147 files changed, 1194 insertions, 894 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index da6973adacda..6af683025ae0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -536,7 +536,7 @@ P:	Mauro Carvalho Chehab
 M:      mchehab@brturbo.com.br
 L:      video4linux-list@redhat.com
 W:      http://linuxtv.org
-T:      quilt http://www.linuxtv.org/download/quilt/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Maintained
 BUSLOGIC SCSI DRIVER
@@ -834,7 +834,7 @@ P:	LinuxTV.org Project
 M:      linux-dvb-maintainer@linuxtv.org
 L:      linux-dvb@linuxtv.org (subscription required)
 W:      http://linuxtv.org/
-T:      quilt http://www.linuxtv.org/download/quilt/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Supported
 EATA-DMA SCSI DRIVER
@@ -2896,7 +2896,7 @@ P:	Mauro Carvalho Chehab
 M:      mchehab@brturbo.com.br
 L:      video4linux-list@redhat.com
 W:      http://linuxtv.org
-T:      quilt http://www.linuxtv.org/download/quilt/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Maintained
 W1 DALLAS'S 1-WIRE BUS
diff --git a/Makefile b/Makefile
index f4218b5db827..497884d3d556 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 15
-EXTRAVERSION =-rc6
+EXTRAVERSION =
 NAME=Sliding Snow Leopard
 # *DOCUMENTATION*
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 2ad4aa2a1536..55076a75e5bf 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -131,7 +131,7 @@ __syscall_start:
                .long   sys_wait4
 /* 115 */       .long   sys_swapoff
                .long   sys_sysinfo
-                .long   sys_ipc_wrapper
+                .long   sys_ipc
                .long   sys_fsync
                .long   sys_sigreturn_wrapper
 /* 120 */       .long   sys_clone_wrapper
@@ -254,7 +254,7 @@ __syscall_start:
                .long   sys_fremovexattr
                .long   sys_tkill
                .long   sys_sendfile64
-/* 240 */       .long   sys_futex_wrapper
+/* 240 */       .long   sys_futex
                .long   sys_sched_setaffinity
                .long   sys_sched_getaffinity
                .long   sys_io_setup
@@ -284,7 +284,7 @@ __syscall_start:
                .long   sys_fstatfs64
                .long   sys_tgkill
                .long   sys_utimes
-/* 270 */       .long   sys_arm_fadvise64_64_wrapper
+/* 270 */       .long   sys_arm_fadvise64_64
                .long   sys_pciconfig_iobase
                .long   sys_pciconfig_read
                .long   sys_pciconfig_write
@@ -333,7 +333,7 @@ __syscall_start:
                .long   sys_inotify_init
                .long   sys_inotify_add_watch
                .long   sys_inotify_rm_watch
-                .long   sys_mbind_wrapper
+                .long   sys_mbind
 /* 320 */       .long   sys_get_mempolicy
                .long   sys_set_mempolicy
 __syscall_end:
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index d9fb819bf7cc..2a8d27e18fa7 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -614,6 +614,47 @@ __kuser_helper_start:
 /*
 * Reference prototype:
 *
+ *      void __kernel_memory_barrier(void)
+ *
+ * Input:
+ *
+ *      lr = return address
+ *
+ * Output:
+ *
+ *      none
+ *
+ * Clobbered:
+ *
+ *      the Z flag might be lost
+ *
+ * Definition and user space usage example:
+ *
+ *      typedef void (__kernel_dmb_t)(void);
+ *      #define __kernel_dmb (*(__kernel_dmb_t *)0xffff0fa0)
+ *
+ * Apply any needed memory barrier to preserve consistency with data modified
+ * manually and __kuser_cmpxchg usage.
+ *
+ * This could be used as follows:
+ *
+ * #define __kernel_dmb() \
+ *         asm volatile ( "mov r0, #0xffff0fff; mov lr, pc; sub pc, r0, #95" \
+ *              : : : "lr","cc" )
+ */
+__kuser_memory_barrier:                         @ 0xffff0fa0
+#if __LINUX_ARM_ARCH__ >= 6 && defined(CONFIG_SMP)
+        mcr     p15, 0, r0, c7, c10, 5  @ dmb
+#endif
+        mov     pc, lr
+        .align  5
+/*
+ * Reference prototype:
+ *
 *      int __kernel_cmpxchg(int oldval, int newval, int *ptr)
 *
 * Input:
@@ -642,6 +683,8 @@ __kuser_helper_start:
 * The C flag is also set if *ptr was changed to allow for assembly
 * optimization in the calling code.
 *
+ * Note: this routine already includes memory barriers as needed.
+ *
 * For example, a user space atomic_add implementation could look like this:
 *
 * #define atomic_add(ptr, val) \
@@ -698,10 +741,16 @@ __kuser_cmpxchg:				@ 0xffff0fc0
 #else
+#ifdef CONFIG_SMP
+        mcr     p15, 0, r0, c7, c10, 5  @ dmb
+#endif
        ldrex   r3, [r2]
        subs    r3, r3, r0
        strexeq r3, r1, [r2]
        rsbs    r0, r3, #0
+#ifdef CONFIG_SMP
+        mcr     p15, 0, r0, c7, c10, 5  @ dmb
+#endif
        mov     pc, lr
 #endif
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index f7f183075237..e2b42997ad33 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -145,7 +145,7 @@ ENTRY(vector_swi)
 #endif
        enable_irq
-        str     r4, [sp, #-S_OFF]!              @ push fifth arg
+        stmdb   sp!, {r4, r5}                   @ push fifth and sixth args
        get_thread_info tsk
        ldr     ip, [tsk, #TI_FLAGS]            @ check for syscall tracing
@@ -204,7 +204,7 @@ ENTRY(sys_call_table)
 * Special system call wrappers
 */
 @ r0 = syscall number
-@ r5 = syscall table
+@ r8 = syscall table
                .type   sys_syscall, #function
 sys_syscall:
                eor     scno, r0, #__NR_SYSCALL_BASE
@@ -255,22 +255,6 @@ sys_sigaltstack_wrapper:
                ldr     r2, [sp, #S_OFF + S_SP]
                b       do_sigaltstack
-sys_futex_wrapper:
-                str     r5, [sp, #4]            @ push sixth arg
-                b       sys_futex
-sys_arm_fadvise64_64_wrapper:
-                str     r5, [sp, #4]            @ push r5 to stack
-                b       sys_arm_fadvise64_64
-sys_mbind_wrapper:
-                str     r5, [sp, #4]
-                b       sys_mbind
-sys_ipc_wrapper:
-                str     r5, [sp, #4]            @ push sixth arg
-                b       sys_ipc
 /*
 * Note: off_4k (r5) is always units of 4K.  If we can't do the requested
 * offset, we return EINVAL.
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index df6c2bcde067..2333aead0563 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -554,7 +554,9 @@ int dump_task_regs(struct task_struct *tsk, elf_gregset_t *regs)
        struct pt_regs ptregs;
        
        ptregs = *(struct pt_regs *)
-                ((unsigned long)tsk->thread_info+THREAD_SIZE - sizeof(ptregs));
+                ((unsigned long)tsk->thread_info +
+                /* see comments in copy_thread() about -8 */
+                THREAD_SIZE - sizeof(ptregs) - 8);
        ptregs.xcs &= 0xffff;
        ptregs.xds &= 0xffff;
        ptregs.xes &= 0xffff;
diff --git a/arch/i386/pci/Makefile b/arch/i386/pci/Makefile
index ead6122dd06d..5461d4d5ea1e 100644
--- a/arch/i386/pci/Makefile
+++ b/arch/i386/pci/Makefile
@@ -1,7 +1,7 @@
 obj-y                           := i386.o
 obj-$(CONFIG_PCI_BIOS)          += pcbios.o
-obj-$(CONFIG_PCI_MMCONFIG)      += mmconfig.o
+obj-$(CONFIG_PCI_MMCONFIG)      += mmconfig.o direct.o
 obj-$(CONFIG_PCI_DIRECT)        += direct.o
 pci-y                           := fixup.o
diff --git a/arch/powerpc/configs/cell_defconfig b/arch/powerpc/configs/cell_defconfig
index 4b433411b9e3..b657f7e44762 100644
--- a/arch/powerpc/configs/cell_defconfig
+++ b/arch/powerpc/configs/cell_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc1
+# Linux kernel version: 2.6.15-rc5
-# Tue Nov 15 14:36:20 2005
+# Tue Dec 20 15:59:26 2005
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -53,6 +53,7 @@ CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
@@ -151,7 +152,7 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-CONFIG_SPLIT_PTLOCK_CPUS=4096
+CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PPC_64K_PAGES is not set
 CONFIG_SCHED_SMT=y
 CONFIG_PROC_DEVICETREE=y
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index e7c23e3902b8..3c22ccb18519 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc1
+# Linux kernel version: 2.6.15-rc5
-# Tue Nov 15 14:39:20 2005
+# Tue Dec 20 15:59:30 2005
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -53,6 +53,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
@@ -162,7 +163,7 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-CONFIG_SPLIT_PTLOCK_CPUS=4096
+CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PPC_64K_PAGES is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
@@ -1203,6 +1204,7 @@ CONFIG_USB_MON=y
 CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
+# CONFIG_USB_SERIAL_ANYDATA is not set
 CONFIG_USB_SERIAL_BELKIN=m
 CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
 # CONFIG_USB_SERIAL_CP2101 is not set
@@ -1233,7 +1235,6 @@ CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
 CONFIG_USB_SERIAL_KLSI=m
 CONFIG_USB_SERIAL_KOBIL_SCT=m
 CONFIG_USB_SERIAL_MCT_U232=m
-# CONFIG_USB_SERIAL_NOKIA_DKU2 is not set
 CONFIG_USB_SERIAL_PL2303=m
 # CONFIG_USB_SERIAL_HP4X is not set
 CONFIG_USB_SERIAL_SAFE=m
diff --git a/arch/powerpc/configs/iseries_defconfig b/arch/powerpc/configs/iseries_defconfig
index 5d0866707a75..751a622fb7a7 100644
--- a/arch/powerpc/configs/iseries_defconfig
+++ b/arch/powerpc/configs/iseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc1
+# Linux kernel version: 2.6.15-rc5
-# Tue Nov 15 14:38:09 2005
+# Tue Dec 20 15:59:32 2005
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -55,6 +55,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
@@ -144,7 +145,7 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-CONFIG_SPLIT_PTLOCK_CPUS=4096
+CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PPC_64K_PAGES is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
diff --git a/arch/powerpc/configs/maple_defconfig b/arch/powerpc/configs/maple_defconfig
index 92e42613ef06..07b6d3d23360 100644
--- a/arch/powerpc/configs/maple_defconfig
+++ b/arch/powerpc/configs/maple_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc1
+# Linux kernel version: 2.6.15-rc5
-# Tue Nov 15 14:38:58 2005
+# Tue Dec 20 15:59:36 2005
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -53,6 +53,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
@@ -149,7 +150,7 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-CONFIG_SPLIT_PTLOCK_CPUS=4096
+CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PPC_64K_PAGES is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
@@ -242,7 +243,6 @@ CONFIG_TCP_CONG_BIC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 #
 # Network testing
@@ -794,6 +794,7 @@ CONFIG_USB_SERIAL=y
 # CONFIG_USB_SERIAL_CONSOLE is not set
 CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
+# CONFIG_USB_SERIAL_ANYDATA is not set
 # CONFIG_USB_SERIAL_BELKIN is not set
 # CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set
 # CONFIG_USB_SERIAL_CP2101 is not set
@@ -824,7 +825,6 @@ CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
 # CONFIG_USB_SERIAL_KLSI is not set
 # CONFIG_USB_SERIAL_KOBIL_SCT is not set
 # CONFIG_USB_SERIAL_MCT_U232 is not set
-# CONFIG_USB_SERIAL_NOKIA_DKU2 is not set
 # CONFIG_USB_SERIAL_PL2303 is not set
 # CONFIG_USB_SERIAL_HP4X is not set
 # CONFIG_USB_SERIAL_SAFE is not set
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index b5ba3bbd96fb..509399eab6f5 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc1
+# Linux kernel version: 2.6.15-rc5
-# Fri Nov 18 16:23:24 2005
+# Tue Dec 20 15:59:38 2005
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -54,6 +54,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
@@ -176,7 +177,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
-CONFIG_SPLIT_PTLOCK_CPUS=4096
+CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PPC_64K_PAGES is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index b589b196eb3f..a50ce0fa9243 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc1
+# Linux kernel version: 2.6.15-rc5
-# Tue Nov 15 14:36:55 2005
+# Tue Dec 20 15:59:40 2005
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -55,6 +55,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
@@ -163,7 +164,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
-CONFIG_SPLIT_PTLOCK_CPUS=4096
+CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
 # CONFIG_PPC_64K_PAGES is not set
 CONFIG_SCHED_SMT=y
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 2d22bf03484e..bce33a38399f 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -183,8 +183,8 @@ syscall_exit_trace_cont:
        ld      r13,GPR13(r1)           /* returning to usermode */
 1:      ld      r2,GPR2(r1)
        li      r12,MSR_RI
-        andc    r10,r10,r12
+        andc    r11,r10,r12
-        mtmsrd  r10,1                   /* clear MSR.RI */
+        mtmsrd  r11,1                   /* clear MSR.RI */
        ld      r1,GPR1(r1)
        mtlr    r4
        mtcr    r5
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index a33583f3b0e7..a606504678bd 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -514,7 +514,7 @@ void __init htab_initialize(void)
 #undef KB
 #undef MB
-void __init htab_initialize_secondary(void)
+void htab_initialize_secondary(void)
 {
        if (!platform_is_lpar())
                mtspr(SPRN_SDR1, _SDR1);
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index 72ac18067ece..0377decc0719 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -48,11 +48,6 @@ static struct hw_interrupt_type xics_pic = {
        .set_affinity = xics_set_affinity
 };
-static struct hw_interrupt_type xics_8259_pic = {
-        .typename = " XICS/8259",
-        .ack = xics_mask_and_ack_irq,
-};
 /* This is used to map real irq numbers to virtual */
 static struct radix_tree_root irq_map = RADIX_TREE_INIT(GFP_ATOMIC);
@@ -367,12 +362,7 @@ int xics_get_irq(struct pt_regs *regs)
        /* for sanity, this had better be < NR_IRQS - 16 */
        if (vec == xics_irq_8259_cascade_real) {
                irq = i8259_irq(regs);
-                if (irq == -1) {
+                xics_end_irq(irq_offset_up(xics_irq_8259_cascade));
-                        /* Spurious cascaded interrupt.  Still must ack xics */
-                        xics_end_irq(irq_offset_up(xics_irq_8259_cascade));
-                        irq = -1;
-                }
        } else if (vec == XICS_IRQ_SPURIOUS) {
                irq = -1;
        } else {
@@ -542,6 +532,7 @@ nextnode:
                xics_irq_8259_cascade_real = *ireg;
                xics_irq_8259_cascade
                        = virt_irq_create_mapping(xics_irq_8259_cascade_real);
+                i8259_init(0, 0);
                of_node_put(np);
        }
@@ -565,12 +556,7 @@ nextnode:
 #endif /* CONFIG_SMP */
        }
-        xics_8259_pic.enable = i8259_pic.enable;
+        for (i = irq_offset_value(); i < NR_IRQS; ++i)
-        xics_8259_pic.disable = i8259_pic.disable;
-        xics_8259_pic.end = i8259_pic.end;
-        for (i = 0; i < 16; ++i)
-                get_irq_desc(i)->handler = &xics_8259_pic;
-        for (; i < NR_IRQS; ++i)
                get_irq_desc(i)->handler = &xics_pic;
        xics_setup_cpu();
@@ -590,7 +576,6 @@ static int __init xics_setup_i8259(void)
                                no_action, 0, "8259 cascade", NULL))
                        printk(KERN_ERR "xics_setup_i8259: couldn't get 8259 "
                                        "cascade\n");
-                i8259_init(0, 0);
        }
        return 0;
 }
diff --git a/arch/ppc/platforms/85xx/mpc85xx_cds_common.c b/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
index d8991b88dc9c..5e8cc5ec6ab5 100644
--- a/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
+++ b/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
@@ -130,10 +130,11 @@ mpc85xx_cds_show_cpuinfo(struct seq_file *m)
 }
 #ifdef CONFIG_CPM2
-static void cpm2_cascade(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t cpm2_cascade(int irq, void *dev_id, struct pt_regs *regs)
 {
        while((irq = cpm2_get_irq(regs)) >= 0)
                __do_IRQ(irq, regs);
+        return IRQ_HANDLED;
 }
 static struct irqaction cpm2_irqaction = {
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 3cfb8be3ff6d..56c34e7fd4ee 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -55,6 +55,10 @@ config NR_CPUS
        depends on SMP
        default "32"
+config SPARC
+        bool
+        default y
 # Identify this as a Sparc32 build
 config SPARC32
        bool
diff --git a/arch/sparc/kernel/sys_sunos.c b/arch/sparc/kernel/sys_sunos.c
index 81c894acd0db..d07ae02101ad 100644
--- a/arch/sparc/kernel/sys_sunos.c
+++ b/arch/sparc/kernel/sys_sunos.c
@@ -894,7 +894,7 @@ asmlinkage long sunos_sysconf (int name)
                ret = ARG_MAX;
                break;
        case _SC_CHILD_MAX:
-                ret = CHILD_MAX;
+                ret = -1; /* no limit */
                break;
        case _SC_CLK_TCK:
                ret = HZ;
diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
index 38938d2e63aa..346c19a949fd 100644
--- a/arch/sparc/kernel/vmlinux.lds.S
+++ b/arch/sparc/kernel/vmlinux.lds.S
@@ -85,19 +85,9 @@ SECTIONS
  }
  _end = . ;
  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  .debug          0 : { *(.debug) }
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  .line           0 : { *(.line) }
  /DISCARD/ : { *(.exit.text) *(.exit.data) *(.exitcall.exit) }
+  STABS_DEBUG
+  DWARF_DEBUG
 }
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index 3fded69b1922..c4b7ad70cd7c 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -5,6 +5,10 @@
 mainmenu "Linux/UltraSPARC Kernel Configuration"
+config SPARC
+        bool
+        default y
 config SPARC64
        bool
        default y
diff --git a/arch/sparc64/Makefile b/arch/sparc64/Makefile
index 43fe382da078..cad10c5b83d3 100644
--- a/arch/sparc64/Makefile
+++ b/arch/sparc64/Makefile
@@ -17,7 +17,6 @@ CC		:= $(shell if $(CC) -m64 -S -o /dev/null -xc /dev/null >/dev/null 2>&1; then
 NEW_GCC := $(call cc-option-yn, -m64 -mcmodel=medlow)
 NEW_GAS := $(shell if $(LD) -V 2>&1 | grep 'elf64_sparc' > /dev/null; then echo y; else echo n; fi)
 UNDECLARED_REGS := $(shell if $(CC) -c -x assembler /dev/null -Wa,--help | grep undeclared-regs > /dev/null; then echo y; else echo n; fi; )
-INLINE_LIMIT := $(call cc-option-yn, -m64 -finline-limit=100000)
 export NEW_GCC
@@ -49,10 +48,6 @@ else
  AFLAGS += -m64 -mcpu=ultrasparc $(CC_UNDECL)
 endif
-ifeq ($(INLINE_LIMIT),y)
-  CFLAGS := $(CFLAGS) -finline-limit=100000
-endif
 ifeq ($(CONFIG_MCOUNT),y)
  CFLAGS := $(CFLAGS) -pg
 endif
diff --git a/arch/sparc64/kernel/sys_sunos32.c b/arch/sparc64/kernel/sys_sunos32.c
index d0592ed54ea5..bfa4aa68312d 100644
--- a/arch/sparc64/kernel/sys_sunos32.c
+++ b/arch/sparc64/kernel/sys_sunos32.c
@@ -854,7 +854,7 @@ asmlinkage s32 sunos_sysconf (int name)
                ret = ARG_MAX;
                break;
        case _SC_CHILD_MAX:
-                ret = CHILD_MAX;
+                ret = -1; /* no limit */
                break;
        case _SC_CLK_TCK:
                ret = HZ;
diff --git a/arch/sparc64/kernel/vmlinux.lds.S b/arch/sparc64/kernel/vmlinux.lds.S
index 2af0cf0a8640..467d13a0d5c1 100644
--- a/arch/sparc64/kernel/vmlinux.lds.S
+++ b/arch/sparc64/kernel/vmlinux.lds.S
@@ -90,19 +90,9 @@ SECTIONS
  }
  _end = . ;
  PROVIDE (end = .);
-  /* Stabs debugging sections.  */
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
-  .stab.excl 0 : { *(.stab.excl) }
-  .stab.exclstr 0 : { *(.stab.exclstr) }
-  .stab.index 0 : { *(.stab.index) }
-  .stab.indexstr 0 : { *(.stab.indexstr) }
-  .comment 0 : { *(.comment) }
-  .debug          0 : { *(.debug) }
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  .line           0 : { *(.line) }
  /DISCARD/ : { *(.exit.text) *(.exit.data) *(.exitcall.exit) }
+  STABS_DEBUG
+  DWARF_DEBUG
 }
diff --git a/arch/sparc64/solaris/misc.c b/arch/sparc64/solaris/misc.c
index 302efbcba70e..3ab4677395f2 100644
--- a/arch/sparc64/solaris/misc.c
+++ b/arch/sparc64/solaris/misc.c
@@ -353,7 +353,7 @@ asmlinkage int solaris_sysconf(int id)
 {
        switch (id) {
        case SOLARIS_CONFIG_NGROUPS:    return NGROUPS_MAX;
-        case SOLARIS_CONFIG_CHILD_MAX:  return CHILD_MAX;
+        case SOLARIS_CONFIG_CHILD_MAX:  return -1; /* no limit */
        case SOLARIS_CONFIG_OPEN_FILES: return OPEN_MAX;
        case SOLARIS_CONFIG_POSIX_VER:  return 199309;
        case SOLARIS_CONFIG_PAGESIZE:   return PAGE_SIZE;
diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
index 37517d49c4ae..29a9e3f43763 100644
--- a/arch/um/os-Linux/start_up.c
+++ b/arch/um/os-Linux/start_up.c
@@ -116,16 +116,16 @@ static int stop_ptraced_child(int pid, void *stack, int exitcode,
        if(!WIFEXITED(status) || (WEXITSTATUS(status) != exitcode)) {
                int exit_with = WEXITSTATUS(status);
                if (exit_with == 2)
-                        printk("check_ptrace : child exited with status 2. "
+                        printf("check_ptrace : child exited with status 2. "
                               "Serious trouble happening! Try updating your "
                               "host skas patch!\nDisabling SYSEMU support.");
-                printk("check_ptrace : child exited with exitcode %d, while "
+                printf("check_ptrace : child exited with exitcode %d, while "
                      "expecting %d; status 0x%x", exit_with,
                      exitcode, status);
                if (mustpanic)
                        panic("\n");
                else
-                        printk("\n");
+                        printf("\n");
                ret = -1;
        }
@@ -183,7 +183,7 @@ static void __init check_sysemu(void)
        void *stack;
        int pid, n, status, count=0;
-        printk("Checking syscall emulation patch for ptrace...");
+        printf("Checking syscall emulation patch for ptrace...");
        sysemu_supported = 0;
        pid = start_ptraced_child(&stack);
@@ -207,10 +207,10 @@ static void __init check_sysemu(void)
                goto fail_stopped;
        sysemu_supported = 1;
-        printk("OK\n");
+        printf("OK\n");
        set_using_sysemu(!force_sysemu_disabled);
-        printk("Checking advanced syscall emulation patch for ptrace...");
+        printf("Checking advanced syscall emulation patch for ptrace...");
        pid = start_ptraced_child(&stack);
        if(ptrace(PTRACE_OLDSETOPTIONS, pid, 0,
@@ -246,7 +246,7 @@ static void __init check_sysemu(void)
                goto fail_stopped;
        sysemu_supported = 2;
-        printk("OK\n");
+        printf("OK\n");
        if ( !force_sysemu_disabled )
                set_using_sysemu(sysemu_supported);
@@ -255,7 +255,7 @@ static void __init check_sysemu(void)
 fail:
        stop_ptraced_child(pid, stack, 1, 0);
 fail_stopped:
-        printk("missing\n");
+        printf("missing\n");
 }
 static void __init check_ptrace(void)
@@ -263,7 +263,7 @@ static void __init check_ptrace(void)
        void *stack;
        int pid, syscall, n, status;
-        printk("Checking that ptrace can change system call numbers...");
+        printf("Checking that ptrace can change system call numbers...");
        pid = start_ptraced_child(&stack);
        if(ptrace(PTRACE_OLDSETOPTIONS, pid, 0, (void *)PTRACE_O_TRACESYSGOOD) < 0)
@@ -292,7 +292,7 @@ static void __init check_ptrace(void)
                }
        }
        stop_ptraced_child(pid, stack, 0, 1);
-        printk("OK\n");
+        printf("OK\n");
        check_sysemu();
 }
@@ -472,6 +472,8 @@ int can_do_skas(void)
 int have_devanon = 0;
+/* Runs on boot kernel stack - already safe to use printk. */
 void check_devanon(void)
 {
        int fd;
diff --git a/arch/um/os-Linux/user_syms.c b/arch/um/os-Linux/user_syms.c
index 56d3f870926b..8da6ab31152a 100644
--- a/arch/um/os-Linux/user_syms.c
+++ b/arch/um/os-Linux/user_syms.c
@@ -34,6 +34,11 @@ EXPORT_SYMBOL(strstr);
       int sym(void);                  \
       EXPORT_SYMBOL(sym);
+extern void readdir64(void) __attribute__((weak));
+EXPORT_SYMBOL(readdir64);
+extern void truncate64(void) __attribute__((weak));
+EXPORT_SYMBOL(truncate64);
 #ifdef SUBARCH_i386
 EXPORT_SYMBOL(vsyscall_ehdr);
 EXPORT_SYMBOL(vsyscall_end);
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index 150059dbee12..f5fd5b0156d0 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -1,6 +1,8 @@
-obj-y = bitops.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
+obj-y := bitops.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
-        ptrace_user.o semaphore.o signal.o sigcontext.o stub.o stub_segv.o \
+        ptrace_user.o semaphore.o signal.o sigcontext.o syscalls.o sysrq.o \
-        syscalls.o sysrq.o sys_call_table.o
+        sys_call_table.o
+obj-$(CONFIG_MODE_SKAS) += stub.o stub_segv.o
 obj-$(CONFIG_HIGHMEM) += highmem.o
 obj-$(CONFIG_MODULES) += module.o
diff --git a/arch/um/sys-x86_64/Makefile b/arch/um/sys-x86_64/Makefile
index 00b2025427df..a351091fbd99 100644
--- a/arch/um/sys-x86_64/Makefile
+++ b/arch/um/sys-x86_64/Makefile
@@ -6,8 +6,9 @@
 #XXX: why into lib-y?
 lib-y = bitops.o bugs.o csum-partial.o delay.o fault.o ldt.o mem.o memcpy.o \
-        ptrace.o ptrace_user.o sigcontext.o signal.o stub.o \
+        ptrace.o ptrace_user.o sigcontext.o signal.o syscalls.o \
-        stub_segv.o syscalls.o syscall_table.o sysrq.o thunk.o
+        syscall_table.o sysrq.o thunk.o
+lib-$(CONFIG_MODE_SKAS) += stub.o stub_segv.o
 obj-y := ksyms.o
 obj-$(CONFIG_MODULES) += module.o um_module.o
diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index 286f6a624c3a..c016dfe84784 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -348,7 +348,7 @@ size_zones(unsigned long *z, unsigned long *h,
        }
        /* Compute holes */
-        w = 0;
+        w = start_pfn;
        for (i = 0; i < MAX_NR_ZONES; i++) {
                unsigned long s = w;
                w += z[i];
diff --git a/arch/x86_64/pci/Makefile b/arch/x86_64/pci/Makefile
index bb34e5ef916c..a8f75a2a0f6f 100644
--- a/arch/x86_64/pci/Makefile
+++ b/arch/x86_64/pci/Makefile
@@ -11,7 +11,7 @@ obj-y		+= fixup.o
 obj-$(CONFIG_ACPI)      += acpi.o
 obj-y                   += legacy.o irq.o common.o
 # mmconfig has a 64bit special
-obj-$(CONFIG_PCI_MMCONFIG) += mmconfig.o
+obj-$(CONFIG_PCI_MMCONFIG) += mmconfig.o direct.o
 obj-$(CONFIG_NUMA)      += k8-bus.o
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 382dea7b224c..6e7db2e79f42 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -442,11 +442,37 @@ error:
        return err;
 }
+/* Send basic block requests */
+static int __blk_send_generic(request_queue_t *q, struct gendisk *bd_disk, int cmd, int data)
+{
+        struct request *rq;
+        int err;
+        rq = blk_get_request(q, WRITE, __GFP_WAIT);
+        rq->flags |= REQ_BLOCK_PC;
+        rq->data = NULL;
+        rq->data_len = 0;
+        rq->timeout = BLK_DEFAULT_TIMEOUT;
+        memset(rq->cmd, 0, sizeof(rq->cmd));
+        rq->cmd[0] = cmd;
+        rq->cmd[4] = data;
+        rq->cmd_len = 6;
+        err = blk_execute_rq(q, bd_disk, rq, 0);
+        blk_put_request(rq);
+        return err;
+}
+static inline int blk_send_start_stop(request_queue_t *q, struct gendisk *bd_disk, int data)
+{
+        return __blk_send_generic(q, bd_disk, GPCMD_START_STOP_UNIT, data);
+}
 int scsi_cmd_ioctl(struct file *file, struct gendisk *bd_disk, unsigned int cmd, void __user *arg)
 {
        request_queue_t *q;
-        struct request *rq;
+        int err;
-        int close = 0, err;
        q = bd_disk->queue;
        if (!q)
@@ -564,19 +590,10 @@ int scsi_cmd_ioctl(struct file *file, struct gendisk *bd_disk, unsigned int cmd,
                        err = sg_scsi_ioctl(file, q, bd_disk, arg);
                        break;
                case CDROMCLOSETRAY:
-                        close = 1;
+                        err = blk_send_start_stop(q, bd_disk, 0x03);
+                        break;
                case CDROMEJECT:
-                        rq = blk_get_request(q, WRITE, __GFP_WAIT);
+                        err = blk_send_start_stop(q, bd_disk, 0x02);
-                        rq->flags |= REQ_BLOCK_PC;
-                        rq->data = NULL;
-                        rq->data_len = 0;
-                        rq->timeout = BLK_DEFAULT_TIMEOUT;
-                        memset(rq->cmd, 0, sizeof(rq->cmd));
-                        rq->cmd[0] = GPCMD_START_STOP_UNIT;
-                        rq->cmd[4] = 0x02 + (close != 0);
-                        rq->cmd_len = 6;
-                        err = blk_execute_rq(q, bd_disk, rq, 0);
-                        blk_put_request(rq);
                        break;
                default:
                        err = -ENOTTY;
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 5f51057518b0..807b0df308f1 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -274,8 +274,6 @@ static void acpi_processor_idle(void)
                }
        }
-        cx->usage++;
 #ifdef CONFIG_HOTPLUG_CPU
        /*
         * Check for P_LVL2_UP flag before entering C2 and above on
@@ -283,9 +281,12 @@ static void acpi_processor_idle(void)
         * detection phase, to work cleanly with logical CPU hotplug.
         */
        if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) && 
-            !pr->flags.has_cst && acpi_fadt.plvl2_up)
+            !pr->flags.has_cst && !acpi_fadt.plvl2_up)
-                cx->type = ACPI_STATE_C1;
+                cx = &pr->power.states[ACPI_STATE_C1];
 #endif
+        cx->usage++;
        /*
         * Sleep:
         * ------
@@ -386,6 +387,15 @@ static void acpi_processor_idle(void)
        next_state = pr->power.state;
+#ifdef CONFIG_HOTPLUG_CPU
+        /* Don't do promotion/demotion */
+        if ((cx->type == ACPI_STATE_C1) && (num_online_cpus() > 1) &&
+            !pr->flags.has_cst && !acpi_fadt.plvl2_up) {
+                next_state = cx;
+                goto end;
+        }
+#endif
        /*
         * Promotion?
         * ----------
@@ -557,7 +567,7 @@ static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
         * Check for P_LVL2_UP flag before entering C2 and above on
         * an SMP system. 
         */
-        if ((num_online_cpus() > 1) && acpi_fadt.plvl2_up)
+        if ((num_online_cpus() > 1) && !acpi_fadt.plvl2_up)
                return_VALUE(-ENODEV);
 #endif
diff --git a/drivers/acpi/processor_thermal.c b/drivers/acpi/processor_thermal.c
index f37584015324..dc9817cfb882 100644
--- a/drivers/acpi/processor_thermal.c
+++ b/drivers/acpi/processor_thermal.c
@@ -102,8 +102,8 @@ static int cpu_has_cpufreq(unsigned int cpu)
 {
        struct cpufreq_policy policy;
        if (!acpi_thermal_cpufreq_is_init || cpufreq_get_policy(&policy, cpu))
-                return -ENODEV;
+                return 0;
-        return 0;
+        return 1;
 }
 static int acpi_thermal_cpufreq_increase(unsigned int cpu)
diff --git a/drivers/acpi/utilities/utmisc.c b/drivers/acpi/utilities/utmisc.c
index 0c5abc536c7a..2ce872d75890 100644
--- a/drivers/acpi/utilities/utmisc.c
+++ b/drivers/acpi/utilities/utmisc.c
@@ -84,14 +84,14 @@ acpi_status acpi_ut_allocate_owner_id(acpi_owner_id * owner_id)
        /* Find a free owner ID */
-        for (i = 0; i < 32; i++) {
+        for (i = 0; i < 64; i++) {
-                if (!(acpi_gbl_owner_id_mask & (1 << i))) {
+                if (!(acpi_gbl_owner_id_mask & (1ULL << i))) {
                        ACPI_DEBUG_PRINT((ACPI_DB_VALUES,
-                                          "Current owner_id mask: %8.8X New ID: %2.2X\n",
+                                          "Current owner_id mask: %16.16LX New ID: %2.2X\n",
                                          acpi_gbl_owner_id_mask,
                                          (unsigned int)(i + 1)));
-                        acpi_gbl_owner_id_mask |= (1 << i);
+                        acpi_gbl_owner_id_mask |= (1ULL << i);
                        *owner_id = (acpi_owner_id) (i + 1);
                        goto exit;
                }
@@ -106,7 +106,7 @@ acpi_status acpi_ut_allocate_owner_id(acpi_owner_id * owner_id)
         */
        *owner_id = 0;
        status = AE_OWNER_ID_LIMIT;
-        ACPI_REPORT_ERROR(("Could not allocate new owner_id (32 max), AE_OWNER_ID_LIMIT\n"));
+        ACPI_REPORT_ERROR(("Could not allocate new owner_id (64 max), AE_OWNER_ID_LIMIT\n"));
      exit:
        (void)acpi_ut_release_mutex(ACPI_MTX_CACHES);
@@ -123,7 +123,7 @@ acpi_status acpi_ut_allocate_owner_id(acpi_owner_id * owner_id)
 *              control method or unloading a table. Either way, we would
 *              ignore any error anyway.
 *
- * DESCRIPTION: Release a table or method owner ID.  Valid IDs are 1 - 32
+ * DESCRIPTION: Release a table or method owner ID.  Valid IDs are 1 - 64
 *
 ******************************************************************************/
@@ -140,7 +140,7 @@ void acpi_ut_release_owner_id(acpi_owner_id * owner_id_ptr)
        /* Zero is not a valid owner_iD */
-        if ((owner_id == 0) || (owner_id > 32)) {
+        if ((owner_id == 0) || (owner_id > 64)) {
                ACPI_REPORT_ERROR(("Invalid owner_id: %2.2X\n", owner_id));
                return_VOID;
        }
@@ -158,8 +158,8 @@ void acpi_ut_release_owner_id(acpi_owner_id * owner_id_ptr)
        /* Free the owner ID only if it is valid */
-        if (acpi_gbl_owner_id_mask & (1 << owner_id)) {
+        if (acpi_gbl_owner_id_mask & (1ULL << owner_id)) {
-                acpi_gbl_owner_id_mask ^= (1 << owner_id);
+                acpi_gbl_owner_id_mask ^= (1ULL << owner_id);
        }
        (void)acpi_ut_release_mutex(ACPI_MTX_CACHES);
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index b46a72d782d6..84e68cdd451b 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -687,7 +687,7 @@ config NVRAM
 config RTC
        tristate "Enhanced Real Time Clock Support"
-        depends on !PPC32 && !PARISC && !IA64 && !M68K
+        depends on !PPC32 && !PARISC && !IA64 && !M68K && (!SPARC || PCI)
        ---help---
          If you say Y here and create a character special file /dev/rtc with
          major number 10 and minor number 135 using mknod ("man mknod"), you
@@ -735,7 +735,7 @@ config SGI_IP27_RTC
 config GEN_RTC
        tristate "Generic /dev/rtc emulation"
-        depends on RTC!=y && !IA64 && !ARM && !M32R && !SPARC32 && !SPARC64
+        depends on RTC!=y && !IA64 && !ARM && !M32R && !SPARC
        ---help---
          If you say Y here and create a character special file /dev/rtc with
          major number 10 and minor number 135 using mknod ("man mknod"), you
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 501e557cbc86..342302d46743 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -1312,8 +1312,6 @@ static void radeon_set_pcigart(drm_radeon_private_t * dev_priv, int on)
 static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
 {
        drm_radeon_private_t *dev_priv = dev->dev_private;
-        unsigned int mem_size;
        DRM_DEBUG("\n");
        dev_priv->is_pci = init->is_pci;
@@ -1523,11 +1521,8 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                                          + dev_priv->fb_location) >> 10));
        dev_priv->gart_size = init->gart_size;
+        dev_priv->gart_vm_start = dev_priv->fb_location
-        mem_size = RADEON_READ(RADEON_CONFIG_MEMSIZE);
+            + RADEON_READ(RADEON_CONFIG_APER_SIZE);
-        if (mem_size == 0)
-                mem_size = 0x800000;
-        dev_priv->gart_vm_start = dev_priv->fb_location + mem_size;
 #if __OS_HAS_AGP
        if (!dev_priv->is_pci)
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 449d029ad4f4..8b603b2d1c42 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -930,8 +930,8 @@ static void kbd_refresh_leds(struct input_handle *handle)
 }
 #if defined(CONFIG_X86) || defined(CONFIG_IA64) || defined(CONFIG_ALPHA) ||\
-    defined(CONFIG_MIPS) || defined(CONFIG_PPC) || defined(CONFIG_SPARC32) ||\
+    defined(CONFIG_MIPS) || defined(CONFIG_PPC) || defined(CONFIG_SPARC) ||\
-    defined(CONFIG_SPARC64) || defined(CONFIG_PARISC) || defined(CONFIG_SUPERH) ||\
+    defined(CONFIG_PARISC) || defined(CONFIG_SUPERH) ||\
    (defined(CONFIG_ARM) && defined(CONFIG_KEYBOARD_ATKBD) && !defined(CONFIG_ARCH_RPC))
 #define HW_RAW(dev) (test_bit(EV_MSC, dev->evbit) && test_bit(MSC_RAW, dev->mscbit) &&\
@@ -958,7 +958,7 @@ static unsigned short x86_keycodes[256] =
 extern int mac_hid_mouse_emulate_buttons(int, int, int);
 #endif /* CONFIG_MAC_EMUMOUSEBTN */
-#if defined(CONFIG_SPARC32) || defined(CONFIG_SPARC64)
+#ifdef CONFIG_SPARC
 static int sparc_l1_a_state = 0;
 extern void sun_do_break(void);
 #endif
@@ -1045,7 +1045,7 @@ static void kbd_keycode(unsigned int keycode, int down,
        if (keycode == KEY_LEFTALT || keycode == KEY_RIGHTALT)
                sysrq_alt = down;
-#if defined(CONFIG_SPARC32) || defined(CONFIG_SPARC64)
+#ifdef CONFIG_SPARC
        if (keycode == KEY_STOP)
                sparc_l1_a_state = down;
 #endif
@@ -1072,7 +1072,7 @@ static void kbd_keycode(unsigned int keycode, int down,
                return;
        }
 #endif
-#if defined(CONFIG_SPARC32) || defined(CONFIG_SPARC64)
+#ifdef CONFIG_SPARC
        if (keycode == KEY_A && sparc_l1_a_state) {
                sparc_l1_a_state = 0;
                sun_do_break();
diff --git a/drivers/char/vc_screen.c b/drivers/char/vc_screen.c
index f66c7ad6fd38..3c1dafaa3441 100644
--- a/drivers/char/vc_screen.c
+++ b/drivers/char/vc_screen.c
@@ -419,7 +419,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
                        while (this_round > 1) {
                                unsigned short w;
-                                w = get_unaligned(((const unsigned short *)con_buf0));
+                                w = get_unaligned(((unsigned short *)con_buf0));
                                vcs_scr_writew(vc, w, org++);
                                con_buf0 += 2;
                                this_round -= 2;
diff --git a/drivers/fc4/Kconfig b/drivers/fc4/Kconfig
index f00c02a13ed6..345dbe6f10df 100644
--- a/drivers/fc4/Kconfig
+++ b/drivers/fc4/Kconfig
@@ -26,7 +26,7 @@ comment "FC4 drivers"
 config FC4_SOC
        tristate "Sun SOC/Sbus"
-        depends on FC4!=n && (SPARC32 || SPARC64)
+        depends on FC4!=n && SPARC
        help
          Serial Optical Channel is an interface card with one or two Fibre
          Optic ports, each of which can be connected to a disk array. Note
@@ -38,7 +38,7 @@ config FC4_SOC
 config FC4_SOCAL
        tristate "Sun SOC+ (aka SOCAL)"
-        depends on FC4!=n && (SPARC32 || SPARC64)
+        depends on FC4!=n && SPARC
        ---help---
          Serial Optical Channel Plus is an interface card with up to two
          Fibre Optic ports. This card supports FC Arbitrated Loop (usually
@@ -62,7 +62,7 @@ config SCSI_PLUTO
          be called pluto.
 config SCSI_FCAL
-        tristate "Sun Enterprise Network Array (A5000 and EX500)" if SPARC32 || SPARC64
+        tristate "Sun Enterprise Network Array (A5000 and EX500)" if SPARC
        depends on FC4!=n && SCSI
        help
          This driver drives FC-AL disks connected through a Fibre Channel
@@ -75,7 +75,7 @@ config SCSI_FCAL
 config SCSI_FCAL
        prompt "Generic FC-AL disk driver"
-        depends on FC4!=n && SCSI && !SPARC32 && !SPARC64
+        depends on FC4!=n && SCSI && !SPARC
 endmenu
diff --git a/drivers/input/joystick/warrior.c b/drivers/input/joystick/warrior.c
index 99a642d2a1fe..1849b176cf18 100644
--- a/drivers/input/joystick/warrior.c
+++ b/drivers/input/joystick/warrior.c
@@ -172,7 +172,7 @@ static int warrior_connect(struct serio *serio, struct serio_driver *drv)
        input_set_abs_params(input_dev, ABS_Y, -64, 64, 0, 8);
        input_set_abs_params(input_dev, ABS_THROTTLE, -112, 112, 0, 0);
        input_set_abs_params(input_dev, ABS_HAT0X, -1, 1, 0, 0);
-        input_set_abs_params(input_dev, ABS_HAT0X, -1, 1, 0, 0);
+        input_set_abs_params(input_dev, ABS_HAT0Y, -1, 1, 0, 0);
        serio_set_drvdata(serio, warrior);
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index 07813fc0523f..e08dbe08f46d 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -26,7 +26,7 @@ config INPUT_PCSPKR
 config INPUT_SPARCSPKR
        tristate "SPARC Speaker support"
-        depends on PCI && (SPARC32 || SPARC64)
+        depends on PCI && SPARC
        help
          Say Y here if you want the standard Speaker on Sparc PCI systems
          to be used for bells and whistles.
diff --git a/drivers/input/mouse/sermouse.c b/drivers/input/mouse/sermouse.c
index 4bf584364d28..2f9a04ae725f 100644
--- a/drivers/input/mouse/sermouse.c
+++ b/drivers/input/mouse/sermouse.c
@@ -95,7 +95,7 @@ static void sermouse_process_msc(struct sermouse *sermouse, signed char data, st
        input_sync(dev);
-        if (++sermouse->count == (5 - ((sermouse->type == SERIO_SUN) << 1)))
+        if (++sermouse->count == 5)
                sermouse->count = 0;
 }
diff --git a/drivers/input/serio/i8042.h b/drivers/input/serio/i8042.h
index 13835039a2a7..cbbf3842da5b 100644
--- a/drivers/input/serio/i8042.h
+++ b/drivers/input/serio/i8042.h
@@ -21,7 +21,7 @@
 #include "i8042-ip22io.h"
 #elif defined(CONFIG_PPC)
 #include "i8042-ppcio.h"
-#elif defined(CONFIG_SPARC32) || defined(CONFIG_SPARC64)
+#elif defined(CONFIG_SPARC)
 #include "i8042-sparcio.h"
 #elif defined(CONFIG_X86) || defined(CONFIG_IA64)
 #include "i8042-x86ia64io.h"
diff --git a/drivers/macintosh/therm_pm72.c b/drivers/macintosh/therm_pm72.c
index 3fc8cdd94c3d..190878eef990 100644
--- a/drivers/macintosh/therm_pm72.c
+++ b/drivers/macintosh/therm_pm72.c
@@ -923,7 +923,7 @@ static void do_monitor_cpu_combined(void)
        if (temp_combi >= ((state0->mpu.tmax + 8) << 16)) {
                printk(KERN_WARNING "Warning ! Temperature way above maximum (%d) !\n",
                       temp_combi >> 16);
-                state0->overtemp = CPU_MAX_OVERTEMP;
+                state0->overtemp += CPU_MAX_OVERTEMP / 4;
        } else if (temp_combi > (state0->mpu.tmax << 16))
                state0->overtemp++;
        else
@@ -933,7 +933,7 @@ static void do_monitor_cpu_combined(void)
        if (state0->overtemp > 0) {
                state0->rpm = state0->mpu.rmaxn_exhaust_fan;
                state0->intake_rpm = intake = state0->mpu.rmaxn_intake_fan;
-                pump = state0->pump_min;
+                pump = state0->pump_max;
                goto do_set_fans;
        }
@@ -998,7 +998,7 @@ static void do_monitor_cpu_split(struct cpu_pid_state *state)
                printk(KERN_WARNING "Warning ! CPU %d temperature way above maximum"
                       " (%d) !\n",
                       state->index, temp >> 16);
-                state->overtemp = CPU_MAX_OVERTEMP;
+                state->overtemp += CPU_MAX_OVERTEMP / 4;
        } else if (temp > (state->mpu.tmax << 16))
                state->overtemp++;
        else
@@ -1060,7 +1060,7 @@ static void do_monitor_cpu_rack(struct cpu_pid_state *state)
                printk(KERN_WARNING "Warning ! CPU %d temperature way above maximum"
                       " (%d) !\n",
                       state->index, temp >> 16);
-                state->overtemp = CPU_MAX_OVERTEMP;
+                state->overtemp = CPU_MAX_OVERTEMP / 4;
        } else if (temp > (state->mpu.tmax << 16))
                state->overtemp++;
        else
diff --git a/drivers/md/md.c b/drivers/md/md.c
index cd12fca73b0d..8175a2a222da 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1729,7 +1729,7 @@ level_show(mddev_t *mddev, char *page)
        if (p == NULL && mddev->raid_disks == 0)
                return 0;
        if (mddev->level >= 0)
-                return sprintf(page, "RAID-%d\n", mddev->level);
+                return sprintf(page, "raid%d\n", mddev->level);
        else
                return sprintf(page, "%s\n", p->name);
 }
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 992be0be6b1e..7dae91e5863c 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -176,6 +176,9 @@ static void init_av7110_av(struct av7110 *av7110)
                }
        }
+        if (dev->pci->subsystem_vendor == 0x13c2 && dev->pci->subsystem_device == 0x000e)
+                av7110_fw_cmd(av7110, COMTYPE_AUDIODAC, SpdifSwitch, 1, 0); // SPDIF on
        ret = av7110_set_volume(av7110, av7110->mixer.volume_left, av7110->mixer.volume_right);
        if (ret < 0)
                printk("dvb-ttpci:cannot set volume :%d\n",ret);
diff --git a/drivers/media/dvb/ttpci/av7110_hw.h b/drivers/media/dvb/ttpci/av7110_hw.h
index fedd20f9815d..2a5e87ba1052 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.h
+++ b/drivers/media/dvb/ttpci/av7110_hw.h
@@ -143,7 +143,8 @@ enum av7110_audio_command {
        MainSwitch,
        ADSwitch,
        SendDiSEqC,
-        SetRegister
+        SetRegister,
+        SpdifSwitch
 };
 enum av7110_request_command {
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index aea3f038cff6..5b93723a1768 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -333,24 +333,30 @@ static int set_input(struct i2c_client *client, enum cx25840_input input)
 static int set_v4lstd(struct i2c_client *client, v4l2_std_id std)
 {
-        u8 fmt;
+        u8 fmt=0;       /* zero is autodetect */
-        switch (std) {
+        /* First tests should be against specific std */
-        /* zero is autodetect */
+        if (std & V4L2_STD_NTSC_M_JP) {
-        case 0: fmt = 0x0; break;
+                fmt=0x2;
-        /* default ntsc to ntsc-m */
+        } else if (std & V4L2_STD_NTSC_443) {
-        case V4L2_STD_NTSC:
+                fmt=0x3;
-        case V4L2_STD_NTSC_M: fmt = 0x1; break;
+        } else if (std & V4L2_STD_PAL_M) {
-        case V4L2_STD_NTSC_M_JP: fmt = 0x2; break;
+                fmt=0x5;
-        case V4L2_STD_NTSC_443: fmt = 0x3; break;
+        } else if (std & V4L2_STD_PAL_N) {
-        case V4L2_STD_PAL: fmt = 0x4; break;
+                fmt=0x6;
-        case V4L2_STD_PAL_M: fmt = 0x5; break;
+        } else if (std & V4L2_STD_PAL_Nc) {
-        case V4L2_STD_PAL_N: fmt = 0x6; break;
+                fmt=0x7;
-        case V4L2_STD_PAL_Nc: fmt = 0x7; break;
+        } else if (std & V4L2_STD_PAL_60) {
-        case V4L2_STD_PAL_60: fmt = 0x8; break;
+                fmt=0x8;
-        case V4L2_STD_SECAM: fmt = 0xc; break;
+        } else {
-        default:
+                /* Then, test against generic ones */
-                return -ERANGE;
+                if (std & V4L2_STD_NTSC) {
+                        fmt=0x1;
+                } else if (std & V4L2_STD_PAL) {
+                        fmt=0x4;
+                } else if (std & V4L2_STD_SECAM) {
+                        fmt=0xc;
+                }
        }
        cx25840_and_or(client, 0x400, ~0xf, fmt);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index ec11619f8ea9..0cfe75416ec6 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -39,7 +39,7 @@ MODULE_PARM_DESC(core_debug,"enable debug messages [core]");
 #define em28xx_coredbg(fmt, arg...) do {\
        if (core_debug) \
                printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 static unsigned int reg_debug;
 module_param(reg_debug,int,0644);
@@ -48,7 +48,7 @@ MODULE_PARM_DESC(reg_debug,"enable debug messages [URB reg]");
 #define em28xx_regdbg(fmt, arg...) do {\
        if (reg_debug) \
                printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 static unsigned int isoc_debug;
 module_param(isoc_debug,int,0644);
@@ -57,7 +57,7 @@ MODULE_PARM_DESC(isoc_debug,"enable debug messages [isoc transfers]");
 #define em28xx_isocdbg(fmt, arg...) do {\
        if (isoc_debug) \
                printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 static int alt = EM28XX_PINOUT;
 module_param(alt, int, 0644);
diff --git a/drivers/media/video/em28xx/em28xx-i2c.c b/drivers/media/video/em28xx/em28xx-i2c.c
index 29e21ad187cc..7f5603054f02 100644
--- a/drivers/media/video/em28xx/em28xx-i2c.c
+++ b/drivers/media/video/em28xx/em28xx-i2c.c
@@ -44,7 +44,7 @@ MODULE_PARM_DESC(i2c_debug, "enable debug messages [i2c]");
                        printk(fmt, ##args); } while (0)
 #define dprintk2(lvl,fmt, args...) if (i2c_debug>=lvl) do{ \
                        printk(KERN_DEBUG "%s at %s: " fmt, \
-                        dev->name, __FUNCTION__, ##args); } while (0)
+                        dev->name, __FUNCTION__ , ##args); } while (0)
 /*
 * em2800_i2c_send_max4()
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 8ecaa0803e08..06d76879bde2 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -45,7 +45,7 @@
 #define em28xx_videodbg(fmt, arg...) do {\
        if (video_debug) \
                printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 1e2ee43db394..5c7a41ce69f3 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -392,18 +392,18 @@ extern const unsigned int em28xx_bcount;
 /* printk macros */
 #define em28xx_err(fmt, arg...) do {\
-        printk(KERN_ERR fmt, ##arg); } while (0)
+        printk(KERN_ERR fmt , ##arg); } while (0)
 #define em28xx_errdev(fmt, arg...) do {\
        printk(KERN_ERR "%s: "fmt,\
-                        dev->name, ##arg); } while (0)
+                        dev->name , ##arg); } while (0)
 #define em28xx_info(fmt, arg...) do {\
        printk(KERN_INFO "%s: "fmt,\
-                        dev->name, ##arg); } while (0)
+                        dev->name , ##arg); } while (0)
 #define em28xx_warn(fmt, arg...) do {\
        printk(KERN_WARNING "%s: "fmt,\
-                        dev->name, ##arg); } while (0)
+                        dev->name , ##arg); } while (0)
 inline static int em28xx_audio_source(struct em28xx *dev, int input)
 {
diff --git a/drivers/media/video/saa7127.c b/drivers/media/video/saa7127.c
index 3428e1ed0032..c36f014f1fdf 100644
--- a/drivers/media/video/saa7127.c
+++ b/drivers/media/video/saa7127.c
@@ -389,7 +389,7 @@ static int saa7127_set_vps(struct i2c_client *client, struct v4l2_sliced_vbi_dat
 static int saa7127_set_cc(struct i2c_client *client, struct v4l2_sliced_vbi_data *data)
 {
        struct saa7127_state *state = i2c_get_clientdata(client);
-        u16 cc = data->data[0] << 8 | data->data[1];
+        u16 cc = data->data[1] << 8 | data->data[0];
        int enable = (data->line != 0);
        if (enable && (data->field != 0 || data->line != 21))
@@ -397,7 +397,7 @@ static int saa7127_set_cc(struct i2c_client *client, struct v4l2_sliced_vbi_data
        if (state->cc_enable != enable) {
                saa7127_dbg("Turn CC %s\n", enable ? "on" : "off");
                saa7127_write(client, SAA7127_REG_CLOSED_CAPTION,
-                                (enable << 6) | 0x11);
+                                (state->xds_enable << 7) | (enable << 6) | 0x11);
                state->cc_enable = enable;
        }
        if (!enable)
@@ -423,7 +423,7 @@ static int saa7127_set_xds(struct i2c_client *client, struct v4l2_sliced_vbi_dat
        if (state->xds_enable != enable) {
                saa7127_dbg("Turn XDS %s\n", enable ? "on" : "off");
                saa7127_write(client, SAA7127_REG_CLOSED_CAPTION,
-                                (enable << 7) | 0x11);
+                                (enable << 7) | (state->cc_enable << 6) | 0x11);
                state->xds_enable = enable;
        }
        if (!enable)
diff --git a/drivers/media/video/saa7134/Kconfig b/drivers/media/video/saa7134/Kconfig
index c512c4411b38..8a5c3e71b37d 100644
--- a/drivers/media/video/saa7134/Kconfig
+++ b/drivers/media/video/saa7134/Kconfig
@@ -1,11 +1,10 @@
 config VIDEO_SAA7134
        tristate "Philips SAA7134 support"
-        depends on VIDEO_DEV && PCI && I2C && SOUND && SND
+        depends on VIDEO_DEV && PCI && I2C
        select VIDEO_BUF
        select VIDEO_IR
        select VIDEO_TUNER
        select CRC32
-        select SND_PCM_OSS
        ---help---
          This is a video4linux driver for Philips SAA713x based
          TV cards.
@@ -13,6 +12,29 @@ config VIDEO_SAA7134
          To compile this driver as a module, choose M here: the
          module will be called saa7134.
+config VIDEO_SAA7134_ALSA
+        tristate "Philips SAA7134 DMA audio support"
+        depends on VIDEO_SAA7134 && SND
+        select SND_PCM_OSS
+        ---help---
+          This is a video4linux driver for direct (DMA) audio in
+          Philips SAA713x based TV cards using ALSA
+          To compile this driver as a module, choose M here: the
+          module will be called saa7134-alsa.
+config VIDEO_SAA7134_OSS
+        tristate "Philips SAA7134 DMA audio support (OSS, DEPRECATED)"
+        depends on VIDEO_SAA7134 && SOUND_PRIME && !VIDEO_SAA7134_ALSA
+        ---help---
+          This is a video4linux driver for direct (DMA) audio in
+          Philips SAA713x based TV cards using OSS
+          This is deprecated in favor of the ALSA module
+          To compile this driver as a module, choose M here: the
+          module will be called saa7134-oss.
 config VIDEO_SAA7134_DVB
        tristate "DVB/ATSC Support for saa7134 based TV cards"
        depends on VIDEO_SAA7134 && DVB_CORE
diff --git a/drivers/media/video/saa7134/Makefile b/drivers/media/video/saa7134/Makefile
index 134f83a96218..1ba998424bbd 100644
--- a/drivers/media/video/saa7134/Makefile
+++ b/drivers/media/video/saa7134/Makefile
@@ -4,8 +4,11 @@ saa7134-objs :=	saa7134-cards.o saa7134-core.o saa7134-i2c.o	\
                saa7134-video.o saa7134-input.o
 obj-$(CONFIG_VIDEO_SAA7134) +=  saa7134.o saa7134-empress.o \
-                                saa6752hs.o saa7134-alsa.o \
+                                saa6752hs.o
-                                saa7134-oss.o
+obj-$(CONFIG_VIDEO_SAA7134_ALSA) += saa7134-alsa.o
+obj-$(CONFIG_VIDEO_SAA7134_OSS) += saa7134-oss.o
 obj-$(CONFIG_VIDEO_SAA7134_DVB) += saa7134-dvb.o
 EXTRA_CFLAGS += -I$(src)/..
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index b24a26b065c2..ade05f75fdb0 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -60,7 +60,7 @@ module_param_array(index, int, NULL, 0444);
 MODULE_PARM_DESC(index, "Index value for SAA7134 capture interface(s).");
 #define dprintk(fmt, arg...)    if (debug) \
-        printk(KERN_DEBUG "%s/alsa: " fmt, dev->name, ## arg)
+        printk(KERN_DEBUG "%s/alsa: " fmt, dev->name , ##arg)
@@ -989,6 +989,14 @@ static int saa7134_alsa_init(void)
        struct saa7134_dev *dev = NULL;
        struct list_head *list;
+        if (!dmasound_init && !dmasound_exit) {
+                dmasound_init = alsa_device_init;
+                dmasound_exit = alsa_device_exit;
+        } else {
+                printk(KERN_WARNING "saa7134 ALSA: can't load, DMA sound handler already assigned (probably to OSS)\n");
+                return -EBUSY;
+        }
        printk(KERN_INFO "saa7134 ALSA driver for DMA sound loaded\n");
        list_for_each(list,&saa7134_devlist) {
@@ -1001,9 +1009,6 @@ static int saa7134_alsa_init(void)
                }
        }
-        dmasound_init = alsa_device_init;
-        dmasound_exit = alsa_device_exit;
        if (dev == NULL)
                printk(KERN_INFO "saa7134 ALSA: no saa7134 cards found\n");
@@ -1023,12 +1028,15 @@ static void saa7134_alsa_exit(void)
                snd_card_free(snd_saa7134_cards[idx]);
        }
+        dmasound_init = NULL;
+        dmasound_exit = NULL;
        printk(KERN_INFO "saa7134 ALSA driver for DMA sound unloaded\n");
        return;
 }
-module_init(saa7134_alsa_init);
+/* We initialize this late, to make sure the sound system is up and running */
+late_initcall(saa7134_alsa_init);
 module_exit(saa7134_alsa_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Ricardo Cerqueira");
diff --git a/drivers/media/video/saa7134/saa7134-oss.c b/drivers/media/video/saa7134/saa7134-oss.c
index 513a699a6df2..8badd2a9cb2f 100644
--- a/drivers/media/video/saa7134/saa7134-oss.c
+++ b/drivers/media/video/saa7134/saa7134-oss.c
@@ -959,8 +959,17 @@ static int saa7134_oss_init(void)
        struct saa7134_dev *dev = NULL;
        struct list_head *list;
+        if (!dmasound_init && !dmasound_exit) {
+                dmasound_init = oss_device_init;
+                dmasound_exit = oss_device_exit;
+        } else {
+                printk(KERN_WARNING "saa7134 OSS: can't load, DMA sound handler already assigned (probably to ALSA)\n");
+                return -EBUSY;
+        }
        printk(KERN_INFO "saa7134 OSS driver for DMA sound loaded\n");
        list_for_each(list,&saa7134_devlist) {
                dev = list_entry(list, struct saa7134_dev, devlist);
                if (dev->dmasound.priv_data == NULL) {
@@ -974,9 +983,6 @@ static int saa7134_oss_init(void)
        if (dev == NULL)
                printk(KERN_INFO "saa7134 OSS: no saa7134 cards found\n");
-        dmasound_init = oss_device_init;
-        dmasound_exit = oss_device_exit;
        return 0;
 }
@@ -997,12 +1003,16 @@ static void saa7134_oss_exit(void)
        }
+        dmasound_init = NULL;
+        dmasound_exit = NULL;
        printk(KERN_INFO "saa7134 OSS driver for DMA sound unloaded\n");
        return;
 }
-module_init(saa7134_oss_init);
+/* We initialize this late, to make sure the sound system is up and running */
+late_initcall(saa7134_oss_init);
 module_exit(saa7134_oss_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Gerd Knorr <kraxel@bytesex.org> [SuSE Labs]");
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index cd7cf1bd12b4..5ac235365dd8 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -206,7 +206,7 @@ hauppauge_tuner[] =
        { TUNER_ABSENT,        "TCL 2002MI_3H"},
        { TUNER_TCL_2002N,     "TCL 2002N 5H"},
        /* 100-109 */
-        { TUNER_ABSENT,        "Philips FMD1216ME"},
+        { TUNER_PHILIPS_FMD1216ME_MK3, "Philips FMD1216ME"},
        { TUNER_TEA5767,       "Philips TEA5768HL FM Radio"},
        { TUNER_ABSENT,        "Panasonic ENV57H12D5"},
        { TUNER_PHILIPS_FM1236_MK3, "TCL MFNM05-4"},
diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c
index d91fcf7c3178..abcf19116d70 100644
--- a/drivers/mmc/mmc_block.c
+++ b/drivers/mmc/mmc_block.c
@@ -359,7 +359,12 @@ static struct mmc_blk_data *mmc_blk_alloc(struct mmc_card *card)
                md->block_bits = card->csd.read_blkbits;
                blk_queue_hardsect_size(md->queue.queue, 1 << md->block_bits);
-                set_capacity(md->disk, card->csd.capacity);
+                /*
+                 * The CSD capacity field is in units of read_blkbits.
+                 * set_capacity takes units of 512 bytes.
+                 */
+                set_capacity(md->disk, card->csd.capacity << (card->csd.read_blkbits - 9));
        }
 out:
        return md;
@@ -373,7 +378,7 @@ mmc_blk_set_blksize(struct mmc_blk_data *md, struct mmc_card *card)
        mmc_card_claim_host(card);
        cmd.opcode = MMC_SET_BLOCKLEN;
-        cmd.arg = 1 << card->csd.read_blkbits;
+        cmd.arg = 1 << md->block_bits;
        cmd.flags = MMC_RSP_R1;
        err = mmc_wait_for_cmd(card->host, &cmd, 5);
        mmc_card_release_host(card);
@@ -412,10 +417,9 @@ static int mmc_blk_probe(struct mmc_card *card)
        if (err)
                goto out;
-        printk(KERN_INFO "%s: %s %s %dKiB %s\n",
+        printk(KERN_INFO "%s: %s %s %luKiB %s\n",
                md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
-                (card->csd.capacity << card->csd.read_blkbits) / 1024,
+                get_capacity(md->disk) >> 1, mmc_blk_readonly(card)?"(ro)":"");
-                mmc_blk_readonly(card)?"(ro)":"");
        mmc_set_drvdata(card, md);
        add_disk(md->disk);
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 452ccd5037c3..b9b77cf39a18 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -62,7 +62,7 @@ config MTD_PHYSMAP_BANKWIDTH
 config MTD_SUN_UFLASH
        tristate "Sun Microsystems userflash support"
-        depends on (SPARC32 || SPARC64) && MTD_CFI
+        depends on SPARC && MTD_CFI
        help
          This provides a 'mapping' driver which supports the way in
          which user-programmable flash chips are connected on various
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 525624fc03b4..c39344adecce 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -10,7 +10,7 @@
 * trademarks of NVIDIA Corporation in the United States and other
 * countries.
 *
- * Copyright (C) 2003,4 Manfred Spraul
+ * Copyright (C) 2003,4,5 Manfred Spraul
 * Copyright (C) 2004 Andrew de Quincey (wol support)
 * Copyright (C) 2004 Carl-Daniel Hailfinger (invalid MAC handling, insane
 *              IRQ rate fixes, bigendian fixes, cleanups, verification)
@@ -100,6 +100,7 @@
 *      0.45: 18 Sep 2005: Remove nv_stop/start_rx from every link check
 *      0.46: 20 Oct 2005: Add irq optimization modes.
 *      0.47: 26 Oct 2005: Add phyaddr 0 in phy scan.
+ *      0.48: 24 Dec 2005: Disable TSO, bugfix for pci_map_single
 *
 * Known bugs:
 * We suspect that on some hardware no TX done interrupts are generated.
@@ -111,7 +112,7 @@
 * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
 * superfluous timer interrupts from the nic.
 */
-#define FORCEDETH_VERSION               "0.47"
+#define FORCEDETH_VERSION               "0.48"
 #define DRV_NAME                        "forcedeth"
 #include <linux/module.h>
@@ -871,8 +872,8 @@ static int nv_alloc_rx(struct net_device *dev)
                } else {
                        skb = np->rx_skbuff[nr];
                }
-                np->rx_dma[nr] = pci_map_single(np->pci_dev, skb->data, skb->len,
+                np->rx_dma[nr] = pci_map_single(np->pci_dev, skb->data,
-                                                PCI_DMA_FROMDEVICE);
+                                        skb->end-skb->data, PCI_DMA_FROMDEVICE);
                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
                        np->rx_ring.orig[nr].PacketBuffer = cpu_to_le32(np->rx_dma[nr]);
                        wmb();
@@ -999,7 +1000,7 @@ static void nv_drain_rx(struct net_device *dev)
                wmb();
                if (np->rx_skbuff[i]) {
                        pci_unmap_single(np->pci_dev, np->rx_dma[i],
-                                                np->rx_skbuff[i]->len,
+                                                np->rx_skbuff[i]->end-np->rx_skbuff[i]->data,
                                                PCI_DMA_FROMDEVICE);
                        dev_kfree_skb(np->rx_skbuff[i]);
                        np->rx_skbuff[i] = NULL;
@@ -1334,7 +1335,7 @@ static void nv_rx_process(struct net_device *dev)
                 * the performance.
                 */
                pci_unmap_single(np->pci_dev, np->rx_dma[i],
-                                np->rx_skbuff[i]->len,
+                                np->rx_skbuff[i]->end-np->rx_skbuff[i]->data,
                                PCI_DMA_FROMDEVICE);
                {
@@ -2455,7 +2456,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK;
                dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
 #ifdef NETIF_F_TSO
-                dev->features |= NETIF_F_TSO;
+                /* disabled dev->features |= NETIF_F_TSO; */
 #endif
        }
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 16bebe7a7ce1..7da0e3dd5fe3 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -38,6 +38,10 @@
 #include <asm/irq.h>
 #include <asm/uaccess.h>
+MODULE_DESCRIPTION("PHY library");
+MODULE_AUTHOR("Andy Fleming");
+MODULE_LICENSE("GPL");
 static struct phy_driver genphy_driver;
 extern int mdio_bus_init(void);
 extern void mdio_bus_exit(void);
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 50430f79f8cf..1c6d328165bb 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -524,9 +524,6 @@ static int get_filter(void __user *arg, struct sock_filter **p)
        if (copy_from_user(&uprog, arg, sizeof(uprog)))
                return -EFAULT;
-        if (uprog.len > BPF_MAXINSNS)
-                return -EINVAL;
        if (!uprog.len) {
                *p = NULL;
                return 0;
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 081717d01374..28ce47a02408 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2907,7 +2907,7 @@ static int __devinit gem_get_device_address(struct gem *gp)
        return 0;
 }
-static void __devexit gem_remove_one(struct pci_dev *pdev)
+static void gem_remove_one(struct pci_dev *pdev)
 {
        struct net_device *dev = pci_get_drvdata(pdev);
@@ -3181,7 +3181,7 @@ static struct pci_driver gem_driver = {
        .name           = GEM_MODULE_NAME,
        .id_table       = gem_pci_tbl,
        .probe          = gem_init_one,
-        .remove         = __devexit_p(gem_remove_one),
+        .remove         = gem_remove_one,
 #ifdef CONFIG_PM
        .suspend        = gem_suspend,
        .resume         = gem_resume,
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index a23ed28a72b8..2fc9893d69e1 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.45"
+#define DRV_MODULE_VERSION      "3.47"
-#define DRV_MODULE_RELDATE      "Dec 13, 2005"
+#define DRV_MODULE_RELDATE      "Dec 28, 2005"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -341,6 +341,16 @@ static struct {
        { "interrupt test (offline)" },
 };
+static void tg3_write32(struct tg3 *tp, u32 off, u32 val)
+{
+        writel(val, tp->regs + off);
+}
+static u32 tg3_read32(struct tg3 *tp, u32 off)
+{
+        return (readl(tp->regs + off)); 
+}
 static void tg3_write_indirect_reg32(struct tg3 *tp, u32 off, u32 val)
 {
        unsigned long flags;
@@ -411,13 +421,29 @@ static u32 tg3_read_indirect_mbox(struct tg3 *tp, u32 off)
        return val;
 }
-static void _tw32_flush(struct tg3 *tp, u32 off, u32 val)
+/* usec_wait specifies the wait time in usec when writing to certain registers
+ * where it is unsafe to read back the register without some delay.
+ * GRC_LOCAL_CTRL is one example if the GPIOs are toggled to switch power.
+ * TG3PCI_CLOCK_CTRL is another example if the clock frequencies are changed.
+ */
+static void _tw32_flush(struct tg3 *tp, u32 off, u32 val, u32 usec_wait)
 {
-        tp->write32(tp, off, val);
+        if ((tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) ||
-        if (!(tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) &&
+            (tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
-            !(tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG) &&
+                /* Non-posted methods */
-            !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
+                tp->write32(tp, off, val);
-                tp->read32(tp, off);    /* flush */
+        else {
+                /* Posted method */
+                tg3_write32(tp, off, val);
+                if (usec_wait)
+                        udelay(usec_wait);
+                tp->read32(tp, off);
+        }
+        /* Wait again after the read for the posted method to guarantee that
+         * the wait time is met.
+         */
+        if (usec_wait)
+                udelay(usec_wait);
 }
 static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
@@ -438,16 +464,6 @@ static void tg3_write32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
                readl(mbox);
 }
-static void tg3_write32(struct tg3 *tp, u32 off, u32 val)
-{
-        writel(val, tp->regs + off);
-}
-static u32 tg3_read32(struct tg3 *tp, u32 off)
-{
-        return (readl(tp->regs + off)); 
-}
 #define tw32_mailbox(reg, val)  tp->write32_mbox(tp, reg, val)
 #define tw32_mailbox_f(reg, val)        tw32_mailbox_flush(tp, (reg), (val))
 #define tw32_rx_mbox(reg, val)  tp->write32_rx_mbox(tp, reg, val)
@@ -455,7 +471,8 @@ static u32 tg3_read32(struct tg3 *tp, u32 off)
 #define tr32_mailbox(reg)       tp->read32_mbox(tp, reg)
 #define tw32(reg,val)           tp->write32(tp, reg, val)
-#define tw32_f(reg,val)         _tw32_flush(tp,(reg),(val))
+#define tw32_f(reg,val)         _tw32_flush(tp,(reg),(val), 0)
+#define tw32_wait_f(reg,val,us) _tw32_flush(tp,(reg),(val), (us))
 #define tr32(reg)               tp->read32(tp, reg)
 static void tg3_write_mem(struct tg3 *tp, u32 off, u32 val)
@@ -595,21 +612,19 @@ static void tg3_switch_clocks(struct tg3 *tp)
        if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS) {
                if (orig_clock_ctrl & CLOCK_CTRL_625_CORE) {
-                        tw32_f(TG3PCI_CLOCK_CTRL,
+                        tw32_wait_f(TG3PCI_CLOCK_CTRL,
-                               clock_ctrl | CLOCK_CTRL_625_CORE);
+                                    clock_ctrl | CLOCK_CTRL_625_CORE, 40);
-                        udelay(40);
                }
        } else if ((orig_clock_ctrl & CLOCK_CTRL_44MHZ_CORE) != 0) {
-                tw32_f(TG3PCI_CLOCK_CTRL,
+                tw32_wait_f(TG3PCI_CLOCK_CTRL,
-                     clock_ctrl |
+                            clock_ctrl |
-                     (CLOCK_CTRL_44MHZ_CORE | CLOCK_CTRL_ALTCLK));
+                            (CLOCK_CTRL_44MHZ_CORE | CLOCK_CTRL_ALTCLK),
-                udelay(40);
+                            40);
-                tw32_f(TG3PCI_CLOCK_CTRL,
+                tw32_wait_f(TG3PCI_CLOCK_CTRL,
-                     clock_ctrl | (CLOCK_CTRL_ALTCLK));
+                            clock_ctrl | (CLOCK_CTRL_ALTCLK),
-                udelay(40);
+                            40);
        }
-        tw32_f(TG3PCI_CLOCK_CTRL, clock_ctrl);
+        tw32_wait_f(TG3PCI_CLOCK_CTRL, clock_ctrl, 40);
-        udelay(40);
 }
 #define PHY_BUSY_LOOPS  5000
@@ -1017,39 +1032,50 @@ static void tg3_frob_aux_power(struct tg3 *tp)
        if ((tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT) != 0)
                return;
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) {
+        if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) ||
-                tp_peer = pci_get_drvdata(tp->pdev_peer);
+            (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714)) {
-                if (!tp_peer)
+                struct net_device *dev_peer;
+                dev_peer = pci_get_drvdata(tp->pdev_peer);
+                if (!dev_peer)
                        BUG();
+                tp_peer = netdev_priv(dev_peer);
        }
        if ((tp->tg3_flags & TG3_FLAG_WOL_ENABLE) != 0 ||
            (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0 ||
            (tp_peer->tg3_flags & TG3_FLAG_WOL_ENABLE) != 0 ||
            (tp_peer->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0) {
                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700 ||
                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701) {
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE0 |
+                                    (GRC_LCLCTRL_GPIO_OE0 |
-                              GRC_LCLCTRL_GPIO_OE1 |
+                                     GRC_LCLCTRL_GPIO_OE1 |
-                              GRC_LCLCTRL_GPIO_OE2 |
+                                     GRC_LCLCTRL_GPIO_OE2 |
-                              GRC_LCLCTRL_GPIO_OUTPUT0 |
+                                     GRC_LCLCTRL_GPIO_OUTPUT0 |
-                              GRC_LCLCTRL_GPIO_OUTPUT1));
+                                     GRC_LCLCTRL_GPIO_OUTPUT1),
-                        udelay(100);
+                                    100);
                } else {
                        u32 no_gpio2;
-                        u32 grc_local_ctrl;
+                        u32 grc_local_ctrl = 0;
                        if (tp_peer != tp &&
                            (tp_peer->tg3_flags & TG3_FLAG_INIT_COMPLETE) != 0)
                                return;
+                        /* Workaround to prevent overdrawing Amps. */
+                        if (GET_ASIC_REV(tp->pci_chip_rev_id) ==
+                            ASIC_REV_5714) {
+                                grc_local_ctrl |= GRC_LCLCTRL_GPIO_OE3;
+                                tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                            grc_local_ctrl, 100);
+                        }
                        /* On 5753 and variants, GPIO2 cannot be used. */
                        no_gpio2 = tp->nic_sram_data_cfg &
                                    NIC_SRAM_DATA_CFG_NO_GPIO2;
-                        grc_local_ctrl = GRC_LCLCTRL_GPIO_OE0 |
+                        grc_local_ctrl |= GRC_LCLCTRL_GPIO_OE0 |
                                         GRC_LCLCTRL_GPIO_OE1 |
                                         GRC_LCLCTRL_GPIO_OE2 |
                                         GRC_LCLCTRL_GPIO_OUTPUT1 |
@@ -1058,21 +1084,18 @@ static void tg3_frob_aux_power(struct tg3 *tp)
                                grc_local_ctrl &= ~(GRC_LCLCTRL_GPIO_OE2 |
                                                    GRC_LCLCTRL_GPIO_OUTPUT2);
                        }
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                                                grc_local_ctrl);
+                                                    grc_local_ctrl, 100);
-                        udelay(100);
                        grc_local_ctrl |= GRC_LCLCTRL_GPIO_OUTPUT0;
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                                                grc_local_ctrl);
+                                                    grc_local_ctrl, 100);
-                        udelay(100);
                        if (!no_gpio2) {
                                grc_local_ctrl &= ~GRC_LCLCTRL_GPIO_OUTPUT2;
-                                tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                                       grc_local_ctrl);
+                                            grc_local_ctrl, 100);
-                                udelay(100);
                        }
                }
        } else {
@@ -1082,19 +1105,16 @@ static void tg3_frob_aux_power(struct tg3 *tp)
                            (tp_peer->tg3_flags & TG3_FLAG_INIT_COMPLETE) != 0)
                                return;
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE1 |
+                                    (GRC_LCLCTRL_GPIO_OE1 |
-                              GRC_LCLCTRL_GPIO_OUTPUT1));
+                                     GRC_LCLCTRL_GPIO_OUTPUT1), 100);
-                        udelay(100);
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE1));
+                                    GRC_LCLCTRL_GPIO_OE1, 100);
-                        udelay(100);
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE1 |
+                                    (GRC_LCLCTRL_GPIO_OE1 |
-                              GRC_LCLCTRL_GPIO_OUTPUT1));
+                                     GRC_LCLCTRL_GPIO_OUTPUT1), 100);
-                        udelay(100);
                }
        }
 }
@@ -1137,10 +1157,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                udelay(100);    /* Delay after power state change */
                /* Switch out of Vaux if it is not a LOM */
-                if (!(tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT)) {
+                if (!(tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT))
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl, 100);
-                        udelay(100);
-                }
                return 0;
@@ -1239,10 +1257,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                base_val |= (CLOCK_CTRL_RXCLK_DISABLE |
                             CLOCK_CTRL_TXCLK_DISABLE);
-                tw32_f(TG3PCI_CLOCK_CTRL, base_val |
+                tw32_wait_f(TG3PCI_CLOCK_CTRL, base_val | CLOCK_CTRL_ALTCLK |
-                     CLOCK_CTRL_ALTCLK |
+                            CLOCK_CTRL_PWRDOWN_PLL133, 40);
-                     CLOCK_CTRL_PWRDOWN_PLL133);
-                udelay(40);
        } else if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS) {
                /* do nothing */
        } else if (!((tp->tg3_flags2 & TG3_FLG2_5750_PLUS) &&
@@ -1263,11 +1279,11 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                        newbits2 = newbits1 | CLOCK_CTRL_44MHZ_CORE;
                }
-                tw32_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits1);
+                tw32_wait_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits1,
-                udelay(40);
+                            40);
-                tw32_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits2);
+                tw32_wait_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits2,
-                udelay(40);
+                            40);
                if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
                        u32 newbits3;
@@ -1281,9 +1297,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                                newbits3 = CLOCK_CTRL_44MHZ_CORE;
                        }
-                        tw32_f(TG3PCI_CLOCK_CTRL,
+                        tw32_wait_f(TG3PCI_CLOCK_CTRL,
-                                         tp->pci_clock_ctrl | newbits3);
+                                    tp->pci_clock_ctrl | newbits3, 40);
-                        udelay(40);
                }
        }
@@ -1294,7 +1309,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                        tg3_writephy(tp, MII_TG3_EXT_CTRL,
                                     MII_TG3_EXT_CTRL_FORCE_LED_OFF);
                        tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x01b2);
-                        tg3_writephy(tp, MII_BMCR, BMCR_PDOWN);
+                        if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5700)
+                                tg3_writephy(tp, MII_BMCR, BMCR_PDOWN);
                }
        }
@@ -7135,8 +7151,13 @@ do {	p = (u32 *)(orig_p + (reg));		\
        GET_REG32_LOOP(BUFMGR_MODE, 0x58);
        GET_REG32_LOOP(RDMAC_MODE, 0x08);
        GET_REG32_LOOP(WDMAC_MODE, 0x08);
-        GET_REG32_LOOP(RX_CPU_BASE, 0x280);
+        GET_REG32_1(RX_CPU_MODE);
-        GET_REG32_LOOP(TX_CPU_BASE, 0x280);
+        GET_REG32_1(RX_CPU_STATE);
+        GET_REG32_1(RX_CPU_PGMCTR);
+        GET_REG32_1(RX_CPU_HWBKPT);
+        GET_REG32_1(TX_CPU_MODE);
+        GET_REG32_1(TX_CPU_STATE);
+        GET_REG32_1(TX_CPU_PGMCTR);
        GET_REG32_LOOP(GRCMBOX_INTERRUPT_0, 0x110);
        GET_REG32_LOOP(FTQ_RESET, 0x120);
        GET_REG32_LOOP(MSGINT_MODE, 0x0c);
@@ -7959,13 +7980,12 @@ static int tg3_test_memory(struct tg3 *tp)
                u32 offset;
                u32 len;
        } mem_tbl_570x[] = {
-                { 0x00000000, 0x01000},
+                { 0x00000000, 0x00b50},
                { 0x00002000, 0x1c000},
                { 0xffffffff, 0x00000}
        }, mem_tbl_5705[] = {
                { 0x00000100, 0x0000c},
                { 0x00000200, 0x00008},
-                { 0x00000b50, 0x00400},
                { 0x00004000, 0x00800},
                { 0x00006000, 0x01000},
                { 0x00008000, 0x02000},
@@ -10466,7 +10486,7 @@ static char * __devinit tg3_bus_string(struct tg3 *tp, char *str)
        return str;
 }
-static struct pci_dev * __devinit tg3_find_5704_peer(struct tg3 *tp)
+static struct pci_dev * __devinit tg3_find_peer(struct tg3 *tp)
 {
        struct pci_dev *peer;
        unsigned int func, devnr = tp->pdev->devfn & ~7;
@@ -10719,8 +10739,9 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                tp->rx_pending = 63;
        }
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704)
+        if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) ||
-                tp->pdev_peer = tg3_find_5704_peer(tp);
+            (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714))
+                tp->pdev_peer = tg3_find_peer(tp);
        err = tg3_get_device_address(tp);
        if (err) {
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 94dbcf3537ec..890e1635996b 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -1124,7 +1124,14 @@
 /* 0x280 --> 0x400 unused */
 #define RX_CPU_BASE                     0x00005000
+#define RX_CPU_MODE                     0x00005000
+#define RX_CPU_STATE                    0x00005004
+#define RX_CPU_PGMCTR                   0x0000501c
+#define RX_CPU_HWBKPT                   0x00005034
 #define TX_CPU_BASE                     0x00005400
+#define TX_CPU_MODE                     0x00005400
+#define TX_CPU_STATE                    0x00005404
+#define TX_CPU_PGMCTR                   0x0000541c
 /* Mailboxes */
 #define GRCMBOX_INTERRUPT_0             0x00005800 /* 64-bit */
diff --git a/drivers/net/wireless/orinoco_nortel.c b/drivers/net/wireless/orinoco_nortel.c
index d8afd51ff8a5..d1a670b35338 100644
--- a/drivers/net/wireless/orinoco_nortel.c
+++ b/drivers/net/wireless/orinoco_nortel.c
@@ -1,6 +1,8 @@
 /* orinoco_nortel.c
 * 
 * Driver for Prism II devices which would usually be driven by orinoco_cs,
+ * but are connected to the PCI bus by a PCI-to-PCMCIA adapter used in
+ * Nortel emobility, Symbol LA-4113 and Symbol LA-4123.
 * but are connected to the PCI bus by a Nortel PCI-PCMCIA-Adapter. 
 *
 * Copyright (C) 2002 Tobias Hoffmann
@@ -165,7 +167,7 @@ static int nortel_pci_init_one(struct pci_dev *pdev,
                goto fail_resources;
        }
-        iomem = pci_iomap(pdev, 3, 0);
+        iomem = pci_iomap(pdev, 2, 0);
        if (!iomem) {
                err = -ENOMEM;
                goto fail_map_io;
@@ -265,6 +267,8 @@ static void __devexit nortel_pci_remove_one(struct pci_dev *pdev)
 static struct pci_device_id nortel_pci_id_table[] = {
        /* Nortel emobility PCI */
        {0x126c, 0x8030, PCI_ANY_ID, PCI_ANY_ID,},
+        /* Symbol LA-4123 PCI */
+        {0x1562, 0x0001, PCI_ANY_ID, PCI_ANY_ID,},
        {0,},
 };
diff --git a/drivers/s390/net/qeth_eddp.c b/drivers/s390/net/qeth_eddp.c
index 011915d5e243..f94f1f25eec6 100644
--- a/drivers/s390/net/qeth_eddp.c
+++ b/drivers/s390/net/qeth_eddp.c
@@ -62,7 +62,8 @@ qeth_eddp_free_context(struct qeth_eddp_context *ctx)
        for (i = 0; i < ctx->num_pages; ++i)
                free_page((unsigned long)ctx->pages[i]);
        kfree(ctx->pages);
-        kfree(ctx->elements);
+        if (ctx->elements != NULL)
+                kfree(ctx->elements);
        kfree(ctx);
 }
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 99cceb242ec4..f8f55cc468ba 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -1,6 +1,6 @@
 /*
 *
- * linux/drivers/s390/net/qeth_main.c ($Revision: 1.242 $)
+ * linux/drivers/s390/net/qeth_main.c ($Revision: 1.251 $)
 *
 * Linux on zSeries OSA Express and HiperSockets support
 *
@@ -12,7 +12,7 @@
 *                        Frank Pavlic (fpavlic@de.ibm.com) and
 *                        Thomas Spatzier <tspat@de.ibm.com>
 *
- *    $Revision: 1.242 $         $Date: 2005/05/04 20:19:18 $
+ *    $Revision: 1.251 $         $Date: 2005/05/04 20:19:18 $
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -72,7 +72,7 @@
 #include "qeth_eddp.h"
 #include "qeth_tso.h"
-#define VERSION_QETH_C "$Revision: 1.242 $"
+#define VERSION_QETH_C "$Revision: 1.251 $"
 static const char *version = "qeth S/390 OSA-Express driver";
 /**
@@ -518,7 +518,8 @@ __qeth_set_offline(struct ccwgroup_device *cgdev, int recovery_mode)
        QETH_DBF_TEXT(setup, 3, "setoffl");
        QETH_DBF_HEX(setup, 3, &card, sizeof(void *));
+        
+        netif_carrier_off(card->dev);
        recover_flag = card->state;
        if (qeth_stop_card(card, recovery_mode) == -ERESTARTSYS){
                PRINT_WARN("Stopping card %s interrupted by user!\n",
@@ -1020,7 +1021,6 @@ void
 qeth_schedule_recovery(struct qeth_card *card)
 {
        QETH_DBF_TEXT(trace,2,"startrec");
        if (qeth_set_thread_start_bit(card, QETH_RECOVER_THREAD) == 0)
                schedule_work(&card->kernel_thread_starter);
 }
@@ -1710,7 +1710,6 @@ qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
                                           "IP address reset.\n",
                                           QETH_CARD_IFNAME(card),
                                           card->info.chpid);
-                                netif_carrier_on(card->dev);
                                qeth_schedule_recovery(card);
                                return NULL;
                        case IPA_CMD_MODCCID:
@@ -1959,7 +1958,7 @@ qeth_osn_send_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob,
 {
        u16 s1, s2;
-QETH_DBF_TEXT(trace,4,"osndipa");
+        QETH_DBF_TEXT(trace,4,"osndipa");
        qeth_prepare_ipa_cmd(card, iob, QETH_PROT_OSN2);
        s1 = (u16)(IPA_PDU_HEADER_SIZE + data_len);
@@ -2203,24 +2202,21 @@ qeth_ulp_setup(struct qeth_card *card)
 }
 static inline int
-qeth_check_for_inbound_error(struct qeth_qdio_buffer *buf,
+qeth_check_qdio_errors(struct qdio_buffer *buf, unsigned int qdio_error,
-                             unsigned int qdio_error,
+                       unsigned int siga_error, const char *dbftext)
-                             unsigned int siga_error)
 {
-        int rc = 0;
        if (qdio_error || siga_error) {
-                QETH_DBF_TEXT(trace, 2, "qdinerr");
+                QETH_DBF_TEXT(trace, 2, dbftext);
-                QETH_DBF_TEXT(qerr, 2, "qdinerr");
+                QETH_DBF_TEXT(qerr, 2, dbftext);
                QETH_DBF_TEXT_(qerr, 2, " F15=%02X",
-                               buf->buffer->element[15].flags & 0xff);
+                               buf->element[15].flags & 0xff);
                QETH_DBF_TEXT_(qerr, 2, " F14=%02X",
-                               buf->buffer->element[14].flags & 0xff);
+                               buf->element[14].flags & 0xff);
                QETH_DBF_TEXT_(qerr, 2, " qerr=%X", qdio_error);
                QETH_DBF_TEXT_(qerr, 2, " serr=%X", siga_error);
-                rc = 1;
+                return 1;
        }
-        return rc;
+        return 0;
 }
 static inline struct sk_buff *
@@ -2769,8 +2765,9 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
        for (i = first_element; i < (first_element + count); ++i) {
                index = i % QDIO_MAX_BUFFERS_PER_Q;
                buffer = &card->qdio.in_q->bufs[index];
-                if (!((status == QDIO_STATUS_LOOK_FOR_ERROR) &&
+                if (!((status & QDIO_STATUS_LOOK_FOR_ERROR) &&
-                      qeth_check_for_inbound_error(buffer, qdio_err, siga_err)))
+                      qeth_check_qdio_errors(buffer->buffer, 
+                                             qdio_err, siga_err,"qinerr")))
                        qeth_process_inbound_buffer(card, buffer, index);
                /* clear buffer and give back to hardware */
                qeth_put_buffer_pool_entry(card, buffer->pool_entry);
@@ -2785,12 +2782,13 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
 static inline int
 qeth_handle_send_error(struct qeth_card *card,
                       struct qeth_qdio_out_buffer *buffer,
-                       int qdio_err, int siga_err)
+                       unsigned int qdio_err, unsigned int siga_err)
 {
        int sbalf15 = buffer->buffer->element[15].flags & 0xff;
        int cc = siga_err & 3;
        QETH_DBF_TEXT(trace, 6, "hdsnderr");
+        qeth_check_qdio_errors(buffer->buffer, qdio_err, siga_err, "qouterr");
        switch (cc) {
        case 0:
                if (qdio_err){
@@ -3047,7 +3045,8 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
        for(i = first_element; i < (first_element + count); ++i){
                buffer = &queue->bufs[i % QDIO_MAX_BUFFERS_PER_Q];
                /*we only handle the KICK_IT error by doing a recovery */
-                if (qeth_handle_send_error(card, buffer, qdio_error, siga_error)
+                if (qeth_handle_send_error(card, buffer,
+                                           qdio_error, siga_error)
                                == QETH_SEND_ERROR_KICK_IT){
                        netif_stop_queue(card->dev);
                        qeth_schedule_recovery(card);
@@ -3289,7 +3288,6 @@ qeth_init_qdio_info(struct qeth_card *card)
        card->qdio.in_buf_pool.buf_count = card->qdio.init_pool.buf_count;
        INIT_LIST_HEAD(&card->qdio.in_buf_pool.entry_list);
        INIT_LIST_HEAD(&card->qdio.init_pool.entry_list);
-        /* outbound */
 }
 static int
@@ -3731,6 +3729,9 @@ qeth_verify_vlan_dev(struct net_device *dev, struct qeth_card *card)
                        break;
                }
        }
+        if (rc && !(VLAN_DEV_INFO(dev)->real_dev->priv == (void *)card))
+                return 0;
 #endif
        return rc;
 }
@@ -3807,10 +3808,8 @@ qeth_open(struct net_device *dev)
        card->data.state = CH_STATE_UP;
        card->state = CARD_STATE_UP;
-        if (!card->lan_online){
+        if (!card->lan_online && netif_carrier_ok(dev))
-                if (netif_carrier_ok(dev))
+                netif_carrier_off(dev);
-                        netif_carrier_off(dev);
-        }
        return 0;
 }
@@ -5870,10 +5869,8 @@ qeth_add_multicast_ipv6(struct qeth_card *card)
        struct inet6_dev *in6_dev;
        QETH_DBF_TEXT(trace,4,"chkmcv6");
-        if ((card->options.layer2 == 0) &&
+        if (!qeth_is_supported(card, IPA_IPV6)) 
-            (!qeth_is_supported(card, IPA_IPV6)) )
                return ;
        in6_dev = in6_dev_get(card->dev);
        if (in6_dev == NULL)
                return;
@@ -7936,8 +7933,8 @@ __qeth_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                QETH_DBF_TEXT_(setup, 2, "6err%d", rc);
                goto out_remove;
        }
-/*maybe it was set offline without ifconfig down
+        netif_carrier_on(card->dev);
- * we can also use this state for recovery purposes*/
        qeth_set_allowed_threads(card, 0xffffffff, 0);
        if (recover_flag == CARD_STATE_RECOVER)
                qeth_start_again(card, recovery_mode);
diff --git a/drivers/s390/net/qeth_mpc.c b/drivers/s390/net/qeth_mpc.c
index f0a080a9e515..5f8754addc14 100644
--- a/drivers/s390/net/qeth_mpc.c
+++ b/drivers/s390/net/qeth_mpc.c
@@ -11,7 +11,7 @@
 #include <asm/cio.h>
 #include "qeth_mpc.h"
-const char *VERSION_QETH_MPC_C = "$Revision: 1.12 $";
+const char *VERSION_QETH_MPC_C = "$Revision: 1.13 $";
 unsigned char IDX_ACTIVATE_READ[]={
        0x00,0x00,0x80,0x00, 0x00,0x00,0x00,0x00,
diff --git a/drivers/s390/net/qeth_mpc.h b/drivers/s390/net/qeth_mpc.h
index 5f71486e708c..864cec5f6c62 100644
--- a/drivers/s390/net/qeth_mpc.h
+++ b/drivers/s390/net/qeth_mpc.h
@@ -14,14 +14,14 @@
 #include <asm/qeth.h>
-#define VERSION_QETH_MPC_H "$Revision: 1.44 $"
+#define VERSION_QETH_MPC_H "$Revision: 1.46 $"
 extern const char *VERSION_QETH_MPC_C;
 #define IPA_PDU_HEADER_SIZE     0x40
 #define QETH_IPA_PDU_LEN_TOTAL(buffer) (buffer+0x0e)
 #define QETH_IPA_PDU_LEN_PDU1(buffer) (buffer+0x26)
-#define QETH_IPA_PDU_LEN_PDU2(buffer) (buffer+0x2a)
+#define QETH_IPA_PDU_LEN_PDU2(buffer) (buffer+0x29)
 #define QETH_IPA_PDU_LEN_PDU3(buffer) (buffer+0x3a)
 extern unsigned char IPA_PDU_HEADER[];
diff --git a/drivers/s390/net/qeth_proc.c b/drivers/s390/net/qeth_proc.c
index f2ccfea8fdb8..7bf35098831e 100644
--- a/drivers/s390/net/qeth_proc.c
+++ b/drivers/s390/net/qeth_proc.c
@@ -1,6 +1,6 @@
 /*
 *
- * linux/drivers/s390/net/qeth_fs.c ($Revision: 1.13 $)
+ * linux/drivers/s390/net/qeth_fs.c ($Revision: 1.16 $)
 *
 * Linux on zSeries OSA Express and HiperSockets support
 * This file contains code related to procfs.
@@ -21,7 +21,7 @@
 #include "qeth_mpc.h"
 #include "qeth_fs.h"
-const char *VERSION_QETH_PROC_C = "$Revision: 1.13 $";
+const char *VERSION_QETH_PROC_C = "$Revision: 1.16 $";
 /***** /proc/qeth *****/
 #define QETH_PROCFILE_NAME "qeth"
@@ -30,30 +30,26 @@ static struct proc_dir_entry *qeth_procfile;
 static int
 qeth_procfile_seq_match(struct device *dev, void *data)
 {
-        return 1;
+        return(dev ? 1 : 0);
 }
 static void *
 qeth_procfile_seq_start(struct seq_file *s, loff_t *offset)
 {
-        struct device *dev;
+        struct device *dev = NULL;
-        loff_t nr;
+        loff_t nr = 0;
+        
        down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
+        if (*offset == 0)
-        nr = *offset;
-        if (nr == 0)
                return SEQ_START_TOKEN;
+        while (1) {
-        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL,
-                                 NULL, qeth_procfile_seq_match);
-        /* get card at pos *offset */
-        nr = *offset;
-        while (nr-- > 1 && dev)
                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
                                         NULL, qeth_procfile_seq_match);
-        return (void *) dev;
+                if (++nr == *offset)
+                        break;
+                put_device(dev);
+        }
+        return dev;
 }
 static void
@@ -66,19 +62,14 @@ static void *
 qeth_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
 {
        struct device *prev, *next;
+        
-        if (it == SEQ_START_TOKEN) {
+        if (it == SEQ_START_TOKEN) 
-                next = driver_find_device(&qeth_ccwgroup_driver.driver,
+                prev = NULL;
-                                          NULL, NULL, qeth_procfile_seq_match);
+        else
-                if (next)
+                prev = (struct device *) it;
-                        (*offset)++;
-                return (void *) next;
-        }
-        prev = (struct device *) it;
        next = driver_find_device(&qeth_ccwgroup_driver.driver,
                                  prev, NULL, qeth_procfile_seq_match);
-        if (next)
+        (*offset)++;
-                (*offset)++;
        return (void *) next;
 }
@@ -87,7 +78,7 @@ qeth_get_router_str(struct qeth_card *card, int ipv)
 {
        int routing_type = 0;
-        if (ipv == 4){
+        if (ipv == 4) {
                routing_type = card->options.route4.type;
        } else {
 #ifdef CONFIG_QETH_IPV6
@@ -154,6 +145,7 @@ qeth_procfile_seq_show(struct seq_file *s, void *it)
                                        card->qdio.in_buf_pool.buf_count);
                else
                        seq_printf(s, "  +++ LAN OFFLINE +++\n");
+                put_device(device);
        }
        return 0;
 }
@@ -184,51 +176,16 @@ static struct file_operations qeth_procfile_fops = {
 static struct proc_dir_entry *qeth_perf_procfile;
 #ifdef CONFIG_QETH_PERF_STATS
-static void *
-qeth_perf_procfile_seq_start(struct seq_file *s, loff_t *offset)
-{
-        struct device *dev = NULL;
-        int nr;
-        down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-        /* get card at pos *offset */
-        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
-                                 qeth_procfile_seq_match);
-        /* get card at pos *offset */
-        nr = *offset;
-        while (nr-- > 1 && dev)
-                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
-                                         NULL, qeth_procfile_seq_match);
-        return (void *) dev;
-}
-static void
-qeth_perf_procfile_seq_stop(struct seq_file *s, void* it)
-{
-        up_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-}
-static void *
-qeth_perf_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
-{
-        struct device *prev, *next;
-        prev = (struct device *) it;
-        next = driver_find_device(&qeth_ccwgroup_driver.driver, prev,
-                                  NULL, qeth_procfile_seq_match);
-        if (next)
-                (*offset)++;
-        return (void *) next;
-}
 static int
 qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
 {
        struct device *device;
        struct qeth_card *card;
+        
+        if (it == SEQ_START_TOKEN)
+                return 0;
        device = (struct device *) it;
        card = device->driver_data;
        seq_printf(s, "For card with devnos %s/%s/%s (%s):\n",
@@ -295,13 +252,14 @@ qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
                        card->perf_stats.outbound_do_qdio_time,
                        card->perf_stats.outbound_do_qdio_cnt
                  );
+        put_device(device);
        return 0;
 }
 static struct seq_operations qeth_perf_procfile_seq_ops = {
-        .start = qeth_perf_procfile_seq_start,
+        .start = qeth_procfile_seq_start,
-        .stop  = qeth_perf_procfile_seq_stop,
+        .stop  = qeth_procfile_seq_stop,
-        .next  = qeth_perf_procfile_seq_next,
+        .next  = qeth_procfile_seq_next,
        .show  = qeth_perf_procfile_seq_show,
 };
@@ -324,93 +282,6 @@ static struct file_operations qeth_perf_procfile_fops = {
 #define qeth_perf_procfile_created 1
 #endif /* CONFIG_QETH_PERF_STATS */
-/***** /proc/qeth_ipa_takeover *****/
-#define QETH_IPATO_PROCFILE_NAME "qeth_ipa_takeover"
-static struct proc_dir_entry *qeth_ipato_procfile;
-static void *
-qeth_ipato_procfile_seq_start(struct seq_file *s, loff_t *offset)
-{
-        struct device *dev;
-        loff_t nr;
-        down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-        /* TODO: finish this */
-        /*
-         * maybe SEQ_SATRT_TOKEN can be returned for offset 0
-         * output driver settings then;
-         * else output setting for respective card
-         */
-        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
-                                 qeth_procfile_seq_match);
-        /* get card at pos *offset */
-        nr = *offset;
-        while (nr-- > 1 && dev)
-                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
-                                         NULL, qeth_procfile_seq_match);
-        return (void *) dev;
-}
-static void
-qeth_ipato_procfile_seq_stop(struct seq_file *s, void* it)
-{
-        up_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-}
-static void *
-qeth_ipato_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
-{
-        struct device *prev, *next;
-        prev = (struct device *) it;
-        next = driver_find_device(&qeth_ccwgroup_driver.driver, prev,
-                                  NULL, qeth_procfile_seq_match);
-        if (next)
-                (*offset)++;
-        return (void *) next;
-}
-static int
-qeth_ipato_procfile_seq_show(struct seq_file *s, void *it)
-{
-        struct device *device;
-        struct qeth_card *card;
-        /* TODO: finish this */
-        /*
-         * maybe SEQ_SATRT_TOKEN can be returned for offset 0
-         * output driver settings then;
-         * else output setting for respective card
-         */
-        device = (struct device *) it;
-        card = device->driver_data;
-        return 0;
-}
-static struct seq_operations qeth_ipato_procfile_seq_ops = {
-        .start = qeth_ipato_procfile_seq_start,
-        .stop  = qeth_ipato_procfile_seq_stop,
-        .next  = qeth_ipato_procfile_seq_next,
-        .show  = qeth_ipato_procfile_seq_show,
-};
-static int
-qeth_ipato_procfile_open(struct inode *inode, struct file *file)
-{
-        return seq_open(file, &qeth_ipato_procfile_seq_ops);
-}
-static struct file_operations qeth_ipato_procfile_fops = {
-        .owner   = THIS_MODULE,
-        .open    = qeth_ipato_procfile_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = seq_release,
-};
 int __init
 qeth_create_procfs_entries(void)
 {
@@ -426,13 +297,7 @@ qeth_create_procfs_entries(void)
                qeth_perf_procfile->proc_fops = &qeth_perf_procfile_fops;
 #endif /* CONFIG_QETH_PERF_STATS */
-        qeth_ipato_procfile = create_proc_entry(QETH_IPATO_PROCFILE_NAME,
-                                           S_IFREG | 0444, NULL);
-        if (qeth_ipato_procfile)
-                qeth_ipato_procfile->proc_fops = &qeth_ipato_procfile_fops;
        if (qeth_procfile &&
-            qeth_ipato_procfile &&
            qeth_perf_procfile_created)
                return 0;
        else
@@ -446,62 +311,5 @@ qeth_remove_procfs_entries(void)
                remove_proc_entry(QETH_PROCFILE_NAME, NULL);
        if (qeth_perf_procfile)
                remove_proc_entry(QETH_PERF_PROCFILE_NAME, NULL);
-        if (qeth_ipato_procfile)
-                remove_proc_entry(QETH_IPATO_PROCFILE_NAME, NULL);
 }
-/* ONLY FOR DEVELOPMENT! -> make it as module */
-/*
-static void
-qeth_create_sysfs_entries(void)
-{
-        struct device *dev;
-        down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-        list_for_each_entry(dev, &qeth_ccwgroup_driver.driver.devices,
-                        driver_list)
-                qeth_create_device_attributes(dev);
-        up_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-}
-static void
-qeth_remove_sysfs_entries(void)
-{
-        struct device *dev;
-        down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-        list_for_each_entry(dev, &qeth_ccwgroup_driver.driver.devices,
-                        driver_list)
-                qeth_remove_device_attributes(dev);
-        up_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-}
-static int __init
-qeth_fs_init(void)
-{
-        printk(KERN_INFO "qeth_fs_init\n");
-        qeth_create_procfs_entries();
-        qeth_create_sysfs_entries();
-        return 0;
-}
-static void __exit
-qeth_fs_exit(void)
-{
-        printk(KERN_INFO "qeth_fs_exit\n");
-        qeth_remove_procfs_entries();
-        qeth_remove_sysfs_entries();
-}
-module_init(qeth_fs_init);
-module_exit(qeth_fs_exit);
-MODULE_LICENSE("GPL");
-*/
diff --git a/drivers/s390/net/qeth_sys.c b/drivers/s390/net/qeth_sys.c
index ddd6019ba092..0ea185f70f75 100644
--- a/drivers/s390/net/qeth_sys.c
+++ b/drivers/s390/net/qeth_sys.c
@@ -1,6 +1,6 @@
 /*
 *
- * linux/drivers/s390/net/qeth_sys.c ($Revision: 1.58 $)
+ * linux/drivers/s390/net/qeth_sys.c ($Revision: 1.60 $)
 *
 * Linux on zSeries OSA Express and HiperSockets support
 * This file contains code related to sysfs.
@@ -20,7 +20,7 @@
 #include "qeth_mpc.h"
 #include "qeth_fs.h"
-const char *VERSION_QETH_SYS_C = "$Revision: 1.58 $";
+const char *VERSION_QETH_SYS_C = "$Revision: 1.60 $";
 /*****************************************************************************/
 /*                                                                           */
@@ -160,7 +160,7 @@ qeth_dev_portname_store(struct device *dev, struct device_attribute *attr, const
                return -EPERM;
        tmp = strsep((char **) &buf, "\n");
-        if ((strlen(tmp) > 8) || (strlen(tmp) < 2))
+        if ((strlen(tmp) > 8) || (strlen(tmp) == 0))
                return -EINVAL;
        card->info.portname[0] = strlen(tmp);
diff --git a/drivers/s390/net/qeth_tso.h b/drivers/s390/net/qeth_tso.h
index e245af3c4cbd..3c50b6f24f51 100644
--- a/drivers/s390/net/qeth_tso.h
+++ b/drivers/s390/net/qeth_tso.h
@@ -1,5 +1,5 @@
 /*
- * linux/drivers/s390/net/qeth_tso.h ($Revision: 1.7 $)
+ * linux/drivers/s390/net/qeth_tso.h ($Revision: 1.8 $)
 *
 * Header file for qeth TCP Segmentation Offload support.
 *
@@ -7,7 +7,7 @@
 *
 *    Author(s): Frank Pavlic <fpavlic@de.ibm.com>
 *
- *    $Revision: 1.7 $   $Date: 2005/05/04 20:19:18 $
+ *    $Revision: 1.8 $   $Date: 2005/05/04 20:19:18 $
 *
 */
 #ifndef __QETH_TSO_H__
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 72ddba98f8fb..2282c04fee46 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -2044,7 +2044,7 @@ static int atapi_qc_complete(struct ata_queued_cmd *qc, unsigned int err_mask)
        else {
                u8 *scsicmd = cmd->cmnd;
-                if (scsicmd[0] == INQUIRY) {
+                if ((scsicmd[0] == INQUIRY) && ((scsicmd[1] & 0x03) == 0)) {
                        u8 *buf = NULL;
                        unsigned int buflen;
@@ -2058,9 +2058,6 @@ static int atapi_qc_complete(struct ata_queued_cmd *qc, unsigned int err_mask)
         * device.  2) Ensure response data format / ATAPI information
         * are always correct.
         */
-        /* FIXME: do we ever override EVPD pages and the like, with
-         * this code?
-         */
                        if (buf[2] == 0) {
                                buf[2] = 0x5;
                                buf[3] = 0x32;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 94e5167f260d..4e6709f448e1 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -400,6 +400,36 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
        return found_target;
 }
+struct work_queue_wrapper {
+        struct work_struct      work;
+        struct scsi_target      *starget;
+};
+static void scsi_target_reap_work(void *data) {
+        struct work_queue_wrapper *wqw = (struct work_queue_wrapper *)data;
+        struct scsi_target *starget = wqw->starget;
+        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+        unsigned long flags;
+        kfree(wqw);
+        spin_lock_irqsave(shost->host_lock, flags);
+        if (--starget->reap_ref == 0 && list_empty(&starget->devices)) {
+                list_del_init(&starget->siblings);
+                spin_unlock_irqrestore(shost->host_lock, flags);
+                transport_remove_device(&starget->dev);
+                device_del(&starget->dev);
+                transport_destroy_device(&starget->dev);
+                put_device(&starget->dev);
+                return;
+        }
+        spin_unlock_irqrestore(shost->host_lock, flags);
+        return;
+}
 /**
 * scsi_target_reap - check to see if target is in use and destroy if not
 *
@@ -411,19 +441,18 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
 */
 void scsi_target_reap(struct scsi_target *starget)
 {
-        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+        struct work_queue_wrapper *wqw = 
-        unsigned long flags;
+                kzalloc(sizeof(struct work_queue_wrapper), GFP_ATOMIC);
-        spin_lock_irqsave(shost->host_lock, flags);
-        if (--starget->reap_ref == 0 && list_empty(&starget->devices)) {
+        if (!wqw) {
-                list_del_init(&starget->siblings);
+                starget_printk(KERN_ERR, starget,
-                spin_unlock_irqrestore(shost->host_lock, flags);
+                               "Failed to allocate memory in scsi_reap_target()\n");
-                device_del(&starget->dev);
-                transport_unregister_device(&starget->dev);
-                put_device(&starget->dev);
                return;
        }
-        spin_unlock_irqrestore(shost->host_lock, flags);
+        INIT_WORK(&wqw->work, scsi_target_reap_work, wqw);
+        wqw->starget = starget;
+        schedule_work(&wqw->work);
 }
 /**
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 6cd5931d9a54..2a1a99a2ef56 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -105,6 +105,7 @@ static struct {
        { FC_PORTSTATE_LINKDOWN,        "Linkdown" },
        { FC_PORTSTATE_ERROR,           "Error" },
        { FC_PORTSTATE_LOOPBACK,        "Loopback" },
+        { FC_PORTSTATE_DELETED,         "Deleted" },
 };
 fc_enum_name_search(port_state, fc_port_state, fc_port_state_names)
 #define FC_PORTSTATE_MAX_NAMELEN        20
@@ -211,6 +212,7 @@ fc_bitfield_name_search(remote_port_roles, fc_remote_port_role_names)
 #define FC_MGMTSRVR_PORTID              0x00000a
+static void fc_shost_remove_rports(void  *data);
 static void fc_timeout_deleted_rport(void *data);
 static void fc_scsi_scan_rport(void *data);
 static void fc_rport_terminate(struct fc_rport  *rport);
@@ -318,6 +320,8 @@ static int fc_host_setup(struct transport_container *tc, struct device *dev,
        fc_host_next_rport_number(shost) = 0;
        fc_host_next_target_id(shost) = 0;
+        fc_host_flags(shost) = 0;
+        INIT_WORK(&fc_host_rport_del_work(shost), fc_shost_remove_rports, shost);
        return 0;
 }
@@ -387,6 +391,7 @@ show_fc_rport_##field (struct class_device *cdev, char *buf)		\
        struct fc_internal *i = to_fc_internal(shost->transportt);      \
        if ((i->f->get_rport_##field) &&                                \
            !((rport->port_state == FC_PORTSTATE_BLOCKED) ||            \
+              (rport->port_state == FC_PORTSTATE_DELETED) ||            \
              (rport->port_state == FC_PORTSTATE_NOTPRESENT)))          \
                i->f->get_rport_##field(rport);                         \
        return snprintf(buf, sz, format_string, cast rport->field);     \
@@ -402,6 +407,7 @@ store_fc_rport_##field(struct class_device *cdev, const char *buf,	\
        struct Scsi_Host *shost = rport_to_shost(rport);                \
        struct fc_internal *i = to_fc_internal(shost->transportt);      \
        if ((rport->port_state == FC_PORTSTATE_BLOCKED) ||              \
+            (rport->port_state == FC_PORTSTATE_DELETED) ||              \
            (rport->port_state == FC_PORTSTATE_NOTPRESENT))             \
                return -EBUSY;                                          \
        val = simple_strtoul(buf, NULL, 0);                             \
@@ -519,6 +525,7 @@ store_fc_rport_dev_loss_tmo(struct class_device *cdev, const char *buf,
        struct Scsi_Host *shost = rport_to_shost(rport);
        struct fc_internal *i = to_fc_internal(shost->transportt);
        if ((rport->port_state == FC_PORTSTATE_BLOCKED) ||
+            (rport->port_state == FC_PORTSTATE_DELETED) ||
            (rport->port_state == FC_PORTSTATE_NOTPRESENT))
                return -EBUSY;
        val = simple_strtoul(buf, NULL, 0);
@@ -1769,7 +1776,7 @@ fc_timeout_deleted_rport(void  *data)
        rport->maxframe_size = -1;
        rport->supported_classes = FC_COS_UNSPECIFIED;
        rport->roles = FC_RPORT_ROLE_UNKNOWN;
-        rport->port_state = FC_PORTSTATE_NOTPRESENT;
+        rport->port_state = FC_PORTSTATE_DELETED;
        /* remove the identifiers that aren't used in the consisting binding */
        switch (fc_host_tgtid_bind_type(shost)) {
@@ -1789,14 +1796,23 @@ fc_timeout_deleted_rport(void  *data)
                break;
        }
-        spin_unlock_irqrestore(shost->host_lock, flags);
        /*
         * As this only occurs if the remote port (scsi target)
         * went away and didn't come back - we'll remove
         * all attached scsi devices.
+         *
+         * We'll schedule the shost work item to perform the actual removal
+         * to avoid recursion in the different flush calls if we perform
+         * the removal in each target - and there are lots of targets
+         * whose timeouts fire at the same time.
         */
-        fc_rport_tgt_remove(rport);
+        if ( !(fc_host_flags(shost) & FC_SHOST_RPORT_DEL_SCHEDULED)) {
+                fc_host_flags(shost) |= FC_SHOST_RPORT_DEL_SCHEDULED;
+                scsi_queue_work(shost, &fc_host_rport_del_work(shost));
+        }
+        spin_unlock_irqrestore(shost->host_lock, flags);
 }
 /**
@@ -1818,6 +1834,41 @@ fc_scsi_scan_rport(void *data)
 }
+/**
+ * fc_shost_remove_rports - called to remove all rports that are marked
+ *                       as in a deleted (not connected) state.
+ * 
+ * @data:       shost whose rports are to be looked at
+ **/
+static void
+fc_shost_remove_rports(void  *data)
+{
+        struct Scsi_Host *shost = (struct Scsi_Host *)data;
+        struct fc_rport *rport, *next_rport;
+        unsigned long flags;
+        spin_lock_irqsave(shost->host_lock, flags);
+        while (fc_host_flags(shost) & FC_SHOST_RPORT_DEL_SCHEDULED) {
+                fc_host_flags(shost) &= ~FC_SHOST_RPORT_DEL_SCHEDULED;
+restart_search:
+                list_for_each_entry_safe(rport, next_rport,
+                                &fc_host_rport_bindings(shost), peers) {
+                        if (rport->port_state == FC_PORTSTATE_DELETED) {
+                                rport->port_state = FC_PORTSTATE_NOTPRESENT;
+                                spin_unlock_irqrestore(shost->host_lock, flags);
+                                fc_rport_tgt_remove(rport);
+                                spin_lock_irqsave(shost->host_lock, flags);
+                                goto restart_search;
+                        }
+                }
+        }
+        spin_unlock_irqrestore(shost->host_lock, flags);
+}
 MODULE_AUTHOR("Martin Hicks");
 MODULE_DESCRIPTION("FC Transport Attributes");
 MODULE_LICENSE("GPL");
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index ad47c1b84c3f..812bae62c8ec 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -10,7 +10,7 @@ menu "Serial drivers"
 # The new 8250/16550 serial drivers
 config SERIAL_8250
        tristate "8250/16550 and compatible serial support"
-        depends on (BROKEN || !(SPARC64 || SPARC32))
+        depends on (BROKEN || !SPARC)
        select SERIAL_CORE
        ---help---
          This selects whether you want to include the driver for the standard
@@ -469,14 +469,14 @@ config SERIAL_IMX_CONSOLE
 config SERIAL_SUNCORE
        bool
-        depends on SPARC32 || SPARC64
+        depends on SPARC
        select SERIAL_CORE
        select SERIAL_CORE_CONSOLE
        default y
 config SERIAL_SUNZILOG
        tristate "Sun Zilog8530 serial support"
-        depends on SPARC32 || SPARC64
+        depends on SPARC
        help
          This driver supports the Zilog8530 serial ports found on many Sparc
          systems.  Say Y or M if you want to be able to these serial ports.
@@ -491,7 +491,7 @@ config SERIAL_SUNZILOG_CONSOLE
 config SERIAL_SUNSU
        tristate "Sun SU serial support"
-        depends on (SPARC32 || SPARC64) && PCI
+        depends on SPARC && PCI
        help
          This driver supports the 8250 serial ports that run the keyboard and
          mouse on (PCI) UltraSPARC systems.  Say Y or M if you want to be able
@@ -547,7 +547,7 @@ config PDC_CONSOLE
 config SERIAL_SUNSAB
        tristate "Sun Siemens SAB82532 serial support"
-        depends on (SPARC32 || SPARC64) && PCI
+        depends on SPARC && PCI
        help
          This driver supports the Siemens SAB82532 DUSCC serial ports on newer
          (PCI) UltraSPARC systems.  Say Y or M if you want to be able to these
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 89d7bd3eaee3..d84476ee6592 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -160,7 +160,7 @@ pl011_rx_chars(struct uart_amba_port *uap)
                                flag = TTY_FRAME;
                }
-                if (uart_handle_sysrq_char(&uap->port, ch, regs))
+                if (uart_handle_sysrq_char(&uap->port, ch & 255, regs))
                        goto ignore_char;
                uart_insert_char(&uap->port, ch, UART011_DR_OE, ch, flag);
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index ff5e6309d682..cc998b99a19f 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -361,7 +361,7 @@ static int serial_pxa_startup(struct uart_port *port)
        if (port->line == 3) /* HWUART */
                up->mcr |= UART_MCR_AFE;
        else
-        up->mcr = 0;
+                up->mcr = 0;
        /*
         * Allocate the IRQ
@@ -641,7 +641,7 @@ serial_pxa_console_write(struct console *co, const char *s, unsigned int count)
        int i;
        /*
-         *      First save the UER then disable the interrupts
+         *      First save the IER then disable the interrupts
         */
        ier = serial_in(up, UART_IER);
        serial_out(up, UART_IER, UART_IER_UUE);
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index e197ce9353de..e80ef9467825 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -1432,7 +1432,8 @@ static int usb_generic_suspend(struct device *dev, pm_message_t message)
                        mark_quiesced(intf);
        } else {
                // FIXME else if there's no suspend method, disconnect...
-                dev_warn(dev, "no %s?\n", "suspend");
+                dev_warn(dev, "no suspend for driver %s?\n", driver->name);
+                mark_quiesced(intf);
                status = 0;
        }
        return status;
@@ -1460,8 +1461,10 @@ static int usb_generic_resume(struct device *dev)
        }
        if ((dev->driver == NULL) ||
-            (dev->driver_data == &usb_generic_driver_data))
+            (dev->driver_data == &usb_generic_driver_data)) {
+                dev->power.power_state.event = PM_EVENT_FREEZE;
                return 0;
+        }
        intf = to_usb_interface(dev);
        driver = to_usb_driver(dev->driver);
@@ -1481,7 +1484,7 @@ static int usb_generic_resume(struct device *dev)
                        mark_quiesced(intf);
                }
        } else
-                dev_warn(dev, "no %s?\n", "resume");
+                dev_warn(dev, "no resume for driver %s?\n", driver->name);
        return 0;
 }
diff --git a/drivers/usb/input/aiptek.c b/drivers/usb/input/aiptek.c
index 1c3b472a3bca..0e2505c073db 100644
--- a/drivers/usb/input/aiptek.c
+++ b/drivers/usb/input/aiptek.c
@@ -2103,7 +2103,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
         * values.
         */
        input_set_abs_params(inputdev, ABS_X, 0, 2999, 0, 0);
-        input_set_abs_params(inputdev, ABS_X, 0, 2249, 0, 0);
+        input_set_abs_params(inputdev, ABS_Y, 0, 2249, 0, 0);
        input_set_abs_params(inputdev, ABS_PRESSURE, 0, 511, 0, 0);
        input_set_abs_params(inputdev, ABS_TILT_X, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
        input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
diff --git a/drivers/usb/input/kbtab.c b/drivers/usb/input/kbtab.c
index a248664b5d1d..fd48e74e78ed 100644
--- a/drivers/usb/input/kbtab.c
+++ b/drivers/usb/input/kbtab.c
@@ -159,7 +159,7 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
        input_dev->keybit[LONG(BTN_DIGI)] |= BIT(BTN_TOOL_PEN) | BIT(BTN_TOUCH);
        input_dev->mscbit[0] |= BIT(MSC_SERIAL);
        input_set_abs_params(input_dev, ABS_X, 0, 0x2000, 4, 0);
-        input_set_abs_params(input_dev, ABS_X, 0, 0x1750, 4, 0);
+        input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0);
        input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0);
        endpoint = &intf->cur_altsetting->endpoint[0].desc;
diff --git a/drivers/usb/input/wacom.c b/drivers/usb/input/wacom.c
index aea1cfae34cc..dc099bbe12bf 100644
--- a/drivers/usb/input/wacom.c
+++ b/drivers/usb/input/wacom.c
@@ -854,7 +854,7 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
        input_dev->evbit[0] |= BIT(EV_KEY) | BIT(EV_ABS);
        input_dev->keybit[LONG(BTN_DIGI)] |= BIT(BTN_TOOL_PEN) | BIT(BTN_TOUCH) | BIT(BTN_STYLUS);
-        input_set_abs_params(input_dev, ABS_X, 0, wacom->features->y_max, 4, 0);
+        input_set_abs_params(input_dev, ABS_X, 0, wacom->features->x_max, 4, 0);
        input_set_abs_params(input_dev, ABS_Y, 0, wacom->features->y_max, 4, 0);
        input_set_abs_params(input_dev, ABS_PRESSURE, 0, wacom->features->pressure_max, 0, 0);
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 4837524eada7..4ef5527028c5 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -109,7 +109,7 @@ static int slave_configure(struct scsi_device *sdev)
         * data comes from.
         */
        if (sdev->scsi_level < SCSI_2)
-                sdev->scsi_level = SCSI_2;
+                sdev->scsi_level = sdev->sdev_target->scsi_level = SCSI_2;
        /* According to the technical support people at Genesys Logic,
         * devices using their chips have problems transferring more than
@@ -162,7 +162,7 @@ static int slave_configure(struct scsi_device *sdev)
                 * a Get-Max-LUN request, we won't lose much by setting the
                 * revision level down to 2.  The only devices that would be
                 * affected are those with sparse LUNs. */
-                sdev->scsi_level = SCSI_2;
+                sdev->scsi_level = sdev->sdev_target->scsi_level = SCSI_2;
                /* USB-IDE bridges tend to report SK = 0x04 (Non-recoverable
                 * Hardware Error) when any low-level error occurs,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 3e470c8b4193..cc8e3bf5001b 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -536,13 +536,13 @@ config FB_SUN3
 config FB_SBUS
        bool "SBUS and UPA framebuffers"
-        depends on (FB = y) && (SPARC32 || SPARC64)
+        depends on (FB = y) && SPARC
        help
          Say Y if you want support for SBUS or UPA based frame buffer device.
 config FB_BW2
        bool "BWtwo support"
-        depends on (FB = y) && ((SPARC32 || SPARC64) && FB_SBUS || (SUN3 || SUN3X) && FB_SUN3)
+        depends on (FB = y) && (SPARC && FB_SBUS || (SUN3 || SUN3X) && FB_SUN3)
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
@@ -551,7 +551,7 @@ config FB_BW2
 config FB_CG3
        bool "CGthree support"
-        depends on (FB = y) && ((SPARC32 || SPARC64) && FB_SBUS || (SUN3 || SUN3X) && FB_SUN3)
+        depends on (FB = y) && (SPARC && FB_SBUS || (SUN3 || SUN3X) && FB_SUN3)
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
@@ -560,7 +560,7 @@ config FB_CG3
 config FB_CG6
        bool "CGsix (GX,TurboGX) support"
-        depends on (FB = y) && ((SPARC32 || SPARC64) && FB_SBUS || (SUN3 || SUN3X) && FB_SUN3)
+        depends on (FB = y) && (SPARC && FB_SBUS || (SUN3 || SUN3X) && FB_SUN3)
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
        help
@@ -1268,7 +1268,7 @@ config FB_LEO
 config FB_PCI
        bool "PCI framebuffers"
-        depends on (FB = y) && PCI && (SPARC64 || SPARC32)
+        depends on (FB = y) && PCI && SPARC
 config FB_IGA
        bool "IGA 168x display support"
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index 5f74df993406..a5d09e159cd1 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -6,7 +6,7 @@ menu "Console display driver support"
 config VGA_CONSOLE
        bool "VGA text console" if EMBEDDED || !X86
-        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC32 && !SPARC64 && !M68K && !PARISC && !ARCH_VERSATILE
+        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC && !M68K && !PARISC && !ARCH_VERSATILE
        default y
        help
          Saying Y here will allow you to use Linux in text mode through a
@@ -68,7 +68,7 @@ config SGI_NEWPORT_CONSOLE
 config PROM_CONSOLE
        bool "PROM console"
-        depends on SPARC32 || SPARC64
+        depends on SPARC
        help
          Say Y to build a console driver for Sun machines that uses the
          terminal emulation built into their console PROMS.
@@ -136,7 +136,7 @@ config FONTS
 config FONT_8x8
        bool "VGA 8x8 font" if FONTS
        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
-        default y if !SPARC32 && !SPARC64 && !FONTS
+        default y if !SPARC && !FONTS
        help
          This is the "high resolution" font for the VGA frame buffer (the one
          provided by the text console 80x50 (and higher) modes).
@@ -150,7 +150,7 @@ config FONT_8x8
 config FONT_8x16
        bool "VGA 8x16 font" if FONTS
        depends on FRAMEBUFFER_CONSOLE || SGI_NEWPORT_CONSOLE=y || STI_CONSOLE || USB_SISUSBVGA_CON 
-        default y if !SPARC32 && !SPARC64 && !FONTS
+        default y if !SPARC && !FONTS
        help
          This is the "high resolution" font for the VGA frame buffer (the one
          provided by the VGA text console 80x25 mode.
@@ -160,7 +160,7 @@ config FONT_8x16
 config FONT_6x11
        bool "Mac console 6x11 font (not supported by all drivers)" if FONTS
        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
-        default y if !SPARC32 && !SPARC64 && !FONTS && MAC
+        default y if !SPARC && !FONTS && MAC
        help
          Small console font with Macintosh-style high-half glyphs.  Some Mac
          framebuffer drivers don't support this one at all.
@@ -176,7 +176,7 @@ config FONT_7x14
 config FONT_PEARL_8x8
        bool "Pearl (old m68k) console 8x8 font" if FONTS
        depends on FRAMEBUFFER_CONSOLE
-        default y if !SPARC32 && !SPARC64 && !FONTS && AMIGA
+        default y if !SPARC && !FONTS && AMIGA
        help
          Small console font with PC-style control-character and high-half
          glyphs.
@@ -184,24 +184,24 @@ config FONT_PEARL_8x8
 config FONT_ACORN_8x8
        bool "Acorn console 8x8 font" if FONTS
        depends on FRAMEBUFFER_CONSOLE
-        default y if !SPARC32 && !SPARC64 && !FONTS && ARM && ARCH_ACORN
+        default y if !SPARC && !FONTS && ARM && ARCH_ACORN
        help
          Small console font with PC-style control characters and high-half
          glyphs.
 config FONT_MINI_4x6
        bool "Mini 4x6 font"
-        depends on !SPARC32 && !SPARC64 && FONTS
+        depends on !SPARC && FONTS
 config FONT_SUN8x16
        bool "Sparc console 8x16 font"
-        depends on FRAMEBUFFER_CONSOLE && (!SPARC32 && !SPARC64 && FONTS || SPARC32 || SPARC64)
+        depends on FRAMEBUFFER_CONSOLE && (!SPARC && FONTS || SPARC)
        help
          This is the high resolution console font for Sun machines. Say Y.
 config FONT_SUN12x22
        bool "Sparc console 12x22 font (not supported by all drivers)"
-        depends on FRAMEBUFFER_CONSOLE && (!SPARC32 && !SPARC64 && FONTS || SPARC32 || SPARC64)
+        depends on FRAMEBUFFER_CONSOLE && (!SPARC && FONTS || SPARC)
        help
          This is the high resolution console font for Sun machines with very
          big letters (like the letters used in the SPARC PROM). If the
diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c
index c4d7c89212b4..9dd059e8b645 100644
--- a/drivers/video/console/fbcon_ud.c
+++ b/drivers/video/console/fbcon_ud.c
@@ -420,13 +420,15 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info,
 int ud_update_start(struct fb_info *info)
 {
        struct fbcon_ops *ops = info->fbcon_par;
-        u32 xoffset, yoffset;
+        int xoffset, yoffset;
        u32 vyres = GETVYRES(ops->p->scrollmode, info);
        u32 vxres = GETVXRES(ops->p->scrollmode, info);
        int err;
-        xoffset = (vxres - info->var.xres) - ops->var.xoffset;
+        xoffset = vxres - info->var.xres - ops->var.xoffset;
-        yoffset = (vyres - info->var.yres) - ops->var.yoffset;
+        yoffset = vyres - info->var.yres - ops->var.yoffset;
+        if (yoffset < 0)
+                yoffset += vyres;
        ops->var.xoffset = xoffset;
        ops->var.yoffset = yoffset;
        err = fb_pan_display(info, &ops->var);
diff --git a/drivers/video/intelfb/intelfb.h b/drivers/video/intelfb/intelfb.h
index f077ca34faba..da29d007f215 100644
--- a/drivers/video/intelfb/intelfb.h
+++ b/drivers/video/intelfb/intelfb.h
@@ -41,6 +41,10 @@
 /*** hw-related values ***/
+/* Resource Allocation */
+#define INTELFB_FB_ACQUIRED                 1
+#define INTELFB_MMIO_ACQUIRED               2
 /* PCI ids for supported devices */
 #define PCI_DEVICE_ID_INTEL_830M        0x3577
 #define PCI_DEVICE_ID_INTEL_845G        0x2562
@@ -257,6 +261,7 @@ struct intelfb_info {
        int hwcursor;
        int fixed_mode;
        int ring_active;
+        int flag;
        /* hw cursor */
        int cursor_on;
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 427689e584da..0090544842f5 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -135,9 +135,6 @@
 static void __devinit get_initial_mode(struct intelfb_info *dinfo);
 static void update_dinfo(struct intelfb_info *dinfo,
                         struct fb_var_screeninfo *var);
-static int intelfb_get_fix(struct fb_fix_screeninfo *fix,
-                           struct fb_info *info);
 static int intelfb_check_var(struct fb_var_screeninfo *var,
                             struct fb_info *info);
 static int intelfb_set_par(struct fb_info *info);
@@ -473,9 +470,9 @@ cleanup(struct intelfb_info *dinfo)
        if (dinfo->aperture.virtual)
                iounmap((void __iomem *)dinfo->aperture.virtual);
-        if (dinfo->mmio_base_phys)
+        if (dinfo->flag & INTELFB_MMIO_ACQUIRED)
                release_mem_region(dinfo->mmio_base_phys, INTEL_REG_SIZE);
-        if (dinfo->aperture.physical)
+        if (dinfo->flag & INTELFB_FB_ACQUIRED)
                release_mem_region(dinfo->aperture.physical,
                                   dinfo->aperture.size);
        framebuffer_release(dinfo->info);
@@ -572,6 +569,9 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                cleanup(dinfo);
                return -ENODEV;
        }
+        dinfo->flag |= INTELFB_FB_ACQUIRED;
        if (!request_mem_region(dinfo->mmio_base_phys,
                                INTEL_REG_SIZE,
                                INTELFB_MODULE_NAME)) {
@@ -580,6 +580,8 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                return -ENODEV;
        }
+        dinfo->flag |= INTELFB_MMIO_ACQUIRED;
        /* Get the chipset info. */
        dinfo->pci_chipset = pdev->device;
@@ -1091,7 +1093,17 @@ intelfb_set_fbinfo(struct intelfb_info *dinfo)
                return 1;
        info->pixmap.scan_align = 1;
+        strcpy(info->fix.id, dinfo->name);
+        info->fix.smem_start = dinfo->fb.physical;
+        info->fix.smem_len = dinfo->fb.size;
+        info->fix.type = FB_TYPE_PACKED_PIXELS;
+        info->fix.type_aux = 0;
+        info->fix.xpanstep = 8;
+        info->fix.ypanstep = 1;
+        info->fix.ywrapstep = 0;
+        info->fix.mmio_start = dinfo->mmio_base_phys;
+        info->fix.mmio_len = INTEL_REG_SIZE;
+        info->fix.accel = FB_ACCEL_I830;
        update_dinfo(dinfo, &info->var);
        return 0;
@@ -1109,7 +1121,8 @@ update_dinfo(struct intelfb_info *dinfo, struct fb_var_screeninfo *var)
        dinfo->yres = var->xres;
        dinfo->pixclock = var->pixclock;
-        intelfb_get_fix(&dinfo->info->fix, dinfo->info);
+        dinfo->info->fix.visual = dinfo->visual;
+        dinfo->info->fix.line_length = dinfo->pitch;
        switch (dinfo->bpp) {
        case 8:
@@ -1139,30 +1152,6 @@ update_dinfo(struct intelfb_info *dinfo, struct fb_var_screeninfo *var)
 /* fbops functions */
-static int
-intelfb_get_fix(struct fb_fix_screeninfo *fix, struct fb_info *info)
-{
-        struct intelfb_info *dinfo = GET_DINFO(info);
-        DBG_MSG("intelfb_get_fix\n");
-        memset(fix, 0, sizeof(*fix));
-        strcpy(fix->id, dinfo->name);
-        fix->smem_start = dinfo->fb.physical;
-        fix->smem_len = dinfo->fb.size;
-        fix->type = FB_TYPE_PACKED_PIXELS;
-        fix->type_aux = 0;
-        fix->visual = dinfo->visual;
-        fix->xpanstep = 8;
-        fix->ypanstep = 1;
-        fix->ywrapstep = 0;
-        fix->line_length = dinfo->pitch;
-        fix->mmio_start = dinfo->mmio_base_phys;
-        fix->mmio_len = INTEL_REG_SIZE;
-        fix->accel = FB_ACCEL_I830;
-        return 0;
-}
 /***************************************************************
 *                       fbdev interface                       *
 ***************************************************************/
diff --git a/drivers/video/logo/Kconfig b/drivers/video/logo/Kconfig
index 8cb7fb4db441..f0e6512c87ff 100644
--- a/drivers/video/logo/Kconfig
+++ b/drivers/video/logo/Kconfig
@@ -47,7 +47,7 @@ config LOGO_SGI_CLUT224
 config LOGO_SUN_CLUT224
        bool "224-color Sun Linux logo"
-        depends on LOGO && (SPARC32 || SPARC64)
+        depends on LOGO && SPARC
        default y
 config LOGO_SUPERH_MONO
diff --git a/drivers/video/sbuslib.c b/drivers/video/sbuslib.c
index 646c43f921c5..3a74a63dd4f2 100644
--- a/drivers/video/sbuslib.c
+++ b/drivers/video/sbuslib.c
@@ -46,6 +46,9 @@ int sbusfb_mmap_helper(struct sbus_mmap_map *map,
        unsigned long off;
        int i;
                                        
+        if (!(vma->vm_flags & (VM_SHARED | VM_MAYSHARE)))
+                return -EINVAL;
        size = vma->vm_end - vma->vm_start;
        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
                return -EINVAL;
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 4684eb7d48c6..b3ad0bd0312f 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -501,11 +501,16 @@ int hostfs_commit_write(struct file *file, struct page *page, unsigned from,
        long long start;
        int err = 0;
-        start = (long long) (page->index << PAGE_CACHE_SHIFT) + from;
+        start = (((long long) page->index) << PAGE_CACHE_SHIFT) + from;
        buffer = kmap(page);
        err = write_file(FILE_HOSTFS_I(file)->fd, &start, buffer + from,
                         to - from);
        if(err > 0) err = 0;
+        /* Actually, if !err, write_file has added to-from to start, so, despite
+         * the appearance, we are comparing i_size against the _last_ written
+         * location, as we should. */
        if(!err && (start > inode->i_size))
                inode->i_size = start;
@@ -910,10 +915,8 @@ static struct inode_operations hostfs_dir_iops = {
 int hostfs_link_readpage(struct file *file, struct page *page)
 {
        char *buffer, *name;
-        long long start;
        int err;
-        start = page->index << PAGE_CACHE_SHIFT;
        buffer = kmap(page);
        name = inode_name(page->mapping->host, 0);
        if(name == NULL) return(-ENOMEM);
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 006bb9e14579..3eaf6e701087 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -157,6 +157,8 @@ void nlmclnt_mark_reclaim(struct nlm_host *host)
                inode = fl->fl_file->f_dentry->d_inode;
                if (inode->i_sb->s_magic != NFS_SUPER_MAGIC)
                        continue;
+                if (fl->fl_u.nfs_fl.owner == NULL)
+                        continue;
                if (fl->fl_u.nfs_fl.owner->host != host)
                        continue;
                if (!(fl->fl_u.nfs_fl.flags & NFS_LCK_GRANTED))
@@ -226,6 +228,8 @@ restart:
                inode = fl->fl_file->f_dentry->d_inode;
                if (inode->i_sb->s_magic != NFS_SUPER_MAGIC)
                        continue;
+                if (fl->fl_u.nfs_fl.owner == NULL)
+                        continue;
                if (fl->fl_u.nfs_fl.owner->host != host)
                        continue;
                if (!(fl->fl_u.nfs_fl.flags & NFS_LCK_RECLAIM))
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index b497c71384e8..079228817603 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -678,15 +678,9 @@ nfs_file_direct_read(struct kiocb *iocb, char __user *buf, size_t count, loff_t
        if (!count)
                goto out;
-        if (mapping->nrpages) {
+        retval = nfs_sync_mapping(mapping);
-                retval = filemap_fdatawrite(mapping);
+        if (retval)
-                if (retval == 0)
+                goto out;
-                        retval = nfs_wb_all(inode);
-                if (retval == 0)
-                        retval = filemap_fdatawait(mapping);
-                if (retval)
-                        goto out;
-        }
        retval = nfs_direct_read(inode, ctx, &iov, pos, 1);
        if (retval > 0)
@@ -764,15 +758,9 @@ nfs_file_direct_write(struct kiocb *iocb, const char __user *buf, size_t count,
        if (!count)
                goto out;
-        if (mapping->nrpages) {
+        retval = nfs_sync_mapping(mapping);
-                retval = filemap_fdatawrite(mapping);
+        if (retval)
-                if (retval == 0)
+                goto out;
-                        retval = nfs_wb_all(inode);
-                if (retval == 0)
-                        retval = filemap_fdatawait(mapping);
-                if (retval)
-                        goto out;
-        }
        retval = nfs_direct_write(inode, ctx, &iov, pos, 1);
        if (mapping->nrpages)
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 57d3e77d97ee..7a79fbe9f539 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -433,11 +433,7 @@ static int do_unlk(struct file *filp, int cmd, struct file_lock *fl)
         * Flush all pending writes before doing anything
         * with locks..
         */
-        filemap_fdatawrite(filp->f_mapping);
+        nfs_sync_mapping(filp->f_mapping);
-        down(&inode->i_sem);
-        nfs_wb_all(inode);
-        up(&inode->i_sem);
-        filemap_fdatawait(filp->f_mapping);
        /* NOTE: special case
         *      If we're signalled while cleaning up locks on process exit, we
@@ -465,15 +461,8 @@ static int do_setlk(struct file *filp, int cmd, struct file_lock *fl)
         * Flush all pending writes before doing anything
         * with locks..
         */
-        status = filemap_fdatawrite(filp->f_mapping);
+        status = nfs_sync_mapping(filp->f_mapping);
-        if (status == 0) {
+        if (status != 0)
-                down(&inode->i_sem);
-                status = nfs_wb_all(inode);
-                up(&inode->i_sem);
-                if (status == 0)
-                        status = filemap_fdatawait(filp->f_mapping);
-        }
-        if (status < 0)
                goto out;
        lock_kernel();
@@ -497,11 +486,7 @@ static int do_setlk(struct file *filp, int cmd, struct file_lock *fl)
         * Make sure we clear the cache whenever we try to get the lock.
         * This makes locking act as a cache coherency point.
         */
-        filemap_fdatawrite(filp->f_mapping);
+        nfs_sync_mapping(filp->f_mapping);
-        down(&inode->i_sem);
-        nfs_wb_all(inode);      /* we may have slept */
-        up(&inode->i_sem);
-        filemap_fdatawait(filp->f_mapping);
        nfs_zap_caches(inode);
 out:
        rpc_clnt_sigunmask(NFS_CLIENT(inode), &oldset);
@@ -524,7 +509,8 @@ static int nfs_lock(struct file *filp, int cmd, struct file_lock *fl)
                return -EINVAL;
        /* No mandatory locks over NFS */
-        if ((inode->i_mode & (S_ISGID | S_IXGRP)) == S_ISGID)
+        if ((inode->i_mode & (S_ISGID | S_IXGRP)) == S_ISGID &&
+            fl->fl_type != F_UNLCK)
                return -ENOLCK;
        if (IS_GETLK(cmd))
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index afd75d0463fd..432f41cd75e6 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -640,6 +640,27 @@ static int nfs_show_options(struct seq_file *m, struct vfsmount *mnt)
        return 0;
 }
+/**
+ * nfs_sync_mapping - helper to flush all mmapped dirty data to disk
+ */
+int nfs_sync_mapping(struct address_space *mapping)
+{
+        int ret;
+        if (mapping->nrpages == 0)
+                return 0;
+        unmap_mapping_range(mapping, 0, 0, 0);
+        ret = filemap_fdatawrite(mapping);
+        if (ret != 0)
+                goto out;
+        ret = filemap_fdatawait(mapping);
+        if (ret != 0)
+                goto out;
+        ret = nfs_wb_all(mapping->host);
+out:
+        return ret;
+}
 /*
 * Invalidate the local caches
 */
@@ -1179,11 +1200,8 @@ void nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
        struct nfs_inode *nfsi = NFS_I(inode);
        if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
-                if (S_ISREG(inode->i_mode)) {
+                if (S_ISREG(inode->i_mode))
-                        if (filemap_fdatawrite(mapping) == 0)
+                        nfs_sync_mapping(mapping);
-                                filemap_fdatawait(mapping);
-                        nfs_wb_all(inode);
-                }
                invalidate_inode_pages2(mapping);
                spin_lock(&inode->i_lock);
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 7cbf0682b2f0..fc95c4df6693 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -107,7 +107,7 @@ static int nfsacld_proc_setacl(struct svc_rqst * rqstp,
        dprintk("nfsd: SETACL(2acl)   %s\n", SVCFH_fmt(&argp->fh));
        fh = fh_copy(&resp->fh, &argp->fh);
-        nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP);
+        nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
        if (!nfserr) {
                nfserr = nfserrno( nfsd_set_posix_acl(
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index 64ba40572fea..16e10c170aed 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -101,7 +101,7 @@ static int nfsd3_proc_setacl(struct svc_rqst * rqstp,
        int nfserr = 0;
        fh = fh_copy(&resp->fh, &argp->fh);
-        nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP);
+        nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
        if (!nfserr) {
                nfserr = nfserrno( nfsd_set_posix_acl(
diff --git a/fs/partitions/Kconfig b/fs/partitions/Kconfig
index deb25b661f04..656bc43431b9 100644
--- a/fs/partitions/Kconfig
+++ b/fs/partitions/Kconfig
@@ -203,7 +203,7 @@ config ULTRIX_PARTITION
 config SUN_PARTITION
        bool "Sun partition tables support" if PARTITION_ADVANCED
-        default y if (SPARC32 || SPARC64 || SUN3 || SUN3X)
+        default y if (SPARC || SUN3 || SUN3X)
        ---help---
          Like most systems, SunOS uses its own hard disk partition table
          format, incompatible with all others. Saying Y here allows you to
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index b638fb500743..72b431d0a0a4 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -54,6 +54,18 @@ proc_file_read(struct file *file, char __user *buf, size_t nbytes,
        ssize_t n, count;
        char    *start;
        struct proc_dir_entry * dp;
+        unsigned long long pos;
+        /*
+         * Gaah, please just use "seq_file" instead. The legacy /proc
+         * interfaces cut loff_t down to off_t for reads, and ignore
+         * the offset entirely for writes..
+         */
+        pos = *ppos;
+        if (pos > MAX_NON_LFS)
+                return 0;
+        if (nbytes > MAX_NON_LFS - pos)
+                nbytes = MAX_NON_LFS - pos;
        dp = PDE(inode);
        if (!(page = (char*) __get_free_page(GFP_KERNEL)))
@@ -202,30 +214,17 @@ proc_file_write(struct file *file, const char __user *buffer,
 static loff_t
 proc_file_lseek(struct file *file, loff_t offset, int orig)
 {
-    lock_kernel();
+        loff_t retval = -EINVAL;
+        switch (orig) {
-    switch (orig) {
+        case 1:
-    case 0:
+                offset += file->f_pos;
-        if (offset < 0)
+        /* fallthrough */
-            goto out;
+        case 0:
-        file->f_pos = offset;
+                if (offset < 0 || offset > MAX_NON_LFS)
-        unlock_kernel();
+                        break;
-        return(file->f_pos);
+                file->f_pos = retval = offset;
-    case 1:
+        }
-        if (offset + file->f_pos < 0)
+        return retval;
-            goto out;
-        file->f_pos += offset;
-        unlock_kernel();
-        return(file->f_pos);
-    case 2:
-        goto out;
-    default:
-        goto out;
-    }
-out:
-    unlock_kernel();
-    return -EINVAL;
 }
 static int proc_notify_change(struct dentry *dentry, struct iattr *iattr)
diff --git a/fs/relayfs/relay.c b/fs/relayfs/relay.c
index 16446a15c96d..2a6f7f12b7f9 100644
--- a/fs/relayfs/relay.c
+++ b/fs/relayfs/relay.c
@@ -333,8 +333,7 @@ size_t relay_switch_subbuf(struct rchan_buf *buf, size_t length)
        return length;
 toobig:
-        printk(KERN_WARNING "relayfs: event too large (%Zd)\n", length);
+        buf->chan->last_toobig = length;
-        WARN_ON(1);
        return 0;
 }
@@ -399,6 +398,11 @@ void relay_close(struct rchan *chan)
                relay_close_buf(chan->buf[i]);
        }
+        if (chan->last_toobig)
+                printk(KERN_WARNING "relayfs: one or more items not logged "
+                       "[item size (%Zd) > sub-buffer size (%Zd)]\n",
+                       chan->last_toobig, chan->subbuf_size);
        kref_put(&chan->kref, relay_destroy_channel);
 }
diff --git a/include/acpi/acglobal.h b/include/acpi/acglobal.h
index e9c2790139ec..4ab2ca18b8df 100644
--- a/include/acpi/acglobal.h
+++ b/include/acpi/acglobal.h
@@ -211,7 +211,7 @@ ACPI_EXTERN u32 acpi_gbl_original_mode;
 ACPI_EXTERN u32 acpi_gbl_rsdp_original_location;
 ACPI_EXTERN u32 acpi_gbl_ns_lookup_count;
 ACPI_EXTERN u32 acpi_gbl_ps_find_count;
-ACPI_EXTERN u32 acpi_gbl_owner_id_mask;
+ACPI_EXTERN u64 acpi_gbl_owner_id_mask;
 ACPI_EXTERN u16 acpi_gbl_pm1_enable_register_save;
 ACPI_EXTERN u16 acpi_gbl_global_lock_handle;
 ACPI_EXTERN u8 acpi_gbl_debugger_configuration;
diff --git a/include/asm-i386/param.h b/include/asm-i386/param.h
index fa02e67ea86b..095580f3a45c 100644
--- a/include/asm-i386/param.h
+++ b/include/asm-i386/param.h
@@ -1,9 +1,8 @@
-#include <linux/config.h>
 #ifndef _ASMi386_PARAM_H
 #define _ASMi386_PARAM_H
 #ifdef __KERNEL__
+# include <linux/config.h>
 # define HZ             CONFIG_HZ       /* Internal kernel timer frequency */
 # define USER_HZ        100             /* .. some user interfaces are in "ticks" */
 # define CLOCKS_PER_SEC         (USER_HZ)       /* like times() */
diff --git a/include/asm-ia64/topology.h b/include/asm-ia64/topology.h
index a9f738bf18a7..f7c330467e7e 100644
--- a/include/asm-ia64/topology.h
+++ b/include/asm-ia64/topology.h
@@ -38,7 +38,7 @@
 /*
 * Returns the number of the first CPU on Node 'node'.
 */
-#define node_to_first_cpu(node) (__ffs(node_to_cpumask(node)))
+#define node_to_first_cpu(node) (first_cpu(node_to_cpumask(node)))
 /*
 * Determines the node for a given pci bus
diff --git a/include/asm-x86_64/param.h b/include/asm-x86_64/param.h
index 40b11937180d..5956b23b57c2 100644
--- a/include/asm-x86_64/param.h
+++ b/include/asm-x86_64/param.h
@@ -1,9 +1,8 @@
-#include <linux/config.h>
 #ifndef _ASMx86_64_PARAM_H
 #define _ASMx86_64_PARAM_H
 #ifdef __KERNEL__
+# include <linux/config.h>
 # define HZ            CONFIG_HZ        /* Internal kernel timer frequency */
 # define USER_HZ       100              /* .. some user interfaces are in "ticks */
 #define CLOCKS_PER_SEC        (USER_HZ)       /* like times() */
diff --git a/include/asm-x86_64/rwlock.h b/include/asm-x86_64/rwlock.h
index 8a78a4ace53c..9942cc393064 100644
--- a/include/asm-x86_64/rwlock.h
+++ b/include/asm-x86_64/rwlock.h
@@ -64,7 +64,7 @@
                     ::"a" (rw) : "memory")
 #define __build_write_lock_const(rw, helper) \
-        asm volatile(LOCK "subl $" RW_LOCK_BIAS_STR ",(%0)\n\t" \
+        asm volatile(LOCK "subl $" RW_LOCK_BIAS_STR ",%0\n\t" \
                     "jnz 2f\n" \
                     "1:\n" \
                    LOCK_SECTION_START("") \
diff --git a/include/asm-x86_64/topology.h b/include/asm-x86_64/topology.h
index d39ebd5263ed..7d82bc56b9fa 100644
--- a/include/asm-x86_64/topology.h
+++ b/include/asm-x86_64/topology.h
@@ -23,7 +23,7 @@ extern int __node_distance(int, int);
 #define cpu_to_node(cpu)                (cpu_to_node[cpu])
 #define parent_node(node)               (node)
-#define node_to_first_cpu(node)         (__ffs(node_to_cpumask[node]))
+#define node_to_first_cpu(node)         (first_cpu(node_to_cpumask[node]))
 #define node_to_cpumask(node)           (node_to_cpumask[node])
 #define pcibus_to_node(bus)             ((long)(bus->sysdata))  
 #define pcibus_to_cpumask(bus)          node_to_cpumask(pcibus_to_node(bus));
diff --git a/include/linux/ipv6_route.h b/include/linux/ipv6_route.h
index e2f935038013..d7c41d1d706a 100644
--- a/include/linux/ipv6_route.h
+++ b/include/linux/ipv6_route.h
@@ -18,6 +18,7 @@
                                           fallback, no routers on link */
 #define RTF_ADDRCONF    0x00040000      /* addrconf route - RA          */
 #define RTF_PREFIX_RT   0x00080000      /* A prefix only route - RA     */
+#define RTF_ANYCAST     0x00100000      /* Anycast                      */
 #define RTF_NONEXTHOP   0x00200000      /* route with no nexthop        */
 #define RTF_EXPIRES     0x00400000
diff --git a/include/linux/irq.h b/include/linux/irq.h
index c516382fbec2..f04ba20712a2 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -10,7 +10,7 @@
 */
 #include <linux/config.h>
-#include <asm/smp.h>            /* cpu_online_map */
+#include <linux/smp.h>
 #if !defined(CONFIG_ARCH_S390)
diff --git a/include/linux/n_r3964.h b/include/linux/n_r3964.h
index 2352bcd31a06..db4f3776978a 100644
--- a/include/linux/n_r3964.h
+++ b/include/linux/n_r3964.h
@@ -13,6 +13,10 @@
 * L. Haag
 *
 * $Log: r3964.h,v $
+ * Revision 1.4  2005/12/21 19:54:24  Kurt Huwig <kurt huwig de>
+ * Fixed HZ usage on 2.6 kernels
+ * Removed unnecessary include
+ *
 * Revision 1.3  2001/03/18 13:02:24  dwmw2
 * Fix timer usage, use spinlocks properly.
 *
@@ -45,9 +49,11 @@
 #define __LINUX_N_R3964_H__
 /* line disciplines for r3964 protocol */
-#include <asm/termios.h>
 #ifdef __KERNEL__
+#include <linux/param.h>
 /*
 * Common ascii handshake characters:
 */
@@ -58,14 +64,14 @@
 #define NAK 0x15
 /*
- * Timeouts (msecs/10 msecs per timer interrupt):
+ * Timeouts (from milliseconds to jiffies)
 */
-#define R3964_TO_QVZ 550/10
+#define R3964_TO_QVZ ((550)*HZ/1000)
-#define R3964_TO_ZVZ 220/10
+#define R3964_TO_ZVZ ((220)*HZ/1000)
-#define R3964_TO_NO_BUF 400/10
+#define R3964_TO_NO_BUF ((400)*HZ/1000)
-#define R3964_NO_TX_ROOM 100/10
+#define R3964_NO_TX_ROOM ((100)*HZ/1000)
-#define R3964_TO_RX_PANIC 4000/10
+#define R3964_TO_RX_PANIC ((4000)*HZ/1000)
 #define R3964_MAX_RETRIES 5
 #endif
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 12787a9b0259..2516adeccecf 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -291,6 +291,7 @@ static inline int nfs_verify_change_attribute(struct inode *inode, unsigned long
 /*
 * linux/fs/nfs/inode.c
 */
+extern int nfs_sync_mapping(struct address_space *mapping);
 extern void nfs_zap_caches(struct inode *);
 extern struct inode *nfs_fhget(struct super_block *, struct nfs_fh *,
                                struct nfs_fattr *);
diff --git a/include/linux/preempt.h b/include/linux/preempt.h
index d9a2f5254a51..5769d14d1e6a 100644
--- a/include/linux/preempt.h
+++ b/include/linux/preempt.h
@@ -48,6 +48,7 @@ do { \
 #define preempt_enable() \
 do { \
        preempt_enable_no_resched(); \
+        barrier(); \
        preempt_check_resched(); \
 } while (0)
diff --git a/include/linux/relayfs_fs.h b/include/linux/relayfs_fs.h
index cfafc3e76bc2..fb7e80737325 100644
--- a/include/linux/relayfs_fs.h
+++ b/include/linux/relayfs_fs.h
@@ -20,9 +20,9 @@
 #include <linux/kref.h>
 /*
- * Tracks changes to rchan_buf struct
+ * Tracks changes to rchan/rchan_buf structs
 */
-#define RELAYFS_CHANNEL_VERSION         5
+#define RELAYFS_CHANNEL_VERSION         6
 /*
 * Per-cpu relay channel buffer
@@ -60,6 +60,7 @@ struct rchan
        struct rchan_callbacks *cb;     /* client callbacks */
        struct kref kref;               /* channel refcount */
        void *private_data;             /* for user-defined data */
+        size_t last_toobig;             /* tried to log event > subbuf size */
        struct rchan_buf *buf[NR_CPUS]; /* per-cpu channel buffers */
 };
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index c231e9a08f0b..d50482ba27fe 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -866,6 +866,7 @@ enum rtnetlink_groups {
 #define RTNLGRP_IPV4_MROUTE     RTNLGRP_IPV4_MROUTE
        RTNLGRP_IPV4_ROUTE,
 #define RTNLGRP_IPV4_ROUTE      RTNLGRP_IPV4_ROUTE
+        RTNLGRP_NOP1,
        RTNLGRP_IPV6_IFADDR,
 #define RTNLGRP_IPV6_IFADDR     RTNLGRP_IPV6_IFADDR
        RTNLGRP_IPV6_MROUTE,
@@ -876,8 +877,11 @@ enum rtnetlink_groups {
 #define RTNLGRP_IPV6_IFINFO     RTNLGRP_IPV6_IFINFO
        RTNLGRP_DECnet_IFADDR,
 #define RTNLGRP_DECnet_IFADDR   RTNLGRP_DECnet_IFADDR
+        RTNLGRP_NOP2,
        RTNLGRP_DECnet_ROUTE,
 #define RTNLGRP_DECnet_ROUTE    RTNLGRP_DECnet_ROUTE
+        RTNLGRP_NOP3,
+        RTNLGRP_NOP4,
        RTNLGRP_IPV6_PREFIX,
 #define RTNLGRP_IPV6_PREFIX     RTNLGRP_IPV6_PREFIX
        __RTNLGRP_MAX
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index e97a9accb71d..eb8afe3499a9 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -24,6 +24,7 @@
 #define IF_RA_MANAGED   0x40
 #define IF_RA_RCVD      0x20
 #define IF_RS_SENT      0x10
+#define IF_READY        0x80000000
 /* prefix flags */
 #define IF_PREFIX_ONLINK        0x01
@@ -82,6 +83,7 @@ struct ipv6_mc_socklist
        struct in6_addr         addr;
        int                     ifindex;
        struct ipv6_mc_socklist *next;
+        rwlock_t                sflock;
        unsigned int            sfmode;         /* MCAST_{INCLUDE,EXCLUDE} */
        struct ip6_sf_socklist  *sflist;
 };
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 5beae1ccd574..1cdb87912137 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 extern void xfrm_policy_flush(void);
 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
 extern int xfrm_flush_bundles(void);
+extern void xfrm_flush_all_bundles(void);
 extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
 extern void xfrm_init_pmtu(struct dst_entry *dst);
diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
index fac547d32a98..394f14a5b7cb 100644
--- a/include/scsi/scsi_transport_fc.h
+++ b/include/scsi/scsi_transport_fc.h
@@ -79,6 +79,7 @@ enum fc_port_state {
        FC_PORTSTATE_LINKDOWN,
        FC_PORTSTATE_ERROR,
        FC_PORTSTATE_LOOPBACK,
+        FC_PORTSTATE_DELETED,
 };
@@ -325,8 +326,14 @@ struct fc_host_attrs {
        struct list_head rport_bindings;
        u32 next_rport_number;
        u32 next_target_id;
+        u8 flags;
+        struct work_struct rport_del_work;
 };
+/* values for struct fc_host_attrs "flags" field: */
+#define FC_SHOST_RPORT_DEL_SCHEDULED    0x01
 #define fc_host_node_name(x) \
        (((struct fc_host_attrs *)(x)->shost_data)->node_name)
 #define fc_host_port_name(x)    \
@@ -365,6 +372,10 @@ struct fc_host_attrs {
        (((struct fc_host_attrs *)(x)->shost_data)->next_rport_number)
 #define fc_host_next_target_id(x) \
        (((struct fc_host_attrs *)(x)->shost_data)->next_target_id)
+#define fc_host_flags(x) \
+        (((struct fc_host_attrs *)(x)->shost_data)->flags)
+#define fc_host_rport_del_work(x) \
+        (((struct fc_host_attrs *)(x)->shost_data)->rport_del_work)
 /* The functions by which the transport class and the driver communicate */
diff --git a/init/Kconfig b/init/Kconfig
index 6c5dbedc6e96..9fc0759fa942 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -260,7 +260,6 @@ config CC_OPTIMIZE_FOR_SIZE
        bool "Optimize for size (Look out for broken compilers!)"
        default y
        depends on ARM || H8300 || EXPERIMENTAL
-        depends on !SPARC64
        help
          Enabling this option will pass "-Os" instead of "-O2" to gcc
          resulting in a smaller kernel.
diff --git a/ipc/sem.c b/ipc/sem.c
index 19af028a3e38..cb5bb2a5df96 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -381,6 +381,7 @@ static void update_queue (struct sem_array * sma)
                        /* hands-off: q will disappear immediately after
                         * writing q->status.
                         */
+                        smp_wmb();
                        q->status = error;
                        q = n;
                } else {
@@ -461,6 +462,7 @@ static void freeary (struct sem_array *sma, int id)
                n = q->next;
                q->status = IN_WAKEUP;
                wake_up_process(q->sleeper); /* doesn't sleep */
+                smp_wmb();
                q->status = -EIDRM;     /* hands-off q */
                q = n;
        }
diff --git a/kernel/futex.c b/kernel/futex.c
index 5872e3507f35..5e71a6bf6f6b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -270,7 +270,13 @@ static void wake_futex(struct futex_q *q)
        /*
         * The waiting task can free the futex_q as soon as this is written,
         * without taking any locks.  This must come last.
+         *
+         * A memory barrier is required here to prevent the following store
+         * to lock_ptr from getting ahead of the wakeup. Clearing the lock
+         * at the end of wake_up_all() does not prevent this store from
+         * moving.
         */
+        wmb();
        q->lock_ptr = NULL;
 }
diff --git a/kernel/params.c b/kernel/params.c
index 47ba69547945..c76ad25e6a21 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -619,7 +619,7 @@ static void __init param_sysfs_builtin(void)
 /* module-related sysfs stuff */
-#ifdef CONFIG_MODULES
+#ifdef CONFIG_SYSFS
 #define to_module_attr(n) container_of(n, struct module_attribute, attr);
 #define to_module_kobject(n) container_of(n, struct module_kobject, kobj);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 9990e10192e8..b53115b882e1 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2192,29 +2192,32 @@ int sysctl_string(ctl_table *table, int __user *name, int nlen,
                  void __user *oldval, size_t __user *oldlenp,
                  void __user *newval, size_t newlen, void **context)
 {
-        size_t l, len;
-        
        if (!table->data || !table->maxlen) 
                return -ENOTDIR;
        
        if (oldval && oldlenp) {
-                if (get_user(len, oldlenp))
+                size_t bufsize;
+                if (get_user(bufsize, oldlenp))
                        return -EFAULT;
-                if (len) {
+                if (bufsize) {
-                        l = strlen(table->data);
+                        size_t len = strlen(table->data), copied;
-                        if (len > l) len = l;
-                        if (len >= table->maxlen)
+                        /* This shouldn't trigger for a well-formed sysctl */
+                        if (len > table->maxlen)
                                len = table->maxlen;
-                        if(copy_to_user(oldval, table->data, len))
-                                return -EFAULT;
+                        /* Copy up to a max of bufsize-1 bytes of the string */
-                        if(put_user(0, ((char __user *) oldval) + len))
+                        copied = (len >= bufsize) ? bufsize - 1 : len;
+                        if (copy_to_user(oldval, table->data, copied) ||
+                            put_user(0, (char __user *)(oldval + copied)))
                                return -EFAULT;
-                        if(put_user(len, oldlenp))
+                        if (put_user(len, oldlenp))
                                return -EFAULT;
                }
        }
        if (newval && newlen) {
-                len = newlen;
+                size_t len = newlen;
                if (len > table->maxlen)
                        len = table->maxlen;
                if(copy_from_user(table->data, newval, len))
@@ -2223,7 +2226,7 @@ int sysctl_string(ctl_table *table, int __user *name, int nlen,
                        len--;
                ((char *) table->data)[len] = 0;
        }
-        return 0;
+        return 1;
 }
 /*
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index 906ad101eab3..dcd4be9bd4e5 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -20,7 +20,8 @@ static void spin_bug(spinlock_t *lock, const char *msg)
                if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT)
                        owner = lock->owner;
                printk("BUG: spinlock %s on CPU#%d, %s/%d\n",
-                        msg, smp_processor_id(), current->comm, current->pid);
+                        msg, raw_smp_processor_id(),
+                        current->comm, current->pid);
                printk(" lock: %p, .magic: %08x, .owner: %s/%d, .owner_cpu: %d\n",
                        lock, lock->magic,
                        owner ? owner->comm : "<none>",
@@ -78,8 +79,8 @@ static void __spin_lock_debug(spinlock_t *lock)
                if (print_once) {
                        print_once = 0;
                        printk("BUG: spinlock lockup on CPU#%d, %s/%d, %p\n",
-                                smp_processor_id(), current->comm, current->pid,
+                                raw_smp_processor_id(), current->comm,
-                                        lock);
+                                current->pid, lock);
                        dump_stack();
                }
        }
@@ -120,7 +121,8 @@ static void rwlock_bug(rwlock_t *lock, const char *msg)
        if (xchg(&print_once, 0)) {
                printk("BUG: rwlock %s on CPU#%d, %s/%d, %p\n", msg,
-                        smp_processor_id(), current->comm, current->pid, lock);
+                        raw_smp_processor_id(), current->comm,
+                        current->pid, lock);
                dump_stack();
 #ifdef CONFIG_SMP
                /*
@@ -148,8 +150,8 @@ static void __read_lock_debug(rwlock_t *lock)
                if (print_once) {
                        print_once = 0;
                        printk("BUG: read-lock lockup on CPU#%d, %s/%d, %p\n",
-                                smp_processor_id(), current->comm, current->pid,
+                                raw_smp_processor_id(), current->comm,
-                                        lock);
+                                current->pid, lock);
                        dump_stack();
                }
        }
@@ -220,8 +222,8 @@ static void __write_lock_debug(rwlock_t *lock)
                if (print_once) {
                        print_once = 0;
                        printk("BUG: write-lock lockup on CPU#%d, %s/%d, %p\n",
-                                smp_processor_id(), current->comm, current->pid,
+                                raw_smp_processor_id(), current->comm,
-                                        lock);
+                                current->pid, lock);
                        dump_stack();
                }
        }
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 57216f3544ca..1ff8dcebf7c6 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -704,8 +704,9 @@ swiotlb_map_sg(struct device *hwdev, struct scatterlist *sg, int nelems,
                addr = SG_ENT_VIRT_ADDRESS(sg);
                dev_addr = virt_to_phys(addr);
                if (swiotlb_force || address_needs_mapping(hwdev, dev_addr)) {
-                        sg->dma_address = (dma_addr_t) virt_to_phys(map_single(hwdev, addr, sg->length, dir));
+                        void *map = map_single(hwdev, addr, sg->length, dir);
-                        if (!sg->dma_address) {
+                        sg->dma_address = virt_to_bus(map);
+                        if (!map) {
                                /* Don't panic here, we expect map_sg users
                                   to do proper error handling. */
                                swiotlb_full(hwdev, sg->length, dir, 0);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index bec88c81244e..72f402cc9c9a 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -161,6 +161,10 @@ static struct mempolicy *mpol_new(int mode, nodemask_t *nodes)
        switch (mode) {
        case MPOL_INTERLEAVE:
                policy->v.nodes = *nodes;
+                if (nodes_weight(*nodes) == 0) {
+                        kmem_cache_free(policy_cache, policy);
+                        return ERR_PTR(-EINVAL);
+                }
                break;
        case MPOL_PREFERRED:
                policy->v.preferred_node = first_node(*nodes);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 91e412b0ab00..67465b65abe4 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -753,6 +753,8 @@ static int vlan_ioctl_handler(void __user *arg)
                break;
        case GET_VLAN_REALDEV_NAME_CMD:
                err = vlan_dev_get_realdev_name(args.device1, args.u.device2);
+                if (err)
+                        goto out;
                if (copy_to_user(arg, &args,
                                 sizeof(struct vlan_ioctl_args))) {
                        err = -EFAULT;
@@ -761,6 +763,8 @@ static int vlan_ioctl_handler(void __user *arg)
        case GET_VLAN_VID_CMD:
                err = vlan_dev_get_vid(args.device1, &vid);
+                if (err)
+                        goto out;
                args.u.VID = vid;
                if (copy_to_user(arg, &args,
                                 sizeof(struct vlan_ioctl_args))) {
@@ -774,7 +778,7 @@ static int vlan_ioctl_handler(void __user *arg)
                        __FUNCTION__, args.cmd);
                return -EINVAL;
        };
+out:
        return err;
 }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index d8e36b775125..23422bd53a5e 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff *skb)
        len -= 2;
        while (len > 0) {
-                int optlen = raw[off+1]+2;
+                int optlen = skb->nh.raw[off+1]+2;
                switch (skb->nh.raw[off]) {
                case IPV6_TLV_PAD0:
@@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff *skb)
                case IPV6_TLV_JUMBO:
                        if (skb->nh.raw[off+1] != 4 || (off&3) != 2)
                                goto bad;
                        pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2));
+                        if (pkt_len <= IPV6_MAXPLEN ||
+                            skb->nh.ipv6h->payload_len)
+                                goto bad;
                        if (pkt_len > skb->len - sizeof(struct ipv6hdr))
                                goto bad;
-                        if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
+                        if (pskb_trim_rcsum(skb,
-                                if (__pskb_trim(skb,
+                            pkt_len+sizeof(struct ipv6hdr)))
-                                    pkt_len + sizeof(struct ipv6hdr)))
+                                goto bad;
-                                        goto bad;
-                                if (skb->ip_summed == CHECKSUM_HW)
-                                        skb->ip_summed = CHECKSUM_NONE;
-                        }
                        break;
                default:
                        if (optlen > len)
@@ -372,6 +369,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
        if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
                        goto inhdr_error;
+        nf_bridge_put(skb->nf_bridge);
        if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                return NF_DROP;
        setup_pre_routing(skb);
@@ -455,6 +453,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
                        skb->ip_summed = CHECKSUM_NONE;
        }
+        nf_bridge_put(skb->nf_bridge);
        if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                return NF_DROP;
        setup_pre_routing(skb);
diff --git a/net/core/filter.c b/net/core/filter.c
index 2841bfce29d6..3a10e0bc90e8 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -293,7 +293,7 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
        struct sock_filter *ftest;
        int pc;
-        if (((unsigned int)flen >= (~0U / sizeof(struct sock_filter))) || flen == 0)
+        if (flen == 0 || flen > BPF_MAXINSNS)
                return -EINVAL;
        /* check the filter code now */
@@ -360,7 +360,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
        int err;
        /* Make sure new filter is there and in the right amounts. */
-        if (fprog->filter == NULL || fprog->len > BPF_MAXINSNS)
+        if (fprog->filter == NULL)
                return -EINVAL;
        fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index ca03521112c5..656e13e38cfb 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -1251,7 +1251,7 @@ static int dccp_v4_destroy_sock(struct sock *sk)
        struct dccp_sock *dp = dccp_sk(sk);
        /*
-         * DCCP doesn't use sk_qrite_queue, just sk_send_head
+         * DCCP doesn't use sk_write_queue, just sk_send_head
         * for retransmissions
         */
        if (sk->sk_send_head != NULL) {
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 058c48e258fc..d0a447e520a2 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -12,6 +12,7 @@ ip_nat_pptp-objs	:= ip_nat_helper_pptp.o ip_nat_proto_gre.o
 # connection tracking
 obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
+obj-$(CONFIG_IP_NF_NAT) += ip_nat.o
 # conntrack netlink interface
 obj-$(CONFIG_IP_NF_CONNTRACK_NETLINK) += ip_conntrack_netlink.o
@@ -41,7 +42,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 # the three instances of ip_tables
 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
-obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o ip_nat.o
+obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
 obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 # matches
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index b2b60f3e9cdd..42196ba3b0b9 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -182,6 +182,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
                case IPPROTO_UDP:
                case IPPROTO_TCP:
                case IPPROTO_SCTP:
+                case IPPROTO_DCCP:
                        if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                u16 *ports = (u16 *)xprth;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 73a23b4130a5..a60585fd85ad 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -137,6 +137,7 @@ static int addrconf_ifdown(struct net_device *dev, int how);
 static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags);
 static void addrconf_dad_timer(unsigned long data);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
+static void addrconf_dad_run(struct inet6_dev *idev);
 static void addrconf_rs_timer(unsigned long data);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -388,6 +389,9 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                }
 #endif
+                if (netif_carrier_ok(dev))
+                        ndev->if_flags |= IF_READY;
                write_lock_bh(&addrconf_lock);
                dev->ip6_ptr = ndev;
                write_unlock_bh(&addrconf_lock);
@@ -415,6 +419,7 @@ static struct inet6_dev * ipv6_find_idev(struct net_device *dev)
                if ((idev = ipv6_add_dev(dev)) == NULL)
                        return NULL;
        }
        if (dev->flags&IFF_UP)
                ipv6_mc_up(idev);
        return idev;
@@ -634,8 +639,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
        }
 #endif
-        for (ifap = &idev->addr_list; (ifa=*ifap) != NULL;
+        for (ifap = &idev->addr_list; (ifa=*ifap) != NULL;) {
-             ifap = &ifa->if_next) {
                if (ifa == ifp) {
                        *ifap = ifa->if_next;
                        __in6_ifa_put(ifp);
@@ -643,6 +647,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                        if (!(ifp->flags & IFA_F_PERMANENT) || onlink > 0)
                                break;
                        deleted = 1;
+                        continue;
                } else if (ifp->flags & IFA_F_PERMANENT) {
                        if (ipv6_prefix_equal(&ifa->addr, &ifp->addr,
                                              ifp->prefix_len)) {
@@ -666,6 +671,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                                }
                        }
                }
+                ifap = &ifa->if_next;
        }
        write_unlock_bh(&idev->lock);
@@ -903,11 +909,18 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                        score.addr_type = __ipv6_addr_type(&ifa->addr);
-                        /* Rule 0: Candidate Source Address (section 4)
+                        /* Rule 0:
+                         * - Tentative Address (RFC2462 section 5.4)
+                         *  - A tentative address is not considered
+                         *    "assigned to an interface" in the traditional
+                         *    sense.
+                         * - Candidate Source Address (section 4)
                         *  - In any case, anycast addresses, multicast
                         *    addresses, and the unspecified address MUST
                         *    NOT be included in a candidate set.
                         */
+                        if (ifa->flags & IFA_F_TENTATIVE)
+                                continue;
                        if (unlikely(score.addr_type == IPV6_ADDR_ANY ||
                                     score.addr_type & IPV6_ADDR_MULTICAST)) {
                                LIMIT_NETDEBUG(KERN_DEBUG
@@ -1215,10 +1228,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 /* Gets referenced address, destroys ifaddr */
-void addrconf_dad_failure(struct inet6_ifaddr *ifp)
+void addrconf_dad_stop(struct inet6_ifaddr *ifp)
 {
-        if (net_ratelimit())
-                printk(KERN_INFO "%s: duplicate address detected!\n", ifp->idev->dev->name);
        if (ifp->flags&IFA_F_PERMANENT) {
                spin_lock_bh(&ifp->lock);
                addrconf_del_timer(ifp);
@@ -1244,6 +1255,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                ipv6_del_addr(ifp);
 }
+void addrconf_dad_failure(struct inet6_ifaddr *ifp)
+{
+        if (net_ratelimit())
+                printk(KERN_INFO "%s: duplicate address detected!\n", ifp->idev->dev->name);
+        addrconf_dad_stop(ifp);
+}
 /* Join to solicited addr multicast group. */
@@ -1596,9 +1613,17 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
           not good.
         */
        if (valid_lft >= 0x7FFFFFFF/HZ)
-                rt_expires = 0;
+                rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ);
        else
-                rt_expires = jiffies + valid_lft * HZ;
+                rt_expires = valid_lft * HZ;
+        /*
+         * We convert this (in jiffies) to clock_t later.
+         * Avoid arithmetic overflow there as well.
+         * Overflow can happen only if HZ < USER_HZ.
+         */
+        if (HZ < USER_HZ && rt_expires > 0x7FFFFFFF / USER_HZ)
+                rt_expires = 0x7FFFFFFF / USER_HZ;
        if (pinfo->onlink) {
                struct rt6_info *rt;
@@ -1610,12 +1635,12 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                                        ip6_del_rt(rt, NULL, NULL, NULL);
                                        rt = NULL;
                                } else {
-                                        rt->rt6i_expires = rt_expires;
+                                        rt->rt6i_expires = jiffies + rt_expires;
                                }
                        }
                } else if (valid_lft) {
                        addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
-                                              dev, rt_expires, RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
+                                              dev, jiffies_to_clock_t(rt_expires), RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
                }
                if (rt)
                        dst_release(&rt->u.dst);
@@ -2125,9 +2150,42 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 {
        struct net_device *dev = (struct net_device *) data;
        struct inet6_dev *idev = __in6_dev_get(dev);
+        int run_pending = 0;
        switch(event) {
        case NETDEV_UP:
+        case NETDEV_CHANGE:
+                if (event == NETDEV_UP) {
+                        if (!netif_carrier_ok(dev)) {
+                                /* device is not ready yet. */
+                                printk(KERN_INFO
+                                        "ADDRCONF(NETDEV_UP): %s: "
+                                        "link is not ready\n",
+                                        dev->name);
+                                break;
+                        }
+                } else {
+                        if (!netif_carrier_ok(dev)) {
+                                /* device is still not ready. */
+                                break;
+                        }
+                        if (idev) {
+                                if (idev->if_flags & IF_READY) {
+                                        /* device is already configured. */
+                                        break;
+                                }
+                                idev->if_flags |= IF_READY;
+                        }
+                        printk(KERN_INFO
+                                        "ADDRCONF(NETDEV_CHANGE): %s: "
+                                        "link becomes ready\n",
+                                        dev->name);
+                        run_pending = 1;
+                }
                switch(dev->type) {
                case ARPHRD_SIT:
                        addrconf_sit_config(dev);
@@ -2144,6 +2202,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                        break;
                };
                if (idev) {
+                        if (run_pending)
+                                addrconf_dad_run(idev);
                        /* If the MTU changed during the interface down, when the
                           interface up, the changed MTU must be reflected in the
                           idev as well as routers.
@@ -2178,8 +2239,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 */
                addrconf_ifdown(dev, event != NETDEV_DOWN);
                break;
-        case NETDEV_CHANGE:
-                break;
        case NETDEV_CHANGENAME:
 #ifdef CONFIG_SYSCTL
                if (idev) {
@@ -2260,7 +2320,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        /* Step 3: clear flags for stateless addrconf */
        if (how != 1)
-                idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD);
+                idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
        /* Step 4: clear address list */
 #ifdef CONFIG_IPV6_PRIVACY
@@ -2369,11 +2429,20 @@ out:
 /*
 *      Duplicate Address Detection
 */
+static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
+{
+        unsigned long rand_num;
+        struct inet6_dev *idev = ifp->idev;
+        rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
+        ifp->probes = idev->cnf.dad_transmits;
+        addrconf_mod_timer(ifp, AC_DAD, rand_num);
+}
 static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
 {
        struct inet6_dev *idev = ifp->idev;
        struct net_device *dev = idev->dev;
-        unsigned long rand_num;
        addrconf_join_solict(dev, &ifp->addr);
@@ -2382,7 +2451,6 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
                                        flags);
        net_srandom(ifp->addr.s6_addr32[3]);
-        rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
        read_lock_bh(&idev->lock);
        if (ifp->dead)
@@ -2399,9 +2467,19 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
                return;
        }
-        ifp->probes = idev->cnf.dad_transmits;
+        if (!(idev->if_flags & IF_READY)) {
-        addrconf_mod_timer(ifp, AC_DAD, rand_num);
+                spin_unlock_bh(&ifp->lock);
+                read_unlock_bh(&idev->lock);
+                /*
+                 * If the defice is not ready:
+                 * - keep it tentative if it is a permanent address.
+                 * - otherwise, kill it.
+                 */
+                in6_ifa_hold(ifp);
+                addrconf_dad_stop(ifp);
+                return;
+        }
+        addrconf_dad_kick(ifp);
        spin_unlock_bh(&ifp->lock);
 out:
        read_unlock_bh(&idev->lock);
@@ -2484,6 +2562,22 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
        }
 }
+static void addrconf_dad_run(struct inet6_dev *idev) {
+        struct inet6_ifaddr *ifp;
+        read_lock_bh(&idev->lock);
+        for (ifp = idev->addr_list; ifp; ifp = ifp->if_next) {
+                spin_lock_bh(&ifp->lock);
+                if (!(ifp->flags & IFA_F_TENTATIVE)) {
+                        spin_unlock_bh(&ifp->lock);
+                        continue;
+                }
+                spin_unlock_bh(&ifp->lock);
+                addrconf_dad_kick(ifp);
+        }
+        read_unlock_bh(&idev->lock);
+}
 #ifdef CONFIG_PROC_FS
 struct if6_iter_state {
        int bucket;
@@ -2689,6 +2783,9 @@ restart:
                                                in6_ifa_hold(ifpub);
                                                spin_unlock(&ifp->lock);
                                                read_unlock(&addrconf_hash_lock);
+                                                spin_lock(&ifpub->lock);
+                                                ifpub->regen_count = 0;
+                                                spin_unlock(&ifpub->lock);
                                                ipv6_create_tempaddr(ifpub, ifp);
                                                in6_ifa_put(ifpub);
                                                in6_ifa_put(ifp);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 34a332225c17..6ec6a2b549bb 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -328,8 +328,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
                iif = skb->dev->ifindex;
        /*
-         *      Must not send if we know that source is Anycast also.
+         *      Must not send error if the source does not uniquely
-         *      for now we don't know that.
+         *      identify a single node (RFC2463 Section 2.4).
+         *      We check unspecified / multicast addresses here,
+         *      and anycast addresses will be checked later.
         */
        if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
                LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: addr_any/mcast source\n");
@@ -373,6 +375,16 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
        err = ip6_dst_lookup(sk, &dst, &fl);
        if (err)
                goto out;
+        /*
+         * We won't send icmp if the destination is known
+         * anycast.
+         */
+        if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
+                LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
+                goto out_dst_release;
+        }
        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
                goto out;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index fd939da090c4..f829a4ad3ccc 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -170,7 +170,7 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
 #define MLDV2_QQIC(value) MLDV2_EXP(0x80, 4, 3, value)
 #define MLDV2_MRC(value) MLDV2_EXP(0x8000, 12, 3, value)
-#define IPV6_MLD_MAX_MSF        10
+#define IPV6_MLD_MAX_MSF        64
 int sysctl_mld_max_msf = IPV6_MLD_MAX_MSF;
@@ -224,6 +224,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, struct in6_addr *addr)
        mc_lst->ifindex = dev->ifindex;
        mc_lst->sfmode = MCAST_EXCLUDE;
+        mc_lst->sflock = RW_LOCK_UNLOCKED;
        mc_lst->sflist = NULL;
        /*
@@ -360,6 +361,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
        struct ip6_sf_socklist *psl;
        int i, j, rv;
        int leavegroup = 0;
+        int pmclocked = 0;
        int err;
        if (pgsr->gsr_group.ss_family != AF_INET6 ||
@@ -403,6 +405,9 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
                pmc->sfmode = omode;
        }
+        write_lock_bh(&pmc->sflock);
+        pmclocked = 1;
        psl = pmc->sflist;
        if (!add) {
                if (!psl)
@@ -475,6 +480,8 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
        /* update the interface list */
        ip6_mc_add_src(idev, group, omode, 1, source, 1);
 done:
+        if (pmclocked)
+                write_unlock_bh(&pmc->sflock);
        read_unlock_bh(&ipv6_sk_mc_lock);
        read_unlock_bh(&idev->lock);
        in6_dev_put(idev);
@@ -510,6 +517,8 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
        dev = idev->dev;
        err = 0;
+        read_lock_bh(&ipv6_sk_mc_lock);
        if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
                leavegroup = 1;
                goto done;
@@ -549,6 +558,8 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
                newpsl = NULL;
                (void) ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
        }
+        write_lock_bh(&pmc->sflock);
        psl = pmc->sflist;
        if (psl) {
                (void) ip6_mc_del_src(idev, group, pmc->sfmode,
@@ -558,8 +569,10 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
                (void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
        pmc->sflist = newpsl;
        pmc->sfmode = gsf->gf_fmode;
+        write_unlock_bh(&pmc->sflock);
        err = 0;
 done:
+        read_unlock_bh(&ipv6_sk_mc_lock);
        read_unlock_bh(&idev->lock);
        in6_dev_put(idev);
        dev_put(dev);
@@ -592,6 +605,11 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
        dev = idev->dev;
        err = -EADDRNOTAVAIL;
+        /*
+         * changes to the ipv6_mc_list require the socket lock and
+         * a read lock on ip6_sk_mc_lock. We have the socket lock,
+         * so reading the list is safe.
+         */
        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
                if (pmc->ifindex != gsf->gf_interface)
@@ -614,6 +632,10 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
            copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
                return -EFAULT;
        }
+        /* changes to psl require the socket lock, a read lock on
+         * on ipv6_sk_mc_lock and a write lock on pmc->sflock. We
+         * have the socket lock, so reading here is safe.
+         */
        for (i=0; i<copycount; i++) {
                struct sockaddr_in6 *psin6;
                struct sockaddr_storage ss;
@@ -650,6 +672,7 @@ int inet6_mc_check(struct sock *sk, struct in6_addr *mc_addr,
                read_unlock(&ipv6_sk_mc_lock);
                return 1;
        }
+        read_lock(&mc->sflock);
        psl = mc->sflist;
        if (!psl) {
                rv = mc->sfmode == MCAST_EXCLUDE;
@@ -665,6 +688,7 @@ int inet6_mc_check(struct sock *sk, struct in6_addr *mc_addr,
                if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
                        rv = 0;
        }
+        read_unlock(&mc->sflock);
        read_unlock(&ipv6_sk_mc_lock);
        return rv;
@@ -1068,7 +1092,8 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
        ma->mca_flags |= MAF_TIMER_RUNNING;
 }
-static void mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
+/* mark EXCLUDE-mode sources */
+static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
        struct in6_addr *srcs)
 {
        struct ip6_sf_list *psf;
@@ -1078,13 +1103,53 @@ static void mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
        for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
                if (scount == nsrcs)
                        break;
-                for (i=0; i<nsrcs; i++)
+                for (i=0; i<nsrcs; i++) {
+                        /* skip inactive filters */
+                        if (pmc->mca_sfcount[MCAST_INCLUDE] ||
+                            pmc->mca_sfcount[MCAST_EXCLUDE] !=
+                            psf->sf_count[MCAST_EXCLUDE])
+                                continue;
+                        if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
+                                scount++;
+                                break;
+                        }
+                }
+        }
+        pmc->mca_flags &= ~MAF_GSQUERY;
+        if (scount == nsrcs)    /* all sources excluded */
+                return 0;
+        return 1;
+}
+static int mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
+        struct in6_addr *srcs)
+{
+        struct ip6_sf_list *psf;
+        int i, scount;
+        if (pmc->mca_sfmode == MCAST_EXCLUDE)
+                return mld_xmarksources(pmc, nsrcs, srcs);
+        /* mark INCLUDE-mode sources */
+        scount = 0;
+        for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
+                if (scount == nsrcs)
+                        break;
+                for (i=0; i<nsrcs; i++) {
                        if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
                                psf->sf_gsresp = 1;
                                scount++;
                                break;
                        }
+                }
+        }
+        if (!scount) {
+                pmc->mca_flags &= ~MAF_GSQUERY;
+                return 0;
        }
+        pmc->mca_flags |= MAF_GSQUERY;
+        return 1;
 }
 int igmp6_event_query(struct sk_buff *skb)
@@ -1167,7 +1232,7 @@ int igmp6_event_query(struct sk_buff *skb)
                /* mark sources to include, if group & source-specific */
                if (mlh2->nsrcs != 0) {
                        if (!pskb_may_pull(skb, srcs_offset + 
-                                mlh2->nsrcs * sizeof(struct in6_addr))) {
+                            ntohs(mlh2->nsrcs) * sizeof(struct in6_addr))) {
                                in6_dev_put(idev);
                                return -EINVAL;
                        }
@@ -1203,10 +1268,9 @@ int igmp6_event_query(struct sk_buff *skb)
                                else
                                        ma->mca_flags &= ~MAF_GSQUERY;
                        }
-                        if (ma->mca_flags & MAF_GSQUERY)
+                        if (!(ma->mca_flags & MAF_GSQUERY) ||
-                                mld_marksources(ma, ntohs(mlh2->nsrcs),
+                           mld_marksources(ma, ntohs(mlh2->nsrcs), mlh2->srcs))
-                                        mlh2->srcs);
+                                igmp6_group_queried(ma, max_delay);
-                        igmp6_group_queried(ma, max_delay);
                        spin_unlock_bh(&ma->mca_lock);
                        if (group_type != IPV6_ADDR_ANY)
                                break;
@@ -1281,7 +1345,18 @@ static int is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
        case MLD2_MODE_IS_EXCLUDE:
                if (gdeleted || sdeleted)
                        return 0;
-                return !((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp);
+                if (!((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp)) {
+                        if (pmc->mca_sfmode == MCAST_INCLUDE)
+                                return 1;
+                        /* don't include if this source is excluded
+                         * in all filters
+                         */
+                        if (psf->sf_count[MCAST_INCLUDE])
+                                return 0;
+                        return pmc->mca_sfcount[MCAST_EXCLUDE] ==
+                                psf->sf_count[MCAST_EXCLUDE];
+                }
+                return 0;
        case MLD2_CHANGE_TO_INCLUDE:
                if (gdeleted || sdeleted)
                        return 0;
@@ -1450,7 +1525,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
        struct mld2_report *pmr;
        struct mld2_grec *pgr = NULL;
        struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
-        int scount, first, isquery, truncate;
+        int scount, stotal, first, isquery, truncate;
        if (pmc->mca_flags & MAF_NOREPORT)
                return skb;
@@ -1460,25 +1535,13 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
        truncate = type == MLD2_MODE_IS_EXCLUDE ||
                    type == MLD2_CHANGE_TO_EXCLUDE;
+        stotal = scount = 0;
        psf_list = sdeleted ? &pmc->mca_tomb : &pmc->mca_sources;
-        if (!*psf_list) {
+        if (!*psf_list)
-                if (type == MLD2_ALLOW_NEW_SOURCES ||
+                goto empty_source;
-                    type == MLD2_BLOCK_OLD_SOURCES)
-                        return skb;
-                if (pmc->mca_crcount || isquery) {
-                        /* make sure we have room for group header and at
-                         * least one source.
-                         */
-                        if (skb && AVAILABLE(skb) < sizeof(struct mld2_grec)+
-                            sizeof(struct in6_addr)) {
-                                mld_sendpack(skb);
-                                skb = NULL; /* add_grhead will get a new one */
-                        }
-                        skb = add_grhead(skb, pmc, type, &pgr);
-                }
-                return skb;
-        }
        pmr = skb ? (struct mld2_report *)skb->h.raw : NULL;
        /* EX and TO_EX get a fresh packet, if needed */
@@ -1491,7 +1554,6 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                }
        }
        first = 1;
-        scount = 0;
        psf_prev = NULL;
        for (psf=*psf_list; psf; psf=psf_next) {
                struct in6_addr *psrc;
@@ -1525,7 +1587,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                }
                psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc));
                *psrc = psf->sf_addr;
-                scount++;
+                scount++; stotal++;
                if ((type == MLD2_ALLOW_NEW_SOURCES ||
                     type == MLD2_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
                        psf->sf_crcount--;
@@ -1540,6 +1602,21 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                }
                psf_prev = psf;
        }
+empty_source:
+        if (!stotal) {
+                if (type == MLD2_ALLOW_NEW_SOURCES ||
+                    type == MLD2_BLOCK_OLD_SOURCES)
+                        return skb;
+                if (pmc->mca_crcount || isquery) {
+                        /* make sure we have room for group header */
+                        if (skb && AVAILABLE(skb) < sizeof(struct mld2_grec)) {
+                                mld_sendpack(skb);
+                                skb = NULL; /* add_grhead will get a new one */
+                        }
+                        skb = add_grhead(skb, pmc, type, &pgr);
+                }
+        }
        if (pgr)
                pgr->grec_nsrcs = htons(scount);
@@ -1621,11 +1698,11 @@ static void mld_send_cr(struct inet6_dev *idev)
                        skb = add_grec(skb, pmc, dtype, 1, 1);
                }
                if (pmc->mca_crcount) {
-                        pmc->mca_crcount--;
                        if (pmc->mca_sfmode == MCAST_EXCLUDE) {
                                type = MLD2_CHANGE_TO_INCLUDE;
                                skb = add_grec(skb, pmc, type, 1, 0);
                        }
+                        pmc->mca_crcount--;
                        if (pmc->mca_crcount == 0) {
                                mld_clear_zeros(&pmc->mca_tomb);
                                mld_clear_zeros(&pmc->mca_sources);
@@ -1659,12 +1736,12 @@ static void mld_send_cr(struct inet6_dev *idev)
                /* filter mode changes */
                if (pmc->mca_crcount) {
-                        pmc->mca_crcount--;
                        if (pmc->mca_sfmode == MCAST_EXCLUDE)
                                type = MLD2_CHANGE_TO_EXCLUDE;
                        else
                                type = MLD2_CHANGE_TO_INCLUDE;
                        skb = add_grec(skb, pmc, type, 0, 0);
+                        pmc->mca_crcount--;
                }
                spin_unlock_bh(&pmc->mca_lock);
        }
@@ -2023,6 +2100,9 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
 {
        int err;
+        /* callers have the socket lock and a write lock on ipv6_sk_mc_lock,
+         * so no other readers or writers of iml or its sflist
+         */
        if (iml->sflist == 0) {
                /* any-source empty exclude case */
                return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 060d61202412..04912f9b35c3 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -211,7 +211,7 @@ config IP6_NF_TARGET_REJECT
 config IP6_NF_TARGET_NFQUEUE
        tristate "NFQUEUE Target Support"
-        depends on IP_NF_IPTABLES
+        depends on IP6_NF_IPTABLES
        help
          This Target replaced the old obsolete QUEUE target.
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a7a537b50595..66140f13d119 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -413,11 +413,14 @@ static struct rt6_info *rt6_cow(struct rt6_info *ort, struct in6_addr *daddr,
        rt = ip6_rt_copy(ort);
        if (rt) {
-                ipv6_addr_copy(&rt->rt6i_dst.addr, daddr);
+                if (!(rt->rt6i_flags&RTF_GATEWAY)) {
+                        if (rt->rt6i_dst.plen != 128 &&
-                if (!(rt->rt6i_flags&RTF_GATEWAY))
+                            ipv6_addr_equal(&rt->rt6i_dst.addr, daddr))
+                                rt->rt6i_flags |= RTF_ANYCAST;
                        ipv6_addr_copy(&rt->rt6i_gateway, daddr);
+                }
+                ipv6_addr_copy(&rt->rt6i_dst.addr, daddr);
                rt->rt6i_dst.plen = 128;
                rt->rt6i_flags |= RTF_CACHE;
                rt->u.dst.flags |= DST_HOST;
@@ -829,7 +832,7 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
        }
        rt->u.dst.obsolete = -1;
-        rt->rt6i_expires = clock_t_to_jiffies(rtmsg->rtmsg_info);
+        rt->rt6i_expires = jiffies + clock_t_to_jiffies(rtmsg->rtmsg_info);
        if (nlh && (r = NLMSG_DATA(nlh))) {
                rt->rt6i_protocol = r->rtm_protocol;
        } else {
@@ -1413,7 +1416,9 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
        rt->u.dst.obsolete = -1;
        rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
-        if (!anycast)
+        if (anycast)
+                rt->rt6i_flags |= RTF_ANYCAST;
+        else
                rt->rt6i_flags |= RTF_LOCAL;
        rt->rt6i_nexthop = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_gateway);
        if (rt->rt6i_nexthop == NULL) {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index cf1d91e74c82..69bd957380e7 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -214,6 +214,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                case IPPROTO_UDP:
                case IPPROTO_TCP:
                case IPPROTO_SCTP:
+                case IPPROTO_DCCP:
                        if (pskb_may_pull(skb, skb->nh.raw + offset + 4 - skb->data)) {
                                u16 *ports = (u16 *)exthdr;
diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
index 004e8599b8fe..a7d88b5ad756 100644
--- a/net/netrom/nr_in.c
+++ b/net/netrom/nr_in.c
@@ -99,7 +99,7 @@ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
                break;
        case NR_RESET:
-                if (sysctl_netrom_reset_circuit);
+                if (sysctl_netrom_reset_circuit)
                        nr_disconnect(sk, ECONNRESET);
                break;
@@ -130,7 +130,7 @@ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
                break;
        case NR_RESET:
-                if (sysctl_netrom_reset_circuit);
+                if (sysctl_netrom_reset_circuit)
                        nr_disconnect(sk, ECONNRESET);
                break;
@@ -265,7 +265,7 @@ static int nr_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype
                break;
        case NR_RESET:
-                if (sysctl_netrom_reset_circuit);
+                if (sysctl_netrom_reset_circuit)
                        nr_disconnect(sk, ECONNRESET);
                break;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 1f7f244806b7..9df888e932c5 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -156,10 +156,6 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
                                sizeof(struct sk_buff) +
                                sizeof(struct sctp_chunk);
-        sk->sk_wmem_queued += SCTP_DATA_SNDSIZE(chunk) +
-                                sizeof(struct sk_buff) +
-                                sizeof(struct sctp_chunk);
        atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
 }
@@ -4426,7 +4422,7 @@ cleanup:
 * tcp_poll().  Note that, based on these implementations, we don't
 * lock the socket in this function, even though it seems that,
 * ideally, locking or some other mechanisms can be used to ensure
- * the integrity of the counters (sndbuf and wmem_queued) used
+ * the integrity of the counters (sndbuf and wmem_alloc) used
 * in this place.  We assume that we don't need locks either until proven
 * otherwise.
 *
@@ -4833,10 +4829,6 @@ static void sctp_wfree(struct sk_buff *skb)
                                sizeof(struct sk_buff) +
                                sizeof(struct sctp_chunk);
-        sk->sk_wmem_queued -= SCTP_DATA_SNDSIZE(chunk) +
-                                sizeof(struct sk_buff) +
-                                sizeof(struct sctp_chunk);
        atomic_sub(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
        sock_wfree(skb);
@@ -4920,7 +4912,7 @@ void sctp_write_space(struct sock *sk)
 /* Is there any sndbuf space available on the socket?
 *
- * Note that wmem_queued is the sum of the send buffers on all of the
+ * Note that sk_wmem_alloc is the sum of the send buffers on all of the
 * associations on the same socket.  For a UDP-style socket with
 * multiple associations, it is possible for it to be "unwriteable"
 * prematurely.  I assume that this is acceptable because
@@ -4933,7 +4925,7 @@ static int sctp_writeable(struct sock *sk)
 {
        int amt = 0;
-        amt = sk->sk_sndbuf - sk->sk_wmem_queued;
+        amt = sk->sk_sndbuf - atomic_read(&sk->sk_wmem_alloc);
        if (amt < 0)
                amt = 0;
        return amt;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f44f46f1d8e0..8d782282ec19 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -638,7 +638,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
                                gss_msg);
                atomic_inc(&gss_msg->count);
                gss_unhash_msg(gss_msg);
-                if (msg->errno == -ETIMEDOUT || msg->errno == -EPIPE) {
+                if (msg->errno == -ETIMEDOUT) {
                        unsigned long now = jiffies;
                        if (time_after(now, ratelimit)) {
                                printk(KERN_WARNING "RPC: AUTH_GSS upcall timed out.\n"
@@ -786,7 +786,9 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int taskflags)
        cred->gc_flags = 0;
        cred->gc_base.cr_ops = &gss_credops;
        cred->gc_service = gss_auth->service;
-        err = gss_create_upcall(gss_auth, cred);
+        do {
+                err = gss_create_upcall(gss_auth, cred);
+        } while (err == -EAGAIN);
        if (err < 0)
                goto out_err;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index c76ea221798c..16a2458f38f7 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -174,7 +174,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
                goto out;
        msg = (struct rpc_pipe_msg *)filp->private_data;
        if (msg != NULL) {
-                msg->errno = -EPIPE;
+                msg->errno = -EAGAIN;
                list_del_init(&msg->list);
                rpci->ops->destroy_msg(msg);
        }
@@ -183,7 +183,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
        if (filp->f_mode & FMODE_READ)
                rpci->nreaders --;
        if (!rpci->nreaders)
-                __rpc_purge_upcall(inode, -EPIPE);
+                __rpc_purge_upcall(inode, -EAGAIN);
        if (rpci->ops->release_pipe)
                rpci->ops->release_pipe(inode);
 out:
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 0a51fd46a848..77e8800d4127 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -990,6 +990,7 @@ static void xs_udp_connect_worker(void *args)
                sk->sk_data_ready = xs_udp_data_ready;
                sk->sk_write_space = xs_udp_write_space;
                sk->sk_no_check = UDP_CSUM_NORCV;
+                sk->sk_allocation = GFP_ATOMIC;
                xprt_set_connected(xprt);
@@ -1074,6 +1075,7 @@ static void xs_tcp_connect_worker(void *args)
                sk->sk_data_ready = xs_tcp_data_ready;
                sk->sk_state_change = xs_tcp_state_change;
                sk->sk_write_space = xs_tcp_write_space;
+                sk->sk_allocation = GFP_ATOMIC;
                /* socket options */
                sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0db9e57013fd..d19e274b9c4a 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -346,6 +346,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
        struct xfrm_policy *pol, **p;
        struct xfrm_policy *delpol = NULL;
        struct xfrm_policy **newpos = NULL;
+        struct dst_entry *gc_list;
        write_lock_bh(&xfrm_policy_lock);
        for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL;) {
@@ -381,9 +382,36 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                xfrm_pol_hold(policy);
        write_unlock_bh(&xfrm_policy_lock);
-        if (delpol) {
+        if (delpol)
                xfrm_policy_kill(delpol);
+        read_lock_bh(&xfrm_policy_lock);
+        gc_list = NULL;
+        for (policy = policy->next; policy; policy = policy->next) {
+                struct dst_entry *dst;
+                write_lock(&policy->lock);
+                dst = policy->bundles;
+                if (dst) {
+                        struct dst_entry *tail = dst;
+                        while (tail->next)
+                                tail = tail->next;
+                        tail->next = gc_list;
+                        gc_list = dst;
+                        policy->bundles = NULL;
+                }
+                write_unlock(&policy->lock);
+        }
+        read_unlock_bh(&xfrm_policy_lock);
+        while (gc_list) {
+                struct dst_entry *dst = gc_list;
+                gc_list = dst->next;
+                dst_free(dst);
        }
        return 0;
 }
 EXPORT_SYMBOL(xfrm_policy_insert);
@@ -1014,13 +1042,12 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 }
 EXPORT_SYMBOL(__xfrm_route_forward);
-/* Optimize later using cookies and generation ids. */
 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        if (!stale_bundle(dst))
+        /* If it is marked obsolete, which is how we even get here,
-                return dst;
+         * then we have purged it from the policy bundle list and we
+         * did that for a good reason.
+         */
        return NULL;
 }
@@ -1104,6 +1131,16 @@ int xfrm_flush_bundles(void)
        return 0;
 }
+static int always_true(struct dst_entry *dst)
+{
+        return 1;
+}
+void xfrm_flush_all_bundles(void)
+{
+        xfrm_prune_bundles(always_true);
+}
 void xfrm_init_pmtu(struct dst_entry *dst)
 {
        do {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 7cf48aa6c95b..479effc97666 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -431,6 +431,8 @@ void xfrm_state_insert(struct xfrm_state *x)
        spin_lock_bh(&xfrm_state_lock);
        __xfrm_state_insert(x);
        spin_unlock_bh(&xfrm_state_lock);
+        xfrm_flush_all_bundles();
 }
 EXPORT_SYMBOL(xfrm_state_insert);
@@ -478,6 +480,9 @@ out:
        spin_unlock_bh(&xfrm_state_lock);
        xfrm_state_put_afinfo(afinfo);
+        if (!err)
+                xfrm_flush_all_bundles();
        if (x1) {
                xfrm_state_delete(x1);
                xfrm_state_put(x1);
diff --git a/sound/sparc/Kconfig b/sound/sparc/Kconfig
index 09ab138646a6..ef022a846b06 100644
--- a/sound/sparc/Kconfig
+++ b/sound/sparc/Kconfig
@@ -1,7 +1,7 @@
 # ALSA Sparc drivers
 menu "ALSA Sparc devices"
-        depends on SND!=n && (SPARC32 || SPARC64)
+        depends on SND!=n && SPARC
 config SND_SUN_AMD7930
        tristate "Sun AMD7930"