Merge bk://linux-dj.bkbits.net/watchdog

into home.transmeta.com:/home/torvalds/v2.5/linux

57 files changed, 284 insertions, 316 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index a3f537d9fb93..fcc45ab27433 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -460,6 +460,13 @@ M:	henrique@cyclades.com
 W:	http://www.cyclades.com/
 S:	Supported
 
+DAC960 RAID CONTROLLER DRIVER
+P:	Dave Olien
+M	dmo@osdl.org
+W:	http://www.osdl.org/archive/dmo/DAC960
+L:	linux-kernel@vger.kernel.org
+S:	Maintained
+
 DAMA SLAVE for AX.25
 P:	Joerg Reuter
 M:	jreuter@yaina.de
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index 73d1bbdbf43c..2f1a8670162b 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -52,7 +52,7 @@ int using_apic_timer = 0;
 
 int prof_multiplier[NR_CPUS] = { 1, };
 int prof_old_multiplier[NR_CPUS] = { 1, };
-int prof_counter[NR_CPUS] = { 1, };
+DEFINE_PER_CPU(int, prof_counter) = 1;
 
 int get_maxlvt(void)
 {
@@ -997,7 +997,7 @@ inline void smp_local_timer_interrupt(struct pt_regs * regs)
 
 	x86_do_profile(regs);
 
-	if (--prof_counter[cpu] <= 0) {
+	if (--per_cpu(prof_counter, cpu) <= 0) {
 		/*
 		 * The multiplier may have changed since the last time we got
 		 * to this point as a result of the user writing to
@@ -1006,10 +1006,12 @@ inline void smp_local_timer_interrupt(struct pt_regs * regs)
 		 *
 		 * Interrupts are already masked off at this point.
 		 */
-		prof_counter[cpu] = prof_multiplier[cpu];
-		if (prof_counter[cpu] != prof_old_multiplier[cpu]) {
-			__setup_APIC_LVTT(calibration_result/prof_counter[cpu]);
-			prof_old_multiplier[cpu] = prof_counter[cpu];
+		per_cpu(prof_counter, cpu) = prof_multiplier[cpu];
+		if (per_cpu(prof_counter, cpu) != prof_old_multiplier[cpu]) {
+			__setup_APIC_LVTT(
+					calibration_result/
+					per_cpu(prof_counter, cpu));
+			prof_old_multiplier[cpu] = per_cpu(prof_counter, cpu);
 		}
 
 #ifdef CONFIG_SMP
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index 1edcbcb07b9c..0e32adb7b0d6 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -1440,7 +1440,8 @@ void disable_IO_APIC(void)
  * by Matt Domsch <Matt_Domsch@dell.com>  Tue Dec 21 12:25:05 CST 1999
  */
 
-static void __init setup_ioapic_ids_from_mpc (void)
+#ifndef CONFIG_X86_NUMAQ
+static void __init setup_ioapic_ids_from_mpc(void)
 {
 	struct IO_APIC_reg_00 reg_00;
 	unsigned long phys_id_present_map;
@@ -1533,6 +1534,9 @@ static void __init setup_ioapic_ids_from_mpc (void)
 			printk(" ok.\n");
 	}
 }
+#else
+static void __init setup_ioapic_ids_from_mpc(void) { }
+#endif
 
 /*
  * There is a nasty bug in some older SMP boards, their mptable lies
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index 0d1158c3607a..36c3bce085df 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -935,10 +935,6 @@ static void smp_tune_scheduling (void)
  * Cycle through the processors sending APIC IPIs to boot each.
  */
 
-extern int prof_multiplier[NR_CPUS];
-extern int prof_old_multiplier[NR_CPUS];
-extern int prof_counter[NR_CPUS];
-
 static int boot_cpu_logical_apicid;
 /* Where the IO area was mapped on multiquad, always 0 otherwise */
 void *xquad_portio;
@@ -950,17 +946,6 @@ static void __init smp_boot_cpus(unsigned int max_cpus)
 	int apicid, cpu, bit;
 
 	/*
-	 * Initialize the logical to physical CPU number mapping
-	 * and the per-CPU profiling counter/multiplier
-	 */
-
-	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-		prof_counter[cpu] = 1;
-		prof_old_multiplier[cpu] = 1;
-		prof_multiplier[cpu] = 1;
-	}
-
-	/*
 	 * Setup boot CPU information
 	 */
 	smp_store_cpu_info(0); /* Final full version of the data */
diff --git a/arch/i386/mach-voyager/voyager_smp.c b/arch/i386/mach-voyager/voyager_smp.c
index cdbc7915b438..5fcad466948d 100644
--- a/arch/i386/mach-voyager/voyager_smp.c
+++ b/arch/i386/mach-voyager/voyager_smp.c
@@ -236,7 +236,7 @@ static __u32 trampoline_base;
 /* The per cpu profile stuff - used in smp_local_timer_interrupt */
 static unsigned int prof_multiplier[NR_CPUS] __cacheline_aligned = { 1, };
 static unsigned int prof_old_multiplier[NR_CPUS] __cacheline_aligned = { 1, };
-static unsigned int prof_counter[NR_CPUS] __cacheline_aligned = { 1, };
+static DEFINE_PER_CPU(unsigned int, prof_counter) =  1;
 
 /* the map used to check if a CPU has booted */
 static __u32 cpu_booted_map;
@@ -393,9 +393,6 @@ find_smp_config(void)
 
 	/* initialize the CPU structures (moved from smp_boot_cpus) */
 	for(i=0; i<NR_CPUS; i++) {
-		prof_counter[i] = 1;
-		prof_old_multiplier[i] = 1;
-		prof_multiplier[i] = 1;
 		cpu_irq_affinity[i] = ~0;
 	}
 	cpu_online_map = (1<<boot_cpu_id);
@@ -1312,7 +1309,7 @@ smp_local_timer_interrupt(struct pt_regs * regs)
 
 	x86_do_profile(regs);
 
-	if (--prof_counter[cpu] <= 0) {
+	if (--per_cpu(prof_counter, cpu) <= 0) {
 		/*
 		 * The multiplier may have changed since the last time we got
 		 * to this point as a result of the user writing to
@@ -1321,10 +1318,10 @@ smp_local_timer_interrupt(struct pt_regs * regs)
 		 *
 		 * Interrupts are already masked off at this point.
 		 */
-		prof_counter[cpu] = prof_multiplier[cpu];
-		if (prof_counter[cpu] != prof_old_multiplier[cpu]) {
+		per_cpu(prof_counter,cpu) = prof_multiplier[cpu];
+		if (per_cpu(prof_counter, cpu) != prof_old_multiplier[cpu]) {
 			/* FIXME: need to update the vic timer tick here */
-			prof_old_multiplier[cpu] = prof_counter[cpu];
+			prof_old_multiplier[cpu] = per_cpu(prof_counter, cpu);
 		}
 
 		update_process_times(user_mode(regs));
diff --git a/arch/i386/mm/hugetlbpage.c b/arch/i386/mm/hugetlbpage.c
index 243d844a1a79..749cadb2e5a3 100644
--- a/arch/i386/mm/hugetlbpage.c
+++ b/arch/i386/mm/hugetlbpage.c
@@ -88,6 +88,18 @@ static void set_huge_pte(struct mm_struct *mm, struct vm_area_struct *vma, struc
 	set_pte(page_table, entry);
 }
 
+/*
+ * This function checks for proper alignment of input addr and len parameters.
+ */
+int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
+{
+	if (len & ~HPAGE_MASK)
+		return -EINVAL;
+	if (addr & ~HPAGE_MASK)
+		return -EINVAL;
+	return 0;
+}
+
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
 			struct vm_area_struct *vma)
 {
diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
index a08a64c1d39d..c71ed65b5a2d 100644
--- a/arch/ia64/mm/hugetlbpage.c
+++ b/arch/ia64/mm/hugetlbpage.c
@@ -96,6 +96,18 @@ set_huge_pte (struct mm_struct *mm, struct vm_area_struct *vma,
 	return;
 }
 
+/*
+ * This function checks for proper alignment of input addr and len parameters.
+ */
+int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
+{
+	if (len & ~HPAGE_MASK)
+		return -EINVAL;
+	if (addr & ~HPAGE_MASK)
+		return -EINVAL;
+	return 0;
+}
+
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
 			struct vm_area_struct *vma)
 {
diff --git a/arch/sparc64/mm/hugetlbpage.c b/arch/sparc64/mm/hugetlbpage.c
index c137cb8c9d56..63895ce0202f 100644
--- a/arch/sparc64/mm/hugetlbpage.c
+++ b/arch/sparc64/mm/hugetlbpage.c
@@ -232,6 +232,18 @@ out_error:
 	return -1;
 }
 
+/*
+ * This function checks for proper alignment of input addr and len parameters.
+ */
+int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
+{
+	if (len & ~HPAGE_MASK)
+		return -EINVAL;
+	if (addr & ~HPAGE_MASK)
+		return -EINVAL;
+	return 0;
+}
+
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
 			    struct vm_area_struct *vma)
 {
diff --git a/arch/x86_64/mm/hugetlbpage.c b/arch/x86_64/mm/hugetlbpage.c
index f8e146193dc6..e1c31afb196e 100644
--- a/arch/x86_64/mm/hugetlbpage.c
+++ b/arch/x86_64/mm/hugetlbpage.c
@@ -86,6 +86,18 @@ static void set_huge_pte(struct mm_struct *mm, struct vm_area_struct *vma, struc
 	set_pte(page_table, entry);
 }
 
+/*
+ * This function checks for proper alignment of input addr and len parameters.
+ */
+int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
+{
+	if (len & ~HPAGE_MASK)
+		return -EINVAL;
+	if (addr & ~HPAGE_MASK)
+		return -EINVAL;
+	return 0;
+}
+
 int
 copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
 			struct vm_area_struct *vma)
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 8881536cd7e0..3582ba2fcca0 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -1731,12 +1731,17 @@ static boolean DAC960_V2_ReadControllerConfiguration(DAC960_Controller_T
       if (!DAC960_V2_NewLogicalDeviceInfo(Controller, LogicalDeviceNumber))
 	break;
       LogicalDeviceNumber = NewLogicalDeviceInfo->LogicalDeviceNumber;
-      if (LogicalDeviceNumber > DAC960_MaxLogicalDrives)
-	panic("DAC960: Logical Drive Number %d not supported\n",
-		       LogicalDeviceNumber);
-      if (NewLogicalDeviceInfo->DeviceBlockSizeInBytes != DAC960_BlockSize)
-	panic("DAC960: Logical Drive Block Size %d not supported\n",
-	      NewLogicalDeviceInfo->DeviceBlockSizeInBytes);
+      if (LogicalDeviceNumber >= DAC960_MaxLogicalDrives) {
+	DAC960_Error("DAC960: Logical Drive Number %d not supported\n",
+		       Controller, LogicalDeviceNumber);
+		break;
+      }
+      if (NewLogicalDeviceInfo->DeviceBlockSizeInBytes != DAC960_BlockSize) {
+	DAC960_Error("DAC960: Logical Drive Block Size %d not supported\n",
+	      Controller, NewLogicalDeviceInfo->DeviceBlockSizeInBytes);
+        LogicalDeviceNumber++;
+        continue;
+      }
       PhysicalDevice.Controller = 0;
       PhysicalDevice.Channel = NewLogicalDeviceInfo->Channel;
       PhysicalDevice.TargetID = NewLogicalDeviceInfo->TargetID;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index c404935bc432..f4a26d1331af 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -345,7 +345,7 @@ static int cciss_open(struct inode *inode, struct file *filep)
 	printk(KERN_DEBUG "cciss_open %x (%x:%x)\n", inode->i_rdev, ctlr, dsk);
 #endif /* CCISS_DEBUG */ 
 
-	if (ctlr > MAX_CTLR || hba[ctlr] == NULL)
+	if (ctlr >= MAX_CTLR || hba[ctlr] == NULL)
 		return -ENXIO;
 	/*
 	 * Root is allowed to open raw volume zero even if its not configured
diff --git a/drivers/block/genhd.c b/drivers/block/genhd.c
index 43af853a617a..69c4ff2ff7ad 100644
--- a/drivers/block/genhd.c
+++ b/drivers/block/genhd.c
@@ -74,7 +74,7 @@ void blk_unregister_region(dev_t dev, unsigned long range)
 	down_write(&block_subsys.rwsem);
 	for (s = &probes[index]; *s; s = &(*s)->next) {
 		struct blk_probe *p = *s;
-		if (p->dev == dev || p->range == range) {
+		if (p->dev == dev && p->range == range) {
 			*s = p->next;
 			kfree(p);
 			break;
diff --git a/drivers/block/ll_rw_blk.c b/drivers/block/ll_rw_blk.c
index e13d0bbca144..154120d9d434 100644
--- a/drivers/block/ll_rw_blk.c
+++ b/drivers/block/ll_rw_blk.c
@@ -677,7 +677,7 @@ static char *rq_flags[] = {
 	"REQ_SENSE",
 	"REQ_FAILED",
 	"REQ_QUIET",
-	"REQ_SPECIAL"
+	"REQ_SPECIAL",
 	"REQ_DRIVE_CMD",
 	"REQ_DRIVE_TASK",
 	"REQ_DRIVE_TASKFILE",
diff --git a/drivers/char/ftape/lowlevel/ftape-read.c b/drivers/char/ftape/lowlevel/ftape-read.c
index 03d24e743b05..d967d8cd86dc 100644
--- a/drivers/char/ftape/lowlevel/ftape-read.c
+++ b/drivers/char/ftape/lowlevel/ftape-read.c
@@ -589,6 +589,8 @@ TRACE(ft_t_info, "the famous ??? bug: max_floppy_track off by one !");
 		(max_floppy_track != 254 || max_floppy_sector != 128))
 #endif
 	   ) {
+		char segperheadz = ftape_segments_per_head ? ' ' : '?';
+		char segpercylz  = ftape_segments_per_cylinder ? ' ' : '?';
 		TRACE(ft_t_err,"Tape parameters inconsistency, please report");
 		TRACE(ft_t_err, "reported = %d/%d/%d/%d/%d/%d",
 		      ft_format_code,
@@ -597,14 +599,20 @@ TRACE(ft_t_info, "the famous ??? bug: max_floppy_track off by one !");
 		      max_floppy_side,
 		      max_floppy_track,
 		      max_floppy_sector);
-		TRACE(ft_t_err, "required = %d/%d/%d/%d/%d/%d",
+		TRACE(ft_t_err, "required = %d/%d/%d/%d%c/%d%c/%d",
 		      ft_format_code,
 		      ft_segments_per_track,
 		      ft_tracks_per_tape,
+		      ftape_segments_per_head ?
 		      ((ft_segments_per_track * ft_tracks_per_tape -1) / 
-		       ftape_segments_per_head ),
+		       ftape_segments_per_head ) :
+			(ft_segments_per_track * ft_tracks_per_tape -1),
+			segperheadz,
+		      ftape_segments_per_cylinder ?
 		      (ftape_segments_per_head / 
-		       ftape_segments_per_cylinder - 1 ),
+		       ftape_segments_per_cylinder - 1 ) :
+			ftape_segments_per_head - 1,
+			segpercylz,
 		      (ftape_segments_per_cylinder * FT_SECTORS_PER_SEGMENT));
 		TRACE_EXIT -EIO;
 	}
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index f56c6de4b7e2..501534e6a109 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -1090,7 +1090,7 @@ static int rc_open(struct tty_struct * tty, struct file * filp)
 	unsigned long flags;
 	
 	board = RC_BOARD(minor(tty->device));
-	if (board > RC_NBOARD || !(rc_board[board].flags & RC_BOARD_PRESENT))
+	if (board >= RC_NBOARD || !(rc_board[board].flags & RC_BOARD_PRESENT))
 		return -ENODEV;
 	
 	bp = &rc_board[board];
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 29c856b8a5d3..cc629ef0d9dc 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1689,7 +1689,7 @@ static int sx_fw_ioctl (struct inode *inode, struct file *filp,
 	switch (cmd) {
 	case SXIO_SET_BOARD:
 		sx_dprintk (SX_DEBUG_FIRMWARE, "set board to %ld\n", arg);
-		if (arg > SX_NBOARDS) return -EIO;
+		if (arg >= SX_NBOARDS) return -EIO;
 		sx_dprintk (SX_DEBUG_FIRMWARE, "not out of range\n");
 		if (!(boards[arg].flags	& SX_BOARD_PRESENT)) return -EIO;
 		sx_dprintk (SX_DEBUG_FIRMWARE, ".. and present!\n");
diff --git a/drivers/ide/pci/amd74xx.c b/drivers/ide/pci/amd74xx.c
index 71d41408d033..d837f3a76812 100644
--- a/drivers/ide/pci/amd74xx.c
+++ b/drivers/ide/pci/amd74xx.c
@@ -60,7 +60,7 @@ static struct amd_ide_chip {
 	{ PCI_DEVICE_ID_AMD_OPUS_7441, 0x00, 0x40, AMD_UDMA_100 },			/* AMD-768 Opus */
 	{ PCI_DEVICE_ID_AMD_8111_IDE,  0x00, 0x40, AMD_UDMA_100 },			/* AMD-8111 */
         { PCI_DEVICE_ID_NVIDIA_NFORCE_IDE, 0x00, 0x50, AMD_UDMA_100 },                  /* nVidia nForce */
-
+	{ PCI_DEVICE_ID_NVIDIA_NFORCE2_IDE, 0x00, 0x50, AMD_UDMA_100 },			/* nVidia nForce 2 */
 	{ 0 }
 };
 
@@ -446,6 +446,7 @@ static struct pci_device_id amd74xx_pci_tbl[] __devinitdata = {
 	{ PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_OPUS_7441,	PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3},
 	{ PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8111_IDE, 	PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
 	{ PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5},
+	{ PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE2_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 6},
 	{ 0, },
 };
 
diff --git a/drivers/ide/pci/amd74xx.h b/drivers/ide/pci/amd74xx.h
index ed76c7f6e33f..e5984607cb56 100644
--- a/drivers/ide/pci/amd74xx.h
+++ b/drivers/ide/pci/amd74xx.h
@@ -110,6 +110,20 @@ static ide_pci_device_t amd74xx_chipsets[] __devinitdata = {
 		.bootable	= ON_BOARD,
 		.extra		= 0,
 	},
+	{	/* 6 */
+		.vendor		= PCI_VENDOR_ID_NVIDIA,
+		.device		= PCI_DEVICE_ID_NVIDIA_NFORCE2_IDE,
+		.name		= "NFORCE2",
+		.init_chipset	= init_chipset_amd74xx,
+		.init_iops	= NULL,
+		.init_hwif	= init_hwif_amd74xx,
+		.init_dma	= init_dma_amd74xx,
+		.channels	= 2,
+		.autodma	= AUTODMA,
+		.enablebits	= {{0x50,0x01,0x01}, {0x50,0x02,0x02}},
+		.bootable	= ON_BOARD,
+		.extra		= 0,
+	},
 	{
 		.vendor		= 0,
 		.device		= 0,
diff --git a/drivers/isdn/hardware/eicon/diva.c b/drivers/isdn/hardware/eicon/diva.c
index aab7fbcaef0f..81cf2292c1c8 100644
--- a/drivers/isdn/hardware/eicon/diva.c
+++ b/drivers/isdn/hardware/eicon/diva.c
@@ -563,10 +563,11 @@ static void diva_init_request_array(void)
 	Requests[31] = DivaIdiRequest31;
 }
 
+/* card:  1-based card number */
 void diva_xdi_display_adapter_features(int card)
 {
 	dword features;
-	if (!card || ((card - 1) > MAX_ADAPTER) || !IoAdapters[card - 1]) {
+	if (!card || ((card - 1) >= MAX_ADAPTER) || !IoAdapters[card - 1]) {
 		return;
 	}
 	card--;
diff --git a/drivers/media/dvb/av7110/av7110.c b/drivers/media/dvb/av7110/av7110.c
index 4df0e077f88a..f0178c18e0e5 100644
--- a/drivers/media/dvb/av7110/av7110.c
+++ b/drivers/media/dvb/av7110/av7110.c
@@ -3243,7 +3243,7 @@ StopHWFilter(struct dvb_demux_filter *dvbdmxfilter)
         u16 handle;
                 
         handle=dvbdmxfilter->hw_handle;
-        if (handle>32) {
+        if (handle >= MAXFILT) {
                 dprintk("dvb: StopHWFilter tried to stop invalid filter %d.\n",
                        handle);
                 dprintk("dvb: filter type = %d\n",  dvbdmxfilter->type);
@@ -4408,7 +4408,7 @@ dvb_register(av7110_t *av7110)
         dvbdemux->priv=(void *) av7110;
 
         if (av7110->saa->card_type==DVB_CARD_TT_SIEMENS) {
-                for (i=0; i<32; i++)
+                for (i = 0; i < MAXFILT; i++)
                         av7110->handle2filter[i]=NULL;
 
                 dvbdemux->filternum=32;
diff --git a/drivers/media/dvb/av7110/av7110.h b/drivers/media/dvb/av7110/av7110.h
index a4e8acaf7cd6..90cdb89e78c2 100644
--- a/drivers/media/dvb/av7110/av7110.h
+++ b/drivers/media/dvb/av7110/av7110.h
@@ -580,7 +580,7 @@ typedef struct av7110_s {
 #define TRICK_FREEZE 3
         struct audio_status      audiostate;
 
-        struct dvb_demux_filter     *handle2filter[32];
+        struct dvb_demux_filter     *handle2filter[MAXFILT];
         p2t_t                   p2t_filter[MAXFILT];
         dvb_filter_pes2ts_t     p2t[2];
         struct ipack_s          ipack[2];
diff --git a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
index d63ea1396972..2ed590fc87c1 100644
--- a/drivers/media/video/bttv-cards.c
+++ b/drivers/media/video/bttv-cards.c
@@ -2172,8 +2172,9 @@ static void __devinit hauppauge_eeprom(struct bttv *btv)
 	tuner = eeprom_data[9];
 	radio = eeprom_data[blk2-1] & 0x01;
 	
-        if (tuner < sizeof(hauppauge_tuner)/sizeof(struct HAUPPAUGE_TUNER))
-                btv->tuner_type = hauppauge_tuner[tuner].id;
+        if (tuner >= ARRAY_SIZE(hauppauge_tuner))
+		tuner = 0;
+	btv->tuner_type = hauppauge_tuner[tuner].id;
 	if (radio)
 		btv->has_radio = 1;
 	
diff --git a/drivers/message/i2o/i2o_core.c b/drivers/message/i2o/i2o_core.c
index 418b2dcd930c..d4f15436a380 100644
--- a/drivers/message/i2o/i2o_core.c
+++ b/drivers/message/i2o/i2o_core.c
@@ -3060,7 +3060,7 @@ void i2o_report_common_status(u8 req_status)
 		"PROGRESS_REPORT"	
 	};
 
-	if (req_status > I2O_REPLY_STATUS_PROGRESS_REPORT)
+	if (req_status >= ARRAY_SIZE(REPLY_STATUS))
 		printk("RequestStatus = %0#2x", req_status);
 	else
 		printk("%s", REPLY_STATUS[req_status]);
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 149113d70b43..815bac11cc72 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -338,16 +338,6 @@ static int __init el3_common_init (struct net_device *dev)
 	dev->watchdog_timeo = TX_TIMEOUT;
 	dev->do_ioctl = netdev_ioctl;
 
-#ifdef CONFIG_PM
-	/* register power management */
-	lp->pmdev = pm_register(PM_ISA_DEV, card_idx, el3_pm_callback);
-	if (lp->pmdev) {
-		struct pm_dev *p;
-		p = lp->pmdev;
-		p->data = (struct net_device *)dev;
-	}
-#endif
-
 	return 0;
 }
 
@@ -417,6 +407,13 @@ static int __init el3_probe(int card_idx)
 					phys_addr[j] =
 						htons(read_eeprom(ioaddr, j));
 			if_port = read_eeprom(ioaddr, 8) >> 14;
+			if (!(dev = init_etherdev(NULL, sizeof(struct el3_private)))) {
+					release_region(ioaddr, EL3_IO_EXTENT);
+					pnp_device_detach(idev);
+					return -ENOMEM;
+			}
+
+			SET_MODULE_OWNER(dev);
 			pnp_cards++;
 			goto found;
 		}
@@ -497,24 +494,29 @@ no_pnp:
 	}
 	irq = id_read_eeprom(9) >> 12;
 
-#if 0							/* Huh ?
-								   Can someone explain what is this for ? */
-	if (dev) {					/* Set passed-in IRQ or I/O Addr. */
-		if (dev->irq > 1  &&  dev->irq < 16)
+	if (!(dev = init_etherdev(NULL, sizeof(struct el3_private))))
+			return -ENOMEM;
+
+	SET_MODULE_OWNER(dev);
+	
+	/* Set passed-in IRQ or I/O Addr. */
+	if (dev->irq > 1  &&  dev->irq < 16)
 			irq = dev->irq;
 
-		if (dev->base_addr) {
+	if (dev->base_addr) {
 			if (dev->mem_end == 0x3c509 			/* Magic key */
 				&& dev->base_addr >= 0x200  &&  dev->base_addr <= 0x3e0)
-				ioaddr = dev->base_addr & 0x3f0;
-			else if (dev->base_addr != ioaddr)
-				return -ENODEV;
-		}
+					ioaddr = dev->base_addr & 0x3f0;
+			else if (dev->base_addr != ioaddr) {
+					unregister_netdev (dev);
+					return -ENODEV;
+			}
 	}
-#endif
 
-	if (!request_region(ioaddr, EL3_IO_EXTENT, "3c509"))
-		return -EBUSY;
+	if (!request_region(ioaddr, EL3_IO_EXTENT, "3c509")) {
+			unregister_netdev (dev);
+			return -EBUSY;
+	}
 
 	/* Set the adaptor tag so that the next card can be found. */
 	outb(0xd0 + ++current_tag, id_port);
@@ -524,6 +526,7 @@ no_pnp:
 
 	EL3WINDOW(0);
 	if (inw(ioaddr) != 0x6d50) {
+		unregister_netdev (dev);
 		release_region(ioaddr, EL3_IO_EXTENT);
 		return -ENODEV;
 	}
@@ -531,12 +534,9 @@ no_pnp:
 	/* Free the interrupt so that some other card can use it. */
 	outw(0x0f00, ioaddr + WN0_IRQ);
 
-	dev = init_etherdev(NULL, sizeof(struct el3_private));
-	if (dev == NULL) {
-	    release_region(ioaddr, EL3_IO_EXTENT);
-		return -ENOMEM;
-	}
-	SET_MODULE_OWNER(dev);
+#ifdef __ISAPNP__	
+ found:							/* PNP jumps here... */
+#endif /* __ISAPNP__ */
 
 	memcpy(dev->dev_addr, phys_addr, sizeof(phys_addr));
 	dev->base_addr = ioaddr;
@@ -547,6 +547,16 @@ no_pnp:
 	lp->dev = &idev->dev;
 #endif
 
+#ifdef CONFIG_PM
+	/* register power management */
+	lp->pmdev = pm_register(PM_ISA_DEV, card_idx, el3_pm_callback);
+	if (lp->pmdev) {
+		struct pm_dev *p;
+		p = lp->pmdev;
+		p->data = (struct net_device *)dev;
+	}
+#endif
+
 	return el3_common_init (dev);
 }
 
@@ -667,6 +677,7 @@ static int __init el3_eisa_probe (struct device *device)
 }
 #endif
 
+#if defined(CONFIG_EISA) || defined(CONFIG_MCA)
 /* This remove works for all device types.
  *
  * The net dev must be stored in the driver_data field */
@@ -679,6 +690,7 @@ static int __devexit el3_device_remove (struct device *device)
 		el3_common_remove (dev);
 		return 0;
 }
+#endif
 
 /* Read a word from the EEPROM using the regular EEPROM access register.
    Assume that we are in register window zero.
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 5432dd2ee6db..f9d764b8a95f 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -181,7 +181,7 @@
     - See http://www.zip.com.au/~akpm/linux/#3c59x-2.3 for more details.
     - Also see Documentation/networking/vortex.txt
 
-   LK1.1.19 10Nov09 Marc Zyngier <maz@wild-wind.fr.eu.org>
+   LK1.1.19 10Nov02 Marc Zyngier <maz@wild-wind.fr.eu.org>
     - EISA sysfs integration.
 */
 
@@ -817,7 +817,11 @@ struct vortex_private {
 	u32 power_state[16];
 };
 
+#ifdef CONFIG_PCI
 #define DEVICE_PCI(dev) (((dev)->bus == &pci_bus_type) ? to_pci_dev((dev)) : NULL)
+#else
+#define DEVICE_PCI(dev) NULL
+#endif
 
 #define VORTEX_PCI(vp) (((vp)->gendev) ? DEVICE_PCI((vp)->gendev) : NULL)
 
diff --git a/drivers/net/Space.c b/drivers/net/Space.c
index d368c990251b..32ec861f96c1 100644
--- a/drivers/net/Space.c
+++ b/drivers/net/Space.c
@@ -224,9 +224,6 @@ static struct devprobe isa_probes[] __initdata = {
 #ifdef CONFIG_EL2 		/* 3c503 */
 	{el2_probe, 0},
 #endif
-#ifdef CONFIG_EL3
-	{el3_probe, 0},
-#endif
 #ifdef CONFIG_HPLAN
 	{hp_probe, 0},
 #endif
diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
index f1ed6647615c..ebe175627dcc 100644
--- a/drivers/net/hamradio/scc.c
+++ b/drivers/net/hamradio/scc.c
@@ -1763,7 +1763,7 @@ static int scc_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 
 			if (hwcfg.irq == 2) hwcfg.irq = 9;
 
-			if (hwcfg.irq <0 || hwcfg.irq > NR_IRQS)
+			if (hwcfg.irq < 0 || hwcfg.irq >= NR_IRQS)
 				return -EINVAL;
 				
 			if (!Ivec[hwcfg.irq].used && hwcfg.irq)
diff --git a/drivers/net/irda/smc-ircc.c b/drivers/net/irda/smc-ircc.c
index 30dfec24f889..5c5e0e36727b 100644
--- a/drivers/net/irda/smc-ircc.c
+++ b/drivers/net/irda/smc-ircc.c
@@ -469,7 +469,7 @@ static int __init ircc_open(unsigned int fir_base, unsigned int sir_base)
 		"firport 0x%03x, sirport 0x%03x dma=%d, irq=%d\n",
 		chip & 0x0f, version, fir_base, sir_base, dma, irq);
 
-	if (dev_count>DIM(dev_self)) {
+	if (dev_count >= DIM(dev_self)) {
 	        IRDA_DEBUG(0, 
 			   "%s(), to many devices!\n", __FUNCTION__ );
 		return -ENOMEM;
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 3c69c80a682b..69c530629b99 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -3057,7 +3057,7 @@ static int orinoco_ioctl_getrate(struct net_device *dev, struct iw_param *rrq)
 
 	ratemode = priv->bitratemode;
 
-	if ( (ratemode < 0) || (ratemode > BITRATE_TABLE_SIZE) )
+	if ( (ratemode < 0) || (ratemode >= BITRATE_TABLE_SIZE) )
 		BUG();
 
 	rrq->value = bitrate_table[ratemode].bitrate * 100000;
diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index cdb66c6c1832..606fef598ca6 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -384,7 +384,7 @@ static int card_present(int socketno)
 	unsigned int val;
 	enter("card_present");
 	
-	if ((socketno<0) || (socketno > MAX_SOCKETS))
+	if ((socketno<0) || (socketno >= MAX_SOCKETS))
 		return 0;
 	if (sockets[socketno].io_base == 0)
 		return 0;
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 8e3ad622cb8b..318a4584ac3b 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -1094,7 +1094,7 @@ static int query_disk(struct aac_dev *dev, void *arg)
 		qd.cnum = TARGET_LUN_TO_CONTAINER(qd.target, qd.lun);
 	else if ((qd.bus == -1) && (qd.target == -1) && (qd.lun == -1)) 
 	{
-		if (qd.cnum < 0 || qd.cnum > MAXIMUM_NUM_CONTAINERS)
+		if (qd.cnum < 0 || qd.cnum >= MAXIMUM_NUM_CONTAINERS)
 			return -EINVAL;
 		qd.instance = dev->scsi_host_ptr->host_no;
 		qd.bus = 0;
@@ -1129,7 +1129,7 @@ static int force_delete_disk(struct aac_dev *dev, void *arg)
 	if (copy_from_user(&dd, arg, sizeof (struct aac_delete_disk)))
 		return -EFAULT;
 
-	if (dd.cnum > MAXIMUM_NUM_CONTAINERS)
+	if (dd.cnum >= MAXIMUM_NUM_CONTAINERS)
 		return -EINVAL;
 	/*
 	 *	Mark this container as being deleted.
@@ -1152,7 +1152,7 @@ static int delete_disk(struct aac_dev *dev, void *arg)
 	if (copy_from_user(&dd, arg, sizeof (struct aac_delete_disk)))
 		return -EFAULT;
 
-	if (dd.cnum > MAXIMUM_NUM_CONTAINERS)
+	if (dd.cnum >= MAXIMUM_NUM_CONTAINERS)
 		return -EINVAL;
 	/*
 	 *	If the container is locked, it can not be deleted by the API.
diff --git a/drivers/scsi/aic7xxx/aic79xx_pci.c b/drivers/scsi/aic7xxx/aic79xx_pci.c
index 79b1a172d6be..345bdeda3fdd 100644
--- a/drivers/scsi/aic7xxx/aic79xx_pci.c
+++ b/drivers/scsi/aic7xxx/aic79xx_pci.c
@@ -691,7 +691,7 @@ static const char *pci_status_source[] =
 
 static const char *split_status_strings[] =
 {
-	"%s: Received split response in %s.\n"
+	"%s: Received split response in %s.\n",
 	"%s: Received split completion error message in %s\n",
 	"%s: Receive overrun in %s\n",
 	"%s: Count not complete in %s\n",
diff --git a/drivers/scsi/cpqfcTSworker.c b/drivers/scsi/cpqfcTSworker.c
index b4dd2a337143..7bec5d1091f7 100644
--- a/drivers/scsi/cpqfcTSworker.c
+++ b/drivers/scsi/cpqfcTSworker.c
@@ -448,7 +448,7 @@ void cpqfcTS_WorkTask( struct Scsi_Host *HostAdapter)
       LONG x_ID = fcLQ->Qitem[QconsumerNdx].ulBuff[0];
       BOOLEAN FrozeTach = FALSE;   
      
-      if( x_ID > TACH_SEST_LEN )  // (in)sanity check
+      if ( x_ID >= TACH_SEST_LEN )  // (in)sanity check
       {
 //	printk( " cpqfcTS ERROR! BOGUS x_ID %Xh", x_ID);
 	break;
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index b35c75e1b62f..2916acf21f87 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -1402,7 +1402,7 @@ static int adpt_i2o_parse_lct(adpt_hba* pHba)
 				printk(KERN_WARNING"%s: Channel number %d out of range \n", pHba->name, bus_no);
 				continue;
 			}
-			if(scsi_id > MAX_ID){
+			if (scsi_id >= MAX_ID){
 				printk(KERN_WARNING"%s: SCSI ID %d out of range \n", pHba->name, bus_no);
 				continue;
 			}
@@ -1476,7 +1476,7 @@ static int adpt_i2o_parse_lct(adpt_hba* pHba)
 				if(bus_no >= MAX_CHANNEL) {	// Something wrong skip it
 					continue;
 				}
-				if(scsi_id > MAX_ID){
+				if (scsi_id >= MAX_ID) {
 					continue;
 				}
 				if( pHba->channel[bus_no].device[scsi_id] == NULL){
diff --git a/fs/buffer.c b/fs/buffer.c
index b06d6ccc1966..140aad55b292 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -31,7 +31,6 @@
 #include <linux/highmem.h>
 #include <linux/module.h>
 #include <linux/writeback.h>
-#include <linux/mempool.h>
 #include <linux/hash.h>
 #include <linux/suspend.h>
 #include <linux/buffer_head.h>
@@ -2791,7 +2790,6 @@ asmlinkage long sys_bdflush(int func, long data)
  * Buffer-head allocation
  */
 static kmem_cache_t *bh_cachep;
-static mempool_t *bh_mempool;
 
 /*
  * Once the number of bh's in the machine exceeds this level, we start
@@ -2825,7 +2823,7 @@ static void recalc_bh_state(void)
 	
 struct buffer_head *alloc_buffer_head(void)
 {
-	struct buffer_head *ret = mempool_alloc(bh_mempool, GFP_NOFS);
+	struct buffer_head *ret = kmem_cache_alloc(bh_cachep, GFP_NOFS);
 	if (ret) {
 		preempt_disable();
 		__get_cpu_var(bh_accounting).nr++;
@@ -2839,7 +2837,7 @@ EXPORT_SYMBOL(alloc_buffer_head);
 void free_buffer_head(struct buffer_head *bh)
 {
 	BUG_ON(!list_empty(&bh->b_assoc_buffers));
-	mempool_free(bh, bh_mempool);
+	kmem_cache_free(bh_cachep, bh);
 	preempt_disable();
 	__get_cpu_var(bh_accounting).nr--;
 	recalc_bh_state();
@@ -2847,7 +2845,8 @@ void free_buffer_head(struct buffer_head *bh)
 }
 EXPORT_SYMBOL(free_buffer_head);
 
-static void init_buffer_head(void *data, kmem_cache_t *cachep, unsigned long flags)
+static void
+init_buffer_head(void *data, kmem_cache_t *cachep, unsigned long flags)
 {
 	if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
 			    SLAB_CTOR_CONSTRUCTOR) {
@@ -2858,19 +2857,6 @@ static void init_buffer_head(void *data, kmem_cache_t *cachep, unsigned long fla
 	}
 }
 
-static void *bh_mempool_alloc(int gfp_mask, void *pool_data)
-{
-	return kmem_cache_alloc(bh_cachep, gfp_mask);
-}
-
-static void bh_mempool_free(void *element, void *pool_data)
-{
-	return kmem_cache_free(bh_cachep, element);
-}
-
-#define NR_RESERVED (10*MAX_BUF_PER_PAGE)
-#define MAX_UNUSED_BUFFERS NR_RESERVED+20
-
 static void buffer_init_cpu(int cpu)
 {
 	struct bh_accounting *bha = &per_cpu(bh_accounting, cpu);
@@ -2907,8 +2893,6 @@ void __init buffer_init(void)
 	bh_cachep = kmem_cache_create("buffer_head",
 			sizeof(struct buffer_head), 0,
 			0, init_buffer_head, NULL);
-	bh_mempool = mempool_create(MAX_UNUSED_BUFFERS, bh_mempool_alloc,
-				bh_mempool_free, NULL);
 	for (i = 0; i < ARRAY_SIZE(bh_wait_queue_heads); i++)
 		init_waitqueue_head(&bh_wait_queue_heads[i].wqh);
 
diff --git a/fs/devfs/base.c b/fs/devfs/base.c
index 02f6bcfc5fe2..b82077b01ec1 100644
--- a/fs/devfs/base.c
+++ b/fs/devfs/base.c
@@ -1169,7 +1169,7 @@ static devfs_handle_t _devfs_make_parent_for_leaf (struct devfs_entry *dir,
     *leaf_pos = (name[namelen] == '/') ? (namelen + 1) : 0;
     for (; namelen > 0; name += next_pos, namelen -= next_pos)
     {
-	struct devfs_entry *de, *old;
+	struct devfs_entry *de, *old = NULL;
 
 	if ( ( de = _devfs_descend (dir, name, namelen, &next_pos) ) == NULL )
 	{
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 24897acf33da..ca17eb33b07d 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1317,10 +1317,7 @@ static int ext3_writepage(struct page *page, struct writeback_control *wbc)
 		goto out_fail;
 
 	needed = ext3_writepage_trans_blocks(inode);
-	if (wbc->for_reclaim)
-		handle = ext3_journal_try_start(inode, needed);
-	else
-		handle = ext3_journal_start(inode, needed);
+	handle = ext3_journal_start(inode, needed);
 				
 	if (IS_ERR(handle)) {
 		ret = PTR_ERR(handle);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 3f92266d6f53..765ec7d043f7 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -1343,9 +1343,7 @@ static int ext3_fill_super (struct super_block *sb, void *data, int silent)
 	 * superblock lock.
 	 */
 	EXT3_SB(sb)->s_mount_state |= EXT3_ORPHAN_FS;
-	unlock_super(sb);	/* akpm: sigh */
 	ext3_orphan_cleanup(sb, es);
-	lock_super(sb);
 	EXT3_SB(sb)->s_mount_state &= ~EXT3_ORPHAN_FS;
 	if (needs_recovery)
 		printk (KERN_INFO "EXT3-fs: recovery complete.\n");
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index dd5e16f8c865..3a8be07f8c7e 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -38,7 +38,6 @@
 #include <linux/proc_fs.h>
 
 EXPORT_SYMBOL(journal_start);
-EXPORT_SYMBOL(journal_try_start);
 EXPORT_SYMBOL(journal_restart);
 EXPORT_SYMBOL(journal_extend);
 EXPORT_SYMBOL(journal_stop);
diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
index f82d7f3cc507..d9afa22f5de2 100644
--- a/fs/jbd/recovery.c
+++ b/fs/jbd/recovery.c
@@ -212,16 +212,14 @@ do {									\
  * 
  * The primary function for recovering the log contents when mounting a
  * journaled device.  
- */
-int journal_recover(journal_t *journal)
-{
-/*
+ *
  * Recovery is done in three passes.  In the first pass, we look for the
  * end of the log.  In the second, we assemble the list of revoke
  * blocks.  In the third and final pass, we replay any un-revoked blocks
  * in the log.  
  */
-
+int journal_recover(journal_t *journal)
+{
 	int			err;
 	journal_superblock_t *	sb;
 
@@ -273,15 +271,13 @@ int journal_recover(journal_t *journal)
  * journal structures in memory to ignore it (presumably because the
  * caller has evidence that it is out of date).  
  * This function does'nt appear to be exorted..
- */
-int journal_skip_recovery(journal_t *journal)
-{
-/*
+ *
  * We perform one pass over the journal to allow us to tell the user how
  * much recovery information is being erased, and to let us initialise
  * the journal transaction sequence numbers to the next unused ID. 
  */
-
+int journal_skip_recovery(journal_t *journal)
+{
 	int			err;
 	journal_superblock_t *	sb;
 
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index b8333d8afdfe..06d27895de7d 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -266,113 +266,6 @@ handle_t *journal_start(journal_t *journal, int nblocks)
 	return handle;
 }
 
-/*
- * Return zero on success
- */
-static int try_start_this_handle(journal_t *journal, handle_t *handle)
-{
-	transaction_t *transaction;
-	int needed;
-	int nblocks = handle->h_buffer_credits;
-	int ret = 0;
-
-	jbd_debug(3, "New handle %p maybe going live.\n", handle);
-
-	lock_journal(journal);
-
-	if (is_journal_aborted(journal) ||
-	    (journal->j_errno != 0 && !(journal->j_flags & JFS_ACK_ERR))) {
-		ret = -EROFS;
-		goto fail_unlock;
-	}
-
-	if (journal->j_barrier_count)
-		goto fail_unlock;
-
-	if (!journal->j_running_transaction && get_transaction(journal, 1) == 0)
-		goto fail_unlock;
-	
-	transaction = journal->j_running_transaction;
-	if (transaction->t_state == T_LOCKED)
-		goto fail_unlock;
-	
-	needed = transaction->t_outstanding_credits + nblocks;
-	/* We could run log_start_commit here */
-	if (needed > journal->j_max_transaction_buffers)
-		goto fail_unlock;
-
-	needed = journal->j_max_transaction_buffers;
-	if (journal->j_committing_transaction) 
-		needed += journal->j_committing_transaction->
-						t_outstanding_credits;
-	
-	if (log_space_left(journal) < needed)
-		goto fail_unlock;
-
-	handle->h_transaction = transaction;
-	transaction->t_outstanding_credits += nblocks;
-	transaction->t_updates++;
-	jbd_debug(4, "Handle %p given %d credits (total %d, free %d)\n",
-		  handle, nblocks, transaction->t_outstanding_credits,
-		  log_space_left(journal));
-	unlock_journal(journal);
-	return 0;
-
-fail_unlock:
-	unlock_journal(journal);
-	if (ret >= 0)
-		ret = -1;
-	return ret;
-}
-
-/**
- * handle_t *journal_try_start() - Don't block, but try and get a handle
- * @journal: Journal to start transaction on.
- * @nblocks: number of block buffer we might modify
- * 
- * Try to start a handle, but non-blockingly.  If we weren't able
- * to, return an ERR_PTR value.
- */
-handle_t *journal_try_start(journal_t *journal, int nblocks)
-{
-	handle_t *handle = journal_current_handle();
-	int err;
-	
-	if (!journal)
-		return ERR_PTR(-EROFS);
-
-	if (handle) {
-		jbd_debug(4, "h_ref %d -> %d\n",
-				handle->h_ref,
-				handle->h_ref + 1);
-		J_ASSERT(handle->h_transaction->t_journal == journal);
-		if (is_handle_aborted(handle))
-			return ERR_PTR(-EIO);
-		handle->h_ref++;
-		return handle;
-	} else {
-		jbd_debug(4, "no current transaction\n");
-	}
-	
-	if (is_journal_aborted(journal))
-		return ERR_PTR(-EIO);
-
-	handle = new_handle(nblocks);
-	if (!handle)
-		return ERR_PTR(-ENOMEM);
-
-	current->journal_info = handle;
-
-	err = try_start_this_handle(journal, handle);
-	if (err < 0) {
-		kfree(handle);
-		current->journal_info = NULL;
-		return ERR_PTR(err);
-	}
-
-	return handle;
-}
-
 /**
  * int journal_extend() - extend buffer credits.
  * @handle:  handle to 'extend'
@@ -969,22 +862,23 @@ out:
 }
 
 /** 
- * int journal_dirty_data() -  mark a buffer as containing dirty data which needs to be flushed before we can commit the current transaction.  
+ * int journal_dirty_data() -  mark a buffer as containing dirty data which
+ *                             needs to be flushed before we can commit the
+ *                             current transaction.  
  * @handle: transaction
  * @bh: bufferhead to mark
  * 
  * The buffer is placed on the transaction's data list and is marked as
  * belonging to the transaction.
  *
- * Returns error number or 0 on success.  
- */
-int journal_dirty_data (handle_t *handle, struct buffer_head *bh)
-{
-/*
+ * Returns error number or 0 on success.
+ *
  * journal_dirty_data() can be called via page_launder->ext3_writepage
  * by kswapd.  So it cannot block.  Happily, there's nothing here
  * which needs lock_journal if `async' is set.
  */
+int journal_dirty_data (handle_t *handle, struct buffer_head *bh)
+{
 	journal_t *journal = handle->h_transaction->t_journal;
 	int need_brelse = 0;
 	struct journal_head *jh;
@@ -1129,23 +1023,22 @@ no_journal:
  * @handle: transaction to add buffer to.
  * @bh: buffer to mark 
  * 
- * mark dirty metadata which needs to be journaled as part of the current transaction.
+ * mark dirty metadata which needs to be journaled as part of the current
+ * transaction.
  *
  * The buffer is placed on the transaction's metadata list and is marked
  * as belonging to the transaction.  
  *
  * Returns error number or 0 on success.  
- */
-int journal_dirty_metadata (handle_t *handle, struct buffer_head *bh)
-{
-/*
+ *
  * Special care needs to be taken if the buffer already belongs to the
  * current committing transaction (in which case we should have frozen
  * data present for that commit).  In that case, we don't relink the
  * buffer: that only gets done when the old transaction finally
  * completes its commit.
- * 
  */
+int journal_dirty_metadata (handle_t *handle, struct buffer_head *bh)
+{
 	transaction_t *transaction = handle->h_transaction;
 	journal_t *journal = transaction->t_journal;
 	struct journal_head *jh = bh2jh(bh);
@@ -1726,13 +1619,6 @@ out:
  * to be called. We do this if the page is releasable by try_to_free_buffers().
  * We also do it if the page has locked or dirty buffers and the caller wants
  * us to perform sync or async writeout.
- */
-int journal_try_to_free_buffers(journal_t *journal, 
-				struct page *page, int unused_gfp_mask)
-{
-/*
- * journal_try_to_free_buffers().  Try to remove all this page's buffers
- * from the journal.
  *
  * This complicates JBD locking somewhat.  We aren't protected by the
  * BKL here.  We wish to remove the buffer from its committing or
@@ -1752,6 +1638,9 @@ int journal_try_to_free_buffers(journal_t *journal,
  * cannot happen because we never reallocate freed data as metadata
  * while the data is part of a transaction.  Yes?
  */
+int journal_try_to_free_buffers(journal_t *journal, 
+				struct page *page, int unused_gfp_mask)
+{
 	struct buffer_head *head;
 	struct buffer_head *bh;
 	int ret = 0;
diff --git a/include/linux/ext3_jbd.h b/include/linux/ext3_jbd.h
index 7ac910d15863..2c75f9f6dab9 100644
--- a/include/linux/ext3_jbd.h
+++ b/include/linux/ext3_jbd.h
@@ -210,14 +210,6 @@ static inline handle_t *ext3_journal_start(struct inode *inode, int nblocks)
 	return journal_start(journal, nblocks);
 }
 
-static inline handle_t *
-ext3_journal_try_start(struct inode *inode, int nblocks)
-{
-	if (inode->i_sb->s_flags & MS_RDONLY)
-		return ERR_PTR(-EROFS);
-	return journal_try_start(EXT3_JOURNAL(inode), nblocks);
-}
-
 /* 
  * The only special thing we need to do here is to make sure that all
  * journal_stop calls result in the superblock being marked dirty, so
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 370411eaaba2..7c31efc0b61b 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -26,6 +26,7 @@ struct vm_area_struct *hugepage_vma(struct mm_struct *mm,
 					unsigned long address);
 struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 				pmd_t *pmd, int write);
+int is_aligned_hugepage_range(unsigned long addr, unsigned long len);
 int pmd_huge(pmd_t pmd);
 
 extern int htlbpage_max;
@@ -56,6 +57,7 @@ static inline int is_vm_hugetlb_page(struct vm_area_struct *vma)
 #define hugepage_vma(mm, addr)			0
 #define mark_mm_hugetlb(mm, vma)		do { } while (0)
 #define follow_huge_pmd(mm, addr, pmd, write)	0
+#define is_aligned_hugepage_range(addr, len)	0
 #define pmd_huge(x)	0
 
 #ifndef HPAGE_MASK
diff --git a/include/linux/jbd.h b/include/linux/jbd.h
index 2236641f5593..71bec2befafa 100644
--- a/include/linux/jbd.h
+++ b/include/linux/jbd.h
@@ -726,7 +726,6 @@ static inline handle_t *journal_current_handle(void)
  */
 
 extern handle_t *journal_start(journal_t *, int nblocks);
-extern handle_t *journal_try_start(journal_t *, int nblocks);
 extern int	 journal_restart (handle_t *, int nblocks);
 extern int	 journal_extend (handle_t *, int nblocks);
 extern int	 journal_get_write_access (handle_t *, struct buffer_head *);
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 0a60a4f52077..bb1e0128228c 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -15,24 +15,14 @@
 extern u64 jiffies_64;
 extern unsigned long volatile jiffies;
 
+#if (BITS_PER_LONG < 64)
+u64 get_jiffies_64(void);
+#else
 static inline u64 get_jiffies_64(void)
 {
-#if BITS_PER_LONG < 64
-	extern seqlock_t xtime_lock;
-	unsigned long seq;
-	u64 tmp;
-
-	do {
-		seq = read_seqbegin(&xtime_lock);
-		tmp = jiffies_64;
-	} while (read_seqretry(&xtime_lock, seq));
-
-	return tmp;
-#else
 	return (u64)jiffies;
-#endif
 }
-
+#endif
 
 /*
  *	These inlines deal with timer wrapping correctly. You are 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 16864532fcd9..b99d2eb57a82 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -509,6 +509,7 @@ extern void __set_special_pids(pid_t session, pid_t pgrp);
 /* per-UID process charging. */
 extern struct user_struct * alloc_uid(uid_t);
 extern void free_uid(struct user_struct *);
+extern void switch_uid(struct user_struct *);
 
 #include <asm/current.h>
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 729e93bff8e4..de34ed9091f5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -249,7 +249,7 @@ void reparent_to_init(void)
 	/* signals? */
 	security_task_reparent_to_init(current);
 	memcpy(current->rlim, init_task.rlim, sizeof(*(current->rlim)));
-	current->user = INIT_USER;
+	switch_uid(INIT_USER);
 
 	write_unlock_irq(&tasklist_lock);
 }
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 1930367d3736..257634f94652 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -121,15 +121,7 @@ int exec_usermodehelper(char *program_path, char *argv[], char *envp[])
 		if (curtask->files->fd[i]) close(i);
 	}
 
-	/* Drop the "current user" thing */
-	{
-		struct user_struct *user = curtask->user;
-		curtask->user = INIT_USER;
-		atomic_inc(&INIT_USER->__count);
-		atomic_inc(&INIT_USER->processes);
-		atomic_dec(&user->processes);
-		free_uid(user);
-	}
+	switch_uid(INIT_USER);
 
 	/* Give kmod all effective privileges.. */
 	curtask->euid = curtask->fsuid = 0;
diff --git a/kernel/ksyms.c b/kernel/ksyms.c
index 0f2b487d0789..f0503df9fe3d 100644
--- a/kernel/ksyms.c
+++ b/kernel/ksyms.c
@@ -490,6 +490,9 @@ EXPORT_SYMBOL(xtime);
 EXPORT_SYMBOL(xtime_lock);
 EXPORT_SYMBOL(do_gettimeofday);
 EXPORT_SYMBOL(do_settimeofday);
+#if (BITS_PER_LONG < 64)
+EXPORT_SYMBOL(get_jiffies_64);
+#endif
 #ifdef CONFIG_DEBUG_SPINLOCK_SLEEP
 EXPORT_SYMBOL(__might_sleep);
 #endif
diff --git a/kernel/sched.c b/kernel/sched.c
index 3e967ec6814f..a501326ed2dc 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -506,7 +506,8 @@ int wake_up_state(task_t *p, unsigned int state)
  */
 void wake_up_forked_process(task_t * p)
 {
-	runqueue_t *rq = this_rq_lock();
+	unsigned long flags;
+	runqueue_t *rq = task_rq_lock(current, &flags);
 
 	p->state = TASK_RUNNING;
 	if (!rt_task(p)) {
@@ -522,7 +523,7 @@ void wake_up_forked_process(task_t * p)
 	set_task_cpu(p, smp_processor_id());
 	activate_task(p, rq);
 
-	rq_unlock(rq);
+	task_rq_unlock(rq, &flags);
 }
 
 /*
diff --git a/kernel/signal.c b/kernel/signal.c
index a4d6618f77d0..b43102e63a8d 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -619,6 +619,7 @@ static void handle_stop_signal(int sig, struct task_struct *p)
 		rm_from_queue(SIG_KERNEL_STOP_MASK, &p->signal->shared_pending);
 		t = p;
 		do {
+			unsigned int state;
 			rm_from_queue(SIG_KERNEL_STOP_MASK, &t->pending);
 			
 			/*
@@ -635,9 +636,12 @@ static void handle_stop_signal(int sig, struct task_struct *p)
 			 * Wake up the stopped thread _after_ setting
 			 * TIF_SIGPENDING
 			 */
-			if (!sigismember(&t->blocked, SIGCONT))
+			state = TASK_STOPPED;
+			if (!sigismember(&t->blocked, SIGCONT)) {
 				set_tsk_thread_flag(t, TIF_SIGPENDING);
-			wake_up_state(t, TASK_STOPPED);
+				state |= TASK_INTERRUPTIBLE;
+			}
+			wake_up_state(t, state);
 
 			t = next_thread(t);
 		} while (t != p);
diff --git a/kernel/sys.c b/kernel/sys.c
index 9404304eba74..afa6d2fc1372 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -561,19 +561,12 @@ asmlinkage long sys_setgid(gid_t gid)
   
 static int set_user(uid_t new_ruid, int dumpclear)
 {
-	struct user_struct *new_user, *old_user;
+	struct user_struct *new_user;
 
-	/* What if a process setreuid()'s and this brings the
-	 * new uid over his NPROC rlimit?  We can check this now
-	 * cheaply with the new uid cache, so if it matters
-	 * we should be checking for it.  -DaveM
-	 */
 	new_user = alloc_uid(new_ruid);
 	if (!new_user)
 		return -EAGAIN;
-	old_user = current->user;
-	atomic_dec(&old_user->processes);
-	atomic_inc(&new_user->processes);
+	switch_uid(new_user);
 
 	if(dumpclear)
 	{
@@ -581,8 +574,6 @@ static int set_user(uid_t new_ruid, int dumpclear)
 		wmb();
 	}
 	current->uid = new_ruid;
-	current->user = new_user;
-	free_uid(old_user);
 	return 0;
 }
 
@@ -916,6 +907,7 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
 	p = find_task_by_pid(pid);
 	if (!p)
 		goto out;
+
 	err = -EINVAL;
 	if (!thread_group_leader(p))
 		goto out;
@@ -927,11 +919,16 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
 		err = -EACCES;
 		if (p->did_exec)
 			goto out;
-	} else if (p != current)
-		goto out;
+	} else {
+		err = -ESRCH;
+		if (p != current)
+			goto out;
+	}
+
 	err = -EPERM;
 	if (p->leader)
 		goto out;
+
 	if (pgid != pid) {
 		struct task_struct *p;
 		struct pid *pid;
diff --git a/kernel/time.c b/kernel/time.c
index c8c8a10eae1f..4ecc0a3b2ac1 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -27,7 +27,6 @@
 #include <linux/timex.h>
 #include <linux/errno.h>
 #include <linux/smp_lock.h>
-
 #include <asm/uaccess.h>
 
 /* 
@@ -416,3 +415,17 @@ struct timespec current_kernel_time(void)
 
 	return now; 
 }
+
+#if (BITS_PER_LONG < 64)
+u64 get_jiffies_64(void)
+{
+	unsigned long seq;
+	u64 ret;
+
+	do {
+		seq = read_seqbegin(&xtime_lock);
+		ret = jiffies_64;
+	} while (read_seqretry(&xtime_lock, seq));
+	return ret;
+}
+#endif
diff --git a/kernel/user.c b/kernel/user.c
index 0704b2aad9c5..592680d8cc68 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -116,6 +116,23 @@ struct user_struct * alloc_uid(uid_t uid)
 	return up;
 }
 
+void switch_uid(struct user_struct *new_user)
+{
+	struct user_struct *old_user;
+
+	/* What if a process setreuid()'s and this brings the
+	 * new uid over his NPROC rlimit?  We can check this now
+	 * cheaply with the new uid cache, so if it matters
+	 * we should be checking for it.  -DaveM
+	 */
+	old_user = current->user;
+	atomic_inc(&new_user->__count);
+	atomic_inc(&new_user->processes);
+	atomic_dec(&old_user->processes);
+	current->user = new_user;
+	free_uid(old_user);
+}
+
 
 static int __init uid_cache_init(void)
 {
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index dc20f8513946..e1973ed79a7a 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -154,8 +154,7 @@ static int radix_tree_extend(struct radix_tree_root *root, unsigned long index)
 
 			/* Increase the height.  */
 			node->slots[0] = root->rnode;
-			if (root->rnode)
-				node->count = 1;
+			node->count = 1;
 			root->rnode = node;
 			root->height++;
 		} while (height > root->height);
diff --git a/mm/mmap.c b/mm/mmap.c
index 07e2417185ff..7696c40185bd 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -801,6 +801,13 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
 			return -ENOMEM;
 		if (addr & ~PAGE_MASK)
 			return -EINVAL;
+		if (is_file_hugepages(file)) {
+			unsigned long ret;
+
+			ret = is_aligned_hugepage_range(addr, len);
+			if (ret)
+				return ret;
+		}
 		return addr;
 	}
 
@@ -1224,8 +1231,10 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
 	/* we have  start < mpnt->vm_end  */
 
 	if (is_vm_hugetlb_page(mpnt)) {
-		if ((start & ~HPAGE_MASK) || (len & ~HPAGE_MASK))
-			return -EINVAL;
+		int ret = is_aligned_hugepage_range(start, len);
+
+		if (ret)
+			return ret;
 	}
 
 	/* if it doesn't overlap, we have nothing.. */
diff --git a/net/irda/qos.c b/net/irda/qos.c
index c7dc0bf1c040..45bab6e55e75 100644
--- a/net/irda/qos.c
+++ b/net/irda/qos.c
@@ -722,8 +722,8 @@ __u32 irlap_max_line_capacity(__u32 speed, __u32 max_turn_time)
 	i = value_index(speed, baud_rates, 10);
 	j = value_index(max_turn_time, max_turn_times, 4);
 
-	ASSERT(((i >=0) && (i <=10)), return 0;);
-	ASSERT(((j >=0) && (j <=4)), return 0;);
+	ASSERT(((i >=0) && (i <10)), return 0;);
+	ASSERT(((j >=0) && (j <4)), return 0;);
 
 	line_capacity = max_line_capacities[i][j];