diff --git a/[refs] b/[refs]
index 09e852b65665..0f49f2ac532c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 86302f417561fec802f88fdfc343265689d4a596
+refs/heads/master: 0efc61eaee5471acd7399c8536feff280b4966dd
diff --git a/trunk/Documentation/cachetlb.txt b/trunk/Documentation/cachetlb.txt
index debf6813934a..73e794f0ff09 100644
--- a/trunk/Documentation/cachetlb.txt
+++ b/trunk/Documentation/cachetlb.txt
@@ -373,15 +373,14 @@ maps this page at its virtual address.
 	likely that you will need to flush the instruction cache
 	for copy_to_user_page().
 
-  void flush_anon_page(struct vm_area_struct *vma, struct page *page,
-                       unsigned long vmaddr)
+  void flush_anon_page(struct page *page, unsigned long vmaddr)
   	When the kernel needs to access the contents of an anonymous
 	page, it calls this function (currently only
 	get_user_pages()).  Note: flush_dcache_page() deliberately
 	doesn't work for an anonymous page.  The default
 	implementation is a nop (and should remain so for all coherent
 	architectures).  For incoherent architectures, it should flush
-	the cache of the page at vmaddr.
+	the cache of the page at vmaddr in the current user process.
 
   void flush_kernel_dcache_page(struct page *page)
 	When the kernel needs to modify a user page is has obtained
diff --git a/trunk/Documentation/x86_64/boot-options.txt b/trunk/Documentation/x86_64/boot-options.txt
index 5c86ed6f0448..dbdcaf68e3ea 100644
--- a/trunk/Documentation/x86_64/boot-options.txt
+++ b/trunk/Documentation/x86_64/boot-options.txt
@@ -52,10 +52,6 @@ APICs
 		 apicmaintimer. Useful when your PIT timer is totally
 		 broken.
 
-   disable_8254_timer / enable_8254_timer
-		 Enable interrupt 0 timer routing over the 8254 in addition to over
-	         the IO-APIC. The kernel tries to set a sensible default.
-
 Early Console
 
    syntax: earlyprintk=vga
diff --git a/trunk/MAINTAINERS b/trunk/MAINTAINERS
index 4ccc5fa06d09..2bd34ef58ffa 100644
--- a/trunk/MAINTAINERS
+++ b/trunk/MAINTAINERS
@@ -412,32 +412,20 @@ S:      Maintained
 ARM/INTEL IOP32X ARM ARCHITECTURE
 P:	Lennert Buytenhek
 M:	kernel@wantstofly.org
-P:	Dan Williams
-M:	dan.j.williams@intel.com
 L:	linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:	Supported
-
-ARM/INTEL IOP33X ARM ARCHITECTURE
-P:	Dan Williams
-M:	dan.j.williams@intel.com
-L:	linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:	Supported
+S:	Maintained
 
 ARM/INTEL IOP13XX ARM ARCHITECTURE
 P:	Lennert Buytenhek
 M:	kernel@wantstofly.org
-P:	Dan Williams
-M:	dan.j.williams@intel.com
 L:	linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:	Supported
+S:	Maintained
 
 ARM/INTEL IQ81342EX MACHINE SUPPORT
 P:	Lennert Buytenhek
 M:	kernel@wantstofly.org
-P:	Dan Williams
-M:	dan.j.williams@intel.com
 L:	linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:	Supported
+S:	Maintained
 
 ARM/INTEL IXP2000 ARM ARCHITECTURE
 P:	Lennert Buytenhek
@@ -460,10 +448,8 @@ S:	Maintained
 ARM/INTEL XSC3 (MANZANO) ARM CORE
 P:	Lennert Buytenhek
 M:	kernel@wantstofly.org
-P:	Dan Williams
-M:	dan.j.williams@intel.com
 L:	linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:	Supported
+S:	Maintained
 
 ARM/IP FABRICS DOUBLE ESPRESSO MACHINE SUPPORT
 P:	Lennert Buytenhek
diff --git a/trunk/arch/arm/kernel/entry-armv.S b/trunk/arch/arm/kernel/entry-armv.S
index 8517c3c3eb33..2db42b18f53f 100644
--- a/trunk/arch/arm/kernel/entry-armv.S
+++ b/trunk/arch/arm/kernel/entry-armv.S
@@ -436,7 +436,7 @@ __und_usr:
 	usr_entry
 
 	tst	r3, #PSR_T_BIT			@ Thumb mode?
-	bne	__und_usr_unknown		@ ignore FP
+	bne	fpundefinstr			@ ignore FP
 	sub	r4, r2, #4
 
 	@
@@ -448,7 +448,7 @@ __und_usr:
 	@
 1:	ldrt	r0, [r4]
 	adr	r9, ret_from_exception
-	adr	lr, __und_usr_unknown
+	adr	lr, fpundefinstr
 	@
 	@ fallthrough to call_fpe
 	@
@@ -476,9 +476,7 @@ __und_usr:
  * Emulators may wish to make use of the following registers:
  *  r0  = instruction opcode.
  *  r2  = PC+4
- *  r9  = normal "successful" return address
  *  r10 = this threads thread_info structure.
- *  lr  = unrecognised instruction return address
  */
 call_fpe:
 	tst	r0, #0x08000000			@ only CDP/CPRT/LDC/STC have bit 27
@@ -547,12 +545,10 @@ do_fpe:
 
 	.data
 ENTRY(fp_enter)
-	.word	no_fp
+	.word	fpundefinstr
 	.text
 
-no_fp:	mov	pc, lr
-
-__und_usr_unknown:
+fpundefinstr:
 	mov	r0, sp
 	adr	lr, ret_from_exception
 	b	do_undefinstr
diff --git a/trunk/arch/arm/kernel/time.c b/trunk/arch/arm/kernel/time.c
index 3c8cdcfe8d4a..6ff5e3ff6cb5 100644
--- a/trunk/arch/arm/kernel/time.c
+++ b/trunk/arch/arm/kernel/time.c
@@ -29,8 +29,6 @@
 #include <linux/timer.h>
 #include <linux/irq.h>
 
-#include <linux/mc146818rtc.h>
-
 #include <asm/leds.h>
 #include <asm/thread_info.h>
 #include <asm/mach/time.h>
@@ -87,17 +85,6 @@ unsigned long long __attribute__((weak)) sched_clock(void)
 	return (unsigned long long)jiffies * (1000000000 / HZ);
 }
 
-/*
- * An implementation of printk_clock() independent from
- * sched_clock().  This avoids non-bootable kernels when
- * printk_clock is enabled.
- */
-unsigned long long printk_clock(void)
-{
-	return (unsigned long long)(jiffies - INITIAL_JIFFIES) *
-			(1000000000 / HZ);
-}
-
 static unsigned long next_rtc_update;
 
 /*
diff --git a/trunk/arch/arm/kernel/traps.c b/trunk/arch/arm/kernel/traps.c
index 908915675edc..042a12982e98 100644
--- a/trunk/arch/arm/kernel/traps.c
+++ b/trunk/arch/arm/kernel/traps.c
@@ -27,7 +27,6 @@
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 #include <asm/traps.h>
-#include <asm/io.h>
 
 #include "ptrace.h"
 #include "signal.h"
diff --git a/trunk/arch/arm/mm/flush.c b/trunk/arch/arm/mm/flush.c
index 9df507d36e0b..628348c9f6c5 100644
--- a/trunk/arch/arm/mm/flush.c
+++ b/trunk/arch/arm/mm/flush.c
@@ -202,42 +202,3 @@ void flush_dcache_page(struct page *page)
 	}
 }
 EXPORT_SYMBOL(flush_dcache_page);
-
-/*
- * Flush an anonymous page so that users of get_user_pages()
- * can safely access the data.  The expected sequence is:
- *
- *  get_user_pages()
- *    -> flush_anon_page
- *  memcpy() to/from page
- *  if written to page, flush_dcache_page()
- */
-void __flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
-{
-	unsigned long pfn;
-
-	/* VIPT non-aliasing caches need do nothing */
-	if (cache_is_vipt_nonaliasing())
-		return;
-
-	/*
-	 * Write back and invalidate userspace mapping.
-	 */
-	pfn = page_to_pfn(page);
-	if (cache_is_vivt()) {
-		flush_cache_page(vma, vmaddr, pfn);
-	} else {
-		/*
-		 * For aliasing VIPT, we can flush an alias of the
-		 * userspace address only.
-		 */
-		flush_pfn_alias(pfn, vmaddr);
-	}
-
-	/*
-	 * Invalidate kernel mapping.  No data should be contained
-	 * in this mapping of the page.  FIXME: this is overkill
-	 * since we actually ask for a write-back and invalidate.
-	 */
-	__cpuc_flush_dcache_page(page_address(page));
-}
diff --git a/trunk/arch/mips/kernel/mips_ksyms.c b/trunk/arch/mips/kernel/mips_ksyms.c
index 2ef857c3ee53..f44a01357ada 100644
--- a/trunk/arch/mips/kernel/mips_ksyms.c
+++ b/trunk/arch/mips/kernel/mips_ksyms.c
@@ -46,7 +46,5 @@ EXPORT_SYMBOL(__strnlen_user_nocheck_asm);
 EXPORT_SYMBOL(__strnlen_user_asm);
 
 EXPORT_SYMBOL(csum_partial);
-EXPORT_SYMBOL(csum_partial_copy_nocheck);
-EXPORT_SYMBOL(__csum_partial_copy_user);
 
 EXPORT_SYMBOL(invalid_pte_table);
diff --git a/trunk/arch/mips/kernel/time.c b/trunk/arch/mips/kernel/time.c
index 8aa544f73a5e..11aab6d6bfe5 100644
--- a/trunk/arch/mips/kernel/time.c
+++ b/trunk/arch/mips/kernel/time.c
@@ -94,8 +94,10 @@ static void c0_timer_ack(void)
 {
 	unsigned int count;
 
+#ifndef CONFIG_SOC_PNX8550	/* pnx8550 resets to zero */
 	/* Ack this timer interrupt and set the next one.  */
 	expirelo += cycles_per_jiffy;
+#endif
 	write_c0_compare(expirelo);
 
 	/* Check to see if we have missed any timer interrupts.  */
diff --git a/trunk/arch/mips/lib/Makefile b/trunk/arch/mips/lib/Makefile
index 989c900b8b14..888b61ea12fe 100644
--- a/trunk/arch/mips/lib/Makefile
+++ b/trunk/arch/mips/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for MIPS-specific library files..
 #
 
-lib-y	+= csum_partial.o memcpy.o promlib.o \
+lib-y	+= csum_partial.o csum_partial_copy.o memcpy.o promlib.o \
 	   strlen_user.o strncpy_user.o strnlen_user.o uncached.o
 
 obj-y	+= iomap.o
diff --git a/trunk/arch/mips/lib/csum_partial.S b/trunk/arch/mips/lib/csum_partial.S
index c0a77fe038be..9db357294be1 100644
--- a/trunk/arch/mips/lib/csum_partial.S
+++ b/trunk/arch/mips/lib/csum_partial.S
@@ -8,9 +8,7 @@
  * Copyright (C) 1998, 1999 Ralf Baechle
  * Copyright (C) 1999 Silicon Graphics, Inc.
  */
-#include <linux/errno.h>
 #include <asm/asm.h>
-#include <asm/asm-offsets.h>
 #include <asm/regdef.h>
 
 #ifdef CONFIG_64BIT
@@ -273,443 +271,3 @@ small_csumcpy:
 	jr	ra
 	.set	noreorder
 	END(csum_partial)
-
-
-/*
- * checksum and copy routines based on memcpy.S
- *
- *	csum_partial_copy_nocheck(src, dst, len, sum)
- *	__csum_partial_copy_user(src, dst, len, sum, errp)
- *
- * See "Spec" in memcpy.S for details.  Unlike __copy_user, all
- * function in this file use the standard calling convention.
- */
-
-#define src a0
-#define dst a1
-#define len a2
-#define psum a3
-#define sum v0
-#define odd t8
-#define errptr t9
-
-/*
- * The exception handler for loads requires that:
- *  1- AT contain the address of the byte just past the end of the source
- *     of the copy,
- *  2- src_entry <= src < AT, and
- *  3- (dst - src) == (dst_entry - src_entry),
- * The _entry suffix denotes values when __copy_user was called.
- *
- * (1) is set up up by __csum_partial_copy_from_user and maintained by
- *	not writing AT in __csum_partial_copy
- * (2) is met by incrementing src by the number of bytes copied
- * (3) is met by not doing loads between a pair of increments of dst and src
- *
- * The exception handlers for stores stores -EFAULT to errptr and return.
- * These handlers do not need to overwrite any data.
- */
-
-#define EXC(inst_reg,addr,handler)		\
-9:	inst_reg, addr;				\
-	.section __ex_table,"a";		\
-	PTR	9b, handler;			\
-	.previous
-
-#ifdef USE_DOUBLE
-
-#define LOAD   ld
-#define LOADL  ldl
-#define LOADR  ldr
-#define STOREL sdl
-#define STORER sdr
-#define STORE  sd
-#define ADD    daddu
-#define SUB    dsubu
-#define SRL    dsrl
-#define SLL    dsll
-#define SLLV   dsllv
-#define SRLV   dsrlv
-#define NBYTES 8
-#define LOG_NBYTES 3
-
-#else
-
-#define LOAD   lw
-#define LOADL  lwl
-#define LOADR  lwr
-#define STOREL swl
-#define STORER swr
-#define STORE  sw
-#define ADD    addu
-#define SUB    subu
-#define SRL    srl
-#define SLL    sll
-#define SLLV   sllv
-#define SRLV   srlv
-#define NBYTES 4
-#define LOG_NBYTES 2
-
-#endif /* USE_DOUBLE */
-
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-#define LDFIRST LOADR
-#define LDREST  LOADL
-#define STFIRST STORER
-#define STREST  STOREL
-#define SHIFT_DISCARD SLLV
-#define SHIFT_DISCARD_REVERT SRLV
-#else
-#define LDFIRST LOADL
-#define LDREST  LOADR
-#define STFIRST STOREL
-#define STREST  STORER
-#define SHIFT_DISCARD SRLV
-#define SHIFT_DISCARD_REVERT SLLV
-#endif
-
-#define FIRST(unit) ((unit)*NBYTES)
-#define REST(unit)  (FIRST(unit)+NBYTES-1)
-
-#define ADDRMASK (NBYTES-1)
-
-	.set	noat
-
-LEAF(__csum_partial_copy_user)
-	PTR_ADDU	AT, src, len	/* See (1) above. */
-#ifdef CONFIG_64BIT
-	move	errptr, a4
-#else
-	lw	errptr, 16(sp)
-#endif
-FEXPORT(csum_partial_copy_nocheck)
-	move	sum, zero
-	move	odd, zero
-	/*
-	 * Note: dst & src may be unaligned, len may be 0
-	 * Temps
-	 */
-	/*
-	 * The "issue break"s below are very approximate.
-	 * Issue delays for dcache fills will perturb the schedule, as will
-	 * load queue full replay traps, etc.
-	 *
-	 * If len < NBYTES use byte operations.
-	 */
-	sltu	t2, len, NBYTES
-	and	t1, dst, ADDRMASK
-	bnez	t2, copy_bytes_checklen
-	 and	t0, src, ADDRMASK
-	andi	odd, dst, 0x1			/* odd buffer? */
-	bnez	t1, dst_unaligned
-	 nop
-	bnez	t0, src_unaligned_dst_aligned
-	/*
-	 * use delay slot for fall-through
-	 * src and dst are aligned; need to compute rem
-	 */
-both_aligned:
-	 SRL	t0, len, LOG_NBYTES+3    # +3 for 8 units/iter
-	beqz	t0, cleanup_both_aligned # len < 8*NBYTES
-	 nop
-	SUB	len, 8*NBYTES		# subtract here for bgez loop
-	.align	4
-1:
-EXC(	LOAD	t0, UNIT(0)(src),	l_exc)
-EXC(	LOAD	t1, UNIT(1)(src),	l_exc_copy)
-EXC(	LOAD	t2, UNIT(2)(src),	l_exc_copy)
-EXC(	LOAD	t3, UNIT(3)(src),	l_exc_copy)
-EXC(	LOAD	t4, UNIT(4)(src),	l_exc_copy)
-EXC(	LOAD	t5, UNIT(5)(src),	l_exc_copy)
-EXC(	LOAD	t6, UNIT(6)(src),	l_exc_copy)
-EXC(	LOAD	t7, UNIT(7)(src),	l_exc_copy)
-	SUB	len, len, 8*NBYTES
-	ADD	src, src, 8*NBYTES
-EXC(	STORE	t0, UNIT(0)(dst),	s_exc)
-	ADDC(sum, t0)
-EXC(	STORE	t1, UNIT(1)(dst),	s_exc)
-	ADDC(sum, t1)
-EXC(	STORE	t2, UNIT(2)(dst),	s_exc)
-	ADDC(sum, t2)
-EXC(	STORE	t3, UNIT(3)(dst),	s_exc)
-	ADDC(sum, t3)
-EXC(	STORE	t4, UNIT(4)(dst),	s_exc)
-	ADDC(sum, t4)
-EXC(	STORE	t5, UNIT(5)(dst),	s_exc)
-	ADDC(sum, t5)
-EXC(	STORE	t6, UNIT(6)(dst),	s_exc)
-	ADDC(sum, t6)
-EXC(	STORE	t7, UNIT(7)(dst),	s_exc)
-	ADDC(sum, t7)
-	bgez	len, 1b
-	 ADD	dst, dst, 8*NBYTES
-	ADD	len, 8*NBYTES		# revert len (see above)
-
-	/*
-	 * len == the number of bytes left to copy < 8*NBYTES
-	 */
-cleanup_both_aligned:
-#define rem t7
-	beqz	len, done
-	 sltu	t0, len, 4*NBYTES
-	bnez	t0, less_than_4units
-	 and	rem, len, (NBYTES-1)	# rem = len % NBYTES
-	/*
-	 * len >= 4*NBYTES
-	 */
-EXC(	LOAD	t0, UNIT(0)(src),	l_exc)
-EXC(	LOAD	t1, UNIT(1)(src),	l_exc_copy)
-EXC(	LOAD	t2, UNIT(2)(src),	l_exc_copy)
-EXC(	LOAD	t3, UNIT(3)(src),	l_exc_copy)
-	SUB	len, len, 4*NBYTES
-	ADD	src, src, 4*NBYTES
-EXC(	STORE	t0, UNIT(0)(dst),	s_exc)
-	ADDC(sum, t0)
-EXC(	STORE	t1, UNIT(1)(dst),	s_exc)
-	ADDC(sum, t1)
-EXC(	STORE	t2, UNIT(2)(dst),	s_exc)
-	ADDC(sum, t2)
-EXC(	STORE	t3, UNIT(3)(dst),	s_exc)
-	ADDC(sum, t3)
-	beqz	len, done
-	 ADD	dst, dst, 4*NBYTES
-less_than_4units:
-	/*
-	 * rem = len % NBYTES
-	 */
-	beq	rem, len, copy_bytes
-	 nop
-1:
-EXC(	LOAD	t0, 0(src),		l_exc)
-	ADD	src, src, NBYTES
-	SUB	len, len, NBYTES
-EXC(	STORE	t0, 0(dst),		s_exc)
-	ADDC(sum, t0)
-	bne	rem, len, 1b
-	 ADD	dst, dst, NBYTES
-
-	/*
-	 * src and dst are aligned, need to copy rem bytes (rem < NBYTES)
-	 * A loop would do only a byte at a time with possible branch
-	 * mispredicts.  Can't do an explicit LOAD dst,mask,or,STORE
-	 * because can't assume read-access to dst.  Instead, use
-	 * STREST dst, which doesn't require read access to dst.
-	 *
-	 * This code should perform better than a simple loop on modern,
-	 * wide-issue mips processors because the code has fewer branches and
-	 * more instruction-level parallelism.
-	 */
-#define bits t2
-	beqz	len, done
-	 ADD	t1, dst, len	# t1 is just past last byte of dst
-	li	bits, 8*NBYTES
-	SLL	rem, len, 3	# rem = number of bits to keep
-EXC(	LOAD	t0, 0(src),		l_exc)
-	SUB	bits, bits, rem	# bits = number of bits to discard
-	SHIFT_DISCARD t0, t0, bits
-EXC(	STREST	t0, -1(t1),		s_exc)
-	SHIFT_DISCARD_REVERT t0, t0, bits
-	.set reorder
-	ADDC(sum, t0)
-	b	done
-	.set noreorder
-dst_unaligned:
-	/*
-	 * dst is unaligned
-	 * t0 = src & ADDRMASK
-	 * t1 = dst & ADDRMASK; T1 > 0
-	 * len >= NBYTES
-	 *
-	 * Copy enough bytes to align dst
-	 * Set match = (src and dst have same alignment)
-	 */
-#define match rem
-EXC(	LDFIRST	t3, FIRST(0)(src),	l_exc)
-	ADD	t2, zero, NBYTES
-EXC(	LDREST	t3, REST(0)(src),	l_exc_copy)
-	SUB	t2, t2, t1	# t2 = number of bytes copied
-	xor	match, t0, t1
-EXC(	STFIRST t3, FIRST(0)(dst),	s_exc)
-	SLL	t4, t1, 3		# t4 = number of bits to discard
-	SHIFT_DISCARD t3, t3, t4
-	/* no SHIFT_DISCARD_REVERT to handle odd buffer properly */
-	ADDC(sum, t3)
-	beq	len, t2, done
-	 SUB	len, len, t2
-	ADD	dst, dst, t2
-	beqz	match, both_aligned
-	 ADD	src, src, t2
-
-src_unaligned_dst_aligned:
-	SRL	t0, len, LOG_NBYTES+2    # +2 for 4 units/iter
-	beqz	t0, cleanup_src_unaligned
-	 and	rem, len, (4*NBYTES-1)   # rem = len % 4*NBYTES
-1:
-/*
- * Avoid consecutive LD*'s to the same register since some mips
- * implementations can't issue them in the same cycle.
- * It's OK to load FIRST(N+1) before REST(N) because the two addresses
- * are to the same unit (unless src is aligned, but it's not).
- */
-EXC(	LDFIRST	t0, FIRST(0)(src),	l_exc)
-EXC(	LDFIRST	t1, FIRST(1)(src),	l_exc_copy)
-	SUB     len, len, 4*NBYTES
-EXC(	LDREST	t0, REST(0)(src),	l_exc_copy)
-EXC(	LDREST	t1, REST(1)(src),	l_exc_copy)
-EXC(	LDFIRST	t2, FIRST(2)(src),	l_exc_copy)
-EXC(	LDFIRST	t3, FIRST(3)(src),	l_exc_copy)
-EXC(	LDREST	t2, REST(2)(src),	l_exc_copy)
-EXC(	LDREST	t3, REST(3)(src),	l_exc_copy)
-	ADD	src, src, 4*NBYTES
-#ifdef CONFIG_CPU_SB1
-	nop				# improves slotting
-#endif
-EXC(	STORE	t0, UNIT(0)(dst),	s_exc)
-	ADDC(sum, t0)
-EXC(	STORE	t1, UNIT(1)(dst),	s_exc)
-	ADDC(sum, t1)
-EXC(	STORE	t2, UNIT(2)(dst),	s_exc)
-	ADDC(sum, t2)
-EXC(	STORE	t3, UNIT(3)(dst),	s_exc)
-	ADDC(sum, t3)
-	bne	len, rem, 1b
-	 ADD	dst, dst, 4*NBYTES
-
-cleanup_src_unaligned:
-	beqz	len, done
-	 and	rem, len, NBYTES-1  # rem = len % NBYTES
-	beq	rem, len, copy_bytes
-	 nop
-1:
-EXC(	LDFIRST t0, FIRST(0)(src),	l_exc)
-EXC(	LDREST	t0, REST(0)(src),	l_exc_copy)
-	ADD	src, src, NBYTES
-	SUB	len, len, NBYTES
-EXC(	STORE	t0, 0(dst),		s_exc)
-	ADDC(sum, t0)
-	bne	len, rem, 1b
-	 ADD	dst, dst, NBYTES
-
-copy_bytes_checklen:
-	beqz	len, done
-	 nop
-copy_bytes:
-	/* 0 < len < NBYTES  */
-#ifdef CONFIG_CPU_LITTLE_ENDIAN
-#define SHIFT_START 0
-#define SHIFT_INC 8
-#else
-#define SHIFT_START 8*(NBYTES-1)
-#define SHIFT_INC -8
-#endif
-	move	t2, zero	# partial word
-	li	t3, SHIFT_START	# shift
-/* use l_exc_copy here to return correct sum on fault */
-#define COPY_BYTE(N)			\
-EXC(	lbu	t0, N(src), l_exc_copy);	\
-	SUB	len, len, 1;		\
-EXC(	sb	t0, N(dst), s_exc);	\
-	SLLV	t0, t0, t3;		\
-	addu	t3, SHIFT_INC;		\
-	beqz	len, copy_bytes_done;	\
-	 or	t2, t0
-
-	COPY_BYTE(0)
-	COPY_BYTE(1)
-#ifdef USE_DOUBLE
-	COPY_BYTE(2)
-	COPY_BYTE(3)
-	COPY_BYTE(4)
-	COPY_BYTE(5)
-#endif
-EXC(	lbu	t0, NBYTES-2(src), l_exc_copy)
-	SUB	len, len, 1
-EXC(	sb	t0, NBYTES-2(dst), s_exc)
-	SLLV	t0, t0, t3
-	or	t2, t0
-copy_bytes_done:
-	ADDC(sum, t2)
-done:
-	/* fold checksum */
-#ifdef USE_DOUBLE
-	dsll32	v1, sum, 0
-	daddu	sum, v1
-	sltu	v1, sum, v1
-	dsra32	sum, sum, 0
-	addu	sum, v1
-#endif
-	sll	v1, sum, 16
-	addu	sum, v1
-	sltu	v1, sum, v1
-	srl	sum, sum, 16
-	addu	sum, v1
-
-	/* odd buffer alignment? */
-	beqz	odd, 1f
-	 nop
-	sll	v1, sum, 8
-	srl	sum, sum, 8
-	or	sum, v1
-	andi	sum, 0xffff
-1:
-	.set reorder
-	ADDC(sum, psum)
-	jr	ra
-	.set noreorder
-
-l_exc_copy:
-	/*
-	 * Copy bytes from src until faulting load address (or until a
-	 * lb faults)
-	 *
-	 * When reached by a faulting LDFIRST/LDREST, THREAD_BUADDR($28)
-	 * may be more than a byte beyond the last address.
-	 * Hence, the lb below may get an exception.
-	 *
-	 * Assumes src < THREAD_BUADDR($28)
-	 */
-	LOAD	t0, TI_TASK($28)
-	 li	t2, SHIFT_START
-	LOAD	t0, THREAD_BUADDR(t0)
-1:
-EXC(	lbu	t1, 0(src),	l_exc)
-	ADD	src, src, 1
-	sb	t1, 0(dst)	# can't fault -- we're copy_from_user
-	SLLV	t1, t1, t2
-	addu	t2, SHIFT_INC
-	ADDC(sum, t1)
-	bne	src, t0, 1b
-	 ADD	dst, dst, 1
-l_exc:
-	LOAD	t0, TI_TASK($28)
-	 nop
-	LOAD	t0, THREAD_BUADDR(t0)	# t0 is just past last good address
-	 nop
-	SUB	len, AT, t0		# len number of uncopied bytes
-	/*
-	 * Here's where we rely on src and dst being incremented in tandem,
-	 *   See (3) above.
-	 * dst += (fault addr - src) to put dst at first byte to clear
-	 */
-	ADD	dst, t0			# compute start address in a1
-	SUB	dst, src
-	/*
-	 * Clear len bytes starting at dst.  Can't call __bzero because it
-	 * might modify len.  An inefficient loop for these rare times...
-	 */
-	beqz	len, done
-	 SUB	src, len, 1
-1:	sb	zero, 0(dst)
-	ADD	dst, dst, 1
-	bnez	src, 1b
-	 SUB	src, src, 1
-	li	v1, -EFAULT
-	b	done
-	 sw	v1, (errptr)
-
-s_exc:
-	li	v0, -1 /* invalid checksum */
-	li	v1, -EFAULT
-	jr	ra
-	 sw	v1, (errptr)
-	END(__csum_partial_copy_user)
diff --git a/trunk/arch/mips/lib/csum_partial_copy.c b/trunk/arch/mips/lib/csum_partial_copy.c
new file mode 100644
index 000000000000..06771040a267
--- /dev/null
+++ b/trunk/arch/mips/lib/csum_partial_copy.c
@@ -0,0 +1,52 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 1994, 1995 Waldorf Electronics GmbH
+ * Copyright (C) 1998, 1999 Ralf Baechle
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <asm/byteorder.h>
+#include <asm/string.h>
+#include <asm/uaccess.h>
+#include <net/checksum.h>
+
+/*
+ * copy while checksumming, otherwise like csum_partial
+ */
+__wsum csum_partial_copy_nocheck(const void *src,
+	void *dst, int len, __wsum sum)
+{
+	/*
+	 * It's 2:30 am and I don't feel like doing it real ...
+	 * This is lots slower than the real thing (tm)
+	 */
+	sum = csum_partial(src, len, sum);
+	memcpy(dst, src, len);
+
+	return sum;
+}
+
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
+
+/*
+ * Copy from userspace and compute checksum.  If we catch an exception
+ * then zero the rest of the buffer.
+ */
+__wsum csum_partial_copy_from_user (const void __user *src,
+	void *dst, int len, __wsum sum, int *err_ptr)
+{
+	int missing;
+
+	might_sleep();
+	missing = copy_from_user(dst, src, len);
+	if (missing) {
+		memset(dst + len - missing, 0, missing);
+		*err_ptr = -EFAULT;
+	}
+
+	return csum_partial(dst, len, sum);
+}
diff --git a/trunk/arch/mips/mips-boards/generic/time.c b/trunk/arch/mips/mips-boards/generic/time.c
index a3c3a1d462b2..e4604c73f02e 100644
--- a/trunk/arch/mips/mips-boards/generic/time.c
+++ b/trunk/arch/mips/mips-boards/generic/time.c
@@ -47,9 +47,6 @@
 #ifdef CONFIG_MIPS_MALTA
 #include <asm/mips-boards/maltaint.h>
 #endif
-#ifdef CONFIG_MIPS_SEAD
-#include <asm/mips-boards/seadint.h>
-#endif
 
 unsigned long cpu_khz;
 
@@ -266,13 +263,11 @@ void __init mips_time_init(void)
 
 void __init plat_timer_setup(struct irqaction *irq)
 {
-#ifdef MSC01E_INT_BASE
 	if (cpu_has_veic) {
 		set_vi_handler (MSC01E_INT_CPUCTR, mips_timer_dispatch);
 		mips_cpu_timer_irq = MSC01E_INT_BASE + MSC01E_INT_CPUCTR;
-	} else
-#endif
-	{
+	}
+	else {
 		if (cpu_has_vint)
 			set_vi_handler (MIPSCPU_INT_CPUCTR, mips_timer_dispatch);
 		mips_cpu_timer_irq = MIPSCPU_INT_BASE + MIPSCPU_INT_CPUCTR;
diff --git a/trunk/arch/mips/mips-boards/malta/malta_mtd.c b/trunk/arch/mips/mips-boards/malta/malta_mtd.c
deleted file mode 100644
index 8ad9bdf25dce..000000000000
--- a/trunk/arch/mips/mips-boards/malta/malta_mtd.c
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2006 MIPS Technologies, Inc.
- *     written by Ralf Baechle <ralf@linux-mips.org>
- */
-
-#include <linux/init.h>
-#include <linux/platform_device.h>
-#include <linux/mtd/partitions.h>
-#include <linux/mtd/physmap.h>
-#include <mtd/mtd-abi.h>
-
-static struct mtd_partition malta_mtd_partitions[] = {
-	{
-		.name =		"YAMON",
-		.offset =	0x0,
-		.size =		0x100000,
-		.mask_flags =	MTD_WRITEABLE
-	}, {
-		.name =		"User FS",
-		.offset = 	0x100000,
-		.size =		0x2e0000
-	}, {
-		.name =		"Board Config",
-		.offset =	0x3e0000,
-		.size =		0x020000,
-		.mask_flags =	MTD_WRITEABLE
-	}
-};
-
-static struct physmap_flash_data malta_flash_data = {
-	.width		= 4,
-	.nr_parts	= ARRAY_SIZE(malta_mtd_partitions),
-	.parts		= malta_mtd_partitions
-};
-
-static struct resource malta_flash_resource = {
-	.start		= 0x1e000000,
-	.end		= 0x1e3fffff,
-	.flags		= IORESOURCE_MEM
-};
-
-static struct platform_device malta_flash = {
-	.name		= "physmap-flash",
-	.id		= 0,
-	.dev		= {
-		.platform_data	= &malta_flash_data,
-	},
-	.num_resources	= 1,
-	.resource	= &malta_flash_resource,
-};
-
-static int __init malta_mtd_init(void)
-{
-	platform_device_register(&malta_flash);
-
-	return 0;
-}
-
-module_init(malta_mtd_init)
diff --git a/trunk/arch/mips/mips-boards/sead/sead_int.c b/trunk/arch/mips/mips-boards/sead/sead_int.c
index 874ccb0066b8..f445fcddfdfd 100644
--- a/trunk/arch/mips/mips-boards/sead/sead_int.c
+++ b/trunk/arch/mips/mips-boards/sead/sead_int.c
@@ -21,7 +21,7 @@
  * Sead board.
  */
 #include <linux/init.h>
-#include <linux/interrupt.h>
+#include <linux/irq.h>
 
 #include <asm/irq_cpu.h>
 #include <asm/mipsregs.h>
@@ -108,7 +108,7 @@ asmlinkage void plat_irq_dispatch(void)
 	if (irq >= 0)
 		do_IRQ(MIPSCPU_INT_BASE + irq);
 	else
-		spurious_interrupt();
+		spurious_interrupt(regs);
 }
 
 void __init arch_init_irq(void)
diff --git a/trunk/arch/mips/mm/pg-r4k.c b/trunk/arch/mips/mm/pg-r4k.c
index dc795be62807..d41fc5885e87 100644
--- a/trunk/arch/mips/mm/pg-r4k.c
+++ b/trunk/arch/mips/mm/pg-r4k.c
@@ -243,10 +243,11 @@ static void __init __build_store_reg(int reg)
 
 static inline void build_store_reg(int reg)
 {
-	int pref_off = cpu_has_prefetch ?
-		(reg ? pref_offset_copy : pref_offset_clear) : 0;
-	if (pref_off)
-		build_dst_pref(pref_off);
+	if (cpu_has_prefetch)
+		if (reg)
+			build_dst_pref(pref_offset_copy);
+		else
+			build_dst_pref(pref_offset_clear);
 	else if (cpu_has_cache_cdex_s)
 		build_cdex_s();
 	else if (cpu_has_cache_cdex_p)
diff --git a/trunk/arch/mips/pci/ops-pnx8550.c b/trunk/arch/mips/pci/ops-pnx8550.c
index f556b7a8dccd..454b65cc3354 100644
--- a/trunk/arch/mips/pci/ops-pnx8550.c
+++ b/trunk/arch/mips/pci/ops-pnx8550.c
@@ -202,7 +202,7 @@ write_config_byte(struct pci_bus *bus, unsigned int devfn, int where, u8 val)
 		break;
 	}
 
-	err = config_access(PCI_CMD_CONFIG_WRITE, bus, devfn, where, ~(1 << (where & 3)), &data);
+	err = config_access(PCI_CMD_CONFIG_READ, bus, devfn, where, ~(1 << (where & 3)), &data);
 
 	return err;
 }
diff --git a/trunk/arch/mips/philips/pnx8550/common/time.c b/trunk/arch/mips/philips/pnx8550/common/time.c
index f80acae07cee..65c440e8480b 100644
--- a/trunk/arch/mips/philips/pnx8550/common/time.c
+++ b/trunk/arch/mips/philips/pnx8550/common/time.c
@@ -33,17 +33,7 @@
 #include <int.h>
 #include <cm.h>
 
-static unsigned long cpj;
-
-static cycle_t hpt_read(void)
-{
-	return read_c0_count2();
-}
-
-static void timer_ack(void)
-{
-	write_c0_compare(cpj);
-}
+extern unsigned int mips_hpt_frequency;
 
 /*
  * pnx8550_time_init() - it does the following things:
@@ -78,47 +68,27 @@ void pnx8550_time_init(void)
 	 * HZ timer interrupts per second.
 	 */
 	mips_hpt_frequency = 27UL * ((1000000UL * n)/(m * pow2p));
-	cpj = (mips_hpt_frequency + HZ / 2) / HZ;
-	timer_ack();
-
-	/* Setup Timer 2 */
-	write_c0_count2(0);
-	write_c0_compare2(0xffffffff);
-
-	clocksource_mips.read = hpt_read;
-	mips_timer_ack = timer_ack;
-}
-
-static irqreturn_t monotonic_interrupt(int irq, void *dev_id)
-{
-	/* Timer 2 clear interrupt */
-	write_c0_compare2(-1);
-	return IRQ_HANDLED;
 }
 
-static struct irqaction monotonic_irqaction = {
-	.handler = monotonic_interrupt,
-	.flags = IRQF_DISABLED,
-	.name = "Monotonic timer",
-};
-
 void __init plat_timer_setup(struct irqaction *irq)
 {
 	int configPR;
 
 	setup_irq(PNX8550_INT_TIMER1, irq);
-	setup_irq(PNX8550_INT_TIMER2, &monotonic_irqaction);
 
-	/* Timer 1 start */
+	/* Start timer1 */
 	configPR = read_c0_config7();
 	configPR &= ~0x00000008;
 	write_c0_config7(configPR);
 
-	/* Timer 2 start */
+	/* Timer 2 stop */
 	configPR = read_c0_config7();
-	configPR &= ~0x00000010;
+	configPR |= 0x00000010;
 	write_c0_config7(configPR);
 
+	write_c0_count2(0);
+	write_c0_compare2(0xffffffff);
+
 	/* Timer 3 stop */
 	configPR = read_c0_config7();
 	configPR |= 0x00000020;
diff --git a/trunk/arch/x86_64/kernel/early-quirks.c b/trunk/arch/x86_64/kernel/early-quirks.c
index 49802f1bee94..829698f6d049 100644
--- a/trunk/arch/x86_64/kernel/early-quirks.c
+++ b/trunk/arch/x86_64/kernel/early-quirks.c
@@ -69,11 +69,6 @@ static void nvidia_bugs(void)
 
 static void ati_bugs(void)
 {
-	if (timer_over_8254 == 1) {
-		timer_over_8254 = 0;
-		printk(KERN_INFO
-	 	"ATI board detected. Disabling timer routing over 8254.\n");
-	}
 }
 
 static void intel_bugs(void)
diff --git a/trunk/arch/x86_64/kernel/io_apic.c b/trunk/arch/x86_64/kernel/io_apic.c
index d7bad90a5ad8..2a1dcd5f69c2 100644
--- a/trunk/arch/x86_64/kernel/io_apic.c
+++ b/trunk/arch/x86_64/kernel/io_apic.c
@@ -55,10 +55,6 @@ int sis_apic_bug; /* not actually supported, dummy for compile */
 
 static int no_timer_check;
 
-static int disable_timer_pin_1 __initdata;
-
-int timer_over_8254 __initdata = 1;
-
 /* Where if anywhere is the i8259 connect in external int mode */
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
@@ -354,29 +350,6 @@ static int __init disable_ioapic_setup(char *str)
 }
 early_param("noapic", disable_ioapic_setup);
 
-/* Actually the next is obsolete, but keep it for paranoid reasons -AK */
-static int __init disable_timer_pin_setup(char *arg)
-{
-	disable_timer_pin_1 = 1;
-	return 1;
-}
-__setup("disable_timer_pin_1", disable_timer_pin_setup);
-
-static int __init setup_disable_8254_timer(char *s)
-{
-	timer_over_8254 = -1;
-	return 1;
-}
-static int __init setup_enable_8254_timer(char *s)
-{
-	timer_over_8254 = 2;
-	return 1;
-}
-
-__setup("disable_8254_timer", setup_disable_8254_timer);
-__setup("enable_8254_timer", setup_enable_8254_timer);
-
-
 /*
  * Find the IRQ entry number of a certain pin.
  */
@@ -1595,10 +1568,33 @@ static inline void unlock_ExtINT_logic(void)
  * a wide range of boards and BIOS bugs.  Fortunately only the timer IRQ
  * is so screwy.  Thanks to Brian Perkins for testing/hacking this beast
  * fanatically on his truly buggy board.
- *
- * FIXME: really need to revamp this for modern platforms only.
  */
-static inline void check_timer(void)
+
+static int try_apic_pin(int apic, int pin, char *msg)
+{
+	apic_printk(APIC_VERBOSE, KERN_INFO
+		    "..TIMER: trying IO-APIC=%d PIN=%d %s",
+		    apic, pin, msg);
+
+	/*
+	 * Ok, does IRQ0 through the IOAPIC work?
+	 */
+	if (!no_timer_check && timer_irq_works()) {
+		nmi_watchdog_default();
+		if (nmi_watchdog == NMI_IO_APIC) {
+			disable_8259A_irq(0);
+			setup_nmi();
+			enable_8259A_irq(0);
+		}
+		return 1;
+	}
+	clear_IO_APIC_pin(apic, pin);
+	apic_printk(APIC_QUIET, KERN_ERR " .. failed\n");
+	return 0;
+}
+
+/* The function from hell */
+static void check_timer(void)
 {
 	int apic1, pin1, apic2, pin2;
 	int vector;
@@ -1619,61 +1615,43 @@ static inline void check_timer(void)
 	 */
 	apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
 	init_8259A(1);
-	if (timer_over_8254 > 0)
-		enable_8259A_irq(0);
 
 	pin1  = find_isa_irq_pin(0, mp_INT);
 	apic1 = find_isa_irq_apic(0, mp_INT);
 	pin2  = ioapic_i8259.pin;
 	apic2 = ioapic_i8259.apic;
 
-	apic_printk(APIC_VERBOSE,KERN_INFO "..TIMER: vector=0x%02X apic1=%d pin1=%d apic2=%d pin2=%d\n",
-		vector, apic1, pin1, apic2, pin2);
+	/* Do this first, otherwise we get double interrupts on ATI boards */
+	if ((pin1 != -1) && try_apic_pin(apic1, pin1,"with 8259 IRQ0 disabled"))
+		return;
 
-	if (pin1 != -1) {
-		/*
-		 * Ok, does IRQ0 through the IOAPIC work?
-		 */
-		unmask_IO_APIC_irq(0);
-		if (!no_timer_check && timer_irq_works()) {
-			nmi_watchdog_default();
-			if (nmi_watchdog == NMI_IO_APIC) {
-				disable_8259A_irq(0);
-				setup_nmi();
-				enable_8259A_irq(0);
-			}
-			if (disable_timer_pin_1 > 0)
-				clear_IO_APIC_pin(0, pin1);
-			return;
-		}
-		clear_IO_APIC_pin(apic1, pin1);
-		apic_printk(APIC_QUIET,KERN_ERR "..MP-BIOS bug: 8254 timer not "
-				"connected to IO-APIC\n");
-	}
+	/* Now try again with IRQ0 8259A enabled.
+	   Assumes timer is on IO-APIC 0 ?!? */
+	enable_8259A_irq(0);
+	unmask_IO_APIC_irq(0);
+	if (try_apic_pin(apic1, pin1, "with 8259 IRQ0 enabled"))
+		return;
+	disable_8259A_irq(0);
 
-	apic_printk(APIC_VERBOSE,KERN_INFO "...trying to set up timer (IRQ0) "
-				"through the 8259A ... ");
+	/* Always try pin0 and pin2 on APIC 0 to handle buggy timer overrides
+	   on Nvidia boards */
+	if (!(apic1 == 0 && pin1 == 0) &&
+	    try_apic_pin(0, 0, "fallback with 8259 IRQ0 disabled"))
+		return;
+	if (!(apic1 == 0 && pin1 == 2) &&
+	    try_apic_pin(0, 2, "fallback with 8259 IRQ0 disabled"))
+		return;
+
+	/* Then try pure 8259A routing on the 8259 as reported by BIOS*/
+	enable_8259A_irq(0);
 	if (pin2 != -1) {
-		apic_printk(APIC_VERBOSE,"\n..... (found apic %d pin %d) ...",
-			apic2, pin2);
-		/*
-		 * legacy devices should be connected to IO APIC #0
-		 */
 		setup_ExtINT_IRQ0_pin(apic2, pin2, vector);
-		if (timer_irq_works()) {
-			apic_printk(APIC_VERBOSE," works.\n");
-			nmi_watchdog_default();
-			if (nmi_watchdog == NMI_IO_APIC) {
-				setup_nmi();
-			}
+		if (try_apic_pin(apic2,pin2,"8259A broadcast ExtINT from BIOS"))
 			return;
-		}
-		/*
-		 * Cleanup, just in case ...
-		 */
-		clear_IO_APIC_pin(apic2, pin2);
 	}
-	apic_printk(APIC_VERBOSE," failed.\n");
+
+	/* Tried all possibilities to go through the IO-APIC. Now come the
+	   really cheesy fallbacks. */
 
 	if (nmi_watchdog == NMI_IO_APIC) {
 		printk(KERN_WARNING "timer doesn't work through the IO-APIC - disabling NMI Watchdog!\n");
diff --git a/trunk/drivers/mmc/mmci.c b/trunk/drivers/mmc/mmci.c
index ccfe6561be24..e9b80e920266 100644
--- a/trunk/drivers/mmc/mmci.c
+++ b/trunk/drivers/mmc/mmci.c
@@ -42,8 +42,6 @@ mmci_request_end(struct mmci_host *host, struct mmc_request *mrq)
 {
 	writel(0, host->base + MMCICOMMAND);
 
-	BUG_ON(host->data);
-
 	host->mrq = NULL;
 	host->cmd = NULL;
 
@@ -200,8 +198,6 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
 	}
 
 	if (!cmd->data || cmd->error != MMC_ERR_NONE) {
-		if (host->data)
-			mmci_stop_data(host);
 		mmci_request_end(host, cmd->mrq);
 	} else if (!(cmd->data->flags & MMC_DATA_READ)) {
 		mmci_start_data(host, cmd->data);
diff --git a/trunk/include/asm-arm/arch-iop32x/iop32x.h b/trunk/include/asm-arm/arch-iop32x/iop32x.h
index 2e9469047eb1..4bbd85f3ed2a 100644
--- a/trunk/include/asm-arm/arch-iop32x/iop32x.h
+++ b/trunk/include/asm-arm/arch-iop32x/iop32x.h
@@ -19,7 +19,7 @@
  * Peripherals that are shared between the iop32x and iop33x but
  * located at different addresses.
  */
-#define IOP3XX_GPIO_REG(reg)	(IOP3XX_PERIPHERAL_VIRT_BASE + 0x07c4 + (reg))
+#define IOP3XX_GPIO_REG(reg)	(IOP3XX_PERIPHERAL_VIRT_BASE + 0x07c0 + (reg))
 #define IOP3XX_TIMER_REG(reg)	(IOP3XX_PERIPHERAL_VIRT_BASE + 0x07e0 + (reg))
 
 #include <asm/hardware/iop3xx.h>
diff --git a/trunk/include/asm-arm/cacheflush.h b/trunk/include/asm-arm/cacheflush.h
index 5f531ea03059..d51049522cd0 100644
--- a/trunk/include/asm-arm/cacheflush.h
+++ b/trunk/include/asm-arm/cacheflush.h
@@ -357,16 +357,6 @@ extern void flush_dcache_page(struct page *);
 
 extern void __flush_dcache_page(struct address_space *mapping, struct page *page);
 
-#define ARCH_HAS_FLUSH_ANON_PAGE
-static inline void flush_anon_page(struct vm_area_struct *vma,
-			 struct page *page, unsigned long vmaddr)
-{
-	extern void __flush_anon_page(struct vm_area_struct *vma,
-				struct page *, unsigned long);
-	if (PageAnon(page))
-		__flush_anon_page(vma, page, vmaddr);
-}
-
 #define flush_dcache_mmap_lock(mapping) \
 	write_lock_irq(&(mapping)->tree_lock)
 #define flush_dcache_mmap_unlock(mapping) \
diff --git a/trunk/include/asm-arm/hardware/iop3xx.h b/trunk/include/asm-arm/hardware/iop3xx.h
index 13ac8a4cd01f..1018a7486ab7 100644
--- a/trunk/include/asm-arm/hardware/iop3xx.h
+++ b/trunk/include/asm-arm/hardware/iop3xx.h
@@ -168,9 +168,9 @@ extern void gpio_line_set(int line, int value);
 #define IOP3XX_PERCR0		(volatile u32 *)IOP3XX_REG_ADDR(0x0710)
 
 /* General Purpose I/O  */
-#define IOP3XX_GPOE		(volatile u32 *)IOP3XX_GPIO_REG(0x0000)
-#define IOP3XX_GPID		(volatile u32 *)IOP3XX_GPIO_REG(0x0004)
-#define IOP3XX_GPOD		(volatile u32 *)IOP3XX_GPIO_REG(0x0008)
+#define IOP3XX_GPOE		(volatile u32 *)IOP3XX_GPIO_REG(0x0004)
+#define IOP3XX_GPID		(volatile u32 *)IOP3XX_GPIO_REG(0x0008)
+#define IOP3XX_GPOD		(volatile u32 *)IOP3XX_GPIO_REG(0x000c)
 
 /* Timers  */
 #define IOP3XX_TU_TMR0		(volatile u32 *)IOP3XX_TIMER_REG(0x0000)
diff --git a/trunk/include/asm-mips/checksum.h b/trunk/include/asm-mips/checksum.h
index 24cdcc6eaab8..9b768c3b96b3 100644
--- a/trunk/include/asm-mips/checksum.h
+++ b/trunk/include/asm-mips/checksum.h
@@ -29,38 +29,31 @@
  */
 __wsum csum_partial(const void *buff, int len, __wsum sum);
 
-__wsum __csum_partial_copy_user(const void *src, void *dst,
-				int len, __wsum sum, int *err_ptr);
-
 /*
  * this is a new version of the above that records errors it finds in *errp,
  * but continues and zeros the rest of the buffer.
  */
-static inline
-__wsum csum_partial_copy_from_user(const void __user *src, void *dst, int len,
-				   __wsum sum, int *err_ptr)
-{
-	might_sleep();
-	return __csum_partial_copy_user((__force void *)src, dst,
-					len, sum, err_ptr);
-}
+__wsum csum_partial_copy_from_user(const void __user *src,
+					 void *dst, int len,
+					 __wsum sum, int *errp);
 
 /*
  * Copy and checksum to user
  */
 #define HAVE_CSUM_COPY_USER
-static inline
-__wsum csum_and_copy_to_user(const void *src, void __user *dst, int len,
-			     __wsum sum, int *err_ptr)
+static inline __wsum csum_and_copy_to_user (const void *src, void __user *dst,
+						  int len, __wsum sum,
+						  int *err_ptr)
 {
 	might_sleep();
-	if (access_ok(VERIFY_WRITE, dst, len))
-		return __csum_partial_copy_user(src, (__force void *)dst,
-						len, sum, err_ptr);
-	if (len)
+	sum = csum_partial(src, len, sum);
+
+	if (copy_to_user(dst, src, len)) {
 		*err_ptr = -EFAULT;
+		return (__force __wsum)-1;
+	}
 
-	return (__force __wsum)-1; /* invalid checksum */
+	return sum;
 }
 
 /*
diff --git a/trunk/include/asm-mips/irq.h b/trunk/include/asm-mips/irq.h
index 386da82e5774..67657089efa7 100644
--- a/trunk/include/asm-mips/irq.h
+++ b/trunk/include/asm-mips/irq.h
@@ -31,14 +31,14 @@ static inline int irq_canonicalize(int irq)
  * functions will take over re-enabling the low-level mask.
  * Otherwise it will be done on return from exception.
  */
-#define __DO_IRQ_SMTC_HOOK(irq)						\
+#define __DO_IRQ_SMTC_HOOK()						\
 do {									\
 	if (irq_hwmask[irq] & 0x0000ff00)				\
 		write_c0_tccontext(read_c0_tccontext() &		\
 		                   ~(irq_hwmask[irq] & 0x0000ff00));	\
 } while (0)
 #else
-#define __DO_IRQ_SMTC_HOOK(irq) do { } while (0)
+#define __DO_IRQ_SMTC_HOOK() do { } while (0)
 #endif
 
 /*
@@ -52,7 +52,7 @@ do {									\
 #define do_IRQ(irq)							\
 do {									\
 	irq_enter();							\
-	__DO_IRQ_SMTC_HOOK(irq);					\
+	__DO_IRQ_SMTC_HOOK();						\
 	generic_handle_irq(irq);					\
 	irq_exit();							\
 } while (0)
diff --git a/trunk/include/asm-parisc/cacheflush.h b/trunk/include/asm-parisc/cacheflush.h
index a799dd8ef395..aedb0512cb04 100644
--- a/trunk/include/asm-parisc/cacheflush.h
+++ b/trunk/include/asm-parisc/cacheflush.h
@@ -186,7 +186,7 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 }
 
 static inline void
-flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
+flush_anon_page(struct page *page, unsigned long vmaddr)
 {
 	if (PageAnon(page))
 		flush_user_dcache_page(vmaddr);
diff --git a/trunk/include/linux/highmem.h b/trunk/include/linux/highmem.h
index 645d440807c2..ca9a602cffd7 100644
--- a/trunk/include/linux/highmem.h
+++ b/trunk/include/linux/highmem.h
@@ -8,7 +8,7 @@
 #include <asm/cacheflush.h>
 
 #ifndef ARCH_HAS_FLUSH_ANON_PAGE
-static inline void flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
+static inline void flush_anon_page(struct page *page, unsigned long vmaddr)
 {
 }
 #endif
diff --git a/trunk/mm/memory.c b/trunk/mm/memory.c
index af227d26e104..563792f4f687 100644
--- a/trunk/mm/memory.c
+++ b/trunk/mm/memory.c
@@ -1091,7 +1091,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 			if (pages) {
 				pages[i] = page;
 
-				flush_anon_page(vma, page, start);
+				flush_anon_page(page, start);
 				flush_dcache_page(page);
 			}
 			if (vmas)
diff --git a/trunk/security/selinux/ss/context.h b/trunk/security/selinux/ss/context.h
index 0562bacb7b99..2eee0dab524d 100644
--- a/trunk/security/selinux/ss/context.h
+++ b/trunk/security/selinux/ss/context.h
@@ -55,6 +55,29 @@ static inline int mls_context_cpy(struct context *dst, struct context *src)
 	return rc;
 }
 
+/*
+ * Sets both levels in the MLS range of 'dst' to the low level of 'src'.
+ */
+static inline int mls_context_cpy_low(struct context *dst, struct context *src)
+{
+	int rc;
+
+	if (!selinux_mls_enabled)
+		return 0;
+
+	dst->range.level[0].sens = src->range.level[0].sens;
+	rc = ebitmap_cpy(&dst->range.level[0].cat, &src->range.level[0].cat);
+	if (rc)
+		goto out;
+
+	dst->range.level[1].sens = src->range.level[0].sens;
+	rc = ebitmap_cpy(&dst->range.level[1].cat, &src->range.level[0].cat);
+	if (rc)
+		ebitmap_destroy(&dst->range.level[0].cat);
+out:
+	return rc;
+}
+
 static inline int mls_context_cmp(struct context *c1, struct context *c2)
 {
 	if (!selinux_mls_enabled)
diff --git a/trunk/security/selinux/ss/mls.c b/trunk/security/selinux/ss/mls.c
index b4f682dc13ff..4a8bab2f3c71 100644
--- a/trunk/security/selinux/ss/mls.c
+++ b/trunk/security/selinux/ss/mls.c
@@ -270,7 +270,7 @@ int mls_context_to_sid(char oldc,
 		if (!defcon)
 			goto out;
 
-		rc = mls_copy_context(context, defcon);
+		rc = mls_context_cpy(context, defcon);
 		goto out;
 	}
 
@@ -400,26 +400,6 @@ int mls_from_string(char *str, struct context *context, gfp_t gfp_mask)
 	return rc;
 }
 
-/*
- * Copies the effective MLS range from `src' into `dst'.
- */
-static inline int mls_scopy_context(struct context *dst,
-                                    struct context *src)
-{
-	int l, rc = 0;
-
-	/* Copy the MLS range from the source context */
-	for (l = 0; l < 2; l++) {
-		dst->range.level[l].sens = src->range.level[0].sens;
-		rc = ebitmap_cpy(&dst->range.level[l].cat,
-				 &src->range.level[0].cat);
-		if (rc)
-			break;
-	}
-
-	return rc;
-}
-
 /*
  * Copies the MLS range `range' into `context'.
  */
@@ -552,19 +532,19 @@ int mls_compute_sid(struct context *scontext,
 	case AVTAB_CHANGE:
 		if (tclass == SECCLASS_PROCESS)
 			/* Use the process MLS attributes. */
-			return mls_copy_context(newcontext, scontext);
+			return mls_context_cpy(newcontext, scontext);
 		else
 			/* Use the process effective MLS attributes. */
-			return mls_scopy_context(newcontext, scontext);
+			return mls_context_cpy_low(newcontext, scontext);
 	case AVTAB_MEMBER:
 		/* Only polyinstantiate the MLS attributes if
 		   the type is being polyinstantiated */
 		if (newcontext->type != tcontext->type) {
 			/* Use the process effective MLS attributes. */
-			return mls_scopy_context(newcontext, scontext);
+			return mls_context_cpy_low(newcontext, scontext);
 		} else {
 			/* Use the related object MLS attributes. */
-			return mls_copy_context(newcontext, tcontext);
+			return mls_context_cpy(newcontext, tcontext);
 		}
 	default:
 		return -EINVAL;
diff --git a/trunk/security/selinux/ss/mls.h b/trunk/security/selinux/ss/mls.h
index 661d6fc76966..096d1b4ef7fb 100644
--- a/trunk/security/selinux/ss/mls.h
+++ b/trunk/security/selinux/ss/mls.h
@@ -24,26 +24,6 @@
 #include "context.h"
 #include "policydb.h"
 
-/*
- * Copies the MLS range from `src' into `dst'.
- */
-static inline int mls_copy_context(struct context *dst,
-				   struct context *src)
-{
-	int l, rc = 0;
-
-	/* Copy the MLS range from the source context */
-	for (l = 0; l < 2; l++) {
-		dst->range.level[l].sens = src->range.level[l].sens;
-		rc = ebitmap_cpy(&dst->range.level[l].cat,
-				 &src->range.level[l].cat);
-		if (rc)
-			break;
-	}
-
-	return rc;
-}
-
 int mls_compute_context_len(struct context *context);
 void mls_sid_to_context(struct context *context, char **scontext);
 int mls_context_isvalid(struct policydb *p, struct context *c);
diff --git a/trunk/security/selinux/ss/services.c b/trunk/security/selinux/ss/services.c
index ee0581557966..372eaade3ca6 100644
--- a/trunk/security/selinux/ss/services.c
+++ b/trunk/security/selinux/ss/services.c
@@ -1916,11 +1916,10 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
 	newcon.user = context1->user;
 	newcon.role = context1->role;
 	newcon.type = context1->type;
-	rc = mls_copy_context(&newcon, context2);
+	rc = mls_context_cpy(&newcon, context2);
 	if (rc)
 		goto out_unlock;
 
-
 	/* Check the validity of the new context. */
 	if (!policydb_context_isvalid(&policydb, &newcon)) {
 		rc = convert_context_handle_invalid_context(&newcon);