112 files changed, 750 insertions, 513 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index da6973adacda..6af683025ae0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -536,7 +536,7 @@ P:	Mauro Carvalho Chehab
 M:      mchehab@brturbo.com.br
 L:      video4linux-list@redhat.com
 W:      http://linuxtv.org
-T:      quilt http://www.linuxtv.org/download/quilt/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Maintained
 
 BUSLOGIC SCSI DRIVER
@@ -834,7 +834,7 @@ P:	LinuxTV.org Project
 M:      linux-dvb-maintainer@linuxtv.org
 L:      linux-dvb@linuxtv.org (subscription required)
 W:      http://linuxtv.org/
-T:      quilt http://www.linuxtv.org/download/quilt/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Supported
 
 EATA-DMA SCSI DRIVER
@@ -2896,7 +2896,7 @@ P:	Mauro Carvalho Chehab
 M:      mchehab@brturbo.com.br
 L:      video4linux-list@redhat.com
 W:      http://linuxtv.org
-T:      quilt http://www.linuxtv.org/download/quilt/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Maintained
 
 W1 DALLAS'S 1-WIRE BUS
diff --git a/Makefile b/Makefile
index ad457e1bd0d2..f4218b5db827 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 15
-EXTRAVERSION =-rc5
-NAME=Affluent Albatross
+EXTRAVERSION =-rc6
+NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/alpha/kernel/machvec_impl.h b/arch/alpha/kernel/machvec_impl.h
index 4959b7a3e1e6..11f996f24fde 100644
--- a/arch/alpha/kernel/machvec_impl.h
+++ b/arch/alpha/kernel/machvec_impl.h
@@ -41,7 +41,7 @@
 #define CAT1(x,y)  x##y
 #define CAT(x,y)   CAT1(x,y)
 
-#define DO_DEFAULT_RTC rtc_port: 0x70
+#define DO_DEFAULT_RTC .rtc_port = 0x70
 
 #define DO_EV4_MMU                                                      \
         .max_asn =                      EV4_MAX_ASN,                    \
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 2ad4aa2a1536..55076a75e5bf 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -131,7 +131,7 @@ __syscall_start:
                 .long   sys_wait4
 /* 115 */       .long   sys_swapoff
                 .long   sys_sysinfo
-                .long   sys_ipc_wrapper
+                .long   sys_ipc
                 .long   sys_fsync
                 .long   sys_sigreturn_wrapper
 /* 120 */       .long   sys_clone_wrapper
@@ -254,7 +254,7 @@ __syscall_start:
                 .long   sys_fremovexattr
                 .long   sys_tkill
                 .long   sys_sendfile64
-/* 240 */       .long   sys_futex_wrapper
+/* 240 */       .long   sys_futex
                 .long   sys_sched_setaffinity
                 .long   sys_sched_getaffinity
                 .long   sys_io_setup
@@ -284,7 +284,7 @@ __syscall_start:
                 .long   sys_fstatfs64
                 .long   sys_tgkill
                 .long   sys_utimes
-/* 270 */       .long   sys_arm_fadvise64_64_wrapper
+/* 270 */       .long   sys_arm_fadvise64_64
                 .long   sys_pciconfig_iobase
                 .long   sys_pciconfig_read
                 .long   sys_pciconfig_write
@@ -333,7 +333,7 @@ __syscall_start:
                 .long   sys_inotify_init
                 .long   sys_inotify_add_watch
                 .long   sys_inotify_rm_watch
-                .long   sys_mbind_wrapper
+                .long   sys_mbind
 /* 320 */       .long   sys_get_mempolicy
                 .long   sys_set_mempolicy
 __syscall_end:
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index d9fb819bf7cc..2a8d27e18fa7 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -614,6 +614,47 @@ __kuser_helper_start:
 /*
  * Reference prototype:
  *
+ *      void __kernel_memory_barrier(void)
+ *
+ * Input:
+ *
+ *      lr = return address
+ *
+ * Output:
+ *
+ *      none
+ *
+ * Clobbered:
+ *
+ *      the Z flag might be lost
+ *
+ * Definition and user space usage example:
+ *
+ *      typedef void (__kernel_dmb_t)(void);
+ *      #define __kernel_dmb (*(__kernel_dmb_t *)0xffff0fa0)
+ *
+ * Apply any needed memory barrier to preserve consistency with data modified
+ * manually and __kuser_cmpxchg usage.
+ *
+ * This could be used as follows:
+ *
+ * #define __kernel_dmb() \
+ *         asm volatile ( "mov r0, #0xffff0fff; mov lr, pc; sub pc, r0, #95" \
+ *              : : : "lr","cc" )
+ */
+
+__kuser_memory_barrier:                         @ 0xffff0fa0
+
+#if __LINUX_ARM_ARCH__ >= 6 && defined(CONFIG_SMP)
+        mcr     p15, 0, r0, c7, c10, 5  @ dmb
+#endif
+        mov     pc, lr
+
+        .align  5
+
+/*
+ * Reference prototype:
+ *
  *      int __kernel_cmpxchg(int oldval, int newval, int *ptr)
  *
  * Input:
@@ -642,6 +683,8 @@ __kuser_helper_start:
  * The C flag is also set if *ptr was changed to allow for assembly
  * optimization in the calling code.
  *
+ * Note: this routine already includes memory barriers as needed.
+ *
  * For example, a user space atomic_add implementation could look like this:
  *
  * #define atomic_add(ptr, val) \
@@ -698,10 +741,16 @@ __kuser_cmpxchg:				@ 0xffff0fc0
 
 #else
 
+#ifdef CONFIG_SMP
+        mcr     p15, 0, r0, c7, c10, 5  @ dmb
+#endif
         ldrex   r3, [r2]
         subs    r3, r3, r0
         strexeq r3, r1, [r2]
         rsbs    r0, r3, #0
+#ifdef CONFIG_SMP
+        mcr     p15, 0, r0, c7, c10, 5  @ dmb
+#endif
         mov     pc, lr
 
 #endif
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index f7f183075237..e2b42997ad33 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -145,7 +145,7 @@ ENTRY(vector_swi)
 #endif
         enable_irq
 
-        str     r4, [sp, #-S_OFF]!              @ push fifth arg
+        stmdb   sp!, {r4, r5}                   @ push fifth and sixth args
 
         get_thread_info tsk
         ldr     ip, [tsk, #TI_FLAGS]            @ check for syscall tracing
@@ -204,7 +204,7 @@ ENTRY(sys_call_table)
  * Special system call wrappers
  */
 @ r0 = syscall number
-@ r5 = syscall table
+@ r8 = syscall table
                 .type   sys_syscall, #function
 sys_syscall:
                 eor     scno, r0, #__NR_SYSCALL_BASE
@@ -255,22 +255,6 @@ sys_sigaltstack_wrapper:
                 ldr     r2, [sp, #S_OFF + S_SP]
                 b       do_sigaltstack
 
-sys_futex_wrapper:
-                str     r5, [sp, #4]            @ push sixth arg
-                b       sys_futex
-
-sys_arm_fadvise64_64_wrapper:
-                str     r5, [sp, #4]            @ push r5 to stack
-                b       sys_arm_fadvise64_64
-
-sys_mbind_wrapper:
-                str     r5, [sp, #4]
-                b       sys_mbind
-
-sys_ipc_wrapper:
-                str     r5, [sp, #4]            @ push sixth arg
-                b       sys_ipc
-
 /*
  * Note: off_4k (r5) is always units of 4K.  If we can't do the requested
  * offset, we return EINVAL.
diff --git a/arch/i386/mm/ioremap.c b/arch/i386/mm/ioremap.c
index 8498b5ac3955..247fde76aaed 100644
--- a/arch/i386/mm/ioremap.c
+++ b/arch/i386/mm/ioremap.c
@@ -245,7 +245,7 @@ void iounmap(volatile void __iomem *addr)
                         addr < phys_to_virt(ISA_END_ADDRESS))
                 return;
 
-        addr = (volatile void *)(PAGE_MASK & (unsigned long __force)addr);
+        addr = (volatile void __iomem *)(PAGE_MASK & (unsigned long __force)addr);
 
         /* Use the vm area unlocked, assuming the caller
            ensures there isn't another iounmap for the same address
diff --git a/arch/i386/pci/mmconfig.c b/arch/i386/pci/mmconfig.c
index 08a084901212..4bb4d4b0f73a 100644
--- a/arch/i386/pci/mmconfig.c
+++ b/arch/i386/pci/mmconfig.c
@@ -155,7 +155,7 @@ static __init void unreachable_devices(void)
                 addr = get_base_addr(0, 0, PCI_DEVFN(i, 0));
                 if (addr != 0)
                         pci_exp_set_dev_base(addr, 0, PCI_DEVFN(i, 0));
-                if (addr == 0 || readl((u32 *)addr) != val1)
+                if (addr == 0 || readl((u32 __iomem *)mmcfg_virt_addr) != val1)
                         set_bit(i, fallback_slots);
                 spin_unlock_irqrestore(&pci_config_lock, flags);
         }
diff --git a/arch/ia64/configs/sn2_defconfig b/arch/ia64/configs/sn2_defconfig
index e1924cc9687b..ff8bb3770c9d 100644
--- a/arch/ia64/configs/sn2_defconfig
+++ b/arch/ia64/configs/sn2_defconfig
@@ -113,7 +113,7 @@ CONFIG_IOSAPIC=y
 CONFIG_IA64_SGI_SN_XP=m
 CONFIG_FORCE_MAX_ZONEORDER=17
 CONFIG_SMP=y
-CONFIG_NR_CPUS=512
+CONFIG_NR_CPUS=1024
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_SCHED_SMT=y
 CONFIG_PREEMPT=y
diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c
index 5b7e736f3b49..028a2b95936c 100644
--- a/arch/ia64/kernel/time.c
+++ b/arch/ia64/kernel/time.c
@@ -249,3 +249,32 @@ time_init (void)
          */
         set_normalized_timespec(&wall_to_monotonic, -xtime.tv_sec, -xtime.tv_nsec);
 }
+
+#define SMALLUSECS 100
+
+void
+udelay (unsigned long usecs)
+{
+        unsigned long start;
+        unsigned long cycles;
+        unsigned long smallusecs;
+
+        /*
+         * Execute the non-preemptible delay loop (because the ITC might
+         * not be synchronized between CPUS) in relatively short time
+         * chunks, allowing preemption between the chunks.
+         */
+        while (usecs > 0) {
+                smallusecs = (usecs > SMALLUSECS) ? SMALLUSECS : usecs;
+                preempt_disable();
+                cycles = smallusecs*local_cpu_data->cyc_per_usec;
+                start = ia64_get_itc();
+
+                while (ia64_get_itc() - start < cycles)
+                        cpu_relax();
+
+                preempt_enable();
+                usecs -= smallusecs;
+        }
+}
+EXPORT_SYMBOL(udelay);
diff --git a/arch/ia64/kernel/uncached.c b/arch/ia64/kernel/uncached.c
index c6d40446c2c4..b631cf86ed44 100644
--- a/arch/ia64/kernel/uncached.c
+++ b/arch/ia64/kernel/uncached.c
@@ -53,7 +53,7 @@ static void uncached_ipi_visibility(void *data)
         if ((status != PAL_VISIBILITY_OK) &&
             (status != PAL_VISIBILITY_OK_REMOTE_NEEDED))
                 printk(KERN_DEBUG "pal_prefetch_visibility() returns %i on "
-                       "CPU %i\n", status, get_cpu());
+                       "CPU %i\n", status, raw_smp_processor_id());
 }
 
 
@@ -63,7 +63,7 @@ static void uncached_ipi_mc_drain(void *data)
         status = ia64_pal_mc_drain();
         if (status)
                 printk(KERN_WARNING "ia64_pal_mc_drain() failed with %i on "
-                       "CPU %i\n", status, get_cpu());
+                       "CPU %i\n", status, raw_smp_processor_id());
 }
 
 
@@ -105,7 +105,7 @@ uncached_get_new_chunk(struct gen_pool *poolp)
         status = ia64_pal_prefetch_visibility(PAL_VISIBILITY_PHYSICAL);
 
         dprintk(KERN_INFO "pal_prefetch_visibility() returns %i on cpu %i\n",
-                status, get_cpu());
+                status, raw_smp_processor_id());
 
         if (!status) {
                 status = smp_call_function(uncached_ipi_visibility, NULL, 0, 1);
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index 30d8564e9603..73af6267d2ef 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -177,6 +177,9 @@ SECTIONS
         }
   . = ALIGN(PAGE_SIZE);         /* make sure the gate page doesn't expose kernel data */
 
+  .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET)
+        { *(.data.read_mostly) }
+
   .data.cacheline_aligned : AT(ADDR(.data.cacheline_aligned) - LOAD_OFFSET)
         { *(.data.cacheline_aligned) }
 
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
index 5d54f5f4e926..471bbaa65d1b 100644
--- a/arch/ia64/sn/kernel/sn2/sn2_smp.c
+++ b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -202,7 +202,7 @@ sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
                      unsigned long end, unsigned long nbits)
 {
         int i, opt, shub1, cnode, mynasid, cpu, lcpu = 0, nasid, flushed = 0;
-        int mymm = (mm == current->active_mm);
+        int mymm = (mm == current->active_mm && current->mm);
         volatile unsigned long *ptc0, *ptc1;
         unsigned long itc, itc2, flags, data0 = 0, data1 = 0, rr_value;
         short nasids[MAX_NUMNODES], nix;
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_reg.c b/arch/ia64/sn/pci/pcibr/pcibr_reg.c
index 5d534091262c..79fdb91d7259 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_reg.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_reg.c
@@ -25,7 +25,7 @@ union br_ptr {
  */
 void pcireg_control_bit_clr(struct pcibus_info *pcibus_info, uint64_t bits)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -38,14 +38,14 @@ void pcireg_control_bit_clr(struct pcibus_info *pcibus_info, uint64_t bits)
                 default:
                         panic
                             ("pcireg_control_bit_clr: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 }
 
 void pcireg_control_bit_set(struct pcibus_info *pcibus_info, uint64_t bits)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -58,7 +58,7 @@ void pcireg_control_bit_set(struct pcibus_info *pcibus_info, uint64_t bits)
                 default:
                         panic
                             ("pcireg_control_bit_set: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 }
@@ -68,7 +68,7 @@ void pcireg_control_bit_set(struct pcibus_info *pcibus_info, uint64_t bits)
  */
 uint64_t pcireg_tflush_get(struct pcibus_info *pcibus_info)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
         uint64_t ret = 0;
 
         if (pcibus_info) {
@@ -82,7 +82,7 @@ uint64_t pcireg_tflush_get(struct pcibus_info *pcibus_info)
                 default:
                         panic
                             ("pcireg_tflush_get: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 
@@ -98,7 +98,7 @@ uint64_t pcireg_tflush_get(struct pcibus_info *pcibus_info)
  */
 uint64_t pcireg_intr_status_get(struct pcibus_info * pcibus_info)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
         uint64_t ret = 0;
 
         if (pcibus_info) {
@@ -112,7 +112,7 @@ uint64_t pcireg_intr_status_get(struct pcibus_info * pcibus_info)
                 default:
                         panic
                             ("pcireg_intr_status_get: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
         return ret;
@@ -123,7 +123,7 @@ uint64_t pcireg_intr_status_get(struct pcibus_info * pcibus_info)
  */
 void pcireg_intr_enable_bit_clr(struct pcibus_info *pcibus_info, uint64_t bits)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -136,14 +136,14 @@ void pcireg_intr_enable_bit_clr(struct pcibus_info *pcibus_info, uint64_t bits)
                 default:
                         panic
                             ("pcireg_intr_enable_bit_clr: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 }
 
 void pcireg_intr_enable_bit_set(struct pcibus_info *pcibus_info, uint64_t bits)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -156,7 +156,7 @@ void pcireg_intr_enable_bit_set(struct pcibus_info *pcibus_info, uint64_t bits)
                 default:
                         panic
                             ("pcireg_intr_enable_bit_set: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 }
@@ -167,7 +167,7 @@ void pcireg_intr_enable_bit_set(struct pcibus_info *pcibus_info, uint64_t bits)
 void pcireg_intr_addr_addr_set(struct pcibus_info *pcibus_info, int int_n,
                                uint64_t addr)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -186,7 +186,7 @@ void pcireg_intr_addr_addr_set(struct pcibus_info *pcibus_info, int int_n,
                 default:
                         panic
                             ("pcireg_intr_addr_addr_get: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 }
@@ -196,7 +196,7 @@ void pcireg_intr_addr_addr_set(struct pcibus_info *pcibus_info, int int_n,
  */
 void pcireg_force_intr_set(struct pcibus_info *pcibus_info, int int_n)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -209,7 +209,7 @@ void pcireg_force_intr_set(struct pcibus_info *pcibus_info, int int_n)
                 default:
                         panic
                             ("pcireg_force_intr_set: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 }
@@ -219,7 +219,7 @@ void pcireg_force_intr_set(struct pcibus_info *pcibus_info, int int_n)
  */
 uint64_t pcireg_wrb_flush_get(struct pcibus_info *pcibus_info, int device)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
         uint64_t ret = 0;
 
         if (pcibus_info) {
@@ -233,7 +233,7 @@ uint64_t pcireg_wrb_flush_get(struct pcibus_info *pcibus_info, int device)
                             __sn_readq_relaxed(&ptr->pic.p_wr_req_buf[device]);
                         break;
                 default:
-                      panic("pcireg_wrb_flush_get: unknown bridgetype bridge 0x%p", (void *)ptr);
+                      panic("pcireg_wrb_flush_get: unknown bridgetype bridge 0x%p", ptr);
                 }
 
         }
@@ -244,7 +244,7 @@ uint64_t pcireg_wrb_flush_get(struct pcibus_info *pcibus_info, int device)
 void pcireg_int_ate_set(struct pcibus_info *pcibus_info, int ate_index,
                         uint64_t val)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -257,15 +257,15 @@ void pcireg_int_ate_set(struct pcibus_info *pcibus_info, int ate_index,
                 default:
                         panic
                             ("pcireg_int_ate_set: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
 }
 
-uint64_t *pcireg_int_ate_addr(struct pcibus_info *pcibus_info, int ate_index)
+uint64_t __iomem *pcireg_int_ate_addr(struct pcibus_info *pcibus_info, int ate_index)
 {
-        union br_ptr *ptr = (union br_ptr *)pcibus_info->pbi_buscommon.bs_base;
-        uint64_t *ret = (uint64_t *) 0;
+        union br_ptr __iomem *ptr = (union br_ptr __iomem *)pcibus_info->pbi_buscommon.bs_base;
+        uint64_t __iomem *ret = NULL;
 
         if (pcibus_info) {
                 switch (pcibus_info->pbi_bridge_type) {
@@ -278,7 +278,7 @@ uint64_t *pcireg_int_ate_addr(struct pcibus_info *pcibus_info, int ate_index)
                 default:
                         panic
                             ("pcireg_int_ate_addr: unknown bridgetype bridge 0x%p",
-                             (void *)ptr);
+                             ptr);
                 }
         }
         return ret;
diff --git a/arch/ia64/sn/pci/tioca_provider.c b/arch/ia64/sn/pci/tioca_provider.c
index 46b646a6d345..27aa1842dacc 100644
--- a/arch/ia64/sn/pci/tioca_provider.c
+++ b/arch/ia64/sn/pci/tioca_provider.c
@@ -38,10 +38,10 @@ tioca_gart_init(struct tioca_kernel *tioca_kern)
         uint64_t offset;
         struct page *tmp;
         struct tioca_common *tioca_common;
-        struct tioca *ca_base;
+        struct tioca __iomem *ca_base;
 
         tioca_common = tioca_kern->ca_common;
-        ca_base = (struct tioca *)tioca_common->ca_common.bs_base;
+        ca_base = (struct tioca __iomem *)tioca_common->ca_common.bs_base;
 
         if (list_empty(tioca_kern->ca_devices))
                 return 0;
@@ -215,7 +215,7 @@ tioca_fastwrite_enable(struct tioca_kernel *tioca_kern)
 {
         int cap_ptr;
         uint32_t reg;
-        struct tioca *tioca_base;
+        struct tioca __iomem *tioca_base;
         struct pci_dev *pdev;
         struct tioca_common *common;
 
@@ -257,7 +257,7 @@ tioca_fastwrite_enable(struct tioca_kernel *tioca_kern)
          * Set ca's fw to match
          */
 
-        tioca_base = (struct tioca *)common->ca_common.bs_base;
+        tioca_base = (struct tioca __iomem*)common->ca_common.bs_base;
         __sn_setq_relaxed(&tioca_base->ca_control1, CA_AGP_FW_ENABLE);
 }
 
@@ -322,7 +322,7 @@ static uint64_t
 tioca_dma_d48(struct pci_dev *pdev, uint64_t paddr)
 {
         struct tioca_common *tioca_common;
-        struct tioca *ca_base;
+        struct tioca __iomem *ca_base;
         uint64_t ct_addr;
         dma_addr_t bus_addr;
         uint32_t node_upper;
@@ -330,7 +330,7 @@ tioca_dma_d48(struct pci_dev *pdev, uint64_t paddr)
         struct pcidev_info *pcidev_info = SN_PCIDEV_INFO(pdev);
 
         tioca_common = (struct tioca_common *)pcidev_info->pdi_pcibus_info;
-        ca_base = (struct tioca *)tioca_common->ca_common.bs_base;
+        ca_base = (struct tioca __iomem *)tioca_common->ca_common.bs_base;
 
         ct_addr = PHYS_TO_TIODMA(paddr);
         if (!ct_addr)
diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c
index f72ced11212d..91b93d917b64 100644
--- a/arch/powerpc/kernel/syscalls.c
+++ b/arch/powerpc/kernel/syscalls.c
@@ -247,7 +247,7 @@ long ppc64_personality(unsigned long personality)
 #define OVERRIDE_MACHINE    0
 #endif
 
-static inline int override_machine(char *mach)
+static inline int override_machine(char __user *mach)
 {
         if (OVERRIDE_MACHINE) {
                 /* change ppc64 to ppc */
diff --git a/arch/ppc/syslib/ppc4xx_dma.c b/arch/ppc/syslib/ppc4xx_dma.c
index f15e64285f96..05ccd598dd4e 100644
--- a/arch/ppc/syslib/ppc4xx_dma.c
+++ b/arch/ppc/syslib/ppc4xx_dma.c
@@ -30,6 +30,7 @@
 
 #include <asm/system.h>
 #include <asm/io.h>
+#include <asm/dma.h>
 #include <asm/ppc4xx_dma.h>
 
 ppc_dma_ch_t dma_channels[MAX_PPC4xx_DMA_CHANNELS];
diff --git a/arch/sparc/kernel/ebus.c b/arch/sparc/kernel/ebus.c
index 1754192c69d0..5c3529ceb5d6 100644
--- a/arch/sparc/kernel/ebus.c
+++ b/arch/sparc/kernel/ebus.c
@@ -22,7 +22,7 @@
 #include <asm/oplib.h>
 #include <asm/bpp.h>
 
-struct linux_ebus *ebus_chain = 0;
+struct linux_ebus *ebus_chain = NULL;
 
 /* We are together with pcic.c under CONFIG_PCI. */
 extern unsigned int pcic_pin_to_irq(unsigned int, char *name);
@@ -46,7 +46,7 @@ static struct ebus_device_irq je1_1[] = {
         { "SUNW,CS4231",         0 },
         { "parallel",            0 },
         { "se",                  2 },
-        { 0, 0 }
+        { NULL, 0 }
 };
 
 /*
@@ -55,7 +55,7 @@ static struct ebus_device_irq je1_1[] = {
  */
 static struct ebus_system_entry ebus_blacklist[] = {
         { "SUNW,JavaEngine1", je1_1 },
-        { 0, 0 }
+        { NULL, NULL }
 };
 
 static struct ebus_device_irq *ebus_blackp = NULL;
@@ -233,7 +233,7 @@ void __init fill_ebus_device(int node, struct linux_ebus_device *dev)
                         ebus_alloc(sizeof(struct linux_ebus_child));
 
                 child = dev->children;
-                child->next = 0;
+                child->next = NULL;
                 child->parent = dev;
                 child->bus = dev->bus;
                 fill_ebus_child(node, &regs[0], child);
@@ -243,7 +243,7 @@ void __init fill_ebus_device(int node, struct linux_ebus_device *dev)
                                 ebus_alloc(sizeof(struct linux_ebus_child));
 
                         child = child->next;
-                        child->next = 0;
+                        child->next = NULL;
                         child->parent = dev;
                         child->bus = dev->bus;
                         fill_ebus_child(node, &regs[0], child);
@@ -275,7 +275,7 @@ void __init ebus_init(void)
                 }
         }
 
-        pdev = pci_get_device(PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_EBUS, 0);
+        pdev = pci_get_device(PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_EBUS, NULL);
         if (!pdev) {
                 return;
         }
@@ -284,7 +284,7 @@ void __init ebus_init(void)
 
         ebus_chain = ebus = (struct linux_ebus *)
                         ebus_alloc(sizeof(struct linux_ebus));
-        ebus->next = 0;
+        ebus->next = NULL;
 
         while (ebusnd) {
 
@@ -325,8 +325,8 @@ void __init ebus_init(void)
                                 ebus_alloc(sizeof(struct linux_ebus_device));
 
                 dev = ebus->devices;
-                dev->next = 0;
-                dev->children = 0;
+                dev->next = NULL;
+                dev->children = NULL;
                 dev->bus = ebus;
                 fill_ebus_device(nd, dev);
 
@@ -335,8 +335,8 @@ void __init ebus_init(void)
                                 ebus_alloc(sizeof(struct linux_ebus_device));
 
                         dev = dev->next;
-                        dev->next = 0;
-                        dev->children = 0;
+                        dev->next = NULL;
+                        dev->children = NULL;
                         dev->bus = ebus;
                         fill_ebus_device(nd, dev);
                 }
@@ -353,7 +353,7 @@ void __init ebus_init(void)
                 ebus->next = (struct linux_ebus *)
                         ebus_alloc(sizeof(struct linux_ebus));
                 ebus = ebus->next;
-                ebus->next = 0;
+                ebus->next = NULL;
                 ++num_ebus;
         }
         if (pdev)
diff --git a/arch/sparc/kernel/led.c b/arch/sparc/kernel/led.c
index 2a3afca453c9..313d1620ae8e 100644
--- a/arch/sparc/kernel/led.c
+++ b/arch/sparc/kernel/led.c
@@ -55,7 +55,7 @@ static int led_read_proc(char *buf, char **start, off_t offset, int count,
         return len;
 }
 
-static int led_write_proc(struct file *file, const char *buffer,
+static int led_write_proc(struct file *file, const char __user *buffer,
                           unsigned long count, void *data)
 {
         char *buf = NULL;
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index cccfc12802ed..42002b742deb 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -161,7 +161,7 @@ static struct pcic_sn2list pcic_known_sysnames[] = {
 static int pcic0_up;
 static struct linux_pcic pcic0;
 
-void * __iomem pcic_regs;
+void __iomem *pcic_regs;
 volatile int pcic_speculative;
 volatile int pcic_trapped;
 
diff --git a/arch/sparc/kernel/time.c b/arch/sparc/kernel/time.c
index 24814d58f9e1..7dadcdb4ca42 100644
--- a/arch/sparc/kernel/time.c
+++ b/arch/sparc/kernel/time.c
@@ -49,7 +49,7 @@ DEFINE_SPINLOCK(rtc_lock);
 enum sparc_clock_type sp_clock_typ;
 DEFINE_SPINLOCK(mostek_lock);
 void __iomem *mstk48t02_regs = NULL;
-static struct mostek48t08 *mstk48t08_regs = NULL;
+static struct mostek48t08 __iomem *mstk48t08_regs = NULL;
 static int set_rtc_mmss(unsigned long);
 static int sbus_do_settimeofday(struct timespec *tv);
 
@@ -342,7 +342,7 @@ static __inline__ void clock_probe(void)
                 /* XXX r/o attribute is somewhere in r.flags */
                 r.flags = clk_reg[0].which_io;
                 r.start = clk_reg[0].phys_addr;
-                mstk48t08_regs = (struct mostek48t08 *) sbus_ioremap(&r, 0,
+                mstk48t08_regs = sbus_ioremap(&r, 0,
                     sizeof(struct mostek48t08), "mk48t08");
 
                 mstk48t02_regs = &mstk48t08_regs->regs;
diff --git a/arch/sparc/mm/sun4c.c b/arch/sparc/mm/sun4c.c
index 1d560390e282..731f19603cad 100644
--- a/arch/sparc/mm/sun4c.c
+++ b/arch/sparc/mm/sun4c.c
@@ -497,7 +497,7 @@ static void __init sun4c_probe_mmu(void)
         patch_kernel_fault_handler();
 }
 
-volatile unsigned long *sun4c_memerr_reg = NULL;
+volatile unsigned long __iomem *sun4c_memerr_reg = NULL;
 
 void __init sun4c_probe_memerr_reg(void)
 {
diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index 563301fe5df8..1eb21de9d1b5 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -289,6 +289,8 @@ source "arch/um/Kconfig.net"
 
 source "drivers/net/Kconfig"
 
+source "drivers/connector/Kconfig"
+
 source "fs/Kconfig"
 
 source "security/Kconfig"
diff --git a/arch/um/Makefile-x86_64 b/arch/um/Makefile-x86_64
index 4f118d5cc2ee..38df311e75dc 100644
--- a/arch/um/Makefile-x86_64
+++ b/arch/um/Makefile-x86_64
@@ -12,3 +12,7 @@ CHECKFLAGS  += -m64
 
 ELF_ARCH := i386:x86-64
 ELF_FORMAT := elf64-x86-64
+
+# Not on all 64-bit distros /lib is a symlink to /lib64. PLD is an example.
+
+LINK-$(CONFIG_LD_SCRIPT_DYN) += -Wl,-rpath,/lib64
diff --git a/arch/um/include/sysdep-i386/stub.h b/arch/um/include/sysdep-i386/stub.h
index 6ba8cbbe0d36..b492b12b4a10 100644
--- a/arch/um/include/sysdep-i386/stub.h
+++ b/arch/um/include/sysdep-i386/stub.h
@@ -6,8 +6,12 @@
 #ifndef __SYSDEP_STUB_H
 #define __SYSDEP_STUB_H
 
+#include <sys/mman.h>
 #include <asm/ptrace.h>
 #include <asm/unistd.h>
+#include "stub-data.h"
+#include "kern_constants.h"
+#include "uml-config.h"
 
 extern void stub_segv_handler(int sig);
 extern void stub_clone_handler(void);
@@ -76,23 +80,22 @@ static inline long stub_syscall5(long syscall, long arg1, long arg2, long arg3,
         return ret;
 }
 
-static inline long stub_syscall6(long syscall, long arg1, long arg2, long arg3,
-                                 long arg4, long arg5, long arg6)
+static inline void trap_myself(void)
 {
-        long ret;
-
-        __asm__ volatile ("push %%ebp ; movl %%eax,%%ebp ; movl %1,%%eax ; "
-                        "int $0x80 ; pop %%ebp"
-                        : "=a" (ret)
-                        : "g" (syscall), "b" (arg1), "c" (arg2), "d" (arg3),
-                          "S" (arg4), "D" (arg5), "0" (arg6));
-
-        return ret;
+        __asm("int3");
 }
 
-static inline void trap_myself(void)
+static inline void remap_stack(int fd, unsigned long offset)
 {
-        __asm("int3");
+        __asm__ volatile ("movl %%eax,%%ebp ; movl %0,%%eax ; int $0x80 ;"
+                          "movl %7, %%ebx ; movl %%eax, (%%ebx)"
+                          : : "g" (STUB_MMAP_NR), "b" (UML_CONFIG_STUB_DATA), 
+                            "c" (UM_KERN_PAGE_SIZE), 
+                            "d" (PROT_READ | PROT_WRITE),
+                            "S" (MAP_FIXED | MAP_SHARED), "D" (fd), 
+                            "a" (offset), 
+                            "i" (&((struct stub_data *) UML_CONFIG_STUB_DATA)->err) 
+                          : "memory");
 }
 
 #endif
diff --git a/arch/um/include/sysdep-x86_64/stub.h b/arch/um/include/sysdep-x86_64/stub.h
index c41689c13dc9..92e989f81761 100644
--- a/arch/um/include/sysdep-x86_64/stub.h
+++ b/arch/um/include/sysdep-x86_64/stub.h
@@ -6,8 +6,12 @@
 #ifndef __SYSDEP_STUB_H
 #define __SYSDEP_STUB_H
 
+#include <sys/mman.h>
 #include <asm/unistd.h>
 #include <sysdep/ptrace_user.h>
+#include "stub-data.h"
+#include "kern_constants.h"
+#include "uml-config.h"
 
 extern void stub_segv_handler(int sig);
 extern void stub_clone_handler(void);
@@ -81,23 +85,23 @@ static inline long stub_syscall5(long syscall, long arg1, long arg2, long arg3,
         return ret;
 }
 
-static inline long stub_syscall6(long syscall, long arg1, long arg2, long arg3,
-                                 long arg4, long arg5, long arg6)
+static inline void trap_myself(void)
 {
-        long ret;
-
-        __asm__ volatile ("movq %5,%%r10 ; movq %6,%%r8 ; "
-                "movq %7, %%r9; " __syscall : "=a" (ret)
-                : "0" (syscall), "D" (arg1), "S" (arg2), "d" (arg3),
-                  "g" (arg4), "g" (arg5), "g" (arg6)
-                : __syscall_clobber, "r10", "r8", "r9" );
-
-        return ret;
+        __asm("int3");
 }
 
-static inline void trap_myself(void)
+static inline void remap_stack(long fd, unsigned long offset)
 {
-        __asm("int3");
+        __asm__ volatile ("movq %4,%%r10 ; movq %5,%%r8 ; "
+                          "movq %6, %%r9; " __syscall "; movq %7, %%rbx ; "
+                          "movq %%rax, (%%rbx)": 
+                          : "a" (STUB_MMAP_NR), "D" (UML_CONFIG_STUB_DATA), 
+                            "S" (UM_KERN_PAGE_SIZE), 
+                            "d" (PROT_READ | PROT_WRITE), 
+                            "g" (MAP_FIXED | MAP_SHARED), "g" (fd), 
+                            "g" (offset),
+                            "i" (&((struct stub_data *) UML_CONFIG_STUB_DATA)->err)
+                          : __syscall_clobber, "r10", "r8", "r9" );
 }
 
 #endif
diff --git a/arch/um/kernel/skas/clone.c b/arch/um/kernel/skas/clone.c
index cb37ce9124a6..47b812b3bca8 100644
--- a/arch/um/kernel/skas/clone.c
+++ b/arch/um/kernel/skas/clone.c
@@ -18,11 +18,10 @@
  * on some systems.
  */
 
-#define STUB_DATA(field) (((struct stub_data *) UML_CONFIG_STUB_DATA)->field)
-
 void __attribute__ ((__section__ (".__syscall_stub")))
 stub_clone_handler(void)
 {
+        struct stub_data *data = (struct stub_data *) UML_CONFIG_STUB_DATA;
         long err;
 
         err = stub_syscall2(__NR_clone, CLONE_PARENT | CLONE_FILES | SIGCHLD,
@@ -35,17 +34,21 @@ stub_clone_handler(void)
         if(err)
                 goto out;
 
-        err = stub_syscall3(__NR_setitimer, ITIMER_VIRTUAL,
-                            (long) &STUB_DATA(timer), 0);
+        err = stub_syscall3(__NR_setitimer, ITIMER_VIRTUAL, 
+                            (long) &data->timer, 0);
         if(err)
                 goto out;
 
-        err = stub_syscall6(STUB_MMAP_NR, UML_CONFIG_STUB_DATA,
-                            UM_KERN_PAGE_SIZE, PROT_READ | PROT_WRITE,
-                            MAP_FIXED | MAP_SHARED, STUB_DATA(fd),
-                            STUB_DATA(offset));
+        remap_stack(data->fd, data->offset);
+        goto done;
+
  out:
-        /* save current result. Parent: pid; child: retcode of mmap */
-        STUB_DATA(err) = err;
+        /* save current result. 
+         * Parent: pid; 
+         * child: retcode of mmap already saved and it jumps around this 
+         * assignment
+         */
+        data->err = err;
+ done:
         trap_myself();
 }
diff --git a/arch/um/scripts/Makefile.rules b/arch/um/scripts/Makefile.rules
index b3fbf125709b..2e41cabd3d93 100644
--- a/arch/um/scripts/Makefile.rules
+++ b/arch/um/scripts/Makefile.rules
@@ -21,11 +21,6 @@ define unprofile
 endef
 
 
-# The stubs and unmap.o can't try to call mcount or update basic block data
-define unprofile
-        $(patsubst -pg,,$(patsubst -fprofile-arcs -ftest-coverage,,$(1)))
-endef
-
 # cmd_make_link checks to see if the $(foo-dir) variable starts with a /.  If
 # so, it's considered to be a path relative to $(srcdir) rather than
 # $(srcdir)/arch/$(SUBARCH).  This is because x86_64 wants to get ldt.c from
diff --git a/arch/x86_64/mm/ioremap.c b/arch/x86_64/mm/ioremap.c
index 0d260e4492f7..ae207064201e 100644
--- a/arch/x86_64/mm/ioremap.c
+++ b/arch/x86_64/mm/ioremap.c
@@ -263,7 +263,7 @@ void iounmap(volatile void __iomem *addr)
                 addr < phys_to_virt(ISA_END_ADDRESS))
                 return;
 
-        addr = (volatile void *)(PAGE_MASK & (unsigned long __force)addr);
+        addr = (volatile void __iomem *)(PAGE_MASK & (unsigned long __force)addr);
         /* Use the vm area unlocked, assuming the caller
            ensures there isn't another iounmap for the same address
            in parallel. Reuse of the virtual address is prevented by
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index 9c4f907e301c..f16c0d57c552 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -18,11 +18,11 @@ static DECLARE_BITMAP(fallback_slots, 32);
 /* Static virtual mapping of the MMCONFIG aperture */
 struct mmcfg_virt {
         struct acpi_table_mcfg_config *cfg;
-        char *virt;
+        char __iomem *virt;
 };
 static struct mmcfg_virt *pci_mmcfg_virt;
 
-static char *get_virt(unsigned int seg, unsigned bus)
+static char __iomem *get_virt(unsigned int seg, unsigned bus)
 {
         int cfg_num = -1;
         struct acpi_table_mcfg_config *cfg;
@@ -43,9 +43,9 @@ static char *get_virt(unsigned int seg, unsigned bus)
         }
 }
 
-static char *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
+static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
 {
-        char *addr;
+        char __iomem *addr;
         if (seg == 0 && bus == 0 && test_bit(PCI_SLOT(devfn), &fallback_slots))
                 return NULL;
         addr = get_virt(seg, bus);
@@ -57,7 +57,7 @@ static char *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn
 static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
                           unsigned int devfn, int reg, int len, u32 *value)
 {
-        char *addr;
+        char __iomem *addr;
 
         /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
         if (unlikely(!value || (bus > 255) || (devfn > 255) || (reg > 4095)))
@@ -85,7 +85,7 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
 static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
                            unsigned int devfn, int reg, int len, u32 value)
 {
-        char *addr;
+        char __iomem *addr;
 
         /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
         if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095)))
@@ -127,7 +127,7 @@ static __init void unreachable_devices(void)
         int i;
         for (i = 0; i < 32; i++) {
                 u32 val1;
-                char *addr;
+                char __iomem *addr;
 
                 pci_conf1_read(0, 0, PCI_DEVFN(i,0), 0, 4, &val1);
                 if (val1 == 0xffffffff)
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 382dea7b224c..6e7db2e79f42 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -442,11 +442,37 @@ error:
         return err;
 }
 
+
+/* Send basic block requests */
+static int __blk_send_generic(request_queue_t *q, struct gendisk *bd_disk, int cmd, int data)
+{
+        struct request *rq;
+        int err;
+
+        rq = blk_get_request(q, WRITE, __GFP_WAIT);
+        rq->flags |= REQ_BLOCK_PC;
+        rq->data = NULL;
+        rq->data_len = 0;
+        rq->timeout = BLK_DEFAULT_TIMEOUT;
+        memset(rq->cmd, 0, sizeof(rq->cmd));
+        rq->cmd[0] = cmd;
+        rq->cmd[4] = data;
+        rq->cmd_len = 6;
+        err = blk_execute_rq(q, bd_disk, rq, 0);
+        blk_put_request(rq);
+
+        return err;
+}
+
+static inline int blk_send_start_stop(request_queue_t *q, struct gendisk *bd_disk, int data)
+{
+        return __blk_send_generic(q, bd_disk, GPCMD_START_STOP_UNIT, data);
+}
+
 int scsi_cmd_ioctl(struct file *file, struct gendisk *bd_disk, unsigned int cmd, void __user *arg)
 {
         request_queue_t *q;
-        struct request *rq;
-        int close = 0, err;
+        int err;
 
         q = bd_disk->queue;
         if (!q)
@@ -564,19 +590,10 @@ int scsi_cmd_ioctl(struct file *file, struct gendisk *bd_disk, unsigned int cmd,
                         err = sg_scsi_ioctl(file, q, bd_disk, arg);
                         break;
                 case CDROMCLOSETRAY:
-                        close = 1;
+                        err = blk_send_start_stop(q, bd_disk, 0x03);
+                        break;
                 case CDROMEJECT:
-                        rq = blk_get_request(q, WRITE, __GFP_WAIT);
-                        rq->flags |= REQ_BLOCK_PC;
-                        rq->data = NULL;
-                        rq->data_len = 0;
-                        rq->timeout = BLK_DEFAULT_TIMEOUT;
-                        memset(rq->cmd, 0, sizeof(rq->cmd));
-                        rq->cmd[0] = GPCMD_START_STOP_UNIT;
-                        rq->cmd[4] = 0x02 + (close != 0);
-                        rq->cmd_len = 6;
-                        err = blk_execute_rq(q, bd_disk, rq, 0);
-                        blk_put_request(rq);
+                        err = blk_send_start_stop(q, bd_disk, 0x02);
                         break;
                 default:
                         err = -ENOTTY;
diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
index d15c194be44a..d1387cfe2d30 100644
--- a/drivers/atm/adummy.c
+++ b/drivers/atm/adummy.c
@@ -123,7 +123,7 @@ static int __init adummy_init(void)
         }
         memset(adummy_dev, 0, sizeof(struct adummy_dev));
 
-        atm_dev = atm_dev_register(DEV_LABEL, &adummy_ops, -1, 0);
+        atm_dev = atm_dev_register(DEV_LABEL, &adummy_ops, -1, NULL);
         if (!atm_dev) {
                 printk(KERN_ERR DEV_LABEL ": atm_dev_register() failed\n");
                 err = -ENODEV;
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index b7ddd651d664..bc3ca6a656b2 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -28,7 +28,6 @@
 static struct sysdev_class memory_sysdev_class = {
         set_kset_name(MEMORY_CLASS_NAME),
 };
-EXPORT_SYMBOL(memory_sysdev_class);
 
 static char *memory_hotplug_name(struct kset *kset, struct kobject *kobj)
 {
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index b46a72d782d6..696f72787fe8 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -687,7 +687,7 @@ config NVRAM
 
 config RTC
         tristate "Enhanced Real Time Clock Support"
-        depends on !PPC32 && !PARISC && !IA64 && !M68K
+        depends on !PPC32 && !PARISC && !IA64 && !M68K && (!(SPARC32 || SPARC64) || PCI)
         ---help---
           If you say Y here and create a character special file /dev/rtc with
           major number 10 and minor number 135 using mknod ("man mknod"), you
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 9f2b4efd0c7a..501e557cbc86 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -1311,7 +1311,9 @@ static void radeon_set_pcigart(drm_radeon_private_t * dev_priv, int on)
 
 static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
 {
-        drm_radeon_private_t *dev_priv = dev->dev_private;;
+        drm_radeon_private_t *dev_priv = dev->dev_private;
+        unsigned int mem_size;
+
         DRM_DEBUG("\n");
 
         dev_priv->is_pci = init->is_pci;
@@ -1521,8 +1523,11 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                                           + dev_priv->fb_location) >> 10));
 
         dev_priv->gart_size = init->gart_size;
-        dev_priv->gart_vm_start = dev_priv->fb_location
-            + RADEON_READ(RADEON_CONFIG_APER_SIZE) * 2;
+
+        mem_size = RADEON_READ(RADEON_CONFIG_MEMSIZE);
+        if (mem_size == 0)
+                mem_size = 0x800000;
+        dev_priv->gart_vm_start = dev_priv->fb_location + mem_size;
 
 #if __OS_HAS_AGP
         if (!dev_priv->is_pci)
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index 7bda7e33d2bd..d92ccee3e54c 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -379,6 +379,7 @@ extern int r300_do_cp_cmdbuf(drm_device_t * dev, DRMFILE filp,
 #       define RADEON_PLL_WR_EN                 (1 << 7)
 #define RADEON_CLOCK_CNTL_INDEX         0x0008
 #define RADEON_CONFIG_APER_SIZE         0x0108
+#define RADEON_CONFIG_MEMSIZE           0x00f8
 #define RADEON_CRTC_OFFSET              0x0224
 #define RADEON_CRTC_OFFSET_CNTL         0x0228
 #       define RADEON_CRTC_TILE_EN              (1 << 15)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 01a1f6badb53..beea450ee4b2 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2399,7 +2399,8 @@ static int init_one_smi(int intf_num, struct smi_info **smi)
                         new_smi->handlers->cleanup(new_smi->si_sm);
                 kfree(new_smi->si_sm);
         }
-        new_smi->io_cleanup(new_smi);
+        if (new_smi->io_cleanup)
+                new_smi->io_cleanup(new_smi);
 
         return rv;
 }
@@ -2518,7 +2519,8 @@ static void __exit cleanup_one_si(struct smi_info *to_clean)
 
         kfree(to_clean->si_sm);
 
-        to_clean->io_cleanup(to_clean);
+        if (to_clean->io_cleanup)
+                to_clean->io_cleanup(to_clean);
 }
 
 static __exit void cleanup_ipmi_si(void)
diff --git a/drivers/char/mwave/mwavepub.h b/drivers/char/mwave/mwavepub.h
index f1f9da7a65c1..60c961ae23b4 100644
--- a/drivers/char/mwave/mwavepub.h
+++ b/drivers/char/mwave/mwavepub.h
@@ -69,7 +69,7 @@ typedef struct _MW_ABILITIES {
 typedef struct _MW_READWRITE {
         unsigned short usDspAddress;    /* The dsp address */
         unsigned long ulDataLength;     /* The size in bytes of the data or user buffer */
-        void *pBuf;             /* Input:variable sized buffer */
+        void __user *pBuf;              /* Input:variable sized buffer */
 } MW_READWRITE, *pMW_READWRITE;
 
 #define IOCTL_MW_RESET           _IO(MWAVE_MINOR,1)
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index ef011ef5dc46..61681c9f3f72 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1444,6 +1444,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
         dev_link_t *link;
         int size;
         int rc;
+        void __user *argp = (void __user *)arg;
 #ifdef PCMCIA_DEBUG
         char *ioctl_names[CM_IOC_MAXNR + 1] = {
                 [_IOC_NR(CM_IOCGSTATUS)] "CM_IOCGSTATUS",
@@ -1481,11 +1482,11 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
               _IOC_DIR(cmd), _IOC_READ, _IOC_WRITE, size, cmd);
 
         if (_IOC_DIR(cmd) & _IOC_READ) {
-                if (!access_ok(VERIFY_WRITE, (void *)arg, size))
+                if (!access_ok(VERIFY_WRITE, argp, size))
                         return -EFAULT;
         }
         if (_IOC_DIR(cmd) & _IOC_WRITE) {
-                if (!access_ok(VERIFY_READ, (void *)arg, size))
+                if (!access_ok(VERIFY_READ, argp, size))
                         return -EFAULT;
         }
 
@@ -1506,14 +1507,14 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                                 status |= CM_NO_READER;
                         if (test_bit(IS_BAD_CARD, &dev->flags))
                                 status |= CM_BAD_CARD;
-                        if (copy_to_user((int *)arg, &status, sizeof(int)))
+                        if (copy_to_user(argp, &status, sizeof(int)))
                                 return -EFAULT;
                 }
                 return 0;
         case CM_IOCGATR:
                 DEBUGP(4, dev, "... in CM_IOCGATR\n");
                 {
-                        struct atreq *atreq = (struct atreq *) arg;
+                        struct atreq __user *atreq = argp;
                         int tmp;
                         /* allow nonblocking io and being interrupted */
                         if (wait_event_interruptible
@@ -1597,7 +1598,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                 {
                         struct ptsreq krnptsreq;
 
-                        if (copy_from_user(&krnptsreq, (struct ptsreq *) arg,
+                        if (copy_from_user(&krnptsreq, argp,
                                            sizeof(struct ptsreq)))
                                 return -EFAULT;
 
@@ -1641,7 +1642,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                         int old_pc_debug = 0;
 
                         old_pc_debug = pc_debug;
-                        if (copy_from_user(&pc_debug, (int *)arg, sizeof(int)))
+                        if (copy_from_user(&pc_debug, argp, sizeof(int)))
                                 return -EFAULT;
 
                         if (old_pc_debug != pc_debug)
diff --git a/drivers/char/watchdog/booke_wdt.c b/drivers/char/watchdog/booke_wdt.c
index 65830ec71042..b6640606b44d 100644
--- a/drivers/char/watchdog/booke_wdt.c
+++ b/drivers/char/watchdog/booke_wdt.c
@@ -72,7 +72,7 @@ static __inline__ void booke_wdt_ping(void)
 /*
  * booke_wdt_write:
  */
-static ssize_t booke_wdt_write (struct file *file, const char *buf,
+static ssize_t booke_wdt_write (struct file *file, const char __user *buf,
                                 size_t count, loff_t *ppos)
 {
         booke_wdt_ping();
@@ -92,14 +92,15 @@ static int booke_wdt_ioctl (struct inode *inode, struct file *file,
                             unsigned int cmd, unsigned long arg)
 {
         u32 tmp = 0;
+        u32 __user *p = (u32 __user *)arg;
 
         switch (cmd) {
         case WDIOC_GETSUPPORT:
-                if (copy_to_user ((struct watchdog_info *) arg, &ident,
+                if (copy_to_user ((struct watchdog_info __user *) arg, &ident,
                                 sizeof(struct watchdog_info)))
                         return -EFAULT;
         case WDIOC_GETSTATUS:
-                return put_user(ident.options, (u32 *) arg);
+                return put_user(ident.options, p);
         case WDIOC_GETBOOTSTATUS:
                 /* XXX: something is clearing TSR */
                 tmp = mfspr(SPRN_TSR) & TSR_WRS(3);
@@ -109,14 +110,14 @@ static int booke_wdt_ioctl (struct inode *inode, struct file *file,
                 booke_wdt_ping();
                 return 0;
         case WDIOC_SETTIMEOUT:
-                if (get_user(booke_wdt_period, (u32 *) arg))
+                if (get_user(booke_wdt_period, p))
                         return -EFAULT;
                 mtspr(SPRN_TCR, (mfspr(SPRN_TCR)&~WDTP(0))|WDTP(booke_wdt_period));
                 return 0;
         case WDIOC_GETTIMEOUT:
-                return put_user(booke_wdt_period, (u32 *) arg);
+                return put_user(booke_wdt_period, p);
         case WDIOC_SETOPTIONS:
-                if (get_user(tmp, (u32 *) arg))
+                if (get_user(tmp, p))
                         return -EINVAL;
                 if (tmp == WDIOS_ENABLECARD) {
                         booke_wdt_ping();
@@ -172,7 +173,7 @@ static int __init booke_wdt_init(void)
         int ret = 0;
 
         printk (KERN_INFO "PowerPC Book-E Watchdog Timer Loaded\n");
-        ident.firmware_version = cpu_specs[0].pvr_value;
+        ident.firmware_version = cur_cpu_spec->pvr_value;
 
         ret = misc_register(&booke_wdt_miscdev);
         if (ret) {
diff --git a/drivers/char/watchdog/wdrtas.c b/drivers/char/watchdog/wdrtas.c
index 619e2ffca33f..dacfe31caccf 100644
--- a/drivers/char/watchdog/wdrtas.c
+++ b/drivers/char/watchdog/wdrtas.c
@@ -320,7 +320,7 @@ static int
 wdrtas_ioctl(struct inode *inode, struct file *file,
              unsigned int cmd, unsigned long arg)
 {
-        int __user *argp = (void *)arg;
+        int __user *argp = (void __user *)arg;
         int i;
         static struct watchdog_info wdinfo = {
                 .options = WDRTAS_SUPPORTED_MASK,
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index 6d83299e7c9b..dfedb777d8c9 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -105,8 +105,8 @@ static int create_packet(void *data, size_t length)
         int ordernum = 0;
         int retval = 0;
         unsigned int packet_array_size = 0;
-        void **invalid_addr_packet_array = 0;
-        void *packet_data_temp_buf = 0;
+        void **invalid_addr_packet_array = NULL;
+        void *packet_data_temp_buf = NULL;
         unsigned int idx = 0;
 
         pr_debug("create_packet: entry \n");
@@ -178,7 +178,7 @@ static int create_packet(void *data, size_t length)
                                                 packet_data_temp_buf),
                                         allocation_floor);
                         invalid_addr_packet_array[idx++] = packet_data_temp_buf;
-                        packet_data_temp_buf = 0;
+                        packet_data_temp_buf = NULL;
                 }
         }
         spin_lock(&rbu_data.lock);
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index afd7634e5cc9..81031eb51056 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -529,14 +529,15 @@ mv64xxx_i2c_probe(struct platform_device *pd)
         i2c_set_adapdata(&drv_data->adapter, drv_data);
 
         if (request_irq(drv_data->irq, mv64xxx_i2c_intr, 0,
-                MV64XXX_I2C_CTLR_NAME, drv_data)) {
-
-                dev_err(dev, "mv64xxx: Can't register intr handler "
-                        "irq: %d\n", drv_data->irq);
+                        MV64XXX_I2C_CTLR_NAME, drv_data)) {
+                dev_err(&drv_data->adapter.dev,
+                        "mv64xxx: Can't register intr handler irq: %d\n",
+                        drv_data->irq);
                 rc = -EINVAL;
                 goto exit_unmap_regs;
         } else if ((rc = i2c_add_adapter(&drv_data->adapter)) != 0) {
-                dev_err(dev, "mv64xxx: Can't add i2c adapter, rc: %d\n", -rc);
+                dev_err(&drv_data->adapter.dev,
+                        "mv64xxx: Can't add i2c adapter, rc: %d\n", -rc);
                 goto exit_free_irq;
         }
 
diff --git a/drivers/ieee1394/hosts.h b/drivers/ieee1394/hosts.h
index 38f42112dff0..ae9b02cc013f 100644
--- a/drivers/ieee1394/hosts.h
+++ b/drivers/ieee1394/hosts.h
@@ -41,6 +41,7 @@ struct hpsb_host {
         /* this nodes state */
         unsigned in_bus_reset:1;
         unsigned is_shutdown:1;
+        unsigned resume_packet_sent:1;
 
         /* this nodes' duties on the bus */
         unsigned is_root:1;
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 7fff5a1d2ea4..0ea37b1bccb2 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -1349,6 +1349,33 @@ static void nodemgr_update_pdrv(struct node_entry *ne)
 }
 
 
+/* Write the BROADCAST_CHANNEL as per IEEE1394a 8.3.2.3.11 and 8.4.2.3.  This
+ * seems like an optional service but in the end it is practically mandatory
+ * as a consequence of these clauses.
+ *
+ * Note that we cannot do a broadcast write to all nodes at once because some
+ * pre-1394a devices would hang. */
+static void nodemgr_irm_write_bc(struct node_entry *ne, int generation)
+{
+        const u64 bc_addr = (CSR_REGISTER_BASE | CSR_BROADCAST_CHANNEL);
+        quadlet_t bc_remote, bc_local;
+        int ret;
+
+        if (!ne->host->is_irm || ne->generation != generation ||
+            ne->nodeid == ne->host->node_id)
+                return;
+
+        bc_local = cpu_to_be32(ne->host->csr.broadcast_channel);
+
+        /* Check if the register is implemented and 1394a compliant. */
+        ret = hpsb_read(ne->host, ne->nodeid, generation, bc_addr, &bc_remote,
+                        sizeof(bc_remote));
+        if (!ret && bc_remote & cpu_to_be32(0x80000000) &&
+            bc_remote != bc_local)
+                hpsb_node_write(ne, bc_addr, &bc_local, sizeof(bc_local));
+}
+
+
 static void nodemgr_probe_ne(struct host_info *hi, struct node_entry *ne, int generation)
 {
         struct device *dev;
@@ -1360,6 +1387,8 @@ static void nodemgr_probe_ne(struct host_info *hi, struct node_entry *ne, int ge
         if (!dev)
                 return;
 
+        nodemgr_irm_write_bc(ne, generation);
+
         /* If "needs_probe", then this is either a new or changed node we
          * rescan totally. If the generation matches for an existing node
          * (one that existed prior to the bus reset) we send update calls
@@ -1413,9 +1442,25 @@ static void nodemgr_node_probe(struct host_info *hi, int generation)
         return;
 }
 
-/* Because we are a 1394a-2000 compliant IRM, we need to inform all the other
- * nodes of the broadcast channel.  (Really we're only setting the validity
- * bit). Other IRM responsibilities go in here as well. */
+static int nodemgr_send_resume_packet(struct hpsb_host *host)
+{
+        struct hpsb_packet *packet;
+        int ret = 1;
+
+        packet = hpsb_make_phypacket(host,
+                        0x003c0000 | NODEID_TO_NODE(host->node_id) << 24);
+        if (packet) {
+                packet->no_waiter = 1;
+                packet->generation = get_hpsb_generation(host);
+                ret = hpsb_send_packet(packet);
+        }
+        if (ret)
+                HPSB_WARN("fw-host%d: Failed to broadcast resume packet",
+                          host->id);
+        return ret;
+}
+
+/* Perform a few high-level IRM responsibilities. */
 static int nodemgr_do_irm_duties(struct hpsb_host *host, int cycles)
 {
         quadlet_t bc;
@@ -1424,13 +1469,8 @@ static int nodemgr_do_irm_duties(struct hpsb_host *host, int cycles)
         if (!host->is_irm || host->irm_id == (nodeid_t)-1)
                 return 1;
 
-        host->csr.broadcast_channel |= 0x40000000;  /* set validity bit */
-
-        bc = cpu_to_be32(host->csr.broadcast_channel);
-
-        hpsb_write(host, LOCAL_BUS | ALL_NODES, get_hpsb_generation(host),
-                   (CSR_REGISTER_BASE | CSR_BROADCAST_CHANNEL),
-                   &bc, sizeof(quadlet_t));
+        /* We are a 1394a-2000 compliant IRM. Set the validity bit. */
+        host->csr.broadcast_channel |= 0x40000000;
 
         /* If there is no bus manager then we should set the root node's
          * force_root bit to promote bus stability per the 1394
@@ -1463,6 +1503,13 @@ static int nodemgr_do_irm_duties(struct hpsb_host *host, int cycles)
                 }
         }
 
+        /* Some devices suspend their ports while being connected to an inactive
+         * host adapter, i.e. if connected before the low-level driver is
+         * loaded.  They become visible either when physically unplugged and
+         * replugged, or when receiving a resume packet.  Send one once. */
+        if (!host->resume_packet_sent && !nodemgr_send_resume_packet(host))
+                host->resume_packet_sent = 1;
+
         return 1;
 }
 
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 49d0416a2a9a..bac3085185fe 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -320,7 +320,7 @@ static struct dmi_system_id dmi_ids[] = {
                 },
                 .driver_data = keymap_acer_aspire_1500
         },
-        { 0, }
+        { NULL, }
 };
 
 static int __init select_keymap(void)
diff --git a/drivers/macintosh/therm_pm72.c b/drivers/macintosh/therm_pm72.c
index 3fc8cdd94c3d..5bb36274a5c6 100644
--- a/drivers/macintosh/therm_pm72.c
+++ b/drivers/macintosh/therm_pm72.c
@@ -933,7 +933,7 @@ static void do_monitor_cpu_combined(void)
         if (state0->overtemp > 0) {
                 state0->rpm = state0->mpu.rmaxn_exhaust_fan;
                 state0->intake_rpm = intake = state0->mpu.rmaxn_intake_fan;
-                pump = state0->pump_min;
+                pump = state0->pump_max;
                 goto do_set_fans;
         }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index cd12fca73b0d..8175a2a222da 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1729,7 +1729,7 @@ level_show(mddev_t *mddev, char *page)
         if (p == NULL && mddev->raid_disks == 0)
                 return 0;
         if (mddev->level >= 0)
-                return sprintf(page, "RAID-%d\n", mddev->level);
+                return sprintf(page, "raid%d\n", mddev->level);
         else
                 return sprintf(page, "%s\n", p->name);
 }
diff --git a/drivers/media/dvb/bt8xx/dst_ca.c b/drivers/media/dvb/bt8xx/dst_ca.c
index e6541aff3996..2239651969c8 100644
--- a/drivers/media/dvb/bt8xx/dst_ca.c
+++ b/drivers/media/dvb/bt8xx/dst_ca.c
@@ -406,7 +406,7 @@ static int ca_send_message(struct dst_state *state, struct ca_msg *p_ca_message,
         }
         dprintk(verbose, DST_CA_DEBUG, 1, " ");
 
-        if (copy_from_user(p_ca_message, (void *)arg, sizeof (struct ca_msg))) {
+        if (copy_from_user(p_ca_message, arg, sizeof (struct ca_msg))) {
                 result = -EFAULT;
                 goto free_mem_and_exit;
         }
@@ -579,7 +579,7 @@ static int dst_ca_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static int dst_ca_read(struct file *file, char __user *buffer, size_t length, loff_t *offset)
+static ssize_t dst_ca_read(struct file *file, char __user *buffer, size_t length, loff_t *offset)
 {
         int bytes_read = 0;
 
@@ -588,7 +588,7 @@ static int dst_ca_read(struct file *file, char __user *buffer, size_t length, lo
         return bytes_read;
 }
 
-static int dst_ca_write(struct file *file, const char __user *buffer, size_t length, loff_t *offset)
+static ssize_t dst_ca_write(struct file *file, const char __user *buffer, size_t length, loff_t *offset)
 {
         dprintk(verbose, DST_CA_DEBUG, 1, " Device write.");
 
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 992be0be6b1e..7dae91e5863c 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -176,6 +176,9 @@ static void init_av7110_av(struct av7110 *av7110)
                 }
         }
 
+        if (dev->pci->subsystem_vendor == 0x13c2 && dev->pci->subsystem_device == 0x000e)
+                av7110_fw_cmd(av7110, COMTYPE_AUDIODAC, SpdifSwitch, 1, 0); // SPDIF on
+
         ret = av7110_set_volume(av7110, av7110->mixer.volume_left, av7110->mixer.volume_right);
         if (ret < 0)
                 printk("dvb-ttpci:cannot set volume :%d\n",ret);
diff --git a/drivers/media/dvb/ttpci/av7110_hw.h b/drivers/media/dvb/ttpci/av7110_hw.h
index fedd20f9815d..2a5e87ba1052 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.h
+++ b/drivers/media/dvb/ttpci/av7110_hw.h
@@ -143,7 +143,8 @@ enum av7110_audio_command {
         MainSwitch,
         ADSwitch,
         SendDiSEqC,
-        SetRegister
+        SetRegister,
+        SpdifSwitch
 };
 
 enum av7110_request_command {
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index aea3f038cff6..5b93723a1768 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -333,24 +333,30 @@ static int set_input(struct i2c_client *client, enum cx25840_input input)
 
 static int set_v4lstd(struct i2c_client *client, v4l2_std_id std)
 {
-        u8 fmt;
-
-        switch (std) {
-        /* zero is autodetect */
-        case 0: fmt = 0x0; break;
-        /* default ntsc to ntsc-m */
-        case V4L2_STD_NTSC:
-        case V4L2_STD_NTSC_M: fmt = 0x1; break;
-        case V4L2_STD_NTSC_M_JP: fmt = 0x2; break;
-        case V4L2_STD_NTSC_443: fmt = 0x3; break;
-        case V4L2_STD_PAL: fmt = 0x4; break;
-        case V4L2_STD_PAL_M: fmt = 0x5; break;
-        case V4L2_STD_PAL_N: fmt = 0x6; break;
-        case V4L2_STD_PAL_Nc: fmt = 0x7; break;
-        case V4L2_STD_PAL_60: fmt = 0x8; break;
-        case V4L2_STD_SECAM: fmt = 0xc; break;
-        default:
-                return -ERANGE;
+        u8 fmt=0;       /* zero is autodetect */
+
+        /* First tests should be against specific std */
+        if (std & V4L2_STD_NTSC_M_JP) {
+                fmt=0x2;
+        } else if (std & V4L2_STD_NTSC_443) {
+                fmt=0x3;
+        } else if (std & V4L2_STD_PAL_M) {
+                fmt=0x5;
+        } else if (std & V4L2_STD_PAL_N) {
+                fmt=0x6;
+        } else if (std & V4L2_STD_PAL_Nc) {
+                fmt=0x7;
+        } else if (std & V4L2_STD_PAL_60) {
+                fmt=0x8;
+        } else {
+                /* Then, test against generic ones */
+                if (std & V4L2_STD_NTSC) {
+                        fmt=0x1;
+                } else if (std & V4L2_STD_PAL) {
+                        fmt=0x4;
+                } else if (std & V4L2_STD_SECAM) {
+                        fmt=0xc;
+                }
         }
 
         cx25840_and_or(client, 0x400, ~0xf, fmt);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index e8a1c2247567..0cfe75416ec6 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -39,7 +39,7 @@ MODULE_PARM_DESC(core_debug,"enable debug messages [core]");
 #define em28xx_coredbg(fmt, arg...) do {\
         if (core_debug) \
                 printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 
 static unsigned int reg_debug;
 module_param(reg_debug,int,0644);
@@ -48,7 +48,7 @@ MODULE_PARM_DESC(reg_debug,"enable debug messages [URB reg]");
 #define em28xx_regdbg(fmt, arg...) do {\
         if (reg_debug) \
                 printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 
 static unsigned int isoc_debug;
 module_param(isoc_debug,int,0644);
@@ -57,7 +57,7 @@ MODULE_PARM_DESC(isoc_debug,"enable debug messages [isoc transfers]");
 #define em28xx_isocdbg(fmt, arg...) do {\
         if (isoc_debug) \
                 printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 
 static int alt = EM28XX_PINOUT;
 module_param(alt, int, 0644);
@@ -126,7 +126,7 @@ u32 em28xx_request_buffers(struct em28xx *dev, u32 count)
         const size_t imagesize = PAGE_ALIGN(dev->frame_size);   /*needs to be page aligned cause the buffers can be mapped individually! */
         void *buff = NULL;
         u32 i;
-        em28xx_coredbg("requested %i buffers with size %i", count, imagesize);
+        em28xx_coredbg("requested %i buffers with size %zd", count, imagesize);
         if (count > EM28XX_NUM_FRAMES)
                 count = EM28XX_NUM_FRAMES;
 
diff --git a/drivers/media/video/em28xx/em28xx-i2c.c b/drivers/media/video/em28xx/em28xx-i2c.c
index 29e21ad187cc..7f5603054f02 100644
--- a/drivers/media/video/em28xx/em28xx-i2c.c
+++ b/drivers/media/video/em28xx/em28xx-i2c.c
@@ -44,7 +44,7 @@ MODULE_PARM_DESC(i2c_debug, "enable debug messages [i2c]");
                         printk(fmt, ##args); } while (0)
 #define dprintk2(lvl,fmt, args...) if (i2c_debug>=lvl) do{ \
                         printk(KERN_DEBUG "%s at %s: " fmt, \
-                        dev->name, __FUNCTION__, ##args); } while (0)
+                        dev->name, __FUNCTION__ , ##args); } while (0)
 
 /*
  * em2800_i2c_send_max4()
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 8ecaa0803e08..06d76879bde2 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -45,7 +45,7 @@
 #define em28xx_videodbg(fmt, arg...) do {\
         if (video_debug) \
                 printk(KERN_INFO "%s %s :"fmt, \
-                         dev->name, __FUNCTION__, ##arg); } while (0)
+                         dev->name, __FUNCTION__ , ##arg); } while (0)
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 1e2ee43db394..5c7a41ce69f3 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -392,18 +392,18 @@ extern const unsigned int em28xx_bcount;
 /* printk macros */
 
 #define em28xx_err(fmt, arg...) do {\
-        printk(KERN_ERR fmt, ##arg); } while (0)
+        printk(KERN_ERR fmt , ##arg); } while (0)
 
 #define em28xx_errdev(fmt, arg...) do {\
         printk(KERN_ERR "%s: "fmt,\
-                        dev->name, ##arg); } while (0)
+                        dev->name , ##arg); } while (0)
 
 #define em28xx_info(fmt, arg...) do {\
         printk(KERN_INFO "%s: "fmt,\
-                        dev->name, ##arg); } while (0)
+                        dev->name , ##arg); } while (0)
 #define em28xx_warn(fmt, arg...) do {\
         printk(KERN_WARNING "%s: "fmt,\
-                        dev->name, ##arg); } while (0)
+                        dev->name , ##arg); } while (0)
 
 inline static int em28xx_audio_source(struct em28xx *dev, int input)
 {
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index b24a26b065c2..953d5fec82d5 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -60,7 +60,7 @@ module_param_array(index, int, NULL, 0444);
 MODULE_PARM_DESC(index, "Index value for SAA7134 capture interface(s).");
 
 #define dprintk(fmt, arg...)    if (debug) \
-        printk(KERN_DEBUG "%s/alsa: " fmt, dev->name, ## arg)
+        printk(KERN_DEBUG "%s/alsa: " fmt, dev->name , ##arg)
 
 
 
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index cd7cf1bd12b4..5ac235365dd8 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -206,7 +206,7 @@ hauppauge_tuner[] =
         { TUNER_ABSENT,        "TCL 2002MI_3H"},
         { TUNER_TCL_2002N,     "TCL 2002N 5H"},
         /* 100-109 */
-        { TUNER_ABSENT,        "Philips FMD1216ME"},
+        { TUNER_PHILIPS_FMD1216ME_MK3, "Philips FMD1216ME"},
         { TUNER_TEA5767,       "Philips TEA5768HL FM Radio"},
         { TUNER_ABSENT,        "Panasonic ENV57H12D5"},
         { TUNER_PHILIPS_FM1236_MK3, "TCL MFNM05-4"},
diff --git a/drivers/message/i2o/pci.c b/drivers/message/i2o/pci.c
index 81ef306cb124..ee7075fa1ec3 100644
--- a/drivers/message/i2o/pci.c
+++ b/drivers/message/i2o/pci.c
@@ -303,6 +303,7 @@ static int __devinit i2o_pci_probe(struct pci_dev *pdev,
         struct i2o_controller *c;
         int rc;
         struct pci_dev *i960 = NULL;
+        int pci_dev_busy = 0;
 
         printk(KERN_INFO "i2o: Checking for PCI I2O controllers...\n");
 
@@ -395,6 +396,8 @@ static int __devinit i2o_pci_probe(struct pci_dev *pdev,
         if ((rc = i2o_pci_alloc(c))) {
                 printk(KERN_ERR "%s: DMA / IO allocation for I2O controller "
                        " failed\n", c->name);
+                if (rc == -ENODEV)
+                        pci_dev_busy = 1;
                 goto free_controller;
         }
 
@@ -425,7 +428,8 @@ static int __devinit i2o_pci_probe(struct pci_dev *pdev,
         i2o_iop_free(c);
 
       disable:
-        pci_disable_device(pdev);
+        if (!pci_dev_busy)
+                pci_disable_device(pdev);
 
         return rc;
 }
diff --git a/drivers/mtd/onenand/generic.c b/drivers/mtd/onenand/generic.c
index 48cce431f89f..45c077d0f063 100644
--- a/drivers/mtd/onenand/generic.c
+++ b/drivers/mtd/onenand/generic.c
@@ -12,9 +12,9 @@
  *   This is a device driver for the OneNAND flash for generic boards.
  */
 
-#include <linux/device.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/platform_device.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/onenand.h>
 #include <linux/mtd/partitions.h>
@@ -39,7 +39,7 @@ static int __devinit generic_onenand_probe(struct device *dev)
 {
         struct onenand_info *info;
         struct platform_device *pdev = to_platform_device(dev);
-        struct onenand_platform_data *pdata = pdev->dev.platform_data;
+        struct flash_platform_data *pdata = pdev->dev.platform_data;
         struct resource *res = pdev->resource;
         unsigned long size = res->end - res->start + 1;
         int err;
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index f67d5d6eb9a6..a53a73fc2a5a 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -940,7 +940,7 @@ static int onenand_writev_ecc(struct mtd_info *mtd, const struct kvec *vecs,
         u_char *eccbuf, struct nand_oobinfo *oobsel)
 {
         struct onenand_chip *this = mtd->priv;
-        unsigned char buffer[MAX_ONENAND_PAGESIZE], *pbuf;
+        unsigned char *pbuf;
         size_t total_len, len;
         int i, written = 0;
         int ret = 0;
@@ -975,7 +975,7 @@ static int onenand_writev_ecc(struct mtd_info *mtd, const struct kvec *vecs,
         /* Loop until all keve's data has been written */
         len = 0;
         while (count) {
-                pbuf = buffer;
+                pbuf = this->page_buf;
                 /*
                  * If the given tuple is >= pagesize then
                  * write it out from the iov
@@ -995,7 +995,7 @@ static int onenand_writev_ecc(struct mtd_info *mtd, const struct kvec *vecs,
                         int cnt = 0, thislen;
                         while (cnt < mtd->oobblock) {
                                 thislen = min_t(int, mtd->oobblock - cnt, vecs->iov_len - len);
-                                memcpy(buffer + cnt, vecs->iov_base + len, thislen);
+                                memcpy(this->page_buf + cnt, vecs->iov_base + len, thislen);
                                 cnt += thislen;
                                 len += thislen;
 
@@ -1296,6 +1296,12 @@ static int onenand_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
 
         /* Block lock scheme */
         for (block = start; block < end; block++) {
+                /* Set block address */
+                value = onenand_block_address(this, block);
+                this->write_word(value, this->base + ONENAND_REG_START_ADDRESS1);
+                /* Select DataRAM for DDP */
+                value = onenand_bufferram_address(this, block);
+                this->write_word(value, this->base + ONENAND_REG_START_ADDRESS2);
                 /* Set start block address */
                 this->write_word(block, this->base + ONENAND_REG_START_BLOCK_ADDRESS);
                 /* Write unlock command */
@@ -1309,10 +1315,6 @@ static int onenand_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
                     & ONENAND_CTRL_ONGO)
                         continue;
 
-                /* Set block address for read block status */
-                value = onenand_block_address(this, block);
-                this->write_word(value, this->base + ONENAND_REG_START_ADDRESS1);
-
                 /* Check lock status */
                 status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
                 if (!(status & ONENAND_WP_US))
@@ -1346,7 +1348,6 @@ static void onenand_print_device_info(int device)
 
 static const struct onenand_manufacturers onenand_manuf_ids[] = {
         {ONENAND_MFR_SAMSUNG, "Samsung"},
-        {ONENAND_MFR_UNKNOWN, "Unknown"}
 };
 
 /**
@@ -1357,17 +1358,22 @@ static const struct onenand_manufacturers onenand_manuf_ids[] = {
  */
 static int onenand_check_maf(int manuf)
 {
+        int size = ARRAY_SIZE(onenand_manuf_ids);
+        char *name;
         int i;
 
-        for (i = 0; onenand_manuf_ids[i].id; i++) {
+        for (i = 0; i < size; i++)
                 if (manuf == onenand_manuf_ids[i].id)
                         break;
-        }
 
-        printk(KERN_DEBUG "OneNAND Manufacturer: %s (0x%0x)\n",
-                onenand_manuf_ids[i].name, manuf);
+        if (i < size)
+                name = onenand_manuf_ids[i].name;
+        else
+                name = "Unknown";
+
+        printk(KERN_DEBUG "OneNAND Manufacturer: %s (0x%0x)\n", name, manuf);
 
-        return (i != ONENAND_MFR_UNKNOWN);
+        return (i == size);
 }
 
 /**
@@ -1513,6 +1519,18 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
                 this->read_bufferram = onenand_sync_read_bufferram;
         }
 
+        /* Allocate buffers, if necessary */
+        if (!this->page_buf) {
+                size_t len;
+                len = mtd->oobblock + mtd->oobsize;
+                this->page_buf = kmalloc(len, GFP_KERNEL);
+                if (!this->page_buf) {
+                        printk(KERN_ERR "onenand_scan(): Can't allocate page_buf\n");
+                        return -ENOMEM;
+                }
+                this->options |= ONENAND_PAGEBUF_ALLOC;
+        }
+
         this->state = FL_READY;
         init_waitqueue_head(&this->wq);
         spin_lock_init(&this->chip_lock);
@@ -1574,12 +1592,21 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
  */
 void onenand_release(struct mtd_info *mtd)
 {
+        struct onenand_chip *this = mtd->priv;
+
 #ifdef CONFIG_MTD_PARTITIONS
         /* Deregister partitions */
         del_mtd_partitions (mtd);
 #endif
         /* Deregister the device */
         del_mtd_device (mtd);
+
+        /* Free bad block table memory, if allocated */
+        if (this->bbm)
+                kfree(this->bbm);
+        /* Buffer allocated by onenand_scan */
+        if (this->options & ONENAND_PAGEBUF_ALLOC)
+                kfree(this->page_buf);
 }
 
 EXPORT_SYMBOL_GPL(onenand_scan);
diff --git a/drivers/mtd/onenand/onenand_bbt.c b/drivers/mtd/onenand/onenand_bbt.c
index f40190f499e1..4510d3361eaa 100644
--- a/drivers/mtd/onenand/onenand_bbt.c
+++ b/drivers/mtd/onenand/onenand_bbt.c
@@ -118,10 +118,10 @@ static int create_bbt(struct mtd_info *mtd, uint8_t *buf, struct nand_bbt_descr
  */
 static inline int onenand_memory_bbt (struct mtd_info *mtd, struct nand_bbt_descr *bd)
 {
-        unsigned char data_buf[MAX_ONENAND_PAGESIZE];
+        struct onenand_chip *this = mtd->priv;
 
         bd->options &= ~NAND_BBT_SCANEMPTY;
-        return create_bbt(mtd, data_buf, bd, -1);
+        return create_bbt(mtd, this->page_buf, bd, -1);
 }
 
 /**
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index e57df8dfe6b4..669dd52c412a 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -3078,7 +3078,7 @@ int s2io_set_swapper(nic_t * sp)
 
 static int wait_for_msix_trans(nic_t *nic, int i)
 {
-        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        XENA_dev_config_t __iomem *bar0 = nic->bar0;
         u64 val64;
         int ret = 0, cnt = 0;
 
@@ -3099,7 +3099,7 @@ static int wait_for_msix_trans(nic_t *nic, int i)
 
 void restore_xmsi_data(nic_t *nic)
 {
-        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        XENA_dev_config_t __iomem *bar0 = nic->bar0;
         u64 val64;
         int i;
 
@@ -3117,7 +3117,7 @@ void restore_xmsi_data(nic_t *nic)
 
 static void store_xmsi_data(nic_t *nic)
 {
-        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        XENA_dev_config_t __iomem *bar0 = nic->bar0;
         u64 val64, addr, data;
         int i;
 
@@ -3140,7 +3140,7 @@ static void store_xmsi_data(nic_t *nic)
 
 int s2io_enable_msi(nic_t *nic)
 {
-        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        XENA_dev_config_t __iomem *bar0 = nic->bar0;
         u16 msi_ctrl, msg_val;
         struct config_param *config = &nic->config;
         struct net_device *dev = nic->dev;
@@ -3190,7 +3190,7 @@ int s2io_enable_msi(nic_t *nic)
 
 int s2io_enable_msi_x(nic_t *nic)
 {
-        XENA_dev_config_t *bar0 = (XENA_dev_config_t *) nic->bar0;
+        XENA_dev_config_t __iomem *bar0 = nic->bar0;
         u64 tx_mat, rx_mat;
         u16 msi_control; /* Temp variable */
         int ret, i, j, msix_indx = 1;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index a23ed28a72b8..cefb0c08a68d 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.45"
-#define DRV_MODULE_RELDATE      "Dec 13, 2005"
+#define DRV_MODULE_VERSION      "3.46"
+#define DRV_MODULE_RELDATE      "Dec 19, 2005"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -341,6 +341,16 @@ static struct {
         { "interrupt test (offline)" },
 };
 
+static void tg3_write32(struct tg3 *tp, u32 off, u32 val)
+{
+        writel(val, tp->regs + off);
+}
+
+static u32 tg3_read32(struct tg3 *tp, u32 off)
+{
+        return (readl(tp->regs + off)); 
+}
+
 static void tg3_write_indirect_reg32(struct tg3 *tp, u32 off, u32 val)
 {
         unsigned long flags;
@@ -411,13 +421,29 @@ static u32 tg3_read_indirect_mbox(struct tg3 *tp, u32 off)
         return val;
 }
 
-static void _tw32_flush(struct tg3 *tp, u32 off, u32 val)
+/* usec_wait specifies the wait time in usec when writing to certain registers
+ * where it is unsafe to read back the register without some delay.
+ * GRC_LOCAL_CTRL is one example if the GPIOs are toggled to switch power.
+ * TG3PCI_CLOCK_CTRL is another example if the clock frequencies are changed.
+ */
+static void _tw32_flush(struct tg3 *tp, u32 off, u32 val, u32 usec_wait)
 {
-        tp->write32(tp, off, val);
-        if (!(tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) &&
-            !(tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG) &&
-            !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
-                tp->read32(tp, off);    /* flush */
+        if ((tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) ||
+            (tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
+                /* Non-posted methods */
+                tp->write32(tp, off, val);
+        else {
+                /* Posted method */
+                tg3_write32(tp, off, val);
+                if (usec_wait)
+                        udelay(usec_wait);
+                tp->read32(tp, off);
+        }
+        /* Wait again after the read for the posted method to guarantee that
+         * the wait time is met.
+         */
+        if (usec_wait)
+                udelay(usec_wait);
 }
 
 static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
@@ -438,16 +464,6 @@ static void tg3_write32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
                 readl(mbox);
 }
 
-static void tg3_write32(struct tg3 *tp, u32 off, u32 val)
-{
-        writel(val, tp->regs + off);
-}
-
-static u32 tg3_read32(struct tg3 *tp, u32 off)
-{
-        return (readl(tp->regs + off)); 
-}
-
 #define tw32_mailbox(reg, val)  tp->write32_mbox(tp, reg, val)
 #define tw32_mailbox_f(reg, val)        tw32_mailbox_flush(tp, (reg), (val))
 #define tw32_rx_mbox(reg, val)  tp->write32_rx_mbox(tp, reg, val)
@@ -455,7 +471,8 @@ static u32 tg3_read32(struct tg3 *tp, u32 off)
 #define tr32_mailbox(reg)       tp->read32_mbox(tp, reg)
 
 #define tw32(reg,val)           tp->write32(tp, reg, val)
-#define tw32_f(reg,val)         _tw32_flush(tp,(reg),(val))
+#define tw32_f(reg,val)         _tw32_flush(tp,(reg),(val), 0)
+#define tw32_wait_f(reg,val,us) _tw32_flush(tp,(reg),(val), (us))
 #define tr32(reg)               tp->read32(tp, reg)
 
 static void tg3_write_mem(struct tg3 *tp, u32 off, u32 val)
@@ -595,21 +612,19 @@ static void tg3_switch_clocks(struct tg3 *tp)
 
         if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS) {
                 if (orig_clock_ctrl & CLOCK_CTRL_625_CORE) {
-                        tw32_f(TG3PCI_CLOCK_CTRL,
-                               clock_ctrl | CLOCK_CTRL_625_CORE);
-                        udelay(40);
+                        tw32_wait_f(TG3PCI_CLOCK_CTRL,
+                                    clock_ctrl | CLOCK_CTRL_625_CORE, 40);
                 }
         } else if ((orig_clock_ctrl & CLOCK_CTRL_44MHZ_CORE) != 0) {
-                tw32_f(TG3PCI_CLOCK_CTRL,
-                     clock_ctrl |
-                     (CLOCK_CTRL_44MHZ_CORE | CLOCK_CTRL_ALTCLK));
-                udelay(40);
-                tw32_f(TG3PCI_CLOCK_CTRL,
-                     clock_ctrl | (CLOCK_CTRL_ALTCLK));
-                udelay(40);
+                tw32_wait_f(TG3PCI_CLOCK_CTRL,
+                            clock_ctrl |
+                            (CLOCK_CTRL_44MHZ_CORE | CLOCK_CTRL_ALTCLK),
+                            40);
+                tw32_wait_f(TG3PCI_CLOCK_CTRL,
+                            clock_ctrl | (CLOCK_CTRL_ALTCLK),
+                            40);
         }
-        tw32_f(TG3PCI_CLOCK_CTRL, clock_ctrl);
-        udelay(40);
+        tw32_wait_f(TG3PCI_CLOCK_CTRL, clock_ctrl, 40);
 }
 
 #define PHY_BUSY_LOOPS  5000
@@ -1017,39 +1032,50 @@ static void tg3_frob_aux_power(struct tg3 *tp)
         if ((tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT) != 0)
                 return;
 
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) {
-                tp_peer = pci_get_drvdata(tp->pdev_peer);
-                if (!tp_peer)
+        if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) ||
+            (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714)) {
+                struct net_device *dev_peer;
+
+                dev_peer = pci_get_drvdata(tp->pdev_peer);
+                if (!dev_peer)
                         BUG();
+                tp_peer = netdev_priv(dev_peer);
         }
 
-
         if ((tp->tg3_flags & TG3_FLAG_WOL_ENABLE) != 0 ||
             (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0 ||
             (tp_peer->tg3_flags & TG3_FLAG_WOL_ENABLE) != 0 ||
             (tp_peer->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0) {
                 if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700 ||
                     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701) {
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE0 |
-                              GRC_LCLCTRL_GPIO_OE1 |
-                              GRC_LCLCTRL_GPIO_OE2 |
-                              GRC_LCLCTRL_GPIO_OUTPUT0 |
-                              GRC_LCLCTRL_GPIO_OUTPUT1));
-                        udelay(100);
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                    (GRC_LCLCTRL_GPIO_OE0 |
+                                     GRC_LCLCTRL_GPIO_OE1 |
+                                     GRC_LCLCTRL_GPIO_OE2 |
+                                     GRC_LCLCTRL_GPIO_OUTPUT0 |
+                                     GRC_LCLCTRL_GPIO_OUTPUT1),
+                                    100);
                 } else {
                         u32 no_gpio2;
-                        u32 grc_local_ctrl;
+                        u32 grc_local_ctrl = 0;
 
                         if (tp_peer != tp &&
                             (tp_peer->tg3_flags & TG3_FLAG_INIT_COMPLETE) != 0)
                                 return;
 
+                        /* Workaround to prevent overdrawing Amps. */
+                        if (GET_ASIC_REV(tp->pci_chip_rev_id) ==
+                            ASIC_REV_5714) {
+                                grc_local_ctrl |= GRC_LCLCTRL_GPIO_OE3;
+                                tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                            grc_local_ctrl, 100);
+                        }
+
                         /* On 5753 and variants, GPIO2 cannot be used. */
                         no_gpio2 = tp->nic_sram_data_cfg &
                                     NIC_SRAM_DATA_CFG_NO_GPIO2;
 
-                        grc_local_ctrl = GRC_LCLCTRL_GPIO_OE0 |
+                        grc_local_ctrl |= GRC_LCLCTRL_GPIO_OE0 |
                                          GRC_LCLCTRL_GPIO_OE1 |
                                          GRC_LCLCTRL_GPIO_OE2 |
                                          GRC_LCLCTRL_GPIO_OUTPUT1 |
@@ -1058,21 +1084,18 @@ static void tg3_frob_aux_power(struct tg3 *tp)
                                 grc_local_ctrl &= ~(GRC_LCLCTRL_GPIO_OE2 |
                                                     GRC_LCLCTRL_GPIO_OUTPUT2);
                         }
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                                                grc_local_ctrl);
-                        udelay(100);
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                                    grc_local_ctrl, 100);
 
                         grc_local_ctrl |= GRC_LCLCTRL_GPIO_OUTPUT0;
 
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                                                grc_local_ctrl);
-                        udelay(100);
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                                    grc_local_ctrl, 100);
 
                         if (!no_gpio2) {
                                 grc_local_ctrl &= ~GRC_LCLCTRL_GPIO_OUTPUT2;
-                                tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                                       grc_local_ctrl);
-                                udelay(100);
+                                tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                            grc_local_ctrl, 100);
                         }
                 }
         } else {
@@ -1082,19 +1105,16 @@ static void tg3_frob_aux_power(struct tg3 *tp)
                             (tp_peer->tg3_flags & TG3_FLAG_INIT_COMPLETE) != 0)
                                 return;
 
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE1 |
-                              GRC_LCLCTRL_GPIO_OUTPUT1));
-                        udelay(100);
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                    (GRC_LCLCTRL_GPIO_OE1 |
+                                     GRC_LCLCTRL_GPIO_OUTPUT1), 100);
 
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE1));
-                        udelay(100);
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                    GRC_LCLCTRL_GPIO_OE1, 100);
 
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
-                             (GRC_LCLCTRL_GPIO_OE1 |
-                              GRC_LCLCTRL_GPIO_OUTPUT1));
-                        udelay(100);
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl |
+                                    (GRC_LCLCTRL_GPIO_OE1 |
+                                     GRC_LCLCTRL_GPIO_OUTPUT1), 100);
                 }
         }
 }
@@ -1137,10 +1157,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                 udelay(100);    /* Delay after power state change */
 
                 /* Switch out of Vaux if it is not a LOM */
-                if (!(tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT)) {
-                        tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
-                        udelay(100);
-                }
+                if (!(tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT))
+                        tw32_wait_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl, 100);
 
                 return 0;
 
@@ -1239,10 +1257,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                 base_val |= (CLOCK_CTRL_RXCLK_DISABLE |
                              CLOCK_CTRL_TXCLK_DISABLE);
 
-                tw32_f(TG3PCI_CLOCK_CTRL, base_val |
-                     CLOCK_CTRL_ALTCLK |
-                     CLOCK_CTRL_PWRDOWN_PLL133);
-                udelay(40);
+                tw32_wait_f(TG3PCI_CLOCK_CTRL, base_val | CLOCK_CTRL_ALTCLK |
+                            CLOCK_CTRL_PWRDOWN_PLL133, 40);
         } else if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS) {
                 /* do nothing */
         } else if (!((tp->tg3_flags2 & TG3_FLG2_5750_PLUS) &&
@@ -1263,11 +1279,11 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                         newbits2 = newbits1 | CLOCK_CTRL_44MHZ_CORE;
                 }
 
-                tw32_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits1);
-                udelay(40);
+                tw32_wait_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits1,
+                            40);
 
-                tw32_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits2);
-                udelay(40);
+                tw32_wait_f(TG3PCI_CLOCK_CTRL, tp->pci_clock_ctrl | newbits2,
+                            40);
 
                 if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
                         u32 newbits3;
@@ -1281,9 +1297,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                                 newbits3 = CLOCK_CTRL_44MHZ_CORE;
                         }
 
-                        tw32_f(TG3PCI_CLOCK_CTRL,
-                                         tp->pci_clock_ctrl | newbits3);
-                        udelay(40);
+                        tw32_wait_f(TG3PCI_CLOCK_CTRL,
+                                    tp->pci_clock_ctrl | newbits3, 40);
                 }
         }
 
@@ -1294,7 +1309,8 @@ static int tg3_set_power_state(struct tg3 *tp, int state)
                         tg3_writephy(tp, MII_TG3_EXT_CTRL,
                                      MII_TG3_EXT_CTRL_FORCE_LED_OFF);
                         tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x01b2);
-                        tg3_writephy(tp, MII_BMCR, BMCR_PDOWN);
+                        if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5700)
+                                tg3_writephy(tp, MII_BMCR, BMCR_PDOWN);
                 }
         }
 
@@ -7959,13 +7975,12 @@ static int tg3_test_memory(struct tg3 *tp)
                 u32 offset;
                 u32 len;
         } mem_tbl_570x[] = {
-                { 0x00000000, 0x01000},
+                { 0x00000000, 0x00b50},
                 { 0x00002000, 0x1c000},
                 { 0xffffffff, 0x00000}
         }, mem_tbl_5705[] = {
                 { 0x00000100, 0x0000c},
                 { 0x00000200, 0x00008},
-                { 0x00000b50, 0x00400},
                 { 0x00004000, 0x00800},
                 { 0x00006000, 0x01000},
                 { 0x00008000, 0x02000},
@@ -10466,7 +10481,7 @@ static char * __devinit tg3_bus_string(struct tg3 *tp, char *str)
         return str;
 }
 
-static struct pci_dev * __devinit tg3_find_5704_peer(struct tg3 *tp)
+static struct pci_dev * __devinit tg3_find_peer(struct tg3 *tp)
 {
         struct pci_dev *peer;
         unsigned int func, devnr = tp->pdev->devfn & ~7;
@@ -10719,8 +10734,9 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                 tp->rx_pending = 63;
         }
 
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704)
-                tp->pdev_peer = tg3_find_5704_peer(tp);
+        if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) ||
+            (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714))
+                tp->pdev_peer = tg3_find_peer(tp);
 
         err = tg3_get_device_address(tp);
         if (err) {
diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
index 716df015f8d0..6707df968934 100644
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -6,6 +6,9 @@ obj-y		+= access.o bus.o probe.o remove.o pci.o quirks.o \
                         pci-driver.o search.o pci-sysfs.o rom.o setup-res.o
 obj-$(CONFIG_PROC_FS) += proc.o
 
+# Build PCI Express stuff if needed
+obj-$(CONFIG_PCIEPORTBUS) += pcie/
+
 obj-$(CONFIG_HOTPLUG) += hotplug.o
 
 # Build the PCI Hotplug drivers if we were asked to
@@ -40,7 +43,3 @@ endif
 ifeq ($(CONFIG_PCI_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
 endif
-
-# Build PCI Express stuff if needed
-obj-$(CONFIG_PCIEPORTBUS) += pcie/
-
diff --git a/drivers/sbus/char/jsflash.c b/drivers/sbus/char/jsflash.c
index c12c5046e2fa..14631ac11bc7 100644
--- a/drivers/sbus/char/jsflash.c
+++ b/drivers/sbus/char/jsflash.c
@@ -249,11 +249,11 @@ static loff_t jsf_lseek(struct file * file, loff_t offset, int orig)
 /*
  * OS SIMM Cannot be read in other size but a 32bits word.
  */
-static ssize_t jsf_read(struct file * file, char * buf, 
+static ssize_t jsf_read(struct file * file, char __user * buf, 
     size_t togo, loff_t *ppos)
 {
         unsigned long p = *ppos;
-        char *tmp = buf;
+        char __user *tmp = buf;
 
         union byte4 {
                 char s[4];
@@ -305,7 +305,7 @@ static ssize_t jsf_read(struct file * file, char * buf,
         return tmp-buf;
 }
 
-static ssize_t jsf_write(struct file * file, const char * buf,
+static ssize_t jsf_write(struct file * file, const char __user * buf,
     size_t count, loff_t *ppos)
 {
         return -ENOSPC;
@@ -356,10 +356,10 @@ static int jsf_ioctl_erase(unsigned long arg)
  * Program a block of flash.
  * Very simple because we can do it byte by byte anyway.
  */
-static int jsf_ioctl_program(unsigned long arg)
+static int jsf_ioctl_program(void __user *arg)
 {
         struct jsflash_program_arg abuf;
-        char *uptr;
+        char __user *uptr;
         unsigned long p;
         unsigned int togo;
         union {
@@ -367,13 +367,13 @@ static int jsf_ioctl_program(unsigned long arg)
                 char s[4];
         } b;
 
-        if (copy_from_user(&abuf, (char *)arg, JSFPRGSZ))
+        if (copy_from_user(&abuf, arg, JSFPRGSZ))
                 return -EFAULT; 
         p = abuf.off;
         togo = abuf.size;
         if ((togo & 3) || (p & 3)) return -EINVAL;
 
-        uptr = (char *) (unsigned long) abuf.data;
+        uptr = (char __user *) (unsigned long) abuf.data;
         while (togo != 0) {
                 togo -= 4;
                 if (copy_from_user(&b.s[0], uptr, 4))
@@ -390,19 +390,20 @@ static int jsf_ioctl(struct inode *inode, struct file *f, unsigned int cmd,
     unsigned long arg)
 {
         int error = -ENOTTY;
+        void __user *argp = (void __user *)arg;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
         switch (cmd) {
         case JSFLASH_IDENT:
-                if (copy_to_user((void *)arg, &jsf0.id, JSFIDSZ))
+                if (copy_to_user(argp, &jsf0.id, JSFIDSZ))
                         return -EFAULT;
                 break;
         case JSFLASH_ERASE:
                 error = jsf_ioctl_erase(arg);
                 break;
         case JSFLASH_PROGRAM:
-                error = jsf_ioctl_program(arg);
+                error = jsf_ioctl_program(argp);
                 break;
         }
 
diff --git a/drivers/sbus/char/uctrl.c b/drivers/sbus/char/uctrl.c
index 858cc683f85c..e2d9a7c85427 100644
--- a/drivers/sbus/char/uctrl.c
+++ b/drivers/sbus/char/uctrl.c
@@ -309,7 +309,7 @@ static void uctrl_do_txn(struct uctrl_txn *txn)
         }
 }
 
-void uctrl_get_event_status()
+void uctrl_get_event_status(void)
 {
         struct uctrl_driver *driver = &drv;
         struct uctrl_txn txn;
@@ -318,7 +318,7 @@ void uctrl_get_event_status()
         txn.opcode = READ_EVENT_STATUS;
         txn.inbits = 0;
         txn.outbits = 2;
-        txn.inbuf = 0;
+        txn.inbuf = NULL;
         txn.outbuf = outbits;
 
         uctrl_do_txn(&txn);
@@ -329,7 +329,7 @@ void uctrl_get_event_status()
         dprintk(("ev is %x\n", driver->status.event_status));
 }
 
-void uctrl_get_external_status()
+void uctrl_get_external_status(void)
 {
         struct uctrl_driver *driver = &drv;
         struct uctrl_txn txn;
@@ -339,7 +339,7 @@ void uctrl_get_external_status()
         txn.opcode = READ_EXTERNAL_STATUS;
         txn.inbits = 0;
         txn.outbits = 2;
-        txn.inbuf = 0;
+        txn.inbuf = NULL;
         txn.outbuf = outbits;
 
         uctrl_do_txn(&txn);
@@ -414,7 +414,7 @@ static void __exit ts102_uctrl_cleanup(void)
         if (driver->irq)
                 free_irq(driver->irq, driver);
         if (driver->regs)
-                driver->regs = 0;
+                driver->regs = NULL;
 }
 
 module_init(ts102_uctrl_init);
diff --git a/drivers/sbus/char/vfc.h b/drivers/sbus/char/vfc.h
index a7782e7da42e..8045cd5e7cb3 100644
--- a/drivers/sbus/char/vfc.h
+++ b/drivers/sbus/char/vfc.h
@@ -125,7 +125,7 @@ struct vfc_regs {
 
 
 struct vfc_dev {
-        volatile struct vfc_regs *regs;
+        volatile struct vfc_regs __iomem *regs;
         struct vfc_regs *phys_regs;
         unsigned int control_reg;
         struct semaphore device_lock_sem;
diff --git a/drivers/sbus/char/vfc_dev.c b/drivers/sbus/char/vfc_dev.c
index 7a103698fa3c..dfdd6be551f3 100644
--- a/drivers/sbus/char/vfc_dev.c
+++ b/drivers/sbus/char/vfc_dev.c
@@ -149,7 +149,7 @@ int init_vfc_device(struct sbus_dev *sdev,struct vfc_dev *dev, int instance)
         }
         printk("Initializing vfc%d\n",instance);
         dev->regs = NULL;
-        dev->regs = (volatile struct vfc_regs *)
+        dev->regs = (volatile struct vfc_regs __iomem *)
                 sbus_ioremap(&sdev->resource[0], 0,
                              sizeof(struct vfc_regs), vfcstr);
         dev->which_io = sdev->reg_addrs[0].which_io;
@@ -319,7 +319,7 @@ int vfc_capture_poll(struct vfc_dev *dev)
         int timeout = 1000;
 
         while (!timeout--) {
-                if (dev->regs->control & VFC_STATUS_CAPTURE)
+                if (sbus_readl(&dev->regs->control) & VFC_STATUS_CAPTURE)
                         break;
                 vfc_i2c_delay_no_busy(dev, 100);
         }
@@ -718,7 +718,7 @@ static void deinit_vfc_device(struct vfc_dev *dev)
         if(dev == NULL)
                 return;
         devfs_remove("vfc/%d", dev->instance);
-        sbus_iounmap((unsigned long)dev->regs, sizeof(struct vfc_regs));
+        sbus_iounmap(dev->regs, sizeof(struct vfc_regs));
         kfree(dev);
 }
 
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 418fc7b896ac..6252b9ddc01e 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -660,7 +660,12 @@ static int adpt_abort(struct scsi_cmnd * cmd)
         msg[2] = 0;
         msg[3]= 0; 
         msg[4] = (u32)cmd;
-        if( (rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER)) != 0){
+        if (pHba->host)
+                spin_lock_irq(pHba->host->host_lock);
+        rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER);
+        if (pHba->host)
+                spin_unlock_irq(pHba->host->host_lock);
+        if (rcode != 0) {
                 if(rcode == -EOPNOTSUPP ){
                         printk(KERN_INFO"%s: Abort cmd not supported\n",pHba->name);
                         return FAILED;
@@ -697,10 +702,15 @@ static int adpt_device_reset(struct scsi_cmnd* cmd)
         msg[2] = 0;
         msg[3] = 0;
 
+        if (pHba->host)
+                spin_lock_irq(pHba->host->host_lock);
         old_state = d->state;
         d->state |= DPTI_DEV_RESET;
-        if( (rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER)) ){
-                d->state = old_state;
+        rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER);
+        d->state = old_state;
+        if (pHba->host)
+                spin_unlock_irq(pHba->host->host_lock);
+        if (rcode != 0) {
                 if(rcode == -EOPNOTSUPP ){
                         printk(KERN_INFO"%s: Device reset not supported\n",pHba->name);
                         return FAILED;
@@ -708,7 +718,6 @@ static int adpt_device_reset(struct scsi_cmnd* cmd)
                 printk(KERN_INFO"%s: Device reset failed\n",pHba->name);
                 return FAILED;
         } else {
-                d->state = old_state;
                 printk(KERN_INFO"%s: Device reset successful\n",pHba->name);
                 return SUCCESS;
         }
@@ -721,6 +730,7 @@ static int adpt_bus_reset(struct scsi_cmnd* cmd)
 {
         adpt_hba* pHba;
         u32 msg[4];
+        u32 rcode;
 
         pHba = (adpt_hba*)cmd->device->host->hostdata[0];
         memset(msg, 0, sizeof(msg));
@@ -729,7 +739,12 @@ static int adpt_bus_reset(struct scsi_cmnd* cmd)
         msg[1] = (I2O_HBA_BUS_RESET<<24|HOST_TID<<12|pHba->channel[cmd->device->channel].tid);
         msg[2] = 0;
         msg[3] = 0;
-        if(adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER) ){
+        if (pHba->host)
+                spin_lock_irq(pHba->host->host_lock);
+        rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER);
+        if (pHba->host)
+                spin_unlock_irq(pHba->host->host_lock);
+        if (rcode != 0) {
                 printk(KERN_WARNING"%s: Bus reset failed.\n",pHba->name);
                 return FAILED;
         } else {
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 4fea3e4edaa7..3d8009f55342 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -3368,7 +3368,7 @@ iscsi_conn_set_param(iscsi_connh_t connh, enum iscsi_param param,
         switch(param) {
         case ISCSI_PARAM_MAX_RECV_DLENGTH: {
                 char *saveptr = conn->data;
-                int flags = GFP_KERNEL;
+                gfp_t flags = GFP_KERNEL;
 
                 if (conn->data_size >= value) {
                         conn->max_recv_dlength = value;
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 49fd18c1a9c6..e08462d50c97 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -249,7 +249,7 @@ static inline struct list_head *skb_to_lh(struct sk_buff *skb)
 }
 
 static void*
-mempool_zone_alloc_skb(unsigned int gfp_mask, void *pool_data)
+mempool_zone_alloc_skb(gfp_t gfp_mask, void *pool_data)
 {
         struct mempool_zone *zone = pool_data;
 
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index ed550132db0b..79efaf7d86a3 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -717,6 +717,7 @@ static int uhci_suspend(struct usb_hcd *hcd, pm_message_t message)
          * at the source, so we must turn off PIRQ.
          */
         pci_write_config_word(to_pci_dev(uhci_dev(uhci)), USBLEGSUP, 0);
+        mb();
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
         uhci->hc_inaccessible = 1;
         hcd->poll_rh = 0;
@@ -738,6 +739,7 @@ static int uhci_resume(struct usb_hcd *hcd)
          * really don't want to keep a stale HCD_FLAG_HW_ACCESSIBLE=0
          */
         set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+        mb();
 
         if (uhci->rh_state == UHCI_RH_RESET)    /* Dead */
                 return 0;
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 9ff25eb520a6..1220a5004a5c 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -137,6 +137,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                         switch (usage->hid & 0xffff) {
                                 case 0xba: map_abs(ABS_RUDDER); break;
                                 case 0xbb: map_abs(ABS_THROTTLE); break;
+                                default:   goto ignore;
                         }
                         break;
 
diff --git a/drivers/usb/misc/auerswald.c b/drivers/usb/misc/auerswald.c
index 2a28ceeaa66a..b293db3c28c3 100644
--- a/drivers/usb/misc/auerswald.c
+++ b/drivers/usb/misc/auerswald.c
@@ -1696,7 +1696,7 @@ static ssize_t auerchar_write (struct file *file, const char __user *buf, size_t
         int ret;
         wait_queue_t wait;
 
-        dbg ("auerchar_write %d bytes", len);
+        dbg ("auerchar_write %zd bytes", len);
 
         /* Error checking */
         if (!ccp)
diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index 080db812ca48..2784f0a9d693 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -441,7 +441,7 @@ static int arcfb_ioctl(struct inode *inode, struct file *file,
  * the fb. it's inefficient for them to do anything less than 64*8
  * writes since we update the lcd in each write() anyway.
  */
-static ssize_t arcfb_write(struct file *file, const char *buf, size_t count,
+static ssize_t arcfb_write(struct file *file, const char __user *buf, size_t count,
                                 loff_t *ppos)
 {
         /* modded from epson 1355 */
diff --git a/drivers/video/cyber2000fb.c b/drivers/video/cyber2000fb.c
index c589d23e7f91..a9300f930ef2 100644
--- a/drivers/video/cyber2000fb.c
+++ b/drivers/video/cyber2000fb.c
@@ -1512,7 +1512,7 @@ static int cyberpro_pci_enable_mmio(struct cfb_info *cfb)
          * I/O cycles storing into a reserved memory space at
          * physical address 0x3000000
          */
-        unsigned char *iop;
+        unsigned char __iomem *iop;
 
         iop = ioremap(0x3000000, 0x5000);
         if (iop == NULL) {
@@ -1526,7 +1526,7 @@ static int cyberpro_pci_enable_mmio(struct cfb_info *cfb)
         writeb(EXT_BIU_MISC, iop + 0x3ce);
         writeb(EXT_BIU_MISC_LIN_ENABLE, iop + 0x3cf);
 
-        iounmap((void *)iop);
+        iounmap(iop);
 #else
         /*
          * Most other machine types are "normal", so
diff --git a/drivers/video/intelfb/intelfb.h b/drivers/video/intelfb/intelfb.h
index f077ca34faba..da29d007f215 100644
--- a/drivers/video/intelfb/intelfb.h
+++ b/drivers/video/intelfb/intelfb.h
@@ -41,6 +41,10 @@
 
 /*** hw-related values ***/
 
+/* Resource Allocation */
+#define INTELFB_FB_ACQUIRED                 1
+#define INTELFB_MMIO_ACQUIRED               2
+
 /* PCI ids for supported devices */
 #define PCI_DEVICE_ID_INTEL_830M        0x3577
 #define PCI_DEVICE_ID_INTEL_845G        0x2562
@@ -257,6 +261,7 @@ struct intelfb_info {
         int hwcursor;
         int fixed_mode;
         int ring_active;
+        int flag;
 
         /* hw cursor */
         int cursor_on;
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 427689e584da..0090544842f5 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -135,9 +135,6 @@
 static void __devinit get_initial_mode(struct intelfb_info *dinfo);
 static void update_dinfo(struct intelfb_info *dinfo,
                          struct fb_var_screeninfo *var);
-static int intelfb_get_fix(struct fb_fix_screeninfo *fix,
-                           struct fb_info *info);
-
 static int intelfb_check_var(struct fb_var_screeninfo *var,
                              struct fb_info *info);
 static int intelfb_set_par(struct fb_info *info);
@@ -473,9 +470,9 @@ cleanup(struct intelfb_info *dinfo)
         if (dinfo->aperture.virtual)
                 iounmap((void __iomem *)dinfo->aperture.virtual);
 
-        if (dinfo->mmio_base_phys)
+        if (dinfo->flag & INTELFB_MMIO_ACQUIRED)
                 release_mem_region(dinfo->mmio_base_phys, INTEL_REG_SIZE);
-        if (dinfo->aperture.physical)
+        if (dinfo->flag & INTELFB_FB_ACQUIRED)
                 release_mem_region(dinfo->aperture.physical,
                                    dinfo->aperture.size);
         framebuffer_release(dinfo->info);
@@ -572,6 +569,9 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 cleanup(dinfo);
                 return -ENODEV;
         }
+
+        dinfo->flag |= INTELFB_FB_ACQUIRED;
+
         if (!request_mem_region(dinfo->mmio_base_phys,
                                 INTEL_REG_SIZE,
                                 INTELFB_MODULE_NAME)) {
@@ -580,6 +580,8 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
+        dinfo->flag |= INTELFB_MMIO_ACQUIRED;
+
         /* Get the chipset info. */
         dinfo->pci_chipset = pdev->device;
 
@@ -1091,7 +1093,17 @@ intelfb_set_fbinfo(struct intelfb_info *dinfo)
                 return 1;
 
         info->pixmap.scan_align = 1;
-
+        strcpy(info->fix.id, dinfo->name);
+        info->fix.smem_start = dinfo->fb.physical;
+        info->fix.smem_len = dinfo->fb.size;
+        info->fix.type = FB_TYPE_PACKED_PIXELS;
+        info->fix.type_aux = 0;
+        info->fix.xpanstep = 8;
+        info->fix.ypanstep = 1;
+        info->fix.ywrapstep = 0;
+        info->fix.mmio_start = dinfo->mmio_base_phys;
+        info->fix.mmio_len = INTEL_REG_SIZE;
+        info->fix.accel = FB_ACCEL_I830;
         update_dinfo(dinfo, &info->var);
 
         return 0;
@@ -1109,7 +1121,8 @@ update_dinfo(struct intelfb_info *dinfo, struct fb_var_screeninfo *var)
         dinfo->yres = var->xres;
         dinfo->pixclock = var->pixclock;
 
-        intelfb_get_fix(&dinfo->info->fix, dinfo->info);
+        dinfo->info->fix.visual = dinfo->visual;
+        dinfo->info->fix.line_length = dinfo->pitch;
 
         switch (dinfo->bpp) {
         case 8:
@@ -1139,30 +1152,6 @@ update_dinfo(struct intelfb_info *dinfo, struct fb_var_screeninfo *var)
 
 /* fbops functions */
 
-static int
-intelfb_get_fix(struct fb_fix_screeninfo *fix, struct fb_info *info)
-{
-        struct intelfb_info *dinfo = GET_DINFO(info);
-
-        DBG_MSG("intelfb_get_fix\n");
-
-        memset(fix, 0, sizeof(*fix));
-        strcpy(fix->id, dinfo->name);
-        fix->smem_start = dinfo->fb.physical;
-        fix->smem_len = dinfo->fb.size;
-        fix->type = FB_TYPE_PACKED_PIXELS;
-        fix->type_aux = 0;
-        fix->visual = dinfo->visual;
-        fix->xpanstep = 8;
-        fix->ypanstep = 1;
-        fix->ywrapstep = 0;
-        fix->line_length = dinfo->pitch;
-        fix->mmio_start = dinfo->mmio_base_phys;
-        fix->mmio_len = INTEL_REG_SIZE;
-        fix->accel = FB_ACCEL_I830;
-        return 0;
-}
-
 /***************************************************************
  *                       fbdev interface                       *
  ***************************************************************/
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 006bb9e14579..3eaf6e701087 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -157,6 +157,8 @@ void nlmclnt_mark_reclaim(struct nlm_host *host)
                 inode = fl->fl_file->f_dentry->d_inode;
                 if (inode->i_sb->s_magic != NFS_SUPER_MAGIC)
                         continue;
+                if (fl->fl_u.nfs_fl.owner == NULL)
+                        continue;
                 if (fl->fl_u.nfs_fl.owner->host != host)
                         continue;
                 if (!(fl->fl_u.nfs_fl.flags & NFS_LCK_GRANTED))
@@ -226,6 +228,8 @@ restart:
                 inode = fl->fl_file->f_dentry->d_inode;
                 if (inode->i_sb->s_magic != NFS_SUPER_MAGIC)
                         continue;
+                if (fl->fl_u.nfs_fl.owner == NULL)
+                        continue;
                 if (fl->fl_u.nfs_fl.owner->host != host)
                         continue;
                 if (!(fl->fl_u.nfs_fl.flags & NFS_LCK_RECLAIM))
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index b497c71384e8..079228817603 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -678,15 +678,9 @@ nfs_file_direct_read(struct kiocb *iocb, char __user *buf, size_t count, loff_t
         if (!count)
                 goto out;
 
-        if (mapping->nrpages) {
-                retval = filemap_fdatawrite(mapping);
-                if (retval == 0)
-                        retval = nfs_wb_all(inode);
-                if (retval == 0)
-                        retval = filemap_fdatawait(mapping);
-                if (retval)
-                        goto out;
-        }
+        retval = nfs_sync_mapping(mapping);
+        if (retval)
+                goto out;
 
         retval = nfs_direct_read(inode, ctx, &iov, pos, 1);
         if (retval > 0)
@@ -764,15 +758,9 @@ nfs_file_direct_write(struct kiocb *iocb, const char __user *buf, size_t count,
         if (!count)
                 goto out;
 
-        if (mapping->nrpages) {
-                retval = filemap_fdatawrite(mapping);
-                if (retval == 0)
-                        retval = nfs_wb_all(inode);
-                if (retval == 0)
-                        retval = filemap_fdatawait(mapping);
-                if (retval)
-                        goto out;
-        }
+        retval = nfs_sync_mapping(mapping);
+        if (retval)
+                goto out;
 
         retval = nfs_direct_write(inode, ctx, &iov, pos, 1);
         if (mapping->nrpages)
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 57d3e77d97ee..eb5cd4c3bbfd 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -433,11 +433,7 @@ static int do_unlk(struct file *filp, int cmd, struct file_lock *fl)
          * Flush all pending writes before doing anything
          * with locks..
          */
-        filemap_fdatawrite(filp->f_mapping);
-        down(&inode->i_sem);
-        nfs_wb_all(inode);
-        up(&inode->i_sem);
-        filemap_fdatawait(filp->f_mapping);
+        nfs_sync_mapping(filp->f_mapping);
 
         /* NOTE: special case
          *      If we're signalled while cleaning up locks on process exit, we
@@ -465,15 +461,8 @@ static int do_setlk(struct file *filp, int cmd, struct file_lock *fl)
          * Flush all pending writes before doing anything
          * with locks..
          */
-        status = filemap_fdatawrite(filp->f_mapping);
-        if (status == 0) {
-                down(&inode->i_sem);
-                status = nfs_wb_all(inode);
-                up(&inode->i_sem);
-                if (status == 0)
-                        status = filemap_fdatawait(filp->f_mapping);
-        }
-        if (status < 0)
+        status = nfs_sync_mapping(filp->f_mapping);
+        if (status != 0)
                 goto out;
 
         lock_kernel();
@@ -497,11 +486,7 @@ static int do_setlk(struct file *filp, int cmd, struct file_lock *fl)
          * Make sure we clear the cache whenever we try to get the lock.
          * This makes locking act as a cache coherency point.
          */
-        filemap_fdatawrite(filp->f_mapping);
-        down(&inode->i_sem);
-        nfs_wb_all(inode);      /* we may have slept */
-        up(&inode->i_sem);
-        filemap_fdatawait(filp->f_mapping);
+        nfs_sync_mapping(filp->f_mapping);
         nfs_zap_caches(inode);
 out:
         rpc_clnt_sigunmask(NFS_CLIENT(inode), &oldset);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index afd75d0463fd..432f41cd75e6 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -640,6 +640,27 @@ static int nfs_show_options(struct seq_file *m, struct vfsmount *mnt)
         return 0;
 }
 
+/**
+ * nfs_sync_mapping - helper to flush all mmapped dirty data to disk
+ */
+int nfs_sync_mapping(struct address_space *mapping)
+{
+        int ret;
+
+        if (mapping->nrpages == 0)
+                return 0;
+        unmap_mapping_range(mapping, 0, 0, 0);
+        ret = filemap_fdatawrite(mapping);
+        if (ret != 0)
+                goto out;
+        ret = filemap_fdatawait(mapping);
+        if (ret != 0)
+                goto out;
+        ret = nfs_wb_all(mapping->host);
+out:
+        return ret;
+}
+
 /*
  * Invalidate the local caches
  */
@@ -1179,11 +1200,8 @@ void nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
         struct nfs_inode *nfsi = NFS_I(inode);
 
         if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
-                if (S_ISREG(inode->i_mode)) {
-                        if (filemap_fdatawrite(mapping) == 0)
-                                filemap_fdatawait(mapping);
-                        nfs_wb_all(inode);
-                }
+                if (S_ISREG(inode->i_mode))
+                        nfs_sync_mapping(mapping);
                 invalidate_inode_pages2(mapping);
 
                 spin_lock(&inode->i_lock);
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 1aea42d71a64..5328a2937127 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -78,7 +78,7 @@ STATIC int	xfs_qm_dqhashlock_nowait(xfs_dquot_t *);
 
 STATIC int      xfs_qm_init_quotainos(xfs_mount_t *);
 STATIC int      xfs_qm_init_quotainfo(xfs_mount_t *);
-STATIC int      xfs_qm_shake(int, unsigned int);
+STATIC int      xfs_qm_shake(int, gfp_t);
 
 #ifdef DEBUG
 extern mutex_t  qcheck_lock;
@@ -2197,7 +2197,7 @@ xfs_qm_shake_freelist(
  */
 /* ARGSUSED */
 STATIC int
-xfs_qm_shake(int nr_to_scan, unsigned int gfp_mask)
+xfs_qm_shake(int nr_to_scan, gfp_t gfp_mask)
 {
         int     ndqused, nfree, n;
 
diff --git a/include/asm-ia64/delay.h b/include/asm-ia64/delay.h
index 57182d6f2b9a..bba702076391 100644
--- a/include/asm-ia64/delay.h
+++ b/include/asm-ia64/delay.h
@@ -84,14 +84,6 @@ __delay (unsigned long loops)
         ia64_delay_loop (loops - 1);
 }
 
-static __inline__ void
-udelay (unsigned long usecs)
-{
-        unsigned long start = ia64_get_itc();
-        unsigned long cycles = usecs*local_cpu_data->cyc_per_usec;
-
-        while (ia64_get_itc() - start < cycles)
-                cpu_relax();
-}
+extern void udelay (unsigned long usecs);
 
 #endif /* _ASM_IA64_DELAY_H */
diff --git a/include/asm-ppc/ppc4xx_dma.h b/include/asm-ppc/ppc4xx_dma.h
index a415001165fa..46a086fff816 100644
--- a/include/asm-ppc/ppc4xx_dma.h
+++ b/include/asm-ppc/ppc4xx_dma.h
@@ -33,9 +33,6 @@
 
 #define MAX_PPC4xx_DMA_CHANNELS         4
 
-/* in arch/ppc/kernel/setup.c -- Cort */
-extern unsigned long DMA_MODE_WRITE, DMA_MODE_READ;
-
 /*
  * Function return status codes
  * These values are used to indicate whether or not the function
diff --git a/include/asm-sparc/memreg.h b/include/asm-sparc/memreg.h
index c0498d3baf93..5fb95c828da6 100644
--- a/include/asm-sparc/memreg.h
+++ b/include/asm-sparc/memreg.h
@@ -36,7 +36,7 @@
 
 /* Memory parity error register with associated bit constants. */
 #ifndef __ASSEMBLY__
-extern __volatile__ unsigned long *sun4c_memerr_reg;
+extern __volatile__ unsigned long __iomem *sun4c_memerr_reg;
 #endif
 
 #define SUN4C_MPE_ERROR 0x80    /* Parity error detected. (ro) */
diff --git a/include/asm-sparc/pcic.h b/include/asm-sparc/pcic.h
index 301ae8022ddd..dedea14d87c8 100644
--- a/include/asm-sparc/pcic.h
+++ b/include/asm-sparc/pcic.h
@@ -16,10 +16,10 @@
 #include <asm/pbm.h>
 
 struct linux_pcic {
-        void * __iomem          pcic_regs;
+        void __iomem            *pcic_regs;
         unsigned long           pcic_io;
-        void * __iomem          pcic_config_space_addr;
-        void * __iomem          pcic_config_space_data;
+        void __iomem            *pcic_config_space_addr;
+        void __iomem            *pcic_config_space_data;
         struct resource         pcic_res_regs;
         struct resource         pcic_res_io;
         struct resource         pcic_res_cfg_addr;
diff --git a/include/linux/cache.h b/include/linux/cache.h
index f6b5a46c5f82..0b7ecf3af78a 100644
--- a/include/linux/cache.h
+++ b/include/linux/cache.h
@@ -13,7 +13,7 @@
 #define SMP_CACHE_BYTES L1_CACHE_BYTES
 #endif
 
-#if defined(CONFIG_X86) || defined(CONFIG_SPARC64)
+#if defined(CONFIG_X86) || defined(CONFIG_SPARC64) || defined(CONFIG_IA64)
 #define __read_mostly __attribute__((__section__(".data.read_mostly")))
 #else
 #define __read_mostly
diff --git a/include/linux/mm.h b/include/linux/mm.h
index e5677f456742..a06a84d347fb 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -163,6 +163,7 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_HUGETLB      0x00400000      /* Huge TLB Page VM */
 #define VM_NONLINEAR    0x00800000      /* Is non-linear (remap_file_pages) */
 #define VM_MAPPED_COPY  0x01000000      /* T if mapped copy of data (nommu mmap) */
+#define VM_INSERTPAGE   0x02000000      /* The vma has had "vm_insert_page()" done on it */
 
 #ifndef VM_STACK_DEFAULT_FLAGS          /* arch can override this */
 #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
diff --git a/include/linux/mtd/onenand.h b/include/linux/mtd/onenand.h
index f1fd4215686a..7419b5fab133 100644
--- a/include/linux/mtd/onenand.h
+++ b/include/linux/mtd/onenand.h
@@ -17,7 +17,6 @@
 #include <linux/mtd/bbm.h>
 
 #define MAX_BUFFERRAM           2
-#define MAX_ONENAND_PAGESIZE    (2048 + 64)
 
 /* Scan and identify a OneNAND device */
 extern int onenand_scan(struct mtd_info *mtd, int max_chips);
@@ -110,6 +109,7 @@ struct onenand_chip {
         spinlock_t              chip_lock;
         wait_queue_head_t       wq;
         onenand_state_t         state;
+        unsigned char           *page_buf;
 
         struct nand_oobinfo     *autooob;
 
@@ -134,13 +134,12 @@ struct onenand_chip {
  * Options bits
  */
 #define ONENAND_CONT_LOCK               (0x0001)
-
+#define ONENAND_PAGEBUF_ALLOC           (0x1000)
 
 /*
  * OneNAND Flash Manufacturer ID Codes
  */
 #define ONENAND_MFR_SAMSUNG     0xec
-#define ONENAND_MFR_UNKNOWN     0x00
 
 /**
  * struct nand_manufacturers - NAND Flash Manufacturer ID Structure
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 12787a9b0259..2516adeccecf 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -291,6 +291,7 @@ static inline int nfs_verify_change_attribute(struct inode *inode, unsigned long
 /*
  * linux/fs/nfs/inode.c
  */
+extern int nfs_sync_mapping(struct address_space *mapping);
 extern void nfs_zap_caches(struct inode *);
 extern struct inode *nfs_fhget(struct super_block *, struct nfs_fh *,
                                 struct nfs_fattr *);
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index c231e9a08f0b..d50482ba27fe 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -866,6 +866,7 @@ enum rtnetlink_groups {
 #define RTNLGRP_IPV4_MROUTE     RTNLGRP_IPV4_MROUTE
         RTNLGRP_IPV4_ROUTE,
 #define RTNLGRP_IPV4_ROUTE      RTNLGRP_IPV4_ROUTE
+        RTNLGRP_NOP1,
         RTNLGRP_IPV6_IFADDR,
 #define RTNLGRP_IPV6_IFADDR     RTNLGRP_IPV6_IFADDR
         RTNLGRP_IPV6_MROUTE,
@@ -876,8 +877,11 @@ enum rtnetlink_groups {
 #define RTNLGRP_IPV6_IFINFO     RTNLGRP_IPV6_IFINFO
         RTNLGRP_DECnet_IFADDR,
 #define RTNLGRP_DECnet_IFADDR   RTNLGRP_DECnet_IFADDR
+        RTNLGRP_NOP2,
         RTNLGRP_DECnet_ROUTE,
 #define RTNLGRP_DECnet_ROUTE    RTNLGRP_DECnet_ROUTE
+        RTNLGRP_NOP3,
+        RTNLGRP_NOP4,
         RTNLGRP_IPV6_PREFIX,
 #define RTNLGRP_IPV6_PREFIX     RTNLGRP_IPV6_PREFIX
         __RTNLGRP_MAX
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 5beae1ccd574..1cdb87912137 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 extern void xfrm_policy_flush(void);
 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
 extern int xfrm_flush_bundles(void);
+extern void xfrm_flush_all_bundles(void);
 extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
 extern void xfrm_init_pmtu(struct dst_entry *dst);
 
diff --git a/mm/memory.c b/mm/memory.c
index d22f78c8a381..d8dde07a3656 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -574,7 +574,7 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
          * readonly mappings. The tradeoff is that copy_page_range is more
          * efficient than faulting.
          */
-        if (!(vma->vm_flags & (VM_HUGETLB|VM_NONLINEAR|VM_PFNMAP))) {
+        if (!(vma->vm_flags & (VM_HUGETLB|VM_NONLINEAR|VM_PFNMAP|VM_INSERTPAGE))) {
                 if (!vma->anon_vma)
                         return 0;
         }
@@ -1228,6 +1228,7 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, struct page *
                 return -EFAULT;
         if (!page_count(page))
                 return -EINVAL;
+        vma->vm_flags |= VM_INSERTPAGE;
         return insert_page(vma->vm_mm, addr, page, vma->vm_page_prot);
 }
 EXPORT_SYMBOL(vm_insert_page);
diff --git a/mm/mmap.c b/mm/mmap.c
index 11ca5927d5ff..64ba4dbcb7de 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -611,7 +611,7 @@ again:			remove_next = 1 + (end > next->vm_end);
  * If the vma has a ->close operation then the driver probably needs to release
  * per-vma resources, so we don't attempt to merge those.
  */
-#define VM_SPECIAL (VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_RESERVED)
+#define VM_SPECIAL (VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
 
 static inline int is_mergeable_vma(struct vm_area_struct *vma,
                         struct file *file, unsigned long vm_flags)
diff --git a/mm/mremap.c b/mm/mremap.c
index b535438c363c..ddaeee9a0b69 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -323,7 +323,7 @@ unsigned long do_mremap(unsigned long addr,
         /* We can't remap across vm area boundaries */
         if (old_len > vma->vm_end - addr)
                 goto out;
-        if (vma->vm_flags & VM_DONTEXPAND) {
+        if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
                 if (new_len > old_len)
                         goto out;
         }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 3b21a13d841c..fe14a8c87fc2 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1896,7 +1896,7 @@ static int __devinit pageset_cpuup_callback(struct notifier_block *nfb,
 static struct notifier_block pageset_notifier =
         { &pageset_cpuup_callback, NULL, 0 };
 
-void __init setup_per_cpu_pageset()
+void __init setup_per_cpu_pageset(void)
 {
         int err;
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index d8e36b775125..43a0b35dfe6f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff *skb)
         len -= 2;
 
         while (len > 0) {
-                int optlen = raw[off+1]+2;
+                int optlen = skb->nh.raw[off+1]+2;
 
                 switch (skb->nh.raw[off]) {
                 case IPV6_TLV_PAD0:
@@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff *skb)
                 case IPV6_TLV_JUMBO:
                         if (skb->nh.raw[off+1] != 4 || (off&3) != 2)
                                 goto bad;
-
                         pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2));
-
+                        if (pkt_len <= IPV6_MAXPLEN ||
+                            skb->nh.ipv6h->payload_len)
+                                goto bad;
                         if (pkt_len > skb->len - sizeof(struct ipv6hdr))
                                 goto bad;
-                        if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
-                                if (__pskb_trim(skb,
-                                    pkt_len + sizeof(struct ipv6hdr)))
-                                        goto bad;
-                                if (skb->ip_summed == CHECKSUM_HW)
-                                        skb->ip_summed = CHECKSUM_NONE;
-                        }
+                        if (pskb_trim_rcsum(skb,
+                            pkt_len+sizeof(struct ipv6hdr)))
+                                goto bad;
                         break;
                 default:
                         if (optlen > len)
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 058c48e258fc..d0a447e520a2 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -12,6 +12,7 @@ ip_nat_pptp-objs	:= ip_nat_helper_pptp.o ip_nat_proto_gre.o
 
 # connection tracking
 obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
+obj-$(CONFIG_IP_NF_NAT) += ip_nat.o
 
 # conntrack netlink interface
 obj-$(CONFIG_IP_NF_CONNTRACK_NETLINK) += ip_conntrack_netlink.o
@@ -41,7 +42,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 # the three instances of ip_tables
 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
-obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o ip_nat.o
+obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
 obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 
 # matches
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index b2b60f3e9cdd..42196ba3b0b9 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -182,6 +182,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
                 case IPPROTO_UDP:
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
+                case IPPROTO_DCCP:
                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                 u16 *ports = (u16 *)xprth;
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 73a23b4130a5..4ea8cf7c0cc4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1596,9 +1596,17 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
            not good.
          */
         if (valid_lft >= 0x7FFFFFFF/HZ)
-                rt_expires = 0;
+                rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ);
         else
-                rt_expires = jiffies + valid_lft * HZ;
+                rt_expires = valid_lft * HZ;
+
+        /*
+         * We convert this (in jiffies) to clock_t later.
+         * Avoid arithmetic overflow there as well.
+         * Overflow can happen only if HZ < USER_HZ.
+         */
+        if (HZ < USER_HZ && rt_expires > 0x7FFFFFFF / USER_HZ)
+                rt_expires = 0x7FFFFFFF / USER_HZ;
 
         if (pinfo->onlink) {
                 struct rt6_info *rt;
@@ -1610,12 +1618,12 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                                         ip6_del_rt(rt, NULL, NULL, NULL);
                                         rt = NULL;
                                 } else {
-                                        rt->rt6i_expires = rt_expires;
+                                        rt->rt6i_expires = jiffies + rt_expires;
                                 }
                         }
                 } else if (valid_lft) {
                         addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
-                                              dev, rt_expires, RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
+                                              dev, jiffies_to_clock_t(rt_expires), RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
                 }
                 if (rt)
                         dst_release(&rt->u.dst);
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 060d61202412..04912f9b35c3 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -211,7 +211,7 @@ config IP6_NF_TARGET_REJECT
 
 config IP6_NF_TARGET_NFQUEUE
         tristate "NFQUEUE Target Support"
-        depends on IP_NF_IPTABLES
+        depends on IP6_NF_IPTABLES
         help
           This Target replaced the old obsolete QUEUE target.
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a7a537b50595..7c68bfbee361 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -829,7 +829,7 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
         }
 
         rt->u.dst.obsolete = -1;
-        rt->rt6i_expires = clock_t_to_jiffies(rtmsg->rtmsg_info);
+        rt->rt6i_expires = jiffies + clock_t_to_jiffies(rtmsg->rtmsg_info);
         if (nlh && (r = NLMSG_DATA(nlh))) {
                 rt->rt6i_protocol = r->rtm_protocol;
         } else {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index cf1d91e74c82..69bd957380e7 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -214,6 +214,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                 case IPPROTO_UDP:
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
+                case IPPROTO_DCCP:
                         if (pskb_may_pull(skb, skb->nh.raw + offset + 4 - skb->data)) {
                                 u16 *ports = (u16 *)exthdr;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d890dfa8818f..9df888e932c5 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -156,10 +156,6 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
                                 sizeof(struct sk_buff) +
                                 sizeof(struct sctp_chunk);
 
-        sk->sk_wmem_queued += SCTP_DATA_SNDSIZE(chunk) +
-                                sizeof(struct sk_buff) +
-                                sizeof(struct sctp_chunk);
-
         atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
 }
 
@@ -3425,7 +3421,7 @@ static int sctp_copy_laddrs_to_user_old(struct sock *sk, __u16 port, int max_add
 }
 
 static int sctp_copy_laddrs_to_user(struct sock *sk, __u16 port,
-                                    void * __user *to, size_t space_left)
+                                    void __user **to, size_t space_left)
 {
         struct list_head *pos;
         struct sctp_sockaddr_entry *addr;
@@ -4426,7 +4422,7 @@ cleanup:
  * tcp_poll().  Note that, based on these implementations, we don't
  * lock the socket in this function, even though it seems that,
  * ideally, locking or some other mechanisms can be used to ensure
- * the integrity of the counters (sndbuf and wmem_queued) used
+ * the integrity of the counters (sndbuf and wmem_alloc) used
  * in this place.  We assume that we don't need locks either until proven
  * otherwise.
  *
@@ -4833,10 +4829,6 @@ static void sctp_wfree(struct sk_buff *skb)
                                 sizeof(struct sk_buff) +
                                 sizeof(struct sctp_chunk);
 
-        sk->sk_wmem_queued -= SCTP_DATA_SNDSIZE(chunk) +
-                                sizeof(struct sk_buff) +
-                                sizeof(struct sctp_chunk);
-
         atomic_sub(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
 
         sock_wfree(skb);
@@ -4920,7 +4912,7 @@ void sctp_write_space(struct sock *sk)
 
 /* Is there any sndbuf space available on the socket?
  *
- * Note that wmem_queued is the sum of the send buffers on all of the
+ * Note that sk_wmem_alloc is the sum of the send buffers on all of the
  * associations on the same socket.  For a UDP-style socket with
  * multiple associations, it is possible for it to be "unwriteable"
  * prematurely.  I assume that this is acceptable because
@@ -4933,7 +4925,7 @@ static int sctp_writeable(struct sock *sk)
 {
         int amt = 0;
 
-        amt = sk->sk_sndbuf - sk->sk_wmem_queued;
+        amt = sk->sk_sndbuf - atomic_read(&sk->sk_wmem_alloc);
         if (amt < 0)
                 amt = 0;
         return amt;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f44f46f1d8e0..8d782282ec19 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -638,7 +638,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
                                 gss_msg);
                 atomic_inc(&gss_msg->count);
                 gss_unhash_msg(gss_msg);
-                if (msg->errno == -ETIMEDOUT || msg->errno == -EPIPE) {
+                if (msg->errno == -ETIMEDOUT) {
                         unsigned long now = jiffies;
                         if (time_after(now, ratelimit)) {
                                 printk(KERN_WARNING "RPC: AUTH_GSS upcall timed out.\n"
@@ -786,7 +786,9 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int taskflags)
         cred->gc_flags = 0;
         cred->gc_base.cr_ops = &gss_credops;
         cred->gc_service = gss_auth->service;
-        err = gss_create_upcall(gss_auth, cred);
+        do {
+                err = gss_create_upcall(gss_auth, cred);
+        } while (err == -EAGAIN);
         if (err < 0)
                 goto out_err;
 
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index c76ea221798c..16a2458f38f7 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -174,7 +174,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
                 goto out;
         msg = (struct rpc_pipe_msg *)filp->private_data;
         if (msg != NULL) {
-                msg->errno = -EPIPE;
+                msg->errno = -EAGAIN;
                 list_del_init(&msg->list);
                 rpci->ops->destroy_msg(msg);
         }
@@ -183,7 +183,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
         if (filp->f_mode & FMODE_READ)
                 rpci->nreaders --;
         if (!rpci->nreaders)
-                __rpc_purge_upcall(inode, -EPIPE);
+                __rpc_purge_upcall(inode, -EAGAIN);
         if (rpci->ops->release_pipe)
                 rpci->ops->release_pipe(inode);
 out:
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 0a51fd46a848..77e8800d4127 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -990,6 +990,7 @@ static void xs_udp_connect_worker(void *args)
                 sk->sk_data_ready = xs_udp_data_ready;
                 sk->sk_write_space = xs_udp_write_space;
                 sk->sk_no_check = UDP_CSUM_NORCV;
+                sk->sk_allocation = GFP_ATOMIC;
 
                 xprt_set_connected(xprt);
 
@@ -1074,6 +1075,7 @@ static void xs_tcp_connect_worker(void *args)
                 sk->sk_data_ready = xs_tcp_data_ready;
                 sk->sk_state_change = xs_tcp_state_change;
                 sk->sk_write_space = xs_tcp_write_space;
+                sk->sk_allocation = GFP_ATOMIC;
 
                 /* socket options */
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0db9e57013fd..54a4be6a7d26 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1014,13 +1014,12 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 }
 EXPORT_SYMBOL(__xfrm_route_forward);
 
-/* Optimize later using cookies and generation ids. */
-
 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        if (!stale_bundle(dst))
-                return dst;
-
+        /* If it is marked obsolete, which is how we even get here,
+         * then we have purged it from the policy bundle list and we
+         * did that for a good reason.
+         */
         return NULL;
 }
 
@@ -1104,6 +1103,16 @@ int xfrm_flush_bundles(void)
         return 0;
 }
 
+static int always_true(struct dst_entry *dst)
+{
+        return 1;
+}
+
+void xfrm_flush_all_bundles(void)
+{
+        xfrm_prune_bundles(always_true);
+}
+
 void xfrm_init_pmtu(struct dst_entry *dst)
 {
         do {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 7cf48aa6c95b..479effc97666 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -431,6 +431,8 @@ void xfrm_state_insert(struct xfrm_state *x)
         spin_lock_bh(&xfrm_state_lock);
         __xfrm_state_insert(x);
         spin_unlock_bh(&xfrm_state_lock);
+
+        xfrm_flush_all_bundles();
 }
 EXPORT_SYMBOL(xfrm_state_insert);
 
@@ -478,6 +480,9 @@ out:
         spin_unlock_bh(&xfrm_state_lock);
         xfrm_state_put_afinfo(afinfo);
 
+        if (!err)
+                xfrm_flush_all_bundles();
+
         if (x1) {
                 xfrm_state_delete(x1);
                 xfrm_state_put(x1);
diff --git a/sound/oss/au1550_ac97.c b/sound/oss/au1550_ac97.c
index 6b46a8a4b1cc..b963c550dae6 100644
--- a/sound/oss/au1550_ac97.c
+++ b/sound/oss/au1550_ac97.c
@@ -578,17 +578,15 @@ set_recv_slots(int num_channels)
         } while ((stat & PSC_AC97STAT_DR) == 0);
 }
 
+/* Hold spinlock for both start_dac() and start_adc() calls */
 static void
 start_dac(struct au1550_state *s)
 {
         struct dmabuf  *db = &s->dma_dac;
-        unsigned long   flags;
 
         if (!db->stopped)
                 return;
 
-        spin_lock_irqsave(&s->lock, flags);
-
         set_xmit_slots(db->num_channels);
         au_writel(PSC_AC97PCR_TC, PSC_AC97PCR);
         au_sync();
@@ -598,8 +596,6 @@ start_dac(struct au1550_state *s)
         au1xxx_dbdma_start(db->dmanr);
 
         db->stopped = 0;
-
-        spin_unlock_irqrestore(&s->lock, flags);
 }
 
 static void
@@ -718,7 +714,6 @@ prog_dmabuf_dac(struct au1550_state *s)
 }
 
 
-/* hold spinlock for the following */
 static void
 dac_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 {
@@ -726,6 +721,8 @@ dac_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         struct dmabuf  *db = &s->dma_dac;
         u32     ac97c_stat;
 
+        spin_lock(&s->lock);
+
         ac97c_stat = au_readl(PSC_AC97STAT);
         if (ac97c_stat & (AC97C_XU | AC97C_XO | AC97C_TE))
                 pr_debug("AC97C status = 0x%08x\n", ac97c_stat);
@@ -747,6 +744,8 @@ dac_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         /* wake up anybody listening */
         if (waitqueue_active(&db->wait))
                 wake_up(&db->wait);
+
+        spin_unlock(&s->lock);
 }
 
 
@@ -758,6 +757,8 @@ adc_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         u32     obytes;
         char    *obuf;
 
+        spin_lock(&s->lock);
+
         /* Pull the buffer from the dma queue.
         */
         au1xxx_dbdma_get_dest(dp->dmanr, (void *)(&obuf), &obytes);
@@ -765,6 +766,7 @@ adc_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         if ((dp->count + obytes) > dp->dmasize) {
                 /* Overrun. Stop ADC and log the error
                 */
+                spin_unlock(&s->lock);
                 stop_adc(s);
                 dp->error++;
                 err("adc overrun");
@@ -787,6 +789,7 @@ adc_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         if (waitqueue_active(&dp->wait))
                 wake_up(&dp->wait);
 
+        spin_unlock(&s->lock);
 }
 
 static loff_t
@@ -1048,9 +1051,9 @@ au1550_read(struct file *file, char *buffer, size_t count, loff_t *ppos)
                 /* wait for samples in ADC dma buffer
                 */
                 do {
+                        spin_lock_irqsave(&s->lock, flags);
                         if (db->stopped)
                                 start_adc(s);
-                        spin_lock_irqsave(&s->lock, flags);
                         avail = db->count;
                         if (avail <= 0)
                                 __set_current_state(TASK_INTERRUPTIBLE);
@@ -1570,15 +1573,19 @@ au1550_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                 if (get_user(val, (int *) arg))
                         return -EFAULT;
                 if (file->f_mode & FMODE_READ) {
-                        if (val & PCM_ENABLE_INPUT)
+                        if (val & PCM_ENABLE_INPUT) {
+                                spin_lock_irqsave(&s->lock, flags);
                                 start_adc(s);
-                        else
+                                spin_unlock_irqrestore(&s->lock, flags);
+                        } else
                                 stop_adc(s);
                 }
                 if (file->f_mode & FMODE_WRITE) {
-                        if (val & PCM_ENABLE_OUTPUT)
+                        if (val & PCM_ENABLE_OUTPUT) {
+                                spin_lock_irqsave(&s->lock, flags);
                                 start_dac(s);
-                        else
+                                spin_unlock_irqrestore(&s->lock, flags);
+                        } else
                                 stop_dac(s);
                 }
                 return 0;