diff --git a/[refs] b/[refs]
index 76154bb0db5f..6e0c702e7514 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a488edc914aa1d766a4e2c982b5ae03d5657ec1b
+refs/heads/master: 3fb962bde48c413bfa419ec4413037e87955dcb6
diff --git a/trunk/arch/i386/kernel/apic.c b/trunk/arch/i386/kernel/apic.c
index 776c90989e06..f39e09ef64ec 100644
--- a/trunk/arch/i386/kernel/apic.c
+++ b/trunk/arch/i386/kernel/apic.c
@@ -570,18 +570,16 @@ void __devinit setup_local_APIC(void)
  */
 void lapic_shutdown(void)
 {
-	unsigned long flags;
-
 	if (!cpu_has_apic)
 		return;
 
-	local_irq_save(flags);
+	local_irq_disable();
 	clear_local_APIC();
 
 	if (enabled_via_apicbase)
 		disable_local_APIC();
 
-	local_irq_restore(flags);
+	local_irq_enable();
 }
 
 #ifdef CONFIG_PM
diff --git a/trunk/arch/x86_64/kernel/entry.S b/trunk/arch/x86_64/kernel/entry.S
index 7c10e9009d61..22cb6ee074b9 100644
--- a/trunk/arch/x86_64/kernel/entry.S
+++ b/trunk/arch/x86_64/kernel/entry.S
@@ -178,6 +178,12 @@ rff_trace:
  * Interrupts are off on entry.
  * Only called from user space.
  *
+ * EM64T CPUs have somewhat weird error reporting for non canonical RIPs in SYSRET. 
+ * We can't handle any exceptions there because the exception handler would
+ * end up running on the user stack which is unsafe. To avoid problems 
+ * any code that might end up with a user touched pt_regs should return
+ * using int_ret_from_syscall.
+ *
  * XXX	if we had a free scratch register we could save the RSP into the stack frame
  *      and report it properly in ps. Unfortunately we haven't.
  */ 			 		
@@ -254,7 +260,9 @@ sysret_signal:
 	xorl %esi,%esi # oldset -> arg2
 	call ptregscall_common
 1:	movl $_TIF_NEED_RESCHED,%edi
-	jmp sysret_check
+	/* Stack frame might have been changed. The IRET path does
+	   some additional checks to handle this */
+	jmp int_with_check
 	
 badsys:
 	movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
@@ -280,7 +288,8 @@ tracesys:
 	call syscall_trace_leave
 	RESTORE_TOP_OF_STACK %rbx
 	RESTORE_REST
-	jmp ret_from_sys_call
+	/* Stack frame might have been changed. Use the more careful IRET path */
+	jmp int_ret_from_sys_call
 	CFI_ENDPROC
 		
 /* 
@@ -408,25 +417,9 @@ ENTRY(stub_execve)
 	CFI_ADJUST_CFA_OFFSET -8
 	CFI_REGISTER rip, r11
 	SAVE_REST
-	movq %r11, %r15
-	CFI_REGISTER rip, r15
 	FIXUP_TOP_OF_STACK %r11
 	call sys_execve
-	GET_THREAD_INFO(%rcx)
-	bt $TIF_IA32,threadinfo_flags(%rcx)
-	CFI_REMEMBER_STATE
-	jc exec_32bit
 	RESTORE_TOP_OF_STACK %r11
-	movq %r15, %r11
-	CFI_REGISTER rip, r11
-	RESTORE_REST
-	pushq %r11
-	CFI_ADJUST_CFA_OFFSET 8
-	CFI_REL_OFFSET rip, 0
-	ret
-
-exec_32bit:
-	CFI_RESTORE_STATE
 	movq %rax,RAX(%rsp)
 	RESTORE_REST
 	jmp int_ret_from_sys_call
diff --git a/trunk/drivers/edac/edac_mc.c b/trunk/drivers/edac/edac_mc.c
index 9c205274c1cb..262e44544dc8 100644
--- a/trunk/drivers/edac/edac_mc.c
+++ b/trunk/drivers/edac/edac_mc.c
@@ -38,12 +38,6 @@
 
 #define	EDAC_MC_VERSION	"edac_mc  Ver: 2.0.0 " __DATE__
 
-/* For now, disable the EDAC sysfs code.  The sysfs interface that EDAC
- * presents to user space needs more thought, and is likely to change
- * substantially.
- */
-#define DISABLE_EDAC_SYSFS
-
 #ifdef CONFIG_EDAC_DEBUG
 /* Values of 0 to 4 will generate output */
 int edac_debug_level = 1;
@@ -53,7 +47,7 @@ EXPORT_SYMBOL(edac_debug_level);
 /* EDAC Controls, setable by module parameter, and sysfs */
 static int log_ue = 1;
 static int log_ce = 1;
-static int panic_on_ue;
+static int panic_on_ue = 1;
 static int poll_msec = 1000;
 
 static int check_pci_parity = 0;	/* default YES check PCI parity */
@@ -83,8 +77,6 @@ static int pci_whitelist_count ;
 
 /*  START sysfs data and methods */
 
-#ifndef DISABLE_EDAC_SYSFS
-
 static const char *mem_types[] = {
 	[MEM_EMPTY] = "Empty",
 	[MEM_RESERVED] = "Reserved",
@@ -249,7 +241,6 @@ static struct kobj_type ktype_memctrl = {
 	.default_attrs	= (struct attribute **) memctrl_attr,
 };
 
-#endif  /* DISABLE_EDAC_SYSFS */
 
 /* Initialize the main sysfs entries for edac:
  *   /sys/devices/system/edac
@@ -260,11 +251,6 @@ static struct kobj_type ktype_memctrl = {
  *         !0 FAILURE
  */
 static int edac_sysfs_memctrl_setup(void)
-#ifdef DISABLE_EDAC_SYSFS
-{
-	return 0;
-}
-#else
 {
 	int err=0;
 
@@ -297,7 +283,6 @@ static int edac_sysfs_memctrl_setup(void)
 
 	return err;
 }
-#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * MC teardown:
@@ -305,7 +290,6 @@ static int edac_sysfs_memctrl_setup(void)
  */
 static void edac_sysfs_memctrl_teardown(void)
 {
-#ifndef DISABLE_EDAC_SYSFS
 	debugf0("MC: " __FILE__ ": %s()\n", __func__);
 
 	/* Unregister the MC's kobject */
@@ -316,11 +300,8 @@ static void edac_sysfs_memctrl_teardown(void)
 
 	/* Unregister the 'edac' object */
 	sysdev_class_unregister(&edac_class);
-#endif  /* DISABLE_EDAC_SYSFS */
 }
 
-#ifndef DISABLE_EDAC_SYSFS
-
 /*
  * /sys/devices/system/edac/pci;
  * 	data structures and methods
@@ -573,18 +554,11 @@ static struct kobj_type ktype_edac_pci = {
 	.default_attrs	= (struct attribute **) edac_pci_attr,
 };
 
-#endif  /* DISABLE_EDAC_SYSFS */
-
 /**
  * edac_sysfs_pci_setup()
  *
  */
 static int edac_sysfs_pci_setup(void)
-#ifdef DISABLE_EDAC_SYSFS
-{
-	return 0;
-}
-#else
 {
 	int err;
 
@@ -608,20 +582,16 @@ static int edac_sysfs_pci_setup(void)
 	}
 	return err;
 }
-#endif  /* DISABLE_EDAC_SYSFS */
+
 
 static void edac_sysfs_pci_teardown(void)
 {
-#ifndef DISABLE_EDAC_SYSFS
 	debugf0("MC: " __FILE__ ": %s()\n", __func__);
 
 	kobject_unregister(&edac_pci_kobj);
 	kobject_put(&edac_pci_kobj);
-#endif
 }
 
-#ifndef DISABLE_EDAC_SYSFS
-
 /* EDAC sysfs CSROW data structures and methods */
 
 /* Set of more detailed csrow<id> attribute show/store functions */
@@ -1075,8 +1045,6 @@ static struct kobj_type ktype_mci = {
 	.default_attrs	= (struct attribute **) mci_attr,
 };
 
-#endif  /* DISABLE_EDAC_SYSFS */
-
 #define EDAC_DEVICE_SYMLINK	"device"
 
 /*
@@ -1088,11 +1056,6 @@ static struct kobj_type ktype_mci = {
  *	!0	Failure
  */
 static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
-#ifdef DISABLE_EDAC_SYSFS
-{
-	return 0;
-}
-#else
 {
 	int i;
 	int err;
@@ -1161,14 +1124,12 @@ static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
 
 	return err;
 }
-#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * remove a Memory Controller instance
  */
 static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
 {
-#ifndef DISABLE_EDAC_SYSFS
 	int i;
 
 	debugf0("MC: " __FILE__ ": %s()\n", __func__);
@@ -1185,7 +1146,6 @@ static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
 
 	kobject_unregister(&mci->edac_mci_kobj);
 	kobject_put(&mci->edac_mci_kobj);
-#endif  /* DISABLE_EDAC_SYSFS */
 }
 
 /* END OF sysfs data and methods */
diff --git a/trunk/drivers/macintosh/via-pmu.c b/trunk/drivers/macintosh/via-pmu.c
index 4a478eb0e27d..6eb93e45fcd3 100644
--- a/trunk/drivers/macintosh/via-pmu.c
+++ b/trunk/drivers/macintosh/via-pmu.c
@@ -825,7 +825,7 @@ proc_get_info(char *page, char **start, off_t off,
 	p += sprintf(p, "PMU driver version     : %d\n", PMU_DRIVER_VERSION);
 	p += sprintf(p, "PMU firmware version   : %02x\n", pmu_version);
 	p += sprintf(p, "AC Power               : %d\n",
-		((pmu_power_flags & PMU_PWR_AC_PRESENT) != 0) || pmu_battery_count == 0);
+		((pmu_power_flags & PMU_PWR_AC_PRESENT) != 0));
 	p += sprintf(p, "Battery count          : %d\n", pmu_battery_count);
 
 	return p - page;
diff --git a/trunk/drivers/media/video/mxb.c b/trunk/drivers/media/video/mxb.c
index 41715cacf926..8416ceff524b 100644
--- a/trunk/drivers/media/video/mxb.c
+++ b/trunk/drivers/media/video/mxb.c
@@ -1,7 +1,7 @@
 /*
     mxb - v4l2 driver for the Multimedia eXtension Board
     
-    Copyright (C) 1998-2006 Michael Hunold <michael@mihu.de>
+    Copyright (C) 1998-2003 Michael Hunold <michael@mihu.de>
 
     Visit http://www.mihu.de/linux/saa7146/mxb/
     for further details about this card.
@@ -327,7 +327,6 @@ static int mxb_init_done(struct saa7146_dev* dev)
 	struct video_decoder_init init;
 	struct i2c_msg msg;
 	struct tuner_setup tun_setup;
-	v4l2_std_id std = V4L2_STD_PAL_BG;
 
 	int i = 0, err = 0;
 	struct	tea6415c_multiplex vm;	
@@ -362,9 +361,6 @@ static int mxb_init_done(struct saa7146_dev* dev)
 	mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_FREQUENCY,
 					&mxb->cur_freq);
 
-	/* set a default video standard */
-	mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
-
 	/* mute audio on tea6420s */
 	mxb->tea6420_1->driver->command(mxb->tea6420_1,TEA6420_SWITCH, &TEA6420_line[6][0]);
 	mxb->tea6420_2->driver->command(mxb->tea6420_2,TEA6420_SWITCH, &TEA6420_line[6][1]);
@@ -925,21 +921,17 @@ static int std_callback(struct saa7146_dev* dev, struct saa7146_standard *std)
 	int one = 1;
 
 	if(V4L2_STD_PAL_I == std->id ) {
-		v4l2_std_id std = V4L2_STD_PAL_I;
 		DEB_D(("VIDIOC_S_STD: setting mxb for PAL_I.\n"));
 		/* set the 7146 gpio register -- I don't know what this does exactly */
       		saa7146_write(dev, GPIO_CTRL, 0x00404050);
 		/* unset the 7111 gpio register -- I don't know what this does exactly */
 		mxb->saa7111a->driver->command(mxb->saa7111a,DECODER_SET_GPIO, &zero);
-		mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
 	} else {
-		v4l2_std_id std = V4L2_STD_PAL_BG;
 		DEB_D(("VIDIOC_S_STD: setting mxb for PAL/NTSC/SECAM.\n"));
 		/* set the 7146 gpio register -- I don't know what this does exactly */
       		saa7146_write(dev, GPIO_CTRL, 0x00404050);
 		/* set the 7111 gpio register -- I don't know what this does exactly */
 		mxb->saa7111a->driver->command(mxb->saa7111a,DECODER_SET_GPIO, &one);
-		mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
 	}
 	return 0;
 }
diff --git a/trunk/drivers/mtd/devices/mtd_dataflash.c b/trunk/drivers/mtd/devices/mtd_dataflash.c
index a19480d07888..155737e7483f 100644
--- a/trunk/drivers/mtd/devices/mtd_dataflash.c
+++ b/trunk/drivers/mtd/devices/mtd_dataflash.c
@@ -178,7 +178,7 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
 		 * we're at a block boundary and need to erase the whole block.
 		 */
 		pageaddr = instr->addr / priv->page_size;
-		do_block = (pageaddr & 0x7) == 0 && instr->len >= blocksize;
+		do_block = (pageaddr & 0x7) == 0 && instr->len <= blocksize;
 		pageaddr = pageaddr << priv->page_offset;
 
 		command[0] = do_block ? OP_ERASE_BLOCK : OP_ERASE_PAGE;
diff --git a/trunk/drivers/s390/scsi/zfcp_def.h b/trunk/drivers/s390/scsi/zfcp_def.h
index 6eba56cd89ba..7f551d66f47f 100644
--- a/trunk/drivers/s390/scsi/zfcp_def.h
+++ b/trunk/drivers/s390/scsi/zfcp_def.h
@@ -664,7 +664,6 @@ do { \
 #define ZFCP_STATUS_UNIT_TEMPORARY		0x00000002
 #define ZFCP_STATUS_UNIT_SHARED			0x00000004
 #define ZFCP_STATUS_UNIT_READONLY		0x00000008
-#define ZFCP_STATUS_UNIT_REGISTERED		0x00000010
 
 /* FSF request status (this does not have a common part) */
 #define ZFCP_STATUS_FSFREQ_NOT_INIT		0x00000000
diff --git a/trunk/drivers/s390/scsi/zfcp_erp.c b/trunk/drivers/s390/scsi/zfcp_erp.c
index 57cb628a05aa..e3c4bdd29a60 100644
--- a/trunk/drivers/s390/scsi/zfcp_erp.c
+++ b/trunk/drivers/s390/scsi/zfcp_erp.c
@@ -3391,13 +3391,10 @@ zfcp_erp_action_cleanup(int action, struct zfcp_adapter *adapter,
 		    && (!atomic_test_mask(ZFCP_STATUS_UNIT_TEMPORARY,
 					  &unit->status))
 		    && !unit->device
-		    && port->rport) {
-			atomic_set_mask(ZFCP_STATUS_UNIT_REGISTERED,
-					&unit->status);
- 			scsi_scan_target(&port->rport->dev, 0,
-					 port->rport->scsi_target_id,
-					 unit->scsi_lun, 0);
-		}
+		    && port->rport)
+ 			scsi_add_device(port->adapter->scsi_host, 0,
+ 					port->rport->scsi_target_id,
+					unit->scsi_lun);
 		zfcp_unit_put(unit);
 		break;
 	case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
diff --git a/trunk/drivers/s390/scsi/zfcp_scsi.c b/trunk/drivers/s390/scsi/zfcp_scsi.c
index 9e6d07d7b3c8..9f6b4d7a46f3 100644
--- a/trunk/drivers/s390/scsi/zfcp_scsi.c
+++ b/trunk/drivers/s390/scsi/zfcp_scsi.c
@@ -68,7 +68,7 @@ struct zfcp_data zfcp_data = {
 	      eh_host_reset_handler:   zfcp_scsi_eh_host_reset_handler,
 			               /* FIXME(openfcp): Tune */
 	      can_queue:               4096,
-	      this_id:	               -1,
+	      this_id:	               0,
 	      /*
 	       * FIXME:
 	       * one less? can zfcp_create_sbale cope with it?
@@ -183,8 +183,7 @@ zfcp_scsi_slave_alloc(struct scsi_device *sdp)
 
 	read_lock_irqsave(&zfcp_data.config_lock, flags);
 	unit = zfcp_unit_lookup(adapter, sdp->channel, sdp->id, sdp->lun);
-	if (unit && atomic_test_mask(ZFCP_STATUS_UNIT_REGISTERED,
-				     &unit->status)) {
+	if (unit) {
 		sdp->hostdata = unit;
 		unit->device = sdp;
 		zfcp_unit_get(unit);
@@ -209,7 +208,6 @@ zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
 	struct zfcp_unit *unit = (struct zfcp_unit *) sdpnt->hostdata;
 
 	if (unit) {
-		atomic_clear_mask(ZFCP_STATUS_UNIT_REGISTERED, &unit->status);
 		sdpnt->hostdata = NULL;
 		unit->device = NULL;
 		zfcp_unit_put(unit);
@@ -293,7 +291,7 @@ zfcp_scsi_command_async(struct zfcp_adapter *adapter, struct zfcp_unit *unit,
 			       "on port 0x%016Lx in recovery\n",
 			       zfcp_get_busid_by_unit(unit),
 			       unit->fcp_lun, unit->port->wwpn);
-		zfcp_scsi_command_fail(scpnt, DID_NO_CONNECT);
+		retval = SCSI_MLQUEUE_DEVICE_BUSY;
 		goto out;
 	}
 
diff --git a/trunk/drivers/scsi/pcmcia/Kconfig b/trunk/drivers/scsi/pcmcia/Kconfig
index eac8e179cfff..df52190f4d94 100644
--- a/trunk/drivers/scsi/pcmcia/Kconfig
+++ b/trunk/drivers/scsi/pcmcia/Kconfig
@@ -8,7 +8,6 @@ menu "PCMCIA SCSI adapter support"
 config PCMCIA_AHA152X
 	tristate "Adaptec AHA152X PCMCIA support"
 	depends on m && !64BIT
-	select SCSI_SPI_ATTRS
 	help
 	  Say Y here if you intend to attach this type of PCMCIA SCSI host
 	  adapter to your computer.
diff --git a/trunk/drivers/scsi/scsi_devinfo.c b/trunk/drivers/scsi/scsi_devinfo.c
index 84c3937ae8fb..f01ec0a7c506 100644
--- a/trunk/drivers/scsi/scsi_devinfo.c
+++ b/trunk/drivers/scsi/scsi_devinfo.c
@@ -126,7 +126,6 @@ static struct {
 	{"ADAPTEC", "Adaptec 5400S", NULL, BLIST_FORCELUN},
 	{"AFT PRO", "-IX CF", "0.0>", BLIST_FORCELUN},
 	{"BELKIN", "USB 2 HS-CF", "1.95",  BLIST_FORCELUN | BLIST_INQUIRY_36},
-	{"BROWNIE", "1600U3P", NULL, BLIST_NOREPORTLUN},
 	{"CANON", "IPUBJD", NULL, BLIST_SPARSELUN},
 	{"CBOX3", "USB Storage-SMC", "300A", BLIST_FORCELUN | BLIST_INQUIRY_36},
 	{"CMD", "CRA-7280", NULL, BLIST_SPARSELUN},	/* CMD RAID Controller */
diff --git a/trunk/drivers/scsi/scsi_transport_fc.c b/trunk/drivers/scsi/scsi_transport_fc.c
index 13ea64119b73..929032e370db 100644
--- a/trunk/drivers/scsi/scsi_transport_fc.c
+++ b/trunk/drivers/scsi/scsi_transport_fc.c
@@ -223,7 +223,7 @@ static void fc_rport_terminate(struct fc_rport  *rport);
  */
 #define FC_STARGET_NUM_ATTRS 	3
 #define FC_RPORT_NUM_ATTRS	9
-#define FC_HOST_NUM_ATTRS	17
+#define FC_HOST_NUM_ATTRS	16
 
 struct fc_internal {
 	struct scsi_transport_template t;
diff --git a/trunk/fs/direct-io.c b/trunk/fs/direct-io.c
index 848044af7e16..27f3e787faca 100644
--- a/trunk/fs/direct-io.c
+++ b/trunk/fs/direct-io.c
@@ -1155,15 +1155,16 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode,
  * For writes, i_mutex is not held on entry; it is never taken.
  *
  * DIO_LOCKING (simple locking for regular files)
- * For writes we are called under i_mutex and return with i_mutex held, even though
- * it is internally dropped.
+ * For writes we are called under i_mutex and return with i_mutex held, even
+ * though it is internally dropped.
  * For reads, i_mutex is not held on entry, but it is taken and dropped before
  * returning.
  *
  * DIO_OWN_LOCKING (filesystem provides synchronisation and handling of
  *	uninitialised data, allowing parallel direct readers and writers)
  * For writes we are called without i_mutex, return without it, never touch it.
- * For reads, i_mutex is held on entry and will be released before returning.
+ * For reads we are called under i_mutex and return with i_mutex held, even
+ * though it may be internally dropped.
  *
  * Additional i_alloc_sem locking requirements described inline below.
  */
@@ -1182,7 +1183,8 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 	ssize_t retval = -EINVAL;
 	loff_t end = offset;
 	struct dio *dio;
-	int reader_with_isem = (rw == READ && dio_lock_type == DIO_OWN_LOCKING);
+	int release_i_mutex = 0;
+	int acquire_i_mutex = 0;
 
 	if (rw & WRITE)
 		current->flags |= PF_SYNCWRITE;
@@ -1225,7 +1227,6 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 	 *	writers need to grab i_alloc_sem only (i_mutex is already held)
 	 * For regular files using DIO_OWN_LOCKING,
 	 *	neither readers nor writers take any locks here
-	 *	(i_mutex is already held and release for writers here)
 	 */
 	dio->lock_type = dio_lock_type;
 	if (dio_lock_type != DIO_NO_LOCKING) {
@@ -1236,7 +1237,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 			mapping = iocb->ki_filp->f_mapping;
 			if (dio_lock_type != DIO_OWN_LOCKING) {
 				mutex_lock(&inode->i_mutex);
-				reader_with_isem = 1;
+				release_i_mutex = 1;
 			}
 
 			retval = filemap_write_and_wait_range(mapping, offset,
@@ -1248,7 +1249,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 
 			if (dio_lock_type == DIO_OWN_LOCKING) {
 				mutex_unlock(&inode->i_mutex);
-				reader_with_isem = 0;
+				acquire_i_mutex = 1;
 			}
 		}
 
@@ -1269,11 +1270,13 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 				nr_segs, blkbits, get_blocks, end_io, dio);
 
 	if (rw == READ && dio_lock_type == DIO_LOCKING)
-		reader_with_isem = 0;
+		release_i_mutex = 0;
 
 out:
-	if (reader_with_isem)
+	if (release_i_mutex)
 		mutex_unlock(&inode->i_mutex);
+	else if (acquire_i_mutex)
+		mutex_lock(&inode->i_mutex);
 	if (rw & WRITE)
 		current->flags &= ~PF_SYNCWRITE;
 	return retval;
diff --git a/trunk/fs/jfs/jfs_dmap.c b/trunk/fs/jfs/jfs_dmap.c
index 79b5404db100..2967b7393415 100644
--- a/trunk/fs/jfs/jfs_dmap.c
+++ b/trunk/fs/jfs/jfs_dmap.c
@@ -532,10 +532,10 @@ dbUpdatePMap(struct inode *ipbmap,
 
 		lastlblkno = lblkno;
 
-		LOGSYNC_LOCK(log, flags);
 		if (mp->lsn != 0) {
 			/* inherit older/smaller lsn */
 			logdiff(diffp, mp->lsn, log);
+			LOGSYNC_LOCK(log, flags);
 			if (difft < diffp) {
 				mp->lsn = lsn;
 
@@ -548,17 +548,20 @@ dbUpdatePMap(struct inode *ipbmap,
 			logdiff(diffp, mp->clsn, log);
 			if (difft > diffp)
 				mp->clsn = tblk->clsn;
+			LOGSYNC_UNLOCK(log, flags);
 		} else {
 			mp->log = log;
 			mp->lsn = lsn;
 
 			/* insert bp after tblock in logsync list */
+			LOGSYNC_LOCK(log, flags);
+
 			log->count++;
 			list_add(&mp->synclist, &tblk->synclist);
 
 			mp->clsn = tblk->clsn;
+			LOGSYNC_UNLOCK(log, flags);
 		}
-		LOGSYNC_UNLOCK(log, flags);
 	}
 
 	/* write the last buffer. */
diff --git a/trunk/fs/jfs/jfs_imap.c b/trunk/fs/jfs/jfs_imap.c
index 4efa0d0eec39..31b4aa13dd4b 100644
--- a/trunk/fs/jfs/jfs_imap.c
+++ b/trunk/fs/jfs/jfs_imap.c
@@ -2844,11 +2844,11 @@ diUpdatePMap(struct inode *ipimap,
 	 */
 	lsn = tblk->lsn;
 	log = JFS_SBI(tblk->sb)->log;
-	LOGSYNC_LOCK(log, flags);
 	if (mp->lsn != 0) {
 		/* inherit older/smaller lsn */
 		logdiff(difft, lsn, log);
 		logdiff(diffp, mp->lsn, log);
+		LOGSYNC_LOCK(log, flags);
 		if (difft < diffp) {
 			mp->lsn = lsn;
 			/* move mp after tblock in logsync list */
@@ -2860,15 +2860,17 @@ diUpdatePMap(struct inode *ipimap,
 		logdiff(diffp, mp->clsn, log);
 		if (difft > diffp)
 			mp->clsn = tblk->clsn;
+		LOGSYNC_UNLOCK(log, flags);
 	} else {
 		mp->log = log;
 		mp->lsn = lsn;
 		/* insert mp after tblock in logsync list */
+		LOGSYNC_LOCK(log, flags);
 		log->count++;
 		list_add(&mp->synclist, &tblk->synclist);
 		mp->clsn = tblk->clsn;
+		LOGSYNC_UNLOCK(log, flags);
 	}
-	LOGSYNC_UNLOCK(log, flags);
 	write_metapage(mp);
 	return (0);
 }
diff --git a/trunk/fs/lockd/clntproc.c b/trunk/fs/lockd/clntproc.c
index 970b6a6aa337..220058d8616d 100644
--- a/trunk/fs/lockd/clntproc.c
+++ b/trunk/fs/lockd/clntproc.c
@@ -662,18 +662,12 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
 	 * reclaimed while we're stuck in the unlock call. */
 	fl->fl_u.nfs_fl.flags &= ~NFS_LCK_GRANTED;
 
-	/*
-	 * Note: the server is supposed to either grant us the unlock
-	 * request, or to deny it with NLM_LCK_DENIED_GRACE_PERIOD. In either
-	 * case, we want to unlock.
-	 */
-	do_vfs_lock(fl);
-
 	if (req->a_flags & RPC_TASK_ASYNC) {
 		status = nlmclnt_async_call(req, NLMPROC_UNLOCK,
 					&nlmclnt_unlock_ops);
 		/* Hrmf... Do the unlock early since locks_remove_posix()
 		 * really expects us to free the lock synchronously */
+		do_vfs_lock(fl);
 		if (status < 0) {
 			nlmclnt_release_lockargs(req);
 			kfree(req);
@@ -686,6 +680,7 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
 	if (status < 0)
 		return status;
 
+	do_vfs_lock(fl);
 	if (resp->status == NLM_LCK_GRANTED)
 		return 0;
 
diff --git a/trunk/fs/nfs/direct.c b/trunk/fs/nfs/direct.c
index 4e9b3a1b36c5..04ab2fc360e7 100644
--- a/trunk/fs/nfs/direct.c
+++ b/trunk/fs/nfs/direct.c
@@ -57,7 +57,6 @@
 #define NFSDBG_FACILITY		NFSDBG_VFS
 #define MAX_DIRECTIO_SIZE	(4096UL << PAGE_SHIFT)
 
-static void nfs_free_user_pages(struct page **pages, int npages, int do_dirty);
 static kmem_cache_t *nfs_direct_cachep;
 
 /*
@@ -108,15 +107,6 @@ nfs_get_user_pages(int rw, unsigned long user_addr, size_t size,
 					page_count, (rw == READ), 0,
 					*pages, NULL);
 		up_read(&current->mm->mmap_sem);
-		/*
-		 * If we got fewer pages than expected from get_user_pages(),
-		 * the user buffer runs off the end of a mapping; return EFAULT.
-		 */
-		if (result >= 0 && result < page_count) {
-			nfs_free_user_pages(*pages, result, 0);
-			*pages = NULL;
-			result = -EFAULT;
-		}
 	}
 	return result;
 }
diff --git a/trunk/fs/nfs/nfs4proc.c b/trunk/fs/nfs/nfs4proc.c
index f8c0066e02e1..984ca3454d04 100644
--- a/trunk/fs/nfs/nfs4proc.c
+++ b/trunk/fs/nfs/nfs4proc.c
@@ -1430,7 +1430,7 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
 	if (status == 0)
 		status = nfs4_do_fsinfo(server, fhandle, info);
 out:
-	return nfs4_map_errors(status);
+	return status;
 }
 
 static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
diff --git a/trunk/kernel/fork.c b/trunk/kernel/fork.c
index ccdfbb16c86d..a8eab86de7f1 100644
--- a/trunk/kernel/fork.c
+++ b/trunk/kernel/fork.c
@@ -1061,12 +1061,6 @@ static task_t *copy_process(unsigned long clone_flags,
 	 */
 	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr: NULL;
 
-	/*
-	 * sigaltstack should be cleared when sharing the same VM
-	 */
-	if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
-		p->sas_ss_sp = p->sas_ss_size = 0;
-
 	/*
 	 * Syscall tracing should be turned off in the child regardless
 	 * of CLONE_PTRACE.
diff --git a/trunk/net/sunrpc/clnt.c b/trunk/net/sunrpc/clnt.c
index d78479782045..d2f0550c4ba0 100644
--- a/trunk/net/sunrpc/clnt.c
+++ b/trunk/net/sunrpc/clnt.c
@@ -113,7 +113,7 @@ rpc_new_client(struct rpc_xprt *xprt, char *servname,
 
 	err = -EINVAL;
 	if (!xprt)
-		goto out_no_xprt;
+		goto out_err;
 	if (vers >= program->nrvers || !(version = program->version[vers]))
 		goto out_err;
 
@@ -182,7 +182,6 @@ rpc_new_client(struct rpc_xprt *xprt, char *servname,
 	kfree(clnt);
 out_err:
 	xprt_destroy(xprt);
-out_no_xprt:
 	return ERR_PTR(err);
 }
 
diff --git a/trunk/net/sunrpc/sched.c b/trunk/net/sunrpc/sched.c
index e838d042f7f5..802d4fe0f55c 100644
--- a/trunk/net/sunrpc/sched.c
+++ b/trunk/net/sunrpc/sched.c
@@ -515,14 +515,16 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-	struct rpc_task *task, *next;
-	struct list_head *head;
+	struct rpc_task *task;
 
+	struct list_head *head;
 	spin_lock_bh(&queue->lock);
 	head = &queue->tasks[queue->maxpriority];
 	for (;;) {
-		list_for_each_entry_safe(task, next, head, u.tk_wait.list)
+		while (!list_empty(head)) {
+			task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
 			__rpc_wake_up_task(task);
+		}
 		if (head == &queue->tasks[0])
 			break;
 		head--;
@@ -539,13 +541,14 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
-	struct rpc_task *task, *next;
 	struct list_head *head;
+	struct rpc_task *task;
 
 	spin_lock_bh(&queue->lock);
 	head = &queue->tasks[queue->maxpriority];
 	for (;;) {
-		list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
+		while (!list_empty(head)) {
+			task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
 			task->tk_status = status;
 			__rpc_wake_up_task(task);
 		}