32 files changed, 205 insertions, 112 deletions

diff --git a/arch/avr32/boards/atstk1000/setup.c b/arch/avr32/boards/atstk1000/setup.c
index 191ab85de9a3..272c011802a7 100644
--- a/arch/avr32/boards/atstk1000/setup.c
+++ b/arch/avr32/boards/atstk1000/setup.c
@@ -21,15 +21,6 @@ struct tag *bootloader_tags __initdata;
 
 struct lcdc_platform_data __initdata atstk1000_fb0_data;
 
-asmlinkage void __init board_early_init(void)
-{
-        extern void sdram_init(void);
-
-#ifdef CONFIG_LOADER_STANDALONE
-        sdram_init();
-#endif
-}
-
 void __init board_setup_fbmem(unsigned long fbmem_start,
                               unsigned long fbmem_size)
 {
diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S
index 773b7ad87be9..6163bd0acb95 100644
--- a/arch/avr32/kernel/head.S
+++ b/arch/avr32/kernel/head.S
@@ -30,9 +30,6 @@ kernel_entry:
         mov     r7, 0
 #endif
 
-        /* Set up the PIO, SDRAM controller, early printk, etc. */
-        rcall   board_early_init
-
         /* Start the show */
         lddpc   pc, kernel_start_addr
 
diff --git a/arch/avr32/kernel/syscall-stubs.S b/arch/avr32/kernel/syscall-stubs.S
index 7589a9b426cb..890286a1e62b 100644
--- a/arch/avr32/kernel/syscall-stubs.S
+++ b/arch/avr32/kernel/syscall-stubs.S
@@ -100,3 +100,12 @@ __sys_splice:
         rcall   sys_splice
         sub     sp, -4
         popm    pc
+
+        .global __sys_epoll_pwait
+        .type   __sys_epoll_pwait,@function
+__sys_epoll_pwait:
+        pushm   lr
+        st.w    --sp, ARG6
+        rcall   sys_epoll_pwait
+        sub     sp, -4
+        popm    pc
diff --git a/arch/avr32/kernel/syscall_table.S b/arch/avr32/kernel/syscall_table.S
index 63b206965d05..db8f8b55ffdf 100644
--- a/arch/avr32/kernel/syscall_table.S
+++ b/arch/avr32/kernel/syscall_table.S
@@ -286,4 +286,5 @@ sys_call_table:
         .long   sys_sync_file_range
         .long   sys_tee
         .long   sys_vmsplice
+        .long   __sys_epoll_pwait       /* 265 */
         .long   sys_ni_syscall          /* r8 is saturated at nr_syscalls */
diff --git a/arch/avr32/lib/findbit.S b/arch/avr32/lib/findbit.S
index 2b4856f4bf7c..c6b91dee857c 100644
--- a/arch/avr32/lib/findbit.S
+++ b/arch/avr32/lib/findbit.S
@@ -136,6 +136,7 @@ ENTRY(generic_find_next_zero_le_bit)
         /* offset is not word-aligned. Handle the first (32 - r10) bits */
         ldswp.w r8, r12[0]
         sub     r12, -4
+        com     r8
         lsr     r8, r8, r10
         brne    .L_found
 
@@ -146,7 +147,7 @@ ENTRY(generic_find_next_zero_le_bit)
 
         /* Main loop. offset must be word-aligned */
 1:      ldswp.w r8, r12[0]
-        cp.w    r8, 0
+        com     r8
         brne    .L_found
         sub     r12, -4
         sub     r9, 32
diff --git a/arch/avr32/lib/io-readsb.S b/arch/avr32/lib/io-readsb.S
index b319d5e71749..2be5da7ed26b 100644
--- a/arch/avr32/lib/io-readsb.S
+++ b/arch/avr32/lib/io-readsb.S
@@ -45,3 +45,5 @@ __raw_readsb:
         sub     r10, 1
         st.b    r11++, r8
         brne    3b
+
+        retal   r12
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 608193cfe43f..245b81bc7157 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -236,9 +236,6 @@ config WARN_STACK_SIZE
           This allows you to specify the maximum frame size a function may
           have without the compiler complaining about it.
 
-config ARCH_POPULATES_NODE_MAP
-        def_bool y
-
 source "mm/Kconfig"
 
 comment "I/O subsystem configuration"
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index c313e9a9304f..7cd51e73e274 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -119,7 +119,6 @@ CONFIG_PACK_STACK=y
 CONFIG_CHECK_STACK=y
 CONFIG_STACK_GUARD=256
 # CONFIG_WARN_STACK is not set
-CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
 # CONFIG_DISCONTIGMEM_MANUAL is not set
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 49f2b68e32b1..2aa13e8e000a 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -70,6 +70,7 @@ struct {
 #define CHUNK_READ_WRITE 0
 #define CHUNK_READ_ONLY 1
 volatile int __cpu_logical_map[NR_CPUS]; /* logical cpu to cpu address */
+unsigned long __initdata zholes_size[MAX_NR_ZONES];
 static unsigned long __initdata memory_end;
 
 /*
@@ -357,6 +358,21 @@ void machine_power_off(void)
  */
 void (*pm_power_off)(void) = machine_power_off;
 
+static void __init
+add_memory_hole(unsigned long start, unsigned long end)
+{
+        unsigned long dma_pfn = MAX_DMA_ADDRESS >> PAGE_SHIFT;
+
+        if (end <= dma_pfn)
+                zholes_size[ZONE_DMA] += end - start + 1;
+        else if (start > dma_pfn)
+                zholes_size[ZONE_NORMAL] += end - start + 1;
+        else {
+                zholes_size[ZONE_DMA] += dma_pfn - start + 1;
+                zholes_size[ZONE_NORMAL] += end - dma_pfn;
+        }
+}
+
 static int __init early_parse_mem(char *p)
 {
         memory_end = memparse(p, &p);
@@ -434,7 +450,7 @@ setup_lowcore(void)
                 lc->extended_save_area_addr = (__u32)
                         __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, 0);
                 /* enable extended save area */
-                ctl_set_bit(14, 29);
+                __ctl_set_bit(14, 29);
         }
 #endif
         set_prefix((u32)(unsigned long) lc);
@@ -478,6 +494,7 @@ setup_memory(void)
 {
         unsigned long bootmap_size;
         unsigned long start_pfn, end_pfn, init_pfn;
+        unsigned long last_rw_end;
         int i;
 
         /*
@@ -533,27 +550,39 @@ setup_memory(void)
         /*
          * Register RAM areas with the bootmem allocator.
          */
+        last_rw_end = start_pfn;
 
         for (i = 0; i < MEMORY_CHUNKS && memory_chunk[i].size > 0; i++) {
-                unsigned long start_chunk, end_chunk, pfn;
+                unsigned long start_chunk, end_chunk;
 
                 if (memory_chunk[i].type != CHUNK_READ_WRITE)
                         continue;
-                start_chunk = PFN_DOWN(memory_chunk[i].addr);
-                end_chunk = start_chunk + PFN_DOWN(memory_chunk[i].size) - 1;
-                end_chunk = min(end_chunk, end_pfn);
-                if (start_chunk >= end_chunk)
-                        continue;
-                add_active_range(0, start_chunk, end_chunk);
-                pfn = max(start_chunk, start_pfn);
-                for (; pfn <= end_chunk; pfn++)
-                        page_set_storage_key(PFN_PHYS(pfn), PAGE_DEFAULT_KEY);
+                start_chunk = (memory_chunk[i].addr + PAGE_SIZE - 1);
+                start_chunk >>= PAGE_SHIFT;
+                end_chunk = (memory_chunk[i].addr + memory_chunk[i].size);
+                end_chunk >>= PAGE_SHIFT;
+                if (start_chunk < start_pfn)
+                        start_chunk = start_pfn;
+                if (end_chunk > end_pfn)
+                        end_chunk = end_pfn;
+                if (start_chunk < end_chunk) {
+                        /* Initialize storage key for RAM pages */
+                        for (init_pfn = start_chunk ; init_pfn < end_chunk;
+                             init_pfn++)
+                                page_set_storage_key(init_pfn << PAGE_SHIFT,
+                                                     PAGE_DEFAULT_KEY);
+                        free_bootmem(start_chunk << PAGE_SHIFT,
+                                     (end_chunk - start_chunk) << PAGE_SHIFT);
+                        if (last_rw_end < start_chunk)
+                                add_memory_hole(last_rw_end, start_chunk - 1);
+                        last_rw_end = end_chunk;
+                }
         }
 
         psw_set_key(PAGE_DEFAULT_KEY);
 
-        free_bootmem_with_active_regions(0, max_pfn);
-        reserve_bootmem(0, PFN_PHYS(start_pfn));
+        if (last_rw_end < end_pfn - 1)
+                add_memory_hole(last_rw_end, end_pfn - 1);
 
         /*
          * Reserve the bootmem bitmap itself as well. We do this in two
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index d99891718709..e1881c31b1cb 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -84,6 +84,7 @@ void show_mem(void)
         printk("%d pages swap cached\n",cached);
 }
 
+extern unsigned long __initdata zholes_size[];
 /*
  * paging_init() sets up the page tables
  */
@@ -100,15 +101,16 @@ void __init paging_init(void)
         unsigned long pgdir_k = (__pa(swapper_pg_dir) & PAGE_MASK) | _KERNSEG_TABLE;
         static const int ssm_mask = 0x04000000L;
         unsigned long ro_start_pfn, ro_end_pfn;
-        unsigned long max_zone_pfns[MAX_NR_ZONES];
+        unsigned long zones_size[MAX_NR_ZONES];
 
         ro_start_pfn = PFN_DOWN((unsigned long)&__start_rodata);
         ro_end_pfn = PFN_UP((unsigned long)&__end_rodata);
 
-        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
-        max_zone_pfns[ZONE_DMA] = max_low_pfn;
-        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
-        free_area_init_nodes(max_zone_pfns);
+        memset(zones_size, 0, sizeof(zones_size));
+        zones_size[ZONE_DMA] = max_low_pfn;
+        free_area_init_node(0, &contig_page_data, zones_size,
+                            __pa(PAGE_OFFSET) >> PAGE_SHIFT,
+                            zholes_size);
 
         /* unmap whole virtual address space */
         
@@ -168,16 +170,26 @@ void __init paging_init(void)
         unsigned long pgdir_k = (__pa(swapper_pg_dir) & PAGE_MASK) |
           _KERN_REGION_TABLE;
         static const int ssm_mask = 0x04000000L;
+        unsigned long zones_size[MAX_NR_ZONES];
+        unsigned long dma_pfn, high_pfn;
         unsigned long ro_start_pfn, ro_end_pfn;
-        unsigned long max_zone_pfns[MAX_NR_ZONES];
 
+        memset(zones_size, 0, sizeof(zones_size));
+        dma_pfn = MAX_DMA_ADDRESS >> PAGE_SHIFT;
+        high_pfn = max_low_pfn;
         ro_start_pfn = PFN_DOWN((unsigned long)&__start_rodata);
         ro_end_pfn = PFN_UP((unsigned long)&__end_rodata);
 
-        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
-        max_zone_pfns[ZONE_DMA] = PFN_DOWN(MAX_DMA_ADDRESS);
-        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
-        free_area_init_nodes(max_zone_pfns);
+        if (dma_pfn > high_pfn)
+                zones_size[ZONE_DMA] = high_pfn;
+        else {
+                zones_size[ZONE_DMA] = dma_pfn;
+                zones_size[ZONE_NORMAL] = high_pfn - dma_pfn;
+        }
+
+        /* Initialize mem_map[].  */
+        free_area_init_node(0, &contig_page_data, zones_size,
+                            __pa(PAGE_OFFSET) >> PAGE_SHIFT, zholes_size);
 
         /*
          * map whole physical memory to virtual memory (identity mapping) 
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index d8d256dadddf..5800beeebb85 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -616,7 +616,7 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         } else if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                 skb_reserve(bcs->skb, HW_HDR_LEN);
         else {
-                gig_dbg(DEBUG_INIT, "could not allocate skb\n");
+                warn("could not allocate skb\n");
                 bcs->inputstate |= INS_skip_frame;
         }
 
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 46a9c35943bd..db9d7df75ae0 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -157,8 +157,8 @@ void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
 
 struct scan_control;
 
-unsigned long jp_shrink_page_list(struct list_head *page_list,
-                                        struct scan_control *sc)
+unsigned long jp_shrink_inactive_list(unsigned long max_scan,
+                                struct zone *zone, struct scan_control *sc)
 {
         lkdtm_handler();
         jprobe_return();
@@ -297,8 +297,8 @@ int lkdtm_module_init(void)
                 lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
                 break;
         case MEM_SWAPOUT:
-                lkdtm.kp.symbol_name = "shrink_page_list";
-                lkdtm.entry = (kprobe_opcode_t*) jp_shrink_page_list;
+                lkdtm.kp.symbol_name = "shrink_inactive_list";
+                lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
                 break;
         case TIMERADD:
                 lkdtm.kp.symbol_name = "hrtimer_start";
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 28c17d1ca5cb..9cb3ca5806fc 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -486,7 +486,7 @@ config SGI_IOC3_ETH_HW_TX_CSUM
 
 config MIPS_SIM_NET
         tristate "MIPS simulator Network device (EXPERIMENTAL)"
-        depends on NETDEVICES && MIPS_SIM && EXPERIMENTAL
+        depends on MIPS_SIM && EXPERIMENTAL
         help
           The MIPSNET device is a simple Ethernet network device which is
           emulated by the MIPS Simulator.
@@ -2467,7 +2467,7 @@ config ISERIES_VETH
 
 config RIONET
         tristate "RapidIO Ethernet over messaging driver support"
-        depends on NETDEVICES && RAPIDIO
+        depends on RAPIDIO
 
 config RIONET_TX_SIZE
         int "Number of outbound queue entries"
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index b40724fc6b74..39ad9f73d1ec 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -39,7 +39,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0034"
+#define DRV_VERSION     "EHEA_0043"
 
 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
         | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
@@ -105,9 +105,6 @@
 #define EHEA_BCMC_VLANID_ALL    0x01
 #define EHEA_BCMC_VLANID_SINGLE 0x00
 
-/* Use this define to kmallocate pHYP control blocks */
-#define H_CB_ALIGNMENT          4096
-
 #define EHEA_CACHE_LINE          128
 
 /* Memory Regions */
diff --git a/drivers/net/ehea/ehea_ethtool.c b/drivers/net/ehea/ehea_ethtool.c
index 82eb2fb8c75e..9f57c2e78ced 100644
--- a/drivers/net/ehea/ehea_ethtool.c
+++ b/drivers/net/ehea/ehea_ethtool.c
@@ -238,7 +238,7 @@ static void ehea_get_ethtool_stats(struct net_device *dev,
         data[i++] = port->port_res[0].swqe_refill_th;
         data[i++] = port->resets;
 
-        cb6 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb6 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb6) {
                 ehea_error("no mem for cb6");
                 return;
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 4538c99733fd..6ad696101418 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -92,7 +92,7 @@ static struct net_device_stats *ehea_get_stats(struct net_device *dev)
 
         memset(stats, 0, sizeof(*stats));
 
-        cb2 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb2 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb2) {
                 ehea_error("no mem for cb2");
                 goto out;
@@ -586,8 +586,8 @@ int ehea_sense_port_attr(struct ehea_port *port)
         u64 hret;
         struct hcp_ehea_port_cb0 *cb0;
 
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_ATOMIC);   /* May be called via */
-        if (!cb0) {                                  /* ehea_neq_tasklet() */
+        cb0 = kzalloc(PAGE_SIZE, GFP_ATOMIC);   /* May be called via */
+        if (!cb0) {                             /* ehea_neq_tasklet() */
                 ehea_error("no mem for cb0");
                 ret = -ENOMEM;
                 goto out;
@@ -670,7 +670,7 @@ int ehea_set_portspeed(struct ehea_port *port, u32 port_speed)
         u64 hret;
         int ret = 0;
 
-        cb4 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb4 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb4) {
                 ehea_error("no mem for cb4");
                 ret = -ENOMEM;
@@ -985,7 +985,7 @@ static int ehea_configure_port(struct ehea_port *port)
         struct hcp_ehea_port_cb0 *cb0;
 
         ret = -ENOMEM;
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb0 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb0)
                 goto out;
 
@@ -1443,7 +1443,7 @@ static int ehea_set_mac_addr(struct net_device *dev, void *sa)
                 goto out;
         }
 
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb0 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb0) {
                 ehea_error("no mem for cb0");
                 ret = -ENOMEM;
@@ -1501,7 +1501,7 @@ static void ehea_promiscuous(struct net_device *dev, int enable)
         if ((enable && port->promisc) || (!enable && !port->promisc))
                 return;
 
-        cb7 = kzalloc(H_CB_ALIGNMENT, GFP_ATOMIC);
+        cb7 = kzalloc(PAGE_SIZE, GFP_ATOMIC);
         if (!cb7) {
                 ehea_error("no mem for cb7");
                 goto out;
@@ -1870,7 +1870,7 @@ static void ehea_vlan_rx_register(struct net_device *dev,
 
         port->vgrp = grp;
 
-        cb1 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb1) {
                 ehea_error("no mem for cb1");
                 goto out;
@@ -1899,7 +1899,7 @@ static void ehea_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
         int index;
         u64 hret;
 
-        cb1 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb1) {
                 ehea_error("no mem for cb1");
                 goto out;
@@ -1935,7 +1935,7 @@ static void ehea_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
         if (port->vgrp)
                 port->vgrp->vlan_devices[vid] = NULL;
 
-        cb1 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb1) {
                 ehea_error("no mem for cb1");
                 goto out;
@@ -1968,7 +1968,7 @@ int ehea_activate_qp(struct ehea_adapter *adapter, struct ehea_qp *qp)
         u64 dummy64 = 0;
         struct hcp_modify_qp_cb0* cb0;
 
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb0 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb0) {
                 ret = -ENOMEM;
                 goto out;
@@ -2269,7 +2269,7 @@ int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
         u64 hret;
         int ret;
 
-        cb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb) {
                 ret = -ENOMEM;
                 goto out;
@@ -2340,7 +2340,7 @@ static int ehea_setup_single_port(struct ehea_port *port,
                 goto out;
 
         /* Enable Jumbo frames */
-        cb4 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb4 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb4) {
                 ehea_error("no mem for cb4");
         } else {
diff --git a/drivers/net/ehea/ehea_phyp.c b/drivers/net/ehea/ehea_phyp.c
index 0b51a8cea077..0cfc2bc1a27b 100644
--- a/drivers/net/ehea/ehea_phyp.c
+++ b/drivers/net/ehea/ehea_phyp.c
@@ -506,7 +506,7 @@ u64 ehea_h_register_rpage_mr(const u64 adapter_handle, const u64 mr_handle,
                              const u8 pagesize, const u8 queue_type,
                              const u64 log_pageaddr, const u64 count)
 {
-        if ((count > 1) && (log_pageaddr & 0xfff)) {
+        if ((count > 1) && (log_pageaddr & ~PAGE_MASK)) {
                 ehea_error("not on pageboundary");
                 return H_PARAMETER;
         }
diff --git a/drivers/net/ehea/ehea_phyp.h b/drivers/net/ehea/ehea_phyp.h
index fa51e3b5bb05..919f94b75933 100644
--- a/drivers/net/ehea/ehea_phyp.h
+++ b/drivers/net/ehea/ehea_phyp.h
@@ -81,14 +81,16 @@ static inline u32 get_longbusy_msecs(int long_busy_ret_code)
 static inline void hcp_epas_ctor(struct h_epas *epas, u64 paddr_kernel,
                                  u64 paddr_user)
 {
-        epas->kernel.addr = ioremap(paddr_kernel, PAGE_SIZE);
+        /* To support 64k pages we must round to 64k page boundary */
+        epas->kernel.addr = ioremap((paddr_kernel & PAGE_MASK), PAGE_SIZE) +
+                            (paddr_kernel & ~PAGE_MASK);
         epas->user.addr = paddr_user;
 }
 
 static inline void hcp_epas_dtor(struct h_epas *epas)
 {
         if (epas->kernel.addr)
-                iounmap(epas->kernel.addr);
+                iounmap((void __iomem*)((u64)epas->kernel.addr & PAGE_MASK));
 
         epas->user.addr = 0;
         epas->kernel.addr = 0;
diff --git a/drivers/net/ehea/ehea_qmr.c b/drivers/net/ehea/ehea_qmr.c
index 3e1862326c88..72ef7bde3346 100644
--- a/drivers/net/ehea/ehea_qmr.c
+++ b/drivers/net/ehea/ehea_qmr.c
@@ -209,11 +209,11 @@ int ehea_destroy_cq(struct ehea_cq *cq)
 {
         u64 adapter_handle, hret;
 
-        adapter_handle = cq->adapter->handle;
-
         if (!cq)
                 return 0;
 
+        adapter_handle = cq->adapter->handle;
+
         /* deregister all previous registered pages */
         hret = ehea_h_free_resource(adapter_handle, cq->fw_handle);
         if (hret != H_SUCCESS) {
@@ -512,7 +512,7 @@ int ehea_reg_mr_adapter(struct ehea_adapter *adapter)
 
         start = KERNELBASE;
         end = (u64)high_memory;
-        nr_pages = (end - start) / PAGE_SIZE;
+        nr_pages = (end - start) / EHEA_PAGESIZE;
 
         pt =  kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!pt) {
@@ -538,9 +538,9 @@ int ehea_reg_mr_adapter(struct ehea_adapter *adapter)
                 if (nr_pages > 1) {
                         u64 num_pages = min(nr_pages, (u64)512);
                         for (i = 0; i < num_pages; i++)
-                                pt[i] = virt_to_abs((void*)(((u64)start)
-                                                             + ((k++) *
-                                                                PAGE_SIZE)));
+                                pt[i] = virt_to_abs((void*)(((u64)start) +
+                                                            ((k++) *
+                                                             EHEA_PAGESIZE)));
 
                         hret = ehea_h_register_rpage_mr(adapter->handle,
                                                         adapter->mr.handle, 0,
@@ -548,8 +548,9 @@ int ehea_reg_mr_adapter(struct ehea_adapter *adapter)
                                                         num_pages);
                         nr_pages -= num_pages;
                 } else {
-                        u64 abs_adr = virt_to_abs((void*)(((u64)start)
-                                                           + (k * PAGE_SIZE)));
+                        u64 abs_adr = virt_to_abs((void*)(((u64)start) +
+                                                          (k * EHEA_PAGESIZE)));
+
                         hret = ehea_h_register_rpage_mr(adapter->handle,
                                                         adapter->mr.handle, 0,
                                                         0, abs_adr,1);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_leds.c b/drivers/net/wireless/bcm43xx/bcm43xx_leds.c
index 2ddbec6bf15b..7d383a27b927 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_leds.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_leds.c
@@ -189,20 +189,24 @@ void bcm43xx_leds_update(struct bcm43xx_private *bcm, int activity)
                 case BCM43xx_LED_INACTIVE:
                         continue;
                 case BCM43xx_LED_OFF:
+                case BCM43xx_LED_BCM4303_3:
                         break;
                 case BCM43xx_LED_ON:
                         turn_on = 1;
                         break;
                 case BCM43xx_LED_ACTIVITY:
+                case BCM43xx_LED_BCM4303_0:
                         turn_on = activity;
                         break;
                 case BCM43xx_LED_RADIO_ALL:
                         turn_on = radio->enabled;
                         break;
                 case BCM43xx_LED_RADIO_A:
+                case BCM43xx_LED_BCM4303_2:
                         turn_on = (radio->enabled && phy->type == BCM43xx_PHYTYPE_A);
                         break;
                 case BCM43xx_LED_RADIO_B:
+                case BCM43xx_LED_BCM4303_1:
                         turn_on = (radio->enabled &&
                                    (phy->type == BCM43xx_PHYTYPE_B ||
                                     phy->type == BCM43xx_PHYTYPE_G));
@@ -257,7 +261,8 @@ void bcm43xx_leds_update(struct bcm43xx_private *bcm, int activity)
                         continue;
 #endif /* CONFIG_BCM43XX_DEBUG */
                 default:
-                        assert(0);
+                        dprintkl(KERN_INFO PFX "Bad value in leds_update,"
+                                " led->behaviour: 0x%x\n", led->behaviour);
                 };
 
                 if (led->activelow)
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_leds.h b/drivers/net/wireless/bcm43xx/bcm43xx_leds.h
index d3716cf3aebc..811e14a81198 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_leds.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_leds.h
@@ -46,6 +46,12 @@ enum { /* LED behaviour values */
         BCM43xx_LED_TEST_BLINKSLOW,
         BCM43xx_LED_TEST_BLINKMEDIUM,
         BCM43xx_LED_TEST_BLINKFAST,
+
+        /* Misc values for BCM4303 */
+        BCM43xx_LED_BCM4303_0 = 0x2B,
+        BCM43xx_LED_BCM4303_1 = 0x78,
+        BCM43xx_LED_BCM4303_2 = 0x2E,
+        BCM43xx_LED_BCM4303_3 = 0x19,
 };
 
 int bcm43xx_leds_init(struct bcm43xx_private *bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index a94c6d8826f8..65edb56107fd 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -3163,9 +3163,11 @@ static int estimate_periodic_work_badness(unsigned int state)
 static void bcm43xx_periodic_work_handler(void *d)
 {
         struct bcm43xx_private *bcm = d;
+        struct net_device *net_dev = bcm->net_dev;
         unsigned long flags;
         u32 savedirqs = 0;
         int badness;
+        unsigned long orig_trans_start = 0;
 
         mutex_lock(&bcm->mutex);
         badness = estimate_periodic_work_badness(bcm->periodic_state);
@@ -3173,7 +3175,18 @@ static void bcm43xx_periodic_work_handler(void *d)
                 /* Periodic work will take a long time, so we want it to
                  * be preemtible.
                  */
-                netif_tx_disable(bcm->net_dev);
+
+                netif_tx_lock_bh(net_dev);
+                /* We must fake a started transmission here, as we are going to
+                 * disable TX. If we wouldn't fake a TX, it would be possible to
+                 * trigger the netdev watchdog, if the last real TX is already
+                 * some time on the past (slightly less than 5secs)
+                 */
+                orig_trans_start = net_dev->trans_start;
+                net_dev->trans_start = jiffies;
+                netif_stop_queue(net_dev);
+                netif_tx_unlock_bh(net_dev);
+
                 spin_lock_irqsave(&bcm->irq_lock, flags);
                 bcm43xx_mac_suspend(bcm);
                 if (bcm43xx_using_pio(bcm))
@@ -3198,6 +3211,7 @@ static void bcm43xx_periodic_work_handler(void *d)
                         bcm43xx_pio_thaw_txqueues(bcm);
                 bcm43xx_mac_enable(bcm);
                 netif_wake_queue(bcm->net_dev);
+                net_dev->trans_start = orig_trans_start;
         }
         mmiowb();
         spin_unlock_irqrestore(&bcm->irq_lock, flags);
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index 6dfa041be66d..bc81b13a5a2a 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -364,7 +364,7 @@ static int prism2_plx_check_cis(void __iomem *attr_mem, int attr_len,
 
         pos = 0;
         while (pos < CIS_MAX_LEN - 1 && cis[pos] != CISTPL_END) {
-                if (pos + cis[pos + 1] >= CIS_MAX_LEN)
+                if (pos + 2 + cis[pos + 1] > CIS_MAX_LEN)
                         goto cis_error;
 
                 switch (cis[pos]) {
@@ -391,7 +391,7 @@ static int prism2_plx_check_cis(void __iomem *attr_mem, int attr_len,
                         break;
 
                 case CISTPL_MANFID:
-                        if (cis[pos + 1] < 5)
+                        if (cis[pos + 1] < 4)
                                 goto cis_error;
                         manfid1 = cis[pos + 2] + (cis[pos + 3] << 8);
                         manfid2 = cis[pos + 4] + (cis[pos + 5] << 8);
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 634139232aaf..8ca18085e68d 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -353,9 +353,6 @@ EXPORT_SYMBOL(lockd_down);
  * Sysctl parameters (same as module parameters, different interface).
  */
 
-/* Something that isn't CTL_ANY, CTL_NONE or a value that may clash. */
-#define CTL_UNNUMBERED          -2
-
 static ctl_table nlm_sysctls[] = {
         {
                 .ctl_name       = CTL_UNNUMBERED,
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index 2fe3403c2409..3ea50ac64820 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -18,11 +18,6 @@
 static const int nfs_set_port_min = 0;
 static const int nfs_set_port_max = 65535;
 static struct ctl_table_header *nfs_callback_sysctl_table;
-/*
- * Something that isn't CTL_ANY, CTL_NONE or a value that may clash.
- * Use the same values as fs/lockd/svc.c
- */
-#define CTL_UNNUMBERED -2
 
 static ctl_table nfs_cb_sysctls[] = {
 #ifdef CONFIG_NFS_V4
diff --git a/include/asm-avr32/unistd.h b/include/asm-avr32/unistd.h
index a50e5004550c..56ed1f9d348a 100644
--- a/include/asm-avr32/unistd.h
+++ b/include/asm-avr32/unistd.h
@@ -280,9 +280,10 @@
 #define __NR_sync_file_range    262
 #define __NR_tee                263
 #define __NR_vmsplice           264
+#define __NR_epoll_pwait        265
 
 #ifdef __KERNEL__
-#define NR_syscalls             265
+#define NR_syscalls             266
 
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 1b24bd45e080..d98562f1df76 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -6,10 +6,17 @@
  ****************************************************************
  ****************************************************************
  **
+ **  WARNING:
  **  The values in this file are exported to user space via 
- **  the sysctl() binary interface.  However this interface
- **  is unstable and deprecated and will be removed in the future. 
- **  For a stable interface use /proc/sys.
+ **  the sysctl() binary interface.  Do *NOT* change the
+ **  numbering of any existing values here, and do not change
+ **  any numbers within any one set of values.  If you have to
+ **  have to redefine an existing interface, use a new number for it.
+ **  The kernel will then return -ENOTDIR to any application using
+ **  the old binary interface.
+ **
+ **  For new interfaces unless you really need a binary number
+ **  please use CTL_UNNUMBERED.
  **
  ****************************************************************
  ****************************************************************
@@ -48,6 +55,7 @@ struct __sysctl_args {
 #ifdef __KERNEL__
 #define CTL_ANY         -1      /* Matches any name */
 #define CTL_NONE        0
+#define CTL_UNNUMBERED  CTL_NONE        /* sysctl without a binary number */
 #endif
 
 enum
@@ -961,8 +969,8 @@ extern ctl_handler sysctl_ms_jiffies;
 /*
  * Register a set of sysctl names by calling register_sysctl_table
  * with an initialised array of ctl_table's.  An entry with zero
- * ctl_name terminates the table.  table->de will be set up by the
- * registration and need not be initialised in advance.
+ * ctl_name and NULL procname terminates the table.  table->de will be
+ * set up by the registration and need not be initialised in advance.
  *
  * sysctl names can be mirrored automatically under /proc/sys.  The
  * procname supplied controls /proc naming.
@@ -973,7 +981,10 @@ extern ctl_handler sysctl_ms_jiffies;
  * Leaf nodes in the sysctl tree will be represented by a single file
  * under /proc; non-leaf nodes will be represented by directories.  A
  * null procname disables /proc mirroring at this node.
- * 
+ *
+ * sysctl entries with a zero ctl_name will not be available through
+ * the binary sysctl interface.
+ *
  * sysctl(2) can automatically manage read and write requests through
  * the sysctl table.  The data and maxlen fields of the ctl_table
  * struct enable minimal validation of the values being written to be
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 663c920b2234..272254f20d97 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -58,8 +58,8 @@ void unlock_cpu_hotplug(void)
                 recursive_depth--;
                 return;
         }
-        mutex_unlock(&cpu_bitmask_lock);
         recursive = NULL;
+        mutex_unlock(&cpu_bitmask_lock);
 }
 EXPORT_SYMBOL_GPL(unlock_cpu_hotplug);
 
diff --git a/kernel/delayacct.c b/kernel/delayacct.c
index 36752f124c6a..66a0ea48751d 100644
--- a/kernel/delayacct.c
+++ b/kernel/delayacct.c
@@ -66,6 +66,7 @@ static void delayacct_end(struct timespec *start, struct timespec *end,
 {
         struct timespec ts;
         s64 ns;
+        unsigned long flags;
 
         do_posix_clock_monotonic_gettime(end);
         ts = timespec_sub(*end, *start);
@@ -73,10 +74,10 @@ static void delayacct_end(struct timespec *start, struct timespec *end,
         if (ns < 0)
                 return;
 
-        spin_lock(&current->delays->lock);
+        spin_lock_irqsave(&current->delays->lock, flags);
         *total += ns;
         (*count)++;
-        spin_unlock(&current->delays->lock);
+        spin_unlock_irqrestore(&current->delays->lock, flags);
 }
 
 void __delayacct_blkio_start(void)
@@ -104,6 +105,7 @@ int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk)
         s64 tmp;
         struct timespec ts;
         unsigned long t1,t2,t3;
+        unsigned long flags;
 
         /* Though tsk->delays accessed later, early exit avoids
          * unnecessary returning of other data
@@ -136,14 +138,14 @@ int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk)
 
         /* zero XXX_total, non-zero XXX_count implies XXX stat overflowed */
 
-        spin_lock(&tsk->delays->lock);
+        spin_lock_irqsave(&tsk->delays->lock, flags);
         tmp = d->blkio_delay_total + tsk->delays->blkio_delay;
         d->blkio_delay_total = (tmp < d->blkio_delay_total) ? 0 : tmp;
         tmp = d->swapin_delay_total + tsk->delays->swapin_delay;
         d->swapin_delay_total = (tmp < d->swapin_delay_total) ? 0 : tmp;
         d->blkio_count += tsk->delays->blkio_count;
         d->swapin_count += tsk->delays->swapin_count;
-        spin_unlock(&tsk->delays->lock);
+        spin_unlock_irqrestore(&tsk->delays->lock, flags);
 
 done:
         return 0;
@@ -152,11 +154,12 @@ done:
 __u64 __delayacct_blkio_ticks(struct task_struct *tsk)
 {
         __u64 ret;
+        unsigned long flags;
 
-        spin_lock(&tsk->delays->lock);
+        spin_lock_irqsave(&tsk->delays->lock, flags);
         ret = nsec_to_clock_t(tsk->delays->blkio_delay +
                                 tsk->delays->swapin_delay);
-        spin_unlock(&tsk->delays->lock);
+        spin_unlock_irqrestore(&tsk->delays->lock, flags);
         return ret;
 }
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8bff2c18fb5a..09e569f4792b 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1315,7 +1315,9 @@ repeat:
                 return -ENOTDIR;
         if (get_user(n, name))
                 return -EFAULT;
-        for ( ; table->ctl_name; table++) {
+        for ( ; table->ctl_name || table->procname; table++) {
+                if (!table->ctl_name)
+                        continue;
                 if (n == table->ctl_name || table->ctl_name == CTL_ANY) {
                         int error;
                         if (table->child) {
@@ -1532,7 +1534,7 @@ static void register_proc_table(ctl_table * table, struct proc_dir_entry *root,
         int len;
         mode_t mode;
         
-        for (; table->ctl_name; table++) {
+        for (; table->ctl_name || table->procname; table++) {
                 /* Can't do anything without a proc name. */
                 if (!table->procname)
                         continue;
@@ -1579,7 +1581,7 @@ static void register_proc_table(ctl_table * table, struct proc_dir_entry *root,
 static void unregister_proc_table(ctl_table * table, struct proc_dir_entry *root)
 {
         struct proc_dir_entry *de;
-        for (; table->ctl_name; table++) {
+        for (; table->ctl_name || table->procname; table++) {
                 if (!(de = table->de))
                         continue;
                 if (de->mode & S_IFDIR) {
@@ -2680,13 +2682,33 @@ int sysctl_ms_jiffies(ctl_table *table, int __user *name, int nlen,
 asmlinkage long sys_sysctl(struct __sysctl_args __user *args)
 {
         static int msg_count;
+        struct __sysctl_args tmp;
+        int name[CTL_MAXNAME];
+        int i;
+
+        /* Read in the sysctl name for better debug message logging */
+        if (copy_from_user(&tmp, args, sizeof(tmp)))
+                return -EFAULT;
+        if (tmp.nlen <= 0 || tmp.nlen >= CTL_MAXNAME)
+                return -ENOTDIR;
+        for (i = 0; i < tmp.nlen; i++)
+                if (get_user(name[i], tmp.name + i))
+                        return -EFAULT;
+
+        /* Ignore accesses to kernel.version */
+        if ((tmp.nlen == 2) && (name[0] == CTL_KERN) && (name[1] == KERN_VERSION))
+                goto out;
 
         if (msg_count < 5) {
                 msg_count++;
                 printk(KERN_INFO
                         "warning: process `%s' used the removed sysctl "
-                        "system call\n", current->comm);
+                        "system call with ", current->comm);
+                for (i = 0; i < tmp.nlen; i++)
+                        printk("%d.", name[i]);
+                printk("\n");
         }
+out:
         return -ENOSYS;
 }
 
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 770704183a1b..2759312a4204 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -1078,12 +1078,12 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
 
         while (length >= sizeof(*info_element)) {
                 if (sizeof(*info_element) + info_element->len > length) {
-                        IEEE80211_ERROR("Info elem: parse failed: "
-                                        "info_element->len + 2 > left : "
-                                        "info_element->len+2=%zd left=%d, id=%d.\n",
-                                        info_element->len +
-                                        sizeof(*info_element),
-                                        length, info_element->id);
+                        IEEE80211_DEBUG_MGMT("Info elem: parse failed: "
+                                             "info_element->len + 2 > left : "
+                                             "info_element->len+2=%zd left=%d, id=%d.\n",
+                                             info_element->len +
+                                             sizeof(*info_element),
+                                             length, info_element->id);
                         /* We stop processing but don't return an error here
                          * because some misbehaviour APs break this rule. ie.
                          * Orinoco AP1000. */
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index 0004c1f0ef04..ee9bb1522d5e 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -126,6 +126,7 @@ void auth_domain_put(struct auth_domain *dom)
         if (atomic_dec_and_lock(&dom->ref.refcount, &auth_domain_lock)) {
                 hlist_del(&dom->hash);
                 dom->flavour->domain_release(dom);
+                spin_unlock(&auth_domain_lock);
         }
 }