79 files changed, 877 insertions, 370 deletions

diff --git a/Documentation/rtc.txt b/Documentation/rtc.txt
index 2a58f985795a..7cf1ec5bcdd3 100644
--- a/Documentation/rtc.txt
+++ b/Documentation/rtc.txt
@@ -1,12 +1,49 @@
 
-        Real Time Clock Driver for Linux
-        ================================
+        Real Time Clock (RTC) Drivers for Linux
+        =======================================
+
+When Linux developers talk about a "Real Time Clock", they usually mean
+something that tracks wall clock time and is battery backed so that it
+works even with system power off.  Such clocks will normally not track
+the local time zone or daylight savings time -- unless they dual boot
+with MS-Windows -- but will instead be set to Coordinated Universal Time
+(UTC, formerly "Greenwich Mean Time").
+
+The newest non-PC hardware tends to just count seconds, like the time(2)
+system call reports, but RTCs also very commonly represent time using
+the Gregorian calendar and 24 hour time, as reported by gmtime(3).
+
+Linux has two largely-compatible userspace RTC API families you may
+need to know about:
+
+    *   /dev/rtc ... is the RTC provided by PC compatible systems,
+        so it's not very portable to non-x86 systems.
+
+    *   /dev/rtc0, /dev/rtc1 ... are part of a framework that's
+        supported by a wide variety of RTC chips on all systems.
+
+Programmers need to understand that the PC/AT functionality is not
+always available, and some systems can do much more.  That is, the
+RTCs use the same API to make requests in both RTC frameworks (using
+different filenames of course), but the hardware may not offer the
+same functionality.  For example, not every RTC is hooked up to an
+IRQ, so they can't all issue alarms; and where standard PC RTCs can
+only issue an alarm up to 24 hours in the future, other hardware may
+be able to schedule one any time in the upcoming century.
+
+
+        Old PC/AT-Compatible driver:  /dev/rtc
+        --------------------------------------
 
 All PCs (even Alpha machines) have a Real Time Clock built into them.
 Usually they are built into the chipset of the computer, but some may
 actually have a Motorola MC146818 (or clone) on the board. This is the
 clock that keeps the date and time while your computer is turned off.
 
+ACPI has standardized that MC146818 functionality, and extended it in
+a few ways (enabling longer alarm periods, and wake-from-hibernate).
+That functionality is NOT exposed in the old driver.
+
 However it can also be used to generate signals from a slow 2Hz to a
 relatively fast 8192Hz, in increments of powers of two. These signals
 are reported by interrupt number 8. (Oh! So *that* is what IRQ 8 is
@@ -63,223 +100,331 @@ Rather than write 50 pages describing the ioctl() and so on, it is
 perhaps more useful to include a small test program that demonstrates
 how to use them, and demonstrates the features of the driver. This is
 probably a lot more useful to people interested in writing applications
-that will be using this driver.
+that will be using this driver.  See the code at the end of this document.
+
+(The original /dev/rtc driver was written by Paul Gortmaker.)
+
+
+        New portable "RTC Class" drivers:  /dev/rtcN
+        --------------------------------------------
+
+Because Linux supports many non-ACPI and non-PC platforms, some of which
+have more than one RTC style clock, it needed a more portable solution
+than expecting a single battery-backed MC146818 clone on every system.
+Accordingly, a new "RTC Class" framework has been defined.  It offers
+three different userspace interfaces:
+
+    *   /dev/rtcN ... much the same as the older /dev/rtc interface
+
+    *   /sys/class/rtc/rtcN ... sysfs attributes support readonly
+        access to some RTC attributes.
+
+    *   /proc/driver/rtc ... the first RTC (rtc0) may expose itself
+        using a procfs interface.  More information is (currently) shown
+        here than through sysfs.
+
+The RTC Class framework supports a wide variety of RTCs, ranging from those
+integrated into embeddable system-on-chip (SOC) processors to discrete chips
+using I2C, SPI, or some other bus to communicate with the host CPU.  There's
+even support for PC-style RTCs ... including the features exposed on newer PCs
+through ACPI.
+
+The new framework also removes the "one RTC per system" restriction.  For
+example, maybe the low-power battery-backed RTC is a discrete I2C chip, but
+a high functionality RTC is integrated into the SOC.  That system might read
+the system clock from the discrete RTC, but use the integrated one for all
+other tasks, because of its greater functionality.
+
+The ioctl() calls supported by /dev/rtc are also supported by the RTC class
+framework.  However, because the chips and systems are not standardized,
+some PC/AT functionality might not be provided.  And in the same way, some
+newer features -- including those enabled by ACPI -- are exposed by the
+RTC class framework, but can't be supported by the older driver.
+
+    *   RTC_RD_TIME, RTC_SET_TIME ... every RTC supports at least reading
+        time, returning the result as a Gregorian calendar date and 24 hour
+        wall clock time.  To be most useful, this time may also be updated.
+
+    *   RTC_AIE_ON, RTC_AIE_OFF, RTC_ALM_SET, RTC_ALM_READ ... when the RTC
+        is connected to an IRQ line, it can often issue an alarm IRQ up to
+        24 hours in the future.
+
+    *   RTC_WKALM_SET, RTC_WKALM_READ ... RTCs that can issue alarms beyond
+        the next 24 hours use a slightly more powerful API, which supports
+        setting the longer alarm time and enabling its IRQ using a single
+        request (using the same model as EFI firmware).
+
+    *   RTC_UIE_ON, RTC_UIE_OFF ... if the RTC offers IRQs, it probably
+        also offers update IRQs whenever the "seconds" counter changes.
+        If needed, the RTC framework can emulate this mechanism.
+
+    *   RTC_PIE_ON, RTC_PIE_OFF, RTC_IRQP_SET, RTC_IRQP_READ ... another
+        feature often accessible with an IRQ line is a periodic IRQ, issued
+        at settable frequencies (usually 2^N Hz).
+
+In many cases, the RTC alarm can be a system wake event, used to force
+Linux out of a low power sleep state (or hibernation) back to a fully
+operational state.  For example, a system could enter a deep power saving
+state until it's time to execute some scheduled tasks.
 
-                                                Paul Gortmaker
 
 -------------------- 8< ---------------- 8< -----------------------------
 
 /*
- *      Real Time Clock Driver Test/Example Program
+ *      Real Time Clock Driver Test/Example Program
  *
- *      Compile with:
- *              gcc -s -Wall -Wstrict-prototypes rtctest.c -o rtctest
+ *      Compile with:
+ *                   gcc -s -Wall -Wstrict-prototypes rtctest.c -o rtctest
  *
- *      Copyright (C) 1996, Paul Gortmaker.
+ *      Copyright (C) 1996, Paul Gortmaker.
  *
- *      Released under the GNU General Public License, version 2,
- *      included herein by reference.
+ *      Released under the GNU General Public License, version 2,
+ *      included herein by reference.
  *
  */
 
 #include <stdio.h>
-#include <stdlib.h>
 #include <linux/rtc.h>
 #include <sys/ioctl.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <fcntl.h>
 #include <unistd.h>
+#include <stdlib.h>
 #include <errno.h>
 
-int main(void) {
-
-int i, fd, retval, irqcount = 0;
-unsigned long tmp, data;
-struct rtc_time rtc_tm;
 
-fd = open ("/dev/rtc", O_RDONLY);
+/*
+ * This expects the new RTC class driver framework, working with
+ * clocks that will often not be clones of what the PC-AT had.
+ * Use the command line to specify another RTC if you need one.
+ */
+static const char default_rtc[] = "/dev/rtc0";
+
+
+int main(int argc, char **argv)
+{
+        int i, fd, retval, irqcount = 0;
+        unsigned long tmp, data;
+        struct rtc_time rtc_tm;
+        const char *rtc = default_rtc;
+
+        switch (argc) {
+        case 2:
+                rtc = argv[1];
+                /* FALLTHROUGH */
+        case 1:
+                break;
+        default:
+                fprintf(stderr, "usage:  rtctest [rtcdev]\n");
+                return 1;
+        }
 
-if (fd ==  -1) {
-        perror("/dev/rtc");
-        exit(errno);
-}
+        fd = open(rtc, O_RDONLY);
 
-fprintf(stderr, "\n\t\t\tRTC Driver Test Example.\n\n");
+        if (fd ==  -1) {
+                perror(rtc);
+                exit(errno);
+        }
 
-/* Turn on update interrupts (one per second) */
-retval = ioctl(fd, RTC_UIE_ON, 0);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
+        fprintf(stderr, "\n\t\t\tRTC Driver Test Example.\n\n");
 
-fprintf(stderr, "Counting 5 update (1/sec) interrupts from reading /dev/rtc:");
-fflush(stderr);
-for (i=1; i<6; i++) {
-        /* This read will block */
-        retval = read(fd, &data, sizeof(unsigned long));
+        /* Turn on update interrupts (one per second) */
+        retval = ioctl(fd, RTC_UIE_ON, 0);
         if (retval == -1) {
-                perror("read");
+                if (errno == ENOTTY) {
+                        fprintf(stderr,
+                                "\n...Update IRQs not supported.\n");
+                        goto test_READ;
+                }
+                perror("ioctl");
                 exit(errno);
         }
-        fprintf(stderr, " %d",i);
+
+        fprintf(stderr, "Counting 5 update (1/sec) interrupts from reading %s:",
+                        rtc);
         fflush(stderr);
-        irqcount++;
-}
+        for (i=1; i<6; i++) {
+                /* This read will block */
+                retval = read(fd, &data, sizeof(unsigned long));
+                if (retval == -1) {
+                        perror("read");
+                        exit(errno);
+                }
+                fprintf(stderr, " %d",i);
+                fflush(stderr);
+                irqcount++;
+        }
 
-fprintf(stderr, "\nAgain, from using select(2) on /dev/rtc:");
-fflush(stderr);
-for (i=1; i<6; i++) {
-        struct timeval tv = {5, 0};     /* 5 second timeout on select */
-        fd_set readfds;
+        fprintf(stderr, "\nAgain, from using select(2) on /dev/rtc:");
+        fflush(stderr);
+        for (i=1; i<6; i++) {
+                struct timeval tv = {5, 0};     /* 5 second timeout on select */
+                fd_set readfds;
+
+                FD_ZERO(&readfds);
+                FD_SET(fd, &readfds);
+                /* The select will wait until an RTC interrupt happens. */
+                retval = select(fd+1, &readfds, NULL, NULL, &tv);
+                if (retval == -1) {
+                        perror("select");
+                        exit(errno);
+                }
+                /* This read won't block unlike the select-less case above. */
+                retval = read(fd, &data, sizeof(unsigned long));
+                if (retval == -1) {
+                        perror("read");
+                        exit(errno);
+                }
+                fprintf(stderr, " %d",i);
+                fflush(stderr);
+                irqcount++;
+        }
 
-        FD_ZERO(&readfds);
-        FD_SET(fd, &readfds);
-        /* The select will wait until an RTC interrupt happens. */
-        retval = select(fd+1, &readfds, NULL, NULL, &tv);
+        /* Turn off update interrupts */
+        retval = ioctl(fd, RTC_UIE_OFF, 0);
         if (retval == -1) {
-                perror("select");
+                perror("ioctl");
                 exit(errno);
         }
-        /* This read won't block unlike the select-less case above. */
-        retval = read(fd, &data, sizeof(unsigned long));
+
+test_READ:
+        /* Read the RTC time/date */
+        retval = ioctl(fd, RTC_RD_TIME, &rtc_tm);
         if (retval == -1) {
-                perror("read");
+                perror("ioctl");
                 exit(errno);
         }
-        fprintf(stderr, " %d",i);
-        fflush(stderr);
-        irqcount++;
-}
-
-/* Turn off update interrupts */
-retval = ioctl(fd, RTC_UIE_OFF, 0);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
-
-/* Read the RTC time/date */
-retval = ioctl(fd, RTC_RD_TIME, &rtc_tm);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
-
-fprintf(stderr, "\n\nCurrent RTC date/time is %d-%d-%d, %02d:%02d:%02d.\n",
-        rtc_tm.tm_mday, rtc_tm.tm_mon + 1, rtc_tm.tm_year + 1900,
-        rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
-
-/* Set the alarm to 5 sec in the future, and check for rollover */
-rtc_tm.tm_sec += 5;
-if (rtc_tm.tm_sec >= 60) {
-        rtc_tm.tm_sec %= 60;
-        rtc_tm.tm_min++;
-}
-if  (rtc_tm.tm_min == 60) {
-        rtc_tm.tm_min = 0;
-        rtc_tm.tm_hour++;
-}
-if  (rtc_tm.tm_hour == 24)
-        rtc_tm.tm_hour = 0;
-
-retval = ioctl(fd, RTC_ALM_SET, &rtc_tm);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
-
-/* Read the current alarm settings */
-retval = ioctl(fd, RTC_ALM_READ, &rtc_tm);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
-
-fprintf(stderr, "Alarm time now set to %02d:%02d:%02d.\n",
-        rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
 
-/* Enable alarm interrupts */
-retval = ioctl(fd, RTC_AIE_ON, 0);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
+        fprintf(stderr, "\n\nCurrent RTC date/time is %d-%d-%d, %02d:%02d:%02d.\n",
+                rtc_tm.tm_mday, rtc_tm.tm_mon + 1, rtc_tm.tm_year + 1900,
+                rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
 
-fprintf(stderr, "Waiting 5 seconds for alarm...");
-fflush(stderr);
-/* This blocks until the alarm ring causes an interrupt */
-retval = read(fd, &data, sizeof(unsigned long));
-if (retval == -1) {
-        perror("read");
-        exit(errno);
-}
-irqcount++;
-fprintf(stderr, " okay. Alarm rang.\n");
-
-/* Disable alarm interrupts */
-retval = ioctl(fd, RTC_AIE_OFF, 0);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
+        /* Set the alarm to 5 sec in the future, and check for rollover */
+        rtc_tm.tm_sec += 5;
+        if (rtc_tm.tm_sec >= 60) {
+                rtc_tm.tm_sec %= 60;
+                rtc_tm.tm_min++;
+        }
+        if  (rtc_tm.tm_min == 60) {
+                rtc_tm.tm_min = 0;
+                rtc_tm.tm_hour++;
+        }
+        if  (rtc_tm.tm_hour == 24)
+                rtc_tm.tm_hour = 0;
 
-/* Read periodic IRQ rate */
-retval = ioctl(fd, RTC_IRQP_READ, &tmp);
-if (retval == -1) {
-        perror("ioctl");
-        exit(errno);
-}
-fprintf(stderr, "\nPeriodic IRQ rate was %ldHz.\n", tmp);
+        retval = ioctl(fd, RTC_ALM_SET, &rtc_tm);
+        if (retval == -1) {
+                if (errno == ENOTTY) {
+                        fprintf(stderr,
+                                "\n...Alarm IRQs not supported.\n");
+                        goto test_PIE;
+                }
+                perror("ioctl");
+                exit(errno);
+        }
 
-fprintf(stderr, "Counting 20 interrupts at:");
-fflush(stderr);
+        /* Read the current alarm settings */
+        retval = ioctl(fd, RTC_ALM_READ, &rtc_tm);
+        if (retval == -1) {
+                perror("ioctl");
+                exit(errno);
+        }
 
-/* The frequencies 128Hz, 256Hz, ... 8192Hz are only allowed for root. */
-for (tmp=2; tmp<=64; tmp*=2) {
+        fprintf(stderr, "Alarm time now set to %02d:%02d:%02d.\n",
+                rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
 
-        retval = ioctl(fd, RTC_IRQP_SET, tmp);
+        /* Enable alarm interrupts */
+        retval = ioctl(fd, RTC_AIE_ON, 0);
         if (retval == -1) {
                 perror("ioctl");
                 exit(errno);
         }
 
-        fprintf(stderr, "\n%ldHz:\t", tmp);
+        fprintf(stderr, "Waiting 5 seconds for alarm...");
         fflush(stderr);
+        /* This blocks until the alarm ring causes an interrupt */
+        retval = read(fd, &data, sizeof(unsigned long));
+        if (retval == -1) {
+                perror("read");
+                exit(errno);
+        }
+        irqcount++;
+        fprintf(stderr, " okay. Alarm rang.\n");
 
-        /* Enable periodic interrupts */
-        retval = ioctl(fd, RTC_PIE_ON, 0);
+        /* Disable alarm interrupts */
+        retval = ioctl(fd, RTC_AIE_OFF, 0);
         if (retval == -1) {
                 perror("ioctl");
                 exit(errno);
         }
 
-        for (i=1; i<21; i++) {
-                /* This blocks */
-                retval = read(fd, &data, sizeof(unsigned long));
+test_PIE:
+        /* Read periodic IRQ rate */
+        retval = ioctl(fd, RTC_IRQP_READ, &tmp);
+        if (retval == -1) {
+                /* not all RTCs support periodic IRQs */
+                if (errno == ENOTTY) {
+                        fprintf(stderr, "\nNo periodic IRQ support\n");
+                        return 0;
+                }
+                perror("ioctl");
+                exit(errno);
+        }
+        fprintf(stderr, "\nPeriodic IRQ rate is %ldHz.\n", tmp);
+
+        fprintf(stderr, "Counting 20 interrupts at:");
+        fflush(stderr);
+
+        /* The frequencies 128Hz, 256Hz, ... 8192Hz are only allowed for root. */
+        for (tmp=2; tmp<=64; tmp*=2) {
+
+                retval = ioctl(fd, RTC_IRQP_SET, tmp);
                 if (retval == -1) {
-                        perror("read");
-                        exit(errno);
+                        /* not all RTCs can change their periodic IRQ rate */
+                        if (errno == ENOTTY) {
+                                fprintf(stderr,
+                                        "\n...Periodic IRQ rate is fixed\n");
+                                goto done;
+                        }
+                        perror("ioctl");
+                        exit(errno);
                 }
-                fprintf(stderr, " %d",i);
+
+                fprintf(stderr, "\n%ldHz:\t", tmp);
                 fflush(stderr);
-                irqcount++;
-        }
 
-        /* Disable periodic interrupts */
-        retval = ioctl(fd, RTC_PIE_OFF, 0);
-        if (retval == -1) {
-                perror("ioctl");
-                exit(errno);
+                /* Enable periodic interrupts */
+                retval = ioctl(fd, RTC_PIE_ON, 0);
+                if (retval == -1) {
+                        perror("ioctl");
+                        exit(errno);
+                }
+
+                for (i=1; i<21; i++) {
+                        /* This blocks */
+                        retval = read(fd, &data, sizeof(unsigned long));
+                        if (retval == -1) {
+                                       perror("read");
+                                       exit(errno);
+                        }
+                        fprintf(stderr, " %d",i);
+                        fflush(stderr);
+                        irqcount++;
+                }
+
+                /* Disable periodic interrupts */
+                retval = ioctl(fd, RTC_PIE_OFF, 0);
+                if (retval == -1) {
+                        perror("ioctl");
+                        exit(errno);
+                }
         }
-}
 
-fprintf(stderr, "\n\n\t\t\t *** Test complete ***\n");
-fprintf(stderr, "\nTyping \"cat /proc/interrupts\" will show %d more events on IRQ 8.\n\n",
-                                                                 irqcount);
+done:
+        fprintf(stderr, "\n\n\t\t\t *** Test complete ***\n");
 
-close(fd);
-return 0;
+        close(fd);
 
-} /* end main */
+        return 0;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index a5508f930ed9..e182992ff799 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -353,6 +353,12 @@ P:	Richard Purdie
 M:      rpurdie@rpsys.net
 S:      Maintained
 
+ARM/HP JORNADA 7XX MACHINE SUPPORT
+P:      Kristoffer Ericson
+M:      kristoffer_e1@hotmail.com
+W:      www.jlime.com
+S:      Maintained
+
 ARM/TOSA MACHINE SUPPORT
 P:      Dirk Opfer
 M:      dirk@opfer-online.de
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index adb05de40e24..ce00c570459d 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -879,6 +879,8 @@ endif
 
 source "drivers/scsi/Kconfig"
 
+source "drivers/ata/Kconfig"
+
 source "drivers/md/Kconfig"
 
 source "drivers/message/fusion/Kconfig"
diff --git a/arch/arm/mach-ebsa110/io.c b/arch/arm/mach-ebsa110/io.c
index c648bfb676a1..db38afb2aa88 100644
--- a/arch/arm/mach-ebsa110/io.c
+++ b/arch/arm/mach-ebsa110/io.c
@@ -28,7 +28,7 @@
 #include <asm/io.h>
 #include <asm/page.h>
 
-static void __iomem *__isamem_convert_addr(void __iomem *addr)
+static void __iomem *__isamem_convert_addr(const volatile void __iomem *addr)
 {
         u32 ret, a = (u32 __force) addr;
 
@@ -63,7 +63,7 @@ static void __iomem *__isamem_convert_addr(void __iomem *addr)
 /*
  * read[bwl] and write[bwl]
  */
-u8 __readb(void __iomem *addr)
+u8 __readb(const volatile void __iomem *addr)
 {
         void __iomem *a = __isamem_convert_addr(addr);
         u32 ret;
@@ -75,7 +75,7 @@ u8 __readb(void __iomem *addr)
         return ret;
 }
 
-u16 __readw(void __iomem *addr)
+u16 __readw(const volatile void __iomem *addr)
 {
         void __iomem *a = __isamem_convert_addr(addr);
 
@@ -85,7 +85,7 @@ u16 __readw(void __iomem *addr)
         return __raw_readw(a);
 }
 
-u32 __readl(void __iomem *addr)
+u32 __readl(const volatile void __iomem *addr)
 {
         void __iomem *a = __isamem_convert_addr(addr);
         u32 ret;
diff --git a/arch/arm/mm/consistent.c b/arch/arm/mm/consistent.c
index 50e6b6bfb2e2..b797217e82be 100644
--- a/arch/arm/mm/consistent.c
+++ b/arch/arm/mm/consistent.c
@@ -476,6 +476,9 @@ core_initcall(consistent_init);
 
 /*
  * Make an area consistent for devices.
+ * Note: Drivers should NOT use this function directly, as it will break
+ * platforms with CONFIG_DMABOUNCE.
+ * Use the driver DMA support - see dma-mapping.h (dma_sync_*)
  */
 void consistent_sync(void *vaddr, size_t size, int direction)
 {
diff --git a/arch/mips/mm/c-sb1.c b/arch/mips/mm/c-sb1.c
index d0ddb4a768a5..3a8afd47feaa 100644
--- a/arch/mips/mm/c-sb1.c
+++ b/arch/mips/mm/c-sb1.c
@@ -19,6 +19,7 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 #include <linux/init.h>
+#include <linux/hardirq.h>
 
 #include <asm/asm.h>
 #include <asm/bootinfo.h>
@@ -242,6 +243,25 @@ void sb1_flush_cache_page(struct vm_area_struct *vma, unsigned long addr, unsign
         __attribute__((alias("local_sb1_flush_cache_page")));
 #endif
 
+#ifdef CONFIG_SMP
+static void sb1_flush_cache_data_page_ipi(void *info)
+{
+        unsigned long start = (unsigned long)info;
+
+        __sb1_writeback_inv_dcache_range(start, start + PAGE_SIZE);
+}
+
+static void sb1_flush_cache_data_page(unsigned long addr)
+{
+        if (in_atomic())
+                __sb1_writeback_inv_dcache_range(addr, addr + PAGE_SIZE);
+        else
+                on_each_cpu(sb1_flush_cache_data_page_ipi, (void *) addr, 1, 1);
+}
+#else
+void sb1_flush_cache_data_page(unsigned long)
+        __attribute__((alias("local_sb1_flush_cache_data_page")));
+#endif
 
 /*
  * Invalidate all caches on this CPU
@@ -481,7 +501,7 @@ void sb1_cache_init(void)
 
         flush_cache_sigtramp = sb1_flush_cache_sigtramp;
         local_flush_data_cache_page = (void *) sb1_nop;
-        flush_data_cache_page = (void *) sb1_nop;
+        flush_data_cache_page = sb1_flush_cache_data_page;
 
         /* Full flush */
         __flush_cache_all = sb1___flush_cache_all;
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index a1b5e4b16151..46a24de36fec 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -1014,48 +1014,6 @@ void __init time_init(void)
         set_dec(tb_ticks_per_jiffy);
 }
 
-#ifdef CONFIG_RTC_CLASS
-static int set_rtc_class_time(struct rtc_time *tm)
-{
-        int err;
-        struct class_device *class_dev =
-                rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
-
-        if (class_dev == NULL)
-                return -ENODEV;
-
-        err = rtc_set_time(class_dev, tm);
-
-        rtc_class_close(class_dev);
-
-        return 0;
-}
-
-static void get_rtc_class_time(struct rtc_time *tm)
-{
-        int err;
-        struct class_device *class_dev =
-                rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
-
-        if (class_dev == NULL)
-                return;
-
-        err = rtc_read_time(class_dev, tm);
-
-        rtc_class_close(class_dev);
-
-        return;
-}
-
-int __init rtc_class_hookup(void)
-{
-        ppc_md.get_rtc_time = get_rtc_class_time;
-        ppc_md.set_rtc_time = set_rtc_class_time;
-
-        return 0;
-}
-#endif /* CONFIG_RTC_CLASS */
-
 
 #define FEBRUARY        2
 #define STARTOFTIME     1970
diff --git a/arch/powerpc/platforms/83xx/mpc832x_mds.c b/arch/powerpc/platforms/83xx/mpc832x_mds.c
index 54dea9d42dc9..a43ac71ab740 100644
--- a/arch/powerpc/platforms/83xx/mpc832x_mds.c
+++ b/arch/powerpc/platforms/83xx/mpc832x_mds.c
@@ -24,6 +24,7 @@
 #include <linux/root_dev.h>
 #include <linux/initrd.h>
 
+#include <asm/of_device.h>
 #include <asm/system.h>
 #include <asm/atomic.h>
 #include <asm/time.h>
@@ -136,6 +137,24 @@ static void __init mpc832x_sys_setup_arch(void)
 #endif
 }
 
+static int __init mpc832x_declare_of_platform_devices(void)
+{
+        struct device_node *np;
+
+        for (np = NULL; (np = of_find_compatible_node(np, "network",
+                                        "ucc_geth")) != NULL;) {
+                int ucc_num;
+                char bus_id[BUS_ID_SIZE];
+
+                ucc_num = *((uint *) get_property(np, "device-id", NULL)) - 1;
+                snprintf(bus_id, BUS_ID_SIZE, "ucc_geth.%u", ucc_num);
+                of_platform_device_create(np, bus_id, NULL);
+        }
+
+        return 0;
+}
+device_initcall(mpc832x_declare_of_platform_devices);
+
 void __init mpc832x_sys_init_IRQ(void)
 {
 
diff --git a/arch/powerpc/platforms/83xx/mpc834x_itx.c b/arch/powerpc/platforms/83xx/mpc834x_itx.c
index 5446bab08eca..e2bcaaf6b329 100644
--- a/arch/powerpc/platforms/83xx/mpc834x_itx.c
+++ b/arch/powerpc/platforms/83xx/mpc834x_itx.c
@@ -108,10 +108,6 @@ static int __init mpc834x_itx_probe(void)
         return 1;
 }
 
-#ifdef CONFIG_RTC_CLASS
-late_initcall(rtc_class_hookup);
-#endif
-
 define_machine(mpc834x_itx) {
         .name                   = "MPC834x ITX",
         .probe                  = mpc834x_itx_probe,
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index 6516f6dca96d..13a86bd383d3 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -233,6 +233,8 @@ extern unsigned long __do_user_copy(void *to, const void *from, int n,
                                     void (*op)(void *to, const void *from,
                                                int n), int *faulted_out);
 
+/* execvp.c */
+extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);
 /* helper.c */
 extern int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
                       unsigned long *stack_out);
diff --git a/arch/um/os-Linux/Makefile b/arch/um/os-Linux/Makefile
index b4183929b32c..2f8c79464015 100644
--- a/arch/um/os-Linux/Makefile
+++ b/arch/um/os-Linux/Makefile
@@ -3,8 +3,8 @@
 # Licensed under the GPL
 #
 
-obj-y = aio.o elf_aux.o file.o helper.o irq.o main.o mem.o process.o sigio.o \
-        signal.o start_up.o time.o trap.o tty.o uaccess.o umid.o tls.o \
+obj-y = aio.o elf_aux.o execvp.o file.o helper.o irq.o main.o mem.o process.o \
+        sigio.o signal.o start_up.o time.o trap.o tty.o uaccess.o umid.o tls.o \
         user_syms.o util.o drivers/ sys-$(SUBARCH)/
 
 obj-$(CONFIG_MODE_SKAS) += skas/
@@ -15,9 +15,9 @@ user-objs-$(CONFIG_MODE_TT) += tt.o
 obj-$(CONFIG_TTY_LOG) += tty_log.o
 user-objs-$(CONFIG_TTY_LOG) += tty_log.o
 
-USER_OBJS := $(user-objs-y) aio.o elf_aux.o file.o helper.o irq.o main.o mem.o \
-        process.o sigio.o signal.o start_up.o time.o trap.o tty.o tls.o \
-        uaccess.o umid.o util.o
+USER_OBJS := $(user-objs-y) aio.o elf_aux.o execvp.o file.o helper.o irq.o \
+        main.o mem.o process.o sigio.o signal.o start_up.o time.o trap.o tty.o \
+        tls.o uaccess.o umid.o util.o
 
 CFLAGS_user_syms.o += -DSUBARCH_$(SUBARCH)
 
diff --git a/arch/um/os-Linux/execvp.c b/arch/um/os-Linux/execvp.c
new file mode 100644
index 000000000000..66e583a4031b
--- /dev/null
+++ b/arch/um/os-Linux/execvp.c
@@ -0,0 +1,149 @@
+/* Copyright (C) 2006 by Paolo Giarrusso - modified from glibc' execvp.c.
+   Original copyright notice follows:
+
+   Copyright (C) 1991,92,1995-99,2002,2004 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, write to the Free
+   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+   02111-1307 USA.  */
+#include <unistd.h>
+
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <limits.h>
+
+#ifndef TEST
+#include "um_malloc.h"
+#else
+#include <stdio.h>
+#define um_kmalloc malloc
+#endif
+#include "os.h"
+
+/* Execute FILE, searching in the `PATH' environment variable if it contains
+   no slashes, with arguments ARGV and environment from `environ'.  */
+int execvp_noalloc(char *buf, const char *file, char *const argv[])
+{
+        if (*file == '\0') {
+                return -ENOENT;
+        }
+
+        if (strchr (file, '/') != NULL) {
+                /* Don't search when it contains a slash.  */
+                execv(file, argv);
+        } else {
+                int got_eacces;
+                size_t len, pathlen;
+                char *name, *p;
+                char *path = getenv("PATH");
+                if (path == NULL)
+                        path = ":/bin:/usr/bin";
+
+                len = strlen(file) + 1;
+                pathlen = strlen(path);
+                /* Copy the file name at the top.  */
+                name = memcpy(buf + pathlen + 1, file, len);
+                /* And add the slash.  */
+                *--name = '/';
+
+                got_eacces = 0;
+                p = path;
+                do {
+                        char *startp;
+
+                        path = p;
+                        //Let's avoid this GNU extension.
+                        //p = strchrnul (path, ':');
+                        p = strchr(path, ':');
+                        if (!p)
+                                p = strchr(path, '\0');
+
+                        if (p == path)
+                                /* Two adjacent colons, or a colon at the beginning or the end
+                                   of `PATH' means to search the current directory.  */
+                                startp = name + 1;
+                        else
+                                startp = memcpy(name - (p - path), path, p - path);
+
+                        /* Try to execute this name.  If it works, execv will not return.  */
+                        execv(startp, argv);
+
+                        /*
+                        if (errno == ENOEXEC) {
+                        }
+                        */
+
+                        switch (errno) {
+                                case EACCES:
+                                        /* Record the we got a `Permission denied' error.  If we end
+                                           up finding no executable we can use, we want to diagnose
+                                           that we did find one but were denied access.  */
+                                        got_eacces = 1;
+                                case ENOENT:
+                                case ESTALE:
+                                case ENOTDIR:
+                                        /* Those errors indicate the file is missing or not executable
+                                           by us, in which case we want to just try the next path
+                                           directory.  */
+                                case ENODEV:
+                                case ETIMEDOUT:
+                                        /* Some strange filesystems like AFS return even
+                                           stranger error numbers.  They cannot reasonably mean
+                                           anything else so ignore those, too.  */
+                                case ENOEXEC:
+                                        /* We won't go searching for the shell
+                                         * if it is not executable - the Linux
+                                         * kernel already handles this enough,
+                                         * for us. */
+                                        break;
+
+                                default:
+                                        /* Some other error means we found an executable file, but
+                                           something went wrong executing it; return the error to our
+                                           caller.  */
+                                        return -errno;
+                        }
+                } while (*p++ != '\0');
+
+                /* We tried every element and none of them worked.  */
+                if (got_eacces)
+                        /* At least one failure was due to permissions, so report that
+                           error.  */
+                        return -EACCES;
+        }
+
+        /* Return the error from the last attempt (probably ENOENT).  */
+        return -errno;
+}
+#ifdef TEST
+int main(int argc, char**argv)
+{
+        char buf[PATH_MAX];
+        int ret;
+        argc--;
+        if (!argc) {
+                fprintf(stderr, "Not enough arguments\n");
+                return 1;
+        }
+        argv++;
+        if (ret = execvp_noalloc(buf, argv[0], argv)) {
+                errno = -ret;
+                perror("execvp_noalloc");
+        }
+        return 0;
+}
+#endif
diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c
index d13299cfa318..c7ad6306e22f 100644
--- a/arch/um/os-Linux/helper.c
+++ b/arch/um/os-Linux/helper.c
@@ -8,18 +8,21 @@
 #include <unistd.h>
 #include <errno.h>
 #include <sched.h>
+#include <limits.h>
 #include <sys/signal.h>
 #include <sys/wait.h>
 #include "user.h"
 #include "kern_util.h"
 #include "user_util.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct helper_data {
         void (*pre_exec)(void*);
         void *pre_data;
         char **argv;
         int fd;
+        char *buf;
 };
 
 /* Debugging aid, changed only from gdb */
@@ -41,9 +44,8 @@ static int helper_child(void *arg)
         }
         if (data->pre_exec != NULL)
                 (*data->pre_exec)(data->pre_data);
-        execvp(argv[0], argv);
-        errval = -errno;
-        printk("helper_child - execve of '%s' failed - errno = %d\n", argv[0], errno);
+        errval = execvp_noalloc(data->buf, argv[0], argv);
+        printk("helper_child - execvp of '%s' failed - errno = %d\n", argv[0], -errval);
         os_write_file(data->fd, &errval, sizeof(errval));
         kill(os_getpid(), SIGKILL);
         return 0;
@@ -84,11 +86,13 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
         data.pre_data = pre_data;
         data.argv = argv;
         data.fd = fds[1];
+        data.buf = __cant_sleep() ? um_kmalloc_atomic(PATH_MAX) :
+                                        um_kmalloc(PATH_MAX);
         pid = clone(helper_child, (void *) sp, CLONE_VM | SIGCHLD, &data);
         if (pid < 0) {
                 ret = -errno;
                 printk("run_helper : clone failed, errno = %d\n", errno);
-                goto out_close;
+                goto out_free2;
         }
 
         close(fds[1]);
@@ -109,6 +113,8 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
                 CATCH_EINTR(waitpid(pid, NULL, 0));
         }
 
+out_free2:
+        kfree(data.buf);
 out_close:
         if (fds[1] != -1)
                 close(fds[1]);
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 7ba5e49ab302..6fd174a37149 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -83,10 +83,8 @@ static int acpi_processor_ppc_notifier(struct notifier_block *nb,
                 goto out;
 
         ppc = (unsigned int)pr->performance_platform_limit;
-        if (!ppc)
-                goto out;
 
-        if (ppc > pr->performance->state_count)
+        if (ppc >= pr->performance->state_count)
                 goto out;
 
         cpufreq_verify_within_limits(policy, 0,
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 68ad11af22b4..002fde46d38d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -591,8 +591,10 @@ void device_del(struct device * dev)
 
         if (parent)
                 klist_del(&dev->knode_parent);
-        if (dev->devt_attr)
+        if (dev->devt_attr) {
                 device_remove_file(dev, dev->devt_attr);
+                kfree(dev->devt_attr);
+        }
         if (dev->class) {
                 sysfs_remove_link(&dev->kobj, "subsystem");
                 sysfs_remove_link(&dev->class->subsys.kset.kobj, dev->bus_id);
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index c39200161688..5ff457b41efb 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -1054,7 +1054,7 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 {
         struct page * page;
 
-        page = alloc_page(GFP_KERNEL);
+        page = alloc_page(GFP_KERNEL | GFP_DMA32);
         if (page == NULL)
                 return NULL;
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index d1ede7db5a12..555b3a8ab49c 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -169,7 +169,7 @@ static void *i8xx_alloc_pages(void)
 {
         struct page * page;
 
-        page = alloc_pages(GFP_KERNEL, 2);
+        page = alloc_pages(GFP_KERNEL | GFP_DMA32, 2);
         if (page == NULL)
                 return NULL;
 
@@ -387,11 +387,7 @@ static void intel_i830_init_gtt_entries(void)
         /* We obtain the size of the GTT, which is also stored (for some
          * reason) at the top of stolen memory. Then we add 4KB to that
          * for the video BIOS popup, which is also stored in there. */
-
-        if (IS_I965)
-                size = 512 + 4;
-        else
-                size = agp_bridge->driver->fetch_size() + 4;
+        size = agp_bridge->driver->fetch_size() + 4;
 
         if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82830_HB ||
             agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82845G_HB) {
@@ -805,6 +801,26 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
 
         return 0;
 }
+
+/*
+ * The i965 supports 36-bit physical addresses, but to keep
+ * the format of the GTT the same, the bits that don't fit
+ * in a 32-bit word are shifted down to bits 4..7.
+ *
+ * Gcc is smart enough to notice that "(addr >> 28) & 0xf0"
+ * is always zero on 32-bit architectures, so no need to make
+ * this conditional.
+ */
+static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
+        unsigned long addr, int type)
+{
+        /* Shift high bits down */
+        addr |= (addr >> 28) & 0xf0;
+
+        /* Type checking must be done elsewhere */
+        return addr | bridge->driver->masks[type].mask;
+}
+
 static int intel_i965_fetch_size(void)
 {
        struct aper_size_info_fixed *values;
@@ -832,7 +848,8 @@ static int intel_i965_fetch_size(void)
 
        agp_bridge->previous_size = agp_bridge->current_size = (void *)(values + offset);
 
-       return values[offset].size;
+        /* The i965 GTT is always sized as if it had a 512kB aperture size */
+        return 512;
 }
 
 /* The intel i965 automatically initializes the agp aperture during POST.
@@ -1584,7 +1601,7 @@ static struct agp_bridge_driver intel_i965_driver = {
        .fetch_size             = intel_i965_fetch_size,
        .cleanup                = intel_i915_cleanup,
        .tlb_flush              = intel_i810_tlbflush,
-       .mask_memory            = intel_i810_mask_memory,
+       .mask_memory            = intel_i965_mask_memory,
        .masks                  = intel_i810_masks,
        .agp_enable             = intel_i810_agp_enable,
        .cache_flush            = global_cache_flush,
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 2444a0e24b31..244d30a03fef 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -792,15 +792,14 @@ static int __init tlclk_init(void)
         ret = misc_register(&tlclk_miscdev);
         if (ret < 0) {
                 printk(KERN_ERR "tlclk: misc_register returns %d.\n", ret);
-                ret = -EBUSY;
                 goto out3;
         }
 
         tlclk_device = platform_device_register_simple("telco_clock",
                                 -1, NULL, 0);
-        if (!tlclk_device) {
+        if (IS_ERR(tlclk_device)) {
                 printk(KERN_ERR "tlclk: platform_device_register failed.\n");
-                ret = -EBUSY;
+                ret = PTR_ERR(tlclk_device);
                 goto out4;
         }
 
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 2cc71b66231e..491779af8d55 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -107,6 +107,7 @@ config CPU_FREQ_GOV_USERSPACE
 
 config CPU_FREQ_GOV_ONDEMAND
         tristate "'ondemand' cpufreq policy governor"
+        select CPU_FREQ_TABLE
         help
           'ondemand' - This driver adds a dynamic cpufreq policy governor.
           The governor does a periodic polling and 
diff --git a/drivers/i2c/busses/i2c-ixp4xx.c b/drivers/i2c/busses/i2c-ixp4xx.c
index 05fffb9415a2..68fe863f9d54 100644
--- a/drivers/i2c/busses/i2c-ixp4xx.c
+++ b/drivers/i2c/busses/i2c-ixp4xx.c
@@ -138,7 +138,7 @@ static int ixp4xx_i2c_probe(struct platform_device *plat_dev)
         gpio_line_set(gpio->sda_pin, 0);
 
         err = i2c_bit_add_bus(&drv_data->adapter);
-        if (err != 0)
+        if (err) {
                 printk(KERN_ERR "ERROR: Could not install %s\n", plat_dev->dev.bus_id);
 
                 kfree(drv_data);
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index 244f7eb7006d..cfad09accf52 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -768,14 +768,7 @@ ioc4_ide_init(void)
         return ioc4_register_submodule(&ioc4_ide_submodule);
 }
 
-static void __devexit
-ioc4_ide_exit(void)
-{
-        ioc4_unregister_submodule(&ioc4_ide_submodule);
-}
-
 late_initcall(ioc4_ide_init); /* Call only after IDE init is done */
-module_exit(ioc4_ide_exit);
 
 MODULE_AUTHOR("Aniket Malatpure/Jeremy Higdon");
 MODULE_DESCRIPTION("IDE PCI driver module for SGI IOC4 Base-IO Card");
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 53304e6991ac..a2ab2eebfc68 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -348,7 +348,7 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra
 
 static void dvb_frontend_swzigzag(struct dvb_frontend *fe)
 {
-        fe_status_t s;
+        fe_status_t s = 0;
         struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         /* if we've got no parameters, just keep idling */
diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
index 7456b0b9976b..4c27a2d90a38 100644
--- a/drivers/media/dvb/frontends/tda10086.c
+++ b/drivers/media/dvb/frontends/tda10086.c
@@ -441,6 +441,10 @@ static int tda10086_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_pa
 
         dprintk ("%s\n", __FUNCTION__);
 
+        // check for invalid symbol rate
+        if (fe_params->u.qpsk.symbol_rate < 500000)
+                return -EINVAL;
+
         // calculate the updated frequency (note: we convert from Hz->kHz)
         tmp64 = tda10086_read_byte(state, 0x52);
         tmp64 |= (tda10086_read_byte(state, 0x51) << 8);
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index e58f0391e9d1..56f1c80defc6 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -46,6 +46,10 @@
 #include "lnbp21.h"
 #include "bsru6.h"
 
+static int diseqc_method;
+module_param(diseqc_method, int, 0444);
+MODULE_PARM_DESC(diseqc_method, "Select DiSEqC method for subsystem id 13c2:1003, 0: default, 1: more reliable (for newer revisions only)");
+
 static void Set22K (struct budget *budget, int state)
 {
         struct saa7146_dev *dev=budget->dev;
@@ -382,6 +386,11 @@ static void frontend_init(struct budget *budget)
                 if (budget->dvb_frontend) {
                         budget->dvb_frontend->ops.tuner_ops.set_params = alps_bsru6_tuner_set_params;
                         budget->dvb_frontend->tuner_priv = &budget->i2c_adap;
+                        if (budget->dev->pci->subsystem_device == 0x1003 && diseqc_method == 0) {
+                                budget->dvb_frontend->ops.diseqc_send_master_cmd = budget_diseqc_send_master_cmd;
+                                budget->dvb_frontend->ops.diseqc_send_burst = budget_diseqc_send_burst;
+                                budget->dvb_frontend->ops.set_tone = budget_set_tone;
+                        }
                         break;
                 }
                 break;
diff --git a/drivers/media/video/et61x251/et61x251_core.c b/drivers/media/video/et61x251/et61x251_core.c
index f786ab11d2cd..86e353b26b53 100644
--- a/drivers/media/video/et61x251/et61x251_core.c
+++ b/drivers/media/video/et61x251/et61x251_core.c
@@ -1182,8 +1182,6 @@ static void et61x251_release_resources(struct et61x251_device* cam)
         video_set_drvdata(cam->v4ldev, NULL);
         video_unregister_device(cam->v4ldev);
 
-        usb_put_dev(cam->usbdev);
-
         mutex_unlock(&et61x251_sysfs_lock);
 
         kfree(cam->control_buffer);
@@ -1275,6 +1273,7 @@ static int et61x251_release(struct inode* inode, struct file* filp)
 
         if (cam->state & DEV_DISCONNECTED) {
                 et61x251_release_resources(cam);
+                usb_put_dev(cam->usbdev);
                 mutex_unlock(&cam->dev_mutex);
                 kfree(cam);
                 return 0;
diff --git a/drivers/media/video/saa6588.c b/drivers/media/video/saa6588.c
index a81285ca7d5b..7b9859c33018 100644
--- a/drivers/media/video/saa6588.c
+++ b/drivers/media/video/saa6588.c
@@ -212,8 +212,10 @@ static void read_from_buf(struct saa6588 *s, struct rds_command *a)
         if (rd_blocks > s->block_count)
                 rd_blocks = s->block_count;
 
-        if (!rd_blocks)
+        if (!rd_blocks) {
+                spin_unlock_irqrestore(&s->lock, flags);
                 return;
+        }
 
         for (i = 0; i < rd_blocks; i++) {
                 if (block_to_user_buf(s, buf_ptr)) {
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index c5719f7bd1ac..f28398dd9d93 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -1464,8 +1464,6 @@ static int saa711x_attach(struct i2c_adapter *adapter, int address, int kind)
         client->driver = &i2c_driver_saa711x;
         snprintf(client->name, sizeof(client->name) - 1, "saa7115");
 
-        v4l_dbg(1, debug, client, "detecting saa7115 client on address 0x%x\n", address << 1);
-
         for (i=0;i<0x0f;i++) {
                 saa711x_write(client, 0, i);
                 name[i] = (saa711x_read(client, 0) &0x0f) +'0';
@@ -1477,6 +1475,13 @@ static int saa711x_attach(struct i2c_adapter *adapter, int address, int kind)
         saa711x_write(client, 0, 5);
         chip_id = saa711x_read(client, 0) & 0x0f;
 
+        /* Check whether this chip is part of the saa711x series */
+        if (memcmp(name, "1f711", 5)) {
+                v4l_dbg(1, debug, client, "chip found @ 0x%x (ID %s) does not match a known saa711x chip.\n",
+                        address << 1, name);
+                return 0;
+        }
+
         snprintf(client->name, sizeof(client->name) - 1, "saa711%d",chip_id);
         v4l_info(client, "saa711%d found (%s) @ 0x%x (%s)\n", chip_id, name, address << 1, adapter->name);
 
diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c
index a4702d3c2aca..42fb60d985b9 100644
--- a/drivers/media/video/sn9c102/sn9c102_core.c
+++ b/drivers/media/video/sn9c102/sn9c102_core.c
@@ -1462,8 +1462,6 @@ static void sn9c102_release_resources(struct sn9c102_device* cam)
         video_set_drvdata(cam->v4ldev, NULL);
         video_unregister_device(cam->v4ldev);
 
-        usb_put_dev(cam->usbdev);
-
         mutex_unlock(&sn9c102_sysfs_lock);
 
         kfree(cam->control_buffer);
@@ -1555,6 +1553,7 @@ static int sn9c102_release(struct inode* inode, struct file* filp)
 
         if (cam->state & DEV_DISCONNECTED) {
                 sn9c102_release_resources(cam);
+                usb_put_dev(cam->usbdev);
                 mutex_unlock(&cam->dev_mutex);
                 kfree(cam);
                 return 0;
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 86b3bb9bec2d..92420f007b97 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -914,7 +914,7 @@ static void decode_prio_command(struct sixpack *sp, unsigned char cmd)
                                         printk(KERN_DEBUG "6pack: protocol violation\n");
                                 else
                                         sp->status = 0;
-                                cmd &= !SIXP_RX_DCD_MASK;
+                                cmd &= ~SIXP_RX_DCD_MASK;
                 }
                 sp->status = cmd & SIXP_PRIO_DATA_MASK;
         } else { /* output watchdog char if idle */
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 1dbdd6bb587b..c20bb998e0e5 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -6979,8 +6979,10 @@ static int tg3_open(struct net_device *dev)
         tg3_full_lock(tp, 0);
 
         err = tg3_set_power_state(tp, PCI_D0);
-        if (err)
+        if (err) {
+                tg3_full_unlock(tp);
                 return err;
+        }
 
         tg3_disable_ints(tp);
         tp->tg3_flags &= ~TG3_FLAG_INIT_COMPLETE;
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index a20d84d707d9..21d83a895b21 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -1272,7 +1272,9 @@ static void pcmcia_bus_remove_socket(struct class_device *class_dev,
         pccard_register_pcmcia(socket, NULL);
 
         /* unregister any unbound devices */
+        mutex_lock(&socket->skt_mutex);
         pcmcia_card_remove(socket, NULL);
+        mutex_unlock(&socket->skt_mutex);
 
         pcmcia_put_socket(socket);
 
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 579cd667b16f..6f11f6dfdd9d 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -145,6 +145,13 @@ int rtc_set_alarm(struct class_device *class_dev, struct rtc_wkalrm *alarm)
 }
 EXPORT_SYMBOL_GPL(rtc_set_alarm);
 
+/**
+ * rtc_update_irq - report RTC periodic, alarm, and/or update irqs
+ * @class_dev: the rtc's class device
+ * @num: how many irqs are being reported (usually one)
+ * @events: mask of RTC_IRQF with one or more of RTC_PF, RTC_AF, RTC_UF
+ * Context: in_interrupt(), irqs blocked
+ */
 void rtc_update_irq(struct class_device *class_dev,
                 unsigned long num, unsigned long events)
 {
@@ -201,12 +208,12 @@ int rtc_irq_register(struct class_device *class_dev, struct rtc_task *task)
         if (task == NULL || task->func == NULL)
                 return -EINVAL;
 
-        spin_lock(&rtc->irq_task_lock);
+        spin_lock_irq(&rtc->irq_task_lock);
         if (rtc->irq_task == NULL) {
                 rtc->irq_task = task;
                 retval = 0;
         }
-        spin_unlock(&rtc->irq_task_lock);
+        spin_unlock_irq(&rtc->irq_task_lock);
 
         return retval;
 }
@@ -216,10 +223,10 @@ void rtc_irq_unregister(struct class_device *class_dev, struct rtc_task *task)
 {
         struct rtc_device *rtc = to_rtc_device(class_dev);
 
-        spin_lock(&rtc->irq_task_lock);
+        spin_lock_irq(&rtc->irq_task_lock);
         if (rtc->irq_task == task)
                 rtc->irq_task = NULL;
-        spin_unlock(&rtc->irq_task_lock);
+        spin_unlock_irq(&rtc->irq_task_lock);
 }
 EXPORT_SYMBOL_GPL(rtc_irq_unregister);
 
@@ -265,3 +272,4 @@ int rtc_irq_set_freq(struct class_device *class_dev, struct rtc_task *task, int
         }
         return err;
 }
+EXPORT_SYMBOL_GPL(rtc_irq_set_freq);
diff --git a/drivers/rtc/rtc-at91.c b/drivers/rtc/rtc-at91.c
index bd61e99540a3..5c8addcaf1fb 100644
--- a/drivers/rtc/rtc-at91.c
+++ b/drivers/rtc/rtc-at91.c
@@ -292,7 +292,8 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
                                         AT91_RTC_CALEV);
 
         ret = request_irq(AT91_ID_SYS, at91_rtc_interrupt,
-                                IRQF_SHARED, "at91_rtc", pdev);
+                                IRQF_DISABLED | IRQF_SHARED,
+                                "at91_rtc", pdev);
         if (ret) {
                 printk(KERN_ERR "at91_rtc: IRQ %d already in use.\n",
                                 AT91_ID_SYS);
diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
index 583789c66cdb..814b9e1873f5 100644
--- a/drivers/rtc/rtc-dev.c
+++ b/drivers/rtc/rtc-dev.c
@@ -61,7 +61,9 @@ static void rtc_uie_task(void *data)
         int err;
 
         err = rtc_read_time(&rtc->class_dev, &tm);
-        spin_lock_irq(&rtc->irq_lock);
+
+        local_irq_disable();
+        spin_lock(&rtc->irq_lock);
         if (rtc->stop_uie_polling || err) {
                 rtc->uie_task_active = 0;
         } else if (rtc->oldsecs != tm.tm_sec) {
@@ -74,11 +76,11 @@ static void rtc_uie_task(void *data)
         } else if (schedule_work(&rtc->uie_task) == 0) {
                 rtc->uie_task_active = 0;
         }
-        spin_unlock_irq(&rtc->irq_lock);
+        spin_unlock(&rtc->irq_lock);
         if (num)
                 rtc_update_irq(&rtc->class_dev, num, RTC_UF | RTC_IRQF);
+        local_irq_enable();
 }
-
 static void rtc_uie_timer(unsigned long data)
 {
         struct rtc_device *rtc = (struct rtc_device *)data;
@@ -214,7 +216,7 @@ static int rtc_dev_ioctl(struct inode *inode, struct file *file,
         struct rtc_wkalrm alarm;
         void __user *uarg = (void __user *) arg;
 
-        /* check that the calles has appropriate permissions
+        /* check that the calling task has appropriate permissions
          * for certain ioctls. doing this check here is useful
          * to avoid duplicate code in each driver.
          */
@@ -238,10 +240,10 @@ static int rtc_dev_ioctl(struct inode *inode, struct file *file,
 
         /* avoid conflicting IRQ users */
         if (cmd == RTC_PIE_ON || cmd == RTC_PIE_OFF || cmd == RTC_IRQP_SET) {
-                spin_lock(&rtc->irq_task_lock);
+                spin_lock_irq(&rtc->irq_task_lock);
                 if (rtc->irq_task)
                         err = -EBUSY;
-                spin_unlock(&rtc->irq_task_lock);
+                spin_unlock_irq(&rtc->irq_task_lock);
 
                 if (err < 0)
                         return err;
@@ -299,6 +301,17 @@ static int rtc_dev_ioctl(struct inode *inode, struct file *file,
 
                 err = rtc_set_time(class_dev, &tm);
                 break;
+
+        case RTC_IRQP_READ:
+                if (ops->irq_set_freq)
+                        err = put_user(rtc->irq_freq, (unsigned long *) arg);
+                break;
+
+        case RTC_IRQP_SET:
+                if (ops->irq_set_freq)
+                        err = rtc_irq_set_freq(class_dev, rtc->irq_task, arg);
+                break;
+
 #if 0
         case RTC_EPOCH_SET:
 #ifndef rtc_epoch
diff --git a/drivers/rtc/rtc-ds1553.c b/drivers/rtc/rtc-ds1553.c
index 78552e6e76aa..001eb1123a65 100644
--- a/drivers/rtc/rtc-ds1553.c
+++ b/drivers/rtc/rtc-ds1553.c
@@ -340,7 +340,8 @@ static int __init ds1553_rtc_probe(struct platform_device *pdev)
 
         if (pdata->irq >= 0) {
                 writeb(0, ioaddr + RTC_INTERRUPTS);
-                if (request_irq(pdata->irq, ds1553_rtc_interrupt, IRQF_SHARED,
+                if (request_irq(pdata->irq, ds1553_rtc_interrupt,
+                                IRQF_DISABLED | IRQF_SHARED,
                                 pdev->name, pdev) < 0) {
                         dev_warn(&pdev->dev, "interrupt not available.\n");
                         pdata->irq = -1;
diff --git a/drivers/rtc/rtc-rs5c372.c b/drivers/rtc/rtc-rs5c372.c
index 2a86632580f1..a44fe4efa216 100644
--- a/drivers/rtc/rtc-rs5c372.c
+++ b/drivers/rtc/rtc-rs5c372.c
@@ -126,13 +126,13 @@ static int rs5c372_get_trim(struct i2c_client *client, int *osc, int *trim)
                 return -EIO;
         }
 
-        dev_dbg(&client->dev, "%s: raw trim=%x\n", __FUNCTION__, *trim);
-
         if (osc)
                 *osc = (buf & RS5C372_TRIM_XSL) ? 32000 : 32768;
 
-        if (trim)
+        if (trim) {
                 *trim = buf & RS5C372_TRIM_MASK;
+                dev_dbg(&client->dev, "%s: raw trim=%x\n", __FUNCTION__, *trim);
+        }
 
         return 0;
 }
diff --git a/drivers/rtc/rtc-test.c b/drivers/rtc/rtc-test.c
index bc4bd24508a2..6ef9c62d5032 100644
--- a/drivers/rtc/rtc-test.c
+++ b/drivers/rtc/rtc-test.c
@@ -99,6 +99,7 @@ static ssize_t test_irq_store(struct device *dev,
         struct rtc_device *rtc = platform_get_drvdata(plat_dev);
 
         retval = count;
+        local_irq_disable();
         if (strncmp(buf, "tick", 4) == 0)
                 rtc_update_irq(&rtc->class_dev, 1, RTC_PF | RTC_IRQF);
         else if (strncmp(buf, "alarm", 5) == 0)
@@ -107,6 +108,7 @@ static ssize_t test_irq_store(struct device *dev,
                 rtc_update_irq(&rtc->class_dev, 1, RTC_UF | RTC_IRQF);
         else
                 retval = -EINVAL;
+        local_irq_enable();
 
         return retval;
 }
diff --git a/drivers/usb/input/ati_remote.c b/drivers/usb/input/ati_remote.c
index f659f3028ad2..787b847d38cc 100644
--- a/drivers/usb/input/ati_remote.c
+++ b/drivers/usb/input/ati_remote.c
@@ -636,13 +636,11 @@ static void ati_remote_free_buffers(struct ati_remote *ati_remote)
         if (ati_remote->out_urb)
                 usb_free_urb(ati_remote->out_urb);
 
-        if (ati_remote->inbuf)
-                usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
-                                ati_remote->inbuf, ati_remote->inbuf_dma);
+        usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
+                ati_remote->inbuf, ati_remote->inbuf_dma);
 
-        if (ati_remote->outbuf)
-                usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
-                                ati_remote->inbuf, ati_remote->outbuf_dma);
+        usb_buffer_free(ati_remote->udev, DATA_BUFSIZE,
+                ati_remote->outbuf, ati_remote->outbuf_dma);
 }
 
 static void ati_remote_input_init(struct ati_remote *ati_remote)
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index a736d44989c4..137d76c3f90a 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -21,6 +21,7 @@
 #include <linux/mount.h>
 #include <linux/pagemap.h>
 #include <linux/init.h>
+#include <linux/kobject.h>
 #include <linux/namei.h>
 #include <linux/debugfs.h>
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index cfc8f81e60d0..c71a6c092ad9 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -138,6 +138,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 struct fuse_entry_out outarg;
                 struct fuse_conn *fc;
                 struct fuse_req *req;
+                struct fuse_req *forget_req;
                 struct dentry *parent;
 
                 /* Doesn't hurt to "reset" the validity timeout */
@@ -152,25 +153,33 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 if (IS_ERR(req))
                         return 0;
 
+                forget_req = fuse_get_req(fc);
+                if (IS_ERR(forget_req)) {
+                        fuse_put_request(fc, req);
+                        return 0;
+                }
+
                 parent = dget_parent(entry);
                 fuse_lookup_init(req, parent->d_inode, entry, &outarg);
                 request_send(fc, req);
                 dput(parent);
                 err = req->out.h.error;
+                fuse_put_request(fc, req);
                 /* Zero nodeid is same as -ENOENT */
                 if (!err && !outarg.nodeid)
                         err = -ENOENT;
                 if (!err) {
                         struct fuse_inode *fi = get_fuse_inode(inode);
                         if (outarg.nodeid != get_node_id(inode)) {
-                                fuse_send_forget(fc, req, outarg.nodeid, 1);
+                                fuse_send_forget(fc, forget_req,
+                                                 outarg.nodeid, 1);
                                 return 0;
                         }
                         spin_lock(&fc->lock);
                         fi->nlookup ++;
                         spin_unlock(&fc->lock);
                 }
-                fuse_put_request(fc, req);
+                fuse_put_request(fc, forget_req);
                 if (err || (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
                         return 0;
 
@@ -221,6 +230,7 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         struct inode *inode = NULL;
         struct fuse_conn *fc = get_fuse_conn(dir);
         struct fuse_req *req;
+        struct fuse_req *forget_req;
 
         if (entry->d_name.len > FUSE_NAME_MAX)
                 return ERR_PTR(-ENAMETOOLONG);
@@ -229,9 +239,16 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         if (IS_ERR(req))
                 return ERR_PTR(PTR_ERR(req));
 
+        forget_req = fuse_get_req(fc);
+        if (IS_ERR(forget_req)) {
+                fuse_put_request(fc, req);
+                return ERR_PTR(PTR_ERR(forget_req));
+        }
+
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
         err = req->out.h.error;
+        fuse_put_request(fc, req);
         /* Zero nodeid is same as -ENOENT, but with valid timeout */
         if (!err && outarg.nodeid &&
             (invalid_nodeid(outarg.nodeid) || !valid_mode(outarg.attr.mode)))
@@ -240,11 +257,11 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                                   &outarg.attr);
                 if (!inode) {
-                        fuse_send_forget(fc, req, outarg.nodeid, 1);
+                        fuse_send_forget(fc, forget_req, outarg.nodeid, 1);
                         return ERR_PTR(-ENOMEM);
                 }
         }
-        fuse_put_request(fc, req);
+        fuse_put_request(fc, forget_req);
         if (err && err != -ENOENT)
                 return ERR_PTR(err);
 
@@ -388,6 +405,13 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         struct fuse_entry_out outarg;
         struct inode *inode;
         int err;
+        struct fuse_req *forget_req;
+
+        forget_req = fuse_get_req(fc);
+        if (IS_ERR(forget_req)) {
+                fuse_put_request(fc, req);
+                return PTR_ERR(forget_req);
+        }
 
         req->in.h.nodeid = get_node_id(dir);
         req->out.numargs = 1;
@@ -395,24 +419,24 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         req->out.args[0].value = &outarg;
         request_send(fc, req);
         err = req->out.h.error;
-        if (err) {
-                fuse_put_request(fc, req);
-                return err;
-        }
+        fuse_put_request(fc, req);
+        if (err)
+                goto out_put_forget_req;
+
         err = -EIO;
         if (invalid_nodeid(outarg.nodeid))
-                goto out_put_request;
+                goto out_put_forget_req;
 
         if ((outarg.attr.mode ^ mode) & S_IFMT)
-                goto out_put_request;
+                goto out_put_forget_req;
 
         inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                           &outarg.attr);
         if (!inode) {
-                fuse_send_forget(fc, req, outarg.nodeid, 1);
+                fuse_send_forget(fc, forget_req, outarg.nodeid, 1);
                 return -ENOMEM;
         }
-        fuse_put_request(fc, req);
+        fuse_put_request(fc, forget_req);
 
         if (S_ISDIR(inode->i_mode)) {
                 struct dentry *alias;
@@ -434,8 +458,8 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         fuse_invalidate_attr(dir);
         return 0;
 
- out_put_request:
-        fuse_put_request(fc, req);
+ out_put_forget_req:
+        fuse_put_request(fc, forget_req);
         return err;
 }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8df27401d292..795319c54f72 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -442,7 +442,8 @@ static int mountstats_open(struct inode *inode, struct file *file)
 
                 if (task) {
                         task_lock(task);
-                        namespace = task->nsproxy->namespace;
+                        if (task->nsproxy)
+                                namespace = task->nsproxy->namespace;
                         if (namespace)
                                 get_namespace(namespace);
                         task_unlock(task);
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index b67ce9354048..ac14318c81ba 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -74,7 +74,8 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
                         igrab(inode);
                         reiserfs_warning(inode->i_sb,
                                          "pinning inode %lu because the "
-                                         "preallocation can't be freed");
+                                         "preallocation can't be freed",
+                                         inode->i_ino);
                         goto out;
                 }
         }
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 5b050c06795f..498ad50d1f45 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -1171,6 +1171,8 @@ xfs_bmap_add_extent_delay_real(
                 xfs_bmap_trace_pre_update(fname, "0", ip, idx, XFS_DATA_FORK);
                 xfs_bmbt_set_blockcount(ep, temp);
                 r[0] = *new;
+                r[1].br_state = PREV.br_state;
+                r[1].br_startblock = 0;
                 r[1].br_startoff = new_endoff;
                 temp2 = PREV.br_startoff + PREV.br_blockcount - new_endoff;
                 r[1].br_blockcount = temp2;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index d72c80dbfbb1..44dfac521285 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2258,7 +2258,7 @@ xfs_ifree_cluster(
                                 AIL_LOCK(mp,s);
                                 iip->ili_flush_lsn = iip->ili_item.li_lsn;
                                 AIL_UNLOCK(mp, s);
-                                xfs_iflags_set(ip, XFS_ISTALE);
+                                xfs_iflags_set(iip->ili_inode, XFS_ISTALE);
                                 pre_flushed++;
                         }
                         lip = lip->li_bio_list;
diff --git a/include/asm-arm/arch-ebsa110/io.h b/include/asm-arm/arch-ebsa110/io.h
index ae048441c9ed..722c5e086285 100644
--- a/include/asm-arm/arch-ebsa110/io.h
+++ b/include/asm-arm/arch-ebsa110/io.h
@@ -27,9 +27,9 @@ void __outw(u16 val, unsigned int port);
 u32 __inl(unsigned int port);
 void __outl(u32 val, unsigned int port);
 
-u8  __readb(void __iomem *addr);
-u16 __readw(void __iomem *addr);
-u32 __readl(void __iomem *addr);
+u8  __readb(const volatile void __iomem *addr);
+u16 __readw(const volatile void __iomem *addr);
+u32 __readl(const volatile void __iomem *addr);
 
 void __writeb(u8  val, void __iomem *addr);
 void __writew(u16 val, void __iomem *addr);
@@ -64,8 +64,14 @@ void __writel(u32 val, void __iomem *addr);
 #define writew(v,b)             __writew(v,b)
 #define writel(v,b)             __writel(v,b)
 
-#define __arch_ioremap(cookie,sz,c)     ((void __iomem *)(cookie))
-#define __arch_iounmap(cookie)          do { } while (0)
+static inline void __iomem *__arch_ioremap(unsigned long cookie, size_t size,
+                                           unsigned int flags)
+{
+        return (void __iomem *)cookie;
+}
+
+#define __arch_ioremap          __arch_ioremap
+#define __arch_iounmap(cookie)  do { } while (0)
 
 extern void insb(unsigned int port, void *buf, int sz);
 extern void insw(unsigned int port, void *buf, int sz);
diff --git a/include/asm-arm/dma-mapping.h b/include/asm-arm/dma-mapping.h
index 55eb4dc3253d..666617711c81 100644
--- a/include/asm-arm/dma-mapping.h
+++ b/include/asm-arm/dma-mapping.h
@@ -12,6 +12,10 @@
  * uncached, unwrite-buffered mapped memory space for use with DMA
  * devices.  This is the "generic" version.  The PCI specific version
  * is in pci.h
+ *
+ * Note: Drivers should NOT use this function directly, as it will break
+ * platforms with CONFIG_DMABOUNCE.
+ * Use the driver DMA support - see dma-mapping.h (dma_sync_*)
  */
 extern void consistent_sync(void *kaddr, size_t size, int rw);
 
diff --git a/include/asm-mips/mach-au1x00/au1xxx_ide.h b/include/asm-mips/mach-au1x00/au1xxx_ide.h
index 301e71300779..e9fa252f8a3f 100644
--- a/include/asm-mips/mach-au1x00/au1xxx_ide.h
+++ b/include/asm-mips/mach-au1x00/au1xxx_ide.h
@@ -170,10 +170,8 @@ int __init auide_probe(void);
         static int auide_dma_host_on(ide_drive_t *drive);
         static int auide_dma_lostirq(ide_drive_t *drive);
         static int auide_dma_on(ide_drive_t *drive);
-        static void auide_ddma_tx_callback(int irq, void *param,
-                                           struct pt_regs *regs);
-        static void auide_ddma_rx_callback(int irq, void *param,
-                                           struct pt_regs *regs);
+        static void auide_ddma_tx_callback(int irq, void *param);
+        static void auide_ddma_rx_callback(int irq, void *param);
         static int auide_dma_off_quietly(ide_drive_t *drive);
 #endif /* end CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA */
 
diff --git a/include/asm-parisc/semaphore.h b/include/asm-parisc/semaphore.h
index c9ee41cd0707..d45827a21f94 100644
--- a/include/asm-parisc/semaphore.h
+++ b/include/asm-parisc/semaphore.h
@@ -115,7 +115,8 @@ extern __inline__ int down_interruptible(struct semaphore * sem)
  */
 extern __inline__ int down_trylock(struct semaphore * sem)
 {
-        int flags, count;
+        unsigned long flags;
+        int count;
 
         spin_lock_irqsave(&sem->sentry, flags);
         count = sem->count - 1;
@@ -131,7 +132,8 @@ extern __inline__ int down_trylock(struct semaphore * sem)
  */
 extern __inline__ void up(struct semaphore * sem)
 {
-        int flags;
+        unsigned long flags;
+
         spin_lock_irqsave(&sem->sentry, flags);
         if (sem->count < 0) {
                 __up(sem);
diff --git a/include/asm-powerpc/time.h b/include/asm-powerpc/time.h
index a78285010d62..4cff977ad526 100644
--- a/include/asm-powerpc/time.h
+++ b/include/asm-powerpc/time.h
@@ -39,10 +39,6 @@ extern void generic_calibrate_decr(void);
 extern void wakeup_decrementer(void);
 extern void snapshot_timebase(void);
 
-#ifdef CONFIG_RTC_CLASS
-extern int __init rtc_class_hookup(void);
-#endif
-
 /* Some sane defaults: 125 MHz timebase, 1GHz processor */
 extern unsigned long ppc_proc_freq;
 #define DEFAULT_PROC_FREQ       (DEFAULT_TB_FREQ * 8)
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index 03f43e2893a4..21dd56905271 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -191,7 +191,7 @@ struct ip_mc_list
 #define IGMPV3_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
 #define IGMPV3_EXP(thresh, nbmant, nbexp, value) \
         ((value) < (thresh) ? (value) : \
-        ((IGMPV3_MASK(value, nbmant) | (1<<(nbmant+nbexp))) << \
+        ((IGMPV3_MASK(value, nbmant) | (1<<(nbmant))) << \
          (IGMPV3_MASK((value) >> (nbmant), nbexp) + (nbexp))))
 
 #define IGMPV3_QQIC(value) IGMPV3_EXP(0x80, 4, 3, value)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 24b611147adb..b9b5e4ba166a 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -30,8 +30,10 @@ extern const char linux_banner[];
 
 #define STACK_MAGIC     0xdeadbeef
 
+#define ALIGN(x,a)              __ALIGN_MASK(x,(typeof(x))(a)-1)
+#define __ALIGN_MASK(x,mask)    (((x)+(mask))&~(mask))
+
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
-#define ALIGN(x,a) (((x)+(a)-1UL)&~((a)-1UL))
 #define FIELD_SIZEOF(t, f) (sizeof(((t*)0)->f))
 #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
 #define roundup(x, y) ((((x) + ((y) - 1)) / (y)) * (y))
diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
index f6baecdeecd6..971d1c6dfc4b 100644
--- a/include/linux/nsproxy.h
+++ b/include/linux/nsproxy.h
@@ -45,8 +45,10 @@ static inline void exit_task_namespaces(struct task_struct *p)
 {
         struct nsproxy *ns = p->nsproxy;
         if (ns) {
-                put_nsproxy(ns);
+                task_lock(p);
                 p->nsproxy = NULL;
+                task_unlock(p);
+                put_nsproxy(ns);
         }
 }
 #endif
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index b800d2d68b32..8451052ca66f 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -183,13 +183,27 @@ do {								\
 #define read_lock(lock)                 _read_lock(lock)
 
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+
 #define spin_lock_irqsave(lock, flags)  flags = _spin_lock_irqsave(lock)
 #define read_lock_irqsave(lock, flags)  flags = _read_lock_irqsave(lock)
 #define write_lock_irqsave(lock, flags) flags = _write_lock_irqsave(lock)
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+#define spin_lock_irqsave_nested(lock, flags, subclass) \
+        flags = _spin_lock_irqsave_nested(lock, subclass)
+#else
+#define spin_lock_irqsave_nested(lock, flags, subclass) \
+        flags = _spin_lock_irqsave(lock)
+#endif
+
 #else
+
 #define spin_lock_irqsave(lock, flags)  _spin_lock_irqsave(lock, flags)
 #define read_lock_irqsave(lock, flags)  _read_lock_irqsave(lock, flags)
 #define write_lock_irqsave(lock, flags) _write_lock_irqsave(lock, flags)
+#define spin_lock_irqsave_nested(lock, flags, subclass) \
+        spin_lock_irqsave(lock, flags)
+
 #endif
 
 #define spin_lock_irq(lock)             _spin_lock_irq(lock)
diff --git a/include/linux/spinlock_api_smp.h b/include/linux/spinlock_api_smp.h
index 8828b8155e9c..8a2307ce7296 100644
--- a/include/linux/spinlock_api_smp.h
+++ b/include/linux/spinlock_api_smp.h
@@ -32,6 +32,8 @@ void __lockfunc _read_lock_irq(rwlock_t *lock)		__acquires(lock);
 void __lockfunc _write_lock_irq(rwlock_t *lock)         __acquires(lock);
 unsigned long __lockfunc _spin_lock_irqsave(spinlock_t *lock)
                                                         __acquires(lock);
+unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclass)
+                                                        __acquires(lock);
 unsigned long __lockfunc _read_lock_irqsave(rwlock_t *lock)
                                                         __acquires(lock);
 unsigned long __lockfunc _write_lock_irqsave(rwlock_t *lock)
diff --git a/include/net/sock.h b/include/net/sock.h
index ac286a353032..9cdbae2a53a3 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -883,18 +883,23 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
 }
 
 /**
- *      sk_filter_release: Release a socket filter
- *      @rcu: rcu_head that contains the sk_filter info to remove
- *
- *      Remove a filter from a socket and release its resources.
+ *      sk_filter_rcu_free: Free a socket filter
+ *      @rcu: rcu_head that contains the sk_filter to free
  */
- 
 static inline void sk_filter_rcu_free(struct rcu_head *rcu)
 {
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
         kfree(fp);
 }
 
+/**
+ *      sk_filter_release: Release a socket filter
+ *      @sk: socket
+ *      @fp: filter to remove
+ *
+ *      Remove a filter from a socket and release its resources.
+ */
+
 static inline void sk_filter_release(struct sock *sk, struct sk_filter *fp)
 {
         unsigned int size = sk_filter_len(fp);
diff --git a/kernel/fork.c b/kernel/fork.c
index 3da978eec791..8cdd3e72ba55 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1315,9 +1315,8 @@ struct task_struct * __devinit fork_idle(int cpu)
         struct pt_regs regs;
 
         task = copy_process(CLONE_VM, 0, idle_regs(&regs), 0, NULL, NULL, 0);
-        if (!task)
-                return ERR_PTR(-ENOMEM);
-        init_idle(task, cpu);
+        if (!IS_ERR(task))
+                init_idle(task, cpu);
 
         return task;
 }
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 42aa6f1a3f0f..a681912bc89a 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -231,10 +231,10 @@ fastcall unsigned int __do_IRQ(unsigned int irq)
                 spin_unlock(&desc->lock);
 
                 action_ret = handle_IRQ_event(irq, action);
-
-                spin_lock(&desc->lock);
                 if (!noirqdebug)
                         note_interrupt(irq, desc, action_ret);
+
+                spin_lock(&desc->lock);
                 if (likely(!(desc->status & IRQ_PENDING)))
                         break;
                 desc->status &= ~IRQ_PENDING;
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 9c7e2e4c1fe7..543ea2e5ad93 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -147,11 +147,7 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
         if (unlikely(irqfixup)) {
                 /* Don't punish working computers */
                 if ((irqfixup == 2 && irq == 0) || action_ret == IRQ_NONE) {
-                        int ok;
-
-                        spin_unlock(&desc->lock);
-                        ok = misrouted_irq(irq);
-                        spin_lock(&desc->lock);
+                        int ok = misrouted_irq(irq);
                         if (action_ret == IRQ_NONE)
                                 desc->irqs_unhandled -= ok;
                 }
diff --git a/kernel/spinlock.c b/kernel/spinlock.c
index 476c3741511b..2c6c2bf85514 100644
--- a/kernel/spinlock.c
+++ b/kernel/spinlock.c
@@ -293,6 +293,27 @@ void __lockfunc _spin_lock_nested(spinlock_t *lock, int subclass)
 }
 
 EXPORT_SYMBOL(_spin_lock_nested);
+unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclass)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        preempt_disable();
+        spin_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
+        /*
+         * On lockdep we dont want the hand-coded irq-enable of
+         * _raw_spin_lock_flags() code, because lockdep assumes
+         * that interrupts are not re-enabled during lock-acquire:
+         */
+#ifdef CONFIG_PROVE_SPIN_LOCKING
+        _raw_spin_lock(lock);
+#else
+        _raw_spin_lock_flags(lock, &flags);
+#endif
+        return flags;
+}
+
+EXPORT_SYMBOL(_spin_lock_irqsave_nested);
 
 #endif
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index bf2f6cff1d6a..aa6fcc7ca66f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2612,6 +2612,9 @@ unsigned long __init find_min_pfn_for_node(unsigned long nid)
 {
         int i;
 
+        /* Regions in the early_node_map can be in any order */
+        sort_node_map();
+
         /* Assuming a sorted map, the first range found has the starting pfn */
         for_each_active_range_index_in_nid(i, nid)
                 return early_node_map[i].start_pfn;
@@ -2680,9 +2683,6 @@ void __init free_area_init_nodes(unsigned long *max_zone_pfn)
                         max(max_zone_pfn[i], arch_zone_lowest_possible_pfn[i]);
         }
 
-        /* Regions in the early_node_map can be in any order */
-        sort_node_map();
-
         /* Print out the zone ranges */
         printk("Zone PFN ranges:\n");
         for (i = 0; i < MAX_NR_ZONES; i++)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 65f094845719..bb94e6da223c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -57,6 +57,7 @@
 static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 {
         __u8 status;
+        struct hci_conn *pend;
 
         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 
@@ -71,6 +72,15 @@ static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb
                         clear_bit(HCI_INQUIRY, &hdev->flags);
                         hci_req_complete(hdev, status);
                 }
+
+                hci_dev_lock(hdev);
+
+                pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+                if (pend)
+                        hci_acl_connect(pend);
+
+                hci_dev_unlock(hdev);
+
                 break;
 
         default:
@@ -565,11 +575,20 @@ static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
+        struct hci_conn *pend;
 
         BT_DBG("%s status %d", hdev->name, status);
 
         clear_bit(HCI_INQUIRY, &hdev->flags);
         hci_req_complete(hdev, status);
+
+        hci_dev_lock(hdev);
+
+        pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+        if (pend)
+                hci_acl_connect(pend);
+
+        hci_dev_unlock(hdev);
 }
 
 /* Inquiry Result */
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index f26a9eb49945..711a085eca5b 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -120,10 +120,13 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                         if (!hci_test_bit(evt, &flt->event_mask))
                                 continue;
 
-                        if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE && 
-                                        flt->opcode != *(__u16 *)(skb->data + 3)) ||
-                                        (evt == HCI_EV_CMD_STATUS && 
-                                        flt->opcode != *(__u16 *)(skb->data + 4))))
+                        if (flt->opcode &&
+                            ((evt == HCI_EV_CMD_COMPLETE &&
+                              flt->opcode !=
+                              get_unaligned((__u16 *)(skb->data + 3))) ||
+                             (evt == HCI_EV_CMD_STATUS &&
+                              flt->opcode !=
+                              get_unaligned((__u16 *)(skb->data + 4)))))
                                 continue;
                 }
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 954eb74eb370..3eeeb7a86e75 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -259,7 +259,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         BT_DBG("conn %p", conn);
 
-        conn->dev.parent  = &hdev->dev;
+        conn->dev.bus = &bt_bus;
+        conn->dev.parent = &hdev->dev;
+
         conn->dev.release = bt_release;
 
         snprintf(conn->dev.bus_id, BUS_ID_SIZE,
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 2b3dcb8f90fa..bbf78e6a7bc3 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1353,12 +1353,12 @@ static inline int l2cap_conf_output(struct sock *sk, void **ptr)
 
         /* Configure output options and let the other side know
          * which ones we don't like. */
-        if (pi->conf_mtu < pi->omtu) {
-                l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+        if (pi->conf_mtu < pi->omtu)
                 result = L2CAP_CONF_UNACCEPT;
-        } else {
+        else
                 pi->omtu = pi->conf_mtu;
-        }
+
+        l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
 
         BT_DBG("sk %p result %d", sk, result);
         return result;
@@ -1533,6 +1533,9 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
                 return -ENOENT;
 
+        if (sk->sk_state == BT_DISCONN)
+                goto unlock;
+
         l2cap_parse_conf_req(sk, req->data, cmd->len - sizeof(*req));
 
         if (flags & 0x0001) {
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index b8e3a5f1c8a8..1fb5d42f37ae 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -765,7 +765,7 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct termios *old)
 
         BT_DBG("tty %p termios %p", tty, old);
 
-        if (!dev)
+        if (!dev || !dev->dlc || !dev->dlc->session)
                 return;
 
         /* Handle turning off CRTSCTS */
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index eb0ff7ab05ed..fc4242c0767c 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -277,7 +277,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         __u64 seq;
 
         sk = inet6_lookup(&dccp_hashinfo, &hdr->daddr, dh->dccph_dport,
-                          &hdr->saddr, dh->dccph_sport, skb->dev->ifindex);
+                          &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
 
         if (sk == NULL) {
                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 146496fce2e2..fded1493c1dc 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -160,6 +160,8 @@ static __init int dccpprobe_init(void)
         init_waitqueue_head(&dccpw.wait);
         spin_lock_init(&dccpw.lock);
         dccpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &dccpw.lock);
+        if (IS_ERR(dccpw.fifo))
+                return PTR_ERR(dccpw.fifo);
 
         if (!proc_net_fops_create(procname, S_IRUSR, &dccpprobe_fops))
                 goto err0;
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index 7b7441202bfd..6cb9070cd0bc 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1417,7 +1417,7 @@ static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
                 DEBUGP
                     ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
                      info->timeout);
-                ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
+                ip_ct_refresh(ct, *pskb, info->timeout * HZ);
 
                 /* Set expect timeout */
                 read_lock_bh(&ip_conntrack_lock);
@@ -1465,7 +1465,7 @@ static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
         info->sig_port[!dir] = 0;
 
         /* Give it 30 seconds for UCF or URJ */
-        ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
+        ip_ct_refresh(ct, *pskb, 30 * HZ);
 
         return 0;
 }
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 4be336f17883..f230eeecf092 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -156,6 +156,8 @@ static __init int tcpprobe_init(void)
         init_waitqueue_head(&tcpw.wait);
         spin_lock_init(&tcpw.lock);
         tcpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &tcpw.lock);
+        if (IS_ERR(tcpw.fifo))
+                return PTR_ERR(tcpw.fifo);
 
         if (!proc_net_fops_create(procname, S_IRUSR, &tcpprobe_fops))
                 goto err0;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 865d75214a9a..9e1bd374875e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -928,23 +928,32 @@ static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
         return 1; 
 #else
         struct udp_sock *up = udp_sk(sk);
-        struct udphdr *uh = skb->h.uh;
+        struct udphdr *uh;
         struct iphdr *iph;
         int iphlen, len;
   
-        __u8 *udpdata = (__u8 *)uh + sizeof(struct udphdr);
-        __be32 *udpdata32 = (__be32 *)udpdata;
+        __u8 *udpdata;
+        __be32 *udpdata32;
         __u16 encap_type = up->encap_type;
 
         /* if we're overly short, let UDP handle it */
-        if (udpdata > skb->tail)
+        len = skb->len - sizeof(struct udphdr);
+        if (len <= 0)
                 return 1;
 
         /* if this is not encapsulated socket, then just return now */
         if (!encap_type)
                 return 1;
 
-        len = skb->tail - udpdata;
+        /* If this is a paged skb, make sure we pull up
+         * whatever data we need to look at. */
+        if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8)))
+                return 1;
+
+        /* Now we can get the pointers */
+        uh = skb->h.uh;
+        udpdata = (__u8 *)uh + sizeof(struct udphdr);
+        udpdata32 = (__be32 *)udpdata;
 
         switch (encap_type) {
         default:
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 84d7ebdb9d21..b9f40290d12a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -542,6 +542,7 @@ ip6ip6_rcv(struct sk_buff *skb)
                 skb->dev = t->dev;
                 dst_release(skb->dst);
                 skb->dst = NULL;
+                nf_reset(skb);
                 if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
                         ipv6_copy_dscp(ipv6h, skb->nh.ipv6h);
                 ip6ip6_ecn_decapsulate(ipv6h, skb);
@@ -1149,6 +1150,20 @@ fail:
         return err;
 }
 
+static void __exit ip6ip6_destroy_tunnels(void)
+{
+        int h;
+        struct ip6_tnl *t;
+
+        for (h = 0; h < HASH_SIZE; h++) {
+                while ((t = tnls_r_l[h]) != NULL)
+                        unregister_netdevice(t->dev);
+        }
+
+        t = tnls_wc[0];
+        unregister_netdevice(t->dev);
+}
+
 /**
  * ip6_tunnel_cleanup - free resources and unregister protocol
  **/
@@ -1158,7 +1173,9 @@ static void __exit ip6_tunnel_cleanup(void)
         if (xfrm6_tunnel_deregister(&ip6ip6_handler))
                 printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
 
-        unregister_netdev(ip6ip6_fb_tnl_dev);
+        rtnl_lock();
+        ip6ip6_destroy_tunnels();
+        rtnl_unlock();
 }
 
 module_init(ip6_tunnel_init);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c953466b7afd..b39ae99122d5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -330,6 +330,8 @@ static int inline rt6_check_neigh(struct rt6_info *rt)
                 read_lock_bh(&neigh->lock);
                 if (neigh->nud_state & NUD_VALID)
                         m = 2;
+                else if (!(neigh->nud_state & NUD_FAILED))
+                        m = 1;
                 read_unlock_bh(&neigh->lock);
         }
         return m;
@@ -347,9 +349,7 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
 #endif
         n = rt6_check_neigh(rt);
-        if (n > 1)
-                m |= 16;
-        else if (!n && strict & RT6_LOOKUP_F_REACHABLE)
+        if (!n && (strict & RT6_LOOKUP_F_REACHABLE))
                 return -1;
         return m;
 }
@@ -380,10 +380,11 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
                         continue;
 
                 if (m > mpri) {
-                        rt6_probe(match);
+                        if (strict & RT6_LOOKUP_F_REACHABLE)
+                                rt6_probe(match);
                         match = rt;
                         mpri = m;
-                } else {
+                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
                         rt6_probe(rt);
                 }
         }
@@ -636,7 +637,7 @@ static struct rt6_info *ip6_pol_route_input(struct fib6_table *table,
         int strict = 0;
         int attempts = 3;
         int err;
-        int reachable = RT6_LOOKUP_F_REACHABLE;
+        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
 
@@ -733,7 +734,7 @@ static struct rt6_info *ip6_pol_route_output(struct fib6_table *table,
         int strict = 0;
         int attempts = 3;
         int err;
-        int reachable = RT6_LOOKUP_F_REACHABLE;
+        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e0c3934a7e4b..c83f23e51c46 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -242,14 +242,13 @@ static void udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct ipv6_pinfo *np;
         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
-        struct net_device *dev = skb->dev;
         struct in6_addr *saddr = &hdr->saddr;
         struct in6_addr *daddr = &hdr->daddr;
         struct udphdr *uh = (struct udphdr*)(skb->data+offset);
         struct sock *sk;
         int err;
 
-        sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, dev->ifindex);
+        sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, inet6_iif(skb));
    
         if (sk == NULL)
                 return;
@@ -348,7 +347,7 @@ static void udpv6_mcast_deliver(struct udphdr *uh,
 
         read_lock(&udp_hash_lock);
         sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
-        dif = skb->dev->ifindex;
+        dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
                 kfree_skb(skb);
@@ -429,7 +428,7 @@ static int udpv6_rcv(struct sk_buff **pskb)
          * check socket cache ... must talk to Alan about his plans
          * for sock caches... i'll skip this for now.
          */
-        sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, dev->ifindex);
+        sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, inet6_iif(skb));
 
         if (sk == NULL) {
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 5073261b9d0c..fede83763095 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -1678,7 +1678,8 @@ static int irlmp_slsap_inuse(__u8 slsap_sel)
          *  every IrLAP connection and check every LSAP associated with each
          *  the connection.
          */
-        spin_lock_irqsave(&irlmp->links->hb_spinlock, flags);
+        spin_lock_irqsave_nested(&irlmp->links->hb_spinlock, flags,
+                        SINGLE_DEPTH_NESTING);
         lap = (struct lap_cb *) hashbin_get_first(irlmp->links);
         while (lap != NULL) {
                 IRDA_ASSERT(lap->magic == LMP_LAP_MAGIC, goto errlap;);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b43e7647e125..2ee14f8a1908 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -495,6 +495,7 @@ static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
                         goto out;
                 }
 
+                err = -ESRCH;
                 x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto,
                                              p->family);
         }
@@ -1927,6 +1928,9 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
         len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -2034,6 +2038,9 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
         len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -2060,6 +2067,9 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
                 len += RTA_SPACE(headlen);
                 headlen = sizeof(*id);
         }
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         len += NLMSG_SPACE(headlen);
 
         skb = alloc_skb(len, GFP_ATOMIC);
@@ -2106,10 +2116,12 @@ static int xfrm_notify_policy_flush(struct km_event *c)
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
         unsigned char *b;
+        int len = 0;
 #ifdef CONFIG_XFRM_SUB_POLICY
         struct xfrm_userpolicy_type upt;
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
 #endif
-        int len = NLMSG_LENGTH(0);
+        len += NLMSG_LENGTH(0);
 
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
diff --git a/scripts/gen_initramfs_list.sh b/scripts/gen_initramfs_list.sh
index 331c079f029b..4c723fd18648 100644
--- a/scripts/gen_initramfs_list.sh
+++ b/scripts/gen_initramfs_list.sh
@@ -158,7 +158,7 @@ unknown_option() {
 }
 
 list_header() {
-        echo "deps_initramfs := \\"
+        :
 }
 
 header() {
@@ -227,6 +227,7 @@ arg="$1"
 case "$arg" in
         "-l")   # files included in initramfs - used by kbuild
                 dep_list="list_"
+                echo "deps_initramfs := \\"
                 shift
                 ;;
         "-o")   # generate gzipped cpio image named $1
diff --git a/scripts/kconfig/lxdialog/util.c b/scripts/kconfig/lxdialog/util.c
index ebc781b493d7..d54440fc166c 100644
--- a/scripts/kconfig/lxdialog/util.c
+++ b/scripts/kconfig/lxdialog/util.c
@@ -221,16 +221,14 @@ static void init_dialog_colors(void)
  */
 static void color_setup(const char *theme)
 {
-        if (set_theme(theme)) {
-                if (has_colors()) {     /* Terminal supports color? */
-                        start_color();
-                        init_dialog_colors();
-                }
-        }
-        else
-        {
+        int use_color;
+
+        use_color = set_theme(theme);
+        if (use_color && has_colors()) {
+                start_color();
+                init_dialog_colors();
+        } else
                 set_mono_theme();
-        }
 }
 
 /*
diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index 393f3749f330..338bdea96541 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -1259,6 +1259,7 @@ void ConfigSearchWindow::search(void)
  * Construct the complete config widget
  */
 ConfigMainWindow::ConfigMainWindow(void)
+        : searchWindow(0)
 {
         QMenuBar* menu;
         bool ok;
diff --git a/usr/Makefile b/usr/Makefile
index e338e7bedb29..382702ad663b 100644
--- a/usr/Makefile
+++ b/usr/Makefile
@@ -20,7 +20,7 @@ $(obj)/initramfs_data.o: $(obj)/initramfs_data.cpio.gz FORCE
 hostprogs-y := gen_init_cpio
 initramfs   := $(CONFIG_SHELL) $(srctree)/scripts/gen_initramfs_list.sh
 ramfs-input := $(if $(filter-out "",$(CONFIG_INITRAMFS_SOURCE)), \
-                    $(CONFIG_INITRAMFS_SOURCE),-d)
+                        $(shell echo $(CONFIG_INITRAMFS_SOURCE)),-d)
 ramfs-args  := \
         $(if $(CONFIG_INITRAMFS_ROOT_UID), -u $(CONFIG_INITRAMFS_ROOT_UID)) \
         $(if $(CONFIG_INITRAMFS_ROOT_GID), -g $(CONFIG_INITRAMFS_ROOT_GID))