166 files changed, 1010 insertions, 562 deletions
diff --git a/.gitignore b/.gitignore
index e1d5c17c12c2..9eb4b7711499 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,7 @@
 # Top-level generic files
 #
 tags
+TAGS
 vmlinux*
 System.map
 Module.symvers
diff --git a/Documentation/filesystems/udf.txt b/Documentation/filesystems/udf.txt
index 511b4230c053..fde829a756e6 100644
--- a/Documentation/filesystems/udf.txt
+++ b/Documentation/filesystems/udf.txt
@@ -7,8 +7,17 @@ If you encounter problems with reading UDF discs using this driver,
 please report them to linux_udf@hpesjro.fc.hp.com, which is the
 developer's list.
-Write support requires a block driver which supports writing. The current
+Write support requires a block driver which supports writing.  Currently
-scsi and ide cdrom drivers do not support writing.
+dvd+rw drives and media support true random sector writes, and so a udf
+filesystem on such devices can be directly mounted read/write.  CD-RW
+media however, does not support this.  Instead the media can be formatted
+for packet mode using the utility cdrwtool, then the pktcdvd driver can
+be bound to the underlying cd device to provide the required buffering
+and read-modify-write cycles to allow the filesystem random sector writes
+while providing the hardware with only full packet writes.  While not
+required for dvd+rw media, use of the pktcdvd driver often enhances
+performance due to very poor read-modify-write support supplied internally
+by drive firmware.
 -------------------------------------------------------------------------------
 The following mount options are supported:
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index dd00fd556a60..67473849f20e 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -164,6 +164,10 @@ and is between 256 and 4096 characters. It is defined in the file
        acpi_skip_timer_override [HW,ACPI]
                        Recognize and ignore IRQ0/pin2 Interrupt Override.
                        For broken nForce2 BIOS resulting in XT-PIC timer.
+        acpi_use_timer_override [HW,ACPI}
+                        Use timer override. For some broken Nvidia NF5 boards
+                        that require a timer override, but don't have
+                        HPET
        acpi_dbg_layer= [HW,ACPI]
                        Format: <int>
diff --git a/Documentation/kprobes.txt b/Documentation/kprobes.txt
index ba26201d5023..d71fafffce90 100644
--- a/Documentation/kprobes.txt
+++ b/Documentation/kprobes.txt
@@ -442,9 +442,10 @@ static int __init kprobe_init(void)
        kp.fault_handler = handler_fault;
        kp.symbol_name = "do_fork";
-        if ((ret = register_kprobe(&kp) < 0)) {
+        ret = register_kprobe(&kp);
+        if (ret < 0) {
                printk("register_kprobe failed, returned %d\n", ret);
-                return -1;
+                return ret;
        }
        printk("kprobe registered\n");
        return 0;
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 138673a907f5..3472d9c4ef1b 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -753,7 +753,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
    position_fix - Fix DMA pointer (0 = auto, 1 = none, 2 = POSBUF, 3 = FIFO size)
    single_cmd  - Use single immediate commands to communicate with
                codecs (for debugging only)
-    disable_msi - Disable Message Signaled Interrupt (MSI)
+    enable_msi  - Enable Message Signaled Interrupt (MSI) (default = off)
    This module supports one card and autoprobe.
diff --git a/MAINTAINERS b/MAINTAINERS
index 8732daeae303..a5508f930ed9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3072,6 +3072,13 @@ L:	video4linux-list@redhat.com
 W:      http://www.linux-projects.org
 S:      Maintained
+USB GADGET/PERIPHERAL SUBSYSTEM
+P:      David Brownell
+M:      dbrownell@users.sourceforge.net
+L:      linux-usb-devel@lists.sourceforge.net
+W:      http://www.linux-usb.org/gadget
+S:      Maintained
 USB HID/HIDBP DRIVERS
 P:      Vojtech Pavlik
 M:      vojtech@suse.cz
@@ -3255,10 +3262,11 @@ L:	linux-usb-users@lists.sourceforge.net
 L:      linux-usb-devel@lists.sourceforge.net
 S:      Maintained
-USB "USBNET" DRIVER
+USB "USBNET" DRIVER FRAMEWORK
 P:      David Brownell
 M:      dbrownell@users.sourceforge.net
 L:      linux-usb-devel@lists.sourceforge.net
+W:      http://www.linux-usb.org/usbnet
 S:      Maintained
 USB W996[87]CF DRIVER
diff --git a/Makefile b/Makefile
index 8484be116e96..958fad6739b3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 19
-EXTRAVERSION =-rc5
+EXTRAVERSION =-rc6
 NAME=Avast! A bilge rat!
 # *DOCUMENTATION*
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 22e4c466e5a3..d12fb97a5337 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -82,6 +82,7 @@ EXPORT_SYMBOL(acpi_strict);
 acpi_interrupt_flags acpi_sci_flags __initdata;
 int acpi_sci_override_gsi __initdata;
 int acpi_skip_timer_override __initdata;
+int acpi_use_timer_override __initdata;
 #ifdef CONFIG_X86_LOCAL_APIC
 static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE;
@@ -1300,6 +1301,13 @@ static int __init parse_acpi_skip_timer_override(char *arg)
        return 0;
 }
 early_param("acpi_skip_timer_override", parse_acpi_skip_timer_override);
+static int __init parse_acpi_use_timer_override(char *arg)
+{
+        acpi_use_timer_override = 1;
+        return 0;
+}
+early_param("acpi_use_timer_override", parse_acpi_use_timer_override);
 #endif /* CONFIG_X86_IO_APIC */
 static int __init setup_acpi_sci(char *s)
diff --git a/arch/i386/kernel/acpi/earlyquirk.c b/arch/i386/kernel/acpi/earlyquirk.c
index fe799b11ac0a..c9841692bb7c 100644
--- a/arch/i386/kernel/acpi/earlyquirk.c
+++ b/arch/i386/kernel/acpi/earlyquirk.c
@@ -27,11 +27,17 @@ static int __init check_bridge(int vendor, int device)
 #ifdef CONFIG_ACPI
        /* According to Nvidia all timer overrides are bogus unless HPET
           is enabled. */
-        if (vendor == PCI_VENDOR_ID_NVIDIA) {
+        if (!acpi_use_timer_override && vendor == PCI_VENDOR_ID_NVIDIA) {
                nvidia_hpet_detected = 0;
                acpi_table_parse(ACPI_HPET, nvidia_hpet_check);
                if (nvidia_hpet_detected == 0) {
                        acpi_skip_timer_override = 1;
+                          printk(KERN_INFO "Nvidia board "
+                       "detected. Ignoring ACPI "
+                       "timer override.\n");
+                printk(KERN_INFO "If you got timer trouble "
+                                 "try acpi_use_timer_override\n");
                }
        }
 #endif
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index ad84bc2802a6..3b7a63e0ed1a 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -1287,9 +1287,11 @@ static void ioapic_register_intr(int irq, int vector, unsigned long trigger)
                        trigger == IOAPIC_LEVEL)
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                         handle_fasteoi_irq, "fasteoi");
-        else
+        else {
+                irq_desc[irq].status |= IRQ_DELAYED_DISABLE;
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                         handle_edge_irq, "edge");
+        }
        set_intr_gate(vector, interrupt[irq]);
 }
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index dbc4aae91959..69163998adeb 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -255,13 +255,13 @@ static int pirq_via_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
 */
 static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
 {
-        static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+        static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
        return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
 }
 static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq)
 {
-        static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+        static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
        write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
        return 1;
 }
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 14682396f7f7..683b12c6f76c 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -484,6 +484,15 @@ source "net/Kconfig"
 source "drivers/Kconfig"
+config MSPEC
+        tristate "Memory special operations driver"
+        depends on IA64
+        select IA64_UNCACHED_ALLOCATOR
+        help
+          If you have an ia64 and you want to enable memory special
+          operations support (formerly known as fetchop), say Y here,
+          otherwise say N.
 source "fs/Kconfig"
 source "lib/Kconfig"
diff --git a/arch/ia64/hp/sim/Kconfig b/arch/ia64/hp/sim/Kconfig
index 18ccb1266e18..f92306bbedb8 100644
--- a/arch/ia64/hp/sim/Kconfig
+++ b/arch/ia64/hp/sim/Kconfig
@@ -13,8 +13,8 @@ config HP_SIMSERIAL_CONSOLE
        depends on HP_SIMSERIAL
 config HP_SIMSCSI
-        tristate "Simulated SCSI disk"
+        bool "Simulated SCSI disk"
-        depends on SCSI
+        depends on SCSI=y
 endmenu
diff --git a/arch/ia64/hp/sim/hpsim_irq.c b/arch/ia64/hp/sim/hpsim_irq.c
index 8145547bb52d..c2f58ff364e7 100644
--- a/arch/ia64/hp/sim/hpsim_irq.c
+++ b/arch/ia64/hp/sim/hpsim_irq.c
@@ -27,7 +27,7 @@ hpsim_set_affinity_noop (unsigned int a, cpumask_t b)
 }
 static struct hw_interrupt_type irq_type_hp_sim = {
-        .typename =     "hpsim",
+        .name =         "hpsim",
        .startup =      hpsim_irq_startup,
        .shutdown =     hpsim_irq_noop,
        .enable =       hpsim_irq_noop,
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index 9bf15fefa7e4..60d64950e3c2 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -426,7 +426,7 @@ iosapic_end_level_irq (unsigned int irq)
 #define iosapic_ack_level_irq           nop
 struct hw_interrupt_type irq_type_iosapic_level = {
-        .typename =     "IO-SAPIC-level",
+        .name =         "IO-SAPIC-level",
        .startup =      iosapic_startup_level_irq,
        .shutdown =     iosapic_shutdown_level_irq,
        .enable =       iosapic_enable_level_irq,
@@ -473,7 +473,7 @@ iosapic_ack_edge_irq (unsigned int irq)
 #define iosapic_end_edge_irq            nop
 struct hw_interrupt_type irq_type_iosapic_edge = {
-        .typename =     "IO-SAPIC-edge",
+        .name =         "IO-SAPIC-edge",
        .startup =      iosapic_startup_edge_irq,
        .shutdown =     iosapic_disable_edge_irq,
        .enable =       iosapic_enable_edge_irq,
@@ -664,7 +664,7 @@ register_intr (unsigned int gsi, int vector, unsigned char delivery,
                        printk(KERN_WARNING
                               "%s: changing vector %d from %s to %s\n",
                               __FUNCTION__, vector,
-                               idesc->chip->typename, irq_type->typename);
+                               idesc->chip->name, irq_type->name);
                idesc->chip = irq_type;
        }
        return 0;
diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
index f07c0864b0b4..54d55e4d64f7 100644
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -76,7 +76,7 @@ int show_interrupts(struct seq_file *p, void *v)
                        seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
                }
 #endif
-                seq_printf(p, " %14s", irq_desc[i].chip->typename);
+                seq_printf(p, " %14s", irq_desc[i].chip->name);
                seq_printf(p, "  %s", action->name);
                for (action=action->next; action; action = action->next)
@@ -197,7 +197,7 @@ void fixup_irqs(void)
                        struct pt_regs *old_regs = set_irq_regs(NULL);
                        vectors_in_migration[irq]=0;
-                        __do_IRQ(irq);
+                        generic_handle_irq(irq);
                        set_irq_regs(old_regs);
                }
        }
diff --git a/arch/ia64/kernel/irq_ia64.c b/arch/ia64/kernel/irq_ia64.c
index 9c6dafa2d0df..ba3ba8bc50be 100644
--- a/arch/ia64/kernel/irq_ia64.c
+++ b/arch/ia64/kernel/irq_ia64.c
@@ -186,7 +186,7 @@ ia64_handle_irq (ia64_vector vector, struct pt_regs *regs)
                        ia64_setreg(_IA64_REG_CR_TPR, vector);
                        ia64_srlz_d();
-                        __do_IRQ(local_vector_to_irq(vector));
+                        generic_handle_irq(local_vector_to_irq(vector));
                        /*
                         * Disable interrupts and send EOI:
@@ -242,7 +242,7 @@ void ia64_process_pending_intr(void)
                         * Probably could shared code.
                         */
                        vectors_in_migration[local_vector_to_irq(vector)]=0;
-                        __do_IRQ(local_vector_to_irq(vector));
+                        generic_handle_irq(local_vector_to_irq(vector));
                        set_irq_regs(old_regs);
                        /*
diff --git a/arch/ia64/kernel/irq_lsapic.c b/arch/ia64/kernel/irq_lsapic.c
index 1ab58b09f3d7..c2f07beb1759 100644
--- a/arch/ia64/kernel/irq_lsapic.c
+++ b/arch/ia64/kernel/irq_lsapic.c
@@ -34,7 +34,7 @@ static int lsapic_retrigger(unsigned int irq)
 }
 struct hw_interrupt_type irq_type_ia64_lsapic = {
-        .typename =     "LSAPIC",
+        .name =         "LSAPIC",
        .startup =      lsapic_noop_startup,
        .shutdown =     lsapic_noop,
        .enable =       lsapic_noop,
diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
index eee5c1cfbe32..f3a9585e98a8 100644
--- a/arch/ia64/mm/hugetlbpage.c
+++ b/arch/ia64/mm/hugetlbpage.c
@@ -70,8 +70,10 @@ huge_pte_offset (struct mm_struct *mm, unsigned long addr)
 * Don't actually need to do any preparation, but need to make sure
 * the address is in the right region.
 */
-int prepare_hugepage_range(unsigned long addr, unsigned long len)
+int prepare_hugepage_range(unsigned long addr, unsigned long len, pgoff_t pgoff)
 {
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
        if (len & ~HPAGE_MASK)
                return -EINVAL;
        if (addr & ~HPAGE_MASK)
diff --git a/arch/ia64/sn/kernel/bte.c b/arch/ia64/sn/kernel/bte.c
index 7f73ad4408aa..ff1c55601178 100644
--- a/arch/ia64/sn/kernel/bte.c
+++ b/arch/ia64/sn/kernel/bte.c
@@ -381,14 +381,13 @@ bte_result_t bte_unaligned_copy(u64 src, u64 dest, u64 len, u64 mode)
                 * bcopy to the destination.
                 */
-                /* Add the leader from source */
-                headBteLen = len + (src & L1_CACHE_MASK);
-                /* Add the trailing bytes from footer. */
-                headBteLen += L1_CACHE_BYTES - (headBteLen & L1_CACHE_MASK);
-                headBteSource = src & ~L1_CACHE_MASK;
                headBcopySrcOffset = src & L1_CACHE_MASK;
                headBcopyDest = dest;
                headBcopyLen = len;
+                headBteSource = src - headBcopySrcOffset;
+                /* Add the leading and trailing bytes from source */
+                headBteLen = L1_CACHE_ALIGN(len + headBcopySrcOffset);
        }
        if (headBcopyLen > 0) {
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index 7bb6ad188ba3..0b49459a878a 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -201,7 +201,7 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
 }
 struct hw_interrupt_type irq_type_sn = {
-        .typename       = "SN hub",
+        .name           = "SN hub",
        .startup        = sn_startup_irq,
        .shutdown       = sn_shutdown_irq,
        .enable         = sn_enable_irq,
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 2bd9b7fb0f6c..0673dbedb241 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -740,7 +740,7 @@ config ARCH_SPARSEMEM_ENABLE
 config ARCH_SPARSEMEM_DEFAULT
        def_bool y
-        depends on SMP && PPC_PSERIES
+        depends on (SMP && PPC_PSERIES) || PPC_CELL
 config ARCH_POPULATES_NODE_MAP
        def_bool y
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index eab7318729e9..b5fb1fee76f8 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -179,11 +179,11 @@ if [ -z "$cacheit" ]; then
 fi
 if [ -n "$initrd" ]; then
-    addsec $tmp "$initrd" initrd
+    addsec $tmp "$initrd" $isection
 fi
 if [ -n "$dtb" ]; then
-    addsec $tmp "$dtb" dtb
+    addsec $tmp "$dtb" .kernel:dtb
 fi
 if [ "$platform" != "miboot" ]; then
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 4b6bb3ffe3dc..4be3c6414b04 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -21,6 +21,11 @@ SECTIONS
    __got2_end = .;
  }
+  . = ALIGN(8);
+  _dtb_start = .;
+  .kernel:dtb : { *(.kernel:dtb) }
+  _dtb_end = .;
  . = ALIGN(4096);
  _vmlinux_start =  .;
  .kernel:vmlinux.strip : { *(.kernel:vmlinux.strip) }
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 1442b63a75da..6f6fc977cb39 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -72,6 +72,10 @@
 #define VALIDATE_BUF_SIZE 4096    
 #define RTAS_MSG_MAXLEN   64
+/* Quirk - RTAS requires 4k list length and block size */
+#define RTAS_BLKLIST_LENGTH 4096
+#define RTAS_BLK_SIZE 4096
 struct flash_block {
        char *data;
        unsigned long length;
@@ -83,7 +87,7 @@ struct flash_block {
 * into a version/length and translate the pointers
 * to absolute.
 */
-#define FLASH_BLOCKS_PER_NODE ((PAGE_SIZE - 16) / sizeof(struct flash_block))
+#define FLASH_BLOCKS_PER_NODE ((RTAS_BLKLIST_LENGTH - 16) / sizeof(struct flash_block))
 struct flash_block_list {
        unsigned long num_blocks;
        struct flash_block_list *next;
@@ -96,6 +100,9 @@ struct flash_block_list_header { /* just the header of flash_block_list */
 static struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
+/* Use slab cache to guarantee 4k alignment */
+static kmem_cache_t *flash_block_cache = NULL;
 #define FLASH_BLOCK_LIST_VERSION (1UL)
 /* Local copy of the flash block list.
@@ -153,7 +160,7 @@ static int flash_list_valid(struct flash_block_list *flist)
                                return FLASH_IMG_NULL_DATA;
                        }
                        block_size = f->blocks[i].length;
-                        if (block_size <= 0 || block_size > PAGE_SIZE) {
+                        if (block_size <= 0 || block_size > RTAS_BLK_SIZE) {
                                return FLASH_IMG_BAD_LEN;
                        }
                        image_size += block_size;
@@ -177,9 +184,9 @@ static void free_flash_list(struct flash_block_list *f)
        while (f) {
                for (i = 0; i < f->num_blocks; i++)
-                        free_page((unsigned long)(f->blocks[i].data));
+                        kmem_cache_free(flash_block_cache, f->blocks[i].data);
                next = f->next;
-                free_page((unsigned long)f);
+                kmem_cache_free(flash_block_cache, f);
                f = next;
        }
 }
@@ -278,6 +285,12 @@ static ssize_t rtas_flash_read(struct file *file, char __user *buf,
        return msglen;
 }
+/* constructor for flash_block_cache */
+void rtas_block_ctor(void *ptr, kmem_cache_t *cache, unsigned long flags)
+{
+        memset(ptr, 0, RTAS_BLK_SIZE);
+}
 /* We could be much more efficient here.  But to keep this function
 * simple we allocate a page to the block list no matter how small the
 * count is.  If the system is low on memory it will be just as well
@@ -302,7 +315,7 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
         * proc file
         */
        if (uf->flist == NULL) {
-                uf->flist = (struct flash_block_list *) get_zeroed_page(GFP_KERNEL);
+                uf->flist = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                if (!uf->flist)
                        return -ENOMEM;
        }
@@ -313,21 +326,21 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
        next_free = fl->num_blocks;
        if (next_free == FLASH_BLOCKS_PER_NODE) {
                /* Need to allocate another block_list */
-                fl->next = (struct flash_block_list *)get_zeroed_page(GFP_KERNEL);
+                fl->next = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                if (!fl->next)
                        return -ENOMEM;
                fl = fl->next;
                next_free = 0;
        }
-        if (count > PAGE_SIZE)
+        if (count > RTAS_BLK_SIZE)
-                count = PAGE_SIZE;
+                count = RTAS_BLK_SIZE;
-        p = (char *)get_zeroed_page(GFP_KERNEL);
+        p = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
        if (!p)
                return -ENOMEM;
        
        if(copy_from_user(p, buffer, count)) {
-                free_page((unsigned long)p);
+                kmem_cache_free(flash_block_cache, p);
                return -EFAULT;
        }
        fl->blocks[next_free].data = p;
@@ -791,6 +804,16 @@ int __init rtas_flash_init(void)
                goto cleanup;
        rtas_flash_term_hook = rtas_flash_firmware;
+        flash_block_cache = kmem_cache_create("rtas_flash_cache",
+                                RTAS_BLK_SIZE, RTAS_BLK_SIZE, 0,
+                                rtas_block_ctor, NULL);
+        if (!flash_block_cache) {
+                printk(KERN_ERR "%s: failed to create block cache\n",
+                                __FUNCTION__);
+                rc = -ENOMEM;
+                goto cleanup;
+        }
        return 0;
 cleanup:
@@ -805,6 +828,10 @@ cleanup:
 void __exit rtas_flash_cleanup(void)
 {
        rtas_flash_term_hook = NULL;
+        if (flash_block_cache)
+                kmem_cache_destroy(flash_block_cache);
        remove_flash_pde(firmware_flash_pde);
        remove_flash_pde(firmware_update_pde);
        remove_flash_pde(validate_pde);
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index fd68b74c07c3..506d89768d45 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -491,11 +491,15 @@ static int open_high_hpage_areas(struct mm_struct *mm, u16 newareas)
        return 0;
 }
-int prepare_hugepage_range(unsigned long addr, unsigned long len)
+int prepare_hugepage_range(unsigned long addr, unsigned long len, pgoff_t pgoff)
 {
        int err = 0;
-        if ( (addr+len) < addr )
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
+        if (len & ~HPAGE_MASK)
+                return -EINVAL;
+        if (addr & ~HPAGE_MASK)
                return -EINVAL;
        if (addr < 0x100000000UL)
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index d0fb959e3ef1..7aa809d5a244 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -655,14 +655,19 @@ static int __init spu_map_interrupts(struct spu *spu, struct device_node *np)
        for (i=0; i < 3; i++) {
                ret = of_irq_map_one(np, i, &oirq);
-                if (ret)
+                if (ret) {
+                        pr_debug("spu_new: failed to get irq %d\n", i);
                        goto err;
+                }
                ret = -EINVAL;
+                pr_debug("  irq %d no 0x%x on %s\n", i, oirq.specifier[0],
+                         oirq.controller->full_name);
                spu->irqs[i] = irq_create_of_mapping(oirq.controller,
                                        oirq.specifier, oirq.size);
-                if (spu->irqs[i] == NO_IRQ)
+                if (spu->irqs[i] == NO_IRQ) {
+                        pr_debug("spu_new: failed to map it !\n");
                        goto err;
+                }
        }
        return 0;
@@ -681,7 +686,7 @@ static int spu_map_resource(struct device_node *node, int nr,
        struct resource resource = { };
        int ret;
-        ret = of_address_to_resource(node, 0, &resource);
+        ret = of_address_to_resource(node, nr, &resource);
        if (ret)
                goto out;
@@ -704,22 +709,42 @@ static int __init spu_map_device(struct spu *spu, struct device_node *node)
        ret = spu_map_resource(node, 0, (void __iomem**)&spu->local_store,
                                        &spu->local_store_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 0\n",
+                         node->full_name);
                goto out;
+        }
        ret = spu_map_resource(node, 1, (void __iomem**)&spu->problem,
                                        &spu->problem_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 1\n",
+                         node->full_name);
                goto out_unmap;
+        }
        ret = spu_map_resource(node, 2, (void __iomem**)&spu->priv2,
                                        NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 2\n",
+                         node->full_name);
                goto out_unmap;
+        }
        if (!firmware_has_feature(FW_FEATURE_LPAR))
                ret = spu_map_resource(node, 3, (void __iomem**)&spu->priv1,
                                        NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 3\n",
+                         node->full_name);
                goto out_unmap;
+        }
+        pr_debug("spu_new: %s maps:\n", node->full_name);
+        pr_debug("  local store   : 0x%016lx -> 0x%p\n",
+                 spu->local_store_phys, spu->local_store);
+        pr_debug("  problem state : 0x%016lx -> 0x%p\n",
+                 spu->problem_phys, spu->problem);
+        pr_debug("  priv2         :                       0x%p\n", spu->priv2);
+        pr_debug("  priv1         :                       0x%p\n", spu->priv1);
        return 0;
 out_unmap:
diff --git a/arch/x86_64/boot/setup.S b/arch/x86_64/boot/setup.S
index c3bfd223ab49..770940cc0108 100644
--- a/arch/x86_64/boot/setup.S
+++ b/arch/x86_64/boot/setup.S
@@ -836,13 +836,12 @@ gdt:
        .word   0x9200                          # data read/write
        .word   0x00CF                          # granularity = 4096, 386
                                                #  (+5th nibble of limit)
+gdt_end:
 idt_48:
        .word   0                               # idt limit = 0
        .word   0, 0                            # idt base = 0L
 gdt_48:
-        .word   0x8000                          # gdt limit=2048,
+        .word   gdt_end-gdt-1                   # gdt limit
-                                                #  256 GDT entries
        .word   0, 0                            # gdt base (filled in later)
 # Include video setup & detection code
diff --git a/arch/x86_64/ia32/ptrace32.c b/arch/x86_64/ia32/ptrace32.c
index 3a7561d4703e..04566fe5de49 100644
--- a/arch/x86_64/ia32/ptrace32.c
+++ b/arch/x86_64/ia32/ptrace32.c
@@ -244,6 +244,8 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
        case PTRACE_DETACH:
        case PTRACE_SYSCALL:
        case PTRACE_SETOPTIONS:
+        case PTRACE_SET_THREAD_AREA:
+        case PTRACE_GET_THREAD_AREA:
                return sys_ptrace(request, pid, addr, data); 
        default:
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index a75c829c2b02..6fe191c58084 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -278,7 +278,7 @@ e820_register_active_regions(int nid, unsigned long start_pfn,
                                                                >> PAGE_SHIFT;
                /* Skip map entries smaller than a page */
-                if (ei_startpfn > ei_endpfn)
+                if (ei_startpfn >= ei_endpfn)
                        continue;
                /* Check if end_pfn_map should be updated */
@@ -594,7 +594,9 @@ static int __init parse_memmap_opt(char *p)
                 * size before original memory map is
                 * reset.
                 */
+                e820_register_active_regions(0, 0, -1UL);
                saved_max_pfn = e820_end_of_ram();
+                remove_all_active_ranges();
 #endif
                end_pfn_map = 0;
                e820.nr_map = 0;
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 2b1245d86258..68273bff58cc 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -45,7 +45,13 @@ static void nvidia_bugs(void)
        /*
         * All timer overrides on Nvidia are
         * wrong unless HPET is enabled.
+         * Unfortunately that's not true on many Asus boards.
+         * We don't know yet how to detect this automatically, but
+         * at least allow a command line override.
         */
+        if (acpi_use_timer_override)
+                return;
        nvidia_hpet_detected = 0;
        acpi_table_parse(ACPI_HPET, nvidia_hpet_check);
        if (nvidia_hpet_detected == 0) {
@@ -53,6 +59,8 @@ static void nvidia_bugs(void)
                printk(KERN_INFO "Nvidia board "
                       "detected. Ignoring ACPI "
                       "timer override.\n");
+                printk(KERN_INFO "If you got timer trouble "
+                        "try acpi_use_timer_override\n");
        }
 #endif
        /* RED-PEN skip them on mptables too? */
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 41bfc49301ad..14654e682411 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -790,9 +790,11 @@ static void ioapic_register_intr(int irq, int vector, unsigned long trigger)
                        trigger == IOAPIC_LEVEL)
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                              handle_fasteoi_irq, "fasteoi");
-        else
+        else {
+                irq_desc[irq].status |= IRQ_DELAYED_DISABLE;
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                              handle_edge_irq, "edge");
+        }
 }
 static void __init setup_IO_APIC_irqs(void)
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index 49f7fac6229e..f6226055d53d 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -88,9 +88,8 @@ void enter_idle(void)
 static void __exit_idle(void)
 {
-        if (read_pda(isidle) == 0)
+        if (test_and_clear_bit_pda(0, isidle) == 0)
                return;
-        write_pda(isidle, 0);
        atomic_notifier_call_chain(&idle_notifier, IDLE_END, NULL);
 }
diff --git a/arch/x86_64/kernel/smp.c b/arch/x86_64/kernel/smp.c
index 4f67697f5036..9f74c883568c 100644
--- a/arch/x86_64/kernel/smp.c
+++ b/arch/x86_64/kernel/smp.c
@@ -376,9 +376,8 @@ int smp_call_function_single (int cpu, void (*func) (void *info), void *info,
        /* prevent preemption and reschedule on another processor */
        int me = get_cpu();
        if (cpu == me) {
-                WARN_ON(1);
                put_cpu();
-                return -EBUSY;
+                return 0;
        }
        spin_lock_bh(&call_lock);
        __smp_call_function_single(cpu, func, info, nonatomic, wait);
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 88722f11ca13..e3ef544d2cfb 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -876,15 +876,6 @@ static struct irqaction irq0 = {
        timer_interrupt, IRQF_DISABLED, CPU_MASK_NONE, "timer", NULL, NULL
 };
-static int __cpuinit
-time_cpu_notifier(struct notifier_block *nb, unsigned long action, void *hcpu)
-{
-        unsigned cpu = (unsigned long) hcpu;
-        if (action == CPU_ONLINE)
-                vsyscall_set_cpu(cpu);
-        return NOTIFY_DONE;
-}
 void __init time_init(void)
 {
        if (nohpet)
@@ -925,8 +916,6 @@ void __init time_init(void)
        vxtime.last_tsc = get_cycles_sync();
        set_cyc2ns_scale(cpu_khz);
        setup_irq(0, &irq0);
-        hotcpu_notifier(time_cpu_notifier, 0);
-        time_cpu_notifier(NULL, CPU_ONLINE, (void *)(long)smp_processor_id());
 #ifndef CONFIG_SMP
        time_init_gtod();
diff --git a/arch/x86_64/kernel/vsyscall.c b/arch/x86_64/kernel/vsyscall.c
index a98b460af6a1..a730bacecb0b 100644
--- a/arch/x86_64/kernel/vsyscall.c
+++ b/arch/x86_64/kernel/vsyscall.c
@@ -27,6 +27,9 @@
 #include <linux/jiffies.h>
 #include <linux/sysctl.h>
 #include <linux/getcpu.h>
+#include <linux/cpu.h>
+#include <linux/smp.h>
+#include <linux/notifier.h>
 #include <asm/vsyscall.h>
 #include <asm/pgtable.h>
@@ -243,32 +246,17 @@ static ctl_table kernel_root_table2[] = {
 #endif
-static void __cpuinit write_rdtscp_cb(void *info)
+/* Assume __initcall executes before all user space. Hopefully kmod
-{
+   doesn't violate that. We'll find out if it does. */
-        write_rdtscp_aux((unsigned long)info);
+static void __cpuinit vsyscall_set_cpu(int cpu)
-}
-void __cpuinit vsyscall_set_cpu(int cpu)
 {
        unsigned long *d;
        unsigned long node = 0;
 #ifdef CONFIG_NUMA
        node = cpu_to_node[cpu];
 #endif
-        if (cpu_has(&cpu_data[cpu], X86_FEATURE_RDTSCP)) {
+        if (cpu_has(&cpu_data[cpu], X86_FEATURE_RDTSCP))
-                void *info = (void *)((node << 12) | cpu);
+                write_rdtscp_aux((node << 12) | cpu);
-                /* Can happen on preemptive kernel */
-                if (get_cpu() == cpu)
-                        write_rdtscp_cb(info);
-#ifdef CONFIG_SMP
-                else {
-                        /* the notifier is unfortunately not executed on the
-                           target CPU */
-                        smp_call_function_single(cpu,write_rdtscp_cb,info,0,1);
-                }
-#endif
-                put_cpu();
-        }
        /* Store cpu number in limit so that it can be loaded quickly
           in user space in vgetcpu.
@@ -280,6 +268,21 @@ void __cpuinit vsyscall_set_cpu(int cpu)
        *d |= (node >> 4) << 48;
 }
+static void __cpuinit cpu_vsyscall_init(void *arg)
+{
+        /* preemption should be already off */
+        vsyscall_set_cpu(raw_smp_processor_id());
+}
+static int __cpuinit
+cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
+{
+        long cpu = (long)arg;
+        if (action == CPU_ONLINE)
+                smp_call_function_single(cpu, cpu_vsyscall_init, NULL, 0, 1);
+        return NOTIFY_DONE;
+}
 static void __init map_vsyscall(void)
 {
        extern char __vsyscall_0;
@@ -299,6 +302,8 @@ static int __init vsyscall_init(void)
 #ifdef CONFIG_SYSCTL
        register_sysctl_table(kernel_root_table2, 0);
 #endif
+        on_each_cpu(cpu_vsyscall_init, NULL, 0, 1);
+        hotcpu_notifier(cpu_vsyscall_notifier, 0);
        return 0;
 }
diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index 971dc1181e69..f1f977aafae1 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -655,9 +655,22 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 void __init reserve_bootmem_generic(unsigned long phys, unsigned len) 
 { 
-        /* Should check here against the e820 map to avoid double free */ 
 #ifdef CONFIG_NUMA
        int nid = phys_to_nid(phys);
+#endif
+        unsigned long pfn = phys >> PAGE_SHIFT;
+        if (pfn >= end_pfn) {
+                /* This can happen with kdump kernels when accessing firmware
+                   tables. */
+                if (pfn < end_pfn_map)
+                        return;
+                printk(KERN_ERR "reserve_bootmem: illegal reserve %lx %u\n",
+                                phys, len);
+                return;
+        }
+        /* Should check here against the e820 map to avoid double free */
+#ifdef CONFIG_NUMA
        reserve_bootmem_node(NODE_DATA(nid), phys, len);
 #else                   
        reserve_bootmem(phys, len);    
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index e61093b34c26..f8b6b2800a62 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -163,37 +163,6 @@ static __init void unreachable_devices(void)
        }
 }
-static __init void pci_mmcfg_insert_resources(void)
-{
-#define PCI_MMCFG_RESOURCE_NAME_LEN 19
-        int i;
-        struct resource *res;
-        char *names;
-        unsigned num_buses;
-        res = kcalloc(PCI_MMCFG_RESOURCE_NAME_LEN + sizeof(*res),
-                        pci_mmcfg_config_num, GFP_KERNEL);
-        if (!res) {
-                printk(KERN_ERR "PCI: Unable to allocate MMCONFIG resources\n");
-                return;
-        }
-        names = (void *)&res[pci_mmcfg_config_num];
-        for (i = 0; i < pci_mmcfg_config_num; i++, res++) {
-                num_buses = pci_mmcfg_config[i].end_bus_number -
-                    pci_mmcfg_config[i].start_bus_number + 1;
-                res->name = names;
-                snprintf(names, PCI_MMCFG_RESOURCE_NAME_LEN, "PCI MMCONFIG %u",
-                        pci_mmcfg_config[i].pci_segment_group_number);
-                res->start = pci_mmcfg_config[i].base_address;
-                res->end = res->start + (num_buses << 20) - 1;
-                res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
-                insert_resource(&iomem_resource, res);
-                names += PCI_MMCFG_RESOURCE_NAME_LEN;
-        }
-}
 void __init pci_mmcfg_init(int type)
 {
        int i;
@@ -237,7 +206,6 @@ void __init pci_mmcfg_init(int type)
        }
        unreachable_devices();
-        pci_mmcfg_insert_resources();
        raw_pci_ops = &pci_mmcfg;
        pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 2dc326421a24..e55a75621437 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -246,10 +246,10 @@ static int sg_io(struct file *file, request_queue_t *q,
                switch (hdr->dxfer_direction) {
                default:
                        return -EINVAL;
-                case SG_DXFER_TO_FROM_DEV:
                case SG_DXFER_TO_DEV:
                        writing = 1;
                        break;
+                case SG_DXFER_TO_FROM_DEV:
                case SG_DXFER_FROM_DEV:
                        break;
                }
@@ -286,9 +286,8 @@ static int sg_io(struct file *file, request_queue_t *q,
         * fill in request structure
         */
        rq->cmd_len = hdr->cmd_len;
+        memset(rq->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
        memcpy(rq->cmd, cmd, hdr->cmd_len);
-        if (sizeof(rq->cmd) != hdr->cmd_len)
-                memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len);
        memset(sense, 0, sizeof(sense));
        rq->sense = sense;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index a8fd0c3e59b3..915a55a6cc14 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5957,7 +5957,7 @@ static void __exit ata_exit(void)
        destroy_workqueue(ata_aux_wq);
 }
-module_init(ata_init);
+subsys_initcall(ata_init);
 module_exit(ata_exit);
 static unsigned long ratelimit_time;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 7af2a4ba4990..5c1fc467fc7f 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1612,9 +1612,9 @@ early_finish:
 err_did:
        ata_qc_free(qc);
-err_mem:
        cmd->result = (DID_ERROR << 16);
        done(cmd);
+err_mem:
        DPRINTK("EXIT - internal\n");
        return 0;
diff --git a/drivers/ata/pata_artop.c b/drivers/ata/pata_artop.c
index 690828eb5226..96a098020a8f 100644
--- a/drivers/ata/pata_artop.c
+++ b/drivers/ata/pata_artop.c
@@ -92,7 +92,7 @@ static int artop6260_pre_reset(struct ata_port *ap)
                return -ENOENT;
        pci_read_config_byte(pdev, 0x49, &tmp);
-        if (tmp & (1 >> ap->port_no))
+        if (tmp & (1 << ap->port_no))
                ap->cbl = ATA_CBL_PATA40;
        else
                ap->cbl = ATA_CBL_PATA80;
diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
index 7350443948c1..fce3fcdc7e79 100644
--- a/drivers/ata/pata_hpt37x.c
+++ b/drivers/ata/pata_hpt37x.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "pata_hpt37x"
-#define DRV_VERSION     "0.5"
+#define DRV_VERSION     "0.5.1"
 struct hpt_clock {
        u8      xfer_speed;
@@ -453,7 +453,13 @@ static int hpt37x_pre_reset(struct ata_port *ap)
 {
        u8 scr2, ata66;
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        static const struct pci_bits hpt37x_enable_bits[] = {
+                { 0x50, 1, 0x04, 0x04 },
+                { 0x54, 1, 0x04, 0x04 }
+        };
+        if (!pci_test_config_bits(pdev, &hpt37x_enable_bits[ap->port_no]))
+                return -ENOENT;
+                
        pci_read_config_byte(pdev, 0x5B, &scr2);
        pci_write_config_byte(pdev, 0x5B, scr2 & ~0x01);
        /* Cable register now active */
@@ -488,10 +494,17 @@ static void hpt37x_error_handler(struct ata_port *ap)
 static int hpt374_pre_reset(struct ata_port *ap)
 {
+        static const struct pci_bits hpt37x_enable_bits[] = {
+                { 0x50, 1, 0x04, 0x04 },
+                { 0x54, 1, 0x04, 0x04 }
+        };
        u16 mcr3, mcr6;
        u8 ata66;
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        if (!pci_test_config_bits(pdev, &hpt37x_enable_bits[ap->port_no]))
+                return -ENOENT;
+                
        /* Do the extra channel work */
        pci_read_config_word(pdev, 0x52, &mcr3);
        pci_read_config_word(pdev, 0x56, &mcr6);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 6ffe2b2bdacc..4105c3bf3476 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1300,6 +1300,12 @@ static void cciss_softirq_done(struct request *rq)
        complete_buffers(rq->bio, rq->errors);
+        if (blk_fs_request(rq)) {
+                const int rw = rq_data_dir(rq);
+                disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
+        }
 #ifdef CCISS_DEBUG
        printk("Done with %p\n", rq);
 #endif                          /* CCISS_DEBUG */
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 570d2f049323..d5f519ebbc08 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -998,6 +998,7 @@ static inline void complete_buffers(struct bio *bio, int ok)
 */
 static inline void complete_command(cmdlist_t *cmd, int timeout)
 {
+        struct request *rq = cmd->rq;
        int ok=1;
        int i, ddir;
@@ -1029,12 +1030,18 @@ static inline void complete_command(cmdlist_t *cmd, int timeout)
                pci_unmap_page(hba[cmd->ctlr]->pci_dev, cmd->req.sg[i].addr,
                                cmd->req.sg[i].size, ddir);
-        complete_buffers(cmd->rq->bio, ok);
+        complete_buffers(rq->bio, ok);
-        add_disk_randomness(cmd->rq->rq_disk);
+        if (blk_fs_request(rq)) {
+                const int rw = rq_data_dir(rq);
-        DBGPX(printk("Done with %p\n", cmd->rq););
+                disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
-        end_that_request_last(cmd->rq, ok ? 1 : -EIO);
+        }
+        add_disk_randomness(rq->rq_disk);
+        DBGPX(printk("Done with %p\n", rq););
+        end_that_request_last(rq, ok ? 1 : -EIO);
 }
 /*
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 39a9f8cc6412..2af12fc45115 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -409,14 +409,6 @@ config SGI_MBCS
         If you have an SGI Altix with an attached SABrick
         say Y or M here, otherwise say N.
-config MSPEC
-        tristate "Memory special operations driver"
-        depends on IA64
-        help
-          If you have an ia64 and you want to enable memory special
-          operations support (formerly known as fetchop), say Y here,
-          otherwise say N.
 source "drivers/serial/Kconfig"
 config UNIX98_PTYS
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 0b07ca1b71fa..c47add8e47df 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1854,7 +1854,7 @@ static ssize_t provides_dev_sdrs_show(struct device *dev,
        struct bmc_device *bmc = dev_get_drvdata(dev);
        return snprintf(buf, 10, "%u\n",
-                        bmc->id.device_revision && 0x80 >> 7);
+                        (bmc->id.device_revision & 0x80) >> 7);
 }
 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
@@ -1863,7 +1863,7 @@ static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
        struct bmc_device *bmc = dev_get_drvdata(dev);
        return snprintf(buf, 20, "%u\n",
-                        bmc->id.device_revision && 0x0F);
+                        bmc->id.device_revision & 0x0F);
 }
 static ssize_t firmware_rev_show(struct device *dev,
@@ -2118,7 +2118,7 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
                dev_set_drvdata(&bmc->dev->dev, bmc);
                kref_init(&bmc->refcount);
-                rv = platform_device_register(bmc->dev);
+                rv = platform_device_add(bmc->dev);
                mutex_unlock(&ipmidriver_mutex);
                if (rv) {
                        printk(KERN_ERR
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index abc5149e30e8..bb1fac104fda 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2346,7 +2346,7 @@ static int try_smi_init(struct smi_info *new_smi)
                new_smi->dev = &new_smi->pdev->dev;
                new_smi->dev->driver = &ipmi_driver;
-                rv = platform_device_register(new_smi->pdev);
+                rv = platform_device_add(new_smi->pdev);
                if (rv) {
                        printk(KERN_ERR
                               "ipmi_si_intf:"
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index e9e9bf31c369..58c955e390b3 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -1062,11 +1062,12 @@ static void isicom_shutdown_port(struct isi_port *port)
 static void isicom_close(struct tty_struct *tty, struct file *filp)
 {
        struct isi_port *port = tty->driver_data;
-        struct isi_board *card = port->card;
+        struct isi_board *card;
        unsigned long flags;
        if (!port)
                return;
+        card = port->card;
        if (isicom_paranoia_check(port, tty->name, "isicom_close"))
                return;
diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index 5c0dec39cf6c..235e89226112 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -72,7 +72,11 @@ enum {
        MSPEC_UNCACHED
 };
+#ifdef CONFIG_SGI_SN
 static int is_sn2;
+#else
+#define is_sn2          0
+#endif
 /*
 * One of these structures is allocated when an mspec region is mmaped. The
@@ -211,7 +215,7 @@ mspec_nopfn(struct vm_area_struct *vma, unsigned long address)
        if (vdata->type == MSPEC_FETCHOP)
                paddr = TO_AMO(maddr);
        else
-                paddr = __pa(TO_CAC(maddr));
+                paddr = maddr & ~__IA64_UNCACHED_OFFSET;
        pfn = paddr >> PAGE_SHIFT;
@@ -335,6 +339,7 @@ mspec_init(void)
         * The fetchop device only works on SN2 hardware, uncached and cached
         * memory drivers should both be valid on all ia64 hardware
         */
+#ifdef CONFIG_SGI_SN
        if (ia64_platform_is("sn2")) {
                is_sn2 = 1;
                if (is_shub2()) {
@@ -363,6 +368,7 @@ mspec_init(void)
                        goto free_scratch_pages;
                }
        }
+#endif
        ret = misc_register(&cached_miscdev);
        if (ret) {
                printk(KERN_ERR "%s: failed to register device %i\n",
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index 08b161798443..fc702e40bd43 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -705,17 +705,16 @@ static struct bin_attribute rbu_packet_size_attr = {
 static int __init dcdrbu_init(void)
 {
-        int rc = 0;
+        int rc;
        spin_lock_init(&rbu_data.lock);
        init_packet_head();
-        rbu_device =
+        rbu_device = platform_device_register_simple("dell_rbu", -1, NULL, 0);
-                platform_device_register_simple("dell_rbu", -1, NULL, 0);
+        if (IS_ERR(rbu_device)) {
-        if (!rbu_device) {
                printk(KERN_ERR
                        "dell_rbu:%s:platform_device_register_simple "
                        "failed\n", __FUNCTION__);
-                return -EIO;
+                return PTR_ERR(rbu_device);
        }
        rc = sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index bddfebdf91d8..88214943d00a 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -724,7 +724,7 @@ static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret)
                 * if we have an error, pass back CHECK_CONDITION as the
                 * scsi status byte
                 */
-                if (!rq->errors)
+                if (blk_pc_request(rq) && !rq->errors)
                        rq->errors = SAM_STAT_CHECK_CONDITION;
                /* Check for tray open. */
diff --git a/drivers/ide/legacy/hd.c b/drivers/ide/legacy/hd.c
index b1d5291531b7..45ed03591cd8 100644
--- a/drivers/ide/legacy/hd.c
+++ b/drivers/ide/legacy/hd.c
@@ -459,7 +459,7 @@ ok_to_read:
 #ifdef DEBUG
        printk("%s: read: sector %ld, remaining = %ld, buffer=%p\n",
                req->rq_disk->disk_name, req->sector, req->nr_sectors,
-                req->buffer+512));
+                req->buffer+512);
 #endif
        if (req->current_nr_sectors <= 0)
                end_request(req, 1);
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 493f4c65c7a2..a72bcea46ff6 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1750,7 +1750,7 @@ ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv,
                     */
                    (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) ||
                     rcv_has_same_gid(mad_agent_priv, wr, wc)))
-                        return wr;
+                        return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
        }
        /*
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 9e7bd94b958a..27fe242ed435 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1155,7 +1155,8 @@ static int __devinit c2_probe(struct pci_dev *pcidev,
                goto bail10;
        }
-        c2_register_device(c2dev);
+        if (c2_register_device(c2dev))
+                goto bail10;
        return 0;
diff --git a/drivers/infiniband/hw/amso1100/c2_provider.c b/drivers/infiniband/hw/amso1100/c2_provider.c
index da98d9f71429..fef972752912 100644
--- a/drivers/infiniband/hw/amso1100/c2_provider.c
+++ b/drivers/infiniband/hw/amso1100/c2_provider.c
@@ -757,20 +757,17 @@ static struct net_device *c2_pseudo_netdev_init(struct c2_dev *c2dev)
 int c2_register_device(struct c2_dev *dev)
 {
-        int ret;
+        int ret = -ENOMEM;
        int i;
        /* Register pseudo network device */
        dev->pseudo_netdev = c2_pseudo_netdev_init(dev);
-        if (dev->pseudo_netdev) {
+        if (!dev->pseudo_netdev)
-                ret = register_netdev(dev->pseudo_netdev);
+                goto out3;
-                if (ret) {
-                        printk(KERN_ERR PFX
+        ret = register_netdev(dev->pseudo_netdev);
-                                "Unable to register netdev, ret = %d\n", ret);
+        if (ret)
-                        free_netdev(dev->pseudo_netdev);
+                goto out2;
-                        return ret;
-                }
-        }
        pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
        strlcpy(dev->ibdev.name, "amso%d", IB_DEVICE_NAME_MAX);
@@ -848,21 +845,25 @@ int c2_register_device(struct c2_dev *dev)
        ret = ib_register_device(&dev->ibdev);
        if (ret)
-                return ret;
+                goto out1;
        for (i = 0; i < ARRAY_SIZE(c2_class_attributes); ++i) {
                ret = class_device_create_file(&dev->ibdev.class_dev,
                                               c2_class_attributes[i]);
-                if (ret) {
+                if (ret)
-                        unregister_netdev(dev->pseudo_netdev);
+                        goto out0;
-                        free_netdev(dev->pseudo_netdev);
-                        ib_unregister_device(&dev->ibdev);
-                        return ret;
-                }
        }
+        goto out3;
-        pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
+out0:
-        return 0;
+        ib_unregister_device(&dev->ibdev);
+out1:
+        unregister_netdev(dev->pseudo_netdev);
+out2:
+        free_netdev(dev->pseudo_netdev);
+out3:
+        pr_debug("%s:%u ret=%d\n", __FUNCTION__, __LINE__, ret);
+        return ret;
 }
 void c2_unregister_device(struct c2_dev *dev)
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 21d9612a56cc..623dc95f91df 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -157,8 +157,8 @@ static int c2_rnic_query(struct c2_dev *c2dev, struct ib_device_attr *props)
        props->fw_ver =
                ((u64)be32_to_cpu(reply->fw_ver_major) << 32) |
-                ((be32_to_cpu(reply->fw_ver_minor) && 0xFFFF) << 16) |
+                ((be32_to_cpu(reply->fw_ver_minor) & 0xFFFF) << 16) |
-                (be32_to_cpu(reply->fw_ver_patch) && 0xFFFF);
+                (be32_to_cpu(reply->fw_ver_patch) & 0xFFFF);
        memcpy(&props->sys_image_guid, c2dev->netdev->dev_addr, 6);
        props->max_mr_size         = 0xFFFFFFFF;
        props->page_size_cap       = ~(C2_MIN_PAGESIZE-1);
diff --git a/drivers/infiniband/hw/ehca/Kconfig b/drivers/infiniband/hw/ehca/Kconfig
index 922389b64394..727b10d89686 100644
--- a/drivers/infiniband/hw/ehca/Kconfig
+++ b/drivers/infiniband/hw/ehca/Kconfig
@@ -10,6 +10,7 @@ config INFINIBAND_EHCA
 config INFINIBAND_EHCA_SCALING
        bool "Scaling support (EXPERIMENTAL)"
        depends on IBMEBUS && INFINIBAND_EHCA && HOTPLUG_CPU && EXPERIMENTAL
+        default y
        ---help---
        eHCA scaling support schedules the CQ callbacks to different CPUs.
diff --git a/drivers/infiniband/hw/ehca/ehca_av.c b/drivers/infiniband/hw/ehca/ehca_av.c
index 3bac197f9014..214e2fdddeef 100644
--- a/drivers/infiniband/hw/ehca/ehca_av.c
+++ b/drivers/infiniband/hw/ehca/ehca_av.c
@@ -118,8 +118,7 @@ struct ib_ah *ehca_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
                }
                memcpy(&av->av.grh.word_1, &gid, sizeof(gid));
        }
-        /* for the time being we use a hard coded PMTU of 2048 Bytes */
+        av->av.pmtu = EHCA_MAX_MTU;
-        av->av.pmtu = 4;
        /* dgid comes in grh.word_3 */
        memcpy(&av->av.grh.word_3, &ah_attr->grh.dgid,
@@ -193,7 +192,7 @@ int ehca_modify_ah(struct ib_ah *ah, struct ib_ah_attr *ah_attr)
                memcpy(&new_ehca_av.grh.word_1, &gid, sizeof(gid));
        }
-        new_ehca_av.pmtu = 4; /* see also comment in create_ah() */
+        new_ehca_av.pmtu = EHCA_MAX_MTU;
        memcpy(&new_ehca_av.grh.word_3, &ah_attr->grh.dgid,
               sizeof(ah_attr->grh.dgid));
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index 5eae6ac48425..e1b618c5f685 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -40,6 +40,7 @@
 */
 #include "ehca_tools.h"
+#include "ehca_iverbs.h"
 #include "hcp_if.h"
 int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
@@ -49,7 +50,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                                              ib_device);
        struct hipz_query_hca *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -96,7 +97,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                = min_t(int, rblock->max_total_mcast_qp_attach, INT_MAX);
 query_device1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -109,7 +110,7 @@ int ehca_query_port(struct ib_device *ibdev,
                                              ib_device);
        struct hipz_query_port *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -162,7 +163,7 @@ int ehca_query_port(struct ib_device *ibdev,
        props->active_speed    = 0x1;
 query_port1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -178,7 +179,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
                return -EINVAL;
        }
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device,  "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -193,7 +194,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
        memcpy(pkey, &rblock->pkey_entries + index, sizeof(u16));
 query_pkey1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -211,7 +212,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
                return -EINVAL;
        }
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -227,7 +228,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
        memcpy(&gid->raw[8], &rblock->guid_entries[index], sizeof(u64));
 query_gid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 048cc443d1e7..c3ea746e9045 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -45,6 +45,7 @@
 #include "ehca_tools.h"
 #include "hcp_if.h"
 #include "hipz_fns.h"
+#include "ipz_pt_fn.h"
 #define EQE_COMPLETION_EVENT   EHCA_BMASK_IBM(1,1)
 #define EQE_CQ_QP_NUMBER       EHCA_BMASK_IBM(8,31)
@@ -137,38 +138,36 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
        u64 *rblock;
        unsigned long block_count;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Cannot allocate rblock memory.");
                ret = -ENOMEM;
                goto error_data1;
        }
+        /* rblock must be 4K aligned and should be 4K large */
        ret = hipz_h_error_data(shca->ipz_hca_handle,
                                resource,
                                rblock,
                                &block_count);
-        if (ret == H_R_STATE) {
+        if (ret == H_R_STATE)
                ehca_err(&shca->ib_device,
                         "No error data is available: %lx.", resource);
-        }
        else if (ret == H_SUCCESS) {
                int length;
                length = EHCA_BMASK_GET(ERROR_DATA_LENGTH, rblock[0]);
-                if (length > PAGE_SIZE)
+                if (length > EHCA_PAGESIZE)
-                        length = PAGE_SIZE;
+                        length = EHCA_PAGESIZE;
                print_error_data(shca, data, rblock, length);
-        }
+        } else
-        else {
                ehca_err(&shca->ib_device,
                         "Error data could not be fetched: %lx", resource);
-        }
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 error_data1:
        return ret;
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/infiniband/hw/ehca/ehca_iverbs.h
index 319c39d47f3a..3720e3032cce 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/infiniband/hw/ehca/ehca_iverbs.h
@@ -179,4 +179,12 @@ int ehca_mmap_register(u64 physical,void **mapped,
 int ehca_munmap(unsigned long addr, size_t len);
+#ifdef CONFIG_PPC_64K_PAGES
+void *ehca_alloc_fw_ctrlblock(void);
+void ehca_free_fw_ctrlblock(void *ptr);
+#else
+#define ehca_alloc_fw_ctrlblock() ((void *) get_zeroed_page(GFP_KERNEL))
+#define ehca_free_fw_ctrlblock(ptr) free_page((unsigned long)(ptr))
+#endif
 #endif
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index 024d511c4b58..01f5aa9cb56d 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -40,6 +40,9 @@
 * POSSIBILITY OF SUCH DAMAGE.
 */
+#ifdef CONFIG_PPC_64K_PAGES
+#include <linux/slab.h>
+#endif
 #include "ehca_classes.h"
 #include "ehca_iverbs.h"
 #include "ehca_mrmw.h"
@@ -49,7 +52,7 @@
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Christoph Raisch <raisch@de.ibm.com>");
 MODULE_DESCRIPTION("IBM eServer HCA InfiniBand Device Driver");
-MODULE_VERSION("SVNEHCA_0017");
+MODULE_VERSION("SVNEHCA_0018");
 int ehca_open_aqp1     = 0;
 int ehca_debug_level   = 0;
@@ -94,11 +97,31 @@ spinlock_t ehca_cq_idr_lock;
 DEFINE_IDR(ehca_qp_idr);
 DEFINE_IDR(ehca_cq_idr);
 static struct list_head shca_list; /* list of all registered ehcas */
 static spinlock_t shca_list_lock;
 static struct timer_list poll_eqs_timer;
+#ifdef CONFIG_PPC_64K_PAGES
+static struct kmem_cache *ctblk_cache = NULL;
+void *ehca_alloc_fw_ctrlblock(void)
+{
+        void *ret = kmem_cache_zalloc(ctblk_cache, SLAB_KERNEL);
+        if (!ret)
+                ehca_gen_err("Out of memory for ctblk");
+        return ret;
+}
+void ehca_free_fw_ctrlblock(void *ptr)
+{
+        if (ptr)
+                kmem_cache_free(ctblk_cache, ptr);
+}
+#endif
 static int ehca_create_slab_caches(void)
 {
        int ret;
@@ -133,6 +156,17 @@ static int ehca_create_slab_caches(void)
                goto create_slab_caches5;
        }
+#ifdef CONFIG_PPC_64K_PAGES
+        ctblk_cache = kmem_cache_create("ehca_cache_ctblk",
+                                        EHCA_PAGESIZE, H_CB_ALIGNMENT,
+                                        SLAB_HWCACHE_ALIGN,
+                                        NULL, NULL);
+        if (!ctblk_cache) {
+                ehca_gen_err("Cannot create ctblk SLAB cache.");
+                ehca_cleanup_mrmw_cache();
+                goto create_slab_caches5;
+        }
+#endif
        return 0;
 create_slab_caches5:
@@ -157,6 +191,10 @@ static void ehca_destroy_slab_caches(void)
        ehca_cleanup_qp_cache();
        ehca_cleanup_cq_cache();
        ehca_cleanup_pd_cache();
+#ifdef CONFIG_PPC_64K_PAGES
+        if (ctblk_cache)
+                kmem_cache_destroy(ctblk_cache);
+#endif
 }
 #define EHCA_HCAAVER  EHCA_BMASK_IBM(32,39)
@@ -168,7 +206,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
        u64 h_ret;
        struct hipz_query_hca *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_gen_err("Cannot allocate rblock memory.");
                return -ENOMEM;
@@ -211,7 +249,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
        shca->sport[1].rate = IB_RATE_30_GBPS;
 num_ports1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -220,7 +258,7 @@ static int init_node_guid(struct ehca_shca *shca)
        int ret = 0;
        struct hipz_query_hca *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -235,7 +273,7 @@ static int init_node_guid(struct ehca_shca *shca)
        memcpy(&shca->ib_device.node_guid, &rblock->node_guid, sizeof(u64));
 init_node_guid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -431,7 +469,7 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                           \
        shca = dev->driver_data;                                           \
                                                                           \
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);                      \
+        rblock = ehca_alloc_fw_ctrlblock();                                \
        if (!rblock) {                                                     \
                dev_err(dev, "Can't allocate rblock memory.");             \
                return 0;                                                  \
@@ -439,12 +477,12 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                           \
        if (hipz_h_query_hca(shca->ipz_hca_handle, rblock) != H_SUCCESS) { \
                dev_err(dev, "Can't query device properties");             \
-                kfree(rblock);                                             \
+                ehca_free_fw_ctrlblock(rblock);                            \
                return 0;                                                  \
        }                                                                  \
                                                                           \
        data = rblock->name;                                               \
-        kfree(rblock);                                                     \
+        ehca_free_fw_ctrlblock(rblock);                                    \
                                                                           \
        if ((strcmp(#name, "num_ports") == 0) && (ehca_nr_ports == 1))     \
                return snprintf(buf, 256, "1\n");                          \
@@ -752,7 +790,7 @@ int __init ehca_module_init(void)
        int ret;
        printk(KERN_INFO "eHCA Infiniband Device Driver "
-                         "(Rel.: SVNEHCA_0017)\n");
+                         "(Rel.: SVNEHCA_0018)\n");
        idr_init(&ehca_qp_idr);
        idr_init(&ehca_cq_idr);
        spin_lock_init(&ehca_qp_idr_lock);
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 5ca65441e1da..abce676c0ae0 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -1013,7 +1013,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
        u32 i;
        u64 *kpage;
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
        if (!kpage) {
                ehca_err(&shca->ib_device, "kpage alloc failed");
                ret = -ENOMEM;
@@ -1092,7 +1092,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
 ehca_reg_mr_rpages_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_reg_mr_rpages_exit0:
        if (ret)
                ehca_err(&shca->ib_device, "ret=%x shca=%p e_mr=%p pginfo=%p "
@@ -1124,7 +1124,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
        ehca_mrmw_map_acl(acl, &hipz_acl);
        ehca_mrmw_set_pgsize_hipz_acl(&hipz_acl);
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
        if (!kpage) {
                ehca_err(&shca->ib_device, "kpage alloc failed");
                ret = -ENOMEM;
@@ -1181,7 +1181,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
        }
 ehca_rereg_mr_rereg1_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_rereg_mr_rereg1_exit0:
        if ( ret && (ret != -EAGAIN) )
                ehca_err(&shca->ib_device, "ret=%x lkey=%x rkey=%x "
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index 4394123cdbd7..cf3e50ee2d06 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -811,8 +811,8 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        unsigned long spl_flags = 0;
        /* do query_qp to obtain current attr values */
-        mqpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        mqpcb = ehca_alloc_fw_ctrlblock();
-        if (mqpcb == NULL) {
+        if (!mqpcb) {
                ehca_err(ibqp->device, "Could not get zeroed page for mqpcb "
                         "ehca_qp=%p qp_num=%x ", my_qp, ibqp->qp_num);
                return -ENOMEM;
@@ -1225,7 +1225,7 @@ modify_qp_exit2:
        }
 modify_qp_exit1:
-        kfree(mqpcb);
+        ehca_free_fw_ctrlblock(mqpcb);
        return ret;
 }
@@ -1277,7 +1277,7 @@ int ehca_query_qp(struct ib_qp *qp,
                return -EINVAL;
        }
-        qpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL );
+        qpcb = ehca_alloc_fw_ctrlblock();
        if (!qpcb) {
                ehca_err(qp->device,"Out of memory for qpcb "
                         "ehca_qp=%p qp_num=%x", my_qp, qp->qp_num);
@@ -1401,7 +1401,7 @@ int ehca_query_qp(struct ib_qp *qp,
                ehca_dmp(qpcb, 4*70, "qp_num=%x", qp->qp_num);
 query_qp_exit1:
-        kfree(qpcb);
+        ehca_free_fw_ctrlblock(qpcb);
        return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/hipz_hw.h b/drivers/infiniband/hw/ehca/hipz_hw.h
index 3fc92b031c50..fad91368dc5a 100644
--- a/drivers/infiniband/hw/ehca/hipz_hw.h
+++ b/drivers/infiniband/hw/ehca/hipz_hw.h
@@ -45,6 +45,8 @@
 #include "ehca_tools.h"
+#define EHCA_MAX_MTU 4
 /* QP Table Entry Memory Map */
 struct hipz_qptemm {
        u64 qpx_hcr;
diff --git a/drivers/infiniband/hw/ipath/Kconfig b/drivers/infiniband/hw/ipath/Kconfig
index 574a678e7fdd..5ca471ac6542 100644
--- a/drivers/infiniband/hw/ipath/Kconfig
+++ b/drivers/infiniband/hw/ipath/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_IPATH
        tristate "QLogic InfiniPath Driver"
-        depends on PCI_MSI && 64BIT && INFINIBAND
+        depends on (PCI_MSI || HT_IRQ) && 64BIT && INFINIBAND
        ---help---
        This is a driver for QLogic InfiniPath host channel adapters,
        including InfiniBand verbs support.  This driver allows these
diff --git a/drivers/infiniband/hw/ipath/Makefile b/drivers/infiniband/hw/ipath/Makefile
index 5e29cb0095e5..7dc10551cf18 100644
--- a/drivers/infiniband/hw/ipath/Makefile
+++ b/drivers/infiniband/hw/ipath/Makefile
@@ -10,8 +10,6 @@ ib_ipath-y := \
        ipath_eeprom.o \
        ipath_file_ops.o \
        ipath_fs.o \
-        ipath_iba6110.o \
-        ipath_iba6120.o \
        ipath_init_chip.o \
        ipath_intr.o \
        ipath_keys.o \
@@ -31,5 +29,8 @@ ib_ipath-y := \
        ipath_verbs_mcast.o \
        ipath_verbs.o
+ib_ipath-$(CONFIG_HT_IRQ) += ipath_iba6110.o
+ib_ipath-$(CONFIG_PCI_MSI) += ipath_iba6120.o
 ib_ipath-$(CONFIG_X86_64) += ipath_wc_x86_64.o
 ib_ipath-$(CONFIG_PPC64) += ipath_wc_ppc64.o
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 09a13c1fc46a..1aeddb48e355 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -390,12 +390,16 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
        /* setup the chip-specific functions, as early as possible. */
        switch (ent->device) {
+#ifdef CONFIG_HT_IRQ
        case PCI_DEVICE_ID_INFINIPATH_HT:
                ipath_init_iba6110_funcs(dd);
                break;
+#endif
+#ifdef CONFIG_PCI_MSI
        case PCI_DEVICE_ID_INFINIPATH_PE800:
                ipath_init_iba6120_funcs(dd);
                break;
+#endif
        default:
                ipath_dev_err(dd, "Found unknown QLogic deviceid 0x%x, "
                              "failing\n", ent->device);
diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
index fa4b13f89369..b3fbb45bc90a 100644
--- a/drivers/macintosh/windfarm_pm112.c
+++ b/drivers/macintosh/windfarm_pm112.c
@@ -685,6 +685,17 @@ static int __init wf_pm112_init(void)
                ++nr_cores;
        printk(KERN_INFO "windfarm: initializing for dual-core desktop G5\n");
+#ifdef MODULE
+        request_module("windfarm_smu_controls");
+        request_module("windfarm_smu_sensors");
+        request_module("windfarm_smu_sat");
+        request_module("windfarm_lm75_sensor");
+        request_module("windfarm_max6690_sensor");
+        request_module("windfarm_cpufreq_clamp");
+#endif /* MODULE */
        platform_driver_register(&wf_pm112_driver);
        return 0;
 }
diff --git a/drivers/macintosh/windfarm_pm81.c b/drivers/macintosh/windfarm_pm81.c
index 2a944851b8e1..f24fa734046a 100644
--- a/drivers/macintosh/windfarm_pm81.c
+++ b/drivers/macintosh/windfarm_pm81.c
@@ -788,6 +788,7 @@ static int __init wf_smu_init(void)
                request_module("windfarm_smu_controls");
                request_module("windfarm_smu_sensors");
                request_module("windfarm_lm75_sensor");
+                request_module("windfarm_cpufreq_clamp");
 #endif /* MODULE */
                platform_driver_register(&wf_smu_driver);
diff --git a/drivers/macintosh/windfarm_pm91.c b/drivers/macintosh/windfarm_pm91.c
index 9961a67b4f85..26eee69ebe6d 100644
--- a/drivers/macintosh/windfarm_pm91.c
+++ b/drivers/macintosh/windfarm_pm91.c
@@ -719,6 +719,7 @@ static int __init wf_smu_init(void)
                request_module("windfarm_smu_controls");
                request_module("windfarm_smu_sensors");
                request_module("windfarm_lm75_sensor");
+                request_module("windfarm_cpufreq_clamp");
 #endif /* MODULE */
                platform_driver_register(&wf_smu_driver);
diff --git a/drivers/media/dvb/b2c2/flexcop-usb.c b/drivers/media/dvb/b2c2/flexcop-usb.c
index 2853ea1bdaf1..87fb75f0d1cf 100644
--- a/drivers/media/dvb/b2c2/flexcop-usb.c
+++ b/drivers/media/dvb/b2c2/flexcop-usb.c
@@ -246,7 +246,7 @@ static int flexcop_usb_i2c_req(struct flexcop_usb *fc_usb,
        wIndex = (chipaddr << 8 ) | addr;
        deb_i2c("i2c %2d: %02x %02x %02x %02x %02x %02x\n",func,request_type,req,
-                        ((wValue && 0xff) << 8),wValue >> 8,((wIndex && 0xff) << 8),wIndex >> 8);
+                wValue & 0xff, wValue >> 8, wIndex & 0xff, wIndex >> 8);
        len = usb_control_msg(fc_usb->udev,pipe,
                        req,
diff --git a/drivers/media/dvb/frontends/tda826x.c b/drivers/media/dvb/frontends/tda826x.c
index eeab26bd36ed..34815b0b97e4 100644
--- a/drivers/media/dvb/frontends/tda826x.c
+++ b/drivers/media/dvb/frontends/tda826x.c
@@ -121,7 +121,7 @@ static struct dvb_tuner_ops tda826x_tuner_ops = {
        .info = {
                .name = "Philips TDA826X",
                .frequency_min = 950000,
-                .frequency_min = 2175000
+                .frequency_max = 2175000
        },
        .release = tda826x_release,
        .sleep = tda826x_sleep,
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index fbe5b6168cc2..bf267552941f 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -186,7 +186,7 @@ config VIDEO_KS0127
 config VIDEO_SAA7110
        tristate "Philips SAA7110 video decoder"
-        depends on VIDEO_V4L1
+        depends on VIDEO_V4L1 && I2C
        ---help---
          Support for the Philips SAA7110 video decoders.
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index a84903e0d810..21ebe8f13815 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -4001,7 +4001,7 @@ static void __devinit init_PXC200(struct bttv *btv)
 *      - sleep 1ms
 *      - write 0x0E
 *     read from GPIO_DATA into buf (uint_32)
- *      - if ( buf>>18 & 0x01 ) || ( buf>>19 && 0x01 != 0 )
+ *      - if ( buf>>18 & 0x01 ) || ( buf>>19 & 0x01 != 0 )
 *                error. ERROR_CPLD_Check_Failed.
 */
 /* ----------------------------------------------------------------------- */
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index ee48995a4ab5..57e1c024a547 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -202,13 +202,19 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
                ir->sampling = 1;
                break;
        case CX88_BOARD_WINFAST_DTV2000H:
-        case CX88_BOARD_WINFAST2000XP_EXPERT:
                ir_codes = ir_codes_winfast;
                ir->gpio_addr = MO_GP0_IO;
                ir->mask_keycode = 0x8f8;
                ir->mask_keyup = 0x100;
                ir->polling = 50; /* ms */
                break;
+        case CX88_BOARD_WINFAST2000XP_EXPERT:
+                ir_codes = ir_codes_winfast;
+                ir->gpio_addr = MO_GP0_IO;
+                ir->mask_keycode = 0x8f8;
+                ir->mask_keyup = 0x100;
+                ir->polling = 1; /* ms */
+                break;
        case CX88_BOARD_IODATA_GVBCTV7E:
                ir_codes = ir_codes_iodata_bctv7e;
                ir->gpio_addr = MO_GP0_IO;
@@ -216,7 +222,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
                ir->mask_keydown = 0x02;
                ir->polling = 5; /* ms */
                break;
-       case CX88_BOARD_PROLINK_PLAYTVPVR:
+        case CX88_BOARD_PROLINK_PLAYTVPVR:
        case CX88_BOARD_PIXELVIEW_PLAYTV_ULTRA_PRO:
                ir_codes = ir_codes_pixelview;
                ir->gpio_addr = MO_GP1_IO;
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index c9d8e3b9cc37..51f0cfdcb680 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -2969,7 +2969,7 @@ struct saa7134_board saa7134_boards[] = {
                /* Petr Baudis <pasky@ucw.cz> */
                .name           = "AVerMedia TV Hybrid A16AR",
                .audio_clock    = 0x187de7,
-                .tuner_type     = TUNER_PHILIPS_TDA8290, /* untested */
+                .tuner_type     = TUNER_PHILIPS_TD1316, /* untested */
                .radio_type     = TUNER_TEA5767, /* untested */
                .tuner_addr     = ADDR_UNSET,
                .radio_addr     = ADDR_UNSET,
@@ -3718,6 +3718,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
        case SAA7134_BOARD_AVERMEDIA_STUDIO_307:
        case SAA7134_BOARD_AVERMEDIA_307:
        case SAA7134_BOARD_AVERMEDIA_GO_007_FM:
+        case SAA7134_BOARD_AVERMEDIA_777:
 /*      case SAA7134_BOARD_SABRENT_SBTTVFM:  */ /* not finished yet */
        case SAA7134_BOARD_VIDEOMATE_TV_PVR:
        case SAA7134_BOARD_VIDEOMATE_GOLD_PLUS:
@@ -3734,6 +3735,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
        case SAA7134_BOARD_FLYDVBT_LR301:
        case SAA7134_BOARD_FLYDVBTDUO:
        case SAA7134_BOARD_PROTEUS_2309:
+        case SAA7134_BOARD_AVERMEDIA_A16AR:
                dev->has_remote = SAA7134_REMOTE_GPIO;
                break;
        case SAA7134_BOARD_FLYDVBS_LR300:
@@ -3772,7 +3774,6 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_writeb(SAA7134_GPIO_GPMODE3, 0x08);
                saa_writeb(SAA7134_GPIO_GPSTATUS3, 0x00);
                break;
-        case SAA7134_BOARD_AVERMEDIA_A16AR:
        case SAA7134_BOARD_AVERMEDIA_CARDBUS:
                /* power-up tuner chip */
                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0xffffffff, 0xffffffff);
diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index ff5991136f4e..dee83552e681 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -185,7 +185,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
        case SAA7134_BOARD_AVERMEDIA_STUDIO_305:
        case SAA7134_BOARD_AVERMEDIA_STUDIO_307:
        case SAA7134_BOARD_AVERMEDIA_GO_007_FM:
-        case SAA7134_BOARD_AVERMEDIA_A16AR:
                ir_codes     = ir_codes_avermedia;
                mask_keycode = 0x0007C8;
                mask_keydown = 0x000010;
@@ -194,6 +193,16 @@ int saa7134_input_init1(struct saa7134_dev *dev)
                saa_setb(SAA7134_GPIO_GPMODE0, 0x4);
                saa_setb(SAA7134_GPIO_GPSTATUS0, 0x4);
                break;
+        case SAA7134_BOARD_AVERMEDIA_777:
+        case SAA7134_BOARD_AVERMEDIA_A16AR:
+                ir_codes     = ir_codes_avermedia;
+                mask_keycode = 0x02F200;
+                mask_keydown = 0x000400;
+                polling      = 50; // ms
+                /* Without this we won't receive key up events */
+                saa_setb(SAA7134_GPIO_GPMODE1, 0x1);
+                saa_setb(SAA7134_GPIO_GPSTATUS1, 0x1);
+                break;
        case SAA7134_BOARD_KWORLD_TERMINATOR:
                ir_codes     = ir_codes_pixelview;
                mask_keycode = 0x00001f;
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index e6baaee038bf..6b9ef731b83a 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -468,7 +468,7 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
                                (eeprom_data[i+6] << 8) +
                                (eeprom_data[i+7] << 16);
-                                if ( (eeprom_data[i + 8] && 0xf0) &&
+                                if ( (eeprom_data[i + 8] & 0xf0) &&
                                        (tvee->serial_number < 0xffffff) ) {
                                        tvee->MAC_address[0] = 0x00;
                                        tvee->MAC_address[1] = 0x0D;
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index ee8863c123e3..766bc54406e5 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -475,7 +475,7 @@ static u32 mmc_select_voltage(struct mmc_host *host, u32 ocr)
        if (bit) {
                bit -= 1;
-                ocr = 3 << bit;
+                ocr &= 3 << bit;
                host->ios.vdd = bit;
                mmc_set_ios(host);
@@ -1178,14 +1178,29 @@ static void mmc_rescan(void *data)
 {
        struct mmc_host *host = data;
        struct list_head *l, *n;
+        unsigned char power_mode;
        mmc_claim_host(host);
-        if (host->ios.power_mode == MMC_POWER_ON)
+        /*
+         * Check for removed cards and newly inserted ones. We check for
+         * removed cards first so we can intelligently re-select the VDD.
+         */
+        power_mode = host->ios.power_mode;
+        if (power_mode == MMC_POWER_ON)
                mmc_check_cards(host);
        mmc_setup(host);
+        /*
+         * Some broken cards process CMD1 even in stand-by state. There is
+         * no reply, but an ILLEGAL_COMMAND error is cached and returned
+         * after next command. We poll for card status here to clear any
+         * possibly pending error.
+         */
+        if (power_mode == MMC_POWER_ON)
+                mmc_check_cards(host);
        if (!list_empty(&host->cards)) {
                /*
                 * (Re-)calculate the fastest clock rate which the
diff --git a/drivers/net/arcnet/com20020.c b/drivers/net/arcnet/com20020.c
index 0dc70c7b7940..aa9dd8f11269 100644
--- a/drivers/net/arcnet/com20020.c
+++ b/drivers/net/arcnet/com20020.c
@@ -337,13 +337,16 @@ static void com20020_set_mc_list(struct net_device *dev)
        }
 }
-#ifdef MODULE
+#if defined(CONFIG_ARCNET_COM20020_PCI_MODULE) || \
+    defined(CONFIG_ARCNET_COM20020_ISA_MODULE)
 EXPORT_SYMBOL(com20020_check);
 EXPORT_SYMBOL(com20020_found);
+#endif
 MODULE_LICENSE("GPL");
+#ifdef MODULE
 int init_module(void)
 {
        BUGLVL(D_NORMAL) printk(VERSION);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c0bbddae4ec4..17a461152d39 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4692,6 +4692,8 @@ static int bond_check_params(struct bond_params *params)
        return 0;
 }
+static struct lock_class_key bonding_netdev_xmit_lock_key;
 /* Create a new bond based on the specified name and bonding parameters.
 * Caller must NOT hold rtnl_lock; we need to release it here before we
 * set up our sysfs entries.
@@ -4727,6 +4729,9 @@ int bond_create(char *name, struct bond_params *params, struct bonding **newbond
        if (res < 0) {
                goto out_bond;
        }
+        lockdep_set_class(&bond_dev->_xmit_lock, &bonding_netdev_xmit_lock_key);
        if (newbond)
                *newbond = bond_dev->priv;
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index 966b563e42bb..a03d781f6d0a 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -509,6 +509,8 @@ etrax_ethernet_init(void)
                 * does not share cacheline with any other data (to avoid cache bug)
                 */
                RxDescList[i].skb = dev_alloc_skb(MAX_MEDIA_DATA_SIZE + 2 * L1_CACHE_BYTES);
+                if (!RxDescList[i].skb)
+                        return -ENOMEM;
                RxDescList[i].descr.ctrl   = 0;
                RxDescList[i].descr.sw_len = MAX_MEDIA_DATA_SIZE;
                RxDescList[i].descr.next   = virt_to_phys(&RxDescList[i + 1]);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 06e4f77b0988..1dbdd6bb587b 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.68"
+#define DRV_MODULE_VERSION      "3.69"
-#define DRV_MODULE_RELDATE      "November 02, 2006"
+#define DRV_MODULE_RELDATE      "November 15, 2006"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -4728,10 +4728,11 @@ static int tg3_poll_fw(struct tg3 *tp)
        u32 val;
        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-                for (i = 0; i < 400; i++) {
+                /* Wait up to 20ms for init done. */
+                for (i = 0; i < 200; i++) {
                        if (tr32(VCPU_STATUS) & VCPU_STATUS_INIT_DONE)
                                return 0;
-                        udelay(10);
+                        udelay(100);
                }
                return -ENODEV;
        }
@@ -10365,7 +10366,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
        u32 pci_state_reg, grc_misc_cfg;
        u32 val;
        u16 pci_cmd;
-        int err;
+        int err, pcie_cap;
        /* Force memory write invalidate off.  If we leave it on,
         * then on 5700_BX chips we have to enable a workaround.
@@ -10540,8 +10541,19 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
            GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
                tp->tg3_flags2 |= TG3_FLG2_JUMBO_CAPABLE;
-        if (pci_find_capability(tp->pdev, PCI_CAP_ID_EXP) != 0)
+        pcie_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_EXP);
+        if (pcie_cap != 0) {
                tp->tg3_flags2 |= TG3_FLG2_PCI_EXPRESS;
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
+                        u16 lnkctl;
+                        pci_read_config_word(tp->pdev,
+                                             pcie_cap + PCI_EXP_LNKCTL,
+                                             &lnkctl);
+                        if (lnkctl & PCI_EXP_LNKCTL_CLKREQ_EN)
+                                tp->tg3_flags2 &= ~TG3_FLG2_HW_TSO_2;
+                }
+        }
        /* If we have an AMD 762 or VIA K8T800 chipset, write
         * reordering to the mailbox registers done by the host
@@ -11808,6 +11820,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
        else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700 ||
            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 ||
            tp->pci_chip_rev_id == CHIPREV_ID_5705_A0 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906 ||
            (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0) {
                tp->tg3_flags2 &= ~TG3_FLG2_TSO_CAPABLE;
        } else {
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 65edb56107fd..a1b783813d8e 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -746,7 +746,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
        if (err)
                goto err_ctlreg;
        spromctl |= 0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
        if (err)
                goto err_ctlreg;
        /* We must burn lots of CPU cycles here, but that does not
@@ -768,7 +768,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
                mdelay(20);
        }
        spromctl &= ~0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
        if (err)
                goto err_ctlreg;
        mdelay(500);
@@ -1463,6 +1463,23 @@ static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
        }
 }
+static void drain_txstatus_queue(struct bcm43xx_private *bcm)
+{
+        u32 dummy;
+        if (bcm->current_core->rev < 5)
+                return;
+        /* Read all entries from the microcode TXstatus FIFO
+         * and throw them away.
+         */
+        while (1) {
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
+                if (!dummy)
+                        break;
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
+        }
+}
 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
 {
        bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
@@ -3532,6 +3549,7 @@ int bcm43xx_select_wireless_core(struct bcm43xx_private *bcm,
        bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
        bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_SELF, (u8 *)(bcm->net_dev->dev_addr));
        bcm43xx_security_init(bcm);
+        drain_txstatus_queue(bcm);
        ieee80211softmac_start(bcm->net_dev);
        /* Let's go! Be careful after enabling the IRQs.
diff --git a/drivers/parport/parport_ip32.c b/drivers/parport/parport_ip32.c
index e3e19277030a..ec44efdbb84e 100644
--- a/drivers/parport/parport_ip32.c
+++ b/drivers/parport/parport_ip32.c
@@ -780,7 +780,7 @@ static irqreturn_t parport_ip32_interrupt(int irq, void *dev_id)
        enum parport_ip32_irq_mode irq_mode = priv->irq_mode;
        switch (irq_mode) {
        case PARPORT_IP32_IRQ_FWD:
-                parport_generic_irq(irq, p, regs);
+                parport_generic_irq(irq, p);
                break;
        case PARPORT_IP32_IRQ_HERE:
                parport_ip32_wakeup(p);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index a1d2e979b17f..f952bfea48a6 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -642,6 +642,9 @@ err:
 */
 void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
 {
+        if (!sysfs_initialized)
+                return;
        if (pdev->cfg_size < 4096)
                sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
        else
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 204b1c8e972b..5b4483811691 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1460,33 +1460,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	0x2609, quirk_intel_pcie_pm);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x260a, quirk_intel_pcie_pm);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x260b, quirk_intel_pcie_pm);
-/*
- * Fixup the cardbus bridges on the IBM Dock II docking station
- */
-static void __devinit quirk_ibm_dock2_cardbus(struct pci_dev *dev)
-{
-        u32 val;
-        /*
-         * tie the 2 interrupt pins to INTA, and configure the
-         * multifunction routing register to handle this.
-         */
-        if ((dev->subsystem_vendor == PCI_VENDOR_ID_IBM) &&
-                (dev->subsystem_device == 0x0148)) {
-                printk(KERN_INFO "PCI: Found IBM Dock II Cardbus Bridge "
-                        "applying quirk\n");
-                pci_read_config_dword(dev, 0x8c, &val);
-                val = ((val & 0xffffff00) | 0x1002);
-                pci_write_config_dword(dev, 0x8c, val);
-                pci_read_config_dword(dev, 0x80, &val);
-                val = ((val & 0x00ffff00) | 0x2864c077);
-                pci_write_config_dword(dev, 0x80, val);
-        }
-}
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_1420,
-                                quirk_ibm_dock2_cardbus);
 static void __devinit quirk_netmos(struct pci_dev *dev)
 {
        unsigned int num_parallel = (dev->subsystem_device & 0xf0) >> 4;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d2c02df12fdc..3ac4890ce086 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -410,6 +410,7 @@ int scsi_execute_async(struct scsi_device *sdev, const unsigned char *cmd,
                goto free_req;
        req->cmd_len = cmd_len;
+        memset(req->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
        memcpy(req->cmd, cmd, req->cmd_len);
        req->sense = sioc->sense;
        req->sense_len = 0;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index fd9e281c3bfe..94a274645f6f 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -631,12 +631,22 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         * scanning run at their own risk, or supply a user level program
         * that can correctly scan.
         */
-        sdev->inquiry = kmalloc(sdev->inquiry_len, GFP_ATOMIC);
-        if (sdev->inquiry == NULL) {
+        /*
+         * Copy at least 36 bytes of INQUIRY data, so that we don't
+         * dereference unallocated memory when accessing the Vendor,
+         * Product, and Revision strings.  Badly behaved devices may set
+         * the INQUIRY Additional Length byte to a small value, indicating
+         * these strings are invalid, but often they contain plausible data
+         * nonetheless.  It doesn't matter if the device sent < 36 bytes
+         * total, since scsi_probe_lun() initializes inq_result with 0s.
+         */
+        sdev->inquiry = kmemdup(inq_result,
+                                max_t(size_t, sdev->inquiry_len, 36),
+                                GFP_ATOMIC);
+        if (sdev->inquiry == NULL)
                return SCSI_SCAN_NO_RESPONSE;
-        }
-        memcpy(sdev->inquiry, inq_result, sdev->inquiry_len);
        sdev->vendor = (char *) (sdev->inquiry + 8);
        sdev->model = (char *) (sdev->inquiry + 16);
        sdev->rev = (char *) (sdev->inquiry + 32);
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index a8f894c78194..69715e556506 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -88,7 +88,7 @@ extern struct uart_cpm_port cpm_uart_ports[UART_NR];
 /* these are located in their respective files */
 void cpm_line_cr_cmd(int line, int cmd);
-int cpm_uart_init_portdesc(void);
+int __init cpm_uart_init_portdesc(void);
 int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con);
 void cpm_uart_freebuf(struct uart_cpm_port *pinfo);
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 0abb544ae63d..7a3b97fdf8d1 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -195,10 +195,8 @@ static void cpm_uart_start_tx(struct uart_port *port)
        if (cpm_uart_tx_pump(port) != 0) {
                if (IS_SMC(pinfo)) {
                        smcp->smc_smcm |= SMCM_TX;
-                        smcp->smc_smcmr |= SMCMR_TEN;
                } else {
                        sccp->scc_sccm |= UART_SCCM_TX;
-                        pinfo->sccp->scc_gsmrl |= SCC_GSMRL_ENT;
                }
        }
 }
@@ -421,9 +419,10 @@ static int cpm_uart_startup(struct uart_port *port)
        /* Startup rx-int */
        if (IS_SMC(pinfo)) {
                pinfo->smcp->smc_smcm |= SMCM_RX;
-                pinfo->smcp->smc_smcmr |= SMCMR_REN;
+                pinfo->smcp->smc_smcmr |= (SMCMR_REN | SMCMR_TEN);
        } else {
                pinfo->sccp->scc_sccm |= UART_SCCM_RX;
+                pinfo->sccp->scc_gsmrl |= (SCC_GSMRL_ENR | SCC_GSMRL_ENT);
        }
        if (!(pinfo->flags & FLAG_CONSOLE))
@@ -1350,11 +1349,10 @@ static int cpm_uart_init(void) {
                pr_info("cpm_uart: WARNING: no UART devices found on platform bus!\n");
                pr_info(
                "cpm_uart: the driver will guess configuration, but this mode is no longer supported.\n");
-#ifndef CONFIG_SERIAL_CPM_CONSOLE
-                ret = cpm_uart_init_portdesc();
+                /* Don't run this again, if the console driver did it already */
-                if (ret)
+                if (cpm_uart_nr == 0)
-                        return ret;
+                        cpm_uart_init_portdesc();
-#endif
                cpm_reg.nr = cpm_uart_nr;
                ret = uart_register_driver(&cpm_reg);
@@ -1366,6 +1364,8 @@ static int cpm_uart_init(void) {
                        int con = cpm_uart_port_map[i];
                        cpm_uart_ports[con].port.line = i;
                        cpm_uart_ports[con].port.flags = UPF_BOOT_AUTOCONF;
+                        if (cpm_uart_ports[con].set_lineif)
+                                cpm_uart_ports[con].set_lineif(&cpm_uart_ports[con]);
                        uart_add_one_port(&cpm_reg, &cpm_uart_ports[con].port);
                }
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index 95afc37297a8..08e55fdc882a 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -184,7 +184,7 @@ void cpm_uart_freebuf(struct uart_cpm_port *pinfo)
 }
 /* Setup any dynamic params in the uart desc */
-int cpm_uart_init_portdesc(void)
+int __init cpm_uart_init_portdesc(void)
 {
        pr_debug("CPM uart[-]:init portdesc\n");
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index b77b30923928..e815b354c09d 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -406,7 +406,7 @@ static struct {
        { PCI_CHIP_MACH64LB, "3D RAGE LT PRO (Mach64 LB, AGP)", 236, 75, 100, 135, ATI_CHIP_264LTPRO },
        { PCI_CHIP_MACH64LD, "3D RAGE LT PRO (Mach64 LD, AGP)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
        { PCI_CHIP_MACH64LI, "3D RAGE LT PRO (Mach64 LI, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO | M64F_G3_PB_1_1 | M64F_G3_PB_1024x768 },
-        { PCI_CHIP_MACH64LP, "3D RAGE LT PRO (Mach64 LP, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
+        { PCI_CHIP_MACH64LP, "3D RAGE LT PRO (Mach64 LP, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO | M64F_G3_PB_1024x768 },
        { PCI_CHIP_MACH64LQ, "3D RAGE LT PRO (Mach64 LQ, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
        { PCI_CHIP_MACH64GM, "3D RAGE XL (Mach64 GM, AGP 2x)", 230, 83, 63, 135, ATI_CHIP_264XL },
diff --git a/drivers/video/nvidia/nv_hw.c b/drivers/video/nvidia/nv_hw.c
index 9ed640d35728..ea426115c6f9 100644
--- a/drivers/video/nvidia/nv_hw.c
+++ b/drivers/video/nvidia/nv_hw.c
@@ -145,12 +145,18 @@ static void nvGetClocks(struct nvidia_par *par, unsigned int *MClk,
        if (par->Architecture >= NV_ARCH_40) {
                pll = NV_RD32(par->PMC, 0x4020);
-                P = (pll >> 16) & 0x03;
+                P = (pll >> 16) & 0x07;
                pll = NV_RD32(par->PMC, 0x4024);
                M = pll & 0xFF;
                N = (pll >> 8) & 0xFF;
-                MB = (pll >> 16) & 0xFF;
+                if (((par->Chipset & 0xfff0) == 0x0290) ||
-                NB = (pll >> 24) & 0xFF;
+                                ((par->Chipset & 0xfff0) == 0x0390)) {
+                        MB = 1;
+                        NB = 1;
+                } else {
+                        MB = (pll >> 16) & 0xFF;
+                        NB = (pll >> 24) & 0xFF;
+                }
                *MClk = ((N * NB * par->CrystalFreqKHz) / (M * MB)) >> P;
                pll = NV_RD32(par->PMC, 0x4000);
diff --git a/drivers/video/nvidia/nv_setup.c b/drivers/video/nvidia/nv_setup.c
index a18a9aebf05f..eab3e282a4de 100644
--- a/drivers/video/nvidia/nv_setup.c
+++ b/drivers/video/nvidia/nv_setup.c
@@ -262,7 +262,7 @@ static void nv10GetConfig(struct nvidia_par *par)
 #endif
        dev = pci_find_slot(0, 1);
-        if ((par->Chipset && 0xffff) == 0x01a0) {
+        if ((par->Chipset & 0xffff) == 0x01a0) {
                int amt = 0;
                pci_read_config_dword(dev, 0x7c, &amt);
@@ -359,6 +359,7 @@ int NVCommonSetup(struct fb_info *info)
        case 0x0186:
        case 0x0187:
        case 0x018D:
+        case 0x0228:
        case 0x0286:
        case 0x028C:
        case 0x0316:
@@ -382,6 +383,10 @@ int NVCommonSetup(struct fb_info *info)
        case 0x034C:
        case 0x0160:
        case 0x0166:
+        case 0x0169:
+        case 0x016B:
+        case 0x016C:
+        case 0x016D:
        case 0x00C8:
        case 0x00CC:
        case 0x0144:
@@ -639,12 +644,23 @@ int NVCommonSetup(struct fb_info *info)
                par->fpHeight = NV_RD32(par->PRAMDAC, 0x0800) + 1;
                par->fpSyncs = NV_RD32(par->PRAMDAC, 0x0848) & 0x30000033;
-                printk("Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
+                printk("nvidiafb: Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
        }
        if (monA)
                info->monspecs = *monA;
+        if (!par->FlatPanel || !par->twoHeads)
+                par->FPDither = 0;
+        par->LVDS = 0;
+        if (par->FlatPanel && par->twoHeads) {
+                NV_WR32(par->PRAMDAC0, 0x08B0, 0x00010004);
+                if (par->PRAMDAC0[0x08b4] & 1)
+                        par->LVDS = 1;
+                printk("nvidiafb: Panel is %s\n", par->LVDS ? "LVDS" : "TMDS");
+        }
        kfree(edidA);
        kfree(edidB);
 done:
diff --git a/drivers/video/nvidia/nv_type.h b/drivers/video/nvidia/nv_type.h
index acdc26693402..86e65dea60d3 100644
--- a/drivers/video/nvidia/nv_type.h
+++ b/drivers/video/nvidia/nv_type.h
@@ -129,6 +129,7 @@ struct nvidia_par {
        int fpHeight;
        int PanelTweak;
        int paneltweak;
+        int LVDS;
        int pm_state;
        u32 crtcSync_read;
        u32 fpSyncs;
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index eb24107bcc81..538e947610e1 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1160,20 +1160,20 @@ static u32 __devinit nvidia_get_arch(struct fb_info *info)
        case 0x0340:            /* GeForceFX 5700 */
                arch = NV_ARCH_30;
                break;
-        case 0x0040:
+        case 0x0040:            /* GeForce 6800 */
-        case 0x00C0:
+        case 0x00C0:            /* GeForce 6800 */
-        case 0x0120:
+        case 0x0120:            /* GeForce 6800 */
        case 0x0130:
-        case 0x0140:
+        case 0x0140:            /* GeForce 6600 */
-        case 0x0160:
+        case 0x0160:            /* GeForce 6200 */
-        case 0x01D0:
+        case 0x01D0:            /* GeForce 7200, 7300, 7400 */
-        case 0x0090:
+        case 0x0090:            /* GeForce 7800 */
-        case 0x0210:
+        case 0x0210:            /* GeForce 6800 */
-        case 0x0220:
+        case 0x0220:            /* GeForce 6200 */
        case 0x0230:
-        case 0x0240:
+        case 0x0240:            /* GeForce 6100 */
-        case 0x0290:
+        case 0x0290:            /* GeForce 7900 */
-        case 0x0390:
+        case 0x0390:            /* GeForce 7600 */
                arch = NV_ARCH_40;
                break;
        case 0x0020:            /* TNT, TNT2 */
diff --git a/drivers/video/pnx4008/pnxrgbfb.c b/drivers/video/pnx4008/pnxrgbfb.c
index 7d9453c91a42..f29e66e2d774 100644
--- a/drivers/video/pnx4008/pnxrgbfb.c
+++ b/drivers/video/pnx4008/pnxrgbfb.c
@@ -154,7 +154,8 @@ static int __devinit rgbfb_probe(struct platform_device *pdev)
                        goto err1;
        }
-        if (!fb_get_options("pnxrgbfb", &option) && !strcmp(option, "nocursor"))
+        if (!fb_get_options("pnxrgbfb", &option) && option &&
+                        !strcmp(option, "nocursor"))
                rgbfb_ops.fb_cursor = no_cursor;
        info->node = -1;
@@ -191,7 +192,7 @@ err:
 static struct platform_driver rgbfb_driver = {
        .driver = {
-                .name = "rgbfb",
+                .name = "pnx4008-rgbfb",
        },
        .probe = rgbfb_probe,
        .remove = rgbfb_remove,
diff --git a/drivers/video/pnx4008/sdum.c b/drivers/video/pnx4008/sdum.c
index 51f0ecc2a511..d23bf0d659b6 100644
--- a/drivers/video/pnx4008/sdum.c
+++ b/drivers/video/pnx4008/sdum.c
@@ -848,7 +848,7 @@ static int sdum_remove(struct platform_device *pdev)
 static struct platform_driver sdum_driver = {
        .driver = {
-                .name = "sdum",
+                .name = "pnx4008-sdum",
        },
        .probe = sdum_probe,
        .remove = sdum_remove,
diff --git a/fs/Kconfig b/fs/Kconfig
index 133dcc8a4150..7b1511d50b05 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -2060,8 +2060,7 @@ config CODA_FS_OLD_API
          For most cases you probably want to say N.
 config AFS_FS
-# for fs/nls/Config.in
+        tristate "Andrew File System support (AFS) (EXPERIMENTAL)"
-        tristate "Andrew File System support (AFS) (Experimental)"
        depends on INET && EXPERIMENTAL
        select RXRPC
        help
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 54c518c89e4c..38ede5c9d6fd 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -25,6 +25,14 @@ void autofs_kill_sb(struct super_block *sb)
        struct autofs_sb_info *sbi = autofs_sbi(sb);
        unsigned int n;
+        /*
+         * In the event of a failure in get_sb_nodev the superblock
+         * info is not present so nothing else has been setup, so
+         * just exit when we are called from deactivate_super.
+         */
+        if (!sbi)
+                return;
        if ( !sbi->catatonic )
                autofs_catatonic_mode(sbi); /* Free wait queues, close pipe */
@@ -136,7 +144,8 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
        s->s_fs_info = sbi;
        sbi->magic = AUTOFS_SBI_MAGIC;
-        sbi->catatonic = 0;
+        sbi->pipe = NULL;
+        sbi->catatonic = 1;
        sbi->exp_timeout = 0;
        sbi->oz_pgrp = process_group(current);
        autofs_initialize_hash(&sbi->dirhash);
@@ -180,6 +189,7 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
        if ( !pipe->f_op || !pipe->f_op->write )
                goto fail_fput;
        sbi->pipe = pipe;
+        sbi->catatonic = 0;
        /*
         * Success! Install the root dentry now to indicate completion.
@@ -198,6 +208,8 @@ fail_iput:
        iput(root_inode);
 fail_free:
        kfree(sbi);
+        s->s_fs_info = NULL;
+        kill_anon_super(s);
 fail_unlock:
        return -EINVAL;
 }
diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
index 633f628005b4..19a9cafb5ddf 100644
--- a/fs/autofs/waitq.c
+++ b/fs/autofs/waitq.c
@@ -41,6 +41,7 @@ void autofs_catatonic_mode(struct autofs_sb_info *sbi)
                wq = nwq;
        }
        fput(sbi->pipe);        /* Close the pipe */
+        sbi->pipe = NULL;
        autofs_hash_dputall(&sbi->dirhash); /* Remove all dentry pointers */
 }
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index 51fd8595bf85..ce7c0f1dd529 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -99,6 +99,9 @@ static void autofs4_force_release(struct autofs_sb_info *sbi)
        struct dentry *this_parent = sbi->sb->s_root;
        struct list_head *next;
+        if (!sbi->sb->s_root)
+                return;
        spin_lock(&dcache_lock);
 repeat:
        next = this_parent->d_subdirs.next;
@@ -146,6 +149,14 @@ void autofs4_kill_sb(struct super_block *sb)
 {
        struct autofs_sb_info *sbi = autofs4_sbi(sb);
+        /*
+         * In the event of a failure in get_sb_nodev the superblock
+         * info is not present so nothing else has been setup, so
+         * just exit when we are called from deactivate_super.
+         */
+        if (!sbi)
+                return;
        sb->s_fs_info = NULL;
        if ( !sbi->catatonic )
@@ -310,7 +321,8 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
        s->s_fs_info = sbi;
        sbi->magic = AUTOFS_SBI_MAGIC;
        sbi->pipefd = -1;
-        sbi->catatonic = 0;
+        sbi->pipe = NULL;
+        sbi->catatonic = 1;
        sbi->exp_timeout = 0;
        sbi->oz_pgrp = process_group(current);
        sbi->sb = s;
@@ -388,6 +400,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
                goto fail_fput;
        sbi->pipe = pipe;
        sbi->pipefd = pipefd;
+        sbi->catatonic = 0;
        /*
         * Success! Install the root dentry now to indicate completion.
@@ -412,6 +425,8 @@ fail_ino:
        kfree(ino);
 fail_free:
        kfree(sbi);
+        s->s_fs_info = NULL;
+        kill_anon_super(s);
 fail_unlock:
        return -EINVAL;
 }
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index c0a6c8d445c7..1e4a539f4417 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -41,10 +41,8 @@ void autofs4_catatonic_mode(struct autofs_sb_info *sbi)
                wake_up_interruptible(&wq->queue);
                wq = nwq;
        }
-        if (sbi->pipe) {
+        fput(sbi->pipe);        /* Close the pipe */
-                fput(sbi->pipe);        /* Close the pipe */
+        sbi->pipe = NULL;
-                sbi->pipe = NULL;
-        }
 }
 static int autofs4_write(struct file *file, const void *addr, int bytes)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 7e056b9b49e8..2436ed8fc840 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -492,10 +492,14 @@ int cifs_close(struct inode *inode, struct file *file)
                                        the struct would be in each open file,
                                        but this should give enough time to 
                                        clear the socket */
-                                        cERROR(1,("close with pending writes"));
+#ifdef CONFIG_CIFS_DEBUG2
+                                        cFYI(1,("close delay, write pending"));
+#endif /* DEBUG2 */
                                        msleep(timeout);
                                        timeout *= 4;
-                                } 
+                                }
+                                if(atomic_read(&pSMBFile->wrtPending))
+                                        cERROR(1,("close with pending writes"));
                                rc = CIFSSMBClose(xid, pTcon,
                                                  pSMBFile->netfid);
                        }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index dffe295825f4..1ad8c9fcc742 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1089,8 +1089,10 @@ int cifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
        struct kstat *stat)
 {
        int err = cifs_revalidate(dentry);
-        if (!err)
+        if (!err) {
                generic_fillattr(dentry->d_inode, stat);
+                stat->blksize = CIFS_MAX_MSGSIZE;
+        }
        return err;
 }
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index a8a083543ba0..bbdda99dce61 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -90,7 +90,9 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
        } */
        /* copy user */
        if(ses->userName == NULL) {
-                /* BB what about null user mounts - check that we do this BB */
+                /* null user mount */
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
        } else { /* 300 should be long enough for any conceivable user name */
                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
                                          300, nls_cp);
@@ -98,10 +100,13 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
        bcc_ptr += 2 * bytes_ret;
        bcc_ptr += 2; /* account for null termination */
        /* copy domain */
-        if(ses->domainName == NULL)
+        if(ses->domainName == NULL) {
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr,
+                /* Sending null domain better than using a bogus domain name (as
-                                          "CIFS_LINUX_DOM", 32, nls_cp);
+                we did briefly in 2.6.18) since server will use its default */
-        else
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
+                bytes_ret = 0;
+        } else
                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName, 
                                          256, nls_cp);
        bcc_ptr += 2 * bytes_ret;
@@ -144,13 +149,11 @@ static void ascii_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
        /* copy domain */
        
-        if(ses->domainName == NULL) {
+        if(ses->domainName != NULL) {
-                strcpy(bcc_ptr, "CIFS_LINUX_DOM");
-                bcc_ptr += 14;  /* strlen(CIFS_LINUX_DOM) */
-        } else {
                strncpy(bcc_ptr, ses->domainName, 256); 
                bcc_ptr += strnlen(ses->domainName, 256);
-        }
+        } /* else we will send a null domain name 
+             so the server will default to its own domain */
        *bcc_ptr = 0;
        bcc_ptr++;
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 0b9992ab990f..52d1e36dc746 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -57,6 +57,12 @@ static int ecryptfs_d_revalidate(struct dentry *dentry, struct nameidata *nd)
        rc = lower_dentry->d_op->d_revalidate(lower_dentry, nd);
        nd->dentry = dentry_save;
        nd->mnt = vfsmount_save;
+        if (dentry->d_inode) {
+                struct inode *lower_inode =
+                        ecryptfs_inode_to_lower(dentry->d_inode);
+                ecryptfs_copy_attr_all(dentry->d_inode, lower_inode);
+        }
 out:
        return rc;
 }
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index ff4865d24f0f..dfcc68484f47 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -470,6 +470,7 @@ out_lock:
        unlock_dir(lower_dir_dentry);
        dput(lower_new_dentry);
        dput(lower_old_dentry);
+        d_drop(lower_old_dentry);
        d_drop(new_dentry);
        d_drop(old_dentry);
        return rc;
@@ -484,7 +485,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
        lock_parent(lower_dentry);
        rc = vfs_unlink(lower_dir_inode, lower_dentry);
        if (rc) {
-                ecryptfs_printk(KERN_ERR, "Error in vfs_unlink\n");
+                printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
                goto out_unlock;
        }
        ecryptfs_copy_attr_times(dir, lower_dir_inode);
@@ -630,6 +631,8 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                ecryptfs_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
 out_lock:
        unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+        dput(lower_new_dentry->d_parent);
+        dput(lower_old_dentry->d_parent);
        dput(lower_new_dentry);
        dput(lower_old_dentry);
        return rc;
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 8337451e7897..0aa813d944a6 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -303,7 +303,17 @@ void fat_truncate(struct inode *inode)
        fat_flush_inodes(inode->i_sb, inode, NULL);
 }
+int fat_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+{
+        struct inode *inode = dentry->d_inode;
+        generic_fillattr(inode, stat);
+        stat->blksize = MSDOS_SB(inode->i_sb)->cluster_size;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(fat_getattr);
 struct inode_operations fat_file_inode_operations = {
        .truncate       = fat_truncate,
        .setattr        = fat_notify_change,
+        .getattr        = fat_getattr,
 };
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index d43b4fcc8ad3..85b17b3fa4a0 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -390,11 +390,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
                hfs_find_exit(&fd);
                goto bail_no_root;
        }
+        res = -EINVAL;
        root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
        hfs_find_exit(&fd);
        if (!root_inode)
                goto bail_no_root;
+        res = -ENOMEM;
        sb->s_root = d_alloc_root(root_inode);
        if (!sb->s_root)
                goto bail_iput;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 0bea6a619e10..7f4756963d05 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -62,24 +62,19 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
        loff_t len, vma_len;
        int ret;
-        if (vma->vm_pgoff & (HPAGE_SIZE / PAGE_SIZE - 1))
+        /*
-                return -EINVAL;
+         * vma alignment has already been checked by prepare_hugepage_range.
+         * If you add any error returns here, do so after setting VM_HUGETLB,
-        if (vma->vm_start & ~HPAGE_MASK)
+         * so is_vm_hugetlb_page tests below unmap_region go the right way
-                return -EINVAL;
+         * when do_mmap_pgoff unwinds (may be important on powerpc and ia64).
+         */
-        if (vma->vm_end & ~HPAGE_MASK)
+        vma->vm_flags |= VM_HUGETLB | VM_RESERVED;
-                return -EINVAL;
+        vma->vm_ops = &hugetlb_vm_ops;
-        if (vma->vm_end - vma->vm_start < HPAGE_SIZE)
-                return -EINVAL;
        vma_len = (loff_t)(vma->vm_end - vma->vm_start);
        mutex_lock(&inode->i_mutex);
        file_accessed(file);
-        vma->vm_flags |= VM_HUGETLB | VM_RESERVED;
-        vma->vm_ops = &hugetlb_vm_ops;
        ret = -ENOMEM;
        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
diff --git a/fs/msdos/namei.c b/fs/msdos/namei.c
index b0f01b3b0536..452461955cbd 100644
--- a/fs/msdos/namei.c
+++ b/fs/msdos/namei.c
@@ -654,6 +654,7 @@ static struct inode_operations msdos_dir_inode_operations = {
        .rmdir          = msdos_rmdir,
        .rename         = msdos_rename,
        .setattr        = fat_notify_change,
+        .getattr        = fat_getattr,
 };
 static int msdos_fill_super(struct super_block *sb, void *data, int silent)
diff --git a/fs/vfat/namei.c b/fs/vfat/namei.c
index edb711ff7b05..0afd745a37cd 100644
--- a/fs/vfat/namei.c
+++ b/fs/vfat/namei.c
@@ -1004,6 +1004,7 @@ static struct inode_operations vfat_dir_inode_operations = {
        .rmdir          = vfat_rmdir,
        .rename         = vfat_rename,
        .setattr        = fat_notify_change,
+        .getattr        = fat_getattr,
 };
 static int vfat_fill_super(struct super_block *sb, void *data, int silent)
diff --git a/fs/xfs/Makefile-linux-2.6 b/fs/xfs/Makefile-linux-2.6
index 291948d5085a..b49989bb89ad 100644
--- a/fs/xfs/Makefile-linux-2.6
+++ b/fs/xfs/Makefile-linux-2.6
@@ -21,22 +21,7 @@ EXTRA_CFLAGS +=	 -Ifs/xfs -Ifs/xfs/linux-2.6 -funsigned-char
 XFS_LINUX := linux-2.6
 ifeq ($(CONFIG_XFS_DEBUG),y)
-        EXTRA_CFLAGS += -g -DSTATIC="" -DDEBUG
+        EXTRA_CFLAGS += -g
-        EXTRA_CFLAGS += -DXFS_BUF_LOCK_TRACKING
-endif
-ifeq ($(CONFIG_XFS_TRACE),y)
-        EXTRA_CFLAGS += -DXFS_ALLOC_TRACE
-        EXTRA_CFLAGS += -DXFS_ATTR_TRACE
-        EXTRA_CFLAGS += -DXFS_BLI_TRACE
-        EXTRA_CFLAGS += -DXFS_BMAP_TRACE
-        EXTRA_CFLAGS += -DXFS_BMBT_TRACE
-        EXTRA_CFLAGS += -DXFS_DIR2_TRACE
-        EXTRA_CFLAGS += -DXFS_DQUOT_TRACE
-        EXTRA_CFLAGS += -DXFS_ILOCK_TRACE
-        EXTRA_CFLAGS += -DXFS_LOG_TRACE
-        EXTRA_CFLAGS += -DXFS_RW_TRACE
-        EXTRA_CFLAGS += -DXFS_BUF_TRACE
-        EXTRA_CFLAGS += -DXFS_VNODE_TRACE
 endif
 obj-$(CONFIG_XFS_FS)            += xfs.o
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index db5f5a3608ca..d3382843698e 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -15,6 +15,7 @@
 * along with this program; if not, write the Free Software Foundation,
 * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
+#include "xfs.h"
 #include <linux/stddef.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
@@ -31,7 +32,6 @@
 #include <linux/kthread.h>
 #include <linux/migrate.h>
 #include <linux/backing-dev.h>
-#include "xfs_linux.h"
 STATIC kmem_zone_t *xfs_buf_zone;
 STATIC kmem_shaker_t xfs_buf_shake;
@@ -1406,7 +1406,7 @@ xfs_alloc_bufhash(
        btp->bt_hashshift = external ? 3 : 8;   /* 8 or 256 buckets */
        btp->bt_hashmask = (1 << btp->bt_hashshift) - 1;
        btp->bt_hash = kmem_zalloc((1 << btp->bt_hashshift) *
-                                        sizeof(xfs_bufhash_t), KM_SLEEP);
+                                        sizeof(xfs_bufhash_t), KM_SLEEP | KM_LARGE);
        for (i = 0; i < (1 << btp->bt_hashshift); i++) {
                spin_lock_init(&btp->bt_hash[i].bh_lock);
                INIT_LIST_HEAD(&btp->bt_hash[i].bh_list);
diff --git a/fs/xfs/linux-2.6/xfs_dmapi_priv.h b/fs/xfs/linux-2.6/xfs_dmapi_priv.h
new file mode 100644
index 000000000000..a8b0b1685eed
--- /dev/null
+++ b/fs/xfs/linux-2.6/xfs_dmapi_priv.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2000-2006 Silicon Graphics, Inc.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it would be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write the Free Software Foundation,
+ * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+#ifndef __XFS_DMAPI_PRIV_H__
+#define __XFS_DMAPI_PRIV_H__
+/*
+ *      Based on IO_ISDIRECT, decide which i_ flag is set.
+ */
+#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
+                              DM_FLAGS_IMUX : 0)
+#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
+#endif /*__XFS_DMAPI_PRIV_H__*/
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index a74f854d91e6..74d094829a4d 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -341,8 +341,11 @@ xfs_open_by_handle(
                put_unused_fd(new_fd);
                return -XFS_ERROR(-PTR_ERR(filp));
        }
-        if (inode->i_mode & S_IFREG)
+        if (inode->i_mode & S_IFREG) {
+                /* invisible operation should not change atime */
+                filp->f_flags |= O_NOATIME;
                filp->f_op = &xfs_invis_file_operations;
+        }
        fd_install(new_fd, filp);
        return new_fd;
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 38c4d128a8c0..de05abbbe7fd 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -227,9 +227,7 @@ xfs_initialize_vnode(
                xfs_revalidate_inode(XFS_BHVTOM(bdp), vp, ip);
                xfs_set_inodeops(inode);
-                spin_lock(&ip->i_flags_lock);
+                xfs_iflags_clear(ip, XFS_INEW);
-                ip->i_flags &= ~XFS_INEW;
-                spin_unlock(&ip->i_flags_lock);
                barrier();
                unlock_new_inode(inode);
diff --git a/fs/xfs/support/debug.c b/fs/xfs/support/debug.c
index c75f68361e33..4363512d2f90 100644
--- a/fs/xfs/support/debug.c
+++ b/fs/xfs/support/debug.c
@@ -15,11 +15,9 @@
 * along with this program; if not, write the Free Software Foundation,
 * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
+#include <xfs.h>
 #include "debug.h"
 #include "spin.h"
-#include <asm/page.h>
-#include <linux/sched.h>
-#include <linux/kernel.h>
 static char             message[256];   /* keep it off the stack */
 static DEFINE_SPINLOCK(xfs_err_lock);
diff --git a/fs/xfs/support/move.c b/fs/xfs/support/move.c
index caefa17b80fe..ac8617ca3909 100644
--- a/fs/xfs/support/move.c
+++ b/fs/xfs/support/move.c
@@ -22,7 +22,7 @@
 * as we go.
 */
 int
-uio_read(caddr_t src, size_t len, struct uio *uio)
+xfs_uio_read(caddr_t src, size_t len, struct uio *uio)
 {
        size_t  count;
diff --git a/fs/xfs/support/move.h b/fs/xfs/support/move.h
index 97a2498d2da3..977879c24ff5 100644
--- a/fs/xfs/support/move.h
+++ b/fs/xfs/support/move.h
@@ -65,6 +65,6 @@ struct uio {
 typedef struct uio uio_t;
 typedef struct iovec iovec_t;
-extern int      uio_read (caddr_t, size_t, uio_t *);
+extern int      xfs_uio_read (caddr_t, size_t, uio_t *);
 #endif  /* __XFS_SUPPORT_MOVE_H__ */
diff --git a/fs/xfs/xfs.h b/fs/xfs/xfs.h
index 1a48dbb902a7..bf0a12040b13 100644
--- a/fs/xfs/xfs.h
+++ b/fs/xfs/xfs.h
@@ -17,5 +17,28 @@
 */
 #ifndef __XFS_H__
 #define __XFS_H__
+#ifdef CONFIG_XFS_DEBUG
+#define STATIC
+#define DEBUG 1
+#define XFS_BUF_LOCK_TRACKING 1
+/* #define QUOTADEBUG 1 */
+#endif
+#ifdef CONFIG_XFS_TRACE
+#define XFS_ALLOC_TRACE 1
+#define XFS_ATTR_TRACE 1
+#define XFS_BLI_TRACE 1
+#define XFS_BMAP_TRACE 1
+#define XFS_BMBT_TRACE 1
+#define XFS_DIR2_TRACE 1
+#define XFS_DQUOT_TRACE 1
+#define XFS_ILOCK_TRACE 1
+#define XFS_LOG_TRACE 1
+#define XFS_RW_TRACE 1
+#define XFS_BUF_TRACE 1
+#define XFS_VNODE_TRACE 1
+#endif
 #include <linux-2.6/xfs_linux.h>
 #endif  /* __XFS_H__ */
diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c
index 8edbe1adb95b..8e8e5279334a 100644
--- a/fs/xfs/xfs_dir2.c
+++ b/fs/xfs/xfs_dir2.c
@@ -678,7 +678,7 @@ xfs_dir2_put_dirent64_uio(
        idbp->d_off = pa->cook;
        idbp->d_name[namelen] = '\0';
        memcpy(idbp->d_name, pa->name, namelen);
-        rval = uio_read((caddr_t)idbp, reclen, uio);
+        rval = xfs_uio_read((caddr_t)idbp, reclen, uio);
        pa->done = (rval == 0);
        return rval;
 }
diff --git a/fs/xfs/xfs_dmapi.h b/fs/xfs/xfs_dmapi.h
index 4e7865ad6f0e..adc3d251240d 100644
--- a/fs/xfs/xfs_dmapi.h
+++ b/fs/xfs/xfs_dmapi.h
@@ -157,27 +157,9 @@ typedef enum {
 #define DM_FLAGS_IALLOCSEM_WR   0x020   /* thread holds i_alloc_sem wr */
 /*
- *      Based on IO_ISDIRECT, decide which i_ flag is set.
+ *      Pull in platform specific event flags defines
 */
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,0)
+#include "xfs_dmapi_priv.h"
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              DM_FLAGS_IMUX : 0)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
-#endif
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)) && \
-    (LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,22))
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              DM_FLAGS_IALLOCSEM_RD : DM_FLAGS_IMUX)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
-#endif
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,4,21)
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              0 : DM_FLAGS_IMUX)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IMUX)
-#endif
 /*
 *      Macros to turn caller specified delay/block flags into
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index b73d216ecaf9..c1c89dac19cc 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -215,7 +215,7 @@ again:
                         * If INEW is set this inode is being set up
                         * we need to pause and try again.
                         */
-                        if (ip->i_flags & XFS_INEW) {
+                        if (xfs_iflags_test(ip, XFS_INEW)) {
                                read_unlock(&ih->ih_lock);
                                delay(1);
                                XFS_STATS_INC(xs_ig_frecycle);
@@ -230,22 +230,50 @@ again:
                                 * on its way out of the system,
                                 * we need to pause and try again.
                                 */
-                                if (ip->i_flags & XFS_IRECLAIM) {
+                                if (xfs_iflags_test(ip, XFS_IRECLAIM)) {
                                        read_unlock(&ih->ih_lock);
                                        delay(1);
                                        XFS_STATS_INC(xs_ig_frecycle);
                                        goto again;
                                }
+                                ASSERT(xfs_iflags_test(ip, XFS_IRECLAIMABLE));
+                                /*
+                                 * If lookup is racing with unlink, then we
+                                 * should return an error immediately so we
+                                 * don't remove it from the reclaim list and
+                                 * potentially leak the inode.
+                                 */
+                                if ((ip->i_d.di_mode == 0) &&
+                                    !(flags & XFS_IGET_CREATE)) {
+                                        read_unlock(&ih->ih_lock);
+                                        return ENOENT;
+                                }
+                                /*
+                                 * There may be transactions sitting in the
+                                 * incore log buffers or being flushed to disk
+                                 * at this time.  We can't clear the
+                                 * XFS_IRECLAIMABLE flag until these
+                                 * transactions have hit the disk, otherwise we
+                                 * will void the guarantee the flag provides
+                                 * xfs_iunpin()
+                                 */
+                                if (xfs_ipincount(ip)) {
+                                        read_unlock(&ih->ih_lock);
+                                        xfs_log_force(mp, 0,
+                                                XFS_LOG_FORCE|XFS_LOG_SYNC);
+                                        XFS_STATS_INC(xs_ig_frecycle);
+                                        goto again;
+                                }
                                vn_trace_exit(vp, "xfs_iget.alloc",
                                        (inst_t *)__return_address);
                                XFS_STATS_INC(xs_ig_found);
-                                spin_lock(&ip->i_flags_lock);
+                                xfs_iflags_clear(ip, XFS_IRECLAIMABLE);
-                                ip->i_flags &= ~XFS_IRECLAIMABLE;
-                                spin_unlock(&ip->i_flags_lock);
                                version = ih->ih_version;
                                read_unlock(&ih->ih_lock);
                                xfs_ihash_promote(ih, ip, version);
@@ -299,10 +327,7 @@ finish_inode:
                        if (lock_flags != 0)
                                xfs_ilock(ip, lock_flags);
-                        spin_lock(&ip->i_flags_lock);
+                        xfs_iflags_clear(ip, XFS_ISTALE);
-                        ip->i_flags &= ~XFS_ISTALE;
-                        spin_unlock(&ip->i_flags_lock);
                        vn_trace_exit(vp, "xfs_iget.found",
                                                (inst_t *)__return_address);
                        goto return_ip;
@@ -371,10 +396,7 @@ finish_inode:
        ih->ih_next = ip;
        ip->i_udquot = ip->i_gdquot = NULL;
        ih->ih_version++;
-        spin_lock(&ip->i_flags_lock);
+        xfs_iflags_set(ip, XFS_INEW);
-        ip->i_flags |= XFS_INEW;
-        spin_unlock(&ip->i_flags_lock);
        write_unlock(&ih->ih_lock);
        /*
@@ -625,7 +647,7 @@ xfs_iput_new(xfs_inode_t	*ip,
        vn_trace_entry(vp, "xfs_iput_new", (inst_t *)__return_address);
        if ((ip->i_d.di_mode == 0)) {
-                ASSERT(!(ip->i_flags & XFS_IRECLAIMABLE));
+                ASSERT(!xfs_iflags_test(ip, XFS_IRECLAIMABLE));
                vn_mark_bad(vp);
        }
        if (inode->i_state & I_NEW)
@@ -683,6 +705,7 @@ xfs_ireclaim(xfs_inode_t *ip)
        /*
         * Free all memory associated with the inode.
         */
+        xfs_iunlock(ip, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
        xfs_idestroy(ip);
 }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index c27d7d495aa0..d72c80dbfbb1 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2193,7 +2193,7 @@ xfs_ifree_cluster(
                        /* Inode not in memory or we found it already,
                         * nothing to do
                         */
-                        if (!ip || (ip->i_flags & XFS_ISTALE)) {
+                        if (!ip || xfs_iflags_test(ip, XFS_ISTALE)) {
                                read_unlock(&ih->ih_lock);
                                continue;
                        }
@@ -2215,10 +2215,7 @@ xfs_ifree_cluster(
                        if (ip == free_ip) {
                                if (xfs_iflock_nowait(ip)) {
-                                        spin_lock(&ip->i_flags_lock);
+                                        xfs_iflags_set(ip, XFS_ISTALE);
-                                        ip->i_flags |= XFS_ISTALE;
-                                        spin_unlock(&ip->i_flags_lock);
                                        if (xfs_inode_clean(ip)) {
                                                xfs_ifunlock(ip);
                                        } else {
@@ -2231,9 +2228,7 @@ xfs_ifree_cluster(
                        if (xfs_ilock_nowait(ip, XFS_ILOCK_EXCL)) {
                                if (xfs_iflock_nowait(ip)) {
-                                        spin_lock(&ip->i_flags_lock);
+                                        xfs_iflags_set(ip, XFS_ISTALE);
-                                        ip->i_flags |= XFS_ISTALE;
-                                        spin_unlock(&ip->i_flags_lock);
                                        if (xfs_inode_clean(ip)) {
                                                xfs_ifunlock(ip);
@@ -2263,9 +2258,7 @@ xfs_ifree_cluster(
                                AIL_LOCK(mp,s);
                                iip->ili_flush_lsn = iip->ili_item.li_lsn;
                                AIL_UNLOCK(mp, s);
-                                spin_lock(&iip->ili_inode->i_flags_lock);
+                                xfs_iflags_set(ip, XFS_ISTALE);
-                                iip->ili_inode->i_flags |= XFS_ISTALE;
-                                spin_unlock(&iip->ili_inode->i_flags_lock);
                                pre_flushed++;
                        }
                        lip = lip->li_bio_list;
@@ -2748,42 +2741,39 @@ xfs_iunpin(
 {
        ASSERT(atomic_read(&ip->i_pincount) > 0);
-        if (atomic_dec_and_test(&ip->i_pincount)) {
+        if (atomic_dec_and_lock(&ip->i_pincount, &ip->i_flags_lock)) {
                /*
-                 * If the inode is currently being reclaimed, the
+                 * If the inode is currently being reclaimed, the link between
-                 * linux inode _and_ the xfs vnode may have been
+                 * the bhv_vnode and the xfs_inode will be broken after the
-                 * freed so we cannot reference either of them safely.
+                 * XFS_IRECLAIM* flag is set. Hence, if these flags are not
-                 * Hence we should not try to do anything to them
+                 * set, then we can move forward and mark the linux inode dirty
-                 * if the xfs inode is currently in the reclaim
+                 * knowing that it is still valid as it won't freed until after
-                 * path.
+                 * the bhv_vnode<->xfs_inode link is broken in xfs_reclaim. The
+                 * i_flags_lock is used to synchronise the setting of the
+                 * XFS_IRECLAIM* flags and the breaking of the link, and so we
+                 * can execute atomically w.r.t to reclaim by holding this lock
+                 * here.
                 *
-                 * However, we still need to issue the unpin wakeup
+                 * However, we still need to issue the unpin wakeup call as the
-                 * call as the inode reclaim may be blocked waiting for
+                 * inode reclaim may be blocked waiting for the inode to become
-                 * the inode to become unpinned.
+                 * unpinned.
                 */
-                struct inode *inode = NULL;
-                spin_lock(&ip->i_flags_lock);
+                if (!__xfs_iflags_test(ip, XFS_IRECLAIM|XFS_IRECLAIMABLE)) {
-                if (!(ip->i_flags & (XFS_IRECLAIM|XFS_IRECLAIMABLE))) {
                        bhv_vnode_t     *vp = XFS_ITOV_NULL(ip);
+                        struct inode *inode = NULL;
+                        BUG_ON(vp == NULL);
+                        inode = vn_to_inode(vp);
+                        BUG_ON(inode->i_state & I_CLEAR);
                        /* make sync come back and flush this inode */
-                        if (vp) {
+                        if (!(inode->i_state & (I_NEW|I_FREEING)))
-                                inode = vn_to_inode(vp);
+                                mark_inode_dirty_sync(inode);
-                                if (!(inode->i_state &
-                                                (I_NEW|I_FREEING|I_CLEAR))) {
-                                        inode = igrab(inode);
-                                        if (inode)
-                                                mark_inode_dirty_sync(inode);
-                                } else
-                                        inode = NULL;
-                        }
                }
                spin_unlock(&ip->i_flags_lock);
                wake_up(&ip->i_ipin_wait);
-                if (inode)
-                        iput(inode);
        }
 }
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index e96eb0835fe6..bc823720d88f 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -305,6 +305,47 @@ typedef struct xfs_inode {
 #endif
 } xfs_inode_t;
+/*
+ * i_flags helper functions
+ */
+static inline void
+__xfs_iflags_set(xfs_inode_t *ip, unsigned short flags)
+{
+        ip->i_flags |= flags;
+}
+static inline void
+xfs_iflags_set(xfs_inode_t *ip, unsigned short flags)
+{
+        spin_lock(&ip->i_flags_lock);
+        __xfs_iflags_set(ip, flags);
+        spin_unlock(&ip->i_flags_lock);
+}
+static inline void
+xfs_iflags_clear(xfs_inode_t *ip, unsigned short flags)
+{
+        spin_lock(&ip->i_flags_lock);
+        ip->i_flags &= ~flags;
+        spin_unlock(&ip->i_flags_lock);
+}
+static inline int
+__xfs_iflags_test(xfs_inode_t *ip, unsigned short flags)
+{
+        return (ip->i_flags & flags);
+}
+static inline int
+xfs_iflags_test(xfs_inode_t *ip, unsigned short flags)
+{
+        int ret;
+        spin_lock(&ip->i_flags_lock);
+        ret = __xfs_iflags_test(ip, flags);
+        spin_unlock(&ip->i_flags_lock);
+        return ret;
+}
 #endif  /* __KERNEL__ */
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 061e2ffdd1de..bda774a04b8f 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1013,7 +1013,7 @@ xfs_readlink(
        pathlen = (int)ip->i_d.di_size;
        if (ip->i_df.if_flags & XFS_IFINLINE) {
-                error = uio_read(ip->i_df.if_u1.if_data, pathlen, uiop);
+                error = xfs_uio_read(ip->i_df.if_u1.if_data, pathlen, uiop);
        }
        else {
                /*
@@ -1044,7 +1044,7 @@ xfs_readlink(
                                byte_cnt = pathlen;
                        pathlen -= byte_cnt;
-                        error = uio_read(XFS_BUF_PTR(bp), byte_cnt, uiop);
+                        error = xfs_uio_read(XFS_BUF_PTR(bp), byte_cnt, uiop);
                        xfs_buf_relse (bp);
                }
@@ -3827,11 +3827,16 @@ xfs_reclaim(
         */
        xfs_synchronize_atime(ip);
-        /* If we have nothing to flush with this inode then complete the
+        /*
-         * teardown now, otherwise break the link between the xfs inode
+         * If we have nothing to flush with this inode then complete the
-         * and the linux inode and clean up the xfs inode later. This
+         * teardown now, otherwise break the link between the xfs inode and the
-         * avoids flushing the inode to disk during the delete operation
+         * linux inode and clean up the xfs inode later. This avoids flushing
-         * itself.
+         * the inode to disk during the delete operation itself.
+         *
+         * When breaking the link, we need to set the XFS_IRECLAIMABLE flag
+         * first to ensure that xfs_iunpin() will never see an xfs inode
+         * that has a linux inode being reclaimed. Synchronisation is provided
+         * by the i_flags_lock.
         */
        if (!ip->i_update_core && (ip->i_itemp == NULL)) {
                xfs_ilock(ip, XFS_ILOCK_EXCL);
@@ -3840,13 +3845,13 @@ xfs_reclaim(
        } else {
                xfs_mount_t     *mp = ip->i_mount;
-                /* Protect sync from us */
+                /* Protect sync and unpin from us */
                XFS_MOUNT_ILOCK(mp);
-                vn_bhv_remove(VN_BHV_HEAD(vp), XFS_ITOBHV(ip));
-                list_add_tail(&ip->i_reclaim, &mp->m_del_inodes);
                spin_lock(&ip->i_flags_lock);
-                ip->i_flags |= XFS_IRECLAIMABLE;
+                __xfs_iflags_set(ip, XFS_IRECLAIMABLE);
+                vn_bhv_remove(VN_BHV_HEAD(vp), XFS_ITOBHV(ip));
                spin_unlock(&ip->i_flags_lock);
+                list_add_tail(&ip->i_reclaim, &mp->m_del_inodes);
                XFS_MOUNT_IUNLOCK(mp);
        }
        return 0;
@@ -3872,8 +3877,8 @@ xfs_finish_reclaim(
         */
        write_lock(&ih->ih_lock);
        spin_lock(&ip->i_flags_lock);
-        if ((ip->i_flags & XFS_IRECLAIM) ||
+        if (__xfs_iflags_test(ip, XFS_IRECLAIM) ||
-            (!(ip->i_flags & XFS_IRECLAIMABLE) && vp == NULL)) {
+            (!__xfs_iflags_test(ip, XFS_IRECLAIMABLE) && vp == NULL)) {
                spin_unlock(&ip->i_flags_lock);
                write_unlock(&ih->ih_lock);
                if (locked) {
@@ -3882,7 +3887,7 @@ xfs_finish_reclaim(
                }
                return 1;
        }
-        ip->i_flags |= XFS_IRECLAIM;
+        __xfs_iflags_set(ip, XFS_IRECLAIM);
        spin_unlock(&ip->i_flags_lock);
        write_unlock(&ih->ih_lock);
diff --git a/include/asm-i386/acpi.h b/include/asm-i386/acpi.h
index 6016632d032f..c80b3a94511a 100644
--- a/include/asm-i386/acpi.h
+++ b/include/asm-i386/acpi.h
@@ -132,6 +132,7 @@ extern int acpi_gsi_to_irq(u32 gsi, unsigned int *irq);
 #ifdef CONFIG_X86_IO_APIC
 extern int acpi_skip_timer_override;
+extern int acpi_use_timer_override;
 #endif
 static inline void acpi_noirq_set(void) { acpi_noirq = 1; }
diff --git a/include/asm-ia64/sn/addrs.h b/include/asm-ia64/sn/addrs.h
index 1d9efe541662..e715c794b186 100644
--- a/include/asm-ia64/sn/addrs.h
+++ b/include/asm-ia64/sn/addrs.h
@@ -136,9 +136,13 @@
 */
 #define TO_PHYS(x)              (TO_PHYS_MASK & (x))
 #define TO_CAC(x)               (CAC_BASE     | TO_PHYS(x))
+#ifdef CONFIG_SGI_SN
 #define TO_AMO(x)               (AMO_BASE     | TO_PHYS(x))
 #define TO_GET(x)               (GET_BASE     | TO_PHYS(x))
+#else
+#define TO_AMO(x)               ({ BUG(); x; })
+#define TO_GET(x)               ({ BUG(); x; })
+#endif
 /*
 * Covert from processor physical address to II/TIO physical address:
diff --git a/include/asm-powerpc/systbl.h b/include/asm-powerpc/systbl.h
index c6a03187f932..97b435484177 100644
--- a/include/asm-powerpc/systbl.h
+++ b/include/asm-powerpc/systbl.h
@@ -304,3 +304,4 @@ SYSCALL_SPU(fchmodat)
 SYSCALL_SPU(faccessat)
 COMPAT_SYS_SPU(get_robust_list)
 COMPAT_SYS_SPU(set_robust_list)
+COMPAT_SYS(move_pages)
diff --git a/include/asm-powerpc/topology.h b/include/asm-powerpc/topology.h
index 8f7ee16781a4..9fe7894ee035 100644
--- a/include/asm-powerpc/topology.h
+++ b/include/asm-powerpc/topology.h
@@ -96,7 +96,13 @@ static inline void sysfs_remove_device_from_node(struct sys_device *dev,
 #ifdef CONFIG_SMP
 #include <asm/cputable.h>
-#define smt_capable()           (cpu_has_feature(CPU_FTR_SMT))
+#define smt_capable()           (cpu_has_feature(CPU_FTR_SMT))
+#ifdef CONFIG_PPC64
+#include <asm/smp.h>
+#define topology_thread_siblings(cpu)   (cpu_sibling_map[cpu])
+#endif
 #endif
 #endif /* __KERNEL__ */
diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h
index b5fe93291c96..0e4ea37f6466 100644
--- a/include/asm-powerpc/unistd.h
+++ b/include/asm-powerpc/unistd.h
@@ -323,10 +323,11 @@
 #define __NR_faccessat          298
 #define __NR_get_robust_list    299
 #define __NR_set_robust_list    300
+#define __NR_move_pages         301
 #ifdef __KERNEL__
-#define __NR_syscalls           301
+#define __NR_syscalls           302
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/include/asm-x86_64/acpi.h b/include/asm-x86_64/acpi.h
index ed59aa4c6ff9..9d1916e59c04 100644
--- a/include/asm-x86_64/acpi.h
+++ b/include/asm-x86_64/acpi.h
@@ -163,6 +163,7 @@ extern u8 x86_acpiid_to_apicid[];
 #define ARCH_HAS_POWER_INIT 1
 extern int acpi_skip_timer_override;
+extern int acpi_use_timer_override;
 #endif /*__KERNEL__*/
diff --git a/include/asm-x86_64/pda.h b/include/asm-x86_64/pda.h
index 14996d962bac..5642634843c4 100644
--- a/include/asm-x86_64/pda.h
+++ b/include/asm-x86_64/pda.h
@@ -109,6 +109,15 @@ extern struct x8664_pda _proxy_pda;
 #define sub_pda(field,val) pda_to_op("sub",field,val)
 #define or_pda(field,val) pda_to_op("or",field,val)
+/* This is not atomic against other CPUs -- CPU preemption needs to be off */
+#define test_and_clear_bit_pda(bit,field) ({            \
+        int old__;                                              \
+        asm volatile("btr %2,%%gs:%c3\n\tsbbl %0,%0"            \
+            : "=r" (old__), "+m" (_proxy_pda.field)             \
+            : "dIr" (bit), "i" (pda_offset(field)) : "memory"); \
+        old__;                                                  \
+})
 #endif
 #define PDA_STACKOFFSET (5*8)
diff --git a/include/asm-x86_64/vsyscall.h b/include/asm-x86_64/vsyscall.h
index fd452fc2c037..01d1c17e2849 100644
--- a/include/asm-x86_64/vsyscall.h
+++ b/include/asm-x86_64/vsyscall.h
@@ -59,8 +59,6 @@ extern seqlock_t xtime_lock;
 extern int sysctl_vsyscall;
-extern void vsyscall_set_cpu(int cpu);
 #define ARCH_HAVE_XTIME_LOCK 1
 #endif /* __KERNEL__ */
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 5081d27bfa27..ace64e57e17f 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -60,8 +60,11 @@ void hugetlb_free_pgd_range(struct mmu_gather **tlb, unsigned long addr,
 * If the arch doesn't supply something else, assume that hugepage
 * size aligned regions are ok without further preparation.
 */
-static inline int prepare_hugepage_range(unsigned long addr, unsigned long len)
+static inline int prepare_hugepage_range(unsigned long addr, unsigned long len,
+                                                pgoff_t pgoff)
 {
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
        if (len & ~HPAGE_MASK)
                return -EINVAL;
        if (addr & ~HPAGE_MASK)
@@ -69,7 +72,8 @@ static inline int prepare_hugepage_range(unsigned long addr, unsigned long len)
        return 0;
 }
 #else
-int prepare_hugepage_range(unsigned long addr, unsigned long len);
+int prepare_hugepage_range(unsigned long addr, unsigned long len,
+                                                pgoff_t pgoff);
 #endif
 #ifndef ARCH_HAS_SETCLEAR_HUGE_PTE
@@ -107,7 +111,7 @@ static inline unsigned long hugetlb_total_pages(void)
 #define hugetlb_report_meminfo(buf)             0
 #define hugetlb_report_node_meminfo(n, buf)     0
 #define follow_huge_pmd(mm, addr, pmd, write)   NULL
-#define prepare_hugepage_range(addr, len)       (-EINVAL)
+#define prepare_hugepage_range(addr,len,pgoff)  (-EINVAL)
 #define pmd_huge(x)     0
 #define is_hugepage_only_range(mm, addr, len)   0
 #define hugetlb_free_pgd_range(tlb, addr, end, floor, ceiling) ({BUG(); 0; })
diff --git a/include/linux/in6.h b/include/linux/in6.h
index 9be6a4756f0b..f28621f638e0 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -225,7 +225,7 @@ struct in6_flowlabel_req
 #endif
 /*
- * Netfilter
+ * Netfilter (1)
 *
 * Following socket options are used in ip6_tables;
 * see include/linux/netfilter_ipv6/ip6_tables.h.
@@ -240,4 +240,14 @@ struct in6_flowlabel_req
 #define IPV6_RECVTCLASS         66
 #define IPV6_TCLASS             67
+/*
+ * Netfilter (2)
+ *
+ * Following socket options are used in ip6_tables;
+ * see include/linux/netfilter_ipv6/ip6_tables.h.
+ *
+ * IP6T_SO_GET_REVISION_MATCH   68
+ * IP6T_SO_GET_REVISION_TARGET  69
+ */
 #endif
diff --git a/include/linux/msdos_fs.h b/include/linux/msdos_fs.h
index ce6c85815cbd..24a9ef1506b6 100644
--- a/include/linux/msdos_fs.h
+++ b/include/linux/msdos_fs.h
@@ -402,6 +402,8 @@ extern const struct file_operations fat_file_operations;
 extern struct inode_operations fat_file_inode_operations;
 extern int fat_notify_change(struct dentry * dentry, struct iattr * attr);
 extern void fat_truncate(struct inode *inode);
+extern int fat_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                       struct kstat *stat);
 /* fat/inode.c */
 extern void fat_attach(struct inode *inode, loff_t i_pos);
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 04319a76103a..022edfa97ed9 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -96,22 +96,6 @@ struct _xt_align
 /* Error verdict. */
 #define XT_ERROR_TARGET "ERROR"
-/*
- * New IP firewall options for [gs]etsockopt at the RAW IP level.
- * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define XT_BASE_CTL             64      /* base for firewall socket options */
-#define XT_SO_SET_REPLACE       (XT_BASE_CTL)
-#define XT_SO_SET_ADD_COUNTERS  (XT_BASE_CTL + 1)
-#define XT_SO_SET_MAX           XT_SO_SET_ADD_COUNTERS
-#define XT_SO_GET_INFO                  (XT_BASE_CTL)
-#define XT_SO_GET_ENTRIES               (XT_BASE_CTL + 1)
-#define XT_SO_GET_REVISION_MATCH        (XT_BASE_CTL + 2)
-#define XT_SO_GET_REVISION_TARGET       (XT_BASE_CTL + 3)
-#define XT_SO_GET_MAX                   XT_SO_GET_REVISION_TARGET
 #define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 44e39b61d9e7..0be235418a2f 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -112,19 +112,20 @@ struct arpt_entry
 * New IP firewall options for [gs]etsockopt at the RAW IP level.
 * Unlike BSD Linux inherits IP options so you don't have to use a raw
 * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
 */
-#define ARPT_CTL_OFFSET         32
+#define ARPT_BASE_CTL           96
-#define ARPT_BASE_CTL           (XT_BASE_CTL+ARPT_CTL_OFFSET)
+#define ARPT_SO_SET_REPLACE             (ARPT_BASE_CTL)
-#define ARPT_SO_SET_REPLACE             (XT_SO_SET_REPLACE+ARPT_CTL_OFFSET)
+#define ARPT_SO_SET_ADD_COUNTERS        (ARPT_BASE_CTL + 1)
-#define ARPT_SO_SET_ADD_COUNTERS        (XT_SO_SET_ADD_COUNTERS+ARPT_CTL_OFFSET)
+#define ARPT_SO_SET_MAX                 ARPT_SO_SET_ADD_COUNTERS
-#define ARPT_SO_SET_MAX                 (XT_SO_SET_MAX+ARPT_CTL_OFFSET)
+#define ARPT_SO_GET_INFO                (ARPT_BASE_CTL)
-#define ARPT_SO_GET_INFO                (XT_SO_GET_INFO+ARPT_CTL_OFFSET)
+#define ARPT_SO_GET_ENTRIES             (ARPT_BASE_CTL + 1)
-#define ARPT_SO_GET_ENTRIES             (XT_SO_GET_ENTRIES+ARPT_CTL_OFFSET)
+/* #define ARPT_SO_GET_REVISION_MATCH   (APRT_BASE_CTL + 2) */
-/* #define ARPT_SO_GET_REVISION_MATCH   XT_SO_GET_REVISION_MATCH  */
+#define ARPT_SO_GET_REVISION_TARGET     (ARPT_BASE_CTL + 3)
-#define ARPT_SO_GET_REVISION_TARGET     (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
+#define ARPT_SO_GET_MAX                 (ARPT_SO_GET_REVISION_TARGET)
-#define ARPT_SO_GET_MAX                 (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
 /* CONTINUE verdict for targets */
 #define ARPT_CONTINUE XT_CONTINUE
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index a536bbdef145..4f06dad0bde9 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -101,18 +101,21 @@ struct ipt_entry
 /*
 * New IP firewall options for [gs]etsockopt at the RAW IP level.
 * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
+ * socket for this. Instead we check rights in the calls.
-#define IPT_BASE_CTL            XT_BASE_CTL
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
-#define IPT_SO_SET_REPLACE      XT_SO_SET_REPLACE
+ */
-#define IPT_SO_SET_ADD_COUNTERS XT_SO_SET_ADD_COUNTERS
+#define IPT_BASE_CTL            64
-#define IPT_SO_SET_MAX          XT_SO_SET_MAX
+#define IPT_SO_SET_REPLACE      (IPT_BASE_CTL)
-#define IPT_SO_GET_INFO                 XT_SO_GET_INFO
+#define IPT_SO_SET_ADD_COUNTERS (IPT_BASE_CTL + 1)
-#define IPT_SO_GET_ENTRIES              XT_SO_GET_ENTRIES
+#define IPT_SO_SET_MAX          IPT_SO_SET_ADD_COUNTERS
-#define IPT_SO_GET_REVISION_MATCH       XT_SO_GET_REVISION_MATCH
-#define IPT_SO_GET_REVISION_TARGET      XT_SO_GET_REVISION_TARGET
+#define IPT_SO_GET_INFO                 (IPT_BASE_CTL)
-#define IPT_SO_GET_MAX                  XT_SO_GET_REVISION_TARGET
+#define IPT_SO_GET_ENTRIES              (IPT_BASE_CTL + 1)
+#define IPT_SO_GET_REVISION_MATCH       (IPT_BASE_CTL + 2)
+#define IPT_SO_GET_REVISION_TARGET      (IPT_BASE_CTL + 3)
+#define IPT_SO_GET_MAX                  IPT_SO_GET_REVISION_TARGET
 #define IPT_CONTINUE XT_CONTINUE
 #define IPT_RETURN XT_RETURN
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index d7a8e9c0dad0..4aed340401db 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -107,18 +107,21 @@ struct ip6t_entry
 /*
 * New IP firewall options for [gs]etsockopt at the RAW IP level.
 * Unlike BSD Linux inherits IP options so you don't have to use
- * a raw socket for this. Instead we check rights in the calls. */
+ * a raw socket for this. Instead we check rights in the calls.
-#define IP6T_BASE_CTL                   XT_BASE_CTL
+ *
+ * ATTENTION: check linux/in6.h before adding new number here.
-#define IP6T_SO_SET_REPLACE             XT_SO_SET_REPLACE
+ */
-#define IP6T_SO_SET_ADD_COUNTERS        XT_SO_SET_ADD_COUNTERS
+#define IP6T_BASE_CTL                   64
-#define IP6T_SO_SET_MAX                 XT_SO_SET_MAX
+#define IP6T_SO_SET_REPLACE             (IP6T_BASE_CTL)
-#define IP6T_SO_GET_INFO                XT_SO_GET_INFO
+#define IP6T_SO_SET_ADD_COUNTERS        (IP6T_BASE_CTL + 1)
-#define IP6T_SO_GET_ENTRIES             XT_SO_GET_ENTRIES
+#define IP6T_SO_SET_MAX                 IP6T_SO_SET_ADD_COUNTERS
-#define IP6T_SO_GET_REVISION_MATCH      XT_SO_GET_REVISION_MATCH
-#define IP6T_SO_GET_REVISION_TARGET     XT_SO_GET_REVISION_TARGET
+#define IP6T_SO_GET_INFO                (IP6T_BASE_CTL)
-#define IP6T_SO_GET_MAX                 XT_SO_GET_REVISION_TARGET
+#define IP6T_SO_GET_ENTRIES             (IP6T_BASE_CTL + 1)
+#define IP6T_SO_GET_REVISION_MATCH      (IP6T_BASE_CTL + 4)
+#define IP6T_SO_GET_REVISION_TARGET     (IP6T_BASE_CTL + 5)
+#define IP6T_SO_GET_MAX                 IP6T_SO_GET_REVISION_TARGET
 /* CONTINUE verdict for targets */
 #define IP6T_CONTINUE XT_CONTINUE
diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
index c312a12ad2d6..c321316f1bc7 100644
--- a/include/linux/pci_regs.h
+++ b/include/linux/pci_regs.h
@@ -371,6 +371,7 @@
 #define  PCI_EXP_DEVSTA_TRPND   0x20    /* Transactions Pending */
 #define PCI_EXP_LNKCAP          12      /* Link Capabilities */
 #define PCI_EXP_LNKCTL          16      /* Link Control */
+#define  PCI_EXP_LNKCTL_CLKREQ_EN 0x100 /* Enable clkreq */
 #define PCI_EXP_LNKSTA          18      /* Link Status */
 #define PCI_EXP_SLTCAP          20      /* Slot Capabilities */
 #define PCI_EXP_SLTCTL          24      /* Slot Control */
diff --git a/include/linux/personality.h b/include/linux/personality.h
index bf4cf2080e5c..012cd558189b 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -114,7 +114,7 @@ struct exec_domain {
 * Change personality of the currently running process.
 */
 #define set_personality(pers) \
-        ((current->personality == pers) ? 0 : __set_personality(pers))
+        ((current->personality == (pers)) ? 0 : __set_personality(pers))
 #endif /* __KERNEL__ */
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index dc9a29d84abc..924e502905d4 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -23,13 +23,14 @@ struct vm_area_struct;
 #endif
 struct vm_struct {
+        /* keep next,addr,size together to speedup lookups */
+        struct vm_struct        *next;
        void                    *addr;
        unsigned long           size;
        unsigned long           flags;
        struct page             **pages;
        unsigned int            nr_pages;
        unsigned long           phys_addr;
-        struct vm_struct        *next;
 };
 /*
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 49c717e3b040..903108e583f8 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -7,6 +7,7 @@
 #define _IP_VS_H
 #include <asm/types.h>          /* For __uXX types */
+#include <linux/types.h>        /* For __beXX types in userland */
 #define IP_VS_VERSION_CODE      0x010201
 #define NVERSION(version)                       \
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 2d0dc3efe813..ebfd24a41858 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -233,6 +233,8 @@ void irq_chip_set_defaults(struct irq_chip *chip)
                chip->shutdown = chip->disable;
        if (!chip->name)
                chip->name = chip->typename;
+        if (!chip->end)
+                chip->end = dummy_irq_chip.end;
 }
 static inline void mask_ack_irq(struct irq_desc *desc, int irq)
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 6879202afe9a..b385878c6e80 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -216,6 +216,7 @@ int setup_irq(unsigned int irq, struct irqaction *new)
 {
        struct irq_desc *desc = irq_desc + irq;
        struct irqaction *old, **p;
+        const char *old_name = NULL;
        unsigned long flags;
        int shared = 0;
@@ -255,8 +256,10 @@ int setup_irq(unsigned int irq, struct irqaction *new)
                 * set the trigger type must match.
                 */
                if (!((old->flags & new->flags) & IRQF_SHARED) ||
-                    ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK))
+                    ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK)) {
+                        old_name = old->name;
                        goto mismatch;
+                }
 #if defined(CONFIG_IRQ_PER_CPU)
                /* All handlers must agree on per-cpuness */
@@ -322,11 +325,13 @@ int setup_irq(unsigned int irq, struct irqaction *new)
        return 0;
 mismatch:
-        spin_unlock_irqrestore(&desc->lock, flags);
        if (!(new->flags & IRQF_PROBE_SHARED)) {
                printk(KERN_ERR "IRQ handler type mismatch for IRQ %d\n", irq);
+                if (old_name)
+                        printk(KERN_ERR "current handler: %s\n", old_name);
                dump_stack();
        }
+        spin_unlock_irqrestore(&desc->lock, flags);
        return -EBUSY;
 }
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 543ea2e5ad93..9c7e2e4c1fe7 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -147,7 +147,11 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
        if (unlikely(irqfixup)) {
                /* Don't punish working computers */
                if ((irqfixup == 2 && irq == 0) || action_ret == IRQ_NONE) {
-                        int ok = misrouted_irq(irq);
+                        int ok;
+                        spin_unlock(&desc->lock);
+                        ok = misrouted_irq(irq);
+                        spin_lock(&desc->lock);
                        if (action_ret == IRQ_NONE)
                                desc->irqs_unhandled -= ok;
                }
diff --git a/mm/mmap.c b/mm/mmap.c
index 497e502dfd6b..7b40abd7cba2 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1379,7 +1379,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
                 * Check if the given range is hugepage aligned, and
                 * can be made suitable for hugepages.
                 */
-                ret = prepare_hugepage_range(addr, len);
+                ret = prepare_hugepage_range(addr, len, pgoff);
        } else {
                /*
                 * Ensure that a normal request is not falling in a
@@ -1880,6 +1880,9 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
        if ((addr + len) > TASK_SIZE || (addr + len) < addr)
                return -EINVAL;
+        if (is_hugepage_only_range(mm, addr, len))
+                return -EINVAL;
        flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
        error = arch_mmap_check(addr, len, flags);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 46606c133e82..86897ee792d6 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -181,16 +181,13 @@ static struct vm_struct *__get_vm_area_node(unsigned long size, unsigned long fl
        }
        addr = ALIGN(start, align);
        size = PAGE_ALIGN(size);
+        if (unlikely(!size))
+                return NULL;
        area = kmalloc_node(sizeof(*area), gfp_mask & GFP_LEVEL_MASK, node);
        if (unlikely(!area))
                return NULL;
-        if (unlikely(!size)) {
-                kfree (area);
-                return NULL;
-        }
        /*
         * We always allocate a guard page.
         */
@@ -532,11 +529,12 @@ void *vmalloc_user(unsigned long size)
        void *ret;
        ret = __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
+        if (ret) {
-        area = __find_vm_area(ret);
+                write_lock(&vmlist_lock);
-        area->flags |= VM_USERMAP;
+                area = __find_vm_area(ret);
-        write_unlock(&vmlist_lock);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
        return ret;
 }
 EXPORT_SYMBOL(vmalloc_user);
@@ -605,11 +603,12 @@ void *vmalloc_32_user(unsigned long size)
        void *ret;
        ret = __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
+        if (ret) {
-        area = __find_vm_area(ret);
+                write_lock(&vmlist_lock);
-        area->flags |= VM_USERMAP;
+                area = __find_vm_area(ret);
-        write_unlock(&vmlist_lock);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
        return ret;
 }
 EXPORT_SYMBOL(vmalloc_32_user);
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index 6d398f10aa91..687c1de1146f 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -200,7 +200,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                from = n_cp->vaddr;
                port = n_cp->vport;
                sprintf(buf,"%d,%d,%d,%d,%d,%d", NIPQUAD(from),
-                        ntohs(port)&255, (ntohs(port)>>8)&255);
+                        (ntohs(port)>>8)&255, ntohs(port)&255);
                buf_len = strlen(buf);
                /*
diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
index bfe779e74590..6ff05c3a32e6 100644
--- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -117,7 +117,7 @@ tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
 {
        tcph->check =
                ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
+                                 ip_vs_check_diff(oldport ^ htons(0xFFFF),
                                                  newport, tcph->check));
 }
diff --git a/net/ipv4/ipvs/ip_vs_proto_udp.c b/net/ipv4/ipvs/ip_vs_proto_udp.c
index 54aa7603591f..691c8b637b29 100644
--- a/net/ipv4/ipvs/ip_vs_proto_udp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_udp.c
@@ -122,10 +122,10 @@ udp_fast_csum_update(struct udphdr *uhdr, __be32 oldip, __be32 newip,
 {
        uhdr->check =
                ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
+                                 ip_vs_check_diff(oldport ^ htons(0xFFFF),
                                                  newport, uhdr->check));
        if (!uhdr->check)
-                uhdr->check = htonl(0xFFFF);
+                uhdr->check = -1;
 }
 static int
@@ -173,7 +173,7 @@ udp_snat_handler(struct sk_buff **pskb,
                                                cp->protocol,
                                                (*pskb)->csum);
                if (udph->check == 0)
-                        udph->check = htonl(0xFFFF);
+                        udph->check = -1;
                IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
                          pp->name, udph->check,
                          (char*)&(udph->check) - (char*)udph);
@@ -228,7 +228,7 @@ udp_dnat_handler(struct sk_buff **pskb,
                                                cp->protocol,
                                                (*pskb)->csum);
                if (udph->check == 0)
-                        udph->check = 0xFFFF;
+                        udph->check = -1;
                (*pskb)->ip_summed = CHECKSUM_UNNECESSARY;
        }
        return 1;
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 7edad790478a..97556cc2e4e0 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -351,9 +351,10 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
        if (v->data_len < sizeof(*user_iph))
                return 0;
        diff = v->data_len - e->skb->len;
-        if (diff < 0)
+        if (diff < 0) {
-                skb_trim(e->skb, v->data_len);
+                if (pskb_trim(e->skb, v->data_len))
-        else if (diff > 0) {
+                        return -ENOMEM;
+        } else if (diff > 0) {
                if (v->data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 4322318ab332..c05e8edaf544 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2316,9 +2316,10 @@ void __init tcp_init(void)
                sysctl_max_syn_backlog = 128;
        }
-        sysctl_tcp_mem[0] =  768 << order;
+        /* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
-        sysctl_tcp_mem[1] = 1024 << order;
+        sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
-        sysctl_tcp_mem[2] = 1536 << order;
+        sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+        sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
        limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
        max_share = min(4UL*1024*1024, limit);
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9510c24ca8d2..9fec832ee08b 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -349,9 +349,10 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
        if (v->data_len < sizeof(*user_iph))
                return 0;
        diff = v->data_len - e->skb->len;
-        if (diff < 0)
+        if (diff < 0) {
-                skb_trim(e->skb, v->data_len);
+                if (pskb_trim(e->skb, v->data_len))
-        else if (diff > 0) {
+                        return -ENOMEM;
+        } else if (diff > 0) {
                if (v->data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 167c2ea88f6b..204e02162d49 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1494,7 +1494,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                        if (_frag_off) {
                                if (target < 0 &&
                                    ((!ipv6_ext_hdr(hp->nexthdr)) ||
-                                     nexthdr == NEXTHDR_NONE)) {
+                                     hp->nexthdr == NEXTHDR_NONE)) {
                                        if (fragoff)
                                                *fragoff = _frag_off;
                                        return hp->nexthdr;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index b2bf8f2e01da..1e5207b80fe5 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -544,7 +544,7 @@ __build_packet_message(struct nfulnl_instance *inst,
        }
        /* global sequence number */
        if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) {
-                tmp_uint = atomic_inc_return(&global_seq);
+                tmp_uint = htonl(atomic_inc_return(&global_seq));
                NFA_PUT(inst->skb, NFULA_SEQ_GLOBAL, sizeof(tmp_uint), &tmp_uint);
        }
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 6e4ada3c1844..e815a9aa6e95 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -622,9 +622,10 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
        int diff;
        diff = data_len - e->skb->len;
-        if (diff < 0)
+        if (diff < 0) {
-                skb_trim(e->skb, data_len);
+                if (pskb_trim(e->skb, data_len))
-        else if (diff > 0) {
+                        return -ENOMEM;
+        } else if (diff > 0) {
                if (data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
diff --git a/scripts/kconfig/.gitignore b/scripts/kconfig/.gitignore
index e8ad1f6b3da4..b49584c932cc 100644
--- a/scripts/kconfig/.gitignore
+++ b/scripts/kconfig/.gitignore
@@ -6,6 +6,8 @@ lex.*.c
 *.tab.c
 *.tab.h
 zconf.hash.c
+*.moc
+lkc_defs.h
 #
 # configuration programs
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 0e292dc4fd87..e35cfd326df2 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -55,7 +55,7 @@ static char *model;
 static int position_fix;
 static int probe_mask = -1;
 static int single_cmd;
-static int disable_msi;
+static int enable_msi;
 module_param(index, int, 0444);
 MODULE_PARM_DESC(index, "Index value for Intel HD audio interface.");
@@ -69,8 +69,8 @@ module_param(probe_mask, int, 0444);
 MODULE_PARM_DESC(probe_mask, "Bitmask to probe codecs (default = -1).");
 module_param(single_cmd, bool, 0444);
 MODULE_PARM_DESC(single_cmd, "Use single command to communicate with codecs (for debugging only).");
-module_param(disable_msi, int, 0);
+module_param(enable_msi, int, 0);
-MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
+MODULE_PARM_DESC(enable_msi, "Enable Message Signaled Interrupt (MSI)");
 /* just for backward compatibility */
@@ -1531,7 +1531,7 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
        chip->pci = pci;
        chip->irq = -1;
        chip->driver_type = driver_type;
-        chip->msi = !disable_msi;
+        chip->msi = enable_msi;
        chip->position_fix = position_fix;
        chip->single_cmd = single_cmd;