75 files changed, 581 insertions, 288 deletions
diff --git a/.gitignore b/.gitignore
index e1d5c17c12c2..9eb4b7711499 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,7 @@
 # Top-level generic files
 #
 tags
+TAGS
 vmlinux*
 System.map
 Module.symvers
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 14682396f7f7..683b12c6f76c 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -484,6 +484,15 @@ source "net/Kconfig"
 source "drivers/Kconfig"
+config MSPEC
+        tristate "Memory special operations driver"
+        depends on IA64
+        select IA64_UNCACHED_ALLOCATOR
+        help
+          If you have an ia64 and you want to enable memory special
+          operations support (formerly known as fetchop), say Y here,
+          otherwise say N.
 source "fs/Kconfig"
 source "lib/Kconfig"
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 2bd9b7fb0f6c..0673dbedb241 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -740,7 +740,7 @@ config ARCH_SPARSEMEM_ENABLE
 config ARCH_SPARSEMEM_DEFAULT
        def_bool y
-        depends on SMP && PPC_PSERIES
+        depends on (SMP && PPC_PSERIES) || PPC_CELL
 config ARCH_POPULATES_NODE_MAP
        def_bool y
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index eab7318729e9..b5fb1fee76f8 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -179,11 +179,11 @@ if [ -z "$cacheit" ]; then
 fi
 if [ -n "$initrd" ]; then
-    addsec $tmp "$initrd" initrd
+    addsec $tmp "$initrd" $isection
 fi
 if [ -n "$dtb" ]; then
-    addsec $tmp "$dtb" dtb
+    addsec $tmp "$dtb" .kernel:dtb
 fi
 if [ "$platform" != "miboot" ]; then
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 4b6bb3ffe3dc..4be3c6414b04 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -21,6 +21,11 @@ SECTIONS
    __got2_end = .;
  }
+  . = ALIGN(8);
+  _dtb_start = .;
+  .kernel:dtb : { *(.kernel:dtb) }
+  _dtb_end = .;
  . = ALIGN(4096);
  _vmlinux_start =  .;
  .kernel:vmlinux.strip : { *(.kernel:vmlinux.strip) }
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 1442b63a75da..6f6fc977cb39 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -72,6 +72,10 @@
 #define VALIDATE_BUF_SIZE 4096    
 #define RTAS_MSG_MAXLEN   64
+/* Quirk - RTAS requires 4k list length and block size */
+#define RTAS_BLKLIST_LENGTH 4096
+#define RTAS_BLK_SIZE 4096
 struct flash_block {
        char *data;
        unsigned long length;
@@ -83,7 +87,7 @@ struct flash_block {
 * into a version/length and translate the pointers
 * to absolute.
 */
-#define FLASH_BLOCKS_PER_NODE ((PAGE_SIZE - 16) / sizeof(struct flash_block))
+#define FLASH_BLOCKS_PER_NODE ((RTAS_BLKLIST_LENGTH - 16) / sizeof(struct flash_block))
 struct flash_block_list {
        unsigned long num_blocks;
        struct flash_block_list *next;
@@ -96,6 +100,9 @@ struct flash_block_list_header { /* just the header of flash_block_list */
 static struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
+/* Use slab cache to guarantee 4k alignment */
+static kmem_cache_t *flash_block_cache = NULL;
 #define FLASH_BLOCK_LIST_VERSION (1UL)
 /* Local copy of the flash block list.
@@ -153,7 +160,7 @@ static int flash_list_valid(struct flash_block_list *flist)
                                return FLASH_IMG_NULL_DATA;
                        }
                        block_size = f->blocks[i].length;
-                        if (block_size <= 0 || block_size > PAGE_SIZE) {
+                        if (block_size <= 0 || block_size > RTAS_BLK_SIZE) {
                                return FLASH_IMG_BAD_LEN;
                        }
                        image_size += block_size;
@@ -177,9 +184,9 @@ static void free_flash_list(struct flash_block_list *f)
        while (f) {
                for (i = 0; i < f->num_blocks; i++)
-                        free_page((unsigned long)(f->blocks[i].data));
+                        kmem_cache_free(flash_block_cache, f->blocks[i].data);
                next = f->next;
-                free_page((unsigned long)f);
+                kmem_cache_free(flash_block_cache, f);
                f = next;
        }
 }
@@ -278,6 +285,12 @@ static ssize_t rtas_flash_read(struct file *file, char __user *buf,
        return msglen;
 }
+/* constructor for flash_block_cache */
+void rtas_block_ctor(void *ptr, kmem_cache_t *cache, unsigned long flags)
+{
+        memset(ptr, 0, RTAS_BLK_SIZE);
+}
 /* We could be much more efficient here.  But to keep this function
 * simple we allocate a page to the block list no matter how small the
 * count is.  If the system is low on memory it will be just as well
@@ -302,7 +315,7 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
         * proc file
         */
        if (uf->flist == NULL) {
-                uf->flist = (struct flash_block_list *) get_zeroed_page(GFP_KERNEL);
+                uf->flist = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                if (!uf->flist)
                        return -ENOMEM;
        }
@@ -313,21 +326,21 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
        next_free = fl->num_blocks;
        if (next_free == FLASH_BLOCKS_PER_NODE) {
                /* Need to allocate another block_list */
-                fl->next = (struct flash_block_list *)get_zeroed_page(GFP_KERNEL);
+                fl->next = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                if (!fl->next)
                        return -ENOMEM;
                fl = fl->next;
                next_free = 0;
        }
-        if (count > PAGE_SIZE)
+        if (count > RTAS_BLK_SIZE)
-                count = PAGE_SIZE;
+                count = RTAS_BLK_SIZE;
-        p = (char *)get_zeroed_page(GFP_KERNEL);
+        p = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
        if (!p)
                return -ENOMEM;
        
        if(copy_from_user(p, buffer, count)) {
-                free_page((unsigned long)p);
+                kmem_cache_free(flash_block_cache, p);
                return -EFAULT;
        }
        fl->blocks[next_free].data = p;
@@ -791,6 +804,16 @@ int __init rtas_flash_init(void)
                goto cleanup;
        rtas_flash_term_hook = rtas_flash_firmware;
+        flash_block_cache = kmem_cache_create("rtas_flash_cache",
+                                RTAS_BLK_SIZE, RTAS_BLK_SIZE, 0,
+                                rtas_block_ctor, NULL);
+        if (!flash_block_cache) {
+                printk(KERN_ERR "%s: failed to create block cache\n",
+                                __FUNCTION__);
+                rc = -ENOMEM;
+                goto cleanup;
+        }
        return 0;
 cleanup:
@@ -805,6 +828,10 @@ cleanup:
 void __exit rtas_flash_cleanup(void)
 {
        rtas_flash_term_hook = NULL;
+        if (flash_block_cache)
+                kmem_cache_destroy(flash_block_cache);
        remove_flash_pde(firmware_flash_pde);
        remove_flash_pde(firmware_update_pde);
        remove_flash_pde(validate_pde);
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index d0fb959e3ef1..7aa809d5a244 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -655,14 +655,19 @@ static int __init spu_map_interrupts(struct spu *spu, struct device_node *np)
        for (i=0; i < 3; i++) {
                ret = of_irq_map_one(np, i, &oirq);
-                if (ret)
+                if (ret) {
+                        pr_debug("spu_new: failed to get irq %d\n", i);
                        goto err;
+                }
                ret = -EINVAL;
+                pr_debug("  irq %d no 0x%x on %s\n", i, oirq.specifier[0],
+                         oirq.controller->full_name);
                spu->irqs[i] = irq_create_of_mapping(oirq.controller,
                                        oirq.specifier, oirq.size);
-                if (spu->irqs[i] == NO_IRQ)
+                if (spu->irqs[i] == NO_IRQ) {
+                        pr_debug("spu_new: failed to map it !\n");
                        goto err;
+                }
        }
        return 0;
@@ -681,7 +686,7 @@ static int spu_map_resource(struct device_node *node, int nr,
        struct resource resource = { };
        int ret;
-        ret = of_address_to_resource(node, 0, &resource);
+        ret = of_address_to_resource(node, nr, &resource);
        if (ret)
                goto out;
@@ -704,22 +709,42 @@ static int __init spu_map_device(struct spu *spu, struct device_node *node)
        ret = spu_map_resource(node, 0, (void __iomem**)&spu->local_store,
                                        &spu->local_store_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 0\n",
+                         node->full_name);
                goto out;
+        }
        ret = spu_map_resource(node, 1, (void __iomem**)&spu->problem,
                                        &spu->problem_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 1\n",
+                         node->full_name);
                goto out_unmap;
+        }
        ret = spu_map_resource(node, 2, (void __iomem**)&spu->priv2,
                                        NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 2\n",
+                         node->full_name);
                goto out_unmap;
+        }
        if (!firmware_has_feature(FW_FEATURE_LPAR))
                ret = spu_map_resource(node, 3, (void __iomem**)&spu->priv1,
                                        NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 3\n",
+                         node->full_name);
                goto out_unmap;
+        }
+        pr_debug("spu_new: %s maps:\n", node->full_name);
+        pr_debug("  local store   : 0x%016lx -> 0x%p\n",
+                 spu->local_store_phys, spu->local_store);
+        pr_debug("  problem state : 0x%016lx -> 0x%p\n",
+                 spu->problem_phys, spu->problem);
+        pr_debug("  priv2         :                       0x%p\n", spu->priv2);
+        pr_debug("  priv1         :                       0x%p\n", spu->priv1);
        return 0;
 out_unmap:
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 2dc326421a24..a19338e6215d 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -246,10 +246,10 @@ static int sg_io(struct file *file, request_queue_t *q,
                switch (hdr->dxfer_direction) {
                default:
                        return -EINVAL;
-                case SG_DXFER_TO_FROM_DEV:
                case SG_DXFER_TO_DEV:
                        writing = 1;
                        break;
+                case SG_DXFER_TO_FROM_DEV:
                case SG_DXFER_FROM_DEV:
                        break;
                }
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 39a9f8cc6412..2af12fc45115 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -409,14 +409,6 @@ config SGI_MBCS
         If you have an SGI Altix with an attached SABrick
         say Y or M here, otherwise say N.
-config MSPEC
-        tristate "Memory special operations driver"
-        depends on IA64
-        help
-          If you have an ia64 and you want to enable memory special
-          operations support (formerly known as fetchop), say Y here,
-          otherwise say N.
 source "drivers/serial/Kconfig"
 config UNIX98_PTYS
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 0b07ca1b71fa..a41b8df24073 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1854,7 +1854,7 @@ static ssize_t provides_dev_sdrs_show(struct device *dev,
        struct bmc_device *bmc = dev_get_drvdata(dev);
        return snprintf(buf, 10, "%u\n",
-                        bmc->id.device_revision && 0x80 >> 7);
+                        (bmc->id.device_revision & 0x80) >> 7);
 }
 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
@@ -1863,7 +1863,7 @@ static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
        struct bmc_device *bmc = dev_get_drvdata(dev);
        return snprintf(buf, 20, "%u\n",
-                        bmc->id.device_revision && 0x0F);
+                        bmc->id.device_revision & 0x0F);
 }
 static ssize_t firmware_rev_show(struct device *dev,
diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index 5c0dec39cf6c..235e89226112 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -72,7 +72,11 @@ enum {
        MSPEC_UNCACHED
 };
+#ifdef CONFIG_SGI_SN
 static int is_sn2;
+#else
+#define is_sn2          0
+#endif
 /*
 * One of these structures is allocated when an mspec region is mmaped. The
@@ -211,7 +215,7 @@ mspec_nopfn(struct vm_area_struct *vma, unsigned long address)
        if (vdata->type == MSPEC_FETCHOP)
                paddr = TO_AMO(maddr);
        else
-                paddr = __pa(TO_CAC(maddr));
+                paddr = maddr & ~__IA64_UNCACHED_OFFSET;
        pfn = paddr >> PAGE_SHIFT;
@@ -335,6 +339,7 @@ mspec_init(void)
         * The fetchop device only works on SN2 hardware, uncached and cached
         * memory drivers should both be valid on all ia64 hardware
         */
+#ifdef CONFIG_SGI_SN
        if (ia64_platform_is("sn2")) {
                is_sn2 = 1;
                if (is_shub2()) {
@@ -363,6 +368,7 @@ mspec_init(void)
                        goto free_scratch_pages;
                }
        }
+#endif
        ret = misc_register(&cached_miscdev);
        if (ret) {
                printk(KERN_ERR "%s: failed to register device %i\n",
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index bddfebdf91d8..88214943d00a 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -724,7 +724,7 @@ static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret)
                 * if we have an error, pass back CHECK_CONDITION as the
                 * scsi status byte
                 */
-                if (!rq->errors)
+                if (blk_pc_request(rq) && !rq->errors)
                        rq->errors = SAM_STAT_CHECK_CONDITION;
                /* Check for tray open. */
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 493f4c65c7a2..a72bcea46ff6 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1750,7 +1750,7 @@ ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv,
                     */
                    (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) ||
                     rcv_has_same_gid(mad_agent_priv, wr, wc)))
-                        return wr;
+                        return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
        }
        /*
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 9e7bd94b958a..27fe242ed435 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1155,7 +1155,8 @@ static int __devinit c2_probe(struct pci_dev *pcidev,
                goto bail10;
        }
-        c2_register_device(c2dev);
+        if (c2_register_device(c2dev))
+                goto bail10;
        return 0;
diff --git a/drivers/infiniband/hw/amso1100/c2_provider.c b/drivers/infiniband/hw/amso1100/c2_provider.c
index da98d9f71429..fef972752912 100644
--- a/drivers/infiniband/hw/amso1100/c2_provider.c
+++ b/drivers/infiniband/hw/amso1100/c2_provider.c
@@ -757,20 +757,17 @@ static struct net_device *c2_pseudo_netdev_init(struct c2_dev *c2dev)
 int c2_register_device(struct c2_dev *dev)
 {
-        int ret;
+        int ret = -ENOMEM;
        int i;
        /* Register pseudo network device */
        dev->pseudo_netdev = c2_pseudo_netdev_init(dev);
-        if (dev->pseudo_netdev) {
+        if (!dev->pseudo_netdev)
-                ret = register_netdev(dev->pseudo_netdev);
+                goto out3;
-                if (ret) {
-                        printk(KERN_ERR PFX
+        ret = register_netdev(dev->pseudo_netdev);
-                                "Unable to register netdev, ret = %d\n", ret);
+        if (ret)
-                        free_netdev(dev->pseudo_netdev);
+                goto out2;
-                        return ret;
-                }
-        }
        pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
        strlcpy(dev->ibdev.name, "amso%d", IB_DEVICE_NAME_MAX);
@@ -848,21 +845,25 @@ int c2_register_device(struct c2_dev *dev)
        ret = ib_register_device(&dev->ibdev);
        if (ret)
-                return ret;
+                goto out1;
        for (i = 0; i < ARRAY_SIZE(c2_class_attributes); ++i) {
                ret = class_device_create_file(&dev->ibdev.class_dev,
                                               c2_class_attributes[i]);
-                if (ret) {
+                if (ret)
-                        unregister_netdev(dev->pseudo_netdev);
+                        goto out0;
-                        free_netdev(dev->pseudo_netdev);
-                        ib_unregister_device(&dev->ibdev);
-                        return ret;
-                }
        }
+        goto out3;
-        pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
+out0:
-        return 0;
+        ib_unregister_device(&dev->ibdev);
+out1:
+        unregister_netdev(dev->pseudo_netdev);
+out2:
+        free_netdev(dev->pseudo_netdev);
+out3:
+        pr_debug("%s:%u ret=%d\n", __FUNCTION__, __LINE__, ret);
+        return ret;
 }
 void c2_unregister_device(struct c2_dev *dev)
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 21d9612a56cc..623dc95f91df 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -157,8 +157,8 @@ static int c2_rnic_query(struct c2_dev *c2dev, struct ib_device_attr *props)
        props->fw_ver =
                ((u64)be32_to_cpu(reply->fw_ver_major) << 32) |
-                ((be32_to_cpu(reply->fw_ver_minor) && 0xFFFF) << 16) |
+                ((be32_to_cpu(reply->fw_ver_minor) & 0xFFFF) << 16) |
-                (be32_to_cpu(reply->fw_ver_patch) && 0xFFFF);
+                (be32_to_cpu(reply->fw_ver_patch) & 0xFFFF);
        memcpy(&props->sys_image_guid, c2dev->netdev->dev_addr, 6);
        props->max_mr_size         = 0xFFFFFFFF;
        props->page_size_cap       = ~(C2_MIN_PAGESIZE-1);
diff --git a/drivers/infiniband/hw/ehca/Kconfig b/drivers/infiniband/hw/ehca/Kconfig
index 922389b64394..727b10d89686 100644
--- a/drivers/infiniband/hw/ehca/Kconfig
+++ b/drivers/infiniband/hw/ehca/Kconfig
@@ -10,6 +10,7 @@ config INFINIBAND_EHCA
 config INFINIBAND_EHCA_SCALING
        bool "Scaling support (EXPERIMENTAL)"
        depends on IBMEBUS && INFINIBAND_EHCA && HOTPLUG_CPU && EXPERIMENTAL
+        default y
        ---help---
        eHCA scaling support schedules the CQ callbacks to different CPUs.
diff --git a/drivers/infiniband/hw/ehca/ehca_av.c b/drivers/infiniband/hw/ehca/ehca_av.c
index 3bac197f9014..214e2fdddeef 100644
--- a/drivers/infiniband/hw/ehca/ehca_av.c
+++ b/drivers/infiniband/hw/ehca/ehca_av.c
@@ -118,8 +118,7 @@ struct ib_ah *ehca_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
                }
                memcpy(&av->av.grh.word_1, &gid, sizeof(gid));
        }
-        /* for the time being we use a hard coded PMTU of 2048 Bytes */
+        av->av.pmtu = EHCA_MAX_MTU;
-        av->av.pmtu = 4;
        /* dgid comes in grh.word_3 */
        memcpy(&av->av.grh.word_3, &ah_attr->grh.dgid,
@@ -193,7 +192,7 @@ int ehca_modify_ah(struct ib_ah *ah, struct ib_ah_attr *ah_attr)
                memcpy(&new_ehca_av.grh.word_1, &gid, sizeof(gid));
        }
-        new_ehca_av.pmtu = 4; /* see also comment in create_ah() */
+        new_ehca_av.pmtu = EHCA_MAX_MTU;
        memcpy(&new_ehca_av.grh.word_3, &ah_attr->grh.dgid,
               sizeof(ah_attr->grh.dgid));
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index 5eae6ac48425..e1b618c5f685 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -40,6 +40,7 @@
 */
 #include "ehca_tools.h"
+#include "ehca_iverbs.h"
 #include "hcp_if.h"
 int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
@@ -49,7 +50,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                                              ib_device);
        struct hipz_query_hca *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -96,7 +97,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                = min_t(int, rblock->max_total_mcast_qp_attach, INT_MAX);
 query_device1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -109,7 +110,7 @@ int ehca_query_port(struct ib_device *ibdev,
                                              ib_device);
        struct hipz_query_port *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -162,7 +163,7 @@ int ehca_query_port(struct ib_device *ibdev,
        props->active_speed    = 0x1;
 query_port1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -178,7 +179,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
                return -EINVAL;
        }
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device,  "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -193,7 +194,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
        memcpy(pkey, &rblock->pkey_entries + index, sizeof(u16));
 query_pkey1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -211,7 +212,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
                return -EINVAL;
        }
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -227,7 +228,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
        memcpy(&gid->raw[8], &rblock->guid_entries[index], sizeof(u64));
 query_gid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 048cc443d1e7..c3ea746e9045 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -45,6 +45,7 @@
 #include "ehca_tools.h"
 #include "hcp_if.h"
 #include "hipz_fns.h"
+#include "ipz_pt_fn.h"
 #define EQE_COMPLETION_EVENT   EHCA_BMASK_IBM(1,1)
 #define EQE_CQ_QP_NUMBER       EHCA_BMASK_IBM(8,31)
@@ -137,38 +138,36 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
        u64 *rblock;
        unsigned long block_count;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Cannot allocate rblock memory.");
                ret = -ENOMEM;
                goto error_data1;
        }
+        /* rblock must be 4K aligned and should be 4K large */
        ret = hipz_h_error_data(shca->ipz_hca_handle,
                                resource,
                                rblock,
                                &block_count);
-        if (ret == H_R_STATE) {
+        if (ret == H_R_STATE)
                ehca_err(&shca->ib_device,
                         "No error data is available: %lx.", resource);
-        }
        else if (ret == H_SUCCESS) {
                int length;
                length = EHCA_BMASK_GET(ERROR_DATA_LENGTH, rblock[0]);
-                if (length > PAGE_SIZE)
+                if (length > EHCA_PAGESIZE)
-                        length = PAGE_SIZE;
+                        length = EHCA_PAGESIZE;
                print_error_data(shca, data, rblock, length);
-        }
+        } else
-        else {
                ehca_err(&shca->ib_device,
                         "Error data could not be fetched: %lx", resource);
-        }
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 error_data1:
        return ret;
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/infiniband/hw/ehca/ehca_iverbs.h
index 319c39d47f3a..3720e3032cce 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/infiniband/hw/ehca/ehca_iverbs.h
@@ -179,4 +179,12 @@ int ehca_mmap_register(u64 physical,void **mapped,
 int ehca_munmap(unsigned long addr, size_t len);
+#ifdef CONFIG_PPC_64K_PAGES
+void *ehca_alloc_fw_ctrlblock(void);
+void ehca_free_fw_ctrlblock(void *ptr);
+#else
+#define ehca_alloc_fw_ctrlblock() ((void *) get_zeroed_page(GFP_KERNEL))
+#define ehca_free_fw_ctrlblock(ptr) free_page((unsigned long)(ptr))
+#endif
 #endif
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index 024d511c4b58..01f5aa9cb56d 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -40,6 +40,9 @@
 * POSSIBILITY OF SUCH DAMAGE.
 */
+#ifdef CONFIG_PPC_64K_PAGES
+#include <linux/slab.h>
+#endif
 #include "ehca_classes.h"
 #include "ehca_iverbs.h"
 #include "ehca_mrmw.h"
@@ -49,7 +52,7 @@
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Christoph Raisch <raisch@de.ibm.com>");
 MODULE_DESCRIPTION("IBM eServer HCA InfiniBand Device Driver");
-MODULE_VERSION("SVNEHCA_0017");
+MODULE_VERSION("SVNEHCA_0018");
 int ehca_open_aqp1     = 0;
 int ehca_debug_level   = 0;
@@ -94,11 +97,31 @@ spinlock_t ehca_cq_idr_lock;
 DEFINE_IDR(ehca_qp_idr);
 DEFINE_IDR(ehca_cq_idr);
 static struct list_head shca_list; /* list of all registered ehcas */
 static spinlock_t shca_list_lock;
 static struct timer_list poll_eqs_timer;
+#ifdef CONFIG_PPC_64K_PAGES
+static struct kmem_cache *ctblk_cache = NULL;
+void *ehca_alloc_fw_ctrlblock(void)
+{
+        void *ret = kmem_cache_zalloc(ctblk_cache, SLAB_KERNEL);
+        if (!ret)
+                ehca_gen_err("Out of memory for ctblk");
+        return ret;
+}
+void ehca_free_fw_ctrlblock(void *ptr)
+{
+        if (ptr)
+                kmem_cache_free(ctblk_cache, ptr);
+}
+#endif
 static int ehca_create_slab_caches(void)
 {
        int ret;
@@ -133,6 +156,17 @@ static int ehca_create_slab_caches(void)
                goto create_slab_caches5;
        }
+#ifdef CONFIG_PPC_64K_PAGES
+        ctblk_cache = kmem_cache_create("ehca_cache_ctblk",
+                                        EHCA_PAGESIZE, H_CB_ALIGNMENT,
+                                        SLAB_HWCACHE_ALIGN,
+                                        NULL, NULL);
+        if (!ctblk_cache) {
+                ehca_gen_err("Cannot create ctblk SLAB cache.");
+                ehca_cleanup_mrmw_cache();
+                goto create_slab_caches5;
+        }
+#endif
        return 0;
 create_slab_caches5:
@@ -157,6 +191,10 @@ static void ehca_destroy_slab_caches(void)
        ehca_cleanup_qp_cache();
        ehca_cleanup_cq_cache();
        ehca_cleanup_pd_cache();
+#ifdef CONFIG_PPC_64K_PAGES
+        if (ctblk_cache)
+                kmem_cache_destroy(ctblk_cache);
+#endif
 }
 #define EHCA_HCAAVER  EHCA_BMASK_IBM(32,39)
@@ -168,7 +206,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
        u64 h_ret;
        struct hipz_query_hca *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_gen_err("Cannot allocate rblock memory.");
                return -ENOMEM;
@@ -211,7 +249,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
        shca->sport[1].rate = IB_RATE_30_GBPS;
 num_ports1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -220,7 +258,7 @@ static int init_node_guid(struct ehca_shca *shca)
        int ret = 0;
        struct hipz_query_hca *rblock;
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
        if (!rblock) {
                ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                return -ENOMEM;
@@ -235,7 +273,7 @@ static int init_node_guid(struct ehca_shca *shca)
        memcpy(&shca->ib_device.node_guid, &rblock->node_guid, sizeof(u64));
 init_node_guid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
        return ret;
 }
@@ -431,7 +469,7 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                           \
        shca = dev->driver_data;                                           \
                                                                           \
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);                      \
+        rblock = ehca_alloc_fw_ctrlblock();                                \
        if (!rblock) {                                                     \
                dev_err(dev, "Can't allocate rblock memory.");             \
                return 0;                                                  \
@@ -439,12 +477,12 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                           \
        if (hipz_h_query_hca(shca->ipz_hca_handle, rblock) != H_SUCCESS) { \
                dev_err(dev, "Can't query device properties");             \
-                kfree(rblock);                                             \
+                ehca_free_fw_ctrlblock(rblock);                            \
                return 0;                                                  \
        }                                                                  \
                                                                           \
        data = rblock->name;                                               \
-        kfree(rblock);                                                     \
+        ehca_free_fw_ctrlblock(rblock);                                    \
                                                                           \
        if ((strcmp(#name, "num_ports") == 0) && (ehca_nr_ports == 1))     \
                return snprintf(buf, 256, "1\n");                          \
@@ -752,7 +790,7 @@ int __init ehca_module_init(void)
        int ret;
        printk(KERN_INFO "eHCA Infiniband Device Driver "
-                         "(Rel.: SVNEHCA_0017)\n");
+                         "(Rel.: SVNEHCA_0018)\n");
        idr_init(&ehca_qp_idr);
        idr_init(&ehca_cq_idr);
        spin_lock_init(&ehca_qp_idr_lock);
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 5ca65441e1da..abce676c0ae0 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -1013,7 +1013,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
        u32 i;
        u64 *kpage;
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
        if (!kpage) {
                ehca_err(&shca->ib_device, "kpage alloc failed");
                ret = -ENOMEM;
@@ -1092,7 +1092,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
 ehca_reg_mr_rpages_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_reg_mr_rpages_exit0:
        if (ret)
                ehca_err(&shca->ib_device, "ret=%x shca=%p e_mr=%p pginfo=%p "
@@ -1124,7 +1124,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
        ehca_mrmw_map_acl(acl, &hipz_acl);
        ehca_mrmw_set_pgsize_hipz_acl(&hipz_acl);
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
        if (!kpage) {
                ehca_err(&shca->ib_device, "kpage alloc failed");
                ret = -ENOMEM;
@@ -1181,7 +1181,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
        }
 ehca_rereg_mr_rereg1_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_rereg_mr_rereg1_exit0:
        if ( ret && (ret != -EAGAIN) )
                ehca_err(&shca->ib_device, "ret=%x lkey=%x rkey=%x "
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index 4394123cdbd7..cf3e50ee2d06 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -811,8 +811,8 @@ static int internal_modify_qp(struct ib_qp *ibqp,
        unsigned long spl_flags = 0;
        /* do query_qp to obtain current attr values */
-        mqpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        mqpcb = ehca_alloc_fw_ctrlblock();
-        if (mqpcb == NULL) {
+        if (!mqpcb) {
                ehca_err(ibqp->device, "Could not get zeroed page for mqpcb "
                         "ehca_qp=%p qp_num=%x ", my_qp, ibqp->qp_num);
                return -ENOMEM;
@@ -1225,7 +1225,7 @@ modify_qp_exit2:
        }
 modify_qp_exit1:
-        kfree(mqpcb);
+        ehca_free_fw_ctrlblock(mqpcb);
        return ret;
 }
@@ -1277,7 +1277,7 @@ int ehca_query_qp(struct ib_qp *qp,
                return -EINVAL;
        }
-        qpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL );
+        qpcb = ehca_alloc_fw_ctrlblock();
        if (!qpcb) {
                ehca_err(qp->device,"Out of memory for qpcb "
                         "ehca_qp=%p qp_num=%x", my_qp, qp->qp_num);
@@ -1401,7 +1401,7 @@ int ehca_query_qp(struct ib_qp *qp,
                ehca_dmp(qpcb, 4*70, "qp_num=%x", qp->qp_num);
 query_qp_exit1:
-        kfree(qpcb);
+        ehca_free_fw_ctrlblock(qpcb);
        return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/hipz_hw.h b/drivers/infiniband/hw/ehca/hipz_hw.h
index 3fc92b031c50..fad91368dc5a 100644
--- a/drivers/infiniband/hw/ehca/hipz_hw.h
+++ b/drivers/infiniband/hw/ehca/hipz_hw.h
@@ -45,6 +45,8 @@
 #include "ehca_tools.h"
+#define EHCA_MAX_MTU 4
 /* QP Table Entry Memory Map */
 struct hipz_qptemm {
        u64 qpx_hcr;
diff --git a/drivers/media/dvb/b2c2/flexcop-usb.c b/drivers/media/dvb/b2c2/flexcop-usb.c
index 2853ea1bdaf1..87fb75f0d1cf 100644
--- a/drivers/media/dvb/b2c2/flexcop-usb.c
+++ b/drivers/media/dvb/b2c2/flexcop-usb.c
@@ -246,7 +246,7 @@ static int flexcop_usb_i2c_req(struct flexcop_usb *fc_usb,
        wIndex = (chipaddr << 8 ) | addr;
        deb_i2c("i2c %2d: %02x %02x %02x %02x %02x %02x\n",func,request_type,req,
-                        ((wValue && 0xff) << 8),wValue >> 8,((wIndex && 0xff) << 8),wIndex >> 8);
+                wValue & 0xff, wValue >> 8, wIndex & 0xff, wIndex >> 8);
        len = usb_control_msg(fc_usb->udev,pipe,
                        req,
diff --git a/drivers/media/dvb/frontends/tda826x.c b/drivers/media/dvb/frontends/tda826x.c
index eeab26bd36ed..34815b0b97e4 100644
--- a/drivers/media/dvb/frontends/tda826x.c
+++ b/drivers/media/dvb/frontends/tda826x.c
@@ -121,7 +121,7 @@ static struct dvb_tuner_ops tda826x_tuner_ops = {
        .info = {
                .name = "Philips TDA826X",
                .frequency_min = 950000,
-                .frequency_min = 2175000
+                .frequency_max = 2175000
        },
        .release = tda826x_release,
        .sleep = tda826x_sleep,
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index fbe5b6168cc2..bf267552941f 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -186,7 +186,7 @@ config VIDEO_KS0127
 config VIDEO_SAA7110
        tristate "Philips SAA7110 video decoder"
-        depends on VIDEO_V4L1
+        depends on VIDEO_V4L1 && I2C
        ---help---
          Support for the Philips SAA7110 video decoders.
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index a84903e0d810..21ebe8f13815 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -4001,7 +4001,7 @@ static void __devinit init_PXC200(struct bttv *btv)
 *      - sleep 1ms
 *      - write 0x0E
 *     read from GPIO_DATA into buf (uint_32)
- *      - if ( buf>>18 & 0x01 ) || ( buf>>19 && 0x01 != 0 )
+ *      - if ( buf>>18 & 0x01 ) || ( buf>>19 & 0x01 != 0 )
 *                error. ERROR_CPLD_Check_Failed.
 */
 /* ----------------------------------------------------------------------- */
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index ee48995a4ab5..57e1c024a547 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -202,13 +202,19 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
                ir->sampling = 1;
                break;
        case CX88_BOARD_WINFAST_DTV2000H:
-        case CX88_BOARD_WINFAST2000XP_EXPERT:
                ir_codes = ir_codes_winfast;
                ir->gpio_addr = MO_GP0_IO;
                ir->mask_keycode = 0x8f8;
                ir->mask_keyup = 0x100;
                ir->polling = 50; /* ms */
                break;
+        case CX88_BOARD_WINFAST2000XP_EXPERT:
+                ir_codes = ir_codes_winfast;
+                ir->gpio_addr = MO_GP0_IO;
+                ir->mask_keycode = 0x8f8;
+                ir->mask_keyup = 0x100;
+                ir->polling = 1; /* ms */
+                break;
        case CX88_BOARD_IODATA_GVBCTV7E:
                ir_codes = ir_codes_iodata_bctv7e;
                ir->gpio_addr = MO_GP0_IO;
@@ -216,7 +222,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
                ir->mask_keydown = 0x02;
                ir->polling = 5; /* ms */
                break;
-       case CX88_BOARD_PROLINK_PLAYTVPVR:
+        case CX88_BOARD_PROLINK_PLAYTVPVR:
        case CX88_BOARD_PIXELVIEW_PLAYTV_ULTRA_PRO:
                ir_codes = ir_codes_pixelview;
                ir->gpio_addr = MO_GP1_IO;
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index c9d8e3b9cc37..51f0cfdcb680 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -2969,7 +2969,7 @@ struct saa7134_board saa7134_boards[] = {
                /* Petr Baudis <pasky@ucw.cz> */
                .name           = "AVerMedia TV Hybrid A16AR",
                .audio_clock    = 0x187de7,
-                .tuner_type     = TUNER_PHILIPS_TDA8290, /* untested */
+                .tuner_type     = TUNER_PHILIPS_TD1316, /* untested */
                .radio_type     = TUNER_TEA5767, /* untested */
                .tuner_addr     = ADDR_UNSET,
                .radio_addr     = ADDR_UNSET,
@@ -3718,6 +3718,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
        case SAA7134_BOARD_AVERMEDIA_STUDIO_307:
        case SAA7134_BOARD_AVERMEDIA_307:
        case SAA7134_BOARD_AVERMEDIA_GO_007_FM:
+        case SAA7134_BOARD_AVERMEDIA_777:
 /*      case SAA7134_BOARD_SABRENT_SBTTVFM:  */ /* not finished yet */
        case SAA7134_BOARD_VIDEOMATE_TV_PVR:
        case SAA7134_BOARD_VIDEOMATE_GOLD_PLUS:
@@ -3734,6 +3735,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
        case SAA7134_BOARD_FLYDVBT_LR301:
        case SAA7134_BOARD_FLYDVBTDUO:
        case SAA7134_BOARD_PROTEUS_2309:
+        case SAA7134_BOARD_AVERMEDIA_A16AR:
                dev->has_remote = SAA7134_REMOTE_GPIO;
                break;
        case SAA7134_BOARD_FLYDVBS_LR300:
@@ -3772,7 +3774,6 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_writeb(SAA7134_GPIO_GPMODE3, 0x08);
                saa_writeb(SAA7134_GPIO_GPSTATUS3, 0x00);
                break;
-        case SAA7134_BOARD_AVERMEDIA_A16AR:
        case SAA7134_BOARD_AVERMEDIA_CARDBUS:
                /* power-up tuner chip */
                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0xffffffff, 0xffffffff);
diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index ff5991136f4e..dee83552e681 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -185,7 +185,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
        case SAA7134_BOARD_AVERMEDIA_STUDIO_305:
        case SAA7134_BOARD_AVERMEDIA_STUDIO_307:
        case SAA7134_BOARD_AVERMEDIA_GO_007_FM:
-        case SAA7134_BOARD_AVERMEDIA_A16AR:
                ir_codes     = ir_codes_avermedia;
                mask_keycode = 0x0007C8;
                mask_keydown = 0x000010;
@@ -194,6 +193,16 @@ int saa7134_input_init1(struct saa7134_dev *dev)
                saa_setb(SAA7134_GPIO_GPMODE0, 0x4);
                saa_setb(SAA7134_GPIO_GPSTATUS0, 0x4);
                break;
+        case SAA7134_BOARD_AVERMEDIA_777:
+        case SAA7134_BOARD_AVERMEDIA_A16AR:
+                ir_codes     = ir_codes_avermedia;
+                mask_keycode = 0x02F200;
+                mask_keydown = 0x000400;
+                polling      = 50; // ms
+                /* Without this we won't receive key up events */
+                saa_setb(SAA7134_GPIO_GPMODE1, 0x1);
+                saa_setb(SAA7134_GPIO_GPSTATUS1, 0x1);
+                break;
        case SAA7134_BOARD_KWORLD_TERMINATOR:
                ir_codes     = ir_codes_pixelview;
                mask_keycode = 0x00001f;
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index e6baaee038bf..6b9ef731b83a 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -468,7 +468,7 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
                                (eeprom_data[i+6] << 8) +
                                (eeprom_data[i+7] << 16);
-                                if ( (eeprom_data[i + 8] && 0xf0) &&
+                                if ( (eeprom_data[i + 8] & 0xf0) &&
                                        (tvee->serial_number < 0xffffff) ) {
                                        tvee->MAC_address[0] = 0x00;
                                        tvee->MAC_address[1] = 0x0D;
diff --git a/drivers/net/arcnet/com20020.c b/drivers/net/arcnet/com20020.c
index 0dc70c7b7940..aa9dd8f11269 100644
--- a/drivers/net/arcnet/com20020.c
+++ b/drivers/net/arcnet/com20020.c
@@ -337,13 +337,16 @@ static void com20020_set_mc_list(struct net_device *dev)
        }
 }
-#ifdef MODULE
+#if defined(CONFIG_ARCNET_COM20020_PCI_MODULE) || \
+    defined(CONFIG_ARCNET_COM20020_ISA_MODULE)
 EXPORT_SYMBOL(com20020_check);
 EXPORT_SYMBOL(com20020_found);
+#endif
 MODULE_LICENSE("GPL");
+#ifdef MODULE
 int init_module(void)
 {
        BUGLVL(D_NORMAL) printk(VERSION);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c0bbddae4ec4..17a461152d39 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4692,6 +4692,8 @@ static int bond_check_params(struct bond_params *params)
        return 0;
 }
+static struct lock_class_key bonding_netdev_xmit_lock_key;
 /* Create a new bond based on the specified name and bonding parameters.
 * Caller must NOT hold rtnl_lock; we need to release it here before we
 * set up our sysfs entries.
@@ -4727,6 +4729,9 @@ int bond_create(char *name, struct bond_params *params, struct bonding **newbond
        if (res < 0) {
                goto out_bond;
        }
+        lockdep_set_class(&bond_dev->_xmit_lock, &bonding_netdev_xmit_lock_key);
        if (newbond)
                *newbond = bond_dev->priv;
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index 966b563e42bb..a03d781f6d0a 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -509,6 +509,8 @@ etrax_ethernet_init(void)
                 * does not share cacheline with any other data (to avoid cache bug)
                 */
                RxDescList[i].skb = dev_alloc_skb(MAX_MEDIA_DATA_SIZE + 2 * L1_CACHE_BYTES);
+                if (!RxDescList[i].skb)
+                        return -ENOMEM;
                RxDescList[i].descr.ctrl   = 0;
                RxDescList[i].descr.sw_len = MAX_MEDIA_DATA_SIZE;
                RxDescList[i].descr.next   = virt_to_phys(&RxDescList[i + 1]);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 65edb56107fd..a1b783813d8e 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -746,7 +746,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
        if (err)
                goto err_ctlreg;
        spromctl |= 0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
        if (err)
                goto err_ctlreg;
        /* We must burn lots of CPU cycles here, but that does not
@@ -768,7 +768,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
                mdelay(20);
        }
        spromctl &= ~0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
        if (err)
                goto err_ctlreg;
        mdelay(500);
@@ -1463,6 +1463,23 @@ static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
        }
 }
+static void drain_txstatus_queue(struct bcm43xx_private *bcm)
+{
+        u32 dummy;
+        if (bcm->current_core->rev < 5)
+                return;
+        /* Read all entries from the microcode TXstatus FIFO
+         * and throw them away.
+         */
+        while (1) {
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
+                if (!dummy)
+                        break;
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
+        }
+}
 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
 {
        bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
@@ -3532,6 +3549,7 @@ int bcm43xx_select_wireless_core(struct bcm43xx_private *bcm,
        bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
        bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_SELF, (u8 *)(bcm->net_dev->dev_addr));
        bcm43xx_security_init(bcm);
+        drain_txstatus_queue(bcm);
        ieee80211softmac_start(bcm->net_dev);
        /* Let's go! Be careful after enabling the IRQs.
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index a1d2e979b17f..f952bfea48a6 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -642,6 +642,9 @@ err:
 */
 void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
 {
+        if (!sysfs_initialized)
+                return;
        if (pdev->cfg_size < 4096)
                sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
        else
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index fd9e281c3bfe..94a274645f6f 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -631,12 +631,22 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         * scanning run at their own risk, or supply a user level program
         * that can correctly scan.
         */
-        sdev->inquiry = kmalloc(sdev->inquiry_len, GFP_ATOMIC);
-        if (sdev->inquiry == NULL) {
+        /*
+         * Copy at least 36 bytes of INQUIRY data, so that we don't
+         * dereference unallocated memory when accessing the Vendor,
+         * Product, and Revision strings.  Badly behaved devices may set
+         * the INQUIRY Additional Length byte to a small value, indicating
+         * these strings are invalid, but often they contain plausible data
+         * nonetheless.  It doesn't matter if the device sent < 36 bytes
+         * total, since scsi_probe_lun() initializes inq_result with 0s.
+         */
+        sdev->inquiry = kmemdup(inq_result,
+                                max_t(size_t, sdev->inquiry_len, 36),
+                                GFP_ATOMIC);
+        if (sdev->inquiry == NULL)
                return SCSI_SCAN_NO_RESPONSE;
-        }
-        memcpy(sdev->inquiry, inq_result, sdev->inquiry_len);
        sdev->vendor = (char *) (sdev->inquiry + 8);
        sdev->model = (char *) (sdev->inquiry + 16);
        sdev->rev = (char *) (sdev->inquiry + 32);
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index a8f894c78194..69715e556506 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -88,7 +88,7 @@ extern struct uart_cpm_port cpm_uart_ports[UART_NR];
 /* these are located in their respective files */
 void cpm_line_cr_cmd(int line, int cmd);
-int cpm_uart_init_portdesc(void);
+int __init cpm_uart_init_portdesc(void);
 int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con);
 void cpm_uart_freebuf(struct uart_cpm_port *pinfo);
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 0abb544ae63d..7a3b97fdf8d1 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -195,10 +195,8 @@ static void cpm_uart_start_tx(struct uart_port *port)
        if (cpm_uart_tx_pump(port) != 0) {
                if (IS_SMC(pinfo)) {
                        smcp->smc_smcm |= SMCM_TX;
-                        smcp->smc_smcmr |= SMCMR_TEN;
                } else {
                        sccp->scc_sccm |= UART_SCCM_TX;
-                        pinfo->sccp->scc_gsmrl |= SCC_GSMRL_ENT;
                }
        }
 }
@@ -421,9 +419,10 @@ static int cpm_uart_startup(struct uart_port *port)
        /* Startup rx-int */
        if (IS_SMC(pinfo)) {
                pinfo->smcp->smc_smcm |= SMCM_RX;
-                pinfo->smcp->smc_smcmr |= SMCMR_REN;
+                pinfo->smcp->smc_smcmr |= (SMCMR_REN | SMCMR_TEN);
        } else {
                pinfo->sccp->scc_sccm |= UART_SCCM_RX;
+                pinfo->sccp->scc_gsmrl |= (SCC_GSMRL_ENR | SCC_GSMRL_ENT);
        }
        if (!(pinfo->flags & FLAG_CONSOLE))
@@ -1350,11 +1349,10 @@ static int cpm_uart_init(void) {
                pr_info("cpm_uart: WARNING: no UART devices found on platform bus!\n");
                pr_info(
                "cpm_uart: the driver will guess configuration, but this mode is no longer supported.\n");
-#ifndef CONFIG_SERIAL_CPM_CONSOLE
-                ret = cpm_uart_init_portdesc();
+                /* Don't run this again, if the console driver did it already */
-                if (ret)
+                if (cpm_uart_nr == 0)
-                        return ret;
+                        cpm_uart_init_portdesc();
-#endif
                cpm_reg.nr = cpm_uart_nr;
                ret = uart_register_driver(&cpm_reg);
@@ -1366,6 +1364,8 @@ static int cpm_uart_init(void) {
                        int con = cpm_uart_port_map[i];
                        cpm_uart_ports[con].port.line = i;
                        cpm_uart_ports[con].port.flags = UPF_BOOT_AUTOCONF;
+                        if (cpm_uart_ports[con].set_lineif)
+                                cpm_uart_ports[con].set_lineif(&cpm_uart_ports[con]);
                        uart_add_one_port(&cpm_reg, &cpm_uart_ports[con].port);
                }
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index 95afc37297a8..08e55fdc882a 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -184,7 +184,7 @@ void cpm_uart_freebuf(struct uart_cpm_port *pinfo)
 }
 /* Setup any dynamic params in the uart desc */
-int cpm_uart_init_portdesc(void)
+int __init cpm_uart_init_portdesc(void)
 {
        pr_debug("CPM uart[-]:init portdesc\n");
diff --git a/drivers/video/nvidia/nv_hw.c b/drivers/video/nvidia/nv_hw.c
index 9ed640d35728..ea426115c6f9 100644
--- a/drivers/video/nvidia/nv_hw.c
+++ b/drivers/video/nvidia/nv_hw.c
@@ -145,12 +145,18 @@ static void nvGetClocks(struct nvidia_par *par, unsigned int *MClk,
        if (par->Architecture >= NV_ARCH_40) {
                pll = NV_RD32(par->PMC, 0x4020);
-                P = (pll >> 16) & 0x03;
+                P = (pll >> 16) & 0x07;
                pll = NV_RD32(par->PMC, 0x4024);
                M = pll & 0xFF;
                N = (pll >> 8) & 0xFF;
-                MB = (pll >> 16) & 0xFF;
+                if (((par->Chipset & 0xfff0) == 0x0290) ||
-                NB = (pll >> 24) & 0xFF;
+                                ((par->Chipset & 0xfff0) == 0x0390)) {
+                        MB = 1;
+                        NB = 1;
+                } else {
+                        MB = (pll >> 16) & 0xFF;
+                        NB = (pll >> 24) & 0xFF;
+                }
                *MClk = ((N * NB * par->CrystalFreqKHz) / (M * MB)) >> P;
                pll = NV_RD32(par->PMC, 0x4000);
diff --git a/drivers/video/nvidia/nv_setup.c b/drivers/video/nvidia/nv_setup.c
index a18a9aebf05f..61dc46fecf2b 100644
--- a/drivers/video/nvidia/nv_setup.c
+++ b/drivers/video/nvidia/nv_setup.c
@@ -359,6 +359,7 @@ int NVCommonSetup(struct fb_info *info)
        case 0x0186:
        case 0x0187:
        case 0x018D:
+        case 0x0228:
        case 0x0286:
        case 0x028C:
        case 0x0316:
@@ -382,6 +383,10 @@ int NVCommonSetup(struct fb_info *info)
        case 0x034C:
        case 0x0160:
        case 0x0166:
+        case 0x0169:
+        case 0x016B:
+        case 0x016C:
+        case 0x016D:
        case 0x00C8:
        case 0x00CC:
        case 0x0144:
@@ -639,12 +644,23 @@ int NVCommonSetup(struct fb_info *info)
                par->fpHeight = NV_RD32(par->PRAMDAC, 0x0800) + 1;
                par->fpSyncs = NV_RD32(par->PRAMDAC, 0x0848) & 0x30000033;
-                printk("Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
+                printk("nvidiafb: Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
        }
        if (monA)
                info->monspecs = *monA;
+        if (!par->FlatPanel || !par->twoHeads)
+                par->FPDither = 0;
+        par->LVDS = 0;
+        if (par->FlatPanel && par->twoHeads) {
+                NV_WR32(par->PRAMDAC0, 0x08B0, 0x00010004);
+                if (par->PRAMDAC0[0x08b4] & 1)
+                        par->LVDS = 1;
+                printk("nvidiafb: Panel is %s\n", par->LVDS ? "LVDS" : "TMDS");
+        }
        kfree(edidA);
        kfree(edidB);
 done:
diff --git a/drivers/video/nvidia/nv_type.h b/drivers/video/nvidia/nv_type.h
index acdc26693402..86e65dea60d3 100644
--- a/drivers/video/nvidia/nv_type.h
+++ b/drivers/video/nvidia/nv_type.h
@@ -129,6 +129,7 @@ struct nvidia_par {
        int fpHeight;
        int PanelTweak;
        int paneltweak;
+        int LVDS;
        int pm_state;
        u32 crtcSync_read;
        u32 fpSyncs;
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index eb24107bcc81..538e947610e1 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1160,20 +1160,20 @@ static u32 __devinit nvidia_get_arch(struct fb_info *info)
        case 0x0340:            /* GeForceFX 5700 */
                arch = NV_ARCH_30;
                break;
-        case 0x0040:
+        case 0x0040:            /* GeForce 6800 */
-        case 0x00C0:
+        case 0x00C0:            /* GeForce 6800 */
-        case 0x0120:
+        case 0x0120:            /* GeForce 6800 */
        case 0x0130:
-        case 0x0140:
+        case 0x0140:            /* GeForce 6600 */
-        case 0x0160:
+        case 0x0160:            /* GeForce 6200 */
-        case 0x01D0:
+        case 0x01D0:            /* GeForce 7200, 7300, 7400 */
-        case 0x0090:
+        case 0x0090:            /* GeForce 7800 */
-        case 0x0210:
+        case 0x0210:            /* GeForce 6800 */
-        case 0x0220:
+        case 0x0220:            /* GeForce 6200 */
        case 0x0230:
-        case 0x0240:
+        case 0x0240:            /* GeForce 6100 */
-        case 0x0290:
+        case 0x0290:            /* GeForce 7900 */
-        case 0x0390:
+        case 0x0390:            /* GeForce 7600 */
                arch = NV_ARCH_40;
                break;
        case 0x0020:            /* TNT, TNT2 */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 7e056b9b49e8..2436ed8fc840 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -492,10 +492,14 @@ int cifs_close(struct inode *inode, struct file *file)
                                        the struct would be in each open file,
                                        but this should give enough time to 
                                        clear the socket */
-                                        cERROR(1,("close with pending writes"));
+#ifdef CONFIG_CIFS_DEBUG2
+                                        cFYI(1,("close delay, write pending"));
+#endif /* DEBUG2 */
                                        msleep(timeout);
                                        timeout *= 4;
-                                } 
+                                }
+                                if(atomic_read(&pSMBFile->wrtPending))
+                                        cERROR(1,("close with pending writes"));
                                rc = CIFSSMBClose(xid, pTcon,
                                                  pSMBFile->netfid);
                        }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index dffe295825f4..1ad8c9fcc742 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1089,8 +1089,10 @@ int cifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
        struct kstat *stat)
 {
        int err = cifs_revalidate(dentry);
-        if (!err)
+        if (!err) {
                generic_fillattr(dentry->d_inode, stat);
+                stat->blksize = CIFS_MAX_MSGSIZE;
+        }
        return err;
 }
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index a8a083543ba0..bbdda99dce61 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -90,7 +90,9 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
        } */
        /* copy user */
        if(ses->userName == NULL) {
-                /* BB what about null user mounts - check that we do this BB */
+                /* null user mount */
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
        } else { /* 300 should be long enough for any conceivable user name */
                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
                                          300, nls_cp);
@@ -98,10 +100,13 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
        bcc_ptr += 2 * bytes_ret;
        bcc_ptr += 2; /* account for null termination */
        /* copy domain */
-        if(ses->domainName == NULL)
+        if(ses->domainName == NULL) {
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr,
+                /* Sending null domain better than using a bogus domain name (as
-                                          "CIFS_LINUX_DOM", 32, nls_cp);
+                we did briefly in 2.6.18) since server will use its default */
-        else
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
+                bytes_ret = 0;
+        } else
                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName, 
                                          256, nls_cp);
        bcc_ptr += 2 * bytes_ret;
@@ -144,13 +149,11 @@ static void ascii_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
        /* copy domain */
        
-        if(ses->domainName == NULL) {
+        if(ses->domainName != NULL) {
-                strcpy(bcc_ptr, "CIFS_LINUX_DOM");
-                bcc_ptr += 14;  /* strlen(CIFS_LINUX_DOM) */
-        } else {
                strncpy(bcc_ptr, ses->domainName, 256); 
                bcc_ptr += strnlen(ses->domainName, 256);
-        }
+        } /* else we will send a null domain name 
+             so the server will default to its own domain */
        *bcc_ptr = 0;
        bcc_ptr++;
diff --git a/fs/xfs/Makefile-linux-2.6 b/fs/xfs/Makefile-linux-2.6
index 291948d5085a..b49989bb89ad 100644
--- a/fs/xfs/Makefile-linux-2.6
+++ b/fs/xfs/Makefile-linux-2.6
@@ -21,22 +21,7 @@ EXTRA_CFLAGS +=	 -Ifs/xfs -Ifs/xfs/linux-2.6 -funsigned-char
 XFS_LINUX := linux-2.6
 ifeq ($(CONFIG_XFS_DEBUG),y)
-        EXTRA_CFLAGS += -g -DSTATIC="" -DDEBUG
+        EXTRA_CFLAGS += -g
-        EXTRA_CFLAGS += -DXFS_BUF_LOCK_TRACKING
-endif
-ifeq ($(CONFIG_XFS_TRACE),y)
-        EXTRA_CFLAGS += -DXFS_ALLOC_TRACE
-        EXTRA_CFLAGS += -DXFS_ATTR_TRACE
-        EXTRA_CFLAGS += -DXFS_BLI_TRACE
-        EXTRA_CFLAGS += -DXFS_BMAP_TRACE
-        EXTRA_CFLAGS += -DXFS_BMBT_TRACE
-        EXTRA_CFLAGS += -DXFS_DIR2_TRACE
-        EXTRA_CFLAGS += -DXFS_DQUOT_TRACE
-        EXTRA_CFLAGS += -DXFS_ILOCK_TRACE
-        EXTRA_CFLAGS += -DXFS_LOG_TRACE
-        EXTRA_CFLAGS += -DXFS_RW_TRACE
-        EXTRA_CFLAGS += -DXFS_BUF_TRACE
-        EXTRA_CFLAGS += -DXFS_VNODE_TRACE
 endif
 obj-$(CONFIG_XFS_FS)            += xfs.o
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index db5f5a3608ca..d3382843698e 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -15,6 +15,7 @@
 * along with this program; if not, write the Free Software Foundation,
 * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
+#include "xfs.h"
 #include <linux/stddef.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
@@ -31,7 +32,6 @@
 #include <linux/kthread.h>
 #include <linux/migrate.h>
 #include <linux/backing-dev.h>
-#include "xfs_linux.h"
 STATIC kmem_zone_t *xfs_buf_zone;
 STATIC kmem_shaker_t xfs_buf_shake;
@@ -1406,7 +1406,7 @@ xfs_alloc_bufhash(
        btp->bt_hashshift = external ? 3 : 8;   /* 8 or 256 buckets */
        btp->bt_hashmask = (1 << btp->bt_hashshift) - 1;
        btp->bt_hash = kmem_zalloc((1 << btp->bt_hashshift) *
-                                        sizeof(xfs_bufhash_t), KM_SLEEP);
+                                        sizeof(xfs_bufhash_t), KM_SLEEP | KM_LARGE);
        for (i = 0; i < (1 << btp->bt_hashshift); i++) {
                spin_lock_init(&btp->bt_hash[i].bh_lock);
                INIT_LIST_HEAD(&btp->bt_hash[i].bh_list);
diff --git a/fs/xfs/linux-2.6/xfs_dmapi_priv.h b/fs/xfs/linux-2.6/xfs_dmapi_priv.h
new file mode 100644
index 000000000000..a8b0b1685eed
--- /dev/null
+++ b/fs/xfs/linux-2.6/xfs_dmapi_priv.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2000-2006 Silicon Graphics, Inc.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it would be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write the Free Software Foundation,
+ * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+#ifndef __XFS_DMAPI_PRIV_H__
+#define __XFS_DMAPI_PRIV_H__
+/*
+ *      Based on IO_ISDIRECT, decide which i_ flag is set.
+ */
+#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
+                              DM_FLAGS_IMUX : 0)
+#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
+#endif /*__XFS_DMAPI_PRIV_H__*/
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index a74f854d91e6..74d094829a4d 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -341,8 +341,11 @@ xfs_open_by_handle(
                put_unused_fd(new_fd);
                return -XFS_ERROR(-PTR_ERR(filp));
        }
-        if (inode->i_mode & S_IFREG)
+        if (inode->i_mode & S_IFREG) {
+                /* invisible operation should not change atime */
+                filp->f_flags |= O_NOATIME;
                filp->f_op = &xfs_invis_file_operations;
+        }
        fd_install(new_fd, filp);
        return new_fd;
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 38c4d128a8c0..de05abbbe7fd 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -227,9 +227,7 @@ xfs_initialize_vnode(
                xfs_revalidate_inode(XFS_BHVTOM(bdp), vp, ip);
                xfs_set_inodeops(inode);
-                spin_lock(&ip->i_flags_lock);
+                xfs_iflags_clear(ip, XFS_INEW);
-                ip->i_flags &= ~XFS_INEW;
-                spin_unlock(&ip->i_flags_lock);
                barrier();
                unlock_new_inode(inode);
diff --git a/fs/xfs/support/debug.c b/fs/xfs/support/debug.c
index c75f68361e33..4363512d2f90 100644
--- a/fs/xfs/support/debug.c
+++ b/fs/xfs/support/debug.c
@@ -15,11 +15,9 @@
 * along with this program; if not, write the Free Software Foundation,
 * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
+#include <xfs.h>
 #include "debug.h"
 #include "spin.h"
-#include <asm/page.h>
-#include <linux/sched.h>
-#include <linux/kernel.h>
 static char             message[256];   /* keep it off the stack */
 static DEFINE_SPINLOCK(xfs_err_lock);
diff --git a/fs/xfs/support/move.c b/fs/xfs/support/move.c
index caefa17b80fe..ac8617ca3909 100644
--- a/fs/xfs/support/move.c
+++ b/fs/xfs/support/move.c
@@ -22,7 +22,7 @@
 * as we go.
 */
 int
-uio_read(caddr_t src, size_t len, struct uio *uio)
+xfs_uio_read(caddr_t src, size_t len, struct uio *uio)
 {
        size_t  count;
diff --git a/fs/xfs/support/move.h b/fs/xfs/support/move.h
index 97a2498d2da3..977879c24ff5 100644
--- a/fs/xfs/support/move.h
+++ b/fs/xfs/support/move.h
@@ -65,6 +65,6 @@ struct uio {
 typedef struct uio uio_t;
 typedef struct iovec iovec_t;
-extern int      uio_read (caddr_t, size_t, uio_t *);
+extern int      xfs_uio_read (caddr_t, size_t, uio_t *);
 #endif  /* __XFS_SUPPORT_MOVE_H__ */
diff --git a/fs/xfs/xfs.h b/fs/xfs/xfs.h
index 1a48dbb902a7..bf0a12040b13 100644
--- a/fs/xfs/xfs.h
+++ b/fs/xfs/xfs.h
@@ -17,5 +17,28 @@
 */
 #ifndef __XFS_H__
 #define __XFS_H__
+#ifdef CONFIG_XFS_DEBUG
+#define STATIC
+#define DEBUG 1
+#define XFS_BUF_LOCK_TRACKING 1
+/* #define QUOTADEBUG 1 */
+#endif
+#ifdef CONFIG_XFS_TRACE
+#define XFS_ALLOC_TRACE 1
+#define XFS_ATTR_TRACE 1
+#define XFS_BLI_TRACE 1
+#define XFS_BMAP_TRACE 1
+#define XFS_BMBT_TRACE 1
+#define XFS_DIR2_TRACE 1
+#define XFS_DQUOT_TRACE 1
+#define XFS_ILOCK_TRACE 1
+#define XFS_LOG_TRACE 1
+#define XFS_RW_TRACE 1
+#define XFS_BUF_TRACE 1
+#define XFS_VNODE_TRACE 1
+#endif
 #include <linux-2.6/xfs_linux.h>
 #endif  /* __XFS_H__ */
diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c
index 8edbe1adb95b..8e8e5279334a 100644
--- a/fs/xfs/xfs_dir2.c
+++ b/fs/xfs/xfs_dir2.c
@@ -678,7 +678,7 @@ xfs_dir2_put_dirent64_uio(
        idbp->d_off = pa->cook;
        idbp->d_name[namelen] = '\0';
        memcpy(idbp->d_name, pa->name, namelen);
-        rval = uio_read((caddr_t)idbp, reclen, uio);
+        rval = xfs_uio_read((caddr_t)idbp, reclen, uio);
        pa->done = (rval == 0);
        return rval;
 }
diff --git a/fs/xfs/xfs_dmapi.h b/fs/xfs/xfs_dmapi.h
index 4e7865ad6f0e..adc3d251240d 100644
--- a/fs/xfs/xfs_dmapi.h
+++ b/fs/xfs/xfs_dmapi.h
@@ -157,27 +157,9 @@ typedef enum {
 #define DM_FLAGS_IALLOCSEM_WR   0x020   /* thread holds i_alloc_sem wr */
 /*
- *      Based on IO_ISDIRECT, decide which i_ flag is set.
+ *      Pull in platform specific event flags defines
 */
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,0)
+#include "xfs_dmapi_priv.h"
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              DM_FLAGS_IMUX : 0)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
-#endif
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)) && \
-    (LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,22))
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              DM_FLAGS_IALLOCSEM_RD : DM_FLAGS_IMUX)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
-#endif
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,4,21)
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              0 : DM_FLAGS_IMUX)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IMUX)
-#endif
 /*
 *      Macros to turn caller specified delay/block flags into
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index b73d216ecaf9..c1c89dac19cc 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -215,7 +215,7 @@ again:
                         * If INEW is set this inode is being set up
                         * we need to pause and try again.
                         */
-                        if (ip->i_flags & XFS_INEW) {
+                        if (xfs_iflags_test(ip, XFS_INEW)) {
                                read_unlock(&ih->ih_lock);
                                delay(1);
                                XFS_STATS_INC(xs_ig_frecycle);
@@ -230,22 +230,50 @@ again:
                                 * on its way out of the system,
                                 * we need to pause and try again.
                                 */
-                                if (ip->i_flags & XFS_IRECLAIM) {
+                                if (xfs_iflags_test(ip, XFS_IRECLAIM)) {
                                        read_unlock(&ih->ih_lock);
                                        delay(1);
                                        XFS_STATS_INC(xs_ig_frecycle);
                                        goto again;
                                }
+                                ASSERT(xfs_iflags_test(ip, XFS_IRECLAIMABLE));
+                                /*
+                                 * If lookup is racing with unlink, then we
+                                 * should return an error immediately so we
+                                 * don't remove it from the reclaim list and
+                                 * potentially leak the inode.
+                                 */
+                                if ((ip->i_d.di_mode == 0) &&
+                                    !(flags & XFS_IGET_CREATE)) {
+                                        read_unlock(&ih->ih_lock);
+                                        return ENOENT;
+                                }
+                                /*
+                                 * There may be transactions sitting in the
+                                 * incore log buffers or being flushed to disk
+                                 * at this time.  We can't clear the
+                                 * XFS_IRECLAIMABLE flag until these
+                                 * transactions have hit the disk, otherwise we
+                                 * will void the guarantee the flag provides
+                                 * xfs_iunpin()
+                                 */
+                                if (xfs_ipincount(ip)) {
+                                        read_unlock(&ih->ih_lock);
+                                        xfs_log_force(mp, 0,
+                                                XFS_LOG_FORCE|XFS_LOG_SYNC);
+                                        XFS_STATS_INC(xs_ig_frecycle);
+                                        goto again;
+                                }
                                vn_trace_exit(vp, "xfs_iget.alloc",
                                        (inst_t *)__return_address);
                                XFS_STATS_INC(xs_ig_found);
-                                spin_lock(&ip->i_flags_lock);
+                                xfs_iflags_clear(ip, XFS_IRECLAIMABLE);
-                                ip->i_flags &= ~XFS_IRECLAIMABLE;
-                                spin_unlock(&ip->i_flags_lock);
                                version = ih->ih_version;
                                read_unlock(&ih->ih_lock);
                                xfs_ihash_promote(ih, ip, version);
@@ -299,10 +327,7 @@ finish_inode:
                        if (lock_flags != 0)
                                xfs_ilock(ip, lock_flags);
-                        spin_lock(&ip->i_flags_lock);
+                        xfs_iflags_clear(ip, XFS_ISTALE);
-                        ip->i_flags &= ~XFS_ISTALE;
-                        spin_unlock(&ip->i_flags_lock);
                        vn_trace_exit(vp, "xfs_iget.found",
                                                (inst_t *)__return_address);
                        goto return_ip;
@@ -371,10 +396,7 @@ finish_inode:
        ih->ih_next = ip;
        ip->i_udquot = ip->i_gdquot = NULL;
        ih->ih_version++;
-        spin_lock(&ip->i_flags_lock);
+        xfs_iflags_set(ip, XFS_INEW);
-        ip->i_flags |= XFS_INEW;
-        spin_unlock(&ip->i_flags_lock);
        write_unlock(&ih->ih_lock);
        /*
@@ -625,7 +647,7 @@ xfs_iput_new(xfs_inode_t	*ip,
        vn_trace_entry(vp, "xfs_iput_new", (inst_t *)__return_address);
        if ((ip->i_d.di_mode == 0)) {
-                ASSERT(!(ip->i_flags & XFS_IRECLAIMABLE));
+                ASSERT(!xfs_iflags_test(ip, XFS_IRECLAIMABLE));
                vn_mark_bad(vp);
        }
        if (inode->i_state & I_NEW)
@@ -683,6 +705,7 @@ xfs_ireclaim(xfs_inode_t *ip)
        /*
         * Free all memory associated with the inode.
         */
+        xfs_iunlock(ip, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
        xfs_idestroy(ip);
 }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index c27d7d495aa0..d72c80dbfbb1 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2193,7 +2193,7 @@ xfs_ifree_cluster(
                        /* Inode not in memory or we found it already,
                         * nothing to do
                         */
-                        if (!ip || (ip->i_flags & XFS_ISTALE)) {
+                        if (!ip || xfs_iflags_test(ip, XFS_ISTALE)) {
                                read_unlock(&ih->ih_lock);
                                continue;
                        }
@@ -2215,10 +2215,7 @@ xfs_ifree_cluster(
                        if (ip == free_ip) {
                                if (xfs_iflock_nowait(ip)) {
-                                        spin_lock(&ip->i_flags_lock);
+                                        xfs_iflags_set(ip, XFS_ISTALE);
-                                        ip->i_flags |= XFS_ISTALE;
-                                        spin_unlock(&ip->i_flags_lock);
                                        if (xfs_inode_clean(ip)) {
                                                xfs_ifunlock(ip);
                                        } else {
@@ -2231,9 +2228,7 @@ xfs_ifree_cluster(
                        if (xfs_ilock_nowait(ip, XFS_ILOCK_EXCL)) {
                                if (xfs_iflock_nowait(ip)) {
-                                        spin_lock(&ip->i_flags_lock);
+                                        xfs_iflags_set(ip, XFS_ISTALE);
-                                        ip->i_flags |= XFS_ISTALE;
-                                        spin_unlock(&ip->i_flags_lock);
                                        if (xfs_inode_clean(ip)) {
                                                xfs_ifunlock(ip);
@@ -2263,9 +2258,7 @@ xfs_ifree_cluster(
                                AIL_LOCK(mp,s);
                                iip->ili_flush_lsn = iip->ili_item.li_lsn;
                                AIL_UNLOCK(mp, s);
-                                spin_lock(&iip->ili_inode->i_flags_lock);
+                                xfs_iflags_set(ip, XFS_ISTALE);
-                                iip->ili_inode->i_flags |= XFS_ISTALE;
-                                spin_unlock(&iip->ili_inode->i_flags_lock);
                                pre_flushed++;
                        }
                        lip = lip->li_bio_list;
@@ -2748,42 +2741,39 @@ xfs_iunpin(
 {
        ASSERT(atomic_read(&ip->i_pincount) > 0);
-        if (atomic_dec_and_test(&ip->i_pincount)) {
+        if (atomic_dec_and_lock(&ip->i_pincount, &ip->i_flags_lock)) {
                /*
-                 * If the inode is currently being reclaimed, the
+                 * If the inode is currently being reclaimed, the link between
-                 * linux inode _and_ the xfs vnode may have been
+                 * the bhv_vnode and the xfs_inode will be broken after the
-                 * freed so we cannot reference either of them safely.
+                 * XFS_IRECLAIM* flag is set. Hence, if these flags are not
-                 * Hence we should not try to do anything to them
+                 * set, then we can move forward and mark the linux inode dirty
-                 * if the xfs inode is currently in the reclaim
+                 * knowing that it is still valid as it won't freed until after
-                 * path.
+                 * the bhv_vnode<->xfs_inode link is broken in xfs_reclaim. The
+                 * i_flags_lock is used to synchronise the setting of the
+                 * XFS_IRECLAIM* flags and the breaking of the link, and so we
+                 * can execute atomically w.r.t to reclaim by holding this lock
+                 * here.
                 *
-                 * However, we still need to issue the unpin wakeup
+                 * However, we still need to issue the unpin wakeup call as the
-                 * call as the inode reclaim may be blocked waiting for
+                 * inode reclaim may be blocked waiting for the inode to become
-                 * the inode to become unpinned.
+                 * unpinned.
                 */
-                struct inode *inode = NULL;
-                spin_lock(&ip->i_flags_lock);
+                if (!__xfs_iflags_test(ip, XFS_IRECLAIM|XFS_IRECLAIMABLE)) {
-                if (!(ip->i_flags & (XFS_IRECLAIM|XFS_IRECLAIMABLE))) {
                        bhv_vnode_t     *vp = XFS_ITOV_NULL(ip);
+                        struct inode *inode = NULL;
+                        BUG_ON(vp == NULL);
+                        inode = vn_to_inode(vp);
+                        BUG_ON(inode->i_state & I_CLEAR);
                        /* make sync come back and flush this inode */
-                        if (vp) {
+                        if (!(inode->i_state & (I_NEW|I_FREEING)))
-                                inode = vn_to_inode(vp);
+                                mark_inode_dirty_sync(inode);
-                                if (!(inode->i_state &
-                                                (I_NEW|I_FREEING|I_CLEAR))) {
-                                        inode = igrab(inode);
-                                        if (inode)
-                                                mark_inode_dirty_sync(inode);
-                                } else
-                                        inode = NULL;
-                        }
                }
                spin_unlock(&ip->i_flags_lock);
                wake_up(&ip->i_ipin_wait);
-                if (inode)
-                        iput(inode);
        }
 }
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index e96eb0835fe6..bc823720d88f 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -305,6 +305,47 @@ typedef struct xfs_inode {
 #endif
 } xfs_inode_t;
+/*
+ * i_flags helper functions
+ */
+static inline void
+__xfs_iflags_set(xfs_inode_t *ip, unsigned short flags)
+{
+        ip->i_flags |= flags;
+}
+static inline void
+xfs_iflags_set(xfs_inode_t *ip, unsigned short flags)
+{
+        spin_lock(&ip->i_flags_lock);
+        __xfs_iflags_set(ip, flags);
+        spin_unlock(&ip->i_flags_lock);
+}
+static inline void
+xfs_iflags_clear(xfs_inode_t *ip, unsigned short flags)
+{
+        spin_lock(&ip->i_flags_lock);
+        ip->i_flags &= ~flags;
+        spin_unlock(&ip->i_flags_lock);
+}
+static inline int
+__xfs_iflags_test(xfs_inode_t *ip, unsigned short flags)
+{
+        return (ip->i_flags & flags);
+}
+static inline int
+xfs_iflags_test(xfs_inode_t *ip, unsigned short flags)
+{
+        int ret;
+        spin_lock(&ip->i_flags_lock);
+        ret = __xfs_iflags_test(ip, flags);
+        spin_unlock(&ip->i_flags_lock);
+        return ret;
+}
 #endif  /* __KERNEL__ */
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 061e2ffdd1de..bda774a04b8f 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1013,7 +1013,7 @@ xfs_readlink(
        pathlen = (int)ip->i_d.di_size;
        if (ip->i_df.if_flags & XFS_IFINLINE) {
-                error = uio_read(ip->i_df.if_u1.if_data, pathlen, uiop);
+                error = xfs_uio_read(ip->i_df.if_u1.if_data, pathlen, uiop);
        }
        else {
                /*
@@ -1044,7 +1044,7 @@ xfs_readlink(
                                byte_cnt = pathlen;
                        pathlen -= byte_cnt;
-                        error = uio_read(XFS_BUF_PTR(bp), byte_cnt, uiop);
+                        error = xfs_uio_read(XFS_BUF_PTR(bp), byte_cnt, uiop);
                        xfs_buf_relse (bp);
                }
@@ -3827,11 +3827,16 @@ xfs_reclaim(
         */
        xfs_synchronize_atime(ip);
-        /* If we have nothing to flush with this inode then complete the
+        /*
-         * teardown now, otherwise break the link between the xfs inode
+         * If we have nothing to flush with this inode then complete the
-         * and the linux inode and clean up the xfs inode later. This
+         * teardown now, otherwise break the link between the xfs inode and the
-         * avoids flushing the inode to disk during the delete operation
+         * linux inode and clean up the xfs inode later. This avoids flushing
-         * itself.
+         * the inode to disk during the delete operation itself.
+         *
+         * When breaking the link, we need to set the XFS_IRECLAIMABLE flag
+         * first to ensure that xfs_iunpin() will never see an xfs inode
+         * that has a linux inode being reclaimed. Synchronisation is provided
+         * by the i_flags_lock.
         */
        if (!ip->i_update_core && (ip->i_itemp == NULL)) {
                xfs_ilock(ip, XFS_ILOCK_EXCL);
@@ -3840,13 +3845,13 @@ xfs_reclaim(
        } else {
                xfs_mount_t     *mp = ip->i_mount;
-                /* Protect sync from us */
+                /* Protect sync and unpin from us */
                XFS_MOUNT_ILOCK(mp);
-                vn_bhv_remove(VN_BHV_HEAD(vp), XFS_ITOBHV(ip));
-                list_add_tail(&ip->i_reclaim, &mp->m_del_inodes);
                spin_lock(&ip->i_flags_lock);
-                ip->i_flags |= XFS_IRECLAIMABLE;
+                __xfs_iflags_set(ip, XFS_IRECLAIMABLE);
+                vn_bhv_remove(VN_BHV_HEAD(vp), XFS_ITOBHV(ip));
                spin_unlock(&ip->i_flags_lock);
+                list_add_tail(&ip->i_reclaim, &mp->m_del_inodes);
                XFS_MOUNT_IUNLOCK(mp);
        }
        return 0;
@@ -3872,8 +3877,8 @@ xfs_finish_reclaim(
         */
        write_lock(&ih->ih_lock);
        spin_lock(&ip->i_flags_lock);
-        if ((ip->i_flags & XFS_IRECLAIM) ||
+        if (__xfs_iflags_test(ip, XFS_IRECLAIM) ||
-            (!(ip->i_flags & XFS_IRECLAIMABLE) && vp == NULL)) {
+            (!__xfs_iflags_test(ip, XFS_IRECLAIMABLE) && vp == NULL)) {
                spin_unlock(&ip->i_flags_lock);
                write_unlock(&ih->ih_lock);
                if (locked) {
@@ -3882,7 +3887,7 @@ xfs_finish_reclaim(
                }
                return 1;
        }
-        ip->i_flags |= XFS_IRECLAIM;
+        __xfs_iflags_set(ip, XFS_IRECLAIM);
        spin_unlock(&ip->i_flags_lock);
        write_unlock(&ih->ih_lock);
diff --git a/include/asm-ia64/sn/addrs.h b/include/asm-ia64/sn/addrs.h
index 1d9efe541662..e715c794b186 100644
--- a/include/asm-ia64/sn/addrs.h
+++ b/include/asm-ia64/sn/addrs.h
@@ -136,9 +136,13 @@
 */
 #define TO_PHYS(x)              (TO_PHYS_MASK & (x))
 #define TO_CAC(x)               (CAC_BASE     | TO_PHYS(x))
+#ifdef CONFIG_SGI_SN
 #define TO_AMO(x)               (AMO_BASE     | TO_PHYS(x))
 #define TO_GET(x)               (GET_BASE     | TO_PHYS(x))
+#else
+#define TO_AMO(x)               ({ BUG(); x; })
+#define TO_GET(x)               ({ BUG(); x; })
+#endif
 /*
 * Covert from processor physical address to II/TIO physical address:
diff --git a/include/linux/personality.h b/include/linux/personality.h
index bf4cf2080e5c..012cd558189b 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -114,7 +114,7 @@ struct exec_domain {
 * Change personality of the currently running process.
 */
 #define set_personality(pers) \
-        ((current->personality == pers) ? 0 : __set_personality(pers))
+        ((current->personality == (pers)) ? 0 : __set_personality(pers))
 #endif /* __KERNEL__ */
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index dc9a29d84abc..924e502905d4 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -23,13 +23,14 @@ struct vm_area_struct;
 #endif
 struct vm_struct {
+        /* keep next,addr,size together to speedup lookups */
+        struct vm_struct        *next;
        void                    *addr;
        unsigned long           size;
        unsigned long           flags;
        struct page             **pages;
        unsigned int            nr_pages;
        unsigned long           phys_addr;
-        struct vm_struct        *next;
 };
 /*
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 49c717e3b040..903108e583f8 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -7,6 +7,7 @@
 #define _IP_VS_H
 #include <asm/types.h>          /* For __uXX types */
+#include <linux/types.h>        /* For __beXX types in userland */
 #define IP_VS_VERSION_CODE      0x010201
 #define NVERSION(version)                       \
diff --git a/kernel/fork.c b/kernel/fork.c
index 3da978eec791..4b4eab2a3161 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -687,6 +687,7 @@ static struct files_struct *dup_fd(struct files_struct *oldf, int *errorp)
                 * the latest pointer.
                 */
                spin_lock(&oldf->file_lock);
+                open_files = count_open_files(old_fdt);
                old_fdt = files_fdtable(oldf);
        }
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 543ea2e5ad93..9c7e2e4c1fe7 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -147,7 +147,11 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
        if (unlikely(irqfixup)) {
                /* Don't punish working computers */
                if ((irqfixup == 2 && irq == 0) || action_ret == IRQ_NONE) {
-                        int ok = misrouted_irq(irq);
+                        int ok;
+                        spin_unlock(&desc->lock);
+                        ok = misrouted_irq(irq);
+                        spin_lock(&desc->lock);
                        if (action_ret == IRQ_NONE)
                                desc->irqs_unhandled -= ok;
                }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 46606c133e82..7dc6aa745166 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -186,10 +186,8 @@ static struct vm_struct *__get_vm_area_node(unsigned long size, unsigned long fl
        if (unlikely(!area))
                return NULL;
-        if (unlikely(!size)) {
+        if (unlikely(!size))
-                kfree (area);
                return NULL;
-        }
        /*
         * We always allocate a guard page.
@@ -532,11 +530,12 @@ void *vmalloc_user(unsigned long size)
        void *ret;
        ret = __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
+        if (ret) {
-        area = __find_vm_area(ret);
+                write_lock(&vmlist_lock);
-        area->flags |= VM_USERMAP;
+                area = __find_vm_area(ret);
-        write_unlock(&vmlist_lock);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
        return ret;
 }
 EXPORT_SYMBOL(vmalloc_user);
@@ -605,11 +604,12 @@ void *vmalloc_32_user(unsigned long size)
        void *ret;
        ret = __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
+        if (ret) {
-        area = __find_vm_area(ret);
+                write_lock(&vmlist_lock);
-        area->flags |= VM_USERMAP;
+                area = __find_vm_area(ret);
-        write_unlock(&vmlist_lock);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
        return ret;
 }
 EXPORT_SYMBOL(vmalloc_32_user);
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index 6d398f10aa91..687c1de1146f 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -200,7 +200,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                from = n_cp->vaddr;
                port = n_cp->vport;
                sprintf(buf,"%d,%d,%d,%d,%d,%d", NIPQUAD(from),
-                        ntohs(port)&255, (ntohs(port)>>8)&255);
+                        (ntohs(port)>>8)&255, ntohs(port)&255);
                buf_len = strlen(buf);
                /*
diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
index bfe779e74590..6ff05c3a32e6 100644
--- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -117,7 +117,7 @@ tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
 {
        tcph->check =
                ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
+                                 ip_vs_check_diff(oldport ^ htons(0xFFFF),
                                                  newport, tcph->check));
 }
diff --git a/net/ipv4/ipvs/ip_vs_proto_udp.c b/net/ipv4/ipvs/ip_vs_proto_udp.c
index 54aa7603591f..691c8b637b29 100644
--- a/net/ipv4/ipvs/ip_vs_proto_udp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_udp.c
@@ -122,10 +122,10 @@ udp_fast_csum_update(struct udphdr *uhdr, __be32 oldip, __be32 newip,
 {
        uhdr->check =
                ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
+                                 ip_vs_check_diff(oldport ^ htons(0xFFFF),
                                                  newport, uhdr->check));
        if (!uhdr->check)
-                uhdr->check = htonl(0xFFFF);
+                uhdr->check = -1;
 }
 static int
@@ -173,7 +173,7 @@ udp_snat_handler(struct sk_buff **pskb,
                                                cp->protocol,
                                                (*pskb)->csum);
                if (udph->check == 0)
-                        udph->check = htonl(0xFFFF);
+                        udph->check = -1;
                IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
                          pp->name, udph->check,
                          (char*)&(udph->check) - (char*)udph);
@@ -228,7 +228,7 @@ udp_dnat_handler(struct sk_buff **pskb,
                                                cp->protocol,
                                                (*pskb)->csum);
                if (udph->check == 0)
-                        udph->check = 0xFFFF;
+                        udph->check = -1;
                (*pskb)->ip_summed = CHECKSUM_UNNECESSARY;
        }
        return 1;
diff --git a/scripts/kconfig/.gitignore b/scripts/kconfig/.gitignore
index e8ad1f6b3da4..b49584c932cc 100644
--- a/scripts/kconfig/.gitignore
+++ b/scripts/kconfig/.gitignore
@@ -6,6 +6,8 @@ lex.*.c
 *.tab.c
 *.tab.h
 zconf.hash.c
+*.moc
+lkc_defs.h
 #
 # configuration programs