123 files changed, 975 insertions, 1154 deletions
diff --git a/Documentation/acpi-hotkey.txt b/Documentation/acpi-hotkey.txt
index 4c115a7bb826..0acdc80c30c2 100644
--- a/Documentation/acpi-hotkey.txt
+++ b/Documentation/acpi-hotkey.txt
@@ -33,3 +33,6 @@ The result of the execution of this aml method is
 attached to /proc/acpi/hotkey/poll_method, which is dnyamically
 created.  Please use command "cat /proc/acpi/hotkey/polling_method" 
 to retrieve it.
+Note: Use cmdline "acpi_generic_hotkey" to over-ride
+loading any platform specific drivers.
diff --git a/Documentation/arm/Samsung-S3C24XX/USB-Host.txt b/Documentation/arm/Samsung-S3C24XX/USB-Host.txt
new file mode 100644
index 000000000000..b93b68e2b143
--- /dev/null
+++ b/Documentation/arm/Samsung-S3C24XX/USB-Host.txt
@@ -0,0 +1,93 @@
+                        S3C24XX USB Host support
+                        ========================
+Introduction
+------------
+  This document details the S3C2410/S3C2440 in-built OHCI USB host support.
+Configuration
+-------------
+  Enable at least the following kernel options:
+  menuconfig:
+   Device Drivers  --->
+     USB support  --->
+       <*> Support for Host-side USB
+       <*>   OHCI HCD support
+  .config:
+    CONFIG_USB
+    CONFIG_USB_OHCI_HCD
+  Once these options are configured, the standard set of USB device
+  drivers can be configured and used.
+Board Support
+-------------
+  The driver attaches to a platform device, which will need to be
+  added by the board specific support file in linux/arch/arm/mach-s3c2410,
+  such as mach-bast.c or mach-smdk2410.c
+  The platform device's platform_data field is only needed if the
+  board implements extra power control or over-current monitoring.
+  The OHCI driver does not ensure the state of the S3C2410's MISCCTRL
+  register, so if both ports are to be used for the host, then it is
+  the board support file's responsibility to ensure that the second
+  port is configured to be connected to the OHCI core.
+Platform Data
+-------------
+  See linux/include/asm-arm/arch-s3c2410/usb-control.h for the
+  descriptions of the platform device data. An implementation
+  can be found in linux/arch/arm/mach-s3c2410/usb-simtec.c .
+  The `struct s3c2410_hcd_info` contains a pair of functions
+  that get called to enable over-current detection, and to
+  control the port power status.
+  The ports are numbered 0 and 1.
+  power_control:
+    Called to enable or disable the power on the port.
+  enable_oc:
+    Called to enable or disable the over-current monitoring.
+    This should claim or release the resources being used to
+    check the power condition on the port, such as an IRQ.
+  report_oc:
+    The OHCI driver fills this field in for the over-current code
+    to call when there is a change to the over-current state on
+    an port. The ports argument is a bitmask of 1 bit per port,
+    with bit X being 1 for an over-current on port X.
+    The function s3c2410_usb_report_oc() has been provided to
+    ensure this is called correctly.
+  port[x]:
+    This is struct describes each port, 0 or 1. The platform driver
+    should set the flags field of each port to S3C_HCDFLG_USED if
+    the port is enabled.
+Document Author
+---------------
+Ben Dooks, (c) 2005 Simtec Electronics
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index a998a8c2f95b..3d5cd7a09b2f 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -159,6 +159,11 @@ running once the system is up.
        acpi_fake_ecdt  [HW,ACPI] Workaround failure due to BIOS lacking ECDT
+        acpi_generic_hotkey [HW,ACPI]
+                        Allow consolidated generic hotkey driver to
+                        over-ride platform specific driver.
+                        See also Documentation/acpi-hotkey.txt.
        ad1816=         [HW,OSS]
                        Format: <io>,<irq>,<dma>,<dma2>
                        See also Documentation/sound/oss/AD1816.
diff --git a/Documentation/pci.txt b/Documentation/pci.txt
index 62b1dc5d97e2..76d28d033657 100644
--- a/Documentation/pci.txt
+++ b/Documentation/pci.txt
@@ -266,20 +266,6 @@ port an old driver to the new PCI interface.  They are no longer present
 in the kernel as they aren't compatible with hotplug or PCI domains or
 having sane locking.
-pcibios_present() and           Since ages, you don't need to test presence
-pci_present()                   of PCI subsystem when trying to talk to it.
-                                If it's not there, the list of PCI devices
-                                is empty and all functions for searching for
-                                devices just return NULL.
-pcibios_(read|write)_*          Superseded by their pci_(read|write)_*
-                                counterparts.
-pcibios_find_*                  Superseded by their pci_get_* counterparts.
-pci_for_each_dev()              Superseded by pci_get_device()
-pci_for_each_dev_reverse()      Superseded by pci_find_device_reverse()
-pci_for_each_bus()              Superseded by pci_find_next_bus()
 pci_find_device()               Superseded by pci_get_device()
 pci_find_subsys()               Superseded by pci_get_subsys()
 pci_find_slot()                 Superseded by pci_get_slot()
-pcibios_find_class()            Superseded by pci_get_class()
-pci_find_class()                Superseded by pci_get_class()
-pci_(read|write)_*_nodev()      Superseded by pci_bus_(read|write)_*()
diff --git a/MAINTAINERS b/MAINTAINERS
index ac594d26d698..2f7d1066c8d7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -787,7 +787,7 @@ DVB SUBSYSTEM AND DRIVERS
 P:      LinuxTV.org Project
 M:      linux-dvb-maintainer@linuxtv.org
 L:      linux-dvb@linuxtv.org (subscription required)
-W:      http://linuxtv.org/developer/dvb.xml
+W:      http://linuxtv.org/
 S:      Supported
 EATA-DMA SCSI DRIVER
@@ -1828,6 +1828,12 @@ P:	Greg Kroah-Hartman
 M:      greg@kroah.com
 S:      Maintained
+PCIE HOTPLUG DRIVER
+P:      Kristen Carlson Accardi
+M:      kristen.c.accardi@intel.com
+L:      pcihpd-discuss@lists.sourceforge.net
+S:      Maintained
 PCMCIA SUBSYSTEM
 P:      Linux PCMCIA Team
 L:      http://lists.infradead.org/mailman/listinfo/linux-pcmcia
@@ -2204,6 +2210,12 @@ W:	http://projects.buici.com/arm
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
 S:      Maintained
+SHPC HOTPLUG DRIVER
+P:      Kristen Carlson Accardi
+M:      kristen.c.accardi@intel.com
+L:      pcihpd-discuss@lists.sourceforge.net
+S:      Maintained
 SPARC (sparc32):
 P:      William L. Irwin
 M:      wli@holomorphy.com
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 39a6c1b0b9a3..7152bfbee581 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -533,6 +533,13 @@ ENTRY(__switch_to)
        ldr     r3, [r2, #TI_TP_VALUE]
        stmia   ip!, {r4 - sl, fp, sp, lr}      @ Store most regs on stack
        ldr     r6, [r2, #TI_CPU_DOMAIN]!
+#if __LINUX_ARM_ARCH__ >= 6
+#ifdef CONFIG_CPU_MPCORE
+        clrex
+#else
+        strex   r3, r4, [ip]                    @ Clear exclusive monitor
+#endif
+#endif
 #if defined(CONFIG_CPU_XSCALE) && !defined(CONFIG_IWMMXT)
        mra     r4, r5, acc0
        stmia   ip, {r4, r5}
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index 2036ff15bda9..64a988c1ad44 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -1,4 +1,6 @@
-#if __LINUX_ARM_ARCH__ >= 6
+#include <linux/config.h>
+#if __LINUX_ARM_ARCH__ >= 6 && defined(CONFIG_CPU_MPCORE)
        .macro  bitop, instr
        mov     r2, #1
        and     r3, r0, #7              @ Get bit offset
diff --git a/arch/arm/mach-s3c2410/usb-simtec.c b/arch/arm/mach-s3c2410/usb-simtec.c
index 7f2b61362976..f021fd82be52 100644
--- a/arch/arm/mach-s3c2410/usb-simtec.c
+++ b/arch/arm/mach-s3c2410/usb-simtec.c
@@ -1,6 +1,6 @@
 /* linux/arch/arm/mach-s3c2410/usb-simtec.c
 *
- * Copyright (c) 2004 Simtec Electronics
+ * Copyright (c) 2004,2005 Simtec Electronics
 *   Ben Dooks <ben@simtec.co.uk>
 *
 * http://www.simtec.co.uk/products/EB2410ITX/
@@ -14,6 +14,8 @@
 * Modifications:
 *      14-Sep-2004 BJD  Created
 *      18-Oct-2004 BJD  Cleanups, and added code to report OC cleared
+ *      09-Aug-2005 BJD  Renamed s3c2410_report_oc to s3c2410_usb_report_oc
+ *      09-Aug-2005 BJD  Ports powered only if both are enabled
 */
 #define DEBUG
@@ -47,13 +49,19 @@
 * designed boards.
 */
+static unsigned int power_state[2];
 static void
 usb_simtec_powercontrol(int port, int to)
 {
        pr_debug("usb_simtec_powercontrol(%d,%d)\n", port, to);
-        if (port == 1)
+        power_state[port] = to;
-                s3c2410_gpio_setpin(S3C2410_GPB4, to ? 0:1);
+        if (power_state[0] && power_state[1])
+                s3c2410_gpio_setpin(S3C2410_GPB4, 0);
+        else
+                s3c2410_gpio_setpin(S3C2410_GPB4, 1);
 }
 static irqreturn_t
@@ -63,10 +71,10 @@ usb_simtec_ocirq(int irq, void *pw, struct pt_regs *regs)
        if (s3c2410_gpio_getpin(S3C2410_GPG10) == 0) {
                pr_debug("usb_simtec: over-current irq (oc detected)\n");
-                s3c2410_report_oc(info, 3);
+                s3c2410_usb_report_oc(info, 3);
        } else {
                pr_debug("usb_simtec: over-current irq (oc cleared)\n");
-                s3c2410_report_oc(info, 0);
+                s3c2410_usb_report_oc(info, 0);
        }
        return IRQ_HANDLED;
diff --git a/arch/arm/mm/mm-armv.c b/arch/arm/mm/mm-armv.c
index e33fe4229d05..3c655c54e231 100644
--- a/arch/arm/mm/mm-armv.c
+++ b/arch/arm/mm/mm-armv.c
@@ -383,6 +383,7 @@ static void __init build_mem_type_table(void)
 {
        struct cachepolicy *cp;
        unsigned int cr = get_cr();
+        unsigned int user_pgprot;
        int cpu_arch = cpu_architecture();
        int i;
@@ -408,6 +409,9 @@ static void __init build_mem_type_table(void)
                }
        }
+        cp = &cache_policies[cachepolicy];
+        user_pgprot = cp->pte;
        /*
         * ARMv6 and above have extended page tables.
         */
@@ -426,11 +430,18 @@ static void __init build_mem_type_table(void)
                mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
                mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
+                /*
+                 * Mark the device area as "shared device"
+                 */
                mem_types[MT_DEVICE].prot_pte |= L_PTE_BUFFERABLE;
                mem_types[MT_DEVICE].prot_sect |= PMD_SECT_BUFFERED;
-        }
-        cp = &cache_policies[cachepolicy];
+                /*
+                 * User pages need to be mapped with the ASID
+                 * (iow, non-global)
+                 */
+                user_pgprot |= L_PTE_ASID;
+        }
        if (cpu_arch >= CPU_ARCH_ARMv5) {
                mem_types[MT_LOW_VECTORS].prot_pte |= cp->pte & PTE_CACHEABLE;
@@ -448,7 +459,7 @@ static void __init build_mem_type_table(void)
        for (i = 0; i < 16; i++) {
                unsigned long v = pgprot_val(protection_map[i]);
-                v &= (~(PTE_BUFFERABLE|PTE_CACHEABLE)) | cp->pte;
+                v &= (~(PTE_BUFFERABLE|PTE_CACHEABLE)) | user_pgprot;
                protection_map[i] = __pgprot(v);
        }
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 352db98ee269..3429ddcf65d1 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -111,12 +111,6 @@ ENTRY(cpu_v6_switch_mm)
        mcr     p15, 0, r1, c13, c0, 1          @ set context ID
        mov     pc, lr
-#define nG      (1 << 11)
-#define APX     (1 << 9)
-#define AP1     (1 << 5)
-#define AP0     (1 << 4)
-#define XN      (1 << 0)
 /*
 *      cpu_v6_set_pte(ptep, pte)
 *
@@ -139,24 +133,24 @@ ENTRY(cpu_v6_switch_mm)
 ENTRY(cpu_v6_set_pte)
        str     r1, [r0], #-2048                @ linux version
-        bic     r2, r1, #0x00000ff0
+        bic     r2, r1, #0x000007f0
        bic     r2, r2, #0x00000003
-        orr     r2, r2, #AP0 | 2
+        orr     r2, r2, #PTE_EXT_AP0 | 2
        tst     r1, #L_PTE_WRITE
        tstne   r1, #L_PTE_DIRTY
-        orreq   r2, r2, #APX
+        orreq   r2, r2, #PTE_EXT_APX
        tst     r1, #L_PTE_USER
-        orrne   r2, r2, #AP1 | nG
+        orrne   r2, r2, #PTE_EXT_AP1
-        tstne   r2, #APX
+        tstne   r2, #PTE_EXT_APX
-        bicne   r2, r2, #APX | AP0
+        bicne   r2, r2, #PTE_EXT_APX | PTE_EXT_AP0
        tst     r1, #L_PTE_YOUNG
-        biceq   r2, r2, #APX | AP1 | AP0
+        biceq   r2, r2, #PTE_EXT_APX | PTE_EXT_AP_MASK
 @       tst     r1, #L_PTE_EXEC
-@       orreq   r2, r2, #XN
+@       orreq   r2, r2, #PTE_EXT_XN
        tst     r1, #L_PTE_PRESENT
        moveq   r2, #0
diff --git a/arch/ia64/kernel/domain.c b/arch/ia64/kernel/domain.c
index d65e87b6394f..bbb8efe126b7 100644
--- a/arch/ia64/kernel/domain.c
+++ b/arch/ia64/kernel/domain.c
@@ -341,7 +341,7 @@ next_sg:
 #endif
        /* Attach the domains */
-        for_each_online_cpu(i) {
+        for_each_cpu_mask(i, *cpu_map) {
                struct sched_domain *sd;
 #ifdef CONFIG_SCHED_SMT
                sd = &per_cpu(cpu_domains, i);
diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
index 66e840609808..051e050359e4 100644
--- a/arch/ia64/kernel/process.c
+++ b/arch/ia64/kernel/process.c
@@ -179,7 +179,7 @@ static int can_do_pal_halt = 1;
 static int __init nohalt_setup(char * str)
 {
-        pal_halt = 0;
+        pal_halt = can_do_pal_halt = 0;
        return 1;
 }
 __setup("nohalt", nohalt_setup);
diff --git a/arch/ppc64/kernel/LparData.c b/arch/ppc64/kernel/LparData.c
index 76cfd1449d52..1c11031c838e 100644
--- a/arch/ppc64/kernel/LparData.c
+++ b/arch/ppc64/kernel/LparData.c
@@ -32,32 +32,12 @@
 /* The HvReleaseData is the root of the information shared between 
 * the hypervisor and Linux.  
 */
-/*
- * WARNING - magic here
- *
- * Ok, this is a horrid hack below, but marginally better than the
- * alternatives.  What we really want is just to initialize
- * hvReleaseData in C as in the #if 0 section here.  However, gcc
- * refuses to believe that (u32)&x is a constant expression, so will
- * not allow the xMsNucDataOffset field to be properly initialized.
- * So, we declare hvReleaseData in inline asm instead.  We use inline
- * asm, rather than a .S file, because the assembler won't generate
- * the necessary relocation for the LparMap either, unless that symbol
- * is declared in the same source file.  Finally, we put the asm in a
- * dummy, attribute-used function, instead of at file scope, because
- * file scope asms don't allow contraints.  We want to use the "i"
- * constraints to put sizeof() and offsetof() expressions in there,
- * because including asm/offsets.h in C code then stringifying causes
- * all manner of warnings.
- */
-#if 0
 struct HvReleaseData hvReleaseData = {
        .xDesc = 0xc8a5d9c4,    /* "HvRD" ebcdic */
        .xSize = sizeof(struct HvReleaseData),
        .xVpdAreasPtrOffset = offsetof(struct naca_struct, xItVpdAreas),
        .xSlicNacaAddr = &naca,         /* 64-bit Naca address */
-        .xMsNucDataOffset = (u32)((unsigned long)&xLparMap - KERNELBASE),
+        .xMsNucDataOffset = LPARMAP_PHYS,
        .xFlags = HVREL_TAGSINACTIVE    /* tags inactive       */
                                        /* 64 bit              */
                                        /* shared processors   */
@@ -70,63 +50,6 @@ struct HvReleaseData hvReleaseData = {
                0xa7, 0x40, 0xf2, 0x4b,
                0xf4, 0x4b, 0xf6, 0xf4 },
 };
-#endif
-extern struct HvReleaseData hvReleaseData;
-static void __attribute_used__ hvReleaseData_wrapper(void)
-{
-        /* This doesn't appear to need any alignment (even 4 byte) */
-        asm volatile (
-                "       lparMapPhys = xLparMap - %3\n"
-                "       .data\n"
-                "       .globl  hvReleaseData\n"
-                "hvReleaseData:\n"
-                "       .long   0xc8a5d9c4\n"   /* xDesc */
-                                                /* "HvRD" in ebcdic */
-                "       .short  %0\n"           /* xSize */
-                "       .short  %1\n"           /* xVpdAreasPtrOffset */
-                "       .llong  naca\n"         /* xSlicNacaAddr */
-                "       .long   lparMapPhys\n"  /* xMsNucDataOffset */
-                "       .long   0\n"            /* xRsvd1 */
-                "       .short  %2\n"           /* xFlags */
-                "       .short  4\n"    /* xVrmIndex  - v5r2m0 */
-                "       .short  3\n"    /* xMinSupportedPlicVrmIndex - v5r1m0 */
-                "       .short  3\n"    /* xMinCompatablePlicVrmIndex - v5r1m0 */
-                "       .long   0xd38995a4\n"   /* xVrmName */
-                "       .long   0xa740f24b\n"   /*   "Linux 2.4.64" ebcdic */
-                "       .long   0xf44bf6f4\n"
-                "       . = hvReleaseData + %0\n"
-                "       .previous\n"
-                : : "i"(sizeof(hvReleaseData)),
-                "i"(offsetof(struct naca_struct, xItVpdAreas)),
-                "i"(HVREL_TAGSINACTIVE /* tags inactive, 64 bit, */
-                                       /* shared processors, HMT allowed */
-                    | 6), /* TEMP: This allows non-GA drivers */
-                "i"(KERNELBASE)
-                );
-}
-struct LparMap __attribute__((aligned (16))) xLparMap = {
-        .xNumberEsids = HvEsidsToMap,
-        .xNumberRanges = HvRangesToMap,
-        .xSegmentTableOffs = STAB0_PAGE,
-        .xEsids = {
-                { .xKernelEsid = GET_ESID(KERNELBASE),
-                  .xKernelVsid = KERNEL_VSID(KERNELBASE), },
-                { .xKernelEsid = GET_ESID(VMALLOCBASE),
-                  .xKernelVsid = KERNEL_VSID(VMALLOCBASE), },
-        },
-        .xRanges = {
-                { .xPages = HvPagesToMap,
-                  .xOffset = 0,
-                  .xVPN = KERNEL_VSID(KERNELBASE) << (SID_SHIFT - PAGE_SHIFT),
-                },
-        },
-};
 extern void system_reset_iSeries(void);
 extern void machine_check_iSeries(void);
diff --git a/arch/ppc64/kernel/Makefile b/arch/ppc64/kernel/Makefile
index d9b2660ef221..2ecccb6b4f8c 100644
--- a/arch/ppc64/kernel/Makefile
+++ b/arch/ppc64/kernel/Makefile
@@ -73,3 +73,8 @@ obj-$(CONFIG_ALTIVEC)		+= vecemu.o vector.o
 obj-$(CONFIG_KPROBES)           += kprobes.o
 CFLAGS_ioctl32.o += -Ifs/
+ifeq ($(CONFIG_PPC_ISERIES),y)
+arch/ppc64/kernel/head.o: arch/ppc64/kernel/lparmap.s
+AFLAGS_head.o += -Iarch/ppc64/kernel
+endif
diff --git a/arch/ppc64/kernel/head.S b/arch/ppc64/kernel/head.S
index 784f56d4684c..accaa052d31f 100644
--- a/arch/ppc64/kernel/head.S
+++ b/arch/ppc64/kernel/head.S
@@ -38,6 +38,7 @@
 #include <asm/cputable.h>
 #include <asm/setup.h>
 #include <asm/hvcall.h>
+#include <asm/iSeries/LparMap.h>
 #ifdef CONFIG_PPC_ISERIES
 #define DO_SOFT_DISABLE
@@ -679,6 +680,11 @@ hardware_interrupt_iSeries_masked:
        .globl fwnmi_data_area
 fwnmi_data_area:
+#ifdef CONFIG_PPC_ISERIES
+        . = LPARMAP_PHYS
+#include "lparmap.s"
+#endif /* CONFIG_PPC_ISERIES */
 /*
 * Vectors for the FWNMI option.  Share common code.
 */
diff --git a/arch/ppc64/kernel/lparmap.c b/arch/ppc64/kernel/lparmap.c
new file mode 100644
index 000000000000..b81de286df5e
--- /dev/null
+++ b/arch/ppc64/kernel/lparmap.c
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2005  Stephen Rothwell  IBM Corp.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <asm/mmu.h>
+#include <asm/page.h>
+#include <asm/iSeries/LparMap.h>
+const struct LparMap __attribute__((__section__(".text"))) xLparMap = {
+        .xNumberEsids = HvEsidsToMap,
+        .xNumberRanges = HvRangesToMap,
+        .xSegmentTableOffs = STAB0_PAGE,
+        .xEsids = {
+                { .xKernelEsid = GET_ESID(KERNELBASE),
+                  .xKernelVsid = KERNEL_VSID(KERNELBASE), },
+                { .xKernelEsid = GET_ESID(VMALLOCBASE),
+                  .xKernelVsid = KERNEL_VSID(VMALLOCBASE), },
+        },
+        .xRanges = {
+                { .xPages = HvPagesToMap,
+                  .xOffset = 0,
+                  .xVPN = KERNEL_VSID(KERNELBASE) << (SID_SHIFT - PAGE_SHIFT),
+                },
+        },
+};
diff --git a/arch/ppc64/kernel/prom_init.c b/arch/ppc64/kernel/prom_init.c
index e248a7950aeb..dbbe6c79d8da 100644
--- a/arch/ppc64/kernel/prom_init.c
+++ b/arch/ppc64/kernel/prom_init.c
@@ -1803,7 +1803,7 @@ static void __init fixup_device_tree(void)
        if (prom_getprop(u3, "device-rev", &u3_rev, sizeof(u3_rev))
            == PROM_ERROR)
                return;
-        if (u3_rev != 0x35)
+        if (u3_rev != 0x35 && u3_rev != 0x37)
                return;
        /* does it need fixup ? */
        if (prom_getproplen(i2c, "interrupts") > 0)
diff --git a/arch/sparc64/solaris/socket.c b/arch/sparc64/solaris/socket.c
index 06740582717e..d3a66ea74a7f 100644
--- a/arch/sparc64/solaris/socket.c
+++ b/arch/sparc64/solaris/socket.c
@@ -16,6 +16,7 @@
 #include <linux/net.h>
 #include <linux/compat.h>
 #include <net/compat.h>
+#include <net/sock.h>
 #include <asm/uaccess.h>
 #include <asm/string.h>
@@ -297,121 +298,165 @@ asmlinkage int solaris_sendmsg(int fd, struct sol_nmsghdr __user *user_msg, unsi
 {
        struct socket *sock;
        char address[MAX_SOCK_ADDR];
-        struct iovec iov[UIO_FASTIOV];
+        struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
        unsigned char ctl[sizeof(struct cmsghdr) + 20];
        unsigned char *ctl_buf = ctl;
-        struct msghdr kern_msg;
+        struct msghdr msg_sys;
-        int err, total_len;
+        int err, ctl_len, iov_size, total_len;
-        if(msghdr_from_user32_to_kern(&kern_msg, user_msg))
+        err = -EFAULT;
-                return -EFAULT;
+        if (msghdr_from_user32_to_kern(&msg_sys, user_msg))
-        if(kern_msg.msg_iovlen > UIO_MAXIOV)
+                goto out;
-                return -EINVAL;
-        err = verify_compat_iovec(&kern_msg, iov, address, VERIFY_READ);
+        sock = sockfd_lookup(fd, &err);
-        if (err < 0)
+        if (!sock)
                goto out;
+        /* do not move before msg_sys is valid */
+        err = -EMSGSIZE;
+        if (msg_sys.msg_iovlen > UIO_MAXIOV)
+                goto out_put;
+        /* Check whether to allocate the iovec area*/
+        err = -ENOMEM;
+        iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
+        if (msg_sys.msg_iovlen > UIO_FASTIOV) {
+                iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
+                if (!iov)
+                        goto out_put;
+        }
+        err = verify_compat_iovec(&msg_sys, iov, address, VERIFY_READ);
+        if (err < 0)
+                goto out_freeiov;
        total_len = err;
-        if(kern_msg.msg_controllen) {
+        err = -ENOBUFS;
-                struct sol_cmsghdr __user *ucmsg = kern_msg.msg_control;
+        if (msg_sys.msg_controllen > INT_MAX)
+                goto out_freeiov;
+        ctl_len = msg_sys.msg_controllen;
+        if (ctl_len) {
+                struct sol_cmsghdr __user *ucmsg = msg_sys.msg_control;
                unsigned long *kcmsg;
                compat_size_t cmlen;
-                if (kern_msg.msg_controllen <= sizeof(compat_size_t))
+                err = -EINVAL;
-                        return -EINVAL;
+                if (ctl_len <= sizeof(compat_size_t))
+                        goto out_freeiov;
-                if(kern_msg.msg_controllen > sizeof(ctl)) {
+                if (ctl_len > sizeof(ctl)) {
                        err = -ENOBUFS;
-                        ctl_buf = kmalloc(kern_msg.msg_controllen, GFP_KERNEL);
+                        ctl_buf = kmalloc(ctl_len, GFP_KERNEL);
-                        if(!ctl_buf)
+                        if (!ctl_buf)
                                goto out_freeiov;
                }
                __get_user(cmlen, &ucmsg->cmsg_len);
                kcmsg = (unsigned long *) ctl_buf;
                *kcmsg++ = (unsigned long)cmlen;
                err = -EFAULT;
-                if(copy_from_user(kcmsg, &ucmsg->cmsg_level,
+                if (copy_from_user(kcmsg, &ucmsg->cmsg_level,
-                                  kern_msg.msg_controllen - sizeof(compat_size_t)))
+                                   ctl_len - sizeof(compat_size_t)))
                        goto out_freectl;
-                kern_msg.msg_control = ctl_buf;
+                msg_sys.msg_control = ctl_buf;
        }
-        kern_msg.msg_flags = solaris_to_linux_msgflags(user_flags);
+        msg_sys.msg_flags = solaris_to_linux_msgflags(user_flags);
-        lock_kernel();
+        if (sock->file->f_flags & O_NONBLOCK)
-        sock = sockfd_lookup(fd, &err);
+                msg_sys.msg_flags |= MSG_DONTWAIT;
-        if (sock != NULL) {
+        err = sock_sendmsg(sock, &msg_sys, total_len);
-                if (sock->file->f_flags & O_NONBLOCK)
-                        kern_msg.msg_flags |= MSG_DONTWAIT;
-                err = sock_sendmsg(sock, &kern_msg, total_len);
-                sockfd_put(sock);
-        }
-        unlock_kernel();
 out_freectl:
-        /* N.B. Use kfree here, as kern_msg.msg_controllen might change? */
+        if (ctl_buf != ctl)    
-        if(ctl_buf != ctl)
+                sock_kfree_s(sock->sk, ctl_buf, ctl_len);
-                kfree(ctl_buf);
 out_freeiov:
-        if(kern_msg.msg_iov != iov)
+        if (iov != iovstack)
-                kfree(kern_msg.msg_iov);
+                sock_kfree_s(sock->sk, iov, iov_size);
-out:
+out_put:
+        sockfd_put(sock);
+out:       
        return err;
 }
 asmlinkage int solaris_recvmsg(int fd, struct sol_nmsghdr __user *user_msg, unsigned int user_flags)
 {
-        struct iovec iovstack[UIO_FASTIOV];
-        struct msghdr kern_msg;
-        char addr[MAX_SOCK_ADDR];
        struct socket *sock;
+        struct iovec iovstack[UIO_FASTIOV];
        struct iovec *iov = iovstack;
+        struct msghdr msg_sys;
+        unsigned long cmsg_ptr;
+        int err, iov_size, total_len, len;
+        /* kernel mode address */
+        char addr[MAX_SOCK_ADDR];
+        /* user mode address pointers */
        struct sockaddr __user *uaddr;
        int __user *uaddr_len;
-        unsigned long cmsg_ptr;
-        int err, total_len, len = 0;
-        if(msghdr_from_user32_to_kern(&kern_msg, user_msg))
+        if (msghdr_from_user32_to_kern(&msg_sys, user_msg))
                return -EFAULT;
-        if(kern_msg.msg_iovlen > UIO_MAXIOV)
-                return -EINVAL;
-        uaddr = kern_msg.msg_name;
+        sock = sockfd_lookup(fd, &err);
+        if (!sock)
+                goto out;
+        err = -EMSGSIZE;
+        if (msg_sys.msg_iovlen > UIO_MAXIOV)
+                goto out_put;
+        /* Check whether to allocate the iovec area*/
+        err = -ENOMEM;
+        iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
+        if (msg_sys.msg_iovlen > UIO_FASTIOV) {
+                iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
+                if (!iov)
+                        goto out_put;
+        }
+        /*
+         *      Save the user-mode address (verify_iovec will change the
+         *      kernel msghdr to use the kernel address space)
+         */
+         
+        uaddr = (void __user *) msg_sys.msg_name;
        uaddr_len = &user_msg->msg_namelen;
-        err = verify_compat_iovec(&kern_msg, iov, addr, VERIFY_WRITE);
+        err = verify_compat_iovec(&msg_sys, iov, addr, VERIFY_WRITE);
        if (err < 0)
-                goto out;
+                goto out_freeiov;
        total_len = err;
-        cmsg_ptr = (unsigned long) kern_msg.msg_control;
+        cmsg_ptr = (unsigned long) msg_sys.msg_control;
-        kern_msg.msg_flags = 0;
+        msg_sys.msg_flags = MSG_CMSG_COMPAT;
-        lock_kernel();
+        if (sock->file->f_flags & O_NONBLOCK)
-        sock = sockfd_lookup(fd, &err);
+                user_flags |= MSG_DONTWAIT;
-        if (sock != NULL) {
-                if (sock->file->f_flags & O_NONBLOCK)
+        err = sock_recvmsg(sock, &msg_sys, total_len, user_flags);
-                        user_flags |= MSG_DONTWAIT;
+        if(err < 0)
-                err = sock_recvmsg(sock, &kern_msg, total_len, user_flags);
+                goto out_freeiov;
-                if(err >= 0)
-                        len = err;
+        len = err;
-                sockfd_put(sock);
-        }
+        if (uaddr != NULL) {
-        unlock_kernel();
+                err = move_addr_to_user(addr, msg_sys.msg_namelen, uaddr, uaddr_len);
+                if (err < 0)
-        if(uaddr != NULL && err >= 0)
+                        goto out_freeiov;
-                err = move_addr_to_user(addr, kern_msg.msg_namelen, uaddr, uaddr_len);
-        if(err >= 0) {
-                err = __put_user(linux_to_solaris_msgflags(kern_msg.msg_flags), &user_msg->msg_flags);
-                if(!err) {
-                        /* XXX Convert cmsg back into userspace 32-bit format... */
-                        err = __put_user((unsigned long)kern_msg.msg_control - cmsg_ptr,
-                                         &user_msg->msg_controllen);
-                }
        }
+        err = __put_user(linux_to_solaris_msgflags(msg_sys.msg_flags), &user_msg->msg_flags);
+        if (err)
+                goto out_freeiov;
+        err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
+                         &user_msg->msg_controllen);
+        if (err)
+                goto out_freeiov;
+        err = len;
-        if(kern_msg.msg_iov != iov)
+out_freeiov:
-                kfree(kern_msg.msg_iov);
+        if (iov != iovstack)
+                sock_kfree_s(sock->sk, iov, iov_size);
+out_put:
+        sockfd_put(sock);
 out:
-        if(err < 0)
+        return err;
-                return err;
-        return len;
 }
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index 6e4807d64d46..b15761ff4101 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -334,7 +334,7 @@ static void __cpuinit tsc_sync_wait(void)
 {
        if (notscsync || !cpu_has_tsc)
                return;
-        sync_tsc(boot_cpu_id);
+        sync_tsc(0);
 }
 static __init int notscsync_setup(char *s)
diff --git a/drivers/acpi/motherboard.c b/drivers/acpi/motherboard.c
index 2934475d67d6..61ea70742d49 100644
--- a/drivers/acpi/motherboard.c
+++ b/drivers/acpi/motherboard.c
@@ -43,7 +43,7 @@ ACPI_MODULE_NAME		("acpi_motherboard")
 */
 #define IS_RESERVED_ADDR(base, len) \
        (((len) > 0) && ((base) > 0) && ((base) + (len) < IO_SPACE_LIMIT) \
-        && ((base) + (len) > 0x1000))
+        && ((base) + (len) > PCIBIOS_MIN_IO))
 /*
 * Clearing the flag (IORESOURCE_BUSY) allows drivers to use
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 7289da3c4db6..0d11d6e6abd6 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -71,7 +71,7 @@ EXPORT_SYMBOL(acpi_in_debugger);
 extern char line_buf[80];
 #endif /*ENABLE_DEBUGGER*/
-int acpi_specific_hotkey_enabled;
+int acpi_specific_hotkey_enabled = TRUE;
 EXPORT_SYMBOL(acpi_specific_hotkey_enabled);
 static unsigned int acpi_irq_irq;
@@ -1162,11 +1162,11 @@ __setup("acpi_wake_gpes_always_on", acpi_wake_gpes_always_on_setup);
 int __init
 acpi_hotkey_setup(char *str)
 {
-        acpi_specific_hotkey_enabled = TRUE;
+        acpi_specific_hotkey_enabled = FALSE;
        return 1;
 }
-__setup("acpi_specific_hotkey", acpi_hotkey_setup);
+__setup("acpi_generic_hotkey", acpi_hotkey_setup);
 /*
 * max_cstate is defined in the base kernel so modules can
diff --git a/drivers/base/class.c b/drivers/base/class.c
index 479c12570881..0154a1623b21 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -299,6 +299,11 @@ static void class_dev_release(struct kobject * kobj)
        pr_debug("device class '%s': release.\n", cd->class_id);
+        if (cd->devt_attr) {
+                kfree(cd->devt_attr);
+                cd->devt_attr = NULL;
+        }
        if (cls->release)
                cls->release(cd);
        else {
@@ -591,11 +596,8 @@ void class_device_del(struct class_device *class_dev)
        if (class_dev->dev)
                sysfs_remove_link(&class_dev->kobj, "device");
-        if (class_dev->devt_attr) {
+        if (class_dev->devt_attr)
                class_device_remove_file(class_dev, class_dev->devt_attr);
-                kfree(class_dev->devt_attr);
-                class_dev->devt_attr = NULL;
-        }
        class_device_remove_attrs(class_dev);
        kobject_hotplug(&class_dev->kobj, KOBJ_REMOVE);
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 42187381506b..850a78c9c4bc 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -261,7 +261,11 @@ static int mmap_mem(struct file * file, struct vm_area_struct * vma)
 static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
-        unsigned long long val;
+        unsigned long pfn;
+        /* Turn a kernel-virtual address into a physical page frame */
+        pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
        /*
         * RED-PEN: on some architectures there is more mapped memory
         * than available in mem_map which pfn_valid checks
@@ -269,10 +273,10 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
         *
         * RED-PEN: vmalloc is not supported right now.
         */
-        if (!pfn_valid(vma->vm_pgoff))
+        if (!pfn_valid(pfn))
                return -EIO;
-        val = (u64)vma->vm_pgoff << PAGE_SHIFT;
-        vma->vm_pgoff = __pa(val) >> PAGE_SHIFT;
+        vma->vm_pgoff = pfn;
        return mmap_mem(file, vma);
 }
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index f975dab1ddf9..a13395e2c372 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -1,5 +1,5 @@
 /*
- *      i8xx_tco 0.07:  TCO timer driver for i8xx chipsets
+ *      i8xx_tco:       TCO timer driver for i8xx chipsets
 *
 *      (c) Copyright 2000 kernel concepts <nils@kernelconcepts.de>, All Rights Reserved.
 *                              http://www.kernelconcepts.de
@@ -63,6 +63,9 @@
 *  20050128 Wim Van Sebroeck <wim@iguana.be>
 *      0.07 Added support for the ICH4-M, ICH6, ICH6R, ICH6-M, ICH6W and ICH6RW
 *           chipsets. Also added support for the "undocumented" ICH7 chipset.
+ *  20050807 Wim Van Sebroeck <wim@iguana.be>
+ *      0.08 Make sure that the watchdog is only "armed" when started.
+ *           (Kernel Bug 4251)
 */
 /*
@@ -87,7 +90,7 @@
 #include "i8xx_tco.h"
 /* Module and version information */
-#define TCO_VERSION "0.07"
+#define TCO_VERSION "0.08"
 #define TCO_MODULE_NAME "i8xx TCO timer"
 #define TCO_DRIVER_NAME   TCO_MODULE_NAME ", v" TCO_VERSION
 #define PFX TCO_MODULE_NAME ": "
@@ -125,10 +128,18 @@ static int tco_timer_start (void)
        unsigned char val;
        spin_lock(&tco_lock);
+        /* disable chipset's NO_REBOOT bit */
+        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val);
+        val &= 0xfd;
+        pci_write_config_byte (i8xx_tco_pci, 0xd4, val);
+        /* Bit 11: TCO Timer Halt -> 0 = The TCO timer is enabled to count */
        val = inb (TCO1_CNT + 1);
        val &= 0xf7;
        outb (val, TCO1_CNT + 1);
        val = inb (TCO1_CNT + 1);
        spin_unlock(&tco_lock);
        if (val & 0x08)
@@ -138,13 +149,20 @@ static int tco_timer_start (void)
 static int tco_timer_stop (void)
 {
-        unsigned char val;
+        unsigned char val, val1;
        spin_lock(&tco_lock);
+        /* Bit 11: TCO Timer Halt -> 1 = The TCO timer is disabled */
        val = inb (TCO1_CNT + 1);
        val |= 0x08;
        outb (val, TCO1_CNT + 1);
        val = inb (TCO1_CNT + 1);
+        /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
+        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val1);
+        val1 |= 0x02;
+        pci_write_config_byte (i8xx_tco_pci, 0xd4, val1);
        spin_unlock(&tco_lock);
        if ((val & 0x08) == 0)
@@ -155,6 +173,7 @@ static int tco_timer_stop (void)
 static int tco_timer_keepalive (void)
 {
        spin_lock(&tco_lock);
+        /* Reload the timer by writing to the TCO Timer Reload register */
        outb (0x01, TCO1_RLD);
        spin_unlock(&tco_lock);
        return 0;
@@ -417,9 +436,8 @@ static unsigned char __init i8xx_tco_getdevice (void)
                        printk (KERN_ERR PFX "failed to get TCOBASE address\n");
                        return 0;
                }
-                /*
-                 * Check chipset's NO_REBOOT bit
+                /* Check chipset's NO_REBOOT bit */
-                 */
                pci_read_config_byte (i8xx_tco_pci, 0xd4, &val1);
                if (val1 & 0x02) {
                        val1 &= 0xfd;
@@ -430,6 +448,10 @@ static unsigned char __init i8xx_tco_getdevice (void)
                                return 0;       /* Cannot reset NO_REBOOT bit */
                        }
                }
+                /* Disable reboots untill the watchdog starts */
+                val1 |= 0x02;
+                pci_write_config_byte (i8xx_tco_pci, 0xd4, val1);
                /* Set the TCO_EN bit in SMI_EN register */
                if (!request_region (SMI_EN + 1, 1, "i8xx TCO")) {
                        printk (KERN_ERR PFX "I/O address 0x%04x already in use\n",
@@ -505,17 +527,10 @@ out:
 static void __exit watchdog_cleanup (void)
 {
-        u8 val;
        /* Stop the timer before we leave */
        if (!nowayout)
                tco_timer_stop ();
-        /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
-        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val);
-        val |= 0x02;
-        pci_write_config_byte (i8xx_tco_pci, 0xd4, val);
        /* Deregister */
        misc_deregister (&i8xx_tco_miscdev);
        unregister_reboot_notifier(&i8xx_tco_notifier);
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 1c99536b673b..fa503ed9f86d 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -23,8 +23,8 @@
 #include <asm/sibyte/sb1250_smbus.h>
 static struct i2c_algo_sibyte_data sibyte_board_data[2] = {
-        { NULL, 0, (void *) (KSEG1+A_SMB_BASE(0)) },
+        { NULL, 0, (void *) (CKSEG1+A_SMB_BASE(0)) },
-        { NULL, 1, (void *) (KSEG1+A_SMB_BASE(1)) }
+        { NULL, 1, (void *) (CKSEG1+A_SMB_BASE(1)) }
 };
 static struct i2c_adapter sibyte_board_adapter[2] = {
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index f9c1acb4ed6a..c9d3a00a3c0c 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -1220,7 +1220,7 @@ static int ide_disk_probe(struct device *dev)
                goto failed;
        g = alloc_disk_node(1 << PARTN_BITS,
-                        pcibus_to_node(drive->hwif->pci_dev->bus));
+                        hwif_to_node(drive->hwif));
        if (!g)
                goto out_free_idkp;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 94daf40ae323..c1128ae5cd2f 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -960,15 +960,6 @@ static void save_match(ide_hwif_t *hwif, ide_hwif_t *new, ide_hwif_t **match)
 }
 #endif /* MAX_HWIFS > 1 */
-static inline int hwif_to_node(ide_hwif_t *hwif)
-{
-        if (hwif->pci_dev)
-                return pcibus_to_node(hwif->pci_dev->bus);
-        else
-                /* Add ways to determine the node of other busses here */
-                return -1;
-}
 /*
 * init request queue
 */
diff --git a/drivers/input/gameport/ns558.c b/drivers/input/gameport/ns558.c
index 1ab5f2dc8a2a..70f051894a3c 100644
--- a/drivers/input/gameport/ns558.c
+++ b/drivers/input/gameport/ns558.c
@@ -275,9 +275,9 @@ static int __init ns558_init(void)
 static void __exit ns558_exit(void)
 {
-        struct ns558 *ns558;
+        struct ns558 *ns558, *safe;
-        list_for_each_entry(ns558, &ns558_list, node) {
+        list_for_each_entry_safe(ns558, safe, &ns558_list, node) {
                gameport_unregister_port(ns558->gameport);
                release_region(ns558->io & ~(ns558->size - 1), ns558->size);
                kfree(ns558);
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index e83256d0fd14..a50a41f6f79d 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -188,7 +188,7 @@ config DVB_BCM3510
          support this frontend.
 config DVB_LGDT330X
-        tristate "LGDT3302 or LGDT3303 based (DViCO FusionHDTV Gold)"
+        tristate "LG Electronics LGDT3302/LGDT3303 based"
        depends on DVB_CORE
        help
          An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
diff --git a/drivers/media/dvb/frontends/lgdt330x.c b/drivers/media/dvb/frontends/lgdt330x.c
index c48e7c11d708..1f1cd7a8d500 100644
--- a/drivers/media/dvb/frontends/lgdt330x.c
+++ b/drivers/media/dvb/frontends/lgdt330x.c
@@ -172,38 +172,6 @@ static int lgdt330x_SwReset(struct lgdt330x_state* state)
        }
 }
-#ifdef MUTE_TDA9887
-static int i2c_write_ntsc_demod (struct lgdt330x_state* state, u8 buf[2])
-{
-        struct i2c_msg msg =
-                { .addr = 0x43,
-                  .flags = 0,
-                  .buf = buf,
-                  .len = 2 };
-        int err;
-        if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err = %i)\n", __FUNCTION__, msg.buf[0], msg.buf[1], err);
-                if (err < 0)
-                        return err;
-                else
-                        return -EREMOTEIO;
-        }
-        return 0;
-}
-static void fiddle_with_ntsc_if_demod(struct lgdt330x_state* state)
-{
-        // Experimental code
-        u8 buf0[] = {0x00, 0x20};
-        u8 buf1[] = {0x01, 0x00};
-        u8 buf2[] = {0x02, 0x00};
-        i2c_write_ntsc_demod(state, buf0);
-        i2c_write_ntsc_demod(state, buf1);
-        i2c_write_ntsc_demod(state, buf2);
-}
-#endif
 static int lgdt330x_init(struct dvb_frontend* fe)
 {
@@ -267,9 +235,6 @@ static int lgdt330x_init(struct dvb_frontend* fe)
                chip_name = "LGDT3303";
                err = i2c_write_demod_bytes(state, lgdt3303_init_data,
                                                                        sizeof(lgdt3303_init_data));
-#ifdef MUTE_TDA9887
-                fiddle_with_ntsc_if_demod(state);
-#endif
                break;
        default:
                chip_name = "undefined";
@@ -772,7 +737,7 @@ error:
 static struct dvb_frontend_ops lgdt3302_ops = {
        .info = {
-                .name= "LG Electronics LGDT3302/LGDT3303 VSB/QAM Frontend",
+                .name= "LG Electronics LGDT3302 VSB/QAM Frontend",
                .type = FE_ATSC,
                .frequency_min= 54000000,
                .frequency_max= 858000000,
diff --git a/drivers/message/i2o/Kconfig b/drivers/message/i2o/Kconfig
index 06e8eb19a05c..43a942a29c2e 100644
--- a/drivers/message/i2o/Kconfig
+++ b/drivers/message/i2o/Kconfig
@@ -53,6 +53,9 @@ config I2O_CONFIG
          To compile this support as a module, choose M here: the
          module will be called i2o_config.
+          Note: If you want to use the new API you have to download the
+          i2o_config patch from http://i2o.shadowconnect.com/
 config I2O_CONFIG_OLD_IOCTL
        bool "Enable ioctls (OBSOLETE)"
        depends on I2O_CONFIG
diff --git a/drivers/message/i2o/config-osm.c b/drivers/message/i2o/config-osm.c
index fe2e7afc9eae..af32ab4e90cd 100644
--- a/drivers/message/i2o/config-osm.c
+++ b/drivers/message/i2o/config-osm.c
@@ -30,503 +30,9 @@
 static struct i2o_driver i2o_config_driver;
-/* Special file operations for sysfs */
-struct fops_attribute {
-        struct bin_attribute bin;
-        struct file_operations fops;
-};
-/**
- *      sysfs_read_dummy
- */
-static ssize_t sysfs_read_dummy(struct kobject *kobj, char *buf, loff_t offset,
-                                size_t count)
-{
-        return 0;
-};
-/**
- *      sysfs_write_dummy
- */
-static ssize_t sysfs_write_dummy(struct kobject *kobj, char *buf, loff_t offset,
-                                 size_t count)
-{
-        return 0;
-};
-/**
- *      sysfs_create_fops_file - Creates attribute with special file operations
- *      @kobj: kobject which should contains the attribute
- *      @attr: attributes which should be used to create file
- *
- *      First creates attribute @attr in kobject @kobj. If it is the first time
- *      this function is called, merge old fops from sysfs with new one and
- *      write it back. Afterwords the new fops will be set for the created
- *      attribute.
- *
- *      Returns 0 on success or negative error code on failure.
- */
-static int sysfs_create_fops_file(struct kobject *kobj,
-                                  struct fops_attribute *attr)
-{
-        struct file_operations tmp, *fops;
-        struct dentry *d;
-        struct qstr qstr;
-        int rc;
-        fops = &attr->fops;
-        if (fops->read)
-                attr->bin.read = sysfs_read_dummy;
-        if (fops->write)
-                attr->bin.write = sysfs_write_dummy;
-        if ((rc = sysfs_create_bin_file(kobj, &attr->bin)))
-                return rc;
-        qstr.name = attr->bin.attr.name;
-        qstr.len = strlen(qstr.name);
-        qstr.hash = full_name_hash(qstr.name, qstr.len);
-        if ((d = lookup_hash(&qstr, kobj->dentry))) {
-                if (!fops->owner) {
-                        memcpy(&tmp, d->d_inode->i_fop, sizeof(tmp));
-                        if (fops->read)
-                                tmp.read = fops->read;
-                        if (fops->write)
-                                tmp.write = fops->write;
-                        memcpy(fops, &tmp, sizeof(tmp));
-                }
-                d->d_inode->i_fop = fops;
-        } else
-                sysfs_remove_bin_file(kobj, &attr->bin);
-        return -ENOENT;
-};
-/**
- *      sysfs_remove_fops_file - Remove attribute with special file operations
- *      @kobj: kobject which contains the attribute
- *      @attr: attributes which are used to create file
- *
- *      Only wrapper arround sysfs_remove_bin_file()
- *
- *      Returns 0 on success or negative error code on failure.
- */
-static inline int sysfs_remove_fops_file(struct kobject *kobj,
-                                         struct fops_attribute *attr)
-{
-        return sysfs_remove_bin_file(kobj, &attr->bin);
-};
-/**
- *      i2o_config_read_hrt - Returns the HRT of the controller
- *      @kob: kernel object handle
- *      @buf: buffer into which the HRT should be copied
- *      @off: file offset
- *      @count: number of bytes to read
- *
- *      Put @count bytes starting at @off into @buf from the HRT of the I2O
- *      controller corresponding to @kobj.
- *
- *      Returns number of bytes copied into buffer.
- */
-static ssize_t i2o_config_read_hrt(struct kobject *kobj, char *buf,
-                                   loff_t offset, size_t count)
-{
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        i2o_hrt *hrt = c->hrt.virt;
-        u32 size = (hrt->num_entries * hrt->entry_len + 2) * 4;
-        if (offset > size)
-                return 0;
-        if (offset + count > size)
-                count = size - offset;
-        memcpy(buf, (u8 *) hrt + offset, count);
-        return count;
-};
-/**
- *      i2o_config_read_lct - Returns the LCT of the controller
- *      @kob: kernel object handle
- *      @buf: buffer into which the LCT should be copied
- *      @off: file offset
- *      @count: number of bytes to read
- *
- *      Put @count bytes starting at @off into @buf from the LCT of the I2O
- *      controller corresponding to @kobj.
- *
- *      Returns number of bytes copied into buffer.
- */
-static ssize_t i2o_config_read_lct(struct kobject *kobj, char *buf,
-                                   loff_t offset, size_t count)
-{
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 size = c->lct->table_size * 4;
-        if (offset > size)
-                return 0;
-        if (offset + count > size)
-                count = size - offset;
-        memcpy(buf, (u8 *) c->lct + offset, count);
-        return count;
-};
-#define I2O_CONFIG_SW_ATTR(_name,_mode,_type,_swid) \
-static ssize_t i2o_config_##_name##_read(struct file *file, char __user *buf, size_t count, loff_t * offset) { \
-        return i2o_config_sw_read(file, buf, count, offset, _type, _swid); \
-};\
-\
-static ssize_t i2o_config_##_name##_write(struct file *file, const char __user *buf, size_t count, loff_t * offset) { \
-        return i2o_config_sw_write(file, buf, count, offset, _type, _swid); \
-}; \
-\
-static struct fops_attribute i2o_config_attr_##_name = { \
-        .bin = { .attr = { .name = __stringify(_name), .mode = _mode, \
-                           .owner = THIS_MODULE }, \
-                 .size = 0, }, \
-        .fops = { .write = i2o_config_##_name##_write, \
-                  .read = i2o_config_##_name##_read} \
-};
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-/**
- *      i2o_config_dpt_reagion - Converts type and id to flash region
- *      @swtype: type of software module reading
- *      @swid: id of software which should be read
- *
- *      Converts type and id from I2O spec to the matching region for DPT /
- *      Adaptec controllers.
- *
- *      Returns region which match type and id or -1 on error.
- */
-static u32 i2o_config_dpt_region(u8 swtype, u8 swid)
-{
-        switch (swtype) {
-        case I2O_SOFTWARE_MODULE_IRTOS:
-                /*
-                 * content: operation firmware
-                 * region size:
-                 *      0xbc000 for 2554, 3754, 2564, 3757
-                 *      0x170000 for 2865
-                 *      0x17c000 for 3966
-                 */
-                if (!swid)
-                        return 0;
-                break;
-        case I2O_SOFTWARE_MODULE_IOP_PRIVATE:
-                /*
-                 * content: BIOS and SMOR
-                 * BIOS size: first 0x8000 bytes
-                 * region size:
-                 *      0x40000 for 2554, 3754, 2564, 3757
-                 *      0x80000 for 2865, 3966
-                 */
-                if (!swid)
-                        return 1;
-                break;
-        case I2O_SOFTWARE_MODULE_IOP_CONFIG:
-                switch (swid) {
-                case 0:
-                        /*
-                         * content: NVRAM defaults
-                         * region size: 0x2000 bytes
-                         */
-                        return 2;
-                case 1:
-                        /*
-                         * content: serial number
-                         * region size: 0x2000 bytes
-                         */
-                        return 3;
-                }
-                break;
-        }
-        return -1;
-};
-#endif
-/**
- *      i2o_config_sw_read - Read a software module from controller
- *      @file: file pointer
- *      @buf: buffer into which the data should be copied
- *      @count: number of bytes to read
- *      @off: file offset
- *      @swtype: type of software module reading
- *      @swid: id of software which should be read
- *
- *      Transfers @count bytes at offset @offset from IOP into buffer using
- *      type @swtype and id @swid as described in I2O spec.
- *
- *      Returns number of bytes copied into buffer or error code on failure.
- */
-static ssize_t i2o_config_sw_read(struct file *file, char __user * buf,
-                                  size_t count, loff_t * offset, u8 swtype,
-                                  u32 swid)
-{
-        struct sysfs_dirent *sd = file->f_dentry->d_parent->d_fsdata;
-        struct kobject *kobj = sd->s_element;
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 m, function = I2O_CMD_SW_UPLOAD;
-        struct i2o_dma buffer;
-        struct i2o_message __iomem *msg;
-        u32 __iomem *mptr;
-        int rc, status;
-        m = i2o_msg_get_wait(c, &msg, I2O_TIMEOUT_MESSAGE_GET);
-        if (m == I2O_QUEUE_EMPTY)
-                return -EBUSY;
-        mptr = &msg->body[3];
-        if ((rc = i2o_dma_alloc(&c->pdev->dev, &buffer, count, GFP_KERNEL))) {
-                i2o_msg_nop(c, m);
-                return rc;
-        }
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                mptr = &msg->body[4];
-                function = I2O_CMD_PRIVATE;
-                writel(TEN_WORD_MSG_SIZE | SGL_OFFSET_8, &msg->u.head[0]);
-                writel(I2O_VENDOR_DPT << 16 | I2O_DPT_FLASH_READ,
-                       &msg->body[0]);
-                writel(i2o_config_dpt_region(swtype, swid), &msg->body[1]);
-                writel(*offset, &msg->body[2]);
-                writel(count, &msg->body[3]);
-        } else
-#endif
-                writel(NINE_WORD_MSG_SIZE | SGL_OFFSET_7, &msg->u.head[0]);
-        writel(0xD0000000 | count, mptr++);
-        writel(buffer.phys, mptr);
-        writel(function << 24 | HOST_TID << 12 | ADAPTER_TID, &msg->u.head[1]);
-        writel(i2o_config_driver.context, &msg->u.head[2]);
-        writel(0, &msg->u.head[3]);
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (!c->adaptec)
-#endif
-        {
-                writel((u32) swtype << 16 | (u32) 1 << 8, &msg->body[0]);
-                writel(0, &msg->body[1]);
-                writel(swid, &msg->body[2]);
-        }
-        status = i2o_msg_post_wait_mem(c, m, 60, &buffer);
-        if (status == I2O_POST_WAIT_OK) {
-                if (!(rc = copy_to_user(buf, buffer.virt, count))) {
-                        rc = count;
-                        *offset += count;
-                }
-        } else
-                rc = -EIO;
-        if (status != -ETIMEDOUT)
-                i2o_dma_free(&c->pdev->dev, &buffer);
-        return rc;
-};
-/**
- *      i2o_config_sw_write - Write a software module to controller
- *      @file: file pointer
- *      @buf: buffer into which the data should be copied
- *      @count: number of bytes to read
- *      @off: file offset
- *      @swtype: type of software module writing
- *      @swid: id of software which should be written
- *
- *      Transfers @count bytes at offset @offset from buffer to IOP using
- *      type @swtype and id @swid as described in I2O spec.
- *
- *      Returns number of bytes copied from buffer or error code on failure.
- */
-static ssize_t i2o_config_sw_write(struct file *file, const char __user * buf,
-                                   size_t count, loff_t * offset, u8 swtype,
-                                   u32 swid)
-{
-        struct sysfs_dirent *sd = file->f_dentry->d_parent->d_fsdata;
-        struct kobject *kobj = sd->s_element;
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 m, function = I2O_CMD_SW_DOWNLOAD;
-        struct i2o_dma buffer;
-        struct i2o_message __iomem *msg;
-        u32 __iomem *mptr;
-        int rc, status;
-        m = i2o_msg_get_wait(c, &msg, I2O_TIMEOUT_MESSAGE_GET);
-        if (m == I2O_QUEUE_EMPTY)
-                return -EBUSY;
-        mptr = &msg->body[3];
-        if ((rc = i2o_dma_alloc(&c->pdev->dev, &buffer, count, GFP_KERNEL)))
-                goto nop_msg;
-        if ((rc = copy_from_user(buffer.virt, buf, count)))
-                goto free_buffer;
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                mptr = &msg->body[4];
-                function = I2O_CMD_PRIVATE;
-                writel(TEN_WORD_MSG_SIZE | SGL_OFFSET_8, &msg->u.head[0]);
-                writel(I2O_VENDOR_DPT << 16 | I2O_DPT_FLASH_WRITE,
-                       &msg->body[0]);
-                writel(i2o_config_dpt_region(swtype, swid), &msg->body[1]);
-                writel(*offset, &msg->body[2]);
-                writel(count, &msg->body[3]);
-        } else
-#endif
-                writel(NINE_WORD_MSG_SIZE | SGL_OFFSET_7, &msg->u.head[0]);
-        writel(0xD4000000 | count, mptr++);
-        writel(buffer.phys, mptr);
-        writel(function << 24 | HOST_TID << 12 | ADAPTER_TID, &msg->u.head[1]);
-        writel(i2o_config_driver.context, &msg->u.head[2]);
-        writel(0, &msg->u.head[3]);
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (!c->adaptec)
-#endif
-        {
-                writel((u32) swtype << 16 | (u32) 1 << 8, &msg->body[0]);
-                writel(0, &msg->body[1]);
-                writel(swid, &msg->body[2]);
-        }
-        status = i2o_msg_post_wait_mem(c, m, 60, &buffer);
-        if (status != -ETIMEDOUT)
-                i2o_dma_free(&c->pdev->dev, &buffer);
-        if (status != I2O_POST_WAIT_OK)
-                return -EIO;
-        *offset += count;
-        return count;
-      free_buffer:
-        i2o_dma_free(&c->pdev->dev, &buffer);
-      nop_msg:
-        i2o_msg_nop(c, m);
-        return rc;
-};
-/* attribute for HRT in sysfs */
-static struct bin_attribute i2o_config_hrt_attr = {
-        .attr = {
-                 .name = "hrt",
-                 .mode = S_IRUGO,
-                 .owner = THIS_MODULE},
-        .size = 0,
-        .read = i2o_config_read_hrt
-};
-/* attribute for LCT in sysfs */
-static struct bin_attribute i2o_config_lct_attr = {
-        .attr = {
-                 .name = "lct",
-                 .mode = S_IRUGO,
-                 .owner = THIS_MODULE},
-        .size = 0,
-        .read = i2o_config_read_lct
-};
-/* IRTOS firmware access */
-I2O_CONFIG_SW_ATTR(irtos, S_IWRSR, I2O_SOFTWARE_MODULE_IRTOS, 0);
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-/*
- * attribute for BIOS / SMOR, nvram and serial number access on DPT / Adaptec
- * controllers
- */
-I2O_CONFIG_SW_ATTR(bios, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_PRIVATE, 0);
-I2O_CONFIG_SW_ATTR(nvram, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_CONFIG, 0);
-I2O_CONFIG_SW_ATTR(serial, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_CONFIG, 1);
-#endif
-/**
- *      i2o_config_notify_controller_add - Notify of added controller
- *      @c: the controller which was added
- *
- *      If a I2O controller is added, we catch the notification to add sysfs
- *      entries.
- */
-static void i2o_config_notify_controller_add(struct i2o_controller *c)
-{
-        struct kobject *kobj = &c->exec->device.kobj;
-        sysfs_create_bin_file(kobj, &i2o_config_hrt_attr);
-        sysfs_create_bin_file(kobj, &i2o_config_lct_attr);
-        sysfs_create_fops_file(kobj, &i2o_config_attr_irtos);
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                sysfs_create_fops_file(kobj, &i2o_config_attr_bios);
-                sysfs_create_fops_file(kobj, &i2o_config_attr_nvram);
-                sysfs_create_fops_file(kobj, &i2o_config_attr_serial);
-        }
-#endif
-};
-/**
- *      i2o_config_notify_controller_remove - Notify of removed controller
- *      @c: the controller which was removed
- *
- *      If a I2O controller is removed, we catch the notification to remove the
- *      sysfs entries.
- */
-static void i2o_config_notify_controller_remove(struct i2o_controller *c)
-{
-        struct kobject *kobj = &c->exec->device.kobj;
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_serial);
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_nvram);
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_bios);
-        }
-#endif
-        sysfs_remove_fops_file(kobj, &i2o_config_attr_irtos);
-        sysfs_remove_bin_file(kobj, &i2o_config_lct_attr);
-        sysfs_remove_bin_file(kobj, &i2o_config_hrt_attr);
-};
 /* Config OSM driver struct */
 static struct i2o_driver i2o_config_driver = {
        .name = OSM_NAME,
-        .notify_controller_add = i2o_config_notify_controller_add,
-        .notify_controller_remove = i2o_config_notify_controller_remove
 };
 #ifdef CONFIG_I2O_CONFIG_OLD_IOCTL
diff --git a/drivers/message/i2o/pci.c b/drivers/message/i2o/pci.c
index 7a60fd7be8ad..66c03e882570 100644
--- a/drivers/message/i2o/pci.c
+++ b/drivers/message/i2o/pci.c
@@ -32,6 +32,8 @@
 #include <linux/i2o.h>
 #include "core.h"
+#define OSM_DESCRIPTION "I2O-subsystem"
 /* PCI device id table for all I2O controllers */
 static struct pci_device_id __devinitdata i2o_pci_ids[] = {
        {PCI_DEVICE_CLASS(PCI_CLASS_INTELLIGENT_I2O << 8, 0xffff00)},
@@ -66,6 +68,8 @@ static void i2o_pci_free(struct i2o_controller *c)
        if (c->base.virt)
                iounmap(c->base.virt);
+        pci_release_regions(c->pdev);
 }
 /**
@@ -84,6 +88,11 @@ static int __devinit i2o_pci_alloc(struct i2o_controller *c)
        struct device *dev = &pdev->dev;
        int i;
+        if (pci_request_regions(pdev, OSM_DESCRIPTION)) {
+                printk(KERN_ERR "%s: device already claimed\n", c->name);
+                return -ENODEV;
+        }
        for (i = 0; i < 6; i++) {
                /* Skip I/O spaces */
                if (!(pci_resource_flags(pdev, i) & IORESOURCE_IO)) {
@@ -138,6 +147,7 @@ static int __devinit i2o_pci_alloc(struct i2o_controller *c)
        c->base.virt = ioremap_nocache(c->base.phys, c->base.len);
        if (!c->base.virt) {
                printk(KERN_ERR "%s: Unable to map controller.\n", c->name);
+                i2o_pci_free(c);
                return -ENOMEM;
        }
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 8b487ed1069c..974f2f36bdbe 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -42,7 +42,7 @@
 #include "wbsd.h"
 #define DRIVER_NAME "wbsd"
-#define DRIVER_VERSION "1.2"
+#define DRIVER_VERSION "1.3"
 #ifdef CONFIG_MMC_DEBUG
 #define DBG(x...) \
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5e5d2c3c7ce4..b82fd15d0891 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3789,6 +3789,7 @@ e1000_netpoll(struct net_device *netdev)
        struct e1000_adapter *adapter = netdev_priv(netdev);
        disable_irq(adapter->pdev->irq);
        e1000_intr(adapter->pdev->irq, netdev, NULL);
+        e1000_clean_tx_irq(adapter);
        enable_irq(adapter->pdev->irq);
 }
 #endif
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index e44f8e9055ef..f9e3be96963c 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -130,12 +130,11 @@ struct sixpack {
 #define AX25_6PACK_HEADER_LEN 0
-static void sp_start_tx_timer(struct sixpack *);
 static void sixpack_decode(struct sixpack *, unsigned char[], int);
 static int encode_sixpack(unsigned char *, unsigned char *, int, unsigned char);
 /*
- * perform the persistence/slottime algorithm for CSMA access. If the
+ * Perform the persistence/slottime algorithm for CSMA access. If the
 * persistence check was successful, write the data to the serial driver.
 * Note that in case of DAMA operation, the data is not sent here.
 */
@@ -143,7 +142,7 @@ static int encode_sixpack(unsigned char *, unsigned char *, int, unsigned char);
 static void sp_xmit_on_air(unsigned long channel)
 {
        struct sixpack *sp = (struct sixpack *) channel;
-        int actual;
+        int actual, when = sp->slottime;
        static unsigned char random;
        random = random * 17 + 41;
@@ -159,20 +158,10 @@ static void sp_xmit_on_air(unsigned long channel)
                sp->tty->driver->write(sp->tty, &sp->led_state, 1);
                sp->status2 = 0;
        } else
-                sp_start_tx_timer(sp);
+                mod_timer(&sp->tx_t, jiffies + ((when + 1) * HZ) / 100);
 }
 /* ----> 6pack timer interrupt handler and friends. <---- */
-static void sp_start_tx_timer(struct sixpack *sp)
-{
-        int when = sp->slottime;
-        del_timer(&sp->tx_t);
-        sp->tx_t.data = (unsigned long) sp;
-        sp->tx_t.function = sp_xmit_on_air;
-        sp->tx_t.expires = jiffies + ((when + 1) * HZ) / 100;
-        add_timer(&sp->tx_t);
-}
 /* Encapsulate one AX.25 frame and stuff into a TTY queue. */
 static void sp_encaps(struct sixpack *sp, unsigned char *icp, int len)
@@ -243,8 +232,7 @@ static void sp_encaps(struct sixpack *sp, unsigned char *icp, int len)
                sp->xleft = count;
                sp->xhead = sp->xbuff;
                sp->status2 = count;
-                if (sp->duplex == 0)
+                sp_xmit_on_air((unsigned long)sp);
-                        sp_start_tx_timer(sp);
        }
        return;
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 46b294a12418..2b92b9e8c910 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
 #ifndef _PCIEHP_H
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index df4915dbc321..cafc7eadcf80 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 0dbcf04aa35e..0e0947601526 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 1cda30bd6e47..7a0e27f0e063 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
index 723b12c0bb7c..33b539b34f7e 100644
--- a/drivers/pci/hotplug/pciehp_pci.c
+++ b/drivers/pci/hotplug/pciehp_pci.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/pciehprm.h b/drivers/pci/hotplug/pciehprm.h
index 966775ffb0ff..05f20fbc5f50 100644
--- a/drivers/pci/hotplug/pciehprm.h
+++ b/drivers/pci/hotplug/pciehprm.h
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/pciehprm_acpi.c b/drivers/pci/hotplug/pciehprm_acpi.c
index 57f4e6d1b27c..305b47ec2f2c 100644
--- a/drivers/pci/hotplug/pciehprm_acpi.c
+++ b/drivers/pci/hotplug/pciehprm_acpi.c
@@ -20,7 +20,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <dely.l.sy@intel.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/pciehprm_nonacpi.c b/drivers/pci/hotplug/pciehprm_nonacpi.c
index 79a0aa6238ef..3622965f8961 100644
--- a/drivers/pci/hotplug/pciehprm_nonacpi.c
+++ b/drivers/pci/hotplug/pciehprm_nonacpi.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/pciehprm_nonacpi.h b/drivers/pci/hotplug/pciehprm_nonacpi.h
index 87c90e85ede9..b10603b0e958 100644
--- a/drivers/pci/hotplug/pciehprm_nonacpi.h
+++ b/drivers/pci/hotplug/pciehprm_nonacpi.h
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
index 67b6a3370ceb..fe4d653da188 100644
--- a/drivers/pci/hotplug/shpchp.h
+++ b/drivers/pci/hotplug/shpchp.h
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
 *
 */
 #ifndef _SHPCHP_H
diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
index a70a5c5705f2..6f7d8a29957a 100644
--- a/drivers/pci/hotplug/shpchp_core.c
+++ b/drivers/pci/hotplug/shpchp_core.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
index 490a9553a062..783b5abb0717 100644
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchp_hpc.c b/drivers/pci/hotplug/shpchp_hpc.c
index 38c5d9066697..8d98410bf1c0 100644
--- a/drivers/pci/hotplug/shpchp_hpc.c
+++ b/drivers/pci/hotplug/shpchp_hpc.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchp_pci.c b/drivers/pci/hotplug/shpchp_pci.c
index 90113e9cd69b..d867099114ec 100644
--- a/drivers/pci/hotplug/shpchp_pci.c
+++ b/drivers/pci/hotplug/shpchp_pci.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchprm.h b/drivers/pci/hotplug/shpchprm.h
index 88aeb978c911..057b192ce589 100644
--- a/drivers/pci/hotplug/shpchprm.h
+++ b/drivers/pci/hotplug/shpchprm.h
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchprm_acpi.c b/drivers/pci/hotplug/shpchprm_acpi.c
index 7957cdc72cd0..d37b31658edf 100644
--- a/drivers/pci/hotplug/shpchprm_acpi.c
+++ b/drivers/pci/hotplug/shpchprm_acpi.c
@@ -20,7 +20,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <dely.l.sy@intel.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchprm_legacy.c b/drivers/pci/hotplug/shpchprm_legacy.c
index 37fa77a98289..ba6c549c9b9d 100644
--- a/drivers/pci/hotplug/shpchprm_legacy.c
+++ b/drivers/pci/hotplug/shpchprm_legacy.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>,<dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>,<kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchprm_legacy.h b/drivers/pci/hotplug/shpchprm_legacy.h
index 29ccea5e57e5..21bda74ddfa5 100644
--- a/drivers/pci/hotplug/shpchprm_legacy.h
+++ b/drivers/pci/hotplug/shpchprm_legacy.h
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchprm_nonacpi.c b/drivers/pci/hotplug/shpchprm_nonacpi.c
index 88f4d9f41886..5f75ef7f3df2 100644
--- a/drivers/pci/hotplug/shpchprm_nonacpi.c
+++ b/drivers/pci/hotplug/shpchprm_nonacpi.c
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/hotplug/shpchprm_nonacpi.h b/drivers/pci/hotplug/shpchprm_nonacpi.h
index 6bc8668023c3..cddaaa5ee1b3 100644
--- a/drivers/pci/hotplug/shpchprm_nonacpi.h
+++ b/drivers/pci/hotplug/shpchprm_nonacpi.h
@@ -23,7 +23,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Send feedback to <greg@kroah.com>, <dely.l.sy@intel.com>
+ * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
 *
 */
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index b5ab9aa6ff7c..2b85aa39f954 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -453,7 +453,7 @@ static void enable_msi_mode(struct pci_dev *dev, int pos, int type)
        }
 }
-static void disable_msi_mode(struct pci_dev *dev, int pos, int type)
+void disable_msi_mode(struct pci_dev *dev, int pos, int type)
 {
        u16 control;
@@ -699,6 +699,9 @@ int pci_enable_msi(struct pci_dev* dev)
        if (!pci_msi_enable || !dev)
                return status;
+        if (dev->no_msi)
+                return status;
        temp = dev->irq;
        if ((status = msi_init()) < 0)
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index d94d7af4f7a0..d00168b1f662 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -47,6 +47,12 @@ extern int pci_msi_quirk;
 #define pci_msi_quirk 0
 #endif
+#ifdef CONFIG_PCI_MSI
+void disable_msi_mode(struct pci_dev *dev, int pos, int type);
+#else
+static inline void disable_msi_mode(struct pci_dev *dev, int pos, int type) { }
+#endif
 extern int pcie_mch_quirk;
 extern struct device_attribute pci_dev_attrs[];
 extern struct class_device_attribute class_device_attr_cpuaffinity;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index a9160ad16581..bb36bb69803f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1291,6 +1291,27 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7520_MCH,	quir
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_E7320_MCH,  quirk_pcie_mch );
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_E7525_MCH,  quirk_pcie_mch );
+/*
+ * It's possible for the MSI to get corrupted if shpc and acpi
+ * are used together on certain PXH-based systems.
+ */
+static void __devinit quirk_pcie_pxh(struct pci_dev *dev)
+{
+        disable_msi_mode(dev, pci_find_capability(dev, PCI_CAP_ID_MSI),
+                                        PCI_CAP_ID_MSI);
+        dev->no_msi = 1;
+        printk(KERN_WARNING "PCI: PXH quirk detected, "
+                "disabling MSI for SHPC device\n");
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXHD_0,     quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXHD_1,     quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXH_0,      quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXH_1,      quirk_pcie_pxh);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_PXHV,       quirk_pcie_pxh);
 static void __devinit quirk_netmos(struct pci_dev *dev)
 {
        unsigned int num_parallel = (dev->subsystem_device & 0xf0) >> 4;
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index b8a2c7353b0a..d44205d52bf3 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -7,6 +7,7 @@
 #define __KERNEL_SYSCALLS__
 #include <linux/kernel.h>
+#include <linux/kthread.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
@@ -459,10 +460,6 @@ static struct task_struct *kenvctrld_task;
 static int kenvctrld(void *__unused)
 {
-        daemonize("kenvctrld");
-        allow_signal(SIGKILL);
-        kenvctrld_task = current;
        printk(KERN_INFO "bbc_envctrl: kenvctrld starting...\n");
        last_warning_jiffies = jiffies - WARN_INTERVAL;
        for (;;) {
@@ -470,7 +467,7 @@ static int kenvctrld(void *__unused)
                struct bbc_fan_control *fp;
                msleep_interruptible(POLL_INTERVAL);
-                if (signal_pending(current))
+                if (kthread_should_stop())
                        break;
                for (tp = all_bbc_temps; tp; tp = tp->next) {
@@ -577,7 +574,6 @@ int bbc_envctrl_init(void)
        int temp_index = 0;
        int fan_index = 0;
        int devidx = 0;
-        int err = 0;
        while ((echild = bbc_i2c_getdev(devidx++)) != NULL) {
                if (!strcmp(echild->prom_name, "temperature"))
@@ -585,9 +581,13 @@ int bbc_envctrl_init(void)
                if (!strcmp(echild->prom_name, "fan-control"))
                        attach_one_fan(echild, fan_index++);
        }
-        if (temp_index != 0 && fan_index != 0)
+        if (temp_index != 0 && fan_index != 0) {
-                err = kernel_thread(kenvctrld, NULL, CLONE_FS | CLONE_FILES);
+                kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
-        return err;
+                if (IS_ERR(kenvctrld_task))
+                        return PTR_ERR(kenvctrld_task);
+        }
+        return 0;
 }
 static void destroy_one_temp(struct bbc_cpu_temperature *tp)
@@ -607,26 +607,7 @@ void bbc_envctrl_cleanup(void)
        struct bbc_cpu_temperature *tp;
        struct bbc_fan_control *fp;
-        if (kenvctrld_task != NULL) {
+        kthread_stop(kenvctrld_task);
-                force_sig(SIGKILL, kenvctrld_task);
-                for (;;) {
-                        struct task_struct *p;
-                        int found = 0;
-                        read_lock(&tasklist_lock);
-                        for_each_process(p) {
-                                if (p == kenvctrld_task) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                        read_unlock(&tasklist_lock);
-                        if (!found)
-                                break;
-                        msleep(1000);
-                }
-                kenvctrld_task = NULL;
-        }
        tp = all_bbc_temps;
        while (tp != NULL) {
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 9a8c572554f5..d765cc1bf060 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -24,6 +24,7 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/kthread.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
@@ -1010,16 +1011,13 @@ static int kenvctrld(void *__unused)
        poll_interval = 5000; /* TODO env_mon_interval */
-        daemonize("kenvctrld");
-        allow_signal(SIGKILL);
-        kenvctrld_task = current;
        printk(KERN_INFO "envctrl: %s starting...\n", current->comm);
        for (;;) {
-                if(msleep_interruptible(poll_interval))
+                msleep_interruptible(poll_interval);
-                        break;
+                if (kthread_should_stop())
+                        break;
+                
                for (whichcpu = 0; whichcpu < ENVCTRL_MAX_CPU; ++whichcpu) {
                        if (0 < envctrl_read_cpu_info(whichcpu, cputemp,
                                                      ENVCTRL_CPUTEMP_MON,
@@ -1041,7 +1039,6 @@ static int kenvctrld(void *__unused)
 static int __init envctrl_init(void)
 {
-#ifdef CONFIG_PCI
        struct linux_ebus *ebus = NULL;
        struct linux_ebus_device *edev = NULL;
        struct linux_ebus_child *edev_child = NULL;
@@ -1118,9 +1115,11 @@ done:
                        i2c_childlist[i].addr, (0 == i) ? ("\n") : (" "));
        }
-        err = kernel_thread(kenvctrld, NULL, CLONE_FS | CLONE_FILES);
+        kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
-        if (err < 0)
+        if (IS_ERR(kenvctrld_task)) {
+                err = PTR_ERR(kenvctrld_task);
                goto out_deregister;
+        }
        return 0;
@@ -1133,37 +1132,13 @@ out_iounmap:
                        kfree(i2c_childlist[i].tables);
        }
        return err;
-#else
-        return -ENODEV;
-#endif
 }
 static void __exit envctrl_cleanup(void)
 {
        int i;
-        if (NULL != kenvctrld_task) {
+        kthread_stop(kenvctrld_task);
-                force_sig(SIGKILL, kenvctrld_task);
-                for (;;) {
-                        struct task_struct *p;
-                        int found = 0;
-                        read_lock(&tasklist_lock);
-                        for_each_process(p) {
-                                if (p == kenvctrld_task) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                        read_unlock(&tasklist_lock);
-                        if (!found)
-                                break;
-                        msleep(1000);
-                }
-                kenvctrld_task = NULL;
-        }
        iounmap(i2c);
        misc_deregister(&envctrl_dev);
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 929170dcd3cb..600ba1202864 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -183,7 +183,7 @@
 * cross a page boundy.
 */
 #define SEGMENTX_LEN    (sizeof(struct SGentry)*DC395x_MAX_SG_LISTENTRY)
-#define VIRTX_LEN       (sizeof(void *) * DC395x_MAX_SG_LISTENTRY)
 struct SGentry {
        u32 address;            /* bus! address */
@@ -235,7 +235,6 @@ struct ScsiReqBlk {
        u8 sg_count;                    /* No of HW sg entries for this request */
        u8 sg_index;                    /* Index of HW sg entry for this request */
        u32 total_xfer_length;          /* Total number of bytes remaining to be transfered */
-        void **virt_map;
        unsigned char *virt_addr;       /* Virtual address of current transfer position */
        /*
@@ -1022,14 +1021,14 @@ static void build_srb(struct scsi_cmnd *cmd, struct DeviceCtlBlk *dcb,
                        reqlen, cmd->request_buffer, cmd->use_sg,
                        srb->sg_count);
+                srb->virt_addr = page_address(sl->page);
                for (i = 0; i < srb->sg_count; i++) {
-                        u32 seglen = (u32)sg_dma_len(sl + i);
+                        u32 busaddr = (u32)sg_dma_address(&sl[i]);
-                        sgp[i].address = (u32)sg_dma_address(sl + i);
+                        u32 seglen = (u32)sl[i].length;
+                        sgp[i].address = busaddr;
                        sgp[i].length = seglen;
                        srb->total_xfer_length += seglen;
-                        srb->virt_map[i] = kmap(sl[i].page);
                }
-                srb->virt_addr = srb->virt_map[0];
                sgp += srb->sg_count - 1;
                /*
@@ -1976,7 +1975,6 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
        int segment = cmd->use_sg;
        u32 xferred = srb->total_xfer_length - left; /* bytes transfered */
        struct SGentry *psge = srb->segment_x + srb->sg_index;
-        void **virt = srb->virt_map;
        dprintkdbg(DBG_0,
                "sg_update_list: Transfered %i of %i bytes, %i remain\n",
@@ -2016,16 +2014,16 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
        /* We have to walk the scatterlist to find it */
        sg = (struct scatterlist *)cmd->request_buffer;
-        idx = 0;
        while (segment--) {
                unsigned long mask =
                    ~((unsigned long)sg->length - 1) & PAGE_MASK;
                if ((sg_dma_address(sg) & mask) == (psge->address & mask)) {
-                        srb->virt_addr = virt[idx] + (psge->address & ~PAGE_MASK);
+                        srb->virt_addr = (page_address(sg->page)
+                                           + psge->address -
+                                           (psge->address & PAGE_MASK));
                        return;
                }
                ++sg;
-                ++idx;
        }
        dprintkl(KERN_ERR, "sg_update_list: sg_to_virt failed\n");
@@ -2151,7 +2149,7 @@ static void data_out_phase0(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb,
                                DC395x_read32(acb, TRM_S1040_DMA_CXCNT));
                }
                /*
-                 * calculate all the residue data that not yet transfered
+                 * calculate all the residue data that not yet tranfered
                 * SCSI transfer counter + left in SCSI FIFO data
                 *
                 * .....TRM_S1040_SCSI_COUNTER (24bits)
@@ -3269,7 +3267,6 @@ static void pci_unmap_srb(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb)
        struct scsi_cmnd *cmd = srb->cmd;
        enum dma_data_direction dir = cmd->sc_data_direction;
        if (cmd->use_sg && dir != PCI_DMA_NONE) {
-                int i;
                /* unmap DC395x SG list */
                dprintkdbg(DBG_SG, "pci_unmap_srb: list=%08x(%05x)\n",
                        srb->sg_bus_addr, SEGMENTX_LEN);
@@ -3279,8 +3276,6 @@ static void pci_unmap_srb(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb)
                dprintkdbg(DBG_SG, "pci_unmap_srb: segs=%i buffer=%p\n",
                        cmd->use_sg, cmd->request_buffer);
                /* unmap the sg segments */
-                for (i = 0; i < srb->sg_count; i++)
-                        kunmap(virt_to_page(srb->virt_map[i]));
                pci_unmap_sg(acb->dev,
                             (struct scatterlist *)cmd->request_buffer,
                             cmd->use_sg, dir);
@@ -3327,7 +3322,7 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
        if (cmd->use_sg) {
                struct scatterlist* sg = (struct scatterlist *)cmd->request_buffer;
-                ptr = (struct ScsiInqData *)(srb->virt_map[0] + sg->offset);
+                ptr = (struct ScsiInqData *)(page_address(sg->page) + sg->offset);
        } else {
                ptr = (struct ScsiInqData *)(cmd->request_buffer);
        }
@@ -4262,9 +4257,8 @@ static void adapter_sg_tables_free(struct AdapterCtlBlk *acb)
        const unsigned srbs_per_page = PAGE_SIZE/SEGMENTX_LEN;
        for (i = 0; i < DC395x_MAX_SRB_CNT; i += srbs_per_page)
-                kfree(acb->srb_array[i].segment_x);
+                if (acb->srb_array[i].segment_x)
+                        kfree(acb->srb_array[i].segment_x);
-        vfree(acb->srb_array[0].virt_map);
 }
@@ -4280,12 +4274,9 @@ static int __devinit adapter_sg_tables_alloc(struct AdapterCtlBlk *acb)
        int srb_idx = 0;
        unsigned i = 0;
        struct SGentry *ptr;
-        void **virt_array;
-        for (i = 0; i < DC395x_MAX_SRB_CNT; i++) {
+        for (i = 0; i < DC395x_MAX_SRB_CNT; i++)
                acb->srb_array[i].segment_x = NULL;
-                acb->srb_array[i].virt_map = NULL;
-        }
        dprintkdbg(DBG_1, "Allocate %i pages for SG tables\n", pages);
        while (pages--) {
@@ -4306,19 +4297,6 @@ static int __devinit adapter_sg_tables_alloc(struct AdapterCtlBlk *acb)
                    ptr + (i * DC395x_MAX_SG_LISTENTRY);
        else
                dprintkl(KERN_DEBUG, "No space for tmsrb SG table reserved?!\n");
-        virt_array = vmalloc((DC395x_MAX_SRB_CNT + 1) * DC395x_MAX_SG_LISTENTRY * sizeof(void*));
-        if (!virt_array) {
-                adapter_sg_tables_free(acb);
-                return 1;
-        }
-        for (i = 0; i < DC395x_MAX_SRB_CNT + 1; i++) {
-                acb->srb_array[i].virt_map = virt_array;
-                virt_array += DC395x_MAX_SG_LISTENTRY;
-        }
        return 0;
 }
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index e2370529c632..7235f94f1191 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -907,9 +907,13 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
                raptorFlag = TRUE;
        }
+        if (pci_request_regions(pDev, "dpt_i2o")) {
+                PERROR("dpti: adpt_config_hba: pci request region failed\n");
+                return -EINVAL;
+        }
        base_addr_virt = ioremap(base_addr0_phys,hba_map0_area_size);
        if (!base_addr_virt) {
+                pci_release_regions(pDev);
                PERROR("dpti: adpt_config_hba: io remap failed\n");
                return -EINVAL;
        }
@@ -919,6 +923,7 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
                if (!msg_addr_virt) {
                        PERROR("dpti: adpt_config_hba: io remap failed on BAR1\n");
                        iounmap(base_addr_virt);
+                        pci_release_regions(pDev);
                        return -EINVAL;
                }
        } else {
@@ -932,6 +937,7 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
                        iounmap(msg_addr_virt);
                }
                iounmap(base_addr_virt);
+                pci_release_regions(pDev);
                return -ENOMEM;
        }
        memset(pHba, 0, sizeof(adpt_hba));
@@ -1027,6 +1033,7 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba)
        up(&adpt_configuration_lock);
        iounmap(pHba->base_addr_virt);
+        pci_release_regions(pHba->pDev);
        if(pHba->msg_addr_virt != pHba->base_addr_virt){
                iounmap(pHba->msg_addr_virt);
        }
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 794fb559efb0..6a75ec2187fd 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -385,6 +385,7 @@ int ata_scsi_error(struct Scsi_Host *host)
         * appropriate place
         */
        host->host_failed--;
+        INIT_LIST_HEAD(&host->eh_cmd_q);
        DPRINTK("EXIT\n");
        return 0;
diff --git a/drivers/scsi/sata_sx4.c b/drivers/scsi/sata_sx4.c
index 140cea05de3f..efd7d7a61135 100644
--- a/drivers/scsi/sata_sx4.c
+++ b/drivers/scsi/sata_sx4.c
@@ -468,7 +468,7 @@ static void pdc20621_dma_prep(struct ata_queued_cmd *qc)
        for (i = 0; i < last; i++) {
                buf[idx++] = cpu_to_le32(sg_dma_address(&sg[i]));
                buf[idx++] = cpu_to_le32(sg_dma_len(&sg[i]));
-                total_len += sg[i].length;
+                total_len += sg_dma_len(&sg[i]);
        }
        buf[idx - 1] |= cpu_to_le32(ATA_PRD_EOT);
        sgt_len = idx * 4;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 2d3c4ac475f2..48edd67982a5 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -336,9 +336,23 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
        unsigned long flags;
        const int size = sizeof(struct scsi_target)
                + shost->transportt->target_size;
-        struct scsi_target *starget = kmalloc(size, GFP_ATOMIC);
+        struct scsi_target *starget;
        struct scsi_target *found_target;
+        /*
+         * Obtain the real parent from the transport. The transport
+         * is allowed to fail (no error) if there is nothing at that
+         * target id.
+         */
+        if (shost->transportt->target_parent) {
+                spin_lock_irqsave(shost->host_lock, flags);
+                parent = shost->transportt->target_parent(shost, channel, id);
+                spin_unlock_irqrestore(shost->host_lock, flags);
+                if (!parent)
+                        return NULL;
+        }
+        starget = kmalloc(size, GFP_KERNEL);
        if (!starget) {
                printk(KERN_ERR "%s: allocation failure\n", __FUNCTION__);
                return NULL;
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 35d1c1e8e345..e6412fce423c 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -1022,6 +1022,23 @@ static int fc_rport_match(struct attribute_container *cont,
        return &i->rport_attr_cont.ac == cont;
 }
+/*
+ * Must be called with shost->host_lock held
+ */
+static struct device *fc_target_parent(struct Scsi_Host *shost,
+                                        int channel, uint id)
+{
+        struct fc_rport *rport;
+        list_for_each_entry(rport, &fc_host_rports(shost), peers)
+                if ((rport->channel == channel) &&
+                    (rport->scsi_target_id == id))
+                        return &rport->dev;
+        return NULL;
+}
 struct scsi_transport_template *
 fc_attach_transport(struct fc_function_template *ft)
 {
@@ -1057,6 +1074,8 @@ fc_attach_transport(struct fc_function_template *ft)
        /* Transport uses the shost workq for scsi scanning */
        i->t.create_work_queue = 1;
+        i->t.target_parent = fc_target_parent;
        
        /*
         * Setup SCSI Target Attributes.
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index 5f6187baad86..73c8a088c160 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -40,13 +40,15 @@
 #define TX_NUM_FIFO     4
 #define TX_BUF_SIZE     32
+#define SCC_WAIT_CLOSING 100
 struct uart_cpm_port {
        struct uart_port        port;
-        u16                     rx_nrfifos;     
+        u16                     rx_nrfifos;
        u16                     rx_fifosize;
-        u16                     tx_nrfifos;     
+        u16                     tx_nrfifos;
        u16                     tx_fifosize;
-        smc_t                   *smcp;  
+        smc_t                   *smcp;
        smc_uart_t              *smcup;
        scc_t                   *sccp;
        scc_uart_t              *sccup;
@@ -67,6 +69,8 @@ struct uart_cpm_port {
        int                      bits;
        /* Keep track of 'odd' SMC2 wirings */
        int                     is_portb;
+        /* wait on close if needed */
+        int                     wait_closing;
 };
 extern int cpm_uart_port_map[UART_NR];
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 29db677d4284..d639ac92a117 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -9,9 +9,10 @@
 *
 *  Maintainer: Kumar Gala (kumar.gala@freescale.com) (CPM2)
 *              Pantelis Antoniou (panto@intracom.gr) (CPM1)
- * 
+ *
 *  Copyright (C) 2004 Freescale Semiconductor, Inc.
 *            (C) 2004 Intracom, S.A.
+ *            (C) 2005 MontaVista Software, Inc. by Vitaly Bordug <vbordug@ru.mvista.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -70,8 +71,22 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo);
 /**************************************************************/
+static inline unsigned long cpu2cpm_addr(void *addr)
+{
+        if ((unsigned long)addr >= CPM_ADDR)
+                return (unsigned long)addr;
+        return virt_to_bus(addr);
+}
+static inline void *cpm2cpu_addr(unsigned long addr)
+{
+        if (addr >= CPM_ADDR)
+                return (void *)addr;
+        return bus_to_virt(addr);
+}
 /*
- * Check, if transmit buffers are processed             
+ * Check, if transmit buffers are processed
 */
 static unsigned int cpm_uart_tx_empty(struct uart_port *port)
 {
@@ -143,15 +158,18 @@ static void cpm_uart_start_tx(struct uart_port *port, unsigned int tty_start)
        }
        if (cpm_uart_tx_pump(port) != 0) {
-                if (IS_SMC(pinfo))
+                if (IS_SMC(pinfo)) {
                        smcp->smc_smcm |= SMCM_TX;
-                else
+                        smcp->smc_smcmr |= SMCMR_TEN;
+                } else {
                        sccp->scc_sccm |= UART_SCCM_TX;
+                        pinfo->sccp->scc_gsmrl |= SCC_GSMRL_ENT;
+                }
        }
 }
 /*
- * Stop receiver 
+ * Stop receiver
 */
 static void cpm_uart_stop_rx(struct uart_port *port)
 {
@@ -176,7 +194,7 @@ static void cpm_uart_enable_ms(struct uart_port *port)
 }
 /*
- * Generate a break. 
+ * Generate a break.
 */
 static void cpm_uart_break_ctl(struct uart_port *port, int break_state)
 {
@@ -231,7 +249,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                /* get number of characters, and check spce in flip-buffer */
                i = bdp->cbd_datlen;
-                /* If we have not enough room in tty flip buffer, then we try 
+                /* If we have not enough room in tty flip buffer, then we try
                 * later, which will be the next rx-interrupt or a timeout
                 */
                if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE) {
@@ -243,7 +261,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                }
                /* get pointer */
-                cp = (unsigned char *)bus_to_virt(bdp->cbd_bufaddr);
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
                /* loop through the buffer */
                while (i-- > 0) {
@@ -265,13 +283,14 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                }               /* End while (i--) */
                /* This BD is ready to be used again. Clear status. get next */
-                bdp->cbd_sc &= ~(BD_SC_BR | BD_SC_FR | BD_SC_PR | BD_SC_OV);
+                bdp->cbd_sc &= ~(BD_SC_BR | BD_SC_FR | BD_SC_PR | BD_SC_OV | BD_SC_ID);
                bdp->cbd_sc |= BD_SC_EMPTY;
                if (bdp->cbd_sc & BD_SC_WRAP)
                        bdp = pinfo->rx_bd_base;
                else
                        bdp++;
        } /* End for (;;) */
        /* Write back buffer pointer */
@@ -336,22 +355,22 @@ static irqreturn_t cpm_uart_int(int irq, void *data, struct pt_regs *regs)
        if (IS_SMC(pinfo)) {
                events = smcp->smc_smce;
+                smcp->smc_smce = events;
                if (events & SMCM_BRKE)
                        uart_handle_break(port);
                if (events & SMCM_RX)
                        cpm_uart_int_rx(port, regs);
                if (events & SMCM_TX)
                        cpm_uart_int_tx(port, regs);
-                smcp->smc_smce = events;
        } else {
                events = sccp->scc_scce;
+                sccp->scc_scce = events;
                if (events & UART_SCCM_BRKE)
                        uart_handle_break(port);
                if (events & UART_SCCM_RX)
                        cpm_uart_int_rx(port, regs);
                if (events & UART_SCCM_TX)
                        cpm_uart_int_tx(port, regs);
-                sccp->scc_scce = events;
        }
        return (events) ? IRQ_HANDLED : IRQ_NONE;
 }
@@ -360,6 +379,7 @@ static int cpm_uart_startup(struct uart_port *port)
 {
        int retval;
        struct uart_cpm_port *pinfo = (struct uart_cpm_port *)port;
+        int line = pinfo - cpm_uart_ports;
        pr_debug("CPM uart[%d]:startup\n", port->line);
@@ -376,9 +396,19 @@ static int cpm_uart_startup(struct uart_port *port)
                pinfo->sccp->scc_sccm |= UART_SCCM_RX;
        }
+        if (!(pinfo->flags & FLAG_CONSOLE))
+                cpm_line_cr_cmd(line,CPM_CR_INIT_TRX);
        return 0;
 }
+inline void cpm_uart_wait_until_send(struct uart_cpm_port *pinfo)
+{
+        unsigned long target_jiffies = jiffies + pinfo->wait_closing;
+        while (!time_after(jiffies, target_jiffies))
+                schedule();
+}
 /*
 * Shutdown the uart
 */
@@ -394,6 +424,12 @@ static void cpm_uart_shutdown(struct uart_port *port)
        /* If the port is not the console, disable Rx and Tx. */
        if (!(pinfo->flags & FLAG_CONSOLE)) {
+                /* Wait for all the BDs marked sent */
+                while(!cpm_uart_tx_empty(port))
+                        schedule_timeout(2);
+                if(pinfo->wait_closing)
+                        cpm_uart_wait_until_send(pinfo);
                /* Stop uarts */
                if (IS_SMC(pinfo)) {
                        volatile smc_t *smcp = pinfo->smcp;
@@ -502,7 +538,7 @@ static void cpm_uart_set_termios(struct uart_port *port,
         */
        if ((termios->c_cflag & CREAD) == 0)
                port->read_status_mask &= ~BD_SC_EMPTY;
-        
        spin_lock_irqsave(&port->lock, flags);
        /* Start bit has not been added (so don't, because we would just
@@ -569,7 +605,8 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                /* Pick next descriptor and fill from buffer */
                bdp = pinfo->tx_cur;
-                p = bus_to_virt(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr);
                *p++ = xmit->buf[xmit->tail];
                bdp->cbd_datlen = 1;
                bdp->cbd_sc |= BD_SC_READY;
@@ -595,7 +632,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
        while (!(bdp->cbd_sc & BD_SC_READY) && (xmit->tail != xmit->head)) {
                count = 0;
-                p = bus_to_virt(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr);
                while (count < pinfo->tx_fifosize) {
                        *p++ = xmit->buf[xmit->tail];
                        xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
@@ -606,6 +643,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                }
                bdp->cbd_datlen = count;
                bdp->cbd_sc |= BD_SC_READY;
+                __asm__("eieio");
                /* Get next BD. */
                if (bdp->cbd_sc & BD_SC_WRAP)
                        bdp = pinfo->tx_bd_base;
@@ -643,12 +681,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
        mem_addr = pinfo->mem_addr;
        bdp = pinfo->rx_cur = pinfo->rx_bd_base;
        for (i = 0; i < (pinfo->rx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
                bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT;
                mem_addr += pinfo->rx_fifosize;
        }
-        
-        bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
        bdp->cbd_sc = BD_SC_WRAP | BD_SC_EMPTY | BD_SC_INTRPT;
        /* Set the physical address of the host memory
@@ -658,12 +696,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
        mem_addr = pinfo->mem_addr + L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize);
        bdp = pinfo->tx_cur = pinfo->tx_bd_base;
        for (i = 0; i < (pinfo->tx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
                bdp->cbd_sc = BD_SC_INTRPT;
                mem_addr += pinfo->tx_fifosize;
        }
-        
-        bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
        bdp->cbd_sc = BD_SC_WRAP | BD_SC_INTRPT;
 }
@@ -763,6 +801,8 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
        /* Using idle charater time requires some additional tuning.  */
        up->smc_mrblr = pinfo->rx_fifosize;
        up->smc_maxidl = pinfo->rx_fifosize;
+        up->smc_brklen = 0;
+        up->smc_brkec = 0;
        up->smc_brkcr = 1;
        cpm_line_cr_cmd(line, CPM_CR_INIT_TRX);
@@ -796,7 +836,7 @@ static int cpm_uart_request_port(struct uart_port *port)
        /*
         * Setup any port IO, connect any baud rate generators,
         * etc.  This is expected to be handled by board
-         * dependant code 
+         * dependant code
         */
        if (pinfo->set_lineif)
                pinfo->set_lineif(pinfo);
@@ -815,6 +855,10 @@ static int cpm_uart_request_port(struct uart_port *port)
                return ret;
        cpm_uart_initbd(pinfo);
+        if (IS_SMC(pinfo))
+                cpm_uart_init_smc(pinfo);
+        else
+                cpm_uart_init_scc(pinfo);
        return 0;
 }
@@ -869,7 +913,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                .flags = FLAG_SMC,
                .tx_nrfifos = TX_NUM_FIFO,
                .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                .rx_fifosize = RX_BUF_SIZE,
                .set_lineif = smc1_lineif,
        },
@@ -883,7 +927,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                .flags = FLAG_SMC,
                .tx_nrfifos = TX_NUM_FIFO,
                .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                .rx_fifosize = RX_BUF_SIZE,
                .set_lineif = smc2_lineif,
 #ifdef CONFIG_SERIAL_CPM_ALT_SMC2
@@ -899,9 +943,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                },
                .tx_nrfifos = TX_NUM_FIFO,
                .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                .rx_fifosize = RX_BUF_SIZE,
                .set_lineif = scc1_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
        },
        [UART_SCC2] = {
                .port = {
@@ -912,9 +957,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                },
                .tx_nrfifos = TX_NUM_FIFO,
                .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                .rx_fifosize = RX_BUF_SIZE,
                .set_lineif = scc2_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
        },
        [UART_SCC3] = {
                .port = {
@@ -925,9 +971,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                },
                .tx_nrfifos = TX_NUM_FIFO,
                .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                .rx_fifosize = RX_BUF_SIZE,
                .set_lineif = scc3_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
        },
        [UART_SCC4] = {
                .port = {
@@ -938,9 +985,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                },
                .tx_nrfifos = TX_NUM_FIFO,
                .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                .rx_fifosize = RX_BUF_SIZE,
                .set_lineif = scc4_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
        },
 };
@@ -983,11 +1031,8 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                 * If the buffer address is in the CPM DPRAM, don't
                 * convert it.
                 */
-                if ((uint) (bdp->cbd_bufaddr) > (uint) CPM_ADDR)
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
-                        cp = (unsigned char *) (bdp->cbd_bufaddr);
-                else
-                        cp = bus_to_virt(bdp->cbd_bufaddr);
-                
                *cp = *s;
                bdp->cbd_datlen = 1;
@@ -1003,10 +1048,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                        while ((bdp->cbd_sc & BD_SC_READY) != 0)
                                ;
-                        if ((uint) (bdp->cbd_bufaddr) > (uint) CPM_ADDR)
+                        cp = cpm2cpu_addr(bdp->cbd_bufaddr);
-                                cp = (unsigned char *) (bdp->cbd_bufaddr);
-                        else
-                                cp = bus_to_virt(bdp->cbd_bufaddr);
                        *cp = 13;
                        bdp->cbd_datlen = 1;
@@ -1045,7 +1087,7 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
        port =
            (struct uart_port *)&cpm_uart_ports[cpm_uart_port_map[co->index]];
        pinfo = (struct uart_cpm_port *)port;
-        
        pinfo->flags |= FLAG_CONSOLE;
        if (options) {
@@ -1062,7 +1104,7 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
        /*
         * Setup any port IO, connect any baud rate generators,
         * etc.  This is expected to be handled by board
-         * dependant code 
+         * dependant code
         */
        if (pinfo->set_lineif)
                pinfo->set_lineif(pinfo);
@@ -1092,14 +1134,14 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
        return 0;
 }
-extern struct uart_driver cpm_reg;
+static struct uart_driver cpm_reg;
 static struct console cpm_scc_uart_console = {
-        .name           "ttyCPM",
+        .name           = "ttyCPM",
-        .write          cpm_uart_console_write,
+        .write          = cpm_uart_console_write,
-        .device         uart_console_device,
+        .device         = uart_console_device,
-        .setup          cpm_uart_console_setup,
+        .setup          = cpm_uart_console_setup,
-        .flags          CON_PRINTBUFFER,
+        .flags          = CON_PRINTBUFFER,
-        .index          -1,
+        .index          = -1,
        .data           = &cpm_reg,
 };
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index 8efbd6d1d6a4..4b0786e7eb7f 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -5,7 +5,7 @@
 *
 *  Maintainer: Kumar Gala (kumar.gala@freescale.com) (CPM2)
 *              Pantelis Antoniou (panto@intracom.gr) (CPM1)
- * 
+ *
 *  Copyright (C) 2004 Freescale Semiconductor, Inc.
 *            (C) 2004 Intracom, S.A.
 *
@@ -82,6 +82,17 @@ void cpm_line_cr_cmd(int line, int cmd)
 void smc1_lineif(struct uart_cpm_port *pinfo)
 {
        volatile cpm8xx_t *cp = cpmp;
+        (void)cp;       /* fix warning */
+#if defined (CONFIG_MPC885ADS)
+        /* Enable SMC1 transceivers */
+        {
+                cp->cp_pepar |= 0x000000c0;
+                cp->cp_pedir &= ~0x000000c0;
+                cp->cp_peso &= ~0x00000040;
+                cp->cp_peso |= 0x00000080;
+        }
+#elif defined (CONFIG_MPC86XADS)
        unsigned int iobits = 0x000000c0;
        if (!pinfo->is_portb) {
@@ -93,41 +104,33 @@ void smc1_lineif(struct uart_cpm_port *pinfo)
                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
        }
-#ifdef CONFIG_MPC885ADS
-        /* Enable SMC1 transceivers */
-        {
-                volatile uint __iomem *bcsr1 = ioremap(BCSR1, 4);
-                uint tmp;
-                tmp = in_be32(bcsr1);
-                tmp &= ~BCSR1_RS232EN_1;
-                out_be32(bcsr1, tmp);
-                iounmap(bcsr1);
-        }
 #endif
        pinfo->brg = 1;
 }
 void smc2_lineif(struct uart_cpm_port *pinfo)
 {
-#ifdef CONFIG_MPC885ADS
        volatile cpm8xx_t *cp = cpmp;
-        volatile uint __iomem *bcsr1;
-        uint tmp;
+        (void)cp;       /* fix warning */
+#if defined (CONFIG_MPC885ADS)
        cp->cp_pepar |= 0x00000c00;
        cp->cp_pedir &= ~0x00000c00;
        cp->cp_peso &= ~0x00000400;
        cp->cp_peso |= 0x00000800;
+#elif defined (CONFIG_MPC86XADS)
+        unsigned int iobits = 0x00000c00;
+        if (!pinfo->is_portb) {
+                cp->cp_pbpar |= iobits;
+                cp->cp_pbdir &= ~iobits;
+                cp->cp_pbodr &= ~iobits;
+        } else {
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_papar |= iobits;
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
+        }
-        /* Enable SMC2 transceivers */
-        bcsr1 = ioremap(BCSR1, 4);
-        tmp = in_be32(bcsr1);
-        tmp &= ~BCSR1_RS232EN_2;
-        out_be32(bcsr1, tmp);
-        iounmap(bcsr1);
 #endif
        pinfo->brg = 2;
@@ -158,7 +161,7 @@ void scc4_lineif(struct uart_cpm_port *pinfo)
 }
 /*
- * Allocate DP-Ram and memory buffers. We need to allocate a transmit and 
+ * Allocate DP-Ram and memory buffers. We need to allocate a transmit and
 * receive buffer descriptors from dual port ram, and a character
 * buffer area from host mem. If we are allocating for the console we need
 * to do it from bootmem
@@ -185,6 +188,8 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
        memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
            L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
        if (is_con) {
+                /* was hostalloc but changed cause it blows away the */
+                /* large tlb mapping when pinning the kernel area    */
                mem_addr = (u8 *) cpm_dpram_addr(cpm_dpalloc(memsz, 8));
                dma_addr = 0;
        } else
diff --git a/drivers/usb/input/wacom.c b/drivers/usb/input/wacom.c
index 02412e31a46b..3b266af3048a 100644
--- a/drivers/usb/input/wacom.c
+++ b/drivers/usb/input/wacom.c
@@ -342,9 +342,6 @@ static void wacom_graphire_irq(struct urb *urb, struct pt_regs *regs)
                goto exit;
        }
-        x = le16_to_cpu(*(__le16 *) &data[2]);
-        y = le16_to_cpu(*(__le16 *) &data[4]);
        input_regs(dev, regs);
        if (data[1] & 0x10) { /* in prox */
@@ -373,15 +370,17 @@ static void wacom_graphire_irq(struct urb *urb, struct pt_regs *regs)
                }
        }
-        if (data[1] & 0x80) {
+        if (data[1] & 0x90) {
+                x = le16_to_cpu(*(__le16 *) &data[2]);
+                y = le16_to_cpu(*(__le16 *) &data[4]);
                input_report_abs(dev, ABS_X, x);
                input_report_abs(dev, ABS_Y, y);
-        }
+                if (wacom->tool[0] != BTN_TOOL_MOUSE) {
-        if (wacom->tool[0] != BTN_TOOL_MOUSE) {
+                        input_report_abs(dev, ABS_PRESSURE, le16_to_cpu(*(__le16 *) &data[6]));
-                input_report_abs(dev, ABS_PRESSURE, le16_to_cpu(*(__le16 *) &data[6]));
+                        input_report_key(dev, BTN_TOUCH, data[1] & 0x01);
-                input_report_key(dev, BTN_TOUCH, data[1] & 0x01);
+                        input_report_key(dev, BTN_STYLUS, data[1] & 0x02);
-                input_report_key(dev, BTN_STYLUS, data[1] & 0x02);
+                        input_report_key(dev, BTN_STYLUS2, data[1] & 0x04);
-                input_report_key(dev, BTN_STYLUS2, data[1] & 0x04);
+                }
        }
        input_report_key(dev, wacom->tool[0], data[1] & 0x10);
@@ -568,7 +567,7 @@ static void wacom_intuos_irq(struct urb *urb, struct pt_regs *regs)
        /* Cintiq doesn't send data when RDY bit isn't set */
        if ((wacom->features->type == CINTIQ) && !(data[1] & 0x40))
-                return;
+                goto exit;
        if (wacom->features->type >= INTUOS3) {
                input_report_abs(dev, ABS_X, (data[2] << 9) | (data[3] << 1) | ((data[9] >> 1) & 1));
diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
index aa9d00808e4e..508a21028db4 100644
--- a/drivers/usb/mon/mon_main.c
+++ b/drivers/usb/mon/mon_main.c
@@ -2,6 +2,8 @@
 * The USB Monitor, inspired by Dave Harding's USBMon.
 *
 * mon_main.c: Main file, module initiation and exit, registrations, etc.
+ *
+ * Copyright (C) 2005 Pete Zaitcev (zaitcev@redhat.com)
 */
 #include <linux/kernel.h>
@@ -311,7 +313,7 @@ static int __init mon_init(void)
        mondir = debugfs_create_dir("usbmon", NULL);
        if (IS_ERR(mondir)) {
-                printk(KERN_NOTICE TAG ": debugs is not available\n");
+                printk(KERN_NOTICE TAG ": debugfs is not available\n");
                return -ENODEV;
        }
        if (mondir == NULL) {
diff --git a/drivers/usb/mon/usb_mon.h b/drivers/usb/mon/usb_mon.h
index ed35c18a5c44..9b06784d2c48 100644
--- a/drivers/usb/mon/usb_mon.h
+++ b/drivers/usb/mon/usb_mon.h
@@ -1,5 +1,7 @@
 /*
 * The USB Monitor, inspired by Dave Harding's USBMon.
+ *
+ * Copyright (C) 2005 Pete Zaitcev (zaitcev@redhat.com)
 */
 #ifndef __USB_MON_H
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index d2e19f6dd72c..4ff853fbe0be 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -628,7 +628,7 @@ fb_pan_display(struct fb_info *info, struct fb_var_screeninfo *var)
 int
 fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 {
-        int err;
+        int err, flags = info->flags;
        if (var->activate & FB_ACTIVATE_INV_MODE) {
                struct fb_videomode mode1, mode2;
@@ -682,7 +682,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
                            !list_empty(&info->modelist))
                                err = fb_add_videomode(&mode, &info->modelist);
-                        if (!err && info->flags & FBINFO_MISC_USEREVENT) {
+                        if (!err && (flags & FBINFO_MISC_USEREVENT)) {
                                struct fb_event event;
                                info->flags &= ~FBINFO_MISC_USEREVENT;
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 298bc9cd99e7..a112a1786855 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -583,23 +583,6 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                return -ENODEV;
        }
-        /* Map the fb and MMIO regions */
-        dinfo->aperture.virtual = (u8 __iomem *)ioremap_nocache
-                (dinfo->aperture.physical, dinfo->aperture.size);
-        if (!dinfo->aperture.virtual) {
-                ERR_MSG("Cannot remap FB region.\n");
-                cleanup(dinfo);
-                return -ENODEV;
-        }
-        dinfo->mmio_base =
-                (u8 __iomem *)ioremap_nocache(dinfo->mmio_base_phys,
-                                               INTEL_REG_SIZE);
-        if (!dinfo->mmio_base) {
-                ERR_MSG("Cannot remap MMIO region.\n");
-                cleanup(dinfo);
-                return -ENODEV;
-        }
        /* Get the chipset info. */
        dinfo->pci_chipset = pdev->device;
@@ -630,9 +613,15 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                dinfo->accel = 0;
        }
+        if (MB(voffset) < stolen_size)
+                offset = (stolen_size >> 12);
+        else
+                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
        /* Framebuffer parameters - Use all the stolen memory if >= vram */
-        if (ROUND_UP_TO_PAGE(stolen_size) >= MB(vram)) {
+        if (ROUND_UP_TO_PAGE(stolen_size) >= ((offset << 12) +  MB(vram))) {
                dinfo->fb.size = ROUND_UP_TO_PAGE(stolen_size);
+                dinfo->fb.offset = 0;
                dinfo->fbmem_gart = 0;
        } else {
                dinfo->fb.size =  MB(vram);
@@ -663,11 +652,6 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                return -ENODEV;
        }
-        if (MB(voffset) < stolen_size)
-                offset = (stolen_size >> 12);
-        else
-                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
        /* set the mem offsets - set them after the already used pages */
        if (dinfo->accel) {
                dinfo->ring.offset = offset + gtt_info.current_memory;
@@ -682,6 +666,26 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                        + (dinfo->cursor.size >> 12);
        }
+        /* Map the fb and MMIO regions */
+        /* ioremap only up to the end of used aperture */
+        dinfo->aperture.virtual = (u8 __iomem *)ioremap_nocache
+                (dinfo->aperture.physical, (dinfo->fb.offset << 12)
+                 + dinfo->fb.size);
+        if (!dinfo->aperture.virtual) {
+                ERR_MSG("Cannot remap FB region.\n");
+                cleanup(dinfo);
+                return -ENODEV;
+        }
+        dinfo->mmio_base =
+                (u8 __iomem *)ioremap_nocache(dinfo->mmio_base_phys,
+                                               INTEL_REG_SIZE);
+        if (!dinfo->mmio_base) {
+                ERR_MSG("Cannot remap MMIO region.\n");
+                cleanup(dinfo);
+                return -ENODEV;
+        }
        /* Allocate memories (which aren't stolen) */
        if (dinfo->accel) {
                if (!(dinfo->gtt_ring_mem =
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 16e37a535d85..30112816420c 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -717,6 +717,9 @@ static void pxafb_enable_controller(struct pxafb_info *fbi)
        DPRINTK("reg_lccr2 0x%08x\n", (unsigned int) fbi->reg_lccr2);
        DPRINTK("reg_lccr3 0x%08x\n", (unsigned int) fbi->reg_lccr3);
+        /* enable LCD controller clock */
+        pxa_set_cken(CKEN16_LCD, 1);
        /* Sequence from 11.7.10 */
        LCCR3 = fbi->reg_lccr3;
        LCCR2 = fbi->reg_lccr2;
@@ -750,6 +753,9 @@ static void pxafb_disable_controller(struct pxafb_info *fbi)
        schedule_timeout(20 * HZ / 1000);
        remove_wait_queue(&fbi->ctrlr_wait, &wait);
+        /* disable LCD controller clock */
+        pxa_set_cken(CKEN16_LCD, 0);
 }
 /*
@@ -1299,8 +1305,6 @@ int __init pxafb_probe(struct device *dev)
                ret = -ENOMEM;
                goto failed;
        }
-        /* enable LCD controller clock */
-        pxa_set_cken(CKEN16_LCD, 1);
        ret = request_irq(IRQ_LCD, pxafb_handle_irq, SA_INTERRUPT, "LCD", fbi);
        if (ret) {
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 8a9c42822502..0bbf029b1ef1 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -593,7 +593,7 @@ void w1_search(struct w1_master *dev, w1_slave_found_callback cb)
                 * Return 0 - device(s) present, 1 - no devices present.
                 */
                if (w1_reset_bus(dev)) {
-                        dev_info(&dev->dev, "No devices present on the wire.\n");
+                        dev_dbg(&dev->dev, "No devices present on the wire.\n");
                        break;
                }
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index dab4774ee7bb..3196d4c4eed3 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,9 @@
+Version 1.35
+------------
+Add writepage performance improvements.  Fix path name conversions
+for long filenames on mounts which were done with "mapchars" mount option
+specified.
 Version 1.34
 ------------
 Fix error mapping of the TOO_MANY_LINKS (hardlinks) case.
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 3c628bf667a5..0db0b313d715 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -2602,6 +2602,9 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
        if(name_len < PATH_MAX) {
                memcpy(pSMB->ResumeFileName, psrch_inf->presume_name, name_len);
                byte_count += name_len;
+                /* 14 byte parm len above enough for 2 byte null terminator */
+                pSMB->ResumeFileName[name_len] = 0;
+                pSMB->ResumeFileName[name_len+1] = 0;
        } else {
                rc = -EINVAL;
                goto FNext2_err_exit;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 072b4ee8c53e..20ae4153f791 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -611,6 +611,7 @@ cifsConvertToUCS(__le16 * target, const char *source, int maxlen,
                src_char = source[i];
                switch (src_char) {
                        case 0:
+                                target[j] = 0;
                                goto ctoUCS_out;
                        case ':':
                                target[j] = cpu_to_le16(UNI_COLON);
diff --git a/fs/inotify.c b/fs/inotify.c
index 27ebcac5e07f..868901b1e779 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -402,7 +402,7 @@ static struct inotify_watch *create_watch(struct inotify_device *dev,
                return ERR_PTR(ret);
        }
-        dev->last_wd = ret;
+        dev->last_wd = watch->wd;
        watch->mask = mask;
        atomic_set(&watch->count, 0);
        INIT_LIST_HEAD(&watch->d_list);
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 2137138c59b0..767c7ecb429e 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -128,6 +128,10 @@ void jfs_delete_inode(struct inode *inode)
 {
        jfs_info("In jfs_delete_inode, inode = 0x%p", inode);
+        if (is_bad_inode(inode) ||
+            (JFS_IP(inode)->fileset != cpu_to_le32(FILESYSTEM_I)))
+                        return;
        if (test_cflag(COMMIT_Freewmap, inode))
                jfs_free_zero_link(inode);
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 22815e88e7cc..d27bac6acaa3 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -191,7 +191,7 @@ static int lbmIOWait(struct lbuf * bp, int flag);
 static bio_end_io_t lbmIODone;
 static void lbmStartIO(struct lbuf * bp);
 static void lmGCwrite(struct jfs_log * log, int cant_block);
-static int lmLogSync(struct jfs_log * log, int nosyncwait);
+static int lmLogSync(struct jfs_log * log, int hard_sync);
@@ -915,19 +915,17 @@ static void lmPostGC(struct lbuf * bp)
 *      if new sync address is available
 *      (normally the case if sync() is executed by back-ground
 *      process).
- *      if not, explicitly run jfs_blogsync() to initiate
- *      getting of new sync address.
 *      calculate new value of i_nextsync which determines when
 *      this code is called again.
 *
 * PARAMETERS:  log     - log structure
- *              nosyncwait - 1 if called asynchronously
+ *              hard_sync - 1 to force all metadata to be written
 *
 * RETURN:      0
 *                      
 * serialization: LOG_LOCK() held on entry/exit
 */
-static int lmLogSync(struct jfs_log * log, int nosyncwait)
+static int lmLogSync(struct jfs_log * log, int hard_sync)
 {
        int logsize;
        int written;            /* written since last syncpt */
@@ -941,11 +939,18 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
        unsigned long flags;
        /* push dirty metapages out to disk */
-        list_for_each_entry(sbi, &log->sb_list, log_list) {
+        if (hard_sync)
-                filemap_flush(sbi->ipbmap->i_mapping);
+                list_for_each_entry(sbi, &log->sb_list, log_list) {
-                filemap_flush(sbi->ipimap->i_mapping);
+                        filemap_fdatawrite(sbi->ipbmap->i_mapping);
-                filemap_flush(sbi->direct_inode->i_mapping);
+                        filemap_fdatawrite(sbi->ipimap->i_mapping);
-        }
+                        filemap_fdatawrite(sbi->direct_inode->i_mapping);
+                }
+        else
+                list_for_each_entry(sbi, &log->sb_list, log_list) {
+                        filemap_flush(sbi->ipbmap->i_mapping);
+                        filemap_flush(sbi->ipimap->i_mapping);
+                        filemap_flush(sbi->direct_inode->i_mapping);
+                }
        /*
         *      forward syncpt
@@ -1021,10 +1026,6 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
                /* next syncpt trigger = written + more */
                log->nextsync = written + more;
-        /* return if lmLogSync() from outside of transaction, e.g., sync() */
-        if (nosyncwait)
-                return lsn;
        /* if number of bytes written from last sync point is more
         * than 1/4 of the log size, stop new transactions from
         * starting until all current transactions are completed
@@ -1049,11 +1050,12 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
 *
 * FUNCTION:    write log SYNCPT record for specified log
 *
- * PARAMETERS:  log     - log structure
+ * PARAMETERS:  log       - log structure
+ *              hard_sync - set to 1 to force metadata to be written
 */
-void jfs_syncpt(struct jfs_log *log)
+void jfs_syncpt(struct jfs_log *log, int hard_sync)
 {       LOG_LOCK(log);
-        lmLogSync(log, 1);
+        lmLogSync(log, hard_sync);
        LOG_UNLOCK(log);
 }
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 747114cd38b8..e4978b5b65ee 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -510,6 +510,6 @@ extern int lmLogFormat(struct jfs_log *log, s64 logAddress, int logSize);
 extern int lmGroupCommit(struct jfs_log *, struct tblock *);
 extern int jfsIOWait(void *);
 extern void jfs_flush_journal(struct jfs_log * log, int wait);
-extern void jfs_syncpt(struct jfs_log *log);
+extern void jfs_syncpt(struct jfs_log *log, int hard_sync);
 #endif                          /* _H_JFS_LOGMGR */
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 121c981ff453..c7a92f9deb2b 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -552,6 +552,11 @@ void txEnd(tid_t tid)
                 * synchronize with logsync barrier
                 */
                if (test_bit(log_SYNCBARRIER, &log->flag)) {
+                        TXN_UNLOCK();
+                        /* write dirty metadata & forward log syncpt */
+                        jfs_syncpt(log, 1);
                        jfs_info("log barrier off: 0x%x", log->lsn);
                        /* enable new transactions start */
@@ -560,11 +565,6 @@ void txEnd(tid_t tid)
                        /* wakeup all waitors for logsync barrier */
                        TXN_WAKEUP(&log->syncwait);
-                        TXN_UNLOCK();
-                        /* forward log syncpt */
-                        jfs_syncpt(log);
                        goto wakeup;
                }
        }
@@ -657,7 +657,9 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
                                /* only anonymous txn.
                                 * Remove from anon_list
                                 */
+                                TXN_LOCK();
                                list_del_init(&jfs_ip->anon_inode_list);
+                                TXN_UNLOCK();
                        }
                        jfs_ip->atlhead = tlck->next;
                } else {
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index ee32211288ce..9ff89720f93b 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -114,6 +114,8 @@ static void jfs_destroy_inode(struct inode *inode)
 {
        struct jfs_inode_info *ji = JFS_IP(inode);
+        BUG_ON(!list_empty(&ji->anon_inode_list));
        spin_lock_irq(&ji->ag_lock);
        if (ji->active_ag != -1) {
                struct bmap *bmap = JFS_SBI(inode->i_sb)->bmap;
@@ -531,7 +533,7 @@ static int jfs_sync_fs(struct super_block *sb, int wait)
        /* log == NULL indicates read-only mount */
        if (log) {
                jfs_flush_journal(log, wait);
-                jfs_syncpt(log);
+                jfs_syncpt(log, 0);
        }
        return 0;
diff --git a/fs/namei.c b/fs/namei.c
index 264e232addda..e2c1413a55c4 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2216,7 +2216,8 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
        if (!error) {
                const char *new_name = old_dentry->d_name.name;
-                fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir, new_dentry->d_inode);
+                fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
+                              new_dentry->d_inode, old_dentry->d_inode);
        }
        fsnotify_oldname_free(old_name);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 4845911f1c63..bb7ca022bcb2 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -814,28 +814,39 @@ nfs_setattr(struct dentry *dentry, struct iattr *attr)
                nfs_wb_all(inode);
        }
        error = NFS_PROTO(inode)->setattr(dentry, &fattr, attr);
-        if (error == 0) {
+        if (error == 0)
                nfs_refresh_inode(inode, &fattr);
+        nfs_end_data_update(inode);
+        unlock_kernel();
+        return error;
+}
+/**
+ * nfs_setattr_update_inode - Update inode metadata after a setattr call.
+ * @inode: pointer to struct inode
+ * @attr: pointer to struct iattr
+ *
+ * Note: we do this in the *proc.c in order to ensure that
+ *       it works for things like exclusive creates too.
+ */
+void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
+{
+        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0) {
                if ((attr->ia_valid & ATTR_MODE) != 0) {
-                        int mode;
+                        int mode = attr->ia_mode & S_IALLUGO;
-                        mode = inode->i_mode & ~S_IALLUGO;
+                        mode |= inode->i_mode & ~S_IALLUGO;
-                        mode |= attr->ia_mode & S_IALLUGO;
                        inode->i_mode = mode;
                }
                if ((attr->ia_valid & ATTR_UID) != 0)
                        inode->i_uid = attr->ia_uid;
                if ((attr->ia_valid & ATTR_GID) != 0)
                        inode->i_gid = attr->ia_gid;
-                if ((attr->ia_valid & ATTR_SIZE) != 0) {
-                        inode->i_size = attr->ia_size;
-                        vmtruncate(inode, attr->ia_size);
-                }
-        }
-        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0)
                NFS_FLAGS(inode) |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-        nfs_end_data_update(inode);
+        }
-        unlock_kernel();
+        if ((attr->ia_valid & ATTR_SIZE) != 0) {
-        return error;
+                inode->i_size = attr->ia_size;
+                vmtruncate(inode, attr->ia_size);
+        }
 }
 /*
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 7851569b31c6..2681485cf2d0 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -120,6 +120,8 @@ nfs3_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
        dprintk("NFS call  setattr\n");
        fattr->valid = 0;
        status = rpc_call(NFS_CLIENT(inode), NFS3PROC_SETATTR, &arg, fattr, 0);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
        dprintk("NFS reply setattr: %d\n", status);
        return status;
 }
@@ -370,6 +372,8 @@ again:
                 * not sure this buys us anything (and I'd have
                 * to revamp the NFSv3 XDR code) */
                status = nfs3_proc_setattr(dentry, &fattr, sattr);
+                if (status == 0)
+                        nfs_setattr_update_inode(dentry->d_inode, sattr);
                nfs_refresh_inode(dentry->d_inode, &fattr);
                dprintk("NFS reply setattr (post-create): %d\n", status);
        }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1b76f80aedb9..0c5a308e4963 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -753,6 +753,7 @@ static int _nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
                .rpc_argp       = &arg,
                .rpc_resp       = &res,
        };
+        int status;
        fattr->valid = 0;
@@ -762,7 +763,8 @@ static int _nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
        } else
                memcpy(&arg.stateid, &zero_stateid, sizeof(arg.stateid));
-        return rpc_call_sync(server->client, &msg, 0);
+        status = rpc_call_sync(server->client, &msg, 0);
+        return status;
 }
 static int nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
@@ -1145,6 +1147,8 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
        status = nfs4_do_setattr(NFS_SERVER(inode), fattr,
                        NFS_FH(inode), sattr, state);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
        if (state != NULL)
                nfs4_close_state(state, FMODE_WRITE);
        put_rpccred(cred);
@@ -1449,8 +1453,10 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
                struct nfs_fattr fattr;
                status = nfs4_do_setattr(NFS_SERVER(dir), &fattr,
                                     NFS_FH(state->inode), sattr, state);
-                if (status == 0)
+                if (status == 0) {
+                        nfs_setattr_update_inode(state->inode, sattr);
                        goto out;
+                }
        } else if (flags != 0)
                goto out;
        nfs4_close_state(state, flags);
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index cedf636bcf3c..be23c3fb9260 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -114,6 +114,8 @@ nfs_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
        dprintk("NFS call  setattr\n");
        fattr->valid = 0;
        status = rpc_call(NFS_CLIENT(inode), NFSPROC_SETATTR, &arg, fattr, 0);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
        dprintk("NFS reply setattr: %d\n", status);
        return status;
 }
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index 18c58c32e326..251e5a1bb1c4 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -239,6 +239,7 @@ nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
        if (xdr_decode_word(buf, base, &entries) ||
            entries > NFS_ACL_MAX_ENTRIES)
                return -EINVAL;
+        nfsacl_desc.desc.array_maxlen = entries;
        err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);
        if (err)
                return err;
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 9709fac6531d..21e21fe519e2 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -174,6 +174,9 @@ ToDo/Notes:
          fact that the vfs and ntfs inodes are one struct in memory to find
          the ntfs inode in memory if present.  Also, the ntfs inode has its
          own locking so it does not matter if the vfs inode is locked.
+        - Fix bug in mft record writing where we forgot to set the device in
+          the buffers when mapping them after the VM had discarded them
+          Thanks to Martin MOKREJŠ for the bug report.
 2.1.22 - Many bug and race fixes and error handling improvements.
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index ac9ff39aa834..317f7c679fd3 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -533,6 +533,7 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
                        LCN lcn;
                        unsigned int vcn_ofs;
+                        bh->b_bdev = vol->sb->s_bdev;
                        /* Obtain the vcn and offset of the current block. */
                        vcn = ((VCN)mft_no << vol->mft_record_size_bits) +
                                        (block_start - m_start);
@@ -725,6 +726,7 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
                        LCN lcn;
                        unsigned int vcn_ofs;
+                        bh->b_bdev = vol->sb->s_bdev;
                        /* Obtain the vcn and offset of the current block. */
                        vcn = ((VCN)ni->mft_no << vol->mft_record_size_bits) +
                                        (block_start - m_start);
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index a20bbc1642dc..3549067c42d9 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -593,6 +593,9 @@ static int new_inode_init(struct inode *inode, struct inode *dir, int mode)
         */
        inode->i_uid = current->fsuid;
        inode->i_mode = mode;
+        /* Make inode invalid - just in case we are going to drop it before
+         * the initialization happens */
+        INODE_PKEY(inode)->k_objectid = 0;
        if (dir->i_mode & S_ISGID) {
                inode->i_gid = dir->i_gid;
diff --git a/include/asm-arm/arch-s3c2410/usb-control.h b/include/asm-arm/arch-s3c2410/usb-control.h
index 1cc85a096b23..bd43b566db3e 100644
--- a/include/asm-arm/arch-s3c2410/usb-control.h
+++ b/include/asm-arm/arch-s3c2410/usb-control.h
@@ -12,6 +12,7 @@
 * Changelog:
 *  11-Sep-2004 BJD  Created file
 *  21-Sep-2004 BJD  Updated port info
+ *  09-Aug-2005 BJD  Renamed s3c2410_report_oc s3c2410_usb_report_oc
 */
 #ifndef __ASM_ARCH_USBCONTROL_H
@@ -35,7 +36,7 @@ struct s3c2410_hcd_info {
        void            (*report_oc)(struct s3c2410_hcd_info *, int ports);
 };
-static void inline s3c2410_report_oc(struct s3c2410_hcd_info *info, int ports)
+static void inline s3c2410_usb_report_oc(struct s3c2410_hcd_info *info, int ports)
 {
        if (info->report_oc != NULL) {
                (info->report_oc)(info, ports);
diff --git a/include/asm-arm/pgtable.h b/include/asm-arm/pgtable.h
index a9892eb42a23..478c49b56e18 100644
--- a/include/asm-arm/pgtable.h
+++ b/include/asm-arm/pgtable.h
@@ -188,12 +188,18 @@ extern void __pgd_error(const char *file, int line, unsigned long val);
 /*
 *   - extended small page/tiny page
 */
+#define PTE_EXT_XN              (1 << 0)        /* v6 */
 #define PTE_EXT_AP_MASK         (3 << 4)
+#define PTE_EXT_AP0             (1 << 4)
+#define PTE_EXT_AP1             (2 << 4)
 #define PTE_EXT_AP_UNO_SRO      (0 << 4)
-#define PTE_EXT_AP_UNO_SRW      (1 << 4)
+#define PTE_EXT_AP_UNO_SRW      (PTE_EXT_AP0)
-#define PTE_EXT_AP_URO_SRW      (2 << 4)
+#define PTE_EXT_AP_URO_SRW      (PTE_EXT_AP1)
-#define PTE_EXT_AP_URW_SRW      (3 << 4)
+#define PTE_EXT_AP_URW_SRW      (PTE_EXT_AP1|PTE_EXT_AP0)
 #define PTE_EXT_TEX(x)          ((x) << 6)      /* v5 */
+#define PTE_EXT_APX             (1 << 9)        /* v6 */
+#define PTE_EXT_SHARED          (1 << 10)       /* v6 */
+#define PTE_EXT_NG              (1 << 11)       /* v6 */
 /*
 *   - small page
@@ -224,6 +230,8 @@ extern void __pgd_error(const char *file, int line, unsigned long val);
 #define L_PTE_WRITE             (1 << 5)
 #define L_PTE_EXEC              (1 << 6)
 #define L_PTE_DIRTY             (1 << 7)
+#define L_PTE_SHARED            (1 << 10)       /* shared between CPUs (v6) */
+#define L_PTE_ASID              (1 << 11)       /* non-global (use ASID, v6) */
 #ifndef __ASSEMBLY__
diff --git a/include/asm-i386/pci.h b/include/asm-i386/pci.h
index 2cbab30734d6..78c85985aee3 100644
--- a/include/asm-i386/pci.h
+++ b/include/asm-i386/pci.h
@@ -18,9 +18,11 @@ extern unsigned int pcibios_assign_all_busses(void);
 #define pcibios_scan_all_fns(a, b)      0
 extern unsigned long pci_mem_start;
-#define PCIBIOS_MIN_IO          0x4000
+#define PCIBIOS_MIN_IO          0x1000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
+#define PCIBIOS_MIN_CARDBUS_IO  0x4000
 void pcibios_config_init(void);
 struct pci_bus * pcibios_scan_root(int bus);
diff --git a/include/asm-i386/processor.h b/include/asm-i386/processor.h
index 5d06e6bd6ba0..d0d8b0160090 100644
--- a/include/asm-i386/processor.h
+++ b/include/asm-i386/processor.h
@@ -29,7 +29,7 @@ struct desc_struct {
 };
 #define desc_empty(desc) \
-                (!((desc)->a + (desc)->b))
+                (!((desc)->a | (desc)->b))
 #define desc_equal(desc1, desc2) \
                (((desc1)->a == (desc2)->a) && ((desc1)->b == (desc2)->b))
diff --git a/include/asm-ppc64/iSeries/LparMap.h b/include/asm-ppc64/iSeries/LparMap.h
index 5c32e38c1c01..a6840b186d03 100644
--- a/include/asm-ppc64/iSeries/LparMap.h
+++ b/include/asm-ppc64/iSeries/LparMap.h
@@ -19,6 +19,8 @@
 #ifndef _LPARMAP_H
 #define _LPARMAP_H
+#ifndef __ASSEMBLY__
 #include <asm/types.h>
 /*
@@ -71,6 +73,11 @@ struct LparMap {
        } xRanges[HvRangesToMap];
 };
-extern struct LparMap           xLparMap;
+extern const struct LparMap     xLparMap;
+#endif /* __ASSEMBLY__ */
+/* the fixed address where the LparMap exists */
+#define LPARMAP_PHYS            0x7000
 #endif /* _LPARMAP_H */
diff --git a/include/asm-sh/unistd.h b/include/asm-sh/unistd.h
index 245447081f0d..4e7701d6d23c 100644
--- a/include/asm-sh/unistd.h
+++ b/include/asm-sh/unistd.h
@@ -406,7 +406,7 @@ register long __sc6 __asm__ ("r6") = (long) arg3; \
 register long __sc7 __asm__ ("r7") = (long) arg4; \
 register long __sc0 __asm__ ("r0") = (long) arg5; \
 register long __sc1 __asm__ ("r1") = (long) arg6; \
-__asm__ __volatile__ ("trapa    #0x15" \
+__asm__ __volatile__ ("trapa    #0x16" \
        : "=z" (__sc0) \
        : "0" (__sc0), "r" (__sc4), "r" (__sc5), "r" (__sc6), "r" (__sc7),  \
          "r" (__sc3), "r" (__sc1) \
diff --git a/include/asm-um/page.h b/include/asm-um/page.h
index 5afee8a8cdf3..f58aedadeb4e 100644
--- a/include/asm-um/page.h
+++ b/include/asm-um/page.h
@@ -104,8 +104,8 @@ extern void *to_virt(unsigned long phys);
 * casting is the right thing, but 32-bit UML can't have 64-bit virtual
 * addresses
 */
-#define __pa(virt) to_phys((void *) (unsigned long) virt)
+#define __pa(virt) to_phys((void *) (unsigned long) (virt))
-#define __va(phys) to_virt((unsigned long) phys)
+#define __va(phys) to_virt((unsigned long) (phys))
 #define page_to_pfn(page) ((page) - mem_map)
 #define pfn_to_page(pfn) (mem_map + (pfn))
diff --git a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
index 9c4527eb55e2..eeb3088a1c9e 100644
--- a/include/asm-x86_64/pci.h
+++ b/include/asm-x86_64/pci.h
@@ -22,9 +22,11 @@ extern unsigned int pcibios_assign_all_busses(void);
 extern int no_iommu, force_iommu;
 extern unsigned long pci_mem_start;
-#define PCIBIOS_MIN_IO          0x4000
+#define PCIBIOS_MIN_IO          0x1000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
+#define PCIBIOS_MIN_CARDBUS_IO  0x4000
 void pcibios_config_init(void);
 struct pci_bus * pcibios_scan_root(int bus);
 extern int (*pci_config_read)(int seg, int bus, int dev, int fn, int reg, int len, u32 *value);
diff --git a/include/asm-x86_64/processor.h b/include/asm-x86_64/processor.h
index 106f666517bb..85549e656eeb 100644
--- a/include/asm-x86_64/processor.h
+++ b/include/asm-x86_64/processor.h
@@ -32,7 +32,7 @@
 #define ID_MASK         0x00200000
 #define desc_empty(desc) \
-               (!((desc)->a + (desc)->b))
+               (!((desc)->a | (desc)->b))
 #define desc_equal(desc1, desc2) \
               (((desc1)->a == (desc2)->a) && ((desc1)->b == (desc2)->b))
diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
index 602c305c8585..03b8e7932b83 100644
--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -21,7 +21,7 @@
 */
 static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
                                 const char *old_name, const char *new_name,
-                                 int isdir, struct inode *target)
+                                 int isdir, struct inode *target, struct inode *source)
 {
        u32 cookie = inotify_get_cookie();
@@ -41,6 +41,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
                inotify_inode_queue_event(target, IN_DELETE_SELF, 0, NULL);
                inotify_inode_is_dead(target);
        }
+        if (source) {
+                inotify_inode_queue_event(source, IN_MOVE_SELF, 0, NULL);
+        }
 }
 /*
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 92129078d4f3..a6dbb51ecd7b 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -1501,4 +1501,10 @@ extern struct bus_type ide_bus_type;
 #define ide_id_has_flush_cache_ext(id)  \
        (((id)->cfs_enable_2 & 0x2400) == 0x2400)
+static inline int hwif_to_node(ide_hwif_t *hwif)
+{
+        struct pci_dev *dev = hwif->pci_dev;
+        return dev ? pcibus_to_node(dev->bus) : -1;
+}
 #endif /* _IDE_H */
diff --git a/include/linux/inotify.h b/include/linux/inotify.h
index a40c2bf0408e..93bb3afe646b 100644
--- a/include/linux/inotify.h
+++ b/include/linux/inotify.h
@@ -35,6 +35,7 @@ struct inotify_event {
 #define IN_CREATE               0x00000100      /* Subfile was created */
 #define IN_DELETE               0x00000200      /* Subfile was deleted */
 #define IN_DELETE_SELF          0x00000400      /* Self was deleted */
+#define IN_MOVE_SELF            0x00000800      /* Self was moved */
 /* the following are legal events.  they are sent as needed to any watch */
 #define IN_UNMOUNT              0x00002000      /* Backing fs was unmounted */
@@ -56,7 +57,8 @@ struct inotify_event {
 */
 #define IN_ALL_EVENTS   (IN_ACCESS | IN_MODIFY | IN_ATTRIB | IN_CLOSE_WRITE | \
                         IN_CLOSE_NOWRITE | IN_OPEN | IN_MOVED_FROM | \
-                         IN_MOVED_TO | IN_DELETE | IN_CREATE | IN_DELETE_SELF)
+                         IN_MOVED_TO | IN_DELETE | IN_CREATE | IN_DELETE_SELF | \
+                         IN_MOVE_SELF)
 #ifdef __KERNEL__
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index bcd0ac33f592..5ade54a78dbb 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -9,6 +9,7 @@
 #include <linux/netdevice.h>
 #include <linux/interrupt.h>
+#include <linux/rcupdate.h>
 #include <linux/list.h>
 struct netpoll;
@@ -26,6 +27,7 @@ struct netpoll {
 struct netpoll_info {
        spinlock_t poll_lock;
        int poll_owner;
+        int tries;
        int rx_flags;
        spinlock_t rx_lock;
        struct netpoll *rx_np; /* netpoll that registered an rx_hook */
@@ -60,25 +62,31 @@ static inline int netpoll_rx(struct sk_buff *skb)
        return ret;
 }
-static inline void netpoll_poll_lock(struct net_device *dev)
+static inline void *netpoll_poll_lock(struct net_device *dev)
 {
+        rcu_read_lock(); /* deal with race on ->npinfo */
        if (dev->npinfo) {
                spin_lock(&dev->npinfo->poll_lock);
                dev->npinfo->poll_owner = smp_processor_id();
+                return dev->npinfo;
        }
+        return NULL;
 }
-static inline void netpoll_poll_unlock(struct net_device *dev)
+static inline void netpoll_poll_unlock(void *have)
 {
-        if (dev->npinfo) {
+        struct netpoll_info *npi = have;
-                dev->npinfo->poll_owner = -1;
-                spin_unlock(&dev->npinfo->poll_lock);
+        if (npi) {
+                npi->poll_owner = -1;
+                spin_unlock(&npi->poll_lock);
        }
+        rcu_read_unlock();
 }
 #else
 #define netpoll_rx(a) 0
-#define netpoll_poll_lock(a)
+#define netpoll_poll_lock(a) 0
 #define netpoll_poll_unlock(a)
 #endif
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 8ea249110fb0..7d78a783c64a 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -292,6 +292,7 @@ extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern void nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
+extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
 extern void nfs_begin_attr_update(struct inode *);
 extern void nfs_end_attr_update(struct inode *);
 extern void nfs_begin_data_update(struct inode *);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 8621cf42b46f..bc4c40000c0d 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -556,7 +556,8 @@ struct pci_dev {
        /* keep track of device state */
        unsigned int    is_enabled:1;   /* pci_enable_device has been called */
        unsigned int    is_busmaster:1; /* device is busmaster */
-        
+        unsigned int    no_msi:1;       /* device may not use msi */
        u32             saved_config_space[16]; /* config space saved at suspend time */
        struct bin_attribute *rom_attr; /* attribute descriptor for sysfs ROM entry */
        int rom_attr_enabled;           /* has display of the rom attribute been enabled? */
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index bc4cc10fabe9..51e61e96051c 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2281,6 +2281,11 @@
 #define PCI_VENDOR_ID_INTEL             0x8086
 #define PCI_DEVICE_ID_INTEL_EESSC       0x0008
 #define PCI_DEVICE_ID_INTEL_21145       0x0039
+#define PCI_DEVICE_ID_INTEL_PXHD_0      0x0320
+#define PCI_DEVICE_ID_INTEL_PXHD_1      0x0321
+#define PCI_DEVICE_ID_INTEL_PXH_0       0x0329
+#define PCI_DEVICE_ID_INTEL_PXH_1       0x032A
+#define PCI_DEVICE_ID_INTEL_PXHV        0x032C
 #define PCI_DEVICE_ID_INTEL_82375       0x0482
 #define PCI_DEVICE_ID_INTEL_82424       0x0483
 #define PCI_DEVICE_ID_INTEL_82378       0x0484
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0061c9470482..948527e42a60 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -255,7 +255,7 @@ struct sk_buff {
                                nohdr:1;
                                /* 3 bits spare */
        __u8                    pkt_type;
-        __u16                   protocol;
+        __be16                  protocol;
        void                    (*destructor)(struct sk_buff *skb);
 #ifdef CONFIG_NETFILTER
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index 34ec3e8d99b3..23448d0fb5bc 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -177,6 +177,7 @@ typedef int (*xdr_xcode_elem_t)(struct xdr_array2_desc *desc, void *elem);
 struct xdr_array2_desc {
        unsigned int elem_size;
        unsigned int array_len;
+        unsigned int array_maxlen;
        xdr_xcode_elem_t xcode;
 };
diff --git a/include/scsi/scsi_transport.h b/include/scsi/scsi_transport.h
index a4f1837a33b1..f6e0bb484c63 100644
--- a/include/scsi/scsi_transport.h
+++ b/include/scsi/scsi_transport.h
@@ -29,6 +29,14 @@ struct scsi_transport_template {
        struct transport_container target_attrs;
        struct transport_container device_attrs;
+        /*
+         * If set, call target_parent prior to allocating a scsi_target,
+         * so we get the appropriate parent for the target. This function
+         * is required for transports like FC and iSCSI that do not put the
+         * scsi_target under scsi_host.
+         */
+        struct device *(*target_parent)(struct Scsi_Host *, int, uint);
        /* The size of the specific transport attribute structure (a
         * space of this size will be left at the end of the
         * scsi_* structure */
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 805fb9097318..21a4e3b2cbda 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -398,21 +398,31 @@ static int cpuset_path(const struct cpuset *cs, char *buf, int buflen)
 * to continue to serve a useful existence.  Next time it's released,
 * we will get notified again, if it still has 'notify_on_release' set.
 *
- * Note final arg to call_usermodehelper() is 0 - that means
+ * The final arg to call_usermodehelper() is 0, which means don't
- * don't wait.  Since we are holding the global cpuset_sem here,
+ * wait.  The separate /sbin/cpuset_release_agent task is forked by
- * and we are asking another thread (started from keventd) to rmdir a
+ * call_usermodehelper(), then control in this thread returns here,
- * cpuset, we can't wait - or we'd deadlock with the removing thread
+ * without waiting for the release agent task.  We don't bother to
- * on cpuset_sem.
+ * wait because the caller of this routine has no use for the exit
+ * status of the /sbin/cpuset_release_agent task, so no sense holding
+ * our caller up for that.
+ *
+ * The simple act of forking that task might require more memory,
+ * which might need cpuset_sem.  So this routine must be called while
+ * cpuset_sem is not held, to avoid a possible deadlock.  See also
+ * comments for check_for_release(), below.
 */
-static int cpuset_release_agent(char *cpuset_str)
+static void cpuset_release_agent(const char *pathbuf)
 {
        char *argv[3], *envp[3];
        int i;
+        if (!pathbuf)
+                return;
        i = 0;
        argv[i++] = "/sbin/cpuset_release_agent";
-        argv[i++] = cpuset_str;
+        argv[i++] = (char *)pathbuf;
        argv[i] = NULL;
        i = 0;
@@ -421,17 +431,29 @@ static int cpuset_release_agent(char *cpuset_str)
        envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
        envp[i] = NULL;
-        return call_usermodehelper(argv[0], argv, envp, 0);
+        call_usermodehelper(argv[0], argv, envp, 0);
+        kfree(pathbuf);
 }
 /*
 * Either cs->count of using tasks transitioned to zero, or the
 * cs->children list of child cpusets just became empty.  If this
 * cs is notify_on_release() and now both the user count is zero and
- * the list of children is empty, send notice to user land.
+ * the list of children is empty, prepare cpuset path in a kmalloc'd
+ * buffer, to be returned via ppathbuf, so that the caller can invoke
+ * cpuset_release_agent() with it later on, once cpuset_sem is dropped.
+ * Call here with cpuset_sem held.
+ *
+ * This check_for_release() routine is responsible for kmalloc'ing
+ * pathbuf.  The above cpuset_release_agent() is responsible for
+ * kfree'ing pathbuf.  The caller of these routines is responsible
+ * for providing a pathbuf pointer, initialized to NULL, then
+ * calling check_for_release() with cpuset_sem held and the address
+ * of the pathbuf pointer, then dropping cpuset_sem, then calling
+ * cpuset_release_agent() with pathbuf, as set by check_for_release().
 */
-static void check_for_release(struct cpuset *cs)
+static void check_for_release(struct cpuset *cs, char **ppathbuf)
 {
        if (notify_on_release(cs) && atomic_read(&cs->count) == 0 &&
            list_empty(&cs->children)) {
@@ -441,10 +463,9 @@ static void check_for_release(struct cpuset *cs)
                if (!buf)
                        return;
                if (cpuset_path(cs, buf, PAGE_SIZE) < 0)
-                        goto out;
+                        kfree(buf);
-                cpuset_release_agent(buf);
+                else
-out:
+                        *ppathbuf = buf;
-                kfree(buf);
        }
 }
@@ -727,14 +748,14 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs, char *buf)
        return 0;
 }
-static int attach_task(struct cpuset *cs, char *buf)
+static int attach_task(struct cpuset *cs, char *pidbuf, char **ppathbuf)
 {
        pid_t pid;
        struct task_struct *tsk;
        struct cpuset *oldcs;
        cpumask_t cpus;
-        if (sscanf(buf, "%d", &pid) != 1)
+        if (sscanf(pidbuf, "%d", &pid) != 1)
                return -EIO;
        if (cpus_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed))
                return -ENOSPC;
@@ -777,7 +798,7 @@ static int attach_task(struct cpuset *cs, char *buf)
        put_task_struct(tsk);
        if (atomic_dec_and_test(&oldcs->count))
-                check_for_release(oldcs);
+                check_for_release(oldcs, ppathbuf);
        return 0;
 }
@@ -801,6 +822,7 @@ static ssize_t cpuset_common_file_write(struct file *file, const char __user *us
        struct cftype *cft = __d_cft(file->f_dentry);
        cpuset_filetype_t type = cft->private;
        char *buffer;
+        char *pathbuf = NULL;
        int retval = 0;
        /* Crude upper limit on largest legitimate cpulist user might write. */
@@ -841,7 +863,7 @@ static ssize_t cpuset_common_file_write(struct file *file, const char __user *us
                retval = update_flag(CS_NOTIFY_ON_RELEASE, cs, buffer);
                break;
        case FILE_TASKLIST:
-                retval = attach_task(cs, buffer);
+                retval = attach_task(cs, buffer, &pathbuf);
                break;
        default:
                retval = -EINVAL;
@@ -852,6 +874,7 @@ static ssize_t cpuset_common_file_write(struct file *file, const char __user *us
                retval = nbytes;
 out2:
        up(&cpuset_sem);
+        cpuset_release_agent(pathbuf);
 out1:
        kfree(buffer);
        return retval;
@@ -1357,6 +1380,7 @@ static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
        struct cpuset *cs = dentry->d_fsdata;
        struct dentry *d;
        struct cpuset *parent;
+        char *pathbuf = NULL;
        /* the vfs holds both inode->i_sem already */
@@ -1376,7 +1400,7 @@ static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
                update_cpu_domains(cs);
        list_del(&cs->sibling); /* delete my sibling from parent->children */
        if (list_empty(&parent->children))
-                check_for_release(parent);
+                check_for_release(parent, &pathbuf);
        spin_lock(&cs->dentry->d_lock);
        d = dget(cs->dentry);
        cs->dentry = NULL;
@@ -1384,6 +1408,7 @@ static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
        cpuset_d_remove_dir(d);
        dput(d);
        up(&cpuset_sem);
+        cpuset_release_agent(pathbuf);
        return 0;
 }
@@ -1483,10 +1508,13 @@ void cpuset_exit(struct task_struct *tsk)
        task_unlock(tsk);
        if (notify_on_release(cs)) {
+                char *pathbuf = NULL;
                down(&cpuset_sem);
                if (atomic_dec_and_test(&cs->count))
-                        check_for_release(cs);
+                        check_for_release(cs, &pathbuf);
                up(&cpuset_sem);
+                cpuset_release_agent(pathbuf);
        } else {
                atomic_dec(&cs->count);
        }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 259cf55da3c9..c7e36d4a70ca 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -308,8 +308,6 @@ struct workqueue_struct *__create_workqueue(const char *name,
        struct workqueue_struct *wq;
        struct task_struct *p;
-        BUG_ON(strlen(name) > 10);
        wq = kmalloc(sizeof(*wq), GFP_KERNEL);
        if (!wq)
                return NULL;
diff --git a/net/compat.c b/net/compat.c
index be5d936dc423..d99ab9695893 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -91,20 +91,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
        } else
                kern_msg->msg_name = NULL;
-        if(kern_msg->msg_iovlen > UIO_FASTIOV) {
-                kern_iov = kmalloc(kern_msg->msg_iovlen * sizeof(struct iovec),
-                                   GFP_KERNEL);
-                if(!kern_iov)
-                        return -ENOMEM;
-        }
        tot_len = iov_from_user_compat_to_kern(kern_iov,
                                          (struct compat_iovec __user *)kern_msg->msg_iov,
                                          kern_msg->msg_iovlen);
        if(tot_len >= 0)
                kern_msg->msg_iov = kern_iov;
-        else if(kern_msg->msg_iovlen > UIO_FASTIOV)
-                kfree(kern_iov);
        return tot_len;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 52a3bf7ae177..faf59b02c4bf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1696,7 +1696,8 @@ static void net_rx_action(struct softirq_action *h)
        struct softnet_data *queue = &__get_cpu_var(softnet_data);
        unsigned long start_time = jiffies;
        int budget = netdev_budget;
-        
+        void *have;
        local_irq_disable();
        while (!list_empty(&queue->poll_list)) {
@@ -1709,10 +1710,10 @@ static void net_rx_action(struct softirq_action *h)
                dev = list_entry(queue->poll_list.next,
                                 struct net_device, poll_list);
-                netpoll_poll_lock(dev);
+                have = netpoll_poll_lock(dev);
                if (dev->quota <= 0 || dev->poll(dev, &budget)) {
-                        netpoll_poll_unlock(dev);
+                        netpoll_poll_unlock(have);
                        local_irq_disable();
                        list_del(&dev->poll_list);
                        list_add_tail(&dev->poll_list, &queue->poll_list);
@@ -1721,7 +1722,7 @@ static void net_rx_action(struct softirq_action *h)
                        else
                                dev->quota = dev->weight;
                } else {
-                        netpoll_poll_unlock(dev);
+                        netpoll_poll_unlock(have);
                        dev_put(dev);
                        local_irq_disable();
                }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index c327c9edadc5..a1a9a7abff50 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -33,6 +33,7 @@
 #define MAX_UDP_CHUNK 1460
 #define MAX_SKBS 32
 #define MAX_QUEUE_DEPTH (MAX_SKBS / 2)
+#define MAX_RETRIES 20000
 static DEFINE_SPINLOCK(skb_list_lock);
 static int nr_skbs;
@@ -248,14 +249,14 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
        int status;
        struct netpoll_info *npinfo;
-repeat:
+        if (!np || !np->dev || !netif_running(np->dev)) {
-        if(!np || !np->dev || !netif_running(np->dev)) {
                __kfree_skb(skb);
                return;
        }
-        /* avoid recursion */
        npinfo = np->dev->npinfo;
+        /* avoid recursion */
        if (npinfo->poll_owner == smp_processor_id() ||
            np->dev->xmit_lock_owner == smp_processor_id()) {
                if (np->drop)
@@ -265,30 +266,37 @@ repeat:
                return;
        }
-        spin_lock(&np->dev->xmit_lock);
+        do {
-        np->dev->xmit_lock_owner = smp_processor_id();
+                npinfo->tries--;
+                spin_lock(&np->dev->xmit_lock);
+                np->dev->xmit_lock_owner = smp_processor_id();
-        /*
+                /*
-         * network drivers do not expect to be called if the queue is
+                 * network drivers do not expect to be called if the queue is
-         * stopped.
+                 * stopped.
-         */
+                 */
-        if (netif_queue_stopped(np->dev)) {
+                if (netif_queue_stopped(np->dev)) {
+                        np->dev->xmit_lock_owner = -1;
+                        spin_unlock(&np->dev->xmit_lock);
+                        netpoll_poll(np);
+                        udelay(50);
+                        continue;
+                }
+                status = np->dev->hard_start_xmit(skb, np->dev);
                np->dev->xmit_lock_owner = -1;
                spin_unlock(&np->dev->xmit_lock);
-                netpoll_poll(np);
+                /* success */
-                goto repeat;
+                if(!status) {
-        }
+                        npinfo->tries = MAX_RETRIES; /* reset */
+                        return;
-        status = np->dev->hard_start_xmit(skb, np->dev);
+                }
-        np->dev->xmit_lock_owner = -1;
-        spin_unlock(&np->dev->xmit_lock);
-        /* transmit busy */
+                /* transmit busy */
-        if(status) {
                netpoll_poll(np);
-                goto repeat;
+                udelay(50);
-        }
+        } while (npinfo->tries > 0);
 }
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
@@ -349,15 +357,11 @@ static void arp_reply(struct sk_buff *skb)
        unsigned char *arp_ptr;
        int size, type = ARPOP_REPLY, ptype = ETH_P_ARP;
        u32 sip, tip;
-        unsigned long flags;
        struct sk_buff *send_skb;
        struct netpoll *np = NULL;
-        spin_lock_irqsave(&npinfo->rx_lock, flags);
        if (npinfo->rx_np && npinfo->rx_np->dev == skb->dev)
                np = npinfo->rx_np;
-        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
        if (!np)
                return;
@@ -639,9 +643,11 @@ int netpoll_setup(struct netpoll *np)
                if (!npinfo)
                        goto release;
+                npinfo->rx_flags = 0;
                npinfo->rx_np = NULL;
                npinfo->poll_lock = SPIN_LOCK_UNLOCKED;
                npinfo->poll_owner = -1;
+                npinfo->tries = MAX_RETRIES;
                npinfo->rx_lock = SPIN_LOCK_UNLOCKED;
        } else
                npinfo = ndev->npinfo;
@@ -718,9 +724,16 @@ int netpoll_setup(struct netpoll *np)
                npinfo->rx_np = np;
                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
        }
+        /* fill up the skb queue */
+        refill_skbs();
        /* last thing to do is link it to the net device structure */
        ndev->npinfo = npinfo;
+        /* avoid racing with NAPI reading npinfo */
+        synchronize_rcu();
        return 0;
 release:
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 96a02800cd28..acdd18e6adb2 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1876,15 +1876,6 @@ static inline unsigned int dn_current_mss(struct sock *sk, int flags)
        return mss_now;
 }
-static int dn_error(struct sock *sk, int flags, int err)
-{
-        if (err == -EPIPE)
-                err = sock_error(sk) ? : -EPIPE;
-        if (err == -EPIPE && !(flags & MSG_NOSIGNAL))
-                send_sig(SIGPIPE, current, 0);
-        return err;
-}
 static int dn_sendmsg(struct kiocb *iocb, struct socket *sock,
           struct msghdr *msg, size_t size)
 {
@@ -2045,7 +2036,7 @@ out:
        return sent ? sent : err;
 out_err:
-        err = dn_error(sk, flags, err);
+        err = sk_stream_error(sk, flags, err);
        release_sock(sk);
        return err;
 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7d076f0db100..3ed6fc15815b 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1370,15 +1370,21 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
        if (skb->len > cur_mss) {
                int old_factor = tcp_skb_pcount(skb);
-                int new_factor;
+                int diff;
                if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                        return -ENOMEM; /* We'll try again later. */
                /* New SKB created, account for it. */
-                new_factor = tcp_skb_pcount(skb);
+                diff = old_factor - tcp_skb_pcount(skb) -
-                tp->packets_out -= old_factor - new_factor;
+                       tcp_skb_pcount(skb->next);
-                tp->packets_out += tcp_skb_pcount(skb->next);
+                tp->packets_out -= diff;
+                if (diff > 0) {
+                        tp->fackets_out -= diff;
+                        if ((int)tp->fackets_out < 0)
+                                tp->fackets_out = 0;
+                }
        }
        /* Collapse two adjacent packets if worthwhile and we can. */
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 56db8f13e6cb..d0c3120d0233 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -586,7 +586,7 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
        }
        if (skb->stamp.tv_sec == 0) {
                skb->stamp.tv_sec = xtime.tv_sec; 
-                skb->stamp.tv_usec = xtime.tv_nsec * 1000; 
+                skb->stamp.tv_usec = xtime.tv_nsec / NSEC_PER_USEC; 
                /* Don't enable netstamp, sunrpc doesn't 
                   need that much accuracy */
        }
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 8a4d9c106af1..fde16f40a581 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
                        return -EINVAL;
        } else {
                if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+                    desc->array_len > desc->array_maxlen ||
                    (unsigned long) base + 4 + desc->array_len *
                                    desc->elem_size > buf->len)
                        return -EINVAL;