Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fix windfarm platform device usage
  [POWERPC] Fix i2c-powermac platform device usage
  [POWERPC] Fix secondary CPU startup on old "powersurge" SMP powermacs
  [POWERPC] ARCH=ppc pt_regs fixes
  [POWERPC] Update maple defconfig
  [POWERPC] Fix Maple secondary IDE interrupt
  [POWERPC] Make U4 PCIe work on maple
  [POWERPC] cell: fix default zImage build target
  [POWERPC] Fix boot wrapper invocation if CROSS_COMPILE contains spaces
  [POWERPC] Fix xmon IRQ handler for pt_regs removal
diff --git a/MAINTAINERS b/MAINTAINERS
index 50fb3ae..931e6e4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2780,14 +2780,7 @@
 UltraSPARC (sparc64):
 P:	David S. Miller
 M:	davem@davemloft.net
-P:	Eddie C. Dost
-M:	ecd@brainaid.de
-P:	Jakub Jelinek
-M:	jj@sunsite.ms.mff.cuni.cz
-P:	Anton Blanchard
-M:	anton@samba.org
 L:	sparclinux@vger.kernel.org
-L:	ultralinux@vger.kernel.org
 T:	git kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6.git
 S:	Maintained
 
diff --git a/arch/ia64/hp/sim/simeth.c b/arch/ia64/hp/sim/simeth.c
index be769ef..424e925 100644
--- a/arch/ia64/hp/sim/simeth.c
+++ b/arch/ia64/hp/sim/simeth.c
@@ -87,7 +87,7 @@
  */
 static struct notifier_block simeth_dev_notifier = {
 	simeth_device_event,
-	0
+	NULL
 };
 
 
diff --git a/arch/ia64/hp/sim/simscsi.c b/arch/ia64/hp/sim/simscsi.c
index 8f0a16a7..bb87682 100644
--- a/arch/ia64/hp/sim/simscsi.c
+++ b/arch/ia64/hp/sim/simscsi.c
@@ -103,7 +103,7 @@
 
 	while ((sc = queue[rd].sc) != 0) {
 		atomic_dec(&num_reqs);
-		queue[rd].sc = 0;
+		queue[rd].sc = NULL;
 		if (DBG)
 			printk("simscsi_interrupt: done with %ld\n", sc->serial_number);
 		(*sc->scsi_done)(sc);
diff --git a/arch/ia64/hp/sim/simserial.c b/arch/ia64/hp/sim/simserial.c
index 5095778..caab986 100644
--- a/arch/ia64/hp/sim/simserial.c
+++ b/arch/ia64/hp/sim/simserial.c
@@ -92,7 +92,7 @@
 	{ "ST16650V2", 32, UART_CLEAR_FIFO | UART_USE_FIFO |
 		  UART_STARTECH },
 	{ "TI16750", 64, UART_CLEAR_FIFO | UART_USE_FIFO},
-	{ 0, 0}
+	{ NULL, 0}
 };
 
 struct tty_driver *hp_simserial_driver;
@@ -555,7 +555,7 @@
 
 		if (info->xmit.buf) {
 			free_page((unsigned long) info->xmit.buf);
-			info->xmit.buf = 0;
+			info->xmit.buf = NULL;
 		}
 
 		if (info->tty) set_bit(TTY_IO_ERROR, &info->tty->flags);
@@ -628,7 +628,7 @@
 	if (tty->driver->flush_buffer) tty->driver->flush_buffer(tty);
 	if (tty->ldisc.flush_buffer) tty->ldisc.flush_buffer(tty);
 	info->event = 0;
-	info->tty = 0;
+	info->tty = NULL;
 	if (info->blocked_open) {
 		if (info->close_delay)
 			schedule_timeout_interruptible(info->close_delay);
@@ -668,7 +668,7 @@
 	info->event = 0;
 	state->count = 0;
 	info->flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->tty = 0;
+	info->tty = NULL;
 	wake_up_interruptible(&info->open_wait);
 }
 
@@ -769,7 +769,7 @@
 	/*
 	 * Insert serial port into IRQ chain.
 	 */
-	info->prev_port = 0;
+	info->prev_port = NULL;
 	info->next_port = IRQ_ports[state->irq];
 	if (info->next_port)
 		info->next_port->prev_port = info;
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_ate.c b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
index 5eb1e1e..935029f 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_ate.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
@@ -126,7 +126,7 @@
  * Setup an Address Translation Entry as specified.  Use either the Bridge
  * internal maps or the external map RAM, as appropriate.
  */
-static inline u64 *pcibr_ate_addr(struct pcibus_info *pcibus_info,
+static inline u64 __iomem *pcibr_ate_addr(struct pcibus_info *pcibus_info,
 				       int ate_index)
 {
 	if (ate_index < pcibus_info->pbi_int_ate_size) {
diff --git a/arch/ia64/sn/pci/tioce_provider.c b/arch/ia64/sn/pci/tioce_provider.c
index 0e81f68..46e16dc 100644
--- a/arch/ia64/sn/pci/tioce_provider.c
+++ b/arch/ia64/sn/pci/tioce_provider.c
@@ -53,7 +53,7 @@
  */
 
 static void inline
-tioce_mmr_war_pre(struct tioce_kernel *kern, void *mmr_addr)
+tioce_mmr_war_pre(struct tioce_kernel *kern, void __iomem *mmr_addr)
 {
 	u64 mmr_base;
 	u64 mmr_offset;
@@ -62,7 +62,7 @@
 		return;
 
 	mmr_base = kern->ce_common->ce_pcibus.bs_base;
-	mmr_offset = (u64)mmr_addr - mmr_base;
+	mmr_offset = (unsigned long)mmr_addr - mmr_base;
 
 	if (mmr_offset < 0x45000) {
 		u64 mmr_war_offset;
@@ -79,7 +79,7 @@
 }
 
 static void inline
-tioce_mmr_war_post(struct tioce_kernel *kern, void *mmr_addr)
+tioce_mmr_war_post(struct tioce_kernel *kern, void __iomem *mmr_addr)
 {
 	u64 mmr_base;
 	u64 mmr_offset;
@@ -88,7 +88,7 @@
 		return;
 
 	mmr_base = kern->ce_common->ce_pcibus.bs_base;
-	mmr_offset = (u64)mmr_addr - mmr_base;
+	mmr_offset = (unsigned long)mmr_addr - mmr_base;
 
 	if (mmr_offset < 0x45000) {
 		if (mmr_offset == 0x100)
@@ -223,7 +223,7 @@
  * @pci_dev.
  */
 static inline void
-pcidev_to_tioce(struct pci_dev *pdev, struct tioce **base,
+pcidev_to_tioce(struct pci_dev *pdev, struct tioce __iomem **base,
 		struct tioce_kernel **kernel, int *port)
 {
 	struct pcidev_info *pcidev_info;
@@ -235,7 +235,7 @@
 	ce_kernel = (struct tioce_kernel *)ce_common->ce_kernel_private;
 
 	if (base)
-		*base = (struct tioce *)ce_common->ce_pcibus.bs_base;
+		*base = (struct tioce __iomem *)ce_common->ce_pcibus.bs_base;
 	if (kernel)
 		*kernel = ce_kernel;
 
@@ -275,13 +275,13 @@
 	u64 pagesize;
 	int msi_capable, msi_wanted;
 	u64 *ate_shadow;
-	u64 *ate_reg;
+	u64 __iomem *ate_reg;
 	u64 addr;
-	struct tioce *ce_mmr;
+	struct tioce __iomem *ce_mmr;
 	u64 bus_base;
 	struct tioce_dmamap *map;
 
-	ce_mmr = (struct tioce *)ce_kern->ce_common->ce_pcibus.bs_base;
+	ce_mmr = (struct tioce __iomem *)ce_kern->ce_common->ce_pcibus.bs_base;
 
 	switch (type) {
 	case TIOCE_ATE_M32:
@@ -386,7 +386,7 @@
 {
 	int dma_ok;
 	int port;
-	struct tioce *ce_mmr;
+	struct tioce __iomem *ce_mmr;
 	struct tioce_kernel *ce_kern;
 	u64 ct_upper;
 	u64 ct_lower;
@@ -461,7 +461,7 @@
 	int i;
 	int port;
 	struct tioce_kernel *ce_kern;
-	struct tioce *ce_mmr;
+	struct tioce __iomem *ce_mmr;
 	unsigned long flags;
 
 	bus_addr = tioce_dma_barrier(bus_addr, 0);
@@ -700,9 +700,9 @@
 tioce_reserve_m32(struct tioce_kernel *ce_kern, u64 base, u64 limit)
 {
 	int ate_index, last_ate, ps;
-	struct tioce *ce_mmr;
+	struct tioce __iomem *ce_mmr;
 
-	ce_mmr = (struct tioce *)ce_kern->ce_common->ce_pcibus.bs_base;
+	ce_mmr = (struct tioce __iomem *)ce_kern->ce_common->ce_pcibus.bs_base;
 	ps = ce_kern->ce_ate3240_pagesize;
 	ate_index = ATE_PAGE(base, ps);
 	last_ate = ate_index + ATE_NPAGES(base, limit-base+1, ps) - 1;
@@ -736,7 +736,7 @@
 	int dev;
 	u32 tmp;
 	unsigned int seg, bus;
-	struct tioce *tioce_mmr;
+	struct tioce __iomem *tioce_mmr;
 	struct tioce_kernel *tioce_kern;
 
 	tioce_kern = kzalloc(sizeof(struct tioce_kernel), GFP_KERNEL);
@@ -767,7 +767,7 @@
 	 * the ate's.
 	 */
 
-	tioce_mmr = (struct tioce *)tioce_common->ce_pcibus.bs_base;
+	tioce_mmr = (struct tioce __iomem *)tioce_common->ce_pcibus.bs_base;
 	tioce_mmr_clri(tioce_kern, &tioce_mmr->ce_ure_page_map,
 		       CE_URE_PAGESIZE_MASK);
 	tioce_mmr_seti(tioce_kern, &tioce_mmr->ce_ure_page_map,
@@ -858,7 +858,7 @@
 	struct pcidev_info *pcidev_info;
 	struct tioce_common *ce_common;
 	struct tioce_kernel *ce_kern;
-	struct tioce *ce_mmr;
+	struct tioce __iomem *ce_mmr;
 	u64 force_int_val;
 
 	if (!sn_irq_info->irq_bridge)
@@ -872,7 +872,7 @@
 		return;
 
 	ce_common = (struct tioce_common *)pcidev_info->pdi_pcibus_info;
-	ce_mmr = (struct tioce *)ce_common->ce_pcibus.bs_base;
+	ce_mmr = (struct tioce __iomem *)ce_common->ce_pcibus.bs_base;
 	ce_kern = (struct tioce_kernel *)ce_common->ce_kernel_private;
 
 	/*
@@ -953,7 +953,7 @@
 	struct pcidev_info *pcidev_info;
 	struct tioce_common *ce_common;
 	struct tioce_kernel *ce_kern;
-	struct tioce *ce_mmr;
+	struct tioce __iomem *ce_mmr;
 	int bit;
 	u64 vector;
 
@@ -962,7 +962,7 @@
 		return;
 
 	ce_common = (struct tioce_common *)pcidev_info->pdi_pcibus_info;
-	ce_mmr = (struct tioce *)ce_common->ce_pcibus.bs_base;
+	ce_mmr = (struct tioce __iomem *)ce_common->ce_pcibus.bs_base;
 	ce_kern = (struct tioce_kernel *)ce_common->ce_kernel_private;
 
 	bit = sn_irq_info->irq_int_bit;
@@ -994,7 +994,7 @@
 	cnodeid_t my_cnode, mem_cnode;
 	struct tioce_common *tioce_common;
 	struct tioce_kernel *tioce_kern;
-	struct tioce *tioce_mmr;
+	struct tioce __iomem *tioce_mmr;
 
 	/*
 	 * Allocate kernel bus soft and copy from prom.
@@ -1018,7 +1018,7 @@
 	 * interrupt handler.
 	 */
 
-	tioce_mmr = (struct tioce *)tioce_common->ce_pcibus.bs_base;
+	tioce_mmr = (struct tioce __iomem *)tioce_common->ce_pcibus.bs_base;
 	tioce_mmr_seti(tioce_kern, &tioce_mmr->ce_adm_int_status_alias, ~0ULL);
 	tioce_mmr_seti(tioce_kern, &tioce_mmr->ce_adm_error_summary_alias,
 		       ~0ULL);
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 731b942..14af6cc 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1010,11 +1010,6 @@
 config ARC32
 	bool
 
-config AU1X00_USB_DEVICE
-	bool
-	depends on MIPS_PB1500 || MIPS_PB1100 || MIPS_PB1000
-	default n
-
 config BOOT_ELF32
 	bool
 
diff --git a/arch/mips/au1000/common/Makefile b/arch/mips/au1000/common/Makefile
index bf682f5..4c35525 100644
--- a/arch/mips/au1000/common/Makefile
+++ b/arch/mips/au1000/common/Makefile
@@ -10,6 +10,5 @@
 	au1xxx_irqmap.o clocks.o platform.o power.o setup.o \
 	sleeper.o cputable.o dma.o dbdma.o gpio.o
 
-obj-$(CONFIG_AU1X00_USB_DEVICE)	+= usbdev.o
 obj-$(CONFIG_KGDB)		+= dbg_io.o
 obj-$(CONFIG_PCI)		+= pci.o
diff --git a/arch/mips/au1000/common/usbdev.c b/arch/mips/au1000/common/usbdev.c
deleted file mode 100644
index 70dc82e..0000000
--- a/arch/mips/au1000/common/usbdev.c
+++ /dev/null
@@ -1,1552 +0,0 @@
-/*
- * BRIEF MODULE DESCRIPTION
- *	Au1000 USB Device-Side (device layer)
- *
- * Copyright 2001-2002 MontaVista Software Inc.
- * Author: MontaVista Software, Inc.
- *		stevel@mvista.com or source@mvista.com
- *
- *  This program is free software; you can redistribute	 it and/or modify it
- *  under  the terms of	 the GNU General  Public License as published by the
- *  Free Software Foundation;  either version 2 of the	License, or (at your
- *  option) any later version.
- *
- *  THIS  SOFTWARE  IS PROVIDED	  ``AS	IS'' AND   ANY	EXPRESS OR IMPLIED
- *  WARRANTIES,	  INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
- *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
- *  NO	EVENT  SHALL   THE AUTHOR  BE	 LIABLE FOR ANY	  DIRECT, INDIRECT,
- *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- *  NOT LIMITED	  TO, PROCUREMENT OF  SUBSTITUTE GOODS	OR SERVICES; LOSS OF
- *  USE, DATA,	OR PROFITS; OR	BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- *  ANY THEORY OF LIABILITY, WHETHER IN	 CONTRACT, STRICT LIABILITY, OR TORT
- *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
- */
-#include <linux/kernel.h>
-#include <linux/ioport.h>
-#include <linux/sched.h>
-#include <linux/signal.h>
-#include <linux/errno.h>
-#include <linux/poll.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/fcntl.h>
-#include <linux/module.h>
-#include <linux/spinlock.h>
-#include <linux/list.h>
-#include <linux/smp_lock.h>
-#define DEBUG
-#include <linux/usb.h>
-
-#include <asm/io.h>
-#include <asm/uaccess.h>
-#include <asm/irq.h>
-#include <asm/mipsregs.h>
-#include <asm/au1000.h>
-#include <asm/au1000_dma.h>
-#include <asm/au1000_usbdev.h>
-
-#ifdef DEBUG
-#undef VDEBUG
-#ifdef VDEBUG
-#define vdbg(fmt, arg...) printk(KERN_DEBUG __FILE__ ": " fmt "\n" , ## arg)
-#else
-#define vdbg(fmt, arg...) do {} while (0)
-#endif
-#else
-#define vdbg(fmt, arg...) do {} while (0)
-#endif
-
-#define ALLOC_FLAGS (in_interrupt () ? GFP_ATOMIC : GFP_KERNEL)
-
-#define EP_FIFO_DEPTH 8
-
-typedef enum {
-	SETUP_STAGE = 0,
-	DATA_STAGE,
-	STATUS_STAGE
-} ep0_stage_t;
-
-typedef struct {
-	int read_fifo;
-	int write_fifo;
-	int ctrl_stat;
-	int read_fifo_status;
-	int write_fifo_status;
-} endpoint_reg_t;
-
-typedef struct {
-	usbdev_pkt_t *head;
-	usbdev_pkt_t *tail;
-	int count;
-} pkt_list_t;
-
-typedef struct {
-	int active;
-	struct usb_endpoint_descriptor *desc;
-	endpoint_reg_t *reg;
-	/* Only one of these are used, unless this is the control ep */
-	pkt_list_t inlist;
-	pkt_list_t outlist;
-	unsigned int indma, outdma; /* DMA channel numbers for IN, OUT */
-	/* following are extracted from endpoint descriptor for easy access */
-	int max_pkt_size;
-	int type;
-	int direction;
-	/* WE assign endpoint addresses! */
-	int address;
-	spinlock_t lock;
-} endpoint_t;
-
-
-static struct usb_dev {
-	endpoint_t ep[6];
-	ep0_stage_t ep0_stage;
-
-	struct usb_device_descriptor *   dev_desc;
-	struct usb_interface_descriptor* if_desc;
-	struct usb_config_descriptor *   conf_desc;
-	u8 *                             full_conf_desc;
-	struct usb_string_descriptor *   str_desc[6];
-
-	/* callback to function layer */
-	void (*func_cb)(usbdev_cb_type_t type, unsigned long arg,
-			void *cb_data);
-	void* cb_data;
-
-	usbdev_state_t state;	// device state
-	int suspended;		// suspended flag
-	int address;		// device address
-	int interface;
-	int num_ep;
-	u8 alternate_setting;
-	u8 configuration;	// configuration value
-	int remote_wakeup_en;
-} usbdev;
-
-
-static endpoint_reg_t ep_reg[] = {
-	// FIFO's 0 and 1 are EP0 default control
-	{USBD_EP0RD, USBD_EP0WR, USBD_EP0CS, USBD_EP0RDSTAT, USBD_EP0WRSTAT },
-	{0},
-	// FIFO 2 is EP2, IN
-	{ -1, USBD_EP2WR, USBD_EP2CS, -1, USBD_EP2WRSTAT },
-	// FIFO 3 is EP3, IN
-	{    -1,     USBD_EP3WR, USBD_EP3CS,     -1,         USBD_EP3WRSTAT },
-	// FIFO 4 is EP4, OUT
-	{USBD_EP4RD,     -1,     USBD_EP4CS, USBD_EP4RDSTAT,     -1         },
-	// FIFO 5 is EP5, OUT
-	{USBD_EP5RD,     -1,     USBD_EP5CS, USBD_EP5RDSTAT,     -1         }
-};
-
-static struct {
-	unsigned int id;
-	const char *str;
-} ep_dma_id[] = {
-	{ DMA_ID_USBDEV_EP0_TX, "USBDev EP0 IN" },
-	{ DMA_ID_USBDEV_EP0_RX, "USBDev EP0 OUT" },
-	{ DMA_ID_USBDEV_EP2_TX, "USBDev EP2 IN" },
-	{ DMA_ID_USBDEV_EP3_TX, "USBDev EP3 IN" },
-	{ DMA_ID_USBDEV_EP4_RX, "USBDev EP4 OUT" },
-	{ DMA_ID_USBDEV_EP5_RX, "USBDev EP5 OUT" }
-};
-
-#define DIR_OUT 0
-#define DIR_IN  (1<<3)
-
-#define CONTROL_EP USB_ENDPOINT_XFER_CONTROL
-#define BULK_EP    USB_ENDPOINT_XFER_BULK
-
-static inline endpoint_t *
-epaddr_to_ep(struct usb_dev* dev, int ep_addr)
-{
-	if (ep_addr >= 0 && ep_addr < 2)
-		return &dev->ep[0];
-	if (ep_addr < 6)
-		return &dev->ep[ep_addr];
-	return NULL;
-}
-
-static const char* std_req_name[] = {
-	"GET_STATUS",
-	"CLEAR_FEATURE",
-	"RESERVED",
-	"SET_FEATURE",
-	"RESERVED",
-	"SET_ADDRESS",
-	"GET_DESCRIPTOR",
-	"SET_DESCRIPTOR",
-	"GET_CONFIGURATION",
-	"SET_CONFIGURATION",
-	"GET_INTERFACE",
-	"SET_INTERFACE",
-	"SYNCH_FRAME"
-};
-
-static inline const char*
-get_std_req_name(int req)
-{
-	return (req >= 0 && req <= 12) ? std_req_name[req] : "UNKNOWN";
-}
-
-#if 0
-static void
-dump_setup(struct usb_ctrlrequest* s)
-{
-	dbg("%s: requesttype=%d", __FUNCTION__, s->requesttype);
-	dbg("%s: request=%d %s", __FUNCTION__, s->request,
-	    get_std_req_name(s->request));
-	dbg("%s: value=0x%04x", __FUNCTION__, s->wValue);
-	dbg("%s: index=%d", __FUNCTION__, s->index);
-	dbg("%s: length=%d", __FUNCTION__, s->length);
-}
-#endif
-
-static inline usbdev_pkt_t *
-alloc_packet(endpoint_t * ep, int data_size, void* data)
-{
-	usbdev_pkt_t* pkt = kmalloc(sizeof(usbdev_pkt_t) + data_size,
-				    ALLOC_FLAGS);
-	if (!pkt)
-		return NULL;
-	pkt->ep_addr = ep->address;
-	pkt->size = data_size;
-	pkt->status = 0;
-	pkt->next = NULL;
-	if (data)
-		memcpy(pkt->payload, data, data_size);
-
-	return pkt;
-}
-
-
-/*
- * Link a packet to the tail of the enpoint's packet list.
- * EP spinlock must be held when calling.
- */
-static void
-link_tail(endpoint_t * ep, pkt_list_t * list, usbdev_pkt_t * pkt)
-{
-	if (!list->tail) {
-		list->head = list->tail = pkt;
-		list->count = 1;
-	} else {
-		list->tail->next = pkt;
-		list->tail = pkt;
-		list->count++;
-	}
-}
-
-/*
- * Unlink and return a packet from the head of the given packet
- * list. It is the responsibility of the caller to free the packet.
- * EP spinlock must be held when calling.
- */
-static usbdev_pkt_t *
-unlink_head(pkt_list_t * list)
-{
-	usbdev_pkt_t *pkt;
-
-	pkt = list->head;
-	if (!pkt || !list->count) {
-		return NULL;
-	}
-
-	list->head = pkt->next;
-	if (!list->head) {
-		list->head = list->tail = NULL;
-		list->count = 0;
-	} else
-		list->count--;
-
-	return pkt;
-}
-
-/*
- * Create and attach a new packet to the tail of the enpoint's
- * packet list. EP spinlock must be held when calling.
- */
-static usbdev_pkt_t *
-add_packet(endpoint_t * ep, pkt_list_t * list, int size)
-{
-	usbdev_pkt_t *pkt = alloc_packet(ep, size, NULL);
-	if (!pkt)
-		return NULL;
-
-	link_tail(ep, list, pkt);
-	return pkt;
-}
-
-
-/*
- * Unlink and free a packet from the head of the enpoint's
- * packet list. EP spinlock must be held when calling.
- */
-static inline void
-free_packet(pkt_list_t * list)
-{
-	kfree(unlink_head(list));
-}
-
-/* EP spinlock must be held when calling. */
-static inline void
-flush_pkt_list(pkt_list_t * list)
-{
-	while (list->count)
-		free_packet(list);
-}
-
-/* EP spinlock must be held when calling */
-static inline void
-flush_write_fifo(endpoint_t * ep)
-{
-	if (ep->reg->write_fifo_status >= 0) {
-		au_writel(USBDEV_FSTAT_FLUSH | USBDEV_FSTAT_UF |
-			  USBDEV_FSTAT_OF,
-			  ep->reg->write_fifo_status);
-		//udelay(100);
-		//au_writel(USBDEV_FSTAT_UF | USBDEV_FSTAT_OF,
-		//	  ep->reg->write_fifo_status);
-	}
-}
-
-/* EP spinlock must be held when calling */
-static inline void
-flush_read_fifo(endpoint_t * ep)
-{
-	if (ep->reg->read_fifo_status >= 0) {
-		au_writel(USBDEV_FSTAT_FLUSH | USBDEV_FSTAT_UF |
-			  USBDEV_FSTAT_OF,
-			  ep->reg->read_fifo_status);
-		//udelay(100);
-		//au_writel(USBDEV_FSTAT_UF | USBDEV_FSTAT_OF,
-		//	  ep->reg->read_fifo_status);
-	}
-}
-
-
-/* EP spinlock must be held when calling. */
-static void
-endpoint_flush(endpoint_t * ep)
-{
-	// First, flush all packets
-	flush_pkt_list(&ep->inlist);
-	flush_pkt_list(&ep->outlist);
-
-	// Now flush the endpoint's h/w FIFO(s)
-	flush_write_fifo(ep);
-	flush_read_fifo(ep);
-}
-
-/* EP spinlock must be held when calling. */
-static void
-endpoint_stall(endpoint_t * ep)
-{
-	u32 cs;
-
-	warn("%s", __FUNCTION__);
-
-	cs = au_readl(ep->reg->ctrl_stat) | USBDEV_CS_STALL;
-	au_writel(cs, ep->reg->ctrl_stat);
-}
-
-/* EP spinlock must be held when calling. */
-static void
-endpoint_unstall(endpoint_t * ep)
-{
-	u32 cs;
-
-	warn("%s", __FUNCTION__);
-
-	cs = au_readl(ep->reg->ctrl_stat) & ~USBDEV_CS_STALL;
-	au_writel(cs, ep->reg->ctrl_stat);
-}
-
-static void
-endpoint_reset_datatoggle(endpoint_t * ep)
-{
-	// FIXME: is this possible?
-}
-
-
-/* EP spinlock must be held when calling. */
-static int
-endpoint_fifo_read(endpoint_t * ep)
-{
-	int read_count = 0;
-	u8 *bufptr;
-	usbdev_pkt_t *pkt = ep->outlist.tail;
-
-	if (!pkt)
-		return -EINVAL;
-
-	bufptr = &pkt->payload[pkt->size];
-	while (au_readl(ep->reg->read_fifo_status) & USBDEV_FSTAT_FCNT_MASK) {
-		*bufptr++ = au_readl(ep->reg->read_fifo) & 0xff;
-		read_count++;
-		pkt->size++;
-	}
-
-	return read_count;
-}
-
-#if 0
-/* EP spinlock must be held when calling. */
-static int
-endpoint_fifo_write(endpoint_t * ep, int index)
-{
-	int write_count = 0;
-	u8 *bufptr;
-	usbdev_pkt_t *pkt = ep->inlist.head;
-
-	if (!pkt)
-		return -EINVAL;
-
-	bufptr = &pkt->payload[index];
-	while ((au_readl(ep->reg->write_fifo_status) &
-		USBDEV_FSTAT_FCNT_MASK) < EP_FIFO_DEPTH) {
-		if (bufptr < pkt->payload + pkt->size) {
-			au_writel(*bufptr++, ep->reg->write_fifo);
-			write_count++;
-		} else {
-			break;
-		}
-	}
-
-	return write_count;
-}
-#endif
-
-/*
- * This routine is called to restart transmission of a packet.
- * The endpoint's TSIZE must be set to the new packet's size,
- * and DMA to the write FIFO needs to be restarted.
- * EP spinlock must be held when calling.
- */
-static void
-kickstart_send_packet(endpoint_t * ep)
-{
-	u32 cs;
-	usbdev_pkt_t *pkt = ep->inlist.head;
-
-	vdbg("%s: ep%d, pkt=%p", __FUNCTION__, ep->address, pkt);
-
-	if (!pkt) {
-		err("%s: head=NULL! list->count=%d", __FUNCTION__,
-		    ep->inlist.count);
-		return;
-	}
-
-	dma_cache_wback_inv((unsigned long)pkt->payload, pkt->size);
-
-	/*
-	 * make sure FIFO is empty
-	 */
-	flush_write_fifo(ep);
-
-	cs = au_readl(ep->reg->ctrl_stat) & USBDEV_CS_STALL;
-	cs |= (pkt->size << USBDEV_CS_TSIZE_BIT);
-	au_writel(cs, ep->reg->ctrl_stat);
-
-	if (get_dma_active_buffer(ep->indma) == 1) {
-		set_dma_count1(ep->indma, pkt->size);
-		set_dma_addr1(ep->indma, virt_to_phys(pkt->payload));
-		enable_dma_buffer1(ep->indma);	// reenable
-	} else {
-		set_dma_count0(ep->indma, pkt->size);
-		set_dma_addr0(ep->indma, virt_to_phys(pkt->payload));
-		enable_dma_buffer0(ep->indma);	// reenable
-	}
-	if (dma_halted(ep->indma))
-		start_dma(ep->indma);
-}
-
-
-/*
- * This routine is called when a packet in the inlist has been
- * completed. Frees the completed packet and starts sending the
- * next. EP spinlock must be held when calling.
- */
-static usbdev_pkt_t *
-send_packet_complete(endpoint_t * ep)
-{
-	usbdev_pkt_t *pkt = unlink_head(&ep->inlist);
-
-	if (pkt) {
-		pkt->status =
-			(au_readl(ep->reg->ctrl_stat) & USBDEV_CS_NAK) ?
-			PKT_STATUS_NAK : PKT_STATUS_ACK;
-
-		vdbg("%s: ep%d, %s pkt=%p, list count=%d", __FUNCTION__,
-		     ep->address, (pkt->status & PKT_STATUS_NAK) ?
-		     "NAK" : "ACK", pkt, ep->inlist.count);
-	}
-
-	/*
-	 * The write fifo should already be drained if things are
-	 * working right, but flush it anyway just in case.
-	 */
-	flush_write_fifo(ep);
-
-	// begin transmitting next packet in the inlist
-	if (ep->inlist.count) {
-		kickstart_send_packet(ep);
-	}
-
-	return pkt;
-}
-
-/*
- * Add a new packet to the tail of the given ep's packet
- * inlist. The transmit complete interrupt frees packets from
- * the head of this list. EP spinlock must be held when calling.
- */
-static int
-send_packet(struct usb_dev* dev, usbdev_pkt_t *pkt, int async)
-{
-	pkt_list_t *list;
-	endpoint_t* ep;
-
-	if (!pkt || !(ep = epaddr_to_ep(dev, pkt->ep_addr)))
-		return -EINVAL;
-
-	if (!pkt->size)
-		return 0;
-
-	list = &ep->inlist;
-
-	if (!async && list->count) {
-		halt_dma(ep->indma);
-		flush_pkt_list(list);
-	}
-
-	link_tail(ep, list, pkt);
-
-	vdbg("%s: ep%d, pkt=%p, size=%d, list count=%d", __FUNCTION__,
-	     ep->address, pkt, pkt->size, list->count);
-
-	if (list->count == 1) {
-		/*
-		 * if the packet count is one, it means the list was empty,
-		 * and no more data will go out this ep until we kick-start
-		 * it again.
-		 */
-		kickstart_send_packet(ep);
-	}
-
-	return pkt->size;
-}
-
-/*
- * This routine is called to restart reception of a packet.
- * EP spinlock must be held when calling.
- */
-static void
-kickstart_receive_packet(endpoint_t * ep)
-{
-	usbdev_pkt_t *pkt;
-
-	// get and link a new packet for next reception
-	if (!(pkt = add_packet(ep, &ep->outlist, ep->max_pkt_size))) {
-		err("%s: could not alloc new packet", __FUNCTION__);
-		return;
-	}
-
-	if (get_dma_active_buffer(ep->outdma) == 1) {
-		clear_dma_done1(ep->outdma);
-		set_dma_count1(ep->outdma, ep->max_pkt_size);
-		set_dma_count0(ep->outdma, 0);
-		set_dma_addr1(ep->outdma, virt_to_phys(pkt->payload));
-		enable_dma_buffer1(ep->outdma);	// reenable
-	} else {
-		clear_dma_done0(ep->outdma);
-		set_dma_count0(ep->outdma, ep->max_pkt_size);
-		set_dma_count1(ep->outdma, 0);
-		set_dma_addr0(ep->outdma, virt_to_phys(pkt->payload));
-		enable_dma_buffer0(ep->outdma);	// reenable
-	}
-	if (dma_halted(ep->outdma))
-		start_dma(ep->outdma);
-}
-
-
-/*
- * This routine is called when a packet in the outlist has been
- * completed (received) and we need to prepare for a new packet
- * to be received. Halts DMA and computes the packet size from the
- * remaining DMA counter. Then prepares a new packet for reception
- * and restarts DMA. FIXME: what if another packet comes in
- * on top of the completed packet? Counter would be wrong.
- * EP spinlock must be held when calling.
- */
-static usbdev_pkt_t *
-receive_packet_complete(endpoint_t * ep)
-{
-	usbdev_pkt_t *pkt = ep->outlist.tail;
-	u32 cs;
-
-	halt_dma(ep->outdma);
-
-	cs = au_readl(ep->reg->ctrl_stat);
-
-	if (!pkt)
-		return NULL;
-
-	pkt->size = ep->max_pkt_size - get_dma_residue(ep->outdma);
-	if (pkt->size)
-		dma_cache_inv((unsigned long)pkt->payload, pkt->size);
-	/*
-	 * need to pull out any remaining bytes in the FIFO.
-	 */
-	endpoint_fifo_read(ep);
-	/*
-	 * should be drained now, but flush anyway just in case.
-	 */
-	flush_read_fifo(ep);
-
-	pkt->status = (cs & USBDEV_CS_NAK) ? PKT_STATUS_NAK : PKT_STATUS_ACK;
-	if (ep->address == 0 && (cs & USBDEV_CS_SU))
-		pkt->status |= PKT_STATUS_SU;
-
-	vdbg("%s: ep%d, %s pkt=%p, size=%d", __FUNCTION__,
-	     ep->address, (pkt->status & PKT_STATUS_NAK) ?
-	     "NAK" : "ACK", pkt, pkt->size);
-
-	kickstart_receive_packet(ep);
-
-	return pkt;
-}
-
-
-/*
- ****************************************************************************
- * Here starts the standard device request handlers. They are
- * all called by do_setup() via a table of function pointers.
- ****************************************************************************
- */
-
-static ep0_stage_t
-do_get_status(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	switch (setup->bRequestType) {
-	case 0x80:	// Device
-		// FIXME: send device status
-		break;
-	case 0x81:	// Interface
-		// FIXME: send interface status
-		break;
-	case 0x82:	// End Point
-		// FIXME: send endpoint status
-		break;
-	default:
-		// Invalid Command
-		endpoint_stall(&dev->ep[0]); // Stall End Point 0
-		break;
-	}
-
-	return STATUS_STAGE;
-}
-
-static ep0_stage_t
-do_clear_feature(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	switch (setup->bRequestType) {
-	case 0x00:	// Device
-		if ((le16_to_cpu(setup->wValue) & 0xff) == 1)
-			dev->remote_wakeup_en = 0;
-	else
-			endpoint_stall(&dev->ep[0]);
-		break;
-	case 0x02:	// End Point
-		if ((le16_to_cpu(setup->wValue) & 0xff) == 0) {
-			endpoint_t *ep =
-				epaddr_to_ep(dev,
-					     le16_to_cpu(setup->wIndex) & 0xff);
-
-			endpoint_unstall(ep);
-			endpoint_reset_datatoggle(ep);
-		} else
-			endpoint_stall(&dev->ep[0]);
-		break;
-	}
-
-	return SETUP_STAGE;
-}
-
-static ep0_stage_t
-do_reserved(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	// Invalid request, stall End Point 0
-	endpoint_stall(&dev->ep[0]);
-	return SETUP_STAGE;
-}
-
-static ep0_stage_t
-do_set_feature(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	switch (setup->bRequestType) {
-	case 0x00:	// Device
-		if ((le16_to_cpu(setup->wValue) & 0xff) == 1)
-			dev->remote_wakeup_en = 1;
-		else
-			endpoint_stall(&dev->ep[0]);
-		break;
-	case 0x02:	// End Point
-		if ((le16_to_cpu(setup->wValue) & 0xff) == 0) {
-			endpoint_t *ep =
-				epaddr_to_ep(dev,
-					     le16_to_cpu(setup->wIndex) & 0xff);
-
-			endpoint_stall(ep);
-		} else
-			endpoint_stall(&dev->ep[0]);
-		break;
-	}
-
-	return SETUP_STAGE;
-}
-
-static ep0_stage_t
-do_set_address(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	int new_state = dev->state;
-	int new_addr = le16_to_cpu(setup->wValue);
-
-	dbg("%s: our address=%d", __FUNCTION__, new_addr);
-
-	if (new_addr > 127) {
-			// usb spec doesn't tell us what to do, so just go to
-			// default state
-		new_state = DEFAULT;
-		dev->address = 0;
-	} else if (dev->address != new_addr) {
-		dev->address = new_addr;
-		new_state = ADDRESS;
-	}
-
-	if (dev->state != new_state) {
-		dev->state = new_state;
-		/* inform function layer of usbdev state change */
-		dev->func_cb(CB_NEW_STATE, dev->state, dev->cb_data);
-	}
-
-	return SETUP_STAGE;
-}
-
-static ep0_stage_t
-do_get_descriptor(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	int strnum, desc_len = le16_to_cpu(setup->wLength);
-
-		switch (le16_to_cpu(setup->wValue) >> 8) {
-		case USB_DT_DEVICE:
-			// send device descriptor!
-		desc_len = desc_len > dev->dev_desc->bLength ?
-			dev->dev_desc->bLength : desc_len;
-			dbg("sending device desc, size=%d", desc_len);
-		send_packet(dev, alloc_packet(&dev->ep[0], desc_len,
-					      dev->dev_desc), 0);
-			break;
-		case USB_DT_CONFIG:
-			// If the config descr index in low-byte of
-			// setup->wValue	is valid, send config descr,
-			// otherwise stall ep0.
-			if ((le16_to_cpu(setup->wValue) & 0xff) == 0) {
-				// send config descriptor!
-				if (desc_len <= USB_DT_CONFIG_SIZE) {
-					dbg("sending partial config desc, size=%d",
-					     desc_len);
-				send_packet(dev,
-					    alloc_packet(&dev->ep[0],
-							 desc_len,
-							 dev->conf_desc),
-					    0);
-				} else {
-				int len = le16_to_cpu(dev->conf_desc->wTotalLength);
-				dbg("sending whole config desc,"
-				    " size=%d, our size=%d", desc_len, len);
-				desc_len = desc_len > len ? len : desc_len;
-				send_packet(dev,
-					    alloc_packet(&dev->ep[0],
-							 desc_len,
-							 dev->full_conf_desc),
-					    0);
-				}
-			} else
-			endpoint_stall(&dev->ep[0]);
-			break;
-		case USB_DT_STRING:
-			// If the string descr index in low-byte of setup->wValue
-			// is valid, send string descr, otherwise stall ep0.
-			strnum = le16_to_cpu(setup->wValue) & 0xff;
-			if (strnum >= 0 && strnum < 6) {
-				struct usb_string_descriptor *desc =
-				dev->str_desc[strnum];
-				desc_len = desc_len > desc->bLength ?
-					desc->bLength : desc_len;
-				dbg("sending string desc %d", strnum);
-			send_packet(dev,
-				    alloc_packet(&dev->ep[0], desc_len,
-						 desc), 0);
-			} else
-			endpoint_stall(&dev->ep[0]);
-			break;
-	default:
-		// Invalid request
-		err("invalid get desc=%d, stalled",
-			    le16_to_cpu(setup->wValue) >> 8);
-		endpoint_stall(&dev->ep[0]);	// Stall endpoint 0
-			break;
-		}
-
-	return STATUS_STAGE;
-}
-
-static ep0_stage_t
-do_set_descriptor(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	// TODO: implement
-	// there will be an OUT data stage (the descriptor to set)
-	return DATA_STAGE;
-}
-
-static ep0_stage_t
-do_get_configuration(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	// send dev->configuration
-	dbg("sending config");
-	send_packet(dev, alloc_packet(&dev->ep[0], 1, &dev->configuration),
-		    0);
-	return STATUS_STAGE;
-}
-
-static ep0_stage_t
-do_set_configuration(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	// set active config to low-byte of setup->wValue
-	dev->configuration = le16_to_cpu(setup->wValue) & 0xff;
-	dbg("set config, config=%d", dev->configuration);
-	if (!dev->configuration && dev->state > DEFAULT) {
-		dev->state = ADDRESS;
-		/* inform function layer of usbdev state change */
-		dev->func_cb(CB_NEW_STATE, dev->state, dev->cb_data);
-	} else if (dev->configuration == 1) {
-		dev->state = CONFIGURED;
-		/* inform function layer of usbdev state change */
-		dev->func_cb(CB_NEW_STATE, dev->state, dev->cb_data);
-	} else {
-		// FIXME: "respond with request error" - how?
-	}
-
-	return SETUP_STAGE;
-}
-
-static ep0_stage_t
-do_get_interface(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-		// interface must be zero.
-	if ((le16_to_cpu(setup->wIndex) & 0xff) || dev->state == ADDRESS) {
-			// FIXME: respond with "request error". how?
-	} else if (dev->state == CONFIGURED) {
-		// send dev->alternate_setting
-			dbg("sending alt setting");
-		send_packet(dev, alloc_packet(&dev->ep[0], 1,
-					      &dev->alternate_setting), 0);
-		}
-
-	return STATUS_STAGE;
-
-}
-
-static ep0_stage_t
-do_set_interface(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	if (dev->state == ADDRESS) {
-			// FIXME: respond with "request error". how?
-	} else if (dev->state == CONFIGURED) {
-		dev->interface = le16_to_cpu(setup->wIndex) & 0xff;
-		dev->alternate_setting =
-			    le16_to_cpu(setup->wValue) & 0xff;
-			// interface and alternate_setting must be zero
-		if (dev->interface || dev->alternate_setting) {
-				// FIXME: respond with "request error". how?
-			}
-		}
-
-	return SETUP_STAGE;
-}
-
-static ep0_stage_t
-do_synch_frame(struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	// TODO
-	return SETUP_STAGE;
-}
-
-typedef ep0_stage_t (*req_method_t)(struct usb_dev* dev,
-				    struct usb_ctrlrequest* setup);
-
-
-/* Table of the standard device request handlers */
-static const req_method_t req_method[] = {
-	do_get_status,
-	do_clear_feature,
-	do_reserved,
-	do_set_feature,
-	do_reserved,
-	do_set_address,
-	do_get_descriptor,
-	do_set_descriptor,
-	do_get_configuration,
-	do_set_configuration,
-	do_get_interface,
-	do_set_interface,
-	do_synch_frame
-};
-
-
-// SETUP packet request dispatcher
-static void
-do_setup (struct usb_dev* dev, struct usb_ctrlrequest* setup)
-{
-	req_method_t m;
-
-	dbg("%s: req %d %s", __FUNCTION__, setup->bRequestType,
-	    get_std_req_name(setup->bRequestType));
-
-	if ((setup->bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD ||
-	    (setup->bRequestType & USB_RECIP_MASK) != USB_RECIP_DEVICE) {
-		err("%s: invalid requesttype 0x%02x", __FUNCTION__,
-		    setup->bRequestType);
-		return;
-		}
-
-	if ((setup->bRequestType & 0x80) == USB_DIR_OUT && setup->wLength)
-		dbg("%s: OUT phase! length=%d", __FUNCTION__, setup->wLength);
-
-	if (setup->bRequestType < sizeof(req_method)/sizeof(req_method_t))
-		m = req_method[setup->bRequestType];
-			else
-		m = do_reserved;
-
-	dev->ep0_stage = (*m)(dev, setup);
-}
-
-/*
- * A SETUP, DATA0, or DATA1 packet has been received
- * on the default control endpoint's fifo.
- */
-static void
-process_ep0_receive (struct usb_dev* dev)
-{
-	endpoint_t *ep0 = &dev->ep[0];
-	usbdev_pkt_t *pkt;
-
-	spin_lock(&ep0->lock);
-
-		// complete packet and prepare a new packet
-	pkt = receive_packet_complete(ep0);
-	if (!pkt) {
-		// FIXME: should  put a warn/err here.
-		spin_unlock(&ep0->lock);
-			return;
-		}
-
-	// unlink immediately from endpoint.
-	unlink_head(&ep0->outlist);
-
-	// override current stage if h/w says it's a setup packet
-	if (pkt->status & PKT_STATUS_SU)
-		dev->ep0_stage = SETUP_STAGE;
-
-	switch (dev->ep0_stage) {
-	case SETUP_STAGE:
-		vdbg("SU bit is %s in setup stage",
-		     (pkt->status & PKT_STATUS_SU) ? "set" : "not set");
-
-			if (pkt->size == sizeof(struct usb_ctrlrequest)) {
-#ifdef VDEBUG
-			if (pkt->status & PKT_STATUS_ACK)
-				vdbg("received SETUP");
-				else
-				vdbg("received NAK SETUP");
-#endif
-			do_setup(dev, (struct usb_ctrlrequest*)pkt->payload);
-		} else
-			err("%s: wrong size SETUP received", __FUNCTION__);
-		break;
-	case DATA_STAGE:
-		/*
-		 * this setup has an OUT data stage. Of the standard
-		 * device requests, only set_descriptor has this stage,
-		 * so this packet is that descriptor. TODO: drop it for
-		 * now, set_descriptor not implemented.
-		 *
-		 * Need to place a byte in the write FIFO here, to prepare
-		 * to send a zero-length DATA ack packet to the host in the
-		 * STATUS stage.
-		 */
-		au_writel(0, ep0->reg->write_fifo);
-		dbg("received OUT stage DATAx on EP0, size=%d", pkt->size);
-		dev->ep0_stage = SETUP_STAGE;
-		break;
-	case STATUS_STAGE:
-		// this setup had an IN data stage, and host is ACK'ing
-		// the packet we sent during that stage.
-		if (pkt->size != 0)
-			warn("received non-zero ACK on EP0??");
-#ifdef VDEBUG
-		else
-			vdbg("received ACK on EP0");
-#endif
-		dev->ep0_stage = SETUP_STAGE;
-		break;
-	}
-
-	spin_unlock(&ep0->lock);
-	// we're done processing the packet, free it
-	kfree(pkt);
-}
-
-
-/*
- * A DATA0/1 packet has been received on one of the OUT endpoints (4 or 5)
- */
-static void
-process_ep_receive (struct usb_dev* dev, endpoint_t *ep)
-{
-	usbdev_pkt_t *pkt;
-
-		spin_lock(&ep->lock);
-	pkt = receive_packet_complete(ep);
-		spin_unlock(&ep->lock);
-
-	dev->func_cb(CB_PKT_COMPLETE, (unsigned long)pkt, dev->cb_data);
-}
-
-
-
-/* This ISR handles the receive complete and suspend events */
-static void req_sus_intr (int irq, void *dev_id)
-{
-	struct usb_dev *dev = (struct usb_dev *) dev_id;
-	u32 status;
-
-	status = au_readl(USBD_INTSTAT);
-	au_writel(status, USBD_INTSTAT);	// ack'em
-
-	if (status & (1<<0))
-		process_ep0_receive(dev);
-	if (status & (1<<4))
-		process_ep_receive(dev, &dev->ep[4]);
-	if (status & (1<<5))
-		process_ep_receive(dev, &dev->ep[5]);
-}
-
-
-/* This ISR handles the DMA done events on EP0 */
-static void dma_done_ep0_intr(int irq, void *dev_id)
-{
-	struct usb_dev *dev = (struct usb_dev *) dev_id;
-	usbdev_pkt_t* pkt;
-	endpoint_t *ep0 = &dev->ep[0];
-	u32 cs0, buff_done;
-
-	spin_lock(&ep0->lock);
-	cs0 = au_readl(ep0->reg->ctrl_stat);
-
-	// first check packet transmit done
-	if ((buff_done = get_dma_buffer_done(ep0->indma)) != 0) {
-		// transmitted a DATAx packet during DATA stage
-		// on control endpoint 0
-		// clear DMA done bit
-		if (buff_done & DMA_D0)
-			clear_dma_done0(ep0->indma);
-		if (buff_done & DMA_D1)
-			clear_dma_done1(ep0->indma);
-
-		pkt = send_packet_complete(ep0);
-		kfree(pkt);
-	}
-
-	/*
-	 * Now check packet receive done. Shouldn't get these,
-	 * the receive packet complete intr should happen
-	 * before the DMA done intr occurs.
-	 */
-	if ((buff_done = get_dma_buffer_done(ep0->outdma)) != 0) {
-		// clear DMA done bit
-		if (buff_done & DMA_D0)
-			clear_dma_done0(ep0->outdma);
-		if (buff_done & DMA_D1)
-			clear_dma_done1(ep0->outdma);
-
-		//process_ep0_receive(dev);
-	}
-
-	spin_unlock(&ep0->lock);
-}
-
-/* This ISR handles the DMA done events on endpoints 2,3,4,5 */
-static void dma_done_ep_intr(int irq, void *dev_id)
-{
-	struct usb_dev *dev = (struct usb_dev *) dev_id;
-	int i;
-
-	for (i = 2; i < 6; i++) {
-	u32 buff_done;
-		usbdev_pkt_t* pkt;
-		endpoint_t *ep = &dev->ep[i];
-
-		if (!ep->active) continue;
-
-	spin_lock(&ep->lock);
-
-		if (ep->direction == USB_DIR_IN) {
-			buff_done = get_dma_buffer_done(ep->indma);
-			if (buff_done != 0) {
-				// transmitted a DATAx pkt on the IN ep
-		// clear DMA done bit
-		if (buff_done & DMA_D0)
-			clear_dma_done0(ep->indma);
-		if (buff_done & DMA_D1)
-			clear_dma_done1(ep->indma);
-
-				pkt = send_packet_complete(ep);
-
-				spin_unlock(&ep->lock);
-				dev->func_cb(CB_PKT_COMPLETE,
-					     (unsigned long)pkt,
-					     dev->cb_data);
-				spin_lock(&ep->lock);
-			}
-		} else {
-	/*
-			 * Check packet receive done (OUT ep). Shouldn't get
-			 * these, the rx packet complete intr should happen
-	 * before the DMA done intr occurs.
-	 */
-			buff_done = get_dma_buffer_done(ep->outdma);
-			if (buff_done != 0) {
-				// received a DATAx pkt on the OUT ep
-		// clear DMA done bit
-		if (buff_done & DMA_D0)
-			clear_dma_done0(ep->outdma);
-		if (buff_done & DMA_D1)
-			clear_dma_done1(ep->outdma);
-
-				//process_ep_receive(dev, ep);
-	}
-	}
-
-		spin_unlock(&ep->lock);
-	}
-}
-
-
-/***************************************************************************
- * Here begins the external interface functions
- ***************************************************************************
- */
-
-/*
- * allocate a new packet
- */
-int
-usbdev_alloc_packet(int ep_addr, int data_size, usbdev_pkt_t** pkt)
-{
-	endpoint_t * ep = epaddr_to_ep(&usbdev, ep_addr);
-	usbdev_pkt_t* lpkt = NULL;
-
-	if (!ep || !ep->active || ep->address < 2)
-		return -ENODEV;
-	if (data_size > ep->max_pkt_size)
-		return -EINVAL;
-
-	lpkt = *pkt = alloc_packet(ep, data_size, NULL);
-	if (!lpkt)
-		return -ENOMEM;
-	return 0;
-}
-
-
-/*
- * packet send
- */
-int
-usbdev_send_packet(int ep_addr, usbdev_pkt_t * pkt)
-{
-	unsigned long flags;
-	int count;
-	endpoint_t * ep;
-
-	if (!pkt || !(ep = epaddr_to_ep(&usbdev, pkt->ep_addr)) ||
-	    !ep->active || ep->address < 2)
-		return -ENODEV;
-	if (ep->direction != USB_DIR_IN)
-		return -EINVAL;
-
-	spin_lock_irqsave(&ep->lock, flags);
-	count = send_packet(&usbdev, pkt, 1);
-	spin_unlock_irqrestore(&ep->lock, flags);
-
-	return count;
-}
-
-/*
- * packet receive
- */
-int
-usbdev_receive_packet(int ep_addr, usbdev_pkt_t** pkt)
-{
-	unsigned long flags;
-	usbdev_pkt_t* lpkt = NULL;
-	endpoint_t *ep = epaddr_to_ep(&usbdev, ep_addr);
-
-	if (!ep || !ep->active || ep->address < 2)
-		return -ENODEV;
-	if (ep->direction != USB_DIR_OUT)
-		return -EINVAL;
-
-	spin_lock_irqsave(&ep->lock, flags);
-	if (ep->outlist.count > 1)
-		lpkt = unlink_head(&ep->outlist);
-	spin_unlock_irqrestore(&ep->lock, flags);
-
-	if (!lpkt) {
-		/* no packet available */
-		*pkt = NULL;
-		return -ENODATA;
-	}
-
-	*pkt = lpkt;
-
-	return lpkt->size;
-}
-
-
-/*
- * return total queued byte count on the endpoint.
- */
-int
-usbdev_get_byte_count(int ep_addr)
-{
-        unsigned long flags;
-        pkt_list_t *list;
-        usbdev_pkt_t *scan;
-        int count = 0;
-	endpoint_t * ep = epaddr_to_ep(&usbdev, ep_addr);
-
-	if (!ep || !ep->active || ep->address < 2)
-		return -ENODEV;
-
-	if (ep->direction == USB_DIR_IN) {
-		list = &ep->inlist;
-
-		spin_lock_irqsave(&ep->lock, flags);
-		for (scan = list->head; scan; scan = scan->next)
-			count += scan->size;
-		spin_unlock_irqrestore(&ep->lock, flags);
-	} else {
-		list = &ep->outlist;
-
-		spin_lock_irqsave(&ep->lock, flags);
-		if (list->count > 1) {
-			for (scan = list->head; scan != list->tail;
-			     scan = scan->next)
-				count += scan->size;
-	}
-		spin_unlock_irqrestore(&ep->lock, flags);
-	}
-
-	return count;
-}
-
-
-void
-usbdev_exit(void)
-{
-	endpoint_t *ep;
-	int i;
-
-	au_writel(0, USBD_INTEN);	// disable usb dev ints
-	au_writel(0, USBD_ENABLE);	// disable usb dev
-
-	free_irq(AU1000_USB_DEV_REQ_INT, &usbdev);
-	free_irq(AU1000_USB_DEV_SUS_INT, &usbdev);
-
-	// free all control endpoint resources
-	ep = &usbdev.ep[0];
-	free_au1000_dma(ep->indma);
-	free_au1000_dma(ep->outdma);
-	endpoint_flush(ep);
-
-	// free ep resources
-	for (i = 2; i < 6; i++) {
-		ep = &usbdev.ep[i];
-		if (!ep->active) continue;
-
-		if (ep->direction == USB_DIR_IN) {
-			free_au1000_dma(ep->indma);
-		} else {
-		free_au1000_dma(ep->outdma);
-		}
-		endpoint_flush(ep);
-	}
-
-	kfree(usbdev.full_conf_desc);
-}
-
-int
-usbdev_init(struct usb_device_descriptor* dev_desc,
-	    struct usb_config_descriptor* config_desc,
-	    struct usb_interface_descriptor* if_desc,
-	    struct usb_endpoint_descriptor* ep_desc,
-	    struct usb_string_descriptor* str_desc[],
-	    void (*cb)(usbdev_cb_type_t, unsigned long, void *),
-	    void* cb_data)
-{
-	endpoint_t *ep0;
-	int i, ret=0;
-	u8* fcd;
-
-	if (dev_desc->bNumConfigurations > 1 ||
-	    config_desc->bNumInterfaces > 1 ||
-	    if_desc->bNumEndpoints > 4) {
-		err("Only one config, one i/f, and no more "
-		    "than 4 ep's allowed");
-		ret = -EINVAL;
-		goto out;
-	}
-
-	if (!cb) {
-		err("Function-layer callback required");
-		ret = -EINVAL;
-		goto out;
-	}
-
-	if (dev_desc->bMaxPacketSize0 != USBDEV_EP0_MAX_PACKET_SIZE) {
-		warn("EP0 Max Packet size must be %d",
-		     USBDEV_EP0_MAX_PACKET_SIZE);
-		dev_desc->bMaxPacketSize0 = USBDEV_EP0_MAX_PACKET_SIZE;
-	}
-
-	memset(&usbdev, 0, sizeof(struct usb_dev));
-
-	usbdev.state = DEFAULT;
-	usbdev.dev_desc = dev_desc;
-	usbdev.if_desc = if_desc;
-	usbdev.conf_desc = config_desc;
-	for (i=0; i<6; i++)
-		usbdev.str_desc[i] = str_desc[i];
-	usbdev.func_cb = cb;
-	usbdev.cb_data = cb_data;
-
-	/* Initialize default control endpoint */
-	ep0 = &usbdev.ep[0];
-	ep0->active = 1;
-	ep0->type = CONTROL_EP;
-	ep0->max_pkt_size = USBDEV_EP0_MAX_PACKET_SIZE;
-	spin_lock_init(&ep0->lock);
-	ep0->desc = NULL;	// ep0 has no descriptor
-	ep0->address = 0;
-	ep0->direction = 0;
-	ep0->reg = &ep_reg[0];
-
-	/* Initialize the other requested endpoints */
-	for (i = 0; i < if_desc->bNumEndpoints; i++) {
-		struct usb_endpoint_descriptor* epd = &ep_desc[i];
-	endpoint_t *ep;
-
-		if ((epd->bEndpointAddress & 0x80) == USB_DIR_IN) {
-			ep = &usbdev.ep[2];
-			ep->address = 2;
-			if (ep->active) {
-				ep = &usbdev.ep[3];
-				ep->address = 3;
-				if (ep->active) {
-					err("too many IN ep's requested");
-					ret = -ENODEV;
-					goto out;
-	}
-	}
-		} else {
-			ep = &usbdev.ep[4];
-			ep->address = 4;
-			if (ep->active) {
-				ep = &usbdev.ep[5];
-				ep->address = 5;
-				if (ep->active) {
-					err("too many OUT ep's requested");
-					ret = -ENODEV;
-					goto out;
-	}
-	}
-		}
-
-		ep->active = 1;
-		epd->bEndpointAddress &= ~0x0f;
-		epd->bEndpointAddress |= (u8)ep->address;
-		ep->direction = epd->bEndpointAddress & 0x80;
-		ep->type = epd->bmAttributes & 0x03;
-		ep->max_pkt_size = le16_to_cpu(epd->wMaxPacketSize);
-		spin_lock_init(&ep->lock);
-		ep->desc = epd;
-		ep->reg = &ep_reg[ep->address];
-		}
-
-	/*
-	 * initialize the full config descriptor
-	 */
-	usbdev.full_conf_desc = fcd = kmalloc(le16_to_cpu(config_desc->wTotalLength),
-					      ALLOC_FLAGS);
-	if (!fcd) {
-		err("failed to alloc full config descriptor");
-		ret = -ENOMEM;
-		goto out;
-	}
-
-	memcpy(fcd, config_desc, USB_DT_CONFIG_SIZE);
-	fcd += USB_DT_CONFIG_SIZE;
-	memcpy(fcd, if_desc, USB_DT_INTERFACE_SIZE);
-	fcd += USB_DT_INTERFACE_SIZE;
-	for (i = 0; i < if_desc->bNumEndpoints; i++) {
-		memcpy(fcd, &ep_desc[i], USB_DT_ENDPOINT_SIZE);
-		fcd += USB_DT_ENDPOINT_SIZE;
-	}
-
-	/* Now we're ready to enable the controller */
-	au_writel(0x0002, USBD_ENABLE);
-	udelay(100);
-	au_writel(0x0003, USBD_ENABLE);
-	udelay(100);
-
-	/* build and send config table based on ep descriptors */
-	for (i = 0; i < 6; i++) {
-		endpoint_t *ep;
-		if (i == 1)
-			continue; // skip dummy ep
-		ep = &usbdev.ep[i];
-		if (ep->active) {
-			au_writel((ep->address << 4) | 0x04, USBD_CONFIG);
-			au_writel(((ep->max_pkt_size & 0x380) >> 7) |
-				  (ep->direction >> 4) | (ep->type << 4),
-				  USBD_CONFIG);
-			au_writel((ep->max_pkt_size & 0x7f) << 1, USBD_CONFIG);
-			au_writel(0x00, USBD_CONFIG);
-			au_writel(ep->address, USBD_CONFIG);
-		} else {
-			u8 dir = (i==2 || i==3) ? DIR_IN : DIR_OUT;
-			au_writel((i << 4) | 0x04, USBD_CONFIG);
-			au_writel(((16 & 0x380) >> 7) | dir |
-				  (BULK_EP << 4), USBD_CONFIG);
-			au_writel((16 & 0x7f) << 1, USBD_CONFIG);
-			au_writel(0x00, USBD_CONFIG);
-			au_writel(i, USBD_CONFIG);
-		}
-	}
-
-	/*
-	 * Enable Receive FIFO Complete interrupts only. Transmit
-	 * complete is being handled by the DMA done interrupts.
-	 */
-	au_writel(0x31, USBD_INTEN);
-
-	/*
-	 * Controller is now enabled, request DMA and IRQ
-	 * resources.
-	 */
-
-	/* request the USB device transfer complete interrupt */
-	if (request_irq(AU1000_USB_DEV_REQ_INT, req_sus_intr, IRQF_DISABLED,
-			"USBdev req", &usbdev)) {
-		err("Can't get device request intr");
-		ret = -ENXIO;
-		goto out;
-	}
-	/* request the USB device suspend interrupt */
-	if (request_irq(AU1000_USB_DEV_SUS_INT, req_sus_intr, IRQF_DISABLED,
-			"USBdev sus", &usbdev)) {
-		err("Can't get device suspend intr");
-		ret = -ENXIO;
-		goto out;
-	}
-
-	/* Request EP0 DMA and IRQ */
-	if ((ep0->indma = request_au1000_dma(ep_dma_id[0].id,
-					     ep_dma_id[0].str,
-					     dma_done_ep0_intr,
-					     IRQF_DISABLED,
-					     &usbdev)) < 0) {
-		err("Can't get %s DMA", ep_dma_id[0].str);
-		ret = -ENXIO;
-		goto out;
-	}
-	if ((ep0->outdma = request_au1000_dma(ep_dma_id[1].id,
-					      ep_dma_id[1].str,
-					      NULL, 0, NULL)) < 0) {
-		err("Can't get %s DMA", ep_dma_id[1].str);
-		ret = -ENXIO;
-		goto out;
-	}
-
-	// Flush the ep0 buffers and FIFOs
-	endpoint_flush(ep0);
-	// start packet reception on ep0
-	kickstart_receive_packet(ep0);
-
-	/* Request DMA and IRQ for the other endpoints */
-	for (i = 2; i < 6; i++) {
-		endpoint_t *ep = &usbdev.ep[i];
-		if (!ep->active)
-			continue;
-
-		// Flush the endpoint buffers and FIFOs
-		endpoint_flush(ep);
-
-		if (ep->direction == USB_DIR_IN) {
-			ep->indma =
-				request_au1000_dma(ep_dma_id[ep->address].id,
-						   ep_dma_id[ep->address].str,
-						   dma_done_ep_intr,
-						   IRQF_DISABLED,
-						   &usbdev);
-			if (ep->indma < 0) {
-				err("Can't get %s DMA",
-				    ep_dma_id[ep->address].str);
-				ret = -ENXIO;
-				goto out;
-			}
-		} else {
-			ep->outdma =
-				request_au1000_dma(ep_dma_id[ep->address].id,
-						   ep_dma_id[ep->address].str,
-						   NULL, 0, NULL);
-			if (ep->outdma < 0) {
-				err("Can't get %s DMA",
-				    ep_dma_id[ep->address].str);
-				ret = -ENXIO;
-				goto out;
-			}
-
-			// start packet reception on OUT endpoint
-			kickstart_receive_packet(ep);
-		}
-	}
-
- out:
-	if (ret)
-		usbdev_exit();
-	return ret;
-}
-
-EXPORT_SYMBOL(usbdev_init);
-EXPORT_SYMBOL(usbdev_exit);
-EXPORT_SYMBOL(usbdev_alloc_packet);
-EXPORT_SYMBOL(usbdev_receive_packet);
-EXPORT_SYMBOL(usbdev_send_packet);
-EXPORT_SYMBOL(usbdev_get_byte_count);
diff --git a/arch/mips/au1000/db1x00/board_setup.c b/arch/mips/au1000/db1x00/board_setup.c
index 7a79293..8b08edb 100644
--- a/arch/mips/au1000/db1x00/board_setup.c
+++ b/arch/mips/au1000/db1x00/board_setup.c
@@ -58,11 +58,6 @@
 
 	pin_func = 0;
 	/* not valid for 1550 */
-#ifdef CONFIG_AU1X00_USB_DEVICE
-	// 2nd USB port is USB device
-	pin_func = au_readl(SYS_PINFUNC) & (u32)(~0x8000);
-	au_writel(pin_func, SYS_PINFUNC);
-#endif
 
 #if defined(CONFIG_IRDA) && (defined(CONFIG_SOC_AU1000) || defined(CONFIG_SOC_AU1100))
 	/* set IRFIRSEL instead of GPIO15 */
diff --git a/arch/mips/au1000/mtx-1/board_setup.c b/arch/mips/au1000/mtx-1/board_setup.c
index e917e54..13f9bf5 100644
--- a/arch/mips/au1000/mtx-1/board_setup.c
+++ b/arch/mips/au1000/mtx-1/board_setup.c
@@ -51,15 +51,11 @@
 
 void __init board_setup(void)
 {
-#if defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
-#ifdef CONFIG_AU1X00_USB_DEVICE
-	// 2nd USB port is USB device
-	au_writel(au_readl(SYS_PINFUNC) & (u32)(~0x8000), SYS_PINFUNC);
-#endif
+#ifdef CONFIG_USB_OHCI
 	// enable USB power switch
 	au_writel( au_readl(GPIO2_DIR) | 0x10, GPIO2_DIR );
 	au_writel( 0x100000, GPIO2_OUTPUT );
-#endif // defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
+#endif // defined (CONFIG_USB_OHCI)
 
 #ifdef CONFIG_PCI
 #if defined(__MIPSEB__)
diff --git a/arch/mips/au1000/pb1000/board_setup.c b/arch/mips/au1000/pb1000/board_setup.c
index 1cf18e16..824cfaf 100644
--- a/arch/mips/au1000/pb1000/board_setup.c
+++ b/arch/mips/au1000/pb1000/board_setup.c
@@ -54,7 +54,7 @@
 	au_writel(0, SYS_PINSTATERD);
 	udelay(100);
 
-#if defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
+#ifdef CONFIG_USB_OHCI
 	/* zero and disable FREQ2 */
 	sys_freqctrl = au_readl(SYS_FREQCTRL0);
 	sys_freqctrl &= ~0xFFF00000;
@@ -105,22 +105,18 @@
 #ifdef CONFIG_USB_OHCI
 	sys_clksrc |= ((4<<12) | (0<<11) | (0<<10));
 #endif
-#ifdef CONFIG_AU1X00_USB_DEVICE
-	sys_clksrc |= ((4<<7) | (0<<6) | (0<<5));
-#endif
 	au_writel(sys_clksrc, SYS_CLKSRC);
 
 	// configure pins GPIO[14:9] as GPIO
 	pin_func = au_readl(SYS_PINFUNC) & (u32)(~0x8080);
 
-#ifndef CONFIG_AU1X00_USB_DEVICE
 	// 2nd USB port is USB host
 	pin_func |= 0x8000;
-#endif
+
 	au_writel(pin_func, SYS_PINFUNC);
 	au_writel(0x2800, SYS_TRIOUTCLR);
 	au_writel(0x0030, SYS_OUTPUTCLR);
-#endif // defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
+#endif // defined (CONFIG_USB_OHCI)
 
 	// make gpio 15 an input (for interrupt line)
 	pin_func = au_readl(SYS_PINFUNC) & (u32)(~0x100);
diff --git a/arch/mips/au1000/pb1100/board_setup.c b/arch/mips/au1000/pb1100/board_setup.c
index db27b93..2d1533f 100644
--- a/arch/mips/au1000/pb1100/board_setup.c
+++ b/arch/mips/au1000/pb1100/board_setup.c
@@ -55,7 +55,7 @@
 	au_writel(0, SYS_PININPUTEN);
 	udelay(100);
 
-#if defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
+#ifdef CONFIG_USB_OHCI
 	// configure pins GPIO[14:9] as GPIO
 	pin_func = au_readl(SYS_PINFUNC) & (u32)(~0x80);
 
@@ -92,12 +92,10 @@
 
 	// get USB Functionality pin state (device vs host drive pins)
 	pin_func = au_readl(SYS_PINFUNC) & (u32)(~0x8000);
-#ifndef CONFIG_AU1X00_USB_DEVICE
 	// 2nd USB port is USB host
 	pin_func |= 0x8000;
-#endif
 	au_writel(pin_func, SYS_PINFUNC);
-#endif // defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
+#endif // defined (CONFIG_USB_OHCI)
 
 	/* Enable sys bus clock divider when IDLE state or no bus activity. */
 	au_writel(au_readl(SYS_POWERCTRL) | (0x3 << 5), SYS_POWERCTRL);
diff --git a/arch/mips/au1000/pb1500/board_setup.c b/arch/mips/au1000/pb1500/board_setup.c
index 1a9a293..0ffdb4f 100644
--- a/arch/mips/au1000/pb1500/board_setup.c
+++ b/arch/mips/au1000/pb1500/board_setup.c
@@ -56,7 +56,7 @@
 	au_writel(0, SYS_PINSTATERD);
 	udelay(100);
 
-#if defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
+#ifdef CONFIG_USB_OHCI
 
 	/* GPIO201 is input for PCMCIA card detect */
 	/* GPIO203 is input for PCMCIA interrupt request */
@@ -88,19 +88,14 @@
 #ifdef CONFIG_USB_OHCI
 	sys_clksrc |= ((4<<12) | (0<<11) | (0<<10));
 #endif
-#ifdef CONFIG_AU1X00_USB_DEVICE
-	sys_clksrc |= ((4<<7) | (0<<6) | (0<<5));
-#endif
 	au_writel(sys_clksrc, SYS_CLKSRC);
 
 
 	pin_func = au_readl(SYS_PINFUNC) & (u32)(~0x8000);
-#ifndef CONFIG_AU1X00_USB_DEVICE
 	// 2nd USB port is USB host
 	pin_func |= 0x8000;
-#endif
 	au_writel(pin_func, SYS_PINFUNC);
-#endif // defined (CONFIG_USB_OHCI) || defined (CONFIG_AU1X00_USB_DEVICE)
+#endif // defined (CONFIG_USB_OHCI)
 
 
 
diff --git a/arch/mips/configs/pb1100_defconfig b/arch/mips/configs/pb1100_defconfig
index 741f825..9e672f6 100644
--- a/arch/mips/configs/pb1100_defconfig
+++ b/arch/mips/configs/pb1100_defconfig
@@ -76,7 +76,6 @@
 CONFIG_SOC_AU1100=y
 CONFIG_SOC_AU1X00=y
 CONFIG_SWAP_IO_SPACE=y
-# CONFIG_AU1X00_USB_DEVICE is not set
 CONFIG_MIPS_L1_CACHE_SHIFT=5
 
 #
diff --git a/arch/mips/configs/pb1500_defconfig b/arch/mips/configs/pb1500_defconfig
index 8576340..d0c0f4a 100644
--- a/arch/mips/configs/pb1500_defconfig
+++ b/arch/mips/configs/pb1500_defconfig
@@ -75,7 +75,6 @@
 CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
 CONFIG_SOC_AU1500=y
 CONFIG_SOC_AU1X00=y
-# CONFIG_AU1X00_USB_DEVICE is not set
 CONFIG_MIPS_L1_CACHE_SHIFT=5
 
 #
diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
index 55d60d5..31dd47d 100644
--- a/arch/mips/dec/int-handler.S
+++ b/arch/mips/dec/int-handler.S
@@ -266,10 +266,8 @@
 handle_it:
 		LONG_L	s0, TI_REGS($28)
 		LONG_S	sp, TI_REGS($28)
-		jal	do_IRQ
-		LONG_S	s0, TI_REGS($28)
-
-		j	ret_from_irq
+		PTR_LA	ra, ret_from_irq
+		j	do_IRQ
 		 nop
 
 #ifdef CONFIG_32BIT
@@ -279,9 +277,8 @@
 #endif
 
 spurious:
-		jal	spurious_interrupt
-		 nop
-		j	ret_from_irq
+		PTR_LA	ra, _ret_from_irq
+		j	spurious_interrupt
 		 nop
 		END(plat_irq_dispatch)
 
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 9fbf843..8485af3 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -135,7 +135,6 @@
 	case CPU_R5000:
 	case CPU_NEVADA:
 	case CPU_RM7000:
-	case CPU_RM9000:
 	case CPU_4KC:
 	case CPU_4KEC:
 	case CPU_4KSC:
@@ -164,6 +163,14 @@
 		} else
 			printk(" unavailable.\n");
 		break;
+	case CPU_RM9000:
+		if ((c->processor_id & 0x00ff) >= 0x40) {
+			cpu_wait = r4k_wait;
+			printk(" available.\n");
+		} else {
+			printk(" unavailable.\n");
+		}
+		break;
 	default:
 		printk(" unavailable.\n");
 		break;
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index e93e43e..417c08a 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -20,10 +20,7 @@
 #include <asm/mipsmtregs.h>
 #endif
 
-#ifdef CONFIG_PREEMPT
-	.macro	preempt_stop
-	.endm
-#else
+#ifndef CONFIG_PREEMPT
 	.macro	preempt_stop
 	local_irq_disable
 	.endm
@@ -32,9 +29,16 @@
 
 	.text
 	.align	5
+FEXPORT(ret_from_irq)
+	LONG_S	s0, TI_REGS($28)
+#ifdef CONFIG_PREEMPT
+FEXPORT(ret_from_exception)
+#else
+	b	_ret_from_irq
 FEXPORT(ret_from_exception)
 	preempt_stop
-FEXPORT(ret_from_irq)
+#endif
+FEXPORT(_ret_from_irq)
 	LONG_L	t0, PT_STATUS(sp)		# returning to kernel mode?
 	andi	t0, t0, KU_USER
 	beqz	t0, resume_kernel
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 50ed772..5baca16 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -133,9 +133,8 @@
 
 	LONG_L	s0, TI_REGS($28)
 	LONG_S	sp, TI_REGS($28)
-	jal	plat_irq_dispatch
-	LONG_S	s0, TI_REGS($28)
-	j	ret_from_irq
+	PTR_LA	ra, ret_from_irq
+	j	plat_irq_dispatch
 	END(handle_int)
 
 	__INIT
@@ -224,9 +223,8 @@
 
 	LONG_L	s0, TI_REGS($28)
 	LONG_S	sp, TI_REGS($28)
-	jalr	v0
-	LONG_S	s0, TI_REGS($28)
 	PTR_LA	ra, ret_from_irq
+	jr	v0
 	END(except_vec_vi_handler)
 
 /*
diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
index 46ee5a6..4ed37ba 100644
--- a/arch/mips/kernel/proc.c
+++ b/arch/mips/kernel/proc.c
@@ -107,7 +107,7 @@
 
 	seq_printf(m, "processor\t\t: %ld\n", n);
 	sprintf(fmt, "cpu model\t\t: %%s V%%d.%%d%s\n",
-	        cpu_has_fpu ? "  FPU V%d.%d" : "");
+	        cpu_data[n].options & MIPS_CPU_FPU ? "  FPU V%d.%d" : "");
 	seq_printf(m, fmt, cpu_name[cpu_data[n].cputype <= CPU_LAST ?
 	                            cpu_data[n].cputype : CPU_UNKNOWN],
 	                           (version >> 4) & 0x0f, version & 0x0f,
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 045d987..9f307eb 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -115,7 +115,7 @@
 	status |= KU_USER;
 	regs->cp0_status = status;
 	clear_used_math();
-	lose_fpu();
+	clear_fpu_owner();
 	if (cpu_has_dsp)
 		__init_dsp();
 	regs->cp0_epc = pc;
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 362d172..258d74f 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -106,6 +106,7 @@
 int ptrace_getfpregs (struct task_struct *child, __u32 __user *data)
 {
 	int i;
+	unsigned int tmp;
 
 	if (!access_ok(VERIFY_WRITE, data, 33 * 8))
 		return -EIO;
@@ -121,10 +122,10 @@
 
 	__put_user (child->thread.fpu.fcr31, data + 64);
 
+	preempt_disable();
 	if (cpu_has_fpu) {
-		unsigned int flags, tmp;
+		unsigned int flags;
 
-		preempt_disable();
 		if (cpu_has_mipsmt) {
 			unsigned int vpflags = dvpe();
 			flags = read_c0_status();
@@ -138,11 +139,11 @@
 			__asm__ __volatile__("cfc1\t%0,$0" : "=r" (tmp));
 			write_c0_status(flags);
 		}
-		preempt_enable();
-		__put_user (tmp, data + 65);
 	} else {
-		__put_user ((__u32) 0, data + 65);
+		tmp = 0;
 	}
+	preempt_enable();
+	__put_user (tmp, data + 65);
 
 	return 0;
 }
@@ -245,16 +246,17 @@
 			unsigned int mtflags;
 #endif /* CONFIG_MIPS_MT_SMTC */
 
-			if (!cpu_has_fpu)
+			preempt_disable();
+			if (!cpu_has_fpu) {
+				preempt_enable();
 				break;
+			}
 
 #ifdef CONFIG_MIPS_MT_SMTC
 			/* Read-modify-write of Status must be atomic */
 			local_irq_save(irqflags);
 			mtflags = dmt();
 #endif /* CONFIG_MIPS_MT_SMTC */
-
-			preempt_disable();
 			if (cpu_has_mipsmt) {
 				unsigned int vpflags = dvpe();
 				flags = read_c0_status();
diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
index f40ecd8..d9a39c1 100644
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -175,7 +175,9 @@
 			unsigned int mtflags;
 #endif /* CONFIG_MIPS_MT_SMTC */
 
+			preempt_disable();
 			if (!cpu_has_fpu) {
+				preempt_enable();
 				tmp = 0;
 				break;
 			}
@@ -186,7 +188,6 @@
 			mtflags = dmt();
 #endif /* CONFIG_MIPS_MT_SMTC */
 
-			preempt_disable();
 			if (cpu_has_mipsmt) {
 				unsigned int vpflags = dvpe();
 				flags = read_c0_status();
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 2218958..1af3612 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -467,14 +467,18 @@
 
 static int __init topology_init(void)
 {
-	int cpu;
-	int ret;
+	int i, ret;
 
-	for_each_present_cpu(cpu) {
-		ret = register_cpu(&per_cpu(cpu_devices, cpu), cpu);
+#ifdef CONFIG_NUMA
+	for_each_online_node(i)
+		register_one_node(i);
+#endif /* CONFIG_NUMA */
+
+	for_each_present_cpu(i) {
+		ret = register_cpu(&per_cpu(cpu_devices, i), i);
 		if (ret)
 			printk(KERN_WARNING "topology_init: register_cpu %d "
-			       "failed (%d)\n", cpu, ret);
+			       "failed (%d)\n", i, ret);
 	}
 
 	return 0;
diff --git a/arch/mips/kernel/smtc-asm.S b/arch/mips/kernel/smtc-asm.S
index 76cb31d..1cb9441 100644
--- a/arch/mips/kernel/smtc-asm.S
+++ b/arch/mips/kernel/smtc-asm.S
@@ -97,15 +97,12 @@
 	SAVE_ALL
 	CLI
 	TRACE_IRQS_OFF
-	move	a0,sp
 	/* Function to be invoked passed stack pad slot 5 */
 	lw	t0,PT_PADSLOT5(sp)
 	/* Argument from sender passed in stack pad slot 4 */
-	lw	a1,PT_PADSLOT4(sp)
-	jalr	t0
-	nop
-	j	ret_from_irq
-	nop
+	lw	a0,PT_PADSLOT4(sp)
+	PTR_LA	ra, _ret_from_irq
+	jr	t0
 
 /*
  * Called from idle loop to provoke processing of queued IPIs
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index b7292a5..cce8313 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -66,7 +66,7 @@
 extern asmlinkage void handle_reserved(void);
 
 extern int fpu_emulator_cop1Handler(struct pt_regs *xcp,
-	struct mips_fpu_struct *ctx);
+	struct mips_fpu_struct *ctx, int has_fpu);
 
 void (*board_be_init)(void);
 int (*board_be_handler)(struct pt_regs *regs, int is_fixup);
@@ -641,7 +641,7 @@
 		preempt_enable();
 
 		/* Run the emulator */
-		sig = fpu_emulator_cop1Handler (regs, &current->thread.fpu);
+		sig = fpu_emulator_cop1Handler (regs, &current->thread.fpu, 1);
 
 		preempt_disable();
 
@@ -791,11 +791,13 @@
 			set_used_math();
 		}
 
-		preempt_enable();
-
-		if (!cpu_has_fpu) {
-			int sig = fpu_emulator_cop1Handler(regs,
-						&current->thread.fpu);
+		if (cpu_has_fpu) {
+			preempt_enable();
+		} else {
+			int sig;
+			preempt_enable();
+			sig = fpu_emulator_cop1Handler(regs,
+						&current->thread.fpu, 0);
 			if (sig)
 				force_sig(sig, current);
 #ifdef CONFIG_MIPS_MT_FPAFF
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 3f0d5d2..80531b3 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -38,8 +38,6 @@
 
 #include <asm/inst.h>
 #include <asm/bootinfo.h>
-#include <asm/cpu.h>
-#include <asm/cpu-features.h>
 #include <asm/processor.h>
 #include <asm/ptrace.h>
 #include <asm/signal.h>
@@ -1233,7 +1231,8 @@
 	return 0;
 }
 
-int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx)
+int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+	int has_fpu)
 {
 	unsigned long oldepc, prevepc;
 	mips_instruction insn;
@@ -1263,7 +1262,7 @@
 			ieee754_csr.rm = mips_rm[ieee754_csr.rm];
 		}
 
-		if (cpu_has_fpu)
+		if (has_fpu)
 			break;
 		if (sig)
 			break;
diff --git a/arch/mips/mips-boards/malta/malta_int.c b/arch/mips/mips-boards/malta/malta_int.c
index ed221dc..6244d0e 100644
--- a/arch/mips/mips-boards/malta/malta_int.c
+++ b/arch/mips/mips-boards/malta/malta_int.c
@@ -212,23 +212,23 @@
 	unsigned int a0 = 7;
 	unsigned int t0;
 
-	t0 = s0 & 0xf000;
+	t0 = pending & 0xf000;
 	t0 = t0 < 1;
 	t0 = t0 << 2;
 	a0 = a0 - t0;
-	s0 = s0 << t0;
+	pending = pending << t0;
 
-	t0 = s0 & 0xc000;
+	t0 = pending & 0xc000;
 	t0 = t0 < 1;
 	t0 = t0 << 1;
 	a0 = a0 - t0;
-	s0 = s0 << t0;
+	pending = pending << t0;
 
-	t0 = s0 & 0x8000;
+	t0 = pending & 0x8000;
 	t0 = t0 < 1;
 	//t0 = t0 << 2;
 	a0 = a0 - t0;
-	//s0 = s0 << t0;
+	//pending = pending << t0;
 
 	return a0;
 #endif
diff --git a/arch/mips/tx4927/common/tx4927_setup.c b/arch/mips/tx4927/common/tx4927_setup.c
index 3ace403..4658b2a 100644
--- a/arch/mips/tx4927/common/tx4927_setup.c
+++ b/arch/mips/tx4927/common/tx4927_setup.c
@@ -53,19 +53,9 @@
 void dump_cp0(char *key);
 
 
-void (*__wbflush) (void);
-
-static void tx4927_write_buffer_flush(void)
-{
-	__asm__ __volatile__
-	    ("sync\n\t" "nop\n\t" "loop: bc0f loop\n\t" "nop\n\t");
-}
-
-
 void __init plat_mem_setup(void)
 {
 	board_time_init = tx4927_time_init;
-	__wbflush = tx4927_write_buffer_flush;
 
 #ifdef CONFIG_TOSHIBA_RBTX4927
 	{
diff --git a/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_irq.c b/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_irq.c
index 3e24413..0c3c3f6 100644
--- a/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_irq.c
+++ b/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_irq.c
@@ -129,6 +129,7 @@
 #include <asm/processor.h>
 #include <asm/reboot.h>
 #include <asm/time.h>
+#include <asm/wbflush.h>
 #include <linux/bootmem.h>
 #include <linux/blkdev.h>
 #ifdef CONFIG_RTC_DS1742
diff --git a/arch/mips/tx4938/common/irq.c b/arch/mips/tx4938/common/irq.c
index b602474..77fe245 100644
--- a/arch/mips/tx4938/common/irq.c
+++ b/arch/mips/tx4938/common/irq.c
@@ -30,6 +30,7 @@
 #include <asm/irq.h>
 #include <asm/mipsregs.h>
 #include <asm/system.h>
+#include <asm/wbflush.h>
 #include <asm/tx4938/rbtx4938.h>
 
 /**********************************************************************************/
diff --git a/arch/mips/tx4938/common/setup.c b/arch/mips/tx4938/common/setup.c
index 71859c4f..f415a1f 100644
--- a/arch/mips/tx4938/common/setup.c
+++ b/arch/mips/tx4938/common/setup.c
@@ -41,29 +41,10 @@
 void __init tx4938_time_init(void);
 void dump_cp0(char *key);
 
-void (*__wbflush) (void);
-
-static void
-tx4938_write_buffer_flush(void)
-{
-	mmiowb();
-
-	__asm__ __volatile__(
-		".set	push\n\t"
-		".set	noreorder\n\t"
-		"lw	$0,%0\n\t"
-		"nop\n\t"
-		".set	pop"
-		: /* no output */
-		: "m" (*(int *)KSEG1)
-		: "memory");
-}
-
 void __init
 plat_mem_setup(void)
 {
 	board_time_init = tx4938_time_init;
-	__wbflush = tx4938_write_buffer_flush;
 	toshiba_rbtx4938_setup();
 }
 
diff --git a/arch/mips/tx4938/toshiba_rbtx4938/irq.c b/arch/mips/tx4938/toshiba_rbtx4938/irq.c
index bbb3390..102e473 100644
--- a/arch/mips/tx4938/toshiba_rbtx4938/irq.c
+++ b/arch/mips/tx4938/toshiba_rbtx4938/irq.c
@@ -83,6 +83,7 @@
 #include <asm/processor.h>
 #include <asm/reboot.h>
 #include <asm/time.h>
+#include <asm/wbflush.h>
 #include <linux/bootmem.h>
 #include <asm/tx4938/rbtx4938.h>
 
diff --git a/arch/powerpc/platforms/82xx/mpc82xx.c b/arch/powerpc/platforms/82xx/mpc82xx.c
index 89d702d..0f5b30d 100644
--- a/arch/powerpc/platforms/82xx/mpc82xx.c
+++ b/arch/powerpc/platforms/82xx/mpc82xx.c
@@ -11,7 +11,6 @@
  * option) any later version.
  */
 
-#include <linux/config.h>
 #include <linux/stddef.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/arch/powerpc/platforms/82xx/mpc82xx_ads.c b/arch/powerpc/platforms/82xx/mpc82xx_ads.c
index 0cea42a..bb9acbb 100644
--- a/arch/powerpc/platforms/82xx/mpc82xx_ads.c
+++ b/arch/powerpc/platforms/82xx/mpc82xx_ads.c
@@ -12,8 +12,6 @@
  * option) any later version.
  */
 
-
-#include <linux/config.h>
 #include <linux/stddef.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/arch/powerpc/platforms/82xx/pq2ads.h b/arch/powerpc/platforms/82xx/pq2ads.h
index a734821..fb2f92b 100644
--- a/arch/powerpc/platforms/82xx/pq2ads.h
+++ b/arch/powerpc/platforms/82xx/pq2ads.h
@@ -22,8 +22,6 @@
 #ifndef __MACH_ADS8260_DEFS
 #define __MACH_ADS8260_DEFS
 
-#include <linux/config.h>
-
 #include <asm/ppcboot.h>
 
 /* For our show_cpuinfo hooks. */
diff --git a/arch/powerpc/sysdev/qe_lib/qe_io.c b/arch/powerpc/sysdev/qe_lib/qe_io.c
index aea4359..0afe6bf 100644
--- a/arch/powerpc/sysdev/qe_lib/qe_io.c
+++ b/arch/powerpc/sysdev/qe_lib/qe_io.c
@@ -14,7 +14,6 @@
  * option) any later version.
  */
 
-#include <linux/config.h>
 #include <linux/stddef.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/arch/sparc/kernel/prom.c b/arch/sparc/kernel/prom.c
index 4ca9e5f..2cc302b 100644
--- a/arch/sparc/kernel/prom.c
+++ b/arch/sparc/kernel/prom.c
@@ -243,7 +243,7 @@
 			void *old_val = prop->value;
 			int ret;
 
-			ret = prom_setprop(dp->node, name, val, len);
+			ret = prom_setprop(dp->node, (char *) name, val, len);
 			err = -EINVAL;
 			if (ret >= 0) {
 				prop->value = new_val;
@@ -477,7 +477,10 @@
 			p->length = 0;
 		} else {
 			p->value = prom_early_alloc(p->length + 1);
-			prom_getproperty(node, p->name, p->value, p->length);
+			len = prom_getproperty(node, p->name, p->value,
+					       p->length);
+			if (len <= 0)
+				p->length = 0;
 			((unsigned char *)p->value)[p->length] = '\0';
 		}
 	}
diff --git a/arch/sparc64/defconfig b/arch/sparc64/defconfig
index f54ab37..dcae559 100644
--- a/arch/sparc64/defconfig
+++ b/arch/sparc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18
-# Mon Oct  2 14:24:40 2006
+# Linux kernel version: 2.6.19-rc1
+# Thu Oct  5 02:08:41 2006
 #
 CONFIG_SPARC=y
 CONFIG_SPARC64=y
@@ -197,6 +197,7 @@
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -214,6 +215,7 @@
 CONFIG_INET6_TUNNEL=m
 CONFIG_INET6_XFRM_MODE_TRANSPORT=m
 CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
 CONFIG_IPV6_TUNNEL=m
 # CONFIG_IPV6_SUBTREES is not set
@@ -373,6 +375,7 @@
 # CONFIG_BLK_DEV_CS5530 is not set
 # CONFIG_BLK_DEV_HPT34X is not set
 # CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
 # CONFIG_BLK_DEV_SC1200 is not set
 # CONFIG_BLK_DEV_PIIX is not set
 # CONFIG_BLK_DEV_IT821X is not set
@@ -449,10 +452,10 @@
 # CONFIG_SCSI_INIA100 is not set
 # CONFIG_SCSI_STEX is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
-# CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLOGICPTI is not set
 # CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -478,6 +481,7 @@
 CONFIG_MD_MULTIPATH=m
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
+# CONFIG_DM_DEBUG is not set
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
@@ -840,12 +844,12 @@
 #
 # Misc devices
 #
+# CONFIG_TIFM_CORE is not set
 
 #
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -858,6 +862,7 @@
 #
 # CONFIG_FIRMWARE_EDID is not set
 CONFIG_FB=y
+CONFIG_FB_DDC=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
@@ -1236,6 +1241,7 @@
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -1279,6 +1285,7 @@
 #
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
+# CONFIG_ECRYPT_FS is not set
 # CONFIG_HFS_FS is not set
 # CONFIG_HFSPLUS_FS is not set
 # CONFIG_BEFS_FS is not set
@@ -1355,6 +1362,10 @@
 # CONFIG_NLS_UTF8 is not set
 
 #
+# Distributed Lock Manager
+#
+
+#
 # Instrumentation Support
 #
 CONFIG_PROFILING=y
diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c
index 7f92045..d822c7c 100644
--- a/arch/sparc64/kernel/of_device.c
+++ b/arch/sparc64/kernel/of_device.c
@@ -841,7 +841,7 @@
 	if (!parent)
 		strcpy(op->dev.bus_id, "root");
 	else
-		strcpy(op->dev.bus_id, dp->path_component_name);
+		sprintf(op->dev.bus_id, "%s@%08x", dp->name, dp->node);
 
 	if (of_device_register(op)) {
 		printk("%s: Could not register of device.\n",
diff --git a/arch/um/drivers/pcap_user.h b/arch/um/drivers/pcap_user.h
index 58f9f6a..96b80b5 100644
--- a/arch/um/drivers/pcap_user.h
+++ b/arch/um/drivers/pcap_user.h
@@ -15,7 +15,7 @@
 	void *dev;
 };
 
-extern struct net_user_info pcap_user_info;
+extern const struct net_user_info pcap_user_info;
 
 extern int pcap_user_read(int fd, void *buf, int len, struct pcap_data *pri);
 
diff --git a/arch/x86_64/ia32/ptrace32.c b/arch/x86_64/ia32/ptrace32.c
index d18198e..3a7561d 100644
--- a/arch/x86_64/ia32/ptrace32.c
+++ b/arch/x86_64/ia32/ptrace32.c
@@ -205,9 +205,9 @@
 static long ptrace32_siginfo(unsigned request, u32 pid, u32 addr, u32 data)
 {
 	int ret;
-	compat_siginfo_t *si32 = (compat_siginfo_t *)compat_ptr(data);
+	compat_siginfo_t __user *si32 = compat_ptr(data);
 	siginfo_t ssi; 
-	siginfo_t *si = compat_alloc_user_space(sizeof(siginfo_t));
+	siginfo_t __user *si = compat_alloc_user_space(sizeof(siginfo_t));
 	if (request == PTRACE_SETSIGINFO) {
 		memset(&ssi, 0, sizeof(siginfo_t));
 		ret = copy_siginfo_from_user32(&ssi, si32);
diff --git a/crypto/serpent.c b/crypto/serpent.c
index 465d091..2b0a19a 100644
--- a/crypto/serpent.c
+++ b/crypto/serpent.c
@@ -364,10 +364,10 @@
 {
 	struct serpent_ctx *ctx = crypto_tfm_ctx(tfm);
 	const u32
-		*k = ctx->expkey,
-		*s = (const u32 *)src;
-	u32	*d = (u32 *)dst,
-		r0, r1, r2, r3, r4;
+		*k = ctx->expkey;
+	const __le32 *s = (const __le32 *)src;
+	__le32	*d = (__le32 *)dst;
+	u32	r0, r1, r2, r3, r4;
 
 /*
  * Note: The conversions between u8* and u32* might cause trouble
@@ -423,10 +423,10 @@
 {
 	struct serpent_ctx *ctx = crypto_tfm_ctx(tfm);
 	const u32
-		*k = ((struct serpent_ctx *)ctx)->expkey,
-		*s = (const u32 *)src;
-	u32	*d = (u32 *)dst,
-		r0, r1, r2, r3, r4;
+		*k = ((struct serpent_ctx *)ctx)->expkey;
+	const __le32 *s = (const __le32 *)src;
+	__le32	*d = (__le32 *)dst;
+	u32	r0, r1, r2, r3, r4;
 
 	r0 = le32_to_cpu(s[0]);
 	r1 = le32_to_cpu(s[1]);
diff --git a/drivers/acpi/cm_sbs.c b/drivers/acpi/cm_sbs.c
index a01ce67..4a9b7bf 100644
--- a/drivers/acpi/cm_sbs.c
+++ b/drivers/acpi/cm_sbs.c
@@ -67,7 +67,7 @@
 		lock_ac_dir_cnt--;
 	if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) {
 		remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
-		acpi_ac_dir = 0;
+		acpi_ac_dir = NULL;
 	}
 	mutex_unlock(&cm_sbs_mutex);
 }
@@ -99,7 +99,7 @@
 	if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param
 	    && acpi_battery_dir) {
 		remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
-		acpi_battery_dir = 0;
+		acpi_battery_dir = NULL;
 	}
 	mutex_unlock(&cm_sbs_mutex);
 	return;
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index d636ede..8bcdfa646 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -360,7 +360,7 @@
 static void pdc_pata_cbl_detect(struct ata_port *ap)
 {
 	u8 tmp;
-	void __iomem *mmio = (void *) ap->ioaddr.cmd_addr + PDC_CTLSTAT + 0x03;
+	void __iomem *mmio = (void __iomem *) ap->ioaddr.cmd_addr + PDC_CTLSTAT + 0x03;
 
 	tmp = readb(mmio);
 
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index ae5edb8..ca8d993 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -349,7 +349,7 @@
 
 static void sil_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val)
 {
-	void *mmio = (void __iomem *) sil_scr_addr(ap, sc_reg);
+	void __iomem *mmio = (void __iomem *) sil_scr_addr(ap, sc_reg);
 	if (mmio)
 		writel(val, mmio);
 }
diff --git a/drivers/ata/sata_svw.c b/drivers/ata/sata_svw.c
index 84025a2..db32d15 100644
--- a/drivers/ata/sata_svw.c
+++ b/drivers/ata/sata_svw.c
@@ -177,7 +177,7 @@
 	struct ata_port *ap = qc->ap;
 	unsigned int rw = (qc->tf.flags & ATA_TFLAG_WRITE);
 	u8 dmactl;
-	void *mmio = (void *) ap->ioaddr.bmdma_addr;
+	void __iomem *mmio = (void __iomem *) ap->ioaddr.bmdma_addr;
 	/* load PRD table addr. */
 	mb();	/* make sure PRD table writes are visible to controller */
 	writel(ap->prd_dma, mmio + ATA_DMA_TABLE_OFS);
@@ -205,7 +205,7 @@
 static void k2_bmdma_start_mmio (struct ata_queued_cmd *qc)
 {
 	struct ata_port *ap = qc->ap;
-	void *mmio = (void *) ap->ioaddr.bmdma_addr;
+	void __iomem *mmio = (void __iomem *) ap->ioaddr.bmdma_addr;
 	u8 dmactl;
 
 	/* start host DMA transaction */
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index d6bb8da..beab6d2 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -295,7 +295,7 @@
  * and do_lo_send_write().
  */
 static int __do_lo_send_write(struct file *file,
-		u8 __user *buf, const int len, loff_t pos)
+		u8 *buf, const int len, loff_t pos)
 {
 	ssize_t bw;
 	mm_segment_t old_fs = get_fs();
@@ -324,7 +324,7 @@
 		struct bio_vec *bvec, int bsize, loff_t pos, struct page *page)
 {
 	ssize_t bw = __do_lo_send_write(lo->lo_backing_file,
-			(u8 __user *)kmap(bvec->bv_page) + bvec->bv_offset,
+			kmap(bvec->bv_page) + bvec->bv_offset,
 			bvec->bv_len, pos);
 	kunmap(bvec->bv_page);
 	cond_resched();
@@ -351,7 +351,7 @@
 			bvec->bv_offset, bvec->bv_len, pos >> 9);
 	if (likely(!ret))
 		return __do_lo_send_write(lo->lo_backing_file,
-				(u8 __user *)page_address(page), bvec->bv_len,
+				page_address(page), bvec->bv_len,
 				pos);
 	printk(KERN_ERR "loop: Transfer error at byte offset %llu, "
 			"length %i.\n", (unsigned long long)pos, bvec->bv_len);
@@ -1187,7 +1187,7 @@
  * - noinlined to reduce stack space usage in main part of driver
  */
 static noinline int
-loop_info64_from_compat(const struct compat_loop_info *arg,
+loop_info64_from_compat(const struct compat_loop_info __user *arg,
 			struct loop_info64 *info64)
 {
 	struct compat_loop_info info;
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 2a0c50d..7ea0f48f 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -703,7 +703,7 @@
 {
 	struct packet_command cgc;
 	char buffer[16];
-	__u16 *feature_code;
+	__be16 *feature_code;
 	int ret;
 
 	init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
@@ -716,7 +716,7 @@
 	if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
 		return ret;
 
-	feature_code = (__u16 *) &buffer[sizeof(struct feature_header)];
+	feature_code = (__be16 *) &buffer[sizeof(struct feature_header)];
 	if (be16_to_cpu(*feature_code) == CDF_HWDM)
 		return 0;
 
@@ -2963,7 +2963,7 @@
 		   how much data is available for transfer. buffer[1] is
 		   unfortunately ambigious and the only reliable way seem
 		   to be to simply skip over the block descriptor... */
-		offset = 8 + be16_to_cpu(*(unsigned short *)(buffer+6));
+		offset = 8 + be16_to_cpu(*(__be16 *)(buffer+6));
 
 		if (offset + 16 > sizeof(buffer))
 			return -E2BIG;
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index d6e0315..ffdf9df 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -686,37 +686,37 @@
 static void	stli_ecpinit(stlibrd_t *brdp);
 static void	stli_ecpenable(stlibrd_t *brdp);
 static void	stli_ecpdisable(stlibrd_t *brdp);
-static char	*stli_ecpgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_ecpgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_ecpreset(stlibrd_t *brdp);
 static void	stli_ecpintr(stlibrd_t *brdp);
 static void	stli_ecpeiinit(stlibrd_t *brdp);
 static void	stli_ecpeienable(stlibrd_t *brdp);
 static void	stli_ecpeidisable(stlibrd_t *brdp);
-static char	*stli_ecpeigetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_ecpeigetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_ecpeireset(stlibrd_t *brdp);
 static void	stli_ecpmcenable(stlibrd_t *brdp);
 static void	stli_ecpmcdisable(stlibrd_t *brdp);
-static char	*stli_ecpmcgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_ecpmcgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_ecpmcreset(stlibrd_t *brdp);
 static void	stli_ecppciinit(stlibrd_t *brdp);
-static char	*stli_ecppcigetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_ecppcigetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_ecppcireset(stlibrd_t *brdp);
 
 static void	stli_onbinit(stlibrd_t *brdp);
 static void	stli_onbenable(stlibrd_t *brdp);
 static void	stli_onbdisable(stlibrd_t *brdp);
-static char	*stli_onbgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_onbgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_onbreset(stlibrd_t *brdp);
 static void	stli_onbeinit(stlibrd_t *brdp);
 static void	stli_onbeenable(stlibrd_t *brdp);
 static void	stli_onbedisable(stlibrd_t *brdp);
-static char	*stli_onbegetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_onbegetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_onbereset(stlibrd_t *brdp);
 static void	stli_bbyinit(stlibrd_t *brdp);
-static char	*stli_bbygetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_bbygetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_bbyreset(stlibrd_t *brdp);
 static void	stli_stalinit(stlibrd_t *brdp);
-static char	*stli_stalgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
+static void __iomem *stli_stalgetmemptr(stlibrd_t *brdp, unsigned long offset, int line);
 static void	stli_stalreset(stlibrd_t *brdp);
 
 static stliport_t *stli_getport(int brdnr, int panelnr, int portnr);
@@ -1566,7 +1566,7 @@
 
 	len = MIN(len, cooksize);
 	count = 0;
-	shbuf = (char *) EBRDGETMEMPTR(brdp, portp->txoffset);
+	shbuf = EBRDGETMEMPTR(brdp, portp->txoffset);
 	buf = stli_txcookbuf;
 
 	while (len > 0) {
@@ -2948,9 +2948,9 @@
 
 /*****************************************************************************/
 
-static char *stli_ecpgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_ecpgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
-	void *ptr;
+	void __iomem *ptr;
 	unsigned char val;
 
 	if (offset > brdp->memsize) {
@@ -3022,9 +3022,9 @@
 
 /*****************************************************************************/
 
-static char *stli_ecpeigetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_ecpeigetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
-	void		*ptr;
+	void __iomem *ptr;
 	unsigned char	val;
 
 	if (offset > brdp->memsize) {
@@ -3074,9 +3074,9 @@
 
 /*****************************************************************************/
 
-static char *stli_ecpmcgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_ecpmcgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
-	void *ptr;
+	void __iomem *ptr;
 	unsigned char val;
 
 	if (offset > brdp->memsize) {
@@ -3119,9 +3119,9 @@
 
 /*****************************************************************************/
 
-static char *stli_ecppcigetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_ecppcigetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
-	void		*ptr;
+	void __iomem *ptr;
 	unsigned char	val;
 
 	if (offset > brdp->memsize) {
@@ -3185,9 +3185,9 @@
 
 /*****************************************************************************/
 
-static char *stli_onbgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_onbgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
-	void	*ptr;
+	void __iomem *ptr;
 
 	if (offset > brdp->memsize) {
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
@@ -3250,9 +3250,9 @@
 
 /*****************************************************************************/
 
-static char *stli_onbegetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_onbegetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
-	void *ptr;
+	void __iomem *ptr;
 	unsigned char val;
 
 	if (offset > brdp->memsize) {
@@ -3300,9 +3300,9 @@
 
 /*****************************************************************************/
 
-static char *stli_bbygetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_bbygetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
-	void *ptr;
+	void __iomem *ptr;
 	unsigned char val;
 
 	BUG_ON(offset > brdp->memsize);
@@ -3337,7 +3337,7 @@
 
 /*****************************************************************************/
 
-static char *stli_stalgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
+static void __iomem *stli_stalgetmemptr(stlibrd_t *brdp, unsigned long offset, int line)
 {	
 	BUG_ON(offset > brdp->memsize);
 	return brdp->membase + (offset % STAL_PAGESIZE);
@@ -3876,7 +3876,7 @@
 			continue;
 
 		if (brdp->brdtype == BRD_ECPE) {
-			ecpsigp = (cdkecpsig_t __iomem *) stli_ecpeigetmemptr(brdp,
+			ecpsigp = stli_ecpeigetmemptr(brdp,
 				CDK_SIGADDR, __LINE__);
 			memcpy_fromio(&ecpsig, ecpsigp, sizeof(cdkecpsig_t));
 			if (ecpsig.magic == cpu_to_le32(ECP_MAGIC))
@@ -4184,7 +4184,7 @@
 static ssize_t stli_memread(struct file *fp, char __user *buf, size_t count, loff_t *offp)
 {
 	unsigned long flags;
-	void *memptr;
+	void __iomem *memptr;
 	stlibrd_t *brdp;
 	int brdnr, size, n;
 	void *p;
@@ -4214,7 +4214,7 @@
 	while (size > 0) {
 		spin_lock_irqsave(&brd_lock, flags);
 		EBRDENABLE(brdp);
-		memptr = (void *) EBRDGETMEMPTR(brdp, off);
+		memptr = EBRDGETMEMPTR(brdp, off);
 		n = MIN(size, (brdp->pagesize - (((unsigned long) off) % brdp->pagesize)));
 		n = MIN(n, PAGE_SIZE);
 		memcpy_fromio(p, memptr, n);
@@ -4247,7 +4247,7 @@
 static ssize_t stli_memwrite(struct file *fp, const char __user *buf, size_t count, loff_t *offp)
 {
 	unsigned long flags;
-	void *memptr;
+	void __iomem *memptr;
 	stlibrd_t *brdp;
 	char __user *chbuf;
 	int brdnr, size, n;
@@ -4287,7 +4287,7 @@
 		}
 		spin_lock_irqsave(&brd_lock, flags);
 		EBRDENABLE(brdp);
-		memptr = (void *) EBRDGETMEMPTR(brdp, off);
+		memptr = EBRDGETMEMPTR(brdp, off);
 		memcpy_toio(memptr, p, n);
 		EBRDDISABLE(brdp);
 		spin_unlock_irqrestore(&brd_lock, flags);
diff --git a/drivers/char/qtronix.c b/drivers/char/qtronix.c
deleted file mode 100644
index 5c94777..0000000
--- a/drivers/char/qtronix.c
+++ /dev/null
@@ -1,605 +0,0 @@
-/*
- *
- * BRIEF MODULE DESCRIPTION
- *	Qtronix 990P infrared keyboard driver.
- *
- *
- * Copyright 2001 MontaVista Software Inc.
- * Author: MontaVista Software, Inc.
- *         	ppopov@mvista.com or source@mvista.com
- *
- *
- *  The bottom portion of this driver was take from 
- *  pc_keyb.c  Please see that file for copyrights.
- *
- *  This program is free software; you can redistribute  it and/or modify it
- *  under  the terms of  the GNU General  Public License as published by the
- *  Free Software Foundation;  either version 2 of the  License, or (at your
- *  option) any later version.
- *
- *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
- *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
- *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
- *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
- *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
- *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
- *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-
-/* 
- * NOTE:  
- *
- *	This driver has only been tested with the Consumer IR
- *	port of the ITE 8172 system controller.
- *
- *	You do not need this driver if you are using the ps/2 or
- *	USB adapter that the keyboard ships with.  You only need 
- *	this driver if your board has a IR port and the keyboard
- *	data is being sent directly to the IR.  In that case,
- *	you also need some low-level IR support. See it8172_cir.c.
- *	
- */
-
-#ifdef CONFIG_QTRONIX_KEYBOARD
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/pci.h>
-#include <linux/kernel.h>
-
-#include <asm/it8172/it8172.h>
-#include <asm/it8172/it8172_int.h>
-#include <asm/it8172/it8172_cir.h>
-
-#include <linux/spinlock.h>
-#include <linux/sched.h>
-#include <linux/interrupt.h>
-#include <linux/tty.h>
-#include <linux/mm.h>
-#include <linux/signal.h>
-#include <linux/init.h>
-#include <linux/kbd_ll.h>
-#include <linux/delay.h>
-#include <linux/poll.h>
-#include <linux/miscdevice.h>
-#include <linux/slab.h>
-#include <linux/kbd_kern.h>
-#include <linux/smp_lock.h>
-#include <asm/io.h>
-#include <linux/pc_keyb.h>
-
-#include <asm/keyboard.h>
-#include <linux/bitops.h>
-#include <asm/uaccess.h>
-#include <asm/irq.h>
-#include <asm/system.h>
-
-#define leading1 0
-#define leading2 0xF
-
-#define KBD_CIR_PORT 0
-#define AUX_RECONNECT 170 /* scancode when ps2 device is plugged (back) in */
-
-static int data_index;
-struct cir_port *cir;
-static unsigned char kbdbytes[5];
-static unsigned char cir_data[32]; /* we only need 16 chars */
-
-static void kbd_int_handler(int irq, void *dev_id);
-static int handle_data(unsigned char *p_data);
-static inline void handle_mouse_event(unsigned char scancode);
-static inline void handle_keyboard_event(unsigned char scancode, int down);
-static int __init psaux_init(void);
-
-static struct aux_queue *queue;	/* Mouse data buffer. */
-static int aux_count = 0;
-
-/*
- * Keys accessed through the 'Fn' key
- * The Fn key does not produce a key-up sequence. So, the first
- * time the user presses it, it will be key-down event. The key
- * stays down until the user presses it again.
- */
-#define NUM_FN_KEYS 56
-static unsigned char fn_keys[NUM_FN_KEYS] = {
-	0,0,0,0,0,0,0,0,        /* 0 7   */
-	8,9,10,93,0,0,0,0,      /* 8 15  */
-	0,0,0,0,0,0,0,5,        /* 16 23 */
-	6,7,91,0,0,0,0,0,       /* 24 31 */
-	0,0,0,0,0,2,3,4,        /* 32 39 */
-	92,0,0,0,0,0,0,0,       /* 40 47 */
-	0,0,0,0,11,0,94,95        /* 48 55 */
-
-};
-
-void __init init_qtronix_990P_kbd(void)
-{
-	int retval;
-
-	cir = (struct cir_port *)kmalloc(sizeof(struct cir_port), GFP_KERNEL);
-	if (!cir) {
-		printk("Unable to initialize Qtronix keyboard\n");
-		return;
-	}
-
-	/* 
-	 * revisit
-	 * this should be programmable, somehow by the, by the user.
-	 */
-	cir->port = KBD_CIR_PORT;
-	cir->baud_rate = 0x1d;
-	cir->rdwos = 0;
-	cir->rxdcr = 0x3;
-	cir->hcfs = 0;
-	cir->fifo_tl = 0;
-	cir->cfq = 0x1d;
-	cir_port_init(cir);
-
-	retval = request_irq(IT8172_CIR0_IRQ, kbd_int_handler, 
-			(unsigned long )(IRQF_DISABLED|IRQF_SHARED),
-			(const char *)"Qtronix IR Keyboard", (void *)cir);
-
-	if (retval) {
-		printk("unable to allocate cir %d irq %d\n", 
-				cir->port, IT8172_CIR0_IRQ);
-	}
-#ifdef CONFIG_PSMOUSE
-	psaux_init();
-#endif
-}
-
-static inline unsigned char BitReverse(unsigned short key)
-{
-	unsigned char rkey = 0;
-	rkey |= (key & 0x1) << 7;
-	rkey |= (key & 0x2) << 5;
-	rkey |= (key & 0x4) << 3;
-	rkey |= (key & 0x8) << 1;
-	rkey |= (key & 0x10) >> 1;
-	rkey |= (key & 0x20) >> 3;
-	rkey |= (key & 0x40) >> 5;
-	rkey |= (key & 0x80) >> 7;
-	return rkey;
-
-}
-
-
-static inline u_int8_t UpperByte(u_int8_t data)
-{
-	return (data >> 4);
-}
-
-
-static inline u_int8_t LowerByte(u_int8_t data)
-{
-	return (data & 0xF);
-}
-
-
-int CheckSumOk(u_int8_t byte1, u_int8_t byte2, 
-		u_int8_t byte3, u_int8_t byte4, u_int8_t byte5)
-{
-	u_int8_t CheckSum;
-
-	CheckSum = (byte1 & 0x0F) + byte2 + byte3 + byte4 + byte5;
-	if ( LowerByte(UpperByte(CheckSum) + LowerByte(CheckSum)) != UpperByte(byte1) )
-		return 0;
-	else
-		return 1;
-}
-
-
-static void kbd_int_handler(int irq, void *dev_id)
-{
-	struct cir_port *cir;
-	int j;
-	unsigned char int_status;
-
-	cir = (struct cir_port *)dev_id;
-	int_status = get_int_status(cir);
-	if (int_status & 0x4) {
-		clear_fifo(cir);
-		return;
-	}
-
-	while (cir_get_rx_count(cir)) {
-
-		cir_data[data_index] = cir_read_data(cir);
-
-		if (data_index == 0) {/* expecting first byte */
-			if (cir_data[data_index] != leading1) {
-				//printk("!leading byte %x\n", cir_data[data_index]);
-				set_rx_active(cir);
-				clear_fifo(cir);
-				continue;
-			}
-		}
-		if (data_index == 1) {
-			if ((cir_data[data_index] & 0xf) != leading2) {
-				set_rx_active(cir);
-				data_index = 0; /* start over */
-				clear_fifo(cir);
-				continue;
-			}
-		}
-
-		if ( (cir_data[data_index] == 0xff)) { /* last byte */
-			//printk("data_index %d\n", data_index);
-			set_rx_active(cir);
-#if 0
-			for (j=0; j<=data_index; j++) {
-				printk("rx_data %d:  %x\n", j, cir_data[j]);
-			}
-#endif
-			data_index = 0;
-			handle_data(cir_data);
-			return;
-		}
-		else if (data_index>16) {
-			set_rx_active(cir);
-#if 0
-			printk("warning: data_index %d\n", data_index);
-			for (j=0; j<=data_index; j++) {
-				printk("rx_data %d:  %x\n", j, cir_data[j]);
-			}
-#endif
-			data_index = 0;
-			clear_fifo(cir);
-			return;
-		}
-		data_index++;
-	}
-}
-
-
-#define NUM_KBD_BYTES 5
-static int handle_data(unsigned char *p_data)
-{
-	u_int32_t bit_bucket;
-	u_int32_t i, j;
-	u_int32_t got_bits, next_byte;
-	int down = 0;
-
-	/* Reorganize the bit stream */
-	for (i=0; i<16; i++)
-		p_data[i] = BitReverse(~p_data[i]);
-
-	/* 
-	 * We've already previously checked that p_data[0]
-	 * is equal to leading1 and that (p_data[1] & 0xf)
-	 * is equal to leading2. These twelve bits are the
-	 * leader code.  We can now throw them away (the 12
-	 * bits) and continue parsing the stream.
-	 */
-	bit_bucket = p_data[1] << 12;
-	got_bits = 4;
-	next_byte = 2;
-
-	/* 
-	 * Process four bits at a time
-	 */
-	for (i=0; i<NUM_KBD_BYTES; i++) {
-
-		kbdbytes[i]=0;
-
-		for (j=0; j<8; j++) /* 8 bits per byte */
-		{
-			if (got_bits < 4) {
-				bit_bucket |= (p_data[next_byte++] << (8 - got_bits));
-				got_bits += 8;
-			}
-
-			if ((bit_bucket & 0xF000) == 0x8000) { 
-				/* Convert 1000b to 1 */
-				kbdbytes[i] = 0x80 | (kbdbytes[i] >> 1);
-				got_bits -= 4;
-				bit_bucket = bit_bucket << 4;
-			}
-			else if ((bit_bucket & 0xC000) == 0x8000) {
-				/* Convert 10b to 0 */
-				kbdbytes[i] =  kbdbytes[i] >> 1;
-				got_bits -= 2;
-				bit_bucket = bit_bucket << 2;
-			}
-			else {
-				/* bad serial stream */
-				return 1;
-			}
-
-			if (next_byte > 16) {
-				//printk("error: too many bytes\n");
-				return 1;
-			}
-		}
-	}
-
-
-	if (!CheckSumOk(kbdbytes[0], kbdbytes[1], 
-				kbdbytes[2], kbdbytes[3], kbdbytes[4])) {
-		//printk("checksum failed\n");
-		return 1;
-	}
-
-	if (kbdbytes[1] & 0x08) {
-		//printk("m: %x %x %x\n", kbdbytes[1], kbdbytes[2], kbdbytes[3]);
-		handle_mouse_event(kbdbytes[1]);
-		handle_mouse_event(kbdbytes[2]);
-		handle_mouse_event(kbdbytes[3]);
-	}
-	else {
-		if (kbdbytes[2] == 0) down = 1;
-#if 0
-		if (down)
-			printk("down %d\n", kbdbytes[3]);
-		else
-			printk("up %d\n", kbdbytes[3]);
-#endif
-		handle_keyboard_event(kbdbytes[3], down);
-	}
-	return 0;
-}
-
-
-DEFINE_SPINLOCK(kbd_controller_lock);
-static unsigned char handle_kbd_event(void);
-
-
-int kbd_setkeycode(unsigned int scancode, unsigned int keycode)
-{
-	printk("kbd_setkeycode scancode %x keycode %x\n", scancode, keycode);
-	return 0;
-}
-
-int kbd_getkeycode(unsigned int scancode)
-{
-	return scancode;
-}
-
-
-int kbd_translate(unsigned char scancode, unsigned char *keycode,
-		    char raw_mode)
-{
-	static int prev_scancode = 0;
-
-	if (scancode == 0x00 || scancode == 0xff) {
-		prev_scancode = 0;
-		return 0;
-	}
-
-	/* todo */
-	if (!prev_scancode && scancode == 160) { /* Fn key down */
-		//printk("Fn key down\n");
-		prev_scancode = 160;
-		return 0;
-	}
-	else if (prev_scancode && scancode == 160) { /* Fn key up */
-		//printk("Fn key up\n");
-		prev_scancode = 0;
-		return 0;
-	}
-
-	/* todo */
-	if (prev_scancode == 160) {
-		if (scancode <= NUM_FN_KEYS) {
-			*keycode = fn_keys[scancode];
-			//printk("fn keycode %d\n", *keycode);
-		}
-		else
-			return 0;
-	} 
-	else if (scancode <= 127) {
-		*keycode = scancode;
-	}
-	else
-		return 0;
-
-
- 	return 1;
-}
-
-char kbd_unexpected_up(unsigned char keycode)
-{
-	//printk("kbd_unexpected_up\n");
-	return 0;
-}
-
-static unsigned char kbd_exists = 1;
-
-static inline void handle_keyboard_event(unsigned char scancode, int down)
-{
-	kbd_exists = 1;
-	handle_scancode(scancode, down);
-	tasklet_schedule(&keyboard_tasklet);
-}	
-
-
-void kbd_leds(unsigned char leds)
-{
-}
-
-/* dummy */
-void kbd_init_hw(void)
-{
-}
-
-
-
-static inline void handle_mouse_event(unsigned char scancode)
-{
-	if(scancode == AUX_RECONNECT){
-		queue->head = queue->tail = 0;  /* Flush input queue */
-	//	__aux_write_ack(AUX_ENABLE_DEV);  /* ping the mouse :) */
-		return;
-	}
-
-	if (aux_count) {
-		int head = queue->head;
-
-		queue->buf[head] = scancode;
-		head = (head + 1) & (AUX_BUF_SIZE-1);
-		if (head != queue->tail) {
-			queue->head = head;
-			kill_fasync(&queue->fasync, SIGIO, POLL_IN);
-			wake_up_interruptible(&queue->proc_list);
-		}
-	}
-}
-
-static unsigned char get_from_queue(void)
-{
-	unsigned char result;
-	unsigned long flags;
-
-	spin_lock_irqsave(&kbd_controller_lock, flags);
-	result = queue->buf[queue->tail];
-	queue->tail = (queue->tail + 1) & (AUX_BUF_SIZE-1);
-	spin_unlock_irqrestore(&kbd_controller_lock, flags);
-	return result;
-}
-
-
-static inline int queue_empty(void)
-{
-	return queue->head == queue->tail;
-}
-
-static int fasync_aux(int fd, struct file *filp, int on)
-{
-	int retval;
-
-	//printk("fasync_aux\n");
-	retval = fasync_helper(fd, filp, on, &queue->fasync);
-	if (retval < 0)
-		return retval;
-	return 0;
-}
-
-
-/*
- * Random magic cookie for the aux device
- */
-#define AUX_DEV ((void *)queue)
-
-static int release_aux(struct inode * inode, struct file * file)
-{
-	fasync_aux(-1, file, 0);
-	aux_count--;
-	return 0;
-}
-
-static int open_aux(struct inode * inode, struct file * file)
-{
-	if (aux_count++) {
-		return 0;
-	}
-	queue->head = queue->tail = 0;		/* Flush input queue */
-	return 0;
-}
-
-/*
- * Put bytes from input queue to buffer.
- */
-
-static ssize_t read_aux(struct file * file, char * buffer,
-			size_t count, loff_t *ppos)
-{
-	DECLARE_WAITQUEUE(wait, current);
-	ssize_t i = count;
-	unsigned char c;
-
-	if (queue_empty()) {
-		if (file->f_flags & O_NONBLOCK)
-			return -EAGAIN;
-		add_wait_queue(&queue->proc_list, &wait);
-repeat:
-		set_current_state(TASK_INTERRUPTIBLE);
-		if (queue_empty() && !signal_pending(current)) {
-			schedule();
-			goto repeat;
-		}
-		current->state = TASK_RUNNING;
-		remove_wait_queue(&queue->proc_list, &wait);
-	}
-	while (i > 0 && !queue_empty()) {
-		c = get_from_queue();
-		put_user(c, buffer++);
-		i--;
-	}
-	if (count-i) {
-		struct inode *inode = file->f_dentry->d_inode;
-		inode->i_atime = current_fs_time(inode->i_sb);
-		return count-i;
-	}
-	if (signal_pending(current))
-		return -ERESTARTSYS;
-	return 0;
-}
-
-/*
- * Write to the aux device.
- */
-
-static ssize_t write_aux(struct file * file, const char * buffer,
-			 size_t count, loff_t *ppos)
-{
-	/*
-	 * The ITE boards this was tested on did not have the
-	 * transmit wires connected.
-	 */
-	return count;
-}
-
-static unsigned int aux_poll(struct file *file, poll_table * wait)
-{
-	poll_wait(file, &queue->proc_list, wait);
-	if (!queue_empty())
-		return POLLIN | POLLRDNORM;
-	return 0;
-}
-
-struct file_operations psaux_fops = {
-	.read		= read_aux,
-	.write		= write_aux,
-	.poll		= aux_poll,
-	.open		= open_aux,
-	.release	= release_aux,
-	.fasync		= fasync_aux,
-};
-
-/*
- * Initialize driver.
- */
-static struct miscdevice psaux_mouse = {
-	PSMOUSE_MINOR, "psaux", &psaux_fops
-};
-
-static int __init psaux_init(void)
-{
-	int retval;
-
-	retval = misc_register(&psaux_mouse);
-	if(retval < 0)
-		return retval;
-
-	queue = (struct aux_queue *) kmalloc(sizeof(*queue), GFP_KERNEL);
-	if (!queue) {
-		misc_deregister(&psaux_mouse);
-		return -ENOMEM;
-	}
-		
-	memset(queue, 0, sizeof(*queue));
-	queue->head = queue->tail = 0;
-	init_waitqueue_head(&queue->proc_list);
-
-	return 0;
-}
-module_init(init_qtronix_990P_kbd);
-#endif
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index abee7a3..66a7385 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -35,13 +35,13 @@
  *	1.09a	Pete Zaitcev: Sun SPARC
  *	1.09b	Jeff Garzik: Modularize, init cleanup
  *	1.09c	Jeff Garzik: SMP cleanup
- *	1.10    Paul Barton-Davis: add support for async I/O
+ *	1.10	Paul Barton-Davis: add support for async I/O
  *	1.10a	Andrea Arcangeli: Alpha updates
  *	1.10b	Andrew Morton: SMP lock fix
  *	1.10c	Cesar Barros: SMP locking fixes and cleanup
  *	1.10d	Paul Gortmaker: delete paranoia check in rtc_exit
  *	1.10e	Maciej W. Rozycki: Handle DECstation's year weirdness.
- *      1.11    Takashi Iwai: Kernel access functions
+ *	1.11	Takashi Iwai: Kernel access functions
  *			      rtc_register/rtc_unregister/rtc_control
  *      1.11a   Daniele Bellucci: Audit create_proc_read_entry in rtc_init
  *	1.12	Venkatesh Pallipadi: Hooks for emulating rtc on HPET base-timer
diff --git a/drivers/dma/ioatdma.c b/drivers/dma/ioatdma.c
index f3bf1e2..0358419 100644
--- a/drivers/dma/ioatdma.c
+++ b/drivers/dma/ioatdma.c
@@ -80,7 +80,7 @@
 
 static struct ioat_desc_sw *ioat_dma_alloc_descriptor(
 	struct ioat_dma_chan *ioat_chan,
-	int flags)
+	gfp_t flags)
 {
 	struct ioat_dma_descriptor *desc;
 	struct ioat_desc_sw *desc_sw;
@@ -686,7 +686,7 @@
 {
 	int err;
 	unsigned long mmio_start, mmio_len;
-	void *reg_base;
+	void __iomem *reg_base;
 	struct ioat_device *device;
 
 	err = pci_enable_device(pdev);
diff --git a/drivers/dma/ioatdma.h b/drivers/dma/ioatdma.h
index a5d3b36..62b26a9 100644
--- a/drivers/dma/ioatdma.h
+++ b/drivers/dma/ioatdma.h
@@ -44,7 +44,7 @@
 
 struct ioat_device {
 	struct pci_dev *pdev;
-	void *reg_base;
+	void __iomem *reg_base;
 	struct pci_pool *dma_pool;
 	struct pci_pool *completion_pool;
 
@@ -73,7 +73,7 @@
 
 struct ioat_dma_chan {
 
-	void *reg_base;
+	void __iomem *reg_base;
 
 	dma_cookie_t completed_cookie;
 	unsigned long last_completion;
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index f35fcc4..25b1018 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -75,6 +75,7 @@
 	struct rb_root remote_sidr_table;
 	struct idr local_id_table;
 	__be32 random_id_operand;
+	struct list_head timewait_list;
 	struct workqueue_struct *wq;
 } cm;
 
@@ -112,6 +113,7 @@
 
 struct cm_timewait_info {
 	struct cm_work work;			/* Must be first. */
+	struct list_head list;
 	struct rb_node remote_qp_node;
 	struct rb_node remote_id_node;
 	__be64 remote_ca_guid;
@@ -647,13 +649,6 @@
 
 static void cm_cleanup_timewait(struct cm_timewait_info *timewait_info)
 {
-	unsigned long flags;
-
-	if (!timewait_info->inserted_remote_id &&
-	    !timewait_info->inserted_remote_qp)
-	    return;
-
-	spin_lock_irqsave(&cm.lock, flags);
 	if (timewait_info->inserted_remote_id) {
 		rb_erase(&timewait_info->remote_id_node, &cm.remote_id_table);
 		timewait_info->inserted_remote_id = 0;
@@ -663,7 +658,6 @@
 		rb_erase(&timewait_info->remote_qp_node, &cm.remote_qp_table);
 		timewait_info->inserted_remote_qp = 0;
 	}
-	spin_unlock_irqrestore(&cm.lock, flags);
 }
 
 static struct cm_timewait_info * cm_create_timewait_info(__be32 local_id)
@@ -684,8 +678,12 @@
 static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
 {
 	int wait_time;
+	unsigned long flags;
 
+	spin_lock_irqsave(&cm.lock, flags);
 	cm_cleanup_timewait(cm_id_priv->timewait_info);
+	list_add_tail(&cm_id_priv->timewait_info->list, &cm.timewait_list);
+	spin_unlock_irqrestore(&cm.lock, flags);
 
 	/*
 	 * The cm_id could be destroyed by the user before we exit timewait.
@@ -701,9 +699,13 @@
 
 static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
 {
+	unsigned long flags;
+
 	cm_id_priv->id.state = IB_CM_IDLE;
 	if (cm_id_priv->timewait_info) {
+		spin_lock_irqsave(&cm.lock, flags);
 		cm_cleanup_timewait(cm_id_priv->timewait_info);
+		spin_unlock_irqrestore(&cm.lock, flags);
 		kfree(cm_id_priv->timewait_info);
 		cm_id_priv->timewait_info = NULL;
 	}
@@ -1307,6 +1309,7 @@
 	if (timewait_info) {
 		cur_cm_id_priv = cm_get_id(timewait_info->work.local_id,
 					   timewait_info->work.remote_id);
+		cm_cleanup_timewait(cm_id_priv->timewait_info);
 		spin_unlock_irqrestore(&cm.lock, flags);
 		if (cur_cm_id_priv) {
 			cm_dup_req_handler(work, cur_cm_id_priv);
@@ -1315,7 +1318,8 @@
 			cm_issue_rej(work->port, work->mad_recv_wc,
 				     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REQ,
 				     NULL, 0);
-		goto error;
+		listen_cm_id_priv = NULL;
+		goto out;
 	}
 
 	/* Find matching listen request. */
@@ -1323,21 +1327,20 @@
 					   req_msg->service_id,
 					   req_msg->private_data);
 	if (!listen_cm_id_priv) {
+		cm_cleanup_timewait(cm_id_priv->timewait_info);
 		spin_unlock_irqrestore(&cm.lock, flags);
 		cm_issue_rej(work->port, work->mad_recv_wc,
 			     IB_CM_REJ_INVALID_SERVICE_ID, CM_MSG_RESPONSE_REQ,
 			     NULL, 0);
-		goto error;
+		goto out;
 	}
 	atomic_inc(&listen_cm_id_priv->refcount);
 	atomic_inc(&cm_id_priv->refcount);
 	cm_id_priv->id.state = IB_CM_REQ_RCVD;
 	atomic_inc(&cm_id_priv->work_count);
 	spin_unlock_irqrestore(&cm.lock, flags);
+out:
 	return listen_cm_id_priv;
-
-error:	cm_cleanup_timewait(cm_id_priv->timewait_info);
-	return NULL;
 }
 
 static int cm_req_handler(struct cm_work *work)
@@ -1899,6 +1902,32 @@
 }
 EXPORT_SYMBOL(ib_send_cm_drep);
 
+static int cm_issue_drep(struct cm_port *port,
+			 struct ib_mad_recv_wc *mad_recv_wc)
+{
+	struct ib_mad_send_buf *msg = NULL;
+	struct cm_dreq_msg *dreq_msg;
+	struct cm_drep_msg *drep_msg;
+	int ret;
+
+	ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
+	if (ret)
+		return ret;
+
+	dreq_msg = (struct cm_dreq_msg *) mad_recv_wc->recv_buf.mad;
+	drep_msg = (struct cm_drep_msg *) msg->mad;
+
+	cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, dreq_msg->hdr.tid);
+	drep_msg->remote_comm_id = dreq_msg->local_comm_id;
+	drep_msg->local_comm_id = dreq_msg->remote_comm_id;
+
+	ret = ib_post_send_mad(msg, NULL);
+	if (ret)
+		cm_free_msg(msg);
+
+	return ret;
+}
+
 static int cm_dreq_handler(struct cm_work *work)
 {
 	struct cm_id_private *cm_id_priv;
@@ -1910,8 +1939,10 @@
 	dreq_msg = (struct cm_dreq_msg *)work->mad_recv_wc->recv_buf.mad;
 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
 				   dreq_msg->local_comm_id);
-	if (!cm_id_priv)
+	if (!cm_id_priv) {
+		cm_issue_drep(work->port, work->mad_recv_wc);
 		return -EINVAL;
+	}
 
 	work->cm_event.private_data = &dreq_msg->private_data;
 
@@ -2601,28 +2632,29 @@
 {
 	struct cm_timewait_info *timewait_info;
 	struct cm_id_private *cm_id_priv;
-	unsigned long flags;
 	int ret;
 
 	timewait_info = (struct cm_timewait_info *)work;
-	cm_cleanup_timewait(timewait_info);
+	spin_lock_irq(&cm.lock);
+	list_del(&timewait_info->list);
+	spin_unlock_irq(&cm.lock);
 
 	cm_id_priv = cm_acquire_id(timewait_info->work.local_id,
 				   timewait_info->work.remote_id);
 	if (!cm_id_priv)
 		return -EINVAL;
 
-	spin_lock_irqsave(&cm_id_priv->lock, flags);
+	spin_lock_irq(&cm_id_priv->lock);
 	if (cm_id_priv->id.state != IB_CM_TIMEWAIT ||
 	    cm_id_priv->remote_qpn != timewait_info->remote_qpn) {
-		spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+		spin_unlock_irq(&cm_id_priv->lock);
 		goto out;
 	}
 	cm_id_priv->id.state = IB_CM_IDLE;
 	ret = atomic_inc_and_test(&cm_id_priv->work_count);
 	if (!ret)
 		list_add_tail(&work->list, &cm_id_priv->work_list);
-	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+	spin_unlock_irq(&cm_id_priv->lock);
 
 	if (ret)
 		cm_process_work(cm_id_priv, work);
@@ -3374,6 +3406,7 @@
 	idr_init(&cm.local_id_table);
 	get_random_bytes(&cm.random_id_operand, sizeof cm.random_id_operand);
 	idr_pre_get(&cm.local_id_table, GFP_KERNEL);
+	INIT_LIST_HEAD(&cm.timewait_list);
 
 	cm.wq = create_workqueue("ib_cm");
 	if (!cm.wq)
@@ -3391,7 +3424,20 @@
 
 static void __exit ib_cm_cleanup(void)
 {
+	struct cm_timewait_info *timewait_info, *tmp;
+
+	spin_lock_irq(&cm.lock);
+	list_for_each_entry(timewait_info, &cm.timewait_list, list)
+		cancel_delayed_work(&timewait_info->work.work);
+	spin_unlock_irq(&cm.lock);
+
 	destroy_workqueue(cm.wq);
+
+	list_for_each_entry_safe(timewait_info, tmp, &cm.timewait_list, list) {
+		list_del(&timewait_info->list);
+		kfree(timewait_info);
+	}
+
 	ib_unregister_client(&cm_client);
 	idr_destroy(&cm.local_id_table);
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_ae.c b/drivers/infiniband/hw/amso1100/c2_ae.c
index 3aae497..a31439b 100644
--- a/drivers/infiniband/hw/amso1100/c2_ae.c
+++ b/drivers/infiniband/hw/amso1100/c2_ae.c
@@ -66,7 +66,6 @@
 	}
 }
 
-#ifdef DEBUG
 static const char* to_event_str(int event)
 {
 	static const char* event_str[] = {
@@ -144,7 +143,6 @@
 		return "<invalid QP state>";
 	};
 }
-#endif
 
 void c2_ae_event(struct c2_dev *c2dev, u32 mq_index)
 {
diff --git a/drivers/infiniband/hw/amso1100/c2_qp.c b/drivers/infiniband/hw/amso1100/c2_qp.c
index 1226113..5bcf697 100644
--- a/drivers/infiniband/hw/amso1100/c2_qp.c
+++ b/drivers/infiniband/hw/amso1100/c2_qp.c
@@ -35,6 +35,8 @@
  *
  */
 
+#include <linux/delay.h>
+
 #include "c2.h"
 #include "c2_vq.h"
 #include "c2_status.h"
@@ -705,10 +707,8 @@
 	 * cannot get on the bus and the card and system hang in a
 	 * deadlock -- thus the need for this code. [TOT]
 	 */
-	while (readl(c2dev->regs + PCI_BAR0_ADAPTER_HINT) & 0x80000000) {
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(0);
-	}
+	while (readl(c2dev->regs + PCI_BAR0_ADAPTER_HINT) & 0x80000000)
+		udelay(10);
 
 	__raw_writel(C2_HINT_MAKE(mq_index, shared),
 		     c2dev->regs + PCI_BAR0_ADAPTER_HINT);
@@ -766,6 +766,7 @@
 	struct c2_dev *c2dev = to_c2dev(ibqp->device);
 	struct c2_qp *qp = to_c2qp(ibqp);
 	union c2wr wr;
+	unsigned long lock_flags;
 	int err = 0;
 
 	u32 flags;
@@ -881,8 +882,10 @@
 		/*
 		 * Post the puppy!
 		 */
+		spin_lock_irqsave(&qp->lock, lock_flags);
 		err = qp_wr_post(&qp->sq_mq, &wr, qp, msg_size);
 		if (err) {
+			spin_unlock_irqrestore(&qp->lock, lock_flags);
 			break;
 		}
 
@@ -890,6 +893,7 @@
 		 * Enqueue mq index to activity FIFO.
 		 */
 		c2_activity(c2dev, qp->sq_mq.index, qp->sq_mq.hint_count);
+		spin_unlock_irqrestore(&qp->lock, lock_flags);
 
 		ib_wr = ib_wr->next;
 	}
@@ -905,6 +909,7 @@
 	struct c2_dev *c2dev = to_c2dev(ibqp->device);
 	struct c2_qp *qp = to_c2qp(ibqp);
 	union c2wr wr;
+	unsigned long lock_flags;
 	int err = 0;
 
 	if (qp->state > IB_QPS_RTS)
@@ -945,8 +950,10 @@
 			break;
 		}
 
+		spin_lock_irqsave(&qp->lock, lock_flags);
 		err = qp_wr_post(&qp->rq_mq, &wr, qp, qp->rq_mq.msg_size);
 		if (err) {
+			spin_unlock_irqrestore(&qp->lock, lock_flags);
 			break;
 		}
 
@@ -954,6 +961,7 @@
 		 * Enqueue mq index to activity FIFO
 		 */
 		c2_activity(c2dev, qp->rq_mq.index, qp->rq_mq.hint_count);
+		spin_unlock_irqrestore(&qp->lock, lock_flags);
 
 		ib_wr = ib_wr->next;
 	}
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 981fe2e..fc67f78 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -179,6 +179,8 @@
 	props->max_mtu           = out_mad->data[41] & 0xf;
 	props->active_mtu        = out_mad->data[36] >> 4;
 	props->subnet_timeout    = out_mad->data[51] & 0x1f;
+	props->max_vl_num        = out_mad->data[37] >> 4;
+	props->init_type_reply   = out_mad->data[41] >> 4;
 
  out:
 	kfree(in_mad);
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 0f316c8..92a72f5 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -201,6 +201,8 @@
 
 	if (mthca_is_memfree(dev))
 		srq->max = roundup_pow_of_two(srq->max + 1);
+	else
+		srq->max = srq->max + 1;
 
 	ds = max(64UL,
 		 roundup_pow_of_two(sizeof (struct mthca_next_seg) +
@@ -277,7 +279,7 @@
 	srq->first_free = 0;
 	srq->last_free  = srq->max - 1;
 
-	attr->max_wr    = (mthca_is_memfree(dev)) ? srq->max - 1 : srq->max;
+	attr->max_wr    = srq->max - 1;
 	attr->max_sge   = srq->max_gs;
 
 	return 0;
@@ -413,7 +415,7 @@
 		srq_attr->srq_limit = be16_to_cpu(tavor_ctx->limit_watermark);
 	}
 
-	srq_attr->max_wr  = (mthca_is_memfree(dev)) ? srq->max - 1 : srq->max;
+	srq_attr->max_wr  = srq->max - 1;
 	srq_attr->max_sge = srq->max_gs;
 
 out:
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index f426a69..8bf5e9e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -355,6 +355,11 @@
 	tx_req->skb = skb;
 	addr = dma_map_single(priv->ca->dma_device, skb->data, skb->len,
 			      DMA_TO_DEVICE);
+	if (unlikely(dma_mapping_error(addr))) {
+		++priv->stats.tx_errors;
+		dev_kfree_skb_any(skb);
+		return;
+	}
 	pci_unmap_addr_set(tx_req, mapping, addr);
 
 	if (unlikely(post_send(priv, priv->tx_head & (ipoib_sendq_size - 1),
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 44b9e5b..4b09147 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -343,29 +343,32 @@
 	 */
 	if (target->io_class == SRP_REV10_IB_IO_CLASS) {
 		memcpy(req->priv.initiator_port_id,
-		       target->srp_host->initiator_port_id + 8, 8);
+		       &target->path.sgid.global.interface_id, 8);
 		memcpy(req->priv.initiator_port_id + 8,
-		       target->srp_host->initiator_port_id, 8);
+		       &target->initiator_ext, 8);
 		memcpy(req->priv.target_port_id,     &target->ioc_guid, 8);
 		memcpy(req->priv.target_port_id + 8, &target->id_ext, 8);
 	} else {
 		memcpy(req->priv.initiator_port_id,
-		       target->srp_host->initiator_port_id, 16);
+		       &target->initiator_ext, 8);
+		memcpy(req->priv.initiator_port_id + 8,
+		       &target->path.sgid.global.interface_id, 8);
 		memcpy(req->priv.target_port_id,     &target->id_ext, 8);
 		memcpy(req->priv.target_port_id + 8, &target->ioc_guid, 8);
 	}
 
 	/*
 	 * Topspin/Cisco SRP targets will reject our login unless we
-	 * zero out the first 8 bytes of our initiator port ID.  The
-	 * second 8 bytes must be our local node GUID, but we always
-	 * use that anyway.
+	 * zero out the first 8 bytes of our initiator port ID and set
+	 * the second 8 bytes to the local node GUID.
 	 */
 	if (topspin_workarounds && !memcmp(&target->ioc_guid, topspin_oui, 3)) {
 		printk(KERN_DEBUG PFX "Topspin/Cisco initiator port ID workaround "
 		       "activated for target GUID %016llx\n",
 		       (unsigned long long) be64_to_cpu(target->ioc_guid));
 		memset(req->priv.initiator_port_id, 0, 8);
+		memcpy(req->priv.initiator_port_id + 8,
+		       &target->srp_host->dev->dev->node_guid, 8);
 	}
 
 	status = ib_send_cm_req(target->cm_id, &req->param);
@@ -1553,6 +1556,7 @@
 	SRP_OPT_MAX_SECT	= 1 << 5,
 	SRP_OPT_MAX_CMD_PER_LUN	= 1 << 6,
 	SRP_OPT_IO_CLASS	= 1 << 7,
+	SRP_OPT_INITIATOR_EXT	= 1 << 8,
 	SRP_OPT_ALL		= (SRP_OPT_ID_EXT	|
 				   SRP_OPT_IOC_GUID	|
 				   SRP_OPT_DGID		|
@@ -1569,6 +1573,7 @@
 	{ SRP_OPT_MAX_SECT,		"max_sect=%d" 		},
 	{ SRP_OPT_MAX_CMD_PER_LUN,	"max_cmd_per_lun=%d" 	},
 	{ SRP_OPT_IO_CLASS,		"io_class=%x"		},
+	{ SRP_OPT_INITIATOR_EXT,	"initiator_ext=%s"	},
 	{ SRP_OPT_ERR,			NULL 			}
 };
 
@@ -1668,6 +1673,12 @@
 			target->io_class = token;
 			break;
 
+		case SRP_OPT_INITIATOR_EXT:
+			p = match_strdup(args);
+			target->initiator_ext = cpu_to_be64(simple_strtoull(p, NULL, 16));
+			kfree(p);
+			break;
+
 		default:
 			printk(KERN_WARNING PFX "unknown parameter or missing value "
 			       "'%s' in target creation request\n", p);
@@ -1708,7 +1719,6 @@
 	target_host->max_lun = SRP_MAX_LUN;
 
 	target = host_to_target(target_host);
-	memset(target, 0, sizeof *target);
 
 	target->io_class   = SRP_REV16A_IB_IO_CLASS;
 	target->scsi_host  = target_host;
@@ -1815,9 +1825,6 @@
 	host->dev  = device;
 	host->port = port;
 
-	host->initiator_port_id[7] = port;
-	memcpy(host->initiator_port_id + 8, &device->dev->node_guid, 8);
-
 	host->class_dev.class = &srp_class;
 	host->class_dev.dev   = device->dev->dma_device;
 	snprintf(host->class_dev.class_id, BUS_ID_SIZE, "srp-%s-%d",
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index 5b581fb..d4e35ef 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -91,7 +91,6 @@
 };
 
 struct srp_host {
-	u8			initiator_port_id[16];
 	struct srp_device      *dev;
 	u8			port;
 	struct class_device	class_dev;
@@ -122,6 +121,7 @@
 	__be64			id_ext;
 	__be64			ioc_guid;
 	__be64			service_id;
+	__be64			initiator_ext;
 	u16			io_class;
 	struct srp_host	       *srp_host;
 	struct Scsi_Host       *scsi_host;
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 20df657..2a461dde4 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -174,7 +174,7 @@
 
 	route.input = INPUT(dev->ctl_input)->vmux;
 	route.output = 0;
-	em28xx_i2c_call_clients(dev, VIDIOC_INT_RESET, 0);
+	em28xx_i2c_call_clients(dev, VIDIOC_INT_RESET, NULL);
 	em28xx_i2c_call_clients(dev, VIDIOC_INT_S_VIDEO_ROUTING, &route);
 	em28xx_i2c_call_clients(dev, VIDIOC_STREAMON, NULL);
 
diff --git a/drivers/mmc/sdhci.c b/drivers/mmc/sdhci.c
index 6d02434..9a7d39b 100644
--- a/drivers/mmc/sdhci.c
+++ b/drivers/mmc/sdhci.c
@@ -1329,7 +1329,7 @@
 	tasklet_init(&host->finish_tasklet,
 		sdhci_tasklet_finish, (unsigned long)host);
 
-	setup_timer(&host->timer, sdhci_timeout_timer, (long)host);
+	setup_timer(&host->timer, sdhci_timeout_timer, (unsigned long)host);
 
 	ret = request_irq(host->irq, sdhci_irq, IRQF_SHARED,
 		host->slot_descr, host);
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index bc7cc71..d171776 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -62,7 +62,7 @@
 	}
 
 	if (info->map.virt != NULL)
-		iounmap((void *)info->map.virt);
+		iounmap(info->map.virt);
 
 	if (info->res != NULL) {
 		release_resource(info->res);
diff --git a/drivers/mtd/nand/cs553x_nand.c b/drivers/mtd/nand/cs553x_nand.c
index e0a1d38..94924d5 100644
--- a/drivers/mtd/nand/cs553x_nand.c
+++ b/drivers/mtd/nand/cs553x_nand.c
@@ -249,7 +249,7 @@
 	goto out;
 
 out_ior:
-	iounmap((void *)this->IO_ADDR_R);
+	iounmap(this->IO_ADDR_R);
 out_mtd:
 	kfree(new_mtd);
 out:
diff --git a/drivers/net/chelsio/cpl5_cmd.h b/drivers/net/chelsio/cpl5_cmd.h
index 27925e4..5b357d9 100644
--- a/drivers/net/chelsio/cpl5_cmd.h
+++ b/drivers/net/chelsio/cpl5_cmd.h
@@ -108,7 +108,7 @@
 	u8 iff:4;
 #endif
 	u16 vlan;
-	u32 len;
+	__be32 len;
 
 	u32 rsvd2;
 	u8 rsvd3;
@@ -119,7 +119,7 @@
 	u8 ip_hdr_words:4;
 	u8 tcp_hdr_words:4;
 #endif
-	u16 eth_type_mss;
+	__be16 eth_type_mss;
 };
 
 struct cpl_rx_pkt {
@@ -138,7 +138,7 @@
 	u8 iff:4;
 #endif
 	u16 csum;
-	u16 vlan;
+	__be16 vlan;
 	u16 len;
 };
 
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 72f52dc..12b719f 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -116,179 +116,179 @@
 /* The statistics block of Xena */
 typedef struct stat_block {
 /* Tx MAC statistics counters. */
-	u32 tmac_data_octets;
-	u32 tmac_frms;
-	u64 tmac_drop_frms;
-	u32 tmac_bcst_frms;
-	u32 tmac_mcst_frms;
-	u64 tmac_pause_ctrl_frms;
-	u32 tmac_ucst_frms;
-	u32 tmac_ttl_octets;
-	u32 tmac_any_err_frms;
-	u32 tmac_nucst_frms;
-	u64 tmac_ttl_less_fb_octets;
-	u64 tmac_vld_ip_octets;
-	u32 tmac_drop_ip;
-	u32 tmac_vld_ip;
-	u32 tmac_rst_tcp;
-	u32 tmac_icmp;
-	u64 tmac_tcp;
-	u32 reserved_0;
-	u32 tmac_udp;
+	__le32 tmac_data_octets;
+	__le32 tmac_frms;
+	__le64 tmac_drop_frms;
+	__le32 tmac_bcst_frms;
+	__le32 tmac_mcst_frms;
+	__le64 tmac_pause_ctrl_frms;
+	__le32 tmac_ucst_frms;
+	__le32 tmac_ttl_octets;
+	__le32 tmac_any_err_frms;
+	__le32 tmac_nucst_frms;
+	__le64 tmac_ttl_less_fb_octets;
+	__le64 tmac_vld_ip_octets;
+	__le32 tmac_drop_ip;
+	__le32 tmac_vld_ip;
+	__le32 tmac_rst_tcp;
+	__le32 tmac_icmp;
+	__le64 tmac_tcp;
+	__le32 reserved_0;
+	__le32 tmac_udp;
 
 /* Rx MAC Statistics counters. */
-	u32 rmac_data_octets;
-	u32 rmac_vld_frms;
-	u64 rmac_fcs_err_frms;
-	u64 rmac_drop_frms;
-	u32 rmac_vld_bcst_frms;
-	u32 rmac_vld_mcst_frms;
-	u32 rmac_out_rng_len_err_frms;
-	u32 rmac_in_rng_len_err_frms;
-	u64 rmac_long_frms;
-	u64 rmac_pause_ctrl_frms;
-	u64 rmac_unsup_ctrl_frms;
-	u32 rmac_accepted_ucst_frms;
-	u32 rmac_ttl_octets;
-	u32 rmac_discarded_frms;
-	u32 rmac_accepted_nucst_frms;
-	u32 reserved_1;
-	u32 rmac_drop_events;
-	u64 rmac_ttl_less_fb_octets;
-	u64 rmac_ttl_frms;
-	u64 reserved_2;
-	u32 rmac_usized_frms;
-	u32 reserved_3;
-	u32 rmac_frag_frms;
-	u32 rmac_osized_frms;
-	u32 reserved_4;
-	u32 rmac_jabber_frms;
-	u64 rmac_ttl_64_frms;
-	u64 rmac_ttl_65_127_frms;
-	u64 reserved_5;
-	u64 rmac_ttl_128_255_frms;
-	u64 rmac_ttl_256_511_frms;
-	u64 reserved_6;
-	u64 rmac_ttl_512_1023_frms;
-	u64 rmac_ttl_1024_1518_frms;
-	u32 rmac_ip;
-	u32 reserved_7;
-	u64 rmac_ip_octets;
-	u32 rmac_drop_ip;
-	u32 rmac_hdr_err_ip;
-	u32 reserved_8;
-	u32 rmac_icmp;
-	u64 rmac_tcp;
-	u32 rmac_err_drp_udp;
-	u32 rmac_udp;
-	u64 rmac_xgmii_err_sym;
-	u64 rmac_frms_q0;
-	u64 rmac_frms_q1;
-	u64 rmac_frms_q2;
-	u64 rmac_frms_q3;
-	u64 rmac_frms_q4;
-	u64 rmac_frms_q5;
-	u64 rmac_frms_q6;
-	u64 rmac_frms_q7;
-	u16 rmac_full_q3;
-	u16 rmac_full_q2;
-	u16 rmac_full_q1;
-	u16 rmac_full_q0;
-	u16 rmac_full_q7;
-	u16 rmac_full_q6;
-	u16 rmac_full_q5;
-	u16 rmac_full_q4;
-	u32 reserved_9;
-	u32 rmac_pause_cnt;
-	u64 rmac_xgmii_data_err_cnt;
-	u64 rmac_xgmii_ctrl_err_cnt;
-	u32 rmac_err_tcp;
-	u32 rmac_accepted_ip;
+	__le32 rmac_data_octets;
+	__le32 rmac_vld_frms;
+	__le64 rmac_fcs_err_frms;
+	__le64 rmac_drop_frms;
+	__le32 rmac_vld_bcst_frms;
+	__le32 rmac_vld_mcst_frms;
+	__le32 rmac_out_rng_len_err_frms;
+	__le32 rmac_in_rng_len_err_frms;
+	__le64 rmac_long_frms;
+	__le64 rmac_pause_ctrl_frms;
+	__le64 rmac_unsup_ctrl_frms;
+	__le32 rmac_accepted_ucst_frms;
+	__le32 rmac_ttl_octets;
+	__le32 rmac_discarded_frms;
+	__le32 rmac_accepted_nucst_frms;
+	__le32 reserved_1;
+	__le32 rmac_drop_events;
+	__le64 rmac_ttl_less_fb_octets;
+	__le64 rmac_ttl_frms;
+	__le64 reserved_2;
+	__le32 rmac_usized_frms;
+	__le32 reserved_3;
+	__le32 rmac_frag_frms;
+	__le32 rmac_osized_frms;
+	__le32 reserved_4;
+	__le32 rmac_jabber_frms;
+	__le64 rmac_ttl_64_frms;
+	__le64 rmac_ttl_65_127_frms;
+	__le64 reserved_5;
+	__le64 rmac_ttl_128_255_frms;
+	__le64 rmac_ttl_256_511_frms;
+	__le64 reserved_6;
+	__le64 rmac_ttl_512_1023_frms;
+	__le64 rmac_ttl_1024_1518_frms;
+	__le32 rmac_ip;
+	__le32 reserved_7;
+	__le64 rmac_ip_octets;
+	__le32 rmac_drop_ip;
+	__le32 rmac_hdr_err_ip;
+	__le32 reserved_8;
+	__le32 rmac_icmp;
+	__le64 rmac_tcp;
+	__le32 rmac_err_drp_udp;
+	__le32 rmac_udp;
+	__le64 rmac_xgmii_err_sym;
+	__le64 rmac_frms_q0;
+	__le64 rmac_frms_q1;
+	__le64 rmac_frms_q2;
+	__le64 rmac_frms_q3;
+	__le64 rmac_frms_q4;
+	__le64 rmac_frms_q5;
+	__le64 rmac_frms_q6;
+	__le64 rmac_frms_q7;
+	__le16 rmac_full_q3;
+	__le16 rmac_full_q2;
+	__le16 rmac_full_q1;
+	__le16 rmac_full_q0;
+	__le16 rmac_full_q7;
+	__le16 rmac_full_q6;
+	__le16 rmac_full_q5;
+	__le16 rmac_full_q4;
+	__le32 reserved_9;
+	__le32 rmac_pause_cnt;
+	__le64 rmac_xgmii_data_err_cnt;
+	__le64 rmac_xgmii_ctrl_err_cnt;
+	__le32 rmac_err_tcp;
+	__le32 rmac_accepted_ip;
 
 /* PCI/PCI-X Read transaction statistics. */
-	u32 new_rd_req_cnt;
-	u32 rd_req_cnt;
-	u32 rd_rtry_cnt;
-	u32 new_rd_req_rtry_cnt;
+	__le32 new_rd_req_cnt;
+	__le32 rd_req_cnt;
+	__le32 rd_rtry_cnt;
+	__le32 new_rd_req_rtry_cnt;
 
 /* PCI/PCI-X Write/Read transaction statistics. */
-	u32 wr_req_cnt;
-	u32 wr_rtry_rd_ack_cnt;
-	u32 new_wr_req_rtry_cnt;
-	u32 new_wr_req_cnt;
-	u32 wr_disc_cnt;
-	u32 wr_rtry_cnt;
+	__le32 wr_req_cnt;
+	__le32 wr_rtry_rd_ack_cnt;
+	__le32 new_wr_req_rtry_cnt;
+	__le32 new_wr_req_cnt;
+	__le32 wr_disc_cnt;
+	__le32 wr_rtry_cnt;
 
 /*	PCI/PCI-X Write / DMA Transaction statistics. */
-	u32 txp_wr_cnt;
-	u32 rd_rtry_wr_ack_cnt;
-	u32 txd_wr_cnt;
-	u32 txd_rd_cnt;
-	u32 rxd_wr_cnt;
-	u32 rxd_rd_cnt;
-	u32 rxf_wr_cnt;
-	u32 txf_rd_cnt;
+	__le32 txp_wr_cnt;
+	__le32 rd_rtry_wr_ack_cnt;
+	__le32 txd_wr_cnt;
+	__le32 txd_rd_cnt;
+	__le32 rxd_wr_cnt;
+	__le32 rxd_rd_cnt;
+	__le32 rxf_wr_cnt;
+	__le32 txf_rd_cnt;
 
 /* Tx MAC statistics overflow counters. */
-	u32 tmac_data_octets_oflow;
-	u32 tmac_frms_oflow;
-	u32 tmac_bcst_frms_oflow;
-	u32 tmac_mcst_frms_oflow;
-	u32 tmac_ucst_frms_oflow;
-	u32 tmac_ttl_octets_oflow;
-	u32 tmac_any_err_frms_oflow;
-	u32 tmac_nucst_frms_oflow;
-	u64 tmac_vlan_frms;
-	u32 tmac_drop_ip_oflow;
-	u32 tmac_vld_ip_oflow;
-	u32 tmac_rst_tcp_oflow;
-	u32 tmac_icmp_oflow;
-	u32 tpa_unknown_protocol;
-	u32 tmac_udp_oflow;
-	u32 reserved_10;
-	u32 tpa_parse_failure;
+	__le32 tmac_data_octets_oflow;
+	__le32 tmac_frms_oflow;
+	__le32 tmac_bcst_frms_oflow;
+	__le32 tmac_mcst_frms_oflow;
+	__le32 tmac_ucst_frms_oflow;
+	__le32 tmac_ttl_octets_oflow;
+	__le32 tmac_any_err_frms_oflow;
+	__le32 tmac_nucst_frms_oflow;
+	__le64 tmac_vlan_frms;
+	__le32 tmac_drop_ip_oflow;
+	__le32 tmac_vld_ip_oflow;
+	__le32 tmac_rst_tcp_oflow;
+	__le32 tmac_icmp_oflow;
+	__le32 tpa_unknown_protocol;
+	__le32 tmac_udp_oflow;
+	__le32 reserved_10;
+	__le32 tpa_parse_failure;
 
 /* Rx MAC Statistics overflow counters. */
-	u32 rmac_data_octets_oflow;
-	u32 rmac_vld_frms_oflow;
-	u32 rmac_vld_bcst_frms_oflow;
-	u32 rmac_vld_mcst_frms_oflow;
-	u32 rmac_accepted_ucst_frms_oflow;
-	u32 rmac_ttl_octets_oflow;
-	u32 rmac_discarded_frms_oflow;
-	u32 rmac_accepted_nucst_frms_oflow;
-	u32 rmac_usized_frms_oflow;
-	u32 rmac_drop_events_oflow;
-	u32 rmac_frag_frms_oflow;
-	u32 rmac_osized_frms_oflow;
-	u32 rmac_ip_oflow;
-	u32 rmac_jabber_frms_oflow;
-	u32 rmac_icmp_oflow;
-	u32 rmac_drop_ip_oflow;
-	u32 rmac_err_drp_udp_oflow;
-	u32 rmac_udp_oflow;
-	u32 reserved_11;
-	u32 rmac_pause_cnt_oflow;
-	u64 rmac_ttl_1519_4095_frms;
-	u64 rmac_ttl_4096_8191_frms;
-	u64 rmac_ttl_8192_max_frms;
-	u64 rmac_ttl_gt_max_frms;
-	u64 rmac_osized_alt_frms;
-	u64 rmac_jabber_alt_frms;
-	u64 rmac_gt_max_alt_frms;
-	u64 rmac_vlan_frms;
-	u32 rmac_len_discard;
-	u32 rmac_fcs_discard;
-	u32 rmac_pf_discard;
-	u32 rmac_da_discard;
-	u32 rmac_red_discard;
-	u32 rmac_rts_discard;
-	u32 reserved_12;
-	u32 rmac_ingm_full_discard;
-	u32 reserved_13;
-	u32 rmac_accepted_ip_oflow;
-	u32 reserved_14;
-	u32 link_fault_cnt;
+	__le32 rmac_data_octets_oflow;
+	__le32 rmac_vld_frms_oflow;
+	__le32 rmac_vld_bcst_frms_oflow;
+	__le32 rmac_vld_mcst_frms_oflow;
+	__le32 rmac_accepted_ucst_frms_oflow;
+	__le32 rmac_ttl_octets_oflow;
+	__le32 rmac_discarded_frms_oflow;
+	__le32 rmac_accepted_nucst_frms_oflow;
+	__le32 rmac_usized_frms_oflow;
+	__le32 rmac_drop_events_oflow;
+	__le32 rmac_frag_frms_oflow;
+	__le32 rmac_osized_frms_oflow;
+	__le32 rmac_ip_oflow;
+	__le32 rmac_jabber_frms_oflow;
+	__le32 rmac_icmp_oflow;
+	__le32 rmac_drop_ip_oflow;
+	__le32 rmac_err_drp_udp_oflow;
+	__le32 rmac_udp_oflow;
+	__le32 reserved_11;
+	__le32 rmac_pause_cnt_oflow;
+	__le64 rmac_ttl_1519_4095_frms;
+	__le64 rmac_ttl_4096_8191_frms;
+	__le64 rmac_ttl_8192_max_frms;
+	__le64 rmac_ttl_gt_max_frms;
+	__le64 rmac_osized_alt_frms;
+	__le64 rmac_jabber_alt_frms;
+	__le64 rmac_gt_max_alt_frms;
+	__le64 rmac_vlan_frms;
+	__le32 rmac_len_discard;
+	__le32 rmac_fcs_discard;
+	__le32 rmac_pf_discard;
+	__le32 rmac_da_discard;
+	__le32 rmac_red_discard;
+	__le32 rmac_rts_discard;
+	__le32 reserved_12;
+	__le32 rmac_ingm_full_discard;
+	__le32 reserved_13;
+	__le32 rmac_accepted_ip_oflow;
+	__le32 reserved_14;
+	__le32 link_fault_cnt;
 	u8  buffer[20];
 	swStat_t sw_stat;
 	xpakStat_t xpak_stat;
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 862a411..c88babc 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -1987,7 +1987,7 @@
 		sbale = &(adapter->response_queue.buffer[i]->element[0]);
 		sbale->length = 0;
 		sbale->flags = SBAL_FLAGS_LAST_ENTRY;
-		sbale->addr = 0;
+		sbale->addr = NULL;
 	}
 
 	ZFCP_LOG_TRACE("calling do_QDIO on adapter %s (flags=0x%x, "
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index 2f69876..81ba2d7 100644
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -630,7 +630,7 @@
 	case OPROMPATH2NODE:
 		if ((file->f_mode & FMODE_READ) == 0)
 			return -EPERM;
-		return openprom_sunos_ioctl(inode, file, cmd, arg, 0);
+		return openprom_sunos_ioctl(inode, file, cmd, arg, NULL);
 
 	case OPIOCGET:
 	case OPIOCNEXTPROP:
diff --git a/drivers/sbus/char/uctrl.c b/drivers/sbus/char/uctrl.c
index ddc0681..b30372f 100644
--- a/drivers/sbus/char/uctrl.c
+++ b/drivers/sbus/char/uctrl.c
@@ -400,7 +400,7 @@
 	}
 
 	driver->regs->uctrl_intr = UCTRL_INTR_RXNE_REQ|UCTRL_INTR_RXNE_MSK;
-	printk("uctrl: 0x%x (irq %d)\n", driver->regs, driver->irq);
+	printk("uctrl: 0x%p (irq %d)\n", driver->regs, driver->irq);
 	uctrl_get_event_status();
 	uctrl_get_external_status();
         return 0;
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 8369541..2b34435 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -3881,7 +3881,7 @@
     /*
      * The following fields are used only for Wide Boards.
      */
-    void                 *ioremap_addr;         /* I/O Memory remap address. */
+    void                 __iomem *ioremap_addr; /* I/O Memory remap address. */
     ushort               ioport;                /* I/O Port address. */
     ADV_CARR_T           *orig_carrp;           /* ADV_CARR_T memory block. */
     adv_req_t            *orig_reqp;            /* adv_req_t memory block. */
@@ -3951,7 +3951,7 @@
 
 /* Number of boards detected in system. */
 STATIC int asc_board_count = 0;
-STATIC struct Scsi_Host    *asc_host[ASC_NUM_BOARD_SUPPORTED] = { 0 };
+STATIC struct Scsi_Host    *asc_host[ASC_NUM_BOARD_SUPPORTED] = { NULL };
 
 /* Overrun buffer used by all narrow boards. */
 STATIC uchar overrun_buf[ASC_OVERRUN_BSIZE] = { 0 };
@@ -6621,7 +6621,7 @@
 	        dma_map_single(dev, scp->request_buffer,
 			       scp->request_bufflen, scp->sc_data_direction);
 	} else {
-	    scsiqp->vdata_addr = 0;
+	    scsiqp->vdata_addr = NULL;
 	    scp->SCp.dma_handle = 0;
 	}
 	scsiqp->data_addr = cpu_to_le32(scp->SCp.dma_handle);
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 23f5e41..e95b367 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -1219,7 +1219,7 @@
 			    	srb, srb->cmd, srb->cmd->pid,
 				srb->cmd->cmnd[0], srb->cmd->device->id,
 			       	srb->cmd->device->lun);
-		printk("  sglist=%p cnt=%i idx=%i len=%Zd\n",
+		printk("  sglist=%p cnt=%i idx=%i len=%zu\n",
 		       srb->segment_x, srb->sg_count, srb->sg_index,
 		       srb->total_xfer_length);
 		printk("  state=0x%04x status=0x%02x phase=0x%02x (%sconn.)\n",
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 3d355d0..aff1b0c 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -495,7 +495,7 @@
 	memcpy(scmd->cmnd, cmnd, cmnd_size);
 
 	if (copy_sense) {
-		int gfp_mask = GFP_ATOMIC;
+		gfp_t gfp_mask = GFP_ATOMIC;
 
 		if (shost->hostt->unchecked_isa_dma)
 			gfp_mask |= __GFP_DMA;
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index b11f6de..73dd2ee 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1057,7 +1057,7 @@
 
 static void sunzilog_putchar(struct uart_port *port, int ch)
 {
-	struct zilog_channel *channel = ZILOG_CHANNEL_FROM_PORT(port);
+	struct zilog_channel __iomem *channel = ZILOG_CHANNEL_FROM_PORT(port);
 	int loops = ZS_PUT_CHAR_MAX_DELAY;
 
 	/* This is a timed polling loop so do not switch the explicit
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 2c9c946..724822c 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1216,7 +1216,7 @@
 {
 	struct usbdevfs_urb uurb;
 
-	if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
+	if (get_urb32(&uurb,(struct usbdevfs_urb32 __user *)arg))
 		return -EFAULT;
 
 	return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
@@ -1251,7 +1251,7 @@
 	}
 
 	free_async(as);
-	if (put_user((u32)(u64)addr, (u32 __user *)arg))
+	if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
 		return -EFAULT;
 	return 0;
 }
@@ -1520,7 +1520,7 @@
 
 	case USBDEVFS_IOCTL32:
 		snoop(&dev->dev, "%s: IOCTL\n", __FUNCTION__);
-		ret = proc_ioctl_compat(ps, (compat_uptr_t)(long)p);
+		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
 		break;
 #endif
 
diff --git a/fs/befs/befs.h b/fs/befs/befs.h
index 057a2c3..d9a40ab 100644
--- a/fs/befs/befs.h
+++ b/fs/befs/befs.h
@@ -94,7 +94,7 @@
 
 void befs_dump_super_block(const struct super_block *sb, befs_super_block *);
 void befs_dump_inode(const struct super_block *sb, befs_inode *);
-void befs_dump_index_entry(const struct super_block *sb, befs_btree_super *);
+void befs_dump_index_entry(const struct super_block *sb, befs_disk_btree_super *);
 void befs_dump_index_node(const struct super_block *sb, befs_btree_nodehead *);
 /****************************/
 
@@ -136,7 +136,7 @@
 static inline unsigned int
 befs_iaddrs_per_block(struct super_block *sb)
 {
-	return BEFS_SB(sb)->block_size / sizeof (befs_inode_addr);
+	return BEFS_SB(sb)->block_size / sizeof (befs_disk_inode_addr);
 }
 
 static inline int
@@ -151,4 +151,6 @@
 	return BEFS_SB(sb)->block_size * run.len;
 }
 
+#include "endian.h"
+
 #endif				/* _LINUX_BEFS_H */
diff --git a/fs/befs/befs_fs_types.h b/fs/befs/befs_fs_types.h
index 63ef1e1..e2595c2 100644
--- a/fs/befs/befs_fs_types.h
+++ b/fs/befs/befs_fs_types.h
@@ -79,17 +79,27 @@
  * On-Disk datastructures of BeFS
  */
 
+typedef u64 __bitwise fs64;
+typedef u32 __bitwise fs32;
+typedef u16 __bitwise fs16;
+
 typedef u64 befs_off_t;
-typedef u64 befs_time_t;
-typedef void befs_binode_etc;
+typedef fs64 befs_time_t;
 
 /* Block runs */
 typedef struct {
+	fs32 allocation_group;
+	fs16 start;
+	fs16 len;
+} PACKED befs_disk_block_run;
+
+typedef struct {
 	u32 allocation_group;
 	u16 start;
 	u16 len;
 } PACKED befs_block_run;
 
+typedef befs_disk_block_run befs_disk_inode_addr;
 typedef befs_block_run befs_inode_addr;
 
 /*
@@ -97,31 +107,31 @@
  */
 typedef struct {
 	char name[B_OS_NAME_LENGTH];
-	u32 magic1;
-	u32 fs_byte_order;
+	fs32 magic1;
+	fs32 fs_byte_order;
 
-	u32 block_size;
-	u32 block_shift;
+	fs32 block_size;
+	fs32 block_shift;
 
-	befs_off_t num_blocks;
-	befs_off_t used_blocks;
+	fs64 num_blocks;
+	fs64 used_blocks;
 
-	u32 inode_size;
+	fs32 inode_size;
 
-	u32 magic2;
-	u32 blocks_per_ag;
-	u32 ag_shift;
-	u32 num_ags;
+	fs32 magic2;
+	fs32 blocks_per_ag;
+	fs32 ag_shift;
+	fs32 num_ags;
 
-	u32 flags;
+	fs32 flags;
 
-	befs_block_run log_blocks;
-	befs_off_t log_start;
-	befs_off_t log_end;
+	befs_disk_block_run log_blocks;
+	fs64 log_start;
+	fs64 log_end;
 
-	u32 magic3;
-	befs_inode_addr root_dir;
-	befs_inode_addr indices;
+	fs32 magic3;
+	befs_disk_inode_addr root_dir;
+	befs_disk_inode_addr indices;
 
 } PACKED befs_super_block;
 
@@ -130,6 +140,16 @@
  * be longer than one block!
  */
 typedef struct {
+	befs_disk_block_run direct[BEFS_NUM_DIRECT_BLOCKS];
+	fs64 max_direct_range;
+	befs_disk_block_run indirect;
+	fs64 max_indirect_range;
+	befs_disk_block_run double_indirect;
+	fs64 max_double_indirect_range;
+	fs64 size;
+} PACKED befs_disk_data_stream;
+
+typedef struct {
 	befs_block_run direct[BEFS_NUM_DIRECT_BLOCKS];
 	befs_off_t max_direct_range;
 	befs_block_run indirect;
@@ -141,35 +161,35 @@
 
 /* Attribute */
 typedef struct {
-	u32 type;
-	u16 name_size;
-	u16 data_size;
+	fs32 type;
+	fs16 name_size;
+	fs16 data_size;
 	char name[1];
 } PACKED befs_small_data;
 
 /* Inode structure */
 typedef struct {
-	u32 magic1;
-	befs_inode_addr inode_num;
-	u32 uid;
-	u32 gid;
-	u32 mode;
-	u32 flags;
+	fs32 magic1;
+	befs_disk_inode_addr inode_num;
+	fs32 uid;
+	fs32 gid;
+	fs32 mode;
+	fs32 flags;
 	befs_time_t create_time;
 	befs_time_t last_modified_time;
-	befs_inode_addr parent;
-	befs_inode_addr attributes;
-	u32 type;
+	befs_disk_inode_addr parent;
+	befs_disk_inode_addr attributes;
+	fs32 type;
 
-	u32 inode_size;
-	u32 etc;		/* not use */
+	fs32 inode_size;
+	fs32 etc;		/* not use */
 
 	union {
-		befs_data_stream datastream;
+		befs_disk_data_stream datastream;
 		char symlink[BEFS_SYMLINK_LEN];
 	} data;
 
-	u32 pad[4];		/* not use */
+	fs32 pad[4];		/* not use */
 	befs_small_data small_data[1];
 } PACKED befs_inode;
 
@@ -190,6 +210,16 @@
 };
 
 typedef struct {
+	fs32 magic;
+	fs32 node_size;
+	fs32 max_depth;
+	fs32 data_type;
+	fs64 root_node_ptr;
+	fs64 free_node_ptr;
+	fs64 max_size;
+} PACKED befs_disk_btree_super;
+
+typedef struct {
 	u32 magic;
 	u32 node_size;
 	u32 max_depth;
@@ -203,11 +233,19 @@
  * Header stucture of each btree node
  */
 typedef struct {
+	fs64 left;
+	fs64 right;
+	fs64 overflow;
+	fs16 all_key_count;
+	fs16 all_key_length;
+} PACKED befs_btree_nodehead;
+
+typedef struct {
 	befs_off_t left;
 	befs_off_t right;
 	befs_off_t overflow;
 	u16 all_key_count;
 	u16 all_key_length;
-} PACKED befs_btree_nodehead;
+} PACKED befs_host_btree_nodehead;
 
 #endif				/* _LINUX_BEFS_FS_TYPES */
diff --git a/fs/befs/btree.c b/fs/befs/btree.c
index 76e2197..81b042e 100644
--- a/fs/befs/btree.c
+++ b/fs/befs/btree.c
@@ -30,7 +30,6 @@
 #include "befs.h"
 #include "btree.h"
 #include "datastream.h"
-#include "endian.h"
 
 /*
  * The btree functions in this file are built on top of the
@@ -80,7 +79,7 @@
  * In memory structure of each btree node
  */
 typedef struct {
-	befs_btree_nodehead head;	/* head of node converted to cpu byteorder */
+	befs_host_btree_nodehead head;	/* head of node converted to cpu byteorder */
 	struct buffer_head *bh;
 	befs_btree_nodehead *od_node;	/* on disk node */
 } befs_btree_node;
@@ -102,9 +101,9 @@
 
 static int befs_leafnode(befs_btree_node * node);
 
-static u16 *befs_bt_keylen_index(befs_btree_node * node);
+static fs16 *befs_bt_keylen_index(befs_btree_node * node);
 
-static befs_off_t *befs_bt_valarray(befs_btree_node * node);
+static fs64 *befs_bt_valarray(befs_btree_node * node);
 
 static char *befs_bt_keydata(befs_btree_node * node);
 
@@ -136,7 +135,7 @@
 		   befs_btree_super * sup)
 {
 	struct buffer_head *bh = NULL;
-	befs_btree_super *od_sup = NULL;
+	befs_disk_btree_super *od_sup = NULL;
 
 	befs_debug(sb, "---> befs_btree_read_super()");
 
@@ -146,7 +145,7 @@
 		befs_error(sb, "Couldn't read index header.");
 		goto error;
 	}
-	od_sup = (befs_btree_super *) bh->b_data;
+	od_sup = (befs_disk_btree_super *) bh->b_data;
 	befs_dump_index_entry(sb, od_sup);
 
 	sup->magic = fs32_to_cpu(sb, od_sup->magic);
@@ -342,7 +341,7 @@
 	u16 keylen;
 	int findkey_len;
 	char *thiskey;
-	befs_off_t *valarray;
+	fs64 *valarray;
 
 	befs_debug(sb, "---> befs_find_key() %s", findkey);
 
@@ -422,7 +421,7 @@
 	befs_btree_super bt_super;
 	befs_off_t node_off = 0;
 	int cur_key;
-	befs_off_t *valarray;
+	fs64 *valarray;
 	char *keystart;
 	u16 keylen;
 	int res;
@@ -572,7 +571,7 @@
 				   this_node->head.overflow);
 			*node_off = this_node->head.overflow;
 		} else {
-			befs_off_t *valarray = befs_bt_valarray(this_node);
+			fs64 *valarray = befs_bt_valarray(this_node);
 			*node_off = fs64_to_cpu(sb, valarray[0]);
 		}
 		if (befs_bt_read_node(sb, ds, this_node, *node_off) != BEFS_OK) {
@@ -622,7 +621,7 @@
  *
  * Except that rounding up to 8 works, and rounding up to 4 doesn't.
  */
-static u16 *
+static fs16 *
 befs_bt_keylen_index(befs_btree_node * node)
 {
 	const int keylen_align = 8;
@@ -633,7 +632,7 @@
 	if (tmp)
 		off += keylen_align - tmp;
 
-	return (u16 *) ((void *) node->od_node + off);
+	return (fs16 *) ((void *) node->od_node + off);
 }
 
 /**
@@ -643,13 +642,13 @@
  * Returns a pointer to the start of the value array
  * of the node pointed to by the node header
  */
-static befs_off_t *
+static fs64 *
 befs_bt_valarray(befs_btree_node * node)
 {
 	void *keylen_index_start = (void *) befs_bt_keylen_index(node);
-	size_t keylen_index_size = node->head.all_key_count * sizeof (u16);
+	size_t keylen_index_size = node->head.all_key_count * sizeof (fs16);
 
-	return (befs_off_t *) (keylen_index_start + keylen_index_size);
+	return (fs64 *) (keylen_index_start + keylen_index_size);
 }
 
 /**
@@ -681,7 +680,7 @@
 {
 	int prev_key_end;
 	char *keystart;
-	u16 *keylen_index;
+	fs16 *keylen_index;
 
 	if (index < 0 || index > node->head.all_key_count) {
 		*keylen = 0;
diff --git a/fs/befs/datastream.c b/fs/befs/datastream.c
index b7d6b92..aacb4da 100644
--- a/fs/befs/datastream.c
+++ b/fs/befs/datastream.c
@@ -18,7 +18,6 @@
 #include "befs.h"
 #include "datastream.h"
 #include "io.h"
-#include "endian.h"
 
 const befs_inode_addr BAD_IADDR = { 0, 0, 0 };
 
@@ -312,7 +311,7 @@
 	befs_blocknr_t indir_start_blk;
 	befs_blocknr_t search_blk;
 	struct buffer_head *indirblock;
-	befs_block_run *array;
+	befs_disk_block_run *array;
 
 	befs_block_run indirect = data->indirect;
 	befs_blocknr_t indirblockno = iaddr2blockno(sb, &indirect);
@@ -334,7 +333,7 @@
 			return BEFS_ERR;
 		}
 
-		array = (befs_block_run *) indirblock->b_data;
+		array = (befs_disk_block_run *) indirblock->b_data;
 
 		for (j = 0; j < arraylen; ++j) {
 			int len = fs16_to_cpu(sb, array[j].len);
@@ -427,7 +426,7 @@
 	struct buffer_head *dbl_indir_block;
 	struct buffer_head *indir_block;
 	befs_block_run indir_run;
-	befs_inode_addr *iaddr_array = NULL;
+	befs_disk_inode_addr *iaddr_array = NULL;
 	befs_sb_info *befs_sb = BEFS_SB(sb);
 
 	befs_blocknr_t indir_start_blk =
@@ -482,7 +481,7 @@
 
 	dbl_block_indx =
 	    dblindir_indx - (dbl_which_block * befs_iaddrs_per_block(sb));
-	iaddr_array = (befs_inode_addr *) dbl_indir_block->b_data;
+	iaddr_array = (befs_disk_inode_addr *) dbl_indir_block->b_data;
 	indir_run = fsrun_to_cpu(sb, iaddr_array[dbl_block_indx]);
 	brelse(dbl_indir_block);
 	iaddr_array = NULL;
@@ -507,7 +506,7 @@
 	}
 
 	block_indx = indir_indx - (which_block * befs_iaddrs_per_block(sb));
-	iaddr_array = (befs_inode_addr *) indir_block->b_data;
+	iaddr_array = (befs_disk_inode_addr *) indir_block->b_data;
 	*run = fsrun_to_cpu(sb, iaddr_array[block_indx]);
 	brelse(indir_block);
 	iaddr_array = NULL;
diff --git a/fs/befs/debug.c b/fs/befs/debug.c
index 875cc0a..e831a8f 100644
--- a/fs/befs/debug.c
+++ b/fs/befs/debug.c
@@ -21,7 +21,6 @@
 #endif				/* __KERNEL__ */
 
 #include "befs.h"
-#include "endian.h"
 
 #define ERRBUFSIZE 1024
 
@@ -125,7 +124,7 @@
 	befs_debug(sb, "  type %08x", fs32_to_cpu(sb, inode->type));
 	befs_debug(sb, "  inode_size %u", fs32_to_cpu(sb, inode->inode_size));
 
-	if (S_ISLNK(inode->mode)) {
+	if (S_ISLNK(fs32_to_cpu(sb, inode->mode))) {
 		befs_debug(sb, "  Symbolic link [%s]", inode->data.symlink);
 	} else {
 		int i;
@@ -231,21 +230,20 @@
 
 /* unused */
 void
-befs_dump_run(const struct super_block *sb, befs_block_run run)
+befs_dump_run(const struct super_block *sb, befs_disk_block_run run)
 {
 #ifdef CONFIG_BEFS_DEBUG
 
-	run = fsrun_to_cpu(sb, run);
+	befs_block_run n = fsrun_to_cpu(sb, run);
 
-	befs_debug(sb, "[%u, %hu, %hu]",
-		   run.allocation_group, run.start, run.len);
+	befs_debug(sb, "[%u, %hu, %hu]", n.allocation_group, n.start, n.len);
 
 #endif				//CONFIG_BEFS_DEBUG
 }
 #endif  /*  0  */
 
 void
-befs_dump_index_entry(const struct super_block *sb, befs_btree_super * super)
+befs_dump_index_entry(const struct super_block *sb, befs_disk_btree_super * super)
 {
 #ifdef CONFIG_BEFS_DEBUG
 
diff --git a/fs/befs/endian.h b/fs/befs/endian.h
index 9ecaea4..e254a20 100644
--- a/fs/befs/endian.h
+++ b/fs/befs/endian.h
@@ -10,85 +10,84 @@
 #define LINUX_BEFS_ENDIAN
 
 #include <linux/byteorder/generic.h>
-#include "befs.h"
 
 static inline u64
-fs64_to_cpu(const struct super_block *sb, u64 n)
+fs64_to_cpu(const struct super_block *sb, fs64 n)
 {
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
-		return le64_to_cpu(n);
+		return le64_to_cpu((__force __le64)n);
 	else
-		return be64_to_cpu(n);
+		return be64_to_cpu((__force __be64)n);
 }
 
-static inline u64
+static inline fs64
 cpu_to_fs64(const struct super_block *sb, u64 n)
 {
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
-		return cpu_to_le64(n);
+		return (__force fs64)cpu_to_le64(n);
 	else
-		return cpu_to_be64(n);
+		return (__force fs64)cpu_to_be64(n);
 }
 
 static inline u32
-fs32_to_cpu(const struct super_block *sb, u32 n)
+fs32_to_cpu(const struct super_block *sb, fs32 n)
 {
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
-		return le32_to_cpu(n);
+		return le32_to_cpu((__force __le32)n);
 	else
-		return be32_to_cpu(n);
+		return be32_to_cpu((__force __be32)n);
 }
 
-static inline u32
+static inline fs32
 cpu_to_fs32(const struct super_block *sb, u32 n)
 {
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
-		return cpu_to_le32(n);
+		return (__force fs32)cpu_to_le32(n);
 	else
-		return cpu_to_be32(n);
+		return (__force fs32)cpu_to_be32(n);
 }
 
 static inline u16
-fs16_to_cpu(const struct super_block *sb, u16 n)
+fs16_to_cpu(const struct super_block *sb, fs16 n)
 {
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
-		return le16_to_cpu(n);
+		return le16_to_cpu((__force __le16)n);
 	else
-		return be16_to_cpu(n);
+		return be16_to_cpu((__force __be16)n);
 }
 
-static inline u16
+static inline fs16
 cpu_to_fs16(const struct super_block *sb, u16 n)
 {
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
-		return cpu_to_le16(n);
+		return (__force fs16)cpu_to_le16(n);
 	else
-		return cpu_to_be16(n);
+		return (__force fs16)cpu_to_be16(n);
 }
 
 /* Composite types below here */
 
 static inline befs_block_run
-fsrun_to_cpu(const struct super_block *sb, befs_block_run n)
+fsrun_to_cpu(const struct super_block *sb, befs_disk_block_run n)
 {
 	befs_block_run run;
 
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE) {
-		run.allocation_group = le32_to_cpu(n.allocation_group);
-		run.start = le16_to_cpu(n.start);
-		run.len = le16_to_cpu(n.len);
+		run.allocation_group = le32_to_cpu((__force __le32)n.allocation_group);
+		run.start = le16_to_cpu((__force __le16)n.start);
+		run.len = le16_to_cpu((__force __le16)n.len);
 	} else {
-		run.allocation_group = be32_to_cpu(n.allocation_group);
-		run.start = be16_to_cpu(n.start);
-		run.len = be16_to_cpu(n.len);
+		run.allocation_group = be32_to_cpu((__force __be32)n.allocation_group);
+		run.start = be16_to_cpu((__force __be16)n.start);
+		run.len = be16_to_cpu((__force __be16)n.len);
 	}
 	return run;
 }
 
-static inline befs_block_run
+static inline befs_disk_block_run
 cpu_to_fsrun(const struct super_block *sb, befs_block_run n)
 {
-	befs_block_run run;
+	befs_disk_block_run run;
 
 	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE) {
 		run.allocation_group = cpu_to_le32(n.allocation_group);
@@ -103,7 +102,7 @@
 }
 
 static inline befs_data_stream
-fsds_to_cpu(const struct super_block *sb, befs_data_stream n)
+fsds_to_cpu(const struct super_block *sb, befs_disk_data_stream n)
 {
 	befs_data_stream data;
 	int i;
diff --git a/fs/befs/inode.c b/fs/befs/inode.c
index d41c924..94c17f9 100644
--- a/fs/befs/inode.c
+++ b/fs/befs/inode.c
@@ -8,7 +8,6 @@
 
 #include "befs.h"
 #include "inode.h"
-#include "endian.h"
 
 /*
 	Validates the correctness of the befs inode
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 57020c7..07f7144 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -22,7 +22,6 @@
 #include "datastream.h"
 #include "super.h"
 #include "io.h"
-#include "endian.h"
 
 MODULE_DESCRIPTION("BeOS File System (BeFS) driver");
 MODULE_AUTHOR("Will Dyson");
diff --git a/fs/befs/super.c b/fs/befs/super.c
index 4557acb..8c3401f 100644
--- a/fs/befs/super.c
+++ b/fs/befs/super.c
@@ -11,7 +11,6 @@
 
 #include "befs.h"
 #include "super.h"
-#include "endian.h"
 
 /**
  * load_befs_sb -- Read from disk and properly byteswap all the fields
diff --git a/fs/buffer.c b/fs/buffer.c
index 16cfbcd..eeb8ac1 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -701,7 +701,10 @@
  */
 int __set_page_dirty_buffers(struct page *page)
 {
-	struct address_space * const mapping = page->mapping;
+	struct address_space * const mapping = page_mapping(page);
+
+	if (unlikely(!mapping))
+		return !TestSetPageDirty(page);
 
 	spin_lock(&mapping->private_lock);
 	if (page_has_buffers(page)) {
diff --git a/fs/compat.c b/fs/compat.c
index 4d3fbcb..50624d4 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1316,7 +1316,7 @@
 		    unsigned int nr_segs, unsigned int flags)
 {
 	unsigned i;
-	struct iovec *iov;
+	struct iovec __user *iov;
 	if (nr_segs > UIO_MAXIOV)
 		return -EINVAL;
 	iov = compat_alloc_user_space(nr_segs * sizeof(struct iovec));
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 0457380..4613cb2 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -384,7 +384,7 @@
 				      le16_to_cpu(de->cdate)) + secs;
 		inode->i_ctime.tv_nsec = csecs * 10000000;
 		inode->i_atime.tv_sec =
-			date_dos2unix(le16_to_cpu(0), le16_to_cpu(de->adate));
+			date_dos2unix(0, le16_to_cpu(de->adate));
 		inode->i_atime.tv_nsec = 0;
 	} else
 		inode->i_ctime = inode->i_atime = inode->i_mtime;
diff --git a/fs/hpfs/inode.c b/fs/hpfs/inode.c
index bcf6ee3..7faef85 100644
--- a/fs/hpfs/inode.c
+++ b/fs/hpfs/inode.c
@@ -60,14 +60,14 @@
 	if (hpfs_sb(i->i_sb)->sb_eas) {
 		if ((ea = hpfs_get_ea(i->i_sb, fnode, "UID", &ea_size))) {
 			if (ea_size == 2) {
-				i->i_uid = le16_to_cpu(*(u16*)ea);
+				i->i_uid = le16_to_cpu(*(__le16*)ea);
 				hpfs_inode->i_ea_uid = 1;
 			}
 			kfree(ea);
 		}
 		if ((ea = hpfs_get_ea(i->i_sb, fnode, "GID", &ea_size))) {
 			if (ea_size == 2) {
-				i->i_gid = le16_to_cpu(*(u16*)ea);
+				i->i_gid = le16_to_cpu(*(__le16*)ea);
 				hpfs_inode->i_ea_gid = 1;
 			}
 			kfree(ea);
@@ -87,7 +87,7 @@
 			int rdev = 0;
 			umode_t mode = hpfs_sb(sb)->sb_mode;
 			if (ea_size == 2) {
-				mode = le16_to_cpu(*(u16*)ea);
+				mode = le16_to_cpu(*(__le16*)ea);
 				hpfs_inode->i_ea_mode = 1;
 			}
 			kfree(ea);
@@ -95,7 +95,7 @@
 			if (S_ISBLK(mode) || S_ISCHR(mode)) {
 				if ((ea = hpfs_get_ea(i->i_sb, fnode, "DEV", &ea_size))) {
 					if (ea_size == 4)
-						rdev = le32_to_cpu(*(u32*)ea);
+						rdev = le32_to_cpu(*(__le32*)ea);
 					kfree(ea);
 				}
 			}
@@ -148,7 +148,7 @@
 		   we'd better not overwrite them
 		hpfs_error(i->i_sb, "fnode %08x has some unknown HPFS386 stuctures", i->i_ino);
 	} else*/ if (hpfs_sb(i->i_sb)->sb_eas >= 2) {
-		u32 ea;
+		__le32 ea;
 		if ((i->i_uid != hpfs_sb(i->i_sb)->sb_uid) || hpfs_inode->i_ea_uid) {
 			ea = cpu_to_le32(i->i_uid);
 			hpfs_set_ea(i, fnode, "UID", (char*)&ea, 2);
@@ -165,6 +165,7 @@
 			  && i->i_mode != ((hpfs_sb(i->i_sb)->sb_mode & ~(S_ISDIR(i->i_mode) ? 0222 : 0333))
 			  | (S_ISDIR(i->i_mode) ? S_IFDIR : S_IFREG))) || hpfs_inode->i_ea_mode) {
 				ea = cpu_to_le32(i->i_mode);
+				/* sick, but legal */
 				hpfs_set_ea(i, fnode, "MODE", (char *)&ea, 2);
 				hpfs_inode->i_ea_mode = 1;
 			}
diff --git a/fs/inode.c b/fs/inode.c
index bf6bec4..d9a21d1 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -162,7 +162,7 @@
 				bdi = sb->s_bdev->bd_inode->i_mapping->backing_dev_info;
 			mapping->backing_dev_info = bdi;
 		}
-		inode->i_private = 0;
+		inode->i_private = NULL;
 		inode->i_mapping = mapping;
 	}
 	return inode;
diff --git a/fs/isofs/joliet.c b/fs/isofs/joliet.c
index 81a90e1..fb8fe7a 100644
--- a/fs/isofs/joliet.c
+++ b/fs/isofs/joliet.c
@@ -14,9 +14,9 @@
  * Convert Unicode 16 to UTF-8 or ASCII.
  */
 static int
-uni16_to_x8(unsigned char *ascii, u16 *uni, int len, struct nls_table *nls)
+uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls)
 {
-	wchar_t *ip, ch;
+	__be16 *ip, ch;
 	unsigned char *op;
 
 	ip = uni;
@@ -24,8 +24,8 @@
 
 	while ((ch = get_unaligned(ip)) && len) {
 		int llen;
-		ch = be16_to_cpu(ch);
-		if ((llen = nls->uni2char(ch, op, NLS_MAX_CHARSET_SIZE)) > 0)
+		llen = nls->uni2char(be16_to_cpu(ch), op, NLS_MAX_CHARSET_SIZE);
+		if (llen > 0)
 			op += llen;
 		else
 			*op++ = '?';
@@ -82,7 +82,7 @@
 		len = wcsntombs_be(outname, de->name,
 				   de->name_len[0] >> 1, PAGE_SIZE);
 	} else {
-		len = uni16_to_x8(outname, (u16 *) de->name,
+		len = uni16_to_x8(outname, (__be16 *) de->name,
 				  de->name_len[0] >> 1, nls);
 	}
 	if ((len > 2) && (outname[len-2] == ';') && (outname[len-1] == '1')) {
diff --git a/fs/partitions/msdos.c b/fs/partitions/msdos.c
index 4f8df71..8c7af17 100644
--- a/fs/partitions/msdos.c
+++ b/fs/partitions/msdos.c
@@ -32,13 +32,11 @@
 #include <asm/unaligned.h>
 
 #define SYS_IND(p)	(get_unaligned(&p->sys_ind))
-#define NR_SECTS(p)	({ __typeof__(p->nr_sects) __a =	\
-				get_unaligned(&p->nr_sects);	\
+#define NR_SECTS(p)	({ __le32 __a =	get_unaligned(&p->nr_sects);	\
 				le32_to_cpu(__a); \
 			})
 
-#define START_SECT(p)	({ __typeof__(p->start_sect) __a =	\
-				get_unaligned(&p->start_sect);	\
+#define START_SECT(p)	({ __le32 __a =	get_unaligned(&p->start_sect);	\
 				le32_to_cpu(__a); \
 			})
 
diff --git a/fs/ufs/util.c b/fs/ufs/util.c
index 22f820a..1743757 100644
--- a/fs/ufs/util.c
+++ b/fs/ufs/util.c
@@ -184,14 +184,13 @@
 dev_t
 ufs_get_inode_dev(struct super_block *sb, struct ufs_inode_info *ufsi)
 {
-	__fs32 fs32;
+	__u32 fs32;
 	dev_t dev;
 
 	if ((UFS_SB(sb)->s_flags & UFS_ST_MASK) == UFS_ST_SUNx86)
-		fs32 = ufsi->i_u1.i_data[1];
+		fs32 = fs32_to_cpu(sb, ufsi->i_u1.i_data[1]);
 	else
-		fs32 = ufsi->i_u1.i_data[0];
-	fs32 = fs32_to_cpu(sb, fs32);
+		fs32 = fs32_to_cpu(sb, ufsi->i_u1.i_data[0]);
 	switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
 	case UFS_ST_SUNx86:
 	case UFS_ST_SUN:
@@ -212,7 +211,7 @@
 void
 ufs_set_inode_dev(struct super_block *sb, struct ufs_inode_info *ufsi, dev_t dev)
 {
-	__fs32 fs32;
+	__u32 fs32;
 
 	switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
 	case UFS_ST_SUNx86:
@@ -227,11 +226,10 @@
 		fs32 = old_encode_dev(dev);
 		break;
 	}
-	fs32 = cpu_to_fs32(sb, fs32);
 	if ((UFS_SB(sb)->s_flags & UFS_ST_MASK) == UFS_ST_SUNx86)
-		ufsi->i_u1.i_data[1] = fs32;
+		ufsi->i_u1.i_data[1] = cpu_to_fs32(sb, fs32);
 	else
-		ufsi->i_u1.i_data[0] = fs32;
+		ufsi->i_u1.i_data[0] = cpu_to_fs32(sb, fs32);
 }
 
 /**
diff --git a/include/asm-ia64/sn/pcibr_provider.h b/include/asm-ia64/sn/pcibr_provider.h
index e3b0c3f..da3eade 100644
--- a/include/asm-ia64/sn/pcibr_provider.h
+++ b/include/asm-ia64/sn/pcibr_provider.h
@@ -135,7 +135,7 @@
 extern void             pcireg_force_intr_set(struct pcibus_info *, int);
 extern u64         pcireg_wrb_flush_get(struct pcibus_info *, int);
 extern void             pcireg_int_ate_set(struct pcibus_info *, int, u64);
-extern u64 *	pcireg_int_ate_addr(struct pcibus_info *, int);
+extern u64 __iomem *	pcireg_int_ate_addr(struct pcibus_info *, int);
 extern void 		pcibr_force_interrupt(struct sn_irq_info *sn_irq_info);
 extern void 		pcibr_change_devices_irq(struct sn_irq_info *sn_irq_info);
 extern int 		pcibr_ate_alloc(struct pcibus_info *, int);
diff --git a/include/asm-ia64/sn/tioca_provider.h b/include/asm-ia64/sn/tioca_provider.h
index 65cdd73..9a820ac 100644
--- a/include/asm-ia64/sn/tioca_provider.h
+++ b/include/asm-ia64/sn/tioca_provider.h
@@ -162,11 +162,11 @@
 tioca_tlbflush(struct tioca_kernel *tioca_kernel)
 {
 	volatile u64 tmp;
-	volatile struct tioca *ca_base;
+	volatile struct tioca __iomem *ca_base;
 	struct tioca_common *tioca_common;
 
 	tioca_common = tioca_kernel->ca_common;
-	ca_base = (struct tioca *)tioca_common->ca_common.bs_base;
+	ca_base = (struct tioca __iomem *)tioca_common->ca_common.bs_base;
 
 	/*
 	 * Explicit flushes not needed if GART is in cached mode
diff --git a/include/asm-ia64/sn/tioce_provider.h b/include/asm-ia64/sn/tioce_provider.h
index 6d62b13..32c32f3 100644
--- a/include/asm-ia64/sn/tioce_provider.h
+++ b/include/asm-ia64/sn/tioce_provider.h
@@ -53,7 +53,7 @@
 	u64		ct_start;	/* coretalk start address */
 	u64		pci_start;	/* bus start address */
 
-	u64		*ate_hw;	/* hw ptr of first ate in map */
+	u64		__iomem *ate_hw;/* hw ptr of first ate in map */
 	u64		*ate_shadow;	/* shadow ptr of firat ate */
 	u16		ate_count;	/* # ate's in the map */
 };
diff --git a/include/asm-mips/fpu.h b/include/asm-mips/fpu.h
index 58c561a..efef843 100644
--- a/include/asm-mips/fpu.h
+++ b/include/asm-mips/fpu.h
@@ -134,9 +134,11 @@
 
 static inline fpureg_t *get_fpu_regs(struct task_struct *tsk)
 {
-	if (cpu_has_fpu) {
-		if ((tsk == current) && __is_fpu_owner())
+	if (tsk == current) {
+		preempt_disable();
+		if (is_fpu_owner())
 			_save_fp(current);
+		preempt_enable();
 	}
 
 	return tsk->thread.fpu.fpr;
diff --git a/include/asm-mips/mach-au1x00/au1000_usbdev.h b/include/asm-mips/mach-au1x00/au1000_usbdev.h
deleted file mode 100644
index 05bc74b..0000000
--- a/include/asm-mips/mach-au1x00/au1000_usbdev.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * BRIEF MODULE DESCRIPTION
- *	Au1000 USB Device-Side Driver
- *
- * Copyright 2001 MontaVista Software Inc.
- * Author: MontaVista Software, Inc.
- *		stevel@mvista.com or source@mvista.com
- *
- *  This program is free software; you can redistribute	 it and/or modify it
- *  under  the terms of	 the GNU General  Public License as published by the
- *  Free Software Foundation;  either version 2 of the	License, or (at your
- *  option) any later version.
- *
- *  THIS  SOFTWARE  IS PROVIDED	  ``AS	IS'' AND   ANY	EXPRESS OR IMPLIED
- *  WARRANTIES,	  INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
- *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
- *  NO	EVENT  SHALL   THE AUTHOR  BE	 LIABLE FOR ANY	  DIRECT, INDIRECT,
- *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- *  NOT LIMITED	  TO, PROCUREMENT OF  SUBSTITUTE GOODS	OR SERVICES; LOSS OF
- *  USE, DATA,	OR PROFITS; OR	BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- *  ANY THEORY OF LIABILITY, WHETHER IN	 CONTRACT, STRICT LIABILITY, OR TORT
- *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#define USBDEV_REV 0x0110 // BCD
-#define USBDEV_EP0_MAX_PACKET_SIZE 64
-
-typedef enum {
-	ATTACHED = 0,
-	POWERED,
-	DEFAULT,
-	ADDRESS,
-	CONFIGURED
-} usbdev_state_t;
-
-typedef enum {
-	CB_NEW_STATE = 0,
-	CB_PKT_COMPLETE
-} usbdev_cb_type_t;
-
-
-typedef struct usbdev_pkt {
-	int                ep_addr;    // ep addr this packet routed to
-	int                size;       // size of payload in bytes
-	unsigned           status;     // packet status
-	struct usbdev_pkt* next;       // function layer can't touch this
-	u8                 payload[0]; // the payload
-} usbdev_pkt_t;
-
-#define PKT_STATUS_ACK  (1<<0)
-#define PKT_STATUS_NAK  (1<<1)
-#define PKT_STATUS_SU   (1<<2)
-
-extern int usbdev_init(struct usb_device_descriptor* dev_desc,
-		       struct usb_config_descriptor* config_desc,
-		       struct usb_interface_descriptor* if_desc,
-		       struct usb_endpoint_descriptor* ep_desc,
-		       struct usb_string_descriptor* str_desc[],
-		       void (*cb)(usbdev_cb_type_t, unsigned long, void *),
-		       void* cb_data);
-
-extern void usbdev_exit(void);
-
-extern int usbdev_alloc_packet  (int ep_addr, int data_size,
-				 usbdev_pkt_t** pkt);
-extern int usbdev_send_packet   (int ep_addr, usbdev_pkt_t* pkt);
-extern int usbdev_receive_packet(int ep_addr, usbdev_pkt_t** pkt);
-extern int usbdev_get_byte_count(int ep_addr);
diff --git a/include/linux/cdrom.h b/include/linux/cdrom.h
index 3c9b0bc..bbbe7b4 100644
--- a/include/linux/cdrom.h
+++ b/include/linux/cdrom.h
@@ -749,7 +749,7 @@
 #define MRW_MODE_PC			0x03
 
 struct mrw_feature_desc {
-	__u16 feature_code;
+	__be16 feature_code;
 #if defined(__BIG_ENDIAN_BITFIELD)
 	__u8 reserved1		: 2;
 	__u8 feature_version	: 4;
@@ -776,7 +776,7 @@
 
 /* cf. mmc4r02g.pdf 5.3.10 Random Writable Feature (0020h) pg 197 of 635 */
 struct rwrt_feature_desc {
-	__u16 feature_code;
+	__be16 feature_code;
 #if defined(__BIG_ENDIAN_BITFIELD)
 	__u8 reserved1		: 2;
 	__u8 feature_version	: 4;
@@ -803,7 +803,7 @@
 };
 
 typedef struct {
-	__u16 disc_information_length;
+	__be16 disc_information_length;
 #if defined(__BIG_ENDIAN_BITFIELD)
 	__u8 reserved1			: 3;
         __u8 erasable			: 1;
@@ -849,7 +849,7 @@
 } disc_information;
 
 typedef struct {
-	__u16 track_information_length;
+	__be16 track_information_length;
 	__u8 track_lsb;
 	__u8 session_lsb;
 	__u8 reserved1;
@@ -880,12 +880,12 @@
 	__u8 lra_v			: 1;
 	__u8 reserved3			: 6;
 #endif
-	__u32 track_start;
-	__u32 next_writable;
-	__u32 free_blocks;
-	__u32 fixed_packet_size;
-	__u32 track_size;
-	__u32 last_rec_address;
+	__be32 track_start;
+	__be32 next_writable;
+	__be32 free_blocks;
+	__be32 fixed_packet_size;
+	__be32 track_size;
+	__be32 last_rec_address;
 } track_information;
 
 struct feature_header {
@@ -896,12 +896,12 @@
 };
 
 struct mode_page_header {
-	__u16 mode_data_length;
+	__be16 mode_data_length;
 	__u8 medium_type;
 	__u8 reserved1;
 	__u8 reserved2;
 	__u8 reserved3;
-	__u16 desc_length;
+	__be16 desc_length;
 };
 
 #ifdef __KERNEL__
@@ -1106,7 +1106,7 @@
 #endif
 	__u8 session_format;
 	__u8 reserved6;
-	__u32 packet_size;
+	__be32 packet_size;
 	__u16 audio_pause;
 	__u8 mcn[16];
 	__u8 isrc[16];
@@ -1151,7 +1151,7 @@
 } rpc_state_t;
 
 struct event_header {
-	__u16 data_len;
+	__be16 data_len;
 #if defined(__BIG_ENDIAN_BITFIELD)
 	__u8 nea		: 1;
 	__u8 reserved1		: 4;
diff --git a/include/linux/compat.h b/include/linux/compat.h
index ef5cd19..f4ebf96 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -163,7 +163,7 @@
 compat_sys_set_robust_list(struct compat_robust_list_head __user *head,
 			   compat_size_t len);
 asmlinkage long
-compat_sys_get_robust_list(int pid, compat_uptr_t *head_ptr,
+compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
 			   compat_size_t __user *len_ptr);
 
 long compat_sys_semctl(int first, int second, int third, void __user *uptr);
diff --git a/include/linux/config.h b/include/linux/config.h
deleted file mode 100644
index 479ffb0..0000000
--- a/include/linux/config.h
+++ /dev/null
@@ -1,9 +0,0 @@
-#ifndef _LINUX_CONFIG_H
-#define _LINUX_CONFIG_H
-/* This file is no longer in use and kept only for backward compatibility.
- * autoconf.h is now included via -imacros on the commandline
- */
-#warning Including config.h is deprecated.
-#include <linux/autoconf.h>
-
-#endif
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index d6f4ec4..53553c9 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -191,7 +191,7 @@
 /* this structure is argument to DCCP_SOCKOPT_CHANGE_X */
 struct dccp_so_feat {
 	__u8 dccpsf_feat;
-	__u8 *dccpsf_val;
+	__u8 __user *dccpsf_val;
 	__u8 dccpsf_len;
 };
 
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index ab27408..35cb385 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -44,7 +44,7 @@
    unsigned char	h_source[ETH_ALEN];	   /* source ether addr	*/
    __be16               h_vlan_proto;              /* Should always be 0x8100 */
    __be16               h_vlan_TCI;                /* Encapsulates priority and VLAN ID */
-   unsigned short	h_vlan_encapsulated_proto; /* packet type ID field (or len) */
+   __be16		h_vlan_encapsulated_proto; /* packet type ID field (or len) */
 };
 
 #include <linux/skbuff.h>
diff --git a/include/linux/ioc4.h b/include/linux/ioc4.h
index de73a32..51e2b9f 100644
--- a/include/linux/ioc4.h
+++ b/include/linux/ioc4.h
@@ -157,7 +157,7 @@
 	unsigned long idd_bar0;
 	struct pci_dev *idd_pdev;
 	const struct pci_device_id *idd_pci_id;
-	struct __iomem ioc4_misc_regs *idd_misc_regs;
+	struct ioc4_misc_regs __iomem *idd_misc_regs;
 	unsigned long count_period;
 	void *idd_serial_data;
 	unsigned int idd_variant;
diff --git a/include/linux/istallion.h b/include/linux/istallion.h
index 1f99662..b55e2a0 100644
--- a/include/linux/istallion.h
+++ b/include/linux/istallion.h
@@ -100,7 +100,7 @@
 	unsigned int	iobase;
 	int		iosize;
 	unsigned long	memaddr;
-	void		*membase;
+	void		__iomem *membase;
 	int		memsize;
 	int		pagesize;
 	int		hostoffset;
@@ -113,7 +113,7 @@
 	void		(*enable)(struct stlibrd *brdp);
 	void		(*reenable)(struct stlibrd *brdp);
 	void		(*disable)(struct stlibrd *brdp);
-	char		*(*getmemptr)(struct stlibrd *brdp, unsigned long offset, int line);
+	void		__iomem *(*getmemptr)(struct stlibrd *brdp, unsigned long offset, int line);
 	void		(*intr)(struct stlibrd *brdp);
 	void		(*reset)(struct stlibrd *brdp);
 	stliport_t	*ports[STL_MAXPORTS];
diff --git a/include/linux/smb_fs.h b/include/linux/smb_fs.h
index 367d6c3e..13b3af5 100644
--- a/include/linux/smb_fs.h
+++ b/include/linux/smb_fs.h
@@ -43,17 +43,17 @@
 
 /* macro names are short for word, double-word, long value (?) */
 #define WVAL(buf,pos) \
-	(le16_to_cpu(get_unaligned((u16 *)((u8 *)(buf) + (pos)))))
+	(le16_to_cpu(get_unaligned((__le16 *)((u8 *)(buf) + (pos)))))
 #define DVAL(buf,pos) \
-	(le32_to_cpu(get_unaligned((u32 *)((u8 *)(buf) + (pos)))))
+	(le32_to_cpu(get_unaligned((__le32 *)((u8 *)(buf) + (pos)))))
 #define LVAL(buf,pos) \
-	(le64_to_cpu(get_unaligned((u64 *)((u8 *)(buf) + (pos)))))
+	(le64_to_cpu(get_unaligned((__le64 *)((u8 *)(buf) + (pos)))))
 #define WSET(buf,pos,val) \
-	put_unaligned(cpu_to_le16((u16)(val)), (u16 *)((u8 *)(buf) + (pos)))
+	put_unaligned(cpu_to_le16((u16)(val)), (__le16 *)((u8 *)(buf) + (pos)))
 #define DSET(buf,pos,val) \
-	put_unaligned(cpu_to_le32((u32)(val)), (u32 *)((u8 *)(buf) + (pos)))
+	put_unaligned(cpu_to_le32((u32)(val)), (__le32 *)((u8 *)(buf) + (pos)))
 #define LSET(buf,pos,val) \
-	put_unaligned(cpu_to_le64((u64)(val)), (u64 *)((u8 *)(buf) + (pos)))
+	put_unaligned(cpu_to_le64((u64)(val)), (__le64 *)((u8 *)(buf) + (pos)))
 
 /* where to find the base of the SMB packet proper */
 #define smb_base(buf) ((u8 *)(((u8 *)(buf))+4))
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 3efcfc7..b0ace3f 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -593,7 +593,7 @@
 asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
 					unsigned int flags);
 asmlinkage long sys_get_robust_list(int pid,
-				    struct robust_list_head __user **head_ptr,
+				    struct robust_list_head __user * __user *head_ptr,
 				    size_t __user *len_ptr);
 asmlinkage long sys_set_robust_list(struct robust_list_head __user *head,
 				    size_t len);
diff --git a/include/linux/ufs_fs.h b/include/linux/ufs_fs.h
index fc62887..61eef50 100644
--- a/include/linux/ufs_fs.h
+++ b/include/linux/ufs_fs.h
@@ -351,6 +351,14 @@
 	__fs64   cs_spare[3];	/* future expansion */
 };
 
+struct ufs_csum_core {
+	__u64	cs_ndir;	/* number of directories */
+	__u64	cs_nbfree;	/* number of free blocks */
+	__u64	cs_nifree;	/* number of free inodes */
+	__u64	cs_nffree;	/* number of free frags */
+	__u64   cs_numclusters;	/* number of free clusters */
+};
+
 /*
  * File system flags
  */
@@ -715,7 +723,7 @@
 
 struct ufs_sb_private_info {
 	struct ufs_buffer_head s_ubh; /* buffer containing super block */
-	struct ufs2_csum_total cs_total;
+	struct ufs_csum_core cs_total;
 	__u32	s_sblkno;	/* offset of super-blocks in filesys */
 	__u32	s_cblkno;	/* offset of cg-block in filesys */
 	__u32	s_iblkno;	/* offset of inode-blocks in filesys */
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 9d850ae..6313c38 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -2137,7 +2137,7 @@
  * See also the previous routine cpuset_handle_cpuhp().
  */
 
-void cpuset_track_online_nodes()
+void cpuset_track_online_nodes(void)
 {
 	common_cpu_mem_hotplug_unplug();
 }
diff --git a/kernel/futex.c b/kernel/futex.c
index 4aaf919..b364e00 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1612,10 +1612,10 @@
  * @len_ptr: pointer to a length field, the kernel fills in the header size
  */
 asmlinkage long
-sys_get_robust_list(int pid, struct robust_list_head __user **head_ptr,
+sys_get_robust_list(int pid, struct robust_list_head __user * __user *head_ptr,
 		    size_t __user *len_ptr)
 {
-	struct robust_list_head *head;
+	struct robust_list_head __user *head;
 	unsigned long ret;
 
 	if (!pid)
@@ -1694,14 +1694,15 @@
  * Fetch a robust-list pointer. Bit 0 signals PI futexes:
  */
 static inline int fetch_robust_entry(struct robust_list __user **entry,
-				     struct robust_list __user **head, int *pi)
+				     struct robust_list __user * __user *head,
+				     int *pi)
 {
 	unsigned long uentry;
 
-	if (get_user(uentry, (unsigned long *)head))
+	if (get_user(uentry, (unsigned long __user *)head))
 		return -EFAULT;
 
-	*entry = (void *)(uentry & ~1UL);
+	*entry = (void __user *)(uentry & ~1UL);
 	*pi = uentry & 1;
 
 	return 0;
@@ -1739,7 +1740,7 @@
 		return;
 
 	if (pending)
-		handle_futex_death((void *)pending + futex_offset, curr, pip);
+		handle_futex_death((void __user *)pending + futex_offset, curr, pip);
 
 	while (entry != &head->list) {
 		/*
@@ -1747,7 +1748,7 @@
 		 * don't process it twice:
 		 */
 		if (entry != pending)
-			if (handle_futex_death((void *)entry + futex_offset,
+			if (handle_futex_death((void __user *)entry + futex_offset,
 						curr, pi))
 				return;
 		/*
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index c5cca3f..50f24ee 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -18,7 +18,7 @@
  */
 static inline int
 fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
-		   compat_uptr_t *head, int *pi)
+		   compat_uptr_t __user *head, int *pi)
 {
 	if (get_user(*uentry, head))
 		return -EFAULT;
@@ -62,7 +62,7 @@
 			       &head->list_op_pending, &pip))
 		return;
 	if (upending)
-		handle_futex_death((void *)pending + futex_offset, curr, pip);
+		handle_futex_death((void __user *)pending + futex_offset, curr, pip);
 
 	while (compat_ptr(uentry) != &head->list) {
 		/*
@@ -70,7 +70,7 @@
 		 * dont process it twice:
 		 */
 		if (entry != pending)
-			if (handle_futex_death((void *)entry + futex_offset,
+			if (handle_futex_death((void __user *)entry + futex_offset,
 						curr, pi))
 				return;
 
@@ -78,7 +78,7 @@
 		 * Fetch the next entry in the list:
 		 */
 		if (fetch_robust_entry(&uentry, &entry,
-				       (compat_uptr_t *)&entry->next, &pi))
+				       (compat_uptr_t __user *)&entry->next, &pi))
 			return;
 		/*
 		 * Avoid excessively long or circular lists:
@@ -103,10 +103,10 @@
 }
 
 asmlinkage long
-compat_sys_get_robust_list(int pid, compat_uptr_t *head_ptr,
+compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
 			   compat_size_t __user *len_ptr)
 {
-	struct compat_robust_list_head *head;
+	struct compat_robust_list_head __user *head;
 	unsigned long ret;
 
 	if (!pid)
diff --git a/kernel/relay.c b/kernel/relay.c
index 1d63ecd..f04bbdb 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -887,7 +887,7 @@
 
 	from = buf->start + read_start;
 	ret = avail;
-	if (copy_to_user(desc->arg.data, from, avail)) {
+	if (copy_to_user(desc->arg.buf, from, avail)) {
 		desc->error = -EFAULT;
 		ret = 0;
 	}
@@ -946,24 +946,17 @@
  */
 static inline ssize_t relay_file_read_subbufs(struct file *filp,
 					      loff_t *ppos,
-					      size_t count,
 					      subbuf_actor_t subbuf_actor,
 					      read_actor_t actor,
-					      void *target)
+					      read_descriptor_t *desc)
 {
 	struct rchan_buf *buf = filp->private_data;
 	size_t read_start, avail;
-	read_descriptor_t desc;
 	int ret;
 
-	if (!count)
+	if (!desc->count)
 		return 0;
 
-	desc.written = 0;
-	desc.count = count;
-	desc.arg.data = target;
-	desc.error = 0;
-
 	mutex_lock(&filp->f_dentry->d_inode->i_mutex);
 	do {
 		if (!relay_file_read_avail(buf, *ppos))
@@ -974,19 +967,19 @@
 		if (!avail)
 			break;
 
-		avail = min(desc.count, avail);
-		ret = subbuf_actor(read_start, buf, avail, &desc, actor);
-		if (desc.error < 0)
+		avail = min(desc->count, avail);
+		ret = subbuf_actor(read_start, buf, avail, desc, actor);
+		if (desc->error < 0)
 			break;
 
 		if (ret) {
 			relay_file_read_consume(buf, read_start, ret);
 			*ppos = relay_file_read_end_pos(buf, read_start, ret);
 		}
-	} while (desc.count && ret);
+	} while (desc->count && ret);
 	mutex_unlock(&filp->f_dentry->d_inode->i_mutex);
 
-	return desc.written;
+	return desc->written;
 }
 
 static ssize_t relay_file_read(struct file *filp,
@@ -994,8 +987,13 @@
 			       size_t count,
 			       loff_t *ppos)
 {
-	return relay_file_read_subbufs(filp, ppos, count, subbuf_read_actor,
-				       NULL, buffer);
+	read_descriptor_t desc;
+	desc.written = 0;
+	desc.count = count;
+	desc.arg.buf = buffer;
+	desc.error = 0;
+	return relay_file_read_subbufs(filp, ppos, subbuf_read_actor,
+				       NULL, &desc);
 }
 
 static ssize_t relay_file_sendfile(struct file *filp,
@@ -1004,8 +1002,13 @@
 				   read_actor_t actor,
 				   void *target)
 {
-	return relay_file_read_subbufs(filp, ppos, count, subbuf_send_actor,
-				       actor, target);
+	read_descriptor_t desc;
+	desc.written = 0;
+	desc.count = count;
+	desc.arg.data = target;
+	desc.error = 0;
+	return relay_file_read_subbufs(filp, ppos, subbuf_send_actor,
+				       actor, &desc);
 }
 
 struct file_operations relay_file_operations = {
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 637d556..aa9bfd0 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -160,13 +160,13 @@
 
 static inline void root_tag_set(struct radix_tree_root *root, unsigned int tag)
 {
-	root->gfp_mask |= (1 << (tag + __GFP_BITS_SHIFT));
+	root->gfp_mask |= (__force gfp_t)(1 << (tag + __GFP_BITS_SHIFT));
 }
 
 
 static inline void root_tag_clear(struct radix_tree_root *root, unsigned int tag)
 {
-	root->gfp_mask &= ~(1 << (tag + __GFP_BITS_SHIFT));
+	root->gfp_mask &= (__force gfp_t)~(1 << (tag + __GFP_BITS_SHIFT));
 }
 
 static inline void root_tag_clear_all(struct radix_tree_root *root)
@@ -176,7 +176,7 @@
 
 static inline int root_tag_get(struct radix_tree_root *root, unsigned int tag)
 {
-	return root->gfp_mask & (1 << (tag + __GFP_BITS_SHIFT));
+	return (__force unsigned)root->gfp_mask & (1 << (tag + __GFP_BITS_SHIFT));
 }
 
 /*
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index da9cfe9..60a508e 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -62,7 +62,7 @@
 	default:
 		printk(VLAN_DBG
 		       "%s: unable to resolve type %X addresses.\n", 
-		       dev->name, (int)veth->h_vlan_encapsulated_proto);
+		       dev->name, ntohs(veth->h_vlan_encapsulated_proto));
 	 
 		memcpy(veth->h_source, dev->dev_addr, ETH_ALEN);
 		break;
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index e433cb0..6d398f1 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -274,7 +274,7 @@
 	while (data <= data_limit - 6) {
 		if (strnicmp(data, "PASV\r\n", 6) == 0) {
 			/* Passive mode on */
-			IP_VS_DBG(7, "got PASV at %zd of %zd\n",
+			IP_VS_DBG(7, "got PASV at %td of %td\n",
 				  data - data_start,
 				  data_limit - data_start);
 			cp->app_data = &ip_vs_ftp_pasv;
diff --git a/net/irda/irias_object.c b/net/irda/irias_object.c
index a154b1d..56292ab 100644
--- a/net/irda/irias_object.c
+++ b/net/irda/irias_object.c
@@ -43,7 +43,7 @@
  *
  * Faster, check boundary... Jean II
  */
-static char *strndup(char *str, int max)
+static char *strndup(char *str, size_t max)
 {
 	char *new_str;
 	int len;
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 447d9ae..1f0f079 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1146,10 +1146,11 @@
 	return ret;
 }
 
-u32 *
+static __be32 *
 svcauth_gss_prepare_to_wrap(struct xdr_buf *resbuf, struct gss_svc_data *gsd)
 {
-	u32 *p, verf_len;
+	__be32 *p;
+	u32 verf_len;
 
 	p = gsd->verf_start;
 	gsd->verf_start = NULL;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 32d7784..acfb852 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -941,7 +941,7 @@
 	int sz_to_copy;
 	int sz_copied = 0;
 	int needed;
-	char *crs = m->msg_iov->iov_base;
+	char __user *crs = m->msg_iov->iov_base;
 	unsigned char *buf_crs;
 	u32 err;
 	int res;
@@ -1496,7 +1496,7 @@
 		return -ENOPROTOOPT;
 	if (ol < sizeof(value))
 		return -EINVAL;
-        if ((res = get_user(value, (u32 *)ov)))
+        if ((res = get_user(value, (u32 __user *)ov)))
 		return res;
 
 	if (down_interruptible(&tsock->sem)) 
@@ -1541,7 +1541,7 @@
  */
 
 static int getsockopt(struct socket *sock, 
-		      int lvl, int opt, char __user *ov, int *ol)
+		      int lvl, int opt, char __user *ov, int __user *ol)
 {
 	struct tipc_sock *tsock = tipc_sk(sock->sk);
         int len;
diff --git a/sound/core/hwdep_compat.c b/sound/core/hwdep_compat.c
index 938f775..3827c0c 100644
--- a/sound/core/hwdep_compat.c
+++ b/sound/core/hwdep_compat.c
@@ -33,7 +33,7 @@
 static int snd_hwdep_dsp_load_compat(struct snd_hwdep *hw,
 				     struct snd_hwdep_dsp_image32 __user *src)
 {
-	struct snd_hwdep_dsp_image *dst;
+	struct snd_hwdep_dsp_image __user *dst;
 	compat_caddr_t ptr;
 	u32 val;