28 files changed, 132 insertions, 90 deletions
diff --git a/arch/ia64/kernel/domain.c b/arch/ia64/kernel/domain.c
index d65e87b6394f..bbb8efe126b7 100644
--- a/arch/ia64/kernel/domain.c
+++ b/arch/ia64/kernel/domain.c
@@ -341,7 +341,7 @@ next_sg:
 #endif
        /* Attach the domains */
-        for_each_online_cpu(i) {
+        for_each_cpu_mask(i, *cpu_map) {
                struct sched_domain *sd;
 #ifdef CONFIG_SCHED_SMT
                sd = &per_cpu(cpu_domains, i);
diff --git a/drivers/acpi/motherboard.c b/drivers/acpi/motherboard.c
index 2934475d67d6..61ea70742d49 100644
--- a/drivers/acpi/motherboard.c
+++ b/drivers/acpi/motherboard.c
@@ -43,7 +43,7 @@ ACPI_MODULE_NAME		("acpi_motherboard")
 */
 #define IS_RESERVED_ADDR(base, len) \
        (((len) > 0) && ((base) > 0) && ((base) + (len) < IO_SPACE_LIMIT) \
-        && ((base) + (len) > 0x1000))
+        && ((base) + (len) > PCIBIOS_MIN_IO))
 /*
 * Clearing the flag (IORESOURCE_BUSY) allows drivers to use
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 42187381506b..850a78c9c4bc 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -261,7 +261,11 @@ static int mmap_mem(struct file * file, struct vm_area_struct * vma)
 static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
-        unsigned long long val;
+        unsigned long pfn;
+        /* Turn a kernel-virtual address into a physical page frame */
+        pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
        /*
         * RED-PEN: on some architectures there is more mapped memory
         * than available in mem_map which pfn_valid checks
@@ -269,10 +273,10 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
         *
         * RED-PEN: vmalloc is not supported right now.
         */
-        if (!pfn_valid(vma->vm_pgoff))
+        if (!pfn_valid(pfn))
                return -EIO;
-        val = (u64)vma->vm_pgoff << PAGE_SHIFT;
-        vma->vm_pgoff = __pa(val) >> PAGE_SHIFT;
+        vma->vm_pgoff = pfn;
        return mmap_mem(file, vma);
 }
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 929170dcd3cb..600ba1202864 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -183,7 +183,7 @@
 * cross a page boundy.
 */
 #define SEGMENTX_LEN    (sizeof(struct SGentry)*DC395x_MAX_SG_LISTENTRY)
-#define VIRTX_LEN       (sizeof(void *) * DC395x_MAX_SG_LISTENTRY)
 struct SGentry {
        u32 address;            /* bus! address */
@@ -235,7 +235,6 @@ struct ScsiReqBlk {
        u8 sg_count;                    /* No of HW sg entries for this request */
        u8 sg_index;                    /* Index of HW sg entry for this request */
        u32 total_xfer_length;          /* Total number of bytes remaining to be transfered */
-        void **virt_map;
        unsigned char *virt_addr;       /* Virtual address of current transfer position */
        /*
@@ -1022,14 +1021,14 @@ static void build_srb(struct scsi_cmnd *cmd, struct DeviceCtlBlk *dcb,
                        reqlen, cmd->request_buffer, cmd->use_sg,
                        srb->sg_count);
+                srb->virt_addr = page_address(sl->page);
                for (i = 0; i < srb->sg_count; i++) {
-                        u32 seglen = (u32)sg_dma_len(sl + i);
+                        u32 busaddr = (u32)sg_dma_address(&sl[i]);
-                        sgp[i].address = (u32)sg_dma_address(sl + i);
+                        u32 seglen = (u32)sl[i].length;
+                        sgp[i].address = busaddr;
                        sgp[i].length = seglen;
                        srb->total_xfer_length += seglen;
-                        srb->virt_map[i] = kmap(sl[i].page);
                }
-                srb->virt_addr = srb->virt_map[0];
                sgp += srb->sg_count - 1;
                /*
@@ -1976,7 +1975,6 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
        int segment = cmd->use_sg;
        u32 xferred = srb->total_xfer_length - left; /* bytes transfered */
        struct SGentry *psge = srb->segment_x + srb->sg_index;
-        void **virt = srb->virt_map;
        dprintkdbg(DBG_0,
                "sg_update_list: Transfered %i of %i bytes, %i remain\n",
@@ -2016,16 +2014,16 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
        /* We have to walk the scatterlist to find it */
        sg = (struct scatterlist *)cmd->request_buffer;
-        idx = 0;
        while (segment--) {
                unsigned long mask =
                    ~((unsigned long)sg->length - 1) & PAGE_MASK;
                if ((sg_dma_address(sg) & mask) == (psge->address & mask)) {
-                        srb->virt_addr = virt[idx] + (psge->address & ~PAGE_MASK);
+                        srb->virt_addr = (page_address(sg->page)
+                                           + psge->address -
+                                           (psge->address & PAGE_MASK));
                        return;
                }
                ++sg;
-                ++idx;
        }
        dprintkl(KERN_ERR, "sg_update_list: sg_to_virt failed\n");
@@ -2151,7 +2149,7 @@ static void data_out_phase0(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb,
                                DC395x_read32(acb, TRM_S1040_DMA_CXCNT));
                }
                /*
-                 * calculate all the residue data that not yet transfered
+                 * calculate all the residue data that not yet tranfered
                 * SCSI transfer counter + left in SCSI FIFO data
                 *
                 * .....TRM_S1040_SCSI_COUNTER (24bits)
@@ -3269,7 +3267,6 @@ static void pci_unmap_srb(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb)
        struct scsi_cmnd *cmd = srb->cmd;
        enum dma_data_direction dir = cmd->sc_data_direction;
        if (cmd->use_sg && dir != PCI_DMA_NONE) {
-                int i;
                /* unmap DC395x SG list */
                dprintkdbg(DBG_SG, "pci_unmap_srb: list=%08x(%05x)\n",
                        srb->sg_bus_addr, SEGMENTX_LEN);
@@ -3279,8 +3276,6 @@ static void pci_unmap_srb(struct AdapterCtlBlk *acb, struct ScsiReqBlk *srb)
                dprintkdbg(DBG_SG, "pci_unmap_srb: segs=%i buffer=%p\n",
                        cmd->use_sg, cmd->request_buffer);
                /* unmap the sg segments */
-                for (i = 0; i < srb->sg_count; i++)
-                        kunmap(virt_to_page(srb->virt_map[i]));
                pci_unmap_sg(acb->dev,
                             (struct scatterlist *)cmd->request_buffer,
                             cmd->use_sg, dir);
@@ -3327,7 +3322,7 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
        if (cmd->use_sg) {
                struct scatterlist* sg = (struct scatterlist *)cmd->request_buffer;
-                ptr = (struct ScsiInqData *)(srb->virt_map[0] + sg->offset);
+                ptr = (struct ScsiInqData *)(page_address(sg->page) + sg->offset);
        } else {
                ptr = (struct ScsiInqData *)(cmd->request_buffer);
        }
@@ -4262,9 +4257,8 @@ static void adapter_sg_tables_free(struct AdapterCtlBlk *acb)
        const unsigned srbs_per_page = PAGE_SIZE/SEGMENTX_LEN;
        for (i = 0; i < DC395x_MAX_SRB_CNT; i += srbs_per_page)
-                kfree(acb->srb_array[i].segment_x);
+                if (acb->srb_array[i].segment_x)
+                        kfree(acb->srb_array[i].segment_x);
-        vfree(acb->srb_array[0].virt_map);
 }
@@ -4280,12 +4274,9 @@ static int __devinit adapter_sg_tables_alloc(struct AdapterCtlBlk *acb)
        int srb_idx = 0;
        unsigned i = 0;
        struct SGentry *ptr;
-        void **virt_array;
-        for (i = 0; i < DC395x_MAX_SRB_CNT; i++) {
+        for (i = 0; i < DC395x_MAX_SRB_CNT; i++)
                acb->srb_array[i].segment_x = NULL;
-                acb->srb_array[i].virt_map = NULL;
-        }
        dprintkdbg(DBG_1, "Allocate %i pages for SG tables\n", pages);
        while (pages--) {
@@ -4306,19 +4297,6 @@ static int __devinit adapter_sg_tables_alloc(struct AdapterCtlBlk *acb)
                    ptr + (i * DC395x_MAX_SG_LISTENTRY);
        else
                dprintkl(KERN_DEBUG, "No space for tmsrb SG table reserved?!\n");
-        virt_array = vmalloc((DC395x_MAX_SRB_CNT + 1) * DC395x_MAX_SG_LISTENTRY * sizeof(void*));
-        if (!virt_array) {
-                adapter_sg_tables_free(acb);
-                return 1;
-        }
-        for (i = 0; i < DC395x_MAX_SRB_CNT + 1; i++) {
-                acb->srb_array[i].virt_map = virt_array;
-                virt_array += DC395x_MAX_SG_LISTENTRY;
-        }
        return 0;
 }
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index d2e19f6dd72c..4ff853fbe0be 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -628,7 +628,7 @@ fb_pan_display(struct fb_info *info, struct fb_var_screeninfo *var)
 int
 fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 {
-        int err;
+        int err, flags = info->flags;
        if (var->activate & FB_ACTIVATE_INV_MODE) {
                struct fb_videomode mode1, mode2;
@@ -682,7 +682,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
                            !list_empty(&info->modelist))
                                err = fb_add_videomode(&mode, &info->modelist);
-                        if (!err && info->flags & FBINFO_MISC_USEREVENT) {
+                        if (!err && (flags & FBINFO_MISC_USEREVENT)) {
                                struct fb_event event;
                                info->flags &= ~FBINFO_MISC_USEREVENT;
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 298bc9cd99e7..a112a1786855 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -583,23 +583,6 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                return -ENODEV;
        }
-        /* Map the fb and MMIO regions */
-        dinfo->aperture.virtual = (u8 __iomem *)ioremap_nocache
-                (dinfo->aperture.physical, dinfo->aperture.size);
-        if (!dinfo->aperture.virtual) {
-                ERR_MSG("Cannot remap FB region.\n");
-                cleanup(dinfo);
-                return -ENODEV;
-        }
-        dinfo->mmio_base =
-                (u8 __iomem *)ioremap_nocache(dinfo->mmio_base_phys,
-                                               INTEL_REG_SIZE);
-        if (!dinfo->mmio_base) {
-                ERR_MSG("Cannot remap MMIO region.\n");
-                cleanup(dinfo);
-                return -ENODEV;
-        }
        /* Get the chipset info. */
        dinfo->pci_chipset = pdev->device;
@@ -630,9 +613,15 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                dinfo->accel = 0;
        }
+        if (MB(voffset) < stolen_size)
+                offset = (stolen_size >> 12);
+        else
+                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
        /* Framebuffer parameters - Use all the stolen memory if >= vram */
-        if (ROUND_UP_TO_PAGE(stolen_size) >= MB(vram)) {
+        if (ROUND_UP_TO_PAGE(stolen_size) >= ((offset << 12) +  MB(vram))) {
                dinfo->fb.size = ROUND_UP_TO_PAGE(stolen_size);
+                dinfo->fb.offset = 0;
                dinfo->fbmem_gart = 0;
        } else {
                dinfo->fb.size =  MB(vram);
@@ -663,11 +652,6 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                return -ENODEV;
        }
-        if (MB(voffset) < stolen_size)
-                offset = (stolen_size >> 12);
-        else
-                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
        /* set the mem offsets - set them after the already used pages */
        if (dinfo->accel) {
                dinfo->ring.offset = offset + gtt_info.current_memory;
@@ -682,6 +666,26 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                        + (dinfo->cursor.size >> 12);
        }
+        /* Map the fb and MMIO regions */
+        /* ioremap only up to the end of used aperture */
+        dinfo->aperture.virtual = (u8 __iomem *)ioremap_nocache
+                (dinfo->aperture.physical, (dinfo->fb.offset << 12)
+                 + dinfo->fb.size);
+        if (!dinfo->aperture.virtual) {
+                ERR_MSG("Cannot remap FB region.\n");
+                cleanup(dinfo);
+                return -ENODEV;
+        }
+        dinfo->mmio_base =
+                (u8 __iomem *)ioremap_nocache(dinfo->mmio_base_phys,
+                                               INTEL_REG_SIZE);
+        if (!dinfo->mmio_base) {
+                ERR_MSG("Cannot remap MMIO region.\n");
+                cleanup(dinfo);
+                return -ENODEV;
+        }
        /* Allocate memories (which aren't stolen) */
        if (dinfo->accel) {
                if (!(dinfo->gtt_ring_mem =
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index dab4774ee7bb..3196d4c4eed3 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,9 @@
+Version 1.35
+------------
+Add writepage performance improvements.  Fix path name conversions
+for long filenames on mounts which were done with "mapchars" mount option
+specified.
 Version 1.34
 ------------
 Fix error mapping of the TOO_MANY_LINKS (hardlinks) case.
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 3c628bf667a5..0db0b313d715 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -2602,6 +2602,9 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
        if(name_len < PATH_MAX) {
                memcpy(pSMB->ResumeFileName, psrch_inf->presume_name, name_len);
                byte_count += name_len;
+                /* 14 byte parm len above enough for 2 byte null terminator */
+                pSMB->ResumeFileName[name_len] = 0;
+                pSMB->ResumeFileName[name_len+1] = 0;
        } else {
                rc = -EINVAL;
                goto FNext2_err_exit;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 072b4ee8c53e..20ae4153f791 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -611,6 +611,7 @@ cifsConvertToUCS(__le16 * target, const char *source, int maxlen,
                src_char = source[i];
                switch (src_char) {
                        case 0:
+                                target[j] = 0;
                                goto ctoUCS_out;
                        case ':':
                                target[j] = cpu_to_le16(UNI_COLON);
diff --git a/fs/inotify.c b/fs/inotify.c
index 27ebcac5e07f..868901b1e779 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -402,7 +402,7 @@ static struct inotify_watch *create_watch(struct inotify_device *dev,
                return ERR_PTR(ret);
        }
-        dev->last_wd = ret;
+        dev->last_wd = watch->wd;
        watch->mask = mask;
        atomic_set(&watch->count, 0);
        INIT_LIST_HEAD(&watch->d_list);
diff --git a/fs/namei.c b/fs/namei.c
index 57046d98a746..b85f158aef0c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2216,7 +2216,8 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
        if (!error) {
                const char *new_name = old_dentry->d_name.name;
-                fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir, new_dentry->d_inode);
+                fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
+                              new_dentry->d_inode, old_dentry->d_inode);
        }
        fsnotify_oldname_free(old_name);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 4845911f1c63..bb7ca022bcb2 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -814,28 +814,39 @@ nfs_setattr(struct dentry *dentry, struct iattr *attr)
                nfs_wb_all(inode);
        }
        error = NFS_PROTO(inode)->setattr(dentry, &fattr, attr);
-        if (error == 0) {
+        if (error == 0)
                nfs_refresh_inode(inode, &fattr);
+        nfs_end_data_update(inode);
+        unlock_kernel();
+        return error;
+}
+/**
+ * nfs_setattr_update_inode - Update inode metadata after a setattr call.
+ * @inode: pointer to struct inode
+ * @attr: pointer to struct iattr
+ *
+ * Note: we do this in the *proc.c in order to ensure that
+ *       it works for things like exclusive creates too.
+ */
+void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
+{
+        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0) {
                if ((attr->ia_valid & ATTR_MODE) != 0) {
-                        int mode;
+                        int mode = attr->ia_mode & S_IALLUGO;
-                        mode = inode->i_mode & ~S_IALLUGO;
+                        mode |= inode->i_mode & ~S_IALLUGO;
-                        mode |= attr->ia_mode & S_IALLUGO;
                        inode->i_mode = mode;
                }
                if ((attr->ia_valid & ATTR_UID) != 0)
                        inode->i_uid = attr->ia_uid;
                if ((attr->ia_valid & ATTR_GID) != 0)
                        inode->i_gid = attr->ia_gid;
-                if ((attr->ia_valid & ATTR_SIZE) != 0) {
-                        inode->i_size = attr->ia_size;
-                        vmtruncate(inode, attr->ia_size);
-                }
-        }
-        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0)
                NFS_FLAGS(inode) |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-        nfs_end_data_update(inode);
+        }
-        unlock_kernel();
+        if ((attr->ia_valid & ATTR_SIZE) != 0) {
-        return error;
+                inode->i_size = attr->ia_size;
+                vmtruncate(inode, attr->ia_size);
+        }
 }
 /*
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 7851569b31c6..2681485cf2d0 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -120,6 +120,8 @@ nfs3_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
        dprintk("NFS call  setattr\n");
        fattr->valid = 0;
        status = rpc_call(NFS_CLIENT(inode), NFS3PROC_SETATTR, &arg, fattr, 0);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
        dprintk("NFS reply setattr: %d\n", status);
        return status;
 }
@@ -370,6 +372,8 @@ again:
                 * not sure this buys us anything (and I'd have
                 * to revamp the NFSv3 XDR code) */
                status = nfs3_proc_setattr(dentry, &fattr, sattr);
+                if (status == 0)
+                        nfs_setattr_update_inode(dentry->d_inode, sattr);
                nfs_refresh_inode(dentry->d_inode, &fattr);
                dprintk("NFS reply setattr (post-create): %d\n", status);
        }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1b76f80aedb9..0c5a308e4963 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -753,6 +753,7 @@ static int _nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
                .rpc_argp       = &arg,
                .rpc_resp       = &res,
        };
+        int status;
        fattr->valid = 0;
@@ -762,7 +763,8 @@ static int _nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
        } else
                memcpy(&arg.stateid, &zero_stateid, sizeof(arg.stateid));
-        return rpc_call_sync(server->client, &msg, 0);
+        status = rpc_call_sync(server->client, &msg, 0);
+        return status;
 }
 static int nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
@@ -1145,6 +1147,8 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
        status = nfs4_do_setattr(NFS_SERVER(inode), fattr,
                        NFS_FH(inode), sattr, state);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
        if (state != NULL)
                nfs4_close_state(state, FMODE_WRITE);
        put_rpccred(cred);
@@ -1449,8 +1453,10 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
                struct nfs_fattr fattr;
                status = nfs4_do_setattr(NFS_SERVER(dir), &fattr,
                                     NFS_FH(state->inode), sattr, state);
-                if (status == 0)
+                if (status == 0) {
+                        nfs_setattr_update_inode(state->inode, sattr);
                        goto out;
+                }
        } else if (flags != 0)
                goto out;
        nfs4_close_state(state, flags);
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index cedf636bcf3c..be23c3fb9260 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -114,6 +114,8 @@ nfs_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
        dprintk("NFS call  setattr\n");
        fattr->valid = 0;
        status = rpc_call(NFS_CLIENT(inode), NFSPROC_SETATTR, &arg, fattr, 0);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
        dprintk("NFS reply setattr: %d\n", status);
        return status;
 }
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index 18c58c32e326..251e5a1bb1c4 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -239,6 +239,7 @@ nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
        if (xdr_decode_word(buf, base, &entries) ||
            entries > NFS_ACL_MAX_ENTRIES)
                return -EINVAL;
+        nfsacl_desc.desc.array_maxlen = entries;
        err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);
        if (err)
                return err;
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 9709fac6531d..21e21fe519e2 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -174,6 +174,9 @@ ToDo/Notes:
          fact that the vfs and ntfs inodes are one struct in memory to find
          the ntfs inode in memory if present.  Also, the ntfs inode has its
          own locking so it does not matter if the vfs inode is locked.
+        - Fix bug in mft record writing where we forgot to set the device in
+          the buffers when mapping them after the VM had discarded them
+          Thanks to Martin MOKREJŠ for the bug report.
 2.1.22 - Many bug and race fixes and error handling improvements.
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index ac9ff39aa834..317f7c679fd3 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -533,6 +533,7 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
                        LCN lcn;
                        unsigned int vcn_ofs;
+                        bh->b_bdev = vol->sb->s_bdev;
                        /* Obtain the vcn and offset of the current block. */
                        vcn = ((VCN)mft_no << vol->mft_record_size_bits) +
                                        (block_start - m_start);
@@ -725,6 +726,7 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
                        LCN lcn;
                        unsigned int vcn_ofs;
+                        bh->b_bdev = vol->sb->s_bdev;
                        /* Obtain the vcn and offset of the current block. */
                        vcn = ((VCN)ni->mft_no << vol->mft_record_size_bits) +
                                        (block_start - m_start);
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index a20bbc1642dc..3549067c42d9 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -593,6 +593,9 @@ static int new_inode_init(struct inode *inode, struct inode *dir, int mode)
         */
        inode->i_uid = current->fsuid;
        inode->i_mode = mode;
+        /* Make inode invalid - just in case we are going to drop it before
+         * the initialization happens */
+        INODE_PKEY(inode)->k_objectid = 0;
        if (dir->i_mode & S_ISGID) {
                inode->i_gid = dir->i_gid;
diff --git a/include/asm-i386/pci.h b/include/asm-i386/pci.h
index 2cbab30734d6..78c85985aee3 100644
--- a/include/asm-i386/pci.h
+++ b/include/asm-i386/pci.h
@@ -18,9 +18,11 @@ extern unsigned int pcibios_assign_all_busses(void);
 #define pcibios_scan_all_fns(a, b)      0
 extern unsigned long pci_mem_start;
-#define PCIBIOS_MIN_IO          0x4000
+#define PCIBIOS_MIN_IO          0x1000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
+#define PCIBIOS_MIN_CARDBUS_IO  0x4000
 void pcibios_config_init(void);
 struct pci_bus * pcibios_scan_root(int bus);
diff --git a/include/asm-sh/unistd.h b/include/asm-sh/unistd.h
index 245447081f0d..4e7701d6d23c 100644
--- a/include/asm-sh/unistd.h
+++ b/include/asm-sh/unistd.h
@@ -406,7 +406,7 @@ register long __sc6 __asm__ ("r6") = (long) arg3; \
 register long __sc7 __asm__ ("r7") = (long) arg4; \
 register long __sc0 __asm__ ("r0") = (long) arg5; \
 register long __sc1 __asm__ ("r1") = (long) arg6; \
-__asm__ __volatile__ ("trapa    #0x15" \
+__asm__ __volatile__ ("trapa    #0x16" \
        : "=z" (__sc0) \
        : "0" (__sc0), "r" (__sc4), "r" (__sc5), "r" (__sc6), "r" (__sc7),  \
          "r" (__sc3), "r" (__sc1) \
diff --git a/include/asm-um/page.h b/include/asm-um/page.h
index 5afee8a8cdf3..f58aedadeb4e 100644
--- a/include/asm-um/page.h
+++ b/include/asm-um/page.h
@@ -104,8 +104,8 @@ extern void *to_virt(unsigned long phys);
 * casting is the right thing, but 32-bit UML can't have 64-bit virtual
 * addresses
 */
-#define __pa(virt) to_phys((void *) (unsigned long) virt)
+#define __pa(virt) to_phys((void *) (unsigned long) (virt))
-#define __va(phys) to_virt((unsigned long) phys)
+#define __va(phys) to_virt((unsigned long) (phys))
 #define page_to_pfn(page) ((page) - mem_map)
 #define pfn_to_page(pfn) (mem_map + (pfn))
diff --git a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
index 9c4527eb55e2..eeb3088a1c9e 100644
--- a/include/asm-x86_64/pci.h
+++ b/include/asm-x86_64/pci.h
@@ -22,9 +22,11 @@ extern unsigned int pcibios_assign_all_busses(void);
 extern int no_iommu, force_iommu;
 extern unsigned long pci_mem_start;
-#define PCIBIOS_MIN_IO          0x4000
+#define PCIBIOS_MIN_IO          0x1000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
+#define PCIBIOS_MIN_CARDBUS_IO  0x4000
 void pcibios_config_init(void);
 struct pci_bus * pcibios_scan_root(int bus);
 extern int (*pci_config_read)(int seg, int bus, int dev, int fn, int reg, int len, u32 *value);
diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
index 602c305c8585..03b8e7932b83 100644
--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -21,7 +21,7 @@
 */
 static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
                                 const char *old_name, const char *new_name,
-                                 int isdir, struct inode *target)
+                                 int isdir, struct inode *target, struct inode *source)
 {
        u32 cookie = inotify_get_cookie();
@@ -41,6 +41,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
                inotify_inode_queue_event(target, IN_DELETE_SELF, 0, NULL);
                inotify_inode_is_dead(target);
        }
+        if (source) {
+                inotify_inode_queue_event(source, IN_MOVE_SELF, 0, NULL);
+        }
 }
 /*
diff --git a/include/linux/inotify.h b/include/linux/inotify.h
index a40c2bf0408e..93bb3afe646b 100644
--- a/include/linux/inotify.h
+++ b/include/linux/inotify.h
@@ -35,6 +35,7 @@ struct inotify_event {
 #define IN_CREATE               0x00000100      /* Subfile was created */
 #define IN_DELETE               0x00000200      /* Subfile was deleted */
 #define IN_DELETE_SELF          0x00000400      /* Self was deleted */
+#define IN_MOVE_SELF            0x00000800      /* Self was moved */
 /* the following are legal events.  they are sent as needed to any watch */
 #define IN_UNMOUNT              0x00002000      /* Backing fs was unmounted */
@@ -56,7 +57,8 @@ struct inotify_event {
 */
 #define IN_ALL_EVENTS   (IN_ACCESS | IN_MODIFY | IN_ATTRIB | IN_CLOSE_WRITE | \
                         IN_CLOSE_NOWRITE | IN_OPEN | IN_MOVED_FROM | \
-                         IN_MOVED_TO | IN_DELETE | IN_CREATE | IN_DELETE_SELF)
+                         IN_MOVED_TO | IN_DELETE | IN_CREATE | IN_DELETE_SELF | \
+                         IN_MOVE_SELF)
 #ifdef __KERNEL__
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 8ea249110fb0..7d78a783c64a 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -292,6 +292,7 @@ extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern void nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
+extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
 extern void nfs_begin_attr_update(struct inode *);
 extern void nfs_end_attr_update(struct inode *);
 extern void nfs_begin_data_update(struct inode *);
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index 34ec3e8d99b3..23448d0fb5bc 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -177,6 +177,7 @@ typedef int (*xdr_xcode_elem_t)(struct xdr_array2_desc *desc, void *elem);
 struct xdr_array2_desc {
        unsigned int elem_size;
        unsigned int array_len;
+        unsigned int array_maxlen;
        xdr_xcode_elem_t xcode;
 };
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 8a4d9c106af1..fde16f40a581 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
                        return -EINVAL;
        } else {
                if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+                    desc->array_len > desc->array_maxlen ||
                    (unsigned long) base + 4 + desc->array_len *
                                    desc->elem_size > buf->len)
                        return -EINVAL;