xx/common/irq.c b/arch/mips/vr41xx/common/irq.c
index 397ba94cd7ec..16decf4ac2f4 100644
--- a/arch/mips/vr41xx/common/irq.c
+++ b/arch/mips/vr41xx/common/irq.c
@@ -1,7 +1,7 @@
 /*
 *  Interrupt handing routines for NEC VR4100 series.
 *
- *  Copyright (C) 2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *  Copyright (C) 2005-2007  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
@@ -73,13 +73,19 @@ static void irq_dispatch(unsigned int irq)
        if (cascade->get_irq != NULL) {
                unsigned int source_irq = irq;
                desc = irq_desc + source_irq;
-                desc->chip->ack(source_irq);
+                if (desc->chip->mask_ack)
+                        desc->chip->mask_ack(source_irq);
+                else {
+                        desc->chip->mask(source_irq);
+                        desc->chip->ack(source_irq);
+                }
                irq = cascade->get_irq(irq);
                if (irq < 0)
                        atomic_inc(&irq_err_count);
                else
                        irq_dispatch(irq);
-                desc->chip->end(source_irq);
+                if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
+                        desc->chip->unmask(source_irq);
        } else
                do_IRQ(irq);
 }
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index f4d1f31c14fa..d6abe495c6b0 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -484,6 +484,7 @@ config PPC_MAPLE
        select PPC_970_NAP
        select PPC_NATIVE
        select PPC_RTAS
+        select ATA_NONSTANDARD if ATA
        default n
        help
          This option enables support for the Maple 970FX Evaluation Board.
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index a4b28c73bba0..ae0ede19879d 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -284,6 +284,13 @@ int arch_setup_additional_pages(struct linux_binprm *bprm,
         * pages though
         */
        vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        vma->vm_flags |= VM_ALWAYSDUMP;
        vma->vm_flags |= mm->def_flags;
        vma->vm_page_prot = protection_map[vma->vm_flags & 0x7];
        vma->vm_ops = &vdso_vmops;
diff --git a/arch/sparc64/kernel/sun4v_tlb_miss.S b/arch/sparc64/kernel/sun4v_tlb_miss.S
index b731881224e8..9871dbb1ab42 100644
--- a/arch/sparc64/kernel/sun4v_tlb_miss.S
+++ b/arch/sparc64/kernel/sun4v_tlb_miss.S
@@ -142,9 +142,9 @@ sun4v_dtlb_prot:
        rdpr    %tl, %g1
        cmp     %g1, 1
        bgu,pn  %xcc, winfix_trampoline
-         nop
-        ba,pt   %xcc, sparc64_realfault_common
         mov    FAULT_CODE_DTLB | FAULT_CODE_WRITE, %g4
+        ba,pt   %xcc, sparc64_realfault_common
+         nop
        /* Called from trap table:
         * %g4: vaddr
diff --git a/arch/um/Kconfig.i386 b/arch/um/Kconfig.i386
index f191a550a079..77558a88a2fe 100644
--- a/arch/um/Kconfig.i386
+++ b/arch/um/Kconfig.i386
@@ -19,22 +19,22 @@ config SEMAPHORE_SLEEPERS
 choice
        prompt "Host memory split"
        default HOST_VMSPLIT_3G
-        ---help---
+        help
-           This is needed when the host kernel on which you run has a non-default
+        This is needed when the host kernel on which you run has a non-default
-           (like 2G/2G) memory split, instead of the customary 3G/1G. If you did
+        (like 2G/2G) memory split, instead of the customary 3G/1G. If you did
-           not recompile your own kernel but use the default distro's one, you can
+        not recompile your own kernel but use the default distro's one, you can
-           safely accept the "Default split" option.
+        safely accept the "Default split" option.
-           It can be enabled on recent (>=2.6.16-rc2) vanilla kernels via
+        It can be enabled on recent (>=2.6.16-rc2) vanilla kernels via
-           CONFIG_VM_SPLIT_*, or on previous kernels with special patches (-ck
+        CONFIG_VM_SPLIT_*, or on previous kernels with special patches (-ck
-           patchset by Con Kolivas, or other ones) - option names match closely the
+        patchset by Con Kolivas, or other ones) - option names match closely the
-           host CONFIG_VM_SPLIT_* ones.
+        host CONFIG_VM_SPLIT_* ones.
-           A lower setting (where 1G/3G is lowest and 3G/1G is higher) will
+        A lower setting (where 1G/3G is lowest and 3G/1G is higher) will
-           tolerate even more "normal" host kernels, but an higher setting will be
+        tolerate even more "normal" host kernels, but an higher setting will be
-           stricter.
+        stricter.
-           So, if you do not know what to do here, say 'Default split'.
+        So, if you do not know what to do here, say 'Default split'.
        config HOST_VMSPLIT_3G
                bool "Default split (3G/1G user/kernel host split)"
@@ -67,13 +67,13 @@ config 3_LEVEL_PGTABLES
 config STUB_CODE
        hex
-        default 0xbfffe000 if !HOST_2G_2G
+        default 0xbfffe000 if !HOST_VMSPLIT_2G
-        default 0x7fffe000 if HOST_2G_2G
+        default 0x7fffe000 if HOST_VMSPLIT_2G
 config STUB_DATA
        hex
-        default 0xbffff000 if !HOST_2G_2G
+        default 0xbffff000 if !HOST_VMSPLIT_2G
-        default 0x7ffff000 if HOST_2G_2G
+        default 0x7ffff000 if HOST_VMSPLIT_2G
 config STUB_START
        hex
diff --git a/arch/x86_64/ia32/ia32_binfmt.c b/arch/x86_64/ia32/ia32_binfmt.c
index 543ef4f405e9..5ce0bd486bbf 100644
--- a/arch/x86_64/ia32/ia32_binfmt.c
+++ b/arch/x86_64/ia32/ia32_binfmt.c
@@ -64,55 +64,6 @@ typedef unsigned int elf_greg_t;
 #define ELF_NGREG (sizeof (struct user_regs_struct32) / sizeof(elf_greg_t))
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
-/*
- * These macros parameterize elf_core_dump in fs/binfmt_elf.c to write out
- * extra segments containing the vsyscall DSO contents.  Dumping its
- * contents makes post-mortem fully interpretable later without matching up
- * the same kernel and hardware config to see what PC values meant.
- * Dumping its extra ELF program headers includes all the other information
- * a debugger needs to easily find how the vsyscall DSO was being used.
- */
-#define ELF_CORE_EXTRA_PHDRS    (find_vma(current->mm, VSYSCALL32_BASE) ?     \
-    (VSYSCALL32_EHDR->e_phnum) : 0)
-#define ELF_CORE_WRITE_EXTRA_PHDRS                                            \
-do {                                                                          \
-        if (find_vma(current->mm, VSYSCALL32_BASE)) {                         \
-                const struct elf32_phdr *const vsyscall_phdrs =               \
-                        (const struct elf32_phdr *) (VSYSCALL32_BASE          \
-                                                   + VSYSCALL32_EHDR->e_phoff);\
-                int i;                                                        \
-                Elf32_Off ofs = 0;                                            \
-                for (i = 0; i < VSYSCALL32_EHDR->e_phnum; ++i) {              \
-                        struct elf32_phdr phdr = vsyscall_phdrs[i];           \
-                        if (phdr.p_type == PT_LOAD) {                         \
-                                BUG_ON(ofs != 0);                             \
-                                ofs = phdr.p_offset = offset;                 \
-                                phdr.p_memsz = PAGE_ALIGN(phdr.p_memsz);      \
-                                phdr.p_filesz = phdr.p_memsz;                 \
-                                offset += phdr.p_filesz;                      \
-                        }                                                     \
-                        else                                                  \
-                                phdr.p_offset += ofs;                         \
-                        phdr.p_paddr = 0; /* match other core phdrs */        \
-                        DUMP_WRITE(&phdr, sizeof(phdr));                      \
-                }                                                             \
-        }                                                                     \
-} while (0)
-#define ELF_CORE_WRITE_EXTRA_DATA                                             \
-do {                                                                          \
-        if (find_vma(current->mm, VSYSCALL32_BASE)) {                         \
-                const struct elf32_phdr *const vsyscall_phdrs =               \
-                        (const struct elf32_phdr *) (VSYSCALL32_BASE          \
-                                                   + VSYSCALL32_EHDR->e_phoff);      \
-                int i;                                                        \
-                for (i = 0; i < VSYSCALL32_EHDR->e_phnum; ++i) {              \
-                        if (vsyscall_phdrs[i].p_type == PT_LOAD)              \
-                                DUMP_WRITE((void *) (u64) vsyscall_phdrs[i].p_vaddr,\
-                                    PAGE_ALIGN(vsyscall_phdrs[i].p_memsz));   \
-                }                                                             \
-        }                                                                     \
-} while (0)
 struct elf_siginfo
 {
        int     si_signo;                       /* signal number */
diff --git a/arch/x86_64/ia32/syscall32.c b/arch/x86_64/ia32/syscall32.c
index 3e5ed20cba45..59f1fa155915 100644
--- a/arch/x86_64/ia32/syscall32.c
+++ b/arch/x86_64/ia32/syscall32.c
@@ -59,6 +59,13 @@ int syscall32_setup_pages(struct linux_binprm *bprm, int exstack)
        vma->vm_end = VSYSCALL32_END;
        /* MAYWRITE to allow gdb to COW and set breakpoints */
        vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYWRITE;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        vma->vm_flags |= VM_ALWAYSDUMP;
        vma->vm_flags |= mm->def_flags;
        vma->vm_page_prot = protection_map[vma->vm_flags & 7];
        vma->vm_ops = &syscall32_vm_ops;
@@ -75,6 +82,14 @@ int syscall32_setup_pages(struct linux_binprm *bprm, int exstack)
        return 0;
 }
+const char *arch_vma_name(struct vm_area_struct *vma)
+{
+        if (vma->vm_start == VSYSCALL32_BASE &&
+            vma->vm_mm && vma->vm_mm->task_size == IA32_PAGE_OFFSET)
+                return "[vdso]";
+        return NULL;
+}
 static int __init init_syscall32(void)
 { 
        syscall32_page = (void *)get_zeroed_page(GFP_KERNEL); 
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 186aebbae32d..9cb42ecb7f89 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -302,8 +302,6 @@ int __init setup_nmi_watchdog(char *str)
        if ((nmi >= NMI_INVALID) || (nmi < NMI_NONE))
                return 0;
-        if ((nmi == NMI_LOCAL_APIC) && (nmi_known_cpu() == 0))
-                return 0;  /* no lapic support */
        nmi_watchdog = nmi;
        return 1;
 }
diff --git a/block/elevator.c b/block/elevator.c
index 536be740ba4e..f6dafa8c7c4d 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -590,6 +590,12 @@ void elv_insert(request_queue_t *q, struct request *rq, int where)
                 */
                rq->cmd_flags |= REQ_SOFTBARRIER;
+                /*
+                 * Most requeues happen because of a busy condition,
+                 * don't force unplug of the queue for that case.
+                 */
+                unplug_it = 0;
                if (q->ordseq == 0) {
                        list_add(&rq->queuelist, &q->queue_head);
                        break;
@@ -604,11 +610,6 @@ void elv_insert(request_queue_t *q, struct request *rq, int where)
                }
                list_add_tail(&rq->queuelist, pos);
-                /*
-                 * most requeues happen because of a busy condition, don't
-                 * force unplug of the queue for that case.
-                 */
-                unplug_it = 0;
                break;
        default:
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 5207f9e4b443..cbb6f0814ce2 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -322,10 +322,6 @@ static int acpi_processor_get_performance_info(struct acpi_processor *pr)
        if (result)
                return result;
-        result = acpi_processor_get_platform_limit(pr);
-        if (result)
-                return result;
        return 0;
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 36b37d755dbc..3d54680d0333 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1677,8 +1677,6 @@ static void acpi_video_device_notify(acpi_handle handle, u32 event, void *data)
        struct acpi_video_device *video_device = data;
        struct acpi_device *device = NULL;
-        printk("video device notify\n");
        if (!video_device)
                return;
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index da21552d2b1c..1c94b43d2c9b 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -19,6 +19,10 @@ config ATA
 if ATA
+config ATA_NONSTANDARD
+       bool
+       default n
 config SATA_AHCI
        tristate "AHCI SATA support"
        depends on PCI
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index b517d2493551..28a82e3403f1 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -75,6 +75,7 @@ enum {
        AHCI_CMD_CLR_BUSY       = (1 << 10),
        RX_FIS_D2H_REG          = 0x40, /* offset of D2H Register FIS data */
+        RX_FIS_SDB              = 0x58, /* offset of SDB FIS data */
        RX_FIS_UNK              = 0x60, /* offset of Unknown FIS data */
        board_ahci              = 0,
@@ -202,6 +203,10 @@ struct ahci_port_priv {
        dma_addr_t              cmd_tbl_dma;
        void                    *rx_fis;
        dma_addr_t              rx_fis_dma;
+        /* for NCQ spurious interrupt analysis */
+        int                     ncq_saw_spurious_sdb_cnt;
+        unsigned int            ncq_saw_d2h:1;
+        unsigned int            ncq_saw_dmas:1;
 };
 static u32 ahci_scr_read (struct ata_port *ap, unsigned int sc_reg);
@@ -361,7 +366,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x27c1), board_ahci }, /* ICH7 */
        { PCI_VDEVICE(INTEL, 0x27c5), board_ahci }, /* ICH7M */
        { PCI_VDEVICE(INTEL, 0x27c3), board_ahci }, /* ICH7R */
-        { PCI_VDEVICE(AL, 0x5288), board_ahci }, /* ULi M5288 */
+        { PCI_VDEVICE(AL, 0x5288), board_ahci_ign_iferr }, /* ULi M5288 */
        { PCI_VDEVICE(INTEL, 0x2681), board_ahci }, /* ESB2 */
        { PCI_VDEVICE(INTEL, 0x2682), board_ahci }, /* ESB2 */
        { PCI_VDEVICE(INTEL, 0x2683), board_ahci }, /* ESB2 */
@@ -586,35 +591,18 @@ static void ahci_power_down(void __iomem *port_mmio, u32 cap)
 {
        u32 cmd, scontrol;
-        cmd = readl(port_mmio + PORT_CMD) & ~PORT_CMD_ICC_MASK;
+        if (!(cap & HOST_CAP_SSS))
+                return;
-        if (cap & HOST_CAP_SSC) {
-                /* enable transitions to slumber mode */
-                scontrol = readl(port_mmio + PORT_SCR_CTL);
-                if ((scontrol & 0x0f00) > 0x100) {
-                        scontrol &= ~0xf00;
-                        writel(scontrol, port_mmio + PORT_SCR_CTL);
-                }
-                /* put device into slumber mode */
-                writel(cmd | PORT_CMD_ICC_SLUMBER, port_mmio + PORT_CMD);
-                /* wait for the transition to complete */
-                ata_wait_register(port_mmio + PORT_CMD, PORT_CMD_ICC_SLUMBER,
-                                  PORT_CMD_ICC_SLUMBER, 1, 50);
-        }
-        /* put device into listen mode */
+        /* put device into listen mode, first set PxSCTL.DET to 0 */
-        if (cap & HOST_CAP_SSS) {
+        scontrol = readl(port_mmio + PORT_SCR_CTL);
-                /* first set PxSCTL.DET to 0 */
+        scontrol &= ~0xf;
-                scontrol = readl(port_mmio + PORT_SCR_CTL);
+        writel(scontrol, port_mmio + PORT_SCR_CTL);
-                scontrol &= ~0xf;
-                writel(scontrol, port_mmio + PORT_SCR_CTL);
-                /* then set PxCMD.SUD to 0 */
+        /* then set PxCMD.SUD to 0 */
-                cmd &= ~PORT_CMD_SPIN_UP;
+        cmd = readl(port_mmio + PORT_CMD) & ~PORT_CMD_ICC_MASK;
-                writel(cmd, port_mmio + PORT_CMD);
+        cmd &= ~PORT_CMD_SPIN_UP;
-        }
+        writel(cmd, port_mmio + PORT_CMD);
 }
 static void ahci_init_port(void __iomem *port_mmio, u32 cap,
@@ -915,7 +903,7 @@ static int ahci_hardreset(struct ata_port *ap, unsigned int *class)
        /* clear D2H reception area to properly wait for D2H FIS */
        ata_tf_init(ap->device, &tf);
-        tf.command = 0xff;
+        tf.command = 0x80;
        ata_tf_to_fis(&tf, d2h_fis, 0);
        rc = sata_std_hardreset(ap, class);
@@ -1126,8 +1114,9 @@ static void ahci_host_intr(struct ata_port *ap)
        void __iomem *mmio = ap->host->mmio_base;
        void __iomem *port_mmio = ahci_port_base(mmio, ap->port_no);
        struct ata_eh_info *ehi = &ap->eh_info;
+        struct ahci_port_priv *pp = ap->private_data;
        u32 status, qc_active;
-        int rc;
+        int rc, known_irq = 0;
        status = readl(port_mmio + PORT_IRQ_STAT);
        writel(status, port_mmio + PORT_IRQ_STAT);
@@ -1154,17 +1143,53 @@ static void ahci_host_intr(struct ata_port *ap)
        /* hmmm... a spurious interupt */
-        /* some devices send D2H reg with I bit set during NCQ command phase */
+        /* if !NCQ, ignore.  No modern ATA device has broken HSM
-        if (ap->sactive && (status & PORT_IRQ_D2H_REG_FIS))
+         * implementation for non-NCQ commands.
+         */
+        if (!ap->sactive)
                return;
-        /* ignore interim PIO setup fis interrupts */
+        if (status & PORT_IRQ_D2H_REG_FIS) {
-        if (ata_tag_valid(ap->active_tag) && (status & PORT_IRQ_PIOS_FIS))
+                if (!pp->ncq_saw_d2h)
-                return;
+                        ata_port_printk(ap, KERN_INFO,
+                                "D2H reg with I during NCQ, "
+                                "this message won't be printed again\n");
+                pp->ncq_saw_d2h = 1;
+                known_irq = 1;
+        }
+        if (status & PORT_IRQ_DMAS_FIS) {
+                if (!pp->ncq_saw_dmas)
+                        ata_port_printk(ap, KERN_INFO,
+                                "DMAS FIS during NCQ, "
+                                "this message won't be printed again\n");
+                pp->ncq_saw_dmas = 1;
+                known_irq = 1;
+        }
+        if (status & PORT_IRQ_SDB_FIS &&
+                   pp->ncq_saw_spurious_sdb_cnt < 10) {
+                /* SDB FIS containing spurious completions might be
+                 * dangerous, we need to know more about them.  Print
+                 * more of it.
+                 */
+                const u32 *f = pp->rx_fis + RX_FIS_SDB;
+                ata_port_printk(ap, KERN_INFO, "Spurious SDB FIS during NCQ "
+                                "issue=0x%x SAct=0x%x FIS=%08x:%08x%s\n",
+                                readl(port_mmio + PORT_CMD_ISSUE),
+                                readl(port_mmio + PORT_SCR_ACT),
+                                le32_to_cpu(f[0]), le32_to_cpu(f[1]),
+                                pp->ncq_saw_spurious_sdb_cnt < 10 ?
+                                "" : ", shutting up");
+                pp->ncq_saw_spurious_sdb_cnt++;
+                known_irq = 1;
+        }
-        if (ata_ratelimit())
+        if (!known_irq)
                ata_port_printk(ap, KERN_INFO, "spurious interrupt "
-                                "(irq_stat 0x%x active_tag %d sactive 0x%x)\n",
+                                "(irq_stat 0x%x active_tag 0x%x sactive 0x%x)\n",
                                status, ap->active_tag, ap->sactive);
 }
diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
index 908751d27e76..24af56081b5d 100644
--- a/drivers/ata/ata_generic.c
+++ b/drivers/ata/ata_generic.c
@@ -64,6 +64,7 @@ static void generic_error_handler(struct ata_port *ap)
 /**
 *      generic_set_mode        -       mode setting
 *      @ap: interface to set up
+ *      @unused: returned device on error
 *
 *      Use a non standard set_mode function. We don't want to be tuned.
 *      The BIOS configured everything. Our job is not to fiddle. We
@@ -71,7 +72,7 @@ static void generic_error_handler(struct ata_port *ap)
 *      and respect them.
 */
-static void generic_set_mode(struct ata_port *ap)
+static int generic_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
        int dma_enabled = 0;
        int i;
@@ -82,7 +83,7 @@ static void generic_set_mode(struct ata_port *ap)
        for (i = 0; i < ATA_MAX_DEVICES; i++) {
                struct ata_device *dev = &ap->device[i];
-                if (ata_dev_enabled(dev)) {
+                if (ata_dev_ready(dev)) {
                        /* We don't really care */
                        dev->pio_mode = XFER_PIO_0;
                        dev->dma_mode = XFER_MW_DMA_0;
@@ -99,6 +100,7 @@ static void generic_set_mode(struct ata_port *ap)
                        }
                }
        }
+        return 0;
 }
 static struct scsi_host_template generic_sht = {
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 0d51d13b16bf..a388a8df0043 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2431,18 +2431,8 @@ int ata_set_mode(struct ata_port *ap, struct ata_device **r_failed_dev)
        int i, rc = 0, used_dma = 0, found = 0;
        /* has private set_mode? */
-        if (ap->ops->set_mode) {
+        if (ap->ops->set_mode)
-                /* FIXME: make ->set_mode handle no device case and
+                return ap->ops->set_mode(ap, r_failed_dev);
-                 * return error code and failing device on failure.
-                 */
-                for (i = 0; i < ATA_MAX_DEVICES; i++) {
-                        if (ata_dev_ready(&ap->device[i])) {
-                                ap->ops->set_mode(ap);
-                                break;
-                        }
-                }
-                return 0;
-        }
        /* step 1: calculate xfer_mask */
        for (i = 0; i < ATA_MAX_DEVICES; i++) {
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 836947da5b14..7cc5a4a910a4 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -372,7 +372,7 @@ struct ata_queued_cmd *ata_scsi_qc_new(struct ata_device *dev,
                if (cmd->use_sg) {
                        qc->__sg = (struct scatterlist *) cmd->request_buffer;
                        qc->n_elem = cmd->use_sg;
-                } else {
+                } else if (cmd->request_bufflen) {
                        qc->__sg = &qc->sgent;
                        qc->n_elem = 1;
                }
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 623cec914c9b..12c88c588039 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -827,7 +827,8 @@ void ata_bmdma_error_handler(struct ata_port *ap)
 */
 void ata_bmdma_post_internal_cmd(struct ata_queued_cmd *qc)
 {
-        ata_bmdma_stop(qc);
+        if (qc->ap->ioaddr.bmdma_addr)
+                ata_bmdma_stop(qc);
 }
 #ifdef CONFIG_PCI
@@ -870,7 +871,8 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int
                        pci_resource_start(pdev, 1) | ATA_PCI_CTL_OFS;
                bmdma = pci_resource_start(pdev, 4);
                if (bmdma) {
-                        if (inb(bmdma + 2) & 0x80)
+                        if ((!(port[p]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 2) & 0x80))
                                probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                        probe_ent->port[p].bmdma_addr = bmdma;
                }
@@ -886,7 +888,8 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int
                bmdma = pci_resource_start(pdev, 4);
                if (bmdma) {
                        bmdma += 8;
-                        if(inb(bmdma + 2) & 0x80)
+                        if ((!(port[p]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 2) & 0x80))
                                probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                        probe_ent->port[p].bmdma_addr = bmdma;
                }
@@ -914,13 +917,14 @@ static struct ata_probe_ent *ata_pci_init_legacy_port(struct pci_dev *pdev,
        probe_ent->irq_flags = IRQF_SHARED;
        if (port_mask & ATA_PORT_PRIMARY) {
-                probe_ent->irq = ATA_PRIMARY_IRQ;
+                probe_ent->irq = ATA_PRIMARY_IRQ(pdev);
                probe_ent->port[0].cmd_addr = ATA_PRIMARY_CMD;
                probe_ent->port[0].altstatus_addr =
                probe_ent->port[0].ctl_addr = ATA_PRIMARY_CTL;
                if (bmdma) {
                        probe_ent->port[0].bmdma_addr = bmdma;
-                        if (inb(bmdma + 2) & 0x80)
+                        if ((!(port[0]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 2) & 0x80))
                                probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                }
                ata_std_ports(&probe_ent->port[0]);
@@ -929,15 +933,16 @@ static struct ata_probe_ent *ata_pci_init_legacy_port(struct pci_dev *pdev,
        if (port_mask & ATA_PORT_SECONDARY) {
                if (probe_ent->irq)
-                        probe_ent->irq2 = ATA_SECONDARY_IRQ;
+                        probe_ent->irq2 = ATA_SECONDARY_IRQ(pdev);
                else
-                        probe_ent->irq = ATA_SECONDARY_IRQ;
+                        probe_ent->irq = ATA_SECONDARY_IRQ(pdev);
                probe_ent->port[1].cmd_addr = ATA_SECONDARY_CMD;
                probe_ent->port[1].altstatus_addr =
                probe_ent->port[1].ctl_addr = ATA_SECONDARY_CTL;
                if (bmdma) {
                        probe_ent->port[1].bmdma_addr = bmdma + 8;
-                        if (inb(bmdma + 10) & 0x80)
+                        if ((!(port[1]->flags & ATA_FLAG_IGN_SIMPLEX)) &&
+                            (inb(bmdma + 10) & 0x80))
                                probe_ent->_host_flags |= ATA_HOST_SIMPLEX;
                }
                ata_std_ports(&probe_ent->port[1]);
diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c
index 15841a563694..449162cbf93e 100644
--- a/drivers/ata/pata_cmd64x.c
+++ b/drivers/ata/pata_cmd64x.c
@@ -197,7 +197,7 @@ static void cmd64x_set_piomode(struct ata_port *ap, struct ata_device *adev)
 static void cmd64x_set_dmamode(struct ata_port *ap, struct ata_device *adev)
 {
        static const u8 udma_data[] = {
-                0x31, 0x21, 0x11, 0x25, 0x15, 0x05
+                0x30, 0x20, 0x10, 0x20, 0x10, 0x00
        };
        static const u8 mwdma_data[] = {
                0x30, 0x20, 0x10
@@ -213,12 +213,21 @@ static void cmd64x_set_dmamode(struct ata_port *ap, struct ata_device *adev)
        pci_read_config_byte(pdev, pciD, &regD);
        pci_read_config_byte(pdev, pciU, &regU);
-        regD &= ~(0x20 << shift);
+        /* DMA bits off */
-        regU &= ~(0x35 << shift);
+        regD &= ~(0x20 << adev->devno);
+        /* DMA control bits */
+        regU &= ~(0x30 << shift);
+        /* DMA timing bits */
+        regU &= ~(0x05 << adev->devno);
-        if (adev->dma_mode >= XFER_UDMA_0)
+        if (adev->dma_mode >= XFER_UDMA_0) {
+                /* Merge thge timing value */
                regU |= udma_data[adev->dma_mode - XFER_UDMA_0] << shift;
-        else
+                /* Merge the control bits */
+                regU |= 1 << adev->devno; /* UDMA on */
+                if (adev->dma_mode > 2) /* 15nS timing */
+                        regU |= 4 << adev->devno;
+        } else
                regD |= mwdma_data[adev->dma_mode - XFER_MW_DMA_0] << shift;
        regD |= 0x20 << adev->devno;
@@ -239,8 +248,8 @@ static void cmd648_bmdma_stop(struct ata_queued_cmd *qc)
        struct ata_port *ap = qc->ap;
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
        u8 dma_intr;
-        int dma_reg = ap->port_no ? ARTTIM23_INTR_CH1 : CFR_INTR_CH0;
+        int dma_mask = ap->port_no ? ARTTIM23_INTR_CH1 : CFR_INTR_CH0;
-        int dma_mask = ap->port_no ? ARTTIM2 : CFR;
+        int dma_reg = ap->port_no ? ARTTIM2 : CFR;
        ata_bmdma_stop(qc);
diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
index f6817b4093a4..886fab9aa62c 100644
--- a/drivers/ata/pata_hpt3x2n.c
+++ b/drivers/ata/pata_hpt3x2n.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "pata_hpt3x2n"
-#define DRV_VERSION     "0.3"
+#define DRV_VERSION     "0.3.2"
 enum {
        HPT_PCI_FAST    =       (1 << 31),
@@ -297,11 +297,11 @@ static int hpt3x2n_pair_idle(struct ata_port *ap)
        return 0;
 }
-static int hpt3x2n_use_dpll(struct ata_port *ap, int reading)
+static int hpt3x2n_use_dpll(struct ata_port *ap, int writing)
 {
        long flags = (long)ap->host->private_data;
        /* See if we should use the DPLL */
-        if (reading == 0)
+        if (writing)
                return USE_DPLL;        /* Needed for write */
        if (flags & PCI66)
                return USE_DPLL;        /* Needed at 66Mhz */
diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
index 0b56ff3d1cfe..e8afd486434a 100644
--- a/drivers/ata/pata_it821x.c
+++ b/drivers/ata/pata_it821x.c
@@ -476,6 +476,7 @@ static unsigned int it821x_passthru_qc_issue_prot(struct ata_queued_cmd *qc)
 /**
 *      it821x_smart_set_mode   -       mode setting
 *      @ap: interface to set up
+ *      @unused: device that failed (error only)
 *
 *      Use a non standard set_mode function. We don't want to be tuned.
 *      The BIOS configured everything. Our job is not to fiddle. We
@@ -483,7 +484,7 @@ static unsigned int it821x_passthru_qc_issue_prot(struct ata_queued_cmd *qc)
 *      and respect them.
 */
-static void it821x_smart_set_mode(struct ata_port *ap)
+static int it821x_smart_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
        int dma_enabled = 0;
        int i;
@@ -512,6 +513,7 @@ static void it821x_smart_set_mode(struct ata_port *ap)
                        }
                }
        }
+        return 0;
 }
 /**
diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
index cb8924109f59..23b8aab3ebd8 100644
--- a/drivers/ata/pata_ixp4xx_cf.c
+++ b/drivers/ata/pata_ixp4xx_cf.c
@@ -23,9 +23,9 @@
 #include <scsi/scsi_host.h>
 #define DRV_NAME        "pata_ixp4xx_cf"
-#define DRV_VERSION     "0.1.1"
+#define DRV_VERSION     "0.1.1ac1"
-static void ixp4xx_set_mode(struct ata_port *ap)
+static int ixp4xx_set_mode(struct ata_port *ap, struct ata_device *adev)
 {
        int i;
@@ -38,6 +38,7 @@ static void ixp4xx_set_mode(struct ata_port *ap)
                        dev->flags |= ATA_DFLAG_PIO;
                }
        }
+        return 0;
 }
 static void ixp4xx_phy_reset(struct ata_port *ap)
diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index e7bf9d89c8ee..581cb33c6f45 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -96,6 +96,7 @@ static int pio_mask = 0x1F;		/* PIO range for autospeed devices */
 /**
 *      legacy_set_mode         -       mode setting
 *      @ap: IDE interface
+ *      @unused: Device that failed when error is returned
 *
 *      Use a non standard set_mode function. We don't want to be tuned.
 *
@@ -105,7 +106,7 @@ static int pio_mask = 0x1F;		/* PIO range for autospeed devices */
 *      expand on this as per hdparm in the base kernel.
 */
-static void legacy_set_mode(struct ata_port *ap)
+static int legacy_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
        int i;
@@ -118,6 +119,7 @@ static void legacy_set_mode(struct ata_port *ap)
                        dev->flags |= ATA_DFLAG_PIO;
                }
        }
+        return 0;
 }
 static struct scsi_host_template legacy_sht = {
diff --git a/drivers/ata/pata_rz1000.c b/drivers/ata/pata_rz1000.c
index adf4cc134f25..cec0729225e1 100644
--- a/drivers/ata/pata_rz1000.c
+++ b/drivers/ata/pata_rz1000.c
@@ -52,19 +52,20 @@ static void rz1000_error_handler(struct ata_port *ap)
 /**
 *      rz1000_set_mode         -       mode setting function
 *      @ap: ATA interface
+ *      @unused: returned device on set_mode failure
 *
 *      Use a non standard set_mode function. We don't want to be tuned. We
 *      would prefer to be BIOS generic but for the fact our hardware is
 *      whacked out.
 */
-static void rz1000_set_mode(struct ata_port *ap)
+static int rz1000_set_mode(struct ata_port *ap, struct ata_device **unused)
 {
        int i;
        for (i = 0; i < ATA_MAX_DEVICES; i++) {
                struct ata_device *dev = &ap->device[i];
-                if (ata_dev_enabled(dev)) {
+                if (ata_dev_ready(dev)) {
                        /* We don't really care */
                        dev->pio_mode = XFER_PIO_0;
                        dev->xfer_mode = XFER_PIO_0;
@@ -72,6 +73,7 @@ static void rz1000_set_mode(struct ata_port *ap)
                        dev->flags |= ATA_DFLAG_PIO;
                }
        }
+        return 0;
 }
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index f6d498e1cf80..f7a963eb1f02 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -700,7 +700,6 @@ static void nv_adma_check_cpb(struct ata_port *ap, int cpb_num, int force_err)
 static int nv_host_intr(struct ata_port *ap, u8 irq_stat)
 {
        struct ata_queued_cmd *qc = ata_qc_from_tag(ap, ap->active_tag);
-        int handled;
        /* freeze if hotplugged */
        if (unlikely(irq_stat & (NV_INT_ADDED | NV_INT_REMOVED))) {
@@ -719,13 +718,7 @@ static int nv_host_intr(struct ata_port *ap, u8 irq_stat)
        }
        /* handle interrupt */
-        handled = ata_host_intr(ap, qc);
+        return ata_host_intr(ap, qc);
-        if (unlikely(!handled)) {
-                /* spurious, clear it */
-                ata_check_status(ap);
-        }
-        return 1;
 }
 static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
@@ -752,6 +745,11 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
                        if (pp->flags & NV_ADMA_PORT_REGISTER_MODE) {
                                u8 irq_stat = readb(host->mmio_base + NV_INT_STATUS_CK804)
                                        >> (NV_INT_PORT_SHIFT * i);
+                                if(ata_tag_valid(ap->active_tag))
+                                        /** NV_INT_DEV indication seems unreliable at times
+                                            at least in ADMA mode. Force it on always when a
+                                            command is active, to prevent losing interrupts. */
+                                        irq_stat |= NV_INT_DEV;
                                handled += nv_host_intr(ap, irq_stat);
                                continue;
                        }
diff --git a/drivers/ata/sata_uli.c b/drivers/ata/sata_uli.c
index 5c603ca3a50a..a43aec62d505 100644
--- a/drivers/ata/sata_uli.c
+++ b/drivers/ata/sata_uli.c
@@ -128,7 +128,8 @@ static const struct ata_port_operations uli_ops = {
 static struct ata_port_info uli_port_info = {
        .sht            = &uli_sht,
-        .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY,
+        .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                          ATA_FLAG_IGN_SIMPLEX,
        .pio_mask       = 0x1f,         /* pio0-4 */
        .udma_mask      = 0x7f,         /* udma0-6 */
        .port_ops       = &uli_ops,
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 88f0565c8883..d3d5c0d57032 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -74,6 +74,7 @@ enum {
 static int svia_init_one (struct pci_dev *pdev, const struct pci_device_id *ent);
 static u32 svia_scr_read (struct ata_port *ap, unsigned int sc_reg);
 static void svia_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val);
+static void svia_noop_freeze(struct ata_port *ap);
 static void vt6420_error_handler(struct ata_port *ap);
 static const struct pci_device_id svia_pci_tbl[] = {
@@ -128,7 +129,7 @@ static const struct ata_port_operations vt6420_sata_ops = {
        .qc_issue               = ata_qc_issue_prot,
        .data_xfer              = ata_pio_data_xfer,
-        .freeze                 = ata_bmdma_freeze,
+        .freeze                 = svia_noop_freeze,
        .thaw                   = ata_bmdma_thaw,
        .error_handler          = vt6420_error_handler,
        .post_internal_cmd      = ata_bmdma_post_internal_cmd,
@@ -204,6 +205,15 @@ static void svia_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val)
        outl(val, ap->ioaddr.scr_addr + (4 * sc_reg));
 }
+static void svia_noop_freeze(struct ata_port *ap)
+{
+        /* Some VIA controllers choke if ATA_NIEN is manipulated in
+         * certain way.  Leave it alone and just clear pending IRQ.
+         */
+        ata_chk_status(ap);
+        ata_bmdma_irq_clear(ap);
+}
 /**
 *      vt6420_prereset - prereset for vt6420
 *      @ap: target ATA port
diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index 4dc10105d610..f96446c358ba 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -1845,7 +1845,7 @@ static u16 __devinit read_bia (const hrz_dev * dev, u16 addr)
 /********** initialise a card **********/
-static int __init hrz_init (hrz_dev * dev) {
+static int __devinit hrz_init (hrz_dev * dev) {
  int onefivefive;
  
  u16 chan;
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 448d5083c381..4fac2bdf6215 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -186,6 +186,7 @@ static int got_event;		/* if events processing have been done */
 static void switchover_timeout(unsigned long data);
 static struct timer_list switchover_timer =
        TIMER_INITIALIZER(switchover_timeout , 0, 0);
+static unsigned long tlclk_timer_data;
 static struct tlclk_alarms *alarm_events;
@@ -197,10 +198,19 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id);
 static DECLARE_WAIT_QUEUE_HEAD(wq);
+static unsigned long useflags;
+static DEFINE_MUTEX(tlclk_mutex);
 static int tlclk_open(struct inode *inode, struct file *filp)
 {
        int result;
+        if (test_and_set_bit(0, &useflags))
+                return -EBUSY;
+                /* this legacy device is always one per system and it doesn't
+                 * know how to handle multiple concurrent clients.
+                 */
        /* Make sure there is no interrupt pending while
         * initialising interrupt handler */
        inb(TLCLK_REG6);
@@ -221,6 +231,7 @@ static int tlclk_open(struct inode *inode, struct file *filp)
 static int tlclk_release(struct inode *inode, struct file *filp)
 {
        free_irq(telclk_interrupt, tlclk_interrupt);
+        clear_bit(0, &useflags);
        return 0;
 }
@@ -230,26 +241,25 @@ static ssize_t tlclk_read(struct file *filp, char __user *buf, size_t count,
 {
        if (count < sizeof(struct tlclk_alarms))
                return -EIO;
+        if (mutex_lock_interruptible(&tlclk_mutex))
+                return -EINTR;
        wait_event_interruptible(wq, got_event);
-        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms)))
+        if (copy_to_user(buf, alarm_events, sizeof(struct tlclk_alarms))) {
+                mutex_unlock(&tlclk_mutex);
                return -EFAULT;
+        }
        memset(alarm_events, 0, sizeof(struct tlclk_alarms));
        got_event = 0;
+        mutex_unlock(&tlclk_mutex);
        return  sizeof(struct tlclk_alarms);
 }
-static ssize_t tlclk_write(struct file *filp, const char __user *buf, size_t count,
-            loff_t *f_pos)
-{
-        return 0;
-}
 static const struct file_operations tlclk_fops = {
        .read = tlclk_read,
-        .write = tlclk_write,
        .open = tlclk_open,
        .release = tlclk_release,
@@ -540,7 +550,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                        SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
                        switch (val) {
                        case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
                                break;
                        case CLK_11_184MHz:
                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
@@ -549,7 +559,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
                                break;
                        case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
                                break;
                        }
                } else
@@ -839,11 +849,13 @@ static void __exit tlclk_cleanup(void)
 static void switchover_timeout(unsigned long data)
 {
-        if ((data & 1)) {
+        unsigned long flags = *(unsigned long *) data;
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+        if ((flags & 1)) {
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                        alarm_events->switchover_primary++;
        } else {
-                if ((inb(TLCLK_REG1) & 0x08) != (data & 0x08))
+                if ((inb(TLCLK_REG1) & 0x08) != (flags & 0x08))
                        alarm_events->switchover_secondary++;
        }
@@ -901,8 +913,9 @@ static irqreturn_t tlclk_interrupt(int irq, void *dev_id)
                /* TIMEOUT in ~10ms */
                switchover_timer.expires = jiffies + msecs_to_jiffies(10);
-                switchover_timer.data = inb(TLCLK_REG1);
+                tlclk_timer_data = inb(TLCLK_REG1);
-                add_timer(&switchover_timer);
+                switchover_timer.data = (unsigned long) &tlclk_timer_data;
+                mod_timer(&switchover_timer, switchover_timer.expires);
        } else {
                got_event = 1;
                wake_up(&wq);
diff --git a/drivers/char/vr41xx_giu.c b/drivers/char/vr41xx_giu.c
index a744dad9cf45..0cea8d4907df 100644
--- a/drivers/char/vr41xx_giu.c
+++ b/drivers/char/vr41xx_giu.c
@@ -3,7 +3,7 @@
 *
 *  Copyright (C) 2002 MontaVista Software Inc.
 *      Author: Yoichi Yuasa <yyuasa@mvista.com or source@mvista.com>
- *  Copyright (C) 2003-2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *  Copyright (C) 2003-2007  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
@@ -125,30 +125,17 @@ static inline uint16_t giu_clear(uint16_t offset, uint16_t clear)
        return data;
 }
-static unsigned int startup_giuint_low_irq(unsigned int irq)
+static void ack_giuint_low(unsigned int irq)
 {
-        unsigned int pin;
+        giu_write(GIUINTSTATL, 1 << GPIO_PIN_OF_IRQ(irq));
-        pin = GPIO_PIN_OF_IRQ(irq);
-        giu_write(GIUINTSTATL, 1 << pin);
-        giu_set(GIUINTENL, 1 << pin);
-        return 0;
 }
-static void shutdown_giuint_low_irq(unsigned int irq)
+static void mask_giuint_low(unsigned int irq)
 {
        giu_clear(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
-static void enable_giuint_low_irq(unsigned int irq)
+static void mask_ack_giuint_low(unsigned int irq)
-{
-        giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
-}
-#define disable_giuint_low_irq  shutdown_giuint_low_irq
-static void ack_giuint_low_irq(unsigned int irq)
 {
        unsigned int pin;
@@ -157,46 +144,30 @@ static void ack_giuint_low_irq(unsigned int irq)
        giu_write(GIUINTSTATL, 1 << pin);
 }
-static void end_giuint_low_irq(unsigned int irq)
+static void unmask_giuint_low(unsigned int irq)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
+        giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
-                giu_set(GIUINTENL, 1 << GPIO_PIN_OF_IRQ(irq));
 }
-static struct hw_interrupt_type giuint_low_irq_type = {
+static struct irq_chip giuint_low_irq_chip = {
-        .typename       = "GIUINTL",
+        .name           = "GIUINTL",
-        .startup        = startup_giuint_low_irq,
+        .ack            = ack_giuint_low,
-        .shutdown       = shutdown_giuint_low_irq,
+        .mask           = mask_giuint_low,
-        .enable         = enable_giuint_low_irq,
+        .mask_ack       = mask_ack_giuint_low,
-        .disable        = disable_giuint_low_irq,
+        .unmask         = unmask_giuint_low,
-        .ack            = ack_giuint_low_irq,
-        .end            = end_giuint_low_irq,
 };
-static unsigned int startup_giuint_high_irq(unsigned int irq)
+static void ack_giuint_high(unsigned int irq)
 {
-        unsigned int pin;
+        giu_write(GIUINTSTATH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
-        pin = GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET;
-        giu_write(GIUINTSTATH, 1 << pin);
-        giu_set(GIUINTENH, 1 << pin);
-        return 0;
 }
-static void shutdown_giuint_high_irq(unsigned int irq)
+static void mask_giuint_high(unsigned int irq)
 {
        giu_clear(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
-static void enable_giuint_high_irq(unsigned int irq)
+static void mask_ack_giuint_high(unsigned int irq)
-{
-        giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
-}
-#define disable_giuint_high_irq shutdown_giuint_high_irq
-static void ack_giuint_high_irq(unsigned int irq)
 {
        unsigned int pin;
@@ -205,20 +176,17 @@ static void ack_giuint_high_irq(unsigned int irq)
        giu_write(GIUINTSTATH, 1 << pin);
 }
-static void end_giuint_high_irq(unsigned int irq)
+static void unmask_giuint_high(unsigned int irq)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
+        giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
-                giu_set(GIUINTENH, 1 << (GPIO_PIN_OF_IRQ(irq) - GIUINT_HIGH_OFFSET));
 }
-static struct hw_interrupt_type giuint_high_irq_type = {
+static struct irq_chip giuint_high_irq_chip = {
-        .typename       = "GIUINTH",
+        .name           = "GIUINTH",
-        .startup        = startup_giuint_high_irq,
+        .ack            = ack_giuint_high,
-        .shutdown       = shutdown_giuint_high_irq,
+        .mask           = mask_giuint_high,
-        .enable         = enable_giuint_high_irq,
+        .mask_ack       = mask_ack_giuint_high,
-        .disable        = disable_giuint_high_irq,
+        .unmask         = unmask_giuint_high,
-        .ack            = ack_giuint_high_irq,
-        .end            = end_giuint_high_irq,
 };
 static int giu_get_irq(unsigned int irq)
@@ -282,9 +250,15 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                        break;
                                }
                        }
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_low_irq_chip,
+                                                 handle_edge_irq);
                } else {
                        giu_clear(GIUINTTYPL, mask);
                        giu_clear(GIUINTHTSELL, mask);
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_low_irq_chip,
+                                                 handle_level_irq);
                }
                giu_write(GIUINTSTATL, mask);
        } else if (pin < GIUINT_HIGH_MAX) {
@@ -311,9 +285,15 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                        break;
                                }
                        }
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_high_irq_chip,
+                                                 handle_edge_irq);
                } else {
                        giu_clear(GIUINTTYPH, mask);
                        giu_clear(GIUINTHTSELH, mask);
+                        set_irq_chip_and_handler(GIU_IRQ(pin),
+                                                 &giuint_high_irq_chip,
+                                                 handle_level_irq);
                }
                giu_write(GIUINTSTATH, mask);
        }
@@ -617,10 +597,11 @@ static const struct file_operations gpio_fops = {
 static int __devinit giu_probe(struct platform_device *dev)
 {
        unsigned long start, size, flags = 0;
-        unsigned int nr_pins = 0;
+        unsigned int nr_pins = 0, trigger, i, pin;
        struct resource *res1, *res2 = NULL;
        void *base;
-        int retval, i;
+        struct irq_chip *chip;
+        int retval;
        switch (current_cpu_data.cputype) {
        case CPU_VR4111:
@@ -688,11 +669,20 @@ static int __devinit giu_probe(struct platform_device *dev)
        giu_write(GIUINTENL, 0);
        giu_write(GIUINTENH, 0);
+        trigger = giu_read(GIUINTTYPH) << 16;
+        trigger |= giu_read(GIUINTTYPL);
        for (i = GIU_IRQ_BASE; i <= GIU_IRQ_LAST; i++) {
-                if (i < GIU_IRQ(GIUINT_HIGH_OFFSET))
+                pin = GPIO_PIN_OF_IRQ(i);
-                        irq_desc[i].chip = &giuint_low_irq_type;
+                if (pin < GIUINT_HIGH_OFFSET)
+                        chip = &giuint_low_irq_chip;
                else
-                        irq_desc[i].chip = &giuint_high_irq_type;
+                        chip = &giuint_high_irq_chip;
+                if (trigger & (1 << pin))
+                        set_irq_chip_and_handler(i, chip, handle_edge_irq);
+                else
+                        set_irq_chip_and_handler(i, chip, handle_level_irq);
        }
        return cascade_irq(GIUINT_IRQ, giu_get_irq);
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 5ab5e393b882..c6281ccd4fe7 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -122,8 +122,6 @@ struct efivar_entry {
        struct kobject kobj;
 };
-#define get_efivar_entry(n) list_entry(n, struct efivar_entry, list)
 struct efivar_attribute {
        struct attribute attr;
        ssize_t (*show) (struct efivar_entry *entry, char *buf);
@@ -386,9 +384,6 @@ static struct sysfs_ops efivar_attr_ops = {
 static void efivar_release(struct kobject *kobj)
 {
        struct efivar_entry *var = container_of(kobj, struct efivar_entry, kobj);
-        spin_lock(&efivars_lock);
-        list_del(&var->list);
-        spin_unlock(&efivars_lock);
        kfree(var);
 }
@@ -430,9 +425,8 @@ static ssize_t
 efivar_create(struct subsystem *sub, const char *buf, size_t count)
 {
        struct efi_variable *new_var = (struct efi_variable *)buf;
-        struct efivar_entry *search_efivar = NULL;
+        struct efivar_entry *search_efivar, *n;
        unsigned long strsize1, strsize2;
-        struct list_head *pos, *n;
        efi_status_t status = EFI_NOT_FOUND;
        int found = 0;
@@ -444,8 +438,7 @@ efivar_create(struct subsystem *sub, const char *buf, size_t count)
        /*
         * Does this variable already exist?
         */
-        list_for_each_safe(pos, n, &efivar_list) {
+        list_for_each_entry_safe(search_efivar, n, &efivar_list, list) {
-                search_efivar = get_efivar_entry(pos);
                strsize1 = utf8_strsize(search_efivar->var.VariableName, 1024);
                strsize2 = utf8_strsize(new_var->VariableName, 1024);
                if (strsize1 == strsize2 &&
@@ -490,9 +483,8 @@ static ssize_t
 efivar_delete(struct subsystem *sub, const char *buf, size_t count)
 {
        struct efi_variable *del_var = (struct efi_variable *)buf;
-        struct efivar_entry *search_efivar = NULL;
+        struct efivar_entry *search_efivar, *n;
        unsigned long strsize1, strsize2;
-        struct list_head *pos, *n;
        efi_status_t status = EFI_NOT_FOUND;
        int found = 0;
@@ -504,8 +496,7 @@ efivar_delete(struct subsystem *sub, const char *buf, size_t count)
        /*
         * Does this variable already exist?
         */
-        list_for_each_safe(pos, n, &efivar_list) {
+        list_for_each_entry_safe(search_efivar, n, &efivar_list, list) {
-                search_efivar = get_efivar_entry(pos);
                strsize1 = utf8_strsize(search_efivar->var.VariableName, 1024);
                strsize2 = utf8_strsize(del_var->VariableName, 1024);
                if (strsize1 == strsize2 &&
@@ -537,9 +528,9 @@ efivar_delete(struct subsystem *sub, const char *buf, size_t count)
                spin_unlock(&efivars_lock);
                return -EIO;
        }
+        list_del(&search_efivar->list);
        /* We need to release this lock before unregistering. */
        spin_unlock(&efivars_lock);
        efivar_unregister(search_efivar);
        /* It's dead Jim.... */
@@ -768,10 +759,14 @@ out_free:
 static void __exit
 efivars_exit(void)
 {
-        struct list_head *pos, *n;
+        struct efivar_entry *entry, *n;
-        list_for_each_safe(pos, n, &efivar_list)
+        list_for_each_entry_safe(entry, n, &efivar_list, list) {
-                efivar_unregister(get_efivar_entry(pos));
+                spin_lock(&efivars_lock);
+                list_del(&entry->list);
+                spin_unlock(&efivars_lock);
+                efivar_unregister(entry);
+        }
        subsystem_unregister(&vars_subsys);
        firmware_unregister(&efi_subsys);
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 93995b658d94..6074c897f51c 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -344,8 +344,11 @@ int ehca_destroy_cq(struct ib_cq *cq)
        unsigned long flags;
        spin_lock_irqsave(&ehca_cq_idr_lock, flags);
-        while (my_cq->nr_callbacks)
+        while (my_cq->nr_callbacks) {
+                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
                yield();
+                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+        }
        idr_remove(&ehca_cq_idr, my_cq->token);
        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index e7209afb4250..c069be8cbcb2 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -440,7 +440,8 @@ void ehca_tasklet_eq(unsigned long data)
                                        cq = idr_find(&ehca_cq_idr, token);
                                        if (cq == NULL) {
-                                                spin_unlock(&ehca_cq_idr_lock);
+                                                spin_unlock_irqrestore(&ehca_cq_idr_lock,
+                                                                       flags);
                                                break;
                                        }
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index cdecbf5911c8..72611fd15103 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1621,18 +1621,30 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
                switch (token) {
                case SRP_OPT_ID_EXT:
                        p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                        target->id_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
                        kfree(p);
                        break;
                case SRP_OPT_IOC_GUID:
                        p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                        target->ioc_guid = cpu_to_be64(simple_strtoull(p, NULL, 16));
                        kfree(p);
                        break;
                case SRP_OPT_DGID:
                        p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                        if (strlen(p) != 32) {
                                printk(KERN_WARNING PFX "bad dest GID parameter '%s'\n", p);
                                kfree(p);
@@ -1656,6 +1668,10 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
                case SRP_OPT_SERVICE_ID:
                        p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                        target->service_id = cpu_to_be64(simple_strtoull(p, NULL, 16));
                        kfree(p);
                        break;
@@ -1693,6 +1709,10 @@ static int srp_parse_options(const char *buf, struct srp_target_port *target)
                case SRP_OPT_INITIATOR_EXT:
                        p = match_strdup(args);
+                        if (!p) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
                        target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
                        kfree(p);
                        break;
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 95eff3b2917a..4f75cce6fdff 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -356,16 +356,17 @@ static struct cardstate *alloc_cs(struct gigaset_driver *drv)
 {
        unsigned long flags;
        unsigned i;
-        static struct cardstate *ret = NULL;
+        struct cardstate *ret = NULL;
        spin_lock_irqsave(&drv->lock, flags);
        for (i = 0; i < drv->minors; ++i) {
                if (!(drv->flags[i] & VALID_MINOR)) {
-                        drv->flags[i] = VALID_MINOR;
+                        if (try_module_get(drv->owner)) {
-                        ret = drv->cs + i;
+                                drv->flags[i] = VALID_MINOR;
-                }
+                                ret = drv->cs + i;
-                if (ret)
+                        }
                        break;
+                }
        }
        spin_unlock_irqrestore(&drv->lock, flags);
        return ret;
@@ -376,6 +377,8 @@ static void free_cs(struct cardstate *cs)
        unsigned long flags;
        struct gigaset_driver *drv = cs->driver;
        spin_lock_irqsave(&drv->lock, flags);
+        if (drv->flags[cs->minor_index] & VALID_MINOR)
+                module_put(drv->owner);
        drv->flags[cs->minor_index] = 0;
        spin_unlock_irqrestore(&drv->lock, flags);
 }
@@ -579,7 +582,7 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
        } else if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                skb_reserve(bcs->skb, HW_HDR_LEN);
        else {
-                warn("could not allocate skb\n");
+                warn("could not allocate skb");
                bcs->inputstate |= INS_skip_frame;
        }
@@ -632,17 +635,25 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
        int i;
        gig_dbg(DEBUG_INIT, "allocating cs");
-        cs = alloc_cs(drv);
+        if (!(cs = alloc_cs(drv))) {
-        if (!cs)
+                err("maximum number of devices exceeded");
-                goto error;
+                return NULL;
+        }
+        mutex_init(&cs->mutex);
+        mutex_lock(&cs->mutex);
        gig_dbg(DEBUG_INIT, "allocating bcs[0..%d]", channels - 1);
        cs->bcs = kmalloc(channels * sizeof(struct bc_state), GFP_KERNEL);
-        if (!cs->bcs)
+        if (!cs->bcs) {
+                err("out of memory");
                goto error;
+        }
        gig_dbg(DEBUG_INIT, "allocating inbuf");
        cs->inbuf = kmalloc(sizeof(struct inbuf_t), GFP_KERNEL);
-        if (!cs->inbuf)
+        if (!cs->inbuf) {
+                err("out of memory");
                goto error;
+        }
        cs->cs_init = 0;
        cs->channels = channels;
@@ -654,8 +665,6 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
        spin_lock_init(&cs->ev_lock);
        cs->ev_tail = 0;
        cs->ev_head = 0;
-        mutex_init(&cs->mutex);
-        mutex_lock(&cs->mutex);
        tasklet_init(&cs->event_tasklet, &gigaset_handle_event,
                     (unsigned long) cs);
@@ -684,8 +693,10 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
        for (i = 0; i < channels; ++i) {
                gig_dbg(DEBUG_INIT, "setting up bcs[%d].read", i);
-                if (!gigaset_initbcs(cs->bcs + i, cs, i))
+                if (!gigaset_initbcs(cs->bcs + i, cs, i)) {
+                        err("could not allocate channel %d data", i);
                        goto error;
+                }
        }
        ++cs->cs_init;
@@ -720,8 +731,10 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
        make_valid(cs, VALID_ID);
        ++cs->cs_init;
        gig_dbg(DEBUG_INIT, "setting up hw");
-        if (!cs->ops->initcshw(cs))
+        if (!cs->ops->initcshw(cs)) {
+                err("could not allocate device specific data");
                goto error;
+        }
        ++cs->cs_init;
@@ -743,8 +756,8 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
        mutex_unlock(&cs->mutex);
        return cs;
-error:  if (cs)
+error:
-                mutex_unlock(&cs->mutex);
+        mutex_unlock(&cs->mutex);
        gig_dbg(DEBUG_INIT, "failed");
        gigaset_freecs(cs);
        return NULL;
@@ -1040,7 +1053,6 @@ void gigaset_freedriver(struct gigaset_driver *drv)
        spin_unlock_irqrestore(&driver_lock, flags);
        gigaset_if_freedriver(drv);
-        module_put(drv->owner);
        kfree(drv->cs);
        kfree(drv->flags);
@@ -1072,10 +1084,6 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
        if (!drv)
                return NULL;
-        if (!try_module_get(owner))
-                goto out1;
-        drv->cs = NULL;
        drv->have_tty = 0;
        drv->minor = minor;
        drv->minors = minors;
@@ -1087,11 +1095,11 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
        drv->cs = kmalloc(minors * sizeof *drv->cs, GFP_KERNEL);
        if (!drv->cs)
-                goto out2;
+                goto error;
        drv->flags = kmalloc(minors * sizeof *drv->flags, GFP_KERNEL);
        if (!drv->flags)
-                goto out3;
+                goto error;
        for (i = 0; i < minors; ++i) {
                drv->flags[i] = 0;
@@ -1108,11 +1116,8 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
        return drv;
-out3:
+error:
        kfree(drv->cs);
-out2:
-        module_put(owner);
-out1:
        kfree(drv);
        return NULL;
 }
diff --git a/drivers/kvm/kvm.h b/drivers/kvm/kvm.h
index 91e0c75aca8f..2db1ca4c6800 100644
--- a/drivers/kvm/kvm.h
+++ b/drivers/kvm/kvm.h
@@ -242,6 +242,7 @@ struct kvm_vcpu {
        u64 pdptrs[4]; /* pae */
        u64 shadow_efer;
        u64 apic_base;
+        u64 ia32_misc_enable_msr;
        int nmsrs;
        struct vmx_msr_entry *guest_msrs;
        struct vmx_msr_entry *host_msrs;
diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index 67c1154960f0..b10972ed0c9f 100644
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -272,7 +272,9 @@ static void kvm_free_physmem(struct kvm *kvm)
 static void kvm_free_vcpu(struct kvm_vcpu *vcpu)
 {
+        vcpu_load(vcpu->kvm, vcpu_slot(vcpu));
        kvm_mmu_destroy(vcpu);
+        vcpu_put(vcpu);
        kvm_arch_ops->vcpu_free(vcpu);
 }
@@ -1224,6 +1226,9 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
        case MSR_IA32_APICBASE:
                data = vcpu->apic_base;
                break;
+        case MSR_IA32_MISC_ENABLE:
+                data = vcpu->ia32_misc_enable_msr;
+                break;
 #ifdef CONFIG_X86_64
        case MSR_EFER:
                data = vcpu->shadow_efer;
@@ -1295,6 +1300,9 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
        case MSR_IA32_APICBASE:
                vcpu->apic_base = data;
                break;
+        case MSR_IA32_MISC_ENABLE:
+                vcpu->ia32_misc_enable_msr = data;
+                break;
        default:
                printk(KERN_ERR "kvm: unhandled wrmsr: 0x%x\n", msr);
                return 1;
@@ -1598,6 +1606,10 @@ static u32 msrs_to_save[] = {
 static unsigned num_msrs_to_save;
+static u32 emulated_msrs[] = {
+        MSR_IA32_MISC_ENABLE,
+};
 static __init void kvm_init_msr_list(void)
 {
        u32 dummy[2];
@@ -1923,7 +1935,7 @@ static long kvm_dev_ioctl(struct file *filp,
                if (copy_from_user(&msr_list, user_msr_list, sizeof msr_list))
                        goto out;
                n = msr_list.nmsrs;
-                msr_list.nmsrs = num_msrs_to_save;
+                msr_list.nmsrs = num_msrs_to_save + ARRAY_SIZE(emulated_msrs);
                if (copy_to_user(user_msr_list, &msr_list, sizeof msr_list))
                        goto out;
                r = -E2BIG;
@@ -1933,6 +1945,11 @@ static long kvm_dev_ioctl(struct file *filp,
                if (copy_to_user(user_msr_list->indices, &msrs_to_save,
                                 num_msrs_to_save * sizeof(u32)))
                        goto out;
+                if (copy_to_user(user_msr_list->indices
+                                 + num_msrs_to_save * sizeof(u32),
+                                 &emulated_msrs,
+                                 ARRAY_SIZE(emulated_msrs) * sizeof(u32)))
+                        goto out;
                r = 0;
                break;
        }
diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index c6f972914f08..22c426cd8cb2 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -143,6 +143,7 @@ static int dbg = 1;
 #define PFERR_PRESENT_MASK (1U << 0)
 #define PFERR_WRITE_MASK (1U << 1)
 #define PFERR_USER_MASK (1U << 2)
+#define PFERR_FETCH_MASK (1U << 4)
 #define PT64_ROOT_LEVEL 4
 #define PT32_ROOT_LEVEL 2
@@ -168,6 +169,11 @@ static int is_cpuid_PSE36(void)
        return 1;
 }
+static int is_nx(struct kvm_vcpu *vcpu)
+{
+        return vcpu->shadow_efer & EFER_NX;
+}
 static int is_present_pte(unsigned long pte)
 {
        return pte & PT_PRESENT_MASK;
@@ -992,16 +998,6 @@ static inline int fix_read_pf(u64 *shadow_ent)
        return 0;
 }
-static int may_access(u64 pte, int write, int user)
-{
-        if (user && !(pte & PT_USER_MASK))
-                return 0;
-        if (write && !(pte & PT_WRITABLE_MASK))
-                return 0;
-        return 1;
-}
 static void paging_free(struct kvm_vcpu *vcpu)
 {
        nonpaging_free(vcpu);
diff --git a/drivers/kvm/paging_tmpl.h b/drivers/kvm/paging_tmpl.h
index 2dbf4307ed9e..149fa45fd9a5 100644
--- a/drivers/kvm/paging_tmpl.h
+++ b/drivers/kvm/paging_tmpl.h
@@ -63,13 +63,15 @@ struct guest_walker {
        pt_element_t *ptep;
        pt_element_t inherited_ar;
        gfn_t gfn;
+        u32 error_code;
 };
 /*
 * Fetch a guest pte for a guest virtual address
 */
-static void FNAME(walk_addr)(struct guest_walker *walker,
+static int FNAME(walk_addr)(struct guest_walker *walker,
-                             struct kvm_vcpu *vcpu, gva_t addr)
+                            struct kvm_vcpu *vcpu, gva_t addr,
+                            int write_fault, int user_fault, int fetch_fault)
 {
        hpa_t hpa;
        struct kvm_memory_slot *slot;
@@ -86,7 +88,7 @@ static void FNAME(walk_addr)(struct guest_walker *walker,
                walker->ptep = &vcpu->pdptrs[(addr >> 30) & 3];
                root = *walker->ptep;
                if (!(root & PT_PRESENT_MASK))
-                        return;
+                        goto not_present;
                --walker->level;
        }
 #endif
@@ -111,11 +113,23 @@ static void FNAME(walk_addr)(struct guest_walker *walker,
                ASSERT(((unsigned long)walker->table & PAGE_MASK) ==
                       ((unsigned long)ptep & PAGE_MASK));
-                if (is_present_pte(*ptep) && !(*ptep &  PT_ACCESSED_MASK))
-                        *ptep |= PT_ACCESSED_MASK;
                if (!is_present_pte(*ptep))
-                        break;
+                        goto not_present;
+                if (write_fault && !is_writeble_pte(*ptep))
+                        if (user_fault || is_write_protection(vcpu))
+                                goto access_error;
+                if (user_fault && !(*ptep & PT_USER_MASK))
+                        goto access_error;
+#if PTTYPE == 64
+                if (fetch_fault && is_nx(vcpu) && (*ptep & PT64_NX_MASK))
+                        goto access_error;
+#endif
+                if (!(*ptep & PT_ACCESSED_MASK))
+                        *ptep |= PT_ACCESSED_MASK;      /* avoid rmw */
                if (walker->level == PT_PAGE_TABLE_LEVEL) {
                        walker->gfn = (*ptep & PT_BASE_ADDR_MASK)
@@ -146,6 +160,23 @@ static void FNAME(walk_addr)(struct guest_walker *walker,
        }
        walker->ptep = ptep;
        pgprintk("%s: pte %llx\n", __FUNCTION__, (u64)*ptep);
+        return 1;
+not_present:
+        walker->error_code = 0;
+        goto err;
+access_error:
+        walker->error_code = PFERR_PRESENT_MASK;
+err:
+        if (write_fault)
+                walker->error_code |= PFERR_WRITE_MASK;
+        if (user_fault)
+                walker->error_code |= PFERR_USER_MASK;
+        if (fetch_fault)
+                walker->error_code |= PFERR_FETCH_MASK;
+        return 0;
 }
 static void FNAME(release_walker)(struct guest_walker *walker)
@@ -274,7 +305,7 @@ static int FNAME(fix_write_pf)(struct kvm_vcpu *vcpu,
        struct kvm_mmu_page *page;
        if (is_writeble_pte(*shadow_ent))
-                return 0;
+                return !user || (*shadow_ent & PT_USER_MASK);
        writable_shadow = *shadow_ent & PT_SHADOW_WRITABLE_MASK;
        if (user) {
@@ -347,8 +378,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
                               u32 error_code)
 {
        int write_fault = error_code & PFERR_WRITE_MASK;
-        int pte_present = error_code & PFERR_PRESENT_MASK;
        int user_fault = error_code & PFERR_USER_MASK;
+        int fetch_fault = error_code & PFERR_FETCH_MASK;
        struct guest_walker walker;
        u64 *shadow_pte;
        int fixed;
@@ -365,19 +396,20 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
        /*
         * Look up the shadow pte for the faulting address.
         */
-        FNAME(walk_addr)(&walker, vcpu, addr);
+        r = FNAME(walk_addr)(&walker, vcpu, addr, write_fault, user_fault,
-        shadow_pte = FNAME(fetch)(vcpu, addr, &walker);
+                             fetch_fault);
        /*
         * The page is not mapped by the guest.  Let the guest handle it.
         */
-        if (!shadow_pte) {
+        if (!r) {
-                pgprintk("%s: not mapped\n", __FUNCTION__);
+                pgprintk("%s: guest page fault\n", __FUNCTION__);
-                inject_page_fault(vcpu, addr, error_code);
+                inject_page_fault(vcpu, addr, walker.error_code);
                FNAME(release_walker)(&walker);
                return 0;
        }
+        shadow_pte = FNAME(fetch)(vcpu, addr, &walker);
        pgprintk("%s: shadow pte %p %llx\n", __FUNCTION__,
                 shadow_pte, *shadow_pte);
@@ -399,22 +431,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         * mmio: emulate if accessible, otherwise its a guest fault.
         */
        if (is_io_pte(*shadow_pte)) {
-                if (may_access(*shadow_pte, write_fault, user_fault))
+                return 1;
-                        return 1;
-                pgprintk("%s: io work, no access\n", __FUNCTION__);
-                inject_page_fault(vcpu, addr,
-                                  error_code | PFERR_PRESENT_MASK);
-                kvm_mmu_audit(vcpu, "post page fault (io)");
-                return 0;
-        }
-        /*
-         * pte not present, guest page fault.
-         */
-        if (pte_present && !fixed && !write_pt) {
-                inject_page_fault(vcpu, addr, error_code);
-                kvm_mmu_audit(vcpu, "post page fault (guest)");
-                return 0;
        }
        ++kvm_stat.pf_fixed;
@@ -429,7 +446,7 @@ static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr)
        pt_element_t guest_pte;
        gpa_t gpa;
-        FNAME(walk_addr)(&walker, vcpu, vaddr);
+        FNAME(walk_addr)(&walker, vcpu, vaddr, 0, 0, 0);
        guest_pte = *walker.ptep;
        FNAME(release_walker)(&walker);
diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
index 714f6a7841cd..9c70ff65e6b7 100644
--- a/drivers/kvm/svm.c
+++ b/drivers/kvm/svm.c
@@ -502,6 +502,7 @@ static void init_vmcb(struct vmcb *vmcb)
                                (1ULL << INTERCEPT_IOIO_PROT) |
                                (1ULL << INTERCEPT_MSR_PROT) |
                                (1ULL << INTERCEPT_TASK_SWITCH) |
+                                (1ULL << INTERCEPT_SHUTDOWN) |
                                (1ULL << INTERCEPT_VMRUN) |
                                (1ULL << INTERCEPT_VMMCALL) |
                                (1ULL << INTERCEPT_VMLOAD) |
@@ -680,14 +681,14 @@ static void svm_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
 static void svm_get_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        dt->limit = vcpu->svm->vmcb->save.ldtr.limit;
+        dt->limit = vcpu->svm->vmcb->save.idtr.limit;
-        dt->base = vcpu->svm->vmcb->save.ldtr.base;
+        dt->base = vcpu->svm->vmcb->save.idtr.base;
 }
 static void svm_set_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
 {
-        vcpu->svm->vmcb->save.ldtr.limit = dt->limit;
+        vcpu->svm->vmcb->save.idtr.limit = dt->limit;
-        vcpu->svm->vmcb->save.ldtr.base = dt->base ;
+        vcpu->svm->vmcb->save.idtr.base = dt->base ;
 }
 static void svm_get_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
@@ -892,6 +893,19 @@ static int pf_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
        return 0;
 }
+static int shutdown_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+{
+        /*
+         * VMCB is undefined after a SHUTDOWN intercept
+         * so reinitialize it.
+         */
+        memset(vcpu->svm->vmcb, 0, PAGE_SIZE);
+        init_vmcb(vcpu->svm->vmcb);
+        kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
+        return 0;
+}
 static int io_get_override(struct kvm_vcpu *vcpu,
                          struct vmcb_seg **seg,
                          int *addr_override)
@@ -1249,6 +1263,7 @@ static int (*svm_exit_handlers[])(struct kvm_vcpu *vcpu,
        [SVM_EXIT_IOIO]                         = io_interception,
        [SVM_EXIT_MSR]                          = msr_interception,
        [SVM_EXIT_TASK_SWITCH]                  = task_switch_interception,
+        [SVM_EXIT_SHUTDOWN]                     = shutdown_interception,
        [SVM_EXIT_VMRUN]                        = invalid_op_interception,
        [SVM_EXIT_VMMCALL]                      = invalid_op_interception,
        [SVM_EXIT_VMLOAD]                       = invalid_op_interception,
@@ -1407,7 +1422,8 @@ static int svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
        int r;
 again:
-        do_interrupt_requests(vcpu, kvm_run);
+        if (!vcpu->mmio_read_completed)
+                do_interrupt_requests(vcpu, kvm_run);
        clgi();
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index 0aa2659f6ae5..27f2751c3baa 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -1717,7 +1717,8 @@ again:
        vmcs_writel(HOST_GS_BASE, segment_base(gs_sel));
 #endif
-        do_interrupt_requests(vcpu, kvm_run);
+        if (!vcpu->mmio_read_completed)
+                do_interrupt_requests(vcpu, kvm_run);
        if (vcpu->guest_debug.enabled)
                kvm_guest_debug_pre(vcpu);
diff --git a/drivers/kvm/x86_emulate.c b/drivers/kvm/x86_emulate.c
index be70795b4822..7513cddb929f 100644
--- a/drivers/kvm/x86_emulate.c
+++ b/drivers/kvm/x86_emulate.c
@@ -61,6 +61,7 @@
 #define ModRM       (1<<6)
 /* Destination is only written; never read. */
 #define Mov         (1<<7)
+#define BitOp       (1<<8)
 static u8 opcode_table[256] = {
        /* 0x00 - 0x07 */
@@ -148,7 +149,7 @@ static u8 opcode_table[256] = {
        0, 0, ByteOp | DstMem | SrcNone | ModRM, DstMem | SrcNone | ModRM
 };
-static u8 twobyte_table[256] = {
+static u16 twobyte_table[256] = {
        /* 0x00 - 0x0F */
        0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
        0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
@@ -180,16 +181,16 @@ static u8 twobyte_table[256] = {
        /* 0x90 - 0x9F */
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        /* 0xA0 - 0xA7 */
-        0, 0, 0, DstMem | SrcReg | ModRM, 0, 0, 0, 0,
+        0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
        /* 0xA8 - 0xAF */
-        0, 0, 0, DstMem | SrcReg | ModRM, 0, 0, 0, 0,
+        0, 0, 0, DstMem | SrcReg | ModRM | BitOp, 0, 0, 0, 0,
        /* 0xB0 - 0xB7 */
        ByteOp | DstMem | SrcReg | ModRM, DstMem | SrcReg | ModRM, 0,
-            DstMem | SrcReg | ModRM,
+            DstMem | SrcReg | ModRM | BitOp,
        0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
            DstReg | SrcMem16 | ModRM | Mov,
        /* 0xB8 - 0xBF */
-        0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM,
+        0, 0, DstMem | SrcImmByte | ModRM, DstMem | SrcReg | ModRM | BitOp,
        0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
            DstReg | SrcMem16 | ModRM | Mov,
        /* 0xC0 - 0xCF */
@@ -469,7 +470,8 @@ static int read_descriptor(struct x86_emulate_ctxt *ctxt,
 int
 x86_emulate_memop(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
 {
-        u8 b, d, sib, twobyte = 0, rex_prefix = 0;
+        unsigned d;
+        u8 b, sib, twobyte = 0, rex_prefix = 0;
        u8 modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
        unsigned long *override_base = NULL;
        unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
@@ -726,46 +728,6 @@ done_prefixes:
                ;
        }
-        /* Decode and fetch the destination operand: register or memory. */
-        switch (d & DstMask) {
-        case ImplicitOps:
-                /* Special instructions do their own operand decoding. */
-                goto special_insn;
-        case DstReg:
-                dst.type = OP_REG;
-                if ((d & ByteOp)
-                    && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
-                        dst.ptr = decode_register(modrm_reg, _regs,
-                                                  (rex_prefix == 0));
-                        dst.val = *(u8 *) dst.ptr;
-                        dst.bytes = 1;
-                } else {
-                        dst.ptr = decode_register(modrm_reg, _regs, 0);
-                        switch ((dst.bytes = op_bytes)) {
-                        case 2:
-                                dst.val = *(u16 *)dst.ptr;
-                                break;
-                        case 4:
-                                dst.val = *(u32 *)dst.ptr;
-                                break;
-                        case 8:
-                                dst.val = *(u64 *)dst.ptr;
-                                break;
-                        }
-                }
-                break;
-        case DstMem:
-                dst.type = OP_MEM;
-                dst.ptr = (unsigned long *)cr2;
-                dst.bytes = (d & ByteOp) ? 1 : op_bytes;
-                if (!(d & Mov) && /* optimisation - avoid slow emulated read */
-                    ((rc = ops->read_emulated((unsigned long)dst.ptr,
-                                              &dst.val, dst.bytes, ctxt)) != 0))
-                        goto done;
-                break;
-        }
-        dst.orig_val = dst.val;
        /*
         * Decode and fetch the source operand: register, memory
         * or immediate.
@@ -838,6 +800,50 @@ done_prefixes:
                break;
        }
+        /* Decode and fetch the destination operand: register or memory. */
+        switch (d & DstMask) {
+        case ImplicitOps:
+                /* Special instructions do their own operand decoding. */
+                goto special_insn;
+        case DstReg:
+                dst.type = OP_REG;
+                if ((d & ByteOp)
+                    && !(twobyte_table && (b == 0xb6 || b == 0xb7))) {
+                        dst.ptr = decode_register(modrm_reg, _regs,
+                                                  (rex_prefix == 0));
+                        dst.val = *(u8 *) dst.ptr;
+                        dst.bytes = 1;
+                } else {
+                        dst.ptr = decode_register(modrm_reg, _regs, 0);
+                        switch ((dst.bytes = op_bytes)) {
+                        case 2:
+                                dst.val = *(u16 *)dst.ptr;
+                                break;
+                        case 4:
+                                dst.val = *(u32 *)dst.ptr;
+                                break;
+                        case 8:
+                                dst.val = *(u64 *)dst.ptr;
+                                break;
+                        }
+                }
+                break;
+        case DstMem:
+                dst.type = OP_MEM;
+                dst.ptr = (unsigned long *)cr2;
+                dst.bytes = (d & ByteOp) ? 1 : op_bytes;
+                if (d & BitOp) {
+                        dst.ptr += src.val / BITS_PER_LONG;
+                        dst.bytes = sizeof(long);
+                }
+                if (!(d & Mov) && /* optimisation - avoid slow emulated read */
+                    ((rc = ops->read_emulated((unsigned long)dst.ptr,
+                                              &dst.val, dst.bytes, ctxt)) != 0))
+                        goto done;
+                break;
+        }
+        dst.orig_val = dst.val;
        if (twobyte)
                goto twobyte_insn;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 5432d07c074d..11108165e264 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -479,9 +479,12 @@ static int bitmap_read_sb(struct bitmap *bitmap)
        int err = -EINVAL;
        /* page 0 is the superblock, read it... */
-        if (bitmap->file)
+        if (bitmap->file) {
-                bitmap->sb_page = read_page(bitmap->file, 0, bitmap, PAGE_SIZE);
+                loff_t isize = i_size_read(bitmap->file->f_mapping->host);
-        else {
+                int bytes = isize > PAGE_SIZE ? PAGE_SIZE : isize;
+                bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes);
+        } else {
                bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset, 0);
        }
        if (IS_ERR(bitmap->sb_page)) {
@@ -877,7 +880,8 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                        int count;
                        /* unmap the old page, we're done with it */
                        if (index == num_pages-1)
-                                count = bytes - index * PAGE_SIZE;
+                                count = bytes + sizeof(bitmap_super_t)
+                                        - index * PAGE_SIZE;
                        else
                                count = PAGE_SIZE;
                        if (index == 0) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index fe7c56e10435..3668b170ea68 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1116,7 +1116,8 @@ static int __bind(struct mapped_device *md, struct dm_table *t)
        if (size != get_capacity(md->disk))
                memset(&md->geometry, 0, sizeof(md->geometry));
-        __set_size(md, size);
+        if (md->suspended_bdev)
+                __set_size(md, size);
        if (size == 0)
                return 0;
@@ -1264,6 +1265,11 @@ int dm_swap_table(struct mapped_device *md, struct dm_table *table)
        if (!dm_suspended(md))
                goto out;
+        /* without bdev, the device size cannot be changed */
+        if (!md->suspended_bdev)
+                if (get_capacity(md->disk) != dm_table_get_size(table))
+                        goto out;
        __unbind(md);
        r = __bind(md, table);
@@ -1341,11 +1347,14 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
        /* This does not get reverted if there's an error later. */
        dm_table_presuspend_targets(map);
-        md->suspended_bdev = bdget_disk(md->disk, 0);
+        /* bdget() can stall if the pending I/Os are not flushed */
-        if (!md->suspended_bdev) {
+        if (!noflush) {
-                DMWARN("bdget failed in dm_suspend");
+                md->suspended_bdev = bdget_disk(md->disk, 0);
-                r = -ENOMEM;
+                if (!md->suspended_bdev) {
-                goto flush_and_out;
+                        DMWARN("bdget failed in dm_suspend");
+                        r = -ENOMEM;
+                        goto flush_and_out;
+                }
        }
        /*
@@ -1473,8 +1482,10 @@ int dm_resume(struct mapped_device *md)
        unlock_fs(md);
-        bdput(md->suspended_bdev);
+        if (md->suspended_bdev) {
-        md->suspended_bdev = NULL;
+                bdput(md->suspended_bdev);
+                md->suspended_bdev = NULL;
+        }
        clear_bit(DMF_SUSPENDED, &md->flags);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d1cb45f6d6a9..e8807ea5377d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1633,7 +1633,8 @@ repeat:
         * and 'events' is odd, we can roll back to the previous clean state */
        if (nospares
            && (mddev->in_sync && mddev->recovery_cp == MaxSector)
-            && (mddev->events & 1))
+            && (mddev->events & 1)
+            && mddev->events != 1)
                mddev->events--;
        else {
                /* otherwise we have to go forward and ... */
@@ -3563,6 +3564,8 @@ static int get_bitmap_file(mddev_t * mddev, void __user * arg)
        char *ptr, *buf = NULL;
        int err = -ENOMEM;
+        md_allow_write(mddev);
        file = kmalloc(sizeof(*file), GFP_KERNEL);
        if (!file)
                goto out;
@@ -5031,6 +5034,33 @@ void md_write_end(mddev_t *mddev)
        }
 }
+/* md_allow_write(mddev)
+ * Calling this ensures that the array is marked 'active' so that writes
+ * may proceed without blocking.  It is important to call this before
+ * attempting a GFP_KERNEL allocation while holding the mddev lock.
+ * Must be called with mddev_lock held.
+ */
+void md_allow_write(mddev_t *mddev)
+{
+        if (!mddev->pers)
+                return;
+        if (mddev->ro)
+                return;
+        spin_lock_irq(&mddev->write_lock);
+        if (mddev->in_sync) {
+                mddev->in_sync = 0;
+                set_bit(MD_CHANGE_CLEAN, &mddev->flags);
+                if (mddev->safemode_delay &&
+                    mddev->safemode == 0)
+                        mddev->safemode = 1;
+                spin_unlock_irq(&mddev->write_lock);
+                md_update_sb(mddev, 0);
+        } else
+                spin_unlock_irq(&mddev->write_lock);
+}
+EXPORT_SYMBOL_GPL(md_allow_write);
 static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
 #define SYNC_MARKS      10
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 164b25dca101..97ee870b265d 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1266,6 +1266,11 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
                                        sbio->bi_sector = r1_bio->sector +
                                                conf->mirrors[i].rdev->data_offset;
                                        sbio->bi_bdev = conf->mirrors[i].rdev->bdev;
+                                        for (j = 0; j < vcnt ; j++)
+                                                memcpy(page_address(sbio->bi_io_vec[j].bv_page),
+                                                       page_address(pbio->bi_io_vec[j].bv_page),
+                                                       PAGE_SIZE);
                                }
                        }
        }
@@ -2099,6 +2104,8 @@ static int raid1_reshape(mddev_t *mddev)
                return -EINVAL;
        }
+        md_allow_write(mddev);
        raid_disks = mddev->raid_disks + mddev->delta_disks;
        if (raid_disks < conf->raid_disks) {
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index be008f034ada..467c16982d02 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -405,6 +405,8 @@ static int resize_stripes(raid5_conf_t *conf, int newsize)
        if (newsize <= conf->pool_size)
                return 0; /* never bother to shrink */
+        md_allow_write(conf->mddev);
        /* Step 1 */
        sc = kmem_cache_create(conf->cache_name[1-conf->active_name],
                               sizeof(struct stripe_head)+(newsize-1)*sizeof(struct r5dev),
@@ -2678,7 +2680,7 @@ static int chunk_aligned_read(request_queue_t *q, struct bio * raid_bio)
        mdk_rdev_t *rdev;
        if (!in_chunk_boundary(mddev, raid_bio)) {
-                printk("chunk_aligned_read : non aligned\n");
+                PRINTK("chunk_aligned_read : non aligned\n");
                return 0;
        }
        /*
@@ -3250,6 +3252,7 @@ raid5_store_stripe_cache_size(mddev_t *mddev, const char *page, size_t len)
                else
                        break;
        }
+        md_allow_write(mddev);
        while (new > conf->max_nr_stripes) {
                if (grow_one_stripe(conf))
                        conf->max_nr_stripes++;
diff --git a/drivers/media/video/video-buf.c b/drivers/media/video/video-buf.c
index 635d102c86f0..6504a5866849 100644
--- a/drivers/media/video/video-buf.c
+++ b/drivers/media/video/video-buf.c
@@ -700,6 +700,7 @@ videobuf_qbuf(struct videobuf_queue *q,
                goto done;
        }
        if (buf->state == STATE_QUEUED ||
+            buf->state == STATE_PREPARED ||
            buf->state == STATE_ACTIVE) {
                dprintk(1,"qbuf: buffer is already queued or active.\n");
                goto done;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index ca5acc4736df..953808efe551 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -57,8 +57,8 @@
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.3"
+#define DRV_MODULE_VERSION      "1.5.4"
-#define DRV_MODULE_RELDATE      "January 8, 2007"
+#define DRV_MODULE_RELDATE      "January 24, 2007"
 #define RUN_AT(x) (jiffies + (x))
@@ -5845,9 +5845,11 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
        reg = REG_RD_IND(bp, BNX2_SHM_HDR_SIGNATURE);
        if ((reg & BNX2_SHM_HDR_SIGNATURE_SIG_MASK) ==
-            BNX2_SHM_HDR_SIGNATURE_SIG)
+            BNX2_SHM_HDR_SIGNATURE_SIG) {
-                bp->shmem_base = REG_RD_IND(bp, BNX2_SHM_HDR_ADDR_0);
+                u32 off = PCI_FUNC(pdev->devfn) << 2;
-        else
+                bp->shmem_base = REG_RD_IND(bp, BNX2_SHM_HDR_ADDR_0 + off);
+        } else
                bp->shmem_base = HOST_VIEW_SHMEM_BASE;
        /* Get the permanent MAC address.  First we need to make sure the
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 39ad9f73d1ec..be10a3a26b5b 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -39,7 +39,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0043"
+#define DRV_VERSION     "EHEA_0044"
 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
        | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 83fa32f72398..1072e69ef85d 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -558,12 +558,12 @@ static irqreturn_t ehea_qp_aff_irq_handler(int irq, void *param)
        u32 qp_token;
        eqe = ehea_poll_eq(port->qp_eq);
-        ehea_debug("eqe=%p", eqe);
        while (eqe) {
-                ehea_debug("*eqe=%lx", *(u64*)eqe);
-                eqe = ehea_poll_eq(port->qp_eq);
                qp_token = EHEA_BMASK_GET(EHEA_EQE_QP_TOKEN, eqe->entry);
-                ehea_debug("next eqe=%p", eqe);
+                ehea_error("QP aff_err: entry=0x%lx, token=0x%x",
+                           eqe->entry, qp_token);
+                eqe = ehea_poll_eq(port->qp_eq);
        }
        return IRQ_HANDLED;
@@ -575,8 +575,9 @@ static struct ehea_port *ehea_get_port(struct ehea_adapter *adapter,
        int i;
        for (i = 0; i < adapter->num_ports; i++)
-                if (adapter->port[i]->logical_port_id == logical_port)
+                if (adapter->port[i])
-                        return adapter->port[i];
+                        if (adapter->port[i]->logical_port_id == logical_port)
+                                return adapter->port[i];
        return NULL;
 }
@@ -642,6 +643,8 @@ int ehea_sense_port_attr(struct ehea_port *port)
                break;
        }
+        port->autoneg = 1;
        /* Number of default QPs */
        port->num_def_qps = cb0->num_default_qps;
@@ -728,10 +731,7 @@ int ehea_set_portspeed(struct ehea_port *port, u32 port_speed)
                }
        } else {
                if (hret == H_AUTHORITY) {
-                        ehea_info("Hypervisor denied setting port speed. Either"
+                        ehea_info("Hypervisor denied setting port speed");
-                                  " this partition is not authorized to set "
-                                  "port speed or another partition has modified"
-                                  " port speed first.");
                        ret = -EPERM;
                } else {
                        ret = -EIO;
@@ -998,7 +998,7 @@ static int ehea_configure_port(struct ehea_port *port)
                     | EHEA_BMASK_SET(PXLY_RC_JUMBO_FRAME, 1);
        for (i = 0; i < port->num_def_qps; i++)
-                cb0->default_qpn_arr[i] = port->port_res[i].qp->init_attr.qp_nr;
+                cb0->default_qpn_arr[i] = port->port_res[0].qp->init_attr.qp_nr;
        if (netif_msg_ifup(port))
                ehea_dump(cb0, sizeof(*cb0), "ehea_configure_port");
@@ -1485,11 +1485,12 @@ out:
 static void ehea_promiscuous_error(u64 hret, int enable)
 {
-        ehea_info("Hypervisor denied %sabling promiscuous mode.%s",
+        if (hret == H_AUTHORITY)
-                  enable == 1 ? "en" : "dis",
+                ehea_info("Hypervisor denied %sabling promiscuous mode",
-                  hret != H_AUTHORITY ? "" : " Another partition owning a "
+                          enable == 1 ? "en" : "dis");
-                  "logical port on the same physical port might have altered "
+        else
-                  "promiscuous mode first.");
+                ehea_error("failed %sabling promiscuous mode",
+                           enable == 1 ? "en" : "dis");
 }
 static void ehea_promiscuous(struct net_device *dev, int enable)
@@ -2267,6 +2268,8 @@ static void ehea_tx_watchdog(struct net_device *dev)
 int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
 {
        struct hcp_query_ehea *cb;
+        struct device_node *lhea_dn = NULL;
+        struct device_node *eth_dn = NULL;
        u64 hret;
        int ret;
@@ -2283,7 +2286,18 @@ int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
                goto out_herr;
        }
-        adapter->num_ports = cb->num_ports;
+        /* Determine the number of available logical ports
+         * by counting the child nodes of the lhea OFDT entry
+         */
+        adapter->num_ports = 0;
+        lhea_dn = of_find_node_by_name(lhea_dn, "lhea");
+        do {
+                eth_dn = of_get_next_child(lhea_dn, eth_dn);
+                if (eth_dn)
+                        adapter->num_ports++;
+        } while ( eth_dn );
+        of_node_put(lhea_dn);
        adapter->max_mc_mac = cb->max_mc_mac - 1;
        ret = 0;
@@ -2334,8 +2348,6 @@ static int ehea_setup_single_port(struct ehea_port *port,
        INIT_LIST_HEAD(&port->mc_list->list);
-        ehea_set_portspeed(port, EHEA_SPEED_AUTONEG);
        ret = ehea_sense_port_attr(port);
        if (ret)
                goto out;
@@ -2471,14 +2483,16 @@ static int __devinit ehea_probe(struct ibmebus_dev *dev,
        adapter_handle = (u64*)get_property(dev->ofdev.node, "ibm,hea-handle",
                                            NULL);
-        if (!adapter_handle) {
+        if (adapter_handle)
+                adapter->handle = *adapter_handle;
+        if (!adapter->handle) {
                dev_err(&dev->ofdev.dev, "failed getting handle for adapter"
                        " '%s'\n", dev->ofdev.node->full_name);
                ret = -ENODEV;
                goto out_free_ad;
        }
-        adapter->handle = *adapter_handle;
        adapter->pd = EHEA_PD_ID;
        dev->ofdev.dev.driver_data = adapter;
diff --git a/drivers/net/ehea/ehea_phyp.c b/drivers/net/ehea/ehea_phyp.c
index 0cfc2bc1a27b..37716e05e808 100644
--- a/drivers/net/ehea/ehea_phyp.c
+++ b/drivers/net/ehea/ehea_phyp.c
@@ -94,6 +94,7 @@ static long ehea_plpar_hcall9(unsigned long opcode,
 {
        long ret;
        int i, sleep_msecs;
+        u8 cb_cat;
        for (i = 0; i < 5; i++) {
                ret = plpar_hcall9(opcode, outs,
@@ -106,7 +107,13 @@ static long ehea_plpar_hcall9(unsigned long opcode,
                        continue;
                }
-                if (ret < H_SUCCESS)
+                cb_cat = EHEA_BMASK_GET(H_MEHEAPORT_CAT, arg2);
+                if ((ret < H_SUCCESS) && !(((ret == H_AUTHORITY)
+                    && (opcode == H_MODIFY_HEA_PORT))
+                    && (((cb_cat == H_PORT_CB4) && ((arg3 == H_PORT_CB4_JUMBO)
+                    || (arg3 == H_PORT_CB4_SPEED))) || ((cb_cat == H_PORT_CB7)
+                    && (arg3 == H_PORT_CB7_DUCQPN)))))
                        ehea_error("opcode=%lx ret=%lx"
                                   " arg1=%lx arg2=%lx arg3=%lx arg4=%lx"
                                   " arg5=%lx arg6=%lx arg7=%lx arg8=%lx"
@@ -120,7 +127,6 @@ static long ehea_plpar_hcall9(unsigned long opcode,
                                   outs[0], outs[1], outs[2], outs[3],
                                   outs[4], outs[5], outs[6], outs[7],
                                   outs[8]);
                return ret;
        }
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 3ca1082ec776..340ee99652eb 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -441,25 +441,13 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
                goto drop;
        }
-        /* Make sure there is room for IrDA-USB header. The actual
+        memcpy(self->tx_buff + self->header_length, skb->data, skb->len);
-         * allocation will be done lower in skb_push().
-         * Also, we don't use directly skb_cow(), because it require
-         * headroom >= 16, which force unnecessary copies - Jean II */
-        if (skb_headroom(skb) < self->header_length) {
-                IRDA_DEBUG(0, "%s(), Insuficient skb headroom.\n", __FUNCTION__);
-                if (skb_cow(skb, self->header_length)) {
-                        IRDA_WARNING("%s(), failed skb_cow() !!!\n", __FUNCTION__);
-                        goto drop;
-                }
-        }
        /* Change setting for next frame */
        if (self->capability & IUC_STIR421X) {
                __u8 turnaround_time;
-                __u8* frame;
+                __u8* frame = self->tx_buff;
                turnaround_time = get_turnaround_time( skb );
-                frame= skb_push(skb, self->header_length);
                irda_usb_build_header(self, frame, 0);
                frame[2] = turnaround_time;
                if ((skb->len != 0) &&
@@ -472,17 +460,17 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
                        frame[1] = 0;
                }
        } else {
-                irda_usb_build_header(self, skb_push(skb, self->header_length), 0);
+                irda_usb_build_header(self, self->tx_buff, 0);
        }
        /* FIXME: Make macro out of this one */
        ((struct irda_skb_cb *)skb->cb)->context = self;
-        usb_fill_bulk_urb(urb, self->usbdev, 
+        usb_fill_bulk_urb(urb, self->usbdev,
                      usb_sndbulkpipe(self->usbdev, self->bulk_out_ep),
-                      skb->data, IRDA_SKB_MAX_MTU,
+                      self->tx_buff, skb->len + self->header_length,
                      write_bulk_callback, skb);
-        urb->transfer_buffer_length = skb->len;
        /* This flag (URB_ZERO_PACKET) indicates that what we send is not
         * a continuous stream of data but separate packets.
         * In this case, the USB layer will insert an empty USB frame (TD)
@@ -1455,6 +1443,9 @@ static inline void irda_usb_close(struct irda_usb_cb *self)
        /* Remove the speed buffer */
        kfree(self->speed_buff);
        self->speed_buff = NULL;
+        kfree(self->tx_buff);
+        self->tx_buff = NULL;
 }
 /********************** USB CONFIG SUBROUTINES **********************/
@@ -1524,8 +1515,6 @@ static inline int irda_usb_parse_endpoints(struct irda_usb_cb *self, struct usb_
        IRDA_DEBUG(0, "%s(), And our endpoints are : in=%02X, out=%02X (%d), int=%02X\n",
                __FUNCTION__, self->bulk_in_ep, self->bulk_out_ep, self->bulk_out_mtu, self->bulk_int_ep);
-        /* Should be 8, 16, 32 or 64 bytes */
-        IRDA_ASSERT(self->bulk_out_mtu == 64, ;);
        return((self->bulk_in_ep != 0) && (self->bulk_out_ep != 0));
 }
@@ -1753,9 +1742,14 @@ static int irda_usb_probe(struct usb_interface *intf,
        memset(self->speed_buff, 0, IRDA_USB_SPEED_MTU);
+        self->tx_buff = kzalloc(IRDA_SKB_MAX_MTU + self->header_length,
+                                GFP_KERNEL);
+        if (self->tx_buff == NULL)
+                goto err_out_4;
        ret = irda_usb_open(self);
        if (ret) 
-                goto err_out_4;
+                goto err_out_5;
        IRDA_MESSAGE("IrDA: Registered device %s\n", net->name);
        usb_set_intfdata(intf, self);
@@ -1766,14 +1760,14 @@ static int irda_usb_probe(struct usb_interface *intf,
                self->needspatch = (ret < 0);
                if (self->needspatch) {
                        IRDA_ERROR("STIR421X: Couldn't upload patch\n");
-                        goto err_out_5;
+                        goto err_out_6;
                }
                /* replace IrDA class descriptor with what patched device is now reporting */
                irda_desc = irda_usb_find_class_desc (self->usbintf);
                if (irda_desc == NULL) {
                        ret = -ENODEV;
-                        goto err_out_5;
+                        goto err_out_6;
                }
                if (self->irda_desc)
                        kfree (self->irda_desc);
@@ -1782,9 +1776,10 @@ static int irda_usb_probe(struct usb_interface *intf,
        }
        return 0;
+err_out_6:
-err_out_5:
        unregister_netdev(self->netdev);
+err_out_5:
+        kfree(self->tx_buff);
 err_out_4:
        kfree(self->speed_buff);
 err_out_3:
diff --git a/drivers/net/irda/irda-usb.h b/drivers/net/irda/irda-usb.h
index 6b2271f18e77..e846c38224a3 100644
--- a/drivers/net/irda/irda-usb.h
+++ b/drivers/net/irda/irda-usb.h
@@ -156,6 +156,7 @@ struct irda_usb_cb {
        struct irlap_cb   *irlap;       /* The link layer we are binded to */
        struct qos_info qos;
        char *speed_buff;               /* Buffer for speed changes */
+        char *tx_buff;
        struct timeval stamp;
        struct timeval now;
diff --git a/drivers/net/irda/stir4200.c b/drivers/net/irda/stir4200.c
index c14a74634fd5..20d306fea4cb 100644
--- a/drivers/net/irda/stir4200.c
+++ b/drivers/net/irda/stir4200.c
@@ -59,7 +59,7 @@
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_DESCRIPTION("IrDA-USB Dongle Driver for SigmaTel STIr4200");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c
index 18c68193bf14..e2b1af618450 100644
--- a/drivers/net/irda/vlsi_ir.c
+++ b/drivers/net/irda/vlsi_ir.c
@@ -166,7 +166,7 @@ static void vlsi_proc_pdev(struct seq_file *seq, struct pci_dev *pdev)
        unsigned i;
        seq_printf(seq, "\n%s (vid/did: %04x/%04x)\n",
-                   PCIDEV_NAME(pdev), (int)pdev->vendor, (int)pdev->device);
+                   pci_name(pdev), (int)pdev->vendor, (int)pdev->device);
        seq_printf(seq, "pci-power-state: %u\n", (unsigned) pdev->current_state);
        seq_printf(seq, "resources: irq=%u / io=0x%04x / dma_mask=0x%016Lx\n",
                   pdev->irq, (unsigned)pci_resource_start(pdev, 0), (unsigned long long)pdev->dma_mask);
@@ -1401,7 +1401,7 @@ static void vlsi_tx_timeout(struct net_device *ndev)
        if (vlsi_start_hw(idev))
                IRDA_ERROR("%s: failed to restart hw - %s(%s) unusable!\n",
-                           __FUNCTION__, PCIDEV_NAME(idev->pdev), ndev->name);
+                           __FUNCTION__, pci_name(idev->pdev), ndev->name);
        else
                netif_start_queue(ndev);
 }
@@ -1643,7 +1643,7 @@ vlsi_irda_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                pdev->current_state = 0; /* hw must be running now */
        IRDA_MESSAGE("%s: IrDA PCI controller %s detected\n",
-                     drivername, PCIDEV_NAME(pdev));
+                     drivername, pci_name(pdev));
        if ( !pci_resource_start(pdev,0)
             || !(pci_resource_flags(pdev,0) & IORESOURCE_IO) ) {
@@ -1728,7 +1728,7 @@ static void __devexit vlsi_irda_remove(struct pci_dev *pdev)
        pci_set_drvdata(pdev, NULL);
-        IRDA_MESSAGE("%s: %s removed\n", drivername, PCIDEV_NAME(pdev));
+        IRDA_MESSAGE("%s: %s removed\n", drivername, pci_name(pdev));
 }
 #ifdef CONFIG_PM
@@ -1748,7 +1748,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
        if (!ndev) {
                IRDA_ERROR("%s - %s: no netdevice \n",
-                           __FUNCTION__, PCIDEV_NAME(pdev));
+                           __FUNCTION__, pci_name(pdev));
                return 0;
        }
        idev = ndev->priv;      
@@ -1759,7 +1759,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
                        pdev->current_state = state.event;
                }
                else
-                        IRDA_ERROR("%s - %s: invalid suspend request %u -> %u\n", __FUNCTION__, PCIDEV_NAME(pdev), pdev->current_state, state.event);
+                        IRDA_ERROR("%s - %s: invalid suspend request %u -> %u\n", __FUNCTION__, pci_name(pdev), pdev->current_state, state.event);
                up(&idev->sem);
                return 0;
        }
@@ -1787,7 +1787,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
        if (!ndev) {
                IRDA_ERROR("%s - %s: no netdevice \n",
-                           __FUNCTION__, PCIDEV_NAME(pdev));
+                           __FUNCTION__, pci_name(pdev));
                return 0;
        }
        idev = ndev->priv;      
@@ -1795,7 +1795,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
        if (pdev->current_state == 0) {
                up(&idev->sem);
                IRDA_WARNING("%s - %s: already resumed\n",
-                             __FUNCTION__, PCIDEV_NAME(pdev));
+                             __FUNCTION__, pci_name(pdev));
                return 0;
        }
        
diff --git a/drivers/net/irda/vlsi_ir.h b/drivers/net/irda/vlsi_ir.h
index c37f0bc4c7f9..2d3b773d8e35 100644
--- a/drivers/net/irda/vlsi_ir.h
+++ b/drivers/net/irda/vlsi_ir.h
@@ -41,39 +41,6 @@
 #define PCI_CLASS_SUBCLASS_MASK         0xffff
 #endif
-/* in recent 2.5 interrupt handlers have non-void return value */
-#ifndef IRQ_RETVAL
-typedef void irqreturn_t;
-#define IRQ_NONE
-#define IRQ_HANDLED
-#define IRQ_RETVAL(x)
-#endif
-/* some stuff need to check kernelversion. Not all 2.5 stuff was present
- * in early 2.5.x - the test is merely to separate 2.4 from 2.5
- */
-#include <linux/version.h>
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-/* PDE() introduced in 2.5.4 */
-#ifdef CONFIG_PROC_FS
-#define PDE(inode) ((inode)->i_private)
-#endif
-/* irda crc16 calculation exported in 2.5.42 */
-#define irda_calc_crc16(fcs,buf,len)    (GOOD_FCS)
-/* we use this for unified pci device name access */
-#define PCIDEV_NAME(pdev)       ((pdev)->name)
-#else /* 2.5 or later */
-/* whatever we get from the associated struct device - bus:slot:dev.fn id */
-#define PCIDEV_NAME(pdev)       (pci_name(pdev))
-#endif
 /* ================================================================ */
 /* non-standard PCI registers */
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index c41ae4286eea..b3bf86422734 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -314,6 +314,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
        while (mp->tx_desc_count > 0) {
                spin_lock_irqsave(&mp->lock, flags);
+                /* tx_desc_count might have changed before acquiring the lock */
+                if (mp->tx_desc_count <= 0) {
+                        spin_unlock_irqrestore(&mp->lock, flags);
+                        return released;
+                }
                tx_index = mp->tx_used_desc_q;
                desc = &mp->p_tx_desc_area[tx_index];
                cmd_sts = desc->cmd_sts;
@@ -332,13 +339,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
                if (skb)
                        mp->tx_skb[tx_index] = NULL;
-                spin_unlock_irqrestore(&mp->lock, flags);
                if (cmd_sts & ETH_ERROR_SUMMARY) {
                        printk("%s: Error in TX\n", dev->name);
                        mp->stats.tx_errors++;
                }
+                spin_unlock_irqrestore(&mp->lock, flags);
                if (cmd_sts & ETH_TX_FIRST_DESC)
                        dma_unmap_single(NULL, addr, count, DMA_TO_DEVICE);
                else
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 6490acf05305..59324b1693d6 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -63,12 +63,11 @@
 #include "netxen_nic_hw.h"
-#define NETXEN_NIC_BUILD_NO     "4"
+#define NETXEN_NIC_BUILD_NO     "2"
 #define _NETXEN_NIC_LINUX_MAJOR 3
 #define _NETXEN_NIC_LINUX_MINOR 3
-#define _NETXEN_NIC_LINUX_SUBVERSION 2
+#define _NETXEN_NIC_LINUX_SUBVERSION 3
-#define NETXEN_NIC_LINUX_VERSIONID  "3.3.2" "-" NETXEN_NIC_BUILD_NO
+#define NETXEN_NIC_LINUX_VERSIONID  "3.3.3" "-" NETXEN_NIC_BUILD_NO
-#define NETXEN_NIC_FW_VERSIONID "3.3.2"
 #define RCV_DESC_RINGSIZE       \
        (sizeof(struct rcv_desc) * adapter->max_rx_desc_count)
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index c0c31d1914a7..191e2336e323 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -984,7 +984,8 @@ void netxen_nic_flash_print(struct netxen_adapter *adapter)
                       _NETXEN_NIC_LINUX_MAJOR, fw_major);
                adapter->driver_mismatch = 1;
        }
-        if (fw_minor != _NETXEN_NIC_LINUX_MINOR) {
+        if (fw_minor != _NETXEN_NIC_LINUX_MINOR &&
+                        fw_minor != (_NETXEN_NIC_LINUX_MINOR + 1)) {
                printk(KERN_ERR "The mismatch in driver version and firmware "
                       "version minor number\n"
                       "Driver version minor number = %d \t"
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 8a5792fea774..96e1bee19ba0 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1144,7 +1144,7 @@ static int __init netxen_init_module(void)
        if ((netxen_workq = create_singlethread_workqueue("netxen")) == 0)
                return -ENOMEM;
-        return pci_module_init(&netxen_driver);
+        return pci_register_driver(&netxen_driver);
 }
 module_init(netxen_init_module);
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 342f4062de0b..461e8274ef69 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -606,11 +606,14 @@ static int el3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
    kio_addr_t ioaddr = dev->base_addr;
    struct el3_private *priv = netdev_priv(dev);
+    unsigned long flags;
    DEBUG(3, "%s: el3_start_xmit(length = %ld) called, "
          "status %4.4x.\n", dev->name, (long)skb->len,
          inw(ioaddr + EL3_STATUS));
+    spin_lock_irqsave(&priv->lock, flags);    
    priv->stats.tx_bytes += skb->len;
    /* Put out the doubleword header... */
@@ -628,6 +631,7 @@ static int el3_start_xmit(struct sk_buff *skb, struct net_device *dev)
    dev_kfree_skb(skb);
    pop_tx_status(dev);
+    spin_unlock_irqrestore(&priv->lock, flags);    
    
    return 0;
 }
@@ -729,14 +733,13 @@ static void media_check(unsigned long arg)
    if (!netif_device_present(dev)) goto reschedule;
-    EL3WINDOW(1);
    /* Check for pending interrupt with expired latency timer: with
       this, we can limp along even if the interrupt is blocked */
    if ((inw(ioaddr + EL3_STATUS) & IntLatch) &&
        (inb(ioaddr + EL3_TIMER) == 0xff)) {
        if (!lp->fast_poll)
            printk(KERN_WARNING "%s: interrupt(s) dropped!\n", dev->name);
-        el3_interrupt(dev->irq, lp);
+        el3_interrupt(dev->irq, dev);
        lp->fast_poll = HZ;
    }
    if (lp->fast_poll) {
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index e175f3910b18..9765fa661467 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -286,6 +286,7 @@ int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd)
        return 0;
 }
+EXPORT_SYMBOL(phy_ethtool_sset);
 int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd)
 {
@@ -302,7 +303,7 @@ int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd)
        return 0;
 }
+EXPORT_SYMBOL(phy_ethtool_gset);
 /* Note that this function is currently incompatible with the
 * PHYCONTROL layer.  It changes registers without regard to
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 250cdbeefdfd..1dd66b8ea0fa 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -556,10 +556,9 @@ static int init_shared_mem(struct s2io_nic *nic)
                }
        }
-        nic->ufo_in_band_v = kmalloc((sizeof(u64) * size), GFP_KERNEL);
+        nic->ufo_in_band_v = kcalloc(size, sizeof(u64), GFP_KERNEL);
        if (!nic->ufo_in_band_v)
                return -ENOMEM;
-        memset(nic->ufo_in_band_v, 0, size);
        /* Allocation and initialization of RXDs in Rings */
        size = 0;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index deedfd5f8226..45283f3f95e4 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -60,7 +60,7 @@
 #define LINK_HZ                 (HZ/2)
 MODULE_DESCRIPTION("SysKonnect Gigabit Ethernet driver");
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index a6601e8d423c..a2e804ddca6c 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -3691,6 +3691,6 @@ module_init(sky2_init_module);
 module_exit(sky2_cleanup_module);
 MODULE_DESCRIPTION("Marvell Yukon 2 Gigabit Ethernet driver");
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index e9e0934380b8..198b9f22fbff 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -492,10 +492,10 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
        spin_lock_irq(&rtc->lock);
-        /* disable alarm interrupt and clear flag */
+        /* disable alarm interrupt and clear the alarm flag */
        rcr1 = readb(rtc->regbase + RCR1);
-        rcr1 &= ~RCR1_AF;
+        rcr1 &= ~(RCR1_AF|RCR1_AIE);
-        writeb(rcr1 & ~RCR1_AIE, rtc->regbase + RCR1);
+        writeb(rcr1, rtc->regbase + RCR1);
        rtc->rearm_aie = 0;
@@ -510,8 +510,10 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
                mon += 1;
        sh_rtc_write_alarm_value(rtc, mon, RMONAR);
-        /* Restore interrupt activation status */
+        if (wkalrm->enabled) {
-        writeb(rcr1, rtc->regbase + RCR1);
+                rcr1 |= RCR1_AIE;
+                writeb(rcr1, rtc->regbase + RCR1);
+        }
        spin_unlock_irq(&rtc->lock);
diff --git a/drivers/rtc/rtc-sysfs.c b/drivers/rtc/rtc-sysfs.c
index 9418a59fb368..2ddd0cf07140 100644
--- a/drivers/rtc/rtc-sysfs.c
+++ b/drivers/rtc/rtc-sysfs.c
@@ -78,7 +78,7 @@ static struct attribute_group rtc_attr_group = {
        .attrs = rtc_attrs,
 };
-static int __devinit rtc_sysfs_add_device(struct class_device *class_dev,
+static int rtc_sysfs_add_device(struct class_device *class_dev,
                                        struct class_interface *class_intf)
 {
        int err;
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 6ed3f1da9296..8b41f9cc2560 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1169,8 +1169,9 @@ static int setup(struct spi_device *spi)
                                spi->bits_per_word - 16 : spi->bits_per_word)
                        | SSCR0_SSE
                        | (spi->bits_per_word > 16 ? SSCR0_EDSS : 0);
-        chip->cr1 |= (((spi->mode & SPI_CPHA) != 0) << 4)
+        chip->cr1 &= ~(SSCR1_SPO | SSCR1_SPH);
-                        | (((spi->mode & SPI_CPOL) != 0) << 3);
+        chip->cr1 |= (((spi->mode & SPI_CPHA) != 0) ? SSCR1_SPH : 0)
+                        | (((spi->mode & SPI_CPOL) != 0) ? SSCR1_SPO : 0);
        /* NOTE:  PXA25x_SSP _could_ use external clocking ... */
        if (drv_data->ssp_type != PXA25x_SSP)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 270e6211c2e3..6307428d2c94 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -366,7 +366,6 @@ spi_alloc_master(struct device *dev, unsigned size)
        class_device_initialize(&master->cdev);
        master->cdev.class = &spi_master_class;
-        kobj_set_kset_s(&master->cdev, spi_master_class.subsys);
        master->cdev.dev = get_device(dev);
        spi_master_set_devdata(master, &master[1]);
@@ -466,14 +465,20 @@ EXPORT_SYMBOL_GPL(spi_unregister_master);
 */
 struct spi_master *spi_busnum_to_master(u16 bus_num)
 {
-        char                    name[9];
+        struct class_device     *cdev;
-        struct kobject          *bus;
+        struct spi_master       *master = NULL;
+        struct spi_master       *m;
-        snprintf(name, sizeof name, "spi%u", bus_num);
-        bus = kset_find_obj(&spi_master_class.subsys.kset, name);
+        down(&spi_master_class.sem);
-        if (bus)
+        list_for_each_entry(cdev, &spi_master_class.children, node) {
-                return container_of(bus, struct spi_master, cdev.kobj);
+                m = container_of(cdev, struct spi_master, cdev);
-        return NULL;
+                if (m->bus_num == bus_num) {
+                        master = spi_master_get(m);
+                        break;
+                }
+        }
+        up(&spi_master_class.sem);
+        return master;
 }
 EXPORT_SYMBOL_GPL(spi_busnum_to_master);
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 8ca08713528e..651379c51ae6 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -10,9 +10,6 @@
 *
 */
-//#define DEBUG
 #include <linux/init.h>
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
@@ -44,6 +41,9 @@ struct s3c24xx_spi {
        int                      len;
        int                      count;
+        int                     (*set_cs)(struct s3c2410_spi_info *spi,
+                                          int cs, int pol);
        /* data buffers */
        const unsigned char     *tx;
        unsigned char           *rx;
@@ -64,6 +64,11 @@ static inline struct s3c24xx_spi *to_hw(struct spi_device *sdev)
        return spi_master_get_devdata(sdev->master);
 }
+static void s3c24xx_spi_gpiocs(struct s3c2410_spi_info *spi, int cs, int pol)
+{
+        s3c2410_gpio_setpin(spi->pin_cs, pol);
+}
 static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
 {
        struct s3c24xx_spi *hw = to_hw(spi);
@@ -72,10 +77,7 @@ static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
        switch (value) {
        case BITBANG_CS_INACTIVE:
-                if (hw->pdata->set_cs)
+                hw->pdata->set_cs(hw->pdata, spi->chip_select, cspol^1);
-                        hw->pdata->set_cs(hw->pdata, value, cspol);
-                else
-                        s3c2410_gpio_setpin(hw->pdata->pin_cs, cspol ^ 1);
                break;
        case BITBANG_CS_ACTIVE:
@@ -96,14 +98,9 @@ static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
                /* write new configration */
                writeb(spcon, hw->regs + S3C2410_SPCON);
+                hw->pdata->set_cs(hw->pdata, spi->chip_select, cspol);
-                if (hw->pdata->set_cs)
-                        hw->pdata->set_cs(hw->pdata, value, cspol);
-                else
-                        s3c2410_gpio_setpin(hw->pdata->pin_cs, cspol);
                break;
        }
 }
@@ -330,9 +327,12 @@ static int s3c24xx_spi_probe(struct platform_device *pdev)
        /* setup any gpio we can */
        if (!hw->pdata->set_cs) {
+                hw->set_cs = s3c24xx_spi_gpiocs;
                s3c2410_gpio_setpin(hw->pdata->pin_cs, 1);
                s3c2410_gpio_cfgpin(hw->pdata->pin_cs, S3C2410_GPIO_OUTPUT);
-        }
+        } else
+                hw->set_cs = hw->pdata->set_cs;
        /* register our spi controller */
diff --git a/drivers/usb/serial/funsoft.c b/drivers/usb/serial/funsoft.c
index 31501c9361b9..2bebd63d5ed1 100644
--- a/drivers/usb/serial/funsoft.c
+++ b/drivers/usb/serial/funsoft.c
@@ -27,7 +27,7 @@ MODULE_DEVICE_TABLE(usb, id_table);
 static int funsoft_ioctl(struct usb_serial_port *port, struct file *file,
                         unsigned int cmd, unsigned long arg)
 {
-        struct termios t;
+        struct ktermios t;
        dbg("%s - port %d, cmd 0x%04x", __FUNCTION__, port->number, cmd);
diff --git a/fs/9p/error.c b/fs/9p/error.c
index ae91555c1558..0d7fa4e08812 100644
--- a/fs/9p/error.c
+++ b/fs/9p/error.c
@@ -83,6 +83,7 @@ int v9fs_errstr2errno(char *errstr, int len)
        if (errno == 0) {
                /* TODO: if error isn't found, add it dynamically */
+                errstr[len] = 0;
                printk(KERN_ERR "%s: errstr :%s: not found\n", __FUNCTION__,
                       errstr);
                errno = 1;
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 27507201f9e7..a9b6301a04fc 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -25,6 +25,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/idr.h>
+#include <asm/semaphore.h>
 #include "debug.h"
 #include "v9fs.h"
@@ -84,6 +85,7 @@ struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *v9ses, int fid)
        new->iounit = 0;
        new->rdir_pos = 0;
        new->rdir_fcall = NULL;
+        init_MUTEX(&new->lock);
        INIT_LIST_HEAD(&new->list);
        return new;
@@ -102,11 +104,11 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
 }
 /**
- * v9fs_fid_lookup - retrieve the right fid from a  particular dentry
+ * v9fs_fid_lookup - return a locked fid from a dentry
 * @dentry: dentry to look for fid in
- * @type: intent of lookup (operation or traversal)
 *
- * find a fid in the dentry
+ * find a fid in the dentry, obtain its semaphore and return a reference to it.
+ * code calling lookup is responsible for releasing lock
 *
 * TODO: only match fids that have the same uid as current user
 *
@@ -124,7 +126,68 @@ struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry)
        if (!return_fid) {
                dprintk(DEBUG_ERROR, "Couldn't find a fid in dentry\n");
+                return_fid = ERR_PTR(-EBADF);
        }
+        if(down_interruptible(&return_fid->lock))
+                return ERR_PTR(-EINTR);
        return return_fid;
 }
+/**
+ * v9fs_fid_clone - lookup the fid for a dentry, clone a private copy and release it
+ * @dentry: dentry to look for fid in
+ *
+ * find a fid in the dentry and then clone to a new private fid
+ *
+ * TODO: only match fids that have the same uid as current user
+ *
+ */
+struct v9fs_fid *v9fs_fid_clone(struct dentry *dentry)
+{
+        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
+        struct v9fs_fid *base_fid, *new_fid = ERR_PTR(-EBADF);
+        struct v9fs_fcall *fcall = NULL;
+        int fid, err;
+        base_fid = v9fs_fid_lookup(dentry);
+        if(IS_ERR(base_fid))
+                return base_fid;
+        if(base_fid) {  /* clone fid */
+                fid = v9fs_get_idpool(&v9ses->fidpool);
+                if (fid < 0) {
+                        eprintk(KERN_WARNING, "newfid fails!\n");
+                        new_fid = ERR_PTR(-ENOSPC);
+                        goto Release_Fid;
+                }
+                err = v9fs_t_walk(v9ses, base_fid->fid, fid, NULL, &fcall);
+                if (err < 0) {
+                        dprintk(DEBUG_ERROR, "clone walk didn't work\n");
+                        v9fs_put_idpool(fid, &v9ses->fidpool);
+                        new_fid = ERR_PTR(err);
+                        goto Free_Fcall;
+                }
+                new_fid = v9fs_fid_create(v9ses, fid);
+                if (new_fid == NULL) {
+                        dprintk(DEBUG_ERROR, "out of memory\n");
+                        new_fid = ERR_PTR(-ENOMEM);
+                }
+Free_Fcall:
+                kfree(fcall);
+        }
+Release_Fid:
+        up(&base_fid->lock);
+        return new_fid;
+}
+void v9fs_fid_clunk(struct v9fs_session_info *v9ses, struct v9fs_fid *fid)
+{
+        v9fs_t_clunk(v9ses, fid->fid);
+        v9fs_fid_destroy(fid);
+}
diff --git a/fs/9p/fid.h b/fs/9p/fid.h
index aa974d6875c3..48fc170c26c8 100644
--- a/fs/9p/fid.h
+++ b/fs/9p/fid.h
@@ -30,6 +30,8 @@ struct v9fs_fid {
        struct list_head list;   /* list of fids associated with a dentry */
        struct list_head active; /* XXX - debug */
+        struct semaphore lock;
        u32 fid;
        unsigned char fidopen;    /* set when fid is opened */
        unsigned char fidclunked; /* set when fid has already been clunked */
@@ -55,3 +57,6 @@ struct v9fs_fid *v9fs_fid_get_created(struct dentry *);
 void v9fs_fid_destroy(struct v9fs_fid *fid);
 struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *, int fid);
 int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry);
+struct v9fs_fid *v9fs_fid_clone(struct dentry *dentry);
+void v9fs_fid_clunk(struct v9fs_session_info *v9ses, struct v9fs_fid *fid);
diff --git a/fs/9p/mux.c b/fs/9p/mux.c
index 944273c3dbff..147ceef8e537 100644
--- a/fs/9p/mux.c
+++ b/fs/9p/mux.c
@@ -132,8 +132,10 @@ int v9fs_mux_global_init(void)
                v9fs_mux_poll_tasks[i].task = NULL;
        v9fs_mux_wq = create_workqueue("v9fs");
-        if (!v9fs_mux_wq)
+        if (!v9fs_mux_wq) {
+                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
                return -ENOMEM;
+        }
        return 0;
 }
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 0b96fae8b479..d9b561ba5e58 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -457,14 +457,19 @@ static int __init init_v9fs(void)
        v9fs_error_init();
-        printk(KERN_INFO "Installing v9fs 9P2000 file system support\n");
+        printk(KERN_INFO "Installing v9fs 9p2000 file system support\n");
        ret = v9fs_mux_global_init();
-        if (!ret)
+        if (ret) {
+                printk(KERN_WARNING "v9fs: starting mux failed\n");
                return ret;
+        }
        ret = register_filesystem(&v9fs_fs_type);
-        if (!ret)
+        if (ret) {
+                printk(KERN_WARNING "v9fs: registering file system failed\n");
                v9fs_mux_global_exit();
+        }
        return ret;
 }
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index e86a07151280..9f17b0cacdd0 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -55,53 +55,22 @@ int v9fs_file_open(struct inode *inode, struct file *file)
        struct v9fs_fid *vfid;
        struct v9fs_fcall *fcall = NULL;
        int omode;
-        int fid = V9FS_NOFID;
        int err;
        dprintk(DEBUG_VFS, "inode: %p file: %p \n", inode, file);
-        vfid = v9fs_fid_lookup(file->f_path.dentry);
+        vfid = v9fs_fid_clone(file->f_path.dentry);
-        if (!vfid) {
+        if (IS_ERR(vfid))
-                dprintk(DEBUG_ERROR, "Couldn't resolve fid from dentry\n");
+                return PTR_ERR(vfid);
-                return -EBADF;
-        }
-        fid = v9fs_get_idpool(&v9ses->fidpool);
-        if (fid < 0) {
-                eprintk(KERN_WARNING, "newfid fails!\n");
-                return -ENOSPC;
-        }
-        err = v9fs_t_walk(v9ses, vfid->fid, fid, NULL, &fcall);
-        if (err < 0) {
-                dprintk(DEBUG_ERROR, "rewalk didn't work\n");
-                if (fcall && fcall->id == RWALK)
-                        goto clunk_fid;
-                else {
-                        v9fs_put_idpool(fid, &v9ses->fidpool);
-                        goto free_fcall;
-                }
-        }
-        kfree(fcall);
-        /* TODO: do special things for O_EXCL, O_NOFOLLOW, O_SYNC */
-        /* translate open mode appropriately */
        omode = v9fs_uflags2omode(file->f_flags);
-        err = v9fs_t_open(v9ses, fid, omode, &fcall);
+        err = v9fs_t_open(v9ses, vfid->fid, omode, &fcall);
        if (err < 0) {
                PRINT_FCALL_ERROR("open failed", fcall);
-                goto clunk_fid;
+                goto Clunk_Fid;
-        }
-        vfid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
-        if (vfid == NULL) {
-                dprintk(DEBUG_ERROR, "out of memory\n");
-                err = -ENOMEM;
-                goto clunk_fid;
        }
        file->private_data = vfid;
-        vfid->fid = fid;
        vfid->fidopen = 1;
        vfid->fidclunked = 0;
        vfid->iounit = fcall->params.ropen.iounit;
@@ -112,10 +81,8 @@ int v9fs_file_open(struct inode *inode, struct file *file)
        return 0;
-clunk_fid:
+Clunk_Fid:
-        v9fs_t_clunk(v9ses, fid);
+        v9fs_fid_clunk(v9ses, vfid);
-free_fcall:
        kfree(fcall);
        return err;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 18f26cdfd882..9109ba1d6969 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -416,12 +416,8 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
        sb = file_inode->i_sb;
        v9ses = v9fs_inode2v9ses(file_inode);
        v9fid = v9fs_fid_lookup(file);
+        if(IS_ERR(v9fid))
-        if (!v9fid) {
+                return PTR_ERR(v9fid);
-                dprintk(DEBUG_ERROR,
-                        "no v9fs_fid\n");
-                return -EBADF;
-        }
        fid = v9fid->fid;
        if (fid < 0) {
@@ -433,11 +429,13 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
        result = v9fs_t_remove(v9ses, fid, &fcall);
        if (result < 0) {
                PRINT_FCALL_ERROR("remove fails", fcall);
+                goto Error;
        }
        v9fs_put_idpool(fid, &v9ses->fidpool);
        v9fs_fid_destroy(v9fid);
+Error:
        kfree(fcall);
        return result;
 }
@@ -473,9 +471,13 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
        inode = NULL;
        vfid = NULL;
        v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
+        dfid = v9fs_fid_clone(dentry->d_parent);
-        perm = unixmode2p9mode(v9ses, mode);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
+        perm = unixmode2p9mode(v9ses, mode);
        if (nd && nd->flags & LOOKUP_OPEN)
                flags = nd->intent.open.flags - 1;
        else
@@ -485,9 +487,10 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                perm, v9fs_uflags2omode(flags), NULL, &fid, &qid, &iounit);
        if (err)
-                goto error;
+                goto clunk_dfid;
        vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
+        v9fs_fid_clunk(v9ses, dfid);
        if (IS_ERR(vfid)) {
                err = PTR_ERR(vfid);
                vfid = NULL;
@@ -525,6 +528,9 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
        return 0;
+clunk_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
 error:
        if (vfid)
                v9fs_fid_destroy(vfid);
@@ -551,7 +557,12 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
        inode = NULL;
        vfid = NULL;
        v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
        perm = unixmode2p9mode(v9ses, mode | S_IFDIR);
        err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
@@ -559,37 +570,36 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
        if (err) {
                dprintk(DEBUG_ERROR, "create error %d\n", err);
-                goto error;
+                goto clean_up_dfid;
-        }
-        err = v9fs_t_clunk(v9ses, fid);
-        if (err) {
-                dprintk(DEBUG_ERROR, "clunk error %d\n", err);
-                goto error;
        }
        vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
        if (IS_ERR(vfid)) {
                err = PTR_ERR(vfid);
                vfid = NULL;
-                goto error;
+                goto clean_up_dfid;
        }
+        v9fs_fid_clunk(v9ses, dfid);
        inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
                inode = NULL;
-                goto error;
+                goto clean_up_fids;
        }
        dentry->d_op = &v9fs_dentry_operations;
        d_instantiate(dentry, inode);
        return 0;
-error:
+clean_up_fids:
        if (vfid)
                v9fs_fid_destroy(vfid);
+clean_up_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
+error:
        return err;
 }
@@ -622,28 +632,23 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
        dentry->d_op = &v9fs_dentry_operations;
        dirfid = v9fs_fid_lookup(dentry->d_parent);
-        if (!dirfid) {
+        if(IS_ERR(dirfid))
-                dprintk(DEBUG_ERROR, "no dirfid\n");
+                return ERR_PTR(PTR_ERR(dirfid));
-                return ERR_PTR(-EINVAL);
-        }
        dirfidnum = dirfid->fid;
-        if (dirfidnum < 0) {
-                dprintk(DEBUG_ERROR, "no dirfid for inode %p, #%lu\n",
-                        dir, dir->i_ino);
-                return ERR_PTR(-EBADF);
-        }
        newfid = v9fs_get_idpool(&v9ses->fidpool);
        if (newfid < 0) {
                eprintk(KERN_WARNING, "newfid fails!\n");
-                return ERR_PTR(-ENOSPC);
+                result = -ENOSPC;
+                goto Release_Dirfid;
        }
        result = v9fs_t_walk(v9ses, dirfidnum, newfid,
                (char *)dentry->d_name.name, &fcall);
+        up(&dirfid->lock);
        if (result < 0) {
                if (fcall && fcall->id == RWALK)
                        v9fs_t_clunk(v9ses, newfid);
@@ -701,8 +706,12 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
        return NULL;
-      FreeFcall:
+Release_Dirfid:
+        up(&dirfid->lock);
+FreeFcall:
        kfree(fcall);
        return ERR_PTR(result);
 }
@@ -746,10 +755,8 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        struct inode *old_inode = old_dentry->d_inode;
        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(old_inode);
        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry);
-        struct v9fs_fid *olddirfid =
+        struct v9fs_fid *olddirfid;
-            v9fs_fid_lookup(old_dentry->d_parent);
+        struct v9fs_fid *newdirfid;
-        struct v9fs_fid *newdirfid =
-            v9fs_fid_lookup(new_dentry->d_parent);
        struct v9fs_wstat wstat;
        struct v9fs_fcall *fcall = NULL;
        int fid = -1;
@@ -759,16 +766,26 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        dprintk(DEBUG_VFS, "\n");
-        if ((!oldfid) || (!olddirfid) || (!newdirfid)) {
+        if(IS_ERR(oldfid))
-                dprintk(DEBUG_ERROR, "problem with arguments\n");
+                return PTR_ERR(oldfid);
-                return -EBADF;
+        olddirfid = v9fs_fid_clone(old_dentry->d_parent);
+        if(IS_ERR(olddirfid)) {
+                retval = PTR_ERR(olddirfid);
+                goto Release_lock;
+        }
+        newdirfid = v9fs_fid_clone(new_dentry->d_parent);
+        if(IS_ERR(newdirfid)) {
+                retval = PTR_ERR(newdirfid);
+                goto Clunk_olddir;
        }
        /* 9P can only handle file rename in the same directory */
        if (memcmp(&olddirfid->qid, &newdirfid->qid, sizeof(newdirfid->qid))) {
                dprintk(DEBUG_ERROR, "old dir and new dir are different\n");
-                retval = -EPERM;
+                retval = -EXDEV;
-                goto FreeFcallnBail;
+                goto Clunk_newdir;
        }
        fid = oldfid->fid;
@@ -779,7 +796,7 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                dprintk(DEBUG_ERROR, "no fid for old file #%lu\n",
                        old_inode->i_ino);
                retval = -EBADF;
-                goto FreeFcallnBail;
+                goto Clunk_newdir;
        }
        v9fs_blank_wstat(&wstat);
@@ -788,11 +805,20 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        retval = v9fs_t_wstat(v9ses, fid, &wstat, &fcall);
-      FreeFcallnBail:
        if (retval < 0)
                PRINT_FCALL_ERROR("wstat error", fcall);
        kfree(fcall);
+Clunk_newdir:
+        v9fs_fid_clunk(v9ses, newdirfid);
+Clunk_olddir:
+        v9fs_fid_clunk(v9ses, olddirfid);
+Release_lock:
+        up(&oldfid->lock);
        return retval;
 }
@@ -810,15 +836,12 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 {
        struct v9fs_fcall *fcall = NULL;
        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
        int err = -EPERM;
        dprintk(DEBUG_VFS, "dentry: %p\n", dentry);
-        if (!fid) {
+        if(IS_ERR(fid))
-                dprintk(DEBUG_ERROR,
+                return PTR_ERR(fid);
-                        "couldn't find fid associated with dentry\n");
-                return -EBADF;
-        }
        err = v9fs_t_stat(v9ses, fid->fid, &fcall);
@@ -831,6 +854,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
        }
        kfree(fcall);
+        v9fs_fid_clunk(v9ses, fid);
        return err;
 }
@@ -844,18 +868,14 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
 {
        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
        struct v9fs_fcall *fcall = NULL;
        struct v9fs_wstat wstat;
        int res = -EPERM;
        dprintk(DEBUG_VFS, "\n");
+        if(IS_ERR(fid))
-        if (!fid) {
+                return PTR_ERR(fid);
-                dprintk(DEBUG_ERROR,
-                        "Couldn't find fid associated with dentry\n");
-                return -EBADF;
-        }
        v9fs_blank_wstat(&wstat);
        if (iattr->ia_valid & ATTR_MODE)
@@ -887,6 +907,7 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
        if (res >= 0)
                res = inode_setattr(dentry->d_inode, iattr);
+        v9fs_fid_clunk(v9ses, fid);
        return res;
 }
@@ -987,18 +1008,15 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
        struct v9fs_fcall *fcall = NULL;
        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
-        if (!fid) {
+        if(IS_ERR(fid))
-                dprintk(DEBUG_ERROR, "could not resolve fid from dentry\n");
+                return PTR_ERR(fid);
-                retval = -EBADF;
-                goto FreeFcall;
-        }
        if (!v9ses->extended) {
                retval = -EBADF;
                dprintk(DEBUG_ERROR, "not extended\n");
-                goto FreeFcall;
+                goto ClunkFid;
        }
        dprintk(DEBUG_VFS, " %s\n", dentry->d_name.name);
@@ -1009,8 +1027,10 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
                goto FreeFcall;
        }
-        if (!fcall)
+        if (!fcall) {
-                return -EIO;
+                retval = -EIO;
+                goto ClunkFid;
+        }
        if (!(fcall->params.rstat.stat.mode & V9FS_DMSYMLINK)) {
                retval = -EINVAL;
@@ -1028,9 +1048,12 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
                fcall->params.rstat.stat.extension.str, buffer);
        retval = buflen;
-      FreeFcall:
+FreeFcall:
        kfree(fcall);
+ClunkFid:
+        v9fs_fid_clunk(v9ses, fid);
        return retval;
 }
@@ -1123,52 +1146,58 @@ static int v9fs_vfs_mkspecial(struct inode *dir, struct dentry *dentry,
        int err;
        u32 fid, perm;
        struct v9fs_session_info *v9ses;
-        struct v9fs_fid *dfid, *vfid;
+        struct v9fs_fid *dfid, *vfid = NULL;
-        struct inode *inode;
+        struct inode *inode = NULL;
-        inode = NULL;
-        vfid = NULL;
        v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
-        perm = unixmode2p9mode(v9ses, mode);
        if (!v9ses->extended) {
                dprintk(DEBUG_ERROR, "not extended\n");
                return -EPERM;
        }
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
+        perm = unixmode2p9mode(v9ses, mode);
        err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
                perm, V9FS_OREAD, (char *) extension, &fid, NULL, NULL);
        if (err)
-                goto error;
+                goto clunk_dfid;
        err = v9fs_t_clunk(v9ses, fid);
        if (err)
-                goto error;
+                goto clunk_dfid;
        vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
        if (IS_ERR(vfid)) {
                err = PTR_ERR(vfid);
                vfid = NULL;
-                goto error;
+                goto clunk_dfid;
        }
        inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
                inode = NULL;
-                goto error;
+                goto free_vfid;
        }
        dentry->d_op = &v9fs_dentry_operations;
        d_instantiate(dentry, inode);
        return 0;
-error:
+free_vfid:
-        if (vfid)
+        v9fs_fid_destroy(vfid);
-                v9fs_fid_destroy(vfid);
+clunk_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
+error:
        return err;
 }
@@ -1209,26 +1238,29 @@ v9fs_vfs_link(struct dentry *old_dentry, struct inode *dir,
              struct dentry *dentry)
 {
        int retval;
+        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
        struct v9fs_fid *oldfid;
        char *name;
        dprintk(DEBUG_VFS, " %lu,%s,%s\n", dir->i_ino, dentry->d_name.name,
                old_dentry->d_name.name);
-        oldfid = v9fs_fid_lookup(old_dentry);
+        oldfid = v9fs_fid_clone(old_dentry);
-        if (!oldfid) {
+        if(IS_ERR(oldfid))
-                dprintk(DEBUG_ERROR, "can't find oldfid\n");
+                return PTR_ERR(oldfid);
-                return -EPERM;
-        }
        name = __getname();
-        if (unlikely(!name))
+        if (unlikely(!name)) {
-                return -ENOMEM;
+                retval = -ENOMEM;
+                goto clunk_fid;
+        }
        sprintf(name, "%d\n", oldfid->fid);
        retval = v9fs_vfs_mkspecial(dir, dentry, V9FS_DMLINK, name);
        __putname(name);
+clunk_fid:
+        v9fs_fid_clunk(v9ses, oldfid);
        return retval;
 }
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 7cb28720f90e..669dbe5b0317 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -682,6 +682,15 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                        retval = PTR_ERR(interpreter);
                        if (IS_ERR(interpreter))
                                goto out_free_interp;
+                        /*
+                         * If the binary is not readable then enforce
+                         * mm->dumpable = 0 regardless of the interpreter's
+                         * permissions.
+                         */
+                        if (file_permission(interpreter, MAY_READ) < 0)
+                                bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
                        retval = kernel_read(interpreter, 0, bprm->buf,
                                             BINPRM_BUF_SIZE);
                        if (retval != BINPRM_BUF_SIZE) {
@@ -1178,6 +1187,10 @@ static int dump_seek(struct file *file, loff_t off)
 */
 static int maydump(struct vm_area_struct *vma)
 {
+        /* The vma can be set up to tell us the answer directly.  */
+        if (vma->vm_flags & VM_ALWAYSDUMP)
+                return 1;
        /* Do not dump I/O mapped devices or special mappings */
        if (vma->vm_flags & (VM_IO | VM_RESERVED))
                return 0;
@@ -1424,6 +1437,32 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
        return sz;
 }
+static struct vm_area_struct *first_vma(struct task_struct *tsk,
+                                        struct vm_area_struct *gate_vma)
+{
+        struct vm_area_struct *ret = tsk->mm->mmap;
+        if (ret)
+                return ret;
+        return gate_vma;
+}
+/*
+ * Helper function for iterating across a vma list.  It ensures that the caller
+ * will visit `gate_vma' prior to terminating the search.
+ */
+static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
+                                        struct vm_area_struct *gate_vma)
+{
+        struct vm_area_struct *ret;
+        ret = this_vma->vm_next;
+        if (ret)
+                return ret;
+        if (this_vma == gate_vma)
+                return NULL;
+        return gate_vma;
+}
 /*
 * Actual dumper
 *
@@ -1439,7 +1478,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
        int segs;
        size_t size = 0;
        int i;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *gate_vma;
        struct elfhdr *elf = NULL;
        loff_t offset = 0, dataoff, foffset;
        unsigned long limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
@@ -1525,6 +1564,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
        segs += ELF_CORE_EXTRA_PHDRS;
 #endif
+        gate_vma = get_gate_vma(current);
+        if (gate_vma != NULL)
+                segs++;
        /* Set up header */
        fill_elf_header(elf, segs + 1); /* including notes section */
@@ -1592,7 +1635,8 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
        dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
        /* Write program headers for segments dump */
-        for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
+        for (vma = first_vma(current, gate_vma); vma != NULL;
+                        vma = next_vma(vma, gate_vma)) {
                struct elf_phdr phdr;
                size_t sz;
@@ -1641,7 +1685,8 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
        /* Align to page */
        DUMP_SEEK(dataoff - foffset);
-        for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
+        for (vma = first_vma(current, gate_vma); vma != NULL;
+                        vma = next_vma(vma, gate_vma)) {
                unsigned long addr;
                if (!maydump(vma))
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 6e6d4568d548..a4d933a51208 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -234,6 +234,14 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
                                goto error;
                        }
+                        /*
+                         * If the binary is not readable then enforce
+                         * mm->dumpable = 0 regardless of the interpreter's
+                         * permissions.
+                         */
+                        if (file_permission(interpreter, MAY_READ) < 0)
+                                bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
                        retval = kernel_read(interpreter, 0, bprm->buf,
                                             BINPRM_BUF_SIZE);
                        if (retval < 0)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 8b18e43b82fe..d9bdf2b3ade2 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -146,7 +146,7 @@ static int blk_end_aio(struct bio *bio, unsigned int bytes_done, int error)
                iocb->ki_nbytes = -EIO;
        if (atomic_dec_and_test(bio_count)) {
-                if (iocb->ki_nbytes < 0)
+                if ((long)iocb->ki_nbytes < 0)
                        aio_complete(iocb, iocb->ki_nbytes, 0);
                else
                        aio_complete(iocb, iocb->ki_left, 0);
@@ -190,6 +190,12 @@ static struct page *blk_get_page(unsigned long addr, size_t count, int rw,
        return pvec->page[pvec->idx++];
 }
+/* return a page back to pvec array */
+static void blk_unget_page(struct page *page, struct pvec *pvec)
+{
+        pvec->page[--pvec->idx] = page;
+}
 static ssize_t
 blkdev_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
                 loff_t pos, unsigned long nr_segs)
@@ -278,6 +284,8 @@ same_bio:
                                count = min(count, nbytes);
                                goto same_bio;
                        }
+                } else {
+                        blk_unget_page(page, &pvec);
                }
                /* bio is ready, submit it */
diff --git a/fs/buffer.c b/fs/buffer.c
index 3b116078b4c3..460f1c43238e 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2834,7 +2834,7 @@ int try_to_free_buffers(struct page *page)
        int ret = 0;
        BUG_ON(!PageLocked(page));
-        if (PageDirty(page) || PageWriteback(page))
+        if (PageWriteback(page))
                return 0;
        if (mapping == NULL) {          /* can this still happen? */
@@ -2845,6 +2845,19 @@ int try_to_free_buffers(struct page *page)
        spin_lock(&mapping->private_lock);
        ret = drop_buffers(page, &buffers_to_free);
        spin_unlock(&mapping->private_lock);
+        /*
+         * If the filesystem writes its buffers by hand (eg ext3)
+         * then we can have clean buffers against a dirty page.  We
+         * clean the page here; otherwise the VM will never notice
+         * that the filesystem did any IO at all.
+         *
+         * Also, during truncate, discard_buffer will have marked all
+         * the page's buffers clean.  We discover that here and clean
+         * the page also.
+         */
+        if (ret)
+                cancel_dirty_page(page, PAGE_CACHE_SIZE);
 out:
        if (buffers_to_free) {
                struct buffer_head *bh = buffers_to_free;
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 3539d6ef9611..d04d2f7448d9 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,7 @@
+Version 1.47
+------------
+Fix oops in list_del during mount caused by unaligned string.
 Version 1.46
 ------------
 Support deep tree mounts.  Better support OS/2, Win9x (DOS) time stamps.
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 96abeb738978..6017c465440e 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -143,8 +143,8 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
                ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
                if((ses->serverDomain == NULL) || (ses->serverOS == NULL) ||
                   (ses->serverNOS == NULL)) {
-                        buf += sprintf("\nentry for %s not fully displayed\n\t",
+                        buf += sprintf(buf, "\nentry for %s not fully "
-                                        ses->serverName);
+                                        "displayed\n\t", ses->serverName);
                        
                } else {
                        length =
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index a243f779b363..8aa66dcf13bd 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -100,5 +100,5 @@ extern ssize_t	cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
 extern int cifs_ioctl (struct inode * inode, struct file * filep,
                       unsigned int command, unsigned long arg);
-#define CIFS_VERSION   "1.46"
+#define CIFS_VERSION   "1.47"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index aedf683f011f..19cc294c7c70 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -71,9 +71,7 @@ sesInfoAlloc(void)
 {
        struct cifsSesInfo *ret_buf;
-        ret_buf =
+        ret_buf = kzalloc(sizeof (struct cifsSesInfo), GFP_KERNEL);
-            (struct cifsSesInfo *) kzalloc(sizeof (struct cifsSesInfo),
-                                           GFP_KERNEL);
        if (ret_buf) {
                write_lock(&GlobalSMBSeslock);
                atomic_inc(&sesInfoAllocCount);
@@ -109,9 +107,7 @@ struct cifsTconInfo *
 tconInfoAlloc(void)
 {
        struct cifsTconInfo *ret_buf;
-        ret_buf =
+        ret_buf = kzalloc(sizeof (struct cifsTconInfo), GFP_KERNEL);
-            (struct cifsTconInfo *) kzalloc(sizeof (struct cifsTconInfo),
-                                            GFP_KERNEL);
        if (ret_buf) {
                write_lock(&GlobalSMBSeslock);
                atomic_inc(&tconInfoAllocCount);
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index bbdda99dce61..758464630893 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -182,11 +182,14 @@ static int decode_unicode_ssetup(char ** pbcc_area, int bleft, struct cifsSesInf
        cFYI(1,("bleft %d",bleft));
-        /* word align, if bytes remaining is not even */
+        /* SMB header is unaligned, so cifs servers word align start of
-        if(bleft % 2) {
+           Unicode strings */
-                bleft--;
+        data++;
-                data++;
+        bleft--; /* Windows servers do not always double null terminate
-        }
+                    their final Unicode string - in which case we
+                    now will not attempt to decode the byte of junk
+                    which follows it */
+                    
        words_left = bleft / 2;
        /* save off server operating system */
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index c403b66ec83c..a4b142a6a2c7 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -251,8 +251,19 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                WARN_ON(inode->i_state & I_WILL_FREE);
        if ((wbc->sync_mode != WB_SYNC_ALL) && (inode->i_state & I_LOCK)) {
+                struct address_space *mapping = inode->i_mapping;
+                int ret;
                list_move(&inode->i_list, &inode->i_sb->s_dirty);
-                return 0;
+                /*
+                 * Even if we don't actually write the inode itself here,
+                 * we can at least start some of the data writeout..
+                 */
+                spin_unlock(&inode_lock);
+                ret = do_writepages(mapping, wbc);
+                spin_lock(&inode_lock);
+                return ret;
        }
        /*
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index dee3d6c0f194..d9ba8cb0ee75 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -532,7 +532,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
        lock_kernel();
-        res = nfs_revalidate_mapping(inode, filp->f_mapping);
+        res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
        if (res < 0) {
                unlock_kernel();
                return res;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 63e470279309..d83498282837 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -665,49 +665,86 @@ int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
        return __nfs_revalidate_inode(server, inode);
 }
+static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+        
+        if (mapping->nrpages != 0) {
+                int ret = invalidate_inode_pages2(mapping);
+                if (ret < 0)
+                        return ret;
+        }
+        spin_lock(&inode->i_lock);
+        nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
+        if (S_ISDIR(inode->i_mode)) {
+                memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
+                /* This ensures we revalidate child dentries */
+                nfsi->cache_change_attribute = jiffies;
+        }
+        spin_unlock(&inode->i_lock);
+        nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
+        dfprintk(PAGECACHE, "NFS: (%s/%Ld) data cache invalidated\n",
+                        inode->i_sb->s_id, (long long)NFS_FILEID(inode));
+        return 0;
+}
+static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
+{
+        int ret = 0;
+        mutex_lock(&inode->i_mutex);
+        if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_DATA) {
+                ret = nfs_sync_mapping(mapping);
+                if (ret == 0)
+                        ret = nfs_invalidate_mapping_nolock(inode, mapping);
+        }
+        mutex_unlock(&inode->i_mutex);
+        return ret;
+}
 /**
- * nfs_revalidate_mapping - Revalidate the pagecache
+ * nfs_revalidate_mapping_nolock - Revalidate the pagecache
 * @inode - pointer to host inode
 * @mapping - pointer to mapping
 */
-int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
+int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
 {
        struct nfs_inode *nfsi = NFS_I(inode);
        int ret = 0;
-        if (NFS_STALE(inode))
-                ret = -ESTALE;
        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                        || nfs_attribute_timeout(inode))
+                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
                ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-        if (ret < 0)
+                if (ret < 0)
-                goto out;
+                        goto out;
+        }
+        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
+                ret = nfs_invalidate_mapping_nolock(inode, mapping);
+out:
+        return ret;
+}
-        if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
+/**
-                if (mapping->nrpages != 0) {
+ * nfs_revalidate_mapping - Revalidate the pagecache
-                        if (S_ISREG(inode->i_mode)) {
+ * @inode - pointer to host inode
-                                ret = nfs_sync_mapping(mapping);
+ * @mapping - pointer to mapping
-                                if (ret < 0)
+ *
-                                        goto out;
+ * This version of the function will take the inode->i_mutex and attempt to
-                        }
+ * flush out all dirty data if it needs to invalidate the page cache.
-                        ret = invalidate_inode_pages2(mapping);
+ */
-                        if (ret < 0)
+int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
-                                goto out;
+{
-                }
+        struct nfs_inode *nfsi = NFS_I(inode);
-                spin_lock(&inode->i_lock);
+        int ret = 0;
-                nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
-                if (S_ISDIR(inode->i_mode)) {
-                        memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
-                        /* This ensures we revalidate child dentries */
-                        nfsi->cache_change_attribute = jiffies;
-                }
-                spin_unlock(&inode->i_lock);
-                nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
+        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                dfprintk(PAGECACHE, "NFS: (%s/%Ld) data cache invalidated\n",
+                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
-                                inode->i_sb->s_id,
+                ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-                                (long long)NFS_FILEID(inode));
+                if (ret < 0)
+                        goto out;
        }
+        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
+                ret = nfs_invalidate_mapping(inode, mapping);
 out:
        return ret;
 }
diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c
index 6c686112cc03..525c136c7d8c 100644
--- a/fs/nfs/symlink.c
+++ b/fs/nfs/symlink.c
@@ -50,7 +50,9 @@ static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
        struct inode *inode = dentry->d_inode;
        struct page *page;
-        void *err = ERR_PTR(nfs_revalidate_mapping(inode, inode->i_mapping));
+        void *err;
+        err = ERR_PTR(nfs_revalidate_mapping_nolock(inode, inode->i_mapping));
        if (err)
                goto read_failed;
        page = read_cache_page(&inode->i_data, 0,
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 277df40f098d..e695660921ec 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -990,15 +990,16 @@ encode_entry(struct readdir_cd *ccd, const char *name,
 }
 int
-nfs3svc_encode_entry(struct readdir_cd *cd, const char *name,
+nfs3svc_encode_entry(void *cd, const char *name,
-                     int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+                     int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
        return encode_entry(cd, name, namlen, offset, ino, d_type, 0);
 }
 int
-nfs3svc_encode_entry_plus(struct readdir_cd *cd, const char *name,
+nfs3svc_encode_entry_plus(void *cd, const char *name,
-                          int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+                          int namlen, loff_t offset, u64 ino,
+                          unsigned int d_type)
 {
        return encode_entry(cd, name, namlen, offset, ino, d_type, 1);
 }
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index fea46368afb2..18aa9440df14 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1880,9 +1880,10 @@ nfsd4_encode_rdattr_error(__be32 *p, int buflen, __be32 nfserr)
 }
 static int
-nfsd4_encode_dirent(struct readdir_cd *ccd, const char *name, int namlen,
+nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
-                    loff_t offset, ino_t ino, unsigned int d_type)
+                    loff_t offset, u64 ino, unsigned int d_type)
 {
+        struct readdir_cd *ccd = ccdv;
        struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
        int buflen;
        __be32 *p = cd->buffer;
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 0aaccb03bf76..fbf5d51947ea 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -72,7 +72,7 @@ static struct svc_program	nfsd_acl_program = {
        .pg_prog                = NFS_ACL_PROGRAM,
        .pg_nvers               = NFSD_ACL_NRVERS,
        .pg_vers                = nfsd_acl_versions,
-        .pg_name                = "nfsd",
+        .pg_name                = "nfsacl",
        .pg_class               = "nfsd",
        .pg_stats               = &nfsd_acl_svcstats,
        .pg_authenticate        = &svc_set_client,
@@ -118,16 +118,16 @@ int nfsd_vers(int vers, enum vers_op change)
        switch(change) {
        case NFSD_SET:
                nfsd_versions[vers] = nfsd_version[vers];
-                break;
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
                if (vers < NFSD_ACL_NRVERS)
-                        nfsd_acl_version[vers] = nfsd_acl_version[vers];
+                        nfsd_acl_versions[vers] = nfsd_acl_version[vers];
 #endif
+                break;
        case NFSD_CLEAR:
                nfsd_versions[vers] = NULL;
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
                if (vers < NFSD_ACL_NRVERS)
-                        nfsd_acl_version[vers] = NULL;
+                        nfsd_acl_versions[vers] = NULL;
 #endif
                break;
        case NFSD_TEST:
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index f5243f943996..6555c50d9006 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -462,9 +462,10 @@ nfssvc_encode_statfsres(struct svc_rqst *rqstp, __be32 *p,
 }
 int
-nfssvc_encode_entry(struct readdir_cd *ccd, const char *name,
+nfssvc_encode_entry(void *ccdv, const char *name,
-                    int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+                    int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
+        struct readdir_cd *ccd = ccdv;
        struct nfsd_readdirres *cd = container_of(ccd, struct nfsd_readdirres, common);
        __be32  *p = cd->buffer;
        int     buflen, slen;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7a79c23aa6d4..5d32e5fa697e 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -822,7 +822,8 @@ nfsd_read_actor(read_descriptor_t *desc, struct page *page, unsigned long offset
                rqstp->rq_res.page_len = size;
        } else if (page != pp[-1]) {
                get_page(page);
-                put_page(*pp);
+                if (*pp)
+                        put_page(*pp);
                *pp = page;
                rqstp->rq_resused++;
                rqstp->rq_res.page_len += size;
@@ -1244,7 +1245,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
        __be32          err;
        int             host_err;
        __u32           v_mtime=0, v_atime=0;
-        int             v_mode=0;
        err = nfserr_perm;
        if (!flen)
@@ -1281,16 +1281,11 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                goto out;
        if (createmode == NFS3_CREATE_EXCLUSIVE) {
-                /* while the verifier would fit in mtime+atime,
+                /* solaris7 gets confused (bugid 4218508) if these have
-                 * solaris7 gets confused (bugid 4218508) if these have
+                 * the high bit set, so just clear the high bits.
-                 * the high bit set, so we use the mode as well
                 */
                v_mtime = verifier[0]&0x7fffffff;
                v_atime = verifier[1]&0x7fffffff;
-                v_mode  = S_IFREG
-                        | ((verifier[0]&0x80000000) >> (32-7)) /* u+x */
-                        | ((verifier[1]&0x80000000) >> (32-9)) /* u+r */
-                        ;
        }
        
        if (dchild->d_inode) {
@@ -1318,7 +1313,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                case NFS3_CREATE_EXCLUSIVE:
                        if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
                            && dchild->d_inode->i_atime.tv_sec == v_atime
-                            && dchild->d_inode->i_mode  == v_mode
                            && dchild->d_inode->i_size  == 0 )
                                break;
                         /* fallthru */
@@ -1340,26 +1334,22 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
        }
        if (createmode == NFS3_CREATE_EXCLUSIVE) {
-                /* Cram the verifier into atime/mtime/mode */
+                /* Cram the verifier into atime/mtime */
                iap->ia_valid = ATTR_MTIME|ATTR_ATIME
-                        | ATTR_MTIME_SET|ATTR_ATIME_SET
+                        | ATTR_MTIME_SET|ATTR_ATIME_SET;
-                        | ATTR_MODE;
                /* XXX someone who knows this better please fix it for nsec */ 
                iap->ia_mtime.tv_sec = v_mtime;
                iap->ia_atime.tv_sec = v_atime;
                iap->ia_mtime.tv_nsec = 0;
                iap->ia_atime.tv_nsec = 0;
-                iap->ia_mode  = v_mode;
        }
        /* Set file attributes.
-         * Mode has already been set but we might need to reset it
-         * for CREATE_EXCLUSIVE
         * Irix appears to send along the gid when it tries to
         * implement setgid directories via NFS. Clear out all that cruft.
         */
 set_attr:
-        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID)) != 0) {
+        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID|ATTR_MODE)) != 0) {
                __be32 err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
                if (err2)
                        err = err2;
@@ -1726,7 +1716,7 @@ out:
 */
 __be32
 nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp, 
-             struct readdir_cd *cdp, encode_dent_fn func)
+             struct readdir_cd *cdp, filldir_t func)
 {
        __be32          err;
        int             host_err;
@@ -1751,7 +1741,7 @@ nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp,
        do {
                cdp->err = nfserr_eof; /* will be cleared on successful read */
-                host_err = vfs_readdir(file, (filldir_t) func, cdp);
+                host_err = vfs_readdir(file, func, cdp);
        } while (host_err >=0 && cdp->err == nfs_ok);
        if (host_err)
                err = nfserrno(host_err);
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index c99e9058c198..e61e218f5e0b 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -587,7 +587,7 @@ static inline u64 ocfs2_backup_super_blkno(struct super_block *sb, int index)
        if (index >= 0 && index < OCFS2_MAX_BACKUP_SUPERBLOCKS) {
                offset <<= (2 * index);
-                offset /= sb->s_blocksize;
+                offset >>= sb->s_blocksize_bits;
                return offset;
        }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 77a57b5799c4..ff7a66850602 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -371,9 +371,11 @@ static int mounts_open(struct inode *inode, struct file *file)
        if (task) {
                task_lock(task);
-                ns = task->nsproxy->mnt_ns;
+                if (task->nsproxy) {
-                if (ns)
+                        ns = task->nsproxy->mnt_ns;
-                        get_mnt_ns(ns);
+                        if (ns)
+                                get_mnt_ns(ns);
+                }
                task_unlock(task);
                put_task_struct(task);
        }
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index 99b6f329ba23..5109f1d5e7ff 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -48,6 +48,11 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
        }
        mutex_lock(&inode->i_mutex);
+        mutex_lock(&(REISERFS_I(inode)->i_mmap));
+        if (REISERFS_I(inode)->i_flags & i_ever_mapped)
+                REISERFS_I(inode)->i_flags &= ~i_pack_on_close_mask;
        reiserfs_write_lock(inode->i_sb);
        /* freeing preallocation only involves relogging blocks that
         * are already in the current transaction.  preallocation gets
@@ -100,11 +105,24 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
                err = reiserfs_truncate_file(inode, 0);
        }
      out:
+        mutex_unlock(&(REISERFS_I(inode)->i_mmap));
        mutex_unlock(&inode->i_mutex);
        reiserfs_write_unlock(inode->i_sb);
        return err;
 }
+static int reiserfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        struct inode *inode;
+        inode = file->f_path.dentry->d_inode;
+        mutex_lock(&(REISERFS_I(inode)->i_mmap));
+        REISERFS_I(inode)->i_flags |= i_ever_mapped;
+        mutex_unlock(&(REISERFS_I(inode)->i_mmap));
+        return generic_file_mmap(file, vma);
+}
 static void reiserfs_vfs_truncate_file(struct inode *inode)
 {
        reiserfs_truncate_file(inode, 1);
@@ -1527,7 +1545,7 @@ const struct file_operations reiserfs_file_operations = {
 #ifdef CONFIG_COMPAT
        .compat_ioctl = reiserfs_compat_ioctl,
 #endif
-        .mmap = generic_file_mmap,
+        .mmap = reiserfs_file_mmap,
        .open = generic_file_open,
        .release = reiserfs_file_release,
        .fsync = reiserfs_sync_file,
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index f3d1c4a77979..9fcbfe316977 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1125,6 +1125,7 @@ static void init_inode(struct inode *inode, struct treepath *path)
        REISERFS_I(inode)->i_prealloc_count = 0;
        REISERFS_I(inode)->i_trans_id = 0;
        REISERFS_I(inode)->i_jl = NULL;
+        mutex_init(&(REISERFS_I(inode)->i_mmap));
        reiserfs_init_acl_access(inode);
        reiserfs_init_acl_default(inode);
        reiserfs_init_xattr_rwsem(inode);
@@ -1832,6 +1833,7 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
        REISERFS_I(inode)->i_attrs =
            REISERFS_I(dir)->i_attrs & REISERFS_INHERIT_MASK;
        sd_attrs_to_i_attrs(REISERFS_I(inode)->i_attrs, inode);
+        mutex_init(&(REISERFS_I(inode)->i_mmap));
        reiserfs_init_acl_access(inode);
        reiserfs_init_acl_default(inode);
        reiserfs_init_xattr_rwsem(inode);
diff --git a/include/asm-generic/libata-portmap.h b/include/asm-generic/libata-portmap.h
index 9202fd02d5be..62fb3618293d 100644
--- a/include/asm-generic/libata-portmap.h
+++ b/include/asm-generic/libata-portmap.h
@@ -3,10 +3,10 @@
 #define ATA_PRIMARY_CMD         0x1F0
 #define ATA_PRIMARY_CTL         0x3F6
-#define ATA_PRIMARY_IRQ         14
+#define ATA_PRIMARY_IRQ(dev)    14
 #define ATA_SECONDARY_CMD       0x170
 #define ATA_SECONDARY_CTL       0x376
-#define ATA_SECONDARY_IRQ       15
+#define ATA_SECONDARY_IRQ(dev)  15
 #endif
diff --git a/include/asm-i386/elf.h b/include/asm-i386/elf.h
index 45d21a0c95bf..369035dfe4b6 100644
--- a/include/asm-i386/elf.h
+++ b/include/asm-i386/elf.h
@@ -143,11 +143,8 @@ extern int dump_task_extended_fpu (struct task_struct *, struct user_fxsr_struct
 # define VDSO_PRELINK           0
 #endif
-#define VDSO_COMPAT_SYM(x) \
-                (VDSO_COMPAT_BASE + (unsigned long)(x) - VDSO_PRELINK)
 #define VDSO_SYM(x) \
-                (VDSO_BASE + (unsigned long)(x) - VDSO_PRELINK)
+                (VDSO_COMPAT_BASE + (unsigned long)(x) - VDSO_PRELINK)
 #define VDSO_HIGH_EHDR          ((const struct elfhdr *) VDSO_HIGH_BASE)
 #define VDSO_EHDR               ((const struct elfhdr *) VDSO_COMPAT_BASE)
@@ -156,10 +153,12 @@ extern void __kernel_vsyscall;
 #define VDSO_ENTRY              VDSO_SYM(&__kernel_vsyscall)
+#ifndef CONFIG_COMPAT_VDSO
 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
 struct linux_binprm;
 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
                                       int executable_stack);
+#endif
 extern unsigned int vdso_enabled;
@@ -169,50 +168,6 @@ do if (vdso_enabled) {						\
                NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_COMPAT_BASE); \
 } while (0)
-/*
- * These macros parameterize elf_core_dump in fs/binfmt_elf.c to write out
- * extra segments containing the vsyscall DSO contents.  Dumping its
- * contents makes post-mortem fully interpretable later without matching up
- * the same kernel and hardware config to see what PC values meant.
- * Dumping its extra ELF program headers includes all the other information
- * a debugger needs to easily find how the vsyscall DSO was being used.
- */
-#define ELF_CORE_EXTRA_PHDRS            (VDSO_HIGH_EHDR->e_phnum)
-#define ELF_CORE_WRITE_EXTRA_PHDRS                                            \
-do {                                                                          \
-        const struct elf_phdr *const vsyscall_phdrs =                         \
-                (const struct elf_phdr *) (VDSO_HIGH_BASE                     \
-                                           + VDSO_HIGH_EHDR->e_phoff);    \
-        int i;                                                                \
-        Elf32_Off ofs = 0;                                                    \
-        for (i = 0; i < VDSO_HIGH_EHDR->e_phnum; ++i) {               \
-                struct elf_phdr phdr = vsyscall_phdrs[i];                     \
-                if (phdr.p_type == PT_LOAD) {                                 \
-                        BUG_ON(ofs != 0);                                     \
-                        ofs = phdr.p_offset = offset;                         \
-                        phdr.p_memsz = PAGE_ALIGN(phdr.p_memsz);              \
-                        phdr.p_filesz = phdr.p_memsz;                         \
-                        offset += phdr.p_filesz;                              \
-                }                                                             \
-                else                                                          \
-                        phdr.p_offset += ofs;                                 \
-                phdr.p_paddr = 0; /* match other core phdrs */                \
-                DUMP_WRITE(&phdr, sizeof(phdr));                              \
-        }                                                                     \
-} while (0)
-#define ELF_CORE_WRITE_EXTRA_DATA                                             \
-do {                                                                          \
-        const struct elf_phdr *const vsyscall_phdrs =                         \
-                (const struct elf_phdr *) (VDSO_HIGH_BASE                     \
-                                           + VDSO_HIGH_EHDR->e_phoff);    \
-        int i;                                                                \
-        for (i = 0; i < VDSO_HIGH_EHDR->e_phnum; ++i) {               \
-                if (vsyscall_phdrs[i].p_type == PT_LOAD)                      \
-                        DUMP_WRITE((void *) vsyscall_phdrs[i].p_vaddr,        \
-                                   PAGE_ALIGN(vsyscall_phdrs[i].p_memsz));    \
-        }                                                                     \
-} while (0)
 #endif
 #endif
diff --git a/include/asm-i386/fixmap.h b/include/asm-i386/fixmap.h
index 02428cb36621..3e9f610c35df 100644
--- a/include/asm-i386/fixmap.h
+++ b/include/asm-i386/fixmap.h
@@ -23,6 +23,8 @@
 extern unsigned long __FIXADDR_TOP;
 #else
 #define __FIXADDR_TOP  0xfffff000
+#define FIXADDR_USER_START      __fix_to_virt(FIX_VDSO)
+#define FIXADDR_USER_END        __fix_to_virt(FIX_VDSO - 1)
 #endif
 #ifndef __ASSEMBLY__
diff --git a/include/asm-i386/page.h b/include/asm-i386/page.h
index fd3f64ace248..7b19f454761d 100644
--- a/include/asm-i386/page.h
+++ b/include/asm-i386/page.h
@@ -143,7 +143,9 @@ extern int page_is_ram(unsigned long pagenr);
 #include <asm-generic/memory_model.h>
 #include <asm-generic/page.h>
+#ifndef CONFIG_COMPAT_VDSO
 #define __HAVE_ARCH_GATE_AREA 1
+#endif
 #endif /* __KERNEL__ */
 #endif /* _I386_PAGE_H */
diff --git a/include/asm-ia64/checksum.h b/include/asm-ia64/checksum.h
index 2b78582cbd61..97af155057e4 100644
--- a/include/asm-ia64/checksum.h
+++ b/include/asm-ia64/checksum.h
@@ -72,8 +72,8 @@ static inline __sum16 csum_fold(__wsum csum)
 #define _HAVE_ARCH_IPV6_CSUM    1
 struct in6_addr;
-extern unsigned short int csum_ipv6_magic(struct in6_addr *saddr,
+extern __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
-        struct in6_addr *daddr, __u32 len, unsigned short proto,
+        const struct in6_addr *daddr, __u32 len, unsigned short proto,
-        unsigned int csum);
+        __wsum csum);
 #endif /* _ASM_IA64_CHECKSUM_H */
diff --git a/include/asm-mips/checksum.h b/include/asm-mips/checksum.h
index 24cdcc6eaab8..20a81e1548f5 100644
--- a/include/asm-mips/checksum.h
+++ b/include/asm-mips/checksum.h
@@ -159,7 +159,8 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr,
 #endif
        "       .set    pop"
        : "=r" (sum)
-        : "0" (daddr), "r"(saddr),
+        : "0" ((__force unsigned long)daddr),
+          "r" ((__force unsigned long)saddr),
 #ifdef __MIPSEL__
          "r" ((proto + len) << 8),
 #else
diff --git a/include/asm-mips/hazards.h b/include/asm-mips/hazards.h
index 0fe02945feba..50073157a617 100644
--- a/include/asm-mips/hazards.h
+++ b/include/asm-mips/hazards.h
@@ -157,7 +157,7 @@ ASMMACRO(back_to_back_c0_hazard,
 * processors.
 */
 ASMMACRO(mtc0_tlbw_hazard,
-        nop
+        nop; nop
        )
 ASMMACRO(tlbw_use_hazard,
        nop; nop; nop
diff --git a/include/asm-mips/irqflags.h b/include/asm-mips/irqflags.h
index 46bf5de5ac72..af3b07dfad4b 100644
--- a/include/asm-mips/irqflags.h
+++ b/include/asm-mips/irqflags.h
@@ -15,6 +15,27 @@
 #include <asm/hazards.h>
+/*
+ * CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY does prompt replay of deferred IPIs,
+ * at the cost of branch and call overhead on each local_irq_restore()
+ */
+#ifdef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
+extern void smtc_ipi_replay(void);
+#define irq_restore_epilog(flags)                               \
+do {                                                            \
+        if (!(flags & 0x0400))                                  \
+                smtc_ipi_replay();                              \
+} while (0)
+#else
+#define irq_restore_epilog(ignore) do { } while (0)
+#endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
 __asm__ (
        "       .macro  raw_local_irq_enable                            \n"
        "       .set    push                                            \n"
@@ -193,6 +214,7 @@ do {									\
                : "=r" (__tmp1)                                         \
                : "0" (flags)                                           \
                : "memory");                                            \
+        irq_restore_epilog(flags);                                      \
 } while(0)
 static inline int raw_irqs_disabled_flags(unsigned long flags)
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index e475c45ea263..fbcda8204473 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -118,6 +118,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_USEDFPU             16      /* FPU was used by this task this quantum (SMP) */
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
+#define TIF_FREEZE              19
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
@@ -129,6 +130,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
 #define _TIF_USEDFPU            (1<<TIF_USEDFPU)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
+#define _TIF_FREEZE             (1<<TIF_FREEZE)
 /* work to do on interrupt/exception return */
 #define _TIF_WORK_MASK          (0x0000ffef & ~_TIF_SECCOMP)
diff --git a/include/asm-powerpc/libata-portmap.h b/include/asm-powerpc/libata-portmap.h
new file mode 100644
index 000000000000..4d8518049f4d
--- /dev/null
+++ b/include/asm-powerpc/libata-portmap.h
@@ -0,0 +1,12 @@
+#ifndef __ASM_POWERPC_LIBATA_PORTMAP_H
+#define __ASM_POWERPC_LIBATA_PORTMAP_H
+#define ATA_PRIMARY_CMD 0x1F0
+#define ATA_PRIMARY_CTL 0x3F6
+#define ATA_PRIMARY_IRQ(dev)    pci_get_legacy_ide_irq(dev, 0)
+#define ATA_SECONDARY_CMD       0x170
+#define ATA_SECONDARY_CTL       0x376
+#define ATA_SECONDARY_IRQ(dev)  pci_get_legacy_ide_irq(dev, 1)
+#endif
diff --git a/include/asm-x86_64/uaccess.h b/include/asm-x86_64/uaccess.h
index d5dbc87274f8..c0eac519840b 100644
--- a/include/asm-x86_64/uaccess.h
+++ b/include/asm-x86_64/uaccess.h
@@ -157,7 +157,7 @@ do {									\
          case 1: __put_user_asm(x,ptr,retval,"b","b","iq",-EFAULT); break;\
          case 2: __put_user_asm(x,ptr,retval,"w","w","ir",-EFAULT); break;\
          case 4: __put_user_asm(x,ptr,retval,"l","k","ir",-EFAULT); break;\
-          case 8: __put_user_asm(x,ptr,retval,"q","","ir",-EFAULT); break;\
+          case 8: __put_user_asm(x,ptr,retval,"q","","Zr",-EFAULT); break;\
          default: __put_user_bad();                                    \
        }                                                               \
 } while (0)
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 862e483cce8a..157db77a7170 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -69,7 +69,6 @@ header-y += hysdn_if.h
 header-y += i2c-dev.h
 header-y += i8k.h
 header-y += icmp.h
-header-y += if_addr.h
 header-y += if_arcnet.h
 header-y += if_arp.h
 header-y += if_bonding.h
@@ -79,7 +78,6 @@ header-y += if_fddi.h
 header-y += if.h
 header-y += if_hippi.h
 header-y += if_infiniband.h
-header-y += if_link.h
 header-y += if_packet.h
 header-y += if_plip.h
 header-y += if_ppp.h
@@ -129,7 +127,6 @@ header-y += posix_types.h
 header-y += ppdev.h
 header-y += prctl.h
 header-y += ps2esdi.h
-header-y += qic117.h
 header-y += qnxtypes.h
 header-y += quotaio_v1.h
 header-y += quotaio_v2.h
@@ -214,6 +211,7 @@ unifdef-y += hpet.h
 unifdef-y += i2c.h
 unifdef-y += i2o-dev.h
 unifdef-y += icmpv6.h
+unifdef-y += if_addr.h
 unifdef-y += if_bridge.h
 unifdef-y += if_ec.h
 unifdef-y += if_eql.h
@@ -221,6 +219,7 @@ unifdef-y += if_ether.h
 unifdef-y += if_fddi.h
 unifdef-y += if_frad.h
 unifdef-y += if_ltalk.h
+unifdef-y += if_link.h
 unifdef-y += if_pppox.h
 unifdef-y += if_shaper.h
 unifdef-y += if_tr.h
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 5d1eabcde5d5..638165f571da 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -31,9 +31,8 @@ static inline unsigned long hweight_long(unsigned long w)
        return sizeof(w) == 4 ? hweight32(w) : hweight64(w);
 }
-/*
+/**
 * rol32 - rotate a 32-bit value left
- *
 * @word: value to rotate
 * @shift: bits to roll
 */
@@ -42,9 +41,8 @@ static inline __u32 rol32(__u32 word, unsigned int shift)
        return (word << shift) | (word >> (32 - shift));
 }
-/*
+/**
 * ror32 - rotate a 32-bit value right
- *
 * @word: value to rotate
 * @shift: bits to roll
 */
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 8de079ba1107..660b5010c2d9 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -1,6 +1,8 @@
 #ifndef _IF_TUNNEL_H_
 #define _IF_TUNNEL_H_
+#include <linux/types.h>
 #define SIOCGETTUNNEL   (SIOCDEVPRIVATE + 0)
 #define SIOCADDTUNNEL   (SIOCDEVPRIVATE + 1)
 #define SIOCDELTUNNEL   (SIOCDEVPRIVATE + 2)
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index bc8b4616bad7..1be148f0fce4 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -46,6 +46,7 @@ enum kvm_exit_reason {
        KVM_EXIT_HLT              = 5,
        KVM_EXIT_MMIO             = 6,
        KVM_EXIT_IRQ_WINDOW_OPEN  = 7,
+        KVM_EXIT_SHUTDOWN         = 8,
 };
 /* for KVM_RUN */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index e53a13ba7f78..22aa69e20905 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -177,6 +177,7 @@ enum {
                                              * Register FIS clearing BSY */
        ATA_FLAG_DEBUGMSG       = (1 << 13),
        ATA_FLAG_SETXFER_POLLING= (1 << 14), /* use polling for SETXFER */
+        ATA_FLAG_IGN_SIMPLEX    = (1 << 15), /* ignore SIMPLEX */
        /* The following flag belongs to ap->pflags but is kept in
         * ap->flags because it's referenced in many LLDs and will be
@@ -612,11 +613,11 @@ struct ata_port_operations {
        void (*dev_select)(struct ata_port *ap, unsigned int device);
        void (*phy_reset) (struct ata_port *ap); /* obsolete */
-        void (*set_mode) (struct ata_port *ap);
+        int  (*set_mode) (struct ata_port *ap, struct ata_device **r_failed_dev);
        void (*post_set_mode) (struct ata_port *ap);
-        int (*check_atapi_dma) (struct ata_queued_cmd *qc);
+        int  (*check_atapi_dma) (struct ata_queued_cmd *qc);
        void (*bmdma_setup) (struct ata_queued_cmd *qc);
        void (*bmdma_start) (struct ata_queued_cmd *qc);
@@ -1149,7 +1150,9 @@ static inline void ata_qc_reinit(struct ata_queued_cmd *qc)
        qc->cursect = qc->cursg = qc->cursg_ofs = 0;
        qc->nsect = 0;
        qc->nbytes = qc->curbytes = 0;
+        qc->n_elem = 0;
        qc->err_mask = 0;
+        qc->pad_len = 0;
        ata_tf_init(qc->dev, &qc->tf);
diff --git a/include/linux/list.h b/include/linux/list.h
index a9c90287c0ff..611059d633f4 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -227,13 +227,13 @@ static inline void list_replace_init(struct list_head *old,
        INIT_LIST_HEAD(old);
 }
-/*
+/**
 * list_replace_rcu - replace old entry by new one
 * @old : the element to be replaced
 * @new : the new element to insert
 *
- * The old entry will be replaced with the new entry atomically.
+ * The @old entry will be replaced with the @new entry atomically.
- * Note: 'old' should not be empty.
+ * Note: @old should not be empty.
 */
 static inline void list_replace_rcu(struct list_head *old,
                                struct list_head *new)
@@ -680,12 +680,12 @@ static inline void hlist_del_init(struct hlist_node *n)
        }
 }
-/*
+/**
 * hlist_replace_rcu - replace old entry by new one
 * @old : the element to be replaced
 * @new : the new element to insert
 *
- * The old entry will be replaced with the new entry atomically.
+ * The @old entry will be replaced with the @new entry atomically.
 */
 static inline void hlist_replace_rcu(struct hlist_node *old,
                                        struct hlist_node *new)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 76912231af41..2d2c08d5f473 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -168,6 +168,7 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_NONLINEAR    0x00800000      /* Is non-linear (remap_file_pages) */
 #define VM_MAPPED_COPY  0x01000000      /* T if mapped copy of data (nommu mmap) */
 #define VM_INSERTPAGE   0x02000000      /* The vma has had "vm_insert_page()" done on it */
+#define VM_ALWAYSDUMP   0x04000000      /* Always include in core dumps */
 #ifndef VM_STACK_DEFAULT_FLAGS          /* arch can override this */
 #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
diff --git a/include/linux/mtio.h b/include/linux/mtio.h
index 8c66151821e3..6f8d2d45a8fb 100644
--- a/include/linux/mtio.h
+++ b/include/linux/mtio.h
@@ -10,7 +10,6 @@
 #include <linux/types.h>
 #include <linux/ioctl.h>
-#include <linux/qic117.h>
 /*
 * Structures and definitions for mag tape io control commands
@@ -116,32 +115,6 @@ struct	mtget {
 #define MT_ISFTAPE_UNKNOWN      0x800000 /* obsolete */
 #define MT_ISFTAPE_FLAG 0x800000
-struct mt_tape_info {
-        long t_type;            /* device type id (mt_type) */
-        char *t_name;           /* descriptive name */
-};
-#define MT_TAPE_INFO    { \
-        {MT_ISUNKNOWN,          "Unknown type of tape device"}, \
-        {MT_ISQIC02,            "Generic QIC-02 tape streamer"}, \
-        {MT_ISWT5150,           "Wangtek 5150, QIC-150"}, \
-        {MT_ISARCHIVE_5945L2,   "Archive 5945L-2"}, \
-        {MT_ISCMSJ500,          "CMS Jumbo 500"}, \
-        {MT_ISTDC3610,          "Tandberg TDC 3610, QIC-24"}, \
-        {MT_ISARCHIVE_VP60I,    "Archive VP60i, QIC-02"}, \
-        {MT_ISARCHIVE_2150L,    "Archive Viper 2150L"}, \
-        {MT_ISARCHIVE_2060L,    "Archive Viper 2060L"}, \
-        {MT_ISARCHIVESC499,     "Archive SC-499 QIC-36 controller"}, \
-        {MT_ISQIC02_ALL_FEATURES, "Generic QIC-02 tape, all features"}, \
-        {MT_ISWT5099EEN24,      "Wangtek 5099-een24, 60MB"}, \
-        {MT_ISTEAC_MT2ST,       "Teac MT-2ST 155mb data cassette drive"}, \
-        {MT_ISEVEREX_FT40A,     "Everex FT40A, QIC-40"}, \
-        {MT_ISONSTREAM_SC,      "OnStream SC-, DI-, DP-, or USB tape drive"}, \
-        {MT_ISSCSI1,            "Generic SCSI-1 tape"}, \
-        {MT_ISSCSI2,            "Generic SCSI-2 tape"}, \
-        {0, NULL} \
-}
 /* structure for MTIOCPOS - mag tape get position command */
@@ -150,130 +123,11 @@ struct	mtpos {
 };
-/*  structure for MTIOCVOLINFO, query information about the volume
- *  currently positioned at (zftape)
- */
-struct mtvolinfo {
-        unsigned int mt_volno;   /* vol-number */
-        unsigned int mt_blksz;   /* blocksize used when recording */
-        unsigned int mt_rawsize; /* raw tape space consumed, in kb */
-        unsigned int mt_size;    /* volume size after decompression, in kb */
-        unsigned int mt_cmpr:1;  /* this volume has been compressed */
-};
-/* raw access to a floppy drive, read and write an arbitrary segment.
- * For ftape/zftape to support formatting etc.
- */
-#define MT_FT_RD_SINGLE  0
-#define MT_FT_RD_AHEAD   1
-#define MT_FT_WR_ASYNC   0 /* start tape only when all buffers are full     */
-#define MT_FT_WR_MULTI   1 /* start tape, continue until buffers are empty  */
-#define MT_FT_WR_SINGLE  2 /* write a single segment and stop afterwards    */
-#define MT_FT_WR_DELETE  3 /* write deleted data marks, one segment at time */
-struct mtftseg
-{            
-        unsigned mt_segno;   /* the segment to read or write */
-        unsigned mt_mode;    /* modes for read/write (sync/async etc.) */
-        int      mt_result;  /* result of r/w request, not of the ioctl */
-        void    __user *mt_data;    /* User space buffer: must be 29kb */
-};
-/* get tape capacity (ftape/zftape)
- */
-struct mttapesize {
-        unsigned long mt_capacity; /* entire, uncompressed capacity 
-                                    * of a cartridge
-                                    */
-        unsigned long mt_used;     /* what has been used so far, raw 
-                                    * uncompressed amount
-                                    */
-};
-/*  possible values of the ftfmt_op field
- */
-#define FTFMT_SET_PARMS         1 /* set software parms */
-#define FTFMT_GET_PARMS         2 /* get software parms */
-#define FTFMT_FORMAT_TRACK      3 /* start formatting a tape track   */
-#define FTFMT_STATUS            4 /* monitor formatting a tape track */
-#define FTFMT_VERIFY            5 /* verify the given segment        */
-struct ftfmtparms {
-        unsigned char  ft_qicstd;   /* QIC-40/QIC-80/QIC-3010/QIC-3020 */
-        unsigned char  ft_fmtcode;  /* Refer to the QIC specs */
-        unsigned char  ft_fhm;      /* floppy head max */
-        unsigned char  ft_ftm;      /* floppy track max */
-        unsigned short ft_spt;      /* segments per track */
-        unsigned short ft_tpc;      /* tracks per cartridge */
-};
-struct ftfmttrack {
-        unsigned int  ft_track;   /* track to format */
-        unsigned char ft_gap3;    /* size of gap3, for FORMAT_TRK */
-};
-struct ftfmtstatus {
-        unsigned int  ft_segment;  /* segment currently being formatted */
-};
-struct ftfmtverify {
-        unsigned int  ft_segment;   /* segment to verify */
-        unsigned long ft_bsm;       /* bsm as result of VERIFY cmd */
-};
-struct mtftformat {
-        unsigned int fmt_op;      /* operation to perform */
-        union fmt_arg {
-                struct ftfmtparms  fmt_parms;  /* format parameters */
-                struct ftfmttrack  fmt_track;  /* ctrl while formatting */
-                struct ftfmtstatus fmt_status;
-                struct ftfmtverify fmt_verify; /* for verifying */ 
-        } fmt_arg;
-};
-struct mtftcmd {
-        unsigned int ft_wait_before; /* timeout to wait for drive to get ready 
-                                      * before command is sent. Milliseconds
-                                      */
-        qic117_cmd_t ft_cmd;         /* command to send */
-        unsigned char ft_parm_cnt;   /* zero: no parm is sent. */
-        unsigned char ft_parms[3];   /* parameter(s) to send to
-                                      * the drive. The parms are nibbles
-                                      * driver sends cmd + 2 step pulses */
-        unsigned int ft_result_bits; /* if non zero, number of bits
-                                      * returned by the tape drive
-                                      */
-        unsigned int ft_result;      /* the result returned by the tape drive*/
-        unsigned int ft_wait_after;  /* timeout to wait for drive to get ready
-                                      * after command is sent. 0: don't wait */
-        int ft_status;               /* status returned by ready wait
-                                      * undefined if timeout was 0.
-                                      */
-        int ft_error;                /* error code if error status was set by 
-                                      * command
-                                      */
-};
 /* mag tape io control commands */
 #define MTIOCTOP        _IOW('m', 1, struct mtop)       /* do a mag tape op */
 #define MTIOCGET        _IOR('m', 2, struct mtget)      /* get tape status */
 #define MTIOCPOS        _IOR('m', 3, struct mtpos)      /* get tape position */
-/* The next two are used by the QIC-02 driver for runtime reconfiguration.
- * See tpqic02.h for struct mtconfiginfo.
- */
-#define MTIOCGETCONFIG  _IOR('m', 4, struct mtconfiginfo) /* get tape config */
-#define MTIOCSETCONFIG  _IOW('m', 5, struct mtconfiginfo) /* set tape config */
-/* the next six are used by the floppy ftape drivers and its frontends
- * sorry, but MTIOCTOP commands are write only.
- */
-#define MTIOCRDFTSEG    _IOWR('m', 6, struct mtftseg)  /* read a segment */
-#define MTIOCWRFTSEG    _IOWR('m', 7, struct mtftseg)   /* write a segment */
-#define MTIOCVOLINFO    _IOR('m',  8, struct mtvolinfo) /* info about volume */
-#define MTIOCGETSIZE    _IOR('m',  9, struct mttapesize)/* get cartridge size*/
-#define MTIOCFTFORMAT   _IOWR('m', 10, struct mtftformat) /* format ftape */
-#define MTIOCFTCMD      _IOWR('m', 11, struct mtftcmd) /* send QIC-117 cmd */
 /* Generic Mag Tape (device independent) status macros for examining
 * mt_gstat -- HP-UX compatible.
diff --git a/include/linux/mutex.h b/include/linux/mutex.h
index a7544afd7582..b81bc2adaeff 100644
--- a/include/linux/mutex.h
+++ b/include/linux/mutex.h
@@ -105,7 +105,7 @@ do {							\
 extern void __mutex_init(struct mutex *lock, const char *name,
                         struct lock_class_key *key);
-/***
+/**
 * mutex_is_locked - is the mutex locked
 * @lock: the mutex to be queried
 *
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index 4f06dad0bde9..98d566c5e32a 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -28,7 +28,7 @@
 #include <linux/netfilter/x_tables.h>
 #define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
-#define IPT_TABLE_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
+#define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
 #define ipt_match xt_match
 #define ipt_target xt_target
 #define ipt_table xt_table
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 04963063e620..c5d4084773e8 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -308,6 +308,7 @@ extern int nfs_attribute_timeout(struct inode *inode);
 extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
+extern int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
 extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
 extern void nfs_begin_attr_update(struct inode *);
diff --git a/include/linux/nfsd/nfsd.h b/include/linux/nfsd/nfsd.h
index 0727774772ba..4b7c4b568f6d 100644
--- a/include/linux/nfsd/nfsd.h
+++ b/include/linux/nfsd/nfsd.h
@@ -52,8 +52,6 @@
 struct readdir_cd {
        __be32                  err;    /* 0, nfserr, or nfserr_eof */
 };
-typedef int             (*encode_dent_fn)(struct readdir_cd *, const char *,
-                                                int, loff_t, ino_t, unsigned int);
 typedef int (*nfsd_dirop_t)(struct inode *, struct dentry *, int, int);
 extern struct svc_program       nfsd_program;
@@ -117,7 +115,7 @@ __be32		nfsd_unlink(struct svc_rqst *, struct svc_fh *, int type,
 int             nfsd_truncate(struct svc_rqst *, struct svc_fh *,
                                unsigned long size);
 __be32          nfsd_readdir(struct svc_rqst *, struct svc_fh *,
-                             loff_t *, struct readdir_cd *, encode_dent_fn);
+                             loff_t *, struct readdir_cd *, filldir_t);
 __be32          nfsd_statfs(struct svc_rqst *, struct svc_fh *,
                                struct kstatfs *);
diff --git a/include/linux/nfsd/nfsfh.h b/include/linux/nfsd/nfsfh.h
index f3b51d62ec7d..d9c6c382165d 100644
--- a/include/linux/nfsd/nfsfh.h
+++ b/include/linux/nfsd/nfsfh.h
@@ -217,11 +217,7 @@ void	fh_put(struct svc_fh *);
 static __inline__ struct svc_fh *
 fh_copy(struct svc_fh *dst, struct svc_fh *src)
 {
-        if (src->fh_dentry || src->fh_locked) {
+        WARN_ON(src->fh_dentry || src->fh_locked);
-                struct dentry *dentry = src->fh_dentry;
-                printk(KERN_ERR "fh_copy: copying %s/%s, already verified!\n",
-                        dentry->d_parent->d_name.name, dentry->d_name.name);
-        }
                        
        *dst = *src;
        return dst;
@@ -300,10 +296,8 @@ fh_lock_nested(struct svc_fh *fhp, unsigned int subclass)
        dfprintk(FILEOP, "nfsd: fh_lock(%s) locked = %d\n",
                        SVCFH_fmt(fhp), fhp->fh_locked);
-        if (!fhp->fh_dentry) {
+        BUG_ON(!dentry);
-                printk(KERN_ERR "fh_lock: fh not verified!\n");
-                return;
-        }
        if (fhp->fh_locked) {
                printk(KERN_WARNING "fh_lock: %s/%s already locked!\n",
                        dentry->d_parent->d_name.name, dentry->d_name.name);
@@ -328,8 +322,7 @@ fh_lock(struct svc_fh *fhp)
 static inline void
 fh_unlock(struct svc_fh *fhp)
 {
-        if (!fhp->fh_dentry)
+        BUG_ON(!fhp->fh_dentry);
-                printk(KERN_ERR "fh_unlock: fh not verified!\n");
        if (fhp->fh_locked) {
                fill_post_wcc(fhp);
diff --git a/include/linux/nfsd/xdr.h b/include/linux/nfsd/xdr.h
index 877192d3ae79..67885d5e6e50 100644
--- a/include/linux/nfsd/xdr.h
+++ b/include/linux/nfsd/xdr.h
@@ -165,8 +165,8 @@ int nfssvc_encode_readres(struct svc_rqst *, __be32 *, struct nfsd_readres *);
 int nfssvc_encode_statfsres(struct svc_rqst *, __be32 *, struct nfsd_statfsres *);
 int nfssvc_encode_readdirres(struct svc_rqst *, __be32 *, struct nfsd_readdirres *);
-int nfssvc_encode_entry(struct readdir_cd *, const char *name,
+int nfssvc_encode_entry(void *, const char *name,
-                                int namlen, loff_t offset, ino_t ino, unsigned int);
+                        int namlen, loff_t offset, u64 ino, unsigned int);
 int nfssvc_release_fhandle(struct svc_rqst *, __be32 *, struct nfsd_fhandle *);
diff --git a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
index 79963867b0d7..89d9d6061a62 100644
--- a/include/linux/nfsd/xdr3.h
+++ b/include/linux/nfsd/xdr3.h
@@ -331,11 +331,11 @@ int nfs3svc_release_fhandle(struct svc_rqst *, __be32 *,
                                struct nfsd3_attrstat *);
 int nfs3svc_release_fhandle2(struct svc_rqst *, __be32 *,
                                struct nfsd3_fhandle_pair *);
-int nfs3svc_encode_entry(struct readdir_cd *, const char *name,
+int nfs3svc_encode_entry(void *, const char *name,
-                                int namlen, loff_t offset, ino_t ino,
+                                int namlen, loff_t offset, u64 ino,
                                unsigned int);
-int nfs3svc_encode_entry_plus(struct readdir_cd *, const char *name,
+int nfs3svc_encode_entry_plus(void *, const char *name,
-                                int namlen, loff_t offset, ino_t ino,
+                                int namlen, loff_t offset, u64 ino,
                                unsigned int);
 /* Helper functions for NFSv3 ACL code */
 __be32 *nfs3svc_encode_post_op_attr(struct svc_rqst *rqstp, __be32 *p,
diff --git a/include/linux/qic117.h b/include/linux/qic117.h
deleted file mode 100644
index 07b537e5d359..000000000000
--- a/include/linux/qic117.h
+++ /dev/null
@@ -1,290 +0,0 @@
-#ifndef _QIC117_H
-#define _QIC117_H
-/*
- *      Copyright (C) 1993-1996 Bas Laarhoven,
- *                (C) 1997      Claus-Justus Heine.
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2, or (at your option)
- any later version.
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU General Public License for more details.
- You should have received a copy of the GNU General Public License
- along with this program; see the file COPYING.  If not, write to
- the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- * $Source: /homes/cvs/ftape-stacked/include/linux/qic117.h,v $
- * $Revision: 1.2 $
- * $Date: 1997/10/05 19:19:32 $
- *
- *      This file contains QIC-117 spec. related definitions for the
- *      QIC-40/80/3010/3020 floppy-tape driver "ftape" for Linux.
- *
- *      These data were taken from the Quarter-Inch Cartridge
- *      Drive Standards, Inc. document titled:
- *      `Common Command Set Interface Specification for Flexible
- *       Disk Controller Based Minicartridge Tape Drives'
- *       document QIC-117 Revision J, 28 Aug 96.
- *      For more information, contact:
- *       Quarter-Inch Cartridge Drive Standards, Inc.
- *       311 East Carrillo Street
- *       Santa Barbara, California 93101
- *       Telephone (805) 963-3853
- *       Fax       (805) 962-1541
- *       WWW       http://www.qic.org
- *
- *      Current QIC standard revisions (of interest) are:
- *       QIC-40-MC,   Rev. M,  2 Sep 92.
- *       QIC-80-MC,   Rev. N, 20 Mar 96.
- *       QIC-80-MC,   Rev. K, 15 Dec 94.
- *       QIC-113,     Rev. G, 15 Jun 95.
- *       QIC-117,     Rev. J, 28 Aug 96.
- *       QIC-122,     Rev. B,  6 Mar 91.
- *       QIC-130,     Rev. C,  2 Sep 92.
- *       QIC-3010-MC, Rev. F, 14 Jun 95.
- *       QIC-3020-MC, Rev. G, 31 Aug 95.
- *       QIC-CRF3,    Rev. B, 15 Jun 95.
- * */
-/*
- *      QIC-117 common command set rev. J.
- *      These commands are sent to the tape unit
- *      as number of pulses over the step line.
- */
-typedef enum {
-        QIC_NO_COMMAND                  = 0,
-        QIC_RESET                       = 1,
-        QIC_REPORT_NEXT_BIT             = 2,
-        QIC_PAUSE                       = 3,
-        QIC_MICRO_STEP_PAUSE            = 4,
-        QIC_ALTERNATE_TIMEOUT           = 5,
-        QIC_REPORT_DRIVE_STATUS         = 6,
-        QIC_REPORT_ERROR_CODE           = 7,
-        QIC_REPORT_DRIVE_CONFIGURATION  = 8,
-        QIC_REPORT_ROM_VERSION          = 9,
-        QIC_LOGICAL_FORWARD             = 10,
-        QIC_PHYSICAL_REVERSE            = 11,
-        QIC_PHYSICAL_FORWARD            = 12,
-        QIC_SEEK_HEAD_TO_TRACK          = 13,
-        QIC_SEEK_LOAD_POINT             = 14,
-        QIC_ENTER_FORMAT_MODE           = 15,
-        QIC_WRITE_REFERENCE_BURST       = 16,
-        QIC_ENTER_VERIFY_MODE           = 17,
-        QIC_STOP_TAPE                   = 18,
-/* commands 19-20: reserved */
-        QIC_MICRO_STEP_HEAD_UP          = 21,
-        QIC_MICRO_STEP_HEAD_DOWN        = 22,
-        QIC_SOFT_SELECT                 = 23,
-        QIC_SOFT_DESELECT               = 24,
-        QIC_SKIP_REVERSE                = 25,
-        QIC_SKIP_FORWARD                = 26,
-        QIC_SELECT_RATE                 = 27,
-/* command 27, in ccs2: Select Rate or Format */
-        QIC_ENTER_DIAGNOSTIC_1          = 28,
-        QIC_ENTER_DIAGNOSTIC_2          = 29,
-        QIC_ENTER_PRIMARY_MODE          = 30,
-/* command 31: vendor unique */
-        QIC_REPORT_VENDOR_ID            = 32,
-        QIC_REPORT_TAPE_STATUS          = 33,
-        QIC_SKIP_EXTENDED_REVERSE       = 34,
-        QIC_SKIP_EXTENDED_FORWARD       = 35,
-        QIC_CALIBRATE_TAPE_LENGTH       = 36,
-        QIC_REPORT_FORMAT_SEGMENTS      = 37,
-        QIC_SET_FORMAT_SEGMENTS         = 38,
-/* commands 39-45: reserved */
-        QIC_PHANTOM_SELECT              = 46,
-        QIC_PHANTOM_DESELECT            = 47
-} qic117_cmd_t;
-typedef enum {
-        discretional = 0, required, ccs1, ccs2
-} qic_compatibility;
-typedef enum {
-        unused, mode, motion, report
-} command_types;
-struct qic117_command_table {
-        char *name;
-        __u8 mask;
-        __u8 state;
-        __u8 cmd_type;
-        __u8 non_intr;
-        __u8 level;
-};
-#define QIC117_COMMANDS {\
-/* command                           mask  state cmd_type           */\
-/* |    name                         |     |     |       non_intr   */\
-/* |    |                            |     |     |       |  level   */\
-/* 0*/ {NULL,                        0x00, 0x00, mode,   0, discretional},\
-/* 1*/ {"soft reset",                0x00, 0x00, motion, 1, required},\
-/* 2*/ {"report next bit",           0x00, 0x00, report, 0, required},\
-/* 3*/ {"pause",                     0x36, 0x24, motion, 1, required},\
-/* 4*/ {"micro step pause",          0x36, 0x24, motion, 1, required},\
-/* 5*/ {"alternate command timeout", 0x00, 0x00, mode,   0, required},\
-/* 6*/ {"report drive status",       0x00, 0x00, report, 0, required},\
-/* 7*/ {"report error code",         0x01, 0x01, report, 0, required},\
-/* 8*/ {"report drive configuration",0x00, 0x00, report, 0, required},\
-/* 9*/ {"report rom version",        0x00, 0x00, report, 0, required},\
-/*10*/ {"logical forward",           0x37, 0x25, motion, 0, required},\
-/*11*/ {"physical reverse",          0x17, 0x05, motion, 0, required},\
-/*12*/ {"physical forward",          0x17, 0x05, motion, 0, required},\
-/*13*/ {"seek head to track",        0x37, 0x25, motion, 0, required},\
-/*14*/ {"seek load point",           0x17, 0x05, motion, 1, required},\
-/*15*/ {"enter format mode",         0x1f, 0x05, mode,   0, required},\
-/*16*/ {"write reference burst",     0x1f, 0x05, motion, 1, required},\
-/*17*/ {"enter verify mode",         0x37, 0x25, mode,   0, required},\
-/*18*/ {"stop tape",                 0x00, 0x00, motion, 1, required},\
-/*19*/ {"reserved (19)",             0x00, 0x00, unused, 0, discretional},\
-/*20*/ {"reserved (20)",             0x00, 0x00, unused, 0, discretional},\
-/*21*/ {"micro step head up",        0x02, 0x00, motion, 0, required},\
-/*22*/ {"micro step head down",      0x02, 0x00, motion, 0, required},\
-/*23*/ {"soft select",               0x00, 0x00, mode,   0, discretional},\
-/*24*/ {"soft deselect",             0x00, 0x00, mode,   0, discretional},\
-/*25*/ {"skip segments reverse",     0x36, 0x24, motion, 1, required},\
-/*26*/ {"skip segments forward",     0x36, 0x24, motion, 1, required},\
-/*27*/ {"select rate or format",     0x03, 0x01, mode,   0, required /* [ccs2] */},\
-/*28*/ {"enter diag mode 1",         0x00, 0x00, mode,   0, discretional},\
-/*29*/ {"enter diag mode 2",         0x00, 0x00, mode,   0, discretional},\
-/*30*/ {"enter primary mode",        0x00, 0x00, mode,   0, required},\
-/*31*/ {"vendor unique (31)",        0x00, 0x00, unused, 0, discretional},\
-/*32*/ {"report vendor id",          0x00, 0x00, report, 0, required},\
-/*33*/ {"report tape status",        0x04, 0x04, report, 0, ccs1},\
-/*34*/ {"skip extended reverse",     0x36, 0x24, motion, 1, ccs1},\
-/*35*/ {"skip extended forward",     0x36, 0x24, motion, 1, ccs1},\
-/*36*/ {"calibrate tape length",     0x17, 0x05, motion, 1, ccs2},\
-/*37*/ {"report format segments",    0x17, 0x05, report, 0, ccs2},\
-/*38*/ {"set format segments",       0x17, 0x05, mode,   0, ccs2},\
-/*39*/ {"reserved (39)",             0x00, 0x00, unused, 0, discretional},\
-/*40*/ {"vendor unique (40)",        0x00, 0x00, unused, 0, discretional},\
-/*41*/ {"vendor unique (41)",        0x00, 0x00, unused, 0, discretional},\
-/*42*/ {"vendor unique (42)",        0x00, 0x00, unused, 0, discretional},\
-/*43*/ {"vendor unique (43)",        0x00, 0x00, unused, 0, discretional},\
-/*44*/ {"vendor unique (44)",        0x00, 0x00, unused, 0, discretional},\
-/*45*/ {"vendor unique (45)",        0x00, 0x00, unused, 0, discretional},\
-/*46*/ {"phantom select",            0x00, 0x00, mode,   0, discretional},\
-/*47*/ {"phantom deselect",          0x00, 0x00, mode,   0, discretional},\
-}
-/*
- *      Status bits returned by QIC_REPORT_DRIVE_STATUS
- */
-#define QIC_STATUS_READY        0x01    /* Drive is ready or idle. */
-#define QIC_STATUS_ERROR        0x02    /* Error detected, must read
-                                           error code to clear this */
-#define QIC_STATUS_CARTRIDGE_PRESENT 0x04       /* Tape is present */
-#define QIC_STATUS_WRITE_PROTECT 0x08   /* Tape is write protected */
-#define QIC_STATUS_NEW_CARTRIDGE 0x10   /* New cartridge inserted, must
-                                           read error status to clear. */
-#define QIC_STATUS_REFERENCED   0x20    /* Cartridge appears to have been
-                                           formatted. */
-#define QIC_STATUS_AT_BOT       0x40    /* Cartridge is at physical
-                                           beginning of tape. */
-#define QIC_STATUS_AT_EOT       0x80    /* Cartridge is at physical end
-                                           of tape. */
-/*
- *      Status bits returned by QIC_REPORT_DRIVE_CONFIGURATION
- */
-#define QIC_CONFIG_RATE_MASK    0x18
-#define QIC_CONFIG_RATE_SHIFT   3
-#define QIC_CONFIG_RATE_250     0
-#define QIC_CONFIG_RATE_500     2
-#define QIC_CONFIG_RATE_1000    3
-#define QIC_CONFIG_RATE_2000    1
-#define QIC_CONFIG_RATE_4000    0       /* since QIC-117 Rev. J */
-#define QIC_CONFIG_LONG         0x40    /* Extra Length Tape Detected */
-#define QIC_CONFIG_80           0x80    /* QIC-80 detected. */
-/*
- *      Status bits returned by QIC_REPORT_TAPE_STATUS
- */
-#define QIC_TAPE_STD_MASK       0x0f
-#define QIC_TAPE_QIC40          0x01
-#define QIC_TAPE_QIC80          0x02
-#define QIC_TAPE_QIC3020        0x03
-#define QIC_TAPE_QIC3010        0x04
-#define QIC_TAPE_LEN_MASK       0x70
-#define QIC_TAPE_205FT          0x10
-#define QIC_TAPE_307FT          0x20
-#define QIC_TAPE_VARIABLE       0x30
-#define QIC_TAPE_1100FT         0x40
-#define QIC_TAPE_FLEX           0x60
-#define QIC_TAPE_WIDE           0x80
-/* Define a value (in feet) slightly higher than 
- * the possible maximum tape length.
- */
-#define QIC_TOP_TAPE_LEN        1500
-/*
- *      Errors: List of error codes, and their severity.
- */
-typedef struct {
-        char *message;          /* Text describing the error. */
-        unsigned int fatal:1;   /* Non-zero if the error is fatal. */
-} ftape_error;
-#define QIC117_ERRORS {\
-  /* 0*/ { "No error", 0, },\
-  /* 1*/ { "Command Received while Drive Not Ready", 0, },\
-  /* 2*/ { "Cartridge Not Present or Removed", 1, },\
-  /* 3*/ { "Motor Speed Error (not within 1%)", 1, },\
-  /* 4*/ { "Motor Speed Fault (jammed, or gross speed error", 1, },\
-  /* 5*/ { "Cartridge Write Protected", 1, },\
-  /* 6*/ { "Undefined or Reserved Command Code", 1, },\
-  /* 7*/ { "Illegal Track Address Specified for Seek", 1, },\
-  /* 8*/ { "Illegal Command in Report Subcontext", 0, },\
-  /* 9*/ { "Illegal Entry into a Diagnostic Mode", 1, },\
-  /*10*/ { "Broken Tape Detected (based on hole sensor)", 1, },\
-  /*11*/ { "Warning--Read Gain Setting Error", 1, },\
-  /*12*/ { "Command Received While Error Status Pending (obs)", 1, },\
-  /*13*/ { "Command Received While New Cartridge Pending", 1, },\
-  /*14*/ { "Command Illegal or Undefined in Primary Mode", 1, },\
-  /*15*/ { "Command Illegal or Undefined in Format Mode", 1, },\
-  /*16*/ { "Command Illegal or Undefined in Verify Mode", 1, },\
-  /*17*/ { "Logical Forward Not at Logical BOT or no Format Segments in Format Mode", 1, },\
-  /*18*/ { "Logical EOT Before All Segments generated", 1, },\
-  /*19*/ { "Command Illegal When Cartridge Not Referenced", 1, },\
-  /*20*/ { "Self-Diagnostic Failed (cannot be cleared)", 1, },\
-  /*21*/ { "Warning EEPROM Not Initialized, Defaults Set", 1, },\
-  /*22*/ { "EEPROM Corrupted or Hardware Failure", 1, },\
-  /*23*/ { "Motion Time-out Error", 1, },\
-  /*24*/ { "Data Segment Too Long -- Logical Forward or Pause", 1, },\
-  /*25*/ { "Transmit Overrun (obs)", 1, },\
-  /*26*/ { "Power On Reset Occurred", 0, },\
-  /*27*/ { "Software Reset Occurred", 0, },\
-  /*28*/ { "Diagnostic Mode 1 Error", 1, },\
-  /*29*/ { "Diagnostic Mode 2 Error", 1, },\
-  /*30*/ { "Command Received During Non-Interruptible Process", 1, },\
-  /*31*/ { "Rate or Format Selection Error", 1, },\
-  /*32*/ { "Illegal Command While in High Speed Mode", 1, },\
-  /*33*/ { "Illegal Seek Segment Value", 1, },\
-  /*34*/ { "Invalid Media", 1, },\
-  /*35*/ { "Head Positioning Failure", 1, },\
-  /*36*/ { "Write Reference Burst Failure", 1, },\
-  /*37*/ { "Prom Code Missing", 1, },\
-  /*38*/ { "Invalid Format", 1, },\
-  /*39*/ { "EOT/BOT System Failure", 1, },\
-  /*40*/ { "Prom A Checksum Error", 1, },\
-  /*41*/ { "Drive Wakeup Reset Occurred", 1, },\
-  /*42*/ { "Prom B Checksum Error", 1, },\
-  /*43*/ { "Illegal Entry into Format Mode", 1, },\
-}
-#endif                          /* _QIC117_H */
diff --git a/include/linux/raid/md.h b/include/linux/raid/md.h
index 866a1e2b0ce0..fbaeda79b2e9 100644
--- a/include/linux/raid/md.h
+++ b/include/linux/raid/md.h
@@ -94,7 +94,7 @@ extern int sync_page_io(struct block_device *bdev, sector_t sector, int size,
                        struct page *page, int rw);
 extern void md_do_sync(mddev_t *mddev);
 extern void md_new_event(mddev_t *mddev);
+extern void md_allow_write(mddev_t *mddev);
 #endif /* CONFIG_MD */
 #endif 
diff --git a/include/linux/reiserfs_fs_i.h b/include/linux/reiserfs_fs_i.h
index 5b3b297aa2c5..ce3663fb0101 100644
--- a/include/linux/reiserfs_fs_i.h
+++ b/include/linux/reiserfs_fs_i.h
@@ -25,6 +25,7 @@ typedef enum {
        i_link_saved_truncate_mask = 0x0020,
        i_has_xattr_dir = 0x0040,
        i_data_log = 0x0080,
+        i_ever_mapped = 0x0100
 } reiserfs_inode_flags;
 struct reiserfs_inode_info {
@@ -52,6 +53,7 @@ struct reiserfs_inode_info {
         ** flushed */
        unsigned long i_trans_id;
        struct reiserfs_journal_list *i_jl;
+        struct mutex i_mmap;
 #ifdef CONFIG_REISERFS_FS_POSIX_ACL
        struct posix_acl *i_acl_access;
        struct posix_acl *i_acl_default;
diff --git a/include/linux/rtmutex.h b/include/linux/rtmutex.h
index b0090e9f7884..382bb7951166 100644
--- a/include/linux/rtmutex.h
+++ b/include/linux/rtmutex.h
@@ -16,7 +16,7 @@
 #include <linux/plist.h>
 #include <linux/spinlock_types.h>
-/*
+/**
 * The rt_mutex structure
 *
 * @wait_lock:  spinlock to protect the structure
@@ -71,7 +71,7 @@ struct hrtimer_sleeper;
 #define DEFINE_RT_MUTEX(mutexname) \
        struct rt_mutex mutexname = __RT_MUTEX_INITIALIZER(mutexname)
-/***
+/**
 * rt_mutex_is_locked - is the mutex locked
 * @lock: the mutex to be queried
 *
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 97c761652581..8b6ce60ea057 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -250,7 +250,6 @@ void		rpc_init_task(struct rpc_task *task, struct rpc_clnt *clnt,
                                int flags, const struct rpc_call_ops *ops,
                                void *data);
 void            rpc_put_task(struct rpc_task *);
-void            rpc_release_task(struct rpc_task *);
 void            rpc_exit_task(struct rpc_task *);
 void            rpc_release_calldata(const struct rpc_call_ops *, void *);
 void            rpc_killall_tasks(struct rpc_clnt *);
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 965d6c20086e..64f3d60c72af 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -144,8 +144,11 @@ extern u32 svc_max_payload(const struct svc_rqst *rqstp);
 *
 * Each request/reply pair can have at most one "payload", plus two pages,
 * one for the request, and one for the reply.
+ * We using ->sendfile to return read data, we might need one extra page
+ * if the request is not page-aligned.  So add another '1'.
 */
-#define RPCSVC_MAXPAGES         ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE + 2)
+#define RPCSVC_MAXPAGES         ((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE \
+                                + 2 + 1)
 static inline u32 svc_getnl(struct kvec *iov)
 {
diff --git a/include/linux/timer.h b/include/linux/timer.h
index eeef6643d4c6..fb5edaaf0ebd 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -41,7 +41,7 @@ static inline void setup_timer(struct timer_list * timer,
        init_timer(timer);
 }
-/***
+/**
 * timer_pending - is a timer pending?
 * @timer: the timer in question
 *
@@ -63,7 +63,7 @@ extern int mod_timer(struct timer_list *timer, unsigned long expires);
 extern unsigned long next_timer_interrupt(void);
-/***
+/**
 * add_timer - start a timer
 * @timer: the timer to be added
 *
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index 16aa96a6a53b..f13ddc2543b1 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -38,5 +38,5 @@ extern void inet6_csk_reqsk_queue_hash_add(struct sock *sk,
 extern void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr);
-extern int inet6_csk_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok);
+extern int inet6_csk_xmit(struct sk_buff *skb, int ipfragok);
 #endif /* _INET6_CONNECTION_SOCK_H */
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index bf16d98d372c..133cf30d2d79 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -37,8 +37,7 @@ struct tcp_congestion_ops;
 * (i.e. things that depend on the address family)
 */
 struct inet_connection_sock_af_ops {
-        int         (*queue_xmit)(struct sk_buff *skb, struct sock *sk,
+        int         (*queue_xmit)(struct sk_buff *skb, int ipfragok);
-                                  int ipfragok);
        void        (*send_check)(struct sock *sk, int len,
                                  struct sk_buff *skb);
        int         (*rebuild_header)(struct sock *sk);
diff --git a/include/net/ip.h b/include/net/ip.h
index 053f02b5cb89..e79c3e3aa4f6 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -97,7 +97,7 @@ extern int		ip_mc_output(struct sk_buff *skb);
 extern int              ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 extern int              ip_do_nat(struct sk_buff *skb);
 extern void             ip_send_check(struct iphdr *ip);
-extern int              ip_queue_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok);
+extern int              ip_queue_xmit(struct sk_buff *skb, int ipfragok);
 extern void             ip_init(void);
 extern int              ip_append_data(struct sock *sk,
                                       int getfrag(void *from, char *to, int offset, int len,
diff --git a/include/net/netfilter/nf_conntrack_compat.h b/include/net/netfilter/nf_conntrack_compat.h
index b9ce5c80d9d5..6f84c1f7fcd4 100644
--- a/include/net/netfilter/nf_conntrack_compat.h
+++ b/include/net/netfilter/nf_conntrack_compat.h
@@ -6,6 +6,7 @@
 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
 #include <linux/netfilter_ipv4/ip_conntrack.h>
+#include <linux/socket.h>
 #ifdef CONFIG_IP_NF_CONNTRACK_MARK
 static inline u_int32_t *nf_ct_get_mark(const struct sk_buff *skb,
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 3269ed1cc222..73cb9943c8a8 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -134,6 +134,7 @@ sctp_state_fn_t sctp_sf_violation;
 sctp_state_fn_t sctp_sf_discard_chunk;
 sctp_state_fn_t sctp_sf_do_5_2_1_siminit;
 sctp_state_fn_t sctp_sf_do_5_2_2_dupinit;
+sctp_state_fn_t sctp_sf_do_5_2_3_initack;
 sctp_state_fn_t sctp_sf_do_5_2_4_dupcook;
 sctp_state_fn_t sctp_sf_unk_chunk;
 sctp_state_fn_t sctp_sf_do_8_5_1_E_sa;
diff --git a/ipc/shm.c b/ipc/shm.c
index 6d16bb6de7d2..f8e10a25ad7d 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -279,7 +279,7 @@ static int newseg (struct ipc_namespace *ns, key_t key, int shmflg, size_t size)
        if (size < SHMMIN || size > ns->shm_ctlmax)
                return -EINVAL;
-        if (ns->shm_tot + numpages >= ns->shm_ctlall)
+        if (ns->shm_tot + numpages > ns->shm_ctlall)
                return -ENOSPC;
        shp = ipc_rcu_alloc(sizeof(*shp));
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index b385878c6e80..8b961adc3bd2 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -315,6 +315,9 @@ int setup_irq(unsigned int irq, struct irqaction *new)
                        /* Undo nested disables: */
                        desc->depth = 1;
        }
+        /* Reset broken irq detection when installing new handler */
+        desc->irq_count = 0;
+        desc->irqs_unhandled = 0;
        spin_unlock_irqrestore(&desc->lock, flags);
        new->irq = irq;
diff --git a/kernel/profile.c b/kernel/profile.c
index a6574a18514e..d6579d511069 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -331,7 +331,6 @@ out:
        local_irq_restore(flags);
        put_cpu();
 }
-EXPORT_SYMBOL_GPL(profile_hits);
 static int __devinit profile_cpu_callback(struct notifier_block *info,
                                        unsigned long action, void *__cpu)
@@ -401,6 +400,8 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
 }
 #endif /* !CONFIG_SMP */
+EXPORT_SYMBOL_GPL(profile_hits);
 void profile_tick(int type)
 {
        struct pt_regs *regs = get_irq_regs();
diff --git a/kernel/sys.c b/kernel/sys.c
index c7675c1bfdf2..6e2101dec0fc 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -323,11 +323,18 @@ EXPORT_SYMBOL_GPL(blocking_notifier_chain_unregister);
 int blocking_notifier_call_chain(struct blocking_notifier_head *nh,
                unsigned long val, void *v)
 {
-        int ret;
+        int ret = NOTIFY_DONE;
-        down_read(&nh->rwsem);
+        /*
-        ret = notifier_call_chain(&nh->head, val, v);
+         * We check the head outside the lock, but if this access is
-        up_read(&nh->rwsem);
+         * racy then it does not matter what the result of the test
+         * is, we re-check the list after having taken the lock anyway:
+         */
+        if (rcu_dereference(nh->head)) {
+                down_read(&nh->rwsem);
+                ret = notifier_call_chain(&nh->head, val, v);
+                up_read(&nh->rwsem);
+        }
        return ret;
 }
diff --git a/mm/memory.c b/mm/memory.c
index af227d26e104..ef09f0acb1d8 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2606,8 +2606,15 @@ static int __init gate_vma_init(void)
        gate_vma.vm_mm = NULL;
        gate_vma.vm_start = FIXADDR_USER_START;
        gate_vma.vm_end = FIXADDR_USER_END;
-        gate_vma.vm_page_prot = PAGE_READONLY;
+        gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-        gate_vma.vm_flags = 0;
+        gate_vma.vm_page_prot = __P101;
+        /*
+         * Make sure the vDSO gets into every core dump.
+         * Dumping its contents makes post-mortem fully interpretable later
+         * without matching up the same kernel and hardware config to see
+         * what PC values meant.
+         */
+        gate_vma.vm_flags |= VM_ALWAYSDUMP;
        return 0;
 }
 __initcall(gate_vma_init);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index da9463946556..c2aec0e1090d 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -884,6 +884,10 @@ asmlinkage long sys_mbind(unsigned long start, unsigned long len,
        err = get_nodes(&nodes, nmask, maxnode);
        if (err)
                return err;
+#ifdef CONFIG_CPUSETS
+        /* Restrict the nodes to the allowed nodes in the cpuset */
+        nodes_and(nodes, nodes, current->mems_allowed);
+#endif
        return do_mbind(start, len, mode, &nodes, flags);
 }
diff --git a/mm/truncate.c b/mm/truncate.c
index 6c79ca4a1ca7..5df947de7654 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -51,15 +51,22 @@ static inline void truncate_partial_page(struct page *page, unsigned partial)
                do_invalidatepage(page, partial);
 }
+/*
+ * This cancels just the dirty bit on the kernel page itself, it
+ * does NOT actually remove dirty bits on any mmap's that may be
+ * around. It also leaves the page tagged dirty, so any sync
+ * activity will still find it on the dirty lists, and in particular,
+ * clear_page_dirty_for_io() will still look at the dirty bits in
+ * the VM.
+ *
+ * Doing this should *normally* only ever be done when a page
+ * is truncated, and is not actually mapped anywhere at all. However,
+ * fs/buffer.c does this when it notices that somebody has cleaned
+ * out all the buffers on a page without actually doing it through
+ * the VM. Can you say "ext3 is horribly ugly"? Tought you could.
+ */
 void cancel_dirty_page(struct page *page, unsigned int account_size)
 {
-        /* If we're cancelling the page, it had better not be mapped any more */
-        if (page_mapped(page)) {
-                static unsigned int warncount;
-                WARN_ON(++warncount < 5);
-        }
-                
        if (TestClearPageDirty(page)) {
                struct address_space *mapping = page->mapping;
                if (mapping && mapping_cap_account_dirty(mapping)) {
@@ -422,7 +429,6 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                pagevec_release(&pvec);
                cond_resched();
        }
-        WARN_ON_ONCE(ret);
        return ret;
 }
 EXPORT_SYMBOL_GPL(invalidate_inode_pages2_range);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 29a8fa4d3728..f8c25d500155 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -585,6 +585,12 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_
                goto done;
        }
+        if (la->l2_psm > 0 && btohs(la->l2_psm) < 0x1001 &&
+                                !capable(CAP_NET_BIND_SERVICE)) {
+                err = -EACCES;
+                goto done;
+        }
+                
        write_lock_bh(&l2cap_sk_list.lock);
        if (la->l2_psm && __l2cap_get_sock_by_addr(la->l2_psm, &la->l2_bdaddr)) {
@@ -2150,8 +2156,8 @@ static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
                str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d 0x%x\n",
                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state, pi->psm, pi->scid, pi->dcid, pi->imtu,
+                                sk->sk_state, btohs(pi->psm), pi->scid, pi->dcid,
-                                pi->omtu, pi->link_mode);
+                                pi->imtu, pi->omtu, pi->link_mode);
        }
        read_unlock_bh(&l2cap_sk_list.lock);
diff --git a/net/core/flow.c b/net/core/flow.c
index d137f971f97d..5d25697920b1 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -231,22 +231,16 @@ nocache:
                err = resolver(key, family, dir, &obj, &obj_ref);
-                if (fle) {
+                if (fle && !err) {
-                        if (err) {
+                        fle->genid = atomic_read(&flow_cache_genid);
-                                /* Force security policy check on next lookup */
-                                *head = fle->next;
+                        if (fle->object)
-                                flow_entry_kill(cpu, fle);
+                                atomic_dec(fle->object_ref);
-                        } else {
-                                fle->genid = atomic_read(&flow_cache_genid);
+                        fle->object = obj;
+                        fle->object_ref = obj_ref;
-                                if (fle->object)
+                        if (obj)
-                                        atomic_dec(fle->object_ref);
+                                atomic_inc(fle->object_ref);
-                                fle->object = obj;
-                                fle->object_ref = obj_ref;
-                                if (obj)
-                                        atomic_inc(fle->object_ref);
-                        }
                }
                local_bh_enable();
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 824569659083..3435542e9652 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -124,7 +124,7 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-                err = icsk->icsk_af_ops->queue_xmit(skb, sk, 0);
+                err = icsk->icsk_af_ops->queue_xmit(skb, 0);
                return net_xmit_eval(err);
        }
        return -ENOBUFS;
@@ -396,7 +396,7 @@ int dccp_send_reset(struct sock *sk, enum dccp_reset_codes code)
                                                      code);
                if (skb != NULL) {
                        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-                        err = inet_csk(sk)->icsk_af_ops->queue_xmit(skb, sk, 0);
+                        err = inet_csk(sk)->icsk_af_ops->queue_xmit(skb, 0);
                        return net_xmit_eval(err);
                }
        }
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index fc6f3c023a54..ed083ab455b7 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1145,16 +1145,23 @@ struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
        init_timer(&dn_db->timer);
        dn_db->uptime = jiffies;
+        dn_db->neigh_parms = neigh_parms_alloc(dev, &dn_neigh_table);
+        if (!dn_db->neigh_parms) {
+                dev->dn_ptr = NULL;
+                kfree(dn_db);
+                return NULL;
+        }
        if (dn_db->parms.up) {
                if (dn_db->parms.up(dev) < 0) {
+                        neigh_parms_release(&dn_neigh_table, dn_db->neigh_parms);
                        dev->dn_ptr = NULL;
                        kfree(dn_db);
                        return NULL;
                }
        }
-        dn_db->neigh_parms = neigh_parms_alloc(dev, &dn_neigh_table);
        dn_dev_sysctl_register(dev, &dn_db->parms);
        dn_dev_set_timer(dev);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index cfb249cc0a58..1e589b91605e 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1989,6 +1989,10 @@ static struct node *fib_trie_get_next(struct fib_trie_iter *iter)
        unsigned cindex = iter->index;
        struct tnode *p;
+        /* A single entry routing table */
+        if (!tn)
+                return NULL;
        pr_debug("get_next iter={node=%p index=%d depth=%d}\n",
                 iter->tnode, iter->index, iter->depth);
 rescan:
@@ -2037,11 +2041,18 @@ static struct node *fib_trie_get_first(struct fib_trie_iter *iter,
        if(!iter)
                return NULL;
-        if (n && IS_TNODE(n)) {
+        if (n) {
-                iter->tnode = (struct tnode *) n;
+                if (IS_TNODE(n)) {
-                iter->trie = t;
+                        iter->tnode = (struct tnode *) n;
-                iter->index = 0;
+                        iter->trie = t;
-                iter->depth = 1;
+                        iter->index = 0;
+                        iter->depth = 1;
+                } else {
+                        iter->tnode = NULL;
+                        iter->trie  = t;
+                        iter->index = 0;
+                        iter->depth = 0;
+                }
                return n;
        }
        return NULL;
@@ -2279,16 +2290,17 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
        if (v == SEQ_START_TOKEN)
                return 0;
+        if (!NODE_PARENT(n)) {
+                if (iter->trie == trie_local)
+                        seq_puts(seq, "<local>:\n");
+                else
+                        seq_puts(seq, "<main>:\n");
+        }
        if (IS_TNODE(n)) {
                struct tnode *tn = (struct tnode *) n;
                __be32 prf = htonl(MASK_PFX(tn->key, tn->pos));
-                if (!NODE_PARENT(n)) {
-                        if (iter->trie == trie_local)
-                                seq_puts(seq, "<local>:\n");
-                        else
-                                seq_puts(seq, "<main>:\n");
-                } 
                seq_indent(seq, iter->depth-1);
                seq_printf(seq, "  +-- %d.%d.%d.%d/%d %d %d %d\n",
                           NIPQUAD(prf), tn->pos, tn->bits, tn->full_children, 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f071f84808fa..a0f2008584bc 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -281,8 +281,9 @@ int ip_output(struct sk_buff *skb)
                            !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
-int ip_queue_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok)
+int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
 {
+        struct sock *sk = skb->sk;
        struct inet_sock *inet = inet_sk(sk);
        struct ip_options *opt = inet->opt;
        struct rtable *rt;
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 15e741aeb291..16d177b71bf8 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -4,6 +4,14 @@
 # objects for the standalone - connection tracking / NAT
 ip_conntrack-objs       := ip_conntrack_standalone.o ip_conntrack_core.o ip_conntrack_proto_generic.o ip_conntrack_proto_tcp.o ip_conntrack_proto_udp.o ip_conntrack_proto_icmp.o
+# objects for l3 independent conntrack
+nf_conntrack_ipv4-objs  :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
+ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
+ifeq ($(CONFIG_PROC_FS),y)
+nf_conntrack_ipv4-objs  += nf_conntrack_l3proto_ipv4_compat.o
+endif
+endif
 ip_nat-objs     := ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o ip_nat_proto_udp.o ip_nat_proto_icmp.o
 nf_nat-objs     := nf_nat_core.o nf_nat_helper.o nf_nat_proto_unknown.o nf_nat_proto_tcp.o nf_nat_proto_udp.o nf_nat_proto_icmp.o
 ifneq ($(CONFIG_NF_NAT),)
@@ -20,6 +28,8 @@ ip_nat_h323-objs := ip_nat_helper_h323.o
 # connection tracking
 obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
+obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
 obj-$(CONFIG_IP_NF_NAT) += ip_nat.o
 obj-$(CONFIG_NF_NAT) += nf_nat.o
@@ -106,13 +116,3 @@ obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
 obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
-# objects for l3 independent conntrack
-nf_conntrack_ipv4-objs  :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
-ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
-ifeq ($(CONFIG_PROC_FS),y)
-nf_conntrack_ipv4-objs  += nf_conntrack_l3proto_ipv4_compat.o
-endif
-endif
-# l3 independent conntrack
-obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 5fcf91d617cd..6f31fad9be13 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -959,7 +959,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
        if (cda[CTA_PROTOINFO-1]) {
                err = ctnetlink_change_protoinfo(ct, cda);
                if (err < 0)
-                        return err;
+                        goto err;
        }
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 0ae45b79a4eb..5df4fcae3ab6 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -72,9 +72,9 @@ static void pptp_nat_expected(struct nf_conn *ct,
                DEBUGP("we are PAC->PNS\n");
                /* build tuple for PNS->PAC */
                t.src.l3num = AF_INET;
-                t.src.u3.ip = master->tuplehash[exp->dir].tuple.src.u3.ip;
+                t.src.u3.ip = master->tuplehash[!exp->dir].tuple.src.u3.ip;
                t.src.u.gre.key = nat_pptp_info->pns_call_id;
-                t.dst.u3.ip = master->tuplehash[exp->dir].tuple.dst.u3.ip;
+                t.dst.u3.ip = master->tuplehash[!exp->dir].tuple.dst.u3.ip;
                t.dst.u.gre.key = nat_pptp_info->pac_call_id;
                t.dst.protonum = IPPROTO_GRE;
        }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c701f6abbfc1..c26076fb890e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1011,10 +1011,11 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                        for (j = 0; j < i; j++){
                                if (after(ntohl(sp[j].start_seq),
                                          ntohl(sp[j+1].start_seq))){
-                                        sp[j].start_seq = htonl(tp->recv_sack_cache[j+1].start_seq);
+                                        struct tcp_sack_block_wire tmp;
-                                        sp[j].end_seq = htonl(tp->recv_sack_cache[j+1].end_seq);
-                                        sp[j+1].start_seq = htonl(tp->recv_sack_cache[j].start_seq);
+                                        tmp = sp[j];
-                                        sp[j+1].end_seq = htonl(tp->recv_sack_cache[j].end_seq);
+                                        sp[j] = sp[j+1];
+                                        sp[j+1] = tmp;
                                }
                        }
@@ -4420,9 +4421,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         * But, this leaves one open to an easy denial of
                         * service attack, and SYN cookies can't defend
                         * against this problem. So, we drop the data
-                         * in the interest of security over speed.
+                         * in the interest of security over speed unless
+                         * it's still in use.
                         */
-                        goto discard;
+                        kfree_skb(skb);
+                        return 0;
                }
                goto discard;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 32c1a972fa31..975f4472af29 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -467,6 +467,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        th = (struct tcphdr *) skb_push(skb, tcp_header_size);
        skb->h.th = th;
+        skb_set_owner_w(skb, sk);
        /* Build TCP header and checksum it. */
        th->source              = inet->sport;
@@ -540,7 +541,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
        if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
                TCP_INC_STATS(TCP_MIB_OUTSEGS);
-        err = icsk->icsk_af_ops->queue_xmit(skb, sk, 0);
+        err = icsk->icsk_af_ops->queue_xmit(skb, 0);
        if (likely(err <= 0))
                return err;
@@ -1650,7 +1651,8 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
                memcpy(skb_put(skb, next_skb_size), next_skb->data, next_skb_size);
-                skb->ip_summed = next_skb->ip_summed;
+                if (next_skb->ip_summed == CHECKSUM_PARTIAL)
+                        skb->ip_summed = CHECKSUM_PARTIAL;
                if (skb->ip_summed != CHECKSUM_PARTIAL)
                        skb->csum = csum_block_add(skb->csum, next_skb->csum, skb_size);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index f230eeecf092..41c157848181 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -30,7 +30,7 @@
 #include <net/tcp.h>
-MODULE_AUTHOR("Stephen Hemminger <shemminger@osdl.org>");
+MODULE_AUTHOR("Stephen Hemminger <shemminger@linux-foundation.org>");
 MODULE_DESCRIPTION("TCP cwnd snooper");
 MODULE_LICENSE("GPL");
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 171e5b55d7d6..2a7e4618f526 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -341,6 +341,7 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
 static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 {
        struct inet6_dev *ndev;
+        struct in6_addr maddr;
        ASSERT_RTNL();
@@ -425,6 +426,11 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 #endif
        /* protected by rtnl_lock */
        rcu_assign_pointer(dev->ip6_ptr, ndev);
+        /* Join all-node multicast group */
+        ipv6_addr_all_nodes(&maddr);
+        ipv6_dev_mc_inc(dev, &maddr);
        return ndev;
 }
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index c700302ad51a..116f94a49071 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -139,8 +139,9 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
 EXPORT_SYMBOL_GPL(inet6_csk_addr2sockaddr);
-int inet6_csk_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok)
+int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
 {
+        struct sock *sk = skb->sk;
        struct inet_sock *inet = inet_sk(sk);
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct flowi fl;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index a1c231a04ac2..882cde4b4047 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2258,8 +2258,6 @@ void ipv6_mc_up(struct inet6_dev *idev)
 void ipv6_mc_init_dev(struct inet6_dev *idev)
 {
-        struct in6_addr maddr;
        write_lock_bh(&idev->lock);
        rwlock_init(&idev->mc_lock);
        idev->mc_gq_running = 0;
@@ -2275,10 +2273,6 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
        idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
        idev->mc_v1_seen = 0;
        write_unlock_bh(&idev->lock);
-        /* Add all-nodes address. */
-        ipv6_addr_all_nodes(&maddr);
-        ipv6_dev_mc_inc(idev->dev, &maddr);
 }
 /*
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8c3d56871b50..5f0043c30b70 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2017,6 +2017,7 @@ static inline size_t rt6_nlmsg_size(void)
               + nla_total_size(4) /* RTA_IIF */
               + nla_total_size(4) /* RTA_OIF */
               + nla_total_size(4) /* RTA_PRIORITY */
+               + RTAX_MAX * nla_total_size(4) /* RTA_METRICS */
               + nla_total_size(sizeof(struct rta_cacheinfo));
 }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bd1d2de75e45..811e3e782f0f 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -981,7 +981,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
        if (cda[CTA_PROTOINFO-1]) {
                err = ctnetlink_change_protoinfo(ct, cda);
                if (err < 0)
-                        return err;
+                        goto err;
        }
 #if defined(CONFIG_NF_CONNTRACK_MARK)
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index f0ff00e0d052..c59df3bc2bbd 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -113,7 +113,7 @@ static void pptp_expectfn(struct nf_conn *ct,
        rcu_read_lock();
        nf_nat_pptp_expectfn = rcu_dereference(nf_nat_pptp_hook_expectfn);
-        if (nf_nat_pptp_expectfn && ct->status & IPS_NAT_MASK)
+        if (nf_nat_pptp_expectfn && ct->master->status & IPS_NAT_MASK)
                nf_nat_pptp_expectfn(ct, exp);
        else {
                struct nf_conntrack_tuple inv_t;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index da73e8a8c18d..6dc01bdeb76b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -359,6 +359,10 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
        if (dev == NULL)
                goto out_unlock;
        
+        err = -ENETDOWN;
+        if (!(dev->flags & IFF_UP))
+                goto out_unlock;
        /*
         *      You may not queue a frame bigger than the mtu. This is the lowest level
         *      raw protocol and you must do your own fragmentation at this level.
@@ -407,10 +411,6 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
        if (err)
                goto out_free;
-        err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
-                goto out_free;
        /*
         *      Now send it
         */
@@ -428,24 +428,18 @@ out_unlock:
 }
 #endif
-static inline int run_filter(struct sk_buff *skb, struct sock *sk,
+static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
-                                                        unsigned *snaplen)
+                                      unsigned int res)
 {
        struct sk_filter *filter;
-        int err = 0;
        rcu_read_lock_bh();
        filter = rcu_dereference(sk->sk_filter);
-        if (filter != NULL) {
+        if (filter != NULL)
-                err = sk_run_filter(skb, filter->insns, filter->len);
+                res = sk_run_filter(skb, filter->insns, filter->len);
-                if (!err)
-                        err = -EPERM;
-                else if (*snaplen > err)
-                        *snaplen = err;
-        }
        rcu_read_unlock_bh();
-        return err;
+        return res;
 }
 /*
@@ -467,7 +461,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
        struct packet_sock *po;
        u8 * skb_head = skb->data;
        int skb_len = skb->len;
-        unsigned snaplen;
+        unsigned int snaplen, res;
        if (skb->pkt_type == PACKET_LOOPBACK)
                goto drop;
@@ -495,8 +489,11 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
        snaplen = skb->len;
-        if (run_filter(skb, sk, &snaplen) < 0)
+        res = run_filter(skb, sk, snaplen);
+        if (!res)
                goto drop_n_restore;
+        if (snaplen > res)
+                snaplen = res;
        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
            (unsigned)sk->sk_rcvbuf)
@@ -568,7 +565,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
        struct tpacket_hdr *h;
        u8 * skb_head = skb->data;
        int skb_len = skb->len;
-        unsigned snaplen;
+        unsigned int snaplen, res;
        unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
        unsigned short macoff, netoff;
        struct sk_buff *copy_skb = NULL;
@@ -592,8 +589,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
        snaplen = skb->len;
-        if (run_filter(skb, sk, &snaplen) < 0)
+        res = run_filter(skb, sk, snaplen);
+        if (!res)
                goto drop_n_restore;
+        if (snaplen > res)
+                snaplen = res;
        if (sk->sk_type == SOCK_DGRAM) {
                macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
@@ -738,6 +738,10 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
        if (sock->type == SOCK_RAW)
                reserve = dev->hard_header_len;
+        err = -ENETDOWN;
+        if (!(dev->flags & IFF_UP))
+                goto out_unlock;
        err = -EMSGSIZE;
        if (len > dev->mtu+reserve)
                goto out_unlock;
@@ -770,10 +774,6 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
        skb->dev = dev;
        skb->priority = sk->sk_priority;
-        err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
-                goto out_free;
        /*
         *      Now send it
         */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 225f39b5d595..0ef48126b117 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -804,7 +804,7 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
                          NIPQUAD(((struct rtable *)skb->dst)->rt_dst));
        SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
-        return ip_queue_xmit(skb, skb->sk, ipfragok);
+        return ip_queue_xmit(skb, ipfragok);
 }
 static struct sctp_af sctp_ipv4_specific;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 167d888d1df2..0b1ddb1005ac 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1562,7 +1562,7 @@ static int sctp_process_missing_param(const struct sctp_association *asoc,
        if (*errp) {
                report.num_missing = htonl(1);
                report.type = paramtype;
-                sctp_init_cause(*errp, SCTP_ERROR_INV_PARAM,
+                sctp_init_cause(*errp, SCTP_ERROR_MISS_PARAM,
                                &report, sizeof(report));
        }
@@ -1775,7 +1775,9 @@ int sctp_verify_init(const struct sctp_association *asoc,
        /* Verify stream values are non-zero. */
        if ((0 == peer_init->init_hdr.num_outbound_streams) ||
-            (0 == peer_init->init_hdr.num_inbound_streams)) {
+            (0 == peer_init->init_hdr.num_inbound_streams) ||
+            (0 == peer_init->init_hdr.init_tag) ||
+            (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
                sctp_process_inv_mandatory(asoc, chunk, errp);
                return 0;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 7bbc6156e455..8bd30976cdee 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -217,7 +217,7 @@ static int sctp_gen_sack(struct sctp_association *asoc, int force,
                asoc->peer.sack_needed = 0;
-                error = sctp_outq_tail(&asoc->outqueue, sack);
+                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(sack));
                /* Stop the SACK timer.  */
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index aa51d190bfb2..fbbc9e6a3b78 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -440,7 +440,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
 {
        struct sctp_chunk *chunk = arg;
        sctp_init_chunk_t *initchunk;
-        __u32 init_tag;
        struct sctp_chunk *err_chunk;
        struct sctp_packet *packet;
        sctp_error_t error;
@@ -462,24 +461,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
        /* Grab the INIT header.  */
        chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
-        init_tag = ntohl(chunk->subh.init_hdr->init_tag);
-        /* Verification Tag: 3.3.3
-         *   If the value of the Initiate Tag in a received INIT ACK
-         *   chunk is found to be 0, the receiver MUST treat it as an
-         *   error and close the association by transmitting an ABORT.
-         */
-        if (!init_tag) {
-                struct sctp_chunk *reply = sctp_make_abort(asoc, chunk, 0);
-                if (!reply)
-                        goto nomem;
-                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
-                return sctp_stop_t1_and_abort(commands, SCTP_ERROR_INV_PARAM,
-                                              ECONNREFUSED, asoc,
-                                              chunk->transport);
-        }
        /* Verify the INIT chunk before processing it. */
        err_chunk = NULL;
        if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
@@ -550,9 +531,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                        SCTP_CHUNK(err_chunk));
        return SCTP_DISPOSITION_CONSUME;
-nomem:
-        return SCTP_DISPOSITION_NOMEM;
 }
 /*
@@ -1553,6 +1531,28 @@ sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
 }
+/*
+ * Unexpected INIT-ACK handler.
+ *
+ * Section 5.2.3
+ * If an INIT ACK received by an endpoint in any state other than the
+ * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
+ * An unexpected INIT ACK usually indicates the processing of an old or
+ * duplicated INIT chunk.
+*/
+sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
+                                            const struct sctp_association *asoc,
+                                            const sctp_subtype_t type,
+                                            void *arg, sctp_cmd_seq_t *commands)
+{
+        /* Per the above section, we'll discard the chunk if we have an
+         * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
+         */
+        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
+                return sctp_sf_ootb(ep, asoc, type, arg, commands);
+        else
+                return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
+}
 /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
 *
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 733dd87b3a7d..5f6cc7aa661b 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -152,7 +152,7 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
        /* SCTP_STATE_EMPTY */ \
        TYPE_SCTP_FUNC(sctp_sf_ootb), \
        /* SCTP_STATE_CLOSED */ \
-        TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
+        TYPE_SCTP_FUNC(sctp_sf_do_5_2_3_initack), \
        /* SCTP_STATE_COOKIE_WAIT */ \
        TYPE_SCTP_FUNC(sctp_sf_do_5_1C_ack), \
        /* SCTP_STATE_COOKIE_ECHOED */ \
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index aba528b9ae76..16c9fbc1db69 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -490,16 +490,14 @@ int rpc_call_sync(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
        /* Set up the call info struct and execute the task */
        status = task->tk_status;
-        if (status != 0) {
+        if (status != 0)
-                rpc_release_task(task);
                goto out;
-        }
        atomic_inc(&task->tk_count);
        status = rpc_execute(task);
        if (status == 0)
                status = task->tk_status;
-        rpc_put_task(task);
 out:
+        rpc_put_task(task);
        rpc_restore_sigmask(&oldset);
        return status;
 }
@@ -537,7 +535,7 @@ rpc_call_async(struct rpc_clnt *clnt, struct rpc_message *msg, int flags,
        if (status == 0)
                rpc_execute(task);
        else
-                rpc_release_task(task);
+                rpc_put_task(task);
        rpc_restore_sigmask(&oldset);           
        return status;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 79bc4cdf5d48..fc083f0b3544 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -42,6 +42,7 @@ static mempool_t	*rpc_buffer_mempool __read_mostly;
 static void                     __rpc_default_timer(struct rpc_task *task);
 static void                     rpciod_killall(void);
 static void                     rpc_async_schedule(struct work_struct *);
+static void                      rpc_release_task(struct rpc_task *task);
 /*
 * RPC tasks sit here while waiting for conditions to improve.
@@ -896,7 +897,7 @@ void rpc_put_task(struct rpc_task *task)
 }
 EXPORT_SYMBOL(rpc_put_task);
-void rpc_release_task(struct rpc_task *task)
+static void rpc_release_task(struct rpc_task *task)
 {
 #ifdef RPC_DEBUG
        BUG_ON(task->tk_magic != RPC_TASK_MAGIC_ID);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index f3001f3626f6..bf21a2047010 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -910,7 +910,8 @@ err_bad_prog:
 err_bad_vers:
 #ifdef RPC_PARANOIA
-        printk("svc: unknown version (%d)\n", vers);
+        printk("svc: unknown version (%d for prog %d, %s)\n",
+               vers, prog, progp->pg_name);
 #endif
        serv->sv_stats->rpcbadfmt++;
        svc_putnl(resv, RPC_PROG_MISMATCH);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 99f54fb6d669..45120f268d03 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1278,6 +1278,8 @@ svc_recv(struct svc_rqst *rqstp, long timeout)
                                schedule_timeout_uninterruptible(msecs_to_jiffies(500));
                        rqstp->rq_pages[i] = p;
                }
+        rqstp->rq_pages[i++] = NULL; /* this might be seen in nfs_read_actor */
+        BUG_ON(pages >= RPCSVC_MAXPAGES);
        /* Make arg->head point to first page and arg->pages point to rest */
        arg = &rqstp->rq_arg;
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 47b68a301677..328d80f000ad 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -56,6 +56,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
                        sk_add_backlog(sk, skb);
                }
                bh_unlock_sock(sk);
+                sock_put(sk);
                return queued;
        }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index bebd40e5a62e..b7e537fe2d75 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -650,19 +650,18 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
        struct xfrm_policy *pol;
        struct xfrm_policy *delpol;
        struct hlist_head *chain;
-        struct hlist_node *entry, *newpos, *last;
+        struct hlist_node *entry, *newpos;
        struct dst_entry *gc_list;
        write_lock_bh(&xfrm_policy_lock);
        chain = policy_hash_bysel(&policy->selector, policy->family, dir);
        delpol = NULL;
        newpos = NULL;
-        last = NULL;
        hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (!delpol &&
+                if (pol->type == policy->type &&
-                    pol->type == policy->type &&
                    !selector_cmp(&pol->selector, &policy->selector) &&
-                    xfrm_sec_ctx_match(pol->security, policy->security)) {
+                    xfrm_sec_ctx_match(pol->security, policy->security) &&
+                    !WARN_ON(delpol)) {
                        if (excl) {
                                write_unlock_bh(&xfrm_policy_lock);
                                return -EEXIST;
@@ -671,17 +670,12 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                        if (policy->priority > pol->priority)
                                continue;
                } else if (policy->priority >= pol->priority) {
-                        last = &pol->bydst;
+                        newpos = &pol->bydst;
                        continue;
                }
-                if (!newpos)
-                        newpos = &pol->bydst;
                if (delpol)
                        break;
-                last = &pol->bydst;
        }
-        if (!newpos)
-                newpos = last;
        if (newpos)
                hlist_add_after(newpos, &policy->bydst);
        else
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 161eb571c82d..31929e39f5ca 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -37,6 +37,11 @@ int selinux_xfrm_sock_rcv_skb(u32 sid, struct sk_buff *skb,
 int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
                        struct avc_audit_data *ad, u8 proto);
 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
+static inline void selinux_xfrm_notify_policyload(void)
+{
+        atomic_inc(&flow_cache_genid);
+}
 #else
 static inline int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
                        struct avc_audit_data *ad)
@@ -55,6 +60,10 @@ static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int
        *sid = SECSID_NULL;
        return 0;
 }
+static inline void selinux_xfrm_notify_policyload(void)
+{
+}
 #endif
 static inline void selinux_skb_xfrm_sid(struct sk_buff *skb, u32 *sid)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 3eb1fa9f0de1..ca9154dc5d82 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1299,6 +1299,7 @@ int security_load_policy(void *data, size_t len)
                avc_ss_reset(seqno);
                selnl_notify_policyload(seqno);
                selinux_netlbl_cache_invalidate();
+                selinux_xfrm_notify_policyload();
                return 0;
        }
@@ -1354,6 +1355,7 @@ int security_load_policy(void *data, size_t len)
        avc_ss_reset(seqno);
        selnl_notify_policyload(seqno);
        selinux_netlbl_cache_invalidate();
+        selinux_xfrm_notify_policyload();
        return 0;
@@ -1853,6 +1855,7 @@ out:
        if (!rc) {
                avc_ss_reset(seqno);
                selnl_notify_policyload(seqno);
+                selinux_xfrm_notify_policyload();
        }
        return rc;
 }
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 367f8a32a665..0a352e46862f 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -322,7 +322,7 @@ static void i_usX2Y_urb_complete(struct urb *urb)
                usX2Y_error_urb_status(usX2Y, subs, urb);
                return;
        }
-        if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
                subs->completed_urb = urb;
        else {
                usX2Y_error_sequence(usX2Y, subs, urb);
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index 8f3e35e24e72..a5e7bcd7ca2e 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -243,7 +243,7 @@ static void i_usX2Y_usbpcm_urb_complete(struct urb *urb)
                usX2Y_error_urb_status(usX2Y, subs, urb);
                return;
        }
-        if (likely(urb->start_frame == usX2Y->wait_iso_frame))
+        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
                subs->completed_urb = urb;
        else {
                usX2Y_error_sequence(usX2Y, subs, urb);