27 files changed, 366 insertions, 111 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 8c8090e02d8e..829407ff41f1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -198,10 +198,25 @@ L:	linux-sound@vger.kernel.org
 W:      http://www.stud.uni-karlsruhe.de/~uh1b/
 S:      Maintained
 
+IPS SCSI RAID DRIVER
+P:      Adaptec OEM Raid Solutions
+M:      aacraid@adaptec.com
+L:      linux-scsi@vger.kernel.org
+W:      http://www.adaptec.com/
+S:      Maintained
+
+DPT_I2O SCSI RAID DRIVER
+P:      Adaptec OEM Raid Solutions
+M:      aacraid@adaptec.com
+L:      linux-scsi@vger.kernel.org
+W:      http://www.adaptec.com/
+S:      Maintained
+
 AACRAID SCSI RAID DRIVER
 P:      Adaptec OEM Raid Solutions
+M:      aacraid@adaptec.com
 L:      linux-scsi@vger.kernel.org
-W:      http://linux.dell.com/storage.shtml
+W:      http://www.adaptec.com/
 S:      Supported
 
 ACPI
diff --git a/arch/i386/kernel/hpet.c b/arch/i386/kernel/hpet.c
index 76afea67f691..17d73459fc5f 100644
--- a/arch/i386/kernel/hpet.c
+++ b/arch/i386/kernel/hpet.c
@@ -3,6 +3,8 @@
 #include <linux/errno.h>
 #include <linux/hpet.h>
 #include <linux/init.h>
+#include <linux/sysdev.h>
+#include <linux/pm.h>
 
 #include <asm/hpet.h>
 #include <asm/io.h>
@@ -307,6 +309,7 @@ int __init hpet_enable(void)
 out_nohpet:
         iounmap(hpet_virt_address);
         hpet_virt_address = NULL;
+        boot_hpet_disable = 1;
         return 0;
 }
 
@@ -521,3 +524,68 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 #endif
+
+
+/*
+ * Suspend/resume part
+ */
+
+#ifdef CONFIG_PM
+
+static int hpet_suspend(struct sys_device *sys_device, pm_message_t state)
+{
+        unsigned long cfg = hpet_readl(HPET_CFG);
+
+        cfg &= ~(HPET_CFG_ENABLE|HPET_CFG_LEGACY);
+        hpet_writel(cfg, HPET_CFG);
+
+        return 0;
+}
+
+static int hpet_resume(struct sys_device *sys_device)
+{
+        unsigned int id;
+
+        hpet_start_counter();
+
+        id = hpet_readl(HPET_ID);
+
+        if (id & HPET_ID_LEGSUP)
+                hpet_enable_int();
+
+        return 0;
+}
+
+static struct sysdev_class hpet_class = {
+        set_kset_name("hpet"),
+        .suspend        = hpet_suspend,
+        .resume         = hpet_resume,
+};
+
+static struct sys_device hpet_device = {
+        .id             = 0,
+        .cls            = &hpet_class,
+};
+
+
+static __init int hpet_register_sysfs(void)
+{
+        int err;
+
+        if (!is_hpet_capable())
+                return 0;
+
+        err = sysdev_class_register(&hpet_class);
+
+        if (!err) {
+                err = sysdev_register(&hpet_device);
+                if (err)
+                        sysdev_class_unregister(&hpet_class);
+        }
+
+        return err;
+}
+
+device_initcall(hpet_register_sysfs);
+
+#endif
diff --git a/arch/powerpc/sysdev/qe_lib/qe.c b/arch/powerpc/sysdev/qe_lib/qe.c
index e3d71e083f35..43f6cc9d7ea0 100644
--- a/arch/powerpc/sysdev/qe_lib/qe.c
+++ b/arch/powerpc/sysdev/qe_lib/qe.c
@@ -251,13 +251,13 @@ static int qe_sdma_init(void)
 
         /* allocate 2 internal temporary buffers (512 bytes size each) for
          * the SDMA */
-        sdma_buf_offset = qe_muram_alloc(512 * 2, 64);
+        sdma_buf_offset = qe_muram_alloc(512 * 2, 4096);
         if (IS_MURAM_ERR(sdma_buf_offset))
                 return -ENOMEM;
 
         out_be32(&sdma->sdebcr, sdma_buf_offset & QE_SDEBCR_BA_MASK);
-        out_be32(&sdma->sdmr, (QE_SDMR_GLB_1_MSK | (0x1 >>
-                                        QE_SDMR_CEN_SHIFT)));
+        out_be32(&sdma->sdmr, (QE_SDMR_GLB_1_MSK |
+                                        (0x1 << QE_SDMR_CEN_SHIFT)));
 
         return 0;
 }
diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 7b8baf146acc..9fdfad649536 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -236,11 +236,11 @@ void free_irqs(void)
         struct chan *chan;
         LIST_HEAD(list);
         struct list_head *ele;
+        unsigned long flags;
 
-        spin_lock_irq(&irqs_to_free_lock);
+        spin_lock_irqsave(&irqs_to_free_lock, flags);
         list_splice_init(&irqs_to_free, &list);
-        INIT_LIST_HEAD(&irqs_to_free);
-        spin_unlock_irq(&irqs_to_free_lock);
+        spin_unlock_irqrestore(&irqs_to_free_lock, flags);
 
         list_for_each(ele, &list){
                 chan = list_entry(ele, struct chan, free_list);
@@ -255,13 +255,15 @@ void free_irqs(void)
 
 static void close_one_chan(struct chan *chan, int delay_free_irq)
 {
+        unsigned long flags;
+
         if(!chan->opened)
                 return;
 
         if(delay_free_irq){
-                spin_lock_irq(&irqs_to_free_lock);
+                spin_lock_irqsave(&irqs_to_free_lock, flags);
                 list_add(&chan->free_list, &irqs_to_free);
-                spin_unlock_irq(&irqs_to_free_lock);
+                spin_unlock_irqrestore(&irqs_to_free_lock, flags);
         }
         else {
                 if(chan->input)
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 178b2eff4a8c..65ad2932672c 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -615,6 +615,9 @@ void mconsole_remove(struct mc_request *req)
         err_msg = NULL;
         err = (*dev->remove)(n, &err_msg);
         switch(err){
+        case 0:
+                err_msg = "";
+                break;
         case -ENODEV:
                 if(err_msg == NULL)
                         err_msg = "Device doesn't exist";
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index f98d26e51381..8bd9204ac1ab 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -109,10 +109,6 @@ static inline void ubd_set_bit(__u64 bit, unsigned char *data)
 
 static DEFINE_MUTEX(ubd_lock);
 
-/* XXX - this made sense in 2.4 days, now it's only used as a boolean, and
- * probably it doesn't make sense even for that. */
-static int do_ubd;
-
 static int ubd_open(struct inode * inode, struct file * filp);
 static int ubd_release(struct inode * inode, struct file * file);
 static int ubd_ioctl(struct inode * inode, struct file * file,
@@ -169,6 +165,7 @@ struct ubd {
         struct platform_device pdev;
         struct request_queue *queue;
         spinlock_t lock;
+        int active;
 };
 
 #define DEFAULT_COW { \
@@ -190,6 +187,7 @@ struct ubd {
         .shared =               0, \
         .cow =                  DEFAULT_COW, \
         .lock =                 SPIN_LOCK_UNLOCKED,     \
+        .active =               0, \
 }
 
 /* Protected by ubd_lock */
@@ -507,7 +505,6 @@ static void ubd_handler(void)
         struct ubd *dev;
         int n;
 
-        do_ubd = 0;
         n = os_read_file(thread_fd, &req, sizeof(req));
         if(n != sizeof(req)){
                 printk(KERN_ERR "Pid %d - spurious interrupt in ubd_handler, "
@@ -517,6 +514,7 @@ static void ubd_handler(void)
 
         rq = req.req;
         dev = rq->rq_disk->private_data;
+        dev->active = 0;
 
         ubd_finish(rq, req.error);
         reactivate_fd(thread_fd, UBD_IRQ);
@@ -1081,11 +1079,12 @@ static void do_ubd_request(request_queue_t *q)
                 }
         }
         else {
-                if(do_ubd || (req = elv_next_request(q)) == NULL)
+                struct ubd *dev = q->queuedata;
+                if(dev->active || (req = elv_next_request(q)) == NULL)
                         return;
                 err = prepare_request(req, &io_req);
                 if(!err){
-                        do_ubd = 1;
+                        dev->active = 1;
                         n = os_write_file(thread_fd, (char *) &io_req,
                                          sizeof(io_req));
                         if(n != sizeof(io_req))
diff --git a/arch/um/include/mconsole.h b/arch/um/include/mconsole.h
index 2666815b6af5..b282839c1625 100644
--- a/arch/um/include/mconsole.h
+++ b/arch/um/include/mconsole.h
@@ -12,6 +12,8 @@
 #define u32 uint32_t
 #endif
 
+#include "sysdep/ptrace.h"
+
 #define MCONSOLE_MAGIC (0xcafebabe)
 #define MCONSOLE_MAX_DATA (512)
 #define MCONSOLE_VERSION 2
diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c
index e85d65deea0d..df7d662b98ce 100644
--- a/arch/um/kernel/mem.c
+++ b/arch/um/kernel/mem.c
@@ -64,8 +64,6 @@ static void setup_highmem(unsigned long highmem_start,
 
 void mem_init(void)
 {
-        max_low_pfn = (high_physmem - uml_physmem) >> PAGE_SHIFT;
-
         /* clear the zero-page */
         memset((void *) empty_zero_page, 0, PAGE_SIZE);
 
@@ -80,6 +78,7 @@ void mem_init(void)
 
         /* this will put all low memory onto the freelists */
         totalram_pages = free_all_bootmem();
+        max_low_pfn = totalram_pages;
 #ifdef CONFIG_HIGHMEM
         totalhigh_pages = highmem >> PAGE_SHIFT;
         totalram_pages += totalhigh_pages;
diff --git a/arch/um/sys-i386/ldt.c b/arch/um/sys-i386/ldt.c
index 4a8b4202ef9e..a939a7ef0227 100644
--- a/arch/um/sys-i386/ldt.c
+++ b/arch/um/sys-i386/ldt.c
@@ -394,7 +394,8 @@ static short * host_ldt_entries = NULL;
 static void ldt_get_host_info(void)
 {
         long ret;
-        struct ldt_entry * ldt, *tmp;
+        struct ldt_entry * ldt;
+        short *tmp;
         int i, size, k, order;
 
         spin_lock(&host_ldt_lock);
diff --git a/arch/x86_64/kernel/i8259.c b/arch/x86_64/kernel/i8259.c
index 21d95b747437..489426682772 100644
--- a/arch/x86_64/kernel/i8259.c
+++ b/arch/x86_64/kernel/i8259.c
@@ -45,7 +45,7 @@
 
 /*
  * ISA PIC or low IO-APIC triggered (INTA-cycle or APIC) interrupts:
- * (these are usually mapped to vectors 0x20-0x2f)
+ * (these are usually mapped to vectors 0x30-0x3f)
  */
 
 /*
@@ -299,7 +299,7 @@ void init_8259A(int auto_eoi)
          * outb_p - this has to work on a wide range of PC hardware.
          */
         outb_p(0x11, 0x20);     /* ICW1: select 8259A-1 init */
-        outb_p(IRQ0_VECTOR, 0x21);      /* ICW2: 8259A-1 IR0-7 mapped to 0x20-0x27 */
+        outb_p(IRQ0_VECTOR, 0x21);      /* ICW2: 8259A-1 IR0-7 mapped to 0x30-0x37 */
         outb_p(0x04, 0x21);     /* 8259A-1 (the master) has a slave on IR2 */
         if (auto_eoi)
                 outb_p(0x03, 0x21);     /* master does Auto EOI */
@@ -307,7 +307,7 @@ void init_8259A(int auto_eoi)
                 outb_p(0x01, 0x21);     /* master expects normal EOI */
 
         outb_p(0x11, 0xA0);     /* ICW1: select 8259A-2 init */
-        outb_p(IRQ8_VECTOR, 0xA1);      /* ICW2: 8259A-2 IR0-7 mapped to 0x28-0x2f */
+        outb_p(IRQ8_VECTOR, 0xA1);      /* ICW2: 8259A-2 IR0-7 mapped to 0x38-0x3f */
         outb_p(0x02, 0xA1);     /* 8259A-2 is a slave on master's IR2 */
         outb_p(0x01, 0xA1);     /* (slave's support for AEOI in flat mode
                                     is to be investigated) */
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 3429ece4ef92..d0c978fbc204 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -386,6 +386,39 @@ config AU1000_SERIAL_CONSOLE
           If you have an Alchemy AU1000 processor (MIPS based) and you want
           to use a console on a serial port, say Y.  Otherwise, say N.
 
+config SERIAL_DEC
+        bool "DECstation serial support"
+        depends on MACH_DECSTATION
+        default y
+        help
+          This selects whether you want to be asked about drivers for
+          DECstation serial ports.
+
+          Note that the answer to this question won't directly affect the
+          kernel: saying N will just cause the configurator to skip all
+          the questions about DECstation serial ports.
+
+config SERIAL_DEC_CONSOLE
+        bool "Support for console on a DECstation serial port"
+        depends on SERIAL_DEC
+        default y
+        help
+          If you say Y here, it will be possible to use a serial port as the
+          system console (the system console is the device which receives all
+          kernel messages and warnings and which allows logins in single user
+          mode).  Note that the firmware uses ttyS0 as the serial console on
+          the Maxine and ttyS2 on the others.
+
+          If unsure, say Y.
+
+config ZS
+        bool "Z85C30 Serial Support"
+        depends on SERIAL_DEC
+        default y
+        help
+          Documentation on the Zilog 85C350 serial communications controller
+          is downloadable at <http://www.zilog.com/pdfs/serial/z85c30.pdf>
+
 config A2232
         tristate "Commodore A2232 serial support (EXPERIMENTAL)"
         depends on EXPERIMENTAL && ZORRO && BROKEN_ON_SMP
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 63e51dd6debe..00e31609a238 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -54,7 +54,7 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define USB_SX353_PRODUCT_ID    0x0022
 
 /* table of devices that work with this driver */
-static struct usb_device_id gigaset_table [] = {
+static const struct usb_device_id gigaset_table [] = {
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3070_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3075_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX303_PRODUCT_ID) },
@@ -2305,7 +2305,7 @@ static void gigaset_disconnect(struct usb_interface *interface)
         gigaset_unassign(cs);
 }
 
-static struct gigaset_ops gigops = {
+static const struct gigaset_ops gigops = {
         gigaset_write_cmd,
         gigaset_write_room,
         gigaset_chars_in_buffer,
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index b460a73a7c85..6df336bdd571 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -944,8 +944,8 @@ static DEFINE_SPINLOCK(driver_lock);
 struct cardstate *gigaset_get_cs_by_id(int id)
 {
         unsigned long flags;
-        static struct cardstate *ret = NULL;
-        static struct cardstate *cs;
+        struct cardstate *ret = NULL;
+        struct cardstate *cs;
         struct gigaset_driver *drv;
         unsigned i;
 
@@ -999,7 +999,7 @@ void gigaset_debugdrivers(void)
 static struct cardstate *gigaset_get_cs_by_minor(unsigned minor)
 {
         unsigned long flags;
-        static struct cardstate *ret = NULL;
+        struct cardstate *ret = NULL;
         struct gigaset_driver *drv;
         unsigned index;
 
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 4661e2c722bc..cec1ef342fcc 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -409,7 +409,7 @@ static struct reply_t tab_cid[] = /* no dle mode */ //FIXME
 };
 #endif
 
-static struct resp_type_t resp_type[]=
+static const struct resp_type_t resp_type[] =
 {
         /*{"",          RSP_EMPTY,      RT_NOTHING},*/
         {"OK",          RSP_OK,         RT_NOTHING},
@@ -511,7 +511,7 @@ void gigaset_handle_modem_response(struct cardstate *cs)
         unsigned char *argv[MAX_REC_PARAMS + 1];
         int params;
         int i, j;
-        struct resp_type_t *rt;
+        const struct resp_type_t *rt;
         int curarg;
         unsigned long flags;
         unsigned next, tail, head;
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 8c0eb522dab1..e0505f238807 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -274,7 +274,7 @@ static inline void dump_bytes(enum debuglevel level, const char *tag,
  *        bit 12..10 = number of trailing '1' bits in result
  *        bit 14..13 = number of bits added by stuffing
  */
-static u16 stufftab[5 * 256] = {
+static const u16 stufftab[5 * 256] = {
 // previous 1s = 0:
  0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, 0x0008, 0x0009, 0x000a, 0x000b, 0x000c, 0x000d, 0x000e, 0x000f,
  0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017, 0x0018, 0x0019, 0x001a, 0x001b, 0x001c, 0x001d, 0x001e, 0x201f,
@@ -629,7 +629,7 @@ static inline void hdlc_frag(struct bc_state *bcs, unsigned inbits)
  *                   (replacing 8 by 7 to make it fit; the algorithm won't care)
  *        bit 7 set if there are 5 or more "interior" consecutive '1' bits
  */
-static unsigned char bitcounts[256] = {
+static const unsigned char bitcounts[256] = {
   0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x03, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x04,
   0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x03, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x05,
   0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x03, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x04,
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index c8b7db65e48f..ea44302e6e7e 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -459,7 +459,7 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
         return -EINVAL;
 }
 
-static struct gigaset_ops ops = {
+static const struct gigaset_ops ops = {
         gigaset_write_cmd,
         gigaset_write_room,
         gigaset_chars_in_buffer,
diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
index 04f2ad7ba8b0..2baef349c12d 100644
--- a/drivers/isdn/gigaset/usb-gigaset.c
+++ b/drivers/isdn/gigaset/usb-gigaset.c
@@ -50,7 +50,7 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define USB_M105_PRODUCT_ID     0x0009
 
 /* table of devices that work with this driver */
-static struct usb_device_id gigaset_table [] = {
+static const struct usb_device_id gigaset_table [] = {
         { USB_DEVICE(USB_M105_VENDOR_ID, USB_M105_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
@@ -860,7 +860,7 @@ static void gigaset_disconnect(struct usb_interface *interface)
         gigaset_unassign(cs);
 }
 
-static struct gigaset_ops ops = {
+static const struct gigaset_ops ops = {
         gigaset_write_cmd,
         gigaset_write_room,
         gigaset_chars_in_buffer,
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 9baf69773ed1..fd301a910122 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -20,7 +20,6 @@
 #include "hostfs.h"
 #include "kern_util.h"
 #include "kern.h"
-#include "user_util.h"
 #include "init.h"
 
 struct hostfs_inode_info {
@@ -939,7 +938,7 @@ static const struct address_space_operations hostfs_link_aops = {
 static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
 {
         struct inode *root_inode;
-        char *name, *data = d;
+        char *host_root_path, *req_root = d;
         int err;
 
         sb->s_blocksize = 1024;
@@ -948,16 +947,16 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
         sb->s_op = &hostfs_sbops;
 
         /* NULL is printed as <NULL> by sprintf: avoid that. */
-        if (data == NULL)
-                data = "";
+        if (req_root == NULL)
+                req_root = "";
 
         err = -ENOMEM;
-        name = kmalloc(strlen(root_ino) + 1
-                        + strlen(data) + 1, GFP_KERNEL);
-        if(name == NULL)
+        host_root_path = kmalloc(strlen(root_ino) + 1
+                                 + strlen(req_root) + 1, GFP_KERNEL);
+        if(host_root_path == NULL)
                 goto out;
 
-        sprintf(name, "%s/%s", root_ino, data);
+        sprintf(host_root_path, "%s/%s", root_ino, req_root);
 
         root_inode = iget(sb, 0);
         if(root_inode == NULL)
@@ -967,10 +966,10 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
         if(err)
                 goto out_put;
 
-        HOSTFS_I(root_inode)->host_filename = name;
-        /* Avoid that in the error path, iput(root_inode) frees again name through
-         * hostfs_destroy_inode! */
-        name = NULL;
+        HOSTFS_I(root_inode)->host_filename = host_root_path;
+        /* Avoid that in the error path, iput(root_inode) frees again
+         * host_root_path through hostfs_destroy_inode! */
+        host_root_path = NULL;
 
         err = -ENOMEM;
         sb->s_root = d_alloc_root(root_inode);
@@ -990,7 +989,7 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
  out_put:
         iput(root_inode);
  out_free:
-        kfree(name);
+        kfree(host_root_path);
  out:
         return(err);
 }
diff --git a/fs/splice.c b/fs/splice.c
index 07f6556add0a..5428b0ff3b6f 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -627,18 +627,25 @@ find_page:
         }
 
         ret = mapping->a_ops->commit_write(file, page, offset, offset+this_len);
-        if (!ret) {
+        if (ret) {
+                if (ret == AOP_TRUNCATED_PAGE) {
+                        page_cache_release(page);
+                        goto find_page;
+                }
+                if (ret < 0)
+                        goto out;
                 /*
-                 * Return the number of bytes written and mark page as
-                 * accessed, we are now done!
+                 * Partial write has happened, so 'ret' already initialized by
+                 * number of bytes written, Where is nothing we have to do here.
                  */
+        } else
                 ret = this_len;
-                mark_page_accessed(page);
-                balance_dirty_pages_ratelimited(mapping);
-        } else if (ret == AOP_TRUNCATED_PAGE) {
-                page_cache_release(page);
-                goto find_page;
-        }
+        /*
+         * Return the number of bytes written and mark page as
+         * accessed, we are now done!
+         */
+        mark_page_accessed(page);
+        balance_dirty_pages_ratelimited(mapping);
 out:
         page_cache_release(page);
         unlock_page(page);
diff --git a/include/asm-powerpc/immap_qe.h b/include/asm-powerpc/immap_qe.h
index 9fdd0491f6a3..1020b7fc0129 100644
--- a/include/asm-powerpc/immap_qe.h
+++ b/include/asm-powerpc/immap_qe.h
@@ -258,8 +258,9 @@ struct ucc_slow {
         u8      uccs;           /* UCCx status register */
         u8      res3[0x24];
         __be16  utpt;
+        u8      res4[0x52];
         u8      guemr;          /* UCC general extended mode register */
-        u8      res4[0x200 - 0x091];
+        u8      res5[0x200 - 0x091];
 } __attribute__ ((packed));
 
 /* QE UCC Fast */
diff --git a/include/asm-um/pgtable-2level.h b/include/asm-um/pgtable-2level.h
index 6050e0eb257e..172a75fde512 100644
--- a/include/asm-um/pgtable-2level.h
+++ b/include/asm-um/pgtable-2level.h
@@ -45,12 +45,12 @@ static inline void pgd_mkuptodate(pgd_t pgd)	{ }
         ((unsigned long) __va(pmd_val(pmd) & PAGE_MASK))
 
 /*
- * Bits 0 through 3 are taken
+ * Bits 0 through 4 are taken
  */
-#define PTE_FILE_MAX_BITS       28
+#define PTE_FILE_MAX_BITS       27
 
-#define pte_to_pgoff(pte) (pte_val(pte) >> 4)
+#define pte_to_pgoff(pte) (pte_val(pte) >> 5)
 
-#define pgoff_to_pte(off) ((pte_t) { ((off) << 4) + _PAGE_FILE })
+#define pgoff_to_pte(off) ((pte_t) { ((off) << 5) + _PAGE_FILE })
 
 #endif
diff --git a/include/asm-x86_64/hw_irq.h b/include/asm-x86_64/hw_irq.h
index 2e4b7a5ed1c4..6153ae5df2e8 100644
--- a/include/asm-x86_64/hw_irq.h
+++ b/include/asm-x86_64/hw_irq.h
@@ -38,7 +38,7 @@
 #define IRQ_MOVE_CLEANUP_VECTOR FIRST_EXTERNAL_VECTOR
  
 /*
- * Vectors 0x20-0x2f are used for ISA interrupts.
+ * Vectors 0x30-0x3f are used for ISA interrupts.
  */
 #define IRQ0_VECTOR             FIRST_EXTERNAL_VECTOR + 0x10
 #define IRQ1_VECTOR             IRQ0_VECTOR + 1
diff --git a/kernel/exit.c b/kernel/exit.c
index f132349c0325..b55ed4cc9104 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -790,7 +790,7 @@ static void exit_notify(struct task_struct *tsk)
         
         pgrp = task_pgrp(tsk);
         if ((task_pgrp(t) != pgrp) &&
-            (task_session(t) != task_session(tsk)) &&
+            (task_session(t) == task_session(tsk)) &&
             will_become_orphaned_pgrp(pgrp, tsk) &&
             has_stopped_jobs(pgrp)) {
                 __kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp);
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index 9dd9fbb75139..cbb335813ec0 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -17,6 +17,29 @@
 #include "filemap.h"
 
 /*
+ * We do use our own empty page to avoid interference with other users
+ * of ZERO_PAGE(), such as /dev/zero
+ */
+static struct page *__xip_sparse_page;
+
+static struct page *xip_sparse_page(void)
+{
+        if (!__xip_sparse_page) {
+                unsigned long zeroes = get_zeroed_page(GFP_HIGHUSER);
+                if (zeroes) {
+                        static DEFINE_SPINLOCK(xip_alloc_lock);
+                        spin_lock(&xip_alloc_lock);
+                        if (!__xip_sparse_page)
+                                __xip_sparse_page = virt_to_page(zeroes);
+                        else
+                                free_page(zeroes);
+                        spin_unlock(&xip_alloc_lock);
+                }
+        }
+        return __xip_sparse_page;
+}
+
+/*
  * This is a file read routine for execute in place files, and uses
  * the mapping->a_ops->get_xip_page() function for the actual low-level
  * stuff.
@@ -162,7 +185,7 @@ EXPORT_SYMBOL_GPL(xip_file_sendfile);
  * xip_write
  *
  * This function walks all vmas of the address_space and unmaps the
- * ZERO_PAGE when found at pgoff. Should it go in rmap.c?
+ * __xip_sparse_page when found at pgoff.
  */
 static void
 __xip_unmap (struct address_space * mapping,
@@ -177,13 +200,16 @@ __xip_unmap (struct address_space * mapping,
         spinlock_t *ptl;
         struct page *page;
 
+        page = __xip_sparse_page;
+        if (!page)
+                return;
+
         spin_lock(&mapping->i_mmap_lock);
         vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
                 mm = vma->vm_mm;
                 address = vma->vm_start +
                         ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
                 BUG_ON(address < vma->vm_start || address >= vma->vm_end);
-                page = ZERO_PAGE(0);
                 pte = page_check_address(page, mm, address, &ptl);
                 if (pte) {
                         /* Nuke the page table entry. */
@@ -222,16 +248,14 @@ xip_file_nopage(struct vm_area_struct * area,
                 + area->vm_pgoff;
 
         size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-        if (pgoff >= size) {
-                return NULL;
-        }
+        if (pgoff >= size)
+                return NOPAGE_SIGBUS;
 
         page = mapping->a_ops->get_xip_page(mapping, pgoff*(PAGE_SIZE/512), 0);
-        if (!IS_ERR(page)) {
+        if (!IS_ERR(page))
                 goto out;
-        }
         if (PTR_ERR(page) != -ENODATA)
-                return NULL;
+                return NOPAGE_SIGBUS;
 
         /* sparse block */
         if ((area->vm_flags & (VM_WRITE | VM_MAYWRITE)) &&
@@ -241,12 +265,14 @@ xip_file_nopage(struct vm_area_struct * area,
                 page = mapping->a_ops->get_xip_page (mapping,
                         pgoff*(PAGE_SIZE/512), 1);
                 if (IS_ERR(page))
-                        return NULL;
+                        return NOPAGE_SIGBUS;
                 /* unmap page at pgoff from all other vmas */
                 __xip_unmap(mapping, pgoff);
         } else {
-                /* not shared and writable, use ZERO_PAGE() */
-                page = ZERO_PAGE(0);
+                /* not shared and writable, use xip_sparse_page() */
+                page = xip_sparse_page();
+                if (!page)
+                        return NOPAGE_OOM;
         }
 
 out:
diff --git a/mm/madvise.c b/mm/madvise.c
index 77916e9fc52b..603c5257ed6e 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -159,9 +159,10 @@ static long madvise_remove(struct vm_area_struct *vma,
                                 unsigned long start, unsigned long end)
 {
         struct address_space *mapping;
-        loff_t offset, endoff;
+        loff_t offset, endoff;
+        int error;
 
-        *prev = vma;
+        *prev = NULL;   /* tell sys_madvise we drop mmap_sem */
 
         if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
                 return -EINVAL;
@@ -180,7 +181,12 @@ static long madvise_remove(struct vm_area_struct *vma,
                         + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
         endoff = (loff_t)(end - vma->vm_start - 1)
                         + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-        return  vmtruncate_range(mapping->host, offset, endoff);
+
+        /* vmtruncate_range needs to take i_mutex and i_alloc_sem */
+        up_write(&current->mm->mmap_sem);
+        error = vmtruncate_range(mapping->host, offset, endoff);
+        down_write(&current->mm->mmap_sem);
+        return error;
 }
 
 static long
@@ -315,12 +321,15 @@ asmlinkage long sys_madvise(unsigned long start, size_t len_in, int behavior)
                 if (error)
                         goto out;
                 start = tmp;
-                if (start < prev->vm_end)
+                if (prev && start < prev->vm_end)
                         start = prev->vm_end;
                 error = unmapped_error;
                 if (start >= end)
                         goto out;
-                vma = prev->vm_next;
+                if (prev)
+                        vma = prev->vm_next;
+                else    /* madvise_remove dropped mmap_sem */
+                        vma = find_vma(current->mm, start);
         }
 out:
         up_write(&current->mm->mmap_sem);
diff --git a/mm/shmem.c b/mm/shmem.c
index b8c429a2d271..b2a35ebf071a 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -402,26 +402,38 @@ static swp_entry_t *shmem_swp_alloc(struct shmem_inode_info *info, unsigned long
 /*
  * shmem_free_swp - free some swap entries in a directory
  *
- * @dir:   pointer to the directory
- * @edir:  pointer after last entry of the directory
+ * @dir:        pointer to the directory
+ * @edir:       pointer after last entry of the directory
+ * @punch_lock: pointer to spinlock when needed for the holepunch case
  */
-static int shmem_free_swp(swp_entry_t *dir, swp_entry_t *edir)
+static int shmem_free_swp(swp_entry_t *dir, swp_entry_t *edir,
+                                                spinlock_t *punch_lock)
 {
+        spinlock_t *punch_unlock = NULL;
         swp_entry_t *ptr;
         int freed = 0;
 
         for (ptr = dir; ptr < edir; ptr++) {
                 if (ptr->val) {
+                        if (unlikely(punch_lock)) {
+                                punch_unlock = punch_lock;
+                                punch_lock = NULL;
+                                spin_lock(punch_unlock);
+                                if (!ptr->val)
+                                        continue;
+                        }
                         free_swap_and_cache(*ptr);
                         *ptr = (swp_entry_t){0};
                         freed++;
                 }
         }
+        if (punch_unlock)
+                spin_unlock(punch_unlock);
         return freed;
 }
 
-static int shmem_map_and_free_swp(struct page *subdir,
-                int offset, int limit, struct page ***dir)
+static int shmem_map_and_free_swp(struct page *subdir, int offset,
+                int limit, struct page ***dir, spinlock_t *punch_lock)
 {
         swp_entry_t *ptr;
         int freed = 0;
@@ -431,7 +443,8 @@ static int shmem_map_and_free_swp(struct page *subdir,
                 int size = limit - offset;
                 if (size > LATENCY_LIMIT)
                         size = LATENCY_LIMIT;
-                freed += shmem_free_swp(ptr+offset, ptr+offset+size);
+                freed += shmem_free_swp(ptr+offset, ptr+offset+size,
+                                                        punch_lock);
                 if (need_resched()) {
                         shmem_swp_unmap(ptr);
                         if (*dir) {
@@ -481,7 +494,10 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
         long nr_swaps_freed = 0;
         int offset;
         int freed;
-        int punch_hole = 0;
+        int punch_hole;
+        spinlock_t *needs_lock;
+        spinlock_t *punch_lock;
+        unsigned long upper_limit;
 
         inode->i_ctime = inode->i_mtime = CURRENT_TIME;
         idx = (start + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
@@ -492,11 +508,20 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
         info->flags |= SHMEM_TRUNCATE;
         if (likely(end == (loff_t) -1)) {
                 limit = info->next_index;
+                upper_limit = SHMEM_MAX_INDEX;
                 info->next_index = idx;
+                needs_lock = NULL;
+                punch_hole = 0;
         } else {
-                limit = (end + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-                if (limit > info->next_index)
-                        limit = info->next_index;
+                if (end + 1 >= inode->i_size) { /* we may free a little more */
+                        limit = (inode->i_size + PAGE_CACHE_SIZE - 1) >>
+                                                        PAGE_CACHE_SHIFT;
+                        upper_limit = SHMEM_MAX_INDEX;
+                } else {
+                        limit = (end + 1) >> PAGE_CACHE_SHIFT;
+                        upper_limit = limit;
+                }
+                needs_lock = &info->lock;
                 punch_hole = 1;
         }
 
@@ -513,17 +538,30 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
                 size = limit;
                 if (size > SHMEM_NR_DIRECT)
                         size = SHMEM_NR_DIRECT;
-                nr_swaps_freed = shmem_free_swp(ptr+idx, ptr+size);
+                nr_swaps_freed = shmem_free_swp(ptr+idx, ptr+size, needs_lock);
         }
 
         /*
          * If there are no indirect blocks or we are punching a hole
          * below indirect blocks, nothing to be done.
          */
-        if (!topdir || (punch_hole && (limit <= SHMEM_NR_DIRECT)))
+        if (!topdir || limit <= SHMEM_NR_DIRECT)
                 goto done2;
 
-        BUG_ON(limit <= SHMEM_NR_DIRECT);
+        /*
+         * The truncation case has already dropped info->lock, and we're safe
+         * because i_size and next_index have already been lowered, preventing
+         * access beyond.  But in the punch_hole case, we still need to take
+         * the lock when updating the swap directory, because there might be
+         * racing accesses by shmem_getpage(SGP_CACHE), shmem_unuse_inode or
+         * shmem_writepage.  However, whenever we find we can remove a whole
+         * directory page (not at the misaligned start or end of the range),
+         * we first NULLify its pointer in the level above, and then have no
+         * need to take the lock when updating its contents: needs_lock and
+         * punch_lock (either pointing to info->lock or NULL) manage this.
+         */
+
+        upper_limit -= SHMEM_NR_DIRECT;
         limit -= SHMEM_NR_DIRECT;
         idx = (idx > SHMEM_NR_DIRECT)? (idx - SHMEM_NR_DIRECT): 0;
         offset = idx % ENTRIES_PER_PAGE;
@@ -543,8 +581,14 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
                 if (*dir) {
                         diroff = ((idx - ENTRIES_PER_PAGEPAGE/2) %
                                 ENTRIES_PER_PAGEPAGE) / ENTRIES_PER_PAGE;
-                        if (!diroff && !offset) {
-                                *dir = NULL;
+                        if (!diroff && !offset && upper_limit >= stage) {
+                                if (needs_lock) {
+                                        spin_lock(needs_lock);
+                                        *dir = NULL;
+                                        spin_unlock(needs_lock);
+                                        needs_lock = NULL;
+                                } else
+                                        *dir = NULL;
                                 nr_pages_to_free++;
                                 list_add(&middir->lru, &pages_to_free);
                         }
@@ -570,39 +614,55 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
                         }
                         stage = idx + ENTRIES_PER_PAGEPAGE;
                         middir = *dir;
-                        *dir = NULL;
-                        nr_pages_to_free++;
-                        list_add(&middir->lru, &pages_to_free);
+                        if (punch_hole)
+                                needs_lock = &info->lock;
+                        if (upper_limit >= stage) {
+                                if (needs_lock) {
+                                        spin_lock(needs_lock);
+                                        *dir = NULL;
+                                        spin_unlock(needs_lock);
+                                        needs_lock = NULL;
+                                } else
+                                        *dir = NULL;
+                                nr_pages_to_free++;
+                                list_add(&middir->lru, &pages_to_free);
+                        }
                         shmem_dir_unmap(dir);
                         cond_resched();
                         dir = shmem_dir_map(middir);
                         diroff = 0;
                 }
+                punch_lock = needs_lock;
                 subdir = dir[diroff];
-                if (subdir && page_private(subdir)) {
+                if (subdir && !offset && upper_limit-idx >= ENTRIES_PER_PAGE) {
+                        if (needs_lock) {
+                                spin_lock(needs_lock);
+                                dir[diroff] = NULL;
+                                spin_unlock(needs_lock);
+                                punch_lock = NULL;
+                        } else
+                                dir[diroff] = NULL;
+                        nr_pages_to_free++;
+                        list_add(&subdir->lru, &pages_to_free);
+                }
+                if (subdir && page_private(subdir) /* has swap entries */) {
                         size = limit - idx;
                         if (size > ENTRIES_PER_PAGE)
                                 size = ENTRIES_PER_PAGE;
                         freed = shmem_map_and_free_swp(subdir,
-                                                offset, size, &dir);
+                                        offset, size, &dir, punch_lock);
                         if (!dir)
                                 dir = shmem_dir_map(middir);
                         nr_swaps_freed += freed;
-                        if (offset)
+                        if (offset || punch_lock) {
                                 spin_lock(&info->lock);
-                        set_page_private(subdir, page_private(subdir) - freed);
-                        if (offset)
+                                set_page_private(subdir,
+                                        page_private(subdir) - freed);
                                 spin_unlock(&info->lock);
-                        if (!punch_hole)
-                                BUG_ON(page_private(subdir) > offset);
-                }
-                if (offset)
-                        offset = 0;
-                else if (subdir && !page_private(subdir)) {
-                        dir[diroff] = NULL;
-                        nr_pages_to_free++;
-                        list_add(&subdir->lru, &pages_to_free);
+                        } else
+                                BUG_ON(page_private(subdir) != freed);
                 }
+                offset = 0;
         }
 done1:
         shmem_dir_unmap(dir);
@@ -614,8 +674,16 @@ done2:
                  * generic_delete_inode did it, before we lowered next_index.
                  * Also, though shmem_getpage checks i_size before adding to
                  * cache, no recheck after: so fix the narrow window there too.
+                 *
+                 * Recalling truncate_inode_pages_range and unmap_mapping_range
+                 * every time for punch_hole (which never got a chance to clear
+                 * SHMEM_PAGEIN at the start of vmtruncate_range) is expensive,
+                 * yet hardly ever necessary: try to optimize them out later.
                  */
                 truncate_inode_pages_range(inode->i_mapping, start, end);
+                if (punch_hole)
+                        unmap_mapping_range(inode->i_mapping, start,
+                                                        end - start, 1);
         }
 
         spin_lock(&info->lock);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index ecfe8da1ce6b..d342e89b8bdd 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -679,6 +679,27 @@ static void hidp_close(struct hid_device *hid)
 {
 }
 
+static const struct {
+        __u16 idVendor;
+        __u16 idProduct;
+        unsigned quirks;
+} hidp_blacklist[] = {
+        /* Apple wireless Mighty Mouse */
+        { 0x05ac, 0x030c, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
+
+        { }     /* Terminating entry */
+};
+
+static void hidp_setup_quirks(struct hid_device *hid)
+{
+        unsigned int n;
+
+        for (n = 0; hidp_blacklist[n].idVendor; n++)
+                if (hidp_blacklist[n].idVendor == le16_to_cpu(hid->vendor) &&
+                                hidp_blacklist[n].idProduct == le16_to_cpu(hid->product))
+                        hid->quirks = hidp_blacklist[n].quirks;
+}
+
 static inline void hidp_setup_hid(struct hidp_session *session, struct hidp_connadd_req *req)
 {
         struct hid_device *hid = session->hid;
@@ -708,6 +729,8 @@ static inline void hidp_setup_hid(struct hidp_session *session, struct hidp_conn
 
         hid->hidinput_input_event = hidp_hidinput_event;
 
+        hidp_setup_quirks(hid);
+
         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].report_list, list)
                 hidp_send_report(session, report);