42 files changed, 474 insertions, 341 deletions

diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 4b873527ce1c..02c2db08114a 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -73,9 +73,6 @@ cpumask_t cpu_online_map;
 
 EXPORT_SYMBOL(cpu_online_map);
 
-/* cpus reported in the hwrpb */
-static unsigned long hwrpb_cpu_present_mask __initdata = 0;
-
 int smp_num_probed;             /* Internal processor count */
 int smp_num_cpus = 1;           /* Number that came online.  */
 
@@ -442,7 +439,7 @@ setup_smp(void)
                         if ((cpu->flags & 0x1cc) == 0x1cc) {
                                 smp_num_probed++;
                                 /* Assume here that "whami" == index */
-                                hwrpb_cpu_present_mask |= (1UL << i);
+                                cpu_set(i, cpu_possible_map);
                                 cpu->pal_revision = boot_cpu_palrev;
                         }
 
@@ -453,12 +450,12 @@ setup_smp(void)
                 }
         } else {
                 smp_num_probed = 1;
-                hwrpb_cpu_present_mask = (1UL << boot_cpuid);
+                cpu_set(boot_cpuid, cpu_possible_map);
         }
         cpu_present_mask = cpumask_of_cpu(boot_cpuid);
 
         printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_mask = %lx\n",
-               smp_num_probed, hwrpb_cpu_present_mask);
+               smp_num_probed, cpu_possible_map.bits[0]);
 }
 
 /*
@@ -467,8 +464,6 @@ setup_smp(void)
 void __init
 smp_prepare_cpus(unsigned int max_cpus)
 {
-        int cpu_count, i;
-
         /* Take care of some initial bookkeeping.  */
         memset(ipi_data, 0, sizeof(ipi_data));
 
@@ -486,19 +481,7 @@ smp_prepare_cpus(unsigned int max_cpus)
 
         printk(KERN_INFO "SMP starting up secondaries.\n");
 
-        cpu_count = 1;
-        for (i = 0; (i < NR_CPUS) && (cpu_count < max_cpus); i++) {
-                if (i == boot_cpuid)
-                        continue;
-
-                if (((hwrpb_cpu_present_mask >> i) & 1) == 0)
-                        continue;
-
-                cpu_set(i, cpu_possible_map);
-                cpu_count++;
-        }
-
-        smp_num_cpus = cpu_count;
+        smp_num_cpus = smp_num_probed;
 }
 
 void __devinit
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 77eee38762d6..15dc1a0dffbb 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -69,6 +69,9 @@ config GENERIC_ISA_DMA
 config FIQ
         bool
 
+config ARCH_MTD_XIP
+        bool
+
 source "init/Kconfig"
 
 menu "System Type"
@@ -153,6 +156,7 @@ config ARCH_L7200
 
 config ARCH_PXA
         bool "PXA2xx-based"
+        select ARCH_MTD_XIP
         help
           Support for Intel's PXA2XX processor line.
 
@@ -171,6 +175,7 @@ config ARCH_SA1100
         bool "SA1100-based"
         select ISA
         select ARCH_DISCONTIGMEM_ENABLE
+        select ARCH_MTD_XIP
         help
           Support for StrongARM 11x0 based boards.
 
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index fa98f10d0132..5232fc752935 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -4,6 +4,7 @@
  * for more details.
  *
  * Copyright (C) 1994 - 1999, 2000 by Ralf Baechle and others.
+ * Copyright (C) 2005, 2006 by Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
  * Copyright (C) 2004 Thiemo Seufer
  */
@@ -58,8 +59,8 @@ ATTRIB_NORET void cpu_idle(void)
         }
 }
 
-extern int do_signal(sigset_t *oldset, struct pt_regs *regs);
-extern int do_signal32(sigset_t *oldset, struct pt_regs *regs);
+extern void do_signal(struct pt_regs *regs);
+extern void do_signal32(struct pt_regs *regs);
 
 /*
  * Native o32 and N64 ABI without DSP ASE
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index a42e0e8caa7b..d7c4a38ed5ae 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -617,6 +617,23 @@ einval:	li	v0, -EINVAL
         sys     sys_inotify_init        0
         sys     sys_inotify_add_watch   3       /* 4285 */
         sys     sys_inotify_rm_watch    2
+        sys     sys_migrate_pages       4
+        sys     sys_openat              4
+        sys     sys_mkdirat             3
+        sys     sys_mknodat             4       /* 4290 */
+        sys     sys_fchownat            5
+        sys     sys_futimesat           3
+        sys     sys_newfstatat          4
+        sys     sys_unlinkat            3
+        sys     sys_renameat            4       /* 4295 */
+        sys     sys_linkat              4
+        sys     sys_symlinkat           3
+        sys     sys_readlinkat          4
+        sys     sys_fchmodat            3
+        sys     sys_faccessat           3       /* 4300 */
+        sys     sys_pselect6            6
+        sys     sys_ppoll               5
+        sys     sys_unshare             1
         .endm
 
         /* We pre-compute the number of _instruction_ bytes needed to
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 47bfbd416709..98bf25df56f3 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -443,3 +443,20 @@ sys_call_table:
         PTR     sys_inotify_init
         PTR     sys_inotify_add_watch
         PTR     sys_inotify_rm_watch            /* 5245 */
+        PTR     sys_migrate_pages
+        PTR     sys_openat
+        PTR     sys_mkdirat
+        PTR     sys_mknodat
+        PTR     sys_fchownat                    /* 5250 */
+        PTR     sys_futimesat
+        PTR     sys_newfstatat
+        PTR     sys_unlinkat
+        PTR     sys_renameat
+        PTR     sys_linkat                      /* 5255 */
+        PTR     sys_symlinkat
+        PTR     sys_readlinkat
+        PTR     sys_fchmodat
+        PTR     sys_faccessat
+        PTR     sys_pselect6                    /* 5260 */
+        PTR     sys_ppoll
+        PTR     sys_unshare
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index b465ced1758f..bc4980cefc8b 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -369,3 +369,20 @@ EXPORT(sysn32_call_table)
         PTR     sys_inotify_init
         PTR     sys_inotify_add_watch
         PTR     sys_inotify_rm_watch
+        PTR     sys_migrate_pages               /* 6250 */
+        PTR     sys_openat
+        PTR     sys_mkdirat
+        PTR     sys_mknodat
+        PTR     sys_fchownat
+        PTR     sys_futimesat                   /* 6255 */
+        PTR     sys_newfstatat
+        PTR     sys_unlinkat
+        PTR     sys_renameat
+        PTR     sys_linkat
+        PTR     sys_symlinkat                   /* 6260 */
+        PTR     sys_readlinkat
+        PTR     sys_fchmodat
+        PTR     sys_faccessat
+        PTR     sys_pselect6
+        PTR     sys_ppoll                       /* 6265 */
+        PTR     sys_unshare
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 3d338ca7eeeb..5b0414018c9a 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -491,4 +491,21 @@ sys_call_table:
         PTR     sys_inotify_init
         PTR     sys_inotify_add_watch           /* 4285 */
         PTR     sys_inotify_rm_watch
+        PTR     sys_migrate_pages
+        PTR     compat_sys_openat
+        PTR     sys_mkdirat
+        PTR     sys_mknodat                     /* 4290 */
+        PTR     sys_fchownat
+        PTR     compat_sys_futimesat
+        PTR     compat_sys_newfstatat
+        PTR     sys_unlinkat
+        PTR     sys_renameat                    /* 4295 */
+        PTR     sys_linkat
+        PTR     sys_symlinkat
+        PTR     sys_readlinkat
+        PTR     sys_fchmodat
+        PTR     sys_faccessat                   /* 4300 */
+        PTR     sys_pselect6
+        PTR     sys_ppoll
+        PTR     sys_unshare
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index aaec4785e9a6..c974cc9b30eb 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -39,8 +39,6 @@
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
-int do_signal(sigset_t *oldset, struct pt_regs *regs);
-
 /*
  * Atomically swap in the new signal mask, and wait for a signal.
  */
@@ -50,7 +48,7 @@ save_static_function(sys_sigsuspend);
 __attribute_used__ noinline static int
 _sys_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
-        sigset_t saveset, newset;
+        sigset_t newset;
         sigset_t __user *uset;
 
         uset = (sigset_t __user *) regs.regs[4];
@@ -59,19 +57,15 @@ _sys_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 #endif
 
@@ -79,7 +73,7 @@ save_static_function(sys_rt_sigsuspend);
 __attribute_used__ noinline static int
 _sys_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
-        sigset_t saveset, newset;
+        sigset_t newset;
         sigset_t __user *unewset;
         size_t sigsetsize;
 
@@ -94,19 +88,15 @@ _sys_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 
 #ifdef CONFIG_TRAD_SIGNALS
@@ -315,11 +305,11 @@ int setup_frame(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, frame->regs[31]);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 #endif
 
@@ -375,11 +365,11 @@ int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, regs->regs[31]);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 
 static inline int handle_signal(unsigned long sig, siginfo_t *info,
@@ -393,7 +383,7 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
                 regs->regs[2] = EINTR;
                 break;
         case ERESTARTSYS:
-                if(!(ka->sa.sa_flags & SA_RESTART)) {
+                if (!(ka->sa.sa_flags & SA_RESTART)) {
                         regs->regs[2] = EINTR;
                         break;
                 }
@@ -420,9 +410,10 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
         return ret;
 }
 
-int do_signal(sigset_t *oldset, struct pt_regs *regs)
+void do_signal(struct pt_regs *regs)
 {
         struct k_sigaction ka;
+        sigset_t *oldset;
         siginfo_t info;
         int signr;
 
@@ -432,17 +423,31 @@ int do_signal(sigset_t *oldset, struct pt_regs *regs)
          * if so.
          */
         if (!user_mode(regs))
-                return 1;
+                return;
 
         if (try_to_freeze())
                 goto no_signal;
 
-        if (!oldset)
+        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                oldset = &current->saved_sigmask;
+        else
                 oldset = &current->blocked;
 
+
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-        if (signr > 0)
-                return handle_signal(signr, &info, &ka, oldset, regs);
+        if (signr > 0) {
+                /* Whee!  Actually deliver the signal.  */
+                if (handle_signal(signr, &info, &ka, oldset, regs) == 0) {
+                        /*
+                         * A signal was successfully delivered; the saved
+                         * sigmask will have been stored in the signal frame,
+                         * and will be restored by sigreturn, so we can simply
+                         * clear the TIF_RESTORE_SIGMASK flag.
+                         */
+                        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                }
+        }
 
 no_signal:
         /*
@@ -463,18 +468,25 @@ no_signal:
                         regs->cp0_epc -= 4;
                 }
         }
-        return 0;
+
+        /*
+         * If there's no signal to deliver, we just put the saved sigmask
+         * back
+         */
+        if (test_thread_flag(TIF_RESTORE_SIGMASK)) {
+                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+        }
 }
 
 /*
  * notification of userspace execution resumption
- * - triggered by current->work.notify_resume
+ * - triggered by the TIF_WORK_MASK flags
  */
-asmlinkage void do_notify_resume(struct pt_regs *regs, sigset_t *oldset,
+asmlinkage void do_notify_resume(struct pt_regs *regs, void *unused,
         __u32 thread_info_flags)
 {
         /* deal with pending signal delivery */
-        if (thread_info_flags & _TIF_SIGPENDING) {
-                current->thread.abi->do_signal(oldset, regs);
-        }
+        if (thread_info_flags & (_TIF_SIGPENDING | _TIF_RESTORE_SIGMASK))
+                current->thread.abi->do_signal(regs);
 }
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 136260c8f756..da3271e1fdac 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -694,11 +694,11 @@ int setup_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, frame->sf_code);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 
 int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
@@ -765,11 +765,11 @@ int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, frame->rs_code);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 
 static inline int handle_signal(unsigned long sig, siginfo_t *info,
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index 9156863c1a5d..384fc4a639a4 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -186,9 +186,9 @@ int setup_rt_frame_n32(struct k_sigaction * ka,
                current->comm, current->pid,
                frame, regs->cp0_epc, regs->regs[31]);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 332358430ff5..1da2eeb3ef9e 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -212,12 +212,12 @@ asmlinkage int sys_execve(nabi_no_regargs struct pt_regs regs)
         int error;
         char * filename;
 
-        filename = getname((char *) (long)regs.regs[4]);
+        filename = getname((char __user *) (long)regs.regs[4]);
         error = PTR_ERR(filename);
         if (IS_ERR(filename))
                 goto out;
-        error = do_execve(filename, (char **) (long)regs.regs[5],
-                          (char **) (long)regs.regs[6], &regs);
+        error = do_execve(filename, (char __user *__user *) (long)regs.regs[5],
+                          (char __user *__user *) (long)regs.regs[6], &regs);
         putname(filename);
 
 out:
@@ -227,7 +227,7 @@ out:
 /*
  * Compacrapability ...
  */
-asmlinkage int sys_uname(struct old_utsname * name)
+asmlinkage int sys_uname(struct old_utsname __user * name)
 {
         if (name && !copy_to_user(name, &system_utsname, sizeof (*name)))
                 return 0;
@@ -237,7 +237,7 @@ asmlinkage int sys_uname(struct old_utsname * name)
 /*
  * Compacrapability ...
  */
-asmlinkage int sys_olduname(struct oldold_utsname * name)
+asmlinkage int sys_olduname(struct oldold_utsname __user * name)
 {
         int error;
 
@@ -274,7 +274,7 @@ void sys_set_thread_area(unsigned long addr)
 asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
 {
         int     tmp, len;
-        char    *name;
+        char    __user *name;
 
         switch(cmd) {
         case SETNAME: {
@@ -283,7 +283,7 @@ asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
 
-                name = (char *) arg1;
+                name = (char __user *) arg1;
 
                 len = strncpy_from_user(nodename, name, __NEW_UTS_LEN);
                 if (len < 0)
@@ -324,7 +324,7 @@ asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
  * This is really horribly ugly.
  */
 asmlinkage int sys_ipc (uint call, int first, int second,
-                        unsigned long third, void *ptr, long fifth)
+                        unsigned long third, void __user *ptr, long fifth)
 {
         int version, ret;
 
@@ -333,24 +333,25 @@ asmlinkage int sys_ipc (uint call, int first, int second,
 
         switch (call) {
         case SEMOP:
-                return sys_semtimedop (first, (struct sembuf *)ptr, second,
-                                       NULL);
+                return sys_semtimedop (first, (struct sembuf __user *)ptr,
+                                       second, NULL);
         case SEMTIMEDOP:
-                return sys_semtimedop (first, (struct sembuf *)ptr, second,
-                                       (const struct timespec __user *)fifth);
+                return sys_semtimedop (first, (struct sembuf __user *)ptr,
+                                       second,
+                                       (const struct timespec __user *)fifth);
         case SEMGET:
                 return sys_semget (first, second, third);
         case SEMCTL: {
                 union semun fourth;
                 if (!ptr)
                         return -EINVAL;
-                if (get_user(fourth.__pad, (void **) ptr))
+                if (get_user(fourth.__pad, (void *__user *) ptr))
                         return -EFAULT;
                 return sys_semctl (first, second, third, fourth);
         }
 
         case MSGSND:
-                return sys_msgsnd (first, (struct msgbuf *) ptr,
+                return sys_msgsnd (first, (struct msgbuf __user *) ptr,
                                    second, third);
         case MSGRCV:
                 switch (version) {
@@ -360,7 +361,7 @@ asmlinkage int sys_ipc (uint call, int first, int second,
                                 return -EINVAL;
 
                         if (copy_from_user(&tmp,
-                                           (struct ipc_kludge *) ptr,
+                                           (struct ipc_kludge __user *) ptr,
                                            sizeof (tmp)))
                                 return -EFAULT;
                         return sys_msgrcv (first, tmp.msgp, second,
@@ -368,35 +369,38 @@ asmlinkage int sys_ipc (uint call, int first, int second,
                 }
                 default:
                         return sys_msgrcv (first,
-                                           (struct msgbuf *) ptr,
+                                           (struct msgbuf __user *) ptr,
                                            second, fifth, third);
                 }
         case MSGGET:
                 return sys_msgget ((key_t) first, second);
         case MSGCTL:
-                return sys_msgctl (first, second, (struct msqid_ds *) ptr);
+                return sys_msgctl (first, second,
+                                   (struct msqid_ds __user *) ptr);
 
         case SHMAT:
                 switch (version) {
                 default: {
                         ulong raddr;
-                        ret = do_shmat (first, (char *) ptr, second, &raddr);
+                        ret = do_shmat (first, (char __user *) ptr, second,
+                                        &raddr);
                         if (ret)
                                 return ret;
-                        return put_user (raddr, (ulong *) third);
+                        return put_user (raddr, (ulong __user *) third);
                 }
                 case 1: /* iBCS2 emulator entry point */
                         if (!segment_eq(get_fs(), get_ds()))
                                 return -EINVAL;
-                        return do_shmat (first, (char *) ptr, second, (ulong *) third);
+                        return do_shmat (first, (char __user *) ptr, second,
+                                         (ulong *) third);
                 }
         case SHMDT:
-                return sys_shmdt ((char *)ptr);
+                return sys_shmdt ((char __user *)ptr);
         case SHMGET:
                 return sys_shmget (first, second, third);
         case SHMCTL:
                 return sys_shmctl (first, second,
-                                   (struct shmid_ds *) ptr);
+                                   (struct shmid_ds __user *) ptr);
         default:
                 return -ENOSYS;
         }
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index c6d0595da6b5..bd837b5dbf06 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -142,11 +142,7 @@ static inline int get_old_sigaction(struct k_sigaction *new_ka,
         return 0;
 }
 
-static inline compat_uptr_t to_user_ptr(void *kp)
-{
-        return (compat_uptr_t)(u64)kp;
-}
-
+#define to_user_ptr(p)          ptr_to_compat(p)
 #define from_user_ptr(p)        compat_ptr(p)
 
 static inline int save_general_regs(struct pt_regs *regs,
@@ -213,8 +209,8 @@ static inline int get_old_sigaction(struct k_sigaction *new_ka,
         return 0;
 }
 
-#define to_user_ptr(p)          (p)
-#define from_user_ptr(p)        (p)
+#define to_user_ptr(p)          ((unsigned long)(p))
+#define from_user_ptr(p)        ((void __user *)(p))
 
 static inline int save_general_regs(struct pt_regs *regs,
                 struct mcontext __user *frame)
@@ -526,7 +522,7 @@ long compat_sys_rt_sigaction(int sig, const struct sigaction32 __user *act,
 
         ret = do_sigaction(sig, act ? &new_ka : NULL, oact ? &old_ka : NULL);
         if (!ret && oact) {
-                ret = put_user((long)old_ka.sa.sa_handler, &oact->sa_handler);
+                ret = put_user(to_user_ptr(old_ka.sa.sa_handler), &oact->sa_handler);
                 ret |= put_sigset_t(&oact->sa_mask, &old_ka.sa.sa_mask);
                 ret |= __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
         }
@@ -675,8 +671,8 @@ long compat_sys_rt_sigqueueinfo(u32 pid, u32 sig, compat_siginfo_t __user *uinfo
 int compat_sys_sigaltstack(u32 __new, u32 __old, int r5,
                       int r6, int r7, int r8, struct pt_regs *regs)
 {
-        stack_32_t __user * newstack = (stack_32_t __user *)(long) __new;
-        stack_32_t __user * oldstack = (stack_32_t __user *)(long) __old;
+        stack_32_t __user * newstack = compat_ptr(__new);
+        stack_32_t __user * oldstack = compat_ptr(__old);
         stack_t uss, uoss;
         int ret;
         mm_segment_t old_fs;
@@ -708,7 +704,7 @@ int compat_sys_sigaltstack(u32 __new, u32 __old, int r5,
         set_fs(old_fs);
         /* Copy the stack information to the user output buffer */
         if (!ret && oldstack  &&
-                (put_user((long)uoss.ss_sp, &oldstack->ss_sp) ||
+                (put_user(ptr_to_compat(uoss.ss_sp), &oldstack->ss_sp) ||
                  __put_user(uoss.ss_flags, &oldstack->ss_flags) ||
                  __put_user(uoss.ss_size, &oldstack->ss_size)))
                 return -EFAULT;
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index b3193116e686..497a5d3df359 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -60,8 +60,8 @@ struct rt_sigframe {
         struct ucontext uc;
         unsigned long _unused[2];
         unsigned int tramp[TRAMP_SIZE];
-        struct siginfo *pinfo;
-        void *puc;
+        struct siginfo __user *pinfo;
+        void __user *puc;
         struct siginfo info;
         /* 64 bit ABI allows for 288 bytes below sp before decrementing it. */
         char abigap[288];
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index f671ed253901..de3f30e6b333 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -136,14 +136,14 @@ static void __init fixup_bus_range(struct device_node *bridge)
         |(((unsigned int)(off)) & 0xFCUL) \
         |1UL)
 
-static unsigned long macrisc_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *macrisc_cfg_access(struct pci_controller* hose,
                                                u8 bus, u8 dev_fn, u8 offset)
 {
         unsigned int caddr;
 
         if (bus == hose->first_busno) {
                 if (dev_fn < (11 << 3))
-                        return 0;
+                        return NULL;
                 caddr = MACRISC_CFA0(dev_fn, offset);
         } else
                 caddr = MACRISC_CFA1(bus, dev_fn, offset);
@@ -154,14 +154,14 @@ static unsigned long macrisc_cfg_access(struct pci_controller* hose,
         } while (in_le32(hose->cfg_addr) != caddr);
 
         offset &= has_uninorth ? 0x07 : 0x03;
-        return ((unsigned long)hose->cfg_data) + offset;
+        return hose->cfg_data + offset;
 }
 
 static int macrisc_read_config(struct pci_bus *bus, unsigned int devfn,
                                       int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -177,13 +177,13 @@ static int macrisc_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -193,7 +193,7 @@ static int macrisc_write_config(struct pci_bus *bus, unsigned int devfn,
                                        int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -209,16 +209,16 @@ static int macrisc_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32(addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -348,25 +348,23 @@ static int u3_ht_skip_device(struct pci_controller *hose,
                 + (((unsigned int)bus) << 16) \
                 + 0x01000000UL)
 
-static unsigned long u3_ht_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *u3_ht_cfg_access(struct pci_controller* hose,
                                              u8 bus, u8 devfn, u8 offset)
 {
         if (bus == hose->first_busno) {
                 /* For now, we don't self probe U3 HT bridge */
                 if (PCI_SLOT(devfn) == 0)
-                        return 0;
-                return ((unsigned long)hose->cfg_data) +
-                        U3_HT_CFA0(devfn, offset);
+                        return NULL;
+                return hose->cfg_data + U3_HT_CFA0(devfn, offset);
         } else
-                return ((unsigned long)hose->cfg_data) +
-                        U3_HT_CFA1(bus, devfn, offset);
+                return hose->cfg_data + U3_HT_CFA1(bus, devfn, offset);
 }
 
 static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
                                     int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -400,13 +398,13 @@ static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -416,7 +414,7 @@ static int u3_ht_write_config(struct pci_bus *bus, unsigned int devfn,
                                      int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -442,16 +440,16 @@ static int u3_ht_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32((u32 __iomem *)addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -476,7 +474,7 @@ static struct pci_ops u3_ht_pci_ops =
          |(((unsigned int)(off)) & 0xfcU)       \
          |1UL)
 
-static unsigned long u4_pcie_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *u4_pcie_cfg_access(struct pci_controller* hose,
                                         u8 bus, u8 dev_fn, int offset)
 {
         unsigned int caddr;
@@ -492,14 +490,14 @@ static unsigned long u4_pcie_cfg_access(struct pci_controller* hose,
         } while (in_le32(hose->cfg_addr) != caddr);
 
         offset &= 0x03;
-        return ((unsigned long)hose->cfg_data) + offset;
+        return hose->cfg_data + offset;
 }
 
 static int u4_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
                                int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -515,13 +513,13 @@ static int u4_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -531,7 +529,7 @@ static int u4_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
                                 int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -547,16 +545,16 @@ static int u4_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32(addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -773,8 +771,7 @@ static void __init setup_u3_ht(struct pci_controller* hose)
          * the reg address cell, we shall fix that by killing struct
          * reg_property and using some accessor functions instead
          */
-        hose->cfg_data = (volatile unsigned char *)ioremap(0xf2000000,
-                                                           0x02000000);
+        hose->cfg_data = ioremap(0xf2000000, 0x02000000);
 
         /*
          * /ht node doesn't expose a "ranges" property, so we "remove"
diff --git a/arch/powerpc/sysdev/dart_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 977de9db8754..6298264efe36 100644
--- a/arch/powerpc/sysdev/dart_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -59,7 +59,7 @@ static unsigned long dart_tablesize;
 static u32 *dart_vbase;
 
 /* Mapped base address for the dart */
-static unsigned int *__iomem dart;
+static unsigned int __iomem *dart;
 
 /* Dummy val that entries are set to when unused */
 static unsigned int dart_emptyval;
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index bf9a7a361b34..cc20f0e3a7d3 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -100,12 +100,12 @@
 #define SET_STAT_UID(stat, uid)         (stat).st_uid = high2lowuid(uid)
 #define SET_STAT_GID(stat, gid)         (stat).st_gid = high2lowgid(gid)
 
-asmlinkage long sys32_chown16(const char * filename, u16 user, u16 group)
+asmlinkage long sys32_chown16(const char __user * filename, u16 user, u16 group)
 {
         return sys_chown(filename, low2highuid(user), low2highgid(group));
 }
 
-asmlinkage long sys32_lchown16(const char * filename, u16 user, u16 group)
+asmlinkage long sys32_lchown16(const char __user * filename, u16 user, u16 group)
 {
         return sys_lchown(filename, low2highuid(user), low2highgid(group));
 }
@@ -141,7 +141,7 @@ asmlinkage long sys32_setresuid16(u16 ruid, u16 euid, u16 suid)
                 low2highuid(suid));
 }
 
-asmlinkage long sys32_getresuid16(u16 *ruid, u16 *euid, u16 *suid)
+asmlinkage long sys32_getresuid16(u16 __user *ruid, u16 __user *euid, u16 __user *suid)
 {
         int retval;
 
@@ -158,7 +158,7 @@ asmlinkage long sys32_setresgid16(u16 rgid, u16 egid, u16 sgid)
                 low2highgid(sgid));
 }
 
-asmlinkage long sys32_getresgid16(u16 *rgid, u16 *egid, u16 *sgid)
+asmlinkage long sys32_getresgid16(u16 __user *rgid, u16 __user *egid, u16 __user *sgid)
 {
         int retval;
 
@@ -179,7 +179,7 @@ asmlinkage long sys32_setfsgid16(u16 gid)
         return sys_setfsgid((gid_t)gid);
 }
 
-static int groups16_to_user(u16 *grouplist, struct group_info *group_info)
+static int groups16_to_user(u16 __user *grouplist, struct group_info *group_info)
 {
         int i;
         u16 group;
@@ -193,7 +193,7 @@ static int groups16_to_user(u16 *grouplist, struct group_info *group_info)
         return 0;
 }
 
-static int groups16_from_user(struct group_info *group_info, u16 *grouplist)
+static int groups16_from_user(struct group_info *group_info, u16 __user *grouplist)
 {
         int i;
         u16 group;
@@ -207,7 +207,7 @@ static int groups16_from_user(struct group_info *group_info, u16 *grouplist)
         return 0;
 }
 
-asmlinkage long sys32_getgroups16(int gidsetsize, u16 *grouplist)
+asmlinkage long sys32_getgroups16(int gidsetsize, u16 __user *grouplist)
 {
         int i;
 
@@ -231,7 +231,7 @@ out:
         return i;
 }
 
-asmlinkage long sys32_setgroups16(int gidsetsize, u16 *grouplist)
+asmlinkage long sys32_setgroups16(int gidsetsize, u16 __user *grouplist)
 {
         struct group_info *group_info;
         int retval;
@@ -278,14 +278,14 @@ asmlinkage long sys32_getegid16(void)
 
 /* 32-bit timeval and related flotsam.  */
 
-static inline long get_tv32(struct timeval *o, struct compat_timeval *i)
+static inline long get_tv32(struct timeval *o, struct compat_timeval __user *i)
 {
         return (!access_ok(VERIFY_READ, o, sizeof(*o)) ||
                 (__get_user(o->tv_sec, &i->tv_sec) ||
                  __get_user(o->tv_usec, &i->tv_usec)));
 }
 
-static inline long put_tv32(struct compat_timeval *o, struct timeval *i)
+static inline long put_tv32(struct compat_timeval __user *o, struct timeval *i)
 {
         return (!access_ok(VERIFY_WRITE, o, sizeof(*o)) ||
                 (__put_user(i->tv_sec, &o->tv_sec) ||
@@ -341,7 +341,7 @@ asmlinkage long sys32_ipc(u32 call, int first, int second, int third, u32 ptr)
         return -ENOSYS;
 }
 
-asmlinkage long sys32_truncate64(const char * path, unsigned long high, unsigned long low)
+asmlinkage long sys32_truncate64(const char __user * path, unsigned long high, unsigned long low)
 {
         if ((int)high < 0)
                 return -EINVAL;
@@ -357,7 +357,7 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
                 return sys_ftruncate(fd, (high << 32) | low);
 }
 
-int cp_compat_stat(struct kstat *stat, struct compat_stat *statbuf)
+int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
         int err;
 
@@ -591,7 +591,7 @@ sys32_delete_module(const char __user *name_user, unsigned int flags)
 
 extern struct timezone sys_tz;
 
-asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_gettimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
         if (tv) {
                 struct timeval ktv;
@@ -606,7 +606,7 @@ asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *t
         return 0;
 }
 
-static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
+static inline long get_ts32(struct timespec *o, struct compat_timeval __user *i)
 {
         long usec;
 
@@ -620,7 +620,7 @@ static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
         return 0;
 }
 
-asmlinkage long sys32_settimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_settimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
         struct timespec kts;
         struct timezone ktz;
@@ -645,7 +645,7 @@ asmlinkage long sys32_pause(void)
         return -ERESTARTNOHAND;
 }
 
-asmlinkage long sys32_pread64(unsigned int fd, char *ubuf,
+asmlinkage long sys32_pread64(unsigned int fd, char __user *ubuf,
                                 size_t count, u32 poshi, u32 poslo)
 {
         if ((compat_ssize_t) count < 0)
@@ -653,7 +653,7 @@ asmlinkage long sys32_pread64(unsigned int fd, char *ubuf,
         return sys_pread64(fd, ubuf, count, ((loff_t)AA(poshi) << 32) | AA(poslo));
 }
 
-asmlinkage long sys32_pwrite64(unsigned int fd, const char *ubuf,
+asmlinkage long sys32_pwrite64(unsigned int fd, const char __user *ubuf,
                                 size_t count, u32 poshi, u32 poslo)
 {
         if ((compat_ssize_t) count < 0)
@@ -666,7 +666,7 @@ asmlinkage compat_ssize_t sys32_readahead(int fd, u32 offhi, u32 offlo, s32 coun
         return sys_readahead(fd, ((loff_t)AA(offhi) << 32) | AA(offlo), count);
 }
 
-asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t *offset, size_t count)
+asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, size_t count)
 {
         mm_segment_t old_fs = get_fs();
         int ret;
@@ -686,7 +686,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t *offset, size
 }
 
 asmlinkage long sys32_sendfile64(int out_fd, int in_fd,
-                                compat_loff_t *offset, s32 count)
+                                compat_loff_t __user *offset, s32 count)
 {
         mm_segment_t old_fs = get_fs();
         int ret;
@@ -722,7 +722,7 @@ struct timex32 {
 
 extern int do_adjtimex(struct timex *);
 
-asmlinkage long sys32_adjtimex(struct timex32 *utp)
+asmlinkage long sys32_adjtimex(struct timex32 __user *utp)
 {
         struct timex txc;
         int ret;
@@ -789,12 +789,13 @@ struct __sysctl_args32 {
         u32 __unused[4];
 };
 
-asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
+asmlinkage long sys32_sysctl(struct __sysctl_args32 __user *args)
 {
         struct __sysctl_args32 tmp;
         int error;
-        size_t oldlen, *oldlenp = NULL;
-        unsigned long addr = (((long)&args->__unused[0]) + 7) & ~7;
+        size_t oldlen;
+        size_t __user *oldlenp = NULL;
+        unsigned long addr = (((unsigned long)&args->__unused[0]) + 7) & ~7;
 
         if (copy_from_user(&tmp, args, sizeof(tmp)))
                 return -EFAULT;
@@ -806,20 +807,20 @@ asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
                    basically copy the whole sysctl.c here, and
                    glibc's __sysctl uses rw memory for the structure
                    anyway.  */
-                if (get_user(oldlen, (u32 *)A(tmp.oldlenp)) ||
-                    put_user(oldlen, (size_t *)addr))
+                if (get_user(oldlen, (u32 __user *)compat_ptr(tmp.oldlenp)) ||
+                    put_user(oldlen, (size_t __user *)addr))
                         return -EFAULT;
-                oldlenp = (size_t *)addr;
+                oldlenp = (size_t __user *)addr;
         }
 
         lock_kernel();
-        error = do_sysctl((int *)A(tmp.name), tmp.nlen, (void *)A(tmp.oldval),
-                          oldlenp, (void *)A(tmp.newval), tmp.newlen);
+        error = do_sysctl(compat_ptr(tmp.name), tmp.nlen, compat_ptr(tmp.oldval),
+                          oldlenp, compat_ptr(tmp.newval), tmp.newlen);
         unlock_kernel();
         if (oldlenp) {
                 if (!error) {
-                        if (get_user(oldlen, (size_t *)addr) ||
-                            put_user(oldlen, (u32 *)A(tmp.oldlenp)))
+                        if (get_user(oldlen, (size_t __user *)addr) ||
+                            put_user(oldlen, (u32 __user *)compat_ptr(tmp.oldlenp)))
                                 error = -EFAULT;
                 }
                 copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
@@ -853,7 +854,7 @@ struct stat64_emu31 {
         unsigned long   st_ino;
 };      
 
-static int cp_stat64(struct stat64_emu31 *ubuf, struct kstat *stat)
+static int cp_stat64(struct stat64_emu31 __user *ubuf, struct kstat *stat)
 {
         struct stat64_emu31 tmp;
 
@@ -877,7 +878,7 @@ static int cp_stat64(struct stat64_emu31 *ubuf, struct kstat *stat)
         return copy_to_user(ubuf,&tmp,sizeof(tmp)) ? -EFAULT : 0; 
 }
 
-asmlinkage long sys32_stat64(char * filename, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_stat64(char __user * filename, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_stat(filename, &stat);
@@ -886,7 +887,7 @@ asmlinkage long sys32_stat64(char * filename, struct stat64_emu31 * statbuf)
         return ret;
 }
 
-asmlinkage long sys32_lstat64(char * filename, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_lstat64(char __user * filename, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_lstat(filename, &stat);
@@ -895,7 +896,7 @@ asmlinkage long sys32_lstat64(char * filename, struct stat64_emu31 * statbuf)
         return ret;
 }
 
-asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_fstat(fd, &stat);
@@ -952,7 +953,7 @@ out:
 
 
 asmlinkage unsigned long
-old32_mmap(struct mmap_arg_struct_emu31 *arg)
+old32_mmap(struct mmap_arg_struct_emu31 __user *arg)
 {
         struct mmap_arg_struct_emu31 a;
         int error = -EFAULT;
@@ -970,7 +971,7 @@ out:
 }
 
 asmlinkage long 
-sys32_mmap2(struct mmap_arg_struct_emu31 *arg)
+sys32_mmap2(struct mmap_arg_struct_emu31 __user *arg)
 {
         struct mmap_arg_struct_emu31 a;
         int error = -EFAULT;
@@ -982,7 +983,7 @@ out:
         return error;
 }
 
-asmlinkage long sys32_read(unsigned int fd, char * buf, size_t count)
+asmlinkage long sys32_read(unsigned int fd, char __user * buf, size_t count)
 {
         if ((compat_ssize_t) count < 0)
                 return -EINVAL; 
@@ -990,7 +991,7 @@ asmlinkage long sys32_read(unsigned int fd, char * buf, size_t count)
         return sys_read(fd, buf, count);
 }
 
-asmlinkage long sys32_write(unsigned int fd, char * buf, size_t count)
+asmlinkage long sys32_write(unsigned int fd, char __user * buf, size_t count)
 {
         if ((compat_ssize_t) count < 0)
                 return -EINVAL; 
@@ -1002,12 +1003,12 @@ asmlinkage long sys32_clone(struct pt_regs regs)
 {
         unsigned long clone_flags;
         unsigned long newsp;
-        int *parent_tidptr, *child_tidptr;
+        int __user *parent_tidptr, *child_tidptr;
 
         clone_flags = regs.gprs[3] & 0xffffffffUL;
         newsp = regs.orig_gpr2 & 0x7fffffffUL;
-        parent_tidptr = (int *) (regs.gprs[4] & 0x7fffffffUL);
-        child_tidptr = (int *) (regs.gprs[5] & 0x7fffffffUL);
+        parent_tidptr = compat_ptr(regs.gprs[4]);
+        child_tidptr = compat_ptr(regs.gprs[5]);
         if (!newsp)
                 newsp = regs.gprs[15];
         return do_fork(clone_flags, newsp, &regs, 0,
diff --git a/arch/s390/kernel/sys_s390.c b/arch/s390/kernel/sys_s390.c
index 6a63553493c5..e351780bb660 100644
--- a/arch/s390/kernel/sys_s390.c
+++ b/arch/s390/kernel/sys_s390.c
@@ -122,8 +122,8 @@ out:
 #ifndef CONFIG_64BIT
 struct sel_arg_struct {
         unsigned long n;
-        fd_set *inp, *outp, *exp;
-        struct timeval *tvp;
+        fd_set __user *inp, *outp, *exp;
+        struct timeval __user *tvp;
 };
 
 asmlinkage long old_select(struct sel_arg_struct __user *arg)
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 5d21e9e6e7b4..a46793beeddd 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -486,7 +486,7 @@ asmlinkage void illegal_op(struct pt_regs * regs, long interruption_code)
                 info.si_signo = signal;
                 info.si_errno = 0;
                 info.si_code = ILL_ILLOPC;
-                info.si_addr = (void *) location;
+                info.si_addr = (void __user *) location;
                 do_trap(interruption_code, signal,
                         "illegal operation", regs, &info);
         }
diff --git a/arch/sh/boards/renesas/rts7751r2d/io.c b/arch/sh/boards/renesas/rts7751r2d/io.c
index c46f9154cfd5..123abbbc91e0 100644
--- a/arch/sh/boards/renesas/rts7751r2d/io.c
+++ b/arch/sh/boards/renesas/rts7751r2d/io.c
@@ -216,24 +216,26 @@ void rts7751r2d_insb(unsigned long port, void *addr, unsigned long count)
 {
         volatile __u8 *bp;
         volatile __u16 *p;
+        unsigned char *s = addr;
 
         if (CHECK_AX88796L_PORT(port)) {
                 p = (volatile unsigned short *)port88796l(port, 0);
-                while (count--) *((unsigned char *) addr)++ = *p & 0xff;
+                while (count--) *s++ = *p & 0xff;
         } else if (PXSEG(port))
-                while (count--) *((unsigned char *) addr)++ = *(volatile unsigned char *)port;
+                while (count--) *s++ = *(volatile unsigned char *)port;
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 bp = (__u8 *)PCI_IOMAP(port);
-                while (count--) *((volatile unsigned char *) addr)++ = *bp;
+                while (count--) *s++ = *bp;
         } else {
                 p = (volatile unsigned short *)port2adr(port);
-                while (count--) *((unsigned char *) addr)++ = *p & 0xff;
+                while (count--) *s++ = *p & 0xff;
         }
 }
 
 void rts7751r2d_insw(unsigned long port, void *addr, unsigned long count)
 {
         volatile __u16 *p;
+        __u16 *s = addr;
 
         if (CHECK_AX88796L_PORT(port))
                 p = (volatile unsigned short *)port88796l(port, 1);
@@ -243,7 +245,7 @@ void rts7751r2d_insw(unsigned long port, void *addr, unsigned long count)
                 p = (volatile unsigned short *)PCI_IOMAP(port);
         else
                 p = (volatile unsigned short *)port2adr(port);
-        while (count--) *((__u16 *) addr)++ = *p;
+        while (count--) *s++ = *p;
 }
 
 void rts7751r2d_insl(unsigned long port, void *addr, unsigned long count)
@@ -252,8 +254,9 @@ void rts7751r2d_insl(unsigned long port, void *addr, unsigned long count)
                 maybebadio(insl, port);
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 volatile __u32 *p = (__u32 *)PCI_IOMAP(port);
+                __u32 *s = addr;
 
-                while (count--) *((__u32 *) addr)++ = *p;
+                while (count--) *s++ = *p;
         } else
                 maybebadio(insl, port);
 }
@@ -262,24 +265,26 @@ void rts7751r2d_outsb(unsigned long port, const void *addr, unsigned long count)
 {
         volatile __u8 *bp;
         volatile __u16 *p;
+        const __u8 *s = addr;
 
         if (CHECK_AX88796L_PORT(port)) {
                 p = (volatile unsigned short *)port88796l(port, 0);
-                while (count--) *p = *((unsigned char *) addr)++;
+                while (count--) *p = *s++;
         } else if (PXSEG(port))
-                while (count--) *(volatile unsigned char *)port = *((unsigned char *) addr)++;
+                while (count--) *(volatile unsigned char *)port = *s++;
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 bp = (__u8 *)PCI_IOMAP(port);
-                while (count--) *bp = *((volatile unsigned char *) addr)++;
+                while (count--) *bp = *s++;
         } else {
                 p = (volatile unsigned short *)port2adr(port);
-                while (count--) *p = *((unsigned char *) addr)++;
+                while (count--) *p = *s++;
         }
 }
 
 void rts7751r2d_outsw(unsigned long port, const void *addr, unsigned long count)
 {
         volatile __u16 *p;
+        const __u16 *s = addr;
 
         if (CHECK_AX88796L_PORT(port))
                 p = (volatile unsigned short *)port88796l(port, 1);
@@ -289,7 +294,7 @@ void rts7751r2d_outsw(unsigned long port, const void *addr, unsigned long count)
                 p = (volatile unsigned short *)PCI_IOMAP(port);
         else
                 p = (volatile unsigned short *)port2adr(port);
-        while (count--) *p = *((__u16 *) addr)++;
+        while (count--) *p = *s++;
 }
 
 void rts7751r2d_outsl(unsigned long port, const void *addr, unsigned long count)
@@ -298,8 +303,9 @@ void rts7751r2d_outsl(unsigned long port, const void *addr, unsigned long count)
                 maybebadio(outsl, port);
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 volatile __u32 *p = (__u32 *)PCI_IOMAP(port);
+                const __u32 *s = addr;
 
-                while (count--) *p = *((__u32 *) addr)++;
+                while (count--) *p = *s++;
         } else
                 maybebadio(outsl, port);
 }
diff --git a/block/elevator.c b/block/elevator.c
index 2fc269f69726..24b702d649a9 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -293,7 +293,7 @@ void elv_requeue_request(request_queue_t *q, struct request *rq)
 
         rq->flags &= ~REQ_STARTED;
 
-        __elv_add_request(q, rq, ELEVATOR_INSERT_REQUEUE, 0);
+        elv_insert(q, rq, ELEVATOR_INSERT_REQUEUE);
 }
 
 static void elv_drain_elevator(request_queue_t *q)
@@ -310,41 +310,11 @@ static void elv_drain_elevator(request_queue_t *q)
         }
 }
 
-void __elv_add_request(request_queue_t *q, struct request *rq, int where,
-                       int plug)
+void elv_insert(request_queue_t *q, struct request *rq, int where)
 {
         struct list_head *pos;
         unsigned ordseq;
 
-        if (q->ordcolor)
-                rq->flags |= REQ_ORDERED_COLOR;
-
-        if (rq->flags & (REQ_SOFTBARRIER | REQ_HARDBARRIER)) {
-                /*
-                 * toggle ordered color
-                 */
-                if (blk_barrier_rq(rq))
-                        q->ordcolor ^= 1;
-
-                /*
-                 * barriers implicitly indicate back insertion
-                 */
-                if (where == ELEVATOR_INSERT_SORT)
-                        where = ELEVATOR_INSERT_BACK;
-
-                /*
-                 * this request is scheduling boundary, update end_sector
-                 */
-                if (blk_fs_request(rq)) {
-                        q->end_sector = rq_end_sector(rq);
-                        q->boundary_rq = rq;
-                }
-        } else if (!(rq->flags & REQ_ELVPRIV) && where == ELEVATOR_INSERT_SORT)
-                where = ELEVATOR_INSERT_BACK;
-
-        if (plug)
-                blk_plug_device(q);
-
         rq->q = q;
 
         switch (where) {
@@ -425,6 +395,42 @@ void __elv_add_request(request_queue_t *q, struct request *rq, int where,
         }
 }
 
+void __elv_add_request(request_queue_t *q, struct request *rq, int where,
+                       int plug)
+{
+        if (q->ordcolor)
+                rq->flags |= REQ_ORDERED_COLOR;
+
+        if (rq->flags & (REQ_SOFTBARRIER | REQ_HARDBARRIER)) {
+                /*
+                 * toggle ordered color
+                 */
+                if (blk_barrier_rq(rq))
+                        q->ordcolor ^= 1;
+
+                /*
+                 * barriers implicitly indicate back insertion
+                 */
+                if (where == ELEVATOR_INSERT_SORT)
+                        where = ELEVATOR_INSERT_BACK;
+
+                /*
+                 * this request is scheduling boundary, update
+                 * end_sector
+                 */
+                if (blk_fs_request(rq)) {
+                        q->end_sector = rq_end_sector(rq);
+                        q->boundary_rq = rq;
+                }
+        } else if (!(rq->flags & REQ_ELVPRIV) && where == ELEVATOR_INSERT_SORT)
+                where = ELEVATOR_INSERT_BACK;
+
+        if (plug)
+                blk_plug_device(q);
+
+        elv_insert(q, rq, where);
+}
+
 void elv_add_request(request_queue_t *q, struct request *rq, int where,
                      int plug)
 {
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index ee5ed98db4cd..03d9c82b0fe7 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -454,7 +454,7 @@ static void queue_flush(request_queue_t *q, unsigned which)
         rq->end_io = end_io;
         q->prepare_flush_fn(q, rq);
 
-        __elv_add_request(q, rq, ELEVATOR_INSERT_FRONT, 0);
+        elv_insert(q, rq, ELEVATOR_INSERT_FRONT);
 }
 
 static inline struct request *start_ordered(request_queue_t *q,
@@ -490,7 +490,7 @@ static inline struct request *start_ordered(request_queue_t *q,
         else
                 q->ordseq |= QUEUE_ORDSEQ_POSTFLUSH;
 
-        __elv_add_request(q, rq, ELEVATOR_INSERT_FRONT, 0);
+        elv_insert(q, rq, ELEVATOR_INSERT_FRONT);
 
         if (q->ordered & QUEUE_ORDERED_PREFLUSH) {
                 queue_flush(q, QUEUE_ORDERED_PREFLUSH);
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index cc72210687eb..24f7af9d0abc 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -310,6 +310,8 @@ static int sg_io(struct file *file, request_queue_t *q,
         if (!rq->timeout)
                 rq->timeout = BLK_DEFAULT_TIMEOUT;
 
+        rq->retries = 0;
+
         start_time = jiffies;
 
         /* ignore return value. All information is passed back to caller
@@ -427,6 +429,7 @@ static int sg_scsi_ioctl(struct file *file, request_queue_t *q,
         rq->data = buffer;
         rq->data_len = bytes;
         rq->flags |= REQ_BLOCK_PC;
+        rq->retries = 0;
 
         blk_execute_rq(q, bd_disk, rq, 0);
         err = rq->errors & 0xff;        /* only 8 bit SCSI status */
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 4c67727d75b1..05ba410682a3 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -222,7 +222,7 @@ config SYNCLINKMP
 
 config SYNCLINK_GT
         tristate "SyncLink GT/AC support"
-        depends on SERIAL_NONSTANDARD
+        depends on SERIAL_NONSTANDARD && PCI
         help
           Support for SyncLink GT and SyncLink AC families of
           synchronous and asynchronous serial adapters
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index 0ef560144be3..6dfc94122dd9 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -351,7 +351,7 @@ config HISAX_ENTERNOW_PCI
 
 config HISAX_AMD7930
         bool "Am7930 (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && SPARC
+        depends on EXPERIMENTAL && SPARC && BROKEN
         help
           This enables HiSax support for the AMD7930 chips on some SPARCs.
           This code is not finished yet.
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index b11cd31d8d27..12ad462737ba 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -190,7 +190,7 @@ config WINDFARM_PM91
 config WINDFARM_PM112
         tristate "Support for thermal management on PowerMac11,2"
         depends on WINDFARM && I2C && PMAC_SMU
-        select I2C_PMAC_SMU
+        select I2C_POWERMAC
         help
           This driver provides thermal control for the PowerMac11,2
           which are the recent dual and quad G5 machines using the
diff --git a/drivers/media/video/compat_ioctl32.c b/drivers/media/video/compat_ioctl32.c
index 297c32ab51e3..840fe0177121 100644
--- a/drivers/media/video/compat_ioctl32.c
+++ b/drivers/media/video/compat_ioctl32.c
@@ -167,29 +167,32 @@ static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user
         if (kp->clipcount > 2048)
                 return -EINVAL;
         if (kp->clipcount) {
-                struct v4l2_clip32 *uclips = compat_ptr(up->clips);
-                struct v4l2_clip *kclips;
+                struct v4l2_clip32 __user *uclips;
+                struct v4l2_clip __user *kclips;
                 int n = kp->clipcount;
+                compat_caddr_t p;
 
+                if (get_user(p, &up->clips))
+                        return -EFAULT;
+                uclips = compat_ptr(p);
                 kclips = compat_alloc_user_space(n * sizeof(struct v4l2_clip));
                 kp->clips = kclips;
                 while (--n >= 0) {
-                        if (!access_ok(VERIFY_READ, &uclips->c, sizeof(uclips->c)) ||
-                                copy_from_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
+                        if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
+                                return -EFAULT;
+                        if (put_user(n ? kclips + 1 : NULL, &kclips->next))
                                 return -EFAULT;
-                        kclips->next = n ? kclips + 1 : 0;
                         uclips += 1;
                         kclips += 1;
                 }
         } else
-                kp->clips = 0;
+                kp->clips = NULL;
         return 0;
 }
 
 static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_window32)) ||
-                copy_to_user(&up->w, &kp->w, sizeof(up->w)) ||
+        if (copy_to_user(&up->w, &kp->w, sizeof(up->w)) ||
                 put_user(kp->field, &up->field) ||
                 put_user(kp->chromakey, &up->chromakey) ||
                 put_user(kp->clipcount, &up->clipcount))
@@ -199,33 +202,29 @@ static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user
 
 static inline int get_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_pix_format)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_pix_format)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_pix_format)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_pix_format)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_pix_format)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_pix_format)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int get_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_vbi_format)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_vbi_format)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_vbi_format)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_vbi_format)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_vbi_format)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_vbi_format)))
+                return -EFAULT;
         return 0;
 }
 
@@ -279,18 +278,16 @@ static int put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user
 
 static inline int get_v4l2_standard(struct v4l2_standard *kp, struct v4l2_standard __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_standard)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_standard)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_standard)))
+                return -EFAULT;
         return 0;
 
 }
 
 static inline int put_v4l2_standard(struct v4l2_standard *kp, struct v4l2_standard __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_standard)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_standard)))
+                return -EFAULT;
         return 0;
 }
 
@@ -328,18 +325,16 @@ static int put_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32
 
 static inline int get_v4l2_tuner(struct v4l2_tuner *kp, struct v4l2_tuner __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_tuner)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_tuner)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_tuner)))
+                return -EFAULT;
         return 0;
 
 }
 
 static inline int put_v4l2_tuner(struct v4l2_tuner *kp, struct v4l2_tuner __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_tuner)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_tuner)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_tuner)))
+                return -EFAULT;
         return 0;
 }
 
@@ -380,11 +375,13 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
                 break;
         case V4L2_MEMORY_USERPTR:
                 {
-                unsigned long tmp = (unsigned long)compat_ptr(up->m.userptr);
+                compat_long_t tmp;
 
-                if(get_user(kp->length, &up->length) ||
-                        get_user(kp->m.userptr, &tmp))
-                                return -EFAULT;
+                if (get_user(kp->length, &up->length) ||
+                    get_user(tmp, &up->m.userptr))
+                        return -EFAULT;
+
+                kp->m.userptr = (unsigned long)compat_ptr(tmp);
                 }
                 break;
         case V4L2_MEMORY_OVERLAY:
@@ -468,33 +465,29 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
 
 static inline int get_v4l2_input32(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_input) - 4) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_input) - 4))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_input) - 4))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_input32(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_input) - 4) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_input) - 4))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_input) - 4))
+                return -EFAULT;
         return 0;
 }
 
 static inline int get_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_input)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_input)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_input)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_input)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_input)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_input)))
+                return -EFAULT;
         return 0;
 }
 
diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig
index effa0d7a73ac..205bb7083335 100644
--- a/drivers/mtd/chips/Kconfig
+++ b/drivers/mtd/chips/Kconfig
@@ -301,7 +301,7 @@ config MTD_JEDEC
 
 config MTD_XIP
         bool "XIP aware MTD support"
-        depends on !SMP && (MTD_CFI_INTELEXT || MTD_CFI_AMDSTD) && EXPERIMENTAL && ARM
+        depends on !SMP && (MTD_CFI_INTELEXT || MTD_CFI_AMDSTD) && EXPERIMENTAL && ARCH_MTD_XIP
         default y if XIP_KERNEL
         help
           This allows MTD support to work with flash memory which is also
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index c5cd61c7f927..e5bb9f5ae429 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -748,7 +748,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
         if (essid->length) {
                 dwrq->flags = 1;        /* set ESSID to ON for Wireless Extensions */
                 /* if it is to big, trunk it */
-                dwrq->length = min(IW_ESSID_MAX_SIZE, essid->length);
+                dwrq->length = min((u8)IW_ESSID_MAX_SIZE, essid->length);
         } else {
                 dwrq->flags = 0;
                 dwrq->length = 0;
diff --git a/drivers/serial/m32r_sio.h b/drivers/serial/m32r_sio.h
index 07d0dd80aa3d..7c3ec24f7e50 100644
--- a/drivers/serial/m32r_sio.h
+++ b/drivers/serial/m32r_sio.h
@@ -37,7 +37,7 @@ struct old_serial_port {
         unsigned int irq;
         unsigned int flags;
         unsigned char io_type;
-        unsigned char *iomem_base;
+        unsigned char __iomem *iomem_base;
         unsigned short iomem_reg_shift;
 };
 
diff --git a/drivers/sn/ioc3.c b/drivers/sn/ioc3.c
index c70ae81b5d98..12357e1fa558 100644
--- a/drivers/sn/ioc3.c
+++ b/drivers/sn/ioc3.c
@@ -38,10 +38,10 @@ static inline unsigned mcr_pack(unsigned pulse, unsigned sample)
 
 static int nic_wait(struct ioc3_driver_data *idd)
 {
-        volatile unsigned mcr;
+        unsigned mcr;
 
         do {
-                mcr = (volatile unsigned)idd->vma->mcr;
+                mcr = readl(&idd->vma->mcr);
         } while (!(mcr & 2));
 
         return mcr & 1;
@@ -53,7 +53,7 @@ static int nic_reset(struct ioc3_driver_data *idd)
         unsigned long flags;
 
         local_irq_save(flags);
-        idd->vma->mcr = mcr_pack(500, 65);
+        writel(mcr_pack(500, 65), &idd->vma->mcr);
         presence = nic_wait(idd);
         local_irq_restore(flags);
 
@@ -68,7 +68,7 @@ static inline int nic_read_bit(struct ioc3_driver_data *idd)
         unsigned long flags;
 
         local_irq_save(flags);
-        idd->vma->mcr = mcr_pack(6, 13);
+        writel(mcr_pack(6, 13), &idd->vma->mcr);
         result = nic_wait(idd);
         local_irq_restore(flags);
 
@@ -80,9 +80,9 @@ static inline int nic_read_bit(struct ioc3_driver_data *idd)
 static inline void nic_write_bit(struct ioc3_driver_data *idd, int bit)
 {
         if (bit)
-                idd->vma->mcr = mcr_pack(6, 110);
+                writel(mcr_pack(6, 110), &idd->vma->mcr);
         else
-                idd->vma->mcr = mcr_pack(80, 30);
+                writel(mcr_pack(80, 30), &idd->vma->mcr);
 
         nic_wait(idd);
 }
@@ -337,7 +337,7 @@ static void probe_nic(struct ioc3_driver_data *idd)
         int save = 0, loops = 3;
         unsigned long first, addr;
 
-        idd->vma->gpcr_s = GPCR_MLAN_EN;
+        writel(GPCR_MLAN_EN, &idd->vma->gpcr_s);
 
         while(loops>0) {
                 idd->nic_part[0] = 0;
@@ -408,7 +408,7 @@ static irqreturn_t ioc3_intr_io(int irq, void *arg, struct pt_regs *regs)
 
         read_lock_irqsave(&ioc3_submodules_lock, flags);
 
-        if(idd->dual_irq && idd->vma->eisr) {
+        if(idd->dual_irq && readb(&idd->vma->eisr)) {
                 /* send Ethernet IRQ to the driver */
                 if(ioc3_ethernet && idd->active[ioc3_ethernet->id] &&
                                                 ioc3_ethernet->intr) {
@@ -682,7 +682,7 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
         idd->id = ioc3_counter++;
         up_write(&ioc3_devices_rwsem);
 
-        idd->gpdr_shadow = idd->vma->gpdr;
+        idd->gpdr_shadow = readl(&idd->vma->gpdr);
 
         /* Read IOC3 NIC contents */
         probe_nic(idd);
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 5dd0207ffd46..057e60217fc5 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -931,8 +931,8 @@ struct compat_sg_req_info { /* used by SG_GET_REQUEST_TABLE ioctl() */
 static int sg_grt_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
         int err, i;
-        sg_req_info_t *r;
-        struct compat_sg_req_info *o = (struct compat_sg_req_info *)arg;
+        sg_req_info_t __user *r;
+        struct compat_sg_req_info __user *o = (void __user *)arg;
         r = compat_alloc_user_space(sizeof(sg_req_info_t)*SG_MAX_QUEUE);
         err = sys_ioctl(fd,cmd,(unsigned long)r);
         if (err < 0)
@@ -2739,8 +2739,8 @@ static int do_ncp_setprivatedata(unsigned int fd, unsigned int cmd, unsigned lon
 static int
 lp_timeout_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
-        struct compat_timeval *tc = (struct compat_timeval *)arg;
-        struct timeval *tn = compat_alloc_user_space(sizeof(struct timeval));
+        struct compat_timeval __user *tc = (struct compat_timeval __user *)arg;
+        struct timeval __user *tn = compat_alloc_user_space(sizeof(struct timeval));
         struct timeval ts;
         if (get_user(ts.tv_sec, &tc->tv_sec) ||
             get_user(ts.tv_usec, &tc->tv_usec) ||
diff --git a/include/asm-mips/abi.h b/include/asm-mips/abi.h
index 2e7e651c3e3f..1ce0518ace2e 100644
--- a/include/asm-mips/abi.h
+++ b/include/asm-mips/abi.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2005 by Ralf Baechle
+ * Copyright (C) 2005, 06 by Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 2005 MIPS Technologies, Inc.
  */
 #ifndef _ASM_ABI_H
@@ -13,7 +13,7 @@
 #include <asm/siginfo.h>
 
 struct mips_abi {
-        int (* const do_signal)(sigset_t *oldset, struct pt_regs *regs);
+        void (* const do_signal)(struct pt_regs *regs);
         int (* const setup_frame)(struct k_sigaction * ka,
                                   struct pt_regs *regs, int signr,
                                   sigset_t *set);
diff --git a/include/asm-mips/io.h b/include/asm-mips/io.h
index a9fa1254894a..5a4c8a54b8f4 100644
--- a/include/asm-mips/io.h
+++ b/include/asm-mips/io.h
@@ -56,38 +56,38 @@
  * variations of functions: non-prefixed ones that preserve the value
  * and prefixed ones that preserve byte addresses.  The latters are
  * typically used for moving raw data between a peripheral and memory (cf.
- * string I/O functions), hence the "mem_" prefix.
+ * string I/O functions), hence the "__mem_" prefix.
  */
 #if defined(CONFIG_SWAP_IO_SPACE)
 
 # define ioswabb(x)             (x)
-# define mem_ioswabb(x)         (x)
+# define __mem_ioswabb(x)       (x)
 # ifdef CONFIG_SGI_IP22
 /*
  * IP22 seems braindead enough to swap 16bits values in hardware, but
  * not 32bits.  Go figure... Can't tell without documentation.
  */
 #  define ioswabw(x)            (x)
-#  define mem_ioswabw(x)        le16_to_cpu(x)
+#  define __mem_ioswabw(x)      le16_to_cpu(x)
 # else
 #  define ioswabw(x)            le16_to_cpu(x)
-#  define mem_ioswabw(x)        (x)
+#  define __mem_ioswabw(x)      (x)
 # endif
 # define ioswabl(x)             le32_to_cpu(x)
-# define mem_ioswabl(x)         (x)
+# define __mem_ioswabl(x)       (x)
 # define ioswabq(x)             le64_to_cpu(x)
-# define mem_ioswabq(x)         (x)
+# define __mem_ioswabq(x)       (x)
 
 #else
 
 # define ioswabb(x)             (x)
-# define mem_ioswabb(x)         (x)
+# define __mem_ioswabb(x)       (x)
 # define ioswabw(x)             (x)
-# define mem_ioswabw(x)         cpu_to_le16(x)
+# define __mem_ioswabw(x)       cpu_to_le16(x)
 # define ioswabl(x)             (x)
-# define mem_ioswabl(x)         cpu_to_le32(x)
+# define __mem_ioswabl(x)       cpu_to_le32(x)
 # define ioswabq(x)             (x)
-# define mem_ioswabq(x)         cpu_to_le32(x)
+# define __mem_ioswabq(x)       cpu_to_le32(x)
 
 #endif
 
@@ -342,7 +342,7 @@ static inline void pfx##write##bwlq(type val,				\
                 BUG();                                                  \
 }                                                                       \
                                                                         \
-static inline type pfx##read##bwlq(volatile void __iomem *mem)          \
+static inline type pfx##read##bwlq(const volatile void __iomem *mem)    \
 {                                                                       \
         volatile type *__mem;                                           \
         type __val;                                                     \
@@ -417,7 +417,7 @@ __BUILD_MEMORY_SINGLE(bus, bwlq, type, 1)
                                                                         \
 __BUILD_MEMORY_PFX(__raw_, bwlq, type)                                  \
 __BUILD_MEMORY_PFX(, bwlq, type)                                        \
-__BUILD_MEMORY_PFX(mem_, bwlq, type)                                    \
+__BUILD_MEMORY_PFX(__mem_, bwlq, type)                                  \
 
 BUILDIO_MEM(b, u8)
 BUILDIO_MEM(w, u16)
@@ -430,7 +430,7 @@ BUILDIO_MEM(q, u64)
 
 #define BUILDIO_IOPORT(bwlq, type)                                      \
         __BUILD_IOPORT_PFX(, bwlq, type)                                \
-        __BUILD_IOPORT_PFX(mem_, bwlq, type)
+        __BUILD_IOPORT_PFX(__mem_, bwlq, type)
 
 BUILDIO_IOPORT(b, u8)
 BUILDIO_IOPORT(w, u16)
@@ -464,7 +464,7 @@ static inline void writes##bwlq(volatile void __iomem *mem,		\
         const volatile type *__addr = addr;                             \
                                                                         \
         while (count--) {                                               \
-                mem_write##bwlq(*__addr, mem);                          \
+                __mem_write##bwlq(*__addr, mem);                        \
                 __addr++;                                               \
         }                                                               \
 }                                                                       \
@@ -475,7 +475,7 @@ static inline void reads##bwlq(volatile void __iomem *mem, void *addr,	\
         volatile type *__addr = addr;                                   \
                                                                         \
         while (count--) {                                               \
-                *__addr = mem_read##bwlq(mem);                          \
+                *__addr = __mem_read##bwlq(mem);                        \
                 __addr++;                                               \
         }                                                               \
 }
@@ -488,7 +488,7 @@ static inline void outs##bwlq(unsigned long port, const void *addr,	\
         const volatile type *__addr = addr;                             \
                                                                         \
         while (count--) {                                               \
-                mem_out##bwlq(*__addr, port);                           \
+                __mem_out##bwlq(*__addr, port);                         \
                 __addr++;                                               \
         }                                                               \
 }                                                                       \
@@ -499,7 +499,7 @@ static inline void ins##bwlq(unsigned long port, void *addr,		\
         volatile type *__addr = addr;                                   \
                                                                         \
         while (count--) {                                               \
-                *__addr = mem_in##bwlq(port);                           \
+                *__addr = __mem_in##bwlq(port);                         \
                 __addr++;                                               \
         }                                                               \
 }
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index 1612b3fe1080..fa193f861e71 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -114,6 +114,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_SYSCALL_AUDIT       4       /* syscall auditing active */
 #define TIF_SECCOMP             5       /* secure computing */
+#define TIF_RESTORE_SIGMASK     9       /* restore signal mask in do_signal() */
 #define TIF_USEDFPU             16      /* FPU was used by this task this quantum (SMP) */
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
@@ -125,6 +126,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
 #define _TIF_SYSCALL_AUDIT      (1<<TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP            (1<<TIF_SECCOMP)
+#define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
 #define _TIF_USEDFPU            (1<<TIF_USEDFPU)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 
diff --git a/include/asm-mips/unistd.h b/include/asm-mips/unistd.h
index 89ea8b60e945..e7ff9b187783 100644
--- a/include/asm-mips/unistd.h
+++ b/include/asm-mips/unistd.h
@@ -307,17 +307,33 @@
 #define __NR_inotify_init               (__NR_Linux + 284)
 #define __NR_inotify_add_watch          (__NR_Linux + 285)
 #define __NR_inotify_rm_watch           (__NR_Linux + 286)
-
+#define __NR_migrate_pages              (__NR_Linux + 287)
+#define __NR_openat                     (__NR_Linux + 288)
+#define __NR_mkdirat                    (__NR_Linux + 289)
+#define __NR_mknodat                    (__NR_Linux + 290)
+#define __NR_fchownat                   (__NR_Linux + 291)
+#define __NR_futimesat                  (__NR_Linux + 292)
+#define __NR_newfstatat                 (__NR_Linux + 293)
+#define __NR_unlinkat                   (__NR_Linux + 294)
+#define __NR_renameat                   (__NR_Linux + 295)
+#define __NR_linkat                     (__NR_Linux + 296)
+#define __NR_symlinkat                  (__NR_Linux + 297)
+#define __NR_readlinkat                 (__NR_Linux + 298)
+#define __NR_fchmodat                   (__NR_Linux + 299)
+#define __NR_faccessat                  (__NR_Linux + 300)
+#define __NR_pselect6                   (__NR_Linux + 301)
+#define __NR_ppoll                      (__NR_Linux + 302)
+#define __NR_unshare                    (__NR_Linux + 303)
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             286
+#define __NR_Linux_syscalls             303
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         283
+#define __NR_O32_Linux_syscalls         303
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -571,16 +587,33 @@
 #define __NR_inotify_init               (__NR_Linux + 243)
 #define __NR_inotify_add_watch          (__NR_Linux + 244)
 #define __NR_inotify_rm_watch           (__NR_Linux + 245)
+#define __NR_migrate_pages              (__NR_Linux + 246)
+#define __NR_openat                     (__NR_Linux + 247)
+#define __NR_mkdirat                    (__NR_Linux + 248)
+#define __NR_mknodat                    (__NR_Linux + 249)
+#define __NR_fchownat                   (__NR_Linux + 250)
+#define __NR_futimesat                  (__NR_Linux + 251)
+#define __NR_newfstatat                 (__NR_Linux + 252)
+#define __NR_unlinkat                   (__NR_Linux + 253)
+#define __NR_renameat                   (__NR_Linux + 254)
+#define __NR_linkat                     (__NR_Linux + 255)
+#define __NR_symlinkat                  (__NR_Linux + 256)
+#define __NR_readlinkat                 (__NR_Linux + 257)
+#define __NR_fchmodat                   (__NR_Linux + 258)
+#define __NR_faccessat                  (__NR_Linux + 259)
+#define __NR_pselect6                   (__NR_Linux + 260)
+#define __NR_ppoll                      (__NR_Linux + 261)
+#define __NR_unshare                    (__NR_Linux + 262)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             245
+#define __NR_Linux_syscalls             262
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          242
+#define __NR_64_Linux_syscalls          262
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -838,16 +871,33 @@
 #define __NR_inotify_init               (__NR_Linux + 247)
 #define __NR_inotify_add_watch          (__NR_Linux + 248)
 #define __NR_inotify_rm_watch           (__NR_Linux + 249)
+#define __NR_migrate_pages              (__NR_Linux + 250)
+#define __NR_openat                     (__NR_Linux + 251)
+#define __NR_mkdirat                    (__NR_Linux + 252)
+#define __NR_mknodat                    (__NR_Linux + 253)
+#define __NR_fchownat                   (__NR_Linux + 254)
+#define __NR_futimesat                  (__NR_Linux + 255)
+#define __NR_newfstatat                 (__NR_Linux + 256)
+#define __NR_unlinkat                   (__NR_Linux + 257)
+#define __NR_renameat                   (__NR_Linux + 258)
+#define __NR_linkat                     (__NR_Linux + 259)
+#define __NR_symlinkat                  (__NR_Linux + 260)
+#define __NR_readlinkat                 (__NR_Linux + 261)
+#define __NR_fchmodat                   (__NR_Linux + 262)
+#define __NR_faccessat                  (__NR_Linux + 263)
+#define __NR_pselect6                   (__NR_Linux + 264)
+#define __NR_ppoll                      (__NR_Linux + 265)
+#define __NR_unshare                    (__NR_Linux + 266)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             249
+#define __NR_Linux_syscalls             266
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         246
+#define __NR_N32_Linux_syscalls         266
 
 #ifndef __ASSEMBLY__
 
diff --git a/include/asm-powerpc/compat.h b/include/asm-powerpc/compat.h
index accb80c9a339..aacaabd28ac1 100644
--- a/include/asm-powerpc/compat.h
+++ b/include/asm-powerpc/compat.h
@@ -126,6 +126,11 @@ static inline void __user *compat_ptr(compat_uptr_t uptr)
         return (void __user *)(unsigned long)uptr;
 }
 
+static inline compat_uptr_t ptr_to_compat(void __user *uptr)
+{
+        return (u32)(unsigned long)uptr;
+}
+
 static inline void __user *compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = current->thread.regs;
diff --git a/include/asm-powerpc/thread_info.h b/include/asm-powerpc/thread_info.h
index 67cdaf3ae9fc..c044ec16a879 100644
--- a/include/asm-powerpc/thread_info.h
+++ b/include/asm-powerpc/thread_info.h
@@ -37,7 +37,7 @@ struct thread_info {
         int             preempt_count;          /* 0 => preemptable,
                                                    <0 => BUG */
         struct restart_block restart_block;
-        void *nvgprs_frame;
+        void __user *nvgprs_frame;
         /* low level flags - has atomic operations done on it */
         unsigned long   flags ____cacheline_aligned_in_smp;
 };
diff --git a/include/asm-s390/uaccess.h b/include/asm-s390/uaccess.h
index be104f21c70a..0b7c0ca4c3d7 100644
--- a/include/asm-s390/uaccess.h
+++ b/include/asm-s390/uaccess.h
@@ -61,7 +61,7 @@
 #define segment_eq(a,b) ((a).ar4 == (b).ar4)
 
 
-static inline int __access_ok(const void *addr, unsigned long size)
+static inline int __access_ok(const void __user *addr, unsigned long size)
 {
         return 1;
 }
@@ -208,25 +208,25 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         case 1: {                                               \
                 unsigned char __x;                              \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 2: {                                               \
                 unsigned short __x;                             \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 4: {                                               \
                 unsigned int __x;                               \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 8: {                                               \
                 unsigned long long __x;                         \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         default:                                                \
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 23fe746a1d51..18cf1f3e1184 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -82,6 +82,7 @@ struct elevator_queue
 extern void elv_dispatch_sort(request_queue_t *, struct request *);
 extern void elv_add_request(request_queue_t *, struct request *, int, int);
 extern void __elv_add_request(request_queue_t *, struct request *, int, int);
+extern void elv_insert(request_queue_t *, struct request *, int);
 extern int elv_merge(request_queue_t *, struct request **, struct bio *);
 extern void elv_merge_requests(request_queue_t *, struct request *,
                                struct request *);
diff --git a/include/linux/ioc3.h b/include/linux/ioc3.h
index e7906a72a4f1..da7c09e4ede6 100644
--- a/include/linux/ioc3.h
+++ b/include/linux/ioc3.h
@@ -27,7 +27,7 @@ struct ioc3_driver_data {
         int id;                         /* IOC3 sequence number */
         /* PCI mapping */
         unsigned long pma;              /* physical address */
-        struct __iomem ioc3 *vma;       /* pointer to registers */
+        struct ioc3 __iomem *vma;       /* pointer to registers */
         struct pci_dev *pdev;           /* PCI device */
         /* IRQ stuff */
         int dual_irq;                   /* set if separate IRQs are used */
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index b23be44cbea8..5208b12d5550 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -549,7 +549,7 @@ struct v4l2_framebuffer
 struct v4l2_clip
 {
         struct v4l2_rect        c;
-        struct v4l2_clip        *next;
+        struct v4l2_clip        __user *next;
 };
 
 struct v4l2_window
diff --git a/mm/slob.c b/mm/slob.c
index 1c240c4b71d9..a1f42bdc0245 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -336,7 +336,7 @@ EXPORT_SYMBOL(slab_reclaim_pages);
 
 #ifdef CONFIG_SMP
 
-void *__alloc_percpu(size_t size, size_t align)
+void *__alloc_percpu(size_t size)
 {
         int i;
         struct percpu_data *pdata = kmalloc(sizeof (*pdata), GFP_KERNEL);