188 files changed, 1394 insertions, 918 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index c3b1430cf603..0bc8b0b2e103 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -316,3 +316,11 @@ Why:	The option/code is
 Who:    Johannes Berg <johannes@sipsolutions.net>
 
 ---------------------------
+
+What:   i8xx_tco watchdog driver
+When:   in 2.6.22
+Why:    the i8xx_tco watchdog driver has been replaced by the iTCO_wdt
+        watchdog driver.
+Who:    Wim Van Sebroeck <wim@iguana.be>
+
+---------------------------
diff --git a/Documentation/gpio.txt b/Documentation/gpio.txt
index 576ce463cf44..989f1130f4f3 100644
--- a/Documentation/gpio.txt
+++ b/Documentation/gpio.txt
@@ -105,12 +105,15 @@ setting up a platform_device using the GPIO, is mark its direction:
 
         /* set as input or output, returning 0 or negative errno */
         int gpio_direction_input(unsigned gpio);
-        int gpio_direction_output(unsigned gpio);
+        int gpio_direction_output(unsigned gpio, int value);
 
 The return value is zero for success, else a negative errno.  It should
 be checked, since the get/set calls don't have error returns and since
 misconfiguration is possible.  (These calls could sleep.)
 
+For output GPIOs, the value provided becomes the initial output value.
+This helps avoid signal glitching during system startup.
+
 Setting the direction can fail if the GPIO number is invalid, or when
 that particular GPIO can't be used in that mode.  It's generally a bad
 idea to rely on boot firmware to have set the direction correctly, since
diff --git a/MAINTAINERS b/MAINTAINERS
index 17555bba20af..6d8d5b917d1f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3103,6 +3103,9 @@ TPM DEVICE DRIVER
 P:      Kylene Hall
 M:      kjhall@us.ibm.com
 W:      http://tpmdd.sourceforge.net
+P:      Marcel Selhorst
+M:      tpm@selhorst.net
+W:      http://www.prosec.rub.de/tpm/
 L:      tpmdd-devel@lists.sourceforge.net
 S:      Maintained
 
diff --git a/Makefile b/Makefile
index 6393738fe968..1c018c468e15 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 21
-EXTRAVERSION = -rc3
-NAME = Homicidal Dwarf Hamster
+EXTRAVERSION = -rc4
+NAME = Nocturnal Monster Puppy
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/mach-at91/gpio.c b/arch/arm/mach-at91/gpio.c
index 44211a0af19a..ba4a1bb3ee40 100644
--- a/arch/arm/mach-at91/gpio.c
+++ b/arch/arm/mach-at91/gpio.c
@@ -215,13 +215,14 @@ int gpio_direction_input(unsigned pin)
 }
 EXPORT_SYMBOL(gpio_direction_input);
 
-int gpio_direction_output(unsigned pin)
+int gpio_direction_output(unsigned pin, int value)
 {
         void __iomem    *pio = pin_to_controller(pin);
         unsigned        mask = pin_to_mask(pin);
 
         if (!pio || !(__raw_readl(pio + PIO_PSR) & mask))
                 return -EINVAL;
+        __raw_writel(mask, pio + (value ? PIO_SODR : PIO_CODR));
         __raw_writel(mask, pio + PIO_OER);
         return 0;
 }
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 192a5a26cf2b..edc349e5fcf7 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -153,7 +153,7 @@ int gpio_direction_input(unsigned gpio)
 
 EXPORT_SYMBOL(gpio_direction_input);
 
-int gpio_direction_output(unsigned gpio)
+int gpio_direction_output(unsigned gpio, int value)
 {
         unsigned long flags;
 
@@ -161,6 +161,7 @@ int gpio_direction_output(unsigned gpio)
                 return -EINVAL;
 
         local_irq_save(flags);
+        gpio_set_value(gpio, value);
         GPDR |= GPIO_GPIO(gpio);
         local_irq_restore(flags);
         return 0;
diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
index 9ba5654cde11..1eb99b814f5b 100644
--- a/arch/avr32/mach-at32ap/pio.c
+++ b/arch/avr32/mach-at32ap/pio.c
@@ -214,7 +214,7 @@ int gpio_direction_input(unsigned int gpio)
 }
 EXPORT_SYMBOL(gpio_direction_input);
 
-int gpio_direction_output(unsigned int gpio)
+int gpio_direction_output(unsigned int gpio, int value)
 {
         struct pio_device *pio;
         unsigned int pin;
@@ -223,6 +223,8 @@ int gpio_direction_output(unsigned int gpio)
         if (!pio)
                 return -ENODEV;
 
+        gpio_set_value(gpio, value);
+
         pin = gpio & 0x1f;
         pio_writel(pio, OER, 1 << pin);
 
diff --git a/arch/i386/defconfig b/arch/i386/defconfig
index 5ae1e0bc8fd7..f4efd66e1ee5 100644
--- a/arch/i386/defconfig
+++ b/arch/i386/defconfig
@@ -1,10 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.20-git8
-# Tue Feb 13 11:25:18 2007
+# Linux kernel version: 2.6.21-rc3
+# Wed Mar  7 15:29:47 2007
 #
 CONFIG_X86_32=y
 CONFIG_GENERIC_TIME=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_SEMAPHORE_SLEEPERS=y
@@ -34,6 +37,7 @@ CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_IPC_NS is not set
+CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
@@ -44,6 +48,7 @@ CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
@@ -103,6 +108,9 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 # Processor type and features
 #
+# CONFIG_TICK_ONESHOT is not set
+# CONFIG_NO_HZ is not set
+# CONFIG_HIGH_RES_TIMERS is not set
 CONFIG_SMP=y
 # CONFIG_X86_PC is not set
 # CONFIG_X86_ELAN is not set
@@ -235,10 +243,8 @@ CONFIG_ACPI_PROCFS=y
 CONFIG_ACPI_AC=y
 CONFIG_ACPI_BATTERY=y
 CONFIG_ACPI_BUTTON=y
-# CONFIG_ACPI_HOTKEY is not set
 CONFIG_ACPI_FAN=y
 # CONFIG_ACPI_DOCK is not set
-# CONFIG_ACPI_BAY is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_THERMAL=y
 # CONFIG_ACPI_ASUS is not set
@@ -289,6 +295,7 @@ CONFIG_X86_POWERNOW_K8_ACPI=y
 # CONFIG_X86_CPUFREQ_NFORCE2 is not set
 # CONFIG_X86_LONGRUN is not set
 # CONFIG_X86_LONGHAUL is not set
+# CONFIG_X86_E_POWERSAVER is not set
 
 #
 # shared options
@@ -368,7 +375,7 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
-# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_TUNNEL=y
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
 # CONFIG_INET_XFRM_MODE_BEET is not set
@@ -470,7 +477,13 @@ CONFIG_FW_LOADER=y
 #
 # Plug and Play support
 #
-# CONFIG_PNP is not set
+CONFIG_PNP=y
+# CONFIG_PNP_DEBUG is not set
+
+#
+# Protocols
+#
+CONFIG_PNPACPI=y
 
 #
 # Block devices
@@ -490,7 +503,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
-CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
@@ -500,6 +512,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_IBM_ASM is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
+# CONFIG_SONY_LAPTOP is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
@@ -526,6 +539,7 @@ CONFIG_BLK_DEV_IDEACPI=y
 #
 CONFIG_IDE_GENERIC=y
 # CONFIG_BLK_DEV_CMD640 is not set
+# CONFIG_BLK_DEV_IDEPNP is not set
 CONFIG_BLK_DEV_IDEPCI=y
 # CONFIG_IDEPCI_SHARE_IRQ is not set
 # CONFIG_BLK_DEV_OFFBOARD is not set
@@ -679,6 +693,7 @@ CONFIG_SATA_VIA=y
 # CONFIG_SATA_VITESSE is not set
 # CONFIG_SATA_INIC162X is not set
 CONFIG_SATA_INTEL_COMBINED=y
+CONFIG_SATA_ACPI=y
 # CONFIG_PATA_ALI is not set
 # CONFIG_PATA_AMD is not set
 # CONFIG_PATA_ARTOP is not set
@@ -786,6 +801,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
 # CONFIG_TUN is not set
+# CONFIG_NET_SB1000 is not set
 
 #
 # ARCnet devices
@@ -979,6 +995,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -1065,6 +1082,11 @@ CONFIG_HANGCHECK_TIMER=y
 # CONFIG_HWMON_VID is not set
 
 #
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
+
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -1078,7 +1100,7 @@ CONFIG_HANGCHECK_TIMER=y
 #
 # Graphics support
 #
-CONFIG_FIRMWARE_EDID=y
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 # CONFIG_FB is not set
 
 #
@@ -1089,7 +1111,6 @@ CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=128
 CONFIG_VIDEO_SELECT=y
 CONFIG_DUMMY_CONSOLE=y
-# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -1238,6 +1259,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
+# CONFIG_USB_BERRY_CHARGE is not set
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
@@ -1248,6 +1270,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1506,6 +1529,7 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
@@ -1525,6 +1549,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
+# CONFIG_FAULT_INJECTION is not set
 CONFIG_EARLY_PRINTK=y
 CONFIG_DEBUG_STACKOVERFLOW=y
 # CONFIG_DEBUG_STACK_USAGE is not set
diff --git a/arch/i386/kernel/i386_ksyms.c b/arch/i386/kernel/i386_ksyms.c
index e3d4b73bfdb0..4afe26e86260 100644
--- a/arch/i386/kernel/i386_ksyms.c
+++ b/arch/i386/kernel/i386_ksyms.c
@@ -28,3 +28,5 @@ EXPORT_SYMBOL(__read_lock_failed);
 #endif
 
 EXPORT_SYMBOL(csum_partial);
+
+EXPORT_SYMBOL(_proxy_pda);
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 821df34d2b3a..14702427b104 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -245,14 +245,6 @@ static int __init check_nmi_watchdog(void)
         unsigned int *prev_nmi_count;
         int cpu;
 
-        /* Enable NMI watchdog for newer systems.
-           Probably safe on most older systems too, but let's be careful.
-           IBM ThinkPads use INT10 inside SMM and that allows early NMI inside SMM
-           which hangs the system. Disable watchdog for all thinkpads */
-        if (nmi_watchdog == NMI_DEFAULT && dmi_get_year(DMI_BIOS_DATE) >= 2004 &&
-                !dmi_name_in_vendors("ThinkPad"))
-                nmi_watchdog = NMI_LOCAL_APIC;
-
         if ((nmi_watchdog == NMI_NONE) || (nmi_watchdog == NMI_DEFAULT))
                 return 0;
 
diff --git a/arch/i386/kernel/tsc.c b/arch/i386/kernel/tsc.c
index 602660df455c..0e65f7ab63a2 100644
--- a/arch/i386/kernel/tsc.c
+++ b/arch/i386/kernel/tsc.c
@@ -105,7 +105,7 @@ unsigned long long sched_clock(void)
         /*
          * Fall back to jiffies if there's no TSC available:
          */
-        if (unlikely(tsc_disable))
+        if (tsc_unstable || unlikely(tsc_disable))
                 /* No locking but a rare wrong value is not a big deal: */
                 return (jiffies_64 - INITIAL_JIFFIES) * (1000000000 / HZ);
 
diff --git a/arch/i386/kernel/vmi.c b/arch/i386/kernel/vmi.c
index fbf45fa08320..fb07a1aad225 100644
--- a/arch/i386/kernel/vmi.c
+++ b/arch/i386/kernel/vmi.c
@@ -23,7 +23,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/license.h>
 #include <linux/cpu.h>
 #include <linux/bootmem.h>
 #include <linux/mm.h>
@@ -48,7 +47,6 @@ typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
    (((VROMLONGFUNC *)(rom->func)) (arg))
 
 static struct vrom_header *vmi_rom;
-static int license_gplok;
 static int disable_pge;
 static int disable_pse;
 static int disable_sep;
@@ -629,13 +627,14 @@ static inline int __init check_vmi_rom(struct vrom_header *rom)
                 rom->api_version_maj, rom->api_version_min,
                 pci->rom_version_maj, pci->rom_version_min);
 
-        license_gplok = license_is_gpl_compatible(license);
-        if (!license_gplok) {
-                printk(KERN_WARNING "VMI: ROM license '%s' taints kernel... "
-                       "inlining disabled\n",
-                       license);
-                add_taint(TAINT_PROPRIETARY_MODULE);
-        }
+        /* Don't allow BSD/MIT here for now because we don't want to end up
+           with any binary only shim layers */
+        if (strcmp(license, "GPL") && strcmp(license, "GPL v2")) {
+                printk(KERN_WARNING "VMI: Non GPL license `%s' found for ROM. Not used.\n",
+                        license);
+                return 0;
+        }
+
         return 1;
 }
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 2b9c65c3b5d1..5f29018a6533 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -250,7 +250,7 @@ config LASAT
         select R5000_CPU_SCACHE
         select SYS_HAS_CPU_R5000
         select SYS_SUPPORTS_32BIT_KERNEL
-        select SYS_SUPPORTS_64BIT_KERNEL if EXPERIMENTAL
+        select SYS_SUPPORTS_64BIT_KERNEL if BROKEN
         select SYS_SUPPORTS_LITTLE_ENDIAN
         select GENERIC_HARDIRQS_NO__DO_IRQ
 
@@ -1559,6 +1559,7 @@ config MIPS_MT_SMP
         select CPU_MIPSR2_IRQ_VI
         select CPU_MIPSR2_SRS
         select MIPS_MT
+        select NR_CPUS_DEFAULT_2
         select SMP
         select SYS_SUPPORTS_SMP
         help
@@ -1573,7 +1574,6 @@ config MIPS_MT_SMTC
         select CPU_MIPSR2_IRQ_VI
         select CPU_MIPSR2_SRS
         select MIPS_MT
-        select NR_CPUS_DEFAULT_2
         select NR_CPUS_DEFAULT_8
         select SMP
         select SYS_SUPPORTS_SMP
diff --git a/arch/mips/kernel/kspd.c b/arch/mips/kernel/kspd.c
index 241ee7a2906e..29eadd404fa5 100644
--- a/arch/mips/kernel/kspd.c
+++ b/arch/mips/kernel/kspd.c
@@ -191,6 +191,8 @@ void sp_work_handle_request(void)
         struct mtsp_syscall_generic generic;
         struct mtsp_syscall_ret ret;
         struct kspd_notifications *n;
+        unsigned long written;
+        mm_segment_t old_fs;
         struct timeval tv;
         struct timezone tz;
         int cmd;
@@ -201,7 +203,11 @@ void sp_work_handle_request(void)
 
         ret.retval = -1;
 
-        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall), 0)) {
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+
+        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall))) {
+                set_fs(old_fs);
                 printk(KERN_ERR "Expected request but nothing to read\n");
                 return;
         }
@@ -209,7 +215,8 @@ void sp_work_handle_request(void)
         size = sc.size;
 
         if (size) {
-                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size, 0)) {
+                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size)) {
+                        set_fs(old_fs);
                         printk(KERN_ERR "Expected request but nothing to read\n");
                         return;
                 }
@@ -282,8 +289,11 @@ void sp_work_handle_request(void)
         if (vpe_getuid(SP_VPE))
                 sp_setfsuidgid( 0, 0);
 
-        if ((rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(struct mtsp_syscall_ret), 0))
-            < sizeof(struct mtsp_syscall_ret))
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+        written = rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(ret));
+        set_fs(old_fs);
+        if (written < sizeof(ret))
                 printk("KSPD: sp_work_handle_request failed to send to SP\n");
 }
 
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 1df544c1f966..37849edd0645 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -311,6 +311,8 @@ asmlinkage int sys32_sched_rr_get_interval(compat_pid_t pid,
         return ret;
 }
 
+#ifdef CONFIG_SYSVIPC
+
 asmlinkage long
 sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 {
@@ -368,6 +370,16 @@ sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
         return err;
 }
 
+#else
+
+asmlinkage long
+sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
+{
+        return -ENOSYS;
+}
+
+#endif /* CONFIG_SYSVIPC */
+
 #ifdef CONFIG_MIPS32_N32
 asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
 {
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 656bde2e11b1..28c2e2e6af73 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -49,8 +49,7 @@ LEAF(resume)
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t1, CP0_STATUS
-        sw      t1, THREAD_STATUS(a0)
+        mfc0    t2, CP0_STATUS
         cpu_save_nonscratch a0
         sw      ra, THREAD_REG31(a0)
 
@@ -60,8 +59,8 @@ LEAF(resume)
         lw      t3, TASK_THREAD_INFO(a0)
         lw      t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t2, t0, t1
-        beqz    t2, 1f
+        and     t1, t0
+        beqz    t1, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -74,10 +73,13 @@ LEAF(resume)
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         sw      t0, ST_OFF(t3)
+        /* clear thread_struct CU1 bit */
+        and     t2, t1
 
         fpu_save_single a0, t0                  # clobbers t0
 
 1:
+        sw      t2, THREAD_STATUS(a0)
         /*
          * The order of restoring the registers takes care of the race
          * updating $28, $29 and kernelsp without disabling ints.
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 59c1577ecbb3..dbd42adc52ed 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -114,14 +114,6 @@ LEAF(_save_fp_context32)
  */
 LEAF(_restore_fp_context)
         EX      lw t0, SC_FPC_CSR(a0)
-
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
-
 #ifdef CONFIG_64BIT
         EX      ldc1 $f1, SC_FPREGS+8(a0)
         EX      ldc1 $f3, SC_FPREGS+24(a0)
@@ -165,14 +157,6 @@ LEAF(_restore_fp_context)
 LEAF(_restore_fp_context32)
         /* Restore an o32 sigcontext.  */
         EX      lw t0, SC32_FPC_CSR(a0)
-
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
-
         EX      ldc1 $f0, SC32_FPREGS+0(a0)
         EX      ldc1 $f2, SC32_FPREGS+16(a0)
         EX      ldc1 $f4, SC32_FPREGS+32(a0)
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index cc566cf12246..c7698fd9955c 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -48,8 +48,7 @@
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t1, CP0_STATUS
-        LONG_S  t1, THREAD_STATUS(a0)
+        mfc0    t2, CP0_STATUS
         cpu_save_nonscratch a0
         LONG_S  ra, THREAD_REG31(a0)
 
@@ -59,8 +58,8 @@
         PTR_L   t3, TASK_THREAD_INFO(a0)
         LONG_L  t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t2, t0, t1
-        beqz    t2, 1f
+        and     t1, t0
+        beqz    t1, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -73,10 +72,13 @@
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         LONG_S  t0, ST_OFF(t3)
+        /* clear thread_struct CU1 bit */
+        and     t2, t1
 
         fpu_save_double a0 t0 t1                # c0_status passed in t0
                                                 # clobbers t1
 1:
+        LONG_S  t2, THREAD_STATUS(a0)
 
         /*
          * The order of restoring the registers takes care of the race
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
index e14ae09eda2b..e6e3047151a6 100644
--- a/arch/mips/kernel/rtlx.c
+++ b/arch/mips/kernel/rtlx.c
@@ -54,6 +54,7 @@ static struct chan_waitqueues {
         wait_queue_head_t rt_queue;
         wait_queue_head_t lx_queue;
         atomic_t in_open;
+        struct mutex mutex;
 } channel_wqs[RTLX_CHANNELS];
 
 static struct irqaction irq;
@@ -146,7 +147,7 @@ static void stopping(int vpe)
 
 int rtlx_open(int index, int can_sleep)
 {
-        volatile struct rtlx_info **p;
+        struct rtlx_info **p;
         struct rtlx_channel *chan;
         enum rtlx_state state;
         int ret = 0;
@@ -179,13 +180,24 @@ int rtlx_open(int index, int can_sleep)
                         }
                 }
 
+                smp_rmb();
                 if (*p == NULL) {
                         if (can_sleep) {
-                                __wait_event_interruptible(channel_wqs[index].lx_queue,
-                                                           *p != NULL,
-                                                           ret);
-                                if (ret)
+                                DEFINE_WAIT(wait);
+
+                                for (;;) {
+                                        prepare_to_wait(&channel_wqs[index].lx_queue, &wait, TASK_INTERRUPTIBLE);
+                                        smp_rmb();
+                                        if (*p != NULL)
+                                                break;
+                                        if (!signal_pending(current)) {
+                                                schedule();
+                                                continue;
+                                        }
+                                        ret = -ERESTARTSYS;
                                         goto out_fail;
+                                }
+                                finish_wait(&channel_wqs[index].lx_queue, &wait);
                         } else {
                                 printk(" *vpe_get_shared is NULL. "
                                        "Has an SP program been loaded?\n");
@@ -277,56 +289,52 @@ unsigned int rtlx_write_poll(int index)
         return write_spacefree(chan->rt_read, chan->rt_write, chan->buffer_size);
 }
 
-static inline void copy_to(void *dst, void *src, size_t count, int user)
-{
-        if (user)
-                copy_to_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-
-static inline void copy_from(void *dst, void *src, size_t count, int user)
+ssize_t rtlx_read(int index, void __user *buff, size_t count, int user)
 {
-        if (user)
-                copy_from_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-
-ssize_t rtlx_read(int index, void *buff, size_t count, int user)
-{
-        size_t fl = 0L;
+        size_t lx_write, fl = 0L;
         struct rtlx_channel *lx;
+        unsigned long failed;
 
         if (rtlx == NULL)
                 return -ENOSYS;
 
         lx = &rtlx->channel[index];
 
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        lx_write = lx->lx_write;
+
         /* find out how much in total */
         count = min(count,
-                     (size_t)(lx->lx_write + lx->buffer_size - lx->lx_read)
+                     (size_t)(lx_write + lx->buffer_size - lx->lx_read)
                      % lx->buffer_size);
 
         /* then how much from the read pointer onwards */
-        fl = min( count, (size_t)lx->buffer_size - lx->lx_read);
+        fl = min(count, (size_t)lx->buffer_size - lx->lx_read);
 
-        copy_to(buff, &lx->lx_buffer[lx->lx_read], fl, user);
+        failed = copy_to_user(buff, lx->lx_buffer + lx->lx_read, fl);
+        if (failed)
+                goto out;
 
         /* and if there is anything left at the beginning of the buffer */
-        if ( count - fl )
-                copy_to (buff + fl, lx->lx_buffer, count - fl, user);
+        if (count - fl)
+                failed = copy_to_user(buff + fl, lx->lx_buffer, count - fl);
 
-        /* update the index */
-        lx->lx_read += count;
-        lx->lx_read %= lx->buffer_size;
+out:
+        count -= failed;
+
+        smp_wmb();
+        lx->lx_read = (lx->lx_read + count) % lx->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
 
         return count;
 }
 
-ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
+ssize_t rtlx_write(int index, const void __user *buffer, size_t count, int user)
 {
         struct rtlx_channel *rt;
+        size_t rt_read;
         size_t fl;
 
         if (rtlx == NULL)
@@ -334,24 +342,35 @@ ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
 
         rt = &rtlx->channel[index];
 
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        rt_read = rt->rt_read;
+
         /* total number of bytes to copy */
         count = min(count,
-                    (size_t)write_spacefree(rt->rt_read, rt->rt_write,
-                                            rt->buffer_size));
+                    (size_t)write_spacefree(rt_read, rt->rt_write, rt->buffer_size));
 
         /* first bit from write pointer to the end of the buffer, or count */
         fl = min(count, (size_t) rt->buffer_size - rt->rt_write);
 
-        copy_from (&rt->rt_buffer[rt->rt_write], buffer, fl, user);
+        failed = copy_from_user(rt->rt_buffer + rt->rt_write, buffer, fl);
+        if (failed)
+                goto out;
 
         /* if there's any left copy to the beginning of the buffer */
-        if( count - fl )
-                copy_from (rt->rt_buffer, buffer + fl, count - fl, user);
+        if (count - fl) {
+                failed = copy_from_user(rt->rt_buffer, buffer + fl, count - fl);
+        }
+
+out:
+        count -= cailed;
 
-        rt->rt_write += count;
-        rt->rt_write %= rt->buffer_size;
+        smp_wmb();
+        rt->rt_write = (rt->rt_write + count) % rt->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
 
-        return(count);
+        return count;
 }
 
 
@@ -403,7 +422,7 @@ static ssize_t file_read(struct file *file, char __user * buffer, size_t count,
                 return 0;       // -EAGAIN makes cat whinge
         }
 
-        return rtlx_read(minor, buffer, count, 1);
+        return rtlx_read(minor, buffer, count);
 }
 
 static ssize_t file_write(struct file *file, const char __user * buffer,
@@ -429,7 +448,7 @@ static ssize_t file_write(struct file *file, const char __user * buffer,
                         return ret;
         }
 
-        return rtlx_write(minor, (void *)buffer, count, 1);
+        return rtlx_write(minor, buffer, count);
 }
 
 static const struct file_operations rtlx_fops = {
@@ -468,6 +487,7 @@ static int rtlx_module_init(void)
                 init_waitqueue_head(&channel_wqs[i].rt_queue);
                 init_waitqueue_head(&channel_wqs[i].lx_queue);
                 atomic_set(&channel_wqs[i].in_open, 0);
+                mutex_init(&channel_wqs[i].mutex);
 
                 dev = device_create(mt_class, NULL, MKDEV(major, i),
                                     "%s%d", module_name, i);
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index fdbdbdc65b54..297dfcb97524 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -31,4 +31,7 @@ extern void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
  */
 extern int install_sigtramp(unsigned int __user *tramp, unsigned int syscall);
 
+/* Check and clear pending FPU exceptions in saved CSR */
+extern int fpcsr_pending(unsigned int __user *fpcsr);
+
 #endif  /* __SIGNAL_COMMON_H */
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index f091786187a6..8c3c5a5789b0 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -82,6 +82,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         int err = 0;
         int i;
+        unsigned int used_math;
 
         err |= __put_user(regs->cp0_epc, &sc->sc_pc);
 
@@ -104,26 +105,53 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                 err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
         }
 
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
 
-        if (used_math()) {
+        if (used_math) {
                 /*
                  * Save FPU state to signal context. Signal handler
                  * will "inherit" current FPU state.
                  */
-                preempt_disable();
-
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
+                own_fpu(1);
+                enable_fp_in_kernel();
                 err |= save_fp_context(sc);
-
-                preempt_enable();
+                disable_fp_in_kernel();
         }
         return err;
 }
 
+int fpcsr_pending(unsigned int __user *fpcsr)
+{
+        int err, sig = 0;
+        unsigned int csr, enabled;
+
+        err = __get_user(csr, fpcsr);
+        enabled = FPU_CSR_UNI_X | ((csr & FPU_CSR_ALL_E) << 5);
+        /*
+         * If the signal handler set some FPU exceptions, clear it and
+         * send SIGFPE.
+         */
+        if (csr & enabled) {
+                csr &= ~enabled;
+                err |= __put_user(csr, fpcsr);
+                sig = SIGFPE;
+        }
+        return err ?: sig;
+}
+
+static int
+check_and_restore_fp_context(struct sigcontext __user *sc)
+{
+        int err, sig;
+
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= restore_fp_context(sc);
+        return err ?: sig;
+}
+
 int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         unsigned int used_math;
@@ -157,19 +185,18 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
         err |= __get_user(used_math, &sc->sc_used_math);
         conditional_used_math(used_math);
 
-        preempt_disable();
-
-        if (used_math()) {
+        if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu();
-                err |= restore_fp_context(sc);
+                own_fpu(0);
+                enable_fp_in_kernel();
+                if (!err)
+                        err = check_and_restore_fp_context(sc);
+                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
         }
 
-        preempt_enable();
-
         return err;
 }
 
@@ -332,6 +359,7 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct sigframe __user *frame;
         sigset_t blocked;
+        int sig;
 
         frame = (struct sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -345,8 +373,11 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->sf_sc))
+        sig = restore_sigcontext(&regs, &frame->sf_sc);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /*
          * Don't let your children do this ...
@@ -368,6 +399,7 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         struct rt_sigframe __user *frame;
         sigset_t set;
         stack_t st;
+        int sig;
 
         frame = (struct rt_sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -381,8 +413,11 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         if (__copy_from_user(&st, &frame->rs_uc.uc_stack, sizeof(st)))
                 goto badframe;
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 19bbef001959..151fd2f0893a 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -181,6 +181,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
 {
         int err = 0;
         int i;
+        u32 used_math;
 
         err |= __put_user(regs->cp0_epc, &sc->sc_pc);
 
@@ -200,26 +201,34 @@ static int setup_sigcontext32(struct pt_regs *regs,
                 err |= __put_user(mflo3(), &sc->sc_lo3);
         }
 
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
 
-        if (used_math()) {
+        if (used_math) {
                 /*
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                preempt_disable();
-
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
+                own_fpu(1);
+                enable_fp_in_kernel();
                 err |= save_fp_context32(sc);
-
-                preempt_enable();
+                disable_fp_in_kernel();
         }
         return err;
 }
 
+static int
+check_and_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, sig;
+
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= restore_fp_context32(sc);
+        return err ?: sig;
+}
+
 static int restore_sigcontext32(struct pt_regs *regs,
                                 struct sigcontext32 __user *sc)
 {
@@ -250,19 +259,18 @@ static int restore_sigcontext32(struct pt_regs *regs,
         err |= __get_user(used_math, &sc->sc_used_math);
         conditional_used_math(used_math);
 
-        preempt_disable();
-
-        if (used_math()) {
+        if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu();
-                err |= restore_fp_context32(sc);
+                own_fpu(0);
+                enable_fp_in_kernel();
+                if (!err)
+                        err = check_and_restore_fp_context32(sc);
+                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
         }
 
-        preempt_enable();
-
         return err;
 }
 
@@ -508,6 +516,7 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct sigframe32 __user *frame;
         sigset_t blocked;
+        int sig;
 
         frame = (struct sigframe32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -521,8 +530,11 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext32(&regs, &frame->sf_sc))
+        sig = restore_sigcontext32(&regs, &frame->sf_sc);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /*
          * Don't let your children do this ...
@@ -545,6 +557,7 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         sigset_t set;
         stack_t st;
         s32 sp;
+        int sig;
 
         frame = (struct rt_sigframe32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -558,8 +571,11 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index ecf1f7ecaad9..a9202fa95987 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -127,6 +127,7 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         sigset_t set;
         stack_t st;
         s32 sp;
+        int sig;
 
         frame = (struct rt_sigframe_n32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -140,8 +141,11 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 18f56a9dbcfa..7d76a85422b2 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -610,16 +610,6 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
         if (fcr31 & FPU_CSR_UNI_X) {
                 int sig;
 
-                preempt_disable();
-
-#ifdef CONFIG_PREEMPT
-                if (!is_fpu_owner()) {
-                        /* We might lose fpu before disabling preempt... */
-                        own_fpu();
-                        BUG_ON(!used_math());
-                        restore_fp(current);
-                }
-#endif
                 /*
                  * Unimplemented operation exception.  If we've got the full
                  * software emulator on-board, let's use it...
@@ -630,18 +620,12 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                  * register operands before invoking the emulator, which seems
                  * a bit extreme for what should be an infrequent event.
                  */
-                save_fp(current);
                 /* Ensure 'resume' not overwrite saved fp context again. */
-                lose_fpu();
-
-                preempt_enable();
+                lose_fpu(1);
 
                 /* Run the emulator */
                 sig = fpu_emulator_cop1Handler (regs, &current->thread.fpu, 1);
 
-                preempt_disable();
-
-                own_fpu();      /* Using the FPU again.  */
                 /*
                  * We can't allow the emulated instruction to leave any of
                  * the cause bit set in $fcr31.
@@ -649,9 +633,7 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                 current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
 
                 /* Restore the hardware register state */
-                restore_fp(current);
-
-                preempt_enable();
+                own_fpu(1);     /* Using the FPU again.  */
 
                 /* If something went wrong, signal */
                 if (sig)
@@ -775,12 +757,11 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 {
         unsigned int cpid;
 
-        die_if_kernel("do_cpu invoked from kernel context!", regs);
-
         cpid = (regs->cp0_cause >> CAUSEB_CE) & 3;
 
         switch (cpid) {
         case 0:
+                die_if_kernel("do_cpu invoked from kernel context!", regs);
                 if (!cpu_has_llsc)
                         if (!simulate_llsc(regs))
                                 return;
@@ -791,21 +772,30 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                 break;
 
         case 1:
-                preempt_disable();
-
-                own_fpu();
-                if (used_math()) {      /* Using the FPU again.  */
-                        restore_fp(current);
-                } else {                        /* First time FPU user.  */
+                if (!test_thread_flag(TIF_ALLOW_FP_IN_KERNEL))
+                        die_if_kernel("do_cpu invoked from kernel context!",
+                                      regs);
+                if (used_math())        /* Using the FPU again.  */
+                        own_fpu(1);
+                else {                  /* First time FPU user.  */
                         init_fpu();
                         set_used_math();
                 }
 
-                if (cpu_has_fpu) {
-                        preempt_enable();
+                if (raw_cpu_has_fpu) {
+                        if (test_thread_flag(TIF_ALLOW_FP_IN_KERNEL)) {
+                                local_irq_disable();
+                                if (cpu_has_fpu)
+                                        regs->cp0_status |= ST0_CU1;
+                                /*
+                                 * We must return without enabling
+                                 * interrupts to ensure keep FPU
+                                 * ownership until resume.
+                                 */
+                                return;
+                        }
                 } else {
                         int sig;
-                        preempt_enable();
                         sig = fpu_emulator_cop1Handler(regs,
                                                 &current->thread.fpu, 0);
                         if (sig)
@@ -1259,26 +1249,26 @@ static inline void mips_srs_init(void)
 /*
  * This is used by native signal handling
  */
-asmlinkage int (*save_fp_context)(struct sigcontext *sc);
-asmlinkage int (*restore_fp_context)(struct sigcontext *sc);
+asmlinkage int (*save_fp_context)(struct sigcontext __user *sc);
+asmlinkage int (*restore_fp_context)(struct sigcontext __user *sc);
 
-extern asmlinkage int _save_fp_context(struct sigcontext *sc);
-extern asmlinkage int _restore_fp_context(struct sigcontext *sc);
+extern asmlinkage int _save_fp_context(struct sigcontext __user *sc);
+extern asmlinkage int _restore_fp_context(struct sigcontext __user *sc);
 
-extern asmlinkage int fpu_emulator_save_context(struct sigcontext *sc);
-extern asmlinkage int fpu_emulator_restore_context(struct sigcontext *sc);
+extern asmlinkage int fpu_emulator_save_context(struct sigcontext __user *sc);
+extern asmlinkage int fpu_emulator_restore_context(struct sigcontext __user *sc);
 
 #ifdef CONFIG_SMP
-static int smp_save_fp_context(struct sigcontext *sc)
+static int smp_save_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
                ? _save_fp_context(sc)
                : fpu_emulator_save_context(sc);
 }
 
-static int smp_restore_fp_context(struct sigcontext *sc)
+static int smp_restore_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
                ? _restore_fp_context(sc)
                : fpu_emulator_restore_context(sc);
 }
@@ -1306,14 +1296,14 @@ static inline void signal_init(void)
 /*
  * This is used by 32-bit signal stuff on the 64-bit kernel
  */
-asmlinkage int (*save_fp_context32)(struct sigcontext32 *sc);
-asmlinkage int (*restore_fp_context32)(struct sigcontext32 *sc);
+asmlinkage int (*save_fp_context32)(struct sigcontext32 __user *sc);
+asmlinkage int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 
-extern asmlinkage int _save_fp_context32(struct sigcontext32 *sc);
-extern asmlinkage int _restore_fp_context32(struct sigcontext32 *sc);
+extern asmlinkage int _save_fp_context32(struct sigcontext32 __user *sc);
+extern asmlinkage int _restore_fp_context32(struct sigcontext32 __user *sc);
 
-extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 *sc);
-extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 *sc);
+extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 __user *sc);
+extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 __user *sc);
 
 static inline void signal32_init(void)
 {
diff --git a/arch/mips/math-emu/kernel_linkage.c b/arch/mips/math-emu/kernel_linkage.c
index 5b3390f64917..ed49ef01ac53 100644
--- a/arch/mips/math-emu/kernel_linkage.c
+++ b/arch/mips/math-emu/kernel_linkage.c
@@ -51,7 +51,7 @@ void fpu_emulator_init_fpu(void)
  * with appropriate macros from uaccess.h
  */
 
-int fpu_emulator_save_context(struct sigcontext *sc)
+int fpu_emulator_save_context(struct sigcontext __user *sc)
 {
         int i;
         int err = 0;
@@ -65,7 +65,7 @@ int fpu_emulator_save_context(struct sigcontext *sc)
         return err;
 }
 
-int fpu_emulator_restore_context(struct sigcontext *sc)
+int fpu_emulator_restore_context(struct sigcontext __user *sc)
 {
         int i;
         int err = 0;
@@ -84,7 +84,7 @@ int fpu_emulator_restore_context(struct sigcontext *sc)
  * This is the o32 version
  */
 
-int fpu_emulator_save_context32(struct sigcontext32 *sc)
+int fpu_emulator_save_context32(struct sigcontext32 __user *sc)
 {
         int i;
         int err = 0;
@@ -98,7 +98,7 @@ int fpu_emulator_save_context32(struct sigcontext32 *sc)
         return err;
 }
 
-int fpu_emulator_restore_context32(struct sigcontext32 *sc)
+int fpu_emulator_restore_context32(struct sigcontext32 __user *sc)
 {
         int i;
         int err = 0;
diff --git a/arch/powerpc/kernel/udbg_16550.c b/arch/powerpc/kernel/udbg_16550.c
index e738f93b42fe..a963f657222b 100644
--- a/arch/powerpc/kernel/udbg_16550.c
+++ b/arch/powerpc/kernel/udbg_16550.c
@@ -184,7 +184,7 @@ void udbg_pas_real_putc(char c)
 
 void udbg_init_pas_realmode(void)
 {
-        udbg_comport = (volatile struct NS16550 __iomem *)0xfcff03f8;
+        udbg_comport = (volatile struct NS16550 __iomem *)0xfcff03f8UL;
 
         udbg_putc = udbg_pas_real_putc;
         udbg_getc = NULL;
diff --git a/arch/powerpc/platforms/pasemi/iommu.c b/arch/powerpc/platforms/pasemi/iommu.c
index 459a53b7d24d..71dbf1a56e13 100644
--- a/arch/powerpc/platforms/pasemi/iommu.c
+++ b/arch/powerpc/platforms/pasemi/iommu.c
@@ -77,7 +77,7 @@
 #define IOBMAP_L2E_V            0x80000000
 #define IOBMAP_L2E_V_CACHED     0xc0000000
 
-static u32 *iob;
+static u32 __iomem *iob;
 static u32 iob_l1_emptyval;
 static u32 iob_l2_emptyval;
 static u32 *iob_l2_base;
diff --git a/arch/s390/appldata/appldata_mem.c b/arch/s390/appldata/appldata_mem.c
index 4ca615788702..697eb30a68a3 100644
--- a/arch/s390/appldata/appldata_mem.c
+++ b/arch/s390/appldata/appldata_mem.c
@@ -117,7 +117,10 @@ static void appldata_get_mem_data(void *data)
         mem_data->pgpgout    = ev[PGPGOUT] >> 1;
         mem_data->pswpin     = ev[PSWPIN];
         mem_data->pswpout    = ev[PSWPOUT];
-        mem_data->pgalloc    = ev[PGALLOC_NORMAL] + ev[PGALLOC_DMA];
+        mem_data->pgalloc    = ev[PGALLOC_NORMAL];
+#ifdef CONFIG_ZONE_DMA
+        mem_data->pgalloc    += ev[PGALLOC_DMA];
+#endif
         mem_data->pgfault    = ev[PGFAULT];
         mem_data->pgmajfault = ev[PGMAJFAULT];
 
diff --git a/arch/sparc/mm/init.c b/arch/sparc/mm/init.c
index c85ddf312747..a532922e2e35 100644
--- a/arch/sparc/mm/init.c
+++ b/arch/sparc/mm/init.c
@@ -75,7 +75,7 @@ void show_mem(void)
         printk("Free swap:       %6ldkB\n",
                nr_swap_pages << (PAGE_SHIFT-10));
         printk("%ld pages of RAM\n", totalram_pages);
-        printk("%d free pages\n", nr_free_pages());
+        printk("%ld free pages\n", nr_free_pages());
 #if 0 /* undefined pgtable_cache_size, pgd_cache_size */
         printk("%ld pages in page table cache\n",pgtable_cache_size);
 #ifndef CONFIG_SMP
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index f75a686ba644..1a6348b565fb 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -136,18 +136,6 @@ config SMP
 
           If you don't know what to do here, say N.
 
-config PREEMPT
-        bool "Preemptible Kernel"
-        help
-          This option reduces the latency of the kernel when reacting to
-          real-time or interactive events by allowing a low priority process to
-          be preempted even if it is in kernel mode executing a system call.
-          This allows applications to run more reliably even when the system is
-          under load.
-
-          Say Y here if you are building a kernel for a desktop, embedded
-          or real-time system.  Say N if you are unsure.
-
 config NR_CPUS
         int "Maximum number of CPUs (2-64)"
         range 2 64
@@ -399,6 +387,8 @@ config SCHED_SMT
           when dealing with UltraSPARC cpus at a cost of slightly increased
           overhead in some places. If unsure say N here.
 
+source "kernel/Kconfig.preempt"
+
 config CMDLINE_BOOL
         bool "Default bootloader kernel arguments"
 
diff --git a/arch/sparc64/defconfig b/arch/sparc64/defconfig
index 860b8b60526c..120c9c33b7a6 100644
--- a/arch/sparc64/defconfig
+++ b/arch/sparc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.21-rc2
-# Wed Feb 28 09:50:51 2007
+# Linux kernel version: 2.6.21-rc4
+# Sat Mar 17 14:18:44 2007
 #
 CONFIG_SPARC=y
 CONFIG_SPARC64=y
@@ -50,6 +50,7 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_IKCONFIG is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_RELAY=y
+# CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
@@ -108,7 +109,6 @@ CONFIG_GENERIC_HARDIRQS=y
 # General machine setup
 #
 # CONFIG_SMP is not set
-# CONFIG_PREEMPT is not set
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=m
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -165,6 +165,9 @@ CONFIG_BINFMT_ELF32=y
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=m
 CONFIG_SOLARIS_EMUL=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_PREEMPT is not set
 # CONFIG_CMDLINE_BOOL is not set
 
 #
@@ -340,7 +343,6 @@ CONFIG_BLK_DEV_NBD=m
 # CONFIG_BLK_DEV_SX8 is not set
 # CONFIG_BLK_DEV_UB is not set
 # CONFIG_BLK_DEV_RAM is not set
-# CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 CONFIG_CDROM_PKTCDVD_WCACHE=y
diff --git a/arch/sparc64/kernel/ktlb.S b/arch/sparc64/kernel/ktlb.S
index e492db845ea3..d4024ac0d619 100644
--- a/arch/sparc64/kernel/ktlb.S
+++ b/arch/sparc64/kernel/ktlb.S
@@ -138,9 +138,15 @@ kvmap_dtlb_4v:
         brgez,pn        %g4, kvmap_dtlb_nonlinear
          nop
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        /* Index through the base page size TSB even for linear
+         * mappings when using page allocation debugging.
+         */
+        KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
+#else
         /* Correct TAG_TARGET is already in %g6, check 4mb TSB.  */
         KERN_TSB4M_LOOKUP_TL1(%g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
-
+#endif
         /* TSB entry address left in %g1, lookup linear PTE.
          * Must preserve %g1 and %g6 (TAG).
          */
diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
index b1a1ee0cc6bd..f146071a4b2a 100644
--- a/arch/sparc64/mm/init.c
+++ b/arch/sparc64/mm/init.c
@@ -59,8 +59,10 @@ unsigned long kern_linear_pte_xor[2] __read_mostly;
  */
 unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
 
+#ifndef CONFIG_DEBUG_PAGEALLOC
 /* A special kernel TSB for 4MB and 256MB linear mappings.  */
 struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
+#endif
 
 #define MAX_BANKS       32
 
@@ -1301,7 +1303,12 @@ static void __init tsb_phys_patch(void)
 }
 
 /* Don't mark as init, we give this to the Hypervisor.  */
-static struct hv_tsb_descr ktsb_descr[2];
+#ifndef CONFIG_DEBUG_PAGEALLOC
+#define NUM_KTSB_DESCR  2
+#else
+#define NUM_KTSB_DESCR  1
+#endif
+static struct hv_tsb_descr ktsb_descr[NUM_KTSB_DESCR];
 extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
 
 static void __init sun4v_ktsb_init(void)
@@ -1340,6 +1347,7 @@ static void __init sun4v_ktsb_init(void)
         ktsb_descr[0].tsb_base = ktsb_pa;
         ktsb_descr[0].resv = 0;
 
+#ifndef CONFIG_DEBUG_PAGEALLOC
         /* Second KTSB for 4MB/256MB mappings.  */
         ktsb_pa = (kern_base +
                    ((unsigned long)&swapper_4m_tsb[0] - KERNBASE));
@@ -1352,6 +1360,7 @@ static void __init sun4v_ktsb_init(void)
         ktsb_descr[1].ctx_idx = 0;
         ktsb_descr[1].tsb_base = ktsb_pa;
         ktsb_descr[1].resv = 0;
+#endif
 }
 
 void __cpuinit sun4v_ktsb_register(void)
@@ -1364,7 +1373,7 @@ void __cpuinit sun4v_ktsb_register(void)
         pa = kern_base + ((unsigned long)&ktsb_descr[0] - KERNBASE);
 
         func = HV_FAST_MMU_TSB_CTX0;
-        arg0 = 2;
+        arg0 = NUM_KTSB_DESCR;
         arg1 = pa;
         __asm__ __volatile__("ta        %6"
                              : "=&r" (func), "=&r" (arg0), "=&r" (arg1)
@@ -1393,7 +1402,9 @@ void __init paging_init(void)
 
         /* Invalidate both kernel TSBs.  */
         memset(swapper_tsb, 0x40, sizeof(swapper_tsb));
+#ifndef CONFIG_DEBUG_PAGEALLOC
         memset(swapper_4m_tsb, 0x40, sizeof(swapper_4m_tsb));
+#endif
 
         if (tlb_type == hypervisor)
                 sun4v_pgprot_init();
@@ -1725,8 +1736,13 @@ static void __init sun4u_pgprot_init(void)
         pg_iobits = (_PAGE_VALID | _PAGE_PRESENT_4U | __DIRTY_BITS_4U |
                      __ACCESS_BITS_4U | _PAGE_E_4U);
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4U) ^
+                0xfffff80000000000;
+#else
         kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4U) ^
                 0xfffff80000000000;
+#endif
         kern_linear_pte_xor[0] |= (_PAGE_CP_4U | _PAGE_CV_4U |
                                    _PAGE_P_4U | _PAGE_W_4U);
 
@@ -1769,13 +1785,23 @@ static void __init sun4v_pgprot_init(void)
         _PAGE_E = _PAGE_E_4V;
         _PAGE_CACHE = _PAGE_CACHE_4V;
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
+                0xfffff80000000000;
+#else
         kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4V) ^
                 0xfffff80000000000;
+#endif
         kern_linear_pte_xor[0] |= (_PAGE_CP_4V | _PAGE_CV_4V |
                                    _PAGE_P_4V | _PAGE_W_4V);
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
+                0xfffff80000000000;
+#else
         kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZ256MB_4V) ^
                 0xfffff80000000000;
+#endif
         kern_linear_pte_xor[1] |= (_PAGE_CP_4V | _PAGE_CV_4V |
                                    _PAGE_P_4V | _PAGE_W_4V);
 
diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index b3a21ba77cd2..354cc6b70530 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -44,7 +44,7 @@ config LOCKDEP_SUPPORT
 
 config STACKTRACE_SUPPORT
         bool
-        default y
+        default n
 
 config GENERIC_CALIBRATE_DELAY
         bool
diff --git a/arch/um/scripts/Makefile.rules b/arch/um/scripts/Makefile.rules
index 813077fb1e5b..a9a4b85ca516 100644
--- a/arch/um/scripts/Makefile.rules
+++ b/arch/um/scripts/Makefile.rules
@@ -10,7 +10,7 @@ USER_OBJS := $(foreach file,$(USER_OBJS),$(obj)/$(file))
 $(USER_OBJS:.o=.%): \
         c_flags = -Wp,-MD,$(depfile) $(USER_CFLAGS) $(CFLAGS_$(basetarget).o)
 $(USER_OBJS) : CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ \
-        -Dunix -D__unix__ -D__$(SUBARCH)__
+        -Dunix -D__unix__ -D__$(SUBARCH)__ $(CF)
 
 # These are like USER_OBJS but filter USER_CFLAGS through unprofile instead of
 # using it directly.
@@ -19,7 +19,7 @@ UNPROFILE_OBJS := $(foreach file,$(UNPROFILE_OBJS),$(obj)/$(file))
 $(UNPROFILE_OBJS:.o=.%): \
         c_flags = -Wp,-MD,$(depfile) $(call unprofile,$(USER_CFLAGS)) $(CFLAGS_$(basetarget).o)
 $(UNPROFILE_OBJS) : CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ \
-        -Dunix -D__unix__ -D__$(SUBARCH)__
+        -Dunix -D__unix__ -D__$(SUBARCH)__ $(CF)
 
 # The stubs and unmap.o can't try to call mcount or update basic block data
 define unprofile
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 293a4a4c609e..7a1e251e333d 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,11 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.20-git8
-# Tue Feb 13 11:25:16 2007
+# Linux kernel version: 2.6.21-rc3
+# Wed Mar  7 15:29:47 2007
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
 CONFIG_X86=y
+CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_ZONE_DMA32=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_STACKTRACE_SUPPORT=y
@@ -43,6 +45,7 @@ CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_IPC_NS is not set
+CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
@@ -53,6 +56,7 @@ CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
@@ -114,11 +118,11 @@ CONFIG_X86_PC=y
 # CONFIG_X86_VSMP is not set
 # CONFIG_MK8 is not set
 # CONFIG_MPSC is not set
-CONFIG_MCORE2=y
-# CONFIG_GENERIC_CPU is not set
-CONFIG_X86_L1_CACHE_BYTES=64
-CONFIG_X86_L1_CACHE_SHIFT=6
-CONFIG_X86_INTERNODE_CACHE_BYTES=64
+# CONFIG_MCORE2 is not set
+CONFIG_GENERIC_CPU=y
+CONFIG_X86_L1_CACHE_BYTES=128
+CONFIG_X86_L1_CACHE_SHIFT=7
+CONFIG_X86_INTERNODE_CACHE_BYTES=128
 CONFIG_X86_TSC=y
 CONFIG_X86_GOOD_APIC=y
 # CONFIG_MICROCODE is not set
@@ -207,10 +211,8 @@ CONFIG_ACPI_PROCFS=y
 CONFIG_ACPI_AC=y
 CONFIG_ACPI_BATTERY=y
 CONFIG_ACPI_BUTTON=y
-# CONFIG_ACPI_HOTKEY is not set
 CONFIG_ACPI_FAN=y
 # CONFIG_ACPI_DOCK is not set
-# CONFIG_ACPI_BAY is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=y
@@ -319,7 +321,7 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
-# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_TUNNEL=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
@@ -421,7 +423,13 @@ CONFIG_FW_LOADER=y
 #
 # Plug and Play support
 #
-# CONFIG_PNP is not set
+CONFIG_PNP=y
+# CONFIG_PNP_DEBUG is not set
+
+#
+# Protocols
+#
+CONFIG_PNPACPI=y
 
 #
 # Block devices
@@ -441,7 +449,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
-CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
@@ -451,6 +458,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_IBM_ASM is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
+# CONFIG_SONY_LAPTOP is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
@@ -477,6 +485,7 @@ CONFIG_BLK_DEV_IDEACPI=y
 #
 CONFIG_IDE_GENERIC=y
 # CONFIG_BLK_DEV_CMD640 is not set
+# CONFIG_BLK_DEV_IDEPNP is not set
 CONFIG_BLK_DEV_IDEPCI=y
 # CONFIG_IDEPCI_SHARE_IRQ is not set
 # CONFIG_BLK_DEV_OFFBOARD is not set
@@ -623,6 +632,7 @@ CONFIG_SATA_VIA=y
 # CONFIG_SATA_VITESSE is not set
 # CONFIG_SATA_INIC162X is not set
 CONFIG_SATA_INTEL_COMBINED=y
+CONFIG_SATA_ACPI=y
 # CONFIG_PATA_ALI is not set
 # CONFIG_PATA_AMD is not set
 # CONFIG_PATA_ARTOP is not set
@@ -726,6 +736,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
 CONFIG_TUN=y
+# CONFIG_NET_SB1000 is not set
 
 #
 # ARCnet devices
@@ -920,6 +931,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -1001,6 +1013,7 @@ CONFIG_I2C_ISA=m
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PASEMI is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
 # CONFIG_I2C_SIS5595 is not set
@@ -1047,6 +1060,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
 # CONFIG_SENSORS_ADM1031 is not set
 # CONFIG_SENSORS_ADM9240 is not set
 # CONFIG_SENSORS_K8TEMP is not set
@@ -1090,6 +1104,11 @@ CONFIG_SENSORS_SMSC47B397=m
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
+
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -1103,7 +1122,7 @@ CONFIG_SENSORS_SMSC47B397=m
 #
 # Graphics support
 #
-# CONFIG_FIRMWARE_EDID is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 # CONFIG_FB is not set
 
 #
@@ -1114,7 +1133,6 @@ CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=256
 CONFIG_VIDEO_SELECT=y
 CONFIG_DUMMY_CONSOLE=y
-# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -1130,9 +1148,8 @@ CONFIG_SOUND=y
 # Open Sound System
 #
 CONFIG_SOUND_PRIME=y
-CONFIG_OBSOLETE_OSS=y
+# CONFIG_OBSOLETE_OSS is not set
 # CONFIG_SOUND_BT878 is not set
-# CONFIG_SOUND_ES1371 is not set
 CONFIG_SOUND_ICH=y
 # CONFIG_SOUND_TRIDENT is not set
 # CONFIG_SOUND_MSNDCLAS is not set
@@ -1263,6 +1280,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
+# CONFIG_USB_BERRY_CHARGE is not set
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
@@ -1273,6 +1291,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1538,6 +1557,7 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
@@ -1556,6 +1576,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
+# CONFIG_FAULT_INJECTION is not set
 # CONFIG_DEBUG_RODATA is not set
 # CONFIG_IOMMU_DEBUG is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
diff --git a/arch/x86_64/ia32/ia32entry.S b/arch/x86_64/ia32/ia32entry.S
index eda7a0d4dc15..796df6992f62 100644
--- a/arch/x86_64/ia32/ia32entry.S
+++ b/arch/x86_64/ia32/ia32entry.S
@@ -560,7 +560,7 @@ ia32_sys_call_table:
         .quad sys_sched_yield
         .quad sys_sched_get_priority_max
         .quad sys_sched_get_priority_min  /* 160 */
-        .quad sys_sched_rr_get_interval
+        .quad sys32_sched_rr_get_interval
         .quad compat_sys_nanosleep
         .quad sys_mremap
         .quad sys_setresuid16
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index 4651fd22b213..a490fabfcf47 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -662,7 +662,7 @@ static int __init parse_memmap_opt(char *p)
 }
 early_param("memmap", parse_memmap_opt);
 
-void finish_e820_parsing(void)
+void __init finish_e820_parsing(void)
 {
         if (userdef) {
                 printk(KERN_INFO "user-defined physical RAM map:\n");
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index dec587b293bf..148c6bcf5bb4 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -16,7 +16,7 @@
 #include <asm/proto.h>
 #include <asm/dma.h>
 
-static void via_bugs(void)
+static void __init via_bugs(void)
 {
 #ifdef CONFIG_IOMMU
         if ((end_pfn > MAX_DMA32_PFN ||  force_iommu) &&
@@ -36,7 +36,7 @@ static int __init nvidia_hpet_check(struct acpi_table_header *header)
 }
 #endif
 
-static void nvidia_bugs(void)
+static void __init nvidia_bugs(void)
 {
 #ifdef CONFIG_ACPI
         /*
@@ -62,7 +62,7 @@ static void nvidia_bugs(void)
 
 }
 
-static void ati_bugs(void)
+static void __init ati_bugs(void)
 {
         if (timer_over_8254 == 1) {
                 timer_over_8254 = 0;
@@ -88,7 +88,7 @@ struct chipset {
         void (*f)(void);
 };
 
-static struct chipset early_qrk[] = {
+static struct __initdata chipset early_qrk[] = {
         { PCI_VENDOR_ID_NVIDIA, nvidia_bugs },
         { PCI_VENDOR_ID_VIA, via_bugs },
         { PCI_VENDOR_ID_ATI, ati_bugs },
diff --git a/arch/x86_64/kernel/mpparse.c b/arch/x86_64/kernel/mpparse.c
index 50dd8bef850e..455aa0b932f0 100644
--- a/arch/x86_64/kernel/mpparse.c
+++ b/arch/x86_64/kernel/mpparse.c
@@ -60,9 +60,9 @@ unsigned long mp_lapic_addr = 0;
 /* Processor that is doing the boot up */
 unsigned int boot_cpu_id = -1U;
 /* Internal processor count */
-unsigned int num_processors __initdata = 0;
+unsigned int num_processors __cpuinitdata = 0;
 
-unsigned disabled_cpus __initdata;
+unsigned disabled_cpus __cpuinitdata;
 
 /* Bitmask of physically existing CPUs */
 physid_mask_t phys_cpu_present_map = PHYSID_MASK_NONE;
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 486f4c61a948..82d9d85d5270 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -187,10 +187,7 @@ void nmi_watchdog_default(void)
 {
         if (nmi_watchdog != NMI_DEFAULT)
                 return;
-        if (nmi_known_cpu())
-                nmi_watchdog = NMI_LOCAL_APIC;
-        else
-                nmi_watchdog = NMI_IO_APIC;
+        nmi_watchdog = NMI_NONE;
 }
 
 static int endflag __initdata = 0;
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index 030eb3753358..2bac8c60ad61 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -675,7 +675,7 @@ void __init gart_iommu_init(void)
         dma_ops = &gart_dma_ops;
 } 
 
-void gart_parse_options(char *p)
+void __init gart_parse_options(char *p)
 {
         int arg;
 
diff --git a/arch/x86_64/kernel/vsyscall.c b/arch/x86_64/kernel/vsyscall.c
index 180ff919eaf9..b43c698cf7d3 100644
--- a/arch/x86_64/kernel/vsyscall.c
+++ b/arch/x86_64/kernel/vsyscall.c
@@ -112,7 +112,7 @@ static __always_inline void do_vgettimeofday(struct timeval * tv)
 
                 vread = __vsyscall_gtod_data.clock.vread;
                 if (unlikely(!__vsyscall_gtod_data.sysctl_enabled || !vread)) {
-                        gettimeofday(tv,0);
+                        gettimeofday(tv,NULL);
                         return;
                 }
                 now = vread();
diff --git a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
index 0dffae69f4ad..77c25b307635 100644
--- a/arch/x86_64/kernel/x8664_ksyms.c
+++ b/arch/x86_64/kernel/x8664_ksyms.c
@@ -59,3 +59,4 @@ EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(init_level4_pgt);
 EXPORT_SYMBOL(load_gs_index);
 
+EXPORT_SYMBOL(_proxy_pda);
diff --git a/drivers/acpi/events/evmisc.c b/drivers/acpi/events/evmisc.c
index 8dcade63b04b..3a799b9b5df5 100644
--- a/drivers/acpi/events/evmisc.c
+++ b/drivers/acpi/events/evmisc.c
@@ -549,7 +549,7 @@ acpi_status acpi_ev_release_global_lock(void)
         acpi_gbl_global_lock_acquired = FALSE;
 
         /* Release the local GL mutex */
-        acpi_ev_global_lock_thread_id = 0;
+        acpi_ev_global_lock_thread_id = NULL;
         acpi_ev_global_lock_acquired = 0;
         acpi_os_release_mutex(acpi_gbl_global_lock_mutex);
         return_ACPI_STATUS(status);
diff --git a/drivers/ata/pata_cs5520.c b/drivers/ata/pata_cs5520.c
index 7ef834250a43..55cc293e7487 100644
--- a/drivers/ata/pata_cs5520.c
+++ b/drivers/ata/pata_cs5520.c
@@ -208,7 +208,7 @@ static struct ata_port_operations cs5520_port_ops = {
 static int __devinit cs5520_init_one(struct pci_dev *dev, const struct pci_device_id *id)
 {
         u8 pcicfg;
-        void *iomap[5];
+        void __iomem *iomap[5];
         static struct ata_probe_ent probe[2];
         int ports = 0;
 
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index f5d88729ca79..882c36eaf293 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -329,7 +329,7 @@ mpc52xx_ata_init_one(struct device *dev, struct mpc52xx_ata_priv *priv)
         ae->dev = dev;
         ae->irq = priv->ata_irq;
 
-        aio->cmd_addr           = 0;    /* Don't have a classic reg block */
+        aio->cmd_addr           = NULL; /* Don't have a classic reg block */
         aio->altstatus_addr     = &priv->ata_regs->tf_control;
         aio->ctl_addr           = &priv->ata_regs->tf_control;
         aio->data_addr          = &priv->ata_regs->tf_data;
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index 1879e0cd56aa..a787f0d4a5ba 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -354,7 +354,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENOMEM;
 
         if (!(probe_ent->port_flags & SIS_FLAG_CFGSCR)) {
-                void *mmio;
+                void __iomem *mmio;
 
                 mmio = pcim_iomap(pdev, SIS_SCR_PCI_BAR, 0);
                 if (!mmio)
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index 0d7091e2077f..2ad2527cf5b3 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -1177,7 +1177,7 @@ static void __devinit eprom_get_esi(struct atm_dev *dev)
 /*--------------------------------- entries ---------------------------------*/
 
 
-static int __init zatm_init(struct atm_dev *dev)
+static int __devinit zatm_init(struct atm_dev *dev)
 {
         struct zatm_dev *zatm_dev;
         struct pci_dev *pci_dev;
@@ -1256,7 +1256,7 @@ static int __init zatm_init(struct atm_dev *dev)
 }
 
 
-static int __init zatm_start(struct atm_dev *dev)
+static int __devinit zatm_start(struct atm_dev *dev)
 {
         struct zatm_dev *zatm_dev = ZATM_DEV(dev);
         struct pci_dev *pdev = zatm_dev->pci_dev;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index f191afe62b4d..ad0f4a2f25c4 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -407,6 +407,35 @@ void device_remove_bin_file(struct device *dev, struct bin_attribute *attr)
 }
 EXPORT_SYMBOL_GPL(device_remove_bin_file);
 
+/**
+ * device_schedule_callback - helper to schedule a callback for a device
+ * @dev: device.
+ * @func: callback function to invoke later.
+ *
+ * Attribute methods must not unregister themselves or their parent device
+ * (which would amount to the same thing).  Attempts to do so will deadlock,
+ * since unregistration is mutually exclusive with driver callbacks.
+ *
+ * Instead methods can call this routine, which will attempt to allocate
+ * and schedule a workqueue request to call back @func with @dev as its
+ * argument in the workqueue's process context.  @dev will be pinned until
+ * @func returns.
+ *
+ * Returns 0 if the request was submitted, -ENOMEM if storage could not
+ * be allocated.
+ *
+ * NOTE: This routine won't work if CONFIG_SYSFS isn't set!  It uses an
+ * underlying sysfs routine (since it is intended for use by attribute
+ * methods), and if sysfs isn't available you'll get nothing but -ENOSYS.
+ */
+int device_schedule_callback(struct device *dev,
+                void (*func)(struct device *))
+{
+        return sysfs_schedule_callback(&dev->kobj,
+                        (void (*)(void *)) func, dev);
+}
+EXPORT_SYMBOL_GPL(device_schedule_callback);
+
 static void klist_children_get(struct klist_node *n)
 {
         struct device *dev = container_of(n, struct device, knode_parent);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 0c716ee905d7..072e18e6d76d 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1439,7 +1439,7 @@ static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
 
                 if (return_code == IO_OK) {
                         listlength =
-                                be32_to_cpu(*(__u32 *) ld_buff->LUNListLength);
+                                be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
                 } else {        /* reading number of logical volumes failed */
                         printk(KERN_WARNING "cciss: report logical volume"
                                " command failed\n");
@@ -1961,8 +1961,8 @@ cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
                                 ctlr, buf, sizeof(ReadCapdata_struct),
                                         1, logvol, 0, NULL, TYPE_CMD);
         if (return_code == IO_OK) {
-                *total_size = be32_to_cpu(*(__u32 *) buf->total_size);
-                *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
+                *total_size = be32_to_cpu(*(__be32 *) buf->total_size);
+                *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
         } else {                /* read capacity command failed */
                 printk(KERN_WARNING "cciss: read capacity failed\n");
                 *total_size = 0;
@@ -1997,8 +1997,8 @@ cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,
                                 1, logvol, 0, NULL, TYPE_CMD);
         }
         if (return_code == IO_OK) {
-                *total_size = be64_to_cpu(*(__u64 *) buf->total_size);
-                *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
+                *total_size = be64_to_cpu(*(__be64 *) buf->total_size);
+                *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
         } else {                /* read capacity command failed */
                 printk(KERN_WARNING "cciss: read capacity failed\n");
                 *total_size = 0;
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 99e2c8ce1cc4..31e01488eb51 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -663,11 +663,11 @@ static enum action pd_identify(struct pd_unit *disk)
                 return Fail;
         pi_read_block(disk->pi, pd_scratch, 512);
         disk->can_lba = pd_scratch[99] & 2;
-        disk->sectors = le16_to_cpu(*(u16 *) (pd_scratch + 12));
-        disk->heads = le16_to_cpu(*(u16 *) (pd_scratch + 6));
-        disk->cylinders = le16_to_cpu(*(u16 *) (pd_scratch + 2));
+        disk->sectors = le16_to_cpu(*(__le16 *) (pd_scratch + 12));
+        disk->heads = le16_to_cpu(*(__le16 *) (pd_scratch + 6));
+        disk->cylinders = le16_to_cpu(*(__le16 *) (pd_scratch + 2));
         if (disk->can_lba)
-                disk->capacity = le32_to_cpu(*(u32 *) (pd_scratch + 120));
+                disk->capacity = le32_to_cpu(*(__le32 *) (pd_scratch + 120));
         else
                 disk->capacity = disk->sectors * disk->heads * disk->cylinders;
 
diff --git a/drivers/char/lcd.c b/drivers/char/lcd.c
index 5f4fdcf7c96e..1f0962616ee5 100644
--- a/drivers/char/lcd.c
+++ b/drivers/char/lcd.c
@@ -11,9 +11,6 @@
  *       March 2001: Ported from 2.0.34  by Liam Davies
  *
  */
-
-#define RTC_IO_EXTENT   0x10    /*Only really two ports, but... */
-
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/miscdevice.h>
@@ -32,8 +29,6 @@
 
 #include "lcd.h"
 
-static DEFINE_SPINLOCK(lcd_lock);
-
 static int lcd_ioctl(struct inode *inode, struct file *file,
                      unsigned int cmd, unsigned long arg);
 
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index c3f8e383933b..1bbb45b937fd 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -724,6 +724,7 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
                 return -ENOMEM;
             memset(vc, 0, sizeof(*vc));
             vc_cons[currcons].d = vc;
+            INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
             visual_init(vc, currcons, 1);
             if (!*vc->vc_uni_pagedir_loc)
                 con_set_default_unimap(vc);
@@ -2185,10 +2186,28 @@ static void console_callback(struct work_struct *ignored)
         release_console_sem();
 }
 
-void set_console(int nr)
+int set_console(int nr)
 {
+        struct vc_data *vc = vc_cons[fg_console].d;
+
+        if (!vc_cons_allocated(nr) || vt_dont_switch ||
+                (vc->vt_mode.mode == VT_AUTO && vc->vc_mode == KD_GRAPHICS)) {
+
+                /*
+                 * Console switch will fail in console_callback() or
+                 * change_console() so there is no point scheduling
+                 * the callback
+                 *
+                 * Existing set_console() users don't check the return
+                 * value so this shouldn't break anything
+                 */
+                return -EINVAL;
+        }
+
         want_console = nr;
         schedule_console_callback();
+
+        return 0;
 }
 
 struct tty_driver *console_driver;
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 3a5d301e783b..1fa2da8f4fbe 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -34,7 +34,7 @@
 #include <linux/kbd_diacr.h>
 #include <linux/selection.h>
 
-static char vt_dont_switch;
+char vt_dont_switch;
 extern struct tty_driver *console_driver;
 
 #define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count)
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index ea09d0c974ea..e812aa129e28 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -301,6 +301,7 @@ config I6300ESB_WDT
 config I8XX_TCO
         tristate "Intel i8xx TCO Timer/Watchdog"
         depends on WATCHDOG && (X86 || IA64) && PCI
+        default n
         ---help---
           Hardware driver for the TCO timer built into the Intel 82801
           I/O Controller Hub family.  The TCO (Total Cost of Ownership)
diff --git a/drivers/char/watchdog/machzwd.c b/drivers/char/watchdog/machzwd.c
index 4a328ba0d262..81fb3dec180f 100644
--- a/drivers/char/watchdog/machzwd.c
+++ b/drivers/char/watchdog/machzwd.c
@@ -324,7 +324,7 @@ static int zf_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                         return put_user(0, p);
 
                 case WDIOC_KEEPALIVE:
-                        zf_ping(0);
+                        zf_ping(NULL);
                         break;
 
                 default:
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 15278044295c..322ee2984e3d 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -176,6 +176,7 @@ void dma_chan_cleanup(struct kref *kref)
         chan->client = NULL;
         kref_put(&chan->device->refcount, dma_async_device_cleanup);
 }
+EXPORT_SYMBOL(dma_chan_cleanup);
 
 static void dma_chan_free_rcu(struct rcu_head *rcu)
 {
@@ -261,6 +262,7 @@ struct dma_client *dma_async_client_register(dma_event_callback event_callback)
 
         return client;
 }
+EXPORT_SYMBOL(dma_async_client_register);
 
 /**
  * dma_async_client_unregister - unregister a client and free the &dma_client
@@ -287,6 +289,7 @@ void dma_async_client_unregister(struct dma_client *client)
         kfree(client);
         dma_chans_rebalance();
 }
+EXPORT_SYMBOL(dma_async_client_unregister);
 
 /**
  * dma_async_client_chan_request - request DMA channels
@@ -304,6 +307,7 @@ void dma_async_client_chan_request(struct dma_client *client,
         client->chans_desired = number;
         dma_chans_rebalance();
 }
+EXPORT_SYMBOL(dma_async_client_chan_request);
 
 /**
  * dma_async_device_register - registers DMA devices found
@@ -346,6 +350,7 @@ int dma_async_device_register(struct dma_device *device)
 
         return 0;
 }
+EXPORT_SYMBOL(dma_async_device_register);
 
 /**
  * dma_async_device_cleanup - function called when all references are released
@@ -390,23 +395,12 @@ void dma_async_device_unregister(struct dma_device *device)
         kref_put(&device->refcount, dma_async_device_cleanup);
         wait_for_completion(&device->done);
 }
+EXPORT_SYMBOL(dma_async_device_unregister);
 
 static int __init dma_bus_init(void)
 {
         mutex_init(&dma_list_mutex);
         return class_register(&dma_devclass);
 }
-
 subsys_initcall(dma_bus_init);
 
-EXPORT_SYMBOL(dma_async_client_register);
-EXPORT_SYMBOL(dma_async_client_unregister);
-EXPORT_SYMBOL(dma_async_client_chan_request);
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_buf);
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_pg);
-EXPORT_SYMBOL(dma_async_memcpy_pg_to_pg);
-EXPORT_SYMBOL(dma_async_memcpy_complete);
-EXPORT_SYMBOL(dma_async_memcpy_issue_pending);
-EXPORT_SYMBOL(dma_async_device_register);
-EXPORT_SYMBOL(dma_async_device_unregister);
-EXPORT_SYMBOL(dma_chan_cleanup);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f4ee1afe488f..67f3347afcf3 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -26,6 +26,7 @@
 #include <asm/byteorder.h>
 #include <linux/input.h>
 #include <linux/wait.h>
+#include <linux/vmalloc.h>
 
 #include <linux/hid.h>
 #include <linux/hiddev.h>
@@ -654,12 +655,13 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
         memcpy(device->rdesc, start, size);
         device->rsize = size;
 
-        if (!(parser = kzalloc(sizeof(struct hid_parser), GFP_KERNEL))) {
+        if (!(parser = vmalloc(sizeof(struct hid_parser)))) {
                 kfree(device->rdesc);
                 kfree(device->collection);
                 kfree(device);
                 return NULL;
         }
+        memset(parser, 0, sizeof(struct hid_parser));
         parser->device = device;
 
         end = start + size;
@@ -668,7 +670,7 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                 if (item.format != HID_ITEM_FORMAT_SHORT) {
                         dbg("unexpected long global item");
                         hid_free_device(device);
-                        kfree(parser);
+                        vfree(parser);
                         return NULL;
                 }
 
@@ -676,7 +678,7 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                         dbg("item %u %u %u %u parsing failed\n",
                                 item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag);
                         hid_free_device(device);
-                        kfree(parser);
+                        vfree(parser);
                         return NULL;
                 }
 
@@ -684,23 +686,23 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                         if (parser->collection_stack_ptr) {
                                 dbg("unbalanced collection at end of report description");
                                 hid_free_device(device);
-                                kfree(parser);
+                                vfree(parser);
                                 return NULL;
                         }
                         if (parser->local.delimiter_depth) {
                                 dbg("unbalanced delimiter at end of report description");
                                 hid_free_device(device);
-                                kfree(parser);
+                                vfree(parser);
                                 return NULL;
                         }
-                        kfree(parser);
+                        vfree(parser);
                         return device;
                 }
         }
 
         dbg("item fetching failed at offset %d\n", (int)(end - start));
         hid_free_device(device);
-        kfree(parser);
+        vfree(parser);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(hid_parse_report);
@@ -753,8 +755,7 @@ static __inline__ __u32 extract(__u8 *report, unsigned offset, unsigned n)
 
         report += offset >> 3;  /* adjust byte index */
         offset &= 7;            /* now only need bit offset into one byte */
-        x = get_unaligned((u64 *) report);
-        x = le64_to_cpu(x);
+        x = le64_to_cpu(get_unaligned((__le64 *) report));
         x = (x >> offset) & ((1ULL << n) - 1);  /* extract bit field */
         return (u32) x;
 }
@@ -769,7 +770,7 @@ static __inline__ __u32 extract(__u8 *report, unsigned offset, unsigned n)
  */
 static __inline__ void implement(__u8 *report, unsigned offset, unsigned n, __u32 value)
 {
-        u64 x;
+        __le64 x;
         u64 m = (1ULL << n) - 1;
 
         WARN_ON(n > 32);
@@ -780,10 +781,10 @@ static __inline__ void implement(__u8 *report, unsigned offset, unsigned n, __u3
         report += offset >> 3;
         offset &= 7;
 
-        x = get_unaligned((u64 *)report);
+        x = get_unaligned((__le64 *)report);
         x &= cpu_to_le64(~(m << offset));
         x |= cpu_to_le64(((u64) value) << offset);
-        put_unaligned(x, (u64 *) report);
+        put_unaligned(x, (__le64 *) report);
 }
 
 /*
@@ -873,10 +874,6 @@ static void hid_output_field(struct hid_field *field, __u8 *data)
         unsigned size = field->report_size;
         unsigned n;
 
-        /* make sure the unused bits in the last byte are zeros */
-        if (count > 0 && size > 0)
-                data[(offset+count*size-1)/8] = 0;
-
         for (n = 0; n < count; n++) {
                 if (field->logical_minimum < 0) /* signed values */
                         implement(data, offset + n * size, size, s32ton(field->value[n], size));
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index c3d4856fb618..6d105a1d41b1 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -527,6 +527,7 @@ config SENSORS_W83792D
 config SENSORS_W83793
         tristate "Winbond W83793"
         depends on HWMON && I2C && EXPERIMENTAL
+        select HWMON_VID
         help
           If you say yes here you get support for the Winbond W83793
           hardware monitoring chip.
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 5d134bb75ba1..8f1fd017679b 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -434,24 +434,8 @@ config BLK_DEV_IDEDMA_FORCED
 
           Generally say N here.
 
-config IDEDMA_PCI_AUTO
-        bool "Use PCI DMA by default when available"
-        ---help---
-          Prior to kernel version 2.1.112, Linux used to automatically use
-          DMA for IDE drives and chipsets which support it. Due to concerns
-          about a couple of cases where buggy hardware may have caused damage,
-          the default is now to NOT use DMA automatically. To revert to the
-          previous behaviour, say Y to this question.
-
-          If you suspect your hardware is at all flakey, say N here.
-          Do NOT email the IDE kernel people regarding this issue!
-
-          It is normally safe to answer Y to this question unless your
-          motherboard uses a VIA VP2 chipset, in which case you should say N.
-
 config IDEDMA_ONLYDISK
         bool "Enable DMA only for disks "
-        depends on IDEDMA_PCI_AUTO
         help
           This is used if you know your ATAPI Devices are going to fail DMA
           Transfers.
@@ -769,6 +753,14 @@ config BLK_DEV_TC86C001
         help
         This driver adds support for Toshiba TC86C001 GOKU-S chip.
 
+config BLK_DEV_CELLEB
+        tristate "Toshiba's Cell Reference Set IDE support"
+        depends on PPC_CELLEB
+        help
+          This driver provides support for the built-in IDE controller on
+          Toshiba Cell Reference Board.
+          If unsure, say Y.
+
 endif
 
 config BLK_DEV_IDE_PMAC
@@ -800,14 +792,6 @@ config BLK_DEV_IDEDMA_PMAC
           to transfer data to and from memory.  Saying Y is safe and improves
           performance.
 
-config BLK_DEV_IDE_CELLEB
-        bool "Toshiba's Cell Reference Set IDE support"
-        depends on PPC_CELLEB
-        help
-          This driver provides support for the built-in IDE controller on
-          Toshiba Cell Reference Board.
-          If unsure, say Y.
-
 config BLK_DEV_IDE_SWARM
         tristate "IDE for Sibyte evaluation boards"
         depends on SIBYTE_SB1xxx_SOC
@@ -851,19 +835,6 @@ config BLK_DEV_IDEDMA_ICS
           Say Y here if you want to add DMA (Direct Memory Access) support to
           the ICS IDE driver.
 
-config IDEDMA_ICS_AUTO
-        bool "Use ICS DMA by default"
-        depends on BLK_DEV_IDEDMA_ICS
-        help
-          Prior to kernel version 2.1.112, Linux used to automatically use
-          DMA for IDE drives and chipsets which support it. Due to concerns
-          about a couple of cases where buggy hardware may have caused damage,
-          the default is now to NOT use DMA automatically. To revert to the
-          previous behaviour, say Y to this question.
-
-          If you suspect your hardware is at all flakey, say N here.
-          Do NOT email the IDE kernel people regarding this issue!
-
 config BLK_DEV_IDE_RAPIDE
         tristate "RapIDE interface support"
         depends on ARM && ARCH_ACORN
@@ -1086,9 +1057,6 @@ config IDEDMA_IVB
 
           It is normally safe to answer Y; however, the default is N.
 
-config IDEDMA_AUTO
-        def_bool IDEDMA_PCI_AUTO || IDEDMA_ICS_AUTO
-
 endif
 
 config BLK_DEV_HD_ONLY
diff --git a/drivers/ide/Makefile b/drivers/ide/Makefile
index 28feedfbd21d..d9f029e8ff74 100644
--- a/drivers/ide/Makefile
+++ b/drivers/ide/Makefile
@@ -37,7 +37,6 @@ ide-core-$(CONFIG_BLK_DEV_Q40IDE)	+= legacy/q40ide.o
 # built-in only drivers from ppc/
 ide-core-$(CONFIG_BLK_DEV_MPC8xx_IDE)   += ppc/mpc8xx.o
 ide-core-$(CONFIG_BLK_DEV_IDE_PMAC)     += ppc/pmac.o
-ide-core-$(CONFIG_BLK_DEV_IDE_CELLEB)   += ppc/scc_pata.o
 
 # built-in only drivers from h8300/
 ide-core-$(CONFIG_H8300)                += h8300/ide-h8300.o
diff --git a/drivers/ide/arm/icside.c b/drivers/ide/arm/icside.c
index 40e5c66b81ce..e2953fc1fafb 100644
--- a/drivers/ide/arm/icside.c
+++ b/drivers/ide/arm/icside.c
@@ -196,11 +196,6 @@ static void icside_maskproc(ide_drive_t *drive, int mask)
 }
 
 #ifdef CONFIG_BLK_DEV_IDEDMA_ICS
-
-#ifndef CONFIG_IDEDMA_ICS_AUTO
-#warning CONFIG_IDEDMA_ICS_AUTO=n support is obsolete, and will be removed soon.
-#endif
-
 /*
  * SG-DMA support.
  *
@@ -474,12 +469,6 @@ static int icside_dma_lostirq(ide_drive_t *drive)
 
 static void icside_dma_init(ide_hwif_t *hwif)
 {
-        int autodma = 0;
-
-#ifdef CONFIG_IDEDMA_ICS_AUTO
-        autodma = 1;
-#endif
-
         printk("    %s: SG-DMA", hwif->name);
 
         hwif->atapi_dma         = 1;
@@ -489,7 +478,7 @@ static void icside_dma_init(ide_hwif_t *hwif)
         hwif->dmatable_cpu      = NULL;
         hwif->dmatable_dma      = 0;
         hwif->speedproc         = icside_set_speed;
-        hwif->autodma           = autodma;
+        hwif->autodma           = 1;
 
         hwif->ide_dma_check     = icside_dma_check;
         hwif->dma_host_off      = icside_dma_host_off;
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index 08e7cd043bcc..fd213088b06b 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -767,7 +767,7 @@ int ide_set_dma(ide_drive_t *drive)
         switch(rc) {
         case -1: /* DMA needs to be disabled */
                 hwif->dma_off_quietly(drive);
-                return 0;
+                return -1;
         case  0: /* DMA needs to be enabled */
                 return hwif->ide_dma_on(drive);
         case  1: /* DMA setting cannot be changed */
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index dfbd74458522..695610f0e3e4 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -177,11 +177,7 @@ DECLARE_MUTEX(ide_cfg_sem);
 static int ide_scan_direction; /* THIS was formerly 2.2.x pci=reverse */
 #endif
 
-#ifdef CONFIG_IDEDMA_AUTO
 int noautodma = 0;
-#else
-int noautodma = 1;
-#endif
 
 EXPORT_SYMBOL(noautodma);
 
diff --git a/drivers/ide/mips/au1xxx-ide.c b/drivers/ide/mips/au1xxx-ide.c
index b2dc028dc8ca..d54d9fe92a7d 100644
--- a/drivers/ide/mips/au1xxx-ide.c
+++ b/drivers/ide/mips/au1xxx-ide.c
@@ -639,6 +639,7 @@ static int au_ide_probe(struct device *dev)
         _auide_hwif *ahwif = &auide_hwif;
         ide_hwif_t *hwif;
         struct resource *res;
+        hw_regs_t *hw;
         int ret = 0;
 
 #if defined(CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA)
@@ -681,7 +682,7 @@ static int au_ide_probe(struct device *dev)
         /* FIXME:  This might possibly break PCMCIA IDE devices */
 
         hwif                            = &ide_hwifs[pdev->id];
-        hw_regs_t *hw                   = &hwif->hw;
+        hw                              = &hwif->hw;
         hwif->irq = hw->irq             = ahwif->irq;
         hwif->chipset                   = ide_au1xxx;
 
diff --git a/drivers/ide/pci/Makefile b/drivers/ide/pci/Makefile
index 6591ff4753cb..95d1ea8f1f14 100644
--- a/drivers/ide/pci/Makefile
+++ b/drivers/ide/pci/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_BLK_DEV_AEC62XX)		+= aec62xx.o
 obj-$(CONFIG_BLK_DEV_ALI15X3)           += alim15x3.o
 obj-$(CONFIG_BLK_DEV_AMD74XX)           += amd74xx.o
 obj-$(CONFIG_BLK_DEV_ATIIXP)            += atiixp.o
+obj-$(CONFIG_BLK_DEV_CELLEB)            += scc_pata.o
 obj-$(CONFIG_BLK_DEV_CMD64X)            += cmd64x.o
 obj-$(CONFIG_BLK_DEV_CS5520)            += cs5520.o
 obj-$(CONFIG_BLK_DEV_CS5530)            += cs5530.o
diff --git a/drivers/ide/pci/cmd64x.c b/drivers/ide/pci/cmd64x.c
index b0d4825c56a9..561197f7b5bb 100644
--- a/drivers/ide/pci/cmd64x.c
+++ b/drivers/ide/pci/cmd64x.c
@@ -1,6 +1,6 @@
 /* $Id: cmd64x.c,v 1.21 2000/01/30 23:23:16
  *
- * linux/drivers/ide/pci/cmd64x.c               Version 1.41    Feb 3, 2007
+ * linux/drivers/ide/pci/cmd64x.c               Version 1.42    Feb 8, 2007
  *
  * cmd64x.c: Enable interrupts at initialization time on Ultra/PCI machines.
  *           Note, this driver is not used at all on other systems because
@@ -189,6 +189,11 @@ static int cmd64x_get_info (char *buffer, char **addr, off_t offset, int count)
 
 #endif  /* defined(DISPLAY_CMD64X_TIMINGS) && defined(CONFIG_PROC_FS) */
 
+static u8 quantize_timing(int timing, int quant)
+{
+        return (timing + quant - 1) / quant;
+}
+
 /*
  * This routine writes the prepared setup/active/recovery counts
  * for a drive into the cmd646 chipset registers to active them.
@@ -268,47 +273,37 @@ static void program_drive_counts (ide_drive_t *drive, int setup_count, int activ
  */
 static u8 cmd64x_tune_pio (ide_drive_t *drive, u8 mode_wanted)
 {
-        int setup_time, active_time, recovery_time;
-        int clock_time, pio_mode, cycle_time;
-        u8 recovery_count2, cycle_count;
-        int setup_count, active_count, recovery_count;
-        int bus_speed = system_bus_clock();
-        ide_pio_data_t  d;
+        int setup_time, active_time, cycle_time;
+        u8  cycle_count, setup_count, active_count, recovery_count;
+        u8  pio_mode;
+        int clock_time = 1000 / system_bus_clock();
+        ide_pio_data_t pio;
 
-        pio_mode = ide_get_best_pio_mode(drive, mode_wanted, 5, &d);
-        cycle_time = d.cycle_time;
+        pio_mode = ide_get_best_pio_mode(drive, mode_wanted, 5, &pio);
+        cycle_time = pio.cycle_time;
 
-        /*
-         * I copied all this complicated stuff from cmd640.c and made a few
-         * minor changes.  For now I am just going to pray that it is correct.
-         */
         setup_time  = ide_pio_timings[pio_mode].setup_time;
         active_time = ide_pio_timings[pio_mode].active_time;
-        recovery_time = cycle_time - (setup_time + active_time);
-        clock_time = 1000 / bus_speed;
-        cycle_count = (cycle_time + clock_time - 1) / clock_time;
-
-        setup_count = (setup_time + clock_time - 1) / clock_time;
 
-        active_count = (active_time + clock_time - 1) / clock_time;
+        setup_count  = quantize_timing( setup_time, clock_time);
+        cycle_count  = quantize_timing( cycle_time, clock_time);
+        active_count = quantize_timing(active_time, clock_time);
 
-        recovery_count = (recovery_time + clock_time - 1) / clock_time;
-        recovery_count2 = cycle_count - (setup_count + active_count);
-        if (recovery_count2 > recovery_count)
-                recovery_count = recovery_count2;
+        recovery_count = cycle_count - active_count;
+        /* program_drive_counts() takes care of zero recovery cycles */
         if (recovery_count > 16) {
                 active_count += recovery_count - 16;
                 recovery_count = 16;
         }
         if (active_count > 16)
-                active_count = 16; /* maximum allowed by cmd646 */
+                active_count = 16; /* maximum allowed by cmd64x */
 
         program_drive_counts (drive, setup_count, active_count, recovery_count);
 
         cmdprintk("%s: PIO mode wanted %d, selected %d (%dns)%s, "
                 "clocks=%d/%d/%d\n",
                 drive->name, mode_wanted, pio_mode, cycle_time,
-                d.overridden ? " (overriding vendor mode)" : "",
+                pio.overridden ? " (overriding vendor mode)" : "",
                 setup_count, active_count, recovery_count);
 
         return pio_mode;
diff --git a/drivers/ide/pci/jmicron.c b/drivers/ide/pci/jmicron.c
index 53f25500c22b..be4fc96c29e0 100644
--- a/drivers/ide/pci/jmicron.c
+++ b/drivers/ide/pci/jmicron.c
@@ -240,12 +240,31 @@ static int __devinit jmicron_init_one(struct pci_dev *dev, const struct pci_devi
         return 0;
 }
 
+/* If libata is configured, jmicron PCI quirk will configure it such
+ * that the SATA ports are in AHCI function while the PATA ports are
+ * in a separate IDE function.  In such cases, match device class and
+ * attach only to IDE.  If libata isn't configured, keep the old
+ * behavior for backward compatibility.
+ */
+#if defined(CONFIG_ATA) || defined(CONFIG_ATA_MODULE)
+#define JMB_CLASS       PCI_CLASS_STORAGE_IDE << 8
+#define JMB_CLASS_MASK  0xffff00
+#else
+#define JMB_CLASS       0
+#define JMB_CLASS_MASK  0
+#endif
+
 static struct pci_device_id jmicron_pci_tbl[] = {
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 0},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 1},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 2},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 3},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 4},
         { 0, },
 };
 
diff --git a/drivers/ide/ppc/scc_pata.c b/drivers/ide/pci/scc_pata.c
index f84bf791f72e..f84bf791f72e 100644
--- a/drivers/ide/ppc/scc_pata.c
+++ b/drivers/ide/pci/scc_pata.c
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index a52c80fe7d3e..118fb3205ca8 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -505,11 +505,6 @@ static void ide_hwif_setup_dma(struct pci_dev *dev, ide_pci_device_t *d, ide_hwi
                 }
         }
 }
-
-#ifndef CONFIG_IDEDMA_PCI_AUTO
-#warning CONFIG_IDEDMA_PCI_AUTO=n support is obsolete, and will be removed soon.
-#endif
-
 #endif /* CONFIG_BLK_DEV_IDEDMA_PCI*/
 
 /**
diff --git a/drivers/infiniband/hw/ipath/ipath_dma.c b/drivers/infiniband/hw/ipath/ipath_dma.c
index f6f949040825..f87f003e3ef8 100644
--- a/drivers/infiniband/hw/ipath/ipath_dma.c
+++ b/drivers/infiniband/hw/ipath/ipath_dma.c
@@ -167,7 +167,7 @@ static void *ipath_dma_alloc_coherent(struct ib_device *dev, size_t size,
 }
 
 static void ipath_dma_free_coherent(struct ib_device *dev, size_t size,
-                                    void *cpu_addr, dma_addr_t dma_handle)
+                                    void *cpu_addr, u64 dma_handle)
 {
         free_pages((unsigned long) cpu_addr, get_order(size));
 }
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index c625ddb8833d..d5ecd2d53046 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -188,7 +188,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
         for (i=0; i < cnt-1 ; i++) {
                 sector_t sz = 0;
                 int j;
-                for (j=i; i<cnt-1 && sz < min_spacing ; j++)
+                for (j = i; j < cnt - 1 && sz < min_spacing; j++)
                         sz += conf->disks[j].size;
                 if (sz >= min_spacing && sz < conf->hash_spacing)
                         conf->hash_spacing = sz;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
index 1ff5138e4bb6..9916cf32494d 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -1248,10 +1248,10 @@ int pvr2_upload_firmware2(struct pvr2_hdw *hdw)
         ret |= pvr2_write_register(hdw, 0xaa18, 0x00840000); /*unknown*/
         LOCK_TAKE(hdw->ctl_lock); do {
                 hdw->cmd_buffer[0] = FX2CMD_FWPOST1;
-                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,1,0,0);
+                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,1,NULL,0);
                 hdw->cmd_buffer[0] = FX2CMD_MEMSEL;
                 hdw->cmd_buffer[1] = 0;
-                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,0,0);
+                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,NULL,0);
         } while (0); LOCK_GIVE(hdw->ctl_lock);
 
         if (ret) {
@@ -1320,7 +1320,7 @@ int pvr2_upload_firmware2(struct pvr2_hdw *hdw)
         LOCK_TAKE(hdw->ctl_lock); do {
                 hdw->cmd_buffer[0] = FX2CMD_MEMSEL;
                 hdw->cmd_buffer[1] = 0;
-                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,0,0);
+                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,NULL,0);
         } while (0); LOCK_GIVE(hdw->ctl_lock);
 
         if (ret) {
diff --git a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
index 5313d342666e..25d3830b482a 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
@@ -808,11 +808,11 @@ static void pvr2_v4l2_destroy_no_lock(struct pvr2_v4l2 *vp)
 {
         if (vp->dev_video) {
                 pvr2_v4l2_dev_destroy(vp->dev_video);
-                vp->dev_video = 0;
+                vp->dev_video = NULL;
         }
         if (vp->dev_radio) {
                 pvr2_v4l2_dev_destroy(vp->dev_radio);
-                vp->dev_radio = 0;
+                vp->dev_radio = NULL;
         }
 
         pvr2_trace(PVR2_TRACE_STRUCT,"Destroying pvr2_v4l2 id=%p",vp);
@@ -1138,7 +1138,7 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
 {
         int mindevnum;
         int unit_number;
-        int *nr_ptr = 0;
+        int *nr_ptr = NULL;
         dip->v4lp = vp;
 
 
diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
index 88d4f70035bb..dee3638ad744 100644
--- a/drivers/net/atl1/atl1_main.c
+++ b/drivers/net/atl1/atl1_main.c
@@ -1328,7 +1328,7 @@ static int atl1_tx_csum(struct atl1_adapter *adapter, struct sk_buff *skb,
 
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
                 cso = skb->h.raw - skb->data;
-                css = (skb->h.raw + skb->csum) - skb->data;
+                css = (skb->h.raw + skb->csum_offset) - skb->data;
                 if (unlikely(cso & 0x1)) {
                         printk(KERN_DEBUG "%s: payload offset != even number\n",
                                 atl1_driver_name);
@@ -1562,7 +1562,7 @@ static int atl1_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         /* mss will be nonzero if we're doing segment offload (TSO/GSO) */
         mss = skb_shinfo(skb)->gso_size;
         if (mss) {
-                if (skb->protocol == ntohs(ETH_P_IP)) {
+                if (skb->protocol == htons(ETH_P_IP)) {
                         proto_hdr_len = ((skb->h.raw - skb->data) +
                                          (skb->h.th->doff << 2));
                         if (unlikely(proto_hdr_len > len)) {
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index c6172a77a6d7..349b96a3ec4c 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -1712,7 +1712,7 @@ static void init_registers(struct net_device *dev)
 
         /* Enable interrupts by setting the interrupt mask. */
         writel(DEFAULT_INTR, ioaddr + IntrMask);
-        writel(1, ioaddr + IntrEnable);
+        natsemi_irq_enable(dev);
 
         writel(RxOn | TxOn, ioaddr + ChipCmd);
         writel(StatsClear, ioaddr + StatsCtrl); /* Clear Stats */
@@ -2119,28 +2119,35 @@ static irqreturn_t intr_handler(int irq, void *dev_instance)
         struct netdev_private *np = netdev_priv(dev);
         void __iomem * ioaddr = ns_ioaddr(dev);
 
-        if (np->hands_off)
+        /* Reading IntrStatus automatically acknowledges so don't do
+         * that while interrupts are disabled, (for example, while a
+         * poll is scheduled).  */
+        if (np->hands_off || !readl(ioaddr + IntrEnable))
                 return IRQ_NONE;
 
-        /* Reading automatically acknowledges. */
         np->intr_status = readl(ioaddr + IntrStatus);
 
+        if (!np->intr_status)
+                return IRQ_NONE;
+
         if (netif_msg_intr(np))
                 printk(KERN_DEBUG
                        "%s: Interrupt, status %#08x, mask %#08x.\n",
                        dev->name, np->intr_status,
                        readl(ioaddr + IntrMask));
 
-        if (!np->intr_status)
-                return IRQ_NONE;
-
         prefetch(&np->rx_skbuff[np->cur_rx % RX_RING_SIZE]);
 
         if (netif_rx_schedule_prep(dev)) {
                 /* Disable interrupts and register for poll */
                 natsemi_irq_disable(dev);
                 __netif_rx_schedule(dev);
-        }
+        } else
+                printk(KERN_WARNING
+                       "%s: Ignoring interrupt, status %#08x, mask %#08x.\n",
+                       dev->name, np->intr_status,
+                       readl(ioaddr + IntrMask));
+
         return IRQ_HANDLED;
 }
 
@@ -2156,6 +2163,20 @@ static int natsemi_poll(struct net_device *dev, int *budget)
         int work_done = 0;
 
         do {
+                if (netif_msg_intr(np))
+                        printk(KERN_DEBUG
+                               "%s: Poll, status %#08x, mask %#08x.\n",
+                               dev->name, np->intr_status,
+                               readl(ioaddr + IntrMask));
+
+                /* netdev_rx() may read IntrStatus again if the RX state
+                 * machine falls over so do it first. */
+                if (np->intr_status &
+                    (IntrRxDone | IntrRxIntr | RxStatusFIFOOver |
+                     IntrRxErr | IntrRxOverrun)) {
+                        netdev_rx(dev, &work_done, work_to_do);
+                }
+
                 if (np->intr_status &
                     (IntrTxDone | IntrTxIntr | IntrTxIdle | IntrTxErr)) {
                         spin_lock(&np->lock);
@@ -2167,12 +2188,6 @@ static int natsemi_poll(struct net_device *dev, int *budget)
                 if (np->intr_status & IntrAbnormalSummary)
                         netdev_error(dev, np->intr_status);
 
-                if (np->intr_status &
-                    (IntrRxDone | IntrRxIntr | RxStatusFIFOOver |
-                     IntrRxErr | IntrRxOverrun)) {
-                        netdev_rx(dev, &work_done, work_to_do);
-                }
-
                 *budget -= work_done;
                 dev->quota -= work_done;
 
@@ -2399,19 +2414,8 @@ static struct net_device_stats *get_stats(struct net_device *dev)
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void natsemi_poll_controller(struct net_device *dev)
 {
-        struct netdev_private *np = netdev_priv(dev);
-
         disable_irq(dev->irq);
-
-        /*
-         * A real interrupt might have already reached us at this point
-         * but NAPI might still haven't called us back.  As the interrupt
-         * status register is cleared by reading, we should prevent an
-         * interrupt loss in this case...
-         */
-        if (!np->intr_status)
-                intr_handler(dev->irq, dev);
-
+        intr_handler(dev->irq, dev);
         enable_irq(dev->irq);
 }
 #endif
@@ -3071,7 +3075,7 @@ static void enable_wol_mode(struct net_device *dev, int enable_intr)
                  * Could be used to send a netlink message.
                  */
                 writel(WOLPkt | LinkChange, ioaddr + IntrMask);
-                writel(1, ioaddr + IntrEnable);
+                natsemi_irq_enable(dev);
         }
 }
 
@@ -3202,7 +3206,7 @@ static int natsemi_suspend (struct pci_dev *pdev, pm_message_t state)
                 disable_irq(dev->irq);
                 spin_lock_irq(&np->lock);
 
-                writel(0, ioaddr + IntrEnable);
+                natsemi_irq_disable(dev);
                 np->hands_off = 1;
                 natsemi_stop_rxtx(dev);
                 netif_stop_queue(dev);
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 81742e4e5610..dd8ce35332fe 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -232,6 +232,7 @@ enum {
 #define MPORT_SINGLE_FUNCTION_MODE 0x1111
 
 extern unsigned long long netxen_dma_mask;
+extern unsigned long last_schedule_time;
 
 /*
  * NetXen host-peg signal message structure
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index 986ef98db229..ee1b5a24cbe7 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -462,6 +462,7 @@ netxen_nic_set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
                 }
                 printk(KERN_INFO "%s: flash unlocked. \n", 
                         netxen_nic_driver_name);
+                last_schedule_time = jiffies;
                 ret = netxen_flash_erase_secondary(adapter);
                 if (ret != FLASH_SUCCESS) {
                         printk(KERN_ERR "%s: Flash erase failed.\n", 
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 1be55702557d..6537574a9cda 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -822,7 +822,10 @@ int netxen_nic_set_mtu_xgb(struct netxen_port *port, int new_mtu)
 {
         struct netxen_adapter *adapter = port->adapter;
         new_mtu += NETXEN_NIU_HDRSIZE + NETXEN_NIU_TLRSIZE;
-        netxen_nic_write_w0(adapter, NETXEN_NIU_XGE_MAX_FRAME_SIZE, new_mtu);
+        if (port->portnum == 0)
+            netxen_nic_write_w0(adapter, NETXEN_NIU_XGE_MAX_FRAME_SIZE, new_mtu);
+        else if (port->portnum == 1)
+            netxen_nic_write_w0(adapter, NETXEN_NIU_XG1_MAX_FRAME_SIZE, new_mtu);
         return 0;
 }
 
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 586d32b676af..229aa1c4fb79 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -42,6 +42,8 @@ struct crb_addr_pair {
         u32 data;
 };
 
+unsigned long last_schedule_time;
+
 #define NETXEN_MAX_CRB_XFORM 60
 static unsigned int crb_addr_xform[NETXEN_MAX_CRB_XFORM];
 #define NETXEN_ADDR_ERROR (0xffffffff)
@@ -404,9 +406,14 @@ static inline int do_rom_fast_write(struct netxen_adapter *adapter, int addr,
 static inline int
 do_rom_fast_read(struct netxen_adapter *adapter, int addr, int *valp)
 {
+        if (jiffies > (last_schedule_time + (8 * HZ))) {
+                last_schedule_time = jiffies;
+                schedule();
+        }
+
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ADDRESS, addr);
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ABYTE_CNT, 3);
-        udelay(70);             /* prevent bursting on CRB */
+        udelay(100);            /* prevent bursting on CRB */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_INSTR_OPCODE, 0xb);
         if (netxen_wait_rom_done(adapter)) {
@@ -415,7 +422,7 @@ do_rom_fast_read(struct netxen_adapter *adapter, int addr, int *valp)
         }
         /* reset abyte_cnt and dummy_byte_cnt */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ABYTE_CNT, 0);
-        udelay(70);             /* prevent bursting on CRB */
+        udelay(100);            /* prevent bursting on CRB */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
 
         *valp = netxen_nic_reg_read(adapter, NETXEN_ROMUSB_ROM_RDATA);
diff --git a/drivers/net/pcmcia/ibmtr_cs.c b/drivers/net/pcmcia/ibmtr_cs.c
index a956a51d284f..1060154ae750 100644
--- a/drivers/net/pcmcia/ibmtr_cs.c
+++ b/drivers/net/pcmcia/ibmtr_cs.c
@@ -138,7 +138,7 @@ static const struct ethtool_ops netdev_ethtool_ops = {
 
 ======================================================================*/
 
-static int ibmtr_attach(struct pcmcia_device *link)
+static int __devinit ibmtr_attach(struct pcmcia_device *link)
 {
     ibmtr_dev_t *info;
     struct net_device *dev;
@@ -217,7 +217,7 @@ static void ibmtr_detach(struct pcmcia_device *link)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static int ibmtr_config(struct pcmcia_device *link)
+static int __devinit ibmtr_config(struct pcmcia_device *link)
 {
     ibmtr_dev_t *info = link->priv;
     struct net_device *dev = info->dev;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index eea75a401b0c..8fecf1b817f7 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3275,24 +3275,30 @@ static int skge_set_mac_address(struct net_device *dev, void *p)
         struct skge_hw *hw = skge->hw;
         unsigned port = skge->port;
         const struct sockaddr *addr = p;
+        u16 ctrl;
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
-        mutex_lock(&hw->phy_mutex);
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
-        memcpy_toio(hw->regs + B2_MAC_1 + port*8,
-                    dev->dev_addr, ETH_ALEN);
-        memcpy_toio(hw->regs + B2_MAC_2 + port*8,
-                    dev->dev_addr, ETH_ALEN);
 
-        if (hw->chip_id == CHIP_ID_GENESIS)
-                xm_outaddr(hw, port, XM_SA, dev->dev_addr);
-        else {
-                gma_set_addr(hw, port, GM_SRC_ADDR_1L, dev->dev_addr);
-                gma_set_addr(hw, port, GM_SRC_ADDR_2L, dev->dev_addr);
+        /* disable Rx */
+        ctrl = gma_read16(hw, port, GM_GP_CTRL);
+        gma_write16(hw, port, GM_GP_CTRL, ctrl & ~GM_GPCR_RX_ENA);
+
+        memcpy_toio(hw->regs + B2_MAC_1 + port*8, dev->dev_addr, ETH_ALEN);
+        memcpy_toio(hw->regs + B2_MAC_2 + port*8, dev->dev_addr, ETH_ALEN);
+
+        if (netif_running(dev)) {
+                if (hw->chip_id == CHIP_ID_GENESIS)
+                        xm_outaddr(hw, port, XM_SA, dev->dev_addr);
+                else {
+                        gma_set_addr(hw, port, GM_SRC_ADDR_1L, dev->dev_addr);
+                        gma_set_addr(hw, port, GM_SRC_ADDR_2L, dev->dev_addr);
+                }
         }
-        mutex_unlock(&hw->phy_mutex);
+
+        gma_write16(hw, port, GM_GP_CTRL, ctrl);
 
         return 0;
 }
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 36202e94ee91..01d55315ee8c 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -346,7 +346,7 @@ static void ibmtr_cleanup_card(struct net_device *dev)
  *      which references it.
  ****************************************************************************/
 
-static int __init ibmtr_probe(struct net_device *dev)
+static int __devinit ibmtr_probe(struct net_device *dev)
 {
         int i;
         int base_addr = dev->base_addr;
@@ -366,7 +366,7 @@ static int __init ibmtr_probe(struct net_device *dev)
         return -ENODEV;
 }
 
-int __init ibmtr_probe_card(struct net_device *dev)
+int __devinit ibmtr_probe_card(struct net_device *dev)
 {
         int err = ibmtr_probe(dev);
         if (!err) {
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index 24a29c99ba94..9aeac76184f3 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -190,13 +190,13 @@
 
 /* Structure/enum declaration ------------------------------- */
 struct tx_desc {
-        u32 tdes0, tdes1, tdes2, tdes3; /* Data for the card */
+        __le32 tdes0, tdes1, tdes2, tdes3; /* Data for the card */
         char *tx_buf_ptr;               /* Data for us */
         struct tx_desc *next_tx_desc;
 } __attribute__(( aligned(32) ));
 
 struct rx_desc {
-        u32 rdes0, rdes1, rdes2, rdes3; /* Data for the card */
+        __le32 rdes0, rdes1, rdes2, rdes3; /* Data for the card */
         struct sk_buff *rx_skb_ptr;     /* Data for us */
         struct rx_desc *next_rx_desc;
 } __attribute__(( aligned(32) ));
@@ -458,7 +458,7 @@ static int __devinit dmfe_init_one (struct pci_dev *pdev,
 
         /* read 64 word srom data */
         for (i = 0; i < 64; i++)
-                ((u16 *) db->srom)[i] =
+                ((__le16 *) db->srom)[i] =
                         cpu_to_le16(read_srom_word(db->ioaddr, i));
 
         /* Set Node address */
diff --git a/drivers/pnp/manager.c b/drivers/pnp/manager.c
index 5026b345cb30..57e6ab1004d0 100644
--- a/drivers/pnp/manager.c
+++ b/drivers/pnp/manager.c
@@ -451,7 +451,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
                 return -EINVAL;
 
         if(!pnp_can_configure(dev)) {
-                pnp_info("Device %s does not support resource configuration.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support resource configuration.", dev->dev.bus_id);
                 return -ENODEV;
         }
 
@@ -482,7 +482,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
 int pnp_start_dev(struct pnp_dev *dev)
 {
         if (!pnp_can_write(dev)) {
-                pnp_info("Device %s does not support activation.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support activation.", dev->dev.bus_id);
                 return -EINVAL;
         }
 
@@ -506,7 +506,7 @@ int pnp_start_dev(struct pnp_dev *dev)
 int pnp_stop_dev(struct pnp_dev *dev)
 {
         if (!pnp_can_disable(dev)) {
-                pnp_info("Device %s does not support disabling.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support disabling.", dev->dev.bus_id);
                 return -EINVAL;
         }
         if (dev->protocol->disable(dev)<0) {
diff --git a/drivers/ps3/ps3av_cmd.c b/drivers/ps3/ps3av_cmd.c
index 21c97c80aa2e..bc70e81f8cb0 100644
--- a/drivers/ps3/ps3av_cmd.c
+++ b/drivers/ps3/ps3av_cmd.c
@@ -485,12 +485,12 @@ static u8 ps3av_cnv_mclk(u32 fs)
 
 static const u32 ps3av_ns_table[][5] = {
                                         /*   D1,    D2,    D3,    D4,    D5 */
-        [PS3AV_CMD_AUDIO_FS_44K-BASE]   {  6272,  6272, 17836, 17836,  8918 },
-        [PS3AV_CMD_AUDIO_FS_48K-BASE]   {  6144,  6144, 11648, 11648,  5824 },
-        [PS3AV_CMD_AUDIO_FS_88K-BASE]   { 12544, 12544, 35672, 35672, 17836 },
-        [PS3AV_CMD_AUDIO_FS_96K-BASE]   { 12288, 12288, 23296, 23296, 11648 },
-        [PS3AV_CMD_AUDIO_FS_176K-BASE]  { 25088, 25088, 71344, 71344, 35672 },
-        [PS3AV_CMD_AUDIO_FS_192K-BASE]  { 24576, 24576, 46592, 46592, 23296 }
+        [PS3AV_CMD_AUDIO_FS_44K-BASE] = {  6272,  6272, 17836, 17836,  8918 },
+        [PS3AV_CMD_AUDIO_FS_48K-BASE] = {  6144,  6144, 11648, 11648,  5824 },
+        [PS3AV_CMD_AUDIO_FS_88K-BASE] = { 12544, 12544, 35672, 35672, 17836 },
+        [PS3AV_CMD_AUDIO_FS_96K-BASE] = { 12288, 12288, 23296, 23296, 11648 },
+        [PS3AV_CMD_AUDIO_FS_176K-BASE] =        { 25088, 25088, 71344, 71344, 35672 },
+        [PS3AV_CMD_AUDIO_FS_192K-BASE] =        { 24576, 24576, 46592, 46592, 23296 }
 };
 
 static void ps3av_cnv_ns(u8 *ns, u32 fs, u32 video_vid)
@@ -543,9 +543,10 @@ static void ps3av_cnv_ns(u8 *ns, u32 fs, u32 video_vid)
 
 #undef BASE
 
-static u8 ps3av_cnv_enable(u32 source, u8 *enable)
+static u8 ps3av_cnv_enable(u32 source, const u8 *enable)
 {
-        u8 *p, ret = 0;
+        const u8 *p;
+        u8 ret = 0;
 
         if (source == PS3AV_CMD_AUDIO_SOURCE_SPDIF) {
                 ret = 0x03;
@@ -559,9 +560,10 @@ static u8 ps3av_cnv_enable(u32 source, u8 *enable)
         return ret;
 }
 
-static u8 ps3av_cnv_fifomap(u8 *map)
+static u8 ps3av_cnv_fifomap(const u8 *map)
 {
-        u8 *p, ret = 0;
+        const u8 *p;
+        u8 ret = 0;
 
         p = map;
         ret = p[0] + (p[1] << 2) + (p[2] << 4) + (p[3] << 6);
@@ -615,7 +617,7 @@ static void ps3av_cnv_info(struct ps3av_audio_info_frame *info,
         info->pb5.lsv = mode->audio_downmix_level;
 }
 
-static void ps3av_cnv_chstat(u8 *chstat, u8 *cs_info)
+static void ps3av_cnv_chstat(u8 *chstat, const u8 *cs_info)
 {
         memcpy(chstat, cs_info, 5);
 }
diff --git a/drivers/ps3/vuart.c b/drivers/ps3/vuart.c
index 1adf186bfaf5..6c12744eeb9d 100644
--- a/drivers/ps3/vuart.c
+++ b/drivers/ps3/vuart.c
@@ -952,7 +952,7 @@ fail_alloc_irq:
         kfree(dev->priv);
         dev->priv = NULL;
 fail_alloc:
-        vuart_bus_priv.devices[port_number] = 0;
+        vuart_bus_priv.devices[port_number] = NULL;
 fail_match:
         up(&vuart_bus_priv.probe_mutex);
         dev_dbg(&dev->core, "%s:%d failed\n", __func__, __LINE__);
@@ -978,7 +978,7 @@ static int ps3_vuart_remove(struct device *_dev)
                 dev_dbg(&dev->core, "%s:%d: %s no remove method\n", __func__,
                         __LINE__, dev->core.bus_id);
 
-        vuart_bus_priv.devices[dev->priv->port_number] = 0;
+        vuart_bus_priv.devices[dev->priv->port_number] = NULL;
 
         if (--vuart_bus_priv.use_count == 0) {
                 BUG();
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index d48e3ca4752c..5aeb68e732b0 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -71,19 +71,31 @@ __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
  * Provide an 'ungroup' attribute so the user can remove group devices no
  * longer needed or accidentially created. Saves memory :)
  */
+static void ccwgroup_ungroup_callback(struct device *dev)
+{
+        struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
+
+        __ccwgroup_remove_symlinks(gdev);
+        device_unregister(dev);
+}
+
 static ssize_t
 ccwgroup_ungroup_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct ccwgroup_device *gdev;
+        int rc;
 
         gdev = to_ccwgroupdev(dev);
 
         if (gdev->state != CCWGROUP_OFFLINE)
                 return -EINVAL;
 
-        __ccwgroup_remove_symlinks(gdev);
-        device_unregister(dev);
-
+        /* Note that we cannot unregister the device from one of its
+         * attribute methods, so we have to use this roundabout approach.
+         */
+        rc = device_schedule_callback(dev, ccwgroup_ungroup_callback);
+        if (rc)
+                count = rc;
         return count;
 }
 
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index e95c281f1e36..84b108d7c7fd 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -873,7 +873,7 @@ qeth_realloc_headroom(struct qeth_card *card, struct sk_buff *skb, int size)
 }
 
 static inline struct sk_buff *
-qeth_pskb_unshare(struct sk_buff *skb, int pri)
+qeth_pskb_unshare(struct sk_buff *skb, gfp_t pri)
 {
         struct sk_buff *nskb;
         if (!skb_cloned(skb))
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index c275dcac3f18..939de0de18bc 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -452,10 +452,22 @@ store_rescan_field (struct device *dev, struct device_attribute *attr, const cha
 }
 static DEVICE_ATTR(rescan, S_IWUSR, NULL, store_rescan_field);
 
+static void sdev_store_delete_callback(struct device *dev)
+{
+        scsi_remove_device(to_scsi_device(dev));
+}
+
 static ssize_t sdev_store_delete(struct device *dev, struct device_attribute *attr, const char *buf,
                                  size_t count)
 {
-        scsi_remove_device(to_scsi_device(dev));
+        int rc;
+
+        /* An attribute cannot be unregistered by one of its own methods,
+         * so we have to use this roundabout approach.
+         */
+        rc = device_schedule_callback(dev, sdev_store_delete_callback);
+        if (rc)
+                count = rc;
         return count;
 };
 static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
diff --git a/drivers/spi/at25.c b/drivers/spi/at25.c
index 48e4f48e779f..8efa07e8b8c2 100644
--- a/drivers/spi/at25.c
+++ b/drivers/spi/at25.c
@@ -291,7 +291,7 @@ static int at25_probe(struct spi_device *spi)
          */
         sr = spi_w8r8(spi, AT25_RDSR);
         if (sr < 0 || sr & AT25_SR_nRDY) {
-                dev_dbg(&at25->spi->dev, "rdsr --> %d (%02x)\n", sr, sr);
+                dev_dbg(&spi->dev, "rdsr --> %d (%02x)\n", sr, sr);
                 err = -ENXIO;
                 goto fail;
         }
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index 6fa260d1a9be..66e7bc985797 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -425,7 +425,7 @@ static int atmel_spi_setup(struct spi_device *spi)
                 if (ret)
                         return ret;
                 spi->controller_state = (void *)npcs_pin;
-                gpio_direction_output(npcs_pin);
+                gpio_direction_output(npcs_pin, !(spi->mode & SPI_CS_HIGH));
         }
 
         dev_dbg(&spi->dev,
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
index 24a330d82395..88425e1af4d3 100644
--- a/drivers/spi/spi_bitbang.c
+++ b/drivers/spi/spi_bitbang.c
@@ -302,10 +302,6 @@ static void bitbang_work(struct work_struct *work)
                 setup_transfer = NULL;
 
                 list_for_each_entry (t, &m->transfers, transfer_list) {
-                        if (bitbang->shutdown) {
-                                status = -ESHUTDOWN;
-                                break;
-                        }
 
                         /* override or restore speed and wordsize */
                         if (t->speed_hz || t->bits_per_word) {
@@ -410,8 +406,6 @@ int spi_bitbang_transfer(struct spi_device *spi, struct spi_message *m)
         m->status = -EINPROGRESS;
 
         bitbang = spi_master_get_devdata(spi->master);
-        if (bitbang->shutdown)
-                return -ESHUTDOWN;
 
         spin_lock_irqsave(&bitbang->lock, flags);
         if (!spi->max_speed_hz)
@@ -507,28 +501,12 @@ EXPORT_SYMBOL_GPL(spi_bitbang_start);
  */
 int spi_bitbang_stop(struct spi_bitbang *bitbang)
 {
-        unsigned        limit = 500;
-
-        spin_lock_irq(&bitbang->lock);
-        bitbang->shutdown = 0;
-        while (!list_empty(&bitbang->queue) && limit--) {
-                spin_unlock_irq(&bitbang->lock);
+        spi_unregister_master(bitbang->master);
 
-                dev_dbg(bitbang->master->cdev.dev, "wait for queue\n");
-                msleep(10);
-
-                spin_lock_irq(&bitbang->lock);
-        }
-        spin_unlock_irq(&bitbang->lock);
-        if (!list_empty(&bitbang->queue)) {
-                dev_err(bitbang->master->cdev.dev, "queue didn't empty\n");
-                return -EBUSY;
-        }
+        WARN_ON(!list_empty(&bitbang->queue));
 
         destroy_workqueue(bitbang->workqueue);
 
-        spi_unregister_master(bitbang->master);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(spi_bitbang_stop);
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 651379c51ae6..220abce63e4a 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -41,7 +41,7 @@ struct s3c24xx_spi {
         int                      len;
         int                      count;
 
-        int                     (*set_cs)(struct s3c2410_spi_info *spi,
+        void                    (*set_cs)(struct s3c2410_spi_info *spi,
                                           int cs, int pol);
 
         /* data buffers */
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 7f5a59836818..e4f0dd00ae85 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1320,7 +1320,7 @@ config FB_AU1100
 
 config FB_AU1200
         bool "Au1200 LCD Driver"
-        depends on FB && MIPS && SOC_AU1200
+        depends on (FB = y) && MIPS && SOC_AU1200
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -1470,7 +1470,7 @@ config FB_G364
 
 config FB_68328
         bool "Motorola 68328 native frame buffer support"
-        depends on FB && (M68328 || M68EZ328 || M68VZ328)
+        depends on (FB = y) && (M68328 || M68EZ328 || M68VZ328)
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -1616,7 +1616,7 @@ config FB_IBM_GXT4500
 
 config FB_PS3
         bool "PS3 GPU framebuffer driver"
-        depends on FB && PS3_PS3AV
+        depends on (FB = y) && PS3_PS3AV
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/backlight/progear_bl.c b/drivers/video/backlight/progear_bl.c
index 702269357861..836ab4df0ef2 100644
--- a/drivers/video/backlight/progear_bl.c
+++ b/drivers/video/backlight/progear_bl.c
@@ -65,13 +65,13 @@ static int progearbl_probe(struct platform_device *pdev)
         u8 temp;
         struct backlight_device *progear_backlight_device;
 
-        pmu_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M7101, 0);
+        pmu_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M7101, NULL);
         if (!pmu_dev) {
                 printk("ALI M7101 PMU not found.\n");
                 return -ENODEV;
         }
 
-        sb_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M1533, 0);
+        sb_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M1533, NULL);
         if (!sb_dev) {
                 printk("ALI 1533 SB not found.\n");
                 pci_dev_put(pmu_dev);
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 4afa30522fdb..0166ec2ccf32 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -384,6 +384,19 @@ SavageSetup2DEngine(struct savagefb_par  *par)
         BCI_SEND(0);
         BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD2);
         BCI_SEND(GlobalBitmapDescriptor);
+
+        /*
+         * I don't know why, sending this twice fixes the intial black screen,
+         * prevents X from crashing at least in Toshiba laptops with SavageIX.
+         * --Tony
+         */
+        par->bci_ptr = 0;
+        par->SavageWaitFifo(par, 4);
+
+        BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD1);
+        BCI_SEND(0);
+        BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD2);
+        BCI_SEND(GlobalBitmapDescriptor);
 }
 
 static void savagefb_set_clip(struct fb_info *info)
@@ -496,7 +509,7 @@ static int common_calc_clock(long freq, int min_m, int min_n1, int max_n1,
 #ifdef SAVAGEFB_DEBUG
 /* This function is used to debug, it prints out the contents of s3 regs */
 
-static void SavagePrintRegs(void)
+static void SavagePrintRegs(struct savagefb_par *par)
 {
         unsigned char i;
         int vgaCRIndex = 0x3d4;
@@ -1525,7 +1538,7 @@ static int savagefb_set_par(struct fb_info *info)
         savagefb_set_fix(info);
         savagefb_set_clip(info);
 
-        SavagePrintRegs();
+        SavagePrintRegs(par);
         return 0;
 }
 
@@ -2155,7 +2168,6 @@ static int __devinit savagefb_probe(struct pci_dev* dev,
         int video_len;
 
         DBG("savagefb_probe");
-        SavagePrintRegs();
 
         info = framebuffer_alloc(sizeof(struct savagefb_par), &dev->dev);
         if (!info)
diff --git a/drivers/video/sstfb.c b/drivers/video/sstfb.c
index 59cd1e750f30..62fa5500361d 100644
--- a/drivers/video/sstfb.c
+++ b/drivers/video/sstfb.c
@@ -257,6 +257,7 @@ static void __sst_dac_write(u8 __iomem *vbase, u8 reg, u8 val)
         r_dprintk("sst_dac_write(%#x, %#x)\n", reg, val);
         reg &= 0x07;
         __sst_write(vbase, DAC_DATA,(((u32)reg << 8)) | (u32)val);
+        __sst_wait_idle(vbase);
 }
 
 /* indexed access to ti/att dacs */
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 51db1182b27e..a2fceba7ef8e 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -507,7 +507,7 @@ out:
 #define INTERPRETER_ELF 2
 
 #ifndef STACK_RND_MASK
-#define STACK_RND_MASK 0x7ff            /* with 4K pages 8MB of VA */
+#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 #endif
 
 static unsigned long randomize_stack_top(unsigned long stack_top)
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 0efdf35aab2c..3af76249dc8b 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -220,7 +220,7 @@
  */
 #define CIFS_NO_HANDLE        0xFFFF
 
-#define NO_CHANGE_64          0xFFFFFFFFFFFFFFFFULL
+#define NO_CHANGE_64          cpu_to_le64(0xFFFFFFFFFFFFFFFFULL)
 #define NO_CHANGE_32          0xFFFFFFFFUL
 
 /* IPC$ in ASCII */
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 34750d5e4ff2..5e6e37e58f36 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1141,25 +1141,22 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys)
 
         err = -ENOMEM;
         dentry = d_alloc(configfs_sb->s_root, &name);
-        if (!dentry)
-                goto out_release;
-
-        d_add(dentry, NULL);
+        if (dentry) {
+                d_add(dentry, NULL);
 
-        err = configfs_attach_group(sd->s_element, &group->cg_item,
-                                    dentry);
-        if (!err)
-                dentry = NULL;
-        else
-                d_delete(dentry);
+                err = configfs_attach_group(sd->s_element, &group->cg_item,
+                                            dentry);
+                if (err) {
+                        d_delete(dentry);
+                        dput(dentry);
+                }
+        }
 
         mutex_unlock(&configfs_sb->s_root->d_inode->i_mutex);
 
-        if (dentry) {
-            dput(dentry);
-out_release:
-            unlink_group(group);
-            configfs_release_fs();
+        if (err) {
+                unlink_group(group);
+                configfs_release_fs();
         }
 
         return err;
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 329efcd3d8c9..cb20b964419f 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -78,18 +78,13 @@ struct kmem_cache *ecryptfs_dentry_info_cache;
  */
 static void ecryptfs_d_release(struct dentry *dentry)
 {
-        struct dentry *lower_dentry;
-
-        lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        if (ecryptfs_dentry_to_private(dentry))
+        if (ecryptfs_dentry_to_private(dentry)) {
+                if (ecryptfs_dentry_to_lower(dentry)) {
+                        mntput(ecryptfs_dentry_to_lower_mnt(dentry));
+                        dput(ecryptfs_dentry_to_lower(dentry));
+                }
                 kmem_cache_free(ecryptfs_dentry_info_cache,
                                 ecryptfs_dentry_to_private(dentry));
-        if (lower_dentry) {
-                struct vfsmount *lower_mnt =
-                        ecryptfs_dentry_to_lower_mnt(dentry);
-
-                mntput(lower_mnt);
-                dput(lower_dentry);
         }
         return;
 }
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index af53c02f473b..93d046c85f52 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -429,7 +429,8 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
         int err;
 
         /* Flush out writes to the server in order to update c/mtime */
-        nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
+        if (S_ISREG(inode->i_mode))
+                nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
 
         /*
          * We may force a getattr if the user cares about atime.
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index bb516a2cfbaf..f1eae44b9a1a 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -151,10 +151,10 @@ int __init register_nfs_fs(void)
         if (ret < 0)
                 goto error_0;
 
-#ifdef CONFIG_NFS_V4
         ret = nfs_register_sysctl();
         if (ret < 0)
                 goto error_1;
+#ifdef CONFIG_NFS_V4
         ret = register_filesystem(&nfs4_fs_type);
         if (ret < 0)
                 goto error_2;
@@ -165,9 +165,9 @@ int __init register_nfs_fs(void)
 #ifdef CONFIG_NFS_V4
 error_2:
         nfs_unregister_sysctl();
+#endif
 error_1:
         unregister_filesystem(&nfs_fs_type);
-#endif
 error_0:
         return ret;
 }
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index fcdcafbb3293..b62481dabae9 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -50,6 +50,14 @@ static ctl_table nfs_cb_sysctls[] = {
                 .proc_handler   = &proc_dointvec_jiffies,
                 .strategy       = &sysctl_jiffies,
         },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "nfs_congestion_kb",
+                .data           = &nfs_congestion_kb,
+                .maxlen         = sizeof(nfs_congestion_kb),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
         { .ctl_name = 0 }
 };
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index febdade91670..2867e6b7096f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -12,6 +12,7 @@
 #include <linux/pagemap.h>
 #include <linux/file.h>
 #include <linux/writeback.h>
+#include <linux/swap.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs_fs.h>
@@ -38,7 +39,6 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context*,
                                             struct page *,
                                             unsigned int, unsigned int);
 static void nfs_mark_request_dirty(struct nfs_page *req);
-static int nfs_wait_on_write_congestion(struct address_space *, int);
 static long nfs_flush_mapping(struct address_space *mapping, struct writeback_control *wbc, int how);
 static const struct rpc_call_ops nfs_write_partial_ops;
 static const struct rpc_call_ops nfs_write_full_ops;
@@ -48,8 +48,6 @@ static struct kmem_cache *nfs_wdata_cachep;
 static mempool_t *nfs_wdata_mempool;
 static mempool_t *nfs_commit_mempool;
 
-static DECLARE_WAIT_QUEUE_HEAD(nfs_write_congestion);
-
 struct nfs_write_data *nfs_commit_alloc(void)
 {
         struct nfs_write_data *p = mempool_alloc(nfs_commit_mempool, GFP_NOFS);
@@ -211,6 +209,40 @@ static int wb_priority(struct writeback_control *wbc)
 }
 
 /*
+ * NFS congestion control
+ */
+
+int nfs_congestion_kb;
+
+#define NFS_CONGESTION_ON_THRESH        (nfs_congestion_kb >> (PAGE_SHIFT-10))
+#define NFS_CONGESTION_OFF_THRESH       \
+        (NFS_CONGESTION_ON_THRESH - (NFS_CONGESTION_ON_THRESH >> 2))
+
+static void nfs_set_page_writeback(struct page *page)
+{
+        if (!test_set_page_writeback(page)) {
+                struct inode *inode = page->mapping->host;
+                struct nfs_server *nfss = NFS_SERVER(inode);
+
+                if (atomic_inc_return(&nfss->writeback) >
+                                NFS_CONGESTION_ON_THRESH)
+                        set_bdi_congested(&nfss->backing_dev_info, WRITE);
+        }
+}
+
+static void nfs_end_page_writeback(struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        struct nfs_server *nfss = NFS_SERVER(inode);
+
+        end_page_writeback(page);
+        if (atomic_dec_return(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH) {
+                clear_bdi_congested(&nfss->backing_dev_info, WRITE);
+                congestion_end(WRITE);
+        }
+}
+
+/*
  * Find an associated nfs write request, and prepare to flush it out
  * Returns 1 if there was no write request, or if the request was
  * already tagged by nfs_set_page_dirty.Returns 0 if the request
@@ -247,7 +279,7 @@ static int nfs_page_mark_flush(struct page *page)
         spin_unlock(req_lock);
         if (test_and_set_bit(PG_FLUSHING, &req->wb_flags) == 0) {
                 nfs_mark_request_dirty(req);
-                set_page_writeback(page);
+                nfs_set_page_writeback(page);
         }
         ret = test_bit(PG_NEED_FLUSH, &req->wb_flags);
         nfs_unlock_request(req);
@@ -302,13 +334,8 @@ int nfs_writepage(struct page *page, struct writeback_control *wbc)
         return err; 
 }
 
-/*
- * Note: causes nfs_update_request() to block on the assumption
- *       that the writeback is generated due to memory pressure.
- */
 int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
 {
-        struct backing_dev_info *bdi = mapping->backing_dev_info;
         struct inode *inode = mapping->host;
         int err;
 
@@ -317,20 +344,12 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
         err = generic_writepages(mapping, wbc);
         if (err)
                 return err;
-        while (test_and_set_bit(BDI_write_congested, &bdi->state) != 0) {
-                if (wbc->nonblocking)
-                        return 0;
-                nfs_wait_on_write_congestion(mapping, 0);
-        }
         err = nfs_flush_mapping(mapping, wbc, wb_priority(wbc));
         if (err < 0)
                 goto out;
         nfs_add_stats(inode, NFSIOS_WRITEPAGES, err);
         err = 0;
 out:
-        clear_bit(BDI_write_congested, &bdi->state);
-        wake_up_all(&nfs_write_congestion);
-        congestion_end(WRITE);
         return err;
 }
 
@@ -360,7 +379,7 @@ static int nfs_inode_add_request(struct inode *inode, struct nfs_page *req)
 }
 
 /*
- * Insert a write request into an inode
+ * Remove a write request from an inode
  */
 static void nfs_inode_remove_request(struct nfs_page *req)
 {
@@ -531,10 +550,10 @@ static inline int nfs_scan_commit(struct inode *inode, struct list_head *dst, un
 }
 #endif
 
-static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
+static int nfs_wait_on_write_congestion(struct address_space *mapping)
 {
+        struct inode *inode = mapping->host;
         struct backing_dev_info *bdi = mapping->backing_dev_info;
-        DEFINE_WAIT(wait);
         int ret = 0;
 
         might_sleep();
@@ -542,31 +561,23 @@ static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
         if (!bdi_write_congested(bdi))
                 return 0;
 
-        nfs_inc_stats(mapping->host, NFSIOS_CONGESTIONWAIT);
+        nfs_inc_stats(inode, NFSIOS_CONGESTIONWAIT);
 
-        if (intr) {
-                struct rpc_clnt *clnt = NFS_CLIENT(mapping->host);
+        do {
+                struct rpc_clnt *clnt = NFS_CLIENT(inode);
                 sigset_t oldset;
 
                 rpc_clnt_sigmask(clnt, &oldset);
-                prepare_to_wait(&nfs_write_congestion, &wait, TASK_INTERRUPTIBLE);
-                if (bdi_write_congested(bdi)) {
-                        if (signalled())
-                                ret = -ERESTARTSYS;
-                        else
-                                schedule();
-                }
+                ret = congestion_wait_interruptible(WRITE, HZ/10);
                 rpc_clnt_sigunmask(clnt, &oldset);
-        } else {
-                prepare_to_wait(&nfs_write_congestion, &wait, TASK_UNINTERRUPTIBLE);
-                if (bdi_write_congested(bdi))
-                        schedule();
-        }
-        finish_wait(&nfs_write_congestion, &wait);
+                if (ret == -ERESTARTSYS)
+                        break;
+                ret = 0;
+        } while (bdi_write_congested(bdi));
+
         return ret;
 }
 
-
 /*
  * Try to update any existing write request, or create one if there is none.
  * In order to match, the request's credentials must match those of
@@ -577,14 +588,15 @@ static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
 static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
                 struct page *page, unsigned int offset, unsigned int bytes)
 {
-        struct inode *inode = page->mapping->host;
+        struct address_space *mapping = page->mapping;
+        struct inode *inode = mapping->host;
         struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_page         *req, *new = NULL;
         unsigned long           rqend, end;
 
         end = offset + bytes;
 
-        if (nfs_wait_on_write_congestion(page->mapping, NFS_SERVER(inode)->flags & NFS_MOUNT_INTR))
+        if (nfs_wait_on_write_congestion(mapping))
                 return ERR_PTR(-ERESTARTSYS);
         for (;;) {
                 /* Loop over all inode entries and see if we find
@@ -727,7 +739,7 @@ int nfs_updatepage(struct file *file, struct page *page,
 
 static void nfs_writepage_release(struct nfs_page *req)
 {
-        end_page_writeback(req->wb_page);
+        nfs_end_page_writeback(req->wb_page);
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
         if (!PageError(req->wb_page)) {
@@ -1042,12 +1054,12 @@ static void nfs_writeback_done_full(struct rpc_task *task, void *calldata)
                 if (task->tk_status < 0) {
                         nfs_set_pageerror(page);
                         req->wb_context->error = task->tk_status;
-                        end_page_writeback(page);
+                        nfs_end_page_writeback(page);
                         nfs_inode_remove_request(req);
                         dprintk(", error = %d\n", task->tk_status);
                         goto next;
                 }
-                end_page_writeback(page);
+                nfs_end_page_writeback(page);
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
                 if (data->args.stable != NFS_UNSTABLE || data->verf.committed == NFS_FILE_SYNC) {
@@ -1514,6 +1526,26 @@ int __init nfs_init_writepagecache(void)
         if (nfs_commit_mempool == NULL)
                 return -ENOMEM;
 
+        /*
+         * NFS congestion size, scale with available memory.
+         *
+         *  64MB:    8192k
+         * 128MB:   11585k
+         * 256MB:   16384k
+         * 512MB:   23170k
+         *   1GB:   32768k
+         *   2GB:   46340k
+         *   4GB:   65536k
+         *   8GB:   92681k
+         *  16GB:  131072k
+         *
+         * This allows larger machines to have larger/more transfers.
+         * Limit the default to 256M
+         */
+        nfs_congestion_kb = (16*int_sqrt(totalram_pages)) << (PAGE_SHIFT-10);
+        if (nfs_congestion_kb > 256*1024)
+                nfs_congestion_kb = 256*1024;
+
         return 0;
 }
 
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index c2660cbfcd96..8d995bcef806 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -17,7 +17,6 @@
 #include <linux/stat.h>
 #include <linux/dcache.h>
 #include <linux/mount.h>
-#include <asm/pgtable.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/svc.h>
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 93628b02ef5d..875c11443817 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -614,6 +614,27 @@ static void ocfs2_dio_end_io(struct kiocb *iocb,
         ocfs2_rw_unlock(inode, 0);
 }
 
+/*
+ * ocfs2_invalidatepage() and ocfs2_releasepage() are shamelessly stolen
+ * from ext3.  PageChecked() bits have been removed as OCFS2 does not
+ * do journalled data.
+ */
+static void ocfs2_invalidatepage(struct page *page, unsigned long offset)
+{
+        journal_t *journal = OCFS2_SB(page->mapping->host->i_sb)->journal->j_journal;
+
+        journal_invalidatepage(journal, page, offset);
+}
+
+static int ocfs2_releasepage(struct page *page, gfp_t wait)
+{
+        journal_t *journal = OCFS2_SB(page->mapping->host->i_sb)->journal->j_journal;
+
+        if (!page_has_buffers(page))
+                return 0;
+        return journal_try_to_free_buffers(journal, page, wait);
+}
+
 static ssize_t ocfs2_direct_IO(int rw,
                                struct kiocb *iocb,
                                const struct iovec *iov,
@@ -661,5 +682,8 @@ const struct address_space_operations ocfs2_aops = {
         .commit_write   = ocfs2_commit_write,
         .bmap           = ocfs2_bmap,
         .sync_page      = block_sync_page,
-        .direct_IO      = ocfs2_direct_IO
+        .direct_IO      = ocfs2_direct_IO,
+        .invalidatepage = ocfs2_invalidatepage,
+        .releasepage    = ocfs2_releasepage,
+        .migratepage    = buffer_migrate_page,
 };
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 5a9779bb9236..eba282da500e 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1234,6 +1234,7 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
                                      const char *page,
                                      size_t count)
 {
+        struct task_struct *hb_task;
         long fd;
         int sectsize;
         char *p = (char *)page;
@@ -1319,20 +1320,28 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
          */
         atomic_set(&reg->hr_steady_iterations, O2HB_LIVE_THRESHOLD + 1);
 
-        reg->hr_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
-                                   reg->hr_item.ci_name);
-        if (IS_ERR(reg->hr_task)) {
-                ret = PTR_ERR(reg->hr_task);
+        hb_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
+                              reg->hr_item.ci_name);
+        if (IS_ERR(hb_task)) {
+                ret = PTR_ERR(hb_task);
                 mlog_errno(ret);
-                reg->hr_task = NULL;
                 goto out;
         }
 
+        spin_lock(&o2hb_live_lock);
+        reg->hr_task = hb_task;
+        spin_unlock(&o2hb_live_lock);
+
         ret = wait_event_interruptible(o2hb_steady_queue,
                                 atomic_read(&reg->hr_steady_iterations) == 0);
         if (ret) {
-                kthread_stop(reg->hr_task);
+                spin_lock(&o2hb_live_lock);
+                hb_task = reg->hr_task;
                 reg->hr_task = NULL;
+                spin_unlock(&o2hb_live_lock);
+
+                if (hb_task)
+                        kthread_stop(hb_task);
                 goto out;
         }
 
@@ -1354,10 +1363,17 @@ out:
 static ssize_t o2hb_region_pid_read(struct o2hb_region *reg,
                                       char *page)
 {
-        if (!reg->hr_task)
+        pid_t pid = 0;
+
+        spin_lock(&o2hb_live_lock);
+        if (reg->hr_task)
+                pid = reg->hr_task->pid;
+        spin_unlock(&o2hb_live_lock);
+
+        if (!pid)
                 return 0;
 
-        return sprintf(page, "%u\n", reg->hr_task->pid);
+        return sprintf(page, "%u\n", pid);
 }
 
 struct o2hb_region_attribute {
@@ -1495,13 +1511,17 @@ out:
 static void o2hb_heartbeat_group_drop_item(struct config_group *group,
                                            struct config_item *item)
 {
+        struct task_struct *hb_task;
         struct o2hb_region *reg = to_o2hb_region(item);
 
         /* stop the thread when the user removes the region dir */
-        if (reg->hr_task) {
-                kthread_stop(reg->hr_task);
-                reg->hr_task = NULL;
-        }
+        spin_lock(&o2hb_live_lock);
+        hb_task = reg->hr_task;
+        reg->hr_task = NULL;
+        spin_unlock(&o2hb_live_lock);
+
+        if (hb_task)
+                kthread_stop(hb_task);
 
         config_item_put(item);
 }
@@ -1682,7 +1702,7 @@ out:
 }
 EXPORT_SYMBOL_GPL(o2hb_register_callback);
 
-int o2hb_unregister_callback(struct o2hb_callback_func *hc)
+void o2hb_unregister_callback(struct o2hb_callback_func *hc)
 {
         BUG_ON(hc->hc_magic != O2HB_CB_MAGIC);
 
@@ -1690,15 +1710,13 @@ int o2hb_unregister_callback(struct o2hb_callback_func *hc)
              __builtin_return_address(0), hc);
 
         if (list_empty(&hc->hc_item))
-                return 0;
+                return;
 
         down_write(&o2hb_callback_sem);
 
         list_del_init(&hc->hc_item);
 
         up_write(&o2hb_callback_sem);
-
-        return 0;
 }
 EXPORT_SYMBOL_GPL(o2hb_unregister_callback);
 
diff --git a/fs/ocfs2/cluster/heartbeat.h b/fs/ocfs2/cluster/heartbeat.h
index cac6223206a9..cc6d40b39771 100644
--- a/fs/ocfs2/cluster/heartbeat.h
+++ b/fs/ocfs2/cluster/heartbeat.h
@@ -70,7 +70,7 @@ void o2hb_setup_callback(struct o2hb_callback_func *hc,
                          void *data,
                          int priority);
 int o2hb_register_callback(struct o2hb_callback_func *hc);
-int o2hb_unregister_callback(struct o2hb_callback_func *hc);
+void o2hb_unregister_callback(struct o2hb_callback_func *hc);
 void o2hb_fill_node_map(unsigned long *map,
                         unsigned bytes);
 void o2hb_init(void);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 1718215fc018..69caf3e12fea 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1638,17 +1638,8 @@ static void o2net_hb_node_up_cb(struct o2nm_node *node, int node_num,
 
 void o2net_unregister_hb_callbacks(void)
 {
-        int ret;
-
-        ret = o2hb_unregister_callback(&o2net_hb_up);
-        if (ret < 0)
-                mlog(ML_ERROR, "Status return %d unregistering heartbeat up "
-                     "callback!\n", ret);
-
-        ret = o2hb_unregister_callback(&o2net_hb_down);
-        if (ret < 0)
-                mlog(ML_ERROR, "Status return %d unregistering heartbeat down "
-                     "callback!\n", ret);
+        o2hb_unregister_callback(&o2net_hb_up);
+        o2hb_unregister_callback(&o2net_hb_down);
 }
 
 int o2net_register_hb_callbacks(void)
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 77e4e6169a0d..9229e04362f6 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2730,14 +2730,17 @@ int dlm_empty_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
         int ret;
         int lock_dropped = 0;
 
+        spin_lock(&res->spinlock);
         if (res->owner != dlm->node_num) {
                 if (!__dlm_lockres_unused(res)) {
                         mlog(ML_ERROR, "%s:%.*s: this node is not master, "
                              "trying to free this but locks remain\n",
                              dlm->name, res->lockname.len, res->lockname.name);
                 }
+                spin_unlock(&res->spinlock);
                 goto leave;
         }
+        spin_unlock(&res->spinlock);
 
         /* Wheee! Migrate lockres here! Will sleep so drop spinlock. */
         spin_unlock(&dlm->spinlock);
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index 8ffa0916eb86..6421a8fae1de 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -265,8 +265,10 @@ static void dlm_run_purge_list(struct dlm_ctxt *dlm,
                 /* This may drop and reacquire the dlm spinlock if it
                  * has to do migration. */
                 mlog(0, "calling dlm_purge_lockres!\n");
+                dlm_lockres_get(lockres);
                 if (dlm_purge_lockres(dlm, lockres))
                         BUG();
+                dlm_lockres_put(lockres);
                 mlog(0, "DONE calling dlm_purge_lockres!\n");
 
                 /* Avoid adding any scheduling latencies */
diff --git a/fs/ocfs2/heartbeat.c b/fs/ocfs2/heartbeat.c
index 8fc52d6d0ce7..b25ef63781ba 100644
--- a/fs/ocfs2/heartbeat.c
+++ b/fs/ocfs2/heartbeat.c
@@ -164,8 +164,10 @@ int ocfs2_register_hb_callbacks(struct ocfs2_super *osb)
         }
 
         status = o2hb_register_callback(&osb->osb_hb_up);
-        if (status < 0)
+        if (status < 0) {
                 mlog_errno(status);
+                o2hb_unregister_callback(&osb->osb_hb_down);
+        }
 
 bail:
         return status;
@@ -173,18 +175,11 @@ bail:
 
 void ocfs2_clear_hb_callbacks(struct ocfs2_super *osb)
 {
-        int status;
-
         if (ocfs2_mount_local(osb))
                 return;
 
-        status = o2hb_unregister_callback(&osb->osb_hb_down);
-        if (status < 0)
-                mlog_errno(status);
-
-        status = o2hb_unregister_callback(&osb->osb_hb_up);
-        if (status < 0)
-                mlog_errno(status);
+        o2hb_unregister_callback(&osb->osb_hb_down);
+        o2hb_unregister_callback(&osb->osb_hb_up);
 }
 
 void ocfs2_stop_heartbeat(struct ocfs2_super *osb)
diff --git a/fs/partitions/Kconfig b/fs/partitions/Kconfig
index 74552c60b671..6e8bb66fe619 100644
--- a/fs/partitions/Kconfig
+++ b/fs/partitions/Kconfig
@@ -235,5 +235,4 @@ config EFI_PARTITION
         select CRC32
         help
           Say Y here if you would like to use hard disks under Linux which
-          were partitioned using EFI GPT.  Presently only useful on the
-          IA-64 platform.
+          were partitioned using EFI GPT.
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index e46d237b10f9..8a7d0035ad7a 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -541,7 +541,7 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
         if (!get_capacity(disk) || !(state = check_partition(disk, bdev)))
                 return 0;
         if (IS_ERR(state))      /* I/O error reading the partition table */
-                return PTR_ERR(state);
+                return -EIO;
         for (p = 1; p < state->limit; p++) {
                 sector_t size = state->parts[p].size;
                 sector_t from = state->parts[p].from;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 01f7769da8e6..989af5e55d1b 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1558,29 +1558,20 @@ static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
                                   size_t count, loff_t *ppos)
 {
         struct inode * inode = file->f_path.dentry->d_inode;
-        unsigned long page;
+        char *p = NULL;
         ssize_t length;
         struct task_struct *task = get_proc_task(inode);
 
-        length = -ESRCH;
         if (!task)
-                goto out_no_task;
-
-        if (count > PAGE_SIZE)
-                count = PAGE_SIZE;
-        length = -ENOMEM;
-        if (!(page = __get_free_page(GFP_KERNEL)))
-                goto out;
+                return -ESRCH;
 
         length = security_getprocattr(task,
                                       (char*)file->f_path.dentry->d_name.name,
-                                      (void*)page, count);
-        if (length >= 0)
-                length = simple_read_from_buffer(buf, count, ppos, (char *)page, length);
-        free_page(page);
-out:
+                                      &p);
         put_task_struct(task);
-out_no_task:
+        if (length > 0)
+                length = simple_read_from_buffer(buf, count, ppos, p, length);
+        kfree(p);
         return length;
 }
 
diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
index 42261dbdf60f..723f7c667661 100644
--- a/fs/smbfs/request.c
+++ b/fs/smbfs/request.c
@@ -181,6 +181,7 @@ static int smb_setup_request(struct smb_request *req)
         req->rq_errno = 0;
         req->rq_fragment = 0;
         kfree(req->rq_trans2buffer);
+        req->rq_trans2buffer = NULL;
 
         return 0;
 }
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 8d4d839a9d88..fc4633378dc0 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -168,12 +168,12 @@ sysfs_read_file(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         ssize_t retval = 0;
 
         down(&buffer->sem);
-        if (buffer->orphaned) {
-                retval = -ENODEV;
-                goto out;
-        }
         if (buffer->needs_read_fill) {
-                if ((retval = fill_read_buffer(file->f_path.dentry,buffer)))
+                if (buffer->orphaned)
+                        retval = -ENODEV;
+                else
+                        retval = fill_read_buffer(file->f_path.dentry,buffer);
+                if (retval)
                         goto out;
         }
         pr_debug("%s: count = %zd, ppos = %lld, buf = %s\n",
@@ -629,6 +629,60 @@ void sysfs_remove_file_from_group(struct kobject *kobj,
 }
 EXPORT_SYMBOL_GPL(sysfs_remove_file_from_group);
 
+struct sysfs_schedule_callback_struct {
+        struct kobject          *kobj;
+        void                    (*func)(void *);
+        void                    *data;
+        struct work_struct      work;
+};
+
+static void sysfs_schedule_callback_work(struct work_struct *work)
+{
+        struct sysfs_schedule_callback_struct *ss = container_of(work,
+                        struct sysfs_schedule_callback_struct, work);
+
+        (ss->func)(ss->data);
+        kobject_put(ss->kobj);
+        kfree(ss);
+}
+
+/**
+ * sysfs_schedule_callback - helper to schedule a callback for a kobject
+ * @kobj: object we're acting for.
+ * @func: callback function to invoke later.
+ * @data: argument to pass to @func.
+ *
+ * sysfs attribute methods must not unregister themselves or their parent
+ * kobject (which would amount to the same thing).  Attempts to do so will
+ * deadlock, since unregistration is mutually exclusive with driver
+ * callbacks.
+ *
+ * Instead methods can call this routine, which will attempt to allocate
+ * and schedule a workqueue request to call back @func with @data as its
+ * argument in the workqueue's process context.  @kobj will be pinned
+ * until @func returns.
+ *
+ * Returns 0 if the request was submitted, -ENOMEM if storage could not
+ * be allocated.
+ */
+int sysfs_schedule_callback(struct kobject *kobj, void (*func)(void *),
+                void *data)
+{
+        struct sysfs_schedule_callback_struct *ss;
+
+        ss = kmalloc(sizeof(*ss), GFP_KERNEL);
+        if (!ss)
+                return -ENOMEM;
+        kobject_get(kobj);
+        ss->kobj = kobj;
+        ss->func = func;
+        ss->data = data;
+        INIT_WORK(&ss->work, sysfs_schedule_callback_work);
+        schedule_work(&ss->work);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(sysfs_schedule_callback);
+
 
 EXPORT_SYMBOL_GPL(sysfs_create_file);
 EXPORT_SYMBOL_GPL(sysfs_remove_file);
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index ccb7d722c558..4de5c6b89918 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -222,13 +222,17 @@ const unsigned char * sysfs_get_name(struct sysfs_dirent *sd)
 
 static inline void orphan_all_buffers(struct inode *node)
 {
-        struct sysfs_buffer_collection *set = node->i_private;
+        struct sysfs_buffer_collection *set;
         struct sysfs_buffer *buf;
 
         mutex_lock_nested(&node->i_mutex, I_MUTEX_CHILD);
-        if (node->i_private) {
-                list_for_each_entry(buf, &set->associates, associates)
+        set = node->i_private;
+        if (set) {
+                list_for_each_entry(buf, &set->associates, associates) {
+                        down(&buf->sem);
                         buf->orphaned = 1;
+                        up(&buf->sem);
+                }
         }
         mutex_unlock(&node->i_mutex);
 }
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index bcc44084e004..841ac25fd950 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -244,62 +244,87 @@ failed:
  * We can come here from ufs_writepage or ufs_prepare_write,
  * locked_page is argument of these functions, so we already lock it.
  */
-static void ufs_change_blocknr(struct inode *inode, unsigned int beg,
-                               unsigned int count, unsigned int oldb,
-                               unsigned int newb, struct page *locked_page)
+static void ufs_change_blocknr(struct inode *inode, sector_t beg,
+                               unsigned int count, sector_t oldb,
+                               sector_t newb, struct page *locked_page)
 {
-        const unsigned mask = (1 << (PAGE_CACHE_SHIFT - inode->i_blkbits)) - 1;
+        const unsigned blks_per_page =
+                1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        const unsigned mask = blks_per_page - 1;
         struct address_space * const mapping = inode->i_mapping;
-        pgoff_t index, cur_index;
-        unsigned end, pos, j;
+        pgoff_t index, cur_index, last_index;
+        unsigned pos, j, lblock;
+        sector_t end, i;
         struct page *page;
         struct buffer_head *head, *bh;
 
-        UFSD("ENTER, ino %lu, count %u, oldb %u, newb %u\n",
-              inode->i_ino, count, oldb, newb);
+        UFSD("ENTER, ino %lu, count %u, oldb %llu, newb %llu\n",
+              inode->i_ino, count,
+             (unsigned long long)oldb, (unsigned long long)newb);
 
         BUG_ON(!locked_page);
         BUG_ON(!PageLocked(locked_page));
 
         cur_index = locked_page->index;
-
-        for (end = count + beg; beg < end; beg = (beg | mask) + 1) {
-                index = beg >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        end = count + beg;
+        last_index = end >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        for (i = beg; i < end; i = (i | mask) + 1) {
+                index = i >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
 
                 if (likely(cur_index != index)) {
                         page = ufs_get_locked_page(mapping, index);
-                        if (!page || IS_ERR(page)) /* it was truncated or EIO */
+                        if (!page)/* it was truncated */
+                                continue;
+                        if (IS_ERR(page)) {/* or EIO */
+                                ufs_error(inode->i_sb, __FUNCTION__,
+                                          "read of page %llu failed\n",
+                                          (unsigned long long)index);
                                 continue;
+                        }
                 } else
                         page = locked_page;
 
                 head = page_buffers(page);
                 bh = head;
-                pos = beg & mask;
+                pos = i & mask;
                 for (j = 0; j < pos; ++j)
                         bh = bh->b_this_page;
-                j = 0;
+
+
+                if (unlikely(index == last_index))
+                        lblock = end & mask;
+                else
+                        lblock = blks_per_page;
+
                 do {
-                        if (buffer_mapped(bh)) {
-                                pos = bh->b_blocknr - oldb;
-                                if (pos < count) {
-                                        UFSD(" change from %llu to %llu\n",
-                                             (unsigned long long)pos + oldb,
-                                             (unsigned long long)pos + newb);
-                                        bh->b_blocknr = newb + pos;
-                                        unmap_underlying_metadata(bh->b_bdev,
-                                                                  bh->b_blocknr);
-                                        mark_buffer_dirty(bh);
-                                        ++j;
+                        if (j >= lblock)
+                                break;
+                        pos = (i - beg) + j;
+
+                        if (!buffer_mapped(bh))
+                                        map_bh(bh, inode->i_sb, oldb + pos);
+                        if (!buffer_uptodate(bh)) {
+                                ll_rw_block(READ, 1, &bh);
+                                wait_on_buffer(bh);
+                                if (!buffer_uptodate(bh)) {
+                                        ufs_error(inode->i_sb, __FUNCTION__,
+                                                  "read of block failed\n");
+                                        break;
                                 }
                         }
 
+                        UFSD(" change from %llu to %llu, pos %u\n",
+                             (unsigned long long)pos + oldb,
+                             (unsigned long long)pos + newb, pos);
+
+                        bh->b_blocknr = newb + pos;
+                        unmap_underlying_metadata(bh->b_bdev,
+                                                  bh->b_blocknr);
+                        mark_buffer_dirty(bh);
+                        ++j;
                         bh = bh->b_this_page;
                 } while (bh != head);
 
-                if (j)
-                        set_page_dirty(page);
-
                 if (likely(cur_index != index))
                         ufs_put_locked_page(page);
         }
@@ -457,8 +482,9 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         if (result) {
                 ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
                                 locked_page != NULL);
-                ufs_change_blocknr(inode, fragment - oldcount, oldcount, tmp,
-                                   result, locked_page);
+                ufs_change_blocknr(inode, fragment - oldcount, oldcount,
+                                   uspi->s_sbbase + tmp,
+                                   uspi->s_sbbase + result, locked_page);
                 ufs_cpu_to_data_ptr(sb, p, result);
                 *err = 0;
                 UFS_I(inode)->i_lastfrag = max_t(u32, UFS_I(inode)->i_lastfrag, fragment + count);
diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c
index b868878009b6..c28a8b6f2feb 100644
--- a/fs/ufs/ialloc.c
+++ b/fs/ufs/ialloc.c
@@ -343,9 +343,8 @@ cg_found:
                 lock_buffer(bh);
                 ufs2_inode = (struct ufs2_inode *)bh->b_data;
                 ufs2_inode += ufs_inotofsbo(inode->i_ino);
-                ufs2_inode->ui_birthtime.tv_sec =
-                        cpu_to_fs32(sb, CURRENT_TIME_SEC.tv_sec);
-                ufs2_inode->ui_birthtime.tv_usec = 0;
+                ufs2_inode->ui_birthtime = cpu_to_fs64(sb, CURRENT_TIME.tv_sec);
+                ufs2_inode->ui_birthnsec = cpu_to_fs32(sb, CURRENT_TIME.tv_nsec);
                 mark_buffer_dirty(bh);
                 unlock_buffer(bh);
                 if (sb->s_flags & MS_SYNCHRONOUS)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index fb34ad03e224..013d7afe7cde 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -212,7 +212,7 @@ repeat:
                         brelse (result);
                         goto repeat;
                 } else {
-                        *phys = tmp + blockoff;
+                        *phys = uspi->s_sbbase + tmp + blockoff;
                         return NULL;
                 }
         }
@@ -282,9 +282,9 @@ repeat:
         }
 
         if (!phys) {
-                result = sb_getblk(sb, tmp + blockoff);
+                result = sb_getblk(sb, uspi->s_sbbase + tmp + blockoff);
         } else {
-                *phys = tmp + blockoff;
+                *phys = uspi->s_sbbase + tmp + blockoff;
                 result = NULL;
                 *err = 0;
                 *new = 1;
@@ -368,7 +368,7 @@ repeat:
                         brelse (result);
                         goto repeat;
                 } else {
-                        *phys = tmp + blockoff;
+                        *phys = uspi->s_sbbase + tmp + blockoff;
                         goto out;
                 }
         }
@@ -389,9 +389,9 @@ repeat:
 
 
         if (!phys) {
-                result = sb_getblk(sb, tmp + blockoff);
+                result = sb_getblk(sb, uspi->s_sbbase + tmp + blockoff);
         } else {
-                *phys = tmp + blockoff;
+                *phys = uspi->s_sbbase + tmp + blockoff;
                 *new = 1;
         }
 
@@ -668,12 +668,12 @@ static void ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
         inode->i_gid = fs32_to_cpu(sb, ufs2_inode->ui_gid);
 
         inode->i_size = fs64_to_cpu(sb, ufs2_inode->ui_size);
-        inode->i_atime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_atime.tv_sec);
-        inode->i_ctime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_ctime.tv_sec);
-        inode->i_mtime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_mtime.tv_sec);
-        inode->i_mtime.tv_nsec = 0;
-        inode->i_atime.tv_nsec = 0;
-        inode->i_ctime.tv_nsec = 0;
+        inode->i_atime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_atime);
+        inode->i_ctime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_ctime);
+        inode->i_mtime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_mtime);
+        inode->i_atime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_atimensec);
+        inode->i_ctime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_ctimensec);
+        inode->i_mtime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_mtimensec);
         inode->i_blocks = fs64_to_cpu(sb, ufs2_inode->ui_blocks);
         inode->i_generation = fs32_to_cpu(sb, ufs2_inode->ui_gen);
         ufsi->i_flags = fs32_to_cpu(sb, ufs2_inode->ui_flags);
@@ -803,12 +803,12 @@ static void ufs2_update_inode(struct inode *inode, struct ufs2_inode *ufs_inode)
         ufs_inode->ui_gid = cpu_to_fs32(sb, inode->i_gid);
 
         ufs_inode->ui_size = cpu_to_fs64(sb, inode->i_size);
-        ufs_inode->ui_atime.tv_sec = cpu_to_fs32(sb, inode->i_atime.tv_sec);
-        ufs_inode->ui_atime.tv_usec = 0;
-        ufs_inode->ui_ctime.tv_sec = cpu_to_fs32(sb, inode->i_ctime.tv_sec);
-        ufs_inode->ui_ctime.tv_usec = 0;
-        ufs_inode->ui_mtime.tv_sec = cpu_to_fs32(sb, inode->i_mtime.tv_sec);
-        ufs_inode->ui_mtime.tv_usec = 0;
+        ufs_inode->ui_atime = cpu_to_fs64(sb, inode->i_atime.tv_sec);
+        ufs_inode->ui_atimensec = cpu_to_fs32(sb, inode->i_atime.tv_nsec);
+        ufs_inode->ui_ctime = cpu_to_fs64(sb, inode->i_ctime.tv_sec);
+        ufs_inode->ui_ctimensec = cpu_to_fs32(sb, inode->i_ctime.tv_nsec);
+        ufs_inode->ui_mtime = cpu_to_fs64(sb, inode->i_mtime.tv_sec);
+        ufs_inode->ui_mtimensec = cpu_to_fs32(sb, inode->i_mtime.tv_nsec);
 
         ufs_inode->ui_blocks = cpu_to_fs64(sb, inode->i_blocks);
         ufs_inode->ui_flags = cpu_to_fs32(sb, ufsi->i_flags);
diff --git a/fs/ufs/truncate.c b/fs/ufs/truncate.c
index 749581fa7729..79c54c85fb58 100644
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -74,7 +74,7 @@ static int ufs_trunc_direct(struct inode *inode)
         unsigned i, tmp;
         int retry;
         
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
 
         sb = inode->i_sb;
         uspi = UFS_SB(sb)->s_uspi;
@@ -96,8 +96,8 @@ static int ufs_trunc_direct(struct inode *inode)
                 block2 = ufs_fragstoblks (frag3);
         }
 
-        UFSD("frag1 %llu, frag2 %llu, block1 %llu, block2 %llu, frag3 %llu,"
-             " frag4 %llu\n",
+        UFSD("ino %lu, frag1 %llu, frag2 %llu, block1 %llu, block2 %llu,"
+             " frag3 %llu, frag4 %llu\n", inode->i_ino,
              (unsigned long long)frag1, (unsigned long long)frag2,
              (unsigned long long)block1, (unsigned long long)block2,
              (unsigned long long)frag3, (unsigned long long)frag4);
@@ -163,7 +163,7 @@ next1:
         mark_inode_dirty(inode);
  next3:
 
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         return retry;
 }
 
@@ -248,7 +248,7 @@ static int ufs_trunc_indirect(struct inode *inode, u64 offset, void *p)
         }
         ubh_brelse (ind_ubh);
         
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         
         return retry;
 }
@@ -262,7 +262,7 @@ static int ufs_trunc_dindirect(struct inode *inode, u64 offset, void *p)
         void *dind;
         int retry = 0;
         
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
         
         sb = inode->i_sb;
         uspi = UFS_SB(sb)->s_uspi;
@@ -312,7 +312,7 @@ static int ufs_trunc_dindirect(struct inode *inode, u64 offset, void *p)
         }
         ubh_brelse (dind_bh);
         
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         
         return retry;
 }
@@ -327,7 +327,7 @@ static int ufs_trunc_tindirect(struct inode *inode)
         void *tind, *p;
         int retry;
         
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
 
         retry = 0;
         
@@ -348,7 +348,7 @@ static int ufs_trunc_tindirect(struct inode *inode)
         }
 
         for (i = tindirect_block ; i < uspi->s_apb ; i++) {
-                tind = ubh_get_addr32 (tind_bh, i);
+                tind = ubh_get_data_ptr(uspi, tind_bh, i);
                 retry |= ufs_trunc_dindirect(inode, UFS_NDADDR + 
                         uspi->s_apb + ((i + 1) << uspi->s_2apbshift), tind);
                 ubh_mark_buffer_dirty(tind_bh);
@@ -372,19 +372,21 @@ static int ufs_trunc_tindirect(struct inode *inode)
         }
         ubh_brelse (tind_bh);
         
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         return retry;
 }
 
 static int ufs_alloc_lastblock(struct inode *inode)
 {
         int err = 0;
+        struct super_block *sb = inode->i_sb;
         struct address_space *mapping = inode->i_mapping;
-        struct ufs_sb_private_info *uspi = UFS_SB(inode->i_sb)->s_uspi;
+        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
         unsigned i, end;
         sector_t lastfrag;
         struct page *lastpage;
         struct buffer_head *bh;
+        u64 phys64;
 
         lastfrag = (i_size_read(inode) + uspi->s_fsize - 1) >> uspi->s_fshift;
 
@@ -424,6 +426,20 @@ static int ufs_alloc_lastblock(struct inode *inode)
                set_page_dirty(lastpage);
        }
 
+       if (lastfrag >= UFS_IND_FRAGMENT) {
+               end = uspi->s_fpb - ufs_fragnum(lastfrag) - 1;
+               phys64 = bh->b_blocknr + 1;
+               for (i = 0; i < end; ++i) {
+                       bh = sb_getblk(sb, i + phys64);
+                       lock_buffer(bh);
+                       memset(bh->b_data, 0, sb->s_blocksize);
+                       set_buffer_uptodate(bh);
+                       mark_buffer_dirty(bh);
+                       unlock_buffer(bh);
+                       sync_dirty_buffer(bh);
+                       brelse(bh);
+               }
+       }
 out_unlock:
        ufs_put_locked_page(lastpage);
 out:
diff --git a/include/asm-arm/arch-at91/gpio.h b/include/asm-arm/arch-at91/gpio.h
index 98ad2114f43a..0a241e2fb672 100644
--- a/include/asm-arm/arch-at91/gpio.h
+++ b/include/asm-arm/arch-at91/gpio.h
@@ -223,7 +223,7 @@ static inline void gpio_free(unsigned gpio)
 }
 
 extern int gpio_direction_input(unsigned gpio);
-extern int gpio_direction_output(unsigned gpio);
+extern int gpio_direction_output(unsigned gpio, int value);
 
 static inline int gpio_get_value(unsigned gpio)
 {
diff --git a/include/asm-arm/arch-omap/gpio.h b/include/asm-arm/arch-omap/gpio.h
index 3762a6ae6a7f..590917efc94a 100644
--- a/include/asm-arm/arch-omap/gpio.h
+++ b/include/asm-arm/arch-omap/gpio.h
@@ -113,8 +113,9 @@ static inline int gpio_direction_input(unsigned gpio)
         return __gpio_set_direction(gpio, 1);
 }
 
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
+        omap_set_gpio_dataout(gpio, value);
         return __gpio_set_direction(gpio, 0);
 }
 
diff --git a/include/asm-arm/arch-pxa/gpio.h b/include/asm-arm/arch-pxa/gpio.h
index 3d348a351157..aeba24347f8e 100644
--- a/include/asm-arm/arch-pxa/gpio.h
+++ b/include/asm-arm/arch-pxa/gpio.h
@@ -43,9 +43,9 @@ static inline int gpio_direction_input(unsigned gpio)
         return pxa_gpio_mode(gpio | GPIO_IN);
 }
 
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
-        return pxa_gpio_mode(gpio | GPIO_OUT);
+        return pxa_gpio_mode(gpio | GPIO_OUT | (value ? 0 : GPIO_DFLT_LOW));
 }
 
 static inline int __gpio_get_value(unsigned gpio)
diff --git a/include/asm-arm/arch-s3c2410/gpio.h b/include/asm-arm/arch-s3c2410/gpio.h
index d47ae453f8ca..7583895fd336 100644
--- a/include/asm-arm/arch-s3c2410/gpio.h
+++ b/include/asm-arm/arch-s3c2410/gpio.h
@@ -44,9 +44,11 @@ static inline int gpio_direction_input(unsigned gpio)
         return 0;
 }
 
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
         s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_OUTPUT);
+        /* REVISIT can we write the value first, to avoid glitching? */
+        s3c2410_gpio_setpin(gpio, value);
         return 0;
 }
 
diff --git a/include/asm-arm/arch-sa1100/gpio.h b/include/asm-arm/arch-sa1100/gpio.h
index da7575b0e5d0..e7a9d26e22a8 100644
--- a/include/asm-arm/arch-sa1100/gpio.h
+++ b/include/asm-arm/arch-sa1100/gpio.h
@@ -38,7 +38,7 @@ static inline void gpio_free(unsigned gpio)
 }
 
 extern int gpio_direction_input(unsigned gpio);
-extern int gpio_direction_output(unsigned gpio);
+extern int gpio_direction_output(unsigned gpio, int value);
 
 
 static inline int gpio_get_value(unsigned gpio)
diff --git a/include/asm-avr32/arch-at32ap/gpio.h b/include/asm-avr32/arch-at32ap/gpio.h
index fcb756bdaa8e..80a21aa9ae77 100644
--- a/include/asm-avr32/arch-at32ap/gpio.h
+++ b/include/asm-avr32/arch-at32ap/gpio.h
@@ -10,7 +10,7 @@ int __must_check gpio_request(unsigned int gpio, const char *label);
 void gpio_free(unsigned int gpio);
 
 int gpio_direction_input(unsigned int gpio);
-int gpio_direction_output(unsigned int gpio);
+int gpio_direction_output(unsigned int gpio, int value);
 int gpio_get_value(unsigned int gpio);
 void gpio_set_value(unsigned int gpio, int value);
 
diff --git a/include/asm-i386/nmi.h b/include/asm-i386/nmi.h
index 64544cb85d6a..b04333ea6f31 100644
--- a/include/asm-i386/nmi.h
+++ b/include/asm-i386/nmi.h
@@ -33,7 +33,7 @@ extern int nmi_watchdog_tick (struct pt_regs * regs, unsigned reason);
 
 extern atomic_t nmi_active;
 extern unsigned int nmi_watchdog;
-#define NMI_DEFAULT     0
+#define NMI_DEFAULT     -1
 #define NMI_NONE        0
 #define NMI_IO_APIC     1
 #define NMI_LOCAL_APIC  2
diff --git a/include/asm-i386/paravirt.h b/include/asm-i386/paravirt.h
index f8319cae2ac5..46dc34ca887a 100644
--- a/include/asm-i386/paravirt.h
+++ b/include/asm-i386/paravirt.h
@@ -130,7 +130,7 @@ struct paravirt_ops
         void (*flush_tlb_kernel)(void);
         void (*flush_tlb_single)(u32 addr);
 
-        void (fastcall *map_pt_hook)(int type, pte_t *va, u32 pfn);
+        void (*map_pt_hook)(int type, pte_t *va, u32 pfn);
 
         void (*alloc_pt)(u32 pfn);
         void (*alloc_pd)(u32 pfn);
diff --git a/include/asm-i386/sync_bitops.h b/include/asm-i386/sync_bitops.h
index c94d51c993ee..7d72351bea75 100644
--- a/include/asm-i386/sync_bitops.h
+++ b/include/asm-i386/sync_bitops.h
@@ -130,7 +130,7 @@ static inline int sync_test_and_change_bit(int nr, volatile unsigned long* addr)
         return oldbit;
 }
 
-static __always_inline int sync_const_test_bit(int nr, const volatile unsigned long *addr)
+static __always_inline int sync_constant_test_bit(int nr, const volatile unsigned long *addr)
 {
         return ((1UL << (nr & 31)) &
                 (((const volatile unsigned int *)addr)[nr >> 5])) != 0;
diff --git a/include/asm-m32r/dma-mapping.h b/include/asm-m32r/dma-mapping.h
index a7fa0302bda7..f9b58ebba361 100644
--- a/include/asm-m32r/dma-mapping.h
+++ b/include/asm-m32r/dma-mapping.h
@@ -1,23 +1,6 @@
 #ifndef _ASM_M32R_DMA_MAPPING_H
 #define _ASM_M32R_DMA_MAPPING_H
 
-/*
- * NOTE: Do not include <asm-generic/dma-mapping.h>
- * Because it requires PCI stuffs, but current M32R don't provide these.
- */
-
-static inline void *
-dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
-                   gfp_t flag)
-{
-        return (void *)NULL;
-}
-
-static inline void
-dma_free_coherent(struct device *dev, size_t size, void *cpu_addr,
-                    dma_addr_t dma_handle)
-{
-        return;
-}
+#include <asm-generic/dma-mapping-broken.h>
 
 #endif /* _ASM_M32R_DMA_MAPPING_H */
diff --git a/include/asm-m68k/dma-mapping.h b/include/asm-m68k/dma-mapping.h
index 00259ed6fc95..a26cdeb46a57 100644
--- a/include/asm-m68k/dma-mapping.h
+++ b/include/asm-m68k/dma-mapping.h
@@ -32,7 +32,7 @@ extern void dma_free_coherent(struct device *, size_t,
                               void *, dma_addr_t);
 
 static inline void *dma_alloc_noncoherent(struct device *dev, size_t size,
-                                          dma_addr_t *handle, int flag)
+                                          dma_addr_t *handle, gfp_t flag)
 {
         return dma_alloc_coherent(dev, size, handle, flag);
 }
diff --git a/include/asm-m68k/mc146818rtc.h b/include/asm-m68k/mc146818rtc.h
index 11fe12ddb913..9f70a01f73dc 100644
--- a/include/asm-m68k/mc146818rtc.h
+++ b/include/asm-m68k/mc146818rtc.h
@@ -11,6 +11,7 @@
 #include <asm/atarihw.h>
 
 #define RTC_PORT(x)     (TT_RTC_BAS + 2*(x))
+#define RTC_ALWAYS_BCD  0
 
 #define CMOS_READ(addr) ({ \
 atari_outb_p((addr),RTC_PORT(0)); \
diff --git a/include/asm-mips/atomic.h b/include/asm-mips/atomic.h
index 8578869a8bcf..1ac50b6c47ad 100644
--- a/include/asm-mips/atomic.h
+++ b/include/asm-mips/atomic.h
@@ -79,9 +79,9 @@ static __inline__ void atomic_add(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter += i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -124,9 +124,9 @@ static __inline__ void atomic_sub(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter -= i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -173,11 +173,11 @@ static __inline__ int atomic_add_return(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result += i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -225,11 +225,11 @@ static __inline__ int atomic_sub_return(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -293,12 +293,12 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 if (result >= 0)
                         v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -454,9 +454,9 @@ static __inline__ void atomic64_add(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter += i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -499,9 +499,9 @@ static __inline__ void atomic64_sub(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter -= i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -548,11 +548,11 @@ static __inline__ long atomic64_add_return(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result += i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -600,11 +600,11 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -668,12 +668,12 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 if (result >= 0)
                         v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
diff --git a/include/asm-mips/bitops.h b/include/asm-mips/bitops.h
index 8959da245cfb..d995413e11fd 100644
--- a/include/asm-mips/bitops.h
+++ b/include/asm-mips/bitops.h
@@ -100,9 +100,9 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 *a |= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -165,9 +165,9 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 *a &= ~mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -220,9 +220,9 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 *a ^= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -287,10 +287,10 @@ static inline int test_and_set_bit(unsigned long nr,
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = (mask & *a) != 0;
                 *a |= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
 
                 return retval;
         }
@@ -381,10 +381,10 @@ static inline int test_and_clear_bit(unsigned long nr,
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = (mask & *a) != 0;
                 *a &= ~mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
 
                 return retval;
         }
@@ -452,10 +452,10 @@ static inline int test_and_change_bit(unsigned long nr,
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = (mask & *a) != 0;
                 *a ^= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
 
                 return retval;
         }
diff --git a/include/asm-mips/cpu-features.h b/include/asm-mips/cpu-features.h
index eadca266f159..5e4bed123b48 100644
--- a/include/asm-mips/cpu-features.h
+++ b/include/asm-mips/cpu-features.h
@@ -40,6 +40,9 @@
 #endif
 #ifndef cpu_has_fpu
 #define cpu_has_fpu             (current_cpu_data.options & MIPS_CPU_FPU)
+#define raw_cpu_has_fpu         (raw_current_cpu_data.options & MIPS_CPU_FPU)
+#else
+#define raw_cpu_has_fpu         cpu_has_fpu
 #endif
 #ifndef cpu_has_32fpr
 #define cpu_has_32fpr           (cpu_data[0].options & MIPS_CPU_32FPR)
diff --git a/include/asm-mips/cpu-info.h b/include/asm-mips/cpu-info.h
index 610d0cdeaa9e..22fe8453fcc7 100644
--- a/include/asm-mips/cpu-info.h
+++ b/include/asm-mips/cpu-info.h
@@ -87,6 +87,7 @@ struct cpuinfo_mips {
 
 extern struct cpuinfo_mips cpu_data[];
 #define current_cpu_data cpu_data[smp_processor_id()]
+#define raw_current_cpu_data cpu_data[raw_smp_processor_id()]
 
 extern void cpu_probe(void);
 extern void cpu_report(void);
diff --git a/include/asm-mips/fpu.h b/include/asm-mips/fpu.h
index efef843b93f0..4e12d1f9534f 100644
--- a/include/asm-mips/fpu.h
+++ b/include/asm-mips/fpu.h
@@ -27,11 +27,11 @@
 struct sigcontext;
 struct sigcontext32;
 
-extern asmlinkage int (*save_fp_context)(struct sigcontext *sc);
-extern asmlinkage int (*restore_fp_context)(struct sigcontext *sc);
+extern asmlinkage int (*save_fp_context)(struct sigcontext __user *sc);
+extern asmlinkage int (*restore_fp_context)(struct sigcontext __user *sc);
 
-extern asmlinkage int (*save_fp_context32)(struct sigcontext32 *sc);
-extern asmlinkage int (*restore_fp_context32)(struct sigcontext32 *sc);
+extern asmlinkage int (*save_fp_context32)(struct sigcontext32 __user *sc);
+extern asmlinkage int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 
 extern void fpu_emulator_init_fpu(void);
 extern void _init_fpu(void);
@@ -68,6 +68,8 @@ do {									\
         /* We don't care about the c0 hazard here  */                   \
 } while (0)
 
+#define __fpu_enabled() (read_c0_status() & ST0_CU1)
+
 #define enable_fpu()                                                    \
 do {                                                                    \
         if (cpu_has_fpu)                                                \
@@ -93,31 +95,47 @@ static inline int is_fpu_owner(void)
         return cpu_has_fpu && __is_fpu_owner();
 }
 
-static inline void own_fpu(void)
+static inline void __own_fpu(void)
 {
-        if (cpu_has_fpu) {
-                __enable_fpu();
-                KSTK_STATUS(current) |= ST0_CU1;
-                set_thread_flag(TIF_USEDFPU);
+        __enable_fpu();
+        KSTK_STATUS(current) |= ST0_CU1;
+        set_thread_flag(TIF_USEDFPU);
+}
+
+static inline void own_fpu(int restore)
+{
+        preempt_disable();
+        if (cpu_has_fpu && !__is_fpu_owner()) {
+                __own_fpu();
+                if (restore)
+                        _restore_fp(current);
         }
+        preempt_enable();
 }
 
-static inline void lose_fpu(void)
+static inline void lose_fpu(int save)
 {
-        if (cpu_has_fpu) {
+        preempt_disable();
+        if (is_fpu_owner()) {
+                if (save)
+                        _save_fp(current);
                 KSTK_STATUS(current) &= ~ST0_CU1;
                 clear_thread_flag(TIF_USEDFPU);
                 __disable_fpu();
         }
+        preempt_enable();
 }
 
 static inline void init_fpu(void)
 {
+        preempt_disable();
         if (cpu_has_fpu) {
+                __own_fpu();
                 _init_fpu();
         } else {
                 fpu_emulator_init_fpu();
         }
+        preempt_enable();
 }
 
 static inline void save_fp(struct task_struct *tsk)
@@ -144,4 +162,18 @@ static inline fpureg_t *get_fpu_regs(struct task_struct *tsk)
         return tsk->thread.fpu.fpr;
 }
 
+static inline void enable_fp_in_kernel(void)
+{
+        set_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
+        /* make sure CU1 and FPU ownership are consistent */
+        if (!__is_fpu_owner() && __fpu_enabled())
+                __disable_fpu();
+}
+
+static inline void disable_fp_in_kernel(void)
+{
+        BUG_ON(!__is_fpu_owner() && __fpu_enabled());
+        clear_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
+}
+
 #endif /* _ASM_FPU_H */
diff --git a/include/asm-mips/mach-au1x00/au1xxx_ide.h b/include/asm-mips/mach-au1x00/au1xxx_ide.h
index e9fa252f8a3f..8fcae21adbd5 100644
--- a/include/asm-mips/mach-au1x00/au1xxx_ide.h
+++ b/include/asm-mips/mach-au1x00/au1xxx_ide.h
@@ -141,40 +141,6 @@ static int auide_ddma_init( _auide_hwif *auide );
 static void auide_setup_ports(hw_regs_t *hw, _auide_hwif *ahwif);
 int __init auide_probe(void);
 
-#ifdef CONFIG_PM
-        int au1200ide_pm_callback( au1xxx_power_dev_t *dev,
-                                   au1xxx_request_t request, void *data);
-        static int au1xxxide_pm_standby( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_sleep( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_resume( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_getstatus( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_access( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_idle( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_cleanup( au1xxx_power_dev_t *dev );
-#endif
-
-
-/*
- * Multi-Word DMA + DbDMA functions
- */
-#ifdef CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA
-        static int auide_build_sglist(ide_drive_t *drive,  struct request *rq);
-        static int auide_build_dmatable(ide_drive_t *drive);
-        static int auide_dma_end(ide_drive_t *drive);
-        ide_startstop_t auide_dma_intr (ide_drive_t *drive);
-        static void auide_dma_exec_cmd(ide_drive_t *drive, u8 command);
-        static int auide_dma_setup(ide_drive_t *drive);
-        static int auide_dma_check(ide_drive_t *drive);
-        static int auide_dma_test_irq(ide_drive_t *drive);
-        static int auide_dma_host_off(ide_drive_t *drive);
-        static int auide_dma_host_on(ide_drive_t *drive);
-        static int auide_dma_lostirq(ide_drive_t *drive);
-        static int auide_dma_on(ide_drive_t *drive);
-        static void auide_ddma_tx_callback(int irq, void *param);
-        static void auide_ddma_rx_callback(int irq, void *param);
-        static int auide_dma_off_quietly(ide_drive_t *drive);
-#endif /* end CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA */
-
 /*******************************************************************************
 * PIO Mode timing calculation :                                                *
 *                                                                              *
diff --git a/include/asm-mips/mach-ip27/dma-coherence.h b/include/asm-mips/mach-ip27/dma-coherence.h
index 659816e200d4..3fdbbf68e952 100644
--- a/include/asm-mips/mach-ip27/dma-coherence.h
+++ b/include/asm-mips/mach-ip27/dma-coherence.h
@@ -18,7 +18,8 @@
 
 struct device;
 
-static dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+static inline dma_addr_t plat_map_dma_mem(struct device *dev, void *addr,
+        size_t size)
 {
         dma_addr_t pa = dev_to_baddr(dev, virt_to_phys(addr));
 
@@ -37,7 +38,7 @@ static unsigned long plat_dma_addr_to_phys(dma_addr_t dma_addr)
         return dma_addr & (0xffUL << 56);
 }
 
-static void plat_unmap_dma_mem(dma_addr_t dma_addr)
+static inline void plat_unmap_dma_mem(dma_addr_t dma_addr)
 {
 }
 
diff --git a/include/asm-mips/mach-ip32/dma-coherence.h b/include/asm-mips/mach-ip32/dma-coherence.h
index 950be17bbb86..c3f9a6a20eb0 100644
--- a/include/asm-mips/mach-ip32/dma-coherence.h
+++ b/include/asm-mips/mach-ip32/dma-coherence.h
@@ -26,7 +26,8 @@ struct device;
 
 #define RAM_OFFSET_MASK 0x3fffffffUL
 
-static dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+static inline dma_addr_t plat_map_dma_mem(struct device *dev, void *addr,
+        size_t size)
 {
         dma_addr_t pa = virt_to_phys(addr) & RAM_OFFSET_MASK;
 
@@ -59,7 +60,7 @@ static unsigned long plat_dma_addr_to_phys(dma_addr_t dma_addr)
         return addr;
 }
 
-static void plat_unmap_dma_mem(dma_addr_t dma_addr)
+static inline void plat_unmap_dma_mem(dma_addr_t dma_addr)
 {
 }
 
diff --git a/include/asm-mips/rtlx.h b/include/asm-mips/rtlx.h
index 59162f74a798..65778c890a62 100644
--- a/include/asm-mips/rtlx.h
+++ b/include/asm-mips/rtlx.h
@@ -23,8 +23,8 @@
 
 extern int rtlx_open(int index, int can_sleep);
 extern int rtlx_release(int index);
-extern ssize_t rtlx_read(int index, void *buff, size_t count, int user);
-extern ssize_t rtlx_write(int index, void *buffer, size_t count, int user);
+extern ssize_t rtlx_read(int index, void __user *buff, size_t count);
+extern ssize_t rtlx_write(int index, const void __user *buffer, size_t count);
 extern unsigned int rtlx_read_poll(int index, int can_sleep);
 extern unsigned int rtlx_write_poll(int index);
 
diff --git a/include/asm-mips/system.h b/include/asm-mips/system.h
index 597a3743f6a1..290887077e44 100644
--- a/include/asm-mips/system.h
+++ b/include/asm-mips/system.h
@@ -121,10 +121,10 @@ static inline unsigned long __xchg_u32(volatile int * m, unsigned int val)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 *m = val;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
@@ -169,10 +169,10 @@ static inline __u64 __xchg_u64(volatile __u64 * m, __u64 val)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 *m = val;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
@@ -250,11 +250,11 @@ static inline unsigned long __cmpxchg_u32(volatile int * m, unsigned long old,
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 if (retval == old)
                         *m = new;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
@@ -304,11 +304,11 @@ static inline unsigned long __cmpxchg_u64(volatile int * m, unsigned long old,
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 if (retval == old)
                         *m = new;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index fbcda8204473..6cf05f4a4e7e 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -119,6 +119,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
 #define TIF_FREEZE              19
+#define TIF_ALLOW_FP_IN_KERNEL  20
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
 
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
diff --git a/include/asm-powerpc/floppy.h b/include/asm-powerpc/floppy.h
index a0f14eea1da5..afa700ded877 100644
--- a/include/asm-powerpc/floppy.h
+++ b/include/asm-powerpc/floppy.h
@@ -178,7 +178,7 @@ static struct fd_dma_ops virt_dma_ops =
         ._dma_setup = vdma_dma_setup
 };
 
-static int fd_request_dma()
+static int fd_request_dma(void)
 {
         if (can_use_virtual_dma & 1) {
                 fd_ops = &virt_dma_ops;
diff --git a/include/asm-sparc/dma-mapping.h b/include/asm-sparc/dma-mapping.h
index 6db83dc93cb7..f3a641e6b2c8 100644
--- a/include/asm-sparc/dma-mapping.h
+++ b/include/asm-sparc/dma-mapping.h
@@ -5,20 +5,7 @@
 #ifdef CONFIG_PCI
 #include <asm-generic/dma-mapping.h>
 #else
-
-static inline void *dma_alloc_coherent(struct device *dev, size_t size,
-                         dma_addr_t *dma_handle, gfp_t flag)
-{
-        BUG();
-        return NULL;
-}
-
-static inline void dma_free_coherent(struct device *dev, size_t size,
-                       void *vaddr, dma_addr_t dma_handle)
-{
-        BUG();
-}
-
+#include <asm-generic/dma-mapping-broken.h>
 #endif /* PCI */
 
 #endif /* _ASM_SPARC_DMA_MAPPING_H */
diff --git a/include/asm-sparc64/tsb.h b/include/asm-sparc64/tsb.h
index e82612cd9f33..ab55ffcb7bf4 100644
--- a/include/asm-sparc64/tsb.h
+++ b/include/asm-sparc64/tsb.h
@@ -264,6 +264,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
         be,a,pt         %xcc, OK_LABEL; \
          mov            REG4, REG1;
 
+#ifndef CONFIG_DEBUG_PAGEALLOC
         /* This version uses a trick, the TAG is already (VADDR >> 22) so
          * we can make use of that for the index computation.
          */
@@ -277,5 +278,6 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
         cmp             REG3, TAG; \
         be,a,pt         %xcc, OK_LABEL; \
          mov            REG4, REG1;
+#endif
 
 #endif /* !(_SPARC64_TSB_H) */
diff --git a/include/asm-x86_64/nmi.h b/include/asm-x86_64/nmi.h
index ceb3d8dac33d..72375e7d32a8 100644
--- a/include/asm-x86_64/nmi.h
+++ b/include/asm-x86_64/nmi.h
@@ -64,7 +64,7 @@ extern int setup_nmi_watchdog(char *);
 
 extern atomic_t nmi_active;
 extern unsigned int nmi_watchdog;
-#define NMI_DEFAULT     0
+#define NMI_DEFAULT     -1
 #define NMI_NONE        0
 #define NMI_IO_APIC     1
 #define NMI_LOCAL_APIC  2
diff --git a/include/asm-x86_64/proto.h b/include/asm-x86_64/proto.h
index f54f3abf93ce..b6e65a699f2a 100644
--- a/include/asm-x86_64/proto.h
+++ b/include/asm-x86_64/proto.h
@@ -99,7 +99,7 @@ extern int force_iommu, no_iommu;
 extern int iommu_detected;
 #ifdef CONFIG_IOMMU
 extern void gart_iommu_init(void);
-extern void gart_parse_options(char *);
+extern void __init gart_parse_options(char *);
 extern void iommu_hole_init(void);
 extern int fallback_aper_order;
 extern int fallback_aper_force;
diff --git a/include/asm-x86_64/smp.h b/include/asm-x86_64/smp.h
index e17b9ec42e98..de592a408c07 100644
--- a/include/asm-x86_64/smp.h
+++ b/include/asm-x86_64/smp.h
@@ -7,6 +7,7 @@
 #include <linux/threads.h>
 #include <linux/cpumask.h>
 #include <linux/bitops.h>
+#include <linux/init.h>
 extern int disable_apic;
 
 #include <asm/fixmap.h>
@@ -68,7 +69,7 @@ extern int __cpu_disable(void);
 extern void __cpu_die(unsigned int cpu);
 extern void prefill_possible_map(void);
 extern unsigned num_processors;
-extern unsigned disabled_cpus;
+extern unsigned __cpuinitdata disabled_cpus;
 
 #define NO_PROC_ID              0xFF            /* No processor magic marker */
 
diff --git a/include/asm-x86_64/uaccess.h b/include/asm-x86_64/uaccess.h
index 1981f70fcad1..9df30b939c4e 100644
--- a/include/asm-x86_64/uaccess.h
+++ b/include/asm-x86_64/uaccess.h
@@ -373,12 +373,12 @@ extern long __copy_user_nocache(void *dst, const void __user *src, unsigned size
 static inline int __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
 {
         might_sleep();
-        return __copy_user_nocache(dst, (__force void *)src, size, 1);
+        return __copy_user_nocache(dst, src, size, 1);
 }
 
 static inline int __copy_from_user_inatomic_nocache(void *dst, const void __user *src, unsigned size)
 {
-        return __copy_user_nocache(dst, (__force void *)src, size, 0);
+        return __copy_user_nocache(dst, src, size, 0);
 }
 
 #endif /* __X86_64_UACCESS_H */
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index 7011d6255593..f2542c24b328 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -93,6 +93,7 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
 void clear_bdi_congested(struct backing_dev_info *bdi, int rw);
 void set_bdi_congested(struct backing_dev_info *bdi, int rw);
 long congestion_wait(int rw, long timeout);
+long congestion_wait_interruptible(int rw, long timeout);
 void congestion_end(int rw);
 
 #define bdi_cap_writeback_dirty(bdi) \
diff --git a/include/linux/device.h b/include/linux/device.h
index 39a3199a826d..caad9bba9652 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -353,6 +353,8 @@ extern int __must_check device_create_bin_file(struct device *dev,
                                                struct bin_attribute *attr);
 extern void device_remove_bin_file(struct device *dev,
                                    struct bin_attribute *attr);
+extern int device_schedule_callback(struct device *dev,
+                void (*func)(struct device *));
 
 /* device resource management */
 typedef void (*dr_release_t)(struct device *dev, void *res);
diff --git a/include/linux/kbd_kern.h b/include/linux/kbd_kern.h
index 06c58c423fe1..506ad20c18f8 100644
--- a/include/linux/kbd_kern.h
+++ b/include/linux/kbd_kern.h
@@ -75,7 +75,7 @@ extern int do_poke_blanked_console;
 
 extern void (*kbd_ledfunc)(unsigned int led);
 
-extern void set_console(int nr);
+extern int set_console(int nr);
 extern void schedule_console_callback(void);
 
 static inline void set_leds(void)
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index c68c7ac6b232..248305bb9a18 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -57,7 +57,11 @@ typedef union {
 } ktime_t;
 
 #define KTIME_MAX                       ((s64)~((u64)1 << 63))
-#define KTIME_SEC_MAX                   (KTIME_MAX / NSEC_PER_SEC)
+#if (BITS_PER_LONG == 64)
+# define KTIME_SEC_MAX                  (KTIME_MAX / NSEC_PER_SEC)
+#else
+# define KTIME_SEC_MAX                  LONG_MAX
+#endif
 
 /*
  * ktime_t definitions when using the 64-bit scalar representation:
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 47aaa2c66738..e9ae0c6e2c62 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -415,6 +415,7 @@ extern void nfs_complete_unlink(struct dentry *);
 /*
  * linux/fs/nfs/write.c
  */
+extern int  nfs_congestion_kb;
 extern int  nfs_writepage(struct page *page, struct writeback_control *wbc);
 extern int  nfs_writepages(struct address_space *, struct writeback_control *);
 extern int  nfs_flush_incompatible(struct file *file, struct page *page);
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 95796e6924f1..c95d5e642548 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -82,6 +82,7 @@ struct nfs_server {
         struct rpc_clnt *       client_acl;     /* ACL RPC client handle */
         struct nfs_iostats *    io_stats;       /* I/O statistics */
         struct backing_dev_info backing_dev_info;
+        atomic_t                writeback;      /* number of writeback pages */
         int                     flags;          /* various flags */
         unsigned int            caps;           /* server capabilities */
         unsigned int            rsize;          /* read size */
diff --git a/include/linux/security.h b/include/linux/security.h
index 7f88d97575fd..47e82c120f9a 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1324,7 +1324,7 @@ struct security_operations {
 
         void (*d_instantiate) (struct dentry *dentry, struct inode *inode);
 
-        int (*getprocattr)(struct task_struct *p, char *name, void *value, size_t size);
+        int (*getprocattr)(struct task_struct *p, char *name, char **value);
         int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size);
         int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);
         void (*release_secctx)(char *secdata, u32 seclen);
@@ -2092,9 +2092,9 @@ static inline void security_d_instantiate (struct dentry *dentry, struct inode *
         security_ops->d_instantiate (dentry, inode);
 }
 
-static inline int security_getprocattr(struct task_struct *p, char *name, void *value, size_t size)
+static inline int security_getprocattr(struct task_struct *p, char *name, char **value)
 {
-        return security_ops->getprocattr(p, name, value, size);
+        return security_ops->getprocattr(p, name, value);
 }
 
 static inline int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
@@ -2749,7 +2749,7 @@ static inline int security_sem_semop (struct sem_array * sma,
 static inline void security_d_instantiate (struct dentry *dentry, struct inode *inode)
 { }
 
-static inline int security_getprocattr(struct task_struct *p, char *name, void *value, size_t size)
+static inline int security_getprocattr(struct task_struct *p, char *name, char **value)
 {
         return -EINVAL;
 }
diff --git a/include/linux/spi/spi_bitbang.h b/include/linux/spi/spi_bitbang.h
index 2e8c048b9b80..9dbca629dcfb 100644
--- a/include/linux/spi/spi_bitbang.h
+++ b/include/linux/spi/spi_bitbang.h
@@ -25,7 +25,6 @@ struct spi_bitbang {
         spinlock_t              lock;
         struct list_head        queue;
         u8                      busy;
-        u8                      shutdown;
         u8                      use_dma;
 
         struct spi_master       *master;
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index 523405e1e1f6..0544edda7168 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -78,6 +78,9 @@ struct sysfs_ops {
 
 #ifdef CONFIG_SYSFS
 
+extern int sysfs_schedule_callback(struct kobject *kobj,
+                void (*func)(void *), void *data);
+
 extern int __must_check
 sysfs_create_dir(struct kobject *, struct dentry *);
 
@@ -132,6 +135,12 @@ extern int __must_check sysfs_init(void);
 
 #else /* CONFIG_SYSFS */
 
+static inline int sysfs_schedule_callback(struct kobject *kobj,
+                void (*func)(void *), void *data)
+{
+        return -ENOSYS;
+}
+
 static inline int sysfs_create_dir(struct kobject * k, struct dentry *shadow)
 {
         return 0;
diff --git a/include/linux/ufs_fs.h b/include/linux/ufs_fs.h
index dc2e9fe69418..daeba22b7656 100644
--- a/include/linux/ufs_fs.h
+++ b/include/linux/ufs_fs.h
@@ -649,10 +649,10 @@ struct ufs2_inode {
         __fs32     ui_blksize;     /*  12: Inode blocksize. */
         __fs64     ui_size;        /*  16: File byte count. */
         __fs64     ui_blocks;      /*  24: Bytes actually held. */
-        struct ufs_timeval   ui_atime;       /*  32: Last access time. */
-        struct ufs_timeval   ui_mtime;       /*  40: Last modified time. */
-        struct ufs_timeval   ui_ctime;       /*  48: Last inode change time. */
-        struct ufs_timeval   ui_birthtime;   /*  56: Inode creation time. */
+        __fs64   ui_atime;       /*  32: Last access time. */
+        __fs64   ui_mtime;       /*  40: Last modified time. */
+        __fs64   ui_ctime;       /*  48: Last inode change time. */
+        __fs64   ui_birthtime;   /*  56: Inode creation time. */
         __fs32     ui_mtimensec;   /*  64: Last modified time. */
         __fs32     ui_atimensec;   /*  68: Last access time. */
         __fs32     ui_ctimensec;   /*  72: Last inode change time. */
diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
index 37a1a41f5b65..e0db669998f3 100644
--- a/include/linux/vt_kern.h
+++ b/include/linux/vt_kern.h
@@ -83,6 +83,7 @@ void reset_vc(struct vc_data *vc);
 #define CON_BUF_SIZE (CONFIG_BASE_SMALL ? 256 : PAGE_SIZE)
 extern char con_buf[CON_BUF_SIZE];
 extern struct semaphore con_buf_sem;
+extern char vt_dont_switch;
 
 struct vt_spawn_console {
         spinlock_t lock;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 359955800dd2..628c7ac590a0 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -739,28 +739,26 @@ static inline void audit_free_context(struct audit_context *context)
 void audit_log_task_context(struct audit_buffer *ab)
 {
         char *ctx = NULL;
-        ssize_t len = 0;
+        unsigned len;
+        int error;
+        u32 sid;
+
+        selinux_get_task_sid(current, &sid);
+        if (!sid)
+                return;
 
-        len = security_getprocattr(current, "current", NULL, 0);
-        if (len < 0) {
-                if (len != -EINVAL)
+        error = selinux_sid_to_string(sid, &ctx, &len);
+        if (error) {
+                if (error != -EINVAL)
                         goto error_path;
                 return;
         }
 
-        ctx = kmalloc(len, GFP_KERNEL);
-        if (!ctx)
-                goto error_path;
-
-        len = security_getprocattr(current, "current", ctx, len);
-        if (len < 0 )
-                goto error_path;
-
         audit_log_format(ab, " subj=%s", ctx);
+        kfree(ctx);
         return;
 
 error_path:
-        kfree(ctx);
         audit_panic("error in audit_log_task_context");
         return;
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index d154cc786489..6af959c034d8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -933,8 +933,8 @@ asmlinkage long sys_set_tid_address(int __user *tidptr)
 
 static inline void rt_mutex_init_task(struct task_struct *p)
 {
-#ifdef CONFIG_RT_MUTEXES
         spin_lock_init(&p->pi_lock);
+#ifdef CONFIG_RT_MUTEXES
         plist_head_init(&p->pi_waiters, &p->pi_lock);
         p->pi_blocked_on = NULL;
 #endif
diff --git a/kernel/futex.c b/kernel/futex.c
index e749e7df14b1..5a270b5e3f95 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -565,6 +565,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
         if (!pi_state)
                 return -EINVAL;
 
+        spin_lock(&pi_state->pi_mutex.wait_lock);
         new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
         /*
@@ -604,6 +605,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
         pi_state->owner = new_owner;
         spin_unlock_irq(&new_owner->pi_lock);
 
+        spin_unlock(&pi_state->pi_mutex.wait_lock);
         rt_mutex_unlock(&pi_state->pi_mutex);
 
         return 0;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index ec4cb9f3e3b7..6a7938a0d513 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -135,7 +135,7 @@ EXPORT_SYMBOL_GPL(ktime_get_ts);
 static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
 {
         ktime_t xtim, tomono;
-        struct timespec xts;
+        struct timespec xts, tom;
         unsigned long seq;
 
         do {
@@ -145,10 +145,11 @@ static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
 #else
                 xts = xtime;
 #endif
+                tom = wall_to_monotonic;
         } while (read_seqretry(&xtime_lock, seq));
 
         xtim = timespec_to_ktime(xts);
-        tomono = timespec_to_ktime(wall_to_monotonic);
+        tomono = timespec_to_ktime(tom);
         base->clock_base[CLOCK_REALTIME].softirq_time = xtim;
         base->clock_base[CLOCK_MONOTONIC].softirq_time =
                 ktime_add(xtim, tomono);
@@ -644,6 +645,12 @@ hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
                 orun++;
         }
         timer->expires = ktime_add(timer->expires, interval);
+        /*
+         * Make sure, that the result did not wrap with a very large
+         * interval.
+         */
+        if (timer->expires.tv64 < 0)
+                timer->expires = ktime_set(KTIME_SEC_MAX, 0);
 
         return orun;
 }
diff --git a/kernel/power/console.c b/kernel/power/console.c
index 623786d44159..89bcf4973ee5 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -27,7 +27,15 @@ int pm_prepare_console(void)
                 return 1;
         }
 
-        set_console(SUSPEND_CONSOLE);
+        if (set_console(SUSPEND_CONSOLE)) {
+                /*
+                 * We're unable to switch to the SUSPEND_CONSOLE.
+                 * Let the calling function know so it can decide
+                 * what to do.
+                 */
+                release_console_sem();
+                return 1;
+        }
         release_console_sem();
 
         if (vt_waitactive(SUSPEND_CONSOLE)) {
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index 406b20adb27a..873cdf8ea5a4 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -58,6 +58,7 @@ static inline int platform_prepare(void)
 
 static void power_down(suspend_disk_method_t mode)
 {
+        disable_nonboot_cpus();
         switch(mode) {
         case PM_DISK_PLATFORM:
                 if (pm_ops && pm_ops->enter) {
@@ -251,6 +252,7 @@ static int software_resume(void)
         error = swsusp_read();
         if (error) {
                 swsusp_free();
+                platform_finish();
                 goto Thaw;
         }
 
diff --git a/kernel/power/user.c b/kernel/power/user.c
index dd09efe7df54..d6a8dcc26ae5 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -398,9 +398,10 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
 
                 case PMOPS_ENTER:
                         if (data->platform_suspend) {
+                                disable_nonboot_cpus();
                                 kernel_shutdown_prepare(SYSTEM_SUSPEND_DISK);
                                 error = pm_ops->enter(PM_SUSPEND_DISK);
-                                error = 0;
+                                enable_nonboot_cpus();
                         }
                         break;
 
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 5567745470f7..eadfce2fff74 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -307,12 +307,19 @@ int tick_resume_broadcast(void)
         spin_lock_irqsave(&tick_broadcast_lock, flags);
 
         bc = tick_broadcast_device.evtdev;
-        if (bc) {
-                if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC &&
-                    !cpus_empty(tick_broadcast_mask))
-                        tick_broadcast_start_periodic(bc);
 
-                broadcast = cpu_isset(smp_processor_id(), tick_broadcast_mask);
+        if (bc) {
+                switch (tick_broadcast_device.mode) {
+                case TICKDEV_MODE_PERIODIC:
+                        if(!cpus_empty(tick_broadcast_mask))
+                                tick_broadcast_start_periodic(bc);
+                        broadcast = cpu_isset(smp_processor_id(),
+                                              tick_broadcast_mask);
+                        break;
+                case TICKDEV_MODE_ONESHOT:
+                        broadcast = tick_resume_broadcast_oneshot(bc);
+                        break;
+                }
         }
         spin_unlock_irqrestore(&tick_broadcast_lock, flags);
 
@@ -347,6 +354,16 @@ static int tick_broadcast_set_event(ktime_t expires, int force)
         }
 }
 
+int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
+{
+        clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+
+        if(!cpus_empty(tick_broadcast_oneshot_mask))
+                tick_broadcast_set_event(ktime_get(), 1);
+
+        return cpu_isset(smp_processor_id(), tick_broadcast_oneshot_mask);
+}
+
 /*
  * Reprogram the broadcast device:
  *
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 43ba1bdec14c..bfda3f7f0716 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -298,18 +298,17 @@ static void tick_shutdown(unsigned int *cpup)
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
-static void tick_suspend_periodic(void)
+static void tick_suspend(void)
 {
         struct tick_device *td = &__get_cpu_var(tick_cpu_device);
         unsigned long flags;
 
         spin_lock_irqsave(&tick_device_lock, flags);
-        if (td->mode == TICKDEV_MODE_PERIODIC)
-                clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_SHUTDOWN);
+        clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_SHUTDOWN);
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
-static void tick_resume_periodic(void)
+static void tick_resume(void)
 {
         struct tick_device *td = &__get_cpu_var(tick_cpu_device);
         unsigned long flags;
@@ -317,6 +316,8 @@ static void tick_resume_periodic(void)
         spin_lock_irqsave(&tick_device_lock, flags);
         if (td->mode == TICKDEV_MODE_PERIODIC)
                 tick_setup_periodic(td->evtdev, 0);
+        else
+                tick_resume_oneshot();
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
@@ -348,13 +349,13 @@ static int tick_notify(struct notifier_block *nb, unsigned long reason,
                 break;
 
         case CLOCK_EVT_NOTIFY_SUSPEND:
-                tick_suspend_periodic();
+                tick_suspend();
                 tick_suspend_broadcast();
                 break;
 
         case CLOCK_EVT_NOTIFY_RESUME:
                 if (!tick_resume_broadcast())
-                        tick_resume_periodic();
+                        tick_resume();
                 break;
 
         default:
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 75890efd24ff..c9d203bde518 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -19,12 +19,13 @@ extern void tick_setup_oneshot(struct clock_event_device *newdev,
 extern int tick_program_event(ktime_t expires, int force);
 extern void tick_oneshot_notify(void);
 extern int tick_switch_to_oneshot(void (*handler)(struct clock_event_device *));
-
+extern void tick_resume_oneshot(void);
 # ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
 extern void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
 extern void tick_broadcast_oneshot_control(unsigned long reason);
 extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
+extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
 # else /* BROADCAST */
 static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
@@ -43,6 +44,10 @@ void tick_setup_oneshot(struct clock_event_device *newdev,
 {
         BUG();
 }
+static inline void tick_resume_oneshot(void)
+{
+        BUG();
+}
 static inline int tick_program_event(ktime_t expires, int force)
 {
         return 0;
@@ -54,6 +59,10 @@ static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 }
 static inline void tick_broadcast_oneshot_control(unsigned long reason) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
+static inline int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
+{
+        return 0;
+}
 #endif /* !TICK_ONESHOT */
 
 /*
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index 2e8b7ff863cc..f6997ab0c3c9 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -41,6 +41,18 @@ int tick_program_event(ktime_t expires, int force)
 }
 
 /**
+ * tick_resume_onshot - resume oneshot mode
+ */
+void tick_resume_oneshot(void)
+{
+        struct tick_device *td = &__get_cpu_var(tick_cpu_device);
+        struct clock_event_device *dev = td->evtdev;
+
+        clockevents_set_mode(dev, CLOCK_EVT_MODE_ONESHOT);
+        tick_program_event(ktime_get(), 1);
+}
+
+/**
  * tick_setup_oneshot - setup the event device for oneshot mode (hres or nohz)
  */
 void tick_setup_oneshot(struct clock_event_device *newdev,
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index f50a2811f9dc..e5de3781d3fe 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -55,6 +55,22 @@ long congestion_wait(int rw, long timeout)
 }
 EXPORT_SYMBOL(congestion_wait);
 
+long congestion_wait_interruptible(int rw, long timeout)
+{
+        long ret;
+        DEFINE_WAIT(wait);
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        prepare_to_wait(wqh, &wait, TASK_INTERRUPTIBLE);
+        if (signal_pending(current))
+                ret = -ERESTARTSYS;
+        else
+                ret = io_schedule_timeout(timeout);
+        finish_wait(wqh, &wait);
+        return ret;
+}
+EXPORT_SYMBOL(congestion_wait_interruptible);
+
 /**
  * congestion_end - wake up sleepers on a congested backing_dev_info
  * @rw: READ or WRITE
diff --git a/mm/filemap.c b/mm/filemap.c
index d1060b8d3cd6..5dfc093ceb3d 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2379,7 +2379,8 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
         struct file *file = iocb->ki_filp;
         struct address_space *mapping = file->f_mapping;
         ssize_t retval;
-        size_t write_len = 0;
+        size_t write_len;
+        pgoff_t end = 0; /* silence gcc */
 
         /*
          * If it's a write, unmap all mmappings of the file up-front.  This
@@ -2388,23 +2389,46 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
          */
         if (rw == WRITE) {
                 write_len = iov_length(iov, nr_segs);
+                end = (offset + write_len - 1) >> PAGE_CACHE_SHIFT;
                 if (mapping_mapped(mapping))
                         unmap_mapping_range(mapping, offset, write_len, 0);
         }
 
         retval = filemap_write_and_wait(mapping);
-        if (retval == 0) {
-                retval = mapping->a_ops->direct_IO(rw, iocb, iov,
-                                                offset, nr_segs);
-                if (rw == WRITE && mapping->nrpages) {
-                        pgoff_t end = (offset + write_len - 1)
-                                                >> PAGE_CACHE_SHIFT;
-                        int err = invalidate_inode_pages2_range(mapping,
+        if (retval)
+                goto out;
+
+        /*
+         * After a write we want buffered reads to be sure to go to disk to get
+         * the new data.  We invalidate clean cached page from the region we're
+         * about to write.  We do this *before* the write so that we can return
+         * -EIO without clobbering -EIOCBQUEUED from ->direct_IO().
+         */
+        if (rw == WRITE && mapping->nrpages) {
+                retval = invalidate_inode_pages2_range(mapping,
                                         offset >> PAGE_CACHE_SHIFT, end);
-                        if (err)
-                                retval = err;
-                }
+                if (retval)
+                        goto out;
         }
+
+        retval = mapping->a_ops->direct_IO(rw, iocb, iov, offset, nr_segs);
+        if (retval)
+                goto out;
+
+        /*
+         * Finally, try again to invalidate clean pages which might have been
+         * faulted in by get_user_pages() if the source of the write was an
+         * mmap()ed region of the file we're writing.  That's a pretty crazy
+         * thing to do, so we don't support it 100%.  If this invalidation
+         * fails and we have -EIOCBQUEUED we ignore the failure.
+         */
+        if (rw == WRITE && mapping->nrpages) {
+                int err = invalidate_inode_pages2_range(mapping,
+                                              offset >> PAGE_CACHE_SHIFT, end);
+                if (err && retval >= 0)
+                        retval = err;
+        }
+out:
         return retval;
 }
 
diff --git a/mm/madvise.c b/mm/madvise.c
index 4e196155a0c3..77916e9fc52b 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -155,11 +155,14 @@ static long madvise_dontneed(struct vm_area_struct * vma,
  * Other filesystems return -ENOSYS.
  */
 static long madvise_remove(struct vm_area_struct *vma,
+                                struct vm_area_struct **prev,
                                 unsigned long start, unsigned long end)
 {
         struct address_space *mapping;
         loff_t offset, endoff;
 
+        *prev = vma;
+
         if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
                 return -EINVAL;
 
@@ -199,7 +202,7 @@ madvise_vma(struct vm_area_struct *vma, struct vm_area_struct **prev,
                 error = madvise_behavior(vma, prev, start, end, behavior);
                 break;
         case MADV_REMOVE:
-                error = madvise_remove(vma, start, end);
+                error = madvise_remove(vma, prev, start, end);
                 break;
 
         case MADV_WILLNEED:
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b278b8d60eee..2f3916986abf 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -320,7 +320,7 @@ static int oom_kill_task(struct task_struct *p)
          * Don't kill the process if any threads are set to OOM_DISABLE
          */
         do_each_thread(g, q) {
-                if (q->mm == mm && p->oomkilladj == OOM_DISABLE)
+                if (q->mm == mm && q->oomkilladj == OOM_DISABLE)
                         return 1;
         } while_each_thread(g, q);
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 820761f9eeef..702fa8f08747 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -463,6 +463,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         memcpy(n->cb, skb->cb, sizeof(skb->cb));
         C(len);
         C(data_len);
+        C(mac_len);
         C(csum);
         C(local_df);
         n->cloned = 1;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 72b3036bbc09..ada9b3db507d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1527,7 +1527,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
         t->revision++;
         t->size--;
 
-        preempt_disable();
         tp = NODE_PARENT(n);
         tnode_free((struct tnode *) n);
 
@@ -1537,7 +1536,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
                 rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
         } else
                 rcu_assign_pointer(t->trie, NULL);
-        preempt_enable();
 
         return 1;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 74c4d103ebc2..3834b10b5115 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2458,11 +2458,18 @@ void __init tcp_init(void)
                 sysctl_max_syn_backlog = 128;
         }
 
-        /* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
-        sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
-        sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+        /* Set the pressure threshold to be a fraction of global memory that
+         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
+         * memory, with a floor of 128 pages.
+         */
+        limit = min(nr_all_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        limit = (limit * (nr_all_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = max(limit, 128UL);
+        sysctl_tcp_mem[0] = limit / 4 * 3;
+        sysctl_tcp_mem[1] = limit;
         sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
 
+        /* Set per-socket limits to no more than 1/128 the pressure threshold */
         limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
         max_share = min(4UL*1024*1024, limit);
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f57a9baa6b27..92f99927d12d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            First: no IPv4 options.
          */
         newinet->opt = NULL;
+        newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
         newnp->rxopt.all = np->rxopt.all;
diff --git a/security/dummy.c b/security/dummy.c
index 558795b237d6..8ffd76405b5b 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -907,7 +907,7 @@ static void dummy_d_instantiate (struct dentry *dentry, struct inode *inode)
         return;
 }
 
-static int dummy_getprocattr(struct task_struct *p, char *name, void *value, size_t size)
+static int dummy_getprocattr(struct task_struct *p, char *name, char **value)
 {
         return -EINVAL;
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 19a385e9968e..d41e24d6ae41 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4468,11 +4468,12 @@ static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
 }
 
 static int selinux_getprocattr(struct task_struct *p,
-                               char *name, void *value, size_t size)
+                               char *name, char **value)
 {
         struct task_security_struct *tsec;
         u32 sid;
         int error;
+        unsigned len;
 
         if (current != p) {
                 error = task_has_perm(current, p, PROCESS__GETATTR);
@@ -4500,7 +4501,10 @@ static int selinux_getprocattr(struct task_struct *p,
         if (!sid)
                 return 0;
 
-        return selinux_getsecurity(sid, value, size);
+        error = security_sid_to_context(sid, value, &len);
+        if (error)
+                return error;
+        return len;
 }
 
 static int selinux_setprocattr(struct task_struct *p,
diff --git a/sound/oss/dmasound/dmasound_core.c b/sound/oss/dmasound/dmasound_core.c
index a0ec886f2aa3..f4056a9c371b 100644
--- a/sound/oss/dmasound/dmasound_core.c
+++ b/sound/oss/dmasound/dmasound_core.c
@@ -1346,22 +1346,34 @@ static const struct file_operations sq_fops =
         .ioctl          = sq_ioctl,
         .open           = sq_open,
         .release        = sq_release,
+};
+
 #ifdef HAS_RECORD
-        .read           = NULL  /* default to no read for compat mode */
-#endif
+static const struct file_operations sq_fops_record =
+{
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .write          = sq_write,
+        .poll           = sq_poll,
+        .ioctl          = sq_ioctl,
+        .open           = sq_open,
+        .release        = sq_release,
+        .read           = sq_read,
 };
+#endif
 
 static int sq_init(void)
 {
+        const struct file_operations *fops = &sq_fops;
 #ifndef MODULE
         int sq_unit;
 #endif
 
 #ifdef HAS_RECORD
         if (dmasound.mach.record)
-                sq_fops.read = sq_read ;
+                fops = &sq_fops_record;
 #endif
-        sq_unit = register_sound_dsp(&sq_fops, -1);
+        sq_unit = register_sound_dsp(fops, -1);
         if (sq_unit < 0) {
                 printk(KERN_ERR "dmasound_core: couldn't register fops\n") ;
                 return sq_unit ;